fix(deps): update module github.com/stacklok/toolhive-core to v0.0.37

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/stacklok/toolhive-core	v0.0.29 → v0.0.37

---

Release Notes

stacklok/toolhive-core (github.com/stacklok/toolhive-core)

v0.0.37

Compare Source

What's Changed

• Add telemetry providers package with OTLP and Prometheus exporters by @​JAORMX in #​204
• Add container images keychain helpers by @​JAORMX in #​206
• Add MCP audit event constants and audit logger by @​JAORMX in #​207

Full Changelog: stacklok/toolhive-core@v0.0.36...v0.0.37

v0.0.36

Compare Source

What's Changed

• Add panic handler hooks and ErrAbortHandler passthrough to recovery by @​JAORMX in #​203
• Add MCP semantic-convention histogram bucket preset by @​JAORMX in #​202
• Update aws-sdk-go-v2 monorepo by @​renovate[bot] in #​201

Full Changelog: stacklok/toolhive-core@v0.0.35...v0.0.36

v0.0.35

Compare Source

Highlights

audit: RFC 8693 act delegation-chain support (#​196) — audit events can now capture the actor identity and full delegation chain of a delegated token ("Alice's agent did X on her behalf"), not just the terminal sub. Typed {iss, sub} per hop; extra per-hop claims are structurally unloggable (in-memory only, guarded across JSON, slog.LogValuer, and fmt.Stringer); never-failing record-and-flag parsing with explicit truncated/omitted/malformed + low-cardinality malformedReason; identical slog and JSON wire shapes. This is the canonical schema for the ToolHive ecosystem — toolhive's pkg/audit migrates to it next.

go-sdk v1.7.0 final (#​200) — moves off the v1.7.0-pre.3 pre-release pin now that go-sdk final shipped with MCP protocol 2026-07-28 support, so downstream consumers no longer inherit a pre-release requirement via MVS.

What's Changed

• feat(audit): support RFC 8693 act delegation chains by @​JAORMX in #​196
• Bump go-sdk to v1.7.0 final ahead of release by @​JAORMX in #​200
• Reconstruct bundles for key-signed cosign signatures by @​jhrozek in #​197
• Export Sigstore bundle retrieval, offline verification, and identity API by @​jhrozek in #​192
• Relax pre-release go-sdk release guard to a warning in #​199
• Update module github.com/google/cel-go to v0.30.0 by @​renovate in #​191

Full Changelog: stacklok/toolhive-core@v0.0.34...v0.0.35

v0.0.34

Compare Source

v0.0.33

Compare Source

What's Changed

• Update actions/checkout action to v7.0.1 by @​renovate[bot] in #​175
• Update aws-sdk-go-v2 monorepo by @​renovate[bot] in #​177
• Add config package for shared base configuration by @​reyortiz3 in #​181
• feat(telemetry): shared metrics vocabulary + operator reconcile emitter by @​glageju in #​183

Full Changelog: stacklok/toolhive-core@v0.0.32...v0.0.33

v0.0.32

Compare Source

Completions, resource templates, resource subscribe/unsubscribe handlers, per-session server->client notification relay, and sampling — enabling the ToolHive vMCP aggregator to be MCP-conformant. See #​174.

v0.0.30

Compare Source

Add per-session prompt support (SessionWithPrompts) so consumers can inject prompts per session that are served by both prompts/list and prompts/get. See #​172.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 3am on friday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 2 additional dependencies were updated

Details:

Package	Change
google.golang.org/genproto/googleapis/rpc	v0.0.0-20260523011958-0a33c5d7ca68 -> v0.0.0-20260526163538-3dc84a4a5aaa
google.golang.org/grpc	v1.82.0 -> v1.82.1

[github-actions]

Registry Build Preview

All registries built successfully!

Registry: official

• Total Servers: 84
  • Container-based: 52
  • Remote: 32
• Skills: 0
• File Size: 2.5M
• Last Updated: 2026-07-30T18:58:20Z

Registry: toolhive

• Total Servers: 110
  • Container-based: 78
  • Remote: 32
• Skills: 180
• File Size: 3.0M
• Last Updated: 2026-07-30T18:58:20Z