[renovate]

This PR contains the following updates:

Package	Update	Change
stacklok/toolhive	patch	v0.55.0 → v0.55.2

After this PR opens, .github/workflows/upstream-release-docs.yml adds source-verified content edits for the new release. For stacklok/toolhive, the same workflow also syncs reference assets (CLI help, Swagger) and regenerates the CRD MDX pages.

---

Release Notes

stacklok/toolhive

v0.55.2

Compare Source

Security

Rootless Podman host-access endpoints blocked by the egress proxy (GHSA-2x65-h9w3-h7hc, Medium)

With network isolation on rootless Podman, a workload could reach host services through the Squid or Envoy egress proxy using host.containers.internal or the address it maps to. ToolHive's protected set only covered Docker's host names and bridge gateways, and Podman's host-access address is not necessarily a bridge gateway.

On Podman, ToolHive now reads the DNS sidecar's runtime-generated /etc/hosts at deployment. It adds every address mapped to host.containers.internal, host.docker.internal, or gateway.docker.internal to the protected set, alongside all bridge gateways. Both proxies block those names and addresses unless --allow-docker-gateway is set.

What changes for operators

• On Podman, deployment fails before the proxy or MCP container starts if host.containers.internal is missing from the runtime's hosts file (for example with no_hosts = true in containers.conf), or if the hosts data cannot be read. This applies even with --allow-docker-gateway.
• The protected set is a deployment-time snapshot. Redeploy workloads after changing Podman's host mappings, rootless networking mode, or bridge networks.

What's Changed

• Use postflight_steps for the thv Homebrew cask hook by @​rdimitrov in #​6870
• Update go modules to v0.0.57 by @​renovate[bot] in #​6869
• Release v0.55.2 by @​toolhive-release-app[bot] in #​6871

Full Changelog: stacklok/toolhive@v0.55.1...v0.55.2

v0.55.1

Compare Source

What's Changed

• Fix flaky ignore overlay tests from shared artifact dir by @​rdimitrov in #​6854
• Publish thv to Homebrew as a cask by @​rdimitrov in #​6859
• Fix Podman client creation with compat transport by @​rdimitrov in #​6860
• Drop Go patch pin, bump toolhive-catalog, stop e2e pings by @​rdimitrov in #​6866
• Release v0.55.1 by @​toolhive-release-app[bot] in #​6868

Full Changelog: stacklok/toolhive@v0.55.0...v0.55.1

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Never, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

---

Docs update for toolhive v0.55.2

At a glance

Upstream	stacklok/toolhive v0.55.0 → v0.55.2
Hand-written changes	2 commit(s)
Reference assets	refreshed (separate commit)
Gaps	0
Owner	@rdimitrov - identified from merged release PR stacklok/toolhive#6871
Release contributors	2 review requested (see sidebar)
Action required	Spot-check skill-authored prose for accuracy

Who does what

@rdimitrov cut this release and owns this PR: review your own changes, chase the remaining approvals, and merge once they're in. You don't need to wait on a review from anyone listed as having no docs impact below.

Everyone with a review request: the target is a review and approval within 2 business days.

Summary of changes

• Updated host-access guidance in docs/toolhive/guides-cli/network-isolation.mdx to cover host.containers.internal, Podman host-alias addresses, redeploying after Podman network changes, and the deployment failure when Podman's hosts file lacks host.containers.internal (GHSA-2x65-h9w3-h7hc, stacklok/toolhive v0.55.2)
• Updated the Allow host machine access description in docs/toolhive/guides-ui/network-isolation.mdx to list host.containers.internal and Podman host-alias addresses
• No change to Homebrew install instructions: thv now publishes as a cask (Publish thv to Homebrew as a cask toolhive#6859), and brew tap stacklok/tap followed by brew install thv still resolves it. A reviewer should confirm that existing formula installs migrate cleanly. That belongs in the release notes, not the install guide.
• No docs changes for Fix Podman client creation with compat transport toolhive#6860 (Podman client compat transport fix) or the CI/test/dependency changes

Run cost

Session	Turns	Cost (USD)
Generation	30	$1.0587
Editorial review	15	$0.4944
Total	45	$1.5531

How this PR was built

Two Claude Opus sessions run per release: a generation pass
(upstream-release-docs skill, 6 phases) followed by a fresh-
context editorial pass (docs-review). Prettier/ESLint
auto-fixes are applied after.

Auto-synced paths — do not hand-edit these in review:

• static/api-specs/
• docs/toolhive/reference/cli/ (toolhive only)
• docs/toolhive/reference/crds/

If a "Gaps needing human context" section is present above,
each entry includes a paste-ready Helper prompt for local
Claude a reviewer can use to resolve the gap.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs-website	Ready	Preview	Oct 20, 2026 10:24am UTC

[claude]

Claude finished @renovate[bot]'s task in 1m 46s —— View job

---

Upstream release docs: stacklok/toolhive v0.55.2

• Discovery: read release notes and .release-meta.json
• Deep dive: checked the Podman host-access fix (GHSA-2x65-h9w3-h7hc) and the Homebrew cask change against source at v0.55.2
• Audit docs and update the network isolation pages
• Format, lint, write artifacts, commit (ba823da)

What changed in the docs

• docs/toolhive/guides-cli/network-isolation.mdx: the section on reaching the host now says:

  • --allow-docker-gateway also covers host.containers.internal.
  • On Podman, it also covers every address the runtime maps to the host names, which includes the rootless Podman host address.
  • You need to redeploy after changing Podman host mappings or the rootless networking mode.
  • On Podman, deployment fails if /etc/hosts has no host.containers.internal entry (for example with no_hosts = true). This happens with or without the flag.

  The source for this is pkg/container/docker/hostdiscovery.go, squid.go, envoy.go, and client.go:281.

• docs/toolhive/guides-ui/network-isolation.mdx: Allow host machine access now lists host.containers.internal and the Podman host addresses.

Left unchanged

• Homebrew install steps: Publish thv to Homebrew as a cask toolhive#6859 now publishes thv as a cask (.goreleaser.yaml homebrew_casks). brew tap stacklok/tap followed by brew install thv still works, so I left the install and quickstart pages alone. A reviewer should confirm that existing formula installs move over to the cask cleanly. If anything is needed there, it belongs in the release notes.
• Fix Podman client creation with compat transport toolhive#6860 (Podman client fix), CI, test, and dependency changes don't need docs.

Checks

• npm run prettier:fix and npm run eslint:fix ran clean.
• I didn't run npm run build; the only edits are prose to existing pages.

[claude]

Claude finished @renovate[bot]'s task in 1m 12s —— View job

---

Editorial review of the v0.55.2 docs changes

• Find files changed in the last commit
• Run /docs-review on guides-cli/network-isolation.mdx and guides-ui/network-isolation.mdx
• Check the claims against the upstream source
• Apply fixes, then run prettier and eslint
• Commit and push (a3aefa6)

Summary

I checked the Podman host-access content in both network isolation guides against upstream v0.55.2, and it matches:

• The --allow-docker-gateway help text in cmd/thv/app/run_flags.go lists host.containers.internal.
• pkg/container/docker/squid.go and the host-discovery code read the hosts file and handle these aliases.
• client_deploy_test.go confirms that deployment fails when the hosts file has no host.containers.internal entry.

I found no structure or accuracy problems in either page.

Fixes applied (docs/toolhive/guides-cli/network-isolation.mdx)

• Bold label: I renamed "Reaching the host with host.docker.internal" to "Reaching the host machine". The paragraph now covers both Docker and Podman hostnames. No other page links to this label.
• Passive voice: I changed "Host gateway addresses are blocked by an explicit deny in the egress proxy" to "The egress proxy blocks host gateway addresses with an explicit deny".

I made no changes to docs/toolhive/guides-ui/network-isolation.mdx. I didn't touch the auto-generated reference files (reference/cli/, reference/helm/). Prettier and ESLint ran over the whole repo, and the only change was rewrapping the edited paragraph.
· Branch: renovate/stacklok-toolhive-0.x