Update stacklok/toolhive-registry-server to v1.5.0

[renovate]

This PR contains the following updates:

Package	Update	Change
stacklok/toolhive-registry-server	minor	v1.4.13 → v1.5.0

After this PR opens, .github/workflows/upstream-release-docs.yml adds source-verified content edits for the new release. For stacklok/toolhive, the same workflow also syncs reference assets (CLI help, Swagger) and regenerates the CRD MDX pages.

---

Release Notes

stacklok/toolhive-registry-server (stacklok/toolhive-registry-server)

v1.5.0

Compare Source

What's Changed

• Add configurable timeout for api sources by @​danbarr in #​844
• Update github actions by @​renovate[bot] in #​838
• Update docker images by @​renovate[bot] in #​839
• Validate api.timeout bounds on API-created sources by @​danbarr in #​846
• Fix request-body schemas in generated OpenAPI spec by @​danbarr in #​847
• Add GetEntryClaims admin endpoint by @​rdimitrov in #​761
• Split claim matching into visibility (OR) and subset (AND) by @​rdimitrov in #​848
• Release v1.5.0 by @​toolhive-release-app[bot] in #​850

Full Changelog: stacklok/toolhive-registry-server@v1.4.13...v1.5.0

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Never, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

---

Docs update for toolhive-registry-server v1.5.0

At a glance

Upstream	stacklok/toolhive-registry-server v1.4.13 → v1.5.0
Hand-written changes	1 commit(s)
Reference assets	refreshed (separate commit)
Gaps	0
Release contributors	2 auto-assigned (see sidebar)
Action required	Spot-check skill-authored prose for accuracy

Summary of changes

Auto-generated from commit titles -- skill did not write SUMMARY.md.

• Document registry-server v1.5.0 authz and api.timeout (4e5a398)

Run cost

Session	Turns	Cost (USD)
Generation	69	$6.5209
Editorial review	30	$2.1637
Total	99	$8.6846

How this PR was built

Two Claude Opus sessions run per release: a generation pass
(upstream-release-docs skill, 6 phases) followed by a fresh-
context editorial pass (docs-review). Prettier/ESLint
auto-fixes are applied after.

Auto-synced paths — do not hand-edit these in review:

• static/api-specs/
• docs/toolhive/reference/cli/ (toolhive only)

If a "Gaps needing human context" section is present above,
each entry includes a paste-ready Helper prompt for local
Claude a reviewer can use to resolve the gap.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs-website	Ready	Preview, Comment	Jul 17, 2026 2:47pm

[claude]

Claude finished @renovate[bot]'s task in 7m 32s —— View job

---

Upstream release docs: toolhive-registry-server v1.5.0

Impact map compiled; applying edits.

• Phase 1: Discovery — 5 user-facing PRs: stacklok/toolhive-registry-server#844, #846, #847, #761, #848; 3 infra/release
• Phase 2: Deep dive — verified against v1.5.0 source
• Phase 3: Audit — impact map ready
• Phase 4: Implementation
  • guides-registry/configuration.mdx — add api.timeout field (#844/#846)
  • guides-registry/authorization.mdx — rewrite "Claim containment" as visibility (OR) + subset (AND) (#848); note delete now uses visibility; link the GET counterpart (#761)
  • guides-registry/publish-servers.mdx — add "Read claims on a published entry" for GET /v1/entries/{type}/{name}/claims (#761)
  • guides-registry/audit-logging.mdx — add entry.claims.read event (#761)
• Phase 5: Validation — build, lint, docs-review
• Phase 6: Handle review feedback

Note: OpenAPI spec fixes in stacklok/toolhive-registry-server#847 land automatically via the swagger sync — no hand-written change needed.
· Branch: renovate/stacklok-toolhive-registry-server-1.x

[claude]

Claude finished @renovate[bot]'s task in 3m 50s —— View job

---

Editorial review: toolhive-registry-server v1.5.0 docs

• Inspect changed docs files (4 files staged by prior session)
• Run /docs-review across the four docs
• Apply actionable fixes
• Format + lint (npm run prettier:fix, npm run eslint:fix)
• Commit & push (4e5a398)

Summary of edits

• authorization.mdx - rewrote three prose sentences that were using - as an em-dash surrogate (project style asks for natural rephrasing over spaced hyphens outside list-style contexts): the "For scalar claims…" line, the "every sync overwrites them…" caveat, and the "list, get, and delete now agree" note under Delete source/registry.
• configuration.mdx - unhyphenated "occasionally-slow" (adverbs ending in -ly don't hyphenate with their adjective) and split the compound sentence at the semicolon so the second sentence stands on its own.
• publish-servers.mdx - simplified the dense "The JWT presented on the read, the original publish, and this update…" sentence into a role statement plus two crisp rules (visibility on read, subset on update).
• audit-logging.mdx - no editorial changes needed; the single entry.claims.read row is well-placed and consistent with the surrounding table.

Content otherwise verified against the prior session's source-verified edits; no factual concerns to raise.
· Branch: renovate/stacklok-toolhive-registry-server-1.x

[danbarr]

Confirmed the configurable timeout for API sources, and that the updated OpenAPI spec is now rendering the expected input types (example checked: the create source endpoint which previously had no input spec rendered).