From aaff9243a3aea7a0f6d6d685faada53bb38a87c3 Mon Sep 17 00:00:00 2001
From: Sarthak Bhardwaj <100398847+SarthakB11@users.noreply.github.com>
Date: Thu, 7 May 2026 20:57:08 +0530
Subject: [PATCH] fix(auth): silence authlib.jose DeprecationWarning at JWT
 import (#4100)

Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>
---
 src/fastmcp/server/auth/jwt_issuer.py    | 17 +++++++++++++++--
 src/fastmcp/server/auth/providers/jwt.py | 18 ++++++++++++++++--
 2 files changed, 31 insertions(+), 4 deletions(-)

diff --git a/src/fastmcp/server/auth/jwt_issuer.py b/src/fastmcp/server/auth/jwt_issuer.py
index 78635b90c..15996efd4 100644
--- a/src/fastmcp/server/auth/jwt_issuer.py
+++ b/src/fastmcp/server/auth/jwt_issuer.py
@@ -9,10 +9,23 @@ from __future__ import annotations
 
 import base64
 import time
+import warnings
 from typing import Any, overload
 
-from authlib.jose import JsonWebToken
-from authlib.jose.errors import JoseError
+with warnings.catch_warnings():
+    # authlib.jose emits AuthlibDeprecationWarning on import; suppress it so
+    # importing this module does not trigger the warning under
+    # `warnings.simplefilter("error")`. The `authlib.deprecate` import lives
+    # inside this block too: importing it for the first time runs
+    # `warnings.simplefilter("always", AuthlibDeprecationWarning)` at module
+    # scope, which would otherwise leak past `catch_warnings()` and clobber
+    # the caller's filter for subsequent Authlib deprecations. See
+    # jlowin/fastmcp#4098.
+    from authlib.deprecate import AuthlibDeprecationWarning
+
+    warnings.simplefilter("ignore", AuthlibDeprecationWarning)
+    from authlib.jose import JsonWebToken
+    from authlib.jose.errors import JoseError
 from cryptography.hazmat.primitives import hashes
 from cryptography.hazmat.primitives.kdf.hkdf import HKDF
 from cryptography.hazmat.primitives.kdf.pbkdf2 import PBKDF2HMAC
diff --git a/src/fastmcp/server/auth/providers/jwt.py b/src/fastmcp/server/auth/providers/jwt.py
index 2417cd067..9b73e6ae9 100644
--- a/src/fastmcp/server/auth/providers/jwt.py
+++ b/src/fastmcp/server/auth/providers/jwt.py
@@ -5,12 +5,26 @@ from __future__ import annotations
 import contextlib
 import json
 import time
+import warnings
 from dataclasses import dataclass
 from typing import Any, cast
 
 import httpx
-from authlib.jose import JsonWebKey, JsonWebToken
-from authlib.jose.errors import JoseError
+
+with warnings.catch_warnings():
+    # authlib.jose emits AuthlibDeprecationWarning on import; suppress it so
+    # importing this provider does not trigger the warning under
+    # `warnings.simplefilter("error")`. The `authlib.deprecate` import lives
+    # inside this block too: importing it for the first time runs
+    # `warnings.simplefilter("always", AuthlibDeprecationWarning)` at module
+    # scope, which would otherwise leak past `catch_warnings()` and clobber
+    # the caller's filter for subsequent Authlib deprecations. See
+    # jlowin/fastmcp#4098.
+    from authlib.deprecate import AuthlibDeprecationWarning
+
+    warnings.simplefilter("ignore", AuthlibDeprecationWarning)
+    from authlib.jose import JsonWebKey, JsonWebToken
+    from authlib.jose.errors import JoseError
 from cryptography.hazmat.primitives import serialization
 from cryptography.hazmat.primitives.asymmetric import rsa
 from pydantic import AnyHttpUrl, SecretStr