From 1b9f69e81b27bc2e3dc73c2c986c890c3af7173a Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Mon, 4 May 2026 10:07:32 -0400 Subject: [PATCH] deploy: update prod to v1.7.7 (#1251) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Summary - Bump `mcp-registry:imageTag` from `1.7.6` → `1.7.7` in `deploy/Pulumi.gcpProd.yaml` - v1.7.7 is a security patch covering three findings (validator hardening, attribute-context UI escaping, IPv6 SSRF blocklist extension); see the v1.7.7 release notes - Staging is on `f5f40bd` (the v1.7.7 commit) and verified end-to-end: - `/v0.1/version` reports the new commit - `/v0.1/validate` rejects a poisoned `websiteUrl` with `website-url-invalid-characters` - `/` HTML serves the `escapeAttr` helper ## Test plan - [ ] Confirm release workflow's `ko-push` job has finished publishing `ghcr.io/modelcontextprotocol/registry:1.7.7` before merging - [ ] Watch deploy-production workflow rolls the registry pods to `1.7.7` - [ ] Hit `https://registry.modelcontextprotocol.io/v0.1/version` and confirm `git_commit` matches `f5f40bd...` - [ ] Spot-check the catalogue UI loads cleanly 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.7 (1M context) --- deploy/Pulumi.gcpProd.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/deploy/Pulumi.gcpProd.yaml b/deploy/Pulumi.gcpProd.yaml index 034330b..44e5839 100644 --- a/deploy/Pulumi.gcpProd.yaml +++ b/deploy/Pulumi.gcpProd.yaml @@ -1,7 +1,7 @@ config: mcp-registry:environment: prod mcp-registry:provider: gcp - mcp-registry:imageTag: 1.7.6 # Set specific image tag for production (change this to deploy different versions) + mcp-registry:imageTag: 1.7.7 # Set specific image tag for production (change this to deploy different versions) gcp:project: mcp-registry-prod mcp-registry:githubClientId: Iv23liUydBbI7Z2Q9bOZ mcp-registry:githubClientSecret: