fix(auth): silence authlib.jose DeprecationWarning at JWT import (#4100)

Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>

src/fastmcp/server/auth/jwt_issuer.py

@@ -9,10 +9,23 @@ from __future__ import annotations
 
 import base64
 import time
+import warnings
 from typing import Any, overload
 
-from authlib.jose import JsonWebToken
-from authlib.jose.errors import JoseError
+with warnings.catch_warnings():
+    # authlib.jose emits AuthlibDeprecationWarning on import; suppress it so
+    # importing this module does not trigger the warning under
+    # `warnings.simplefilter("error")`. The `authlib.deprecate` import lives
+    # inside this block too: importing it for the first time runs
+    # `warnings.simplefilter("always", AuthlibDeprecationWarning)` at module
+    # scope, which would otherwise leak past `catch_warnings()` and clobber
+    # the caller's filter for subsequent Authlib deprecations. See
+    # jlowin/fastmcp#4098.
+    from authlib.deprecate import AuthlibDeprecationWarning
+
+    warnings.simplefilter("ignore", AuthlibDeprecationWarning)
+    from authlib.jose import JsonWebToken
+    from authlib.jose.errors import JoseError
 from cryptography.hazmat.primitives import hashes
 from cryptography.hazmat.primitives.kdf.hkdf import HKDF
 from cryptography.hazmat.primitives.kdf.pbkdf2 import PBKDF2HMAC

src/fastmcp/server/auth/providers/jwt.py

@@ -5,12 +5,26 @@ from __future__ import annotations
 import contextlib
 import json
 import time
+import warnings
 from dataclasses import dataclass
 from typing import Any, cast
 
 import httpx
-from authlib.jose import JsonWebKey, JsonWebToken
-from authlib.jose.errors import JoseError
+
+with warnings.catch_warnings():
+    # authlib.jose emits AuthlibDeprecationWarning on import; suppress it so
+    # importing this provider does not trigger the warning under
+    # `warnings.simplefilter("error")`. The `authlib.deprecate` import lives
+    # inside this block too: importing it for the first time runs
+    # `warnings.simplefilter("always", AuthlibDeprecationWarning)` at module
+    # scope, which would otherwise leak past `catch_warnings()` and clobber
+    # the caller's filter for subsequent Authlib deprecations. See
+    # jlowin/fastmcp#4098.
+    from authlib.deprecate import AuthlibDeprecationWarning
+
+    warnings.simplefilter("ignore", AuthlibDeprecationWarning)
+    from authlib.jose import JsonWebKey, JsonWebToken
+    from authlib.jose.errors import JoseError
 from cryptography.hazmat.primitives import serialization
 from cryptography.hazmat.primitives.asymmetric import rsa
 from pydantic import AnyHttpUrl, SecretStr