Update module github.com/stacklok/toolhive-core to v0.0.23

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/stacklok/toolhive-core	v0.0.21 → v0.0.23

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

stacklok/toolhive-core (github.com/stacklok/toolhive-core)

v0.0.23

Compare Source

What's Changed

• Update golangci/golangci-lint-action action to v9.2.1 by @​renovate[bot] in #​113
• Update module golang.org/x/net to v0.55.0 by @​renovate[bot] in #​114
• Update aws-sdk-go-v2 monorepo by @​renovate[bot] in #​115
• Update module github.com/mark3labs/mcp-go to v0.54.1 by @​renovate[bot] in #​116
• Update module github.com/redis/go-redis/v9 to v9.20.0 by @​renovate[bot] in #​117

Full Changelog: stacklok/toolhive-core@v0.0.22...v0.0.23

v0.0.22

Compare Source

What's Changed

• Update module github.com/google/go-containerregistry to v0.21.6 by @​renovate[bot] in #​112
• Add shared postgres client package by @​reyortiz3 in #​111
• Add stateless field to registry server types by @​gkatz2 in #​89

New Contributors

• @​gkatz2 made their first contribution in #​89

Full Changelog: stacklok/toolhive-core@v0.0.21...v0.0.22

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 6 additional dependencies were updated

Details:

Package	Change
github.com/google/go-containerregistry	v0.21.5 -> v0.21.6
github.com/mark3labs/mcp-go	v0.54.0 -> v0.54.1
github.com/redis/go-redis/v9	v9.19.0 -> v9.20.0
github.com/docker/cli	v29.4.0+incompatible -> v29.4.3+incompatible
github.com/klauspost/compress	v1.18.5 -> v1.18.6
golang.org/x/tools	v0.44.0 -> v0.45.0

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 68.84%. Comparing base (ab2d3a1) to head (b5dec35).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #5317   +/-   ##
=======================================
  Coverage   68.84%   68.84%           
=======================================
  Files         634      634           
  Lines       64433    64433           
=======================================
+ Hits        44358    44361    +3     
+ Misses      16795    16790    -5     
- Partials     3280     3282    +2     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

[rdimitrov]

🚫 Please don't merge yet — this can't go green until an upstream library ships a fix. Requesting changes so it isn't merged by accident.

What's broken, in plain terms

Downloading a container image is like carrying boxes (the image's "layers") into a room one at a time. A new version of the go-containerregistry library added a rule: only 4 people can carry boxes at once, and each carrier must hand their badge back when they finish a box. But there's a bug — they never hand the badge back. After 4 boxes, everyone is holding a badge, nobody can grab one, and the line freezes forever.

ToolHive downloads every image this way, so any image with 5+ layers (like the time test server) freezes mid-download and never finishes. Our E2E Tests Core (proxy) job then waits and waits until the whole 15-minute run gives up — that's the red ❌ you keep seeing. (Smaller images, or ones already downloaded, have ≤4 boxes, so they're fine — which is why only this one test hangs.)

Why this PR triggers it

• This PR updates toolhive-core to v0.0.23.
• v0.0.23 quietly pulls in the buggy library version — go-containerregistry v0.21.6.
• So this PR inherits the freeze. Nothing in the PR's own code is wrong.

The good news

The bug is already fixed upstream (google/go-containerregistry#2308 — "close the box, hand the badge back"). But that fix came out 3 days after the broken v0.21.6 was released, so there is no released version with the fix yet.

What to do

Wait for go-containerregistry to publish a new release (> v0.21.6) that includes the fix, then this PR will pass and can be merged. If we need toolhive-core v0.0.23 sooner, we can temporarily force the old, working library version (replace github.com/google/go-containerregistry => …@v0.21.5 in go.mod) — already tested and confirmed working — and remove it once the fixed release lands.

Heads-up: this freeze will hit any PR that pulls in go-containerregistry v0.21.6, not just this one.