Skip to content

Update go modules - #951

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/go-modules
Open

Update go modules#951
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/go-modules

Conversation

@renovate

@renovate renovate Bot commented Oct 19, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
github.com/aws/smithy-go v1.28.5 → v1.28.6 age confidence
github.com/go-chi/chi/v5 v5.3.2 → v5.5.0 age confidence
github.com/modelcontextprotocol/registry v1.8.1 → v1.8.4 age confidence
github.com/stacklok/toolhive v0.51.4 → v0.56.0 age confidence
github.com/stacklok/toolhive-core v0.0.53 → v0.0.57 age confidence

Release Notes

aws/smithy-go (github.com/aws/smithy-go)

v1.28.6

Compare Source

General Highlights

  • Dependency Update: Updated to the latest SDK module versions

Module Highlights

  • github.com/aws/smithy-go: v1.28.6
    • Bug Fix: Enforce event stream header key value length limit instead of truncating
    • Bug Fix: Retain the value in a list with the zero value when encountering a null entry on a dense list. This matches how legacy code-generated JSON deserializers behaved.
go-chi/chi (github.com/go-chi/chi/v5)

v5.5.0

Compare Source

What's Changed

New Contributors

Full Changelog: go-chi/chi@v5.4.0...v5.5.0

v5.4.0

Compare Source

What's Changed

New Contributors

Full Changelog: go-chi/chi@v5.3.2...v5.4.0

modelcontextprotocol/registry (github.com/modelcontextprotocol/registry)

v1.8.4

Compare Source

What's Changed

Full Changelog: modelcontextprotocol/registry@v1.8.3...v1.8.4

v1.8.3

Compare Source

What's Changed

Full Changelog: modelcontextprotocol/registry@v1.8.2...v1.8.3

v1.8.2

Compare Source

What's Changed

New Contributors

Full Changelog: modelcontextprotocol/registry@v1.8.1...v1.8.2

stacklok/toolhive (github.com/stacklok/toolhive)

v0.56.0

Compare Source

What's Changed

New Contributors

Full Changelog: stacklok/toolhive@v0.55.2...v0.56.0

v0.55.2

Compare Source

Security

Rootless Podman host-access endpoints blocked by the egress proxy (GHSA-2x65-h9w3-h7hc, Medium)

With network isolation on rootless Podman, a workload could reach host services through the Squid or Envoy egress proxy using host.containers.internal or the address it maps to. ToolHive's protected set only covered Docker's host names and bridge gateways, and Podman's host-access address is not necessarily a bridge gateway.

On Podman, ToolHive now reads the DNS sidecar's runtime-generated /etc/hosts at deployment. It adds every address mapped to host.containers.internal, host.docker.internal, or gateway.docker.internal to the protected set, alongside all bridge gateways. Both proxies block those names and addresses unless --allow-docker-gateway is set.

What changes for operators

  • On Podman, deployment fails before the proxy or MCP container starts if host.containers.internal is missing from the runtime's hosts file (for example with no_hosts = true in containers.conf), or if the hosts data cannot be read. This applies even with --allow-docker-gateway.
  • The protected set is a deployment-time snapshot. Redeploy workloads after changing Podman's host mappings, rootless networking mode, or bridge networks.

What's Changed

Full Changelog: stacklok/toolhive@v0.55.1...v0.55.2

v0.55.1

Compare Source

What's Changed

Full Changelog: stacklok/toolhive@v0.55.0...v0.55.1

v0.55.0

Compare Source

What's Changed

Full Changelog: stacklok/toolhive@v0.54.0...v0.55.0

v0.54.0

Compare Source

What's Changed

New Contributors

Full Changelog: stacklok/toolhive@v0.53.0...v0.54.0

v0.53.0

Compare Source

🚀 Toolhive v0.53.0 is live!

This release adds group-based upstream selection to the vMCP embedded auth server, and stops the operator from acting on spec.permissionProfile as a security fix. It also makes vMCP keep a backend's valid tools when one of its items can't be decoded, and makes MCPRemoteProxy report config failures correctly.

🔄 Deprecations

  • MCPServer.spec.permissionProfile is deprecated and the Kubernetes operator now ignores it. The field still exists in the v1beta1 CRD so existing manifests keep applying, but it never restricted pods in Kubernetes. Use podTemplateSpec security contexts and NetworkPolicy resources instead. MCPServers that set the field get a PermissionProfileUnsupported Warning event. No removal version has been announced yet. (security fix, commit d5aa374)

🆕 New Features

  • vMCP operators using the embedded auth server can set an upstream filter in authserver-config.yaml. It picks which extra upstream providers each user goes through, based on group claims from the first upstream, so users skip OAuth legs for services they have no account on. The feature is opt-in and fails closed when the group claim is missing. CRD support follows in #​6740. (#​6739)

🐛 Bug Fixes

  • The operator no longer passes spec.permissionProfile to the runner as a profile name or file path. Before, a crafted value could make the operator read arbitrary local files. The configmap profile volume is no longer mounted, and thv export --format k8s no longer emits the field. MCPServers that set the field may roll their proxy pods once after upgrading. (d5aa374)
  • When a referenced config fails to resolve, MCPRemoteProxy now reports Ready=False with a message naming the failing handler and an up-to-date observedGeneration. Before, it could show Phase: Failed while still reporting a stale Ready=True. (#​6776)
  • vMCP now skips individual tools/list, resources/list, resource-template and prompt items it cannot decode, and logs a warning naming the backend and the item. Before, one bad item hid all of that backend's capabilities. This applies to the Modern list path only; the Legacy path is tracked in #​6814. (#​6772)
  • Tools whose top-level schema type is a JSON Schema type array (for example ["object","null"]) are now kept, with the schema passed through unchanged, because toolhive-core is bumped to v0.0.52. (#​6815)

📦 Dependencies

Module Version
github.com/stacklok/toolhive-core v0.0.52
ghcr.io/modelcontextprotocol/inspector (default thv inspector image) 2.10.1
github.com/go-chi/chi/v5 v5.4.0
github.com/aws/aws-sdk-go-v2 v1.47.3
github.com/aws/aws-sdk-go-v2/config v1.33.9
github.com/aws/aws-sdk-go-v2/service/sts v1.51.4
github.com/pressly/goose/v3 v3.29.0
github.com/prometheus/common v0.72.1
github.com/onsi/ginkgo/v2 v2.33.1
github.com/alicebob/miniredis/v2 v2.40.0
golang.org/x/crypto v0.58.0
golang.org/x/mod v0.42.0
golang.org/x/net v0.61.0
golang.org/x/sync v0.24.0
golang.org/x/sys v0.49.0
golang.org/x/term v0.47.0
golang.org/x/exp/jsonrpc2 faecfb2
oras.land/oras-go/v2 v2.6.3
python (e2e test image) 3.15-slim
GitHub Actions (create-github-app-token, download-artifact, setup-node, upload-artifact, claude-code-action, codeql-action, goreleaser-action, kind-action) latest patch/minor

👋 Welcome to our newest contributor: @​feiiiiii5 🎉

Full commit log

What's Changed

New Contributors

Full Changelog: stacklok/toolhive@v0.52.0...v0.53.0

🔗 Full changelog: stacklok/toolhive@v0.52.0...v0.53.0

v0.52.0

Compare Source

🚀 Toolhive v0.52.0 is live!

This release adds TLS for Redis session storage (runtime and operator), makes thv llm setup and teardown safer by default, and fixes several authorization, OAuth and operator issues.

⚠️ Breaking Changes

  • thv llm teardown now purges cached tokens by default — a full teardown deletes cached OIDC tokens and fails if cleanup fails; pass --keep-tokens to keep the old behavior (migration guide) (#​6733)
  • DCRCredentialStore gained a method — out-of-tree implementations of pkg/authserver/storage.DCRCredentialStore no longer compile until they add UpdateDCRCredentialsIfUnchanged (migration guide) (#​6758)
Migration guide: thv llm teardown purges cached tokens by default

Affects CLI users and scripts that run thv llm teardown. Cleanup is local only: tokens are deleted from the secrets provider, not revoked at the identity provider.

Before
# Tokens survived teardown unless you opted in
thv llm teardown
thv llm teardown --purge-tokens
After
# Full teardown (no configured tools remain) purges cached tokens
thv llm teardown

# Keep tokens for a later setup
thv llm teardown --keep-tokens

# Targeted teardown still keeps tokens; --purge-tokens deletes them even when other tools remain
thv llm teardown <tool> --purge-tokens
Migration steps
  1. If a script relied on tokens surviving a full teardown so a later thv llm setup could skip re-authentication, add --keep-tokens.
  2. Teardown now exits non-zero if the secrets provider is unavailable or token listing or deletion fails (these were warnings before). Handle the failure, or pass --keep-tokens to skip the purge.
  3. --keep-tokens and --purge-tokens are mutually exclusive.
  4. Go callers: llm.Teardown has new parameters and llm.PurgeTokens now returns an error.

PR: #​6733 — Closes #​6732

Migration guide: DCRCredentialStore gained a method

Affects only Go code outside this repository that implements DCRCredentialStore (including hand-written mocks). The built-in memory and Redis stores are already updated.

Before
type DCRCredentialStore interface {
    StoreDCRCredentialsIfAbsent(...)
    UpdateDCRCredentialsIfPresent(...)
    // ...
}
After
type DCRCredentialStore interface {
    // ...existing methods...
    UpdateDCRCredentialsIfUnchanged(ctx context.Context, creds *DCRCredentials, expected *DCRCredentials) error
}
Migration steps
  1. Add UpdateDCRCredentialsIfUnchanged(ctx, creds, expected) to your implementation.
  2. Overwrite the row at creds.Key only if the stored row still equals expected.
  3. Return a wrapped ErrNotFound if the row is absent and the new ErrDCRCredentialsChanged if it differs; write nothing in either case.
  4. Reject a nil expected, or one whose Key differs from creds.Key.

PR: #​6758

🆕 New Features

  • Redis session storage supports TLS in the proxy runner, vMCP and their rate limiters, with system roots or a private CA bundle (#​6731)
  • MCPServer, MCPRemoteProxy and VirtualMCPServer accept spec.sessionStorage.tls, including caCertSecretRef for a private CA; a startup WARN is now logged when Redis session storage runs without TLS, so log-based alerting may fire for existing plaintext setups (#​6767)
  • thv llm setup now configures Claude Code for one-hour prompt caching by default; re-run setup to pick it up, or use --short-prompt-cache to opt out (#​6515)

🐛 Bug Fixes

  • spec.secrets on MCPServer accepts multiple keys of the same Secret; re-apply the operator-crds chart (#​6690)
  • The token-exchange issuer policy no longer rejects an omitted allowMayAct with a wildcard delegate; re-apply the operator-crds chart (#​6532)
  • Config resources are deleted promptly once their last referrer goes away instead of lingering up to 30 seconds (#​6768)
  • Cedar policies can use extension claims from RFC 7662 introspection (such as roles); policies that referenced these claims will now see real values, so review any that were written around them being absent (#​6707)
  • Authz-filtered tools/list, prompts/list and resources/list responses keep the members the backend sent (including MCP 2026-07-28 resultType), always carry Cache-Control: private, no-store, and reject ambiguous duplicate or aliased annotation members (#​6709)
  • The embedded auth server no longer cuts off slow upstream identity-provider token endpoints at 10 seconds, which could leave a revoked refresh token stored (#​6755)

🧹 Misc

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate

renovate Bot commented Oct 19, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 20 additional dependencies were updated

Details:

Package Change
github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.14.1 -> v1.15.0
github.com/Microsoft/go-winio v0.6.2 -> v0.6.4
github.com/cenkalti/backoff/v7 v7.0.0 -> v7.0.1
github.com/docker/cli v29.9.0+incompatible -> v29.9.1+incompatible
github.com/docker/go-connections v0.8.1 -> v0.8.2
github.com/dustin/go-humanize v1.0.1 -> v1.1.0
github.com/ebitengine/purego v0.11.1 -> v0.11.2
github.com/go-jose/go-jose/v4 v4.1.5 -> v4.1.6
github.com/grpc-ecosystem/grpc-gateway/v2 v2.31.0 -> v2.32.0
github.com/moby/moby/api v1.56.0 -> v1.56.1
github.com/moby/moby/client v0.6.0 -> v0.6.2
github.com/redis/go-redis/v9 v9.22.0 -> v9.23.0
github.com/spiffe/go-spiffe/v2 v2.8.2 -> v2.9.0
github.com/stacklok/toolhive-core/redisconn v0.0.2 -> v0.0.57
github.com/tidwall/gjson v1.19.0 -> v1.20.0
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.71.0 -> v0.72.0
golang.ngrok.com/ngrok/v2 v2.2.0 -> v2.2.1
golang.org/x/exp v0.0.0-20261013213113-2ab7f3cbc5fb -> v0.0.0-20261014143641-f0251eb4aa3e
golang.org/x/exp/event v0.0.0-20260824195058-e88cd73687aa -> v0.0.0-20261009195045-ca0d7ba23607
golang.org/x/exp/jsonrpc2 v0.0.0-20260908205506-85c1c2202aba -> v0.0.0-20261014143641-f0251eb4aa3e

@codecov-commenter

codecov-commenter commented Oct 19, 2026 •
edited
Loading

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 67.02%. Comparing base (8526905) to head (633db21).

Additional details and impacted files 
@@           Coverage Diff           @@
##             main     #951   +/-   ##
=======================================
  Coverage   67.02%   67.02%           
=======================================
  Files         116      116           
  Lines       11216    11216           
=======================================
  Hits         7518     7518           
  Misses       3698     3698

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@renovate
renovate Bot force-pushed the renovate/go-modules branch 4 times, most recently from 74e2340 to 1caccde Compare October 23, 2026 19:29
@renovate
renovate Bot force-pushed the renovate/go-modules branch from 1caccde to 633db21 Compare October 23, 2026 22:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@codecov-commenter