Update module github.com/stacklok/toolhive to v0.29.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/stacklok/toolhive	v0.28.3 → v0.29.0

---

Release Notes

stacklok/toolhive (github.com/stacklok/toolhive)

v0.29.0

Compare Source

What's Changed

• Admit obo in MCPExternalAuthConfig CRD enum by @​tgrunnagle in #​5361
• Consolidate authserver DCR types onto pkg/oauthproto by @​tgrunnagle in #​5372
• Add CIMD storage decorator for embedded AS by @​amirejaz in #​5343
• Address post-approval review feedback on VirtualMCPServer authz by @​blkt in #​5368
• Clear all cached registry tokens on logout by @​rdimitrov in #​5382
• Wire CIMD config through embedded AS and enable storage decorator by @​amirejaz in #​5348
• Refresh docs/arch/ to match current codebase by @​JAORMX in #​5388
• Freeze MCPServer generation per pod via downward API by @​ChrisJBurns in #​5364
• Add StorageVersionMigrator controller (opt-in, default off) by @​ChrisJBurns in #​5362
• Fixed VirtualMCPCompositeToolDefinition printer columns output by @​Sanskarzz in #​5380
• Delete .claude/skills/pr-review directory by @​ChrisJBurns in #​5392
• Update github/codeql-action digest to 7211b7c by @​renovate[bot] in #​5375
• Update module github.com/stacklok/toolhive-catalog to v0.20260529.0 by @​renovate[bot] in #​5342
• Update anthropics/claude-code-action digest to 787c5a0 by @​renovate[bot] in #​5374
• Opt 12 v1beta1 CRDs into storage-version migration + CI guard by @​ChrisJBurns in #​5391
• chore: add needs-triage caller workflow by @​dussab in #​5398
• Update module github.com/stacklok/toolhive-catalog to v0.20260529.0 by @​renovate[bot] in #​5396
• Add 'thv mcp call' for invoking MCP server tools by @​JAORMX in #​5389
• Update aws-sdk-go-v2 monorepo by @​renovate[bot] in #​5406
• Update golang.org/x/exp/jsonrpc2 digest to c761662 by @​renovate[bot] in #​5404
• Update go.starlark.net digest to ec58d4b by @​renovate[bot] in #​5376
• Deprecate Roo Code client integration by @​danbarr in #​5415
• Fall back to request-token claims for opaque upstream tokens by @​cjohnhanson in #​5147
• Persist config backward-compat migrations to load path by @​danbarr in #​5416
• Isolate skills client discovery in default-client test by @​danbarr in #​5417
• dcr: support RFC 8414 §3.1 path-insertion in discovery-URL → issuer derivation by @​juzerpatanwala in #​5395
• Add workload upgrade detection package by @​JAORMX in #​5407
• Bind vMCP sessions to OIDC identity, not raw token bytes by @​jhrozek in #​5378
• Add upgrade-check REST endpoints for workloads by @​JAORMX in #​5408
• Add thv upgrade check and list --check-upgrades by @​JAORMX in #​5409
• Add Applier for upgrading workloads in place by @​JAORMX in #​5410
• Surface StorageVersionMigrator behind chart feature flag (opt-in) by @​ChrisJBurns in #​5418
• Validate CIMD scope, grant_types and response_types against AS policy by @​amirejaz in #​5385
• Add upgrade apply for the CLI and API by @​JAORMX in #​5411
• Add e2e coverage and lifecycle docs for upgrades by @​JAORMX in #​5412
• Update goreleaser/goreleaser-action digest to 5daf1e9 by @​renovate[bot] in #​5405
• Expose CIMD config in MCPExternalAuthConfig CRD by @​amirejaz in #​5384
• Update module github.com/stacklok/toolhive-catalog to v0.20260603.0 by @​renovate[bot] in #​5413
• Migrate container client to moby/moby modules by @​rdimitrov in #​5420
• Ignore go1.26.4 stdlib vulns in govulncheck until toolchain bump by @​rdimitrov in #​5425
• Release v0.29.0 by @​toolhive-release-app[bot] in #​5424

New Contributors

• @​cjohnhanson made their first contribution in #​5147
• @​juzerpatanwala made their first contribution in #​5395

Full Changelog: stacklok/toolhive@v0.28.3...v0.29.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 15 additional dependencies were updated

Details:

Package	Change
github.com/aws/aws-sdk-go-v2	v1.41.8 -> v1.41.9
github.com/aws/aws-sdk-go-v2/config	v1.32.19 -> v1.32.20
github.com/aws/aws-sdk-go-v2/credentials	v1.19.18 -> v1.19.19
github.com/aws/aws-sdk-go-v2/feature/ec2/imds	v1.18.24 -> v1.18.25
github.com/aws/aws-sdk-go-v2/internal/configsources	v1.4.24 -> v1.4.25
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2	v2.7.24 -> v2.7.25
github.com/aws/aws-sdk-go-v2/internal/v4a	v1.4.25 -> v1.4.26
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding	v1.13.9 -> v1.13.10
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url	v1.13.24 -> v1.13.25
github.com/aws/aws-sdk-go-v2/service/signin	v1.1.0 -> v1.1.1
github.com/aws/aws-sdk-go-v2/service/sso	v1.30.18 -> v1.30.19
github.com/aws/aws-sdk-go-v2/service/ssooidc	v1.36.1 -> v1.36.2
github.com/aws/aws-sdk-go-v2/service/sts	v1.42.2 -> v1.42.3
github.com/aws/smithy-go	v1.25.1 -> v1.26.0
golang.org/x/exp/jsonrpc2	v0.0.0-20260508232706-74f9aab9d74a -> v0.0.0-20260529124908-c761662dc8c9