You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@superset.apache.org by mi...@apache.org on 2026/07/01 16:42:32 UTC
(superset) branch master updated: chore(deps): bump fastmcp from >=3.2.4 to >=3.4.2 (#41592)
This is an automated email from the ASF dual-hosted git repository.
aminghadersohi pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/superset.git
The following commit(s) were added to refs/heads/master by this push:
new da4cae16574 chore(deps): bump fastmcp from >=3.2.4 to >=3.4.2 (#41592)
da4cae16574 is described below
commit da4cae165745aa989dc2b8c67b910085d202af10
Author: Amin Ghadersohi <am...@gmail.com>
AuthorDate: Wed Jul 1 12:42:25 2026 -0400
chore(deps): bump fastmcp from >=3.2.4 to >=3.4.2 (#41592)
---
pyproject.toml | 2 +-
requirements/development.txt | 66 +++++++++++++++++++++---------------
superset/mcp_service/jwt_verifier.py | 5 +++
3 files changed, 45 insertions(+), 28 deletions(-)
diff --git a/pyproject.toml b/pyproject.toml
index 5f904ee2732..ff8b7dec74f 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -154,7 +154,7 @@ elasticsearch = ["elasticsearch-dbapi>=0.2.13, <0.3.0"]
exasol = ["sqlalchemy-exasol>=2.4.0, <8.0"]
excel = ["xlrd>=2.0.2, <2.1"]
fastmcp = [
- "fastmcp>=3.2.4,<4.0",
+ "fastmcp>=3.4.2,<4.0",
# tiktoken backs the response-size-guard token estimator. Without
# it, the middleware falls back to a coarser character-based
# heuristic that under-counts JSON-heavy MCP responses.
diff --git a/requirements/development.txt b/requirements/development.txt
index a8c49266322..16a662942c0 100644
--- a/requirements/development.txt
+++ b/requirements/development.txt
@@ -53,7 +53,7 @@ attrs==25.3.0
# requests-cache
# trio
authlib==1.6.12
- # via fastmcp
+ # via fastmcp-slim
babel==2.17.0
# via
# -c requirements/base-constraint.txt
@@ -184,6 +184,7 @@ cryptography==48.0.1
# apache-superset
# authlib
# google-auth
+ # joserfc
# paramiko
# pyjwt
# pyopenssl
@@ -191,7 +192,7 @@ cryptography==48.0.1
cycler==0.12.1
# via matplotlib
cyclopts==4.2.4
- # via fastmcp
+ # via fastmcp-slim
db-dtypes==1.3.1
# via pandas-gbq
defusedxml==0.7.1
@@ -236,9 +237,11 @@ et-xmlfile==2.0.0
# -c requirements/base-constraint.txt
# openpyxl
exceptiongroup==1.3.0
- # via fastmcp
-fastmcp==3.2.4
+ # via fastmcp-slim
+fastmcp==3.4.2
# via apache-superset
+fastmcp-slim==3.4.2
+ # via fastmcp
filelock==3.20.3
# via
# -c requirements/base-constraint.txt
@@ -382,7 +385,7 @@ greenlet==3.5.1
# shillelagh
# sqlalchemy
griffelib==2.0.2
- # via fastmcp
+ # via fastmcp-slim
grpcio==1.81.1
# via
# apache-superset
@@ -413,7 +416,7 @@ httpcore==1.0.9
# via httpx
httpx==0.28.1
# via
- # fastmcp
+ # fastmcp-slim
# mcp
httpx-sse==0.4.1
# via mcp
@@ -472,12 +475,14 @@ jmespath==1.1.0
# via
# boto3
# botocore
+joserfc==1.7.2
+ # via fastmcp-slim
jsonpath-ng==1.8.0
# via
# -c requirements/base-constraint.txt
# apache-superset
jsonref==1.1.0
- # via fastmcp
+ # via fastmcp-slim
jsonschema==4.23.0
# via
# -c requirements/base-constraint.txt
@@ -487,7 +492,7 @@ jsonschema==4.23.0
# openapi-spec-validator
jsonschema-path==0.3.4
# via
- # fastmcp
+ # fastmcp-slim
# openapi-spec-validator
jsonschema-specifications==2025.4.1
# via
@@ -550,7 +555,7 @@ matplotlib==3.9.0
mccabe==0.7.0
# via pylint
mcp==1.24.0
- # via fastmcp
+ # via fastmcp-slim
mdurl==0.1.2
# via
# -c requirements/base-constraint.txt
@@ -594,7 +599,7 @@ odfpy==1.4.1
# -c requirements/base-constraint.txt
# pandas
openapi-pydantic==0.5.1
- # via fastmcp
+ # via fastmcp-slim
openapi-schema-validator==0.6.3
# via
# -c requirements/base-constraint.txt
@@ -606,7 +611,7 @@ openpyxl==3.1.5
# -c requirements/base-constraint.txt
# pandas
opentelemetry-api==1.39.1
- # via fastmcp
+ # via fastmcp-slim
ordered-set==4.1.0
# via
# -c requirements/base-constraint.txt
@@ -627,7 +632,7 @@ packaging==25.0
# deprecation
# docker
# duckdb-engine
- # fastmcp
+ # fastmcp-slim
# google-cloud-bigquery
# gunicorn
# limits
@@ -672,7 +677,7 @@ pip==25.1.1
platformdirs==4.3.8
# via
# -c requirements/base-constraint.txt
- # fastmcp
+ # fastmcp-slim
# pylint
# requests-cache
# virtualenv
@@ -714,7 +719,7 @@ psutil==6.1.0
psycopg2-binary==2.9.12
# via apache-superset
py-key-value-aio==0.4.4
- # via fastmcp
+ # via fastmcp-slim
pyarrow==24.0.0
# via
# -c requirements/base-constraint.txt
@@ -741,7 +746,7 @@ pydantic==2.11.7
# -c requirements/base-constraint.txt
# apache-superset
# apache-superset-core
- # fastmcp
+ # fastmcp-slim
# mcp
# openapi-pydantic
# pydantic-settings
@@ -750,7 +755,9 @@ pydantic-core==2.33.2
# -c requirements/base-constraint.txt
# pydantic
pydantic-settings==2.10.1
- # via mcp
+ # via
+ # fastmcp-slim
+ # mcp
pydata-google-auth==1.9.0
# via pandas-gbq
pydruid==0.6.9
@@ -793,7 +800,7 @@ pyparsing==3.2.3
# apache-superset
# matplotlib
pyperclip==1.10.0
- # via fastmcp
+ # via fastmcp-slim
pysocks==1.7.1
# via
# -c requirements/base-constraint.txt
@@ -835,12 +842,14 @@ python-dotenv==1.2.2
# via
# -c requirements/base-constraint.txt
# apache-superset
- # fastmcp
+ # fastmcp-slim
# pydantic-settings
python-ldap==3.4.7
# via apache-superset
python-multipart==0.0.29
- # via mcp
+ # via
+ # fastmcp-slim
+ # mcp
pytz==2025.2
# via
# -c requirements/base-constraint.txt
@@ -856,7 +865,7 @@ pyyaml==6.0.3
# -c requirements/base-constraint.txt
# apache-superset
# apispec
- # fastmcp
+ # fastmcp-slim
# jsonschema-path
# pre-commit
redis==5.3.1
@@ -899,7 +908,7 @@ rich==13.9.4
# via
# -c requirements/base-constraint.txt
# cyclopts
- # fastmcp
+ # fastmcp-slim
# flask-limiter
# rich-rst
rich-rst==1.3.1
@@ -995,8 +1004,10 @@ sshtunnel==0.4.0
# via
# -c requirements/base-constraint.txt
# apache-superset
-starlette==0.49.1
- # via mcp
+starlette==1.3.1
+ # via
+ # fastmcp-slim
+ # mcp
statsd==4.0.1
# via apache-superset
syntaqlite==0.4.2
@@ -1035,6 +1046,7 @@ typing-extensions==4.15.0
# apache-superset-core
# cattrs
# exceptiongroup
+ # fastmcp-slim
# grpcio
# limits
# mcp
@@ -1062,7 +1074,7 @@ tzdata==2025.2
tzlocal==5.2
# via trino
uncalled-for==0.2.0
- # via fastmcp
+ # via fastmcp-slim
url-normalize==2.2.1
# via
# -c requirements/base-constraint.txt
@@ -1077,7 +1089,7 @@ urllib3==2.7.0
# selenium
uvicorn==0.37.0
# via
- # fastmcp
+ # fastmcp-slim
# mcp
vine==5.1.0
# via
@@ -1093,7 +1105,7 @@ watchdog==6.0.0
# apache-superset
# apache-superset-extensions-cli
watchfiles==1.1.1
- # via fastmcp
+ # via fastmcp-slim
wcwidth==0.2.13
# via
# -c requirements/base-constraint.txt
@@ -1103,7 +1115,7 @@ websocket-client==1.8.0
# -c requirements/base-constraint.txt
# selenium
websockets==15.0.1
- # via fastmcp
+ # via fastmcp-slim
werkzeug==3.1.6
# via
# -c requirements/base-constraint.txt
diff --git a/superset/mcp_service/jwt_verifier.py b/superset/mcp_service/jwt_verifier.py
index 74387c2b7b7..8276855d1a9 100644
--- a/superset/mcp_service/jwt_verifier.py
+++ b/superset/mcp_service/jwt_verifier.py
@@ -36,6 +36,7 @@ from contextvars import ContextVar
from typing import Any, cast
import httpx
+from authlib.jose import JsonWebToken
from authlib.jose.errors import JoseError
from fastmcp.server.auth.auth import AccessToken
from fastmcp.server.auth.providers.jwt import JWTVerifier
@@ -393,6 +394,10 @@ class MCPJWTVerifier(JWTVerifier):
# is unset, so self.algorithm is always truthy post-construction).
explicit_algorithm = kwargs.get("algorithm")
super().__init__(*args, **kwargs)
+ # fastmcp >= 3.4.2 removed self.jwt from JWTVerifier (switched to joserfc
+ # internally). Restore it here using authlib so that load_access_token()
+ # can continue to call self.jwt.decode() with the raw verification key.
+ self.jwt = JsonWebToken([self.algorithm])
# Surface permissive auth configuration at startup. Config-gated:
# a verifier is only built when auth is enabled (see mcp_config).
# Prefer the raw MCP_JWT_ALGORITHM config value over the constructor