rusackas commented on PR #41259: URL: https://github.com/apache/superset/pull/41259#issuecomment-4782288886
The fastmcp 3.2.4 → 3.4.2 bump is a genuine breaking change that needs manual work before this can merge. **What changed:** fastmcp 3.4.2 switched its internal JWT library from `authlib` (`JsonWebToken`) to `joserfc`. The `JWTVerifier.jwt` instance attribute — which was a `JsonWebToken` object — no longer exists in 3.4.2. **What breaks:** `superset/mcp_service/jwt_verifier.py` line ~568 calls `self.jwt.decode(token, verification_key)` (inherited from `JWTVerifier`). This attribute is gone in 3.4.2. All 19 tests in `tests/unit_tests/mcp_service/test_jwt_verifier.py` patch `hs256_verifier.jwt` and fail with `AttributeError: 'DetailedJWTVerifier' object has no attribute 'jwt'`. **Fix needed:** `DetailedJWTVerifier.load_access_token` and the corresponding tests need to be adapted to the new `joserfc`-based API in the parent class. Not a one-liner — needs a real look at the authentication path. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
