Update stacklok/toolhive to v0.28.1

[renovate]

This PR contains the following updates:

Package	Update	Change
stacklok/toolhive	patch	v0.28.0 → v0.28.1

After this PR opens, .github/workflows/upstream-release-docs.yml adds source-verified content edits for the new release. For stacklok/toolhive, the same workflow also syncs reference assets (CLI help, Swagger) and regenerates the CRD MDX pages.

---

Release Notes

stacklok/toolhive (stacklok/toolhive)

v0.28.1

Compare Source

What's Changed

• Use shared toolhive-core redis client for session storage by @​reyortiz3 in #​5324
• Bump github.com/go-git/go-git/v5 from 5.19.0 to 5.19.1 by @​dependabot[bot] in #​5330
• fix(operator): inject THV_SESSION_REDIS_PASSWORD for MCPServer by @​dallinstevens in #​5286
• fix: validate k8s export volume format by @​immanuwell in #​5319
• Update dependency kyverno/chainsaw to v0.2.15 by @​renovate[bot] in #​5297
• Update kyverno/action-install-chainsaw action to v0.2.15 by @​renovate[bot] in #​5298
• Update module github.com/pelletier/go-toml/v2 to v2.3.1 by @​renovate[bot] in #​5311
• Use events.k8s.io in registry-api Role by @​rdimitrov in #​5340
• Preserve fresh per-request identity in vMCP backend transports by @​tgrunnagle in #​5335
• Factor thv-operator main into app.Run; add proxyrunner Run helper by @​tgrunnagle in #​5332
• Add CIMD document fetch/validate and extend SSRF protections by @​amirejaz in #​5320
• Add default OBO handler hooks and vMCP/proxy converter stubs by @​tgrunnagle in #​5338
• Inject spawn seam in RunWorkloadDetached to stop orphan test processes by @​tgrunnagle in #​5346
• Release v0.28.1 by @​toolhive-release-app[bot] in #​5352

New Contributors

• @​immanuwell made their first contribution in #​5319

Full Changelog: stacklok/toolhive@v0.28.0...v0.28.1

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Never, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

---

Docs update for toolhive v0.28.1

Note

Skill reported no doc-relevant changes for this release.
This PR only bumps the version pin and any pin_files edits.

At a glance

Upstream	stacklok/toolhive v0.28.0 → v0.28.1
Hand-written changes	0 commit(s)
Reference assets	refreshed (separate commit)
Gaps	0
Release contributors	6 auto-assigned (see sidebar)
Action required	—

Run cost

Session	Turns	Cost (USD)
Generation	49	$2.9036
Editorial review	5	$0.4470
Total	54	$3.3506

How this PR was built

Two Claude Opus sessions run per release: a generation pass
(upstream-release-docs skill, 6 phases) followed by a fresh-
context editorial pass (docs-review). Prettier/ESLint
auto-fixes are applied after.

Auto-synced paths — do not hand-edit these in review:

• docs/toolhive/reference/cli/
• docs/toolhive/reference/crds/
• static/api-specs/

If a "Gaps needing human context" section is present above,
each entry includes a paste-ready Helper prompt for local
Claude a reviewer can use to resolve the gap.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs-website	Ready	Preview, Comment	May 21, 2026 7:41am

[claude]

Claude finished @renovate[bot]'s task in 4m 49s —— View job

---

Upstream release docs update for toolhive v0.28.1

• Phase 1: Discovery — enumerated PRs between v0.28.0 and v0.28.1 (13 PRs + release PR)
• Phase 2: Deep-dive — read PR descriptions and noted user-facing claims
• Phase 3: Docs audit — built impact map; result is empty
• Phase 4: Implementation — no hand edits required
• Phase 5: Validation — skipped (no edits to validate)
• Phase 6: Wrote NO_CHANGES.md signal file (gitignored, consumed by workflow)

Result: no hand-written docs changes for this release

The v0.28.1 release contains only internal refactors, bug fixes, and enterprise-only stub infrastructure. Each candidate change was checked against the existing docs:

• fix(operator): inject THV_SESSION_REDIS_PASSWORD for MCPServer toolhive#5286 — operator THV_SESSION_REDIS_PASSWORD fix for MCPServer. docs/toolhive/guides-k8s/redis-session-storage.mdx and run-mcp-k8s.mdx already document MCPServer.spec.sessionStorage.passwordRef; the fix aligns runtime behavior with the docs.
• fix: validate k8s export volume format toolhive#5319 — thv export --format k8s now rejects volume strings like /host:/container:rw or extra : segments. docs/toolhive/guides-cli/filesystem-access.mdx already documents <HOST_PATH>:<CONTAINER_PATH>[:ro] as the only supported form.
• Preserve fresh per-request identity in vMCP backend transports toolhive#5335 — vMCP backend transport identity bug fix (no more forced 24h re-auth on upstreamInject / tokenExchange / awsSts). Transparent fix; no doc surface changed.
• Use shared toolhive-core redis client for session storage toolhive#5324 — internal Redis client refactor; env var names (THV_SESSION_REDIS_PASSWORD) and CRD field names preserved.
• Use events.k8s.io in registry-api Role toolhive#5340 — operator registry-api Role switched from core events to events.k8s.io/events. Our docs don't enumerate operator RBAC rules.
• Add CIMD document fetch/validate and extend SSRF protections toolhive#5320 — CIMD library + SSRF range extensions, leaf-only with no server wiring yet.
• Add default OBO handler hooks and vMCP/proxy converter stubs toolhive#5338 — OBO handler hooks; CRD enum still rejects spec.type: obo in upstream-only builds (the PR is explicit about this). OBO stays undocumented in OSS until Admit obo in MCPExternalAuthConfig CRD enum and regenerate manifests toolhive#5329 widens the enum.
• Factor thv-operator main into app.Run; add proxyrunner Run helper toolhive#5332 — thv-operator / thv-proxyrunner main factored into app.Run(); identical runtime behavior.
• Inject spawn seam in RunWorkloadDetached to stop orphan test processes toolhive#5346 — test-process spawn seam (test-only).
• Dependency bumps (Bump github.com/go-git/go-git/v5 from 5.19.0 to 5.19.1 toolhive#5330, #5311) and CI updates (Update dependency kyverno/chainsaw to v0.2.15 toolhive#5297, #5298): no docs impact.

Auto-generated reference assets were refreshed by the workflow's earlier Refresh reference assets for toolhive v0.28.1 step (commit ec15c34); the only diff in this PR beyond the version bump is the auto-regenerated static/api-specs/crds/virtualmcpservers.schema.json (description text added "obo" to the strategy-type list, but the CRD enum itself was not widened).
· Branch

[claude]

Claude finished @renovate[bot]'s task in 30s —— View job

---

Editorial review for toolhive v0.28.1 docs update

• Identify hand-edited docs files changed by the previous session
• Run /docs-review over those files

Result: no hand-written docs to review

The previous Claude session concluded that v0.28.1 required no hand edits, and the PR diff confirms it. The only changed files are:

• .github/upstream-projects.yaml — Renovate version bump, not docs.
• static/api-specs/crds/virtualmcpservers.schema.json — auto-regenerated CRD schema in the excluded static/api-specs/ path.

Both are out of scope for editorial review per the custom instructions (no edits to static/api-specs/, docs/toolhive/reference/cli/, or docs/toolhive/reference/crds/; signal files like NO_CHANGES.md also off-limits). The previous session's reasoning checks out against the upstream release notes — the v0.28.1 changes are internal refactors, dependency bumps, transparent bug fixes, and enterprise-only stub infrastructure that does not yet have a documented OSS surface.

Nothing to change.
· Branch