Skip to content

Update stacklok/toolhive to v0.51.1 - #1173

Open
renovate[bot] wants to merge 4 commits into
mainfrom
renovate/stacklok-toolhive-0.x
Open

Update stacklok/toolhive to v0.51.1#1173
renovate[bot] wants to merge 4 commits into
mainfrom
renovate/stacklok-toolhive-0.x

Conversation

@renovate

@renovate renovate Bot commented Sep 23, 2026 •
edited by github-actions Bot
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Update Change
stacklok/toolhive minor v0.50.0 → v0.51.1

After this PR opens, .github/workflows/upstream-release-docs.yml adds source-verified content edits for the new release. For stacklok/toolhive, the same workflow also syncs reference assets (CLI help, Swagger) and regenerates the CRD MDX pages.

Release Notes

stacklok/toolhive (stacklok/toolhive)

v0.51.1

Compare Source

What's Changed

Full Changelog: stacklok/toolhive@v0.51.0...v0.51.1

v0.51.0

Compare Source

What's Changed

New Contributors

Full Changelog: stacklok/toolhive@v0.50.0...v0.51.0

Configuration

📅 Schedule: (in timezone America/New_York)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Never, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

Docs update for toolhive v0.51.1

At a glance
Upstream stacklok/toolhive v0.50.0 → v0.51.1
Hand-written changes 2 commit(s)
Reference assets refreshed (separate commit)
Gaps 0
Owner @rdimitrov - identified from merged release PR stacklok/toolhive#6704
Release contributors 1 review requested (see sidebar) · 4 not requested (no docs impact)
Action required Spot-check skill-authored prose for accuracy

Who does what

@rdimitrov cut this release and owns this PR: review your own changes, chase the remaining approvals, and merge once they're in. You don't need to wait on a review from anyone listed as having no docs impact below.

Everyone with a review request: the target is a review and approval within 2 business days.

Summary of changes

  • Updated the Cedar actions section in docs/toolhive/reference/authz-policy-reference.mdx to document that completion/complete and subscriptions/listen are now authorized against the referenced prompt or resource, and removed completion/complete from the always-allowed table. Added a "Changed in v0.51.0" admonition covering the upgrade action for existing deployments.

No docs impact identified

4 contributor(s) had no-docs-impact commits in this release. No review was requested, and the workflow did not auto-notify them.

Run cost

Session Turns Cost (USD)
Generation 52 $5.1659
Editorial review 28 $2.5278
Total 80 $7.6937
How this PR was built

Two Claude Opus sessions run per release: a generation pass
(upstream-release-docs skill, 6 phases) followed by a fresh-
context editorial pass (docs-review). Prettier/ESLint
auto-fixes are applied after.

Auto-synced paths — do not hand-edit these in review:

  • static/api-specs/
  • docs/toolhive/reference/cli/ (toolhive only)
  • docs/toolhive/reference/crds/

If a "Gaps needing human context" section is present above,
each entry includes a paste-ready Helper prompt for local
Claude a reviewer can use to resolve the gap.

@renovate
Update stacklok/toolhive to v0.51.1
e0ed5eb 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
@renovate renovate Bot added the autogen-docs Pull requests generated by automated release workflows label Sep 23, 2026
@vercel

vercel Bot commented Sep 23, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
docs-website Ready Ready Preview Sep 23, 2026 12:22am UTC

Request Review

@github-actions
github-actions Bot marked this pull request as draft September 23, 2026 00:08
@claude

claude Bot commented Sep 23, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Claude finished @renovate[bot]'s task in 6m 23s —— View job

Upstream release docs sync: toolhive v0.50.0 → v0.51.1

  • Load /upstream-release-docs skill and read .release-meta.json
  • Phase 1: Enumerate commits and classify docs-relevance
  • Phase 2: Investigate source for each docs-relevant commit
  • Phase 3: Locate affected docs pages
  • Phase 4: Draft and apply edits
  • Phase 5: Format, lint, and verify build
  • Phase 6: Write artifacts (SUMMARY.md, REVIEWERS.json) and push

Summary

The user-visible change in this release is the authz behavior for completion/complete and subscriptions/listen: both were always-allowed before v0.51.0 and now derive their check from the referenced prompt or resource. Updated docs/toolhive/reference/authz-policy-reference.mdx to describe the derived checks, request-shape rejections, and the upgrade action.

The rest of the release is not docs-facing:

Committed: f691ff6 - "Document derived authz for completion and subscriptions".
· Branch: renovate/stacklok-toolhive-0.x

@github-actions @claude
Document derived authz for completion and subscriptions
f691ff6 
completion/complete and subscriptions/listen are no longer
always-allowed in v0.51.0; both are authorized against the
prompt or resource they reference. Update the Cedar actions
section to describe the derived checks, the request-shape
rejections, and the upgrade action for existing deployments.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
@claude

claude Bot commented Sep 23, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Claude finished @renovate[bot]'s task in 4m 38s —— View job

Editorial review complete

Reviewed the derived-authz additions in docs/toolhive/reference/authz-policy-reference.mdx against the upstream source at pkg/authz/derived_authz.go and pkg/authz/middleware.go.

  • Identify files changed in the last commit
  • Verify claims against upstream source (resources/subscribe/unsubscribe → read_resource, 50-URI cap, 30 s budget, null/unknown-member rejection, resource-template URI verbatim as entity ID — all match the code)
  • Apply actionable prose fixes
  • Run prettier and eslint (both clean)
  • Commit and push

Fixes applied (commit 16a9d45)

  • Replaced engineering shorthand: admitted as a unit → authorized as a whole; leave this proxy and the backend guessing at the same meaning → force ToolHive and the backend to guess at its meaning (also names ToolHive explicitly since "this proxy" had no clear antecedent).
  • Split the long paragraph that mixed the "denied as a unit" fact, the 50-URI cap, and the notifications/null handling into two focused paragraphs.
  • Reworded the opening Several other MCP methods name a capability the same actions already govern to act on a capability that the actions above already govern — the earlier phrasing used "name" in an unusual sense and the reference to "the actions above" now cross-refers explicitly to the preceding table.

Not fixed (pre-existing, out of scope)

  • The Resource URI sanitization section (lines ~530-537) and the Resource::"<sanitized_uri>" note in the entity type table describe a sanitization pass that no longer runs. pkg/authz/authorizers/cedar/core.go:1173 uses the URI verbatim as the entity ID (TestAuthorizeResourceReadEntityIDsCollisionFree covers this), and the newly added resource-template example correctly uses unsanitized URIs in its policy grants. Worth cleaning up in a follow-up PR so the sanitization section and the new template example stop contradicting each other, but it predates this release.
    · Branch

@github-actions @claude
Tighten derived authz prose for clarity
16a9d45 
Replace engineering shorthand ("admitted as a unit", "leave this
proxy and the backend guessing") with reader-facing terms, split
the long paragraph on subscriptions/listen into two, and reword
the opening so the derivation table reads more naturally.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
@github-actions
github-actions Bot requested a review from rdimitrov September 23, 2026 00:21
@github-actions
github-actions Bot marked this pull request as ready for review September 23, 2026 00:21

This branch was successfully deployed

1 active deployment
Preview — 16a9d450 Deployed Sep 23, 2026 by vercel[bot]
View deployment
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@rdimitrov rdimitrov rdimitrov approved these changes

Assignees

@rdimitrov rdimitrov

Labels

autogen-docs Pull requests generated by automated release workflows

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@rdimitrov