Release/1.0.9 - #6486
Conversation
Signed-off-by: prakhar-singh1928 <prakhar.singh1928@ibm.com>
Signed-off-by: prakhar-singh1928 <prakhar.singh1928@ibm.com>
e7689c1 to
589c69f
Compare
Signed-off-by: Lang-Akshay <akshay.shinde26@ibm.com>
Signed-off-by: Lang-Akshay <akshay.shinde26@ibm.com>
msureshkumar88
left a comment
msureshkumar88
left a comment
There was a problem hiding this comment.
Thanks for putting the 1.0.9 bump together — the version propagation is clean almost everywhere, and I validated the release artifacts end to end before reviewing:
make dist+make verifyproduce a 1.0.9 wheel/sdist, pyroma 10/10, sdist and VCS file lists matchmake docker-prodbuilds successfully; image labelorg.opencontainers.image.version=1.0.9, container comes up healthy and/versionreports 1.0.9cargo check -p contextforge_mcp_runtime --testsis clean (0 warnings) with the test-helper change in placehelm lint charts/mcp-stackpasses, chart renders asmcp-stack-1.0.9- Live smoke against the built image: admin login, admin UI panels render, gateway federation + tool discovery,
/rpctool invocation, and virtual-servertools/list/tools/callall work
Blocking
charts/mcp-stack/values.yaml:1065 — migration job image tag is still v1.0.8
image:
repository: ghcr.io/ibm/mcp-context-forge
tag: "v1.0.8" # Should match mcpContextForge.image.tagtemplates/job-migration.yaml:52 renders this as {{ .Values.migration.image.repository }}:{{ .Values.migration.image.tag }}, so a 1.0.9 Helm install would run the Alembic migration job on the 1.0.8 image against a 1.0.9 gateway. The inline comment on that same line already says it should match mcpContextForge.image.tag (correctly bumped at line 88). Bumping this to v1.0.9 resolves it.
Suggestions (non-blocking)
Consider extending .bumpversion.cfg so this can't recur. It currently covers only mcpgateway/__init__.py, pyproject.toml, Cargo.toml, charts/mcp-stack/Chart.yaml and SECURITY.md. That leaves charts/mcp-stack/values.yaml (both image tags), Containerfile, plugins/external/cedar/pyproject.toml and plugins/external/opa/pyproject.toml to be edited by hand every release — which is exactly where the miss above happened. Adding them as [bumpversion:file(...)] entries would be a nice follow-up, either here or separately.
crates/mcp_runtime/src/lib.rs — ensure_test_auth_secret(). The switch from Once::call_once to a check-then-set is a behaviour change that's unrelated to the version bump, and it drops the serialization that made the unsafe { set_var(...) } sound. Rust 2024 marks set_var unsafe specifically because of the concurrent getenv/setenv race, and the tests run multi-threaded, so two threads can now observe the var as unset and both call set_var. The original // SAFETY: comment went away with the Once as well. If the goal was to re-set the var when a test clears it, keeping the Once for the initial set (or wrapping the check-and-set in a Mutex) would preserve that guarantee — and it'd be worth a line in the PR description explaining the change either way.
PR description. The template is still unfilled (no linked issue, summary, or verification section). Filling in at least the summary and verification commands would help whoever audits this release later.
Signed-off-by: prakhar-singh1928 <prakhar.singh1928@ibm.com>
Signed-off-by: Lang-Akshay <akshay.shinde26@ibm.com>
Signed-off-by: Lang-Akshay <akshay.shinde26@ibm.com>
Signed-off-by: Lang-Akshay <akshay.shinde26@ibm.com>
jonpspri
added
the
MUST
chore: release v1.0.9 — mTLS, OAuth Quick Wins, Tool Preview, Catalog Actions, and Security Hardening
msureshkumar88
left a comment
msureshkumar88
left a comment
There was a problem hiding this comment.
The migration job image tag is fixed at the current head (charts/mcp-stack/values.yaml:1065 v1.0.9), CHANGELOG has the 1.0.9 section, and everything I validated on the earlier revision — dist/wheel build, helm lint, container build/health, cargo check, and a live black-box pass through the admin UI, federation, and RPC — still holds since none of that touched the file that changed since. Approving.
Signed-off-by: prakhar-singh1928 <prakhar.singh1928@ibm.com>
brian-hussey
left a comment
brian-hussey
left a comment
There was a problem hiding this comment.
All processes followed for team clearance and all changes here look good. Approving.
6 participants
[1.0.9] - 2026-08-31 - mTLS, OAuth Quick Wins, Tool Preview, Catalog Actions, and Security Hardening
Overview
Release 1.0.9 consolidates 42 PRs focused on inbound mTLS client certificate auth, MCP server OAuth improvements, tool preview and schema publishing, catalog gateway actions, TLS/SSL enhancements, and security hardening:
Added
Security & Auth
API & Platform
Operations & Tooling
Fixed
Security & Auth
Gateway & Platform
Deprecations & Cleanup
Build & CI
Changed
Documentation
Chores