Skip to content

Update stacklok/toolhive to v0.43.0 - #1102

Open
renovate[bot] wants to merge 5 commits into
mainfrom
renovate/stacklok-toolhive-0.x
Open

Update stacklok/toolhive to v0.43.0#1102
renovate[bot] wants to merge 5 commits into
mainfrom
renovate/stacklok-toolhive-0.x

Conversation

@renovate

@renovate renovate Bot commented Aug 14, 2026 •
edited by github-actions Bot
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Update Change
stacklok/toolhive minor v0.42.1 → v0.43.0

After this PR opens, .github/workflows/upstream-release-docs.yml adds source-verified content edits for the new release. For stacklok/toolhive, the same workflow also syncs reference assets (CLI help, Swagger) and regenerates the CRD MDX pages.

Release Notes

stacklok/toolhive (stacklok/toolhive)

v0.43.0

Compare Source

What's Changed

New Contributors

Full Changelog: stacklok/toolhive@v0.42.1...v0.43.0

Configuration

📅 Schedule: (in timezone America/New_York)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Never, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

Docs update for toolhive v0.43.0

At a glance
Upstream stacklok/toolhive v0.42.1 → v0.43.0
Hand-written changes 2 commit(s)
Reference assets refreshed (separate commit)
Gaps 0
Release contributors 10 auto-assigned (see sidebar)
Action required Spot-check skill-authored prose for accuracy

Summary of changes

  • Added confidential DCR and delegate client sections (allowConfidentialClientRegistration, insecureAllowConfidentialOverLoopbackHTTP, forceConfidentialRedirectUris, delegateClients) to docs/toolhive/guides-k8s/embedded-auth-server-k8s.mdx.
  • Added parallel confidential DCR and delegate client sections to docs/toolhive/guides-vmcp/embedded-auth-server-vmcp.mdx, cross-linked to the K8s guide for full validation rules.
  • Updated docs/toolhive/guides-cli/skills-management.mdx to remove the "experimental" caveat on thv skill sync / thv skill upgrade and drop the TOOLHIVE_SKILLS_LOCK_ENABLED requirement; added a thv skill sync section covering --check, --adopt, and --prune.
  • Documented signed skill pushes in docs/toolhive/guides-cli/skills-management.mdx: thv skill push now signs by default; --key selects a cosign private key and --no-sign opts out. Unsigned project-scoped installs require --allow-unsigned on thv skill install.

Run cost

Session Turns Cost (USD)
Generation 94 $9.0783
Editorial review 28 $2.0518
Total 122 $11.1301
How this PR was built

Two Claude Opus sessions run per release: a generation pass
(upstream-release-docs skill, 6 phases) followed by a fresh-
context editorial pass (docs-review). Prettier/ESLint
auto-fixes are applied after.

Auto-synced paths — do not hand-edit these in review:

  • static/api-specs/
  • docs/toolhive/reference/cli/ (toolhive only)
  • docs/toolhive/reference/crds/

If a "Gaps needing human context" section is present above,
each entry includes a paste-ready Helper prompt for local
Claude a reviewer can use to resolve the gap.

@renovate renovate Bot added the autogen-docs Pull requests generated by automated release workflows label Aug 14, 2026
@vercel

vercel Bot commented Aug 14, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
docs-website Ready Ready Preview Aug 17, 2026 7:45pm

Request Review

@github-actions
github-actions Bot marked this pull request as draft August 14, 2026 18:27
@claude

claude Bot commented Aug 14, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Claude finished @renovate[bot]'s task in 8m 28s —— View job

ToolHive v0.43.0 upstream release docs

Ran /upstream-release-docs stacklok/toolhive v0.43.0 in unattended mode.

  • Phase 1: Discover release changes
  • Phase 2: Deep dive PRs (source-verify)
  • Phase 3: Docs displacement audit
  • Phase 4: Implement source-verified doc edits
  • Phase 5: Format and lint
  • Phase 6: Commit, push, write artifacts

Summary of hand-written changes

  • Added confidential DCR + delegate client sections (allowConfidentialClientRegistration, insecureAllowConfidentialOverLoopbackHTTP, forceConfidentialRedirectUris, delegateClients) to docs/toolhive/guides-k8s/embedded-auth-server-k8s.mdx.
  • Added parallel sections to docs/toolhive/guides-vmcp/embedded-auth-server-vmcp.mdx, cross-linked to the K8s guide for full validation rules.
  • Updated docs/toolhive/guides-cli/skills-management.mdx to drop the TOOLHIVE_SKILLS_LOCK_ENABLED requirement and the "experimental" caveat on thv skill sync / thv skill upgrade (now GA in v0.43.0); added a thv skill sync section covering --check, --adopt, and --prune.
  • Documented signed skill pushes: thv skill push now signs by default; --key selects a cosign key; --no-sign opts out. Unsigned project-scoped installs require --allow-unsigned on thv skill install.

Notes

  • Auto-generated reference under static/api-specs/ and docs/toolhive/reference/cli/ was refreshed by the earlier workflow step - not hand-edited here. The CRD schemas already reflect the new fields; my prose additions ride alongside.
  • Did not create a standalone new page: every addition extends an existing page that already covers the surrounding capability (embedded auth server config, skill lifecycle).
  • Local npm run build fails at the mcp-metadata-plugin's remote data fetch (network-restricted sandbox), unrelated to my changes; PR CI will run the real build.

Commit: 4165743 Document v0.43.0 skill signing and confidential DCR
— branch: renovate/stacklok-toolhive-0.x

@claude

claude Bot commented Aug 14, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Claude finished @renovate[bot]'s task in 4m 4s —— View job

Editorial review of v0.43.0 docs changes

Done. Pushed 75bcaa3 with editorial polish on the three content pages the release commit touched. Reference files (CLI, CRD, API specs) were not modified, per workflow policy.

  • Review docs/toolhive/guides-cli/skills-management.mdx
  • Review docs/toolhive/guides-k8s/embedded-auth-server-k8s.mdx
  • Review docs/toolhive/guides-vmcp/embedded-auth-server-vmcp.mdx
  • Apply editorial fixes
  • Run npm run prettier:fix and npm run eslint:fix
  • Commit and push

Edits applied

Style fixes (spaced hyphens in prose as em-dash substitutes are discouraged):

  • skills-management.mdx (line 247): Split "anything - useful as a CI gate" into two sentences.
  • skills-management.mdx (line 284): Replaced "as not upgradable - there is nothing newer" with "as not upgradable, because there is nothing newer". Also capitalized "Git".
  • embedded-auth-server-k8s.mdx (line 508): Rewrote the two-em-dash sentence "For a client the operator controls and knows in advance - typically a backend service ... - pre-provision" to use a parenthetical. Also changed third-person "the operator" to second-person "you".
  • embedded-auth-server-k8s.mdx (line 537): Split "categorically at admission - the CEL rule..." into two sentences (naming it "The CEL admission rule").
  • embedded-auth-server-vmcp.mdx (line 345): Changed "typically a backend service the operator controls" to "typically a backend service you control" (second person).
  • embedded-auth-server-vmcp.mdx (line 363): Replaced spaced hyphen ("must use https:// - delegate clients") with a semicolon.

Code-block comment fix:

  • skills-management.mdx (lines 388-389): Rewrote the cosign push code-block comment; the backticks around `thv serve` don't render inside a bash comment, so the comment now reads as plain prose about setting COSIGN_PASSWORD in the thv serve environment.

Left as-is

  • Parenthetical "(with the Redis storage backend)" in the k8s DCR section: acceptable qualifier.
  • Passive "leaving them empty is not permitted": awkward but faithful to the underlying admission rule; rephrasing risked changing the meaning.
    • Branch: renovate/stacklok-toolhive-0.x

@github-actions
github-actions Bot marked this pull request as ready for review August 14, 2026 18:42
ChrisJBurns
ChrisJBurns previously approved these changes Aug 14, 2026
View reviewed changes
amirejaz
amirejaz previously approved these changes Aug 15, 2026
View reviewed changes
eleftherias
eleftherias previously approved these changes Aug 17, 2026
View reviewed changes
samuv
samuv previously approved these changes Aug 17, 2026
View reviewed changes
renovate Bot and others added 4 commits August 17, 2026 21:19
@renovate @jhrozek
Update stacklok/toolhive to v0.43.0
c5f0e48 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
@github-actions @jhrozek
Refresh reference assets for toolhive v0.43.0
d06340a
@github-actions @claude @jhrozek
Document v0.43.0 skill signing and confidential DCR
a668528 
Document confidential DCR clients, delegate clients, and forced-confidential
redirect URIs on the embedded auth server; document signed skill pushes and
promote skill sync/upgrade out of the experimental gate.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
@github-actions @jhrozek
Polish v0.43.0 docs edits
93f7686
@jhrozek
jhrozek dismissed stale reviews from samuv, eleftherias, amirejaz, and ChrisJBurns via efa40d9 August 17, 2026 19:37
@jhrozek
jhrozek force-pushed the renovate/stacklok-toolhive-0.x branch from 75bcaa3 to efa40d9 Compare August 17, 2026 19:37
@jhrozek
Trim duplicate DCR guidance
ec59009 
Keep the K8s guide as the canonical explanation of confidential DCR validation, security implications, and behavior. Retain the VirtualMCPServer-specific configuration examples and link to that guide for the shared rationale.
@jhrozek
jhrozek force-pushed the renovate/stacklok-toolhive-0.x branch from efa40d9 to ec59009 Compare August 17, 2026 19:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jhrozek jhrozek jhrozek approved these changes
@jerm-dro jerm-dro jerm-dro approved these changes
@samuv samuv samuv left review comments
@eleftherias eleftherias eleftherias left review comments
@ChrisJBurns ChrisJBurns ChrisJBurns left review comments
@amirejaz amirejaz amirejaz left review comments
@Nashon-Steffen Nashon-Steffen Awaiting requested review from Nashon-Steffen

Assignees

No one assigned

Labels

autogen-docs Pull requests generated by automated release workflows

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

6 participants

@jhrozek @samuv @eleftherias @jerm-dro @ChrisJBurns @amirejaz