v0.29.0

What's Changed

• Admit obo in MCPExternalAuthConfig CRD enum by @tgrunnagle in #5361
• Consolidate authserver DCR types onto pkg/oauthproto by @tgrunnagle in #5372
• Add CIMD storage decorator for embedded AS by @amirejaz in #5343
• Address post-approval review feedback on VirtualMCPServer authz by @blkt in #5368
• Clear all cached registry tokens on logout by @rdimitrov in #5382
• Wire CIMD config through embedded AS and enable storage decorator by @amirejaz in #5348
• Refresh docs/arch/ to match current codebase by @JAORMX in #5388
• Freeze MCPServer generation per pod via downward API by @ChrisJBurns in #5364
• Add StorageVersionMigrator controller (opt-in, default off) by @ChrisJBurns in #5362
• Fixed VirtualMCPCompositeToolDefinition printer columns output by @Sanskarzz in #5380
• Delete .claude/skills/pr-review directory by @ChrisJBurns in #5392
• Update github/codeql-action digest to 7211b7c by @renovate[bot] in #5375
• Update module github.com/stacklok/toolhive-catalog to v0.20260529.0 by @renovate[bot] in #5342
• Update anthropics/claude-code-action digest to 787c5a0 by @renovate[bot] in #5374
• Opt 12 v1beta1 CRDs into storage-version migration + CI guard by @ChrisJBurns in #5391
• chore: add needs-triage caller workflow by @dussab in #5398
• Update module github.com/stacklok/toolhive-catalog to v0.20260529.0 by @renovate[bot] in #5396
• Add 'thv mcp call' for invoking MCP server tools by @JAORMX in #5389
• Update aws-sdk-go-v2 monorepo by @renovate[bot] in #5406
• Update golang.org/x/exp/jsonrpc2 digest to c761662 by @renovate[bot] in #5404
• Update go.starlark.net digest to ec58d4b by @renovate[bot] in #5376
• Deprecate Roo Code client integration by @danbarr in #5415
• Fall back to request-token claims for opaque upstream tokens by @cjohnhanson in #5147
• Persist config backward-compat migrations to load path by @danbarr in #5416
• Isolate skills client discovery in default-client test by @danbarr in #5417
• dcr: support RFC 8414 §3.1 path-insertion in discovery-URL → issuer derivation by @juzerpatanwala in #5395
• Add workload upgrade detection package by @JAORMX in #5407
• Bind vMCP sessions to OIDC identity, not raw token bytes by @jhrozek in #5378
• Add upgrade-check REST endpoints for workloads by @JAORMX in #5408
• Add thv upgrade check and list --check-upgrades by @JAORMX in #5409
• Add Applier for upgrading workloads in place by @JAORMX in #5410
• Surface StorageVersionMigrator behind chart feature flag (opt-in) by @ChrisJBurns in #5418
• Validate CIMD scope, grant_types and response_types against AS policy by @amirejaz in #5385
• Add upgrade apply for the CLI and API by @JAORMX in #5411
• Add e2e coverage and lifecycle docs for upgrades by @JAORMX in #5412
• Update goreleaser/goreleaser-action digest to 5daf1e9 by @renovate[bot] in #5405
• Expose CIMD config in MCPExternalAuthConfig CRD by @amirejaz in #5384
• Update module github.com/stacklok/toolhive-catalog to v0.20260603.0 by @renovate[bot] in #5413
• Migrate container client to moby/moby modules by @rdimitrov in #5420
• Ignore go1.26.4 stdlib vulns in govulncheck until toolchain bump by @rdimitrov in #5425
• Release v0.29.0 by @toolhive-release-app[bot] in #5424

New Contributors

• @cjohnhanson made their first contribution in #5147
• @juzerpatanwala made their first contribution in #5395

Full Changelog: v0.28.3...v0.29.0