v0.13.0

What's Changed

• Handle shutdown timeout in thv HTTP server by @JAORMX in #4328
• Preserve prompt message structure through vMCP relay by @JAORMX in #4334
• Guard PID reset against replacement process by @gkatz2 in #4325
• Add RegisterProviderFactory extension point to pkg/config by @aponcedeleonch in #4340
• Add AuthServerConfigRef CRD field, config model, and JwksAllowPrivateIP by @jhrozek in #4286
• Fix flaky TestWorkflowEngine_ParallelExecution on CI by @JAORMX in #4333
• Improve E2E test debuggability in CI by @JAORMX in #4332
• Increase timeout and add debug logging in lifecycle E2E test by @JAORMX in #4331
• Increase session management E2E test timeout to 3 minutes by @JAORMX in #4344
• Add RegisterHandlers and wire embedded AS routes on vMCP mux by @jhrozek in #4348
• Enable multi-upstream for MCPServer, MCPRemoteProxy, and proxy runner by @jhrozek in #4322
• Preserve content-level annotations through vMCP relay by @JAORMX in #4336
• Fix resource relay to preserve text/blob distinction by @JAORMX in #4335
• Add session planning and comment guardrails to code-review-assist skill by @jerm-dro in #4356
• Remove SessionCacheSize from ScalingConfig by @yrobla in #4347
• fix: return 503 instead of 500 when upstream registry is unavailable by @peppescg in #4352
• Update module github.com/stacklok/toolhive-catalog to v0.20260325.0 by @renovate[bot] in #4329
• Move TTL refresh into LocalStorage.Load, remove Session.Touch() by @yrobla in #4337
• fix(ci): clear full build cache before coverage to prevent NumStmt mismatch by @yrobla in #4362
• Fix concurrent SetSecret calls silently clobbering each other by @JAORMX in #4345
• Inject run config store into WorkloadFromContainerInfo by @JAORMX in #4342
• Wire git resolver into skill install flow by @JAORMX in #4338
• fix(composer): expand template expressions in elicitation messages by @saschabuehrle in #4313
• Merge runtime config override with defaults by @lorr1 in #4304
• Add upstream_inject strategy type and auth server validation by @jhrozek in #4349
• Enrich Identity with upstream tokens and simplify upstreamswap by @jhrozek in #4355
• Add AuthServerConfig validation condition to VirtualMCPServer reconciler by @jhrozek in #4350
• Support publishing additional container ports in thv run by @Sanskarzz in #3892
• Couple registry server URL and registry auth by @eleftherias in #4361
• Wire session-aware backend routing in proxy transports (RC-12) by @yrobla in #4318
• Webhook Middleware Phase 2: Validating webhook middleware by @Sanskarzz in #4314
• Add multi-violation CEL integration tests for OIDCConfigRef and AuthzConfigRef by @ChrisJBurns in #4309
• Update module github.com/stacklok/toolhive-catalog to v0.20260326.0 by @renovate[bot] in #4376
• Update module github.com/mark3labs/mcp-go to v0.46.0 by @renovate[bot] in #4380
• Update anchore/scan-action action to v7.4.0 by @renovate[bot] in #4378
• Update anchore/sbom-action action to v0.24.0 - autoclosed by @renovate[bot] in #4377
• Add CRD type changes for horizontal scaling by @yrobla in #4363
• Wire server discovery protocol into thv serve by @JAORMX in #4319
• Wire spec-driven replicas and session storage validation for MCPServer by @yrobla in #4364
• Fall through to well-known discovery when resource metadata auth fails by @reyortiz3 in #4371
• Update module github.com/cedar-policy/cedar-go to v1.6.0 by @renovate[bot] in #4379
• wire spec-driven replicas and Redis password for VirtualMCPServer by @yrobla in #4367
• Update module modernc.org/sqlite to v1.47.0 by @renovate[bot] in #4381
• Expose content array alongside structuredContent in workflow templates by @JAORMX in #4384
• Inject BackendReplicas and Redis session config into MCPServer RunConfig by @yrobla in #4368
• Add forEach step type for VMCP composite tool workflows by @JAORMX in #4375
• Release v0.13.0 by @stacklokbot in #4389

New Contributors

• @saschabuehrle made their first contribution in #4313
• @lorr1 made their first contribution in #4304

Full Changelog: v0.12.5...v0.13.0