## IBM/mcp-context-forge — v1.0.5…v1.0.6

_62 commits._

### Features
- **feat(plugins): restrict non-hook plugin initialization to a single worker across instances (#5430)** (1c74d0e)
- **feat(plugins): consume metrics from 5 remaining bundled cpex-* plugins (#5611)** (26d46a9)
- **feat: publish dataplane resource uris and capabilities (#5588)** (992e692)
- **feat: add MCP Apps support (#5079)** (7fc997e)
- **feat(plugins): build + consume CPEX plugin trace context and metrics (G0+G1) (#5470)** (02d2ae2)
- **feat(oauth): RFC 8693 token exchange (On-Behalf-Of) for OAuth gateways (#5224)** (21b241a)
- **feat(api): add public GET /v1/resources/test/{resource_uri} endpoint (#5455)** (a408891)
- **feat(api): add POST /v1/mcp-servers/test endpoint for React UI connection testing (#5443)** (29701cf)

### Fixes
- **fix(api): use savepoint for personal team cascade delete and reorder FK deletes (#5659)** (bc42180)
- **fix(auth): unify email extraction across all resource operations (#4821)** (528577b)
- **fix: return 404 for missing server and gateway deletes (#5672)** (01b20b1)
- **fix(ui): Add static assets to CSS bundle (#5705)** (e7c6d44)
- **fix(transport): remove manual Content-Length headers causing compression errors (#5663)** (77d99df)
- **Update python call in fix file headers pre-commit to use uv run (#5669)** (186abb9)
- **fix cwe-117 improper output neutralization logs. (#5441)** (50602d6)
- **fix(resources): revert resource name uniqueness constraint from #5158 (#5664)** (098dc0e)
- **fix(security): respect global ssrf_protection_enabled flag in gateway test endpoint (#5023)** (1f34d7a)
- **fix: rename Keycloak test user to avoid email collision with default admin (#5647)** (d302a5a)
- **fix(services): rebuild fork-poisoned FileLock and back off on health-check errors (#5654)** (3efce13)
- **FIX(CHORE): Remove renovate json file and update security.md to include dependabot (#5623)** (378c403)
- **fix(schemas): persist auth_headers array in POST /tools and PUT /tools/{tool_id} (#5314)** (79f7d0f)
- **Fix playwright tests (#5625)** (2ccb4f5)
- **FIX(REDIS): Raise maxclients from 10000 to 15000 and reduce redis max connections (#4724)** (6a42524)
- **fix: remove premature exit in Containerfile and restore linting targets that run on Go (#5596)** (48b1efe)
- **Fix/output length guard resource bypass (#5619)** (91b582f)
- **hotfix: ppc & s390x CSS builds (#5620)** (d354ab6)
- **Fix templated resource proxy reads (#5569)** (fa7a35d)
- **fix(a2a): pass safe headers to tool pre-invoke hooks (#4925)** (6703151)
- **fix(resources): show meaningful conflict message for duplicate resource name (#5158)** (2fd6b89)
- **fix(plugins): restrict non-hook plugin initialization to a single worker (#5406)** (da7971d)
- **fix(dataplane_publisher): publish streamable-HTTP backends only (#5519)** (808b1f9)
- **PR: Fix bootstrap_resource_assignments race condition on concurrent pod restart (#5003)** (d6eb379)
- **fix(security): validate all oauth_config URLs to prevent SSRF during gateway registration (#5601)** (dc429d9)
- **fix(grpc): enforce SSRF/TLS validation in GrpcEndpoint.start() (#5410)** (ee562f5)
- **fix(api): Check for existing team membership before accepting invitation (#5543)** (6c36dd9)
- **fix(dataplane_publisher): per-worker lock id and safer key TTL (#5517)** (7365dd2)
- **fix: schema builder input_schema not persisting and dark mode missing styles (#4888)** (a0a66ee)
- **fix(ci): remove deleted a2a-echo-agent from docker-scan workflow and fix Makefile actionlint quote (#5590)** (143c3ea)
- **fix(dataplane_publisher): publish original_name in allowed_tool_names (#5510)** (bc6d329)

### Backend
- **Release/v1.0.6 (#5738)** (d24df05)
- **Update roadmap for 1.0.6 (#5710)** (ec8a728)
- **Disable pyright, this had an unintended consequence of requiring any touched file to then become pyright compliant (#5703)** (050cfa2)
- **Update fix_file_headers to have generic default AUTHOR, defined COPYR… (#5637)** (633a182)
- **Update SecretsDetection field filter config (#5635)** (7dbe41d)
- **Merge commit from fork** (dedfd8b)
- **Update secrets and reset some of content from .secrets.baseline file (#5622)** (1500d86)
- **Package all js libs (#5481)** (3f06618)
- **Modernize Content Security Policy Configuration (#5111)** (d377ded)
- **Improve test coverage on rbac admin delete tool (#4518)** (43deecd)
- **Move Rust and Go MCP servers to contextforge-examples repository (#5425)** (cd10eaf)

### Tests
- **test: Fix pw test (#5653)** (7b17f12)
- **test: wait for per-server route before compliance gateway_virtual runs (#5515)** (6a5ca58)
- **test: retry live RBAC per-server access (#5482)** (db33649)
- **test(protocol): remove xfail for GAP-001/GAP-002 — log and progress notifications now relayed (#5603)** (4873c4c)
- **test: align admin private-server listing test with owner matching (#5523)** (3a962b6)

### Docs
- **docs: add generic MCP extension framework ADR (#5007)** (e870427)

### Chore
- **ci(pyright): add PR-scoped type check workflow and pyright-pr make target (#5634)** (5eece0f)
- **chore(templates): remove CSP-violating airgapped Tailwind JS branch from change-password-required.html (#5646)** (444bb74)
- **chore:updated python dependencies (#5605)** (55a677f)
- **chore: update-release documentation (#5576)** (cbc6c70)
- **ci: remove direct-merge Slack notification (#5503)** (925eee4)
- **ci(plugins): replace fast-time-server source build with pre-built Docker image (#5513)** (e24f2e7)

_Recap by [Repo Wrapped](https://repowrapped.com/gh/IBM/mcp-context-forge?utm_source=github-action)._