Update stacklok/toolhive to v0.58.0 by renovate[bot] · Pull Request #1278 · stacklok/docs-website

renovate · 2026-10-27T14:53:28Z

This PR contains the following updates:

Package	Update	Change
stacklok/toolhive	minor	`v0.57.0` → `v0.58.0`

After this PR opens, .github/workflows/upstream-release-docs.yml adds source-verified content edits for the new release. For stacklok/toolhive, the same workflow also syncs reference assets (CLI help, Swagger) and regenerates the CRD MDX pages.

Release Notes

stacklok/toolhive

`v0.58.0`

Compare Source

What's Changed

Add opt-in at+jwt typ for embedded AS access tokens by @jhrozek in #6942
Refuse refresh grants whose upstream credential is dead by @tgrunnagle in #6930
Stop serving delegate clients removed from config by @jhrozek in #6945
Fix authserver test build on main by @jhrozek in #6950
Rename embedded-auth ConfigMap ref helpers by @jhrozek in #6951
Skip upstream identity capture when sub_id is off by @jhrozek in #6956
Update k8s.io/utils digest to ca04ba5 by @renovate[bot] in #6933
Release v0.58.0 by @toolhive-release-app[bot] in #6957

Full Changelog: stacklok/toolhive@v0.57.0...v0.58.0

Configuration

📅 Schedule: (in timezone America/New_York)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Never, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

Docs update for `toolhive` v0.58.0

At a glance


Upstream	`stacklok/toolhive` `v0.57.0` → `v0.58.0`
Hand-written changes	2 commit(s)
Reference assets	refreshed (separate commit)
Gaps	0
Owner	@rdimitrov - identified from merged release PR stacklok/toolhive#6957
Release contributors	3 review requested (see sidebar)
Action required	Spot-check skill-authored prose for accuracy

Who does what

@rdimitrov cut this release and owns this PR: review your own changes, chase the remaining approvals, and merge once they're in. You don't need to wait on a review from anyone listed as having no docs impact below.

Everyone with a review request: the target is a review and approval within 2 business days.

Summary of changes

Updated the automatic token refresh section in docs/toolhive/concepts/embedded-auth-server.mdx to describe the upstream refresh guard: a refresh grant whose upstream credential can't be used anymore now returns HTTP 400 invalid_grant (Refuse refresh grants whose upstream credential is dead toolhive#6930)
Updated docs/toolhive/guides-vmcp/embedded-auth-server-vmcp.mdx to explain that removing a delegateClients entry revokes the client, how Redis records and rolling updates behave (Stop serving delegate clients removed from config toolhive#6945)
Updated the private_key_jwt client assertion audience in docs/toolhive/guides-vmcp/delegate-agent-identity.mdx: the issuer is now the recommended aud, and the token endpoint URL is noted as deprecated (Stop serving delegate clients removed from config toolhive#6945, carrying Accept issuer as client assertion audience toolhive#6946)
Skipped the opt-in at+jwt access token typ (Add opt-in at+jwt typ for embedded AS access tokens toolhive#6942), the Config.DisableUpstreamRefreshGuard opt-out (Refuse refresh grants whose upstream credential is dead toolhive#6930), and the sub_id identity capture change (Skip upstream identity capture when sub_id is off toolhive#6956). All three are Go embedder settings only, with no RunConfig, CLI, or CRD field, so thv, vMCP, and operator users can't set them
Reviewer check: the Redis key in the delegate revocation paragraph uses <KEY_PREFIX>client:<CLIENT_ID>, based on the {prefix}client:{client_id} layout in the upstream docs/redis-storage.md

Run cost

Session	Turns	Cost (USD)
Generation	38	$1.2910
Editorial review	26	$0.6824
Total	64	$1.9734

How this PR was built

Two Claude Opus sessions run per release: a generation pass
(upstream-release-docs skill, 6 phases) followed by a fresh-
context editorial pass (docs-review). Prettier/ESLint
auto-fixes are applied after.

Auto-synced paths — do not hand-edit these in review:

static/api-specs/
docs/toolhive/reference/cli/ (toolhive only)
docs/toolhive/reference/crds/

If a "Gaps needing human context" section is present above,
each entry includes a paste-ready Helper prompt for local
Claude a reviewer can use to resolve the gap.

Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

vercel · 2026-10-27T14:53:33Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs-website	Ready	Preview	Oct 27, 2026 3:02pm UTC

claude · 2026-10-27T14:54:56Z

Claude finished @renovate[bot]'s task in 2m 42s —— View job

Upstream release docs: stacklok/toolhive v0.58.0

What changed

I pushed 10c36c5 with three edits, each checked against the source at v0.58.0:

Refresh guard (Refuse refresh grants whose upstream credential is dead toolhive#6930), concepts/embedded-auth-server.mdx: the guard is on whenever an upstream provider is configured. When the upstream credential can't be used anymore, a refresh grant now gets HTTP 400 invalid_grant. When the result is uncertain (network error, 5xx or 429 from the provider, or a check that runs past 10 seconds), the server still issues the tokens.
Removing delegate clients (Stop serving delegate clients removed from config toolhive#6945), guides-vmcp/embedded-auth-server-vmcp.mdx: removing a delegateClients entry now revokes that client. The client gets invalid_client, but access tokens it already holds stay valid until they expire. The client's Redis record isn't deleted. During a rolling update, replicas still on the old config refuse a newly added delegate client until they restart.
private_key_jwt assertion audience (Accept issuer as client assertion audience toolhive#6946, merged through Stop serving delegate clients removed from config toolhive#6945), guides-vmcp/delegate-agent-identity.mdx: aud should now be the issuer. The token endpoint URL still works but is noted as deprecated.

Not documented

These three changes only affect Go code that embeds the auth server. None of them has a RunConfig, CLI, or CRD field, so thv, vMCP, and operator users can't set them:

The opt-in at+jwt access token type (Add opt-in at+jwt typ for embedded AS access tokens toolhive#6942)
The DisableUpstreamRefreshGuard opt-out (Refuse refresh grants whose upstream credential is dead toolhive#6930)
The sub_id identity capture change (Skip upstream identity capture when sub_id is off toolhive#6956)

Notes

I didn't run npm run build; CI will cover it. The edits don't add any links.
In REVIEWERS.json, @jhrozek and @tgrunnagle are both marked as docs-facing.

Describe the upstream refresh guard, delegate client revocation on removal from config, and the issuer as client assertion audience. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

claude · 2026-10-27T14:57:54Z

Claude finished @renovate[bot]'s task in 1m 51s —— View job

Editorial review of v0.58.0 content

Identify files changed by previous commit
Run /docs-review
Apply fixes, format, lint
Commit and push

Summary

The three pages edited for v0.58.0 are accurate and in the right places. I made a few wording fixes and pushed them in 336cad3. I added no new claims.

Checked against upstream:

Refresh check: the timeout is 10 seconds, and when the outcome is uncertain, ToolHive still issues the tokens (pkg/authserver/refresh_grant_guard.go).
Assertion aud: ToolHive accepts either the issuer or the token endpoint URL, and both forms other than the issuer alone are deprecated (private_key_jwt_client_auth.go, docs/arch/17-token-exchange-delegation.md).
Redis key: the client key format is <prefix>client:<id> (storage/redis_keys.go).

Edits

File	Change
`concepts/embedded-auth-server.mdx`	"applies the same check" now reads "also checks the upstream credential", because the paragraph before it describes a refresh, not a check. "refreshes any expired one" now reads "refreshes any that have expired". "issues the refreshed tokens" now reads "issues the new tokens".
`guides-vmcp/delegate-agent-identity.mdx`	Split the long sentence with a semicolon about the deprecated `aud` forms into two sentences.
`guides-vmcp/embedded-auth-server-vmcp.mdx`	"answers any other stored delegate client" now reads "answers requests from any other delegate client in storage". In the rolling-update sentence, "until they restart" now reads "until they're replaced".

I ran npm run prettier:fix (it reflowed one file) and npm run eslint:fix (no errors). I didn't touch the generated Helm reference pages.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Update stacklok/toolhive to v0.58.0

f53dff9

Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

renovate Bot added the autogen-docs Pull requests generated by automated release workflows label Oct 27, 2026

github-actions Bot marked this pull request as draft October 27, 2026 14:53

Refresh reference assets for toolhive v0.58.0

1bf1e9f

vercel Bot deployed to Preview October 27, 2026 14:57

View deployment

Document auth server changes for toolhive v0.58.0

10c36c5

Describe the upstream refresh guard, delegate client revocation on removal from config, and the issuer as client assertion audience. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

vercel Bot deployed to Preview October 27, 2026 14:59

View deployment

Polish v0.58.0 auth server wording

336cad3

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

github-actions Bot assigned rdimitrov Oct 27, 2026

github-actions Bot requested review from jhrozek, rdimitrov and tgrunnagle October 27, 2026 15:00

github-actions Bot marked this pull request as ready for review October 27, 2026 15:00

vercel Bot deployed to Preview October 27, 2026 15:02

View deployment

rdimitrov approved these changes Oct 27, 2026

View reviewed changes

tgrunnagle approved these changes Oct 27, 2026

View reviewed changes

jhrozek approved these changes Oct 27, 2026

View reviewed changes

rdimitrov merged commit de50cc5 into main Oct 27, 2026
10 checks passed

rdimitrov deleted the renovate/stacklok-toolhive-0.x branch October 27, 2026 15:53

Navigation Menu

Repository navigation

Update stacklok/toolhive to v0.58.0 - #1278

Update stacklok/toolhive to v0.58.0#1278
rdimitrov merged 4 commits into
mainfrom
renovate/stacklok-toolhive-0.x

renovate Bot commented Oct 27, 2026 •

edited by github-actions Bot

Loading

Uh oh!

vercel Bot commented Oct 27, 2026 •

edited

Loading

Uh oh!

claude Bot commented Oct 27, 2026 •

edited

Loading

Uh oh!

claude Bot commented Oct 27, 2026 •

edited

Loading

Uh oh!

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

renovate Bot commented Oct 27, 2026 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v0.58.0

What's Changed

Configuration

Docs update for toolhive v0.58.0

At a glance

Who does what

Summary of changes

Run cost

Uh oh!

vercel Bot commented Oct 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

claude Bot commented Oct 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Upstream release docs: stacklok/toolhive v0.58.0

What changed

Not documented

Notes

Uh oh!

claude Bot commented Oct 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Editorial review of v0.58.0 content

Summary

Edits

Uh oh!

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

renovate Bot commented Oct 27, 2026 •

edited by github-actions Bot

Loading

`v0.58.0`

Docs update for `toolhive` v0.58.0

vercel Bot commented Oct 27, 2026 •

edited

Loading

claude Bot commented Oct 27, 2026 •

edited

Loading

claude Bot commented Oct 27, 2026 •

edited

Loading