Skip to content

Update stacklok/toolhive to v0.47.0 - #1141

Merged
rdimitrov merged 7 commits into
mainfrom
renovate/stacklok-toolhive-0.x
Sep 9, 2026
Merged

Update stacklok/toolhive to v0.47.0#1141
rdimitrov merged 7 commits into
mainfrom
renovate/stacklok-toolhive-0.x

Conversation

@renovate

@renovate renovate Bot commented Sep 8, 2026 •
edited by github-actions Bot
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Update Change
stacklok/toolhive minor v0.46.0 → v0.47.0

After this PR opens, .github/workflows/upstream-release-docs.yml adds source-verified content edits for the new release. For stacklok/toolhive, the same workflow also syncs reference assets (CLI help, Swagger) and regenerates the CRD MDX pages.

Release Notes

stacklok/toolhive (stacklok/toolhive)

v0.47.0

Compare Source

What's Changed

New Contributors

Full Changelog: stacklok/toolhive@v0.46.0...v0.47.0

Configuration

📅 Schedule: (in timezone America/New_York)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Never, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

Docs update for toolhive v0.47.0

At a glance
Upstream stacklok/toolhive v0.46.0 → v0.47.0
Hand-written changes 2 commit(s)
Reference assets refreshed (separate commit)
Gaps 1
Owner @rdimitrov - identified from merged release PR stacklok/toolhive#6539
Release contributors 4 review requested (see sidebar) · 13 not requested (no docs impact)
Action required Yes — resolve 1 gap(s), then spot-check prose

Who does what

@rdimitrov cut this release and owns this PR: review your own changes, chase the remaining approvals, and merge once they're in. You don't need to wait on a review from anyone listed as having no docs impact below.

Everyone with a review request: the target is a review and approval within 2 business days.

Summary of changes

Summary of changes

Deferred (recorded as decisions rather than omissions)

Gaps needing human context

Canonical inbound grants restructure on MCPExternalAuthConfig (PR stacklok/toolhive#6499 by @jhrozek)

v0.47.0 introduces a canonical inboundGrants structure on MCPExternalAuthConfig.spec.embeddedAuthServer with three sub-families (tokenExchange, jwtBearer, and — pending SVID verification — spiffeClientAuth). The legacy top-level fields (delegateClients and the RFC 8693 policy fields on trustedIssuers entries) are marked deprecated but retained for CRD compatibility. Admission rules enforce that canonical and legacy policy for the same grant family are mutually exclusive.

The existing delegateClients and token-exchange documentation in docs/toolhive/guides-k8s/embedded-auth-server-k8s.mdx and docs/toolhive/guides-vmcp/embedded-auth-server-vmcp.mdx describes the legacy shape, which still works. A dedicated pass to introduce the canonical form (recommended shape, migration notes, and reworked examples) is deferred rather than partially shipped here, since a half-migrated guide would misdirect readers.

File(s): docs/toolhive/guides-k8s/embedded-auth-server-k8s.mdx, docs/toolhive/guides-vmcp/embedded-auth-server-vmcp.mdx, docs/toolhive/concepts/embedded-auth-server.mdx

Helper prompt for local Claude:

Read PR stacklok/toolhive#6499 ("Expose canonical inbound grants in CRDs") and PR stacklok/toolhive#6473 ("Normalize canonical inbound grants") for context. Update the "Pre-provision confidential clients for token exchange" section in docs/toolhive/guides-k8s/embedded-auth-server-k8s.mdx and the matching section in docs/toolhive/guides-vmcp/embedded-auth-server-vmcp.mdx to lead with the canonical inboundGrants.tokenExchange shape (delegateClients + issuerPolicies referencing named trustedIssuers[].name). Preserve the legacy delegateClients and trustedIssuers-embedded policy as a compatibility note, and call out that canonical and legacy configurations for the same grant family are mutually exclusive per the CRD's XValidation rules. Verify field names, required fields, and the admission-rule messages against static/api-specs/toolhive-crds/mcpexternalauthconfigs.schema.json at v0.47.0 before writing prose.

No docs impact identified

13 contributor(s) had no-docs-impact commits in this release. No review was requested, and the workflow did not auto-notify them.

Review routing

GitHub could not request the upstream contributor directly, so review went to the human merger of each relevant upstream PR:

Run cost

Session Turns Cost (USD)
Generation 120 $15.5099
Editorial review 50 $5.6408
Total 170 $21.1507
How this PR was built

Two Claude Opus sessions run per release: a generation pass
(upstream-release-docs skill, 6 phases) followed by a fresh-
context editorial pass (docs-review). Prettier/ESLint
auto-fixes are applied after.

Auto-synced paths — do not hand-edit these in review:

  • static/api-specs/
  • docs/toolhive/reference/cli/ (toolhive only)
  • docs/toolhive/reference/crds/

If a "Gaps needing human context" section is present above,
each entry includes a paste-ready Helper prompt for local
Claude a reviewer can use to resolve the gap.

@renovate
Update stacklok/toolhive to v0.47.0
9a6088c 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
@renovate renovate Bot added the autogen-docs Pull requests generated by automated release workflows label Sep 8, 2026
@vercel

vercel Bot commented Sep 8, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
docs-website Ready Ready Preview Sep 9, 2026 7:29am UTC

Request Review

@github-actions
github-actions Bot marked this pull request as draft September 8, 2026 15:07
@claude

claude Bot commented Sep 8, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Claude finished @renovate[bot]'s task in 14m 25s —— View job

Upstream release docs for toolhive v0.47.0

Ran the upstream-release-docs skill in unattended mode. Doc edits committed as f85af5c on this branch.

  • Phase 1: Discovery — categorized PRs into docs-facing vs internal
  • Phase 2: Deep dive — verified against local clone at v0.47.0; SPIFFE readiness gate confirmed via validateSPIFFENotYetEnforced
  • Phase 3: Displacement audit and impact map
  • Phase 4: Applied doc edits to 5 files
  • Phase 5: npm run prettier:fix and npm run eslint:fix clean
  • Phase 6: Wrote SUMMARY.md, GAPS.md, REVIEWERS.json for the workflow

Hand-written edits in this commit

Deferred with reasons (see SUMMARY.md)

@github-actions
Document toolhive v0.47.0 user-facing changes
f85af5c 
- Add signing (keyless default, --identity-token, --no-sign) and
  sync/upgrade lifecycle sections to the ai-plugins guide; add a
  --public-key install section for key-pair-signed plugins
- Add a --public-key install note for key-pair-signed skills
- Add --max-request-body-size coverage to the CLI run guide and a
  spec.maxRequestBodySize example to the K8s run guide (default 8 MiB)
- Note OBO middleware (Stacklok Enterprise) alongside tokenExchange and
  awsSts as incompatible with disableUpstreamTokenInjection
@claude

claude Bot commented Sep 8, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Claude finished @renovate[bot]'s task in 7m 4s —— View job

Docs review for toolhive v0.47.0 release edits

Reviewed the 5 hand-written docs the previous commit changed. Applied minor editorial fixes to the newly added content per the project style guide, then formatted and linted the edits.

  • Locate files changed in HEAD (5 hand-written .mdx files)
  • Run docs-review on each file
  • Apply actionable fixes
  • Verify factual claims against CLI reference and upstream source
  • Format and lint edits
  • Commit and push (d97e1e9)

Fixes applied

  • Replaced "consumers" PR jargon (three occurrences in the newly added sections) with reader-focused wording. The project's CLAUDE.md style guide lists "consumers" as engineering shorthand that should not appear in docs.
    • docs/toolhive/guides-cli/ai-plugins.mdx:130 — "so consumers can supply it" → "so users installing the plugin can supply it"
    • docs/toolhive/guides-cli/ai-plugins.mdx:275 — rewritten from "Consumers who install an unsigned plugin project-scoped must pass…" into a direct imperative: "To install an unsigned plugin project-scoped, pass --allow-unsigned to thv ai-plugin install."
    • docs/toolhive/guides-cli/skills-management.mdx:456 — same "consumers" → "users installing the skill"

Notes (verified but not changed)

  • Cross-checked new claims against cmd/thv/app/ai_plugin_push.go and the CLI reference. The --max-request-body-size flag, --public-key install flag, and the keyless-only plugin push behavior are all accurate. The upstream source explicitly comments that plugin push is keyless-only (#6442), and the doc's note about that is correct.
  • The disableUpstreamTokenInjection table row in the embedded auth server K8s guide correctly adds the OBO/Enterprise caveat and gives the "why" ("since each would re-add credentials after the strip").
  • The MCPServer CRD reference link from the new "Limit inbound request body size" section resolves; spec.maxRequestBodySize is present in the CRD schema.

Branch: renovate/stacklok-toolhive-0.x -

@github-actions @claude
Refine wording in v0.47.0 release notes
d97e1e9 
Replace "consumers" (flagged as PR jargon by the project style guide)
with reader-focused wording in the newly added key-pair signing
sections. Also rewrite the "unsigned plugin project-scoped" sentence
into a direct imperative for the reader.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
@github-actions
github-actions Bot marked this pull request as ready for review September 8, 2026 15:30
ChrisJBurns
ChrisJBurns previously approved these changes Sep 8, 2026
View reviewed changes
@samuv

samuv commented Sep 8, 2026

Copy link
Copy Markdown
Contributor

@claude please remove the key-pair-signed ai-plugin we still have some work to be merged before we can document it

@claude

claude Bot commented Sep 8, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Claude finished @samuv's task in 1m 45s —— View job

Removed key-pair-signed plugin docs

  • Read the added plugin signing content
  • Remove the key-pair-signed install section
  • Format and lint
  • Commit and push (db07b6e)

What changed

Removed the "Install a key-pair-signed plugin" section from docs/toolhive/guides-cli/ai-plugins.mdx (18 lines) - the --public-key install example and the surrounding explanation about pinning the key in toolhive.lock.yaml.

What I left in place, and why

  • The keyless signing coverage under Publish to a registry (thv ai-plugin push default behavior, --identity-token, --no-sign, --allow-unsigned) stays, since that's the merged v0.47.0 behavior from Sign plugin pushes and remove the lock feature gate toolhive#6438.
  • The :::note in that section still says plugin push is keyless-only and points readers to skills for key-pair signing. That reads correctly now that the install section is gone. Say the word if you'd rather drop the note too.
  • docs/toolhive/guides-cli/skills-management.mdx still documents --public-key for skills signed with --key (Verify key-signed skill installs against a public key toolhive#6447). Your request named ai-plugin specifically, so I didn't touch it - tell me if skills should come out as well.
  • docs/toolhive/reference/cli/thv_ai-plugin_install.md still lists the --public-key flag. That file is auto-generated from the CLI source on every release sync, so hand-editing it would be silently overwritten. Hiding the flag has to land upstream.

Checks

npm run prettier:fix and npm run eslint are clean. npm run build fails in this environment at the MCP metadata plugin's network fetch (Failed to fetch MCP server data), which is a sandbox network restriction unrelated to this change; the change is a prose deletion with no remaining inbound links to the removed heading.
· Branch: renovate/stacklok-toolhive-0.x

@github-actions @samuv @claude
Drop key-pair-signed plugin install docs
db07b6e 
Upstream work for key-pair-signed AI plugin installs is not fully
merged yet, so remove the section documenting `--public-key` on
`thv ai-plugin install`. The auto-generated CLI reference still
lists the flag.

Co-authored-by: Samuele V <4377202+samuv@users.noreply.github.com>
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
samuv
samuv previously approved these changes Sep 8, 2026
View reviewed changes
rdimitrov
rdimitrov previously approved these changes Sep 8, 2026
View reviewed changes
jhrozek and others added 2 commits September 9, 2026 09:27
@jhrozek @claude
Remove request body size limit section from CLI/K8s guides
8ccf1df 
The flag and CRD field are already fully documented in the
auto-generated CLI reference (thv_run.md, thv_proxy.md), so the
hand-written guide sections just duplicated it with extra internal
rationale that doesn't help readers decide when to use it.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
@jhrozek @claude
Fix broken MCPExternalAuthConfig example
65b7e81 
embeddedAuthServer requires at least one of upstreamProviders,
delegateClients, or a trustedIssuers entry with jwtBearerGrant, but
that's an "at least one of" CEL rule the example generator's
required-field walk can't see, so upstreamProviders silently dropped
out of the generated example when it became optional upstream. The
issuer-only example that resulted fails admission.

Add exampleForceFields to crd-intros.mjs so an override can restore a
sibling field the schema doesn't mark required, and use it to put
upstreamProviders back in the embeddedAuthServer example.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
@jhrozek
jhrozek dismissed stale reviews from rdimitrov and samuv via 65b7e81 September 9, 2026 07:28
@rdimitrov
rdimitrov merged commit 8dff84a into main Sep 9, 2026
5 checks passed
@rdimitrov
rdimitrov deleted the renovate/stacklok-toolhive-0.x branch September 9, 2026 10:38
@jhrozek jhrozek mentioned this pull request Sep 9, 2026
Merged
7 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jhrozek jhrozek jhrozek approved these changes
@rdimitrov rdimitrov rdimitrov approved these changes
@samuv samuv samuv left review comments
@ChrisJBurns ChrisJBurns ChrisJBurns left review comments

Assignees

@rdimitrov rdimitrov

Labels

autogen-docs Pull requests generated by automated release workflows

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@samuv @jhrozek @rdimitrov @ChrisJBurns