Skip to content

Update stacklok/toolhive to v0.50.0 - #1165

Open
renovate[bot] wants to merge 4 commits into
mainfrom
renovate/stacklok-toolhive-0.x
Open

Update stacklok/toolhive to v0.50.0#1165
renovate[bot] wants to merge 4 commits into
mainfrom
renovate/stacklok-toolhive-0.x

Conversation

@renovate

@renovate renovate Bot commented Sep 18, 2026 •
edited by github-actions Bot
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Update Change
stacklok/toolhive minor v0.49.0 → v0.50.0

After this PR opens, .github/workflows/upstream-release-docs.yml adds source-verified content edits for the new release. For stacklok/toolhive, the same workflow also syncs reference assets (CLI help, Swagger) and regenerates the CRD MDX pages.

Release Notes

stacklok/toolhive (stacklok/toolhive)

v0.50.0

Compare Source

What's Changed

New Contributors

Full Changelog: stacklok/toolhive@v0.49.0...v0.50.0

Configuration

📅 Schedule: (in timezone America/New_York)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Never, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

Docs update for toolhive v0.50.0

At a glance
Upstream stacklok/toolhive v0.49.0 → v0.50.0
Hand-written changes 2 commit(s)
Reference assets refreshed (separate commit)
Gaps 0
Owner @jhrozek - identified from merged release PR stacklok/toolhive#6691
Release contributors 2 review requested (see sidebar) · 7 not requested (no docs impact)
Action required Spot-check skill-authored prose for accuracy

Who does what

@jhrozek cut this release and owns this PR: review your own changes, chase the remaining approvals, and merge once they're in. You don't need to wait on a review from anyone listed as having no docs impact below.

Everyone with a review request: the target is a review and approval within 2 business days.

Summary of changes

  • Added additionalTokenParams section to docs/toolhive/guides-k8s/embedded-auth-server-k8s.mdx covering RFC 8707 resource indicators on token requests, the reserved parameter list, and the URI shape check on resource.
  • Added operational.timeouts.backendInit and operational.listChanged (enabled, disabledWorkloads) subsections to docs/toolhive/guides-vmcp/configuration.mdx, cross-linked so the two knobs are used together for stalling backends.
  • Updated the "Upgrade project-scoped skills" and "Upgrade project-scoped plugins" sections in docs/toolhive/guides-cli/skills-management.mdx and docs/toolhive/guides-cli/ai-plugins.mdx to split Git-hash immutability from OCI-digest trust-only re-anchors, and document --allow-signer-change --public-key.
  • Added the --adopt --public-key offline-verification example to both the skill and plugin sync sections.
  • Skipped documenting the RFC 8628 device authorization grant (RunConfig.DeviceFlowEnabled, PRs Add RFC 8628 device authorization grant support toolhive#6647 and Add device flow verification page and DCR support toolhive#6682): the operator does not surface the flag on any CRD, so a Kubernetes reader has no way to opt in. The documented deployment path (via MCPExternalAuthConfig and VirtualMCPServer) cannot reach the feature until the operator wires it through.
  • Skipped a fresh section for the ID-JAG target-AS handler (feat(authserver): accept ID-JAG assertions with a bound JWT-bearer handler toolhive#6677): the PR adds no new config surface. Existing inboundGrants.jwtBearer.issuerPolicies docs already describe the accepted grant, and the oauth-id-jag+jwt acceptance is transparent to a reader who has configured that policy.
  • Skipped documenting the Argon2id secrets-file KDF migration (Derive secrets encryption key with Argon2id toolhive#6657): the on-open rewrite is transparent and the current secrets-management.mdx guide does not describe the file format. The only externally visible effect is a downgrade break for local mixed-binary setups, which is a release-note item rather than a current-behavior fact.

No docs impact identified

7 contributor(s) had no-docs-impact commits in this release. No review was requested, and the workflow did not auto-notify them.

Review routing

GitHub could not request the upstream contributor directly, so review went to the human merger of each relevant upstream PR:

Run cost

Session Turns Cost (USD)
Generation 153 $17.2624
Editorial review 40 $3.6662
Total 193 $20.9286
How this PR was built

Two Claude Opus sessions run per release: a generation pass
(upstream-release-docs skill, 6 phases) followed by a fresh-
context editorial pass (docs-review). Prettier/ESLint
auto-fixes are applied after.

Auto-synced paths — do not hand-edit these in review:

  • static/api-specs/
  • docs/toolhive/reference/cli/ (toolhive only)
  • docs/toolhive/reference/crds/

If a "Gaps needing human context" section is present above,
each entry includes a paste-ready Helper prompt for local
Claude a reviewer can use to resolve the gap.

@renovate
Update stacklok/toolhive to v0.50.0
4bdb0a5 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
@renovate renovate Bot added the autogen-docs Pull requests generated by automated release workflows label Sep 18, 2026
@vercel

vercel Bot commented Sep 18, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
docs-website Ready Ready Preview Sep 18, 2026 5:23pm UTC

Request Review

@github-actions
github-actions Bot marked this pull request as draft September 18, 2026 17:00
@claude

claude Bot commented Sep 18, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Claude finished @renovate[bot]'s task in 15m 31s —— View job

Upstream release documentation update: toolhive v0.50.0

Ran /upstream-release-docs stacklok/toolhive v0.50.0 in unattended mode. Committed 17f0807.

  • Phase 1: Discovery - fetch release notes, categorize PRs
  • Phase 2: Deep dive - verify each PR against source at tag
  • Phase 3: Audit existing docs - build impact map
  • Phase 4: Implementation - apply changes
  • Phase 5: Validation - build clean, lint clean, docs-review clean
  • Phase 6: Artifacts - SUMMARY.md and REVIEWERS.json written

Hand-written changes (4 files, +127/-8)

Deferrals (recorded in SUMMARY.md)

REVIEWERS.json

  • Docs-facing (2): aron-muon (additionalTokenParams, vMCP listChanged/backendInit), samuv (skill and plugin key rotation).
  • Non-docs-facing (8): eleftherias, hellouz818, jhrozek, melbinjp, rdimitrov, reyortiz3, siddiqueirshad, tgrunnagle.
    · Branch: renovate/stacklok-toolhive-0.x

@github-actions @claude
Document v0.50.0 auth, vMCP, and key-rotation surface
17f0807 
Cover the reader-visible additions in ToolHive v0.50.0:

- additionalTokenParams for RFC 8707 resource indicators on token
  requests, alongside the existing additionalAuthorizationParams
- operational.listChanged (enabled, disabledWorkloads) and
  operational.timeouts.backendInit for vMCP session-init stalls
- --allow-signer-change --public-key for trust-only OCI-digest upgrades
  in thv skill upgrade and thv ai-plugin upgrade, plus --public-key
  for offline verification during --adopt on sync

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
@claude

claude Bot commented Sep 18, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Claude finished @renovate[bot]'s task in 5m 5s —— View job

Docs review for v0.50.0 upstream release

  • Read files changed by the previous commit
  • Cross-check claims against upstream source (pkg/authserver/oauthparams/reserved.go, CRD schemas, CLI reference)
  • Run /docs-review across each file
  • Apply actionable fixes
  • Run npm run prettier:fix and npm run eslint:fix
  • Commit and push

Review notes

Overall the v0.50.0 content is technically accurate and reads well. Cross-checked and verified:

  • additionalTokenParams reserved list in embedded-auth-server-k8s.mdx matches pkg/authserver/oauthparams/reserved.go (10 params including client_assertion and client_assertion_type - more accurate than the CRD schema description, which lists only 8).
  • RFC 8707 resource-indicator validation (absolute URI, no fragment) matches validateResourceIndicator in the same file.
  • additionalTokenParams map cap of 16 matches maxProperties: 16 in mcpexternalauthconfigs.schema.json.
  • operational.timeouts.backendInit and operational.listChanged.{enabled,disabledWorkloads} in guides-vmcp/configuration.mdx match virtualmcpservers.schema.json.
  • --allow-signer-change --public-key and --adopt --public-key flag pairings match the CLI reference (--public-key requires --allow-signer-change on upgrade and --adopt on sync).
  • Anchor link #exclude-backends-from-live-list_changed-propagation correctly targets the new heading (Docusaurus 3.10 uses github-slugger, which preserves underscores).

Change applied

  • docs/toolhive/guides-cli/ai-plugins.mdx: aligned the --fail-on-changes description with the parallel section in skills-management.mdx. Both thv ai-plugin upgrade and thv skill upgrade now report the same class of change (content + trust) under --fail-on-changes, so the CI-gate wording should match. Committed as 570be93.

Nothing else rose to the actionable bar. A few candidate rewrites (e.g., "not only on authorization requests" → "on both authorization and token requests", "a heavy query wanting a 60s budget" → "a workload configured with a 60s request timeout") were considered but skipped as style-neutral alternatives.
· Branch: renovate/stacklok-toolhive-0.x

@github-actions @claude
Align ai-plugin upgrade freshness wording with skill upgrade
570be93 
The parallel section in skills-management.mdx already describes
`--fail-on-changes` as reporting content and trust changes, matching the
new --allow-signer-change trust-only upgrade path. Update ai-plugins.mdx
to match so the two sibling flows describe the same behavior.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
@github-actions
github-actions Bot requested review from jhrozek and samuv September 18, 2026 17:23
@github-actions
github-actions Bot marked this pull request as ready for review September 18, 2026 17:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jhrozek jhrozek Awaiting requested review from jhrozek
@samuv samuv Awaiting requested review from samuv

At least 1 approving review is required to merge this pull request.

Assignees

@jhrozek jhrozek

Labels

autogen-docs Pull requests generated by automated release workflows

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@jhrozek