v0.55.2

Security

Rootless Podman host-access endpoints blocked by the egress proxy (GHSA-2x65-h9w3-h7hc, Medium)

With network isolation on rootless Podman, a workload could reach host services through the Squid or Envoy egress proxy using host.containers.internal or the address it maps to. ToolHive's protected set only covered Docker's host names and bridge gateways, and Podman's host-access address is not necessarily a bridge gateway.

On Podman, ToolHive now reads the DNS sidecar's runtime-generated /etc/hosts at deployment. It adds every address mapped to host.containers.internal, host.docker.internal, or gateway.docker.internal to the protected set, alongside all bridge gateways. Both proxies block those names and addresses unless --allow-docker-gateway is set.

What changes for operators

• On Podman, deployment fails before the proxy or MCP container starts if host.containers.internal is missing from the runtime's hosts file (for example with no_hosts = true in containers.conf), or if the hosts data cannot be read. This applies even with --allow-docker-gateway.
• The protected set is a deployment-time snapshot. Redeploy workloads after changing Podman's host mappings, rootless networking mode, or bridge networks.

What's Changed

• Use postflight_steps for the thv Homebrew cask hook by @rdimitrov in #6870
• Update go modules to v0.0.57 by @renovate[bot] in #6869
• Release v0.55.2 by @toolhive-release-app[bot] in #6871

Full Changelog: v0.55.1...v0.55.2