Migrate from deprecated authlib.jose to joserfc in fastmcp

[rdmueller]

Migrate from deprecated authlib.jose to joserfc in fastmcp

Problem

The authlib.jose module in the Authlib library is deprecated and should be replaced with joserfc. This deprecation warning appears in the build output and affects the JWT authentication provider in fastmcp.

Context

Currently, authlib.jose is used in:

• .workshop-tools/.venv/lib64/python3.12/site-packages/fastmcp/server/auth/providers/jwt.py
  • Uses: JsonWebKey, JsonWebToken from authlib.jose
  • Uses: JoseError from authlib.jose.errors
• .workshop-tools/.venv/lib64/python3.12/site-packages/fastmcp/server/auth/jwt_issuer.py
  • Uses: JsonWebToken from authlib.jose
  • Uses: JoseError from authlib.jose.errors

According to the Authlib documentation, authlib.jose will be removed in a future version.

Solution

Migrate to joserfc which provides compatible replacements:

• authlib.jose.JsonWebKey → joserfc.JWK
• authlib.jose.JsonWebToken → joserfc.JWS / joserfc.JWE
• Error handling with joserfc exceptions

Tasks

• Review migration guide: https://jose.authlib.org/en/dev/migrations/authlib/
• Update fastmcp dependency to latest version (with joserfc support)
• Test JWT authentication functionality after update
• Verify no deprecation warnings in build output

Acceptance Criteria

• No deprecation warnings related to authlib.jose
• All JWT authentication tests pass
• JWT token creation and validation work as before