chore(deps): Bump the minor-and-patch group across 1 directory with 5 updates

[dependabot]

Bumps the minor-and-patch group with 3 updates in the /mcp/weather_tool directory: fastmcp, starlette and opentelemetry-api.

Updates fastmcp from 3.4.0 to 3.4.2

Release notes

Sourced from fastmcp's releases.

v3.4.2: Heads Up

FastMCP 3.4.2 restores JWT compatibility for providers that include private, non-critical JWS header parameters. Tokens from providers like Clerk can carry header metadata such as cat without being rejected before signature and claim validation, while unsupported critical headers are still rejected.

What's Changed

Fixes 🐞

• Allow private JWT headers by @​jlowin in PrefectHQ/fastmcp#4290

Docs 📚

• Docs: add v3.4.1 changelog entries by @​jlowin in PrefectHQ/fastmcp#4289

Full Changelog: PrefectHQ/fastmcp@v3.4.1...v3.4.2

v3.4.1: Floor It

FastMCP 3.4.1 floors Starlette at >=1.0.1 so installs can no longer resolve to a version affected by CVE-2026-48710 — previously the dependency was only constrained transitively through mcp, which allowed vulnerable versions. It also makes OAuthProxy log refresh-token cache misses instead of failing silently.

What's Changed

Enhancements ✨

• Log refresh-token misses in OAuthProxy instead of failing silently by @​jlowin in PrefectHQ/fastmcp#4276

Security 🔒

• Add explicit starlette>=1.0.1 floor (CVE-2026-48710) by @​jlowin in PrefectHQ/fastmcp#4286

Docs 📚

• Document --notes-start-tag in release instructions by @​jlowin in PrefectHQ/fastmcp#4275

Full Changelog: PrefectHQ/fastmcp@v3.4.0...v3.4.1

Commits

• 3b8538e Allow private JWT headers (#4290)
• 0445c31 chore: Update SDK documentation (#4223)
• 9261793 Docs: add v3.4.1 changelog entries (#4289)
• e1b52d0 Add explicit starlette>=1.0.1 floor (CVE-2026-48710) (#4286)
• e58f386 Log refresh-token misses in OAuthProxy instead of failing silently (#4276)
• 3f09c68 Document --notes-start-tag requirement in release instructions (#4275)
• See full diff in compare view

Updates starlette from 1.2.1 to 1.3.1

Release notes

Sourced from starlette's releases.

Version 1.3.1

What's Changed

• Use StarletteDeprecationWarning instead of DeprecationWarning by @​Kludex in Kludex/starlette#3119
• Enforce max_fields and max_part_size in FormParser by @​Kludex in Kludex/starlette#3329
• Enforce FormParser limits in parser callbacks by @​Kludex in Kludex/starlette#3331

Full Changelog: Kludex/starlette@1.3.0...1.3.1

Version 1.3.0

What's Changed

• Clamp oversized suffix ranges in FileResponse by @​jiyujie2006 in Kludex/starlette#3307
• Catch OSError alongside MultiPartException when closing temp files by @​N3XT3R1337 in Kludex/starlette#3191
• Add httpx2 to the full extra by @​Kludex in Kludex/starlette#3323
• Adjust testclient typing and warnings by @​waketzheng in Kludex/starlette#3322
• Fix IndexError in URL.replace() on a URL with no authority by @​LeSingh1 in Kludex/starlette#3317
• Annotate URLPath protocol parameter with Literal by @​Chang-LeHung in Kludex/starlette#3285
• avoid collapsing exception groups from user code by @​graingert in Kludex/starlette#2830
• Use removeprefix to strip weak ETag indicator in is_not_modified by @​gnosyslambda in Kludex/starlette#3193
• Build request.url from structured components by @​Kludex in Kludex/starlette#3326

New Contributors

• @​jiyujie2006 made their first contribution in Kludex/starlette#3307
• @​N3XT3R1337 made their first contribution in Kludex/starlette#3191
• @​leestana01 made their first contribution in Kludex/starlette#3319
• @​LeSingh1 made their first contribution in Kludex/starlette#3317
• @​EmmanuelNiyonshuti made their first contribution in Kludex/starlette#3204
• @​Chang-LeHung made their first contribution in Kludex/starlette#3285
• @​gnosyslambda made their first contribution in Kludex/starlette#3193

Full Changelog: Kludex/starlette@1.2.1...1.3.0

Changelog

Sourced from starlette's changelog.

1.3.1 (June 12, 2026)

Fixed

• Enforce max_fields and max_part_size in FormParser #3329.
• Enforce FormParser limits in parser callbacks #3331.

1.3.0 (June 11, 2026)

Added

• Add httpx2 to the full extra #3323.
• Annotate the URLPath protocol parameter with Literal #3285.

Fixed

• Build request.url from structured components #3326.
• Clamp oversized suffix ranges in FileResponse #3307.
• Catch OSError alongside MultiPartException when closing temp files #3191.
• Avoid collapsing exception groups raised from user code #2830.
• Use removeprefix to strip the weak ETag indicator in is_not_modified #3193.
• Fix IndexError in URL.replace() on a URL with no authority #3317.
• Adjust testclient typing and warnings #3322.

Commits

• 8ebffd0 Version 1.3.1 (#3330)
• 25b8e17 Enforce FormParser limits in parser callbacks (#3331)
• dba1c4b Enforce max_fields and max_part_size in FormParser (#3329)
• 45e51dc Use StarletteDeprecationWarning instead of DeprecationWarning (#3119)
• 5f8610c Version 1.3.0 (#3327)
• 167b585 Build request.url from structured components (#3326)
• 3730925 Use removeprefix to strip weak ETag indicator in is_not_modified (#3193)
• e6f7ad1 avoid collapsing exception groups from user code (#2830)
• 115228f Annotate URLPath protocol parameter with Literal (#3285)
• 113f193 docs: replace inline ASGI server list with link to canonical implemen… (#3204)
• Additional commits viewable in compare view

Updates opentelemetry-api from 1.42.1 to 1.43.0

Changelog

Sourced from opentelemetry-api's changelog.

Version 1.43.0/0.64b0 (2026-06-24)

Added

• opentelemetry-sdk: add add_metric_reader / remove_metric_reader public APIs to register / unregister metric readers at runtime. (#4863)
• opentelemetry-exporter-prometheus: add support for configuring metric scope labels (#5123)
• opentelemetry-exporter-otlp-proto-grpc: Add grpc error details to the log message that's written when the grpc call fails. (#5143)
• opentelemetry-exporter-http-transport: add 'opentelemetry-exporter-http-transport' package for HTTP exporters (#5194)
• opentelemetry-sdk: Add composite/development samplers support to declarative file configuration (#5201)
• opentelemetry-exporter-otlp-json-file: Add OTLP JSON File exporter implementation (#5207)
• opentelemetry-sdk: add _resolve_component shared utility for declarative config plugin loading, reducing boilerplate in exporter factory functions (#5215)
• opentelemetry-sdk: add pull metric reader support to declarative file configuration, including Prometheus metric reader via the prometheus_development config field (#5216)
• opentelemetry-proto-json: update to use opentelemetry-proto v1.10.0 (#5224)
• opentelemetry-proto: bump maximum supported protobuf version to 7.x.x (#5251)
• opentelemetry-sdk: add ServiceInstanceIdResourceDetector for populating service.instance.id (#5259)
• opentelemetry-sdk: declarative config loader now recursively converts parsed dicts into typed dataclass instances, including nested dataclasses, lists of dataclasses, and enum values. End-to-end YAML/JSON → SDK configuration now works via the factory functions. (#5269)
• opentelemetry-sdk: add configure_sdk(config) to the declarative configuration API. Single entry point that takes a parsed OpenTelemetryConfiguration, builds the resource, and applies the tracer/meter/logger providers and propagator globally. Honors the top-level disabled flag. (#5270)
• opentelemetry-sdk: the SDK configurator now honors the OTEL_CONFIG_FILE environment variable. When set, the SDK loads and applies the referenced declarative configuration file (YAML or JSON) in place of the env-var-based

... (truncated)

Commits

• fcbbeb8 [release/v1.43.x-0.64bx] Prepare release 1.43.0/0.64b0 (#5349)
• b40dcbc opentelemetry-exporter-http-transport: enable entry-point loading of transpor...
• 10e8577 update to Sphinx to 8.1.3 in order to support Python 3.14 (#5278)
• 6ac6895 docs: add declarative configuration guide and example (#5309)
• 13ad4d5 opentelemetry-api: normalize empty environment propagation names to "_" in En...
• 6a0ab84 opentelemetry-sdk: merge doesn't need a copy, dict already does this (#5326)
• ac7a3df feat(config): support OTEL_CONFIG_FILE in the SDK configurator (#5271)
• fa75422 Add support for composite samplers in declarative config (#5201)
• 43f079f Update json and proto encoder to always accept None type, cleanup code / test...
• 53c9d96 chore: cleanup typo found in test (#5324)
• Additional commits viewable in compare view

Updates opentelemetry-sdk from 1.42.1 to 1.43.0

Changelog

Sourced from opentelemetry-sdk's changelog.

Version 1.43.0/0.64b0 (2026-06-24)

Added

• opentelemetry-sdk: add add_metric_reader / remove_metric_reader public APIs to register / unregister metric readers at runtime. (#4863)
• opentelemetry-exporter-prometheus: add support for configuring metric scope labels (#5123)
• opentelemetry-exporter-otlp-proto-grpc: Add grpc error details to the log message that's written when the grpc call fails. (#5143)
• opentelemetry-exporter-http-transport: add 'opentelemetry-exporter-http-transport' package for HTTP exporters (#5194)
• opentelemetry-sdk: Add composite/development samplers support to declarative file configuration (#5201)
• opentelemetry-exporter-otlp-json-file: Add OTLP JSON File exporter implementation (#5207)
• opentelemetry-sdk: add _resolve_component shared utility for declarative config plugin loading, reducing boilerplate in exporter factory functions (#5215)
• opentelemetry-sdk: add pull metric reader support to declarative file configuration, including Prometheus metric reader via the prometheus_development config field (#5216)
• opentelemetry-proto-json: update to use opentelemetry-proto v1.10.0 (#5224)
• opentelemetry-proto: bump maximum supported protobuf version to 7.x.x (#5251)
• opentelemetry-sdk: add ServiceInstanceIdResourceDetector for populating service.instance.id (#5259)
• opentelemetry-sdk: declarative config loader now recursively converts parsed dicts into typed dataclass instances, including nested dataclasses, lists of dataclasses, and enum values. End-to-end YAML/JSON → SDK configuration now works via the factory functions. (#5269)
• opentelemetry-sdk: add configure_sdk(config) to the declarative configuration API. Single entry point that takes a parsed OpenTelemetryConfiguration, builds the resource, and applies the tracer/meter/logger providers and propagator globally. Honors the top-level disabled flag. (#5270)
• opentelemetry-sdk: the SDK configurator now honors the OTEL_CONFIG_FILE environment variable. When set, the SDK loads and applies the referenced declarative configuration file (YAML or JSON) in place of the env-var-based

... (truncated)

Commits

• fcbbeb8 [release/v1.43.x-0.64bx] Prepare release 1.43.0/0.64b0 (#5349)
• b40dcbc opentelemetry-exporter-http-transport: enable entry-point loading of transpor...
• 10e8577 update to Sphinx to 8.1.3 in order to support Python 3.14 (#5278)
• 6ac6895 docs: add declarative configuration guide and example (#5309)
• 13ad4d5 opentelemetry-api: normalize empty environment propagation names to "_" in En...
• 6a0ab84 opentelemetry-sdk: merge doesn't need a copy, dict already does this (#5326)
• ac7a3df feat(config): support OTEL_CONFIG_FILE in the SDK configurator (#5271)
• fa75422 Add support for composite samplers in declarative config (#5201)
• 43f079f Update json and proto encoder to always accept None type, cleanup code / test...
• 53c9d96 chore: cleanup typo found in test (#5324)
• Additional commits viewable in compare view

Updates opentelemetry-exporter-otlp-proto-http from 1.42.1 to 1.43.0

Changelog

Sourced from opentelemetry-exporter-otlp-proto-http's changelog.

Version 1.43.0/0.64b0 (2026-06-24)

Added

• opentelemetry-sdk: add add_metric_reader / remove_metric_reader public APIs to register / unregister metric readers at runtime. (#4863)
• opentelemetry-exporter-prometheus: add support for configuring metric scope labels (#5123)
• opentelemetry-exporter-otlp-proto-grpc: Add grpc error details to the log message that's written when the grpc call fails. (#5143)
• opentelemetry-exporter-http-transport: add 'opentelemetry-exporter-http-transport' package for HTTP exporters (#5194)
• opentelemetry-sdk: Add composite/development samplers support to declarative file configuration (#5201)
• opentelemetry-exporter-otlp-json-file: Add OTLP JSON File exporter implementation (#5207)
• opentelemetry-sdk: add _resolve_component shared utility for declarative config plugin loading, reducing boilerplate in exporter factory functions (#5215)
• opentelemetry-sdk: add pull metric reader support to declarative file configuration, including Prometheus metric reader via the prometheus_development config field (#5216)
• opentelemetry-proto-json: update to use opentelemetry-proto v1.10.0 (#5224)
• opentelemetry-proto: bump maximum supported protobuf version to 7.x.x (#5251)
• opentelemetry-sdk: add ServiceInstanceIdResourceDetector for populating service.instance.id (#5259)
• opentelemetry-sdk: declarative config loader now recursively converts parsed dicts into typed dataclass instances, including nested dataclasses, lists of dataclasses, and enum values. End-to-end YAML/JSON → SDK configuration now works via the factory functions. (#5269)
• opentelemetry-sdk: add configure_sdk(config) to the declarative configuration API. Single entry point that takes a parsed OpenTelemetryConfiguration, builds the resource, and applies the tracer/meter/logger providers and propagator globally. Honors the top-level disabled flag. (#5270)
• opentelemetry-sdk: the SDK configurator now honors the OTEL_CONFIG_FILE environment variable. When set, the SDK loads and applies the referenced declarative configuration file (YAML or JSON) in place of the env-var-based

... (truncated)

Commits

• fcbbeb8 [release/v1.43.x-0.64bx] Prepare release 1.43.0/0.64b0 (#5349)
• b40dcbc opentelemetry-exporter-http-transport: enable entry-point loading of transpor...
• 10e8577 update to Sphinx to 8.1.3 in order to support Python 3.14 (#5278)
• 6ac6895 docs: add declarative configuration guide and example (#5309)
• 13ad4d5 opentelemetry-api: normalize empty environment propagation names to "_" in En...
• 6a0ab84 opentelemetry-sdk: merge doesn't need a copy, dict already does this (#5326)
• ac7a3df feat(config): support OTEL_CONFIG_FILE in the SDK configurator (#5271)
• fa75422 Add support for composite samplers in declarative config (#5201)
• 43f079f Update json and proto encoder to always accept None type, cleanup code / test...
• 53c9d96 chore: cleanup typo found in test (#5324)
• Additional commits viewable in compare view

[pdettori]

Low-risk grouped Dependabot update (minor/patch only). All CI checks green and mergeable. Approved via triage.