Skip to content

Update stacklok/toolhive to v0.48.0 - #1147

Merged
JAORMX merged 3 commits into
mainfrom
renovate/stacklok-toolhive-0.x
Sep 11, 2026
Merged

Update stacklok/toolhive to v0.48.0#1147
JAORMX merged 3 commits into
mainfrom
renovate/stacklok-toolhive-0.x

Conversation

@renovate

@renovate renovate Bot commented Sep 11, 2026 •
edited by github-actions Bot
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Update Change
stacklok/toolhive minor v0.47.1 → v0.48.0

After this PR opens, .github/workflows/upstream-release-docs.yml adds source-verified content edits for the new release. For stacklok/toolhive, the same workflow also syncs reference assets (CLI help, Swagger) and regenerates the CRD MDX pages.

Release Notes

stacklok/toolhive (stacklok/toolhive)

v0.48.0

Compare Source

What's Changed

Full Changelog: stacklok/toolhive@v0.47.1...v0.48.0

Configuration

📅 Schedule: (in timezone America/New_York)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Never, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

Docs update for toolhive v0.48.0

At a glance
Upstream stacklok/toolhive v0.47.1 → v0.48.0
Hand-written changes 1 commit(s)
Reference assets refreshed (separate commit)
Gaps 0
Owner @JAORMX - identified from merged release PR stacklok/toolhive#6631
Release contributors 4 review requested (see sidebar) · 5 not requested (no docs impact)
Action required Spot-check skill-authored prose for accuracy

Who does what

@JAORMX cut this release and owns this PR: review your own changes, chase the remaining approvals, and merge once they're in. You don't need to wait on a review from anyone listed as having no docs impact below.

Everyone with a review request: the target is a review and approval within 2 business days.

Summary of changes

  • Updated guides-k8s/embedded-auth-server-k8s.mdx to cover OIDC dcrConfig alongside OAuth2 (new #### DCR with an OIDC upstream subsection, revised intro bullet, split OAuth2 example under #### DCR with an OAuth 2.0 upstream)
  • Updated guides-vmcp/embedded-auth-server-vmcp.mdx "Register ToolHive with an OAuth provider" section to cover OIDC dcrConfig
  • Added ### Select the token endpoint auth method on both guides-k8s/embedded-auth-server-k8s.mdx and guides-vmcp/embedded-auth-server-vmcp.mdx, with a :::info[Changed in v0.48.0] admonition for the OAuth2 upstream default flip from client_secret_post to client_secret_basic
  • Added ### Adjust the proxy read timeout in guides-cli/configure-mcp-servers.mdx for the new --proxy-read-timeout flag
  • Updated the --key bullet in guides-cli/skills-management.mdx to note thv skill push --key now requires the locally discovered ToolHive server (returns 403 through TOOLHIVE_API_URL or a manual client)
  • Deferred: no hand-written Kubernetes prose for MCPServer.spec.proxyReadTimeout; the CRD reference now carries the field, and the k8s guides have no existing proxy-tuning section to graft it onto

No docs impact identified

5 contributor(s) had no-docs-impact commits in this release. No review was requested, and the workflow did not auto-notify them.

Review routing

GitHub could not request the upstream contributor directly, so review went to the human merger of each relevant upstream PR:

Run cost

Session Turns Cost (USD)
Generation 75 $9.4414
Editorial review 49 $4.6348
Total 124 $14.0762
How this PR was built

Two Claude Opus sessions run per release: a generation pass
(upstream-release-docs skill, 6 phases) followed by a fresh-
context editorial pass (docs-review). Prettier/ESLint
auto-fixes are applied after.

Auto-synced paths — do not hand-edit these in review:

  • static/api-specs/
  • docs/toolhive/reference/cli/ (toolhive only)
  • docs/toolhive/reference/crds/

If a "Gaps needing human context" section is present above,
each entry includes a paste-ready Helper prompt for local
Claude a reviewer can use to resolve the gap.

@renovate
Update stacklok/toolhive to v0.48.0
5b6549b 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
@renovate renovate Bot added the autogen-docs Pull requests generated by automated release workflows label Sep 11, 2026
@vercel

vercel Bot commented Sep 11, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
docs-website Ready Ready Preview Sep 11, 2026 9:56am UTC

Request Review

@github-actions
github-actions Bot marked this pull request as draft September 11, 2026 09:38
@claude

claude Bot commented Sep 11, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Claude finished @renovate[bot]'s task in 10m 17s —— View job

ToolHive v0.48.0 release documentation

  • Phase 1: Discover changes and categorize
  • Phase 2: Deep dive on each PR, verify against source
  • Phase 3: Audit existing docs, build impact map
  • Phase 4: Implement changes
  • Phase 5: Build clean; lint clean; docs-review in flight
  • Phase 6: Wrote SUMMARY.md and REVIEWERS.json handoff artifacts

Files changed (hand-written prose)

  • docs/toolhive/guides-k8s/embedded-auth-server-k8s.mdx
  • docs/toolhive/guides-vmcp/embedded-auth-server-vmcp.mdx
  • docs/toolhive/guides-cli/configure-mcp-servers.mdx
  • docs/toolhive/guides-cli/skills-management.mdx

Auto-generated reference (CLI .md, CRD *.schema.json, Swagger YAML) refreshed by the sync workflow.

Waiting on docs-review; commit will follow.
• Branch: renovate/stacklok-toolhive-0.x

@claude

claude Bot commented Sep 11, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Claude finished @renovate[bot]'s task in 5m 22s —— View job

Docs review for toolhive v0.48.0 upstream release

Editorial pass done. Findings and fixes below; all edits pushed as 05bbcc2.

  • Identify files in scope for editorial review
  • Read each edited page in full context
  • Cross-check factual claims against upstream (/tmp/tmp.DQ9OEaJY3U/upstream)
  • Apply /docs-review fixes
  • Run prettier:fix and eslint:fix
  • Commit and push edits

Findings addressed

  1. Contradiction in dcrConfig guidance (k8s) — embedded-auth-server-k8s.mdx
    The new "DCR with an OIDC upstream" subsection tells readers an empty dcrConfig: {} is valid, but the trailing note said "Set exactly one of discoveryUrl or registrationEndpoint". Changed to "at most one", matching the vMCP guide and the new OIDC case.

  2. Duplicated "Don't set clientId" note (k8s) — The same one-liner appeared under both the OIDC and OAuth 2.0 DCR subsections. Kept the OIDC copy (the introductory case), removed the trailing duplicate.

  3. Prose polish, Adjust the proxy read timeout (CLI) — configure-mcp-servers.mdx
    Fixed the "Accepts any Go duration string…" sentence fragment, rephrased the "does not affect long-lived SSE responses" negation positively, and dropped hedging ("workloads that legitimately upload large payloads" → "workloads that upload large payloads").

  4. --key note wording (CLI) — skills-management.mdx
    Changed "drop --key for keyless signing" to "omit --key" (register-neutral phrasing).

Verified accurate

  • --proxy-read-timeout behavior (default 30s, 0 uses the default, Go duration string) matches docs/toolhive/reference/cli/thv_run.md.
  • The --key / local-server / 403 claim matches the upstream API description in pkg/authserver/… and the swagger definition.
  • The client_secret_basic default and the pre-registered-vs-DCR behavior match pkg/authserver/upstream/oauth2.go (lines 150-159, 476-479).
  • The empty dcrConfig: {} for OIDC upstreams is confirmed by pkg/authserver/runner/dcr_adapter.go:80-82 (auto-derives discoveryURL from IssuerURL + /.well-known/openid-configuration).

Not touched

  • docs/toolhive/reference/cli/*.md (auto-generated CLI reference)
  • static/api-specs/** (auto-generated API/CRD specs)
  • Existing prose that was clear and factually correct
    · Branch

@github-actions
Polish v0.48.0 upstream release doc edits
05bbcc2 
- Fix contradiction in DCR guidance: "at most one" instead of
  "exactly one", matching the OIDC case where empty dcrConfig is valid
- Remove duplicated "Don't set clientId" note in the OAuth 2.0
  DCR subsection (already covered in the OIDC subsection above)
- Polish proxy read timeout prose: fix sentence fragment, rephrase
  the "does not affect SSE" negation positively, drop hedging
- Change "drop --key" to "omit --key" in the skill push signing note
@github-actions
github-actions Bot marked this pull request as ready for review September 11, 2026 09:56
@JAORMX
JAORMX merged commit 4d61f16 into main Sep 11, 2026
4 checks passed
@JAORMX
JAORMX deleted the renovate/stacklok-toolhive-0.x branch September 11, 2026 10:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@JAORMX JAORMX JAORMX approved these changes
@samuv samuv samuv approved these changes
@ChrisJBurns ChrisJBurns Awaiting requested review from ChrisJBurns
@jhrozek jhrozek Awaiting requested review from jhrozek

Assignees

@JAORMX JAORMX

Labels

autogen-docs Pull requests generated by automated release workflows

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@JAORMX @samuv