v0.56.0

What's Changed

• Add OSS Scanner audit configuration by @rdimitrov in #6874
• Make unit tests pass as root and without a container runtime by @rdimitrov in #6875
• Cover the embedded auth server in threat model by @jhrozek in #6879
• Add native Go fuzz targets for untrusted parsers by @rdimitrov in #6877
• Decode IPv4 in IPv4-compatible and SIIT addresses by @rdimitrov in #6878
• Let embedders skip consent for preauthorized clients by @jhrozek in #6882
• Cap DCR clients and expire unused ones after 24h by @tgrunnagle in #6863
• Expose DCR client cap and register rate limit in CRD by @tgrunnagle in #6867
• Enable Claude Code gateway model discovery by @jerm-dro in #6862
• Answer 401 when a token session holds no upstream access token by @alex-feel in #6846
• Verify row ownership in Redis upstream token read by @hellouz818 in #6876
• Add coverage for -32601 under HTTP error statuses by @hellouz818 in #6873
• Test client response posts across handlers by @jstar0 in #5885
• Fix field names in external-auth examples by @3nesdeniz in #6330
• Add auth server TLS listener and SPIFFE middleware by @jhrozek in #6843
• Start auth server TLS listener in vMCP by @jhrozek in #6891
• Explain LLM gateway model-discovery failures by @jerm-dro in #6884
• Fix Claude Desktop paths and managed check on Linux by @jerm-dro in #6883
• Release v0.56.0 by @toolhive-release-app[bot] in #6917

New Contributors

• @3nesdeniz made their first contribution in #6330

Full Changelog: v0.55.2...v0.56.0