[renovate]

This PR contains the following updates:

Package	Update	Change
stacklok/toolhive-registry-server	patch	v1.5.2 → v1.5.3

After this PR opens, .github/workflows/upstream-release-docs.yml adds source-verified content edits for the new release. For stacklok/toolhive, the same workflow also syncs reference assets (CLI help, Swagger) and regenerates the CRD MDX pages.

---

Release Notes

stacklok/toolhive-registry-server

v1.5.3

Compare Source

What's Changed

• Update go modules by @​renovate[bot] in #​893
• Route Claude PR Assistant through Stacklok AI gateway by @​eleftherias in #​891
• Update docker images by @​renovate[bot] in #​889
• Update github actions by @​renovate[bot] in #​890
• Update module github.com/gobwas/glob to v1 by @​renovate[bot] in #​892
• Update github actions by @​renovate[bot] in #​896
• Update docker images by @​renovate[bot] in #​895
• Bump vulnerable claude-code-action workflow pin by @​rdimitrov with @​Copilot in #​897
• Use repo variable for Anthropic base URL by @​eleftherias in #​898
• Update docker images by @​renovate[bot] in #​899
• Update github actions by @​renovate[bot] in #​900
• [WIP] Fix code scanning alert #​43 by @​rdimitrov with @​Copilot in #​901
• Run test PostgreSQL as a child process by @​JAORMX in #​902
• Update github actions by @​renovate[bot] in #​903
• Update docker images by @​renovate[bot] in #​905
• Update go modules by @​renovate[bot] in #​904
• Clarify Helm values descriptions by @​danbarr in #​924
• Update docker images by @​renovate[bot] in #​925
• Update github actions by @​renovate[bot] in #​926
• Validate API sources by probing /v0.1/servers by @​rdimitrov in #​947
• Bump toolhive-core to v0.0.53 by @​rdimitrov in #​949
• Release v1.5.3 by @​toolhive-release-app[bot] in #​948

New Contributors

• @​rdimitrov with @​Copilot made their first contribution in #​897

Full Changelog: stacklok/toolhive-registry-server@v1.5.2...v1.5.3

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Never, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

---

Docs update for toolhive-registry-server v1.5.3

At a glance

Upstream	stacklok/toolhive-registry-server v1.5.2 → v1.5.3
Hand-written changes	2 commit(s)
Reference assets	refreshed (separate commit)
Gaps	0
Owner	@rdimitrov - identified from merged release PR stacklok/toolhive-registry-server#948
Release contributors	2 review requested (see sidebar) · 3 not requested (no docs impact)
Action required	Spot-check skill-authored prose for accuracy

Who does what

@rdimitrov cut this release and owns this PR: review your own changes, chase the remaining approvals, and merge once they're in. You don't need to wait on a review from anyone listed as having no docs impact below.

Everyone with a review request: the target is a review and approval within 2 business days.

Summary of changes

• Updated the API endpoint source section in docs/toolhive/guides-registry/configuration.mdx to explain the /v0.1/servers?limit=1 validation check, that any MCP Registry v0.1 implementation (including another ToolHive Registry Server via its /registry/<name> path) is accepted, that upstreams must allow anonymous reads, and where validation errors surface (syncStatus.message) (Validate API sources by probing /v0.1/servers toolhive-registry-server#947)
• Updated the API source section in docs/toolhive/guides-registry/deploy-operator.mdx with the same compatibility note and a cross-link to the configuration guide
• No prose change for Bump toolhive-core to v0.0.53 toolhive-registry-server#949 (publisher-provided metadata with non-object keys now validates in file and Git sources): a bug fix that no existing page contradicts

No docs impact identified

3 contributor(s) had no-docs-impact commits in this release. No review was requested, and the workflow did not auto-notify them.

Run cost

Session	Turns	Cost (USD)
Generation	33	$1.0520
Editorial review	22	$0.6612
Total	55	$1.7132

How this PR was built

Two Claude Opus sessions run per release: a generation pass
(upstream-release-docs skill, 6 phases) followed by a fresh-
context editorial pass (docs-review). Prettier/ESLint
auto-fixes are applied after.

Auto-synced paths — do not hand-edit these in review:

• static/api-specs/
• docs/toolhive/reference/cli/ (toolhive only)

If a "Gaps needing human context" section is present above,
each entry includes a paste-ready Helper prompt for local
Claude a reviewer can use to resolve the gap.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs-website	Ready	Preview	Oct 14, 2026 1:32pm UTC

[claude]

Claude finished @renovate[bot]'s task in 2m 16s —— View job

---

Upstream release docs: toolhive-registry-server v1.5.3

• Discovery: sorted the release changes into categories
• Deep dive: checked the user-facing PRs against source at v1.5.3
• Audited the existing docs
• Made the edits (commit 76bda68)
• Ran Prettier and ESLint (both clean) and wrote SUMMARY.md and REVIEWERS.json

What changed

Only two upstream PRs change behavior a reader can see. The rest are CI, test, and dependency updates.

• Validate API sources by probing /v0.1/servers toolhive-registry-server#947: API sources are now checked by probing /v0.1/servers. I confirmed this in internal/sources/api_upstream.go. Before syncing, the server now sends GET {endpoint}/v0.1/servers?limit=1 and checks that the response has a servers array. The old check only passed for the official MCP registry. Any service that implements the v0.1 API now passes, including another ToolHive Registry Server. When the check fails, the underlying error is now included in the message the source reports.
  • guides-registry/configuration.mdx: I replaced the short note under API endpoint source with a paragraph that covers:
    • what the check does
    • how to sync from another Registry Server (put its /registry/<name> path in the endpoint)
    • that upstreams must allow anonymous reads, because APIConfig has only endpoint and timeout and no credential fields
    • that the error appears in syncStatus.message
  • guides-registry/deploy-operator.mdx: the API source section now has the same compatibility note and a link to the configuration guide.
• Bump toolhive-core to v0.0.53 toolhive-registry-server#949: toolhive-core updated to v0.0.53. File and Git sources no longer reject a whole registry when a server's publisher-provided metadata has keys whose values aren't objects. No page says otherwise, so I made no prose change.
• Clarify Helm values descriptions toolhive-registry-server#924: Helm values descriptions. These flow into the auto-generated Helm reference, which the earlier workflow step already updated. I didn't hand-edit it.

Not done

• I didn't run npm run build; PR CI covers it. The edits don't add any new pages or links that could break.
• I didn't run the /docs-review pass. The edits are two short paragraphs, which I wrote to the style guide directly.

[claude]

Claude finished @renovate[bot]'s task in 1m 46s —— View job

---

Editorial review of v1.5.3 content

• Identify files changed in previous commit (guides-registry/configuration.mdx, guides-registry/deploy-operator.mdx)
• Run docs-review on changed files
• Apply fixes, format, lint
• Commit and push (0801356)

Summary

The generated content about API source validation is accurate. I checked it against upstream stacklok/toolhive-registry-server#947. The server probes GET {endpoint}/v0.1/servers?limit=1 and requires a servers array. Any MCP Registry v0.1 implementation passes, including another ToolHive Registry Server reached through /registry/{name}. API sources can't send credentials, and the underlying error now appears in the sync status. The new prose also correctly drops the old :::note admonition and states the current behavior.

Fixes applied

File	Issue	Fix
configuration.mdx L261	The endpoint option said "(without path)", but the new prose tells readers to include /registry/default in the endpoint.	Reworded to "without the /v0.1/... API paths"
configuration.mdx L277	The page didn't say where to find syncStatus.message.	Added the source details endpoint (GET /v1/sources/{name}), as defined in the registry API spec
deploy-operator.mdx L256	A long parenthetical held the main instruction.	Split it into its own sentence and gave the cross-link a clearer purpose

No new claims added. Prettier and ESLint ran clean. I didn't touch any auto-generated files (static/api-specs/, reference/helm/).