v0.42.0

🚀 Toolhive v0.42.0 is live!

AI-tool plugin management goes end to end — thv ai-plugin gains a full CLI, REST API, and registry catalog — and the skills supply chain gets Sigstore signature verification at install, sync, and upgrade time. Alongside that, a large batch of MCP dual-era correctness fixes lands: multiple clients can finally share a stdio server, and vMCP stops flapping between the Modern and Legacy revisions.

⚠️ Breaking Changes

• Config CRD status fields removed — status.referencingWorkloads and status.referenceCount (and the References printer column) are gone from all six config CRDs; replace any automation reading them with a workload field query (migration guide)
• Cedar policy is now evaluated against the mutated MCP request — if you run a mutating webhook together with authorization, policy decisions and audit records can change on upgrade; re-audit your policies against the post-mutation shape first (migration guide)
• Recovered HTTP panics no longer produce a log line — an unintended regression from the recovery-middleware migration; without Sentry configured a recovered panic is now silent apart from the 500 (migration guide)
• Go API removals for out-of-tree importers — pkg/telemetry/providers was deleted and two long-published optimizerdec constants were removed (migration guide)

Migration guide: Config CRD status fields removed

Who is affected: anyone reading status.referencingWorkloads or status.referenceCount from MCPOIDCConfig, MCPAuthzConfig, MCPExternalAuthConfig, MCPToolConfig, MCPWebhookConfig, or MCPTelemetryConfig — kubectl users relying on the REFERENCES column, scripts and GitOps assertions using jsonpath/jq on those paths, Chainsaw/kuttl tests, kube-state-metrics custom-resource-state configs and the dashboards built on them, and Go code reading .Status.ReferencingWorkloads / .Status.ReferenceCount.

MCPWebhookConfig and MCPTelemetryConfig only ever had referencingWorkloads. MCPTelemetryConfig never had a References printer column, so its kubectl get output is unchanged.

Upgrade safety: these were derived values computed from workload specs — the source of truth (spec.*ConfigRef on workloads) is untouched, so nothing unrecoverable is lost. Applying the new schema does not rewrite or reject existing stored objects; residual values stay inert in etcd until each object's status is next written. No storage-version bump, no CRD delete/recreate, no migration job. Deletion protection is unchanged — every config controller still recomputes referrers live at deletion time and sets DeletionBlocked=True with reason ReferencedByWorkloads.

Before

$ kubectl -n toolhive-system get mcpoidcconfig
NAME       SOURCE   VALID   REFERENCES   AGE
my-oidc    inline   True    3            5d

After

$ kubectl -n toolhive-system get mcpoidcconfig
NAME       SOURCE   VALID   AGE
my-oidc    inline   True    5d

To list referrers, query the workloads by their config-ref:

kubectl -n toolhive-system get mcpservers,mcpremoteproxies,virtualmcpservers -o json \
  | jq -r --arg n my-oidc '.items[]
      | select((.spec.oidcConfigRef.name // .spec.incomingAuth.oidcConfigRef.name) == $n)
      | "\(.kind)/\(.metadata.name)"'

The reference paths per config kind, exactly as the operator's own indexers define them:

Config kind	Workload kinds tracked	Spec paths
MCPOIDCConfig	MCPServer, MCPRemoteProxy, VirtualMCPServer	spec.oidcConfigRef.name; spec.incomingAuth.oidcConfigRef.name (vMCP)
MCPAuthzConfig	MCPServer, MCPRemoteProxy, VirtualMCPServer	spec.authzConfigRef.name; spec.incomingAuth.authzConfigRef.name (vMCP)
MCPTelemetryConfig	MCPServer, MCPRemoteProxy, VirtualMCPServer	spec.telemetryConfigRef.name
MCPExternalAuthConfig	MCPServer, MCPRemoteProxy	spec.externalAuthConfigRef.name, or spec.authServerRef.name when spec.authServerRef.kind == "MCPExternalAuthConfig"
MCPToolConfig	MCPServer	spec.toolConfigRef.name
MCPWebhookConfig	MCPServer	spec.webhookConfigRef.name

Note kubectl --field-selector will not work for these paths — the operator's indexes are controller-runtime cache indexes, not API-server field selectors. Use -o json | jq or -o custom-columns.

Migration steps

1. While still on v0.41.x, snapshot anything you may need: kubectl get mcpoidcconfigs,mcpauthzconfigs,mcpexternalauthconfigs,mcptoolconfigs,mcpwebhookconfigs,mcptelemetryconfigs -A -o json > /tmp/thv-config-refs-pre-0.42.json
2. Grep your automation for referenceCount, referencingWorkloads, and the References/REFERENCES column — shell scripts, kubectl wait --for=jsonpath=, Chainsaw/kuttl assertions, Argo CD/Flux health checks, kube-state-metrics configs, Grafana panels, Kyverno/Gatekeeper rules.
3. Rewrite each hit with the query for that config kind from the table above. For "is this config still in use?" checks, prefer the condition: kubectl -n NS get mcpoidcconfig my-oidc -o jsonpath='{.status.conditions[?(@.type=="DeletionBlocked")].message}'
4. helm upgrade the operator-crds chart, then the operator chart. No pre/post hooks needed.
5. Verify: kubectl -n toolhive-system get mcpoidcconfig shows NAME SOURCE VALID AGE, and deletion of a referenced config still leaves it with DeletionBlocked=True.
6. Go consumers: drop .Status.ReferencingWorkloads / .Status.ReferenceCount reads. The WorkloadReference type (Kind, Name) is still exported if you want to keep your own list shape.

PR: #5631 — completes the cleanup tracked in #5607

Migration guide: Cedar policy now sees the post-mutation request

Who is affected: only workloads configured with at least one mutating webhook and either Cedar authorization or any consumer of audit / telemetry / usage metrics. Both are shipped, supported, non-mutually-exclusive configurations — thv run --webhook-config <file with a mutating: entry> --authz-config <file>, or MCPWebhookConfig.spec.mutating in the operator. Workloads with no mutating webhook see zero change; the republish is gated on the body actually having changed.

What was wrong: ParsingMiddleware parses the request body once and refuses to parse again. The mutating webhook replaced r.Body but passed the request through unchanged, so Cedar evaluated policy against the tool name and arguments that arrived while the backend executed the ones that ran. The audit half was reachable in the default configuration: the event type and target.name resolve through the parsed-request holder regardless of includeRequestData (which defaults to false), so the audit trail named a request that never executed. Telemetry and usage metrics drifted the same way.

Security framing, stated precisely: before v0.42.0, a client could reach a tool or argument set Cedar would have denied by sending a permitted request shape that the webhook rewrote into a forbidden one. A second bug narrowed this in practice: r.ContentLength was not refreshed alongside r.Body, so a mutation that shrank the body failed at the reverse proxy and one that grew it was truncated into invalid JSON. The bypass was live for length-preserving rewrites — which is exactly case/format normalization, and a webhook can pad JSON whitespace to hold length constant. That stale Content-Length is also fixed here.

Before

client request  ──► ParsingMiddleware ──► parse cached ──► mutating webhook rewrites body
                                                │                      │
                                          Cedar reads ◄────────────────┘  (pre-mutation)
                                          audit reads                     backend runs post-mutation

After

client request  ──► ParsingMiddleware ──► parse cached ──► mutating webhook rewrites body
                                                                        │
                                                       RepublishParsedMCPRequest (body changed)
                                                                        │
                                          Cedar reads ◄────────────────┘  (post-mutation)
                                          audit reads                     backend runs post-mutation

Migration steps

1. Check whether you set --webhook-config with a mutating: entry (or MCPWebhookConfig.spec.mutating). If not, stop — no action needed.
2. Read each mutating webhook's patch and enumerate what it rewrites: the JSON-RPC method, params.name, and/or params.arguments.
3. Re-check your Cedar policies against the post-mutation shape — resource names (MCP::Tool::"<name>") and every when { context.arg_* } clause. Policies that were passing only because they never saw the rewrite will now deny, and vice versa.
4. Update SIEM rules, dashboards, and saved queries keyed on audit type or target.name — for mutated requests those values change on upgrade.
5. Expect two new fail-closed responses replacing what previously reached the backend: 400 if a webhook rewrites a single request into a JSON-RPC batch, and 500 if a webhook emits a body that is not a valid JSON-RPC request.

Gaps this deliberately does not close, all documented rather than fixed:

• With includeRequestData: true, th...

v0.41.0

🚀 Toolhive v0.41.0 is live!

This release delivers first-class support for the new MCP 2026-07-28 ("Modern") specification revision across every ToolHive surface — the transport proxies, the transparent proxy, and Virtual MCP now recognize, serve, and bridge both the session-based 2025-11-25 revision and the new stateless revision, including mixed client×backend combinations. It also ships a reproducible project-skills workflow (thv skill sync/upgrade with a lock file and Sigstore groundwork), an opt-in Envoy network-isolation backend, and RFC 8693 token exchange with full delegation-chain auditing.

⚠️ Breaking Changes

• Storage version migrator is now enabled by default in the operator Helm chart — namespace-scoped installs (operator.rbac.scope=namespace) fail helm upgrade at render time unless they set operator.features.storageVersionMigrator: false; cluster-scoped installs need no action (#5603)
• JSON-RPC batch requests are now rejected — top-level arrays get HTTP 400 / -32600 instead of being executed; batches previously bypassed authorization, tool filtering, and audit, and MCP removed batching in 2025-06-18, so send individual requests (#5931)
• Rate-limit JSON-RPC error code moved from -32029 to 429 — the MCP 2026-07-28 spec reserves -32020..-32099; clients branching on error.code == -32029 must match 429 (the HTTP 429 status, Retry-After header, and data.retryAfterSeconds are unchanged) (#6120)

Migration guide: storage version migrator default

The chart now enables the StorageVersionMigrator controller by default (operator.features.storageVersionMigrator: true), and a new chart validation rejects that combination with operator.rbac.scope=namespace — the controller cannot sync its cluster-scoped CRD informer under namespace RBAC. Affected users see helm install/helm upgrade fail with:

operator.features.storageVersionMigrator requires operator.rbac.scope=cluster

Cluster-scoped installs (the chart default) need no action: the operator pod restarts once with the migrator enabled and begins automatically trimming status.storedVersions on ToolHive CRDs — the precondition for a future release to drop deprecated API versions. No new pods or RBAC objects are created. To opt out anyway, set operator.features.storageVersionMigrator: false.

Namespace-scoped installs must opt out explicitly:

Before

operator:
  rbac:
    scope: namespace

After

operator:
  rbac:
    scope: namespace
  features:
    storageVersionMigrator: false

Migration steps

1. Check whether you are affected: helm get values <release> -n <ns> — you are affected if operator.rbac.scope is namespace and operator.features.storageVersionMigrator is unset or true.
2. Add operator.features.storageVersionMigrator: false to your values (or pass --set operator.features.storageVersionMigrator=false).
3. Run helm upgrade as usual.
4. Since namespace-scoped installs cannot run the migrator, plan to clean CRD status.storedVersions by other means (e.g. a one-off run of kube-storage-version-migrator) before any future release drops a deprecated CRD version. See docs/operator/storage-version-migration.md.

PR: #5603

Migration guide: JSON-RPC batch rejection and rate-limit error code

Batch requests (#5931) — affects only clients sending JSON-RPC batches (removed from MCP in 2025-06-18); no conformant 2025-11-25 or 2026-07-28 client emits them.

Before

[{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{...}},
 {"jsonrpc":"2.0","id":2,"method":"tools/call","params":{...}}]

After

Each request must be its own POST; a batch now returns:

{"jsonrpc":"2.0","id":null,"error":{"code":-32600,"message":"Invalid Request: batch requests are not supported"}}

Rate-limit error code (#6120) — affects only clients branching on the JSON-RPC error.code for backoff.

Before

{"jsonrpc":"2.0","error":{"code":-32029,"message":"rate limited","data":{"retryAfterSeconds":30}}}

After

{"jsonrpc":"2.0","error":{"code":429,"message":"rate limited","data":{"retryAfterSeconds":30}}}

Migration steps

1. Replace any JSON-RPC batch sends with sequential or concurrent single requests.
2. Update rate-limit handling to match error.code == 429 — or, better, key off the HTTP 429 status or data.retryAfterSeconds, which are stable across versions.

Upgrade notes (not breaking, worth knowing)

• HMAC secrets are now used byte-for-byte (#6067): if your HMACSecretRefs secret file carried leading/trailing whitespace bytes, previously-minted authorization codes and refresh tokens fail validation once after upgrade and clients re-authenticate; ensure the mounted secret is exactly the raw random bytes (no trailing newline).
• Denial/error responses are now spec-conformant JSON-RPC (#5944, #6055, #6066, #6068): correct envelope, standard error codes instead of HTTP statuses (500→-32603), id omitted rather than null, generic denial messages, and filtered tool calls answered with -32602 over HTTP 200 instead of a bodyless 400 — monitoring or scripts keyed to the old malformed shapes need updating.

🆕 New Features

MCP 2026-07-28 ("Modern") spec support

• ToolHive now speaks the MCP 2026-07-28 stateless revision end to end, negotiating both revisions per backend via go-sdk v1.7 (#5993)
• The streamable and transparent proxies classify and serve Modern stateless requests alongside Legacy session traffic (#5839, #5884)
• Virtual MCP serves Modern clients directly (#5953), classifies request revisions at the client edge (#5913), and resolves each backend's revision independently (885e8b1)
• Era-mismatched client×backend combinations are bridged in vMCP, so a Modern client can use Legacy backends and vice versa (#6006)
• Modern client-facing dispatch is complete with listen-stream support and pagination (#6050), gated per capability instead of a global kill-switch (#6033)
• vMCP falls back to Legacy when a backend's revision probe is inconclusive, keeping health checks and aggregation resilient (#6001)
• Mid-call elicitation/sampling refusals to Modern clients are classified per spec with the new error codes (#6061), and the typed input_required seam lands as groundwork for MRTR (SEP-2322) (#6074)
• Reserved io.modelcontextprotocol/* keys are stripped from backend response _meta so backends cannot spoof protocol metadata (#6024)
• W3C trace context now propagates through outbound MCP _meta (SEP-414), joining backend spans to the client→proxy→server trace (#5964)
• Tool definitions carrying invalid x-mcp-header annotations (SEP-2243) are rejected as the spec requires (#6013)
• The readiness probe sends the current MCP protocol version instead of a hardcoded 2024-11-05 (#5940)
• Opt-in strict MCP-Protocol-Version header validation for the streamable proxy (#5957)

Virtual MCP conformance and aggregation

• vMCP is now MCP-conformant: completions, resource templates, subscriptions, and mid-call server→client forwarding all work (#5875)
• The streamable HTTP proxy supports GET listen streams and routes server-to-client messages per session, so progress, sampling, and elicitation reach clients (#5934)
• Backend list_changed notifications are consumed and propagated to clients for tools (#5965) and for resources and prompts (#5971)
• The aggregator resolves cross-backend name conflicts for resources, resource templates, and prompts, not just tools (#6075), and drops ambiguous prompt names instead of failing aggregation (#6099)
• tools/list pagination completeness is guaranteed for >1000-tool aggregated sets (#6021)

Reproducible project skills

• Project-scoped skill installs are pinned in a toolhive.lock.yaml lock file (#5892, #5893, #5894)
• thv skill sync restores a project's ...

v0.40.1

What's Changed

• Serve prompts per-session in vMCP by @JAORMX in #5857
• Strip hop-by-hop headers before SigV4 signing by @Yanhaoxi in #5836
• Stop auto-requesting changes on XL PRs by @jhrozek in #5864
• Capture proxy logs in conformance CI runs by @jhrozek in #5863
• Respect DCR-negotiated token endpoint auth method by @tgrunnagle in #5866
• Stop VirtualMCPServer hot-reconcile on cleared podTemplateSpec by @jhrozek in #5846
• Audit authorization denials on the proxy runner path by @JAORMX in #5872
• Update anthropics/claude-code-action digest to af0559e by @renovate[bot] in #5868
• Fix isolation error wording and log-level rationale from #5794 review by @aponcedeleonch in #5853
• Update module github.com/stacklok/toolhive-catalog to v0.20260717.0 by @renovate[bot] in #5858
• Update module github.com/stacklok/toolhive-catalog to v0.20260720.0 by @renovate[bot] in #5876
• Release v0.40.1 by @toolhive-release-app[bot] in #5877

New Contributors

• @Yanhaoxi made their first contribution in #5836

Full Changelog: v0.40.0...v0.40.1

v0.40.0

🚀 Toolhive v0.40.0 is live!

This release hardens Virtual MCP authorization end-to-end — explicit HTTP 403 denials, a unified authz gate, and complete capability pagination — while laying the groundwork for agentic auth (RFC 8693 token exchange, the MCP 2026-07-28 revision) and moving MCP protocol handling onto the official modelcontextprotocol/go-sdk. It also fixes network isolation silently breaking --network host workloads and closes an SSRF gap in upstream Dynamic Client Registration.

🆕 New Features

• The embedded authorization server gains an RFC 8693 OAuth 2.0 Token Exchange grant handler, so an agent can exchange a user's token for a delegated token carrying both the user (sub) and the acting agent (act.sub) — the foundation for agentic delegation (not yet wired into the server) (#5822).
• ToolHive's request-parsing layer now understands the upcoming stateless MCP 2026-07-28 ("Modern") revision — a revision classifier, the Mcp-Method/Mcp-Name header and _meta vocabulary, and server/discover/subscriptions/listen authz registration — dormant until later slices wire it into proxy routing, with no change to existing traffic (#5834).

🐛 Bug Fixes

• Virtual MCP now returns an explicit HTTP 403 (with a JSON-RPC error code 403 and a "denied by authorization policy" message) when a Cedar policy denies a tools/call, resources/read, or prompts/get, instead of a misleading -32602 "not found" at HTTP 200 — and records the denial as denied in the audit log (#5841).
• thv run --network host no longer silently loses outbound connectivity: network isolation (on by default) is dropped for host/none networking with a warning, and explicitly combining --isolate-network=true with --network host now fails fast with an actionable error instead of starting a broken workload (#5794).
• The Virtual MCP authz gate is hardened so the gate decision, the enforced decision, and the backend forward all derive from a single argument decode, and a backend tool named execute_tool_script now fails loudly instead of being silently shadowed by the code-mode virtual tool (#5850).
• Virtual MCP capability discovery now follows list pagination cursors to exhaustion, so backends advertising more than one page (>1000 tools, resources, or prompts) no longer have their extra capabilities silently dropped from routing and clients (#5851).
• Upstream Dynamic Client Registration (DCR) discovery and registration calls are now routed through a private-IP-guarded HTTP client, closing an SSRF vector (CWE-918) — safe by default and honoring the upstream's existing allow_private_ips setting (#5826).
• Multi-upstream embedded authservers with two or more OAuth2 DCR upstreams requesting the same scopes now register a distinct client per upstream instead of silently reusing the first upstream's credentials, fixing failed or misattributed authorization (#5824).

🧹 Misc

• Migrated MCP protocol handling from mark3labs/mcp-go to the go-sdk-backed toolhive-core/mcpcompat compatibility shim (a pure, atomic import swap with no call-site logic changes), moving ToolHive onto the official modelcontextprotocol/go-sdk. Note: the stdio bridge currently forwards only progress/message notifications, so tools/list_changed and similar notifications are dropped — dynamic-capability servers may show stale lists until clients re-list (#5729).
• Resolved temp-dir symlinks in the plugin adapter tests so task test passes on macOS (/var → /private/var); product code is unchanged (#5849).

📦 Dependencies

Module	Version
github.com/stacklok/toolhive-core	v0.0.29
github.com/stacklok/toolhive-catalog	v0.20260716.0
github/codeql-action	7188fc3
golang.org/x/exp/jsonrpc2	9ea1abe

Full commit log

What's Changed

• Add upstream identity to DCR credential cache key by @tgrunnagle in #5824
• Update github/codeql-action digest to 7188fc3 by @renovate[bot] in #5778
• Guard upstream-DCR HTTP calls against SSRF by @tgrunnagle in #5826
• Update module github.com/stacklok/toolhive-core to v0.0.29 by @renovate[bot] in #5840
• feat: migrate from mark3labs/mcp-go to toolhive-core/mcpcompat (go-sdk) by @JAORMX in #5729
• Update module github.com/stacklok/toolhive-catalog to v0.20260716.0 by @renovate[bot] in #5843
• Return HTTP 403 for authz-denied vMCP calls (#5827) by @JAORMX in #5841
• Update golang.org/x/exp/jsonrpc2 digest to 9ea1abe by @renovate[bot] in #5780
• Reconcile network isolation with network mode by @JAORMX in #5794
• Resolve temp dirs in plugin adapter tests by @jhrozek in #5849
• Add MCP 2026-07-28 revision classification and method vocabulary by @jhrozek in #5834
• Harden vMCP authz gate: single parse source and reserved-name check by @JAORMX in #5850
• Add RFC 8693 token exchange handler to the embedded AS by @jhrozek in #5822
• Follow list pagination cursors in vMCP capability discovery by @JAORMX in #5851
• Release v0.40.0 by @toolhive-release-app[bot] in #5855

Full Changelog: v0.39.0...v0.40.0

v0.39.0

What's Changed

• Stop VirtualMCPServer hot-reconcile on cleared imagePullSecrets by @jhrozek in #5821
• Update module github.com/stacklok/toolhive-core to v0.0.28 by @renovate[bot] in #5798
• Add Bedrock compatibility flag to thv llm setup by @aponcedeleonch in #5832
• Release v0.39.0 by @toolhive-release-app[bot] in #5833

Full Changelog: v0.38.0...v0.39.0

v0.38.0

What's Changed

• Fix tool-filter terminal drain dropping error bodies by @aponcedeleonch in #5816
• Add Codex App LLM setup support by @JAORMX in #5810
• Release v0.38.0 by @toolhive-release-app[bot] in #5820

Full Changelog: v0.37.0...v0.38.0

v0.37.0

What's Changed

• Document operator phase conventions by @buyicoder in #5766
• Add runtime-stage environment variables to protocol Dockerfiles by @danbarr in #5801
• Add MCP conformance CI job for thv run proxy by @jhrozek in #5806
• Prefer context7 for MCP spec lookups, drop hardcoded version by @jhrozek in #5805
• Expose --allow-docker-gateway in workload API by @kantord in #5799
• Added spec.podTemplateSpec support to MCPRemoteProxy by @Sanskarzz in #5531
• Stop SSE filter from leaking tools/list on undecodable lines by @saivedant169 in #5304
• Validate aud and resource claims in returned ID-JAG JWT by @jhrozek in #5716
• Flush tool-filter buffer after handler returns by @aponcedeleonch in #5809
• Release v0.37.0 by @toolhive-release-app[bot] in #5811

New Contributors

• @buyicoder made their first contribution in #5766
• @saivedant169 made their first contribution in #5304

Full Changelog: v0.36.0...v0.37.0

v0.36.0

What's Changed

• Add Codex CLI direct-mode support to thv llm setup by @jerm-dro in #5789
• Use llmgateway mode constants for direct/proxy modes by @JAORMX in #5790
• Update anthropics/claude-code-action digest to f1bd27c by @renovate[bot] in #5777
• Release v0.36.0 by @toolhive-release-app[bot] in #5795

Full Changelog: v0.35.0...v0.36.0

v0.35.0

What's Changed

• Update module github.com/stacklok/toolhive-core to v0.0.27 by @renovate[bot] in #5736
• Improve documentation discoverability and cross-linking by @JAORMX in #5739
• Add ListBackends/LookupBackend to the vMCP core interface by @ChrisJBurns in #5763
• Rate limiting observability (metrics and tracing) PR A by @Sanskarzz in #5701
• Suppress GO-2026-5932 (x/crypto/openpgp deprecated-by-design, no fix available) by @JAORMX in #5781
• Allow HTTP upstream OIDC issuers for in-cluster dev environments by @ChrisJBurns in #5787
• Release v0.35.0 by @toolhive-release-app[bot] in #5788

Full Changelog: v0.34.0...v0.35.0

v0.34.0

What's Changed

• Unify token-endpoint URL validation, fix insecure-mode gap by @jhrozek in #5706
• Allow custom HTTP headers on the OpenAI embedding client by @gabrielcosi in #5704
• Sort aggregated tools by name for deterministic embedding order by @gabrielcosi in #5709
• Fix documentation link rot across the repo by @JAORMX in #5711
• Add plugin install/list/info/uninstall + MaterializationAdapter (Phase 3, THV-0077) by @JAORMX in #5685
• Make --allow-docker-gateway grant host access, not just unblock it by @eleftherias in #5707
• Support nested map claims in Cedar authorization for act claim by @jhrozek in #5713
• Document that --allow-docker-gateway ignores allowed ports by @eleftherias in #5714
• Replace opaque Step A/B labels in XAA CRD comments by @jhrozek in #5703
• Unify subject provider defaulting, hard-error xaa by @jhrozek in #5708
• Update auth and security libraries by @renovate[bot] in #5670
• Update anthropics/claude-code-action action to v1.0.165 by @renovate[bot] in #5721
• Update anthropics/claude-code-action digest to 558b1d6 by @renovate[bot] in #5718
• Update aws-sdk-go-v2 monorepo by @renovate[bot] in #5722
• Update module github.com/getsentry/sentry-go to v0.47.0 by @renovate[bot] in #5726
• Update goreleaser/goreleaser-action digest to f06c13b by @renovate[bot] in #5720
• Update github/codeql-action digest to 54f647b by @renovate[bot] in #5719
• Update module github.com/stacklok/toolhive-catalog to v0.20260706.0 by @renovate[bot] in #5728
• Filter upstream auth chain via callback hook by @tgrunnagle in #5725
• Preserve external annotations on operator Services by @blkt in #5731
• Drop unconditional ACL password guard from auth server Redis storage by @JAORMX in #5734
• Remove Amp editor extension clients by @ecgang in #5717
• Expose UpstreamFilter through authserver.New facade by @tgrunnagle in #5733
• Add Claude Desktop as an LLM gateway client by @jerm-dro in #5712
• Fix TOOLHIVE_DEV plain HTTP breaking real OCI registry pulls by @samuv in #5735
• Release v0.34.0 by @toolhive-release-app[bot] in #5737

New Contributors

• @ecgang made their first contribution in #5717

Full Changelog: v0.33.0...v0.34.0