v0.28.0

What's Changed

• Update module github.com/modelcontextprotocol/registry to v1.7.7 [SECURITY] by @renovate[bot] in #5230
• Add TOOLHIVE_SKIP_UPDATE_CHECK env var to disable update checks by @lujunsan in #5264
• Add RFC 7523 JWT Bearer grant package by @jhrozek in #5262
• Extract DCR resolver into pkg/auth/dcr by @tgrunnagle in #5198
• Wire identityFromToken into the OAuth2 upstream provider by @jhrozek in #5222
• Add API endpoint to refresh the registry cache by @rdimitrov in #5268
• Retry OAuth token refresh on infrastructure 4xx by @gkatz2 in #5170
• docs: remove stale chart version bump guidance from check-contribution skill by @wucm667 in #5211
• Configure rate limits on VirtualMCPServer PR A by @Sanskarzz in #5079
• Migrate CLI OAuth flow to pkg/auth/dcr resolver by @tgrunnagle in #5250
• Drop legacy registry schema from release artifacts by @rdimitrov in #5273
• Watch authz ConfigMaps from VirtualMCPServer by @blkt in #5271
• Split api-workloads E2E suite into parallel entries by @jhrozek in #5275
• Update module github.com/stacklok/toolhive-catalog to v0.20260513.0 by @renovate[bot] in #5274
• Add identityFromToken to MCPExternalAuthConfig CRD by @jhrozek in #5269
• Reset RunWorkload retry counter after stable run by @gkatz2 in #5172
• Drop per-component CRD and controller gating from operator install by @ChrisJBurns in #5281
• Fix wrapper name in api-compat workflow comments by @ChrisJBurns in #5282
• Pin helm-crd-wrapper to v0.0.1 by @ChrisJBurns in #5283
• Fix operator RBAC for event recording by @pl4nty in #5243
• Add GitHub Copilot CLI as a supported MCP client by @danbarr in #5287
• Wire identityFromToken through authserver config and runtime by @jhrozek in #5285
• References printcolumn shows raw JSON instead of useful summary by @Sanskarzz in #5267
• Fix audit events logged as INFO+2 instead of AUDIT by @kimjune01 in #5256
• Update github/codeql-action digest to 9e0d7b8 by @renovate[bot] in #5295
• Update module github.com/cedar-policy/cedar-go to v1.6.1 by @renovate[bot] in #5307
• Update golang.org/x/exp/jsonrpc2 digest to 74f9aab by @renovate[bot] in #5296
• Update module github.com/google/cel-go to v0.28.1 by @renovate[bot] in #5309
• Deep-copy shared fixtures in mapMCPServerToWebhookConfig subtests by @jhrozek in #5310
• Add --session-ttl flag and fix three session timeout bugs by @JAORMX in #5117
• Update module github.com/charmbracelet/x/ansi to v0.11.7 by @renovate[bot] in #5308
• Deflake transientRefresher singleflight test by @jhrozek in #5312
• Move HeaderForward helpers to pkg/vmcp/headerforward by @lorr1 in #5302
• Update anthropics/claude-code-action digest to 51ea8ea by @renovate[bot] in #5294
• Update module github.com/stacklok/toolhive-catalog to v0.20260518.0 by @renovate[bot] in #5313
• Bump toolhive-core on release day via Renovate by @reyortiz3 in #5315
• Drop empty PULLS column from registry list and search output by @danbarr in #5314
• fix(operator): add startup probe to proxyrunner deployment by @gabrielcosi in #5300
• Bump toolhive-core to v0.0.20 by @reyortiz3 in #5316
• Wire HeaderForward into vMCP per-session HTTP client by @lorr1 in #5301
• Bump toolhive-core to v0.0.21 and use shared redis client by @reyortiz3 in #5318
• Release v0.28.0 by @toolhive-release-app[bot] in #5322

New Contributors

• @pl4nty made their first contribution in #5243
• @kimjune01 made their first contribution in #5256
• @gabrielcosi made their first contribution in #5300

Full Changelog: v0.27.2...v0.28.0