Update stacklok/toolhive-registry-server to v1.4.9

[renovate]

This PR contains the following updates:

Package	Update	Change
stacklok/toolhive-registry-server	patch	v1.4.6 → v1.4.9

After this PR opens, .github/workflows/upstream-release-docs.yml adds source-verified content edits for the new release. For stacklok/toolhive, the same workflow also syncs reference assets (CLI help, Swagger) and regenerates the CRD MDX pages.

---

Release Notes

stacklok/toolhive-registry-server (stacklok/toolhive-registry-server)

v1.4.9

Compare Source

What's Changed

• Bump toolhive-core to v0.0.25 by @​reyortiz3 in #​825
• Release v1.4.9 by @​toolhive-release-app[bot] in #​827

Full Changelog: stacklok/toolhive-registry-server@v1.4.8...v1.4.9

v1.4.8

Compare Source

What's Changed

• Update docker images by @​renovate[bot] in #​817
• Update github actions by @​renovate[bot] in #​818
• Update go modules by @​renovate[bot] in #​821
• Update github actions by @​renovate[bot] in #​820
• Suppress Grype false positive for github.com/docker/cli GO-2026-4610 by @​rdimitrov in #​822
• Release v1.4.8 by @​toolhive-release-app[bot] in #​823

Full Changelog: stacklok/toolhive-registry-server@v1.4.7...v1.4.8

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Never, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

---

Docs update for toolhive-registry-server v1.4.9

Note

Skill reported no doc-relevant changes for this release.
This PR only bumps the version pin and any pin_files edits.

At a glance

Upstream	stacklok/toolhive-registry-server v1.4.6 → v1.4.9
Hand-written changes	0 commit(s)
Reference assets	unchanged
Gaps	0
Release contributors	3 auto-assigned (see sidebar)
Action required	—

Run cost

Session	Turns	Cost (USD)
Generation	48	$2.2399
Editorial review	4	$0.4427
Total	52	$2.6826

How this PR was built

Two Claude Opus sessions run per release: a generation pass
(upstream-release-docs skill, 6 phases) followed by a fresh-
context editorial pass (docs-review). Prettier/ESLint
auto-fixes are applied after.

Auto-synced paths — do not hand-edit these in review:

• docs/toolhive/reference/cli/
• docs/toolhive/reference/crds/
• static/api-specs/

If a "Gaps needing human context" section is present above,
each entry includes a paste-ready Helper prompt for local
Claude a reviewer can use to resolve the gap.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs-website	Ready	Preview, Comment	Jun 24, 2026 12:51am

[claude]

Claude finished @renovate[bot]'s task in 3m 58s —— View job

---

Upstream release docs: toolhive-registry-server v1.4.6 → v1.4.9

No documentation changes required.

• Phase 1: Discovery
• Phase 2: Deep dive
• Phase 3: Audit existing docs — impact map empty
• Phase 4: Wrote NO_CHANGES.md at repo root for the caller workflow
• Phase 5: Skipped (no hand-edits to validate)
• Phase 6: No commit (no tracked changes; NO_CHANGES.md is gitignored and picked up by the caller workflow from the working tree)

Findings

The v1.4.6 → v1.4.9 source diff (24 files) is:

• Renovate bumps to 13 GitHub Actions workflows
• .grype.yaml suppression for a false-positive docker/cli CVE (Suppress Grype false positive for github.com/docker/cli GO-2026-4610 toolhive-registry-server#822)
• Dockerfile, VERSION, chart Chart.yaml / values.yaml / README.md, docker/dockerfile-compose — pure version bumps
• go.mod / go.sum — toolhive-core v0.0.24 → v0.0.25 (Bump toolhive-core to v0.0.25 toolhive-registry-server#825), plus the renovate go-modules sweep in Update go modules toolhive-registry-server#821 (notably toolhive v0.29.0 → v0.30.0, already documented in Update stacklok/toolhive to v0.30.0 #954)
• internal/app/builder.go — security-headers middleware (fix(api): add X-Content-Type-Options and Cross-Origin-Resource-Policy headers toolhive-registry-server#811): adds X-Content-Type-Options: nosniff and Cross-Origin-Resource-Policy: same-origin to every response. This is a transparent additive baseline-security improvement on an API server, with no flag, no config knob, and no documented behavior contradicted.

Searches for X-Content-Type-Options, Cross-Origin-Resource-Policy, nosniff, CORS, same-origin, and any image-tag references like thv-registry-api:v1.4.x across docs/ returned no hits in the registry-server docs. The existing version call-outs in the docs (v1.4.1 in authorization.mdx, v1.4.3 in telemetry-metrics.mdx, etc.) describe earlier-release behavior changes and remain accurate.

No displaced concepts; no contradictions; nothing for a reader-facing edit.

[claude]

Claude finished @renovate[bot]'s task in 25s —— View job

---

Editorial review: toolhive-registry-server v1.4.9

• Identify files changed in the upstream-release-docs commit
• Run /docs-review over changed docs files
• Apply formatting and lint fixes

No docs changes to review.

The HEAD commit (9cf4e84) only touches .github/upstream-projects.yaml, which is the renovate-managed version pin, not documentation. The previous Claude session correctly determined that the v1.4.6 → v1.4.9 source diff (renovate version bumps, a Grype false-positive suppression, a toolhive-core bump, and an additive nosniff / Cross-Origin-Resource-Policy: same-origin baseline security-headers middleware) had no reader-facing impact and wrote NO_CHANGES.md for the caller workflow.

Nothing to format, nothing to lint, nothing to push.
— branch: renovate/stacklok-toolhive-registry-server-1.x