build(deps): Bump mcp-contextforge-gateway from 1.0.0rc1 to 1.0.6

[dependabot]

Bumps mcp-contextforge-gateway from 1.0.0rc1 to 1.0.6.

Release notes

Sourced from mcp-contextforge-gateway's releases.

v1.0.6 - OAuth Token Exchange, Vault Credentials, MCP Apps, Dataplane Publishing, and Security Hardening

[1.0.6] - 2026-07-22 - OAuth Token Exchange, Vault Credentials, MCP Apps, Dataplane Publishing, and Security Hardening

Overview

Release 1.0.6 consolidates 61 PRs focused on OAuth RFC 8693 token exchange, HashiCorp Vault per-user credential resolution, MCP Apps support, dataplane resource and tool publishing, SSRF/TLS security hardening, plugin observability, and CI/DevOps improvements:

• Security - SSRF/TLS validation in gRPC endpoint, SSRF validation for all OAuth config URLs, CSP modernisation, output neutralisation (CWE-117), global SSRF flag respected in gateway test endpoint, output-length guard resource bypass fix, and stricter auth-header key validation.
• OAuth & Auth - RFC 8693 On-Behalf-Of token exchange for OAuth gateways, unified email extraction across all resource operations, and Keycloak test-user collision fix.
• Vault - Per-user credential resolution from HashiCorp Vault for all auth types.
• MCP Apps - New MCP Apps support added to the platform.
• Dataplane - Publish original tool names, streamable-HTTP-only backends, resource URIs and capabilities, per-worker lock IDs with safer key TTL.
• Plugins - CPEX plugin trace context and metrics (G0+G1), metrics from 5 remaining bundled cpex-* plugins, single-worker initialisation across instances, fork-poisoned FileLock rebuild.
• API & Fixes - Bootstrap race condition fix, resource proxy templated reads, savepoint for personal-team cascade delete, 404 for missing server/gateway deletes, team invitation duplicate membership check.
• CI / DevOps - PR-scoped pyright workflow, s390x build flag, remove Slack direct-merge notification, remove Renovate in favour of Dependabot, Redis maxclients increase.

Breaking Changes

• Stricter auth_headers Key Validation (Gateways, Tools, A2A Agents) (#5314) - Header-key validation is now shared across all create/update schemas and the admin form. Keys with embedded whitespace (e.g. X Api Key) were previously accepted and stored as invalid HTTP header names that failed at invocation time; they are now rejected with a 422 at config time, and surrounding whitespace is trimmed before storage. Gateway or A2A configs relying on the old behaviour will need their header keys corrected on the next update.

  	Before 1.0.6	From 1.0.6
  Header key X Api Key	Accepted, stored, failed at invocation	Rejected with HTTP 422 at config time
  Header key Authorization	Accepted with leading/trailing spaces	Stored as Authorization (trimmed)

Added

API & Platform

• POST /v1/mcp-servers/test Endpoint (#5443) - Added POST endpoint for connection testing.
• GET /v1/resources/test/{resource_uri} Endpoint (#5455) - Added public resource test endpoint.
• MCP Apps Support (#5079) - Added MCP Apps support to the platform.

OAuth & Auth

• RFC 8693 Token Exchange (#5224) - Added On-Behalf-Of token exchange for OAuth gateways per RFC 8693.

Vault

• Per-User Vault Credential Resolution (#5651) - Resolve per-user credentials from HashiCorp Vault for all auth types.

Plugins & Observability

• CPEX Plugin Trace Context and Metrics (#5470) - Build and consume CPEX plugin trace context and metrics (G0+G1).
• Remaining CPEX Plugin Metrics (#5611) - Consume metrics from 5 remaining bundled cpex-* plugins.

Dataplane

• Publish Resource URIs and Capabilities (#5588) - Publish dataplane resource URIs and capabilities.

... (truncated)

Changelog

Sourced from mcp-contextforge-gateway's changelog.

[1.0.6] - 2026-07-22 - OAuth Token Exchange, Vault Credentials, MCP Apps, Dataplane Publishing, and Security Hardening

Overview

Release 1.0.6 consolidates 61 PRs focused on OAuth RFC 8693 token exchange, HashiCorp Vault per-user credential resolution, MCP Apps support, dataplane resource and tool publishing, SSRF/TLS security hardening, plugin observability, and CI/DevOps improvements:

• Security - SSRF/TLS validation in gRPC endpoint, SSRF validation for all OAuth config URLs, CSP modernisation, output neutralisation (CWE-117), global SSRF flag respected in gateway test endpoint, output-length guard resource bypass fix, and stricter auth-header key validation.
• OAuth & Auth - RFC 8693 On-Behalf-Of token exchange for OAuth gateways, unified email extraction across all resource operations, and Keycloak test-user collision fix.
• Vault - Per-user credential resolution from HashiCorp Vault for all auth types.
• MCP Apps - New MCP Apps support added to the platform.
• Dataplane - Publish original tool names, streamable-HTTP-only backends, resource URIs and capabilities, per-worker lock IDs with safer key TTL.
• Plugins - CPEX plugin trace context and metrics (G0+G1), metrics from 5 remaining bundled cpex-* plugins, single-worker initialisation across instances, fork-poisoned FileLock rebuild.
• API & Fixes - Bootstrap race condition fix, resource proxy templated reads, savepoint for personal-team cascade delete, 404 for missing server/gateway deletes, team invitation duplicate membership check.
• CI / DevOps - PR-scoped pyright workflow, s390x build flag, remove Slack direct-merge notification, remove Renovate in favour of Dependabot, Redis maxclients increase.

Breaking Changes

• Stricter auth_headers Key Validation (Gateways, Tools, A2A Agents) (#5314) - Header-key validation is now shared across all create/update schemas and the admin form. Keys with embedded whitespace (e.g. X Api Key) were previously accepted and stored as invalid HTTP header names that failed at invocation time; they are now rejected with a 422 at config time, and surrounding whitespace is trimmed before storage. Gateway or A2A configs relying on the old behaviour will need their header keys corrected on the next update.

  	Before 1.0.6	From 1.0.6
  Header key X Api Key	Accepted, stored, failed at invocation	Rejected with HTTP 422 at config time
  Header key Authorization	Accepted with leading/trailing spaces	Stored as Authorization (trimmed)

Added

API & Platform

• POST /v1/mcp-servers/test Endpoint (#5443) - Added POST endpoint for connection testing.
• GET /v1/resources/test/{resource_uri} Endpoint (#5455) - Added public resource test endpoint.
• MCP Apps Support (#5079) - Added MCP Apps support to the platform.

OAuth & Auth

• RFC 8693 Token Exchange (#5224) - Added On-Behalf-Of token exchange for OAuth gateways per RFC 8693.

Vault

• Per-User Vault Credential Resolution (#5651) - Resolve per-user credentials from HashiCorp Vault for all auth types.

Plugins & Observability

• CPEX Plugin Trace Context and Metrics (#5470) - Build and consume CPEX plugin trace context and metrics (G0+G1).
• Remaining CPEX Plugin Metrics (#5611) - Consume metrics from 5 remaining bundled cpex-* plugins.

Dataplane

• Publish Resource URIs and Capabilities (#5588) - Publish dataplane resource URIs and capabilities.

Changed

... (truncated)

Commits

• d24df05 Release/v1.0.6 (#5738)
• ec8a728 Update roadmap for 1.0.6 (#5710)
• bc42180 fix(api): use savepoint for personal team cascade delete and reorder FK delet...
• 528577b fix(auth): unify email extraction across all resource operations (#4821)
• 01b20b1 fix: return 404 for missing server and gateway deletes (#5672)
• e7c6d44 fix(ui): Add static assets to CSS bundle (#5705)
• 77d99df fix(transport): remove manual Content-Length headers causing compression erro...
• 050cfa2 Disable pyright, this had an unintended consequence of requiring any touched ...
• 5eece0f ci(pyright): add PR-scoped type check workflow and pyright-pr make target (#5...
• 186abb9 Update python call in fix file headers pre-commit to use uv run (#5669)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)