dependabot[bot] opened a new pull request, #10101: URL: https://github.com/apache/gravitino/pull/10101
Bumps [fastmcp](https://github.com/PrefectHQ/fastmcp) from 2.14.5 to 3.0.2. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/PrefectHQ/fastmcp/releases";>fastmcp's releases</a>.</em></p> <blockquote> <h2>v3.0.2: Threecovery Mode II</h2> <p>Two community-contributed fixes: auth headers from MCP transport no longer leak through to downstream OpenAPI APIs, and background task workers now correctly receive the originating request ID. Plus a new docs example for context-aware tool factories.</p> <!-- raw HTML omitted --> <h2>What's Changed</h2> <h3>Fixes đ</h3> <ul> <li>fix: prevent MCP transport auth header from leaking to downstream OpenAPI APIs (<a href="https://redirect.github.com/PrefectHQ/fastmcp/issues/3260";>#3260</a>) by <a href="https://github.com/stakeswky";><code>@âstakeswky</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/3262";>PrefectHQ/fastmcp#3262</a></li> <li>fix: propagate origin_request_id to background task workers by <a href="https://github.com/gfortaine";><code>@âgfortaine</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/3175";>PrefectHQ/fastmcp#3175</a></li> </ul> <h3>Docs đ</h3> <ul> <li>Add v3.0.1 release notes by <a href="https://github.com/jlowin";><code>@âjlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/3259";>PrefectHQ/fastmcp#3259</a></li> <li>docs: add context-aware tool factory example by <a href="https://github.com/machov";><code>@âmachov</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/3264";>PrefectHQ/fastmcp#3264</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/stakeswky";><code>@âstakeswky</code></a> made their first contribution in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/3262";>PrefectHQ/fastmcp#3262</a></li> <li><a href="https://github.com/machov";><code>@âmachov</code></a> made their first contribution in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/3264";>PrefectHQ/fastmcp#3264</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/PrefectHQ/fastmcp/compare/v3.0.1...v3.0.2";>https://github.com/PrefectHQ/fastmcp/compare/v3.0.1...v3.0.2</a></p> <h2>v3.0.1: Threecovery Mode</h2> <p>First patch after 3.0 â mostly smoothing out rough edges discovered in the wild. The big ones: middleware state that wasn't surviving the trip to tool handlers now does, <code>Tool.from_tool()</code> accepts callables again, OpenAPI schemas with circular references no longer crash discovery, and decorator overloads now return the correct types in function mode. Also adds <code>verify_id_token</code> to OIDCProxy for providers (like some Azure AD configs) that issue opaque access tokens but standard JWT id_tokens.</p> <!-- raw HTML omitted --> <h2>What's Changed</h2> <h3>Enhancements đ§</h3> <ul> <li>Add verify_id_token option to OIDCProxy by <a href="https://github.com/jlowin";><code>@âjlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/3248";>PrefectHQ/fastmcp#3248</a></li> </ul> <h3>Fixes đ</h3> <ul> <li>Fix v3.0.0 changelog compare link by <a href="https://github.com/jlowin";><code>@âjlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/3223";>PrefectHQ/fastmcp#3223</a></li> <li>Fix MDX parse error in upgrade guide prompts by <a href="https://github.com/jlowin";><code>@âjlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/3227";>PrefectHQ/fastmcp#3227</a></li> <li>Fix non-serializable state lost between middleware and tools by <a href="https://github.com/jlowin";><code>@âjlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/3234";>PrefectHQ/fastmcp#3234</a></li> <li>Accept callables in Tool.from_tool() by <a href="https://github.com/jlowin";><code>@âjlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/3235";>PrefectHQ/fastmcp#3235</a></li> <li>Preserve skill metadata through provider wrapping by <a href="https://github.com/jlowin";><code>@âjlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/3237";>PrefectHQ/fastmcp#3237</a></li> <li>Fix circular reference crash in OpenAPI schemas by <a href="https://github.com/jlowin";><code>@âjlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/3245";>PrefectHQ/fastmcp#3245</a></li> <li>Fix NameError with future annotations and Context/Depends parameters by <a href="https://github.com/jlowin";><code>@âjlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/3243";>PrefectHQ/fastmcp#3243</a></li> <li>Fix ty ignore syntax in OpenAPI provider by <a href="https://github.com/jlowin";><code>@âjlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/3253";>PrefectHQ/fastmcp#3253</a></li> <li>Use max_completion_tokens instead of deprecated max_tokens in OpenAI handler by <a href="https://github.com/jlowin";><code>@âjlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/3254";>PrefectHQ/fastmcp#3254</a></li> <li>Fix ty compatibility with upgraded deps by <a href="https://github.com/jlowin";><code>@âjlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/3257";>PrefectHQ/fastmcp#3257</a></li> <li>Fix decorator overload return types for function mode by <a href="https://github.com/jlowin";><code>@âjlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/3258";>PrefectHQ/fastmcp#3258</a></li> </ul> <h3>Docs đ</h3> <ul> <li>Sync README with welcome.mdx, fix install count by <a href="https://github.com/jlowin";><code>@âjlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/3224";>PrefectHQ/fastmcp#3224</a></li> <li>Document dict-to-Message prompt migration in upgrade guides by <a href="https://github.com/jlowin";><code>@âjlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/3225";>PrefectHQ/fastmcp#3225</a></li> <li>Fix v2 upgrade guide: remove incorrect v1 import advice by <a href="https://github.com/jlowin";><code>@âjlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/3226";>PrefectHQ/fastmcp#3226</a></li> <li>Animated banner by <a href="https://github.com/jlowin";><code>@âjlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/3231";>PrefectHQ/fastmcp#3231</a></li> <li>Document mounted server state store isolation in upgrade guide by <a href="https://github.com/jlowin";><code>@âjlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/3236";>PrefectHQ/fastmcp#3236</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/PrefectHQ/fastmcp/compare/v3.0.0...v3.0.1";>https://github.com/PrefectHQ/fastmcp/compare/v3.0.0...v3.0.1</a></p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/PrefectHQ/fastmcp/blob/main/docs/changelog.mdx";>fastmcp's changelog</a>.</em></p> <blockquote> <hr /> <h2>title: "Changelog" icon: "list-check" rss: true tag: NEW</h2> <!-- raw HTML omitted --> <p><strong><a href="https://github.com/PrefectHQ/fastmcp/releases/tag/v3.0.2";>v3.0.2: Threecovery Mode II</a></strong></p> <p>Two community-contributed fixes: auth headers from MCP transport no longer leak through to downstream OpenAPI APIs, and background task workers now correctly receive the originating request ID. Plus a new docs example for context-aware tool factories.</p> <h3>Fixes đ</h3> <ul> <li>fix: prevent MCP transport auth header from leaking to downstream OpenAPI APIs by <a href="https://github.com/stakeswky";><code>@âstakeswky</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/3262";>#3262</a></li> <li>fix: propagate origin_request_id to background task workers by <a href="https://github.com/gfortaine";><code>@âgfortaine</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/3175";>#3175</a></li> </ul> <h3>Docs đ</h3> <ul> <li>Add v3.0.1 release notes by <a href="https://github.com/jlowin";><code>@âjlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/3259";>#3259</a></li> <li>docs: add context-aware tool factory example by <a href="https://github.com/machov";><code>@âmachov</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/3264";>#3264</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/PrefectHQ/fastmcp/compare/v3.0.1...v3.0.2";>v3.0.1...v3.0.2</a></p> <!-- raw HTML omitted --> <!-- raw HTML omitted --> <p><strong><a href="https://github.com/PrefectHQ/fastmcp/releases/tag/v3.0.1";>v3.0.1: Three-covery Mode</a></strong></p> <p>First patch after 3.0 â mostly smoothing out rough edges discovered in the wild. The big ones: middleware state that wasn't surviving the trip to tool handlers now does, <code>Tool.from_tool()</code> accepts callables again, OpenAPI schemas with circular references no longer crash discovery, and decorator overloads now return the correct types in function mode. Also adds <code>verify_id_token</code> to OIDCProxy for providers (like some Azure AD configs) that issue opaque access tokens but standard JWT id_tokens.</p> <h3>Enhancements đ§</h3> <ul> <li>Add verify_id_token option to OIDCProxy by <a href="https://github.com/jlowin";><code>@âjlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/3248";>#3248</a></li> </ul> <h3>Fixes đ</h3> <ul> <li>Fix v3.0.0 changelog compare link by <a href="https://github.com/jlowin";><code>@âjlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/3223";>#3223</a></li> <li>Fix MDX parse error in upgrade guide prompts by <a href="https://github.com/jlowin";><code>@âjlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/3227";>#3227</a></li> <li>Fix non-serializable state lost between middleware and tools by <a href="https://github.com/jlowin";><code>@âjlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/3234";>#3234</a></li> <li>Accept callables in Tool.from_tool() by <a href="https://github.com/jlowin";><code>@âjlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/3235";>#3235</a></li> <li>Preserve skill metadata through provider wrapping by <a href="https://github.com/jlowin";><code>@âjlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/3237";>#3237</a></li> <li>Fix circular reference crash in OpenAPI schemas by <a href="https://github.com/jlowin";><code>@âjlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/3245";>#3245</a></li> <li>Fix NameError with future annotations and Context/Depends parameters by <a href="https://github.com/jlowin";><code>@âjlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/3243";>#3243</a></li> <li>Fix ty ignore syntax in OpenAPI provider by <a href="https://github.com/jlowin";><code>@âjlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/3253";>#3253</a></li> <li>Use max_completion_tokens instead of deprecated max_tokens in OpenAI handler by <a href="https://github.com/jlowin";><code>@âjlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/3254";>#3254</a></li> <li>Fix ty compatibility with upgraded deps by <a href="https://github.com/jlowin";><code>@âjlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/3257";>#3257</a></li> <li>Fix decorator overload return types for function mode by <a href="https://github.com/jlowin";><code>@âjlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/3258";>#3258</a></li> </ul> <h3>Docs đ</h3> <ul> <li>Sync README with welcome.mdx, fix install count by <a href="https://github.com/jlowin";><code>@âjlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/3224";>#3224</a></li> <li>Document dict-to-Message prompt migration in upgrade guides by <a href="https://github.com/jlowin";><code>@âjlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/3225";>#3225</a></li> <li>Fix v2 upgrade guide: remove incorrect v1 import advice by <a href="https://github.com/jlowin";><code>@âjlowin</code></a> in <a href="https://redirect.github.com/PrefectHQ/fastmcp/pull/3226";>#3226</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/PrefectHQ/fastmcp/commit/c71840631e03cddfd391ad2a91d5bbab7aef05d6";><code>c718406</code></a> docs: add context-aware tool factory example (<a href="https://redirect.github.com/PrefectHQ/fastmcp/issues/3264";>#3264</a>)</li> <li><a href="https://github.com/PrefectHQ/fastmcp/commit/40d3190317707d46019ded953325cbcad78bca57";><code>40d3190</code></a> fix: propagate origin_request_id to background task workers (<a href="https://redirect.github.com/PrefectHQ/fastmcp/issues/3175";>#3175</a>)</li> <li><a href="https://github.com/PrefectHQ/fastmcp/commit/d85cfb84e1f6dfb66ad402383356f361ad79b1d2";><code>d85cfb8</code></a> Revert to long-lived PR approach for auto-generated docs/schema (<a href="https://redirect.github.com/PrefectHQ/fastmcp/issues/3272";>#3272</a>)</li> <li><a href="https://github.com/PrefectHQ/fastmcp/commit/83d6254757806c1b9f2e07c9ffcbd580a5b96aec";><code>83d6254</code></a> Allow Marvin to open PRs on comment (<a href="https://redirect.github.com/PrefectHQ/fastmcp/issues/3267";>#3267</a>)</li> <li><a href="https://github.com/PrefectHQ/fastmcp/commit/0d4580fef32a8666b93dabbef86e05d763307ba4";><code>0d4580f</code></a> fix: prevent MCP transport auth header from leaking to downstream OpenAPI API...</li> <li><a href="https://github.com/PrefectHQ/fastmcp/commit/3ec7cfa0d55c8ecd0550f656e4f1bc82ca4b0325";><code>3ec7cfa</code></a> Add v3.0.1 release notes (<a href="https://redirect.github.com/PrefectHQ/fastmcp/issues/3259";>#3259</a>)</li> <li><a href="https://github.com/PrefectHQ/fastmcp/commit/bb3e159bc643d3d5a8ed336a794c828abbf4e00e";><code>bb3e159</code></a> Fix decorator overload return types for function mode (<a href="https://redirect.github.com/PrefectHQ/fastmcp/issues/3258";>#3258</a>)</li> <li><a href="https://github.com/PrefectHQ/fastmcp/commit/43e9cdd2758c64f7a12e8290794df468d5d97948";><code>43e9cdd</code></a> Fix ty compatibility with upgraded deps (<a href="https://redirect.github.com/PrefectHQ/fastmcp/issues/3257";>#3257</a>)</li> <li><a href="https://github.com/PrefectHQ/fastmcp/commit/2218a6f52a2e5ba89d9b1705e2fbe2d8ea6de08d";><code>2218a6f</code></a> Use max_completion_tokens instead of deprecated max_tokens in OpenAI handler ...</li> <li><a href="https://github.com/PrefectHQ/fastmcp/commit/1d7e92ecaba5be516bf7f4140d4dee43ed856c88";><code>1d7e92e</code></a> Fix ty ignore syntax in OpenAPI provider (<a href="https://redirect.github.com/PrefectHQ/fastmcp/issues/3253";>#3253</a>)</li> <li>Additional commits viewable in <a href="https://github.com/PrefectHQ/fastmcp/compare/v2.14.5...v3.0.2";>compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
