Skip to content

Update module github.com/stacklok/toolhive to v0.49.0 - #235

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/github.com-stacklok-toolhive-0.x
Open

Update module github.com/stacklok/toolhive to v0.49.0#235
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/github.com-stacklok-toolhive-0.x

Conversation

@renovate

@renovate renovate Bot commented Aug 5, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
github.com/stacklok/toolhive v0.41.0 → v0.49.0 age confidence

Release Notes

stacklok/toolhive (github.com/stacklok/toolhive)

v0.49.0

Compare Source

🚀 Toolhive v0.49.0 is live!

A security- and auth-correctness release: a signer-pin bypass in thv skill upgrade is closed, the embedded auth server's documented zero-downtime key rotation finally works, and AWS STS role claims now fail closed instead of silently handing out the fallback role. This release also ships a dependency-light generated Go client for the management API, and moves the project to Go 1.27.

⚠️ Breaking Changes

  • pkg/vmcp/session.WithDialControl removed — vMCP embedders who set a dial-control hook on the session factory get a compile error; wrap the hook in the new WithDialControlResolver (migration guide below).
  • OAuth2 upstream token-endpoint auth method default reverted — only affects upgrades from v0.48.0: pre-registered oauth2 upstreams with a client secret and no explicit tokenEndpointAuthMethod go back to sending credentials in the POST body instead of HTTP Basic; set client_secret_basic explicitly if your IdP requires it (migration guide below).
  • AWS STS role claims must be a string or a list of strings — object, number, boolean, or null role claims now fail closed with HTTP 403 instead of silently receiving the fallback role, and a bare-string claim now selects its mapped role (migration guide below).
  • Root Go module now requires Go 1.27, and go:// workloads default to golang:1.27-alpine — builds pinned to Go 1.26 with GOTOOLCHAIN=local fail, and go:// servers that do not compile under Go 1.27 need an explicit image pin (migration guide below).
Migration guide: session.WithDialControl → session.WithDialControlResolver

Affects Go embedders of vMCP that called session.WithDialControl — the option added in v0.48.0 by #​6547. The option was address-blind, so every backend received the same net.Dialer.Control hook and a per-backend dial policy could not be expressed. It is replaced in place rather than deprecated alongside a second option.

On v0.49.0 the old call fails to compile with undefined: session.WithDialControl.

⚠️ pkg/vmcp/client.WithDialControl is unchanged. Only the pkg/vmcp/session option was renamed — do not migrate client.WithDialControl call sites.

Before
factory := session.NewSessionFactory(registry,
    session.WithDialControl(denyPrivateRanges),
)
After
factory := session.NewSessionFactory(registry,
    // Same hook for every backend — identical to v0.48.0 behavior.
    session.WithDialControlResolver(
        func(_ string) func(network, address string, c syscall.RawConn) error {
            return denyPrivateRanges
        },
    ),
)

Per-backend policy — the capability this unlocks. Returning nil for a workload leaves that backend on http.DefaultTransport, byte-for-byte identical to the no-hook path:

session.WithDialControlResolver(
    func(workloadID string) func(string, string, syscall.RawConn) error {
        if allowsPrivateDialing(workloadID) {
            return nil
        }
        return denyPrivateRanges
    },
)
Migration steps
  1. Find every session.WithDialControl( call site in the pkg/vmcp/session package — not pkg/vmcp/client, whose identically-named option is unchanged.
  2. Rename it to session.WithDialControlResolver.
  3. Wrap your existing hook in func(workloadID string) func(network, address string, c syscall.RawConn) error { return hook } to preserve v0.48.0 semantics exactly.
  4. Optionally branch on workloadID to vary policy per backend; return nil to leave a backend untouched.
  5. Make sure your resolver is goroutine-safe — it is invoked concurrently from the per-backend session-init goroutines. A panicking resolver is recovered per backend and excludes only that backend.
  6. Rebuild. If you are enforcing SSRF/DNS-rebinding protection, confirm the returned hook still inspects address — deciding allow/deny from workloadID alone provides no network-level protection.

PR: #​6567

Migration guide: OAuth2 upstream tokenEndpointAuthMethod default

Affects anyone on v0.48.0 with a pure oauth2-type upstream provider that uses a pre-registered clientId plus a client secret and leaves tokenEndpointAuthMethod unset.

#​6543 (shipped in v0.48.0, and only in v0.48.0) added the token_endpoint_auth_method field, but also made an unset field silently default to client_secret_basic whenever a secret was configured — flipping every existing pre-registered upstream from POST-body credentials to HTTP Basic with no opt-in. v0.49.0 restores the historical default while keeping the new field.

The auth style is strict, not probing: an unset method sends credentials in the token-request POST body and does not retry with Basic. Against a Basic-only IdP the exchange fails with invalid_client — on both initial login and token refresh.

  • Upgrading from v0.47.x or earlier → no change; v0.49.0 matches what you already had.
  • On v0.48.0 with an IdP that required POST body → v0.48.0 broke you and v0.49.0 fixes it.
  • On v0.48.0 with a Basic-only IdP → you must now opt in explicitly.

OIDC-type upstreams and Dynamic Client Registration upstreams are unaffected.

Before
apiVersion: toolhive.stacklok.dev/v1beta1
kind: MCPExternalAuthConfig
spec:
  type: embeddedAuthServer
  embeddedAuthServer:
    upstreamProviders:
      - name: my-idp
        type: oauth2
        oauth2Config:
          clientId: my-client
          clientSecretRef:
            name: idp-client-secret
            key: client-secret
          tokenEndpoint: https://idp.example.com/oauth2/token
          # unset -> v0.48.0 silently used client_secret_basic
After
        oauth2Config:
          clientId: my-client
          clientSecretRef:
            name: idp-client-secret
            key: client-secret
          tokenEndpoint: https://idp.example.com/oauth2/token
          tokenEndpointAuthMethod: client_secret_basic   # now required to get Basic

Raw auth-server run config:

upstreams:
  - name: my-idp
    type: oauth2
    oauth2_config:
      client_id: my-client
      client_secret_env_var: MY_IDP_CLIENT_SECRET
      token_endpoint: https://idp.example.com/oauth2/token
      token_endpoint_auth_method: client_secret_basic   # add this
Migration steps
  1. Confirm this applies: you are coming from v0.48.0 and use a pre-registered (non-DCR) oauth2 upstream with a client secret.
  2. Check your IdP's token_endpoint_auth_methods_supported in its discovery document, or its client registration. If only client_secret_basic is accepted, act.
  3. Set tokenEndpointAuthMethod: client_secret_basic on every affected upstreamProviders[].oauth2Config (spec.embeddedAuthServer.upstreamProviders[] for MCPExternalAuthConfig, spec.authServerConfig.upstreamProviders[] for VirtualMCPServer), or token_endpoint_auth_method under upstreams[].oauth2_config in a raw run config.
  4. Apply and restart the workload, then verify a full login and a token refresh — refresh uses the same auth style.
  5. If your IdP accepts either style, or requires the POST body, do nothing.

The CRD schema is unchanged apart from doc text, so there is no CRD upgrade ordering concern.

PR: #​6648

Migration guide: AWS STS role claim shapes now fail closed

Affects deployments using an awsSts external auth config with claim-based roleMappings. Matcher-expression-only configurations are unaffected.

Role mappings are evaluated with the CEL expression claim_value in claims[role_claim_key], and CEL's in only has list and map overloads. Two bugs followed: a string role claim raised a swallowed "no such overload" error and silently produced the fallback role even on an exact match, and an object role claim made in test map-key membership, matching spuriously. Both are now corrected, and unsupported shapes fail closed rather than quietly granting a role.

Two behavior changes, both deliberate:

  1. A bare-string role claim exactly equal to a configured claim now selects its mapped role instead of fallbackRoleArn. Strings that merely contain the value still do not match.
  2. A role claim that is an object, number, boolean, or null now fails closed — HTTP 403 Failed to determine IAM role from the aws_sts middleware, or a failed backend call with failed to select IAM role in vMCP outbound auth.

A missing role claim still falls back exactly as before.

Before
{ "sub": "user1", "groups": { "admins": true } }
{ "sub": "user2", "groups": 7 }
After
{ "sub": "user1", "groups": ["admins"] }
{ "sub": "user1", "groups": "admins" }
Migration steps
  1. Decode a representative token for each IdP feeding an awsSts config and inspect the claim named by awsSts.roleClaim (default groups).
  2. List of strings → no action, behavior unchanged.
  3. Bare string → no config change needed, but confirm the outcome is intended: those users now receive the mapped role rather than fallbackRoleArn. Verify the mapped role's IAM trust policy accepts these subjects and that its permissions suit that population.
  4. Object, number, boolean, or null → change the IdP claim mapping to emit a string or a JSON array of strings (in Keycloak, use a multivalued group/role mapper and flatten nested claims like realm_access.roles to a top-level key — roleClaim is a flat lookup, not a dot path). Alternatively point roleClaim at a correctly-shaped claim, or convert those mappings to matcher CEL expressions, which are evaluated against the raw claims and are unaffected.
  5. Before rolling out, watch for the new WARN lines role claim has unsupported shape, failing closed and claim-based role mapping evaluation failed, failing closed — they name the offending role_arn. Note that CEL expression evaluation failed, skipping mapping was promoted from Debug to Warn, so pre-existing matcher-expression bugs will now appear at default log level.
  6. In a mixed configuration, re-check priorities: a claim mapping with a lower priority number than a previously-winning matcher mapping now wins for string claims.

PR: #​6306 — Closes #​6305

Migration guide: Go 1.27 toolchain and go:// builder image

Two separate audiences.

go:// workload users. The default builder image for go:// workloads moved from golang:1.26-alpine to golang:1.27-alpine. Only freshly built go:// workloads with no override are affected. Go's compatibility promise makes a failure unlikely, but a server relying on a removed deprecated API will not compile.

Downstream Go importers of the root module. github.com/stacklok/toolhive now declares go 1.27.0 with no toolchain directive. Under the default GOTOOLCHAIN=auto Go downloads 1.27 transparently; under GOTOOLCHAIN=local, a pinned-toolchain CI, an air-gapped build, or a distro-packaged Go, the build fails hard with go: go.mod requires go >= 1.27. The nested github.com/stacklok/toolhive/sdk/go module deliberately keeps its go 1.26.0 floor and is not affected.

Before
# ~/.toolhive/config.yaml — previously relied on the golang:1.26-alpine default
runtime_configs: {}
After
# Pin the previous builder image persistently
runtime_configs:
  go:
    builder_image: "golang:1.26-alpine"
    additional_packages:
      - ca-certificates
      - git
Migration steps
  1. For a one-off go:// run, pin per invocation: thv run go://github.com/example/server --runtime-image golang:1.26-alpine.
  2. For a persistent pin, set runtime_configs.go.builder_image in ~/.toolhive/config.yaml as above. additional_packages replaces rather than appends to the built-in ["ca-certificates", "git"], so list them explicitly. Only the builder stage is customizable for Go workloads; the runtime stage is always alpine:3.23.
  3. If you import the root module, upgrade your toolchain to Go 1.27+, or keep GOTOOLCHAIN=auto and allow Go to fetch the toolchain on demand.
  4. If you only need the management API client, depend on github.com/stacklok/toolhive/sdk/go instead — it retains the go 1.26.0 floor.
  5. In GitHub Actions, point setup-go at the root go-version-file: go.mod rather than pinning a version.

PR: #​6639

🆕 New Features

  • A new github.com/stacklok/toolhive/sdk/go module provides a typed, generated client covering all 77 documented management API operations, with safe default timeout and response-size handling, without pulling in ToolHive's full application dependency graph (#​6637).
  • Cedar policies can now govern the MCP SEP-2640 Skills extension on direct-proxied servers: skills/get maps to Action::"get_skill" on the skill's exact URI, and skills/list responses are filtered to the skills the caller may get — previously both methods were refused outright by default-deny, and skills/list without a get_skill permit now returns an empty list instead of a 403 (#​6512).
  • thv ai-plugin push --key <cosign.key> is available again for publishers using automatic local server discovery, now that key-signed plugins can be verified at install time with thv ai-plugin install --public-key and pinned in toolhive.lock.yaml for later sync/upgrade; remote or manually configured API URLs must still sign keylessly (#​6528).
  • The embedded auth server and vMCP Redis session storage can now connect to an unauthenticated Redis/Valkey instance by omitting the ACL user configuration, logging a startup WARN that names the store so an unintended downgrade stays visible (#​6551).

🐛 Bug Fixes

  • Security: thv skill upgrade --allow-signer-change no longer doubles as unsigned consent — it previously succeeded against an unsigned candidate, silently dropping a signer-pinned skill's recorded identity and rewriting the lock entry as unsigned: true; both thv skill upgrade and thv ai-plugin upgrade now report failed [unsigned-rejected] and name the uninstall … --scope project then install … --scope project --allow-unsigned sequence that records the exception explicitly (#​6629).
  • The auth server's /.well-known/jwks.json now publishes configured fallback keys alongside the signing key (primary first, de-duplicated by kid), making the documented three-step zero-downtime signing-key rotation actually work instead of a hard cutover that invalidated every outstanding JWT (#​6638 — Closes #​6451).
  • Progress notifications that arrived just before a request's final response are no longer silently dropped in the Streamable HTTP proxy — queued notifications/progress frames are flushed to the SSE stream, in backend order, before the response closes it (#​6491 — Closes #​6349).
  • VirtualMCPServer Deployments using spec.podTemplateSpec no longer get a metadata.generation bump and a spurious DeploymentUpdated event on every statusReportingInterval tick, including the 30s default — pod-template drift detection was comparing user-merged label maps for exact equality (#​6377 — Fixes #​6340).
  • OAuth error responses from the embedded auth server now preserve Fosite's RFC 6749 error codes and hints (invalid_client, invalid_grant, …) where a wrapped error could previously degrade to a generic server_error (#​6639).

🧹 Misc

  • vMCP session dial control is now resolved per backend workload rather than through a single address-blind hook, so a deployment can enforce a different dial policy for each backend at session initialization (#​6567).
  • Fixed a missing miniredis import that broke typecheck — and therefore every test — in pkg/authserver/runner on main (#​6636).
  • Fixed the Go SDK verification job, which was installing Go 1.26 for root-module generator tooling that now requires 1.27, and refreshed the stale generated SDK artifacts (#​6645).

📦 Dependencies

Module Version
github.com/stacklok/toolhive-core v0.0.47

Also migrates all Redis call sites from the now-deprecated toolhive-core/redis compatibility facade to redisconn directly (#​6646).

👋 Welcome to our newest contributor: @​isaacgao4396 🎉

Full commit log

What's Changed

New Contributors

Full Changelog: stacklok/toolhive@v0.48.0...v0.49.0

🔗 Full changelog: stacklok/toolhive@v0.48.0...v0.49.0

v0.48.0

Compare Source

What's Changed

Full Changelog: stacklok/toolhive@v0.47.1...v0.48.0

v0.47.1

Compare Source

What's Changed

Full Changelog: stacklok/toolhive@v0.47.0...v0.47.1

v0.47.0

Compare Source

What's Changed

New Contributors

Full Changelog: stacklok/toolhive@v0.46.0...v0.47.0

v0.46.0

Compare Source

🚀 Toolhive v0.46.0 is live!

An authentication and supply-chain hardening release: embedded auth servers can now trust private CAs for upstream identity providers, plugin upgrades refuse silent signer rotations, and three OAuth flows return the right answer instead of a misleading one.

🆕 New Features

  • You can now point an embedded auth server at an in-cluster identity provider behind an internal CA by setting caBundleRef on an OIDC or OAuth2 upstream, which adds that CA to the system trust roots for discovery, token, user-info, and dynamic client registration calls to that upstream only (#​6428).
    • Upgrade note: apply the operator-crds 0.46.0 chart before (or together with) the operator chart — a stale CRD silently prunes caBundleRef from applied resources instead of rejecting it. Existing manifests that do not set caBundleRef reconcile identically and are not restarted by this upgrade.
  • thv ai-plugin upgrade now refuses to install a plugin update whose signature identity differs from the one recorded in the project lock file — or that is unsigned — reporting signer-change-blocked and exiting 4 until you confirm the rotation with the new --allow-signer-change flag, which re-records the new identity in the lock (#​6401).
    • Available with the experimental plugins lock file behind TOOLHIVE_PLUGINS_LOCK_ENABLED; lock entries with no recorded provenance are unaffected.

🐛 Bug Fixes

  • OAuth clients such as ChatGPT that publish a Client ID Metadata Document listing several token endpoint authentication methods can now sign in against ToolHive's authorization server, which negotiates a mutually supported method instead of rejecting the document outright (#​6400).
  • thv llm setup now fails fast with an actionable "callback port already in use" message instead of silently switching to a random port that your identity provider would reject — free the port or pass --callback-port <port> with a redirect URI registered with your IdP (#​6432).
  • Deployments that provision user accounts out-of-band (for example via SCIM) can now have logins from unprovisioned identities rejected with a proper access_denied OAuth error, so clients stop treating a deliberate denial as a retryable server failure (#​6441).

🧹 Misc

  • The release-notes CI workflow now allowlists the tools its expert subagents actually use, so release-notes generation stops burning turns on permission denials and completes within budget (#​6439).

👋 Welcome to our newest contributor: @​alex-feel 🎉

Full commit log

What's Changed

New Contributors

Full Changelog: stacklok/toolhive@v0.45.0...v0.46.0

🔗 Full changelog: stacklok/toolhive@v0.45.0...v0.46.0

v0.45.0

Compare Source

🚀 Toolhive v0.45.0 is live!

A security-and-supply-chain release: two coordinated fixes harden the thv serve management API and the container build path, plugin artifacts gain end-to-end Sigstore verification, and skill pushes are now signed keylessly by default. Alongside that, Prometheus metrics move to a dedicated diagnostics port behind a migration switch, the embedded auth server gains two new RFC 7523 flows, and Virtual MCP finally honours configured backend timeouts and propagates backend health changes to live sessions.

🔐 Security

  • Cross-origin requests to the thv serve management API are now rejected — the management API creates workloads with caller-named host bind mounts, registers MCP servers into on-disk agent configs, and installs skill artifacts, all as unauthenticated state-changing routes in the default configuration, and a cross-origin web page could drive it with a CORS "simple" POST that never triggers a preflight. This is GHSA-xv9h-79wp-q9w6. Two independent barriers are added for TCP listeners only (migration guide below).
  • Package names can no longer inject shell syntax into generated Dockerfiles — package names from npx://, uvx:// and go:// references were interpolated into RUN instructions unvalidated; they are now constrained to a character class that excludes shell metacharacters, and the two remaining bare interpolations in the templates are quoted (migration guide below).
  • A UTF-8 BOM can no longer smuggle a filtered list past authorization — a BOM-prefixed tools/list/prompts/list/resources/list response failed every decode and sniff and passed through unfiltered, leaking entries the Cedar policy or tool filter was supposed to remove (#​6304).
  • Non-2xx list responses are no longer delivered as HTTP 200 with an unfiltered body — under the transparent proxy, the first Flush() committed an implicit WriteHeader(200), so a backend 500 reached the client as a 200 carrying the full unfiltered list (#​6335).
  • Stored plugin signature material is size-capped — Sigstore bundles and git commit payloads/signatures are rejected (422) above 1 MiB rather than truncated, so a hostile repo or registry cannot push a multi-MB blob into SQLite on every install (#​6399).

⚠️ Breaking Changes

  • thv serve now requires Content-Type: application/json on state-changing requests that carry a body, and validates Origin on loopback TCP binds — non-JSON callers get 415 Unsupported Media Type (migration guide below)
  • Package names are constrained to [A-Za-z0-9@/:._+=~[]-] — a npx:///uvx:///go:// reference containing anything else now fails at build time instead of being interpolated into the Dockerfile (migration guide below)
  • thv skill sync without --clients now targets every skill-supporting client — combined with the new qoder client, every locked skill reports as drifted on the first sync after upgrading, and thv skill sync --check exits non-zero in CI (migration guide below)
  • runtime_config.build_with on npx:///go:// images is now a 400, and runtime_config.runtime_env is now actually applied to the built image — both were silently discarded by the workload REST API (migration guide below)
  • thv skill push requires exactly one of --key, --identity-token, or --no-sign — key + no_sign was previously accepted and pushed an unsigned artifact; it is now a 400 (migration guide below)
  • Virtual MCP now honours operational.timeouts — a configured value below 30 s will now actually cut backend calls that previously got the silent 30 s default (migration guide below)
  • Several exported Go interfaces gained required methods or changed signatures — plugins.MaterializationAdapter, state.Store writers, storage.UpstreamTokenStorage, and six function signatures. No effect on the CLI, the operator, the wire protocol, or persisted state (migration guide below)
  • The thv llm local proxy returns 401 token_required instead of 502 server_error when the stored credential has been rejected by the IdP ([#​6389](https://redirect.github.co

❗ Important

✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate

renovate Bot commented Aug 5, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 111 additional dependencies were updated
  • The go directive was updated for compatibility reasons

Details:

Package Change
go 1.26.2 -> 1.27.0
github.com/gofrs/flock v0.13.0 -> v0.13.1
github.com/google/go-containerregistry v0.21.8 -> v0.22.1
github.com/stacklok/toolhive-core v0.0.37 -> v0.0.47
github.com/stretchr/testify v1.11.1 -> v1.12.1
go.opentelemetry.io/otel v1.44.0 -> v1.46.0
go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.44.0 -> v1.45.0
go.opentelemetry.io/otel/sdk v1.44.0 -> v1.46.0
go.opentelemetry.io/otel/trace v1.44.0 -> v1.46.0
golang.org/x/crypto v0.54.0 -> v0.57.0
golang.org/x/sync v0.22.0 -> v0.23.0
golang.org/x/sys v0.47.0 -> v0.48.0
golang.org/x/term v0.45.0 -> v0.46.0
cel.dev/expr v0.25.1 -> v0.25.2
github.com/1password/onepassword-sdk-go v0.3.1 -> v0.4.1
github.com/aws/aws-sdk-go-v2 v1.43.2 -> v1.47.0
github.com/aws/aws-sdk-go-v2/config v1.32.33 -> v1.33.4
github.com/aws/aws-sdk-go-v2/credentials v1.19.32 -> v1.20.4
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.33 -> v1.20.0
github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.33 -> v1.5.3
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.33 -> v2.8.3
github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.34 -> v1.5.3
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.14 -> v1.13.19
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.33 -> v1.14.3
github.com/aws/aws-sdk-go-v2/service/signin v1.5.2 -> v1.10.0
github.com/aws/aws-sdk-go-v2/service/sso v1.33.2 -> v1.38.0
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.38.2 -> v1.43.0
github.com/aws/aws-sdk-go-v2/service/sts v1.45.2 -> v1.50.0
github.com/aws/smithy-go v1.27.5 -> v1.28.1
github.com/charmbracelet/x/ansi v0.11.7 -> v0.11.8
github.com/coreos/go-oidc/v3 v3.20.0 -> v3.21.0
github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.0 -> v4.4.1
github.com/docker/cli v29.6.2+incompatible -> v29.7.2+incompatible
github.com/docker/go-connections v0.7.0 -> v0.8.1
github.com/dylibso/observe-sdk/go v0.0.0-20240819160327-2d926c5d788a -> v0.0.0-20240828172851-9145d8ad07e1
github.com/ebitengine/purego v0.10.0 -> v0.10.2
github.com/emicklei/go-restful/v3 v3.12.2 -> v3.13.0
github.com/extism/go-sdk v1.7.0 -> v1.7.1
github.com/felixge/httpsnoop v1.0.4 -> v1.1.0
github.com/getsentry/sentry-go v0.47.0 -> v0.49.0
github.com/go-chi/chi/v5 v5.3.0 -> v5.3.2
github.com/go-jose/go-jose/v4 v4.1.4 -> v4.1.5
github.com/go-logr/logr v1.4.3 -> v1.4.4
github.com/go-ole/go-ole v1.2.6 -> v1.3.0
github.com/go-openapi/jsonpointer v0.23.1 -> v1.0.0
github.com/go-openapi/jsonreference v0.21.6 -> v1.0.1
github.com/go-openapi/swag v0.26.1 -> v0.28.0
github.com/go-openapi/swag/cmdutils v0.26.1 -> v0.28.0
github.com/go-openapi/swag/conv v0.27.0 -> v0.29.2
github.com/go-openapi/swag/fileutils v0.26.1 -> v0.29.1
github.com/go-openapi/swag/jsonutils v0.26.1 -> v0.29.1
github.com/go-openapi/swag/loading v0.26.1 -> v0.29.1
github.com/go-openapi/swag/mangling v0.26.1 -> v0.29.1
github.com/go-openapi/swag/netutils v0.26.1 -> v0.28.0
github.com/go-openapi/swag/stringutils v0.26.1 -> v0.29.1
github.com/go-openapi/swag/typeutils v0.27.0 -> v0.29.2
github.com/go-openapi/swag/yamlutils v0.26.1 -> v0.29.1
github.com/goccy/go-json v0.10.5 -> v0.10.6
github.com/google/gnostic-models v0.7.0 -> v0.7.1
github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0 -> v2.30.0
github.com/ianlancetaylor/demangle v0.0.0-20250417193237-f615e6bd150b -> v0.0.0-20251118225945-96ee0021ea0f
github.com/lestrrat-go/jwx/v3 v3.0.13 -> v3.3.0
github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0 -> v0.0.0-20260330125221-c963978e514e
github.com/mattn/go-isatty v0.0.21 -> v0.0.24
github.com/mattn/go-runewidth v0.0.23 -> v0.0.24
github.com/moby/moby/api v1.55.0 -> v1.56.0
github.com/moby/moby/client v0.5.1 -> v0.6.0
github.com/modelcontextprotocol/registry v1.8.0 -> v1.8.1
github.com/openzipkin/zipkin-go v0.4.2 -> v0.4.3
github.com/ory/x v0.0.665 -> v0.0.729
github.com/prometheus/client_golang v1.23.2 -> v1.24.1
github.com/prometheus/client_model v0.6.2 -> v0.6.3
github.com/prometheus/common v0.67.5 -> v0.71.0
github.com/prometheus/procfs v0.20.1 -> v0.22.0
github.com/redis/go-redis/v9 v9.21.0 -> v9.22.0
github.com/sagikazarmark/locafero v0.11.0 -> v0.12.0
github.com/shirou/gopsutil/v4 v4.26.5 -> v4.26.8
github.com/tailscale/hujson v0.0.0-20260302212456-ecc657c15afd -> v0.0.0-20260727124030-b80ff77dac4f
github.com/tetratelabs/wazero v1.9.0 -> v1.11.0
github.com/tidwall/gjson v1.18.0 -> v1.19.0
github.com/tklauser/go-sysconf v0.3.16 -> v0.4.0
github.com/tklauser/numcpus v0.11.0 -> v0.12.0
go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace v0.46.1 -> v0.60.0
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.68.0 -> v0.71.0
go.opentelemetry.io/contrib/propagators/b3 v1.21.0 -> v1.40.0
go.opentelemetry.io/contrib/propagators/jaeger v1.21.1 -> v1.40.0
go.opentelemetry.io/contrib/samplers/jaegerremote v0.15.1 -> v0.29.0
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.44.0 -> v1.46.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.44.0 -> v1.46.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.44.0 -> v1.46.0
go.opentelemetry.io/otel/exporters/prometheus v0.66.0 -> v0.68.0
go.opentelemetry.io/otel/exporters/zipkin v1.21.0 -> v1.35.0
go.opentelemetry.io/otel/metric v1.44.0 -> v1.46.0
go.yaml.in/yaml/v3 v3.0.4 -> v3.0.5
golang.ngrok.com/ngrok/v2 v2.1.4 -> v2.2.0
golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f -> v0.0.0-20260824195058-e88cd73687aa
golang.org/x/exp/event v0.0.0-20260611194520-c48552f49976 -> v0.0.0-20260824195058-e88cd73687aa
golang.org/x/exp/jsonrpc2 v0.0.0-20260709172345-9ea1abe57597 -> v0.0.0-20260908205506-85c1c2202aba
golang.org/x/mod v0.38.0 -> v0.41.0
golang.org/x/net v0.57.0 -> v0.59.0
golang.org/x/oauth2 v0.36.0 -> v0.37.0
golang.org/x/text v0.40.0 -> v0.42.0
golang.org/x/time v0.15.0 -> v0.16.0
golang.org/x/tools v0.48.0 -> v0.49.0
google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa -> v0.0.0-20260819154853-08b0e4226688
google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa -> v0.0.0-20260831171406-18b4a7587f8a
google.golang.org/grpc v1.82.1 -> v1.83.2
google.golang.org/protobuf v1.36.11 -> v1.36.12
k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912 -> v0.0.0-20251125145642-4e65d59e963e
modernc.org/libc v1.72.1 -> v1.75.6
modernc.org/memory v1.11.0 -> v1.12.1
modernc.org/sqlite v1.49.1 -> v1.58.0

@renovate
renovate Bot force-pushed the renovate/github.com-stacklok-toolhive-0.x branch from 5af15b3 to 53f4f72 Compare August 10, 2026 13:29
@renovate renovate Bot changed the title Update module github.com/stacklok/toolhive to v0.42.0 Update module github.com/stacklok/toolhive to v0.42.1 Aug 10, 2026
@renovate
renovate Bot force-pushed the renovate/github.com-stacklok-toolhive-0.x branch from 53f4f72 to 162a713 Compare August 14, 2026 17:45
@renovate renovate Bot changed the title Update module github.com/stacklok/toolhive to v0.42.1 Update module github.com/stacklok/toolhive to v0.43.0 Aug 14, 2026
@renovate
renovate Bot force-pushed the renovate/github.com-stacklok-toolhive-0.x branch from 162a713 to 39f565c Compare August 18, 2026 17:46
@renovate renovate Bot changed the title Update module github.com/stacklok/toolhive to v0.43.0 Update module github.com/stacklok/toolhive to v0.44.0 Aug 18, 2026
@renovate
renovate Bot force-pushed the renovate/github.com-stacklok-toolhive-0.x branch from 39f565c to 800744f Compare August 26, 2026 19:58
@renovate renovate Bot changed the title Update module github.com/stacklok/toolhive to v0.44.0 Update module github.com/stacklok/toolhive to v0.45.0 Aug 26, 2026
@renovate
renovate Bot force-pushed the renovate/github.com-stacklok-toolhive-0.x branch from 800744f to a893bd8 Compare August 27, 2026 20:03
@renovate renovate Bot changed the title Update module github.com/stacklok/toolhive to v0.45.0 Update module github.com/stacklok/toolhive to v0.46.0 Aug 27, 2026
@renovate
renovate Bot force-pushed the renovate/github.com-stacklok-toolhive-0.x branch from a893bd8 to a8eed49 Compare September 8, 2026 12:29
@renovate renovate Bot changed the title Update module github.com/stacklok/toolhive to v0.46.0 Update module github.com/stacklok/toolhive to v0.47.0 Sep 8, 2026
@renovate
renovate Bot force-pushed the renovate/github.com-stacklok-toolhive-0.x branch from a8eed49 to 76ac97f Compare September 8, 2026 22:17
@renovate renovate Bot changed the title Update module github.com/stacklok/toolhive to v0.47.0 Update module github.com/stacklok/toolhive to v0.47.1 Sep 8, 2026
@renovate
renovate Bot force-pushed the renovate/github.com-stacklok-toolhive-0.x branch from 76ac97f to 4608efd Compare September 10, 2026 21:52
@renovate renovate Bot changed the title Update module github.com/stacklok/toolhive to v0.47.1 Update module github.com/stacklok/toolhive to v0.48.0 Sep 10, 2026
@renovate
renovate Bot force-pushed the renovate/github.com-stacklok-toolhive-0.x branch from 4608efd to 29d4f6f Compare September 11, 2026 21:17
@renovate renovate Bot changed the title Update module github.com/stacklok/toolhive to v0.48.0 Update module github.com/stacklok/toolhive to v0.49.0 Sep 11, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants