Skip to content

Update stacklok/toolhive to v0.27.2#867

Merged
danbarr merged 5 commits into
mainfrom
renovate/stacklok-toolhive-0.x
May 13, 2026
Merged

Update stacklok/toolhive to v0.27.2#867
danbarr merged 5 commits into
mainfrom
renovate/stacklok-toolhive-0.x

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate Bot commented May 12, 2026 •
edited by github-actions Bot
Loading

This PR contains the following updates:

Package Update Change
stacklok/toolhive patch v0.27.1 → v0.27.2

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

After this PR opens, .github/workflows/upstream-release-docs.yml adds source-verified content edits for the new release. For stacklok/toolhive, the same workflow also syncs reference assets (CLI help, Swagger) and regenerates the CRD MDX pages.

Release Notes

stacklok/toolhive (stacklok/toolhive)

v0.27.2

Compare Source

What's Changed

Full Changelog: stacklok/toolhive@v0.27.1...v0.27.2

Configuration

📅 Schedule: (in timezone America/New_York)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Never, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

Docs update for toolhive v0.27.2

At a glance
Upstream stacklok/toolhive v0.27.1 → v0.27.2
Hand-written changes 2 commit(s)
Reference assets refreshed (separate commit)
Gaps 0
Release contributors 10 auto-assigned (see sidebar)
Action required Spot-check skill-authored prose for accuracy

Summary of changes

Summary of changes

  • Added a Baseline scopes for DCR clients section to docs/toolhive/concepts/embedded-auth-server.mdx explaining the new baselineClientScopes field, including the invalid_scope failure mode it addresses and security guidance to keep the baseline narrow.
  • Updated the embedded auth server configuration reference table in docs/toolhive/guides-k8s/auth-k8s.mdx to document the new baselineClientScopes field on MCPExternalAuthConfig.spec.embeddedAuthServer.
  • Added a baselineClientScopes example and cross-link in docs/toolhive/guides-vmcp/authentication.mdx to cover the matching field on VirtualMCPServer.spec.authServerConfig.

Other v0.27.2 PRs were bug fixes, refactors, or operator-side robustness changes with no documented behavior to update. The CRD JSON schema deltas for the new field were auto-synced into static/api-specs/crds/ by the release workflow and surface through <CRDReference /> on the existing CRD reference pages.

Run cost

Session Turns Cost (USD)
Generation 79 $5.7729
Editorial review 48 $3.0189
Total 127 $8.7918
How this PR was built

Two Claude Opus sessions run per release: a generation pass
(upstream-release-docs skill, 6 phases) followed by a fresh-
context editorial pass (docs-review). Prettier/ESLint
auto-fixes are applied after.

Auto-synced paths — do not hand-edit these in review:

  • docs/toolhive/reference/cli/
  • docs/toolhive/reference/crds/
  • static/api-specs/

If a "Gaps needing human context" section is present above,
each entry includes a paste-ready Helper prompt for local
Claude a reviewer can use to resolve the gap.

@renovate
Update stacklok/toolhive to v0.27.2
c171347 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
@renovate renovate Bot added the autogen-docs Pull requests generated by automated release workflows label May 12, 2026
@vercel
Copy link
Copy Markdown

vercel Bot commented May 12, 2026 •
edited
Loading

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
docs-website Ready Ready Preview, Comment May 12, 2026 7:07pm

Request Review

@github-actions github-actions Bot marked this pull request as draft May 12, 2026 14:33
@claude
Copy link
Copy Markdown
Contributor

claude Bot commented May 12, 2026 •
edited
Loading

Claude finished @renovate[bot]'s task in 6m 14s —— View job

Updated docs for toolhive v0.27.2

Pushed 6f878b6 to the PR branch.

  • Phase 1: Discover and categorize changes
  • Phase 2: Deep-dive into doc-relevant PRs
  • Phase 3: Audit existing docs for embedded auth/DCR references
  • Phase 4: Document baselineClientScopes (3 files)
  • Phase 5: Validate edits (prettier, eslint clean)
  • Phase 6: Wrote SUMMARY.md and committed

What changed

The only user-facing addition in v0.27.2 is the new baselineClientScopes field on the embedded authorization server (PR stacklok/toolhive#5233). It surfaces on:

  • MCPExternalAuthConfig.spec.embeddedAuthServer.baselineClientScopes
  • VirtualMCPServer.spec.authServerConfig.baselineClientScopes

The operator unions these scopes into every DCR-registered client's scope set so clients that narrow scope at /oauth/register (notably Claude Code) can still request the baseline at /oauth/authorize. Verified the runtime union behavior at pkg/authserver/server/handlers/dcr.go at v0.27.2.

Hand-written edits

File Change
docs/toolhive/concepts/embedded-auth-server.mdx Added a Baseline scopes for DCR clients subsection under Key characteristics with security guidance.
docs/toolhive/guides-k8s/auth-k8s.mdx Added a baselineClientScopes row to the MCPExternalAuthConfig configuration-reference table.
docs/toolhive/guides-vmcp/authentication.mdx Added a baselineClientScopes snippet and concept cross-link inside Configure the embedded auth server.

The CRD JSON-schema deltas already in this PR (mcpexternalauthconfigs.schema.json, virtualmcpservers.schema.json) auto-flow into the generated CRD reference pages via the <CRDReference /> component, so no hand edits to docs/toolhive/reference/crds/ were needed.

All other v0.27.2 PRs were bug fixes, refactors, or operator-side robustness changes with no documented behavior to update (header forwarding bug fix is invisible to users; corev1.PullPolicy swap is type-only; Helm helper rename is internal; spec-violating list tolerance, mcp-go auth sentinels, OTEL via API, Docker socket fallback, legacy registry 502, and tokenexchange refactors all leave external surfaces unchanged).

Validation

  • npm run prettier:fix — clean.
  • npm run eslint — clean.
  • npm run build — failed on the mcp-metadata-plugin external-data fetch (sandbox network restriction). PR CI will run the full build.
  • Branch

@claude
Copy link
Copy Markdown
Contributor

claude Bot commented May 12, 2026 •
edited
Loading

Claude finished @renovate[bot]'s task in 4m 53s —— View job

Editorial review of v0.27.2 docs changes

Pushed b3ca6cc — editorial polish on top of 6f878b6.

  • Identify files changed in the previous commit (docs/toolhive/concepts/embedded-auth-server.mdx, docs/toolhive/guides-k8s/auth-k8s.mdx, docs/toolhive/guides-vmcp/authentication.mdx)
  • Verify technical claims against upstream pkg/authserver/server/handlers/dcr.go at v0.27.2
  • Apply /docs-review skill
  • Apply editorial fixes
  • Validate (prettier, eslint clean)
  • Commit and push

Editorial findings and fixes

Primary: heading hierarchy

The new "Baseline scopes for DCR clients" content sat as an h3 inside ## Key characteristics on the concept page. That parent section is otherwise a flat bullet list of one-line traits, so a multi-paragraph h3 with security guidance underneath it created an awkward depth mismatch — readers scanning the TOC would expect the h3 to be a sub-aspect of "Key characteristics" rather than a standalone topic with its own configuration knob.

Fix: Promoted to a top-level ## Baseline scopes for DCR clients, sitting between Key characteristics and Session storage. The anchor slug (#baseline-scopes-for-dcr-clients) is unchanged, so existing cross-links from auth-k8s.mdx and authentication.mdx still resolve.

Secondary: verb choice

The original text used "unions"/"unioned" as a verb in all three files ("The server unions these scopes into…", "scopes that are unioned into…", "the embedded auth server unions those scopes into…"). "Union" as a verb is set-theory jargon that reads as awkward English even though it's precise.

Fix: Replaced with "merges"/"merged" throughout — preserves the union semantics and reads more naturally.

Secondary: prose tightening

  • "register via DCR with a narrowed scope value, then later request a wider set of scopes" → "then request a wider set of scopes" (dropped redundant "later").
  • "To work around this, configure…" → "To support this pattern, configure…" — the operator opts in to enable a client pattern, not to bypass a defect.
  • vMCP page: "merges those scopes into every registered client" → "merges those scopes into every registered client's scope set" (consistent object across all three files; previously dropped the trailing noun phrase).

Reviewed but not changed

  • Source-truth verification: Read pkg/authserver/server/handlers/dcr.go in the local upstream clone at v0.27.2. The documented behavior matches: ValidateScopes runs first, then if BaselineClientScopes is configured, unionScopes(scopes, baseline) becomes the effective scope set stored on the client. The startup-time guarantee that the baseline is a subset of ScopesSupported is described in the source comments at dcr.go:71-75 and matches the doc claim that "the auth server fails to start if any value is missing."
  • The cross-page link pattern (concept page is the canonical source; k8s and vMCP pages link to it) is correct.
  • The example clients named ("Claude Code, Cursor, and VS Code" on the concept page; "a pattern used by Claude Code, among others" on the vMCP page) are slightly different in specificity but consistent in intent — left as-is to avoid introducing new claims.
  • The CRD schema deltas (mcpexternalauthconfigs.schema.json, virtualmcpservers.schema.json) auto-flow into the generated CRD reference pages and are out of scope per the workflow handoff.

Validation

  • npm run prettier:fix — clean; touched only the table column widths in auth-k8s.mdx.
  • npm run eslint — clean.

Branch ·

@github-actions github-actions Bot requested review from samuv and tgrunnagle May 12, 2026 14:45
@github-actions github-actions Bot marked this pull request as ready for review May 12, 2026 14:46
peppescg
peppescg previously approved these changes May 12, 2026
View reviewed changes
@ChrisJBurns ChrisJBurns removed their request for review May 12, 2026 16:04
@jhrozek
Fix baselineClientScopes validation description
1e05d0a 
Clarify that when scopesSupported is omitted, the embedded auth server
validates baselineClientScopes against its default scope set
(openid, profile, email, offline_access) rather than failing to start.

This behavior shipped in toolhive v0.27.2 as part of #5233.
jhrozek
jhrozek approved these changes May 12, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

@jhrozek jhrozek left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not sure if this lets me approve but LGTM after my latest commit

@danbarr
Copy link
Copy Markdown
Collaborator

danbarr commented May 13, 2026

Merging as it appears the only generated prose was around the DCR scopes which @jhrozek already touched up. If any of the other reviewers landed changes that weren't captured by the workflow, please file as follow-up PRs.

@danbarr danbarr merged commit 01ade9d into main May 13, 2026
6 checks passed
@danbarr danbarr deleted the renovate/stacklok-toolhive-0.x branch May 13, 2026 14:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jhrozek jhrozek jhrozek approved these changes

@samuv samuv samuv approved these changes

@rdimitrov rdimitrov rdimitrov approved these changes

@peppescg peppescg peppescg left review comments

@lorr1 lorr1 Awaiting requested review from lorr1

@reyortiz3 reyortiz3 Awaiting requested review from reyortiz3

@tgrunnagle tgrunnagle Awaiting requested review from tgrunnagle

Assignees

No one assigned

Labels

autogen-docs Pull requests generated by automated release workflows

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@danbarr @jhrozek @samuv @peppescg @rdimitrov