[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/stacklok/toolhive	v0.52.0 → v0.58.0

---

Release Notes

stacklok/toolhive (github.com/stacklok/toolhive)

v0.58.0

Compare Source

What's Changed

• Add opt-in at+jwt typ for embedded AS access tokens by @​jhrozek in #​6942
• Refuse refresh grants whose upstream credential is dead by @​tgrunnagle in #​6930
• Stop serving delegate clients removed from config by @​jhrozek in #​6945
• Fix authserver test build on main by @​jhrozek in #​6950
• Rename embedded-auth ConfigMap ref helpers by @​jhrozek in #​6951
• Skip upstream identity capture when sub_id is off by @​jhrozek in #​6956
• Update k8s.io/utils digest to ca04ba5 by @​renovate[bot] in #​6933
• Release v0.58.0 by @​toolhive-release-app[bot] in #​6957

Full Changelog: stacklok/toolhive@v0.57.0...v0.58.0

v0.57.0

Compare Source

What's Changed

• Parse SKILL.md with maintained YAML fork by @​rdimitrov in #​6919
• Let delegate clients change policy on restart by @​jhrozek in #​6918
• Let embedders refuse refresh grants on dead upstreams by @​tgrunnagle in #​6902
• Mount workload auth secrets in inline mode by @​hellouz818 in #​6905
• Support authorization_details on token exchange by @​jhrozek in #​6921
• Reject request bodies on non-POST methods by @​peppescg in #​6806
• Add dcrConfig.registrationProbe with an authorization-endpoint strategy by @​aron-muon in #​6834
• Add opt-in upstream subject identifiers by @​jhrozek in #​6908
• Move remaining YAML parsing to go.yaml.in/yaml/v3 by @​rdimitrov in #​6920
• Classify MCPRemoteProxy pods by container readiness, not phase alone by @​feiiiiii5 in #​6765
• Decouple authserver identity from host auth types by @​jhrozek in #​6923
• test(vmcp): pin that the health path never opens a standalone GET stream by @​jstar0 in #​6520
• Wire OIDC transport flags into thv run auth middleware config by @​7487 in #​6529
• Fix vMCP incoming OIDC client secret resolution by @​xianshujun in #​6904
• Update docker images by @​renovate[bot] in #​6934
• Update issue triage model to Sonnet 5.5 by @​eleftherias in #​6943
• Read required environment variable prompts as a whole line by @​feiiiiii5 in #​6781
• Add backend-scoped vMCP authorization by @​Sanskarzz in #​6487
• Update github actions by @​renovate[bot] in #​6935
• Update go modules by @​renovate[bot] in #​6936
• Show upstream display name on consent page by @​tgrunnagle in #​6929
• Release v0.57.0 by @​toolhive-release-app[bot] in #​6947

New Contributors

• @​7487 made their first contribution in #​6529
• @​xianshujun made their first contribution in #​6904

Full Changelog: stacklok/toolhive@v0.56.0...v0.57.0

v0.56.0

Compare Source

What's Changed

• Add OSS Scanner audit configuration by @​rdimitrov in #​6874
• Make unit tests pass as root and without a container runtime by @​rdimitrov in #​6875
• Cover the embedded auth server in threat model by @​jhrozek in #​6879
• Add native Go fuzz targets for untrusted parsers by @​rdimitrov in #​6877
• Decode IPv4 in IPv4-compatible and SIIT addresses by @​rdimitrov in #​6878
• Let embedders skip consent for preauthorized clients by @​jhrozek in #​6882
• Cap DCR clients and expire unused ones after 24h by @​tgrunnagle in #​6863
• Expose DCR client cap and register rate limit in CRD by @​tgrunnagle in #​6867
• Enable Claude Code gateway model discovery by @​jerm-dro in #​6862
• Answer 401 when a token session holds no upstream access token by @​alex-feel in #​6846
• Verify row ownership in Redis upstream token read by @​hellouz818 in #​6876
• Add coverage for -32601 under HTTP error statuses by @​hellouz818 in #​6873
• Test client response posts across handlers by @​jstar0 in #​5885
• Fix field names in external-auth examples by @​3nesdeniz in #​6330
• Add auth server TLS listener and SPIFFE middleware by @​jhrozek in #​6843
• Start auth server TLS listener in vMCP by @​jhrozek in #​6891
• Explain LLM gateway model-discovery failures by @​jerm-dro in #​6884
• Fix Claude Desktop paths and managed check on Linux by @​jerm-dro in #​6883
• Release v0.56.0 by @​toolhive-release-app[bot] in #​6917

New Contributors

• @​3nesdeniz made their first contribution in #​6330

Full Changelog: stacklok/toolhive@v0.55.2...v0.56.0

v0.55.2

Compare Source

Security

Rootless Podman host-access endpoints blocked by the egress proxy (GHSA-2x65-h9w3-h7hc, Medium)

With network isolation on rootless Podman, a workload could reach host services through the Squid or Envoy egress proxy using host.containers.internal or the address it maps to. ToolHive's protected set only covered Docker's host names and bridge gateways, and Podman's host-access address is not necessarily a bridge gateway.

On Podman, ToolHive now reads the DNS sidecar's runtime-generated /etc/hosts at deployment. It adds every address mapped to host.containers.internal, host.docker.internal, or gateway.docker.internal to the protected set, alongside all bridge gateways. Both proxies block those names and addresses unless --allow-docker-gateway is set.

What changes for operators

• On Podman, deployment fails before the proxy or MCP container starts if host.containers.internal is missing from the runtime's hosts file (for example with no_hosts = true in containers.conf), or if the hosts data cannot be read. This applies even with --allow-docker-gateway.
• The protected set is a deployment-time snapshot. Redeploy workloads after changing Podman's host mappings, rootless networking mode, or bridge networks.

What's Changed

• Use postflight_steps for the thv Homebrew cask hook by @​rdimitrov in #​6870
• Update go modules to v0.0.57 by @​renovate[bot] in #​6869
• Release v0.55.2 by @​toolhive-release-app[bot] in #​6871

Full Changelog: stacklok/toolhive@v0.55.1...v0.55.2

v0.55.1

Compare Source

What's Changed

• Fix flaky ignore overlay tests from shared artifact dir by @​rdimitrov in #​6854
• Publish thv to Homebrew as a cask by @​rdimitrov in #​6859
• Fix Podman client creation with compat transport by @​rdimitrov in #​6860
• Drop Go patch pin, bump toolhive-catalog, stop e2e pings by @​rdimitrov in #​6866
• Release v0.55.1 by @​toolhive-release-app[bot] in #​6868

Full Changelog: stacklok/toolhive@v0.55.0...v0.55.1

v0.55.0

Compare Source

What's Changed

• Return release notes via structured output by @​rdimitrov in #​6826
• Bump x/net and x/text in the Go SDK module by @​rdimitrov in #​6828
• Add dcrConfig.rotationKey to re-register upstream DCR clients by @​aron-muon in #​6825
• Allow omitting scope on upstream token refresh by @​hellouz818 in #​6832
• Close terminated vMCP sessions instead of waiting for eviction by @​hellouz818 in #​6807
• Clarify session eviction cleanup guarantees by @​JAORMX in #​6833
• Expose group-based upstream filter via vMCP CRD by @​hellouz818 in #​6740
• Re-register DCR clients the upstream evicted by @​peppescg in #​6822
• Add TLS listener config and SPIFFE X.509 authority capability by @​jhrozek in #​6760
• Codify conventions stated in recent code reviews by @​alex-feel in #​6812
• Support Pi in LLM gateway setup by @​jerm-dro in #​6818
• Honor PI_CODING_AGENT_DIR for Pi MCP and skills by @​jerm-dro in #​6839
• Grant pods/attach only for stdio transport by @​hellouz818 in #​6841
• Add thv client connector for Claude Desktop by @​jerm-dro in #​6840
• Update github actions by @​renovate[bot] in #​6849
• Update go modules by @​renovate[bot] in #​6850
• Update golang.org/x/exp/jsonrpc2 digest to f0251eb by @​renovate[bot] in #​6848
• Update docker images by @​renovate[bot] in #​6851
• Fix codespell hits in vMCP resource validation by @​rdimitrov in #​6853
• Release v0.55.0 by @​toolhive-release-app[bot] in #​6855

Full Changelog: stacklok/toolhive@v0.54.0...v0.55.0

v0.54.0

Compare Source

What's Changed

• Update module github.com/stacklok/toolhive-catalog to v0.20261013.0 by @​renovate[bot] in #​6816
• Extract exact-ID decode from DecodeMessage by @​jhrozek in #​6820
• Add Pi coding agent as a supported MCP client by @​danbarr in #​6819
• Add SPIFFE file bundle source by @​jhrozek in #​6759
• Refresh upstream tokens when the ID token expires by @​tgrunnagle in #​6773
• Narrow OIDC referrer watches to ref changes by @​Sriram-PR in #​6706
• Fix lint in RSA client key validation by @​rdimitrov in #​6824
• Release v0.54.0 by @​toolhive-release-app[bot] in #​6823

New Contributors

• @​Sriram-PR made their first contribution in #​6706

Full Changelog: stacklok/toolhive@v0.53.0...v0.54.0

v0.53.0

Compare Source

🚀 Toolhive v0.53.0 is live!

This release adds group-based upstream selection to the vMCP embedded auth server, and stops the operator from acting on spec.permissionProfile as a security fix. It also makes vMCP keep a backend's valid tools when one of its items can't be decoded, and makes MCPRemoteProxy report config failures correctly.

🔄 Deprecations

• MCPServer.spec.permissionProfile is deprecated and the Kubernetes operator now ignores it. The field still exists in the v1beta1 CRD so existing manifests keep applying, but it never restricted pods in Kubernetes. Use podTemplateSpec security contexts and NetworkPolicy resources instead. MCPServers that set the field get a PermissionProfileUnsupported Warning event. No removal version has been announced yet. (security fix, commit d5aa374)

🆕 New Features

• vMCP operators using the embedded auth server can set an upstream filter in authserver-config.yaml. It picks which extra upstream providers each user goes through, based on group claims from the first upstream, so users skip OAuth legs for services they have no account on. The feature is opt-in and fails closed when the group claim is missing. CRD support follows in #​6740. (#​6739)

🐛 Bug Fixes

• The operator no longer passes spec.permissionProfile to the runner as a profile name or file path. Before, a crafted value could make the operator read arbitrary local files. The configmap profile volume is no longer mounted, and thv export --format k8s no longer emits the field. MCPServers that set the field may roll their proxy pods once after upgrading. (d5aa374)
• When a referenced config fails to resolve, MCPRemoteProxy now reports Ready=False with a message naming the failing handler and an up-to-date observedGeneration. Before, it could show Phase: Failed while still reporting a stale Ready=True. (#​6776)
• vMCP now skips individual tools/list, resources/list, resource-template and prompt items it cannot decode, and logs a warning naming the backend and the item. Before, one bad item hid all of that backend's capabilities. This applies to the Modern list path only; the Legacy path is tracked in #​6814. (#​6772)
• Tools whose top-level schema type is a JSON Schema type array (for example ["object","null"]) are now kept, with the schema passed through unchanged, because toolhive-core is bumped to v0.0.52. (#​6815)

📦 Dependencies

Module	Version
github.com/stacklok/toolhive-core	v0.0.52
ghcr.io/modelcontextprotocol/inspector (default thv inspector image)	2.10.1
github.com/go-chi/chi/v5	v5.4.0
github.com/aws/aws-sdk-go-v2	v1.47.3
github.com/aws/aws-sdk-go-v2/config	v1.33.9
github.com/aws/aws-sdk-go-v2/service/sts	v1.51.4
github.com/pressly/goose/v3	v3.29.0
github.com/prometheus/common	v0.72.1
github.com/onsi/ginkgo/v2	v2.33.1
github.com/alicebob/miniredis/v2	v2.40.0
golang.org/x/crypto	v0.58.0
golang.org/x/mod	v0.42.0
golang.org/x/net	v0.61.0
golang.org/x/sync	v0.24.0
golang.org/x/sys	v0.49.0
golang.org/x/term	v0.47.0
golang.org/x/exp/jsonrpc2	faecfb2
oras.land/oras-go/v2	v2.6.3
python (e2e test image)	3.15-slim
GitHub Actions (create-github-app-token, download-artifact, setup-node, upload-artifact, claude-code-action, codeql-action, goreleaser-action, kind-action)	latest patch/minor

👋 Welcome to our newest contributor: @​feiiiiii5 🎉

Full commit log

What's Changed

• Update github actions by @​renovate[bohttps://github.com/stacklok/toolhive/pull/6775l/6775
• Add group-based upstream filter for vMCP auth by @​hellouz8https://github.com/stacklok/toolhive/pull/6739l/6739
• Update docker images by @​renovate[bohttps://github.com/stacklok/toolhive/pull/6778l/6778
• Update golang.org/x/exp/jsonrpc2 digest to faecfb2 by @​renovate[bohttps://github.com/stacklok/toolhive/pull/6774l/6774
• Record config-handler failures on the MCPRemoteProxy status by @​feiiiiihttps://github.com/stacklok/toolhive/pull/6776l/6776
• Update go modules by @​renovate[bohttps://github.com/stacklok/toolhive/pull/6777l/6777
• Skip undecodable items in Modern list responses by @​reyortihttps://github.com/stacklok/toolhive/pull/6772l/6772
• Bump toolhive-core to v0.0.52 by @​reyortihttps://github.com/stacklok/toolhive/pull/6815l/6815
• Release v0.53.0 by @​toolhive-release-app[bohttps://github.com/stacklok/toolhive/pull/6817l/6817

New Contributors

• @​feiiiiii5 made their first contributihttps://github.com/stacklok/toolhive/pull/6776l/6776

Full Changelog: stacklok/toolhive@v0.52.0...v0.53.0

🔗 Full changelog: stacklok/toolhive@v0.52.0...v0.53.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 52 additional dependencies were updated

Details:

Package	Change
github.com/stacklok/toolhive-core	v0.0.51 -> v0.0.57
go.opentelemetry.io/otel/exporters/stdout/stdouttrace	v1.46.0 -> v1.47.0
golang.org/x/crypto	v0.57.0 -> v0.58.0
cel.dev/expr	v0.25.2 -> v0.25.3
github.com/Microsoft/go-winio	v0.6.3 -> v0.6.4
github.com/ProtonMail/go-crypto	v1.4.1 -> v1.5.2
github.com/aws/aws-sdk-go-v2	v1.47.2 -> v1.47.4
github.com/aws/aws-sdk-go-v2/config	v1.33.8 -> v1.33.10
github.com/aws/aws-sdk-go-v2/credentials	v1.20.8 -> v1.20.10
github.com/aws/aws-sdk-go-v2/feature/ec2/imds	v1.20.2 -> v1.20.4
github.com/aws/aws-sdk-go-v2/internal/configsources	v1.5.5 -> v1.5.7
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2	v2.8.5 -> v2.8.7
github.com/aws/aws-sdk-go-v2/internal/v4a	v1.5.5 -> v1.5.7
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding	v1.13.20 -> v1.13.22
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url	v1.14.5 -> v1.14.7
github.com/aws/aws-sdk-go-v2/service/signin	v1.10.3 -> v1.10.5
github.com/aws/aws-sdk-go-v2/service/sso	v1.38.3 -> v1.38.5
github.com/aws/aws-sdk-go-v2/service/ssooidc	v1.43.3 -> v1.43.5
github.com/aws/aws-sdk-go-v2/service/sts	v1.51.3 -> v1.51.5
github.com/aws/smithy-go	v1.28.4 -> v1.28.6
github.com/cloudflare/circl	v1.6.3 -> v1.6.5
github.com/docker/cli	v29.7.2+incompatible -> v29.9.1+incompatible
github.com/docker/docker-credential-helpers	v0.9.5 -> v0.9.10
github.com/dustin/go-humanize	v1.0.1 -> v1.1.0
github.com/ebitengine/purego	v0.11.1 -> v0.11.2
github.com/go-chi/chi/v5	v5.3.2 -> v5.5.0
github.com/go-jose/go-jose/v4	v4.1.5 -> v4.1.6
github.com/go-openapi/jsonpointer	v1.0.1 -> v1.0.2
github.com/go-openapi/jsonreference	v1.0.2 -> v1.0.3
github.com/grpc-ecosystem/grpc-gateway/v2	v2.31.0 -> v2.32.0
github.com/klauspost/compress	v1.19.2 -> v1.20.3
github.com/lestrrat-go/jwx/v4	v4.5.0 -> v4.6.0
github.com/modelcontextprotocol/registry	v1.8.1 -> v1.8.5
github.com/ncruces/go-strftime	v1.0.0 -> v1.1.0
github.com/power-devops/perfstat	v0.0.0-20260805114148-88456608a4f6 -> v0.0.0-20260916203055-22a1a467d9f0
github.com/prometheus/client_golang	v1.24.1 -> v1.25.0
github.com/prometheus/common	v0.72.0 -> v0.72.1
github.com/stacklok/toolhive-core/redisconn	v0.0.2 -> v0.0.57
golang.ngrok.com/ngrok/v2	v2.2.0 -> v2.4.0
golang.org/x/exp	v0.0.0-20260908205506-85c1c2202aba -> v0.0.0-20261014143641-f0251eb4aa3e
golang.org/x/exp/event	v0.0.0-20260824195058-e88cd73687aa -> v0.0.0-20261009195045-ca0d7ba23607
golang.org/x/exp/jsonrpc2	v0.0.0-20260908205506-85c1c2202aba -> v0.0.0-20261014143641-f0251eb4aa3e
golang.org/x/mod	v0.41.0 -> v0.42.0
golang.org/x/net	v0.60.0 -> v0.61.0
golang.org/x/text	v0.42.0 -> v0.43.0
golang.org/x/tools	v0.50.0 -> v0.52.0
google.golang.org/genproto/googleapis/api	v0.0.0-20260928230214-8a89bd6388cc -> v0.0.0-20261012220534-4341edf3f941
google.golang.org/genproto/googleapis/rpc	v0.0.0-20260928230214-8a89bd6388cc -> v0.0.0-20261012220534-4341edf3f941
k8s.io/utils	v0.0.0-20260707023825-cf1189d6abe3 -> v0.0.0-20261023123148-ca04ba58ecab
modernc.org/libc	v1.77.1 -> v1.79.0
modernc.org/sqlite	v1.60.1 -> v1.61.0
oras.land/oras-go/v2	v2.6.2 -> v2.7.0