Review of 871c6db

Small, targeted fix — the approach is sound and consistent with the existing marshmallow/google suppression patterns in _suppress_third_party_warnings(). Two suggestions below.

MEDIUM — Missing category makes filter broader than necessary

superset/mcp_service/__init__.py:45-48 and superset/mcp_service/server.py:81-84

Both filterwarnings calls omit the category parameter, which defaults to Warning (the root class), meaning the filter matches any warning category whose message matches the regex. The authlib deprecation uses AuthlibDeprecationWarning(DeprecationWarning) (defined in authlib/deprecate.py). Adding category=DeprecationWarning constrains the match to deprecation warnings only, consistent with how the marshmallow filter specifies category=DeprecationWarning and the google filter specifies category=FutureWarning in the same function.

Unlikely to cause harm in practice (the message regex is very specific), but easy to tighten:

warnings.filterwarnings(
    "ignore",
    message=r"authlib\.jose module is deprecated",
    category=DeprecationWarning,
)

LOW — Test not updated for the new filter

test_suppress_third_party_warnings (tests/unit_tests/mcp_service/test_mcp_server.py:112) asserts the marshmallow and google filters are installed but doesn't check the new authlib filter. Adding a matching assertion would catch accidental removal:

authlib_filters = [
    f
    for f in warnings.filters
    if f[0] == "ignore"
    and isinstance(f[1], re.Pattern)
    and f[1].pattern == r"authlib\.jose module is deprecated"
]
assert len(authlib_filters) >= 1, "Expected authlib deprecation filter"

LOW — Superset's own authlib.jose imports

The PR comment attributes the warning to fastmcp, but Superset itself also imports from the deprecated module (jwt_verifier.py:38, mcp_config.py:23). These will also trigger the warning once authlib is upgraded past 1.6.x (currently pinned at 1.6.12). The suppression is a fine stopgap, but worth tracking a follow-up to migrate those imports to joserfc.

Overall this is clean and well-commented. The two actionable items (add category=DeprecationWarning, extend the test) are small.

Two small consistency/coverage notes on the warning suppression — neither blocking.

MEDIUM — specify category=DeprecationWarning for consistency and narrowness. Both new warnings.filterwarnings(...) calls (superset/mcp_service/__init__.py:45 and superset/mcp_service/server.py:81) omit the category argument, so they default to the root Warning class and match any category whose message matches the regex. The adjacent filters in _suppress_third_party_warnings() are explicit — marshmallow uses category=DeprecationWarning (server.py:70) and google uses category=FutureWarning (server.py:75). AuthlibDeprecationWarning subclasses DeprecationWarning, so adding category=DeprecationWarning keeps the new filters consistent with the surrounding code and slightly narrows the match. The message regex is specific enough that this is unlikely to cause harm in practice.

LOW — test_suppress_third_party_warnings doesn't assert the new authlib filter. tests/unit_tests/mcp_service/test_mcp_server.py checks the marshmallow and google filters but not the authlib one, so it won't catch an accidental removal. An authlib_filters assertion mirroring the existing two would close the gap.

For a follow-up (not this PR): Superset's own code imports from the deprecated module (superset/mcp_service/jwt_verifier.py:38, superset/mcp_service/mcp_config.py:23), so the eventual migration off authlib.jose should cover those first-party imports too, not just the fastmcp-triggered one.