v0.46.0

🚀 Toolhive v0.46.0 is live!

An authentication and supply-chain hardening release: embedded auth servers can now trust private CAs for upstream identity providers, plugin upgrades refuse silent signer rotations, and three OAuth flows return the right answer instead of a misleading one.

🆕 New Features

• You can now point an embedded auth server at an in-cluster identity provider behind an internal CA by setting caBundleRef on an OIDC or OAuth2 upstream, which adds that CA to the system trust roots for discovery, token, user-info, and dynamic client registration calls to that upstream only (#6428).
  • Upgrade note: apply the operator-crds 0.46.0 chart before (or together with) the operator chart — a stale CRD silently prunes caBundleRef from applied resources instead of rejecting it. Existing manifests that do not set caBundleRef reconcile identically and are not restarted by this upgrade.
• thv ai-plugin upgrade now refuses to install a plugin update whose signature identity differs from the one recorded in the project lock file — or that is unsigned — reporting signer-change-blocked and exiting 4 until you confirm the rotation with the new --allow-signer-change flag, which re-records the new identity in the lock (#6401).
  • Available with the experimental plugins lock file behind TOOLHIVE_PLUGINS_LOCK_ENABLED; lock entries with no recorded provenance are unaffected.

🐛 Bug Fixes

• OAuth clients such as ChatGPT that publish a Client ID Metadata Document listing several token endpoint authentication methods can now sign in against ToolHive's authorization server, which negotiates a mutually supported method instead of rejecting the document outright (#6400).
• thv llm setup now fails fast with an actionable "callback port already in use" message instead of silently switching to a random port that your identity provider would reject — free the port or pass --callback-port <port> with a redirect URI registered with your IdP (#6432).
• Deployments that provision user accounts out-of-band (for example via SCIM) can now have logins from unprovisioned identities rejected with a proper access_denied OAuth error, so clients stop treating a deliberate denial as a retryable server failure (#6441).

🧹 Misc

• The release-notes CI workflow now allowlists the tools its expert subagents actually use, so release-notes generation stops burning turns on permission denials and completes within budget (#6439).

👋 Welcome to our newest contributor: @alex-feel 🎉

Full commit log

What's Changed

• Trust private CAs for upstream auth servers by @jhrozek in #6428
• Block plugin upgrades that change the signer identity by @samuv in #6401
• Fail LLM setup when callback port is busy by @jerm-dro in #6432
• Scope release-notes tool allowlist for Phase 3 experts by @reyortiz3 in #6439
• Negotiate CIMD token endpoint auth method by @alex-feel in #6400
• fix(authserver): map deliberate provisioning refusal to access_denied by @reyortiz3 in #6441
• Release v0.46.0 by @toolhive-release-app[bot] in #6448

New Contributors

• @alex-feel made their first contribution in #6400

Full Changelog: v0.45.0...v0.46.0

🔗 Full changelog: v0.45.0...v0.46.0