Update stacklok/toolhive to v0.52.0 by renovate[bot] · Pull Request #1233 · stacklok/docs-website

renovate · 2026-10-13T02:29:48Z

This PR contains the following updates:

Package	Update	Change
stacklok/toolhive	minor	`v0.51.4` → `v0.52.0`

After this PR opens, .github/workflows/upstream-release-docs.yml adds source-verified content edits for the new release. For stacklok/toolhive, the same workflow also syncs reference assets (CLI help, Swagger) and regenerates the CRD MDX pages.

Release Notes

stacklok/toolhive (stacklok/toolhive)

`v0.52.0`

Compare Source

🚀 Toolhive v0.52.0 is live!

This release adds TLS for Redis session storage (runtime and operator), makes thv llm setup and teardown safer by default, and fixes several authorization, OAuth and operator issues.

⚠️ Breaking Changes

thv llm teardown now purges cached tokens by default — a full teardown deletes cached OIDC tokens and fails if cleanup fails; pass --keep-tokens to keep the old behavior (migration guide) (#6733)
DCRCredentialStore gained a method — out-of-tree implementations of pkg/authserver/storage.DCRCredentialStore no longer compile until they add UpdateDCRCredentialsIfUnchanged (migration guide) (#6758)

Migration guide: thv llm teardown purges cached tokens by default

Affects CLI users and scripts that run thv llm teardown. Cleanup is local only: tokens are deleted from the secrets provider, not revoked at the identity provider.

Before

# Tokens survived teardown unless you opted in
thv llm teardown
thv llm teardown --purge-tokens

After

# Full teardown (no configured tools remain) purges cached tokens
thv llm teardown

# Keep tokens for a later setup
thv llm teardown --keep-tokens

# Targeted teardown still keeps tokens; --purge-tokens deletes them even when other tools remain
thv llm teardown <tool> --purge-tokens

Migration steps

If a script relied on tokens surviving a full teardown so a later thv llm setup could skip re-authentication, add --keep-tokens.
Teardown now exits non-zero if the secrets provider is unavailable or token listing or deletion fails (these were warnings before). Handle the failure, or pass --keep-tokens to skip the purge.
--keep-tokens and --purge-tokens are mutually exclusive.
Go callers: llm.Teardown has new parameters and llm.PurgeTokens now returns an error.

PR: #6733 — Closes #6732

Migration guide: DCRCredentialStore gained a method

Affects only Go code outside this repository that implements DCRCredentialStore (including hand-written mocks). The built-in memory and Redis stores are already updated.

Before

type DCRCredentialStore interface {
    StoreDCRCredentialsIfAbsent(...)
    UpdateDCRCredentialsIfPresent(...)
    // ...
}

After

type DCRCredentialStore interface {
    // ...existing methods...
    UpdateDCRCredentialsIfUnchanged(ctx context.Context, creds *DCRCredentials, expected *DCRCredentials) error
}

Migration steps

Add UpdateDCRCredentialsIfUnchanged(ctx, creds, expected) to your implementation.
Overwrite the row at creds.Key only if the stored row still equals expected.
Return a wrapped ErrNotFound if the row is absent and the new ErrDCRCredentialsChanged if it differs; write nothing in either case.
Reject a nil expected, or one whose Key differs from creds.Key.

PR: #6758

🆕 New Features

Redis session storage supports TLS in the proxy runner, vMCP and their rate limiters, with system roots or a private CA bundle (#6731)
MCPServer, MCPRemoteProxy and VirtualMCPServer accept spec.sessionStorage.tls, including caCertSecretRef for a private CA; a startup WARN is now logged when Redis session storage runs without TLS, so log-based alerting may fire for existing plaintext setups (#6767)
thv llm setup now configures Claude Code for one-hour prompt caching by default; re-run setup to pick it up, or use --short-prompt-cache to opt out (#6515)

🐛 Bug Fixes

spec.secrets on MCPServer accepts multiple keys of the same Secret; re-apply the operator-crds chart (#6690)
The token-exchange issuer policy no longer rejects an omitted allowMayAct with a wildcard delegate; re-apply the operator-crds chart (#6532)
Config resources are deleted promptly once their last referrer goes away instead of lingering up to 30 seconds (#6768)
Cedar policies can use extension claims from RFC 7662 introspection (such as roles); policies that referenced these claims will now see real values, so review any that were written around them being absent (#6707)
Authz-filtered tools/list, prompts/list and resources/list responses keep the members the backend sent (including MCP 2026-07-28 resultType), always carry Cache-Control: private, no-store, and reject ambiguous duplicate or aliased annotation members (#6709)
The embedded auth server no longer cuts off slow upstream identity-provider token endpoints at 10 seconds, which could leave a revoked refresh token stored (#6755)

🧹 Misc

Add a shared JWT claim string-array decoder; Cedar behavior is unchanged (#6738)
Clarify priority-conflict documentation and strengthen regression coverage (#6716)
Clarify operator Helm values descriptions (#6771)
Reduce Podman network normalization complexity (#6809)
Drop the ping step from the remote MCP server e2e test (#6766)
Use exact version comments on artifact actions (#6761)
Add alex-feel to MAINTAINERS (#6808)

📦 Dependencies

Module	Version
`charm.land/bubbletea/v2`	v2.1.0
`github.com/aws/aws-sdk-go-v2`	v1.47.2
`github.com/aws/aws-sdk-go-v2/config`	v1.33.8
`github.com/aws/aws-sdk-go-v2/service/sts`	v1.51.3
`github.com/cenkalti/backoff/v7`	v7.0.1
`github.com/getsentry/sentry-go` (+ `otel`, `otel/otlp`)	v0.50.0
`github.com/go-git/go-git/v5`	v5.19.3
`github.com/go-git/go-billy/v5`	v5.9.2
`github.com/Microsoft/go-winio`	v0.6.3
`github.com/moby/moby/client`	v0.6.2
`github.com/moby/moby/api`	v1.56.1
`github.com/prometheus/common`	v0.72.0
`github.com/redis/go-redis/v9`	v9.23.0
`github.com/shirou/gopsutil/v4`	v4.26.9
`github.com/spiffe/go-spiffe/v2`	v2.9.0
`github.com/stacklok/toolhive-catalog`	v0.20261005.0
`github.com/stacklok/toolhive-core`	v0.0.51
`github.com/tidwall/gjson`	v1.20.0
`go.opentelemetry.io/otel` (and SDK/exporters)	v1.47.0
`go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp`	v0.72.0
`modernc.org/sqlite`	v1.60.1
`sigs.k8s.io/controller-runtime`	v0.25.2
`ghcr.io/modelcontextprotocol/inspector`	2.9.0
`anchore/sbom-action`	v0.24.3
`anthropics/claude-code-action`	v1.0.241

Full commit log

What's Changed

Guard token exchange may_act CEL by @kocaemhttps://github.com/stacklok/toolhive/pull/6532l/6532
Preserve custom claims from RFC 7662 introspection by @lorenzozanhttps://github.com/stacklok/toolhive/pull/6707l/6707
Clarify priority conflicts and strengthen regression coverage by @JAORhttps://github.com/stacklok/toolhive/pull/6716l/6716
fix(operator): allow multiple keys of one Secret in spec.secrets by @lightsabhttps://github.com/stacklok/toolhive/pull/6690l/6690
Purge LLM tokens on full teardown by @danbahttps://github.com/stacklok/toolhive/pull/6733l/6733
Update docker images by @renovate[bohttps://github.com/stacklok/toolhive/pull/6750l/6750
Update github actions by @renovate[bohttps://github.com/stacklok/toolhive/pull/6747l/6747
Default Claude Code prompt cache to one hour by @Sanskarhttps://github.com/stacklok/toolhive/pull/6515l/6515
Add compare-and-set update for DCR credentials by @tgrunnaghttps://github.com/stacklok/toolhive/pull/6758l/6758
Use exact version comments on artifact actions by @jhrozhttps://github.com/stacklok/toolhive/pull/6761l/6761
Update go modules by @renovate[bohttps://github.com/stacklok/toolhive/pull/6749l/6749
Update go modules by @renovate[bohttps://github.com/stacklok/toolhive/pull/6764l/6764
Add TLS to Redis session storage by @Sanskarhttps://github.com/stacklok/toolhive/pull/6731l/6731
Drop ping from remote MCP server e2e test by @jhrozhttps://github.com/stacklok/toolhive/pull/6766l/6766
Remove the 10s header timeout from the upstream IdP client by @alex-fehttps://github.com/stacklok/toolhive/pull/6755l/6755
Preserve list result members in authz filters by @alex-fehttps://github.com/stacklok/toolhive/pull/6709l/6709
Clarify operator Helm values descriptions by @danbahttps://github.com/stacklok/toolhive/pull/6771l/6771
Add operator support for Redis session storage TLS by @peppeshttps://github.com/stacklok/toolhive/pull/6767l/6767
Add shared JWT claim string-array decoder by @hellouz8https://github.com/stacklok/toolhive/pull/6738l/6738
Add alex-feel to MAINTAINERS by @jhrozhttps://github.com/stacklok/toolhive/pull/6808l/6808
Unblock config deletion when referrers go away by @jhrozhttps://github.com/stacklok/toolhive/pull/6768l/6768
Reduce Podman network normalization complexity by @ChrisJBurhttps://github.com/stacklok/toolhive/pull/6809l/6809
Release v0.52.0 by @toolhive-release-app[bohttps://github.com/stacklok/toolhive/pull/6810l/6810

Full Changelog: stacklok/toolhive@v0.51.4...v0.52.0

🔗 Full changelog: stacklok/toolhive@v0.51.4...v0.52.0

Configuration

📅 Schedule: (in timezone America/New_York)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Never, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

Docs update for `toolhive` v0.52.0

At a glance


Upstream	`stacklok/toolhive` `v0.51.4` → `v0.52.0`
Hand-written changes	2 commit(s)
Reference assets	refreshed (separate commit)
Gaps	0
Owner	@ChrisJBurns - identified from merged release PR stacklok/toolhive#6810
Release contributors	6 review requested (see sidebar) · 4 not requested (no docs impact) · 1 review routing issue(s)
Action required	Yes — manually route 1 unresolved review(s)

Who does what

@ChrisJBurns cut this release and owns this PR: review your own changes, chase the remaining approvals, and merge once they're in. You don't need to wait on a review from anyone listed as having no docs impact below.

Everyone with a review request: the target is a review and approval within 2 business days.

Summary of changes

Added an "Enable TLS for session storage" section (spec.sessionStorage.tls, caCertSecretRef, insecureSkipVerify, startup WARN for plaintext) in docs/toolhive/guides-k8s/redis-session-storage.mdx
Updated the rate limiting prerequisites to note the rate limiter reuses the session storage Redis and its TLS settings in docs/toolhive/guides-k8s/rate-limiting.mdx
Updated --allow-docker-gateway coverage to include every bridge network gateway, discovered at deployment, in docs/toolhive/guides-cli/network-isolation.mdx
Updated the opaque token introspection note to reflect that RFC 7662 extension members (such as act and roles) now reach the audit and authorization layers in docs/toolhive/concepts/embedded-auth-server.mdx
Skipped hand-written docs for thv llm teardown --keep-tokens/purge default and --short-prompt-cache: no guide page covers thv llm setup/teardown, so the auto-generated CLI reference is the only coverage
Skipped sessionStorage.tls.caCertFile for standalone (non-Kubernetes) vMCP config: no existing page documents standalone vMCP session storage
No change needed for priority conflict resolution (Clarify priority conflicts and strengthen regression coverage toolhive#6716), already documented in docs/toolhive/guides-vmcp/tool-aggregation.mdx

No docs impact identified

4 contributor(s) had no-docs-impact commits in this release. No review was requested, and the workflow did not auto-notify them.

Review routing

GitHub could not request the upstream contributor directly, so review went to the human merger of each relevant upstream PR:

These reviews require manual routing:

Upstream PR stacklok/toolhive#6515 has no human merger available as a stand-in. The release owner must route this review.

Run cost

Session	Turns	Cost (USD)
Generation	54	$1.8877
Editorial review	15	$0.5245
Total	69	$2.4122

How this PR was built

Two Claude Opus sessions run per release: a generation pass
(upstream-release-docs skill, 6 phases) followed by a fresh-
context editorial pass (docs-review). Prettier/ESLint
auto-fixes are applied after.

Auto-synced paths — do not hand-edit these in review:

static/api-specs/
docs/toolhive/reference/cli/ (toolhive only)
docs/toolhive/reference/crds/

If a "Gaps needing human context" section is present above,
each entry includes a paste-ready Helper prompt for local
Claude a reviewer can use to resolve the gap.

Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

vercel · 2026-10-13T02:29:50Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs-website	Ready	Preview	Oct 13, 2026 2:38am UTC

claude · 2026-10-13T02:31:38Z

Claude finished @renovate[bot]'s task in 3m 1s —— View job

Upstream release docs: stacklok/toolhive v0.52.0

Discovery
Deep dive and source verification (local clone at v0.52.0)
Audit existing docs (including stale-claim check)
Implement changes
Validate (prettier:fix, eslint:fix)
Write SUMMARY.md / REVIEWERS.json and push

Changes (commit `8dd9640`)

guides-k8s/redis-session-storage.mdx: new section, "Enable TLS for session storage". It covers spec.sessionStorage.tls (empty object, caCertSecretRef, insecureSkipVerify) and the CRD rules that apply to it. It also explains that a failed handshake never falls back to plaintext, that spec.config.sessionStorage.tls is rejected on VirtualMCPServer, and that a WARN is logged at startup when the connection is plaintext or skips verification (Add TLS to Redis session storage toolhive#6731, Add operator support for Redis session storage TLS toolhive#6767).
guides-k8s/rate-limiting.mdx: notes that the rate limiter connects to the session storage Redis and uses its TLS settings.
guides-cli/network-isolation.mdx: --allow-docker-gateway now opens the gateway of every bridge network. Those gateways are discovered when the server is deployed, so a server must be redeployed to pick up a bridge network created later (source: pkg/container/docker/client.go).
concepts/embedded-auth-server.mdx: fixed a note that was no longer true. RFC 7662 introspection now passes extension members such as act and roles through to the audit and authorization layers (Preserve custom claims from RFC 7662 introspection toolhive#6707, pkg/auth/token.go).

What I didn't change, and why

thv llm teardown token purge default and --short-prompt-cache: no guide page covers thv llm setup or teardown, so the generated CLI reference is the only place these appear.
caCertFile for standalone vMCP session storage: no existing page documents session storage for vMCP outside Kubernetes.
Priority conflict resolution (Clarify priority conflicts and strengthen regression coverage toolhive#6716): already documented correctly in guides-vmcp/tool-aggregation.mdx.

For reviewers

Untested example: npm run build wasn't run in this session, and the new TLS example hasn't been applied to a cluster.
Fork merge with no release-note entry: d7877b89 changed the embedded auth server's consent, authorize, and token handlers. I didn't update any docs for it, and I flagged @jhrozek in REVIEWERS.json to confirm whether anything needs documenting.

Add Redis session storage TLS guidance, update Docker gateway access coverage, and fix the introspection claims note. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

claude · 2026-10-13T02:34:56Z

Claude finished @renovate[bot]'s task in 59s —— View job

Editorial review of v0.52.0 content

Identify files changed in the content commit (4 pages)
Run /docs-review over changed files
Apply fixes
Format and lint (prettier:fix, eslint:fix)
Commit and push (ff7a471)

Summary

The content commit is accurate and well-placed, so it needed only two small wording fixes. I checked the new claims against the upstream source.

File	Review result
`concepts/embedded-auth-server.mdx`	Introspection note now correctly says RFC 7662 extension claims (`act`, `roles`) reach the audit and authorization layers (#6707). No changes.
`guides-cli/network-isolation.mdx`	"Every bridge network gateway" and the note that gateways are captured once when the server is deployed match `pkg/container/runtime/types.go` (`AllowDockerGateway`: "Gateways are snapshotted at deployment; redeploy to include bridges created later"). No changes.
`guides-k8s/rate-limiting.mdx`	The prerequisite now links to the new TLS section. No changes.
`guides-k8s/redis-session-storage.mdx`	The new Enable TLS for session storage section is in the right place, sits next to the MCPServer and VirtualMCPServer configuration sections, and has a working example. Fixed: "set TLS ... as shown" now says "the same way", because the example above it is an `MCPServer`, not a `VirtualMCPServer`. Also cut the hedge in "you can expect this warning" to "expect this warning".

No primary issues found. I didn't touch any auto-generated reference files (CLI, Helm, CRD, static/api-specs).
· Branch

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Update stacklok/toolhive to v0.52.0

0bb4f09

Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

renovate Bot added the autogen-docs Pull requests generated by automated release workflows label Oct 13, 2026

github-actions Bot marked this pull request as draft October 13, 2026 02:30

Refresh reference assets for toolhive v0.52.0

902baba

vercel Bot deployed to Preview October 13, 2026 02:33

View deployment

Document toolhive v0.52.0 changes

8dd9640

Add Redis session storage TLS guidance, update Docker gateway access coverage, and fix the introspection claims note. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Tighten Redis session storage TLS wording

ff7a471

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

github-actions Bot assigned ChrisJBurns Oct 13, 2026

github-actions Bot requested review from ChrisJBurns, JAORMX, danbarr, jhrozek, peppescg and rdimitrov October 13, 2026 02:36

github-actions Bot marked this pull request as ready for review October 13, 2026 02:36

vercel Bot deployed to Preview October 13, 2026 02:38

View deployment

jhrozek approved these changes Oct 13, 2026

View reviewed changes

peppescg approved these changes Oct 13, 2026

View reviewed changes

danbarr approved these changes Oct 13, 2026

View reviewed changes

ChrisJBurns approved these changes Oct 13, 2026

View reviewed changes

ChrisJBurns merged commit 35587af into main Oct 13, 2026
8 checks passed

ChrisJBurns deleted the renovate/stacklok-toolhive-0.x branch October 13, 2026 18:36

Navigation Menu

Repository navigation

Update stacklok/toolhive to v0.52.0 - #1233

Update stacklok/toolhive to v0.52.0#1233
ChrisJBurns merged 4 commits into
mainfrom
renovate/stacklok-toolhive-0.x

renovate Bot commented Oct 13, 2026 •

edited by github-actions Bot

Loading

Uh oh!

vercel Bot commented Oct 13, 2026 •

edited

Loading

Uh oh!

claude Bot commented Oct 13, 2026 •

edited

Loading

Uh oh!

claude Bot commented Oct 13, 2026 •

edited

Loading

Uh oh!

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

renovate Bot commented Oct 13, 2026 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v0.52.0

🚀 Toolhive v0.52.0 is live!

⚠️ Breaking Changes

Before

After

Migration steps

Before

After

Migration steps

🆕 New Features

🐛 Bug Fixes

🧹 Misc

📦 Dependencies

What's Changed

Configuration

Docs update for toolhive v0.52.0

At a glance

Who does what

Summary of changes

No docs impact identified

Review routing

Run cost

Uh oh!

vercel Bot commented Oct 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

claude Bot commented Oct 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Upstream release docs: stacklok/toolhive v0.52.0

Changes (commit 8dd9640)

What I didn't change, and why

For reviewers

Uh oh!

claude Bot commented Oct 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Editorial review of v0.52.0 content

Summary

Uh oh!

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

renovate Bot commented Oct 13, 2026 •

edited by github-actions Bot

Loading

`v0.52.0`

Docs update for `toolhive` v0.52.0

vercel Bot commented Oct 13, 2026 •

edited

Loading

claude Bot commented Oct 13, 2026 •

edited

Loading

Changes (commit `8dd9640`)

claude Bot commented Oct 13, 2026 •

edited

Loading