[toolhive-release-app]

Release v0.55.2

Version Bump

patch release

Files Updated

• VERSION
• deploy/charts/operator-crds/Chart.yaml (path: version)
• deploy/charts/operator-crds/Chart.yaml (path: appVersion)
• deploy/charts/operator/Chart.yaml (path: version)
• deploy/charts/operator/Chart.yaml (path: appVersion)
• deploy/charts/operator/values.yaml (path: operator.image)
• deploy/charts/operator/values.yaml (path: operator.toolhiveRunnerImage)
• deploy/charts/operator/values.yaml (path: operator.vmcpImage)
• Helm chart docs (via helm-docs)

Next Steps

1. Review this PR
2. Merge to main
3. Release automation will handle the rest

Checklist

• Version bump is correct
• All CI checks pass

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 79.76%. Comparing base (47e10f3) to head (9f6dd61).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #6871      +/-   ##
==========================================
- Coverage   79.77%   79.76%   -0.01%     
==========================================
  Files         820      820              
  Lines       83723    83723              
==========================================
- Hits        66788    66784       -4     
- Misses      16930    16934       +4     
  Partials        5        5              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[github-actions]

📝 Generated release notes for v0.55.2

Auto-generated by the release-notes skill. Review and, if good, apply with:

gh release edit v0.55.2 --notes-file <paste-below>.md

Click to expand release notes

🚀 Toolhive v0.55.2 is live!

This patch release closes a gap in network isolation on Podman: isolated workloads could reach host services through Podman's host aliases. It also removes the Homebrew deprecation warning for the thv cask.

⚠️ Breaking Changes

• Podman: isolated workloads can no longer reach host addresses by default — With --isolate-network on Podman, the egress proxy now blocks host.containers.internal and every other Podman host address. If ToolHive can't read Podman's host mappings, the workload won't start. Pass --allow-docker-gateway if your MCP server needs to reach services on the host. (migration guide)

Migration guide: Podman host addresses are now blocked under network isolation

Who is affected: Podman users who run MCP servers with --isolate-network. Workloads without network isolation are not affected. On Docker nothing changes functionally, except that host.containers.internal is now on the hostname deny list too.

This is a security fix. Podman can map its host aliases (such as host.containers.internal) to addresses that aren't bridge gateways. The old deny rules only covered bridge gateways, so an isolated workload could reach host services without permission. Before it starts the proxy and the workload, ToolHive now reads the host mappings from the running DNS sidecar's /etc/hosts. Squid and Envoy then block those addresses along with every bridge gateway.

There are two consequences:

1. Traffic from an isolated Podman workload to host.containers.internal, or to any other discovered Podman host address, is now blocked unless you pass --allow-docker-gateway.
2. Discovery fails closed. If ToolHive can't read the hosts file, finds a malformed entry, or finds no host.containers.internal entry, the workload does not start. You'll see an error like:
   failed to discover Podman host addresses: hosts missing host.containers.internal; check Podman hosts configuration
   A missing host.docker.internal entry is fine, because older Podman releases only write host.containers.internal. --allow-docker-gateway does not get around a discovery failure.

Before

# On Podman, the workload could reach host services through host.containers.internal
thv run --isolate-network my-server

After

# Allow host access explicitly (port-independent: the host is reachable on any port)
thv run --isolate-network --allow-docker-gateway my-server

Migration steps

1. Find any isolated Podman workloads whose MCP servers call services on the host, for example a local database or API reached through host.containers.internal.
2. Redeploy those workloads with --allow-docker-gateway. This opens all host addresses on any port and ignores the permission profile's allowed ports, so use it only where you need it.
3. If a workload won't start because of a Podman host discovery error, fix the Podman configuration so the container's hosts file has a host.containers.internal entry.
4. Host addresses are captured when a workload is deployed. Redeploy after you change the runtime network.

Commit: b5246d8 (security fix merged from a private fork)

🐛 Bug Fixes

• With --isolate-network, Squid and Envoy now block Podman host-alias addresses along with all bridge gateways, which closes a path from isolated workloads to host services. The --allow-docker-gateway help text now covers Podman host addresses, including host.containers.internal. (b5246d8)
• Homebrew no longer prints Calling `postflight` is deprecated! when it loads the thv cask. The cask now uses postflight_steps to clear the macOS quarantine flag, so it needs Homebrew 5.1.14 or newer; run brew update if the cask fails to load. (#6870)

📦 Dependencies

Module	Version
github.com/stacklok/toolhive-core	v0.0.57
github.com/stacklok/toolhive-core/redisconn	v0.0.57

Full commit log

What's Changed

• Use postflight_steps for the thv Homebrew cask hook by @rdimitrov in Use postflight_steps for the thv Homebrew cask hook #6870
• Update go modules to v0.0.57 by @renovate[bot] in Update go modules to v0.0.57 #6869
• Release v0.55.2 by @toolhive-release-app[bot] in Release v0.55.2 #6871

Full Changelog: v0.55.1...v0.55.2

🔗 Full changelog: v0.55.1...v0.55.2