Repository navigation
fix(deps): update toolhive - #1089
Open
renovate[bot] wants to merge 1 commit into
Open
renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
Contributor
Author
ℹ️ Artifact update noticeFile name: go.modIn order to perform the update(s) described in the table above, Renovate ran the
Details:
|
Contributor
🔒 MCP Security Scan Results |
renovate
Bot
force-pushed
the
renovate/toolhive
branch
5 times, most recently
from
October 14, 2026 13:51
71b3a5e to
6f9637c
Compare
Contributor
🛡️ Grype Vulnerability Scan ResultsFixable High and Critical findings block publishing. Review these package versions when evaluating an override.
|
| Severity | Vulnerability | Package | Installed | Available fix |
|---|---|---|---|---|
| High | GHSA-mrhx-c7xc-m3w5 |
zod |
3.25.76 |
4.6.6 |
| High | GHSA-xjj6-f33q-929c |
undici |
6.28.1 |
6.29.1 |
| High | GHSA-qrxm-fqhp-jwvm |
undici |
6.28.1 |
6.29.1 |
| High | GHSA-2m5v-pch6-74hx |
undici |
6.28.1 |
6.29.1 |
aws-documentation
✅ No blocking findings.
blender-mcp
✅ No blocking findings.
brightdata-mcp
| Severity | Vulnerability | Package | Installed | Available fix |
|---|---|---|---|---|
| High | GHSA-mrhx-c7xc-m3w5 |
zod |
3.25.76 |
4.6.6 |
chroma-mcp
✅ No blocking findings.
chrome-devtools-mcp
✅ No blocking findings.
clarity-mcp-server
| Severity | Vulnerability | Package | Installed | Available fix |
|---|---|---|---|---|
| High | GHSA-mrhx-c7xc-m3w5 |
zod |
3.25.76 |
4.6.6 |
context7
✅ No blocking findings.
graphlit-mcp-server
| Severity | Vulnerability | Package | Installed | Available fix |
|---|---|---|---|---|
| High | GHSA-7mx3-vvmw-hjmv |
@graphql-tools/utils |
11.2.2 |
12.0.1 |
| High | GHSA-mrhx-c7xc-m3w5 |
zod |
3.25.76 |
4.6.6 |
| High | GHSA-c4qx-w738-7hr3 |
@graphql-tools/utils |
11.2.2 |
12.0.2 |
heroku-mcp-server
| Severity | Vulnerability | Package | Installed | Available fix |
|---|---|---|---|---|
| High | GHSA-mrhx-c7xc-m3w5 |
zod |
3.25.76 |
4.6.6 |
launchdarkly-mcp-server
✅ No blocking findings.
mcp-clickhouse
✅ No blocking findings.
mcp-neo4j-aura-manager
| Severity | Vulnerability | Package | Installed | Available fix |
|---|---|---|---|---|
| Critical | GHSA-vv7q-7jx5-f767 |
fastmcp |
2.14.7 |
3.2.0 |
| High | GHSA-rww4-4w9c-7733 |
fastmcp |
2.14.7 |
3.2.0 |
mcp-neo4j-cypher
| Severity | Vulnerability | Package | Installed | Available fix |
|---|---|---|---|---|
| Critical | GHSA-vv7q-7jx5-f767 |
fastmcp |
2.14.7 |
3.2.0 |
| High | GHSA-rww4-4w9c-7733 |
fastmcp |
2.14.7 |
3.2.0 |
mcp-neo4j-memory
| Severity | Vulnerability | Package | Installed | Available fix |
|---|---|---|---|---|
| Critical | GHSA-vv7q-7jx5-f767 |
fastmcp |
2.14.7 |
3.2.0 |
| High | GHSA-rww4-4w9c-7733 |
fastmcp |
2.14.7 |
3.2.0 |
mcp-searxng
✅ No blocking findings.
mcp-server-git
✅ No blocking findings.
mcp-server-time
✅ No blocking findings.
next-devtools-mcp
| Severity | Vulnerability | Package | Installed | Available fix |
|---|---|---|---|---|
| High | GHSA-22jm-h49p-29qw |
@modelcontextprotocol/sdk |
1.26.0 |
1.32.0 |
| High | GHSA-mrhx-c7xc-m3w5 |
zod |
3.25.76 |
4.6.6 |
| High | GHSA-6qxp-vccf-f47h |
@modelcontextprotocol/sdk |
1.26.0 |
1.31.0 |
| High | GHSA-46jr-4wx8-v453 |
@modelcontextprotocol/sdk |
1.26.0 |
1.32.0 |
| High | GHSA-f897-62hf-6gxq |
@modelcontextprotocol/sdk |
1.26.0 |
1.30.1 |
notion
| Severity | Vulnerability | Package | Installed | Available fix |
|---|---|---|---|---|
| High | GHSA-mrhx-c7xc-m3w5 |
zod |
3.24.1 |
4.6.6 |
octocode-mcp
| Severity | Vulnerability | Package | Installed | Available fix |
|---|---|---|---|---|
| High | GHSA-mrhx-c7xc-m3w5 |
zod |
3.25.76 |
4.6.6 |
okta
✅ No blocking findings.
perplexity-ask
| Severity | Vulnerability | Package | Installed | Available fix |
|---|---|---|---|---|
| High | GHSA-mrhx-c7xc-m3w5 |
zod |
3.25.76 |
4.6.6 |
phoenix-mcp
✅ No blocking findings.
pinecone-mcp
✅ No blocking findings.
playwright-mcp
✅ No blocking findings.
redis-mcp-server
✅ No blocking findings.
sentry-mcp-server
| Severity | Vulnerability | Package | Installed | Available fix |
|---|---|---|---|---|
| High | GHSA-22jm-h49p-29qw |
@modelcontextprotocol/sdk |
1.31.0 |
1.32.0 |
| High | GHSA-46jr-4wx8-v453 |
@modelcontextprotocol/sdk |
1.31.0 |
1.32.0 |
server-everything
✅ No blocking findings.
server-memory
✅ No blocking findings.
server-sequential-thinking
✅ No blocking findings.
stripe-mcp
✅ No blocking findings.
supabase-mcp-server
✅ No blocking findings.
tavily-mcp
| Severity | Vulnerability | Package | Installed | Available fix |
|---|---|---|---|---|
| High | GHSA-22jm-h49p-29qw |
@modelcontextprotocol/sdk |
1.26.0 |
1.32.0 |
| High | GHSA-6qxp-vccf-f47h |
@modelcontextprotocol/sdk |
1.26.0 |
1.31.0 |
| High | GHSA-46jr-4wx8-v453 |
@modelcontextprotocol/sdk |
1.26.0 |
1.32.0 |
| High | GHSA-f897-62hf-6gxq |
@modelcontextprotocol/sdk |
1.26.0 |
1.30.1 |
renovate
Bot
force-pushed
the
renovate/toolhive
branch
4 times, most recently
from
October 20, 2026 18:04
44f2a67 to
bc1ad69
Compare
renovate
Bot
force-pushed
the
renovate/toolhive
branch
5 times, most recently
from
October 28, 2026 19:06
363a172 to
bc0e507
Compare
renovate
Bot
force-pushed
the
renovate/toolhive
branch
from
October 28, 2026 21:10
bc0e507 to
f56f40e
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Note
This PR body was truncated due to platform limits.
This PR contains the following updates:
v0.42.1→v0.59.0v0.0.38→v0.0.58Release Notes
stacklok/toolhive (github.com/stacklok/toolhive)
v0.59.0Compare Source
What's Changed
Full Changelog: stacklok/toolhive@v0.58.0...v0.59.0
v0.58.0Compare Source
What's Changed
ca04ba5by @renovate[bot] in #6933Full Changelog: stacklok/toolhive@v0.57.0...v0.58.0
v0.57.0Compare Source
What's Changed
New Contributors
Full Changelog: stacklok/toolhive@v0.56.0...v0.57.0
v0.56.0Compare Source
What's Changed
New Contributors
Full Changelog: stacklok/toolhive@v0.55.2...v0.56.0
v0.55.2Compare Source
Security
Rootless Podman host-access endpoints blocked by the egress proxy (GHSA-2x65-h9w3-h7hc, Medium)
With network isolation on rootless Podman, a workload could reach host services through the Squid or Envoy egress proxy using
host.containers.internalor the address it maps to. ToolHive's protected set only covered Docker's host names and bridge gateways, and Podman's host-access address is not necessarily a bridge gateway.On Podman, ToolHive now reads the DNS sidecar's runtime-generated
/etc/hostsat deployment. It adds every address mapped tohost.containers.internal,host.docker.internal, orgateway.docker.internalto the protected set, alongside all bridge gateways. Both proxies block those names and addresses unless--allow-docker-gatewayis set.What changes for operators
host.containers.internalis missing from the runtime's hosts file (for example withno_hosts = trueincontainers.conf), or if the hosts data cannot be read. This applies even with--allow-docker-gateway.What's Changed
Full Changelog: stacklok/toolhive@v0.55.1...v0.55.2
v0.55.1Compare Source
What's Changed
Full Changelog: stacklok/toolhive@v0.55.0...v0.55.1
v0.55.0Compare Source
What's Changed
f0251ebby @renovate[bot] in #6848Full Changelog: stacklok/toolhive@v0.54.0...v0.55.0
v0.54.0Compare Source
What's Changed
New Contributors
Full Changelog: stacklok/toolhive@v0.53.0...v0.54.0
v0.53.0Compare Source
🚀 Toolhive v0.53.0 is live!
This release adds group-based upstream selection to the vMCP embedded auth server, and stops the operator from acting on
spec.permissionProfileas a security fix. It also makes vMCP keep a backend's valid tools when one of its items can't be decoded, and makes MCPRemoteProxy report config failures correctly.🔄 Deprecations
MCPServer.spec.permissionProfileis deprecated and the Kubernetes operator now ignores it. The field still exists in thev1beta1CRD so existing manifests keep applying, but it never restricted pods in Kubernetes. UsepodTemplateSpecsecurity contexts andNetworkPolicyresources instead. MCPServers that set the field get aPermissionProfileUnsupportedWarning event. No removal version has been announced yet. (security fix, commit d5aa374)🆕 New Features
authserver-config.yaml. It picks which extra upstream providers each user goes through, based on group claims from the first upstream, so users skip OAuth legs for services they have no account on. The feature is opt-in and fails closed when the group claim is missing. CRD support follows in #6740. (#6739)🐛 Bug Fixes
spec.permissionProfileto the runner as a profile name or file path. Before, a crafted value could make the operator read arbitrary local files. Theconfigmapprofile volume is no longer mounted, andthv export --format k8sno longer emits the field. MCPServers that set the field may roll their proxy pods once after upgrading. (d5aa374)Ready=Falsewith a message naming the failing handler and an up-to-dateobservedGeneration. Before, it could showPhase: Failedwhile still reporting a staleReady=True. (#6776)tools/list,resources/list, resource-template and prompt items it cannot decode, and logs a warning naming the backend and the item. Before, one bad item hid all of that backend's capabilities. This applies to the Modern list path only; the Legacy path is tracked in #6814. (#6772)typeis a JSON Schema type array (for example["object","null"]) are now kept, with the schema passed through unchanged, because toolhive-core is bumped to v0.0.52. (#6815)📦 Dependencies
github.com/stacklok/toolhive-coreghcr.io/modelcontextprotocol/inspector(defaultthv inspectorimage)github.com/go-chi/chi/v5github.com/aws/aws-sdk-go-v2github.com/aws/aws-sdk-go-v2/configgithub.com/aws/aws-sdk-go-v2/service/stsgithub.com/pressly/goose/v3github.com/prometheus/commongithub.com/onsi/ginkgo/v2github.com/alicebob/miniredis/v2golang.org/x/cryptogolang.org/x/modgolang.org/x/netgolang.org/x/syncgolang.org/x/sysgolang.org/x/termgolang.org/x/exp/jsonrpc2faecfb2oras.land/oras-go/v2python(e2e test image)create-github-app-token,download-artifact,setup-node,upload-artifact,claude-code-action,codeql-action,goreleaser-action,kind-action)👋 Welcome to our newest contributor: @feiiiiii5 🎉
Full commit log
What's Changed
New Contributors
Full Changelog: stacklok/toolhive@v0.52.0...v0.53.0
🔗 Full changelog: stacklok/toolhive@v0.52.0...v0.53.0
v0.52.0Compare Source
🚀 Toolhive v0.52.0 is live!
This release adds TLS for Redis session storage (runtime and operator), makes
thv llmsetup and teardown safer by default, and fixes several authorization, OAuth and operator issues.thv llm teardownnow purges cached tokens by default — a full teardown deletes cached OIDC tokens and fails if cleanup fails; pass--keep-tokensto keep the old behavior (migration guide) (#6733)DCRCredentialStoregained a method — out-of-tree implementations ofpkg/authserver/storage.DCRCredentialStoreno longer compile until they addUpdateDCRCredentialsIfUnchanged(migration guide) (#6758)Migration guide:
thv llm teardownpurges cached tokens by defaultAffects CLI users and scripts that run
thv llm teardown. Cleanup is local only: tokens are deleted from the secrets provider, not revoked at the identity provider.Before
# Tokens survived teardown unless you opted in thv llm teardown thv llm teardown --purge-tokensAfter
Migration steps
thv llm setupcould skip re-authentication, add--keep-tokens.--keep-tokensto skip the purge.--keep-tokensand--purge-tokensare mutually exclusive.llm.Teardownhas new parameters andllm.PurgeTokensnow returns an error.PR: #6733 — Closes #6732
Migration guide:
DCRCredentialStoregained a methodAffects only Go code outside this repository that implements
DCRCredentialStore(including hand-written mocks). The built-in memory and Redis stores are already updated.Before
After
Migration steps
UpdateDCRCredentialsIfUnchanged(ctx, creds, expected)to your implementation.creds.Keyonly if the stored row still equalsexpected.ErrNotFoundif the row is absent and the newErrDCRCredentialsChangedif it differs; write nothing in either case.expected, or one whoseKeydiffers fromcreds.Key.PR: #6758
🆕 New Features
MCPServer,MCPRemoteProxyandVirtualMCPServeracceptspec.sessionStorage.tls, includingcaCertSecretReffor a private CA; a startup WARN is now logged when Redis session storage runs without TLS, so log-based alerting may fire for existing plaintext setups (#6767)thv llm setupnow configures Claude Code for one-hour prompt caching by default; re-run setup to pick it up, or use--short-prompt-cacheto opt out (#6515)🐛 Bug Fixes
spec.secretsonMCPServeraccepts multiple keys of the same Secret; re-apply theoperator-crdschart (#6690)allowMayActwith a wildcard delegate; re-apply theoperator-crdschart (#6532)roles); policies that referenced these claims will now see real values, so review any that were written around them being absent (#6707)tools/list,prompts/listandresources/listresponses keep the members the backend sent (including MCP 2026-07-28resultType), always carryCache-Control: private, no-store, and reject ambiguous duplicate or aliased annotation members (#6709)🧹 Misc
📦 Dependencies
charm.land/bubbletea/v2github.com/aws/aws-sdk-go-v2github.com/aws/aws-sdk-go-v2/configgithub.com/aws/aws-sdk-go-v2/service/stsgithub.com/cenkalti/backoff/v7github.com/getsentry/sentry-go(+otel,otel/otlp)github.com/go-git/go-git/v5github.com/go-git/go-billy/v5github.com/Microsoft/go-winiogithub.com/moby/moby/clientgithub.com/moby/moby/apigithub.com/prometheus/commongithub.com/redis/go-redis/v9github.com/shirou/gopsutil/v4github.com/spiffe/go-spiffe/v2github.com/stacklok/toolhive-cataloggithub.com/stacklok/toolhive-coregithub.com/tidwall/gjsongo.opentelemetry.io/otel(and SDK/exporters)go.opentelemetry.io/contrib/instrumentation/net/http/otelhttpmodernc.org/sqlitesigs.k8s.io/controller-runtimeghcr.io/modelcontextprotocol/inspectoranchore/sbom-actionanthropics/claude-code-actionFull commit log
What's Changed
Full Changelog: stacklok/toolhive@v0.51.4...v0.52.0
🔗 Full changelog: stacklok/toolhive@v0.51.4...v0.52.0
v0.51.4Compare Source
What's Changed
Full Changelog: stacklok/toolhive@v0.51.3...v0.51.4
v0.51.3Compare Source
Security
Embedded authorization server: upstream callback bound to the initiating browser (GHSA-2gjv-f568-6cxp, High)
/oauth/callbackcompleted a login for whichever browser arrived with a valid upstreamstate. An attacker who started an authorization for their own client could hand the upstream identity provider URL to a victim and receive an authorization code minted for the victim's identity. The device flow's verification-page login shared the same gap.Both flows now bind the login to the browser that started it:
/oauth/authorizeandPOST /oauth/deviceset a per-flow cookie whose hash is stored on the pending record, and the callback completes only when the same browser presents it. The device verification form additionally requires an anti-forgery token, so a cross-site page cannot start a device login from a victim's browser.What changes for operators and tooling
/oauth/authorizeor the device verification page, with cookies enabled for that host. Headless drivers that walk the flow with a plain HTTP client must carry cookies between steps, and must load the device verification form before posting auser_code.redirect_uri, defaulting to{resourceUrl}/oauth/callbackin the operator) must share a hostname with the browser-facing authorize URL (authorizationEndpointBaseUrl, elseissuer). If the authorize URL ishttps, a non-loopback callback must behttpstoo. Mismatched deployments log aWARNat startup naming the upstream, and every browser login through it is rejected until fixed.authorizationEndpointBaseUrlis set, the device flow'sverification_uriis now advertised from that base URL instead of the issuer.What's Changed
Full Changelog: stacklok/toolhive@v0.51.2...v0.51.3
v0.51.2Compare Source
What's Changed
Full Changelog: stacklok/toolhive@v0.51.1...v0.51.2
v0.51.1Compare Source
What's Changed
Full Changelog: stacklok/toolhive@v0.51.0...v0.51.1
v0.51.0Compare Source
What's Changed
New Contributors
Full Changelog: stacklok/toolhive@v0.50.0...v0.51.0
v0.50.0Compare Source
What's Changed
Configuration
📅 Schedule: (UTC)
* 0-3 * * 1)🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.