## IBM/mcp-context-forge — v1.0.2…v1.0.3

_63 commits._

### Features
- **Add hashed version to external repositories installed in pre-commit (#4983)** (d6b9076)
- **feat(OAuth): add OAuth audience parameter support for Atlassian and Auth0 (#4795)** (a93b4cc)
- **feat: parameterize base images and add opt-in FIPS compliance mode (#4810)** (aaaba4d)
- **Add Redis-based configuration publisher for experimental dataplane pu… (#4926)** (d2d7700)

### Fixes
- **fix: Disable CA Cert validation on authless MCPs (#5075)** (84cb8d1)
- **fix: resolve teams panel not loading due to undefined getPaginationParams in admin UI (#5085)** (7944992)
- **fix(ui): add defer attribute to script tags to prevent Alpine.js race condition (#5117)** (c6acf5c)
- **fix(compose): repoint fast_test_server build context to renamed rust crate (#5118)** (6eb1ff7)
- **perf: speed up rust fast-test server (#5059)** (285da49)
- **fix(fedramp): keep /app group-owned by root so FIPS 0750 mode survives arbitrary-UID runtimes (#5112)** (a798fdf)
- **fix(sso): SSO callback redirect for non-admin users with team memberships (#4777)** (9291a7d)
- **fix(plugins): Return operator labels in GET /admin/plugins to match PUT input (#4718)** (83f340d)
- **fix(fedramp): set mode 0740 on /app dotfiles in FIPS compliance block (#5069)** (fe9a765)
- **fix(observability): rename resource span from invoke.resource to resource.read (#3977)** (2c55cfe)
- **fix(cache): team cache hardening - cross-worker eviction, update_team, transient ORM, nullable safety (#5008)** (d3181cd)
- **fix(OAuth): honor token_endpoint_auth_method in OAuth token exchange (#4717)** (49ba1ef)
- **Fix node installation on paywright worflow (#5063)** (4989e72)
- **fix(auth): allow cookie auth for same-origin OAuth callback fetch requests (#4868)** (b1095d1)
- **Rename file and fix nodejs (#5042)** (4634add)
- **fix(testing): playwright admin_api fixture to stop duplicating JWT auth, fix linting (#4265)** (db2cf69)
- **fix: resolve remaining 4 STIG failures from 2026-06-03 OpenSCAP scan (#5053)** (938f883)
- **fix: admin users can now view and edit their own private resources (tools, prompts, resources, servers, gateways) (#4878)** (8c186c5)
- **fix: move global code owners to the bottom (#5055)** (587b1cd)
- **Fixed image bug. Added postgres (#5039)** (6b982c7)
- **fix: extend FedRAMP FIPS compliance block with missing STIG controls (#5033)** (c441de9)
- **Fix/s390x wheel (#5014)** (509d300)
- **fix: use valid JSON string in Slack notify payload instead of YAML >- block scalar (#5028)** (f3a28cc)
- **fix(api): add JSON support and RESTful endpoints for admin gateway CRUD operations (#4808)** (8d56b6d)
- **fix(auth): cache get_token_revocation / is_token_revoked to eliminate hot-path DB queries (#4527)** (cec0d5c)
- **fix: migrate Alpine.js to Vite-bundled @alpinejs/csp build and eliminate unsafe-eval (#4676)** (22966d6)
- **fix: skip idle timeout for API tokens; fix is_admin fallback chain (#5000)** (2c9bf4f)
- **fix: resolve plugin metadata from packages (#4916)** (f827b8a)
- **fix: update Rust dependency pins (#4832)** (9f63ec9)
- **fix: Hardening container images on fast-test, slow-test, a2a-test-echo servers (#4973)** (28e024e)
- **Fix: Make serve no longer silently deletes existing .venv  (#4944)** (4ac823f)
- **fix: cover CPEX plugin regressions (#4629)** (079cbe2)
- **perf(cache): store full team objects in AuthCache to eliminate secondary DB query (#4550)** (13083ce)
- **fix(mcp): prevent 307 redirects for Streamable HTTP /mcp probes (#4446)** (4cfd8ae)
- **fix(metrics): throttle aggregate_all_components with pg advisory lock and configurable interval (#4468)** (3f2ac5d)
- **fix: Loadtest gaps (#4698)** (ce31d2a)

### Backend
- **Release/v1.0.3 (#5159)** (65dcfe2)
- **removed extra spaces introduced in yaml files #4983 (#5120)** (b1663bf)
- **bugfix/4400-migration-blocked-missing-gateway-secret (#4787)** (56a6513)
- **bugfix/edge-mode-health-mirror-convergence-4440 (#4606)** (cb9fa40)
- **[170] JWT Cleanup (#4816)** (d713595)
- **Fixed psycopg.errors.UndefinedColumn in postgres (#4980)** (35d5b82)
- **Connected s390 wheels with build (#5057)** (5fab5ed)
- **Redact PII from the logs (#5013)** (0baf71e)
- **fixed the alpine.js sri hashes (#5025)** (800b70b)
- **Correct secrets following bad addition & linting issues (#5029)** (273f87d)
- **separate redis for ratelimiter is enabled (#4859)** (5464049)
- **Update CODEOWNERS to remove test ownership (#4941)** (917a6d3)
- **Basic logging for sql sanitizer (#4708)** (8f1a534)
- **Merge commit from fork** (fba11a9)

### Tests
- **test: expand gRPC integration test depth for PR #3202 (#4658)** (88eeaa5)

### Docs
- **docs(rate-limiter): tighten plugin-bindings payload surface (#4848)** (0ccc61d)

### Chore
- **chore(ui): consolidate Alpine.js component setup (#5024)** (2e8542a)
- **chore: upgrade prometheus-fastapi-instrumentator to 8.0.0, update starlette to >=1.0.1 (#5006)** (b944cf0)
- **ci: add Docker Build Complete gate for merge queue (#5060)** (ae5181d)
- **ci: enable merge queue support in docker-multiplatform.yml (#5032)** (3d92bed)
- **Chore: add diagnostics for tool pre-invoke modified payloads (#4937)** (f858cf0)
- **chore: update cpex to 0.1.1.dev1 for CopyOnWriteDict support (#4985)** (226c32e)
- **chore: bump cpex detection plugins (#4979)** (6d35d91)

_Recap by [Repo Wrapped](https://repowrapped.com/gh/IBM/mcp-context-forge?utm_source=github-action)._