v0.47.0

What's Changed

• Log MCPRegistry deprecation at most once by @asjdf in #6366
• Trust private CAs for RFC 8693 trusted issuers by @jhrozek in #6437
• Update README after Cloud UI retirement by @danbarr in #6456
• Allow embedded auth servers without upstreams by @jhrozek in #6452
• Degrade transient optional list failures in Modern enumeration by @lorenzozanee in #6348
• Guard OIDC discovery against private IPs by @jhrozek in #6455
• Report key-signed artifacts as such at install by @samuv in #6443
• Fix VirtualMCPServer reconciliation by @jhrozek in #6465
• Intersect default scopes with scopes_supported when scope is omitted by @alex-feel in #6283
• test: cover OIDC upstream allowPrivateIPs in BuildAuthServerRunConfig by @alex-feel in #6288
• Record a pinned cosign key in the lock schema by @samuv in #6444
• Verify key-signed skill installs against a public key by @samuv in #6447
• fix(authserver): scope upstream-token callback cleanup to the chain's providers by @tgrunnagle in #6476
• fix(operator): detect vMCP volume drift by @jstar0 in #6299
• Detect GUI editors without a PATH binary by @stantheman0128 in #6481
• Encode empty mirrored parameter headers by @jhrozek in #6485
• Honour a pinned cosign key on sync and upgrade by @samuv in #6478
• Define SPIFFE trust configuration by @jhrozek in #6467
• fix(operator): warn when VirtualMCPServer inline telemetry is ignored by @RaviTharuma in #6408
• Bound and close HTTP client connection pools by @tgrunnagle in #6480
• Persist resolved CIMD clients so Redis session rehydration finds them by @alex-feel in #6284
• Route Claude workflows through the Stacklok LLM gateway by @eleftherias in #6498
• Exclude the x/crypto/ssh DoS advisories from govulncheck by @jhrozek in #6502
• Bump x/crypto to v0.56.0 and adopt go 1.26.0 by @tgrunnagle in #6494
• Bump google.golang.org/grpc from 1.83.0 to 1.83.1 by @dependabot[bot] in #6486
• Update VS Code LLM integration by @blkt in #6492
• Restore go.mod patch-version lint with floor-friendly regex by @reyortiz3 in #6503
• Sign plugin pushes and remove the lock feature gate by @samuv in #6438
• Release per-issuer JWKS refresh workers on auth-server shutdown by @tgrunnagle in #6493
• Grant CIMD clients the server's allowed audiences by @alex-feel in #6490
• Close leaked test validators and fix validator-sharing docs by @tgrunnagle in #6504
• Bound and drain hand-rolled HTTP transport pools by @tgrunnagle in #6495
• Restart health checks when a backend's auth config changes by @alex-feel in #6510
• Preserve config-level outgoing auth across backend watcher reconciles by @alex-feel in #6513
• Allow Cedar delegation without an upstream session by @jhrozek in #6506
• Normalize canonical inbound grants by @jhrozek in #6473
• Suppress OAuth callback Referer by @adrian-muon in #6519
• Expose canonical inbound grants in CRDs by @jhrozek in #6499
• Expose SPIFFE client-auth registration through the operator CRDs by @jhrozek in #6500
• Document SPIFFE association declarations by @jhrozek in #6501
• Make proxy request-body limit configurable by @Sanskarzz in #6298
• Update github/codeql-action action to v4.37.9 by @renovate[bot] in #6463
• Update anchore/scan-action action to v7.4.2 - autoclosed by @renovate[bot] in #6461
• Update anchore/sbom-action action to v0.24.2 by @renovate[bot] in #6460
• Update module github.com/stacklok/toolhive-catalog to v0.20260831.0 by @renovate[bot] in #6530
• Update module github.com/stacklok/toolhive-catalog to v0.20260908.0 by @renovate[bot] in #6534
• Cancel superseded pull request checks by @rdimitrov in #6533
• Reduce cached token restore complexity to fix CI by @rdimitrov in #6535
• Cancel superseded main validation runs by @rdimitrov in #6537
• Update anthropics/claude-code-action action to v1.0.217 by @renovate[bot] in #6462
• Verify key-signed plugin installs against a public key by @samuv in #6524
• Release v0.47.0 by @toolhive-release-app[bot] in #6539

New Contributors

• @asjdf made their first contribution in #6366
• @lorenzozanee made their first contribution in #6348
• @jstar0 made their first contribution in #6299
• @adrian-muon made their first contribution in #6519

Full Changelog: v0.46.0...v0.47.0