Update module github.com/stacklok/toolhive to v0.19.0#119
Merged
Conversation
renovate
bot
force-pushed
the
renovate/github.com-stacklok-toolhive-0.x
branch
from
7ad4888 to
2b609c1
Compare
renovate
bot
changed the title
Contributor
Author
ℹ️ Artifact update noticeFile name: go.modIn order to perform the update(s) described in the table above, Renovate ran the
Details:
|
jhrozek
approved these changes
Apr 13, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v0.17.0→v0.19.0Release Notes
stacklok/toolhive (github.com/stacklok/toolhive)
v0.19.0Compare Source
Breaking Changes
[Operator] Remove
enforceServersand image validation fromMCPRegistry(#4776)The
enforceServersfeature and its image validation logic have been removed from theMCPRegistryCRD. This feature was silently non-functional since PR #2568 removed the backing data sources — the registry-storage ConfigMap it depended on was never populated, so every image check returnedfalse. The entire surface area has been cleaned up rather than fixed.What changed:
MCPRegistrySpec.enforceServersfield removed from the CRDConditionImageValidatedstatus condition removedimage_validation.godeleted along with its testsMigration steps:
enforceServers: true(orfalse) field from yourMCPRegistrymanifests.ImageValidatedcondition — it will no longer appear in status.[Operator] Rename
remoteURL/externalURLJSON tags to camelCase (#4775)The JSON field names on
MCPRemoteProxyandMCPServerEntryresources have been corrected to match Kubernetes API conventions and the rest of the codebase.MCPRemoteProxySpecremoteURLremoteUrlMCPRemoteProxyStatusexternalURLexternalUrlMCPServerEntrySpecremoteURLremoteUrlMigration steps:
MCPRemoteProxyandMCPServerEntryYAML manifests to use the new lowercase field names.kubectl get ... -o jsonpath='{.spec.remoteUrl}') that reference these fields.[Operator] Rename
BackendAuthTypeenum valueexternal_auth_config_ref→externalAuthConfigRef(#4563)The
backendAuthTypediscriminator onVirtualMCPServerpreviously used snake_case for theexternal_auth_config_refvalue, inconsistent with all other enum values (tokenExchange,headerInjection,bearerToken, etc.). It is nowexternalAuthConfigRef.Backwards compatibility: The old value
external_auth_config_refis still accepted but deprecated. A deprecation warning will be logged when it is detected. It will be removed in a future release.Migration steps:
VirtualMCPServermanifests to usebackendAuthType: externalAuthConfigRef.[API] Skills install endpoint:
clientfield replaced byclients(#4732)The request body for the skills install endpoint has changed. The single-value
clientstring field is replaced by aclientsstring array to support multi-client installation.Migration steps:
"clients": ["<client-name>"]instead of"client": "<client-name>".New Features
Webhook middleware: CLI configuration support (#4410)
Phase 4 of the webhook middleware integration adds full CLI support for configuring webhooks directly via
thv runflags. Webhooks let you delegate MCP tool call authorization to an external HTTP service.New flags on
thv run:--webhook-url— URL of the external webhook endpoint--webhook-timeout— request timeout (supports JSON duration format)--webhook-failure-policy—fail(default) orignoreon connectivity errorsSee docs/examples/webhooks.json for a configuration example.
Skills API v0.1 endpoints (#4753)
Two new API endpoints are available for browsing and fetching skills from the registry:
GET /registry/{name}/v0.1/skills— paginated, searchable list of available skillsGET /registry/{name}/v0.1/skills/{namespace}/{skillName}— fetch a single skill by nameMulti-client and all-clients skill installation (#4732)
thv skills installnow supports installing a skill to multiple clients in a single command. You can specify multiple--clientflags or use--all-clientsto target every configured client at once. Writes are atomic with rollback on failure.Cursor support for skills (#4762)
Cursor is now recognized as a skill-supporting client. Skills can be installed directly to Cursor alongside Claude Desktop and other supported clients.
TelemetryConfigRefsupport onMCPRemoteProxy(#4719)MCPRemoteProxynow supports thetelemetryConfigReffield, bringing it to parity withMCPServer. You can reference a sharedMCPTelemetryConfigresource instead of inlining telemetry configuration. Mutual exclusivity with the (deprecated) inlinetelemetryfield is enforced via CEL validation.Improvements
Proxy returns 503 on expired OAuth token (#4722)
When the proxy's OAuth token source fails (e.g. an expired token), it previously returned
401 Unauthorized. MCP clients interpret401as an authentication challenge and may retry indefinitely. The proxy now returns503 Service Unavailable, which correctly signals a transient backend fault.Webhook 422 treated as unconditional deny (#4703)
A
422 Unprocessable Entityresponse from a webhook endpoint is now treated as an unconditional deny, regardless of thefailurePolicysetting. This prevents malformed webhook requests from accidentally being allowed through.Non-registry-server policy correctly enforced for remote URLs (#4752)
Three gaps allowed the
non_registry_serverspolicy (enforced: true, value: false) to be bypassed when running remote MCP servers by URL. All three call sites now enforce the policy gate before the server is started.LRU eviction added to
ValidatingCache(#4731)ValidatingCachenow supports bounded LRU capacity and a storageUpdatemethod, preventing unbounded memory growth in long-running deployments.Enterprise config provider respected in
thv run(#4755, #4754, #4740)Several code paths in
thv runand the HTTP handler setup were callingconfig.NewDefaultProvider()directly, bypassing the registered enterprise provider factory. These are now consistently routed throughcfg.NewProvider(), ensuring enterprise configuration overrides are applied correctly.runtime_configAPI semantics and validation tightened (#4435)The workload API's
runtime_confighandling now validates inputs at the boundary and keeps merge behavior scoped to the API layer, preventing invalid configurations from propagating to the image build step.Dependency Updates
github.com/stacklok/toolhive-cataloggithub.com/google/go-containerregistrygolang.org/x/exp/jsonrpc2746e56fFull Changelog
v0.18.0...v0.19.0
What's Changed
746e56fby @renovate[bot] in #4750b47fd72by @renovate[bot] in #4749Full Changelog: stacklok/toolhive@v0.18.0...v0.19.0
v0.18.0Compare Source
What's Changed
New Contributors
Full Changelog: stacklok/toolhive@v0.17.0...v0.18.0
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.