Repository navigation
build(deps): bump toolhive to v0.58.0 and golang.org/x/net to v0.62.0 - #2581
Merged
Merged
Conversation
Picks up sub_id and authorization_details (v0.57.0) and the opt-in at+jwt access-token typ (v0.58.0) the agent identity work needs. go mod tidy also moved a few indirect dependencies; integration/microvm is tidied to the same versions. Co-authored-by: Mecatl <noreply@mecatl.dev>
task tidy (go work sync plus per-module tidy) aligns the shared indirect dependencies the bump moved: AWS SDK, modelcontextprotocol/registry, fxamacker/cbor, pierrec/lz4, and go-colorable patch releases in the root, environment/microvm, integration/microvm, and provider/anthropic modules. Co-authored-by: Mecatl <noreply@mecatl.dev>
A second task tidy pass records the go.mod hashes for the cbor and go-colorable versions that go work sync raised. Co-authored-by: Mecatl <noreply@mecatl.dev>
GO-2026-6860 (CVE-2026-78661), published today, reports quadratic allocation in golang.org/x/net/html parsing, fixed in v0.62.0. Bump it in every module that requires it and tidy the rest. Co-authored-by: Mecatl <noreply@mecatl.dev>
ChrisJBurns
changed the title
This was referenced Oct 28, 2026
Phase 1, Track: ToolHive — The authorization server and gateway changes the phase 1 flow needs
#2543
Open
Closed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps
github.com/stacklok/toolhivefrom v0.56.0 to v0.58.0, the latest release, in the root module and (indirectly)integration/microvm.go mod tidyalso moved a few indirect dependencies (AWS SDK patch releases,modelcontextprotocol/registry,ngrok,modernc.org/sqlite/libc,oras-go).Why
The agent identity work needs ToolHive changes that shipped after v0.56.0:
sub_id(RFC 9493) in access tokens (Add opt-in upstream subject identifiers toolhive#6908), which feat(authn): own sessions by the sign-in's sub_id identity #2497 keys session owners on andauthorization_detailsin token exchange (Support authorization_details on token exchange toolhive#6921).typ: at+jwton embedded AS access tokens (Add opt-in at+jwt typ for embedded AS access tokens toolhive#6942), which feat(authn): own sessions by the sign-in's sub_id identity #2497's checks require of real AS-1 tokens; plus fixes to delegate clients removed from config (#6945) and refresh grants with a dead upstream credential (#6930).Not in this release: the issuer as the client-assertion audience (stacklok/toolhive#6946), which #2533's real AS-2 test still waits for.
Also bumps
golang.org/x/netto v0.62.0 in every module, for GO-2026-6860 (CVE-2026-78661, published 2026-10-27): quadratic allocation ingolang.org/x/net/htmlparsing. The govulncheck gate flags it on any branch,mainincluded, sincemainpins v0.61.0.Changes
go.mod/go.sum:github.com/stacklok/toolhive v0.58.0and the indirect dependenciesgo mod tidyselected.integration/microvm/go.mod/go.sum: the same versions, viaGOWORK=off go mod tidy(it replaces the root module with../..).task tidy(go work syncplus per-module tidy) then aligned the shared indirect dependencies the bump moved inenvironment/microvm,integration/microvm, andprovider/anthropic(AWS SDK,modelcontextprotocol/registry,fxamacker/cbor,pierrec/lz4,go-colorablepatch releases).No code changes were needed.
Testing
go build ./...in the root module and inintegration/microvm.go test -raceoninternal/adapter/mcpbroker,internal/mcpbroker,cmd/mecak8s,internal/testutil/identityharness, and the MCP broker tests ininternal/app.task test:module-metadata: passes; a secondtask tidychanges nothing.GOWORK=off go build -mod=readonly ./...in every module.provider/anthropictests;environment/microvmbuilds.task lint: clean except the existing gosec finding inenvironment/microvm/launch_ownership_darwin.go.API compatibility
No wire, engine API, or stored-data change.