feat(deps): update spanner to v0.3.5

[renovate-bot]

This PR contains the following updates:

Package	Update	Change
plugins/spanner	patch	0.3.1 → 0.3.5
spanner	patch	0.3.1 → 0.3.5

---

Release Notes

gemini-cli-extensions/spanner (plugins/spanner)

v0.3.5

Compare Source

Features

• groups: Add ttlMs and cacheScope customization to config (mcp-toolbox#​3805) (a5d4947) (08cb038)
• migrate: Convert toolset to group kind during migration (mcp-toolbox#​3704) (0adeaa5) (08cb038)
• server/mcp: Introduce generic client extension registry (mcp-toolbox#​3723) (016245c) (08cb038)
• skill: Add review-prs skill for mcp-toolbox (mcp-toolbox#​3743) (5b7bacc) (08cb038)
• sources/spanner: Rename execute_sql_dql to execute_sql_readonly (mcp-toolbox#​3776) (cf5a0c8) (08cb038)
• tools: Add cloud-sql-connect-gce for pg, mysql, mssql (mcp-toolbox#​3740) (ca58fa4) (08cb038)

Bug Fixes

• auth/mcp: Derive PRM URL from Toolbox URL (mcp-toolbox#​3765) (aa30842) (08cb038)
• config: Ignore environment variables in YAML comments (mcp-toolbox#​3807) (79aa732), refs mcp-toolbox#​3793 (08cb038)
• mcp: Return Tool execution error for invalid input param (mcp-toolbox#​3799) (8120197) (08cb038)
• prebuilt/cloud-storage: Declare tool collections as groups (mcp-toolbox#​3764) (7d468be) (08cb038)
• server: Avoid a nil-flusher panic in the SSE handler (mcp-toolbox#​3520) (947f42f) (08cb038)
• server/mcp: Disallow client overriding URL bound parameters (mcp-toolbox#​3798) (f15a9c7) (08cb038)
• util: Convert exponent-form JSON numbers in ConvertNumbers (mcp-toolbox#​3730) (e9713ee) (08cb038)

v0.3.4

Compare Source

Features

• deps: update dependency googleapis/mcp-toolbox to v1.8.0 (#​125) (fa88644)

v0.3.3

Compare Source

Features

• plugin: support agent plugin spec (#​126) (265099e)

v0.3.2

Compare Source

Features

• auth: Implement MCP auth tool-level scopes validation (mcp-toolbox#​3049) (c528985) (49be417)
• auth/google: Require audience or clientId for mcpEnabled (mcp-toolbox#​3450) (59f7b6e) (49be417)
• ci: Add support for windows/arm64 binary distribution (mcp-toolbox#​3231) (10abf3b) (49be417)
• datalineage: Add Data Lineage integration (mcp-toolbox#​3285) (19353c3) (49be417)
• looker: Propagate client IP from incoming MCP requests to downstream SDK calls (mcp-toolbox#​3253) (75da6c2) (49be417)
• mcp: Add URL parameter binding for HTTP transport (mcp-toolbox#​3112) (0cc7b37) (49be417)
• release: Add digital signature to Toolbox binaries (mcp-toolbox#​3528) (3f0f0af) (49be417)
• scylladb: Adding support for ScyllaDB source and tool (mcp-toolbox#​3119) (2dada83) (49be417)
• server: Add support for toolset filtering in prebuilt CLI flag (mcp-toolbox#​3245) (7cc4f65) (49be417)
• server: Ignore unknown tools at startup with --ignore-unknown-tools flag (mcp-toolbox#​3353) (5f0304f) (49be417)
• skills: Generate skills offline without live source connections (mcp-toolbox#​3388) (4c860b6) (49be417)
• skills: Tolerate missing env vars during offline skills-generate (mcp-toolbox#​3399) (ea5d3e5) (49be417)
• tools: Decouple tool initialization from sources (mcp-toolbox#​3355) (32a24e3) (49be417)
• tools/spanner-search-catalog: Implement search_catalog tool (mcp-toolbox#​3140) (defc086) (49be417)
• Enable per source level flags for sql commenter (mcp-toolbox#​3465) (ecce6b7) (49be417)
• Setup SQLCommenter and allow client metadata (mcp-toolbox#​3064) (9f1f9b3) (49be417)
• Support MCP 2026 draft specs (mcp-toolbox#​3544) (d12eaa8) (49be417)

Bug Fixes

• auth: Separate Google and Generic MCP OAuth verification (mcp-toolbox#​3341) (dfd66ee) (49be417)
• auth/dataplex: Fix failing source with service account credentials (mcp-toolbox#​3369) (ba4deef) (49be417)
• auth/generic: Enforce issuer presence in opaque token validation (mcp-toolbox#​3360) (1d8df0d) (49be417)
• auth/generic: Fix generic auth expiration field and integration with authRequired (mcp-toolbox#​3251) (f4d16c0) (49be417)
• bigquery: Wire maximumBytesBilled into prebuilt config (mcp-toolbox#​3385) (4abbf6e) (49be417)
• config: Add doc/line context to parse errors (mcp-toolbox#​2957) (4b097da) (49be417)
• mcp: Support annotations and metadata within Tools to earlier MCP schemas (mcp-toolbox#​3300) (9a88c72) (49be417)
• npm: Source binary version from cmd/version.txt (mcp-toolbox#​3417) (6ffbdec) (49be417)
• oracle: Remove trailing semicolons from prebuilt tools (mcp-toolbox#​3215) (fcad02d) (49be417)
• prebuilt/alloydb-omni: Require password env var explicitly (mcp-toolbox#​3398) (fcbe3e7) (49be417)
• server: Fail if MCP auth is enabled together with enable-api (mcp-toolbox#​3435) (a6ff910) (49be417)
• server: Return errors instead of panicking in InitializeConfigs (mcp-toolbox#​3397) (f48b01d) (49be417)
• server: Return null id for batch request rejection (mcp-toolbox#​3333) (0b18d58) (49be417)
• server/auth: Centralize tool scopes validation (mcp-toolbox#​3335) (adce4ab) (49be417)
• telemetry: Allow GCP project override (mcp-toolbox#​2960) (3c83ba5) (49be417)
• tool/spanner-sql,tool/spanner-execute-sql: Use read-only annotations when readOnly is set (mcp-toolbox#​3338) (8bde0ec) (49be417)
• tools: Initialize query result slices to empty array (mcp-toolbox#​3250) (60ddf48) (49be417)
• Bound MCP HTTP body size (mcp-toolbox#​3216) (d4f4342) (49be417)
• Escape delimiter characters in applyEscape to prevent SQL injection (932519a) (49be417)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.