v0.11.3

What's Changed

• Add multi-backend optimizer acceptance test by @aponcedeleonch in #4049
• Add optimizer+circuit breaker acceptance test for vMCP by @aponcedeleonch in #4052
• Return RFC 6750 compliant JSON error responses from auth middleware by @amirejaz in #4057
• Add remaining Claude Code subagent definitions by @ChrisJBurns in #4060
• changes from review by @yrobla in #4028
• Automate HMAC secret management by @yrobla in #4008
• Fix CI build failures on main by @JAORMX in #4071
• Fix SSE/JSON race condition in session capability injection by @aponcedeleonch in #4075
• Add optimizer composite tool E2E test with fake embedding server by @jerm-dro in #4059
• Strengthen session hijacking prevention types and tests by @yrobla in #4067
• fix: refresh upstream tokens transparently instead of forcing re-auth by @aron-muon in #4036
• Rebalance E2E test CI matrix from 4 to 8 buckets by @JAORMX in #4074
• Fix SSE endpoint rewrite E2E tests using nonexistent flags by @ChrisJBurns in #4080
• Use go-containerregistry for OCI tag validation by @JAORMX in #4017
• Handle mid-session backend crashes gracefully by @yrobla in #4053
• Fix validateOCITag to accept full OCI references by @JAORMX in #4088
• Elevate session management V2 tests to e2e by @yrobla in #4069
• Remove @eleftherias from codeowners by @eleftherias in #4089
• Fix deterministic E2E proxy SSE endpoint rewrite tests by @JAORMX in #4093
• Preserve tool annotations and output schema through vmcp by @JAORMX in #4090
• Hide already registered clients in thv client setup by @carlos-gn in #3889
• Add distributable skills directory and CI pipeline by @JAORMX in #4070
• Fix Content-Length mismatch in authz response filter with remote proxies by @jhrozek in #4092
• Add gitresolver package for git:// skill references by @JAORMX in #4051
• Fix flaky TestMemoryStorage_CleanupLoop timing test by @JAORMX in #4098
• Speed up CI unit tests by @ChrisJBurns in #4081
• Update MCP protocol expert agent for 2025-11-25 spec by @JAORMX in #4099
• Fix flaky api-workloads E2E test timeout by @JAORMX in #4106
• Fix flaky E2E lifecycle tests: tool discovery race by @JAORMX in #4107
• Add tool annotation context for Cedar/HTTP authz by @JAORMX in #4102
• Speed up CI and fix flaky E2E tests by @ChrisJBurns in #4104
• Remove unused per-session channels from StreamableSession by @ChrisJBurns in #4076
• Add OAuth/OIDC authentication for remote MCP server registries by @ChrisJBurns in #3908
• Re-panic http.ErrAbortHandler in recovery middleware by @gkatz2 in #4065
• Fix Session Leak in Transparent Proxy by @ChrisJBurns in #4079
• Make proxy response timeout configurable by @gkatz2 in #4063
• Clean up client filtering after PR #3889 by @JAORMX in #4095
• Bump Kubernetes e2e test tool versions and add Renovate managers by @JAORMX in #4105
• Add ClusterIP service with SessionAffinity for MCP server backend by @JAORMX in #3992
• Address review feedback for MCP backend session affinity by @JAORMX in #4116
• Add annotation cache for tools/list to tools/call flow by @JAORMX in #4114
• Split vmcp auth/authz middleware for annotation flow by @JAORMX in #4115
• Release v0.11.3 by @stacklokbot in #4119

Full Changelog: v0.11.2...v0.11.3