Update stacklok/toolhive to v0.44.0 by renovate[bot] · Pull Request #1113 · stacklok/docs-website

renovate · 2026-08-24T19:26:51Z

This PR contains the following updates:

Package	Update	Change
stacklok/toolhive	minor	`v0.43.0` → `v0.44.0`

After this PR opens, .github/workflows/upstream-release-docs.yml adds source-verified content edits for the new release. For stacklok/toolhive, the same workflow also syncs reference assets (CLI help, Swagger) and regenerates the CRD MDX pages.

Release Notes

stacklok/toolhive (stacklok/toolhive)

`v0.44.0`

Compare Source

What's Changed

Push skills unsigned until keyless signing lands by @samuv in #6334
Support actor_token in RFC 8693 token exchange by @jhrozek in #6331
Guard OAuth token and DCR endpoints against SSRF by @jhrozek in #6351
fix(auth): require audience when introspecting via Google tokeninfo by @SashaMIT in #6236
Fix stale version comment on codespell action pin by @samuv in #6360
Harden external may_act delegation by @jhrozek in #6353
Use an absolute thv path in the Claude Desktop helper shim by @jerm-dro in #6354
Release v0.44.0 by @toolhive-release-app[bot] in #6365

Full Changelog: stacklok/toolhive@v0.43.0...v0.44.0

Configuration

📅 Schedule: (in timezone America/New_York)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Never, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

Docs update for `toolhive` v0.44.0

At a glance


Upstream	`stacklok/toolhive` `v0.43.0` → `v0.44.0`
Hand-written changes	1 commit(s)
Reference assets	refreshed (separate commit)
Gaps	0
Owner	@jerm-dro - identified from merged release PR stacklok/toolhive#6365
Release contributors	3 review requested (see sidebar) · 1 not requested (no docs impact)
Action required	Spot-check skill-authored prose for accuracy

Who does what

@jerm-dro cut this release and owns this PR: review your own changes, chase the remaining approvals, and merge once they're in. You don't need to wait on a review from anyone listed as having no docs impact below.

Everyone with a review request: the target is a review and approval within 2 business days.

Summary of changes

Added the "Accept subject tokens from external issuers" section to docs/toolhive/guides-k8s/embedded-auth-server-k8s.mdx, covering the new trustedIssuers CRD field on MCPExternalAuthConfig.spec.embeddedAuthServer (external OIDC issuers, per-issuer allowedActors/allowedDelegateClients/actorClaim, and the allowMayAct opt-in) from Harden external may_act delegation toolhive#6353.
Added a shorter sibling "Accept subject tokens from external issuers" section to docs/toolhive/guides-vmcp/embedded-auth-server-vmcp.mdx, covering trustedIssuers under VirtualMCPServer.spec.authServerConfig and linking back to the Kubernetes guide for the full field list and trust model.
Skipped: Support actor_token in RFC 8693 token exchange toolhive#6331 (actor_token in RFC 8693 token exchange) — request-time /oauth/token parameter with no CLI/CRD surface; already covered by upstream's design doc, and the docs don't shadow that layer.
Skipped: Guard OAuth token and DCR endpoints against SSRF toolhive#6351 (OAuth/DCR SSRF guard) — the narrowed INSECURE_DISABLE_URL_VALIDATION behavior is not user-facing in these docs (the env var isn't mentioned anywhere).
Skipped: fix(auth): require audience when introspecting via Google tokeninfo toolhive#6236 (Google tokeninfo audience) — fails loudly at startup with an explanatory error, which per CLAUDE.md doesn't warrant a callout; --oidc-audience is already recommended in the thv serve docs.
Skipped: Use an absolute thv path in the Claude Desktop helper shim toolhive#6354 (absolute thv path in Claude Desktop shim) — bug fix; thv llm setup is only surfaced in auto-generated CLI reference.
Skipped: Push skills unsigned until keyless signing lands toolhive#6334 (skills push --no-sign) — internal CI workflow only.

No docs impact identified

@samuv - your changes in this release didn't appear to affect the docs, so no review is requested and you're not blocking this PR. Please skim the diff anyway and comment if something of yours was missed or misjudged.

Run cost

Session	Turns	Cost (USD)
Generation	128	$10.6838
Editorial review	18	$1.6264
Total	146	$12.3102

How this PR was built

Two Claude Opus sessions run per release: a generation pass
(upstream-release-docs skill, 6 phases) followed by a fresh-
context editorial pass (docs-review). Prettier/ESLint
auto-fixes are applied after.

Auto-synced paths — do not hand-edit these in review:

static/api-specs/
docs/toolhive/reference/cli/ (toolhive only)
docs/toolhive/reference/crds/

If a "Gaps needing human context" section is present above,
each entry includes a paste-ready Helper prompt for local
Claude a reviewer can use to resolve the gap.

vercel · 2026-08-24T19:26:58Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs-website	Ready	Preview	Aug 25, 2026 11:40am

claude · 2026-08-24T19:27:54Z

Claude finished @renovate[bot]'s task in 11m 52s —— View job

Upstream release docs sync — toolhive v0.44.0

Ran the upstream-release-docs skill in unattended mode. Pushed 07035d9 to renovate/stacklok-toolhive-0.x and wrote SUMMARY.md + REVIEWERS.json at the repo root for the workflow to consume (both are gitignored).

Phase 1: Discovery — categorized PRs #6331, #6236, #6334, #6351, #6353, #6354, #6360, #6365
Phase 2: Deep-dive — source-verified each PR at v0.44.0
Phase 3: Audit existing docs — built impact map (no displaced language for trustedIssuers; new terrain)
Phase 4: Implementation — added two sections
Phase 5: Validation — prettier and eslint clean, docs-review findings applied
Phase 6: Wrote SUMMARY.md and REVIEWERS.json

Content changes

docs/toolhive/guides-k8s/embedded-auth-server-k8s.mdx — new section "Accept subject tokens from external issuers" covering trustedIssuers on MCPExternalAuthConfig.spec.embeddedAuthServer. Full field table, the allowedDelegateClients binding rule, the allowMayAct opt-in and its ["*"] rejection, and the <issuerUrl>#<externalSub> subject qualification.
docs/toolhive/guides-vmcp/embedded-auth-server-vmcp.mdx — sibling section for VirtualMCPServer.spec.authServerConfig.trustedIssuers with a link back to the Kubernetes guide for the full field list. Matches the pattern the vMCP page uses elsewhere for shared config.

Skipped PRs (rationale in `SUMMARY.md`)

Support actor_token in RFC 8693 token exchange toolhive#6331 (actor_token in RFC 8693) — request-time endpoint parameter, no CLI/CRD surface, upstream design doc already covers it at that level.
Guard OAuth token and DCR endpoints against SSRF toolhive#6351 (OAuth/DCR SSRF guard) — INSECURE_DISABLE_URL_VALIDATION isn't currently documented anywhere, so the narrowing has no docs impact.
fix(auth): require audience when introspecting via Google tokeninfo toolhive#6236 (Google tokeninfo audience) — fails loudly at startup with an explanatory error; per CLAUDE.md that doesn't warrant a callout, and --oidc-audience is already recommended in the thv serve guide.
Use an absolute thv path in the Claude Desktop helper shim toolhive#6354 (Claude Desktop shim absolute path) — thv llm setup is only surfaced in auto-generated CLI reference, so the bug fix needs no hand-written change.
Push skills unsigned until keyless signing lands toolhive#6334 (skills push --no-sign) and Fix stale version comment on codespell action pin toolhive#6360 (codespell version comment) — CI-only.

`REVIEWERS.json`

docs_facing: true — jhrozek (author of #6353 that this documents), SashaMIT (per "when unsure classify true" — flagged for confirmation on the fail-loud skip), jerm-dro (release owner, plus flagged on the Claude Desktop shim skip).
docs_facing: false — samuv (CI-only PRs).

Notes

Local npm run build failed on an unrelated pre-existing issue: plugins/mcp-metadata-plugin shells out to thv (the ToolHive CLI) which isn't installed in this environment. Not a docs issue. Prettier and eslint pass.
· branch: renovate/stacklok-toolhive-0.x

claude · 2026-08-24T19:40:02Z

Claude finished @renovate[bot]'s task in 2m 36s —— View job

Editorial review of upstream release docs

Reviewing changes from commit 07035d9 (Document trustedIssuers for embedded auth server).

Todos

Identify files changed in the last commit
Run /docs-review over the changed docs files
Apply actionable fixes
Format and lint edits
Commit and push

Files under review:

docs/toolhive/guides-k8s/embedded-auth-server-k8s.mdx
docs/toolhive/guides-vmcp/embedded-auth-server-vmcp.mdx

Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

Add an "Accept subject tokens from external issuers" section to both the vMCP and Kubernetes embedded auth server guides, covering the new `trustedIssuers` CRD field shipped in toolhive v0.44.0 (stacklok/toolhive#6353) that lets the RFC 8693 token-exchange grant accept subject tokens minted by an external OIDC issuer. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Replace the hand-written trustedIssuers sections with pointers to the dedicated token exchange guide. Keep generated CRD references as the single source for field details and avoid duplicating the conceptual delegation guidance.

renovate Bot added the autogen-docs Pull requests generated by automated release workflows label Aug 24, 2026

github-actions Bot marked this pull request as draft August 24, 2026 19:27

vercel Bot deployed to Preview August 24, 2026 19:29 View deployment

vercel Bot deployed to Preview August 24, 2026 19:40 View deployment

github-actions Bot assigned jerm-dro Aug 24, 2026

github-actions Bot requested review from jerm-dro and jhrozek August 24, 2026 19:43

github-actions Bot marked this pull request as ready for review August 24, 2026 19:43

vercel Bot deployed to Preview August 24, 2026 19:44 View deployment

danbarr mentioned this pull request Aug 24, 2026

Fix tool denials and restore build validation in release docs workflow #1114

Merged

4 tasks

renovate Bot and others added 5 commits August 25, 2026 12:57

Update stacklok/toolhive to v0.44.0

cbe4768

Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

Refresh reference assets for toolhive v0.44.0

f4ca0fe

Apply prettier and eslint fixups to skill output

84f7ece

Trim duplicated delegation guidance

7d1844f

Replace the hand-written trustedIssuers sections with pointers to the dedicated token exchange guide. Keep generated CRD references as the single source for field details and avoid duplicating the conceptual delegation guidance.

jhrozek force-pushed the renovate/stacklok-toolhive-0.x branch from 095f321 to 7d1844f Compare August 25, 2026 11:39

vercel Bot deployed to Preview August 25, 2026 11:40 View deployment

jhrozek approved these changes Aug 25, 2026

View reviewed changes

samuv approved these changes Aug 25, 2026

View reviewed changes

jerm-dro merged commit e84aff7 into main Aug 25, 2026
5 checks passed

jerm-dro deleted the renovate/stacklok-toolhive-0.x branch August 25, 2026 21:21

Navigation Menu

Uh oh!

Update stacklok/toolhive to v0.44.0 - #1113

Update stacklok/toolhive to v0.44.0#1113
jerm-dro merged 5 commits into
mainfrom
renovate/stacklok-toolhive-0.x

renovate Bot commented Aug 24, 2026 •

edited by github-actions Bot

Loading

Uh oh!

vercel Bot commented Aug 24, 2026 •

edited

Loading

Uh oh!

claude Bot commented Aug 24, 2026 •

edited

Loading

Uh oh!

claude Bot commented Aug 24, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

renovate Bot commented Aug 24, 2026 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v0.44.0

What's Changed

Configuration

Docs update for toolhive v0.44.0

At a glance

Who does what

Summary of changes

No docs impact identified

Run cost

Uh oh!

vercel Bot commented Aug 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

claude Bot commented Aug 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Upstream release docs sync — toolhive v0.44.0

Content changes

Skipped PRs (rationale in SUMMARY.md)

REVIEWERS.json

Notes

Uh oh!

claude Bot commented Aug 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Editorial review of upstream release docs

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

renovate Bot commented Aug 24, 2026 •

edited by github-actions Bot

Loading

`v0.44.0`

Docs update for `toolhive` v0.44.0

vercel Bot commented Aug 24, 2026 •

edited

Loading

claude Bot commented Aug 24, 2026 •

edited

Loading

Skipped PRs (rationale in `SUMMARY.md`)

`REVIEWERS.json`

claude Bot commented Aug 24, 2026 •

edited

Loading