From 5d1f670936dbb323dfe0e0185fddaaac4bad8d5b Mon Sep 17 00:00:00 2001
From: Radoslav Dimitrov <radoslav@stacklok.com>
Date: Thu, 23 Oct 2025 20:14:47 +0300
Subject: [PATCH] Enable dependabot for /deploy and pin Go version to 1.24
 (#697)

<!-- Provide a brief summary of your changes -->

## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
There was feedback that other projects wanting to use the registry
package have to upgrade to 1.25 (because of how Go works). In the
registry itself we are not relying on 1.25 features so this PR reverts
us back to 1.24 until 1.25 becomes better adopted and we can safely move
to it.

Also realised we were not keeping our dependencies for our deploy/infra
code up to date with Dependabot so this fixes that too.

## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->

## Breaking Changes
<!-- Will users need to update their code or configurations? -->

## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update

## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed

## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->

---------

Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>
---
 .github/dependabot.yml | 4 ++++
 Dockerfile             | 2 +-
 deploy/go.mod          | 4 +---
 go.mod                 | 4 ++--
 4 files changed, 8 insertions(+), 6 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 02a3cd3..69e2da5 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -4,6 +4,10 @@ updates:
     directory: /
     schedule:
       interval: daily
+  - package-ecosystem: gomod
+    directory: /deploy
+    schedule:
+      interval: daily
   - package-ecosystem: github-actions
     directory: /
     groups:
diff --git a/Dockerfile b/Dockerfile
index bee434f..9117e8e 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.25-alpine AS builder
+FROM golang:1.24-alpine AS builder
 WORKDIR /app
 
 # Copy go mod files first and download dependencies
diff --git a/deploy/go.mod b/deploy/go.mod
index 08bb2e6..d331dec 100644
--- a/deploy/go.mod
+++ b/deploy/go.mod
@@ -1,8 +1,6 @@
 module github.com/modelcontextprotocol/registry/deploy/infra
 
-go 1.23.0
-
-toolchain go1.24.1
+go 1.24.6
 
 require (
 	github.com/pulumi/pulumi-gcp/sdk/v8 v8.39.0
diff --git a/go.mod b/go.mod
index 77f3e24..b8a7394 100644
--- a/go.mod
+++ b/go.mod
@@ -1,11 +1,12 @@
 module github.com/modelcontextprotocol/registry
 
-go 1.25
+go 1.24.6
 
 require (
 	github.com/caarlos0/env/v11 v11.3.1
 	github.com/coreos/go-oidc/v3 v3.16.0
 	github.com/danielgtaylor/huma/v2 v2.34.1
+	github.com/distribution/reference v0.6.0
 	github.com/golang-jwt/jwt/v5 v5.3.0
 	github.com/jackc/pgx/v5 v5.7.6
 	github.com/prometheus/client_golang v1.23.2
@@ -25,7 +26,6 @@ require (
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
-	github.com/distribution/reference v0.6.0 // indirect
 	github.com/go-jose/go-jose/v4 v4.1.3 // indirect
 	github.com/go-logr/logr v1.4.3 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect