Release 0 9 0 (#1403)

* Update dependencies

Signed-off-by: Mihai Criveti <[email protected]>

* Bump version to 0.9.0

Signed-off-by: Mihai Criveti <[email protected]>

* Bump version to 0.9.0

Signed-off-by: Mihai Criveti <[email protected]>

---------

Signed-off-by: Mihai Criveti <[email protected]>

Author: crivetimihai

.bumpversion.cfg

@@ -1,5 +1,5 @@
 [bumpversion]
-current_version = 0.8.0
+current_version = 0.9.0
 commit = False
 tag = False
 sign-tags = True

.github/workflows/docker-release.yml

@@ -4,12 +4,12 @@
 #
 # This workflow re-tags a Docker image (built by a previous workflow)
 # when a GitHub Release is published, giving it a semantic version tag
-# like `v0.8.0`. It assumes the CI build has already pushed an image
+# like `v0.9.0`. It assumes the CI build has already pushed an image
 # tagged with the commit SHA, and that all checks on that commit passed.
 #
 # ➤ Trigger: Release published (e.g. from GitHub UI or `gh release` CLI)
 # ➤ Assumes: Existing image tagged with the commit SHA is available
-# ➤ Result: Image re-tagged as `ghcr.io/OWNER/REPO:v0.8.0`
+# ➤ Result: Image re-tagged as `ghcr.io/OWNER/REPO:v0.9.0`
 #
 # ======================================================================
 
@@ -25,7 +25,7 @@ on:
   workflow_dispatch:
     inputs:
       tag:
-        description: 'Release tag (e.g., v0.8.0)'
+        description: 'Release tag (e.g., v0.9.0)'
         required: true
         type: string
 

CHANGELOG.md

@@ -4,7 +4,7 @@
 
 ---
 
-## [0.9.0] - 2025-11-05 - REST Passthrough, Ed25519 Certificate Signing, Multi-Tenancy Fixes & Platform Enhancements
+## [0.9.0] - 2025-11-09 - REST Passthrough, Ed25519 Certificate Signing, Multi-Tenancy Fixes & Platform Enhancements
 
 ### Overview
 
@@ -431,9 +431,12 @@ docker compose up -d
 
 **Multi-Tenancy & RBAC:**
 - Closes #969 - Backend Multi-Tenancy Issues - Critical bugs and missing features
+- Closes #967 - UI Gaps in Multi-Tenancy Support - Visibility fields missing for most resource types
 - Closes #959 - Unable to Re-add Team Member Due to Unique Constraint
 - Closes #958 - Incomplete Visibility Implementation
+- Closes #946 - Alembic migrations fails in docker compose setup
 - Closes #945 - Scoped uniqueness for prompts, resources, and A2A agents
+- Closes #926 - Bootstrap fails to assign platform_admin role due to foreign key constraint violation
 - Closes #1180 - Prompt editing to include team_id in form data
 - Closes #1184 - Prompt and resource endpoints to use unique IDs instead of name/URI
 - Closes #1222 - Already addressed as part of #945
@@ -444,6 +447,9 @@ docker compose up -d
 - Closes #1254 - JWT jti mismatch between token and database record
 - Closes #1262 - JWT token follows default variable payload expiry instead of UI
 - Closes #1261 - API Token Expiry Issue: UI Configuration overridden by default env Variable
+- Closes #1111 - Support application/x-www-form-urlencoded Requests in MCP Gateway UI for OAuth2 / Keycloak Integration
+- Closes #1094 - Creating an MCP OAUTH2 server fails if using API
+- Closes #1092 - After issue 1078 change, how to add X-Upstream-Authorization header when clicking Authorize in admin UI
 - Closes #1048 - Login issue - Serving over HTTP requires SECURE_COOKIES=false
 - Closes #1101 - Login issue with v0.7.0
 - Closes #1117 - Login not working with 0.7.0 version
@@ -460,6 +466,7 @@ docker compose up -d
 **Developer Tools & Operations:**
 - Closes #1197 - Support Bundle Generation - Automated Diagnostics Collection
 - Closes #1200 - In built MCP client - LLM Chat service for virtual servers
+- Closes #1239 - LLMChat Multi-Worker: Add Documentation and Integration Tests
 - Closes #1202 - LLM Chat Interface with MCP Enabled Tool Orchestration
 - Closes #1228 - Show system statistics in metrics page
 - Closes #1225 - Production-Scale Load Data Generator for Multi-Tenant Testing
@@ -470,28 +477,35 @@ docker compose up -d
 - Closes #1271 - Consolidated linting configuration in pyproject.toml
 
 **Plugin Framework:**
+- Closes #1249 - Rust-Powered PII Filter Plugin - 5-10x Performance Improvement
 - Closes #1196 - Plugin client server mTLS support
 - Closes #1137 - Add missing hooks to OPA plugin
 - Closes #1198 - Complete OPA plugin hook implementation
 
 **Platform & Protocol:**
+- Closes #1381 - Resource view error - mime type handling for resource added via mcp server
+- Closes #1348 - Add support for IBM Watsonx.ai LLM provider
 - Closes #1258 - MCP Tool outputSchema Field is Stripped During Discovery
 - Closes #1188 - Allow multiple StreamableHTTP content
 - Closes #1138 - Support for container builds for s390x
 
 **Performance Optimizations:**
 - Closes #1294 - orjson JSON Serialization for 5-6x faster JSON encoding/decoding
+- Closes #1292 - Brotli/Zstd/GZip Response Compression reducing bandwidth by 30-70%
 
 **Bug Fixes:**
+- Closes #1336 - Add toggles to password/sensitive textboxes to mask/unmask the input value
 - Closes #1098 - Unable to see request payload being sent
 - Closes #1024 - plugin tool_prefetch hook cannot access PASSTHROUGH_HEADERS, tags
+- Closes #1020 - Edit Button Functionality - A2A
 - Closes #861 - Passthrough header parameters not persisted to database
 - Closes #1178 - Header overlaps with modals in UI
 - Closes #922 - IFraming the admin UI is not working
 - Closes #625 - Gateway unable to register gateway or call tools on MacOS
 - Closes #1230 - pyproject.toml conflicting dependencies with uv
 - Closes #448 - MCP server with custom base path "/api" not working
 - Closes #835 - Adding Custom annotation for tools
+- Closes #409 - Add configurable limits for data cleaning / XSS prevention in .env.example and helm
 
 **Documentation:**
 - Closes #1159 - Several minor quirks in main README.md

Containerfile

@@ -51,7 +51,7 @@ FROM rust-builder-base AS rust-builder
 FROM registry.access.redhat.com/ubi10-minimal:10.0-1758699349
 LABEL maintainer="Mihai Criveti" \
       name="mcp/mcpgateway" \
-      version="0.8.0" \
+      version="0.9.0" \
       description="MCP Gateway: An enterprise-ready Model Context Protocol Gateway"
 
 ARG PYTHON_VERSION=3.12

Containerfile.lite

@@ -294,7 +294,7 @@ LABEL maintainer="Mihai Criveti" \
       org.opencontainers.image.title="mcp/mcpgateway" \
       org.opencontainers.image.description="MCP Gateway: An enterprise-ready Model Context Protocol Gateway" \
       org.opencontainers.image.licenses="Apache-2.0" \
-      org.opencontainers.image.version="0.8.0"
+      org.opencontainers.image.version="0.9.0"
 
 # ----------------------------------------------------------------------------
 # Copy the entire prepared root filesystem from the builder stage

Makefile

@@ -3073,7 +3073,7 @@ MINIKUBE_ADDONS  ?= ingress ingress-dns metrics-server dashboard registry regist
 # OCI image tag to preload into the cluster.
 # - By default we point to the *local* image built via `make docker-prod`, e.g.
 #   mcpgateway/mcpgateway:latest.  Override with IMAGE=<repo:tag> to use a
-#   remote registry (e.g. ghcr.io/ibm/mcp-context-forge:v0.8.0).
+#   remote registry (e.g. ghcr.io/ibm/mcp-context-forge:v0.9.0).
 TAG              ?= latest         # override with TAG=<ver>
 IMAGE            ?= $(IMG):$(TAG)  # or IMAGE=ghcr.io/ibm/mcp-context-forge:$(TAG)
 
@@ -3708,7 +3708,7 @@ devpi-unconfigure-pip:
 
 # ─────────────────────────────────────────────────────────────────────────────
 # 📦  Version helper (defaults to the version in pyproject.toml)
-#      override on the CLI:  make VER=0.8.0 devpi-delete
+#      override on the CLI:  make VER=0.9.0 devpi-delete
 # ─────────────────────────────────────────────────────────────────────────────
 VER ?= $(shell python3 -c "import tomllib, pathlib; \
 print(tomllib.loads(pathlib.Path('pyproject.toml').read_text())['project']['version'])" \
@@ -4905,7 +4905,7 @@ MIGRATION_TEST_DIR := tests/migration
 MIGRATION_REPORTS_DIR := $(MIGRATION_TEST_DIR)/reports
 
 # Get supported versions from version config (n-2 policy)
-MIGRATION_VERSIONS := $(shell cd $(MIGRATION_TEST_DIR) && python3 -c "from version_config import get_supported_versions; print(' '.join(get_supported_versions()))" 2>/dev/null || echo "0.5.0 0.8.0 latest")
+MIGRATION_VERSIONS := $(shell cd $(MIGRATION_TEST_DIR) && python3 -c "from version_config import get_supported_versions; print(' '.join(get_supported_versions()))" 2>/dev/null || echo "0.5.0 0.8.0 0.9.0 latest")
 
 .PHONY: migration-test-all migration-test-sqlite migration-test-postgres migration-test-performance \
         migration-setup migration-cleanup migration-debug migration-status

README.md

@@ -486,15 +486,15 @@ docker run -d --name mcpgateway \
   -e PLATFORM_ADMIN_FULL_NAME="Platform Administrator" \
   -e DATABASE_URL=sqlite:///./mcp.db \
   -e SECURE_COOKIES=false \
-  ghcr.io/ibm/mcp-context-forge:0.8.0
+  ghcr.io/ibm/mcp-context-forge:0.9.0
 
 # Note: when not running over SSL, use SECURE_COOKIES=false to prevent the browser denying access.
 
 # Tail logs (Ctrl+C to quit)
 docker logs -f mcpgateway
 
 # Generating an API key
-docker run --rm -it ghcr.io/ibm/mcp-context-forge:0.8.0 \
+docker run --rm -it ghcr.io/ibm/mcp-context-forge:0.9.0 \
   python3 -m mcpgateway.utils.create_jwt_token --username [email protected] --exp 0 --secret my-test-key
 ```
 
@@ -525,7 +525,7 @@ docker run -d --name mcpgateway \
   -e [email protected] \
   -e PLATFORM_ADMIN_PASSWORD=changeme \
   -e PLATFORM_ADMIN_FULL_NAME="Platform Administrator" \
-  ghcr.io/ibm/mcp-context-forge:0.8.0
+  ghcr.io/ibm/mcp-context-forge:0.9.0
 ```
 
 SQLite now lives on the host at `./data/mcp.db`.
@@ -552,7 +552,7 @@ docker run -d --name mcpgateway \
   -e PLATFORM_ADMIN_PASSWORD=changeme \
   -e PLATFORM_ADMIN_FULL_NAME="Platform Administrator" \
   -v $(pwd)/data:/data \
-  ghcr.io/ibm/mcp-context-forge:0.8.0
+  ghcr.io/ibm/mcp-context-forge:0.9.0
 ```
 
 Using `--network=host` allows Docker to access the local network, allowing you to add MCP servers running on your host. See [Docker Host network driver documentation](https://docs.docker.com/engine/network/drivers/host/) for more details.
@@ -568,7 +568,7 @@ podman run -d --name mcpgateway \
   -p 4444:4444 \
   -e HOST=0.0.0.0 \
   -e DATABASE_URL=sqlite:///./mcp.db \
-  ghcr.io/ibm/mcp-context-forge:0.8.0
+  ghcr.io/ibm/mcp-context-forge:0.9.0
 ```
 
 #### 2 - Persist SQLite
@@ -587,7 +587,7 @@ podman run -d --name mcpgateway \
   -p 4444:4444 \
   -v $(pwd)/data:/data \
   -e DATABASE_URL=sqlite:////data/mcp.db \
-  ghcr.io/ibm/mcp-context-forge:0.8.0
+  ghcr.io/ibm/mcp-context-forge:0.9.0
 ```
 
 #### 3 - Host networking (rootless)
@@ -605,7 +605,7 @@ podman run -d --name mcpgateway \
   --network=host \
   -v $(pwd)/data:/data \
   -e DATABASE_URL=sqlite:////data/mcp.db \
-  ghcr.io/ibm/mcp-context-forge:0.8.0
+  ghcr.io/ibm/mcp-context-forge:0.9.0
 ```
 
 ---
@@ -614,7 +614,7 @@ podman run -d --name mcpgateway \
 <summary><strong>✏️ Docker/Podman tips</strong></summary>
 
 * **.env files** - Put all the `-e FOO=` lines into a file and replace them with `--env-file .env`. See the provided [.env.example](https://github.com/IBM/mcp-context-forge/blob/main/.env.example) for reference.
-* **Pinned tags** - Use an explicit version (e.g. `v0.8.0`) instead of `latest` for reproducible builds.
+* **Pinned tags** - Use an explicit version (e.g. `v0.9.0`) instead of `latest` for reproducible builds.
 * **JWT tokens** - Generate one in the running container:
 
   ```bash
@@ -660,7 +660,7 @@ docker run --rm -i \
   -e MCP_SERVER_URL=http://host.docker.internal:4444/servers/UUID_OF_SERVER_1/mcp \
   -e MCP_TOOL_CALL_TIMEOUT=120 \
   -e MCP_WRAPPER_LOG_LEVEL=DEBUG \
-  ghcr.io/ibm/mcp-context-forge:0.8.0 \
+  ghcr.io/ibm/mcp-context-forge:0.9.0 \
   python3 -m mcpgateway.wrapper
 ```
 
@@ -708,7 +708,7 @@ python3 -m mcpgateway.wrapper
 <summary><strong>Expected responses from mcpgateway.wrapper</strong></summary>
 
 ```json
-{"jsonrpc":"2.0","id":1,"result":{"protocolVersion":"2025-03-26","capabilities":{"experimental":{},"prompts":{"listChanged":false},"resources":{"subscribe":false,"listChanged":false},"tools":{"listChanged":false}},"serverInfo":{"name":"mcpgateway-wrapper","version":"0.8.0"}}}
+{"jsonrpc":"2.0","id":1,"result":{"protocolVersion":"2025-03-26","capabilities":{"experimental":{},"prompts":{"listChanged":false},"resources":{"subscribe":false,"listChanged":false},"tools":{"listChanged":false}},"serverInfo":{"name":"mcpgateway-wrapper","version":"0.9.0"}}}
 
 # When there's no tools
 {"jsonrpc":"2.0","id":2,"result":{"tools":[]}}
@@ -742,7 +742,7 @@ docker run -i --rm \
   -e MCP_SERVER_URL=http://localhost:4444/servers/UUID_OF_SERVER_1/mcp \
   -e MCP_AUTH=${MCP_AUTH} \
   -e MCP_TOOL_CALL_TIMEOUT=120 \
-  ghcr.io/ibm/mcp-context-forge:0.8.0 \
+  ghcr.io/ibm/mcp-context-forge:0.9.0 \
   python3 -m mcpgateway.wrapper
 ```
 
@@ -1689,7 +1689,7 @@ MCP Gateway includes **vendor-agnostic OpenTelemetry support** for distributed t
 | ------------------------------- | ---------------------------------------------- | --------------------- | ------------------------------------------ |
 | `OTEL_ENABLE_OBSERVABILITY`     | Master switch for observability               | `true`                | `true`, `false`                           |
 | `OTEL_SERVICE_NAME`             | Service identifier in traces                   | `mcp-gateway`         | string                                     |
-| `OTEL_SERVICE_VERSION`          | Service version in traces                      | `0.8.0`               | string                                     |
+| `OTEL_SERVICE_VERSION`          | Service version in traces                      | `0.9.0`               | string                                     |
 | `OTEL_DEPLOYMENT_ENVIRONMENT`   | Environment tag (dev/staging/prod)            | `development`         | string                                     |
 | `OTEL_TRACES_EXPORTER`          | Trace exporter backend                         | `otlp`                | `otlp`, `jaeger`, `zipkin`, `console`, `none` |
 | `OTEL_RESOURCE_ATTRIBUTES`      | Custom resource attributes                     | (empty)               | `key=value,key2=value2`                   |

SECURITY.md

@@ -2,7 +2,7 @@
 
 ## ⚠️ Beta Software Notice
 
-**Current Version: 0.8.0 (Beta)**
+**Current Version: 0.9.0 (Beta)**
 
 MCP Gateway is currently in beta and should be treated as such until the 1.0 release. While we implement comprehensive security measures and follow best practices, important limitations exist:
 

charts/README.md

@@ -247,7 +247,7 @@ Below is a minimal example. Copy the default file and adjust for your environmen
 mcpContextForge:
   image:
     repository: ghcr.io/ibm/mcp-context-forge
-    tag: 0.8.0
+    tag: 0.9.0
   ingress:
     enabled: true
     host: gateway.local   # replace with real DNS
@@ -630,7 +630,7 @@ For every setting see the [full annotated `values.yaml`](https://github.com/IBM/
 * 💾 Stateful storage - PV + PVC for Postgres (`/var/lib/postgresql/data`), storage class selectable.
 * 🌐 Networking & access - ClusterIP services, optional NGINX Ingress, and `NOTES.txt` with port-forward plus safe secret-fetch commands (password, bearer token, `JWT_SECRET_KEY`).
 * 📈 Replicas & availability - Gateway (3) and Fast-Time-Server (2) provide basic HA; stateful components run single-instance.
-* 📦 Helm best-practice layout - Clear separation of Deployments, Services, ConfigMaps, Secrets, PVC/PV and Ingress; chart version 0.8.0.
+* 📦 Helm best-practice layout - Clear separation of Deployments, Services, ConfigMaps, Secrets, PVC/PV and Ingress; chart version 0.9.0.
 * ⚙️ Horizontal Pod Autoscaler (HPA) support for mcpgateway
 
 ---

charts/mcp-stack/CONTRIBUTING.md

@@ -262,8 +262,8 @@ When making changes:
 Update both `version` and `appVersion` in `Chart.yaml`:
 
 ```yaml
-version: 0.8.0          # Chart version
-appVersion: "0.8.0"     # Application version
+version: 0.9.0          # Chart version
+appVersion: "0.9.0"     # Application version
 ```
 
 ### Release Checklist