[renovate]

This PR contains the following updates:

Package	Update	Change
stacklok/toolhive	patch	v0.51.1 → v0.51.4

After this PR opens, .github/workflows/upstream-release-docs.yml adds source-verified content edits for the new release. For stacklok/toolhive, the same workflow also syncs reference assets (CLI help, Swagger) and regenerates the CRD MDX pages.

---

Release Notes

stacklok/toolhive (stacklok/toolhive)

v0.51.4

Compare Source

What's Changed

• Clarify MCP admission and rejection diagnostics by @​JAORMX in #​6727
• Release v0.51.4 by @​toolhive-release-app[bot] in #​6728

Full Changelog: stacklok/toolhive@v0.51.3...v0.51.4

v0.51.3

Compare Source

Security

Embedded authorization server: upstream callback bound to the initiating browser (GHSA-2gjv-f568-6cxp, High)

/oauth/callback completed a login for whichever browser arrived with a valid upstream state. An attacker who started an authorization for their own client could hand the upstream identity provider URL to a victim and receive an authorization code minted for the victim's identity. The device flow's verification-page login shared the same gap.

Both flows now bind the login to the browser that started it: /oauth/authorize and POST /oauth/device set a per-flow cookie whose hash is stored on the pending record, and the callback completes only when the same browser presents it. The device verification form additionally requires an anti-forgery token, so a cross-site page cannot start a device login from a victim's browser.

What changes for operators and tooling

• Interactive sign-in must be completed in the browser that opened /oauth/authorize or the device verification page, with cookies enabled for that host. Headless drivers that walk the flow with a plain HTTP client must carry cookies between steps, and must load the device verification form before posting a user_code.
• The upstream callback (redirect_uri, defaulting to {resourceUrl}/oauth/callback in the operator) must share a hostname with the browser-facing authorize URL (authorizationEndpointBaseUrl, else issuer). If the authorize URL is https, a non-loopback callback must be https too. Mismatched deployments log a WARN at startup naming the upstream, and every browser login through it is rejected until fixed.
• When authorizationEndpointBaseUrl is set, the device flow's verification_uri is now advertised from that base URL instead of the issuer.
• During a rolling upgrade, a login started on a v0.51.2 replica and finished on v0.51.3 fails within the 10-minute pending window and must be restarted; one started on v0.51.3 and finished on v0.51.2 is not checked.

What's Changed

• Close workflow audit log writers by @​kocaemre in #​6110
• Preserve vMCP resources until requests drain by @​JAORMX in #​6715
• Avoid priority annexing unlisted tools by @​kocaemre in #​6127
• Fix spelling flagged by codespell by @​rdimitrov in #​6722
• Update docker images by @​renovate[bot] in #​6719
• Update github actions by @​renovate[bot] in #​6717
• Update go modules by @​renovate[bot] in #​6718
• Regenerate OpenAPI docs and SDK for auth config by @​rdimitrov in #​6724
• Release v0.51.3 by @​toolhive-release-app[bot] in #​6725

Full Changelog: stacklok/toolhive@v0.51.2...v0.51.3

v0.51.2

Compare Source

What's Changed

• Preserve access across security migrations by @​JAORMX in #​6712
• Preserve legacy encrypted stores by @​jhrozek in #​6711
• Release v0.51.2 by @​toolhive-release-app[bot] in #​6714

Full Changelog: stacklok/toolhive@v0.51.1...v0.51.2

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Never, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

---

Docs update for toolhive v0.51.4

At a glance

Upstream	stacklok/toolhive v0.51.1 → v0.51.4
Hand-written changes	2 commit(s)
Reference assets	refreshed (separate commit)
Gaps	0
Owner	@JAORMX - identified from merged release PR stacklok/toolhive#6728
Release contributors	3 review requested (see sidebar)
Action required	Spot-check skill-authored prose for accuracy

Who does what

@JAORMX cut this release and owns this PR: review your own changes, chase the remaining approvals, and merge once they're in. You don't need to wait on a review from anyone listed as having no docs impact below.

Everyone with a review request: the target is a review and approval within 2 business days.

Summary of changes

• Added thv secret upgrade-protection guidance in docs/toolhive/guides-cli/secrets-management.mdx, explaining when to migrate legacy encrypted stores to Argon2id and the one-way compatibility break.
• Updated docs/toolhive/guides-vmcp/tool-aggregation.mdx to note that the priority strategy now drops every candidate in a tool-name collision when any conflicting backend is absent from priorityOrder (verified against pkg/vmcp/aggregator/priority_resolver.go).
• Updated docs/toolhive/guides-k8s/embedded-auth-server-k8s.mdx and docs/toolhive/guides-vmcp/embedded-auth-server-vmcp.mdx to require each upstream provider's redirectUri to share the browser-facing authorize hostname (issuer or authorizationEndpointBaseUrl), because /oauth/callback binds each login to the browser that started it with a host-only cookie.

Review routing

GitHub could not request the upstream contributor directly, so review went to the human merger of each relevant upstream PR:

• @JAORMX (merged Avoid priority annexing unlisted tools toolhive#6127)

Run cost

Session	Turns	Cost (USD)
Generation	93	$11.5335
Editorial review	36	$2.8230
Total	129	$14.3565

How this PR was built

Two Claude Opus sessions run per release: a generation pass
(upstream-release-docs skill, 6 phases) followed by a fresh-
context editorial pass (docs-review). Prettier/ESLint
auto-fixes are applied after.

Auto-synced paths — do not hand-edit these in review:

• static/api-specs/
• docs/toolhive/reference/cli/ (toolhive only)
• docs/toolhive/reference/crds/

If a "Gaps needing human context" section is present above,
each entry includes a paste-ready Helper prompt for local
Claude a reviewer can use to resolve the gap.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs-website	Ready	Preview	Sep 30, 2026 7:24am UTC

[claude]

Claude finished @renovate[bot]'s task in 14m 31s —— View job

---

Upstream release docs: toolhive v0.51.1 → v0.51.4

Committed 2a96cf7 to renovate/stacklok-toolhive-0.x.

Hand-written edits (4 files, +47 lines)

• docs/toolhive/guides-cli/secrets-management.mdx — new "Upgrade encrypted secrets protection" subsection documenting thv secret upgrade-protection, the one-way Argon2id migration and its multi-process compatibility caveat. Source: cmd/thv/app/secret.go (newSecretUpgradeProtectionCommand) and PR stacklok/toolhive#6711.
• docs/toolhive/guides-vmcp/tool-aggregation.mdx — Priority strategy now drops every candidate for a tool name when any conflicting backend is absent from priorityOrder, logs an ERROR, and leaves non-colliding tools untouched. Source: pkg/vmcp/aggregator/priority_resolver.go and PR stacklok/toolhive#6127.
• docs/toolhive/guides-k8s/embedded-auth-server-k8s.mdx — Upstream redirectUri hostname must match the browser-facing authorize URL (issuer or authorizationEndpointBaseUrl); config validation logs WARN for host or scheme mismatch. Source: pkg/authserver/config.go (warnOnAuthorizeCallbackHostMismatch) and pkg/authserver/server/handlers/browser_binding.go. Corresponds to security advisory GHSA-2gjv-f568-6cxp.
• docs/toolhive/guides-vmcp/embedded-auth-server-vmcp.mdx — Same hostname constraint documented for vMCP's inline authServerConfig.authorizationEndpointBaseUrl.

Deferred (not documented)

• stacklok/toolhive#6712 (contributor security rules), stacklok/toolhive#6110 (internal audit fd leak), stacklok/toolhive#6715 (vMCP library-caller Server.Stop retry contract), stacklok/toolhive#6727 (internal MCP admission refactor with bounded log reason fields), and the renovate/codespell bumps.

Artifacts written

• SUMMARY.md and REVIEWERS.json at the repo root (gitignored — consumed by the upstream release workflow to compose the PR body and pick reviewers).

• Phase 1: Discover contributors and set up release metadata

• Phase 2: Read release notes and identify user-facing changes

• Phase 3: Inspect source and map changes to docs

• Phase 4: Edit documentation

• Phase 5: Build and lint clean

• Phase 6: Wrote artifacts, committed, pushed

Build succeeded (npm run build); ESLint and Prettier clean.
· Branch: renovate/stacklok-toolhive-0.x

[claude]

Claude finished @renovate[bot]'s task in 5m 36s —— View job

---

Editorial review of v0.51.4 release docs

• Read changed docs files
• Run /docs-review on the files
• Apply editorial fixes
• Format and lint edits
• Commit and push (8b23c7b)

Summary

Editorial pass over the four docs updated in 2a96cf7. All fixes stay within the paragraphs the release commit added; no factual claims changed.

docs/toolhive/guides-vmcp/tool-aggregation.mdx
Replaced the spaced-hyphen em-dashes around the appositive ("- a forbid or permit policy written against the tool name -") with parentheses, and named the Cedar policy language explicitly. The bare noun "permit" reads as unfamiliar terminology without that anchor.

docs/toolhive/guides-vmcp/embedded-auth-server-vmcp.mdx
Folded the trailing "This constraint also applies when authorizationEndpointBaseUrl is omitted, in which case the callback host must match issuer" sentence into the opening one, so the hostname source is stated once as authorizationEndpointBaseUrl when it's set, otherwise issuer.

docs/toolhive/guides-k8s/embedded-auth-server-k8s.mdx
Split the long run-on describing the cookie binding into two sentences so the matching rule and the cookie mechanics each stand alone.

docs/toolhive/guides-cli/secrets-management.mdx
Reframed the intro to lead with current behavior: ToolHive supports two on-disk formats, ordinary reads and writes preserve whichever the file already uses. Trims the "written by an older ToolHive release" framing that read as a transition narration.
· Branch: renovate/stacklok-toolhive-0.x