fix(deps): update module github.com/stacklok/toolhive to v0.8.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/stacklok/toolhive	v0.7.2 → v0.8.0

---

Release Notes

stacklok/toolhive (github.com/stacklok/toolhive)

v0.8.0

Compare Source

What's Changed

• Fix keyctl password not re-prompted after incorrect entry by @​JAORMX in #​3334
• Update toolhive images to v0.7.2 by @​renovate[bot] in #​3336
• Update registry from toolhive-registry release v2026.01.19 by @​github-actions[bot] in #​3333
• Add thv status command for detailed workload info by @​carlos-gn in #​3161
• Call audit config validation in vMCP server by @​yrobla in #​3340
• Update anthropics/claude-code-action digest to a017b83 by @​renovate[bot] in #​3326
• Simplify redirect URI validation in autheserver upstream package to use fosite by @​jhrozek in #​3339
• Add contributor guidelines for issue claiming and expectations by @​JAORMX in #​3341
• Fix race condition in auth server tests by @​dmjb in #​3343
• Create E2E suite for ToolHive REST API by @​dmjb in #​3288
• Update module github.com/olekukonko/tablewriter to v1.1.3 by @​renovate[bot] in #​3324
• Update actions/cache digest to 8b402f5 by @​renovate[bot] in #​3322
• Add UserInfo fetching support to authserver's upstream OAuth2 provider by @​jhrozek in #​3344
• Fix 413 error conversion bug in request body middleware by @​dmjb in #​3350
• Add shared pkg/oauth for OAuth/OIDC types and constants by @​jhrozek in #​3349
• Update registry from toolhive-registry release v2026.01.20 by @​github-actions[bot] in #​3352
• Remove VMCP-specific env var from generic auth code by @​yrobla in #​3342
• Consolidate PKCE to use golang.org/x/oauth2 stdlib functions by @​jhrozek in #​3351
• Add OAuth handler infrastructure and discovery endpoints by @​jhrozek in #​3321
• Fix workload update API by using background context for async operation by @​amirejaz in #​3307
• Update maintainers by @​jhrozek in #​3355
• Add dynamic/static mode support to VirtualMCPServer operator by @​yrobla in #​3235
• Run the API E2E test server as a standalone process by @​dmjb in #​3356
• feat(vmcp): integrate a dummy optimizer by @​jerm-dro in #​3312
• Update alpine Docker tag to v3.23.2 by @​renovate[bot] in #​2895
• Add UserStorage interface to authserver for multi-IDP support by @​jhrozek in #​3358
• Bump MCP Inspector source image and add to Renovate by @​danbarr in #​3364
• Update registry from toolhive-registry release v2026.01.21 by @​github-actions[bot] in #​3365
• Add SPDX license headers to all Go files by @​JAORMX in #​3366
• Add validation in create workloads endpoint by @​dmjb in #​3367
• Add logging guidelines by @​eleftherias in #​3338
• fix: correct transport type reporting in workload list endpoint by @​Sanskarzz in #​3313
• Document SPDX license header requirements by @​JAORMX in #​3371
• Remove none secrets provider by @​JAORMX in #​3369
• fix(config): migrate another telemetry config by @​jerm-dro in #​3328
• Fix SSE response processor rewrite logic by @​blkt in #​3381
• Handle context cancellation in proxy logs by @​eleftherias in #​3378
• Add MCPRemoteProxy controller integration tests by @​ChrisJBurns in #​3376
• Update anchore/sbom-action action to v0.22.0 by @​renovate[bot] in #​3387
• Update registry from toolhive-registry release v2026.01.22 by @​github-actions[bot] in #​3392
• Update actions/setup-python digest to a309ff8 by @​renovate[bot] in #​3394
• Update anthropics/claude-code-action digest to 2316a9a by @​renovate[bot] in #​3390
• Migrate proposals to toolhive-rfcs repository by @​JAORMX in #​3395
• Update peter-evans/create-pull-request digest to c0f553f by @​renovate[bot] in #​3374
• First phase of API e2e tests by @​dmjb in #​3348

New Contributors

• @​Sanskarzz made their first contribution in #​3313

Full Changelog: stacklok/toolhive@v0.7.2...v0.8.0

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

🔒 MCP Security Scan Results

✅ adb-mysql-mcp-server

• Status: Passed
• Tools scanned: 0
• Result: No security issues detected

⚠️ agentql-mcp

• Status: Warning
• Message: No JSON output found in scan results (insecure_ignore is enabled)

✅ arxiv-mcp-server

• Status: Passed
• Tools scanned: 0
• Result: No security issues detected

✅ astra-db-mcp

• Status: Passed
• Tools scanned: 0
• Result: No security issues detected

✅ aws-diagram

• Status: Passed
• Tools scanned: 0
• Result: No security issues detected

✅ aws-documentation

• Status: Passed
• Tools scanned: 0
• Result: No security issues detected

✅ blender-mcp

• Status: Passed
• Tools scanned: 0
• Result: No security issues detected

⚠️ brightdata-mcp

• Status: Warning
• Message: No JSON output found in scan results (insecure_ignore is enabled)

⚠️ browserbase-mcp-server

• Status: Warning
• Message: No JSON output found in scan results (insecure_ignore is enabled)

✅ chroma-mcp

• Status: Passed
• Tools scanned: 0
• Result: No security issues detected

✅ chrome-devtools-mcp

• Status: Passed
• Tools scanned: 0
• Result: No security issues detected

✅ context7

• Status: Passed
• Tools scanned: 0
• Result: No security issues detected

⚠️ graphlit-mcp-server

• Status: Warning
• Message: No JSON output found in scan results (insecure_ignore is enabled)

⚠️ heroku-mcp-server

• Status: Warning
• Message: No JSON output found in scan results (insecure_ignore is enabled)

✅ ida-pro-mcp

• Status: Passed
• Tools scanned: 0
• Result: No security issues detected

⚠️ launchdarkly-mcp-server

• Status: Warning
• Message: No JSON output found in scan results (insecure_ignore is enabled)

⚠️ magic-mcp

• Status: Warning
• Message: Could not parse scan results (insecure_ignore is enabled): Expecting property name enclosed in double quotes: line 1 column 2 (char 1)

✅ mcp-clickhouse

• Status: Passed
• Tools scanned: 0
• Result: No security issues detected

⚠️ mcp-jetbrains

• Status: Warning
• Message: No JSON output found in scan results (insecure_ignore is enabled)

⚠️ mcp-neo4j-aura-manager

• Status: Warning
• Message: No JSON output found in scan results (insecure_ignore is enabled)

✅ mcp-neo4j-cypher

• Status: Passed
• Tools scanned: 0
• Result: No security issues detected

⚠️ mcp-neo4j-memory

• Status: Warning
• Message: No JSON output found in scan results (insecure_ignore is enabled)

⚠️ mcp-server-box

• Status: Warning
• Message: No JSON output found in scan results (insecure_ignore is enabled)

✅ mcp-server-circleci

• Status: Passed
• Tools scanned: 0
• Result: No security issues detected

⚠️ mcp-server-neon

• Status: Warning
• Message: No JSON output found in scan results (insecure_ignore is enabled)

⚠️ netbird

• Status: Warning
• Message: No JSON output found in scan results (insecure_ignore is enabled)

✅ notion

• Status: Passed
• Tools scanned: 0
• Result: No security issues detected

✅ onchain-mcp

• Status: Passed
• Tools scanned: 0
• Result: No security issues detected

✅ pagerduty-mcp

• Status: Passed
• Tools scanned: 0
• Result: No security issues detected

⚠️ phoenix-mcp

• Status: Warning
• Message: No JSON output found in scan results (insecure_ignore is enabled)

⚠️ playwright-mcp

• Status: Error
• Message: No JSON output found in scan results

⚠️ sentry-mcp-server

• Status: Warning
• Message: No JSON output found in scan results (insecure_ignore is enabled)

⚠️ supabase-mcp-server

• Status: Warning
• Message: No JSON output found in scan results (insecure_ignore is enabled)

⚠️ tavily-mcp

• Status: Warning
• Message: No JSON output found in scan results (insecure_ignore is enabled)

---

Summary: Scanned 34 MCP server(s), all passed security checks. ✅