Update stacklok/toolhive to v0.46.0 - #1125
Conversation
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
renovate
Bot
added
the
autogen-docs
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Claude finished @renovate[bot]'s task in 6m 57s —— View job Upstream release docs sync: stacklok/toolhive v0.46.0Committed Impact map (verified against source at tag v0.46.0)
Files changed (hand-written)
Todos
Branch: |
- Add a "Trust a private CA for the upstream provider" section to the K8s embedded auth server guide covering the new caBundleRef field on OIDC and OAuth2 upstream providers. - Cross-link the vMCP embedded auth server guide to the new K8s section. - Update the CIMD document rules on both pages to reflect token_endpoint_auth_method negotiation via a supported-methods list containing "none". Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
|
Claude finished @renovate[bot]'s task in 6m 3s —— View job Editorial review complete
Findings and fixesFactual correction (both files). The v0.46.0 draft claimed that a CIMD document declaring a symmetric shared-secret Editorial polish (K8s file only).
Pushed as ed77850 to |
- The upstream fetcher rejects symmetric shared-secret token_endpoint_auth_method values outright; only asymmetric methods (for example, private_key_jwt) can be negotiated down to none via the token_endpoint_auth_methods_supported list. Rewrite the rule and the two troubleshooting entries to match. - Use the already-introduced DCR acronym in the new CA-trust section and change "independent from" to "independent of". Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
1 participant
This PR contains the following updates:
v0.45.0→v0.46.0After this PR opens,
.github/workflows/upstream-release-docs.ymladds source-verified content edits for the new release. Forstacklok/toolhive, the same workflow also syncs reference assets (CLI help, Swagger) and regenerates the CRD MDX pages.Release Notes
stacklok/toolhive (stacklok/toolhive)
v0.46.0Compare Source
🚀 Toolhive v0.46.0 is live!
An authentication and supply-chain hardening release: embedded auth servers can now trust private CAs for upstream identity providers, plugin upgrades refuse silent signer rotations, and three OAuth flows return the right answer instead of a misleading one.
🆕 New Features
caBundleRefon an OIDC or OAuth2 upstream, which adds that CA to the system trust roots for discovery, token, user-info, and dynamic client registration calls to that upstream only (#6428).operator-crds0.46.0 chart before (or together with) the operator chart — a stale CRD silently prunescaBundleReffrom applied resources instead of rejecting it. Existing manifests that do not setcaBundleRefreconcile identically and are not restarted by this upgrade.thv ai-plugin upgradenow refuses to install a plugin update whose signature identity differs from the one recorded in the project lock file — or that is unsigned — reportingsigner-change-blockedand exiting 4 until you confirm the rotation with the new--allow-signer-changeflag, which re-records the new identity in the lock (#6401).TOOLHIVE_PLUGINS_LOCK_ENABLED; lock entries with no recorded provenance are unaffected.🐛 Bug Fixes
thv llm setupnow fails fast with an actionable "callback port already in use" message instead of silently switching to a random port that your identity provider would reject — free the port or pass--callback-port <port>with a redirect URI registered with your IdP (#6432).access_deniedOAuth error, so clients stop treating a deliberate denial as a retryable server failure (#6441).🧹 Misc
👋 Welcome to our newest contributor: @alex-feel 🎉
Full commit log
What's Changed
New Contributors
Full Changelog: stacklok/toolhive@v0.45.0...v0.46.0
🔗 Full changelog: stacklok/toolhive@v0.45.0...v0.46.0
Configuration
📅 Schedule: (in timezone America/New_York)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Never, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.
Docs update for
toolhivev0.46.0At a glance
stacklok/toolhivev0.45.0→v0.46.0Who does what
@reyortiz3 cut this release and owns this PR: review your own changes, chase the remaining approvals, and merge once they're in. You don't need to wait on a review from anyone listed as having no docs impact below.
Everyone with a review request: the target is a review and approval within 2 business days.
Summary of changes
docs/toolhive/guides-k8s/embedded-auth-server-k8s.mdxcovering the newcaBundleReffield on OIDC and OAuth2 upstream providers (Trust private CAs for upstream auth servers toolhive#6428).docs/toolhive/guides-vmcp/embedded-auth-server-vmcp.mdxto the new K8s section so vMCP readers using multiple upstreams find the same guidance.docs/toolhive/guides-k8s/embedded-auth-server-k8s.mdxanddocs/toolhive/guides-vmcp/embedded-auth-server-vmcp.mdxto reflect the newtoken_endpoint_auth_methodnegotiation: a symmetric shared-secret method is now accepted when the document also publishestoken_endpoint_auth_methods_supportedcontainingnone(Negotiate CIMD token endpoint auth method toolhive#6400).thv ai-plugin upgrade --allow-signer-change(Block plugin upgrades that change the signer identity toolhive#6401): the entireai-plugincommand surface remains gated by the experimentalTOOLHIVE_PLUGINS_LOCK_ENABLEDenv var perpkg/plugins/feature_gate.goat the tag; the auto-generated CLI reference already carries the new flag.thv llm setupfail-fast on busy callback port (Fail LLM setup when callback port is busy toolhive#6432):thv llm setuphas no hand-written guide; the auto-generated CLI reference already documents--callback-port.access_deniedmapping on deliberate provisioning refusal (fix(authserver): map deliberate provisioning refusal to access_denied toolhive#6441): the change is an internalUserStoragecontract with no user-visible surface in the docs.No docs impact identified
@samuv @jerm-dro - your changes in this release didn't appear to affect the docs, so no review is requested and you're not blocking this PR. Please skim the diff anyway and comment if something of yours was missed or misjudged.
Run cost
How this PR was built
Two Claude Opus sessions run per release: a generation pass
(
upstream-release-docsskill, 6 phases) followed by a fresh-context editorial pass (
docs-review). Prettier/ESLintauto-fixes are applied after.
Auto-synced paths — do not hand-edit these in review:
static/api-specs/docs/toolhive/reference/cli/(toolhive only)docs/toolhive/reference/crds/If a "Gaps needing human context" section is present above,
each entry includes a paste-ready Helper prompt for local
Claude a reviewer can use to resolve the gap.