Skip to content

Update stacklok/toolhive to v0.40.1#1046

Open
renovate[bot] wants to merge 2 commits into
mainfrom
renovate/stacklok-toolhive-0.x
Open

Update stacklok/toolhive to v0.40.1#1046
renovate[bot] wants to merge 2 commits into
mainfrom
renovate/stacklok-toolhive-0.x

Conversation

@renovate

@renovate renovate Bot commented Jul 20, 2026 •
edited by github-actions Bot
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Update Change
stacklok/toolhive patch v0.40.0 → v0.40.1

After this PR opens, .github/workflows/upstream-release-docs.yml adds source-verified content edits for the new release. For stacklok/toolhive, the same workflow also syncs reference assets (CLI help, Swagger) and regenerates the CRD MDX pages.

Release Notes

stacklok/toolhive (stacklok/toolhive)

v0.40.1

Compare Source

What's Changed

New Contributors

Full Changelog: stacklok/toolhive@v0.40.0...v0.40.1

Configuration

📅 Schedule: (in timezone America/New_York)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Never, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

Docs update for toolhive v0.40.1

At a glance
Upstream stacklok/toolhive v0.40.0 → v0.40.1
Hand-written changes 1 commit(s)
Reference assets unchanged
Gaps 0
Release contributors 5 auto-assigned (see sidebar)
Action required Spot-check skill-authored prose for accuracy

Summary of changes

  • Updated the outcome field descriptions in docs/toolhive/guides-k8s/logging.mdx to list all reachable values (success, failure, error, denied, application_error). The denied outcome is newly reachable on MCPServer and MCPRemoteProxy audit chains after stacklok/toolhive#5872, which moved audit ahead of authorization so Cedar denials no longer short-circuit before the audit middleware runs.
  • Updated the outcome row in docs/toolhive/guides-vmcp/audit-logging.mdx to add the missing application_error value, matching the shared audit event schema in pkg/audit/event.go.

Run cost

Session Turns Cost (USD)
Generation 85 $5.7824
Editorial review 17 $1.3672
Total 102 $7.1496
How this PR was built

Two Claude Opus sessions run per release: a generation pass
(upstream-release-docs skill, 6 phases) followed by a fresh-
context editorial pass (docs-review). Prettier/ESLint
auto-fixes are applied after.

Auto-synced paths — do not hand-edit these in review:

  • static/api-specs/
  • docs/toolhive/reference/cli/ (toolhive only)
  • docs/toolhive/reference/crds/

If a "Gaps needing human context" section is present above,
each entry includes a paste-ready Helper prompt for local
Claude a reviewer can use to resolve the gap.

@renovate
Update stacklok/toolhive to v0.40.1
8c89c21 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
@renovate renovate Bot added the autogen-docs Pull requests generated by automated release workflows label Jul 20, 2026
@vercel

vercel Bot commented Jul 20, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
docs-website Ready Ready Preview, Comment Jul 20, 2026 10:20am

Request Review

@github-actions
github-actions Bot marked this pull request as draft July 20, 2026 10:11
@claude

claude Bot commented Jul 20, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Claude finished @renovate[bot]'s task in 7m 33s —— View job

Upstream release docs: toolhive v0.40.1

Pushed commit cfbfe6c with source-verified content edits.

Categorized change summary (Phase 1)

Doc-relevant PRs:

  • stacklok/toolhive#5857 — vMCP now serves prompts/get per-session. No doc-facing surface change; existing docs don't claim vMCP lacks prompt support, so nothing to correct.
  • stacklok/toolhive#5872 — Audit authorization denials on the proxy runner path (thv run, MCPServer, MCPRemoteProxy). Cedar denials now emit audit events with outcome: "denied". Displaces the K8s logging doc claim that outcome is success or failure.
  • stacklok/toolhive#5866 — DCR-negotiated token_endpoint_auth_method now respected (fixes Ory Hydra client_secret_basic). Bug fix; no doc claim was made about this.
  • stacklok/toolhive#5836 — SigV4 middleware strips hop-by-hop headers. Bug fix. Docs don't discuss WebSocket/trailer trade-off, so no correction needed.
  • stacklok/toolhive#5846 — Operator no-op reconcile fix for cleared podTemplateSpec. Bug fix, no doc impact.
  • stacklok/toolhive#5853 — CLI network-isolation error wording tweak. Docs don't quote the error, no correction needed.

Infra/CI-only PRs skipped: stacklok/toolhive#5864, stacklok/toolhive#5863, stacklok/toolhive#5868, stacklok/toolhive#5858, stacklok/toolhive#5876, stacklok/toolhive#5877.

Verified changes (Phase 4)

Verified against pkg/audit/event.go at v0.40.1 (five Outcome* constants: success, failure, error, denied, application_error; DefaultConfig enables DetectApplicationErrors).

  • docs/toolhive/guides-k8s/logging.mdx — corrected two outcome descriptions from "success or failure" to the full five-value list; added inline notes for denied and application_error in the long field reference.
  • docs/toolhive/guides-vmcp/audit-logging.mdx — added missing application_error value to the outcome row.

Registry doc left as-is: internal/audit/audit.go OutcomeFromStatus in toolhive-registry-server maps HTTP status only to success/denied/failure/error, so application_error is genuinely not reachable there.

Validation (Phase 5)

  • Ran npm run prettier:fix and npm run eslint:fix — both clean; prettier reflowed the two edited markdown tables.

  • Ran npm run build — fails on the mcp-metadata-plugin remote fetch step (sandbox network restriction), unrelated to these edits. PR CI will run the real build.

  • Phase 1: Discovery

  • Phase 2: Deep dive

  • Phase 3: Audit — impact map

  • Phase 4: Implementation — 2 files updated

  • Phase 5: Validation — prettier + eslint clean; build blocked by sandbox

  • Phase 6: SUMMARY.md written (gitignored, read by caller); no GAPS.md needed
    · Branch: renovate/stacklok-toolhive-0.x · Commit: cfbfe6c

@github-actions @claude
Correct audit outcome value lists for v0.40.1
cfbfe6c 
The K8s logging guide claimed `outcome` was `success` or `failure`.
toolhive/pkg/audit/event.go defines five values, all reachable in
Kubernetes audit chains. #5872 also makes `denied` newly reachable on
MCPServer and MCPRemoteProxy by moving audit ahead of authorization so
Cedar denials no longer short-circuit before audit runs. The vMCP audit
guide was missing `application_error`, which the shared auditor emits
by default when a JSON-RPC response reports an error.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
@claude

claude Bot commented Jul 20, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Claude finished @renovate[bot]'s task in 2m 53s —— View job

Editorial review of v0.40.1 doc edits

  • Identify changed files (docs/toolhive/guides-k8s/logging.mdx, docs/toolhive/guides-vmcp/audit-logging.mdx)
  • Read each file and run editorial review
  • Verify against upstream (pkg/audit/event.go @ v0.40.1, PR #5872)
  • Apply actionable fixes — none needed
  • Format check — no edits to format

Review outcome: clean

The three tables updated to include the full 5-value outcome enum are accurate and stylistically appropriate.

Verified against upstream:

  • pkg/audit/event.go defines exactly five Outcome* constants: success, failure, error, denied, application_error. Order in both docs matches the Go const block.
  • PR #5872 confirms denied became a newly reachable outcome on MCPServer/MCPRemoteProxy in v0.40.1 (audit middleware now wraps authorization, so Cedar denials produce audit events instead of short-circuiting). The wording change is warranted.
  • Registry doc (guides-registry/audit-logging.mdx:218) intentionally still lists only four outcomes — toolhive-registry-server's OutcomeFromStatus maps HTTP status to success/denied/failure/error only; application_error is genuinely unreachable there. Correctly left alone.

Style compliance: backticks on code values, sentence case, straight quotes, no em dashes. ✓

Observations considered and skipped (per skill severity guidelines — style-neutral alternatives where the current version is clear):

  • Short K8s table (logging.mdx:207) lists values without parentheticals; the long reference table (logging.mdx:236) explains only denied and application_error. Reasonable split — the self-explanatory values don't need annotation, and the long table is where readers go for detail.
  • Result: (K8s) vs Result (…) (vMCP) framing predates the diff; both are clear.
  • vMCP field table has only one (short) form, so keeping outcome values un-annotated preserves the visual pattern of that table.

No changes to apply. The cfbfe6c commit passes editorial review.
· Branch: renovate/stacklok-toolhive-0.x

@github-actions
github-actions Bot marked this pull request as ready for review July 20, 2026 10:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@tgrunnagle tgrunnagle tgrunnagle approved these changes
@jhrozek jhrozek jhrozek approved these changes
@aponcedeleonch aponcedeleonch aponcedeleonch approved these changes
@JAORMX JAORMX Awaiting requested review from JAORMX

Assignees

No one assigned

Labels

autogen-docs Pull requests generated by automated release workflows

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@tgrunnagle @jhrozek @aponcedeleonch