Update module github.com/stacklok/toolhive to v0.50.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/stacklok/toolhive	v0.49.0 → v0.50.0

---

Release Notes

stacklok/toolhive (github.com/stacklok/toolhive)

v0.50.0

Compare Source

What's Changed

• Use self-repository syntax for local workflow refs by @​rdimitrov in #​6654
• Upgrade CI to Helm 4 by @​renovate[bot] in #​6614
• Update kubernetes dependencies by @​renovate[bot] in #​6589
• Simplify Renovate dependency groups by @​rdimitrov in #​6658
• Update module github.com/getsentry/sentry-go/otel to v0.49.0 by @​renovate[bot] in #​6592
• Update cli and ui libraries to v2 by @​renovate[bot] in #​6611
• Derive secrets encryption key with Argon2id by @​rdimitrov in #​6657
• Document request-claim fallback provenance by @​rdimitrov in #​6656
• Retry ID-token validation after OIDC refresh by @​siddiqueirshad in #​6559
• Enforce catalog provenance for plugin installs by @​samuv in #​6653
• Document key-pair signing trust limits by @​samuv in #​6661
• Update module github.com/cenkalti/backoff/v5 to v7 by @​renovate[bot] in #​6625
• Tolerate MethodNotFound for optional capabilities in ListCapabilities by @​hellouz818 in #​6660
• feat(authserver): support additional token-request params (RFC 8707 resource indicators) by @​aron-muon in #​6430
• feat(vmcp): stop session init stalling on backends that never service the notification stream by @​aron-muon in #​6633
• fix(vmcp): make the version poll interval per-Server, not a global by @​aron-muon in #​6644
• docs: point nine stale paths at the code that exists by @​melbinjp in #​6650
• Update module github.com/lestrrat-go/jwx/v3 to v4 by @​renovate[bot] in #​6626
• Use repo variable for Anthropic base URL by @​eleftherias in #​6672
• feat(authserver): accept ID-JAG assertions with a bound JWT-bearer handler by @​aron-muon in #​6677
• Add RFC 8628 device authorization grant support by @​reyortiz3 in #​6647
• Reduce buildProvider cyclomatic complexity by @​reyortiz3 in #​6680
• fix(operator): forward default Redis password to MCPServer and MCPRemoteProxy by @​reyortiz3 in #​6679
• Add lock-driven skill key rotation by @​samuv in #​6662
• Add plugin key rotation workflows by @​samuv in #​6663
• Add device flow verification page and DCR support by @​reyortiz3 in #​6682
• authserver/storage: add UpdateDCRCredentialsIfPresent by @​tgrunnagle in #​6674
• Release v0.50.0 by @​toolhive-release-app[bot] in #​6691

New Contributors

• @​siddiqueirshad made their first contribution in #​6559
• @​hellouz818 made their first contribution in #​6660

Full Changelog: stacklok/toolhive@v0.49.0...v0.50.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 13 additional dependencies were updated

Details:

Package	Change
github.com/stacklok/toolhive-core	v0.0.47 -> v0.0.49
github.com/fxamacker/cbor/v2	v2.9.0 -> v2.9.1
github.com/getsentry/sentry-go/otel	v0.44.1 -> v0.49.0
github.com/mattn/go-runewidth	v0.0.24 -> v0.0.27
github.com/modelcontextprotocol/go-sdk	v1.7.0 -> v1.8.0
k8s.io/api	v0.35.3 -> v0.37.0
k8s.io/apiextensions-apiserver	v0.35.0 -> v0.37.0
k8s.io/apimachinery	v0.35.3 -> v0.37.0
k8s.io/client-go	v0.35.3 -> v0.37.0
k8s.io/kube-openapi	v0.0.0-20251125145642-4e65d59e963e -> v0.0.0-20260721132016-d427ff9ee9ad
k8s.io/utils	v0.0.0-20260319190234-28399d86e0b5 -> v0.0.0-20260707023825-cf1189d6abe3
sigs.k8s.io/controller-runtime	v0.23.3 -> v0.25.0
sigs.k8s.io/structured-merge-diff/v6	v6.3.2-0.20260122202528-d9cc6641c482 -> v6.4.2

[JAORMX]

@renovate rebase