diff --git a/.github/actions/run-claude/action.yml b/.github/actions/run-claude/action.yml index 66f4bb286..b79131462 100644 --- a/.github/actions/run-claude/action.yml +++ b/.github/actions/run-claude/action.yml @@ -37,6 +37,11 @@ inputs: required: false default: "" + extra-allowed-tools: + description: "Additional comma-separated tools to append to allowed-tools" + required: false + default: "" + model: description: "Model to use for Claude" required: false @@ -88,7 +93,7 @@ runs: track_progress: ${{ inputs.track-progress }} prompt: ${{ inputs.prompt }} claude_args: | - ${{ (inputs.allowed-tools != '' || inputs.extra-allowed-tools != '') && format('--allowedTools {0}{1}', inputs.allowed-tools, inputs.extra-allowed-tools != '' && format(',{0}', inputs.extra-allowed-tools) || '') || '' }} + ${{ (inputs.allowed-tools != '' || inputs.extra-allowed-tools != '') && format('--allowedTools ''{0}{1}''', inputs.allowed-tools, inputs.extra-allowed-tools != '' && format(',{0}', inputs.extra-allowed-tools) || '') || '' }} ${{ inputs.mcp-servers != '' && format('--mcp-config ''{0}''', inputs.mcp-servers) || '' }} --model ${{ inputs.model }} settings: | diff --git a/.github/dependabot.yml b/.github/dependabot.yml deleted file mode 100644 index 20d3ccecf..000000000 --- a/.github/dependabot.yml +++ /dev/null @@ -1,14 +0,0 @@ -version: 2 -updates: - - package-ecosystem: "pip" - directory: "/" - schedule: - interval: "daily" - labels: - - "dependencies" - - package-ecosystem: "github-actions" - directory: "/" - schedule: - interval: "weekly" - labels: - - "dependencies" diff --git a/.github/workflows/require-issue-link.yml b/.github/workflows/require-issue-link.yml index 6d674d0e2..fda27b36a 100644 --- a/.github/workflows/require-issue-link.yml +++ b/.github/workflows/require-issue-link.yml @@ -379,9 +379,6 @@ jobs: async function enforceFailure(kind) { await addLabel(); - const reason = kind === 'no-link' - ? "it doesn't reference a tracked issue assigned to you" - : "you aren't assigned to the issue it references"; const steps = kind === 'no-link' ? [ `1. Find or [open an issue](https://github.com/${owner}/${repo}/issues/new/choose) describing the change — if you open it, you have first claim on it.`, @@ -393,9 +390,9 @@ jobs: const commentBody = [ MARKER, - "**Don't open a new pull request — this one reopens on its own.** It's closed for " + - `now because ${reason}, but the moment that's fixed it reopens automatically. Keep this ` + - 'PR and edit it; opening a fresh duplicate just starts you over and creates more to triage.', + '**This pull request was closed because it must link to an issue assigned to you.** ' + + 'Once this PR links to an issue and a maintainer assigns that issue to you, it will ' + + 'reopen automatically. Please update this PR rather than opening a new one.', '', `Per [CONTRIBUTING.md](https://github.com/${owner}/${repo}/blob/main/CONTRIBUTING.md), an external PR must reference an issue that's assigned to its author. To get there:`, '', diff --git a/CLAUDE.md b/CLAUDE.md index 1a2cbddb0..79b040531 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -56,6 +56,8 @@ When modifying MCP functionality, changes typically need to be applied across al **Read `CONTRIBUTING.md` before opening issues or PRs.** It describes when PRs are appropriate, what we expect from enhancement proposals, and what we'll close without review. +**Review closed contributor PRs.** When reviewing an issue, inspect every associated non-maintainer PR, including closed PRs. External PRs may be closed as part of the issue-link and assignment workflow, so closure alone is not a negative signal. Read `CONTRIBUTING.md` and the PR timeline and comments to understand its status before evaluating it. + ### Git & CI - Prek hooks are required (run automatically on commits) diff --git a/docs/changelog.mdx b/docs/changelog.mdx index de17a3f8e..82aeb032d 100644 --- a/docs/changelog.mdx +++ b/docs/changelog.mdx @@ -5,6 +5,38 @@ rss: true tag: NEW --- + + +**[v3.4.7: Know Your Audience](https://github.com/PrefectHQ/fastmcp/releases/tag/v3.4.7)** + +FastMCP 3.4.7 fixes CIMD `private_key_jwt` authentication on bare-origin OAuth proxy deployments by validating client assertions against the exact token endpoint advertised in OAuth metadata. + +### Security 🔒 +* Backport CIMD assertion audience fix to v3 by [@jlowin](https://github.com/jlowin) in [#4799](https://github.com/PrefectHQ/fastmcp/pull/4799) + +### Docs 📚 +* Docs: add v3.4.7 changelog entries by [@jlowin](https://github.com/jlowin) in [#4810](https://github.com/PrefectHQ/fastmcp/pull/4810) + +**Full Changelog**: [v3.4.6...v3.4.7](https://github.com/PrefectHQ/fastmcp/compare/v3.4.6...v3.4.7) + + + + + +**[v3.4.6: Trust, but Proxy](https://github.com/PrefectHQ/fastmcp/releases/tag/v3.4.6)** + +FastMCP 3.4.6 backports trusted-proxy support for SSRF-protected OAuth metadata and JWKS fetches. Deployments can now route these requests through a mandated corporate proxy while preserving custom CA certificates; FastMCP refuses the fetch when no proxy is configured instead of risking an unprotected direct request. + +### Fixes 🐞 +* Backport #4412 to 3.x: support trusted SSRF proxies by [@jlowin](https://github.com/jlowin) in [#4755](https://github.com/PrefectHQ/fastmcp/pull/4755) + +### Docs 📚 +* Docs: add v3.4.6 changelog entries by [@jlowin](https://github.com/jlowin) in [#4761](https://github.com/PrefectHQ/fastmcp/pull/4761) + +**Full Changelog**: [v3.4.5...v3.4.6](https://github.com/PrefectHQ/fastmcp/compare/v3.4.5...v3.4.6) + + + **[v4.0.0b1: Fourgone Conclusion](https://github.com/PrefectHQ/fastmcp/releases/tag/v4.0.0b1)** diff --git a/docs/css/language-dropdown.css b/docs/css/language-dropdown.css index 0eb810545..8193274be 100644 --- a/docs/css/language-dropdown.css +++ b/docs/css/language-dropdown.css @@ -7,6 +7,7 @@ margin-left: auto; display: inline-flex; align-items: center; + position: relative; } #language-switch select { @@ -55,3 +56,31 @@ color: rgb(209 213 219); border-color: rgb(255 255 255 / 0.1); } + +/* Colored language mark on the visible trigger; the native