v0.27.1

What's Changed

• Redact webhook response body from returned errors by @JAORMX in #5191
• Add omitempty to MCPGroupStatus JSON fields by @sharanrajt in #5181
• Cap webhook middleware request body at 1 MB by @JAORMX in #5192
• Update anthropics/claude-code-action digest to 9db782c by @renovate[bot] in #5164
• Update module github.com/stacklok/toolhive-catalog to v0.20260507.0 by @renovate[bot] in #5206
• Add Windows named-pipe support to the API listener by @samuv in #5201
• Restrict Windows named-pipe DACL to creating user by @samuv in #5214
• Add persistent DCRCredentialStore types and memory backend by @tgrunnagle in #5186
• Expose explicit primaryUpstreamProvider for Cedar authz on VirtualMCPServer by @tgrunnagle in #5199
• Use shared pkg/oauthproto helpers in tokenexchange by @jhrozek in #5212
• Skip WARN for non-POST Streamable HTTP requests by @danbarr in #5221
• Move pipe and socket URL handling to net/url by @samuv in #5215
• Guard RedisStorageConfig CEL rules with has() checks by @reyortiz3 in #5228
• Pin npipe round-trip and pipe lifecycle invariants by @samuv in #5216
• Add Redis backend for DCRCredentialStore by @tgrunnagle in #5195
• Wire persistent DCRCredentialStore into EmbeddedAuthServer by @tgrunnagle in #5196
• Add CRD-runtime drift detection test framework by @ChrisJBurns in #5209
• MCPGroup Ready column misleadingly shows MCPServersChecked condition by @Sanskarzz in #5241
• Release v0.27.1 by @toolhive-release-app[bot] in #5244

New Contributors

• @sharanrajt made their first contribution in #5181

Full Changelog: v0.27.0...v0.27.1