Update module github.com/stacklok/toolhive to v0.27.2 by renovate[bot] · Pull Request #145 · stacklok/brood-box

renovate · 2026-05-09T05:02:11Z

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/stacklok/toolhive	`v0.24.0` → `v0.27.2`

Release Notes

stacklok/toolhive (github.com/stacklok/toolhive)

`v0.27.2`

Compare Source

What's Changed

Update github/codeql-action digest to 68bde55 by @renovate[bot] in #5236
Update anthropics/claude-code-action digest to 476e359 by @renovate[bot] in #5235
Forward MCPServerEntry headerForward to vMCP outbound requests by @ChrisJBurns in #5239
Tolerate spec-violating list methods on backend init by @tgrunnagle in #5232
Bump github.com/in-toto/in-toto-golang from 0.9.0 to 0.11.0 by @dependabot[bot] in #5234
Use corev1.PullPolicy instead of string for EmbeddingServer ImagePullPolicy by @Sanskarzz in #5240
Namespace operator.* Helm helpers to prevent umbrella chart collisions by @wucm667 in #5245
Recognize mcp-go authorization-required sentinels as auth by @lorr1 in #5225
Delegate tokenexchange HTTP plumbing to pkg/oauthproto by @jhrozek in #5226
Bump github.com/go-git/go-git/v5 from 5.18.0 to 5.19.0 by @dependabot[bot] in #5249
Move tokenexchange under pkg/oauthproto by @jhrozek in #5251
Apply OTEL config to workloads created via API by @reyortiz3 in #5254
Fall back across Docker sockets on connect failure by @samuv in #5246
fix(registry): surface legacy registry format as a structured API error by @peppescg in #5260
Allow operators to inject baseline scopes into DCR registrations by @jhrozek in #5233
Collapse registry provider error ladder into a helper by @rdimitrov in #5261
Update module github.com/stacklok/toolhive-catalog to v0.20260511.0 by @renovate[bot] in #5227
Update goreleaser/goreleaser-action digest to 1a80836 by @renovate[bot] in #5054
Release v0.27.2 by @toolhive-release-app[bot] in #5263

Full Changelog: stacklok/toolhive@v0.27.1...v0.27.2

`v0.27.1`

Compare Source

What's Changed

Redact webhook response body from returned errors by @JAORMX in #5191
Add omitempty to MCPGroupStatus JSON fields by @sharanrajt in #5181
Cap webhook middleware request body at 1 MB by @JAORMX in #5192
Update anthropics/claude-code-action digest to 9db782c by @renovate[bot] in #5164
Update module github.com/stacklok/toolhive-catalog to v0.20260507.0 by @renovate[bot] in #5206
Add Windows named-pipe support to the API listener by @samuv in #5201
Restrict Windows named-pipe DACL to creating user by @samuv in #5214
Add persistent DCRCredentialStore types and memory backend by @tgrunnagle in #5186
Expose explicit primaryUpstreamProvider for Cedar authz on VirtualMCPServer by @tgrunnagle in #5199
Use shared pkg/oauthproto helpers in tokenexchange by @jhrozek in #5212
Skip WARN for non-POST Streamable HTTP requests by @danbarr in #5221
Move pipe and socket URL handling to net/url by @samuv in #5215
Guard RedisStorageConfig CEL rules with has() checks by @reyortiz3 in #5228
Pin npipe round-trip and pipe lifecycle invariants by @samuv in #5216
Add Redis backend for DCRCredentialStore by @tgrunnagle in #5195
Wire persistent DCRCredentialStore into EmbeddedAuthServer by @tgrunnagle in #5196
Add CRD-runtime drift detection test framework by @ChrisJBurns in #5209
MCPGroup Ready column misleadingly shows MCPServersChecked condition by @Sanskarzz in #5241
Release v0.27.1 by @toolhive-release-app[bot] in #5244

New Contributors

@sharanrajt made their first contribution in #5181

Full Changelog: stacklok/toolhive@v0.27.0...v0.27.1

`v0.27.0`

Compare Source

What's Changed

Support CIMD as preferred OAuth client registration for thv run by @amirejaz in #5085
Add --client flag to thv llm setup and teardown by @yrobla in #5144
Carry forward upstream refresh token on re-authorization by @jhrozek in #5132
Add follow-up CIMD E2E and unit tests by @amirejaz in #5130
Add authserver DCR credential store and resolver by @tgrunnagle in #5042
Allow standalone Redis in auth server storage by @reyortiz3 in #4994
Fix golangci-lint failures from Go 1.26 linter upgrade by @reyortiz3 in #5161
Fix flaky VirtualMCPServer composite tool watch integration test by @reyortiz3 in #5163
Correct Gemini CLI LLM gateway config to proxy mode by @yrobla in #5142
Add --anthropic-path-prefix flag and auto-probe for Envoy AI Gateway by @yrobla in #5174
Phase 5: Dynamic Webhook Middleware Kubernetes Controller by @Sanskarzz in #4564
Automate Gemini CLI .env injection for LLM gateway proxy setup by @yrobla in #5175
Strengthen test assertions in llm_gateway_test.go using jsonPointerGet by @yrobla in #5187
Update github/codeql-action digest to e46ed2c by @renovate[bot] in #5165
Update aws-sdk-go-v2 monorepo by @renovate[bot] in #5166
Preserve runconfig-checksum on pod template overrides by @jhrozek in #5149
Populate LLMSetupNote for Gemini CLI to warn on --tls-skip-verify no-op by @yrobla in #5188
Publish thv llm commands and regenerate CLI reference docs by @yrobla in #5189
Set User-Agent on OAuth token refresh requests by @gkatz2 in #5168
Wire authserver DCR resolver and add structured logs by @tgrunnagle in #5044
Return *oauth2.RetrieveError from tokenexchange by @jhrozek in #5082
Update module github.com/stacklok/toolhive-catalog to v0.20260504.0 by @renovate[bot] in #5118
fix(#5063): deterministically order env vars in DeployWorkload by @nalditopr in #5064
fix(api,cli): stop auto-deriving RFC 8707 resource indicator from URL by @peppescg in #5204
Expose DCR config in operator CRD for OAuth2 upstreams by @tgrunnagle in #5069
Install local skill builds by name when tag differs by @samuv in #5182
Add identity extractor for OAuth2 token responses by @jhrozek in #5200
Add Redis Cluster mode support to auth server storage by @reyortiz3 in #5153
Release v0.27.0 by @toolhive-release-app[bot] in #5207

New Contributors

@nalditopr made their first contribution in #5064

Full Changelog: stacklok/toolhive@v0.26.1...v0.27.0

`v0.26.1`

Compare Source

What's Changed

Make Cedar group entity type name configurable by @jhrozek in #5121
Add authserver DCR discovery and config surface by @tgrunnagle in #5041
fix(authserver): send scope explicitly on upstream token refresh by @dallinstevens in #5096
test(e2e): add all-client LLM gateway e2e matrix + fix secret provider bugs by @yrobla in #5116
Add --tls-skip-verify flag to thv llm setup, config set, and proxy start by @yrobla in #5136
Auto-detect Docker Desktop socket on Linux by @samuv in #5122
Consolidate ToolApplyConfig and LLMApplyConfig into pkg/llmgateway by @yrobla in #5138
Include nested files when resolving git skills by @samuv in #5139
Release v0.26.1 by @toolhive-release-app[bot] in #5140

New Contributors

@dallinstevens made their first contribution in #5096

Full Changelog: stacklok/toolhive@v0.26.0...v0.26.1

`v0.26.0`

Compare Source

What's Changed

Drop legacy ToolHive registry format references from docs by @rdimitrov in #5087
Update module github.com/stacklok/toolhive-catalog to v0.20260428.0 by @renovate[bot] in #5080
Update module github.com/shirou/gopsutil/v4 to v4.26.3 by @renovate[bot] in #5061
Add interactive TUI dashboard for managing MCP servers by @peppescg in #4680
Introduce LLMClientApp type to remove xcode from MCP API swagger enum by @yrobla in #5081
Strengthen tool detection with binary presence check by @yrobla in #5083
Add awsSts auth type support to vMCP by @tgrunnagle in #5019
Update module github.com/moby/moby/client to v0.4.1 by @renovate[bot] in #5059
thv llm: complete setup/teardown orchestration by @yrobla in #5068
Align REGISTRY.md with configYAML-only MCPRegistry spec by @rdimitrov in #5088
ci(release): mint GitHub App installation token instead of RELEASE_TOKEN PAT by @Nashon-Steffen in #5093
Wire MCPRemoteProxy resourceOverrides.proxyDeployment.imagePullSecrets by @JAORMX in #5103
Extract shared OAuthTokenSource into pkg/auth/tokensource by @yrobla in #5090
fix(llm): use correct binary name for VS Code Insiders detection by @yrobla in #5109
Preserve user fields in EmbeddingServer podTemplateSpec merge by @JAORMX in #5104
Add explicit imagePullSecrets field to VirtualMCPServer by @JAORMX in #5107
Add explicit imagePullSecrets field to MCPRegistry by @JAORMX in #5106
Move llm setup/teardown orchestration to pkg/llm by @yrobla in #5112
Add missing encoding/json import to virtualmcpserver_deployment.go by @jhrozek in #5114
fix(test): use require instead of assert in TestBuildServerConfig to prevent nil panic by @wucm667 in #5098
Detect imagePullSecrets drift on proxy Deployments by @jhrozek in #5113
Add operator-level defaultImagePullSecrets across all controllers by @JAORMX in #5105
Fix non-expiring upstream token handling and storage TTL bugs by @jhrozek in #5092
Allow OAuth2 upstreams to omit userInfo config by @tgrunnagle in #5094
Release v0.26.0 by @toolhive-release-app[bot] in #5131

New Contributors

@wucm667 made their first contribution in #5098
@toolhive-release-app[bot] made their first contribution in #5131

Full Changelog: stacklok/toolhive@v0.25.0...v0.26.0

`v0.25.0`

Compare Source

What's Changed

Add thv llm command group with config types and management commands by @yrobla in #5032
Improvements for the vmcp e2e test infrastructure by @yrobla in #5026
pkg/llm: implement OIDC token source and thv llm token command by @yrobla in #5033
llm: extract shared OIDC config, move business logic to pkg/llm, add E2E tests by @yrobla in #5049
Expose hook for embedder-driven MCP elicitation by @JAORMX in #4934
Treat 401/403 from auth-configured backends as healthy by @JAORMX in #4935
Update dockerfile template base images by @renovate[bot] in #5058
Update anthropics/claude-code-action digest to 567fe95 by @renovate[bot] in #5053
Add localhost reverse proxy for LLM gateway by @yrobla in #5035
pkg/llm: fix withPreemptiveRefresh composition and stale _AT on rotation by @yrobla in #5052
Rename pkg/oauth to pkg/oauthproto and move DCR primitives by @tgrunnagle in #5036
Apply request version to tag-less skill OCI install ref by @samuv in #5078
Add thv registry convert command by @rdimitrov in #5071
Strip Content-Length when wrapping tool filter response by @danbarr in #5077
Drop legacy registry format support by @rdimitrov in #5067
Update aws-sdk-go-v2 monorepo by @renovate[bot] in #5057
Update module golang.ngrok.com/ngrok/v2 to v2.1.4 by @renovate[bot] in #5062
Classify packager errors as 400 in skill build handler by @samuv in #5076
Add tool adapter registry and per-tool LLM gateway implementations by @yrobla in #5065
Add pkg/oauth grant-helper primitives by @jhrozek in #5045
Release v0.25.0 by @stacklokbot in #5084

Full Changelog: stacklok/toolhive@v0.24.1...v0.25.0

`v0.24.1`

Compare Source

What's Changed

Bump releaseo_version input to v0.0.4 by @ChrisJBurns in #5007
Honor --debug flag in vmcp by @jhrozek in #5008
Fix Cedar upstream-claim evaluation on VirtualMCPServer by @jhrozek in #5002
Add shared OAuth constants and expose ExchangeConfig fields by @jhrozek in #5003
Fix MCPRegistry probe port and bump registry image to v1.3.0 by @rdimitrov in #5020
Add JWT/OIDC and Redis session storage vMCP CLI e2e tests by @yrobla in #4998
Update module github.com/stacklok/toolhive-catalog to v0.20260423.0 by @renovate[bot] in #5021
Classify OCI pull errors and fall back to git for skills content API by @samuv in #5014
Document scalability limits and constraints by @yrobla in #5025
Introduce MutateAndPatchSpec and adopt across spec-patch sites by @jhrozek in #5004
Gate proxyrunner StatefulSet apply by MCPServer generation by @JAORMX in #5024
Release v0.24.1 by @stacklokbot in #5034

Full Changelog: stacklok/toolhive@v0.24.0...v0.24.1

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate · 2026-05-09T05:02:12Z

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

22 additional dependencies were updated

Details:

Package	Change
`github.com/stacklok/toolhive-core`	`v0.0.16` -> `v0.0.17`
`github.com/aws/aws-sdk-go-v2`	`v1.41.5` -> `v1.41.7`
`github.com/aws/aws-sdk-go-v2/config`	`v1.32.14` -> `v1.32.17`
`github.com/aws/aws-sdk-go-v2/credentials`	`v1.19.14` -> `v1.19.16`
`github.com/aws/aws-sdk-go-v2/feature/ec2/imds`	`v1.18.21` -> `v1.18.23`
`github.com/aws/aws-sdk-go-v2/internal/configsources`	`v1.4.21` -> `v1.4.23`
`github.com/aws/aws-sdk-go-v2/internal/endpoints/v2`	`v2.7.21` -> `v2.7.23`
`github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding`	`v1.13.7` -> `v1.13.9`
`github.com/aws/aws-sdk-go-v2/service/internal/presigned-url`	`v1.13.21` -> `v1.13.23`
`github.com/aws/aws-sdk-go-v2/service/signin`	`v1.0.9` -> `v1.0.11`
`github.com/aws/aws-sdk-go-v2/service/sso`	`v1.30.15` -> `v1.30.17`
`github.com/aws/aws-sdk-go-v2/service/ssooidc`	`v1.35.19` -> `v1.35.21`
`github.com/aws/aws-sdk-go-v2/service/sts`	`v1.41.10` -> `v1.42.1`
`github.com/aws/smithy-go`	`v1.24.2` -> `v1.25.1`
`github.com/docker/go-connections`	`v0.6.0` -> `v0.7.0`
`github.com/mark3labs/mcp-go`	`v0.48.0` -> `v0.49.0`
`github.com/moby/moby/api`	`v1.54.1` -> `v1.54.2`
`github.com/moby/moby/client`	`v0.4.0` -> `v0.4.1`
`github.com/modelcontextprotocol/registry`	`v1.6.0` -> `v1.7.0`
`github.com/shirou/gopsutil/v4`	`v4.26.2` -> `v4.26.3`
`golang.ngrok.com/ngrok/v2`	`v2.1.2` -> `v2.1.4`
`golang.org/x/exp`	`v0.0.0-20260312153236-7ab1446f8b90` -> `v0.0.0-20260410095643-746e56fc9e2f`

renovate Bot force-pushed the renovate/github.com-stacklok-toolhive-0.x branch from 2246e8a to 419198d Compare May 11, 2026 15:37

renovate Bot changed the title ~~Update module github.com/stacklok/toolhive to v0.27.0~~ Update module github.com/stacklok/toolhive to v0.27.1 May 11, 2026

Update module github.com/stacklok/toolhive to v0.27.2

9cd5265

renovate Bot force-pushed the renovate/github.com-stacklok-toolhive-0.x branch from 419198d to 9cd5265 Compare May 12, 2026 16:14

renovate Bot changed the title ~~Update module github.com/stacklok/toolhive to v0.27.1~~ Update module github.com/stacklok/toolhive to v0.27.2 May 12, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update module github.com/stacklok/toolhive to v0.27.2#145

Update module github.com/stacklok/toolhive to v0.27.2#145
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/github.com-stacklok-toolhive-0.x

renovate Bot commented May 9, 2026 •

edited

Loading

Uh oh!

renovate Bot commented May 9, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented May 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v0.27.2

What's Changed

v0.27.1

What's Changed

New Contributors

v0.27.0

What's Changed

New Contributors

v0.26.1

What's Changed

New Contributors

v0.26.0

What's Changed

New Contributors

v0.25.0

What's Changed

v0.24.1

What's Changed

Configuration

Uh oh!

renovate Bot commented May 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

ℹ️ Artifact update notice

File name: go.mod

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented May 9, 2026 •

edited

Loading

`v0.27.2`

`v0.27.1`

`v0.27.0`

`v0.26.1`

`v0.26.0`

`v0.25.0`

`v0.24.1`

renovate Bot commented May 9, 2026 •

edited

Loading