fix(deps): update module github.com/stacklok/toolhive to v0.6.13

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/stacklok/toolhive	v0.6.7 -> v0.6.13

---

Release Notes

stacklok/toolhive (github.com/stacklok/toolhive)

v0.6.13

Compare Source

What's Changed

• Bump operator versions by @​rdimitrov in #​3017
• Deprecate SSE proxy mode for stdio transport by @​carlos-gn in #​3008
• Composite Tools Supports DefaultResults for Skippable Steps by @​jerm-dro in #​3006
• Optimize VirtualMCP e2e test performance by @​yrobla in #​3012
• Update actions/cache digest to 9255dc7 by @​renovate[bot] in #​3019
• Remove RetryOnConflict Logic in Favour of Controller-Level Backoff by @​ChrisJBurns in #​3020
• Refactors ConfigMap management in the Operator to use reusable configmaps package by @​ChrisJBurns in #​3021
• Attempt to Deflake vMCP Tests by @​jerm-dro in #​3024
• Update registry from toolhive-registry release v2025.12.13 by @​github-actions[bot] in #​3026
• Update GitHub Artifact Actions (major) by @​renovate[bot] in #​3023
• Update registry from toolhive-registry release v2025.12.14 by @​github-actions[bot] in #​3027
• Update kindest/node Docker tag to v1.34.2 by @​renovate[bot] in #​3025
• add documentation for virtualmcp by @​yrobla in #​2931
• Temporarily skip flaky e2e tests by @​eleftherias in #​3037
• Fix workload restart API by using background context by @​eleftherias in #​3034
• Fix client registration by not skipping workloads by @​eleftherias in #​3035

Full Changelog: stacklok/toolhive@v0.6.12...v0.6.13

v0.6.12

Compare Source

What's Changed

• Update alpine Docker tag to v3.23.0 by @​renovate[bot] in #​2882
• Update registry from toolhive-registry release v2025.12.04 by @​github-actions[bot] in #​2886
• fix vmcp crd don't reconcile after podtemplatespec changes by @​yrobla in #​2817
• Require explicit authentication configuration in VirtualMCPServer by @​yrobla in #​2865
• validate that group membership changes trigger reconciliation by @​yrobla in #​2866
• Update module github.com/spf13/cobra to v1.10.2 by @​renovate[bot] in #​2887
• Bump the operator versions by @​rdimitrov in #​2889
• Revert "Update alpine Docker tag to v3.23.0" by @​rdimitrov in #​2894
• fix mcp controller and test status propagation by @​yrobla in #​2823
• Update module github.com/mark3labs/mcp-go to v0.43.2 by @​renovate[bot] in #​2892
• use status manager and constants on podtemplatespec reconciliation by @​yrobla in #​2888
• Fix legacy registry schema ID and file references by @​danbarr in #​2880
• Return error when custom registry is unreachable by @​JAORMX in #​2879
• Drop any code which writes to PID files by @​dmjb in #​2899
• Gracefully Shutdown Foreground Server on Interrupt by @​jerm-dro in #​2863
• Bump the registry-server version in the operator by @​rdimitrov in #​2904
• Fix VirtualMCPServer controller to check PodReady condition by @​JAORMX in #​2901
• Refactor CRD Telemetry Config Conversion for Reusability by @​jerm-dro in #​2908
• Update MCP protocol expert agent to spec 2025-11-25 by @​JAORMX in #​2911
• add validation tests to detect invalid configs by @​yrobla in #​2896
• Update registry from toolhive-registry release v2025.12.05 by @​github-actions[bot] in #​2912
• Implement CompositeToolRefs resolution in VirtualMCPServer converter by @​amirejaz in #​2885
• Fix: Added path configuration to registry server by @​dmartinol in #​2794
• Fix vMCP podTemplateSpec when only pod-level settings is applied by @​jhrozek in #​2897
• Update module github.com/lestrrat-go/httprc/v3 to v3.0.2 by @​renovate[bot] in #​2913
• Revert "Gracefully Shutdown Foreground Server on Interrupt (#​2863)" by @​dmjb in #​2916
• add examples of configuration for virtualmcp by @​yrobla in #​2900
• Disable failing vMCP test for k8s by @​dmjb in #​2919
• Ensure PID files are cleaned up after migration by @​dmjb in #​2905
• Move regex compilation to package-level variable in virtualmcpserver_controller #issue-2874 by @​deepika1214 in #​2875
• fixes generation of manifests via kubebuilder by @​eleftherias in #​2924
• Update module github.com/go-git/go-billy/v5 to v5.7.0 by @​renovate[bot] in #​2933
• Remove tool type column and rename created at to created in the thv list by @​carlos-gn in #​2917
• Update helm/kind-action digest to 2cd8ada by @​renovate[bot] in #​2937
• Add build auth file injection for protocol builds by @​JAORMX in #​2909
• Default anonymous authentication by @​dmartinol in #​2914
• adds permission for claude to make content write changes by @​ChrisJBurns in #​2925
• Add log level configuration support to VirtualMCPServer by @​4t8dd in #​2837
• Update module golang.org/x/sys to v0.39.0 by @​renovate[bot] in #​2943
• Gracefully Shutdown Foreground Server on Interrupt by @​jerm-dro in #​2927
• Instrument vMCP and Document o11y Configuration by @​jerm-dro in #​2906
• Validate ValidationStatus of referenced CompositeToolRefs by @​amirejaz in #​2944
• Fix logic bug in WaitForPodsReady that incorrectly reports pods as ready by @​slyt3 in #​2898
• Populate remote workload metadata in GetWorkload by @​carlos-gn in #​2929
• Update module golang.ngrok.com/ngrok/v2 to v2.1.1 by @​renovate[bot] in #​2928
• fix and test mcptoolconfig for vmcp by @​yrobla in #​2891
• Update module golang.org/x/mod to v0.31.0 by @​renovate[bot] in #​2952
• Add unauthenticated and headerinjection auth strategy to MCPExternalAuthConfig by @​yrobla in #​2915
• Use autoupdate github action to auto update all PRs. by @​dmjb in #​2958
• Bump the registry-server version in the operator to v0.4.2 by @​rdimitrov in #​2959
• Update kyverno/action-install-chainsaw action to v0.2.14 by @​renovate[bot] in #​2939
• Warn users about affected workloads when updating or deleting secrets by @​JAORMX in #​2945
• Update module golang.org/x/term to v0.38.0 by @​renovate[bot] in #​2965
• Update module github.com/onsi/gomega to v1.38.3 by @​renovate[bot] in #​2947
• Add design proposal for K8s-aware vMCP with dynamic backend discovery by @​jhrozek in #​2884
• Update module golang.org/x/oauth2 to v0.34.0 by @​renovate[bot] in #​2940
• Update peter-evans/create-pull-request digest to 22a9089 by @​renovate[bot] in #​2926
• Update module golang.org/x/sync to v0.19.0 by @​renovate[bot] in #​2942
• Add vulnerability exclusion support to govulncheck workflow by @​jhrozek in #​2972
• Bump the operator versions by @​rdimitrov in #​2974
• Update peter-evans/create-pull-request action to v8 by @​renovate[bot] in #​2973
• Update golang.org/x/exp/jsonrpc2 digest to 8475f28 by @​renovate[bot] in #​2966
• Fix VirtualMCPServer reconciliation for discovered auth config updates by @​yrobla in #​2957
• add test for composite workflow by reference by @​yrobla in #​2956
• Update module github.com/onsi/ginkgo/v2 to v2.27.3 by @​renovate[bot] in #​2946
• Update anthropics/claude-code-action digest to f0c8eb2 by @​renovate[bot] in #​2969
• Update module golang.org/x/net to v0.48.0 by @​renovate[bot] in #​2963
• Update kubernetes packages to v0.34.3 by @​renovate[bot] in #​2977
• Update anchore/sbom-action action to v0.20.11 by @​renovate[bot] in #​2975
• Add audit middleware to vMCP server by @​yrobla in #​2981
• Add OnDecline and OnCancel handlers for workflow steps by @​yrobla in #​2961
• Add configurable scopes to the auth info handler and expose them through CLI by @​jhrozek in #​2982
• Update opentelemetry-go monorepo by @​renovate[bot] in #​2967
• vMCP: Composite Tools supports non-string Arguments by @​jerm-dro in #​2971
• enable CRD upgrades via Helm with feature flags by @​ChrisJBurns in #​2809
• adds reusable Kubernetes secrets functionality in Operator by @​ChrisJBurns in #​2991
• Pass debug flag to detached process restart command by @​carlos-gn in #​2992
• Remove redundant ToolType field from Workload by @​carlos-gn in #​2932
• Add scopes field to MCPServer CRD for OIDC config by @​jhrozek in #​2988
• Update module github.com/sigstore/sigstore-go to v1.1.4 by @​renovate[bot] in #​2990
• Remove autoupdate for now by @​dmjb in #​3002
• Wire up audit config to vMCP CLI by @​yrobla in #​2987
• adds reusable Kubernetes configmap functionality in Operato for C/R/U actions by @​ChrisJBurns in #​2997
• Update registry from toolhive-registry release v2025.12.11 by @​github-actions[bot] in #​2930
• Consolidate and fix VirtualMCP E2E tests by @​yrobla in #​2978
• Simplify the registry auto-detection by @​rdimitrov in #​2976
• Wire scopes through VirtualMCPServer to auth middleware by @​jhrozek in #​3005
• Enable MCPRemoteProxy discovery in MCPGroup and VirtualMCPServer by @​amirejaz in #​2970
• Add backend routing capture to vMCP audit logs by @​yrobla in #​2983
• Update registry from toolhive-registry release v2025.12.12 by @​github-actions[bot] in #​3010
• Update actions/cache action to v5 by @​renovate[bot] in #​3007
• Vmcp rbac mcpremoteproxies by @​amirejaz in #​3013

New Contributors

• @​deepika1214 made their first contribution in #​2875
• @​carlos-gn made their first contribution in #​2917
• @​slyt3 made their first contribution in #​2898

Full Changelog: stacklok/toolhive@v0.6.11...v0.6.12

v0.6.11

Compare Source

Headline changes:

• Include ping checks for remote workloads.
• Allow build envs to include secrets from the secrets manager and environment variables on the host.

What's Changed

• Add Debug Logs for thv run Server Location by @​jerm-dro in #​2834
• bumps toolhive operator and registry api images by @​ChrisJBurns in #​2842
• Update actions/checkout digest to 8e8c483 by @​renovate[bot] in #​2844
• Implement ExternalAuthConfig discovery for VirtualMCPServer backends by @​amirejaz in #​2726
• upgrade go to 1.25.5 to fix GO-2025-4155 by @​ChrisJBurns in #​2846
• Update registry from toolhive-registry release v2025.12.03 by @​github-actions[bot] in #​2862
• Update golangci/golangci-lint-action action to v9.2.0 by @​renovate[bot] in #​2861
• Split out podTemplateBuilder to be reusable and cover with integration tests by @​jhrozek in #​2840
• Fix VirtualMCPServer OIDC configuration by implementing OIDCConfigurable interface by @​jhrozek in #​2821
• Refactor vMCP e2e tests to extract common helpers by @​jhrozek in #​2839
• Update build-env proposal with secure credential handling by @​JAORMX in #​2859
• Use gopkg.in/yaml.v3 not v2 by @​JAORMX in #​2868
• Change pinging logic for remote workloads by @​dmjb in #​2872
• Add --from-secret and --from-env flags to set-build-env by @​JAORMX in #​2860
• Display custom metadata in registry info text output by @​JAORMX in #​2871
• Use ubuntu-slim runner for lightweight CI jobs by @​JAORMX in #​2869
• List workloads once to ensure consistency by @​amirejaz in #​2867

New Contributors

• @​jerm-dro made their first contribution in #​2834

Full Changelog: stacklok/toolhive@v0.6.10...v0.6.11

v0.6.10

Compare Source

What's Changed

• Update toolhive images to v0.6.9 and registry server to v0.3.1 by @​renovate[bot] in #​2737
• Update registry from toolhive-registry release v2025.11.29 by @​github-actions[bot] in #​2808
• Make client_secret_env optional in vMCP OIDC config by @​jhrozek in #​2803
• Remove tokenCache documentation and examples by @​jhrozek in #​2801
• Update registry from toolhive-registry release v2025.11.30 by @​github-actions[bot] in #​2810
• Update module github.com/olekukonko/tablewriter to v1.1.2 by @​renovate[bot] in #​2812
• Add vMCP image to operator-deploy-local task by @​jhrozek in #​2802
• Update registry from toolhive-registry release v2025.12.01 by @​github-actions[bot] in #​2814
• remove mixed mode to simplify vmcp operation by @​yrobla in #​2798
• Fix vMCP error on partially set operational config by @​jhrozek in #​2813
• fix lint problems on main by @​yrobla in #​2816
• fix: propagate identity for token exchange + add real integration tests by @​yrobla in #​2769
• add tests for validating conflict resolution by @​yrobla in #​2818
• Refactor/typed backend auth strategy by @​jhrozek in #​2797
• Centralize container image references in e2e tests by @​4t8dd in #​2819
• Make client_id optional in vMCP OIDC config by @​jhrozek in #​2822
• Add PVC source support for MCPRegistry by @​jonburdo in #​2719
• Add Output Schema Support to CompositeToolSpec CRD by @​tgrunnagle in #​2824
• Proposal: Kubernetes source type for registry server by @​JAORMX in #​2829
• adds kubernetes registry config for registry server by @​ChrisJBurns in #​2830
• Update registry.access.redhat.com/ubi10/ubi-minimal Docker tag to v10.1-1764604111 by @​renovate[bot] in #​2828
• Update anthropics/claude-code-action digest to 6337623 by @​renovate[bot] in #​2827
• Update registry from toolhive-registry release v2025.12.02 by @​github-actions[bot] in #​2833
• Add support for Zed client by @​eleftherias in #​2836
• Add vMCP e2e tests for tool overrides and composite workflows by @​JAORMX in #​2826
• add RBAC resources for MCPRegistry API server by @​ChrisJBurns in #​2832

New Contributors

• @​jonburdo made their first contribution in #​2719

Full Changelog: stacklok/toolhive@v0.6.9...v0.6.10

v0.6.9

Compare Source

🚀 Toolhive v0.6.9 is live!

This release brings enhancements to MCP workflows, better registry customization, and improved developer experience across the board.

MCP & Workflows
• Smart transport auto-detection makes thv mcp commands easier to use
• Standard JSON Schema format now used for composite tool parameters
• Added RetryDelay to error handling in WorkflowStep CRD for more resilient workflows
• Extracted MCP client setup into reusable CreateInitializedMCPClient helper
• E2E tests now use mcp.LATEST_PROTOCOL_VERSION for better compatibility
• Removed token cache from vMCP for cleaner authentication flow

Registry & Deployment
• Registry server can now be configured with custom database connection details
• New podTemplateSpec field in MCPRegistry CRD lets you fully customize registry API deployments
• MergePodTemplateSpecs utility added for cleaner pod template composition
• Updated registry from toolhive-registry release v2025.11.28

Tool Filtering & Configuration
• New ExcludeAll option provides more flexible tool filtering controls
• Better error handling throughout vMCP code (replaced utilruntime.Must with proper error checks)
• Minor fixes for retryDelay handling improve reliability

Testing & Quality
• Added vMCP E2E tests using yardstick MCP server
• Proposal naming validation now only checks new files, reducing false positives

Infrastructure
• Updated docker/metadata-action to v5.10.0

👋 Welcome to our newest contributors @​ignorant05 and @​4t8dd! 🥳

🔗 Full changelog: stacklok/toolhive@v0.6.8...v0.6.9

What's Changed

• Update docker/metadata-action action to v5.10.0 by @​renovate[bot] in #​2760
• adds MergePodTemplateSpecs that merges podTemplateSpecs by @​ChrisJBurns in #​2770
• Use standard JSON Schema format for VMCP composite tool parameters by @​JAORMX in #​2651
• Fix proposal naming validation to only check new files by @​JAORMX in #​2788
• Update registry from toolhive-registry release v2025.11.28 by @​github-actions[bot] in #​2791
• Replace utilruntime.Must with proper error handling in vMCP code by @​JAORMX in #​2787
• Add smart transport auto-detection for thv mcp commands by @​JAORMX in #​2790
• Add vmcp e2e tests using yardstick MCP server by @​JAORMX in #​2778
• Enhancement: Added ExcludeAll option for toll filtering by @​ignorant05 in #​2789
• Use mcp.LATEST_PROTOCOL_VERSION in E2E tests by @​jhrozek in #​2793
• Add RetryDelay to ErrorHandling in WorkflowStep CRD by @​JAORMX in #​2776
• adds podTemplateSpec field to MCPRegistry CRD that allows user to customise registry api deployment by @​ChrisJBurns in #​2777
• Extract MCP client setup to CreateInitializedMCPClient helper by @​jhrozek in #​2796
• Two minor fixes for vMCP retryDelay handling by @​jhrozek in #​2795
• Issue 2680 by @​4t8dd in #​2757
• fix: remove tokencache from vmcp by @​yrobla in #​2799
• adds ability to configure database details for registry server by @​ChrisJBurns in #​2800

New Contributors

• @​ignorant05 made their first contribution in #​2789
• @​4t8dd made their first contribution in #​2757

Full Changelog: stacklok/toolhive@v0.6.8...v0.6.9

v0.6.8

Compare Source

What's Changed

• Add OAuth authorization server fallback for registration endpoint discovery by @​amirejaz in #​2711
• Add schema test ensuring the correct version by @​rdimitrov in #​2738
• Update registry from toolhive-registry release v2025.11.26 by @​github-actions[bot] in #​2739
• Add build environment configuration and validation by @​JAORMX in #​2740
• Add header injection authentication support by @​yrobla in #​2730
• fix: follow up for removing not needed value on secrets by @​yrobla in #​2744
• Remove redundant best_effort failure mode from composer by @​jhrozek in #​2746
• adds multi-configmap data source for registry by @​ChrisJBurns in #​2745
• removes unused registry helper functions by @​ChrisJBurns in #​2748
• Add new diagram to README by @​danbarr in #​2743
• Remove NewUpstreamRegistryFromUpstreamServers by @​rdimitrov in #​2752
• Update module github.com/cedar-policy/cedar-go to v1.3.1 by @​renovate[bot] in #​2751
• Update golang.org/x/exp/jsonrpc2 digest to 87e1e73 by @​renovate[bot] in #​2735
• Add CLI commands and template integration for build environment by @​JAORMX in #​2742
• adds dedicated podtemplatespec builder for registry server deployment by @​ChrisJBurns in #​2754
• Update registry from toolhive-registry release v2025.11.27 by @​github-actions[bot] in #​2756
• Implement discovered mode for vMCP authentication by @​yrobla in #​2747
• Remove unimplemented pass_through auth strategy by @​jhrozek in #​2753
• fix: fail when discover of auth creds fail by @​yrobla in #​2758
• Remove local incoming auth type from operator CRDs by @​jhrozek in #​2759

Full Changelog: stacklok/toolhive@v0.6.7...v0.6.8

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 2 additional dependencies were updated

Details:

Package	Change
github.com/cedar-policy/cedar-go	v1.3.0 -> v1.3.1
golang.org/x/exp/jsonrpc2	v0.0.0-20251113190631-e25ba8c21ef6 -> v0.0.0-20251125195548-87e1e737ad39

[github-actions]

🔒 MCP Security Scan Results

⚠️ No MCP servers were scanned in this PR.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: go.sum

Command failed: go get -t ./...
go: module github.com/stacklok/toolhive@v0.6.13 requires go >= 1.25.5; switching to go1.25.5
go: downloading go1.25.5 (linux/amd64)
go: download go1.25.5: golang.org/toolchain@v0.0.1-go1.25.5.linux-amd64: verifying module: checksum database disabled by GOSUMDB=off