Update docker images

.github/workflows/claude.yml

@@ -1,7 +1,10 @@
 name: Claude PR Assistant
 
 on:
-  issue_comment:
+  # Required for @claude commands; the job gates comment author associations,
+  # and the pinned action checks the invoking actor's repository write access.
+  # Invocation authorizes a privileged coding agent, not sandboxed PR analysis.
+  issue_comment: # zizmor: ignore[dangerous-triggers]
     types: [created]
   pull_request_review_comment:
     types: [created]
@@ -78,8 +81,7 @@ jobs:
           ANTHROPIC_BASE_URL: ${{ vars.ANTHROPIC_BASE_URL }}
         with:
           anthropic_api_key: ${{ secrets.STACKLOK_GATEWAY_KEY_CLAUDE_TAG }}
-          # Security: Restrict tools to prevent arbitrary code execution.
-          # Bash is scoped to known-safe commands (task, go, git, helm-docs).
-          # No unrestricted Bash access — prevents prompt injection from
-          # executing arbitrary shell commands via crafted issue/PR content.
-          allowed_tools: "Read,Edit,Write,Glob,Grep,Bash(task *),Bash(go *),Bash(git *),Bash(helm-docs *),mcp__github__*"
+          # Limit preapproved tools; these commands can execute repository code
+          # and are not a sandbox against prompt injection.
+          claude_args: >-
+            --allowedTools "Read,Edit,Write,Glob,Grep,Bash(task *),Bash(go *),Bash(git *),Bash(helm-docs *),mcp__github__*"

.github/workflows/e2e-tests.yml

@@ -163,7 +163,7 @@ jobs:
           fi
           # Envoy is only used by the network-isolation test suite
           if [ "${{ matrix.title }}" = "network-isolation" ]; then
-            images="$images envoyproxy/envoy:distroless-v1.39.1@sha256:eb2c01c13125d1629637cb4e4cce7207009fb7cc2c8027f9742758549d15b6f4 python:3.15-slim@sha256:ea4f1f290e071bf7d28199cfb3e09f5dbad31b50e9c32fd58f2f2d7be915f3ae"
+            images="$images envoyproxy/envoy:distroless-v1.39.1@sha256:eb2c01c13125d1629637cb4e4cce7207009fb7cc2c8027f9742758549d15b6f4 python:3.15-slim@sha256:2da676046630d7bf14c6764ae1143dc7fa0377a53f94bf5a642f0b214aca5bce"
           fi
 
           for server in $servers; do

.github/workflows/retest.yaml

@@ -26,7 +26,9 @@
 name: Retest Action on PR Comment
 
 on:
-  issue_comment:
+  # Required for /retest; trusted authors can only rerun pull_request workflows.
+  # No PR checkout or execution; event values are passed through quoted env vars.
+  issue_comment: # zizmor: ignore[dangerous-triggers]
     types: [created]
 
 # Default everything to read-only; the job below opts into the minimum it needs.
@@ -71,7 +73,8 @@ jobs:
 
           # Capture the query separately so a transient API failure surfaces as
           # an error (set -e) rather than being mistaken for "nothing to retry".
-          runs_json=$(gh api "repos/$REPO/actions/runs?head_sha=$head_sha&per_page=100")
+          # Only replay pull_request CI, never push, release, or other privileged runs.
+          runs_json=$(gh api "repos/$REPO/actions/runs?event=pull_request&head_sha=$head_sha&per_page=100")
           mapfile -t run_ids < <(jq -r \
             '.workflow_runs[] | select(.conclusion=="failure" or .conclusion=="cancelled" or .conclusion=="timed_out") | .id' \
             <<<"$runs_json")

.github/workflows/security-scan.yml

@@ -72,7 +72,7 @@ jobs:
       - name: Report findings
         uses: zizmorcore/zizmor-action@85b2b9fb8e3325e7a23d7d0a9d7ba5ae0f999e3e # v0.7.1
         with:
-          version: "1.30.1"
+          version: "1.31.1"
           inputs: .github/
           persona: regular
 
@@ -90,7 +90,7 @@ jobs:
       - name: Fail on new findings
         uses: zizmorcore/zizmor-action@85b2b9fb8e3325e7a23d7d0a9d7ba5ae0f999e3e # v0.7.1
         with:
-          version: "1.30.1"
+          version: "1.31.1"
           inputs: .github/
           persona: regular
           min-severity: medium

cmd/thv/app/inspector/version.go

@@ -7,4 +7,4 @@ package inspector
 // Image specifies the image to use for the inspector command.
 // TODO: This could probably be a flag with a sensible default
 // Pinning to a specific version for stability.
-var Image = "ghcr.io/modelcontextprotocol/inspector:2.10.1"
+var Image = "ghcr.io/modelcontextprotocol/inspector:2.11.0"

deploy/charts/operator/README.md

@@ -99,8 +99,8 @@ The command removes all the Kubernetes components associated with the chart and
 | operator.vmcpImage | string | `"ghcr.io/stacklok/toolhive/vmcp:v0.54.0"` | Container image for Virtual MCP Server (vMCP) deployments created by the operator. |
 | operator.volumeMounts | list | `[]` | Additional volume mounts for the operator container. |
 | operator.volumes | list | `[]` | Additional volumes for the operator pod. |
-| registryAPI | object | `{"image":"ghcr.io/stacklok/thv-registry-api:v1.5.2"}` | Settings for the registry API workloads created by the operator. |
-| registryAPI.image | string | `"ghcr.io/stacklok/thv-registry-api:v1.5.2"` | Container image for registry API workloads created by the operator. |
+| registryAPI | object | `{"image":"ghcr.io/stacklok/thv-registry-api:v1.5.3"}` | Settings for the registry API workloads created by the operator. |
+| registryAPI.image | string | `"ghcr.io/stacklok/thv-registry-api:v1.5.3"` | Container image for registry API workloads created by the operator. |
 
 ## Contributing
 

deploy/charts/operator/values.yaml

@@ -261,4 +261,4 @@ operator:
 # -- Settings for the registry API workloads created by the operator.
 registryAPI:
   # -- Container image for registry API workloads created by the operator.
-  image: "ghcr.io/stacklok/thv-registry-api:v1.5.2"
+  image: "ghcr.io/stacklok/thv-registry-api:v1.5.3"

test/e2e/images/images.go

@@ -42,7 +42,7 @@ const (
 	// in Kubernetes tests. These run Flask-based Python services for testing authentication flows.
 	PythonImage = pythonImageURL + ":" + pythonImageTag
 
-	networkFixtureImageDigest = "sha256:ea4f1f290e071bf7d28199cfb3e09f5dbad31b50e9c32fd58f2f2d7be915f3ae"
+	networkFixtureImageDigest = "sha256:2da676046630d7bf14c6764ae1143dc7fa0377a53f94bf5a642f0b214aca5bce"
 	// NetworkFixtureImage is pinned because network-isolation tests use it for
 	// security-sensitive DNS and HTTP fixtures in the Docker-backed CI shard.
 	NetworkFixtureImage = pythonImageURL + ":" + pythonImageTag + "@" + networkFixtureImageDigest