fix(mcp): suppress AuthlibDeprecationWarning from authlib.jose imports#40977
Open
eschutho wants to merge 2 commits into
Open
fix(mcp): suppress AuthlibDeprecationWarning from authlib.jose imports#40977eschutho wants to merge 2 commits into
eschutho wants to merge 2 commits into
Conversation
authlib.jose is deprecated in favor of joserfc, but fastmcp (a hard dependency of the MCP service) still imports authlib.jose internally. We cannot migrate the caught error classes to joserfc.errors because the exceptions raised by fastmcp's jwt.decode() are authlib.jose.errors.*, not joserfc.errors.* — swapping the catch clauses would silently stop catching real JWT errors. Wraps each `from authlib.jose.errors import ...` in `warnings.catch_warnings()` so the AuthlibDeprecationWarning that fires on first import (authlib 1.3+) is suppressed at the callsite where we trigger it. Once fastmcp migrates to joserfc the workaround can be removed and the imports replaced with joserfc equivalents. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Contributor
Code Review Agent Run #40526eActionable Suggestions - 0Review Details
Bito Usage GuideCommands Type the following command in the pull request comment and save the comment.
Refer to the documentation for additional commands. Configuration This repository uses Documentation & Help AI Code Review powered by |
✅ Deploy Preview for superset-docs-preview ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
Codecov Report❌ Patch coverage is
❌ Your project check has failed because the head coverage (99.95%) is below the target coverage (100.00%). You can increase the head coverage or adjust the target coverage. Additional details and impacted files@@ Coverage Diff @@
## master #40977 +/- ##
==========================================
- Coverage 64.29% 64.29% -0.01%
==========================================
Files 2657 2657
Lines 144027 144061 +34
Branches 33207 33215 +8
==========================================
+ Hits 92604 92622 +18
- Misses 49803 49815 +12
- Partials 1620 1624 +4
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
authlib 1.3+ emits AuthlibDeprecationWarning (configured as "always") when authlib.jose is first imported. The warning fires from fastmcp's own authlib.jose import — not from the superset.mcp_service files — so wrapping our error-class imports in catch_warnings() was a no-op. The correct fix is a module-level warnings.filterwarnings() call in superset/mcp_service/__init__.py, which Python always runs before any submodule import. This ensures the filter is active before fastmcp triggers the authlib.jose import in both the production server path and test imports. Also adds authlib to _suppress_third_party_warnings() in server.py for defense in depth (covers any late authlib.jose imports during tool execution). The error classes remain from authlib.jose.errors — not joserfc.errors — because fastmcp's jwt.decode() raises authlib.jose.errors.* subclasses. Migrating the exception catch clauses to joserfc would silently stop catching real JWT errors until fastmcp itself migrates. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Contributor
Code Review Agent Run #d373e7Actionable Suggestions - 0Additional Suggestions - 2
Review Details
Bito Usage GuideCommands Type the following command in the pull request comment and save the comment.
Refer to the documentation for additional commands. Configuration This repository uses Documentation & Help AI Code Review powered by |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What's the problem?
authlib1.3+ marksauthlib.joseas deprecated and emitsAuthlibDeprecationWarning(configured as"always") every timeauthlib.joseis first imported per process.fastmcp(the MCP transport) importsauthlib.joseduring its own startup, so every Superset MCP worker logs this on boot, polluting Datadog.Root cause
The warning fires when
fastmcp/server/auth/providers/jwt.pyrunsfrom authlib.jose import JsonWebKey, JsonWebToken. This happens during the import ofsuperset.mcp_service.jwt_verifier(which importsfastmcp). Anywarnings.catch_warnings()block placed injwt_verifier.pyormcp_config.pyafter their fastmcp imports is a no-op —authlib.joseis already insys.modules.Fix
A single
warnings.filterwarnings()call insuperset/mcp_service/__init__.py. Python always runs package__init__.pybefore any submodule import, so the filter is active before fastmcp triggersauthlib.jose. This covers both the production server path (server.py → jwt_verifier.py → fastmcp) and direct test imports.Also adds authlib to
_suppress_third_party_warnings()inserver.pyfor defense in depth.Why not migrate to
joserfc.errors?fastmcp'sjwt.decode()raisesauthlib.jose.errors.*. Changing our catch clauses tojoserfc.errors.*would silently stop catching real JWT signature/expiry errors until fastmcp migrates. The current error classes are correct.Files changed
superset/mcp_service/__init__.py— module-levelfilterwarningsbefore any submodule import firessuperset/mcp_service/server.py— adds authlib to_suppress_third_party_warnings()for defense in depthsuperset/mcp_service/jwt_verifier.py— restores normal import position (filter now handled by__init__.py)superset/mcp_service/mcp_config.py— sametests/unit_tests/mcp_service/test_jwt_verifier.py— sameNo behavior change
Warning suppression only. Exception handling is identical to before.
Test plan
pytest tests/unit_tests/mcp_service/test_jwt_verifier.py— all existing tests passAuthlibDeprecationWarningis not emitted on MCP service startup