## IBM/mcp-context-forge — v1.0.4…v1.0.5

_65 commits._

### Features
- **feat(a2a): add JSON-RPC passthrough endpoint for SDK compatibility (#5313)** (717c30b)
- **feat(tests): E2E integration tests for cpex plugins in the gateway (#5332)** (f193742)
- **feat: API endpoint is served under the `/v1` prefix (#4403)** (1e0a7f9)
- **feat(fast-time): rmcp /mcp transport + legacy SSE shim (#5299)** (1b98aeb)
- **5142 UI rewrite create a new v1toolsgenerate schemas from openapi endpoint (#5261)** (6966e36)
- **feat: support external OIDC bearer tokens on API and MCP endpoints (#5200)** (369e02f)
- **feat: A2A Passthrough Headers with ENABLE_SENSITIVE_HEADER_PASSTHROUGH Flag (Phase 1) #3621` (#5183)** (f4b38cc)
- **feat(security): expand inbound passthrough denylist to block protocol-level headers (#4726)** (2dcb92a)
- **feat: add title field to MCP tool serialization paths (#5019)** (13c4939)

### Fixes
- **Fix admin CSRF issuance for non-email platform-admin sessions by bind… (#5497)** (d3ead30)
- **fix: removed double mounter /v1/v1 prefix to /v1 and also preserved the legacy route(one without prefix /v1) (#5504)** (68cf649)
- **fix(loadtest): eliminate harness false-positives across 30+ admin endpoints (#5456)** (d5c8c94)
- **fix(ui): resolve CSP parser errors in maintenance panel (#5163)** (2102b67)
- **fix(ui): resolve missing window.Admin registrations in mcp_registry_partial.html (#5197)** (50d2796)
- **Fix package verify (#5491)** (5f70e8b)
- **fix(admin-ui, tests): stabilize iframe team-selector flaky test (#5444)** (bf24276)
- **fix(gateway): propagate connection errors on gateway update (#5204)** (ec07841)
- **fix: eliminate multi-worker session-affinity forward amplification (#5393)** (b885937)
- **fix: upgrade undici to 7.28.0 (npm audit) (#5464)** (6924ac6)
- **fix: propagate tool validation errors in gateway refresh response (#5290) (#5317)** (5c22ade)
- **Fix chores changelog (#5354)** (5240152)
- **fix: remove Tailwind CSS from download-cdn-assets.sh (#5035) (#5193)** (9dfdcf5)
- **fix: validate transport type on GatewayCreate and GatewayUpdate (#5289) (#5312)** (4999e17)
- **fix: normalize dataplane passthrough headers (#5459)** (a8f786b)
- **Fix/sign image on tagged version (#5363)** (86bd269)
- **fix(tests): handle FastAPI 0.137+ _IncludedRouter in route path helpers (#5447)** (70c31bd)
- **fix(ci): upgrade anchore/scan-action to v7.4.0 (Node 24); skip unfixable CVEs (#5436)** (9965a11)
- **fix: include admin's own personal team in GET /teams (#5392)** (8e9c049)
- **fix: add recursive scanning to regex_filter and deny_filter (#5243)** (1867330)
- **fix failed to shutdown plugin (#5400)** (06fa8f7)
- **fix(api): remove shared db session from audit trail calls to prevent inactive transaction errors (#3178)** (b6a4177)
- **fix(tests): pin MCP live-gateway client URLs to IPv4 to avoid localhost IPv6 stall (#5230)** (1306ff2)
- **fix(deps): bump prometheus-fastapi-instrumentator to 8.0.1 (#5397)** (6a35eb0)
- **fix: session token admin bypass broken in get_rpc_filter_context (#5232) (#5239)** (ae08574)
- **fix: enforce Rust lockfile checks in CI (#5381)** (913e6ee)
- **fix(a2a-echo): drop broken wget healthcheck, add SSE streaming and v1 agent card (#5360)** (25f7053)
- **fix(db): remove global unique constraints breaking multi-tenant isolation (#5161)** (4d058e4)
- **fix(security): suppress Pydantic validation error details in HTTP response (#5087)** (7e9d90c)
- **Fix: Remove JMeter load testing to rely only on locust load testing (#5277)** (d9c78dd)
- **fix(playwright): test_should_handle_object_parameter_validation by resolving HTMX race condition and async evaluate error (#5310)** (12d0eed)

### Backend
- **Release/v1.0.5 (#5509)** (932d2a3)
- **Sync MCP meta traceparent with outbound header (#5465)** (99d864d)
- **cleanup/2373-sonar-code-duplication-list-tools (#4695)** (01278c4)
- **bugfix/5152-firefox-closest-blur (#5315)** (a1f5e8a)
- **Ci/slack merge queue fixes (#5480)** (3b13bf0)
- **bugfix/5155-roots-panel-openmenu-undefined (#5291)** (a88604e)
- **Rename pre-commit config file to default name.  Adjust CI (#5387)** (7782c65)
- **update python versions (#5416)** (5f1dd0a)
- **Merge commit from fork** (0ac44bb)
- **Merge commit from fork** (5714507)
- **Merge commit from fork** (8ffb813)
- **Added ruff check and formatter to pre-commit (#5169)** (1fef514)

### Docs
- **docs(architecture): session-affinity alternatives — trade-offs doc for #4557 (#5083)** (471bbef)
- **docs: add BeeAI Framework MCP integration guide (#5185)** (7b7a615)

### Chore
- **ci: temporarily disable s390x builds on push to main (#5545)** (af178ee)
- **refactor: consolidate to single Containerfile (#5468)** (b5d53ae)
- **chore: update npm packages (#5494)** (b0239fd)
- **ci: detect queue merges by replaying PR timeline queue membership (#5483)** (5f8a4c6)
- **ci: add Slack notifications for merge queue ejection and direct merges (#5479)** (5c028df)
- **ci: exclude s390x/ppc64le from merge queue gate (#5476)** (d7af9fa)
- **chore(ci): remove redundant release workflows (#5423)** (96c8014)
- **chore: migrate Rust server runtime images from debian:trixie-slim to ubi-minimal (#5404)** (8aec3e0)
- **chore: speed up merge queue Docker validation (#5371)** (8d51a32)
- **chore: bump cpex plugin packages (#5362)** (b14061b)
- **chore: add missing rust crates to workspace (#5305)** (cdb708d)

_Recap by [Repo Wrapped](https://repowrapped.com/gh/IBM/mcp-context-forge?utm_source=github-action)._