dependabot[bot] opened a new pull request, #43210: URL: https://github.com/apache/superset/pull/43210
Bumps [fastmcp](https://github.com/PrefectHQ/fastmcp) from 3.4.5 to 3.4.6. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/PrefectHQ/fastmcp/releases";>fastmcp's releases</a>.</em></p> <blockquote> <h2>v3.4.6: Trust, but Proxy</h2> <p>FastMCP 3.4.6 backports trusted-proxy support for SSRF-protected OAuth metadata and JWKS fetches. Deployments can now route these requests through a mandated corporate proxy while preserving custom CA certificates; FastMCP refuses the fetch when no proxy is configured instead of risking an unprotected direct request.</p> <!-- raw HTML omitted --> <h2>What's Changed</h2> <h3>Fixes đ</h3> <ul> <li>Backport <a href="https://redirect.github.com/PrefectHQ/fastmcp/issues/4412";>#4412</a> to 3.x: support trusted SSRF proxies by <a href="https://github.com/jlowin";><code>@âjlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4755";>PrefectHQ/fastmcp#4755</a></li> </ul> <h3>Docs đ</h3> <ul> <li>Docs: add v3.4.6 changelog entries by <a href="https://github.com/jlowin";><code>@âjlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4761";>PrefectHQ/fastmcp#4761</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/PrefectHQ/fastmcp/compare/v3.4.5...v3.4.6";>https://github.com/PrefectHQ/fastmcp/compare/v3.4.5...v3.4.6</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/PrefectHQ/fastmcp/blob/main/docs/changelog.mdx";>fastmcp's changelog</a>.</em></p> <blockquote> <hr /> <h2>title: "Changelog" icon: "list-check" rss: true tag: NEW</h2> <!-- raw HTML omitted --> <p><strong><a href="https://github.com/PrefectHQ/fastmcp/releases/tag/v4.0.0b3";>v4.0.0b3: Fast Fourward</a></strong></p> <p>FastMCP 4 beta 3 moves the v4 line toward general availability with Prefect Horizon authentication, <code>CallArgument</code> and <code>Depends</code> bindings for tools and background tasks, and a round of OAuth, proxy, OpenAPI, and Python 3.14 compatibility hardening.</p> <h3>Enhancements â¨</h3> <ul> <li>Add Prefect Horizon authentication client and local state by <a href="https://github.com/parkedwards";><code>@âparkedwards</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4785";>#4785</a></li> <li>Clarify auto-closed PR message by <a href="https://github.com/jlowin";><code>@âjlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4820";>#4820</a></li> <li>Support CallArgument and Depends bindings from uncalled-for 0.4.0 by <a href="https://github.com/chrisguidry";><code>@âchrisguidry</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4802";>#4802</a></li> <li>Fix static analysis under newer ty releases by <a href="https://github.com/zzstoatzz";><code>@âzzstoatzz</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4831";>#4831</a></li> <li>Cover CallArgument resolution in background tasks by <a href="https://github.com/zzstoatzz";><code>@âzzstoatzz</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4833";>#4833</a></li> <li>Scalekit issuer updates backward compatibility by <a href="https://github.com/AkshayParihar33";><code>@âAkshayParihar33</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4798";>#4798</a></li> </ul> <h3>Security đ</h3> <ul> <li>Add audience pinning to GoogleTokenVerifier by <a href="https://github.com/zzstoatzz";><code>@âzzstoatzz</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4827";>#4827</a></li> <li>Bump cryptography to 50.0.0 by <a href="https://github.com/zzstoatzz";><code>@âzzstoatzz</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4836";>#4836</a></li> </ul> <h3>Fixes đ</h3> <ul> <li>Fix partial parameter hints on Python 3.14 by <a href="https://github.com/zzstoatzz";><code>@âzzstoatzz</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4796";>#4796</a></li> <li>fix(openapi): extract parameter-level example and examples by <a href="https://github.com/doneman536";><code>@âdoneman536</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4793";>#4793</a></li> <li>Keep earlier consent CSRF tokens valid within a transaction by <a href="https://github.com/trevhud";><code>@âtrevhud</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4818";>#4818</a></li> <li>Fix StatefulProxyClient reconnection after session failure by <a href="https://github.com/jlowin";><code>@âjlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4829";>#4829</a></li> </ul> <h3>Docs đ</h3> <ul> <li>Docs language dropdown by <a href="https://github.com/znicholasbrown";><code>@âznicholasbrown</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4801";>#4801</a></li> <li>Docs: mirror v3.4.7 release notes by <a href="https://github.com/jlowin";><code>@âjlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4811";>#4811</a></li> <li>docs: prepare FastMCP 4 beta 3 by <a href="https://github.com/jlowin";><code>@âjlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4840";>#4840</a></li> <li>docs: add FastMCP 4 beta 3 release entries by <a href="https://github.com/jlowin";><code>@âjlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4841";>#4841</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/parkedwards";><code>@âparkedwards</code></a> made their first contribution in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4785";>#4785</a></li> <li><a href="https://github.com/trevhud";><code>@âtrevhud</code></a> made their first contribution in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/4818";>#4818</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/PrefectHQ/fastmcp/compare/v4.0.0b2...v4.0.0b3";>v4.0.0b2...v4.0.0b3</a></p> <!-- raw HTML omitted --> <!-- raw HTML omitted --> <p><strong><a href="https://github.com/PrefectHQ/fastmcp/releases/tag/v3.4.7";>v3.4.7: Know Your Audience</a></strong></p> <p>FastMCP 3.4.7 fixes CIMD <code>private_key_jwt</code> authentication on bare-origin OAuth proxy deployments by validating client assertions against the exact token endpoint advertised in OAuth metadata.</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/PrefectHQ/fastmcp/commit/c587bdd854c85052e908a7c8ef8088d108c87174";><code>c587bdd</code></a> Docs: add v3.4.6 changelog entries (<a href="https://redirect.github.com/PrefectHQ/fastmcp/issues/4761";>#4761</a>)</li> <li><a href="https://github.com/PrefectHQ/fastmcp/commit/fcdf422e54fe84d384b37a10115d3e7b4aeb0f3f";><code>fcdf422</code></a> Backport <a href="https://redirect.github.com/PrefectHQ/fastmcp/issues/4412";>#4412</a> to 3.x: support trusted SSRF proxies (<a href="https://redirect.github.com/PrefectHQ/fastmcp/issues/4755";>#4755</a>)</li> <li>See full diff in <a href="https://github.com/PrefectHQ/fastmcp/compare/v3.4.5...v3.4.6";>compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
