v0.68.0 (from v0.67.0)

What changed

minor release — Adds backward-compatible capabilities including identity group-claim warnings, directory-group login claims, session revocation propagation, and improved MCP Store behavior.

Commits

• 722ecab Merge pull request #1130 from NeuralTrust/develop
• 158ac5e update agentgateway image tag to 1a5ba9f in k8s/overlays/dev
• 1a5ba9f Merge pull request #1154 from NeuralTrust/cursor/empty-app-mcp-surface-develop-d3fa
• f6dac09 update agentgateway image tag to 5fd863c in k8s/overlays/dev
• 26f4674 update agentgateway image tag to 21d3705 in k8s/overlays/dev
• e1c90a1 Return an empty tool list when an application has no registries.
• 5fd863c Merge pull request #1151 from NeuralTrust/cursor/store-install-tool-errors-d8b2
• e27374a Merge pull request #1150 from NeuralTrust/cursor/omit-unfilled-instance-choice-89ed
• 21d3705 Merge pull request #1153 from NeuralTrust/cursor/eng-2471-consent-instance-b0a6
• 39ae2dd ci: retrigger (unrelated bedrockguardrail timing flake)
• 7d549a0 Let a shared-account connect open a disabled instance.
• 03905c6 Pin Store consent tickets to the shelf, not the install row.
• e0a970e Pin Store needs-connect tickets to the called instance.
• e370c41 Return a fixed message for a bad upstream URL.
• 9aa096e Report unknown Store tools as invalid params.
• f50ac6f Limit the discover error URL to scheme, host and path.
• 1194ec6 Avoid echoing the upstream URL in the connect error body.
• e302a28 Answer missing upstream OAuth metadata with a JSON 502.
• 0449ae9 Return Store install config and instance-id failures as tool errors.
• d977799 Skip unfilled admin instances when choosing a store install.
• 30e54ff update agentgateway image tag to 2008156 in k8s/overlays/dev
• 2008156 Merge pull request #1149 from NeuralTrust/cursor/shopify-admin-setup-placeholder-0b87
• e74577d Report admin setup when a registry URL placeholder is still unfilled.
• f911398 update agentgateway image tag to 2a4fe7b in k8s/overlays/dev
• 2a4fe7b Merge pull request #1145 from NeuralTrust/cursor/session-revocation-lkg-c7fd
• cb5faed update agentgateway image tag to 309ae34 in k8s/overlays/dev
• 309ae34 Merge pull request #1144 from NeuralTrust/cursor/recorded-session-revocation-4b15
• ed2a20f update agentgateway image tag to 139ecf2 in k8s/overlays/dev
• 139ecf2 Merge pull request #1143 from NeuralTrust/cursor/revocation-before-code-take-7eba
• 4361260 fix(configsnapshot): skip revocation seed when a persisted row is rejected
• 0f4f500 fix(configsnapshot): keep restored session revocations when listing fails
• a9c3da6 Merge branch 'develop' into cursor/revocation-before-code-take-7eba
• aa48e8d Report recorded:true after a durable session revocation
• bcfa9cb fix(oauth): read the revocation marker before consuming an auth code
• df39f68 update agentgateway image tag to 485599b in k8s/overlays/dev
• 485599b Merge pull request #1142 from NeuralTrust/cursor/hybrid-session-revocation-4b15
• 046efed Publish default-IdP session revocations to data planes
• 779b83a update agentgateway image tag to 2ff5be9 in k8s/overlays/dev
• dc94b51 Merge pull request #1141 from NeuralTrust/fix/eng-2276-codeql-url-values-cap
• f462892 update agentgateway image tag to d6ccdb6 in k8s/overlays/dev
• 2ff5be9 Merge pull request #1140 from NeuralTrust/cursor/revoke-issued-code-4b15
• 9d72666 Merge pull request #1138 from NeuralTrust/cursor/gateway-shared-waiting-a40e
• 7dcfe0d Merge pull request #1137 from NeuralTrust/cursor/eng-2418-unknown-status-fail-closed-ac75
• 7764039 Merge pull request #1136 from NeuralTrust/cursor/none-mcp-access-revokes-grants-33b6
• 8293962 Potential fix for pull request finding 'CodeQL / Size computation for allocation may overflow'
• d6ccdb6 Merge pull request #1135 from NeuralTrust/cursor/default-idp-session-groups-d842
• a04a681 Merge remote-tracking branch 'origin/develop' into cursor/default-idp-session-groups-d842
• 5b0e52e fix(oauth): drop the capacity arithmetic CodeQL flags in adminURLValues
• 19bca97 ci: rerun checks after retargeting the base to develop
• c722ff8 Merge origin/develop into cursor/revoke-issued-code-4b15
• 89dfd89 fix(oauth): refuse a pre-revocation auth code at exchange
• b089f85 update agentgateway image tag to a5bac2b in k8s/overlays/dev
• a5bac2b Merge pull request #1139 from NeuralTrust/cursor/revoke-subject-sessions-4b15
• 598c384 chore: retrigger CI after an unrelated latency flake
• b5de300 fix(oauth): block refresh of sessions issued before revocation
• 29f63be Merge origin/develop into cursor/eng-2418-unknown-status-fail-closed-ac75
• 8245715 chore: retrigger CI for the unrecognized-status review fixes
• 96b4e61 fix(oauth): revoke a subject's default-IdP refresh sessions
• 1be9151 Refuse the Store install tool when access is None.
• 8416b66 update agentgateway image tag to ed93040 in k8s/overlays/dev
• f504e46 update agentgateway image tag to 57374dc in k8s/overlays/dev
• 7d8b216 fix(trustguard): keep an unrecognized status out of the client block body
• 650a6be fix(oauth): show a waiting state on an unconnected shared connect page
• ed93040 Merge pull request #1133 from NeuralTrust/cursor/legacy-expose-as-name-57a7
• 08cf3b7 Merge pull request #1132 from NeuralTrust/cursor/admin-url-save-gate-b4be
• 1d1a516 Expect the db-less Store listing to drop a server when access is None.
• 2c21613 Refuse service credentials on directory group writes.
• 57374dc Merge pull request #1134 from NeuralTrust/cursor/eng-2408-trustguard-skip-allowed-cf61
• f6ae27e fix(trustguard): fail closed on an unrecognized status in blocking mode
• 224209d Close MCP Store access when a principal's mode is None.
• cd9e95d test(store): stop pinning map order in the install refusal
• 4ada877 Add directory groups onto the default-IdP login claim.
• 0e35a9c fix(trustguard): record a buffered skip verdict as allowed
• 9675181 fix(mcp): spell pre-v2 names from ExposeAs
• 92b5d85 fix(registry): validate admin URL values and mark six entries admin-only
• 6d2a85e update agentgateway image tag to 14f4854 in k8s/overlays/dev
• c319535 update agentgateway image tag to a89a222 in k8s/overlays/dev
• 14f4854 Potential fix for pull request finding 'CodeQL / Size computation for allocation may overflow'
• a89a222 Merge pull request #1127 from NeuralTrust/cursor/admin-registry-url-variables-b4be
• 44ea6a3 update agentgateway image tag to f64d60f in k8s/overlays/dev
• f64d60f Merge pull request #1128 from NeuralTrust/fix/mcp-legacy-tool-name-alias
• 006af6d fix(store): revoke the removed credential when the uninstall row delete fails
• c56973f fix(mcp): keep pre-v2 tool and prompt names callable
• 9d6cea7 test: rename a fixture account label gitleaks flagged
• 5fcc37c update agentgateway image tag to 31cb81f in k8s/overlays/dev
• 85c2037 fix(registry): resolve non-secret URL variables from the admin row
• 31cb81f Merge pull request #1126 from NeuralTrust/cursor/groups-claim-drop-warning-8fc7
• 9e3b7e9 feat(identity): warn when groups claim values are dropped
• edafbee promote agentgateway v0.67.0 in k8s/overlays/prod,k8s/overlays/prod-us