v0.43.0

What's Changed

• Guard against shell injection via github.ref in image workflow by @ChrisJBurns in #6248
• Extend private-IP guard to 6to4/Teredo addresses by @ChrisJBurns in #6249
• Parse multi-line Modern SSE events by @kocaemre in #6126
• Add zizmor to CI and stop double-running the security scan by @ChrisJBurns in #6251
• Pin actions to commit SHAs and fix stale version comments by @ChrisJBurns in #6254
• Stop persisting git credentials in CI workflow checkouts by @ChrisJBurns in #6255
• Bind workflow expressions and drop persisted credentials by @ChrisJBurns in #6258
• Derive PR number from the triggering run in the size labeler by @ChrisJBurns in #6259
• Gate the Claude workflow on write access, not contribution history by @ChrisJBurns in #6260
• Stop writing the PR number into the size label artifact by @ChrisJBurns in #6261
• Suppress four zizmor findings that cannot be fixed by @ChrisJBurns in #6262
• Scope the release app token to what releaseo needs by @ChrisJBurns in #6266
• Scope releaser permissions and bind the tag expression by @ChrisJBurns in #6263
• Pass only the secret the test workflow needs by @ChrisJBurns in #6269
• Bind the GHCR credentials and chart version in helm-publish by @ChrisJBurns in #6270
• Scope the remaining release app tokens and bind a trailer by @ChrisJBurns in #6272
• Rate limiting observability (metrics and tracing) PR B by @Sanskarzz in #5800
• Clear the remaining zizmor findings in helm-publish by @ChrisJBurns in #6275
• Make the zizmor check blocking by @ChrisJBurns in #6274
• Clear the last zizmor findings in the release workflows by @ChrisJBurns in #6281
• Drop build fingerprint from proxy /health response by @Nashon-Steffen in #6280
• Let an explicit non-Modern header outrank a reserved key by @amirejaz in #6231
• Deflake the initialize dial-error proxy test by @amirejaz in #6264
• Support confidential clients in dynamic client registration by @jhrozek in #6252
• fix(vmcp): reject Authorization and Cookie in passthroughHeaders, as documented by @SashaMIT in #6235
• fix(auth): bind OAuth callback listener to loopback only by @SashaMIT in #6238
• Display recorded trust state to the user by @samuv in #6137
• Bound client-controlled metric label length by @Nashon-Steffen in #6279
• Sign the macOS thv binary with a Developer ID certificate by @eleftherias in #6156
• Sign pushes by default and remove the lock feature gate by @samuv in #6139
• Ignore unsupported grant types in CIMD documents by @amirejaz in #6297
• fix(authz): make Cedar URI entity IDs collision-free by @SashaMIT in #6239
• Add plugins key to lock file schema by @samuv in #6303
• Update module github.com/stacklok/toolhive-catalog to v0.20260810.0 by @renovate[bot] in #6257
• Add PluginLockService and managed install flag by @samuv in #6311
• Record certificate ref and runner in lock provenance by @samuv in #6312
• Pin CodeQL SARIF action comment to v4.37.6 by @samuv in #6313
• Reset the LLM config when the last tool is torn down by @jerm-dro in #6295
• Use a bare thv command as the LLM token helper by @jerm-dro in #6326
• Bump go.mod to get CVE fixes by @jhrozek in #6327
• Make RFC 8693 delegate clients reachable and usable by @jhrozek in #6320
• Enforce recorded ref and runner on skill verification by @samuv in #6315
• Release v0.43.0 by @toolhive-release-app[bot] in #6333

New Contributors

• @kocaemre made their first contribution in #6126

Full Changelog: v0.42.1...v0.43.0