fix(deps): update module github.com/stacklok/toolhive to v0.5.2

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/stacklok/toolhive	v0.3.11 -> v0.5.2

---

Release Notes

stacklok/toolhive (github.com/stacklok/toolhive)

v0.5.2

Compare Source

What's Changed

• fix: Cannot deploy MCPRegistry from git in OpenShift by @​dmartinol in #​2263
• Fix CI failure by @​dmartinol in #​2363
• Implement tool conflict resolution for Virtual MCP Server by @​JAORMX in #​2365
• lint issue by @​dmartinol in #​2374
• Remove e2e test by @​dmartinol in #​2381
• Skip auto-generated files from linter by @​JAORMX in #​2382
• Proposal to refactor the MCP Registry controller by @​dmartinol in #​2301
• Return tools_override in workload GET endpoint by @​ChrisJBurns in #​2386
• Fix CI linter issues by @​dmartinol in #​2387
• vMCP: Implement capability merging and routing integration by @​JAORMX in #​2376
• pins registry api image until refactor is complete by @​ChrisJBurns in #​2401
• Update anthropics/claude-code-action digest to 8a1c437 by @​renovate[bot] in #​2369
• Update module github.com/charmbracelet/lipgloss to v2 by @​renovate[bot] in #​2373
• Update registry from toolhive-registry release v2025.10.31 by @​github-actions[bot] in #​2405
• Design and implement the VirtualMCPServer CRD by @​yrobla in #​2371
• Handle partial flushes in tool config middleware by @​blkt in #​2404
• Fix race condition in operator git tests by @​JAORMX in #​2408
• add missing gaps in k8s virtualmcpserver crd by @​yrobla in #​2409
• Consolidate bearer token extraction into utility by @​jhrozek in #​2410
• Add HTTP header validation to prevent injection by @​jhrozek in #​2411
• vMCP: Implement CLI serve command and session management by @​JAORMX in #​2406
• vMCP: Use proxy-mode instead of transport by @​JAORMX in #​2413
• Fix flaky vMCP health endpoint tests by @​JAORMX in #​2415
• vMCP: Add comprehensive tests for cache and registry components by @​JAORMX in #​2407
• Add -hide all to test-coverage Taskfile target by @​JAORMX in #​2414
• Update ubi golang builder to 1.25.z via epel10 copr repo. by @​RoddieKieley in #​2418
• build: use golang base image for building binary for UBI by @​TomerFi in #​2420
• Handle partial flushes for application/json by @​blkt in #​2422
• fix: switch operator micro ubi variant to minimal variant for missing certs by @​TomerFi in #​2424
• build: bump go to 1.25.3 by @​TomerFi in #​2423
• Update registry from toolhive-registry release v2025.11.01 by @​github-actions[bot] in #​2425
• Update registry from toolhive-registry release v2025.11.02 by @​github-actions[bot] in #​2428
• Update module golang.org/x/net to v0.46.0 by @​renovate[bot] in #​2427
• Update module github.com/mark3labs/mcp-go to v0.43.0 by @​renovate[bot] in #​2431
• Update registry from toolhive-registry release v2025.11.03 by @​github-actions[bot] in #​2432
• Decouple transport from runtime by @​blkt in #​2430
• Fix group name validation by @​eleftherias in #​2402
• Implement core authentication infrastructure for vMCP by @​jhrozek in #​2393
• Update registry.access.redhat.com/ubi10/ubi-minimal Docker tag to v10.0-1758699349 by @​renovate[bot] in #​2426
• Don't try to install mockgen if it's already available by @​JAORMX in #​2434
• Update helm/kind-action action to v1.13.0 by @​renovate[bot] in #​2436
• Fix flacky tests by @​NastyaAR in #​2178
• vMCP: Kubernetes - VirtualMCPCompositeToolDefinition CRD by @​yrobla in #​2412

New Contributors

• @​NastyaAR made their first contribution in #​2178

Full Changelog: stacklok/toolhive@v0.5.1...v0.5.2

v0.5.1

Compare Source

What's Changed

• Bump operator to use toolhive v0.5.0 by @​JAORMX in #​2336
• Rename MCPServer CRD Port Attributes for Clarity by @​ChrisJBurns in #​1806
• adds new port attributes to crds by @​ChrisJBurns in #​2338
• Add Virtual MCP Server routing interfaces and domain model by @​JAORMX in #​2333
• changes examples to use new port names by @​ChrisJBurns in #​2341
• moves GetToolConfigForMCPServer into separate package for easier testing and reducing code in controllers layer by @​ChrisJBurns in #​2344
• Update registry from toolhive-registry release v2025.10.28 by @​github-actions[bot] in #​2345
• Update module github.com/onsi/ginkgo/v2 to v2.27.2 by @​renovate[bot] in #​2342
• Update anthropics/claude-code-action digest to f4d737a by @​renovate[bot] in #​2346
• clean more flags/args code from operator and removes redundant functions by @​ChrisJBurns in #​2343
• Update module golang.org/x/time to v0.14.0 by @​renovate[bot] in #​2348
• Add Virtual MCP Server proposal by @​JAORMX in #​2106
• Add Dockerfile UBI images for the Operator and ProxyRunner by @​TomerFi in #​2327
• Fix UBI aggregated tag by @​dmartinol in #​2361
• Update registry from toolhive-registry release v2025.10.29 by @​github-actions[bot] in #​2358
• add initial binary implementation for vmcp by @​yrobla in #​2340
• Implement capability discovery and querying for Virtual MCP Server by @​JAORMX in #​2354
• Fix server port when network mode is host by @​blkt in #​2353
• feat: add validation command for vmcp by @​yrobla in #​2364
• Refactor telemetry and audit configuration into dedicated runconfig package by @​ChrisJBurns in #​2356
• adds nil check for runconfig options and logs error in case of parsing SampleRate float by @​ChrisJBurns in #​2367
• Update registry from toolhive-registry release v2025.10.29 by @​github-actions[bot] in #​2368
• Run task lint-fix by @​JAORMX in #​2370
• Add govulncheck by @​rdimitrov in #​2372

Full Changelog: stacklok/toolhive@v0.5.0...v0.5.1

v0.5.0

Compare Source

What's Changed

• Update toolhive images to v0.4.2 by @​renovate[bot] in #​2176
• Increase MCPRemoteProxy readiness probe initial delay to 15 seconds by @​JAORMX in #​2313
• Add /health endpoint to all proxy types for Kubernetes health probes by @​JAORMX in #​2315
• Configure chart-testing to install all charts by @​JAORMX in #​2310
• Update anthropics/claude-code-action digest to f30f5ee by @​renovate[bot] in #​2307
• Update golang.org/x/exp/jsonrpc2 digest to a4bb9ff by @​renovate[bot] in #​2309
• Update anchore/sbom-action action to v0.20.9 by @​renovate[bot] in #​2303
• Add environment variable support for OIDC client secret by @​JAORMX in #​2325
• Fix MCPServer and MCPRemoteProxy operator spec change reconciliation by @​JAORMX in #​2320
• fix: prevent zombie supervisor processes on restart by @​therealnb in #​2306
• Add SecretKeyRef support to InlineOIDCConfig for enhanced secret management by @​JAORMX in #​2324
• Add GitHub.com OAuth authentication provider for token introspection by @​JAORMX in #​2322
• Update registry from toolhive-registry release v2025.10.25 by @​github-actions[bot] in #​2308
• adds new port values for MCPServer CRD by @​ChrisJBurns in #​2330
• Update registry from toolhive-registry release v2025.10.26 by @​github-actions[bot] in #​2331
• Update registry from toolhive-registry release v2025.10.27 by @​github-actions[bot] in #​2332
• Run task operator-manifests by @​JAORMX in #​2334

Full Changelog: stacklok/toolhive@v0.4.2...v0.5.0

v0.4.2

Compare Source

What's Changed

• Add insecure HTTP OIDC support for local development by @​JAORMX in #​2292
• Ignore operator tags when releasing thv CLI by @​eleftherias in #​2304
• Add MCPGroup CRD documentation to operator architecture by @​JAORMX in #​2302

Full Changelog: stacklok/toolhive@v0.4.1...v0.4.2

v0.4.1

Compare Source

🚀 Toolhive v0.4.1 is live!

This release focuses on improved networking flexibility, observability enhancements, and better resource efficiency in Kubernetes deployments.

Networking & Infrastructure
• Added --network option for more flexible network configurations
• Kubernetes agents can now be merged between local and project-specific setups for streamlined deployments

Observability & Telemetry
• Custom OpenTelemetry resource attributes are now supported for richer trace metadata
• Registry data source API added for better integration and data access

Developer Experience
• New /check-contribution command added to Claude integration for easier contribution validation
• Controller helpers extracted into dedicated package for cleaner codebase architecture
• MCPServer CRD size reduced by optimizing PodTemplateSpec handling

Documentation
• Clarified file naming conventions for proposal documents

Dependencies
• Updated ginkgo/v2 → v2.27.1
• Updated cedar-policy/cedar-go → v1.2.8
• Registry synced with toolhive-registry release v2025.10.23
• Toolhive images updated to v0.4.0

👋 Welcome to our newest contributors @​therealnb, @​tgrunnagle, @​dmartinol, @​ChrisJBurns, and @​blkt! 🥳

Change log

• Add a --network option by @​therealnb in #​1867
• Update toolhive images to v0.4.0 by @​JAORMX in #​2284
• Refactor: Extract common controller helpers to dedicated package by @​JAORMX in #​2283
• Add claude /check-contribution command by @​tgrunnagle in #​2290
• fea: Registry API Data Source by @​dmartinol in #​2189
• Update module github.com/onsi/ginkgo/v2 to v2.27.1 by @​renovate[bot] in #​2293
• Merge my local k8s agent with the project-specific one by @​jhrozek in #​2291
• Update module github.com/cedar-policy/cedar-go to v1.2.8 by @​renovate[bot] in #​2294
• Reduce MCPServer CRD size by using runtime.RawExtension for PodTemplateSpec by @​JAORMX in #​2015
• Update registry from toolhive-registry release v2025.10.23 by @​github-actions[bot] in #​2297
• Add Custom OpenTelemetry Resource Attributes Support by @​ChrisJBurns in #​2285
• Clarify file name format for docs/proposals by @​blkt in #​2298
• Fix proposal name. by @​blkt in #​2299

Full Changelog: stacklok/toolhive@v0.4.0...v0.4.1

v0.4.0

Compare Source

🚀 Toolhive v0.4.0 is live!

This release brings major enhancements to Kubernetes integration, MCP server capabilities, and developer tooling support!

Developer Experience
• Added support for Trae IDE and Continue.dev clients for more flexible development workflows
• New Claude Code skills and agents help automate documentation and PR tasks
• Improved developer guide with updated Go version references
• Export command now supports Kubernetes format for easier deployments

Architecture & Documentation
• Added comprehensive architecture documentation
• New MCP _meta field support improves request parsing capabilities
• Registry API has been fully externalized from the core project

MCP & Kubernetes
• Introduced MCPRemoteProxy CRD controller for seamless remote MCP server proxying
• MCPGroup now supported in Kubernetes environments for better organization
• Internal MCP optimizer group is now hidden for cleaner interfaces
• Fixed regression that broke detection of already-running remote MCP servers

Workloads & APIs
• New proxy-logs endpoint gives visibility into workload logging
• Enhanced token-exchange middleware with comprehensive unit tests

Infrastructure & Reliability
• Fixed nil pointer dereference in environment variable validation
• Resolved race condition in keyring provider that caused concurrent restart failures
• OpenShift values now properly aligned with core Kubernetes values
• Fixed chainsaw install for e2e tests
• Registry updates pulled from multiple releases (v2025.10.18–v2025.10.22)

Dependencies
• Bumped lestrrat-go/jwx/v3 → 3.0.12
• Bumped cedar-policy/cedar-go → 1.2.7
• Bumped mark3labs/mcp-go → 0.42.0
• Updated golang.org/x/exp/jsonrpc2
• Go downgraded to 1.24 for UBI alignment

👋 Welcome to our newest contributor @​tgrunnagle! 🥳

🔗 Full changelog: stacklok/toolhive@v0.3.11...v0.4.0

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 23 additional dependencies were updated
• The go directive was updated for compatibility reasons

Details:

Package	Change
go	1.25.2 -> 1.25.3
cloud.google.com/go/compute/metadata	v0.8.0 -> v0.8.2
cloud.google.com/go/storage	v1.56.1 -> v1.56.2
github.com/cedar-policy/cedar-go	v1.2.6 -> v1.2.8
github.com/goccy/go-json	v0.10.3 -> v0.10.5
github.com/grpc-ecosystem/grpc-gateway/v2	v2.27.2 -> v2.27.3
github.com/jedisct1/go-minisign	v0.0.0-20211028175153-1c139d1cc84b -> v0.0.0-20230811132847-661be99b8267
github.com/lestrrat-go/jwx/v3	v3.0.11 -> v3.0.12
github.com/letsencrypt/boulder	v0.0.0-20240620165639-de9c06129bec -> v0.0.0-20241021211548-844334e04aef
github.com/mark3labs/mcp-go	v0.41.1 -> v0.43.0
github.com/segmentio/asm	v1.2.0 -> v1.2.1
github.com/sirupsen/logrus	v1.9.3 -> v1.9.4-0.20230606125235-dd1b4c2e81af
go.mongodb.org/mongo-driver	v1.14.0 -> v1.17.4
go.opentelemetry.io/proto/otlp	v1.7.1 -> v1.8.0
golang.org/x/crypto	v0.42.0 -> v0.43.0
golang.org/x/exp/jsonrpc2	v0.0.0-20251009144603-d2f985daa21b -> v0.0.0-20251023183803-a4bb9ffd2546
golang.org/x/net	v0.44.0 -> v0.46.0
golang.org/x/text	v0.29.0 -> v0.30.0
golang.org/x/time	v0.12.0 -> v0.14.0
google.golang.org/api	v0.248.0 -> v0.249.0
google.golang.org/genproto/googleapis/api	v0.0.0-20250826171959-ef028d996bc1 -> v0.0.0-20250929231259-57b25ae835d4
google.golang.org/genproto/googleapis/rpc	v0.0.0-20250826171959-ef028d996bc1 -> v0.0.0-20250929231259-57b25ae835d4
google.golang.org/grpc	v1.75.0 -> v1.76.0
google.golang.org/protobuf	v1.36.9 -> v1.36.10

[github-actions]

🔒 MCP Security Scan Results

⚠️ adb-mysql-mcp-server

• Status: Warning
• Message: No JSON output found in scan results (insecure_ignore is enabled)

✅ agentql-mcp

• Status: Passed
• Tools scanned: 0
• Result: No security issues detected

✅ arxiv-mcp-server

• Status: Passed
• Tools scanned: 4
• Result: No security issues detected

⚠️ astra-db-mcp

• Status: Error
• Message: No JSON output found in scan results

✅ aws-diagram

• Status: Passed
• Tools scanned: 3
• Result: No security issues detected

⚠️ aws-documentation

• Status: Error
• Message: No JSON output found in scan results

⚠️ blender-mcp

• Status: Error
• Message: No JSON output found in scan results

✅ brightdata-mcp

• Status: Passed
• Tools scanned: 0
• Result: No security issues detected

✅ browserbase-mcp-server

• Status: Passed
• Tools scanned: 8
• Result: No security issues detected

⚠️ chroma-mcp

• Status: Error
• Message: No JSON output found in scan results

✅ context7

• Status: Passed
• Tools scanned: 2
• Result: No security issues detected

✅ graphlit-mcp-server

• Status: Passed
• Tools scanned: 0
• Result: No security issues detected

✅ heroku-mcp-server

• Status: Passed
• Tools scanned: 0
• Result: No security issues detected

⚠️ ida-pro-mcp

• Status: Error
• Message: No JSON output found in scan results

✅ launchdarkly-mcp-server

• Status: Passed
• Tools scanned: 0
• Result: No security issues detected

✅ magic-mcp

• Status: Passed
• Tools scanned: 0
• Result: No security issues detected

✅ mcp-clickhouse

• Status: Passed
• Tools scanned: 0
• Result: No security issues detected

✅ mcp-jetbrains

• Status: Passed
• Tools scanned: 0
• Result: No security issues detected

✅ mcp-neo4j-aura-manager

• Status: Passed
• Tools scanned: 0
• Result: No security issues detected

⚠️ mcp-neo4j-cypher

• Status: Error
• Message: No JSON output found in scan results

✅ mcp-neo4j-memory

• Status: Passed
• Tools scanned: 0
• Result: No security issues detected

✅ mcp-server-box

• Status: Passed
• Tools scanned: 0
• Result: No security issues detected

⚠️ mcp-server-circleci

• Status: Error
• Message: No JSON output found in scan results

✅ mcp-server-neon

• Status: Passed
• Tools scanned: 0
• Result: No security issues detected

✅ netbird

• Status: Passed
• Tools scanned: 0
• Result: No security issues detected

⚠️ notion

• Status: Error
• Message: No JSON output found in scan results

⚠️ onchain-mcp

• Status: Error
• Message: No JSON output found in scan results

⚠️ phoenix-mcp

• Status: Error
• Message: No JSON output found in scan results

❌ playwright-mcp

• Status: Failed
• Tools scanned: 21
• Vulnerabilities found: 1

Security issues detected:

• [E001] Malicious input detected within the tool documentation.

Allowed issues (not blocking):

• [TF001] Data leak toxic flow detected. The same agent has access to at least one tool that produces untrusted content, one tool that can access private data, and one tool that can behave as a public sink. For more information, see https://explorer.invariantlabs.ai/docs/mcp-scan/issue-code-reference/#TF001 (Allowed: Data leak risk acceptable - tool designed for browser automation and web testing workflows where external content interaction is essential. Users should be aware of potential data exposure when automating web interactions.)
• [TF002] Destructive toxic flow detected. The same agent has access to at least one tool that produces untrusted content and one tool that can behave destructively. For more information, see https://explorer.invariantlabs.ai/docs/mcp-scan/issue-code-reference/#TF002 (Allowed: Destructive flow risk acceptable - browser automation tools are core functionality for web testing and automation. Users should only use with trusted prompts and on non-production systems.)

✅ sentry-mcp-server

• Status: Passed
• Tools scanned: 0
• Result: No security issues detected

✅ supabase-mcp-server

• Status: Passed
• Tools scanned: 0
• Result: No security issues detected

✅ tavily-mcp

• Status: Passed
• Tools scanned: 0
• Result: No security issues detected

---

Summary: Scanned 32 MCP server(s), found 1 security issue(s).

⚠️ Action Required: Security issues were detected. Please review and address them before merging.