Skip to content

Update stacklok/toolhive to v0.28.0#884

Merged
rdimitrov merged 6 commits into
mainfrom
renovate/stacklok-toolhive-0.x
May 21, 2026
Merged

Update stacklok/toolhive to v0.28.0#884
rdimitrov merged 6 commits into
mainfrom
renovate/stacklok-toolhive-0.x

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate Bot commented May 19, 2026 •
edited by github-actions Bot
Loading

This PR contains the following updates:

Package Update Change
stacklok/toolhive minor v0.27.2 → v0.28.0

After this PR opens, .github/workflows/upstream-release-docs.yml adds source-verified content edits for the new release. For stacklok/toolhive, the same workflow also syncs reference assets (CLI help, Swagger) and regenerates the CRD MDX pages.

Release Notes

stacklok/toolhive (stacklok/toolhive)

v0.28.0

Compare Source

What's Changed

New Contributors

Full Changelog: stacklok/toolhive@v0.27.2...v0.28.0

Configuration

📅 Schedule: (in timezone America/New_York)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Never, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

Docs update for toolhive v0.28.0

At a glance
Upstream stacklok/toolhive v0.27.2 → v0.28.0
Hand-written changes 2 commit(s)
Reference assets refreshed (separate commit)
Gaps 0
Release contributors 16 auto-assigned (see sidebar)
Action required Spot-check skill-authored prose for accuracy

Summary of changes

Summary of changes

  • Added GitHub Copilot CLI to the supported clients table and a new
    "Configuration locations" section in docs/toolhive/reference/client-compatibility.mdx
    (stacklok/toolhive#5287).
  • Added a new "Extract identity from the token response" section in
    docs/toolhive/guides-k8s/auth-k8s.mdx covering the identityFromToken
    OAuth 2.0 upstream field, with a cross-link tip in
    docs/toolhive/guides-vmcp/authentication.mdx (stacklok/toolhive#5269,
    stacklok/toolhive#5222, stacklok/toolhive#5285).
  • Added a "Rate limit a VirtualMCPServer" section in
    docs/toolhive/guides-k8s/rate-limiting.mdx covering the new
    spec.config.rateLimiting field, with prerequisites for Redis session
    storage and OIDC incoming auth (stacklok/toolhive#5079).
  • Documented the new --session-ttl flag in docs/toolhive/guides-cli/run-mcp-servers.mdx,
    the thv vmcp serve flag reference in docs/toolhive/guides-vmcp/local-cli.mdx,
    and the vMCP TTL discussion in
    docs/toolhive/guides-vmcp/scaling-and-performance.mdx
    (stacklok/toolhive#5117).
  • Added a "How do I disable update checks?" FAQ entry covering the new
    TOOLHIVE_SKIP_UPDATE_CHECK environment variable in
    docs/toolhive/faq.mdx (stacklok/toolhive#5264).

Run cost

Session Turns Cost (USD)
Generation 161 $12.4569
Editorial review 103 $8.3143
Total 264 $20.7712
How this PR was built

Two Claude Opus sessions run per release: a generation pass
(upstream-release-docs skill, 6 phases) followed by a fresh-
context editorial pass (docs-review). Prettier/ESLint
auto-fixes are applied after.

Auto-synced paths — do not hand-edit these in review:

  • docs/toolhive/reference/cli/
  • docs/toolhive/reference/crds/
  • static/api-specs/

If a "Gaps needing human context" section is present above,
each entry includes a paste-ready Helper prompt for local
Claude a reviewer can use to resolve the gap.

@renovate
Update stacklok/toolhive to v0.28.0
91e306f 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
@renovate renovate Bot added the autogen-docs Pull requests generated by automated release workflows label May 19, 2026
@vercel
Copy link
Copy Markdown

vercel Bot commented May 19, 2026 •
edited
Loading

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
docs-website Ready Ready Preview, Comment May 19, 2026 10:20pm

Request Review

@github-actions github-actions Bot marked this pull request as draft May 19, 2026 18:33
@claude
Copy link
Copy Markdown
Contributor

claude Bot commented May 19, 2026 •
edited
Loading

Claude finished @renovate[bot]'s task in 15m 34s —— View job

Upstream release docs: toolhive v0.28.0

  • Phase 1: Discovery
  • Phase 2: Deep-dive into major features
  • Phase 3: Docs impact map
  • Phase 4: Source-verified implementation
  • Phase 5: Self-check (prettier + eslint clean; build error is from MCP-metadata plugin needing network, unrelated to these edits)
  • Phase 6: Commit + SUMMARY.md

Summary

Wrote source-verified hand-written docs for the user-facing changes in toolhive v0.28.0. Auto-generated CLI/CRD/API reference files were already refreshed by the workflow.

Files changed (hand-written):

  • docs/toolhive/reference/client-compatibility.mdx - Added GitHub Copilot CLI row and a Configuration locations section (stacklok/toolhive#5287).
  • docs/toolhive/guides-k8s/auth-k8s.mdx - Added an "Extract identity from the token response" subsection covering identityFromToken, updated synthesis-mode wording (stacklok/toolhive#5269, stacklok/toolhive#5222, stacklok/toolhive#5285).
  • docs/toolhive/guides-vmcp/authentication.mdx - Added a cross-link tip for identityFromToken next to the existing tokenResponseMapping tip.
  • docs/toolhive/guides-k8s/rate-limiting.mdx - Added a "Rate limit a VirtualMCPServer" section with the new spec.config.rateLimiting field, Redis + OIDC prerequisites, and a worked example (stacklok/toolhive#5079).
  • docs/toolhive/guides-cli/run-mcp-servers.mdx - Added an "Override the session timeout" section for the new --session-ttl flag (stacklok/toolhive#5117).
  • docs/toolhive/guides-vmcp/local-cli.mdx - Added --session-ttl to the thv vmcp serve flag reference table.
  • docs/toolhive/guides-vmcp/scaling-and-performance.mdx - Noted that the 30-minute TTL is now overridable via --session-ttl.
  • docs/toolhive/faq.mdx - Added a "How do I disable update checks?" Q&A covering TOOLHIVE_SKIP_UPDATE_CHECK and its coupling to usage metrics (stacklok/toolhive#5264).

Verification:

  • All claims (env var name + semantics, Copilot CLI config path/format, identityFromToken paths and validation rules, rate-limiting CEL rules, --session-ttl flag defaults) verified against stacklok/toolhive source at the v0.28.0 tag via gh api.
  • Prettier and ESLint pass clean on the changed files.
  • Local npm run build fails inside the action sandbox because the MCP-metadata plugin can't reach external server endpoints; the Vercel preview build (already green on this PR) covers the production path.
  • branch

@github-actions @unknown
Document v0.28.0 user-facing features
89b4a45 
Cover the toolhive v0.28.0 changes that need hand-written docs:
Copilot CLI client, identityFromToken on OAuth2 upstreams,
VirtualMCPServer rate limiting, --session-ttl flag, and the new
TOOLHIVE_SKIP_UPDATE_CHECK env var.

Co-authored-by: Unknown <Unknown@users.noreply.github.com>
@claude
Copy link
Copy Markdown
Contributor

claude Bot commented May 19, 2026 •
edited
Loading

Claude finished @renovate[bot]'s task in 9m 31s —— View job

Docs review: toolhive v0.28.0 release docs

  • Read all changed docs files (8 hand-written)
  • Cross-check claims against upstream v0.28.0 source
  • Apply editorial fixes
  • Run prettier + eslint (skipped locally - npm restricted in sandbox; CI will validate)
  • Commit and push (ac1238b)

Summary

Verified the previous commit's source-verified docs against upstream v0.28.0 (via gh api) and applied two editorial fixes to docs/toolhive/guides-k8s/auth-k8s.mdx:

  1. Clarity (line 799): "resolves identity from gjson dot-notation paths into the token response body" had awkward "from X into Y" grammar. Reworded to "extracts identity from the token response body using gjson dot-notation paths."
  2. Accuracy (lines 822-824): "identityFromToken and userInfo can both be set, but only one is used at runtime" was ambiguous about which wins. Source code (pkg/authserver/upstream/oauth2.go) confirms identityFromToken takes precedence and the userinfo HTTP call is skipped entirely. Made this explicit.

Cross-checks that passed

  • TOOLHIVE_SKIP_UPDATE_CHECK env var name and gating behavior (pkg/updates/client.go)
  • thv run --session-ttl 2h default + thv vmcp serve --session-ttl 30m default
  • identityFromToken paths (1-256 char validation), @upstreamjwt modifier semantics, tk- synthesized-subject prefix
  • VirtualMCPServer rateLimiting CEL rules (Redis required, incomingAuth.type=oidc required for per-user)
  • GitHub Copilot CLI config path (~/.copilot/mcp-config.json) and schema

No content was added beyond refinement of what the prior commit wrote. SUMMARY.md and auto-generated reference assets were left untouched per workflow protocol.

branch ·

github-actions Bot added 2 commits May 19, 2026 18:59
@github-actions
Clarify identityFromToken behavior in auth-k8s docs
ac1238b 
Fix awkward "from X into Y" phrasing and make precedence explicit
when both identityFromToken and userInfo are set on an OAuth2 upstream.
@github-actions
Add upstream-release-docs content for toolhive v0.28.0
370e809
@github-actions github-actions Bot marked this pull request as ready for review May 19, 2026 19:00
@jhrozek @claude
Fix identityFromToken examples in auth-k8s docs
74412f2 
Snowflake returns the login name as a top-level username field, not as
a JWT claim inside access_token. Replace the @upstreamjwt example with
the actual top-level path, keep @upstreamjwt as a generic capability.

Slack's oauth.v2.access response only returns authed_user.id; drop the
fabricated authed_user.name and authed_user.email fields.

Also link to the gjson path syntax, promote the section to H3 with a
back-link from the synthesis-mode note, and clarify that extraction
failure has no fallback to userInfo.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
jhrozek
jhrozek approved these changes May 19, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

@jhrozek jhrozek left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I pushed a fixup for the identityFromToken examples, now the changes do look good to me

danbarr
danbarr approved these changes May 19, 2026
View reviewed changes
Copy link
Copy Markdown
Collaborator

@danbarr danbarr left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Updates specifically related to my client addition (Copilot CLI) are good to go.

@claude claude Bot mentioned this pull request May 20, 2026
Open
1 task
@rdimitrov rdimitrov merged commit e905248 into main May 21, 2026
6 checks passed
@rdimitrov rdimitrov deleted the renovate/stacklok-toolhive-0.x branch May 21, 2026 07:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jhrozek jhrozek jhrozek approved these changes

@danbarr danbarr danbarr approved these changes

@rdimitrov rdimitrov rdimitrov approved these changes

@ChrisJBurns ChrisJBurns Awaiting requested review from ChrisJBurns

@JAORMX JAORMX Awaiting requested review from JAORMX

@blkt blkt Awaiting requested review from blkt

@lorr1 lorr1 Awaiting requested review from lorr1

@lujunsan lujunsan Awaiting requested review from lujunsan

@reyortiz3 reyortiz3 Awaiting requested review from reyortiz3

@tgrunnagle tgrunnagle Awaiting requested review from tgrunnagle

Assignees

No one assigned

Labels

autogen-docs Pull requests generated by automated release workflows

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@jhrozek @danbarr @rdimitrov