v0.12.5

What's Changed

• Fix MCPRegistry operator to update deployments on spec changes by @rdimitrov in #4237
• Update module github.com/stacklok/toolhive-catalog to v0.20260319.0 by @renovate[bot] in #4230
• Wire non-interactive registry auth for serve mode by @ChrisJBurns in #4111
• Fix release workflow: cosign-installer upgrade and re-run support by @amirejaz in #4244
• Add Swagger annotations for registry auth endpoints by @ChrisJBurns in #4243
• Remove orphaned registry API Helm templates by @ChrisJBurns in #4246
• Key authserver's upstream token storage on (sessionID, providerName) by @jhrozek in #4198
• refactor(vmcp): pull optimizer and composite tool decoration into session factory by @yrobla in #4231
• feat(session): implement Redis storage backend (RC-6) by @yrobla in #4233
• Support overriding tool annotations in aggregation config by @jerm-dro in #4285
• Add BackendReplicas and SessionCacheSize to RunConfig by @yrobla in #4239
• Fix missing resource parameter on cached token restore by @rodrigo1208 in #4292
• Fix inspector URL using wrong transport for proxied stdio servers by @danbarr in #4300
• Enterprise quick link by @aaortiz in #4303
• Add CEL validation to OIDCConfigRef and AuthzConfigRef union types by @ChrisJBurns in #4299
• Update actions/cache digest to 6682284 by @renovate[bot] in #4305
• Add code review assist skill and expand vMCP anti-patterns by @jerm-dro in #4302
• chore: migrate from Trivy to Grype for vulnerability scanning by @JAORMX in #4288
• Add foundational webhook package (Phase 1 of dynamic webhook middleware) by @Sanskarzz in #3840
• feat(proxyrunner): wire SIGTERM-aware graceful shutdown (RC-14) by @yrobla in #4241
• Resolve plain skill names from registry during install by @JAORMX in #4200
• Update github/codeql-action digest to 3869755 by @renovate[bot] in #4308
• feat(session): add NewManagerWithRedis constructor (RC-7) by @yrobla in #4236
• Update codecov/codecov-action digest to 1af5884 by @renovate[bot] in #4307
• Update anthropics/claude-code-action digest to ff9acae by @renovate[bot] in #4306
• Bump github.com/buger/jsonparser from 1.1.1 to 1.1.2 by @dependabot[bot] in #4311
• Update module github.com/stacklok/toolhive-catalog to v0.20260323.0 by @renovate[bot] in #4289
• Prevent permanent backend unhealthy marking after startup race by @yrobla in #4290
• Map mcp-go sentinel errors and poll registry version for timely status reports by @yrobla in #4317
• Wire BackendReplicas through to StatefulSet replica count by @yrobla in #4291
• Replace webhook.Principal with auth.Identity by @JAORMX in #4316
• Improve code-review-assist skill from review sessions by @jerm-dro in #4321
• Implement multi-upstream sequential authorization chain by @jhrozek in #4283
• Retry transient network errors in background token monitor by @reyortiz3 in #4281
• Gracefully handle SIGTERM in thv HTTP server by @JAORMX in #4327
• Release v0.12.5 by @stacklokbot in #4330

New Contributors

• @aaortiz made their first contribution in #4303

Full Changelog: v0.12.4...v0.12.5