713 commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
Yusufhan Sacak
|
d1dcaf3fb3 |
fix(publisher): tolerate transient device-flow failures during login polling (#1588)
Some checks failed
Follow-up to my analysis on #1543. Heads up on the shape first: this builds on #1290's poll-loop seams and github wont let me target a fork branch, so the diff shows its two commits too. Review only the last commit, the first two are #1290 unchanged, credit to @developer-ishan. Happy to rebase whichever way #1290 goes, or split differently if that's easier to review. What it does. pollForToken treats every non-pending answer as terminal, so one flaky response kills a login the user may already have approved in the browser. This spends a small grace budget (2 polls) on incorrect_device_code before giving up, retries 5xx with a growing backoff, and returns status plus body on other non-200s instead of dying inside json.Unmarshal on an html error page. Terminal errors now carry error_description and error_uri, and a timeout that happens after polling recovered reports a plain timeout, not a stale error from minutes earlier. Also honours the interval and expires_in GitHub returns with the device code (RFC 8628 3.2) instead of hardcoding 5/900, clamped (60s / 3600s) so a misbehaving response can't stall the CLI or overflow the duration math. One thing I changed my mind on from the issue comment: I wrote there that the client should wait one interval before the first poll. Dropped that. My own repro test showed 40s of clean polling before authorize, so the propagation theory doesn't hold, and the grace retry covers the same window without taxing every fast login. First poll stays immediate, pinned by a test. Root cause note: I can't prove the GitHub-side race (cli/cli#9302 is the same error class but was closed on an unconfirmed "platform race"). So this isn't claimed as a root-cause fix, it makes the login recoverable if the condition is transient and diagnosable if it isn't. Btw incorrect_device_code is a GitHub extension, not an RFC 8628 3.5 code, so there's no spec retry semantic being violated by the grace polls. ## Test 12 new tests in github_at_device_flow_internal_test.go, all green with -race (33 in the package). #1290's four tests pass unmodified. golangci-lint clean in the touched files under both v2.11.4 (this branch's CI pin) and v2.13.1 (what main pins now). ## AI Disclosure AI assistance (Claude) was used for issue research and during development. All changes were reviewed and tested by the author. Fixes #1543 --------- Co-authored-by: developer-ishan <igupta@groupon.com> Co-authored-by: Ishan Gupta <62565307+developer-ishan@users.noreply.github.com> Co-authored-by: developer-ishan <guptaishan849@gmail.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Co-authored-by: Radoslav Dimitrov <radoslav@stacklok.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> |
||
Ishan Gupta
|
73aebc1526 |
fix(publisher): treat GitHub device-flow slow_down as retriable (#1290)
## Summary - Handle GitHub's OAuth device-flow `slow_down` response per [RFC 8628 §3.5](https://datatracker.ietf.org/doc/html/rfc8628#section-3.5) — treat it as retriable and bump the polling interval by 5 seconds, instead of bailing with a fatal error. Fixes #1289. ## Why `pollForToken` in `cmd/publisher/auth/github-at.go` only treats `authorization_pending` as retriable. Every other response from GitHub's token endpoint — including the non-terminal `slow_down` signal — falls through to: ```go return "", fmt.Errorf("token request failed: %s", tokenResp.Error) ``` So users hitting GitHub's polling rate-limit get: ``` Error: login failed: error polling for token: token request failed: slow_down ``` …and have to re-run `mcp-publisher login github` from scratch, which is especially painful because `slow_down` is more likely when the user takes more than a few seconds to enter and authorize the device code. Per RFC 8628 §3.5, `slow_down` is defined as: > A variant of "authorization_pending", the authorization request is still pending and polling should continue, but the interval MUST be increased by 5 seconds for this and all subsequent requests. ## Change Treat `slow_down` the same as `authorization_pending` but increase `interval` by 5 seconds before sleeping, matching the RFC exactly. A possible follow-up (not in this PR, to keep the diff minimal): seed the initial `interval` from `DeviceCodeResponse.Interval` (already parsed but currently unused) instead of hardcoding `5`. Happy to do that here or as a separate PR if preferred. ## Test plan - [x] `go build ./cmd/publisher/...` — clean - [x] `go test ./cmd/publisher/auth/...` — passes - [x] `gofmt -d` and `go vet ./cmd/publisher/auth/...` — clean - [ ] CI `make check` (lint + integration tests) I could not exercise `pollForToken` from a unit test without refactoring `GitHubAccessTokenURL` to be injectable, which felt out of scope for a bug-fix PR. Glad to add that refactor + a table-driven test for `authorization_pending` / `slow_down` / fatal errors in a follow-up if maintainers want it. --------- Co-authored-by: developer-ishan <igupta@groupon.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> |
||
dependabot[bot]
|
cabf0607b6 |
build(deps): bump google.golang.org/grpc from 1.83.1 to 1.83.2 in /deploy (#1630)
Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.83.1 to 1.83.2. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/grpc/grpc-go/releases">google.golang.org/grpc's releases</a>.</em></p> <blockquote> <h2>Release 1.83.2</h2> <h1>Security</h1> <ul> <li>server: Reject requests missing both <code>:authority</code> and <code>Host</code> headers with HTTP 400 and status <code>Internal</code>. (<a href="https://redirect.github.com/grpc/grpc-go/pull/9365">grpc/grpc-go#9365</a>) <ul> <li>Special Thanks: <a href="https://github.com/winklemad"><code>@winklemad</code></a></li> </ul> </li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
c7411aeaba |
build(deps): bump the go-dependencies group with 2 updates (#1634)
Bumps the go-dependencies group with 2 updates: [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry) and [golang.org/x/mod](https://github.com/golang/mod). Updates `github.com/google/go-containerregistry` from 0.22.0 to 0.22.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/google/go-containerregistry/releases">github.com/google/go-containerregistry's releases</a>.</em></p> <blockquote> <h2>v0.22.1</h2> <h2>What's Changed</h2> <ul> <li>Reject non-canonical IP literals in all SSRF guards by <a href="https://github.com/shaggyinsomniac"><code>@shaggyinsomniac</code></a> in <a href="https://redirect.github.com/google/go-containerregistry/pull/2426">google/go-containerregistry#2426</a></li> <li>daemon: fix stale docker/docker reference in WithClient docs by <a href="https://github.com/BobDu"><code>@BobDu</code></a> in <a href="https://redirect.github.com/google/go-containerregistry/pull/2428">google/go-containerregistry#2428</a></li> <li>build(deps): bump the go-deps group across 2 directories with 4 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/google/go-containerregistry/pull/2422">google/go-containerregistry#2422</a></li> <li>authn: do not overwrite AuthConfig.Auth when username and password are empty by <a href="https://github.com/nileshpatil6"><code>@nileshpatil6</code></a> in <a href="https://redirect.github.com/google/go-containerregistry/pull/2420">google/go-containerregistry#2420</a></li> <li>build(deps): bump the actions group across 1 directory with 8 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/google/go-containerregistry/pull/2423">google/go-containerregistry#2423</a></li> <li>Support pulling images by sha512 digest by <a href="https://github.com/BobDu"><code>@BobDu</code></a> in <a href="https://redirect.github.com/google/go-containerregistry/pull/2427">google/go-containerregistry#2427</a></li> <li>Allow empty label and annotation values in crane mutate by <a href="https://github.com/theadsingh"><code>@theadsingh</code></a> in <a href="https://redirect.github.com/google/go-containerregistry/pull/2418">google/go-containerregistry#2418</a></li> <li>fix(build): Use dependencies.gitSource in cloudbuild_v2.yaml by <a href="https://github.com/tprussak"><code>@tprussak</code></a> in <a href="https://redirect.github.com/google/go-containerregistry/pull/2434">google/go-containerregistry#2434</a></li> <li>validate: support index attestation manifests and empty configs by <a href="https://github.com/Subserial"><code>@Subserial</code></a> in <a href="https://redirect.github.com/google/go-containerregistry/pull/2414">google/go-containerregistry#2414</a></li> <li>name: improve error when parsing a reference with a URL scheme by <a href="https://github.com/locker95"><code>@locker95</code></a> in <a href="https://redirect.github.com/google/go-containerregistry/pull/2431">google/go-containerregistry#2431</a></li> <li>fix(build): install binaries to /ko-app and add to PATH (<a href="https://redirect.github.com/google/go-containerregistry/issues/2424">#2424</a>) by <a href="https://github.com/tprussak"><code>@tprussak</code></a> in <a href="https://redirect.github.com/google/go-containerregistry/pull/2436">google/go-containerregistry#2436</a></li> <li>fix(release): honor declared Go toolchain by <a href="https://github.com/rksharma-owg"><code>@rksharma-owg</code></a> in <a href="https://redirect.github.com/google/go-containerregistry/pull/2435">google/go-containerregistry#2435</a></li> <li>remote: apply checkRedirectSSRF to writer-side HTTP clients by <a href="https://github.com/locker95"><code>@locker95</code></a> in <a href="https://redirect.github.com/google/go-containerregistry/pull/2432">google/go-containerregistry#2432</a></li> <li>flatten: preserve config and layer media types when flattening by <a href="https://github.com/Subserial"><code>@Subserial</code></a> in <a href="https://redirect.github.com/google/go-containerregistry/pull/2438">google/go-containerregistry#2438</a></li> <li>fix(mutate): make Time layer updates lazy by <a href="https://github.com/amarkdotdev"><code>@amarkdotdev</code></a> in <a href="https://redirect.github.com/google/go-containerregistry/pull/2429">google/go-containerregistry#2429</a></li> <li>build(deps): bump the go-deps group across 2 directories with 3 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/google/go-containerregistry/pull/2439">google/go-containerregistry#2439</a></li> <li>remote: copy manifest annotations to referrers fallback tag descriptors by <a href="https://github.com/codysoyland"><code>@codysoyland</code></a> in <a href="https://redirect.github.com/google/go-containerregistry/pull/2441">google/go-containerregistry#2441</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/shaggyinsomniac"><code>@shaggyinsomniac</code></a> made their first contribution in <a href="https://redirect.github.com/google/go-containerregistry/pull/2426">google/go-containerregistry#2426</a></li> <li><a href="https://github.com/BobDu"><code>@BobDu</code></a> made their first contribution in <a href="https://redirect.github.com/google/go-containerregistry/pull/2428">google/go-containerregistry#2428</a></li> <li><a href="https://github.com/nileshpatil6"><code>@nileshpatil6</code></a> made their first contribution in <a href="https://redirect.github.com/google/go-containerregistry/pull/2420">google/go-containerregistry#2420</a></li> <li><a href="https://github.com/theadsingh"><code>@theadsingh</code></a> made their first contribution in <a href="https://redirect.github.com/google/go-containerregistry/pull/2418">google/go-containerregistry#2418</a></li> <li><a href="https://github.com/locker95"><code>@locker95</code></a> made their first contribution in <a href="https://redirect.github.com/google/go-containerregistry/pull/2431">google/go-containerregistry#2431</a></li> <li><a href="https://github.com/rksharma-owg"><code>@rksharma-owg</code></a> made their first contribution in <a href="https://redirect.github.com/google/go-containerregistry/pull/2435">google/go-containerregistry#2435</a></li> <li><a href="https://github.com/codysoyland"><code>@codysoyland</code></a> made their first contribution in <a href="https://redirect.github.com/google/go-containerregistry/pull/2441">google/go-containerregistry#2441</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/google/go-containerregistry/compare/v0.22.0...v0.22.1">https://github.com/google/go-containerregistry/compare/v0.22.0...v0.22.1</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
Radoslav Dimitrov
|
739b70e8bc |
fix: fail safely in registry admin scripts (#1622)
The takedown script previously treated any nonempty `ALL_VERSIONS` value, including `false`, as permission to delete every version. Require exactly `true` when the variable is set, and reject other values before sending a request. Enable strict shell error handling in the auth helper so a failed identity-token command stops execution before exchanging an empty token. Validation: `bash -n` and `git diff --check` passed. Mocked command checks confirmed that `false`, `1`, and `TRUE` are rejected before network access, and that identity-token retrieval failure stops before the token exchange. The updated scripts also completed the authorized takedown associated with #1563; public API reads confirmed the deleted record and removal from default results. |
||
Jeff Wainwright
|
dd4b2939e3 |
test: isolates temp test fixtures (#1569)
## Motivation and Context Replace shared temp paths with `t.TempDir()`` so each test gets its own cleanup-scoped directory. - This avoids leftover files and cross-test interference. No production code changed. ## How Has This Been Tested? GitHub CI passed. - https://github.com/yowainwright/registry/pull/1 ## Breaking Changes No breaking changes; just tests. ## Types of changes - [x] chore ## Checklist <!-- Go over all the following points, and put an `x` in all the boxes that apply. --> - [x] I have read the [MCP Documentation](https://modelcontextprotocol.io) - [x] My code follows the repository's style guidelines - [x] New and existing tests pass locally - [x] I have added appropriate error handling - [x] I have added or updated documentation as needed ## Additional context Small test-only cleanup. No production code paths are changed. Co-authored-by: Radoslav Dimitrov <radoslav@stacklok.com> |
||
|
Radoslav Dimitrov
|
068a97a2f8 |
fix: identify submitted server version in publish diagnostics (#1621)
Publishing a manifest with a stale version currently produces a duplicate-version error without identifying the version that was submitted. This made a request containing `0.4.5` look like a rejected publication of `0.4.6` in #1615. Include the submitted `name@version` in the CLI output before sending the request and in the API duplicate-version error. HTTP 400, the response structure, and duplicate-rejection behavior remain unchanged. The service wraps the existing error sentinel so `errors.Is` continues to work. Adds a CLI regression test for a failed publication and updates the API duplicate-error assertion. Validation: - Publish command tests passed (`go test ./cmd/publisher/commands -run TestPublishCommand -count=1`). - `git diff --check` passed. - API endpoint tests were attempted but could not run because PostgreSQL was unavailable on localhost:5432; Docker was also unavailable locally. Related to #1615. |
||
|
Radoslav Dimitrov
|
d3fbdc61ce |
ci: detect more invalid server publish paths (#1620)
## Summary - detect publish attempts under `data/data/servers/` - detect server-looking JSON files directly under `data/` - keep the stage-one and privileged stage-two classifiers in sync ## Testing - verified both new patterns against PRs #1600 and #1589 - verified ordinary files such as `data/example.json` remain unmatched - ran `git diff --check` |
||
Nikolife2016
|
5271ba5075 |
docs: add PulseFeed MCP Drift Watch to community projects (#1581)
One line in `docs/community-projects.md` under **Other**, following the format in *Adding Your Project*. **What it is.** A daily external diff of the whole registry population — 25,122 entries as of today — recording what changed in a server *after* it was listed rather than whether it is safe right now: package ownership transferred, an install script added in a later version, repository link removed, package unpublished, a removed name republished by someone else. **Why the distinction matters.** A rug pull is clean at review time by construction: the package collects installs for weeks, then ships the patch. Detecting that needs yesterday's snapshot to exist, which is why the series starts on 2026-07-30 and cannot be reconstructed after the fact. The registry's own moderation policy notes it relies on downstream consumers for this kind of check. **Free, no key, no account:** JSON and RSS feeds filterable to your own package list, a README badge, and webhook alerts. Every day's manifest of dataset digests is timestamped into Bitcoin via OpenTimestamps, so the series can be shown to have existed on a given date by anyone, without trusting us. Placed next to `polygraph` as the nearest precedent for an independent security project in this list. All links in the entry were checked before opening this PR. Nothing else in the file is touched. |
||
Koichi ITO
|
974a523857 |
docs: carry two modelcontextprotocol.io fixes back upstream (#1590)
Both were already fixed on https://modelcontextprotocol.io; this copy is behind. - `faq.mdx`: capitalize PyPI correctly in the abuse reporting steps. https://github.com/modelcontextprotocol/modelcontextprotocol/pull/3153 - `remote-servers.mdx`: recommend Streamable HTTP and link the deprecated features page. The 2026-07-28 draft reclassifies the HTTP+SSE transport as deprecated under the feature lifecycle policy, so SSE should no longer be presented as an equal option. https://github.com/modelcontextprotocol/modelcontextprotocol/pull/3064 ## Types of changes <!-- What types of changes does your code introduce? Put an `x` in all the boxes that apply: --> - [ ] Bug fix (non-breaking change which fixes an issue) - [ ] New feature (non-breaking change which adds functionality) - [ ] Breaking change (fix or feature that would cause existing functionality to change) - [x] Documentation update ## Checklist <!-- Go over all the following points, and put an `x` in all the boxes that apply. --> - [x] I have read the [MCP Documentation](https://modelcontextprotocol.io) - [x] My code follows the repository's style guidelines - [x] New and existing tests pass locally - [x] I have added appropriate error handling - [x] I have added or updated documentation as needed |
||
|
dependabot[bot]
|
1d1eb91e51 |
build(deps): bump github.com/coreos/go-oidc/v3 from 3.20.0 to 3.21.0 in the go-dependencies group (#1619)
Bumps the go-dependencies group with 1 update:
[github.com/coreos/go-oidc/v3](https://github.com/coreos/go-oidc).
Updates `github.com/coreos/go-oidc/v3` from 3.20.0 to 3.21.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/coreos/go-oidc/releases">github.com/coreos/go-oidc/v3's
releases</a>.</em></p>
<blockquote>
<h2>v3.21.0</h2>
<h2>What's Changed</h2>
<ul>
<li>oidc: ignore JWKs with unsupported key types rather than failing by
<a href="https://github.com/nicoske"><code>@nicoske</code></a> in <a
href="https://redirect.github.com/coreos/go-oidc/pull/499">coreos/go-oidc#499</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/nicoske"><code>@nicoske</code></a> made
their first contribution in <a
href="https://redirect.github.com/coreos/go-oidc/pull/499">coreos/go-oidc#499</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/coreos/go-oidc/compare/v3.20.0...v3.21.0">https://github.com/coreos/go-oidc/compare/v3.20.0...v3.21.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="
|
||
|
Radoslav Dimitrov
|
99c9439d6f |
chore: group Dependabot updates (#1618)
## Summary - group all root Go module updates into one weekly PR - group all deployment Go module updates into a separate weekly PR - keep GitHub Actions updates in their own weekly group - leave Docker updates independent ## Validation - parsed `.github/dependabot.yml` successfully as YAML - `git diff --check` passes Co-authored-by: Radoslav Dimitrov <rado@Radoslavs-MacBook-Pro.local> |
||
|
dependabot[bot]
|
30ca36e42e |
build(deps): bump github.com/google/go-containerregistry from 0.21.9 to 0.22.0 (#1576)
Bumps [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry) from 0.21.9 to 0.22.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/google/go-containerregistry/releases">github.com/google/go-containerregistry's releases</a>.</em></p> <blockquote> <h2>v0.22.0</h2> <h2>What's Changed</h2> <ul> <li>mutate: let Time and Canonical take tarball.LayerOption by <a href="https://github.com/mzihlmann"><code>@mzihlmann</code></a> in <a href="https://redirect.github.com/google/go-containerregistry/pull/2403">google/go-containerregistry#2403</a></li> <li>build: add multi-architecture Cloud Build configurations for crane, gcrane, and krane by <a href="https://github.com/tprussak"><code>@tprussak</code></a> in <a href="https://redirect.github.com/google/go-containerregistry/pull/2412">google/go-containerregistry#2412</a></li> <li>remote: resolve push-check credentials against the repository by <a href="https://github.com/mzihlmann"><code>@mzihlmann</code></a> in <a href="https://redirect.github.com/google/go-containerregistry/pull/2411">google/go-containerregistry#2411</a></li> <li>Allow single-character repository paths by <a href="https://github.com/semx"><code>@semx</code></a> in <a href="https://redirect.github.com/google/go-containerregistry/pull/2407">google/go-containerregistry#2407</a></li> <li>fix: add missing substitutions and workspace cleanup to new build files by <a href="https://github.com/tprussak"><code>@tprussak</code></a> in <a href="https://redirect.github.com/google/go-containerregistry/pull/2413">google/go-containerregistry#2413</a></li> <li>remote: retry failed Puller and Pusher initialization by <a href="https://github.com/iahsanGill"><code>@iahsanGill</code></a> in <a href="https://redirect.github.com/google/go-containerregistry/pull/2406">google/go-containerregistry#2406</a></li> <li>build(deps): bump the actions group across 1 directory with 8 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/google/go-containerregistry/pull/2405">google/go-containerregistry#2405</a></li> <li>build(deps): bump the go-deps group across 1 directory with 3 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/google/go-containerregistry/pull/2415">google/go-containerregistry#2415</a></li> <li>go.mod: bump Go version + add toolchain directive to replace .go-version file by <a href="https://github.com/Subserial"><code>@Subserial</code></a> in <a href="https://redirect.github.com/google/go-containerregistry/pull/2416">google/go-containerregistry#2416</a></li> <li>fix: Fix new build options and provenance by <a href="https://github.com/tprussak"><code>@tprussak</code></a> in <a href="https://redirect.github.com/google/go-containerregistry/pull/2417">google/go-containerregistry#2417</a></li> <li>fix(build): unify new build flow into cloudbuild_v2.yaml by <a href="https://github.com/tprussak"><code>@tprussak</code></a> in <a href="https://redirect.github.com/google/go-containerregistry/pull/2419">google/go-containerregistry#2419</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/mzihlmann"><code>@mzihlmann</code></a> made their first contribution in <a href="https://redirect.github.com/google/go-containerregistry/pull/2403">google/go-containerregistry#2403</a></li> <li><a href="https://github.com/tprussak"><code>@tprussak</code></a> made their first contribution in <a href="https://redirect.github.com/google/go-containerregistry/pull/2412">google/go-containerregistry#2412</a></li> <li><a href="https://github.com/semx"><code>@semx</code></a> made their first contribution in <a href="https://redirect.github.com/google/go-containerregistry/pull/2407">google/go-containerregistry#2407</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/google/go-containerregistry/compare/v0.21.9...v0.21.10">https://github.com/google/go-containerregistry/compare/v0.21.9...v0.21.10</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
f98e367dd9 |
build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.259.0 to 3.261.0 in /deploy (#1606)
Bumps [github.com/pulumi/pulumi/sdk/v3](https://github.com/pulumi/pulumi) from 3.259.0 to 3.261.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/pulumi/pulumi/releases">github.com/pulumi/pulumi/sdk/v3's releases</a>.</em></p> <blockquote> <h2>v3.261.0</h2> <h2>3.261.0 (2026-09-02)</h2> <h3>Features</h3> <ul> <li>[engine] Support state migration callbacks on resource registrations <a href="https://redirect.github.com/pulumi/pulumi/pull/24328">#24328</a></li> <li>[cli/env] Add <code>pulumi env setup {aws,azure,gcp}</code> to configure cloud OIDC trust and create the ESC environments that use it <a href="https://redirect.github.com/pulumi/pulumi/pull/23911">#23911</a></li> </ul> <h3>Bug Fixes</h3> <ul> <li>[engine] Report a clear error instead of panicking when the stack's state contains a custom resource with no ID <a href="https://redirect.github.com/pulumi/pulumi/pull/24438">#24438</a></li> <li>[cli] Show the agent account's claim URL instead of an inaccessible View Live link when running on ephemeral agent credentials <a href="https://redirect.github.com/pulumi/pulumi/pull/24476">#24476</a></li> <li>[pcl] Fix a crash when binding a schema property with an integer constant value <a href="https://redirect.github.com/pulumi/pulumi/pull/24480">#24480</a></li> <li>[cli/policy] Avoid hanging when policy pack fails to start up <a href="https://redirect.github.com/pulumi/pulumi/pull/24492">#24492</a></li> <li>[pkg/testing] Fix ProgramTest for providers whose Go module or NuGet package has a double-digit major version <a href="https://redirect.github.com/pulumi/pulumi/pull/24499">#24499</a></li> <li>[sdk] Fix serialization of secret unknowns in NodeJS, Python and PCL <a href="https://redirect.github.com/pulumi/pulumi/pull/24500">#24500</a></li> <li>[engine] Ignore internal property keys (those starting with an underscore) when generating and checking update plans <a href="https://redirect.github.com/pulumi/pulumi/pull/24532">#24532</a></li> </ul> <h3>Improvements</h3> <ul> <li>[sdkgen] Generate precise Python output types for discriminated unions. An array of a union was typed <code>Sequence[Any]</code> and a scalar union <code>Any</code>, while the matching getters on the generated Args classes were already typed <a href="https://redirect.github.com/pulumi/pulumi/pull/24485">#24485</a></li> <li>[sdk/python] Resolve a union value to its member by matching the value's wire shape, so unions whose members carry no constant properties serialize and translate with the right member's property names <a href="https://redirect.github.com/pulumi/pulumi/pull/24484">#24484</a></li> <li>[sdkgen/python] Accept a generated output type wherever the classes-and-dicts input types accept its Args class or TypedDict, so a resource's output can be passed to another resource's input without a type error <a href="https://redirect.github.com/pulumi/pulumi/pull/24507">#24507</a></li> <li>[engine] Send previously persisted outputs to a provider's Check on update, gated by a new sends_old_outputs_to_check handshake capability <a href="https://redirect.github.com/pulumi/pulumi/pull/24524">#24524</a></li> <li>[sdk/python] Add helper methods to transform ResourceOptions to InvokeOptions <a href="https://redirect.github.com/pulumi/pulumi/pull/24533">#24533</a></li> </ul> <h3>Miscellaneous</h3> <ul> <li>[java] Upgrade java to v1.36.3 <a href="https://redirect.github.com/pulumi/pulumi/pull/24509">#24509</a></li> <li>[yaml] Upgrade yaml to v1.38.5 <a href="https://redirect.github.com/pulumi/pulumi/pull/24509">#24509</a></li> <li>[sdk/dotnet] Upgrade dotnet to v3.113.1 <a href="https://redirect.github.com/pulumi/pulumi/pull/24512">#24512</a></li> </ul> <h2>v3.260.0</h2> <h2>3.260.0 (2026-08-28)</h2> <h3>Features</h3> <ul> <li>[cli/deployment] Make <code>pulumi deployment settings get</code> render every source kind and show environment variable values, changing the <code>--output=json</code> shape of <code>environmentVariables</code> from a list of names to a list of objects <a href="https://redirect.github.com/pulumi/pulumi/pull/24284">#24284</a></li> <li>[sdk/go] Support Go 1.27 <a href="https://redirect.github.com/pulumi/pulumi/pull/24401">#24401</a></li> <li>[cli/state] Add <code>pulumi state promote</code> to turn stateful snippets into Pulumi program code <a href="https://redirect.github.com/pulumi/pulumi/pull/24453">#24453</a></li> </ul> <h3>Bug Fixes</h3> <ul> <li>[engine] Replace resources whose deletedWith target is being replaced, instead of leaving them orphaned in state <a href="https://redirect.github.com/pulumi/pulumi/pull/23818">#23818</a></li> <li>[sdk/python] Serialize typed object stack outputs with their wire-format (camelCase) property names, matching other language SDKs <a href="https://redirect.github.com/pulumi/pulumi/pull/24246">#24246</a></li> <li>[cli/neo] Cancelling a task now interrupts a running local tool call instead of waiting for it to finish <a href="https://redirect.github.com/pulumi/pulumi/pull/24268">#24268</a></li> <li>[programgen/python] Access schema properties whose names contain hyphens as attributes under their Python names instead of subscripting <a href="https://redirect.github.com/pulumi/pulumi/pull/24300">#24300</a></li> <li>[programgen/go] Generate valid struct field names for properties whose names contain hyphens <a href="https://redirect.github.com/pulumi/pulumi/pull/24300">#24300</a></li> <li>[sdkgen/nodejs] Quote property names that are not legal identifiers (e.g. kebab-case) in generated declarations and use bracket access for them <a href="https://redirect.github.com/pulumi/pulumi/pull/24300">#24300</a></li> <li>[cli/neo] Cancelling a local tool call no longer leaves the TUI stuck on "Thinking..." with input blocked <a href="https://redirect.github.com/pulumi/pulumi/pull/24318">#24318</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/pulumi/pulumi/blob/master/CHANGELOG.md">github.com/pulumi/pulumi/sdk/v3's changelog</a>.</em></p> <blockquote> <h2>3.261.0 (2026-09-02)</h2> <h3>Features</h3> <ul> <li>[engine] Support state migration callbacks on resource registrations <a href="https://redirect.github.com/pulumi/pulumi/pull/24328">#24328</a></li> <li>[cli/env] Add <code>pulumi env setup {aws,azure,gcp}</code> to configure cloud OIDC trust and create the ESC environments that use it <a href="https://redirect.github.com/pulumi/pulumi/pull/23911">#23911</a></li> </ul> <h3>Bug Fixes</h3> <ul> <li>[engine] Report a clear error instead of panicking when the stack's state contains a custom resource with no ID <a href="https://redirect.github.com/pulumi/pulumi/pull/24438">#24438</a></li> <li>[cli] Show the agent account's claim URL instead of an inaccessible View Live link when running on ephemeral agent credentials <a href="https://redirect.github.com/pulumi/pulumi/pull/24476">#24476</a></li> <li>[pcl] Fix a crash when binding a schema property with an integer constant value <a href="https://redirect.github.com/pulumi/pulumi/pull/24480">#24480</a></li> <li>[cli/policy] Avoid hanging when policy pack fails to start up <a href="https://redirect.github.com/pulumi/pulumi/pull/24492">#24492</a></li> <li>[pkg/testing] Fix ProgramTest for providers whose Go module or NuGet package has a double-digit major version <a href="https://redirect.github.com/pulumi/pulumi/pull/24499">#24499</a></li> <li>[sdk] Fix serialization of secret unknowns in NodeJS, Python and PCL <a href="https://redirect.github.com/pulumi/pulumi/pull/24500">#24500</a></li> <li>[engine] Ignore internal property keys (those starting with an underscore) when generating and checking update plans <a href="https://redirect.github.com/pulumi/pulumi/pull/24532">#24532</a></li> </ul> <h3>Improvements</h3> <ul> <li>[sdkgen] Generate precise Python output types for discriminated unions. An array of a union was typed <code>Sequence[Any]</code> and a scalar union <code>Any</code>, while the matching getters on the generated Args classes were already typed <a href="https://redirect.github.com/pulumi/pulumi/pull/24485">#24485</a></li> <li>[sdk/python] Resolve a union value to its member by matching the value's wire shape, so unions whose members carry no constant properties serialize and translate with the right member's property names <a href="https://redirect.github.com/pulumi/pulumi/pull/24484">#24484</a></li> <li>[sdkgen/python] Accept a generated output type wherever the classes-and-dicts input types accept its Args class or TypedDict, so a resource's output can be passed to another resource's input without a type error <a href="https://redirect.github.com/pulumi/pulumi/pull/24507">#24507</a></li> <li>[engine] Send previously persisted outputs to a provider's Check on update, gated by a new sends_old_outputs_to_check handshake capability <a href="https://redirect.github.com/pulumi/pulumi/pull/24524">#24524</a></li> <li>[sdk/python] Add helper methods to transform ResourceOptions to InvokeOptions <a href="https://redirect.github.com/pulumi/pulumi/pull/24533">#24533</a></li> </ul> <h3>Miscellaneous</h3> <ul> <li>[java] Upgrade java to v1.36.3 <a href="https://redirect.github.com/pulumi/pulumi/pull/24509">#24509</a></li> <li>[yaml] Upgrade yaml to v1.38.5 <a href="https://redirect.github.com/pulumi/pulumi/pull/24509">#24509</a></li> <li>[sdk/dotnet] Upgrade dotnet to v3.113.1 <a href="https://redirect.github.com/pulumi/pulumi/pull/24512">#24512</a></li> </ul> <h2>3.260.0 (2026-08-28)</h2> <h3>Features</h3> <ul> <li>[cli/deployment] Make <code>pulumi deployment settings get</code> render every source kind and show environment variable values, changing the <code>--output=json</code> shape of <code>environmentVariables</code> from a list of names to a list of objects <a href="https://redirect.github.com/pulumi/pulumi/pull/24284">#24284</a></li> <li>[sdk/go] Support Go 1.27 <a href="https://redirect.github.com/pulumi/pulumi/pull/24401">#24401</a></li> <li>[cli/state] Add <code>pulumi state promote</code> to turn stateful snippets into Pulumi program code <a href="https://redirect.github.com/pulumi/pulumi/pull/24453">#24453</a></li> </ul> <h3>Bug Fixes</h3> <ul> <li>[engine] Replace resources whose deletedWith target is being replaced, instead of leaving them orphaned in state <a href="https://redirect.github.com/pulumi/pulumi/pull/23818">#23818</a></li> <li>[sdk/python] Serialize typed object stack outputs with their wire-format (camelCase) property names, matching other language SDKs <a href="https://redirect.github.com/pulumi/pulumi/pull/24246">#24246</a></li> <li>[cli/neo] Cancelling a task now interrupts a running local tool call instead of waiting for it to finish <a href="https://redirect.github.com/pulumi/pulumi/pull/24268">#24268</a></li> <li>[programgen/python] Access schema properties whose names contain hyphens as attributes under their Python names instead of subscripting <a href="https://redirect.github.com/pulumi/pulumi/pull/24300">#24300</a></li> <li>[programgen/go] Generate valid struct field names for properties whose names contain hyphens <a href="https://redirect.github.com/pulumi/pulumi/pull/24300">#24300</a></li> <li>[sdkgen/nodejs] Quote property names that are not legal identifiers (e.g. kebab-case) in generated declarations and use bracket access for them <a href="https://redirect.github.com/pulumi/pulumi/pull/24300">#24300</a></li> <li>[cli/neo] Cancelling a local tool call no longer leaves the TUI stuck on "Thinking..." with input blocked <a href="https://redirect.github.com/pulumi/pulumi/pull/24318">#24318</a></li> <li>[sdk/go] Use resolved environment names when evaluating ESC imports <a href="https://redirect.github.com/pulumi/pulumi/pull/24375">#24375</a></li> <li>[codegen/pcl] Allow output-typed values for the id attribute of a read resource <a href="https://redirect.github.com/pulumi/pulumi/pull/24386">#24386</a></li> <li>[sdkgen/nodejs] Register resolvers for output-only properties in generated Resource.get so they resolve as unknown during preview when the id is unknown <a href="https://redirect.github.com/pulumi/pulumi/pull/24386">#24386</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
e166f76f06 |
build(deps): bump the opentelemetry group across 1 directory with 6 updates (#1607)
Bumps the opentelemetry group with 2 updates in the / directory: [go.opentelemetry.io/contrib/instrumentation/runtime](https://github.com/open-telemetry/opentelemetry-go-contrib) and [go.opentelemetry.io/otel/exporters/prometheus](https://github.com/open-telemetry/opentelemetry-go). Updates `go.opentelemetry.io/contrib/instrumentation/runtime` from 0.70.0 to 0.71.0 <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/open-telemetry/opentelemetry-go-contrib/blob/main/CHANGELOG.md">go.opentelemetry.io/contrib/instrumentation/runtime's changelog</a>.</em></p> <blockquote> <h2>[1.46.0/2.5.3/0.71.0/0.37.3/0.26.0/0.20.1/0.16.3/0.18.0] - 2026-08-25</h2> <p>This release is the last to support [Go 1.25]. The next release will require at least [Go 1.26].</p> <h3>Added</h3> <ul> <li>Add support for the <code>aws.ec2</code> resource detector in <code>go.opentelemetry.io/contrib/otelconf/x</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9139">#9139</a>)</li> <li>Support testing of [Go 1.27]. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9524">#9524</a>)</li> <li>Add <code>go.opentelemetry.io/contrib/detectors/docker</code>, a resource detector for Docker, ported from <code>processor/resourcedetectionprocessor/internal/docker</code> in opentelemetry-collector-contrib. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9001">#9001</a>)</li> <li>Add <code>S3AttributeBuilder</code> to <code>go.opentelemetry.io/contrib/instrumentation/github.com/aws/aws-sdk-go-v2/otelaws</code> that sets S3-specific span attributes following the OpenTelemetry S3 semantic conventions. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9292">#9292</a>)</li> </ul> <h3>Deprecated</h3> <ul> <li>Deprecate <code>go.opentelemetry.io/contrib/instrumentation/github.com/labstack/echo/otelecho</code>. Use <code>github.com/labstack/echo-opentelemetry</code> instead. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9136">#9136</a>)</li> </ul> <h3>Fixed</h3> <ul> <li>Record <code>error.type</code> attribute on server spans in <code>go.opentelemetry.io/contrib/instrumentation/github.com/emicklei/go-restful/otelrestful</code> when a request is cancelled or ends in a 5xx error. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9387">#9387</a>)</li> <li>Report <code>ot-baggage-*</code> extraction errors from <code>go.opentelemetry.io/contrib/propagators/ot</code> to <code>otel.Handle</code> instead of silently discarding them, while still attaching the successfully parsed baggage members to the context. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9395">#9395</a>)</li> <li>Set <code>error.type</code> on the <code>rpc.client.call.duration</code> and <code>rpc.server.call.duration</code> metrics in <code>go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc</code> when the RPC fails with a non-OK status, per the RPC semantic conventions. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9429">#9429</a>)</li> <li>Reject OTLP exporter headers with an empty <code>name</code> in <code>go.opentelemetry.io/contrib/otelconf</code>, <code>go.opentelemetry.io/contrib/otelconf/x</code>, and <code>go.opentelemetry.io/contrib/otelconf/v0.3.0</code>, instead of forwarding invalid header names to OTLP exporters. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9102">#9102</a>)</li> <li><code>go.opentelemetry.io/contrib/detectors/aws/lambda</code> no longer returns an error when run outside of an AWS Lambda environment, matching the no-op behavior of other resource detectors. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9464">#9464</a>)</li> <li>Convert Prometheus untyped metrics to OTLP Gauges in <code>go.opentelemetry.io/contrib/bridges/prometheus</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9099">#9099</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
d08e70b32a |
build(deps): bump github.com/Azure/azure-sdk-for-go/sdk/azidentity from 1.14.0 to 1.14.1 (#1608)
Bumps [github.com/Azure/azure-sdk-for-go/sdk/azidentity](https://github.com/Azure/azure-sdk-for-go) from 1.14.0 to 1.14.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/Azure/azure-sdk-for-go/releases">github.com/Azure/azure-sdk-for-go/sdk/azidentity's releases</a>.</em></p> <blockquote> <h2>sdk/azidentity/v1.14.1</h2> <h2>1.14.1 (2026-08-27)</h2> <h3>Other Changes</h3> <ul> <li>Upgraded dependencies</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
00d5aaad79 |
build(deps): bump github.com/pulumi/pulumi-kubernetes/sdk/v4 from 4.33.0 to 4.34.0 in /deploy (#1609)
Bumps [github.com/pulumi/pulumi-kubernetes/sdk/v4](https://github.com/pulumi/pulumi-kubernetes) from 4.33.0 to 4.34.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/pulumi/pulumi-kubernetes/releases">github.com/pulumi/pulumi-kubernetes/sdk/v4's releases</a>.</em></p> <blockquote> <h2>v4.34.0</h2> <h2>What's Changed</h2> <ul> <li>Generate extension-parameterized SDKs from Kubernetes CRDs by <a href="https://github.com/guineveresaenger"><code>@guineveresaenger</code></a> in <a href="https://redirect.github.com/pulumi/pulumi-kubernetes/pull/4437">pulumi/pulumi-kubernetes#4437</a></li> <li>Fix waitFor JSONPath filters using !=, >= and <= by <a href="https://github.com/matanbaruch"><code>@matanbaruch</code></a> in <a href="https://redirect.github.com/pulumi/pulumi-kubernetes/pull/4524">pulumi/pulumi-kubernetes#4524</a></li> <li>Alias base-provider tokens on extension-served resources by <a href="https://github.com/guineveresaenger"><code>@guineveresaenger</code></a> in <a href="https://redirect.github.com/pulumi/pulumi-kubernetes/pull/4559">pulumi/pulumi-kubernetes#4559</a></li> <li>Upgrade to Kubernetes v1.37 by <a href="https://github.com/guineveresaenger"><code>@guineveresaenger</code></a> in <a href="https://redirect.github.com/pulumi/pulumi-kubernetes/pull/4570">pulumi/pulumi-kubernetes#4570</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/matanbaruch"><code>@matanbaruch</code></a> made their first contribution in <a href="https://redirect.github.com/pulumi/pulumi-kubernetes/pull/4524">pulumi/pulumi-kubernetes#4524</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/pulumi/pulumi-kubernetes/compare/v4.33.0...v4.34.0">https://github.com/pulumi/pulumi-kubernetes/compare/v4.33.0...v4.34.0</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/pulumi/pulumi-kubernetes/blob/master/CHANGELOG.md">github.com/pulumi/pulumi-kubernetes/sdk/v4's changelog</a>.</em></p> <blockquote> <h2>4.34.0 (August 27, 2026)</h2> <h3>Added</h3> <ul> <li>Support adding CustomResourceDefinitions as an extension of the base <code>kubernetes</code> provider via <code>pulumi package add <provider> --extension</code>. Extension-served resources alias their <code>kubernetes:</code>-namespaced token, so state written by a crd2pulumi-generated SDK is adopted rather than replaced.</li> </ul> <h3>Changed</h3> <ul> <li>Upgrade Kubernetes schema and libraries to v1.36.3.</li> <li>Upgrade Kubernetes schema and libraries to v1.36.4.</li> <li>Upgrade Kubernetes schema and libraries to v1.37.0. See the <a href="https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.37.md">Kubernetes 1.37 release notes</a> for upstream API changes.</li> </ul> <h3>Fixed</h3> <ul> <li> <p>Restore <code>scheduling.k8s.io/v1alpha1</code> <code>Workload</code>, which the Kubernetes 1.36 upgrade dropped from the SDKs, and retain <code>scheduling.k8s.io/v1alpha2</code> <code>PodGroup</code> and <code>Workload</code>, which Kubernetes 1.37 removes from its OpenAPI specification. Both remain available to clusters that still serve them, and <code>scheduling.k8s.io/v1beta1</code> now aliases the older versions so that existing resources migrate in place rather than being replaced.</p> </li> <li> <p><a href="https://redirect.github.com/pulumi/pulumi-kubernetes/pull/4524">#4524</a> Fix <code>pulumi.com/waitFor</code> rejecting JSONPath filters that use <code>!=</code>, <code>>=</code> or <code><=</code>. The expression was split on every <code>=</code> that was not part of <code>==</code>, so <code>jsonpath={.status.conditions[?(@.type!="Failed")].status}=True</code> failed to parse. The path and value are now separated structurally, which also allows braces inside string literals. Comparing one path against another (<code>jsonpath={.status.readyReplicas}={.spec.replicas}</code>) is still unsupported, but now reports an error instead of silently never matching.</p> </li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
57b19e27d2 |
build(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.1 (#1616)
Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.82.1 to 1.83.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/grpc/grpc-go/releases">google.golang.org/grpc's releases</a>.</em></p> <blockquote> <h2>Release 1.83.1</h2> <h1>Security</h1> <ul> <li>xds/rbac: Fix a bug where nested <code>Principal</code> or <code>Permission</code> rules with <code>:scheme</code> or <code>grpc-</code> prefixed header matchers were not rejected, which could cause DENY rules to fail open. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9258">#9258</a>) <ul> <li>Special Thanks: <a href="https://github.com/nvxbug"><code>@nvxbug</code></a></li> </ul> </li> <li>xds/rbac: Fix a bug where the <code>host</code> header matcher was not being replaced with <code>:authority</code> in nested <code>Principal</code> or <code>Permission</code> rules. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9258">#9258</a>) <ul> <li>Special Thanks: <a href="https://github.com/nvxbug"><code>@nvxbug</code></a></li> </ul> </li> <li>xds/rbac: Fix a bug where a header matcher whose name was not lowercase, such as <code>X-Role</code>, matched no header, which could cause DENY rules to fail open. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9332">#9332</a>) <ul> <li>Special Thanks: <a href="https://github.com/alimony"><code>@alimony</code></a></li> </ul> </li> <li>xds/rbac: Fix a bug where a <code>:scheme</code> or <code>grpc-</code> prefixed header matcher was accepted when its name was not lowercase. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9332">#9332</a>) <ul> <li>Special Thanks: <a href="https://github.com/alimony"><code>@alimony</code></a></li> </ul> </li> <li>xds/rbac: Fix a bug where a <code>Host</code> header matcher was not replaced with <code>:authority</code>. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9332">#9332</a>) <ul> <li>Special Thanks: <a href="https://github.com/alimony"><code>@alimony</code></a></li> </ul> </li> </ul> <h1>Performance</h1> <ul> <li>transport: Restrict memory overhead of buffering small data frames. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9331">#9331</a>)</li> </ul> <h2>Release 1.83.0</h2> <h1>Security</h1> <ul> <li>server: Stop reading from connections when flooded by HTTP/2 frames to mitigate resource exhaustion. The default value for this limit is 100 frames, excluding DATA and HEADERS, and may be changed by setting environment variable <code>GRPC_GO_EXPERIMENTAL_CONTROL_BUFFER_THROTTLE_LIMIT</code>.</li> <li>xds/rbac: Support <code>Metadata</code> and <code>RequestedServerName</code> permissions matcher fields. If present in a DENY rule, previously these would be ignored and fail-open.</li> <li>xds/rbac: Fix panic when parsing unsupported fields in <code>NotRule</code>/<code>NotId</code> permissions.</li> <li>xds/rbac: Support the deprecated <code>source_ip</code> principal identifier by treating it as equivalent to <code>direct_remote_ip</code>.</li> <li>xds: Fix panic when parsing route header matchers configured with empty <code>exact_match</code>, <code>prefix_match</code>, or <code>suffix_match</code> strings. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9223">#9223</a>)</li> </ul> <h1>New Features</h1> <ul> <li>xds/googlec2p: Enable DirectPath over Interconnect support for on-premises clients via the <code>force-xds</code> target URI query parameter. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9133">#9133</a>)</li> <li>xds: Enable xDS configuration to control which fields get propagated from ORCA backend metric reports to LRS load reports. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9145">#9145</a>)</li> <li>authz: Add <code>OnPolicyUpdate</code> callback to <code>FileWatcherOptions</code> to notify when an authz policy is loaded or updated. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9142">#9142</a>) <ul> <li>Special Thanks: <a href="https://github.com/hnefatl"><code>@hnefatl</code></a></li> </ul> </li> <li>xds: Add support for the GCP Authentication HTTP Filter, which automatically fetches and attaches GCP Service Account Identity JWT tokens to outgoing RPCs. <ul> <li>This feature can be enabled by setting environment variable <code>GRPC_EXPERIMENTAL_XDS_GCP_AUTHENTICATION_FILTER=true</code>. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9119">#9119</a>)</li> </ul> </li> <li>xds: Add support for xDS-based HTTP CONNECT proxies. <ul> <li>This feature can be enabled by setting environment variable <code>GRPC_EXPERIMENTAL_XDS_HTTP_CONNECT=true</code>. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9151">#9151</a>)</li> </ul> </li> <li>xds: Add support for <code>contains_match</code> in route header matchers. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9223">#9223</a>)</li> </ul> <h1>Bug Fixes</h1> <ul> <li>credentials/alts: Fix panic when processing malformed frames by validating that the message frame length exceeds the message type field size. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9197">#9197</a>)</li> <li>grpc: Fix compilation on Plan 9 targets (<code>GOOS=plan9</code>), broken since v1.81.0. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9255">#9255</a>) <ul> <li>Special Thanks: <a href="https://github.com/Yusufihsangorgel"><code>@Yusufihsangorgel</code></a></li> </ul> </li> </ul> <h2>Release 1.82.2</h2> <h1>Security</h1> <ul> <li>server: Reject requests missing both <code>:authority</code> and <code>Host</code> headers with HTTP 400 and status <code>Internal</code>. (<a href="https://redirect.github.com/grpc/grpc-go/pull/9365">grpc/grpc-go#9365</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
da98ceced3 |
build(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.1 in /deploy (#1617)
Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.82.1 to 1.83.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/grpc/grpc-go/releases">google.golang.org/grpc's releases</a>.</em></p> <blockquote> <h2>Release 1.83.1</h2> <h1>Security</h1> <ul> <li>xds/rbac: Fix a bug where nested <code>Principal</code> or <code>Permission</code> rules with <code>:scheme</code> or <code>grpc-</code> prefixed header matchers were not rejected, which could cause DENY rules to fail open. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9258">#9258</a>) <ul> <li>Special Thanks: <a href="https://github.com/nvxbug"><code>@nvxbug</code></a></li> </ul> </li> <li>xds/rbac: Fix a bug where the <code>host</code> header matcher was not being replaced with <code>:authority</code> in nested <code>Principal</code> or <code>Permission</code> rules. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9258">#9258</a>) <ul> <li>Special Thanks: <a href="https://github.com/nvxbug"><code>@nvxbug</code></a></li> </ul> </li> <li>xds/rbac: Fix a bug where a header matcher whose name was not lowercase, such as <code>X-Role</code>, matched no header, which could cause DENY rules to fail open. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9332">#9332</a>) <ul> <li>Special Thanks: <a href="https://github.com/alimony"><code>@alimony</code></a></li> </ul> </li> <li>xds/rbac: Fix a bug where a <code>:scheme</code> or <code>grpc-</code> prefixed header matcher was accepted when its name was not lowercase. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9332">#9332</a>) <ul> <li>Special Thanks: <a href="https://github.com/alimony"><code>@alimony</code></a></li> </ul> </li> <li>xds/rbac: Fix a bug where a <code>Host</code> header matcher was not replaced with <code>:authority</code>. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9332">#9332</a>) <ul> <li>Special Thanks: <a href="https://github.com/alimony"><code>@alimony</code></a></li> </ul> </li> </ul> <h1>Performance</h1> <ul> <li>transport: Restrict memory overhead of buffering small data frames. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9331">#9331</a>)</li> </ul> <h2>Release 1.83.0</h2> <h1>Security</h1> <ul> <li>server: Stop reading from connections when flooded by HTTP/2 frames to mitigate resource exhaustion. The default value for this limit is 100 frames, excluding DATA and HEADERS, and may be changed by setting environment variable <code>GRPC_GO_EXPERIMENTAL_CONTROL_BUFFER_THROTTLE_LIMIT</code>.</li> <li>xds/rbac: Support <code>Metadata</code> and <code>RequestedServerName</code> permissions matcher fields. If present in a DENY rule, previously these would be ignored and fail-open.</li> <li>xds/rbac: Fix panic when parsing unsupported fields in <code>NotRule</code>/<code>NotId</code> permissions.</li> <li>xds/rbac: Support the deprecated <code>source_ip</code> principal identifier by treating it as equivalent to <code>direct_remote_ip</code>.</li> <li>xds: Fix panic when parsing route header matchers configured with empty <code>exact_match</code>, <code>prefix_match</code>, or <code>suffix_match</code> strings. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9223">#9223</a>)</li> </ul> <h1>New Features</h1> <ul> <li>xds/googlec2p: Enable DirectPath over Interconnect support for on-premises clients via the <code>force-xds</code> target URI query parameter. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9133">#9133</a>)</li> <li>xds: Enable xDS configuration to control which fields get propagated from ORCA backend metric reports to LRS load reports. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9145">#9145</a>)</li> <li>authz: Add <code>OnPolicyUpdate</code> callback to <code>FileWatcherOptions</code> to notify when an authz policy is loaded or updated. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9142">#9142</a>) <ul> <li>Special Thanks: <a href="https://github.com/hnefatl"><code>@hnefatl</code></a></li> </ul> </li> <li>xds: Add support for the GCP Authentication HTTP Filter, which automatically fetches and attaches GCP Service Account Identity JWT tokens to outgoing RPCs. <ul> <li>This feature can be enabled by setting environment variable <code>GRPC_EXPERIMENTAL_XDS_GCP_AUTHENTICATION_FILTER=true</code>. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9119">#9119</a>)</li> </ul> </li> <li>xds: Add support for xDS-based HTTP CONNECT proxies. <ul> <li>This feature can be enabled by setting environment variable <code>GRPC_EXPERIMENTAL_XDS_HTTP_CONNECT=true</code>. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9151">#9151</a>)</li> </ul> </li> <li>xds: Add support for <code>contains_match</code> in route header matchers. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9223">#9223</a>)</li> </ul> <h1>Bug Fixes</h1> <ul> <li>credentials/alts: Fix panic when processing malformed frames by validating that the message frame length exceeds the message type field size. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9197">#9197</a>)</li> <li>grpc: Fix compilation on Plan 9 targets (<code>GOOS=plan9</code>), broken since v1.81.0. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9255">#9255</a>) <ul> <li>Special Thanks: <a href="https://github.com/Yusufihsangorgel"><code>@Yusufihsangorgel</code></a></li> </ul> </li> </ul> <h2>Release 1.82.2</h2> <h1>Security</h1> <ul> <li>server: Reject requests missing both <code>:authority</code> and <code>Host</code> headers with HTTP 400 and status <code>Internal</code>. (<a href="https://redirect.github.com/grpc/grpc-go/pull/9365">grpc/grpc-go#9365</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
71f3a1b62e |
build(deps): bump anchore/sbom-action from 0.24.0 to 0.24.2 in the actions group (#1610)
Bumps the actions group with 1 update: [anchore/sbom-action](https://github.com/anchore/sbom-action). Updates `anchore/sbom-action` from 0.24.0 to 0.24.2 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/anchore/sbom-action/releases">anchore/sbom-action's releases</a>.</em></p> <blockquote> <h2>v0.24.2</h2> <h3>Added Features</h3> <ul> <li>bump eslint from 10.8.1 to 10.9.0 [<a href="https://redirect.github.com/anchore/sbom-action/pull/724">#724</a> <a href="https://github.com/dependabot"><code>@dependabot</code></a>]</li> </ul> <h3>Additional Changes</h3> <ul> <li>add makefile target to bump syft [<a href="https://redirect.github.com/anchore/sbom-action/pull/620">#620</a> <a href="https://github.com/willmurphyscode"><code>@willmurphyscode</code></a>]</li> <li>update zizmor workflow triggers [<a href="https://redirect.github.com/anchore/sbom-action/pull/624">#624</a> <a href="https://github.com/wagoodman"><code>@wagoodman</code></a>]</li> <li>require zizmor security events [<a href="https://redirect.github.com/anchore/sbom-action/pull/621">#621</a> <a href="https://github.com/wagoodman"><code>@wagoodman</code></a>]</li> </ul> <p><strong><a href="https://github.com/anchore/sbom-action/compare/v0.24.0...v0.24.2">(Full Changelog)</a></strong></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
6036804f1c |
build(deps): bump the opentelemetry group across 1 directory with 6 updates (#1530)
Bumps the opentelemetry group with 2 updates in the / directory: [go.opentelemetry.io/contrib/instrumentation/runtime](https://github.com/open-telemetry/opentelemetry-go-contrib) and [go.opentelemetry.io/otel/exporters/prometheus](https://github.com/open-telemetry/opentelemetry-go). Updates `go.opentelemetry.io/contrib/instrumentation/runtime` from 0.69.0 to 0.70.0 <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/open-telemetry/opentelemetry-go-contrib/blob/main/CHANGELOG.md">go.opentelemetry.io/contrib/instrumentation/runtime's changelog</a>.</em></p> <blockquote> <h2>[1.45.0/2.5.2/0.70.0/0.37.2/0.25.0/0.20.0/0.16.2/0.17.0] - 2026-08-03</h2> <h3>Added</h3> <ul> <li>Add <code>go.opentelemetry.io/contrib/detectors/ibmcloud/vpc</code>, a new resource detector for IBM Cloud VPC virtual server instances, ported from <code>github.com/open-telemetry/opentelemetry-collector-contrib/processor/resourcedetectionprocessor/internal/ibmcloud/vpc</code>. Detects <code>cloud.provider</code>, <code>cloud.platform</code>, <code>cloud.region</code>, <code>cloud.availability_zone</code>, <code>cloud.account.id</code>, <code>cloud.resource_id</code>, <code>host.id</code>, <code>host.image.id</code>, <code>host.image.name</code>, <code>host.name</code>, and <code>host.type</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9011">#9011</a>)</li> <li>Add <code>go.opentelemetry.io/contrib/detectors/k8sapi</code>, a new resource detector that queries the Kubernetes API. Detects <code>k8s.node.name</code> and <code>k8s.node.uid</code> when <code>K8S_NODE_NAME</code> is set via the downward API, and <code>k8s.cluster.uid</code> derived from the kube-system namespace UID (works on any Kubernetes distribution). (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9108">#9108</a>)</li> <li>Add new <code>elasticbeanstalk</code> resource detector for AWS Elastic Beanstalk, ported from <code>processor/resourcedetectionprocessor/internal/aws/elasticbeanstalk</code> in opentelemetry-collector-contrib. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8993">#8993</a>)</li> <li>The resource created by <code>go.opentelemetry.io/contrib/otelconf</code> now includes <a href="https://pkg.go.dev/go.opentelemetry.io/otel/sdk/resource#Default">default SDK attributes</a>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8990">#8990</a>)</li> <li>Add support for the <code>aws.ecs</code> resource detector in <code>go.opentelemetry.io/contrib/otelconf/x</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8915">#8915</a>)</li> <li>Add support for the <code>aws.eks</code> resource detector in <code>go.opentelemetry.io/contrib/otelconf/x</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9138">#9138</a>)</li> <li>Add support for the <code>azure.vm</code> resource detector in <code>go.opentelemetry.io/contrib/otelconf/x</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9074">#9074</a>)</li> <li>Add support for the <code>gcp</code> resource detector in <code>go.opentelemetry.io/contrib/otelconf/x</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9137">#9137</a>)</li> <li>Add <code>go.opentelemetry.io/contrib/detectors/azure/azureappservice</code>, a new resource detector for Azure App Service. Detects <code>cloud.*</code>, <code>service.name</code>, <code>azure.resource_group.name</code>, <code>azure.app_service.instance.id</code>, and <code>deployment.environment.name</code> from the <code>WEBSITE_*</code> and <code>REGION_NAME</code> environment variables. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9289">#9289</a>)</li> <li>Add <code>azurecontainerapps</code> resource detector for Azure Container Apps. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8939">#8939</a>)</li> <li>Add <code>go.opentelemetry.io/contrib/detectors/azure/azurefunctions</code>, a new resource detector for Azure Functions. Detects <code>cloud.*</code>, <code>service.name</code>, <code>azure.resource_group.name</code>, <code>faas.instance</code>, and <code>deployment.environment.name</code> from the <code>FUNCTIONS_*</code>, <code>WEBSITE_*</code>, <code>CONTAINER_NAME</code>, and <code>REGION_NAME</code> environment variables. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9290">#9290</a>)</li> <li>Add <code>NewResourceDetector</code> along with the <code>WithAttributeFilter</code> and <code>WithTagKeyFilter</code> options in <code>go.opentelemetry.io/contrib/detectors/azure/azurevm</code>. <code>WithAttributeFilter</code> restricts the returned resource to the attributes the filter accepts. <code>WithTagKeyFilter</code> opts in to <code>azure.tag.<name></code> attributes for the VM tags whose keys satisfy the provided predicate; no VM tags are emitted without it. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9162">#9162</a>)</li> <li>Add <code>go.opentelemetry.io/contrib/detectors/vultr</code> — a new resource detector for Vultr Cloud Compute instances, ported from <code>processor/resourcedetectionprocessor/internal/vultr</code> in <code>opentelemetry-collector-contrib</code>. Detects <code>cloud.provider</code>, <code>cloud.platform</code>, <code>cloud.region</code>, <code>host.id</code>, and <code>host.name</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8995">#8995</a>)</li> </ul> <h3>Changed</h3> <ul> <li>Upgrade <code>go.opentelemetry.io/otel/semconv</code> to <code>v1.43.0</code>, including updates across instrumentation and detector modules. See <a href="https://github.com/open-telemetry/semantic-conventions/releases/tag/v1.43.0">semantic-conventions v1.43.0 release</a> for complete details. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9337">#9337</a>)</li> <li>Upgrade <code>go.opentelemetry.io/otel/semconv</code> to <code>v1.42.0</code>, including updates across instrumentation and detector modules. See <a href="https://github.com/open-telemetry/semantic-conventions/releases/tag/v1.42.0">semantic-conventions v1.42.0 release</a> for complete details. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9196">#9196</a>)</li> <li>Use direct normalized-key lookups in <code>Carrier.Get</code> and <code>Carrier.Keys</code> in <code>go.opentelemetry.io/contrib/propagators/envcar</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9112">#9112</a>)</li> <li>Update log bridge conversions to use attribute key-values instead of the removed log key-values in <code>go.opentelemetry.io/contrib/bridges/otellogr</code>, <code>go.opentelemetry.io/contrib/bridges/otellogrus</code>, <code>go.opentelemetry.io/contrib/bridges/otelslog</code>, and <code>go.opentelemetry.io/contrib/bridges/otelzap</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9180">#9180</a>)</li> <li>The <code>Version()</code> function in <code>go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux</code> has been replaced by <code>const Version</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9076">#9076</a>)</li> <li>Set <code>error.type</code> attribute instead of adding <code>exception</code> span events in <code>go.opentelemetry.io/contrib/instrumentation/github.com/gin-gonic/gin/otelgin</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8977">#8977</a>)</li> <li>Prefer the gRPC dial target over the resolved peer IP for the <code>server.address</code> and <code>server.port</code> attributes in <code>go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/8904">#8904</a>)</li> <li>The detector in <code>go.opentelemetry.io/contrib/detectors/azure/azurevm</code> now also detects <code>cloud.account.id</code>, <code>cloud.availability_zone</code>, <code>azure.vm.name</code>, <code>azure.vm.size</code>, <code>azure.vm.scaleset.name</code>, and <code>azure.resource_group.name</code>, and prefers <code>osProfile.computerName</code> for <code>host.name</code> (falling back to the VM name), reconciling it with the collector-contrib Azure resource detector. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9162">#9162</a>)</li> </ul> <h3>Fixed</h3> <ul> <li>Fix Prometheus reader resource label filter configuration in <code>go.opentelemetry.io/contrib/otelconf/v0.2.0</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9062">#9062</a>)</li> <li>Apply <code>resource.detection/development.attributes.included</code> and <code>excluded</code> filtering to resource detector attributes in <code>go.opentelemetry.io/contrib/otelconf/x</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9131">#9131</a>)</li> <li>Honor the context configured with <code>WithContext</code> when constructing resources in <code>go.opentelemetry.io/contrib/otelconf</code> and <code>go.opentelemetry.io/contrib/otelconf/x</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9160">#9160</a>)</li> <li>Handle nil response bodies from custom <code>RoundTripper</code> implementations in <code>go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp</code> without panicking. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9184">#9184</a>)</li> <li>Fix incorrect (overestimated) sum calculation for runtime histograms in <code>go.opentelemetry.io/contrib/instrumentation/runtime</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9063">#9063</a>)</li> <li>Fix <code>Severity.UnmarshalText</code> round trip for positive <code>FATAL</code> offsets above the named range in <code>go.opentelemetry.io/contrib/processors/minsev</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9197">#9197</a>)</li> <li>Reduce binary size by fetching ConfigMaps via <code>rest.HTTPClientFor</code> instead of the Kubernetes clientset in <code>go.opentelemetry.io/contrib/detectors/aws/eks</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9284">#9284</a>)</li> <li><code>TextMapPropagator</code> in <code>go.opentelemetry.io/contrib/propagators/autoprop</code> returns the no-op propagator for empty input, matching the behavior of <code>none</code>. An unknown <code>OTEL_PROPAGATORS</code> value still returns an error with a nil propagator so <code>NewTextMapPropagator</code> falls back to the default TraceContext and Baggage propagators instead of disabling propagation. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9163">#9163</a>)</li> <li>Preserve error-valued attributes nested in a group as grouped attributes instead of silently dropping them in <code>go.opentelemetry.io/contrib/bridges/otelslog</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9238">#9238</a>)</li> <li>Fix a data race in <code>go.opentelemetry.io/contrib/bridges/otelslog</code> where concurrent <code>Handle</code> calls could corrupt each other's log attributes because <code>kvBuffer.KeyValues</code> returned a slice aliasing a shared buffer. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9229">#9229</a>)</li> <li>Avoid a panic in <code>go.opentelemetry.io/contrib/bridges/otelzap</code> when a malformed error field contains a nil or non-error value. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9068">#9068</a>)</li> <li>Use <code>azure.container_app.instance.id</code> instead of <code>service.instance.id</code> for the replica name detected by <code>go.opentelemetry.io/contrib/detectors/azure/azurecontainerapps</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9208">#9208</a>)</li> <li>Preserve the underlying metadata errors returned with partial resources from <code>go.opentelemetry.io/contrib/detectors/gcp</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9069">#9069</a>)</li> <li>Copy <code>MultipartForm</code> back to the request <code>otelmux.Middleware</code> was given after the wrapped handler returns, so <code>net/http</code> can find and remove the temp files <code>ParseMultipartForm</code> created on the context-derived request copy, when <code>otelmux.Middleware</code> wraps a handler directly, in <code>go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux</code>. This does not cover a handler panic, nor the common <code>router.Use(...)</code> integration, where <code>gorilla/mux</code>'s own routing step makes an additional request copy the middleware cannot write back through; see <a href="https://redirect.github.com/gorilla/mux/pull/777">gorilla/mux#777</a>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9361">#9361</a>)</li> <li>Report the <code>b3</code> header from <code>Fields()</code> for the default <code>B3Unspecified</code> single-header injection encoding, matching what <code>Inject</code> writes, in <code>go.opentelemetry.io/contrib/propagators/b3</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9273">#9273</a>)</li> <li>Fix <code>go.opentelemetry.io/contrib/propagators/aws/xray</code> producing deterministic trace and span IDs when the seed read from <code>crypto/rand</code> silently failed, by switching to <code>math/rand/v2</code>'s concurrency-safe top-level generator. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9359">#9359</a>)</li> <li>Strip connection number suffix from connection ID in <code>go.opentelemetry.io/contrib/instrumentation/go.mongodb.org/mongo-driver/v2/mongo/otelmongo</code> to prevent unbounded metric cardinality. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/9352">#9352</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
3c1ee7d272 |
build(deps): bump github.com/google/go-containerregistry from 0.21.8 to 0.21.9 (#1531)
Bumps [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry) from 0.21.8 to 0.21.9. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/google/go-containerregistry/releases">github.com/google/go-containerregistry's releases</a>.</em></p> <blockquote> <h2>v0.21.9</h2> <h2>What's Changed</h2> <ul> <li>actions: pin slsa generator by version by <a href="https://github.com/Subserial"><code>@Subserial</code></a> in <a href="https://redirect.github.com/google/go-containerregistry/pull/2395">google/go-containerregistry#2395</a></li> <li>fix: prevent data race on scope refreshes within remote.writer by <a href="https://github.com/Subserial"><code>@Subserial</code></a> in <a href="https://redirect.github.com/google/go-containerregistry/pull/2396">google/go-containerregistry#2396</a></li> <li>fix: remove '.' from unsafe path prefixes by <a href="https://github.com/Subserial"><code>@Subserial</code></a> in <a href="https://redirect.github.com/google/go-containerregistry/pull/2400">google/go-containerregistry#2400</a></li> <li>build(deps): bump the actions group with 3 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/google/go-containerregistry/pull/2398">google/go-containerregistry#2398</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/google/go-containerregistry/compare/v0.21.8...v0.21.9">https://github.com/google/go-containerregistry/compare/v0.21.8...v0.21.9</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
Radoslav Dimitrov
|
5022e04399 |
ci: widen the publish-attempt path list (#1560)
#1524 tried to publish by adding `data/servers/io.decisionrules/server.json`. The detector ran fine and logged: ``` Non-publish file changed: data/servers/io.decisionrules/server.json PR #1524 match=false ``` The path list only knew `servers/**` at the repo root and exactly `data/seed.json`. Putting the file under `data/servers/` is a natural guess given `data/seed.json` exists, and it fell straight through. Adds `data/servers/**` plus root-level `server.json` / `servers.json`. `find` confirms nothing legitimate lives at any of those paths today. The list stays explicit rather than becoming a broad `**/server.json` glob. The classifier only flags a PR when *every* changed file matches, which makes widening asymmetric: too narrow silently misses spam, too broad auto-closes a legitimate single-file PR. Both copies of the list (stage 1 and stage 2) are updated identically, with a comment on each pointing at the other. ## Testing `actionlint` clean. macOS ships bash 3.2, so I extracted the literal `if [[ ... ]]` condition from each workflow file and ran it under bash 5 in Docker — testing the shipped text rather than a retyped copy. Both copies are byte-identical and agree: ``` MATCH data/servers/io.decisionrules/server.json # PR 1524 MATCH servers/com.aradia/x.json # PR 1549 MATCH data/seed.json MATCH server.json MATCH servers.json keep internal/api/handler.go keep internal/servers/service.go keep data/servers.md keep docs/README.md ``` Also dry-ran the full classifier against all 35 currently-open PRs from untrusted authors: **0 would be closed**. No legitimate open PR is affected. ## Known remaining gap (deliberately not fixed here) The detector does not run at all for authors new to GitHub. This repo's Actions approval policy is `first_time_contributors_new_to_github`, so their fork PRs sit in `action_required` until a maintainer approves the run. That is why #1549 was never flagged. I'm leaving that alone for now because the numbers don't justify the fix. Since the automation landed on 2026-07-09 it has had **71 detect runs: 70 ran, 1 was gated**. It has correctly closed 3 publish attempts (SAGE, Diagram Generation API, Kairos Signal) and missed 2 — one to the path bug this PR fixes, one to the gate. So the gate costs roughly one missed PR every six weeks, and those get closed manually within a day. The only ways around it are `pull_request_target` (runs untrusted PRs in a privileged context — one future `actions/checkout` from being a privilege-escalation hole) or a scheduled sweep (works, but trades the two-stage design for cron semantics and a ~15 min delay). Neither seems worth it at that rate. Happy to open a follow-up if you'd rather close the gap. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> |
||
|
Radoslav Dimitrov
|
8759d9d8c0 |
ci: bump golangci-lint to v2.13.1 to fix panic on Go 1.27 (#1561)
CI is red on `main` and on every open PR (including the Dependabot PRs #1531, #1552–#1554) with: ``` panic: file requires newer Go version go1.27 (application built with go1.26) golangci-lint exit with code 2 ``` ## Cause `actions/setup-go` with `go-version: 'stable'` started resolving to **go1.27.0**. The pinned golangci-lint **v2.11.4** release binary is built with **go1.26**, and its `go/types` refuses to typecheck source files declaring a newer language version. Nothing in the failing PRs is at fault. ## Fix Bump to **golangci-lint v2.13.1**, whose release binaries are built with go1.27, so linting works under `stable` again. That bump also pulls in newer linter versions, which surface 57 findings this tree did not have before. Handled as follows: | Linter | Count | Resolution | |---|---|---| | `goconst` | 50 | 39 were repeated literals in `_test.go` files — goconst started counting those in v2.12.0 (golangci-lint#6480 exposed `ignore-tests`). Fixture data like `"1.0.0"` (89 occurrences) is not a missing constant, so `goconst.ignore-tests: true`. The other 11 were real duplication in production code (OpenAPI tags, the `bearer` security scheme name, `$ref`, `http`/`https`) and became named constants. | | `gosec` G710 | 1 | **True positive, fixed.** See below. | | `staticcheck` SA1019 | 6 | Go 1.26 deprecated `ecdsa.PublicKey.X/Y` and `PrivateKey.D`. Annotated with the same targeted `nolint` + rationale already used for `ScalarBaseMult` in `cmd/publisher/auth/common.go`. | ### The open redirect is real `TrailingSlashMiddleware` copied the entire `*url.URL` before rewriting the path. For an absolute-form request URI — legal for a Go HTTP server to parse, e.g. `GET http://evil.com/foo/ HTTP/1.1` — `r.URL.Scheme` and `r.URL.Host` are populated, and they were echoed straight back in the `Location` header. The redirect target is now built from the cleaned path and query alone. The existing `path.Clean` hardening for GHSA-v8vw-gw5j-w7m6 (protocol-relative `//evil.com/`) is unchanged. ### Also Switched `gomodguard` → `gomodguard_v2`; the former is deprecated as of v2.12.0 and was emitting a warning on every run. ## Verification - `golangci-lint v2.13.1` against this tree: **0 issues**, no deprecation warnings - `make validate`: all validations passed - `go build ./...` and tests for every touched package pass (DB-backed tests need Postgres; left to CI) ## Note on migrating the ecdsa key paths Moving those six sites to `PublicKey.Bytes` / `ParseUncompressedPublicKey` / `crypto/ecdh` touches key parsing and signature verification. It should be its own reviewed PR rather than riding along on a CI unblock. Happy to open one. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> |
||
|
dependabot[bot]
|
4ec2ed3f9f |
build(deps): bump golang.org/x/mod from 0.38.0 to 0.40.0 (#1552)
Bumps [golang.org/x/mod](https://github.com/golang/mod) from 0.38.0 to 0.40.0. <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
17dec17a41 |
build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.255.0 to 3.257.0 in /deploy (#1553)
Bumps [github.com/pulumi/pulumi/sdk/v3](https://github.com/pulumi/pulumi) from 3.255.0 to 3.257.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/pulumi/pulumi/releases">github.com/pulumi/pulumi/sdk/v3's releases</a>.</em></p> <blockquote> <h2>v3.257.0</h2> <h2>3.257.0 (2026-08-13)</h2> <h3>Features</h3> <ul> <li>[cli] Offer to create a first project after logging in to an account with no stacks <a href="https://redirect.github.com/pulumi/pulumi/pull/24133">#24133</a></li> <li>[cli/do] Auto-assign identifiers to existing stack resources in <code>pulumi do</code> input expressions, and add <code>pulumi do show-resources</code> to list them <a href="https://redirect.github.com/pulumi/pulumi/pull/24184">#24184</a></li> <li>[cli/do] Make "<code>pulumi do <pkg> <resource> patch <name></code> work in stateful mode, overlaying the supplied inputs onto the existing snippet" <a href="https://redirect.github.com/pulumi/pulumi/pull/24295">#24295</a></li> <li>[cli/state] Implement <code>pulumi state get</code> to show individual resources <a href="https://redirect.github.com/pulumi/pulumi/pull/24191">#24191</a></li> <li>[cli/do] Fall back to an auto-created project and stack under PULUMI_HOME when <code>pulumi do</code> is invoked outside of a Pulumi project <a href="https://redirect.github.com/pulumi/pulumi/pull/24231">#24231</a></li> </ul> <h3>Bug Fixes</h3> <ul> <li>[sdkgen/go] Generated output-form invokes pass their arguments to the core SDK without resolving them first, so invoke dependencies can be inferred from arguments; generated SDKs now require pulumi SDK v3.255.0 or later <a href="https://redirect.github.com/pulumi/pulumi/pull/24060">#24060</a></li> <li>[cli] Make '<code>pulumi stack history events --summary</code> report the program errors from the language host <a href="https://redirect.github.com/pulumi/pulumi/pull/24111">#24111</a></li> <li>[cli/cloud] <code>pulumi api</code>: repeated <code>-H</code>/<code>--header</code> values for the same header name now all reach the wire, instead of each one silently overwriting the last <a href="https://redirect.github.com/pulumi/pulumi/pull/24180">#24180</a></li> <li>[cli/package] Maintain <code>--server</code> when adding to the packages section of Pulumi.yaml <a href="https://redirect.github.com/pulumi/pulumi/pull/24189">#24189</a></li> <li>[sdk/go] Fix panics in hooks to not crash the entire process <a href="https://redirect.github.com/pulumi/pulumi/pull/24218">#24218</a></li> <li>[programgen/go] <code>for</code> expressions are now generated as Go loops <a href="https://redirect.github.com/pulumi/pulumi/pull/24228">#24228</a></li> <li>[programgen/go] Fix invalid <code>_ := index</code> statement emitted for resources with a numeric <code>range</code> whose value variable is unused <a href="https://redirect.github.com/pulumi/pulumi/pull/24227">#24227</a></li> <li>[sdk/python] Report an error instead of hanging when a Python resource depends on its own parent <a href="https://redirect.github.com/pulumi/pulumi/pull/24230">#24230</a></li> <li>[sdkgen/go] Generate the missing Go input types for resource input properties that are deeply nested collections of object types <a href="https://redirect.github.com/pulumi/pulumi/pull/24236">#24236</a></li> <li>[programgen/go] Rename properties that collide with reserved names (e.g. <code>elementType</code>) the same way SDK codegen does, instead of emitting uncompilable code <a href="https://redirect.github.com/pulumi/pulumi/pull/24235">#24235</a></li> <li>[cli/display] Show the value being added when a refresh or provider diff reports an added property <a href="https://redirect.github.com/pulumi/pulumi/pull/24245">#24245</a></li> <li>[cli/plugin] Track when a plugin was last run so <code>pulumi plugin ls</code> reports an accurate last-used time on all platforms <a href="https://redirect.github.com/pulumi/pulumi/pull/24251">#24251</a></li> <li>[engine] Show secrets in diff display when <code>--show-secrets</code> is passed <a href="https://redirect.github.com/pulumi/pulumi/pull/24253">#24253</a></li> <li>[cli] Exit promptly when a command is cancelled while an HTTP request is being retried <a href="https://redirect.github.com/pulumi/pulumi/pull/24276">#24276</a></li> </ul> <h3>Improvements</h3> <ul> <li>[sdk/nodejs] Improve error message when resource registrations are still pending when pulumi exits <a href="https://redirect.github.com/pulumi/pulumi/pull/24082">#24082</a></li> <li>[cli] Pass the invoked command (e.g. <code>pulumi new</code>) to the browser-based login/signup flow so Pulumi Cloud can attribute signups to the command that triggered them <a href="https://redirect.github.com/pulumi/pulumi/pull/24192">#24192</a></li> </ul> <h3>Miscellaneous</h3> <ul> <li>[sdkgen] Extension-parameterized packages now namespace their resource and function tokens under their own package name rather than the base provider's <a href="https://redirect.github.com/pulumi/pulumi/pull/24143">#24143</a></li> <li>[java] Upgrade java to v1.35.0 <a href="https://redirect.github.com/pulumi/pulumi/pull/24202">#24202</a></li> <li>[backend/diy] The deprecation warning is now an error. PULUMI_DIY_BACKEND_IGNORE_DEPRECATION_WARNING is now PULUMI_DIY_BACKEND_IGNORE_DEPRECATION_ERROR. <a href="https://redirect.github.com/pulumi/pulumi/pull/24216">#24216</a></li> <li>[java] Upgrade java to v1.36.0 <a href="https://redirect.github.com/pulumi/pulumi/pull/24243">#24243</a></li> <li>[sdk/dotnet] Upgrade dotnet to v3.111.1 <a href="https://redirect.github.com/pulumi/pulumi/pull/24249">#24249</a></li> </ul> <h2>v3.256.0</h2> <h2>3.256.0 (2026-08-04)</h2> <h3>Features</h3> <ul> <li>[cli] Add <code>--ignore-protect</code> flag to <code>pulumi up</code>, <code>pulumi preview</code> and <code>pulumi destroy</code> to allow deleting protected resources without unprotecting them in the state first <a href="https://redirect.github.com/pulumi/pulumi/pull/24053">#24053</a></li> <li>[cli/env] Add an optional <code>--export-env-vars</code> flag to the <code>env provider {aws,azure,gcp}-login</code> commands to also set the standard SDK environment variables referencing the login outputs <a href="https://redirect.github.com/pulumi/pulumi/pull/24055">#24055</a></li> <li>[cli] Add a <code>--server</code> flag to <code>pulumi package add</code>, <code>publish</code>, <code>get-schema</code>, <code>get-mapping</code>, <code>gen-sdk</code>, <code>info</code> and <code>pulumi schema check</code> that skips package resolution and uses the given URL as the plugin download URL <a href="https://redirect.github.com/pulumi/pulumi/pull/24107">#24107</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/pulumi/pulumi/blob/master/CHANGELOG.md">github.com/pulumi/pulumi/sdk/v3's changelog</a>.</em></p> <blockquote> <h2>3.257.0 (2026-08-13)</h2> <h3>Features</h3> <ul> <li>[cli] Offer to create a first project after logging in to an account with no stacks <a href="https://redirect.github.com/pulumi/pulumi/pull/24133">#24133</a></li> <li>[cli/do] Auto-assign identifiers to existing stack resources in <code>pulumi do</code> input expressions, and add <code>pulumi do show-resources</code> to list them <a href="https://redirect.github.com/pulumi/pulumi/pull/24184">#24184</a></li> <li>[cli/do] Make "<code>pulumi do <pkg> <resource> patch <name></code> work in stateful mode, overlaying the supplied inputs onto the existing snippet" <a href="https://redirect.github.com/pulumi/pulumi/pull/24295">#24295</a></li> <li>[cli/state] Implement <code>pulumi state get</code> to show individual resources <a href="https://redirect.github.com/pulumi/pulumi/pull/24191">#24191</a></li> <li>[cli/do] Fall back to an auto-created project and stack under PULUMI_HOME when <code>pulumi do</code> is invoked outside of a Pulumi project <a href="https://redirect.github.com/pulumi/pulumi/pull/24231">#24231</a></li> </ul> <h3>Bug Fixes</h3> <ul> <li>[sdkgen/go] Generated output-form invokes pass their arguments to the core SDK without resolving them first, so invoke dependencies can be inferred from arguments; generated SDKs now require pulumi SDK v3.255.0 or later <a href="https://redirect.github.com/pulumi/pulumi/pull/24060">#24060</a></li> <li>[cli] Make '<code>pulumi stack history events --summary</code> report the program errors from the language host <a href="https://redirect.github.com/pulumi/pulumi/pull/24111">#24111</a></li> <li>[cli/cloud] <code>pulumi api</code>: repeated <code>-H</code>/<code>--header</code> values for the same header name now all reach the wire, instead of each one silently overwriting the last <a href="https://redirect.github.com/pulumi/pulumi/pull/24180">#24180</a></li> <li>[cli/package] Maintain <code>--server</code> when adding to the packages section of Pulumi.yaml <a href="https://redirect.github.com/pulumi/pulumi/pull/24189">#24189</a></li> <li>[sdk/go] Fix panics in hooks to not crash the entire process <a href="https://redirect.github.com/pulumi/pulumi/pull/24218">#24218</a></li> <li>[programgen/go] <code>for</code> expressions are now generated as Go loops <a href="https://redirect.github.com/pulumi/pulumi/pull/24228">#24228</a></li> <li>[programgen/go] Fix invalid <code>_ := index</code> statement emitted for resources with a numeric <code>range</code> whose value variable is unused <a href="https://redirect.github.com/pulumi/pulumi/pull/24227">#24227</a></li> <li>[sdk/python] Report an error instead of hanging when a Python resource depends on its own parent <a href="https://redirect.github.com/pulumi/pulumi/pull/24230">#24230</a></li> <li>[sdkgen/go] Generate the missing Go input types for resource input properties that are deeply nested collections of object types <a href="https://redirect.github.com/pulumi/pulumi/pull/24236">#24236</a></li> <li>[programgen/go] Rename properties that collide with reserved names (e.g. <code>elementType</code>) the same way SDK codegen does, instead of emitting uncompilable code <a href="https://redirect.github.com/pulumi/pulumi/pull/24235">#24235</a></li> <li>[cli/display] Show the value being added when a refresh or provider diff reports an added property <a href="https://redirect.github.com/pulumi/pulumi/pull/24245">#24245</a></li> <li>[cli/plugin] Track when a plugin was last run so <code>pulumi plugin ls</code> reports an accurate last-used time on all platforms <a href="https://redirect.github.com/pulumi/pulumi/pull/24251">#24251</a></li> <li>[engine] Show secrets in diff display when <code>--show-secrets</code> is passed <a href="https://redirect.github.com/pulumi/pulumi/pull/24253">#24253</a></li> <li>[cli] Exit promptly when a command is cancelled while an HTTP request is being retried <a href="https://redirect.github.com/pulumi/pulumi/pull/24276">#24276</a></li> </ul> <h3>Improvements</h3> <ul> <li>[sdk/nodejs] Improve error message when resource registrations are still pending when pulumi exits <a href="https://redirect.github.com/pulumi/pulumi/pull/24082">#24082</a></li> <li>[cli] Pass the invoked command (e.g. <code>pulumi new</code>) to the browser-based login/signup flow so Pulumi Cloud can attribute signups to the command that triggered them <a href="https://redirect.github.com/pulumi/pulumi/pull/24192">#24192</a></li> </ul> <h3>Miscellaneous</h3> <ul> <li>[sdkgen] Extension-parameterized packages now namespace their resource and function tokens under their own package name rather than the base provider's <a href="https://redirect.github.com/pulumi/pulumi/pull/24143">#24143</a></li> <li>[java] Upgrade java to v1.35.0 <a href="https://redirect.github.com/pulumi/pulumi/pull/24202">#24202</a></li> <li>[backend/diy] The deprecation warning is now an error. PULUMI_DIY_BACKEND_IGNORE_DEPRECATION_WARNING is now PULUMI_DIY_BACKEND_IGNORE_DEPRECATION_ERROR. <a href="https://redirect.github.com/pulumi/pulumi/pull/24216">#24216</a></li> <li>[java] Upgrade java to v1.36.0 <a href="https://redirect.github.com/pulumi/pulumi/pull/24243">#24243</a></li> <li>[sdk/dotnet] Upgrade dotnet to v3.111.1 <a href="https://redirect.github.com/pulumi/pulumi/pull/24249">#24249</a></li> </ul> <h2>3.256.0 (2026-08-04)</h2> <h3>Features</h3> <ul> <li>[cli] Add <code>--ignore-protect</code> flag to <code>pulumi up</code>, <code>pulumi preview</code> and <code>pulumi destroy</code> to allow deleting protected resources without unprotecting them in the state first <a href="https://redirect.github.com/pulumi/pulumi/pull/24053">#24053</a></li> <li>[cli/env] Add an optional <code>--export-env-vars</code> flag to the <code>env provider {aws,azure,gcp}-login</code> commands to also set the standard SDK environment variables referencing the login outputs <a href="https://redirect.github.com/pulumi/pulumi/pull/24055">#24055</a></li> <li>[cli] Add a <code>--server</code> flag to <code>pulumi package add</code>, <code>publish</code>, <code>get-schema</code>, <code>get-mapping</code>, <code>gen-sdk</code>, <code>info</code> and <code>pulumi schema check</code> that skips package resolution and uses the given URL as the plugin download URL <a href="https://redirect.github.com/pulumi/pulumi/pull/24107">#24107</a></li> </ul> <h3>Bug Fixes</h3> <ul> <li>[backend/service] Fix <code>pulumi login --insecure</code> not being reflected in the stack's service secrets manager state, which caused TLS verification failures against self-hosted backends using self-signed certificates <a href="https://redirect.github.com/pulumi/pulumi/pull/24134">#24134</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
91cc4aed20 |
build(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.0 (#1554)
Bumps [github.com/stretchr/testify](https://github.com/stretchr/testify) from 1.11.1 to 1.12.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/stretchr/testify/releases">github.com/stretchr/testify's releases</a>.</em></p> <blockquote> <h2>v1.12.0</h2> <h2>What's Changed</h2> <h3>Functional Changes</h3> <ul> <li>assert: make *AssertionFunc types just aliases by <a href="https://github.com/dolmen"><code>@dolmen</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1563">stretchr/testify#1563</a></li> </ul> <h3>Fixes</h3> <ul> <li>mock: avoid panic when expected type is nil in Arguments.Diff by <a href="https://github.com/mutaiib"><code>@mutaiib</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1775">stretchr/testify#1775</a></li> <li>mock: revert to pre-v1.11.0 argument matching behavior for mutating stringers by <a href="https://github.com/brackendawson"><code>@brackendawson</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1786">stretchr/testify#1786</a></li> <li>suite: validate method signatures and continue execution for valid tests by <a href="https://github.com/vyas-git"><code>@vyas-git</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1665">stretchr/testify#1665</a></li> <li>assert.PanicsWithError: report error message by <a href="https://github.com/olivergondza"><code>@olivergondza</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1400">stretchr/testify#1400</a></li> <li>assert: IsIncreasing et al can return false w/out failing by <a href="https://github.com/brackendawson"><code>@brackendawson</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1787">stretchr/testify#1787</a></li> <li>add type to error message of assert.Same by <a href="https://github.com/egawata"><code>@egawata</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1792">stretchr/testify#1792</a></li> <li>mock.AssertExpectationsForObjects fix panic with wrong testObject type. by <a href="https://github.com/brackendawson"><code>@brackendawson</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1795">stretchr/testify#1795</a></li> <li>assert: truncate very long objects in test failure messages by <a href="https://github.com/brackendawson"><code>@brackendawson</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1646">stretchr/testify#1646</a></li> <li>assert: fix NotSubset error messages using %#v instead of %q (fixes <a href="https://redirect.github.com/stretchr/testify/issues/1800">#1800</a>) by <a href="https://github.com/nghiack7"><code>@nghiack7</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1888">stretchr/testify#1888</a></li> <li>suite: prevent panic when SetupTest skips with HandleStats by <a href="https://github.com/blackwell-systems"><code>@blackwell-systems</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1877">stretchr/testify#1877</a></li> </ul> <h3>Documentation, Build & CI</h3> <ul> <li>CI: test also with Go 1.23 by <a href="https://github.com/dolmen"><code>@dolmen</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1783">stretchr/testify#1783</a></li> <li>Vendor unmaintained github.com/pmezard/go-difflib by <a href="https://github.com/brackendawson"><code>@brackendawson</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1708">stretchr/testify#1708</a></li> <li>Promote ccoVeille to maintainer by <a href="https://github.com/brackendawson"><code>@brackendawson</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1784">stretchr/testify#1784</a></li> <li>build(deps): bump actions/setup-go from 5 to 6 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/stretchr/testify/pull/1790">stretchr/testify#1790</a></li> <li>assert.YAMLEq: Document mutlidoc behavior by <a href="https://github.com/brackendawson"><code>@brackendawson</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1791">stretchr/testify#1791</a></li> <li>_codegen: copy dependency github.com/ernesto-jimenez/gogen/imports by <a href="https://github.com/dolmen"><code>@dolmen</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1782">stretchr/testify#1782</a></li> <li>doc: remove ineffective inline code blocks by <a href="https://github.com/brackendawson"><code>@brackendawson</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1714">stretchr/testify#1714</a></li> <li>Tag generated assertions as non-generated in new .gitattributes by <a href="https://github.com/ubunatic"><code>@ubunatic</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1815">stretchr/testify#1815</a></li> <li>chore: vendor go-spew from <a href="https://github.com/davecgh/go-spew">https://github.com/davecgh/go-spew</a> by <a href="https://github.com/ccoVeille"><code>@ccoVeille</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1827">stretchr/testify#1827</a></li> <li>require: fix godoc generation for assertions returning a bool by <a href="https://github.com/Baxromumarov"><code>@Baxromumarov</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1850">stretchr/testify#1850</a></li> <li>docs(require): correct example usage to use assert.CollectT (require.CollectT does not exist) by <a href="https://github.com/a2not"><code>@a2not</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1821">stretchr/testify#1821</a></li> <li>docs: Fix EventuallyWithTf documentation with proper placement of formatting arguments by <a href="https://github.com/a2not"><code>@a2not</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1842">stretchr/testify#1842</a></li> <li>EMERITUS.md: add <a href="https://github.com/tylerb"><code>@tylerb</code></a> by <a href="https://github.com/dolmen"><code>@dolmen</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1812">stretchr/testify#1812</a></li> <li>CI: test also with Go 1.24 by <a href="https://github.com/alexandear"><code>@alexandear</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1856">stretchr/testify#1856</a></li> <li>deps: bump objx to v0.5.3 and remove dependency cycle issue by <a href="https://github.com/ccoVeille"><code>@ccoVeille</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1823">stretchr/testify#1823</a></li> <li>CI: upgrade GitHub Actions and pin hashes by <a href="https://github.com/SuperQ"><code>@SuperQ</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1883">stretchr/testify#1883</a></li> <li>CI: add _readme-gofmt tool to reformat Go code in README by <a href="https://github.com/dolmen"><code>@dolmen</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1889">stretchr/testify#1889</a></li> <li>CI: add check of GitHub Action pinned hashes against tag by <a href="https://github.com/dolmen"><code>@dolmen</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1885">stretchr/testify#1885</a></li> <li>_codegen: modernize by <a href="https://github.com/dolmen"><code>@dolmen</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1890">stretchr/testify#1890</a></li> <li>build(deps): bump actions/checkout from 6.0.2 to 6.0.3 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/stretchr/testify/pull/1906">stretchr/testify#1906</a></li> <li>mock: Mock.Return does not exist anymore by <a href="https://github.com/Kentzo"><code>@Kentzo</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1905">stretchr/testify#1905</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/mutaiib"><code>@mutaiib</code></a> made their first contribution in <a href="https://redirect.github.com/stretchr/testify/pull/1775">stretchr/testify#1775</a></li> <li><a href="https://github.com/vyas-git"><code>@vyas-git</code></a> made their first contribution in <a href="https://redirect.github.com/stretchr/testify/pull/1665">stretchr/testify#1665</a></li> <li><a href="https://github.com/olivergondza"><code>@olivergondza</code></a> made their first contribution in <a href="https://redirect.github.com/stretchr/testify/pull/1400">stretchr/testify#1400</a></li> <li><a href="https://github.com/egawata"><code>@egawata</code></a> made their first contribution in <a href="https://redirect.github.com/stretchr/testify/pull/1792">stretchr/testify#1792</a></li> <li><a href="https://github.com/ubunatic"><code>@ubunatic</code></a> made their first contribution in <a href="https://redirect.github.com/stretchr/testify/pull/1815">stretchr/testify#1815</a></li> <li><a href="https://github.com/Baxromumarov"><code>@Baxromumarov</code></a> made their first contribution in <a href="https://redirect.github.com/stretchr/testify/pull/1850">stretchr/testify#1850</a></li> <li><a href="https://github.com/a2not"><code>@a2not</code></a> made their first contribution in <a href="https://redirect.github.com/stretchr/testify/pull/1821">stretchr/testify#1821</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
Radoslav Dimitrov
|
a25f166b4b |
docs: remove stale complete.md and fix remaining stale references (#1522)
Deletes `complete.md` and cleans up the last references to the pre-restructuring docs layout. ## Why `complete.md` goes It is 2,944 lines (31% of all documentation lines in the repo) self-described as *"all documentation from the docs/ directory compiled into a single markdown file"*. But: - **No generator exists.** No make target, no workflow, no script. `grep -rn "complete\.md"` finds **zero** references anywhere in the repo. - **It mirrors a docs tree that no longer exists** — `docs/guides/`, `docs/explanations/`, `docs/concepts/`. - **All 72 of its relative links are broken**, and six of the basenames it references exist nowhere in the repo. - **~14 current docs are missing from it entirely** (`about.mdx`, `authentication.mdx`, `package-types.mdx`, both CHANGELOGs, ...). - **Its `server.json` examples pin the superseded `2025-07-09` schema** (current is `2025-12-11`). The strongest argument is its own last commit. [PR #1278](https://github.com/modelcontextprotocol/registry/pull/1278) closed [issue #767](https://github.com/modelcontextprotocol/registry/issues/767) — a real user-reported CLI flag bug — by editing **only `complete.md`**. A genuine fix landed in a file nobody reads, while the docs a reader would actually find stayed wrong. A generated file with no generator degrades into a trap: authoritative enough that people edit it, with nothing validating it. If the LLM-consumption use case is worth keeping, the right shape is a `make docs-bundle` target plus a `check-docs-bundle` CI job mirroring the existing `check-schema` pattern — happy to do that instead if you would rather keep it. ## Remaining stale references | File | Was | Now | |---|---|---| | `contributing/add-package-registry.md` | Add `docs/guides/publishing/publish-[yourregistry].md`, update `docs/guides/publishing/README.md` | Add a section to `package-types.mdx`. These were the **last live references** to the obsolete `docs/guides/` layout outside `complete.md` | | `administration/maintainer-onboarding.md` | Add them to "Current key maintainers" in README | "Registry Working Group" — the section that actually exists | | `reference/README.md` | Omitted 6 reference docs | Adds `api/extensions.md`, `api/openapi.yaml`, `api/CHANGELOG.md`, `server-json/CHANGELOG.md`, `server-json/CONTRIBUTING.md`, `server-json/draft/` | | `docs/README.md` | Index omitted `community-projects.md` | Listed | | `reference/api/generic-registry-api.md` | `PUT .../versions/{version}` "not implemented by official registry" | It **is** implemented ([edit.go:36](https://github.com/modelcontextprotocol/registry/blob/main/internal/api/handlers/v0/edit.go#L36)), and `official-registry-api.md` already lists it as an admin endpoint | | `reference/api/official-registry-api.md` | Omitted 3 registered routes | Adds `POST /v0.1/validate` (which `mcp-publisher validate` calls), `GET /v0.1/ping`, `GET /v0.1/version`, and notes these plus `/health` are absent from `openapi.yaml` | | `server-json/official-registry-requirements.md` | Per-registry verification → `quickstart.mdx` | → `package-types.mdx`, which has an Ownership Verification section per registry | | `design/design-principles.md` | Sections 1,2,3,4,**6**,7 | Renumbered 1–6 | | `contributing/releasing.md` | Steps 1,2,3,**5**,6 | Renumbered 1–5 | I left the sibling `DELETE` claim in `generic-registry-api.md` alone — it is accurate, no DELETE route is registered (the `http.MethodDelete` hit in `server.go` is CORS config, not a route). ## Staleness banners rather than rewrites **`design/tech-architecture.md`** is substantially fictional. Rather than a vague "may be outdated", the banner lists what I verified is wrong: - Describes Helm-chart deployment; the registry is a plain `Deployment` ([registry.go:65](https://github.com/modelcontextprotocol/registry/blob/main/deploy/pkg/k8s/registry.go#L65)). Helm is used only for third-party components. - Diagram shows a `StatefulSet` on port **27017** — MongoDB's port. The DB is PostgreSQL on 5432 via the CloudNativePG operator. - Documents a `verify-domain` challenge flow (`POST /verify-domain`, `/verify-domain/check`, server-issued tokens) that **was never built**. - Documents `/admin/*` routes that are not registered. - Says the DB stores user auth state and DNS verification records; only `servers` and `server_extensions` tables exist. **`design/roadmap.md`** still says "Phase 1: MVP/Go-Live (Current Focus)" ~11 months after launch. I added a dated note rather than inventing a current phase — that is a working-group call. ## Verification All **101** remaining relative links across every `.md`/`.mdx` in the repo resolve. The only two non-resolving matches are the intentional `[project-name](link)` template placeholder and the moderation link fixed in #1518. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5 <noreply@anthropic.com> |
||
|
Radoslav Dimitrov
|
3e463e52bb |
docs: correct contributor prerequisites and stale dev-env references (#1520)
The README prerequisites were both stale, and the docs restated the Go version in three places. ## Prerequisites: name the source, do not restate the version | README said | Reality | |---|---| | `Go 1.24.x` | `go 1.26` in [go.mod](https://github.com/modelcontextprotocol/registry/blob/main/go.mod) | | `golangci-lint v2.4.0` | `v2.11.4` pinned in [ci.yml:30](https://github.com/modelcontextprotocol/registry/blob/main/.github/workflows/ci.yml#L30) | Rather than swap in fresher numbers — which only resets the clock on the same drift — this **removes the numbers** and names the authoritative file: ``` - **Go** - version per the `go` directive in go.mod; the Go toolchain fetches it for you - **golangci-lint** - version per the `golangci-lint-action` pin in ci.yml, so local lint matches CI ``` The Go version was stated in **three** places, which is exactly why all three drifted together. All three now point at a single source, so the prerequisites list cannot go stale. Two notes on why the numbers earn so little in prose: - **Go corrects itself.** `go.mod` has no `toolchain` directive, so under the default `GOTOOLCHAIN=auto` the toolchain downloads the required version automatically. A contributor on an older Go gets an upgrade, not a failure — it only hard-errors under `GOTOOLCHAIN=local`. (An earlier version of this description said such a contributor "cannot build"; that was too strong.) - **golangci-lint does not.** Version skew here genuinely changes what you see: running CI's config under a newer golangci-lint (2.12.2) surfaces 23 `goconst` findings in `cmd/publisher/commands/validate_test.go` that CI's pinned 2.11.4 does not report. That is why the README now points at the pin rather than a number someone has to keep in sync. ## `make check` does more than documented Documented in three files as "lint, unit tests and integration tests". Actually [`check: dev-down lint validate test-all`](https://github.com/modelcontextprotocol/registry/blob/main/Makefile#L85) — it also runs schema validation and **stops your running `dev-compose` environment**. Worth knowing before running it mid-session. The Makefile's own `##` help string already said this correctly; only the prose was stale. ## Other verified corrections - **README project structure** omitted `cmd/registry/` — the server entry point and ko/goreleaser build target — and `internal/importer/`. - **`tests/integration/README.md`** said the suite launches **MongoDB**. It launches PostgreSQL (`postgres-integration-test`), as the same file admits nine lines later. It also cited `/v0/servers/{server_id}`, a path removed a while ago; the test actually calls `GET /v0/servers` and `GET /v0/servers/{serverName}/versions/latest` ([main.go:210,255](https://github.com/modelcontextprotocol/registry/blob/main/tests/integration/main.go#L210)). - **`scripts/mirror_data/README.md`** pointed at `internal/database/migrations/008_separate_official_metadata.sql`, which does not exist — that migration is `009_`, while `008_` is `clean_invalid_data.sql`. (Migration 008's own header still calls itself "007a", which is how the numbering slipped.) Also swapped two "edit line NN" pointers for identifier names, since both had already drifted (`maxMigration` is at :30 not :24; the connection string at :23 not :17), and corrected the fetch URL from `/v0.1/servers` to the `/v0/servers` the script actually requests. - **`.env.example`** was missing `MCP_REGISTRY_ENABLE_REGISTRY_VALIDATION`, even though the config reads it ([config.go:18](https://github.com/modelcontextprotocol/registry/blob/main/internal/config/config.go#L18)) and README:50 tells contributors to set it while pointing at `.env.example` as *the* reference. - **`docker-compose.yml`** set `MCP_REGISTRY_ENVIRONMENT`, which nothing reads — no `ENVIRONMENT` env tag in `internal/config`, and no other occurrence in the repo. Removed. (The Pulumi-side `mcp-registry:environment` key is a separate, real thing and is untouched.) - **Deleted `CHANGES.md`** — 0 bytes, untouched since the squashed history base, zero references anywhere. ## Verification `docker compose config` validates. `grep` for `Go 1.x` / `golangci-lint vX` across all `.md`/`.mdx` now returns nothing outside `complete.md` (which #1522 deletes). Both `../../README.md#pre-requisites` links resolve and the anchor matches the real `#### Pre-requisites` heading. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com> |
||
|
Radoslav Dimitrov
|
988b078e02 |
docs(deploy): correct config parameter names in deploy README (#1521)
The deploy configuration table named two parameters that **no code reads**, and omitted two that a deploy cannot succeed without. ## Wrong names | Documented | Actual | Evidence | |---|---|---| | `gcpProjectId` | `gcp:project` | [provider.go:30](https://github.com/modelcontextprotocol/registry/blob/main/deploy/pkg/providers/gcp/provider.go#L30) — its error text literally says `Set gcp:project` | | `gcpRegion` | `gcp:region` | [provider.go:36](https://github.com/modelcontextprotocol/registry/blob/main/deploy/pkg/providers/gcp/provider.go#L36), default `us-central1` | `gcpProjectId` and `gcpRegion` appear **nowhere** in `deploy/` outside this table. All three stack files (`Pulumi.gcpProd.yaml`, `Pulumi.gcpStaging.yaml`, `Pulumi.local.yaml`) already use `gcp:project`. ## Missing required secrets Both are `RequireSecret`, so a deploy fails outright without them — yet neither was in the table: - `mcp-registry:jwtPrivateKey` — [registry.go:56](https://github.com/modelcontextprotocol/registry/blob/main/deploy/pkg/k8s/registry.go#L56) - `mcp-registry:googleOauthClientSecret` — [monitoring.go:463](https://github.com/modelcontextprotocol/registry/blob/main/deploy/pkg/k8s/monitoring.go#L463) ## Also - Documents `gcp:credentials` (read at [provider.go:42](https://github.com/modelcontextprotocol/registry/blob/main/deploy/pkg/providers/gcp/provider.go#L42), set in the staging and prod stacks) - Marks which values are secrets - **Adds the namespace prefixes.** The table listed bare names, which is part of why the two wrong ones survived: `gcpProjectId` reads as plausible right up until you notice the real key lives in a different config namespace altogether. ## Verification Checked both directions: - every key now in the table is read by code in `deploy/` (reference counts confirmed per key) - every `conf.*("...")` key found anywhere in `deploy/` now appears in the table 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5 <noreply@anthropic.com> |
||
|
Radoslav Dimitrov
|
43402d8f6f |
fix(publisher): document --algorithm for ECDSA login and fix validate --help (#1519)
Two real defects, plus the CLI reference claims that go with them. ## 1. ECDSA P-384 login instructions cannot work Every "ECDSA P-384" tab ran the *identical* command to the Ed25519 tab. Since `--algorithm` defaults to ed25519 ([login.go:100](https://github.com/modelcontextprotocol/registry/blob/main/cmd/publisher/commands/login.go#L100)), a 96-hex key is rejected outright. Verified against a freshly generated P-384 key: ``` $ mcp-publisher login dns --domain=example.com --private-key=$KEY Signing in process using key algorithm ed25519 Error: failed to get token: failed to sign timestamp: invalid seed length: expected 32 bytes, got 48 $ mcp-publisher login dns --algorithm ecdsap384 --domain=example.com --private-key=$KEY Signing in process using key algorithm ecdsap384 Expected proof record: # works ``` `--algorithm` is registered at [login.go:129](https://github.com/modelcontextprotocol/registry/blob/main/cmd/publisher/commands/login.go#L129) and described correctly by the CLI's own help, but `grep -rn algorithm docs/` had **zero** hits for it. Anyone following the ECDSA path in the docs hit that error with nothing to tell them why. Fixed at all four in-process ECDSA sites (2 in `authentication.mdx`, 2 in `cli/commands.md`), with a note that cloud signing providers derive the algorithm from the key itself so the flag does not apply to them. ## 2. `mcp-publisher validate --help` was broken ``` $ mcp-publisher validate --help Unknown command: validate ... Use 'mcp-publisher <command> --help' for more information about a command. ``` It printed the very instruction that had just failed. `main.go` intercepted `--help` for all subcommands and called `printCommandHelp`, whose switch had no `validate` case — making `ValidateCommand`'s own help block ([validate.go:120-129](https://github.com/modelcontextprotocol/registry/blob/main/cmd/publisher/commands/validate.go#L120)) unreachable. Rather than paste a third copy of the help text, `printCommandHelp` now returns whether it handled the command, and the caller falls through to normal dispatch when it did not. Commands own their own `--help`, and any future command with this shape works automatically. | Command | Before | After | |---|---|---| | `validate --help` | `Unknown command`, exit 0 | prints its help, exit 0 | | `publish --help` | works | works | | `init -h` | works | works | | `bogus --help` | `Unknown command`, exit 0 | `Unknown command`, **exit 1** | ## 3. CLI reference corrections - **`--registry` is not global.** It exists only on `login`; other commands read the URL from the stored token. `publish --registry=URL` silently treats the flag as the `server.json` path. `cmd/publisher/README.md` had exactly this broken example. - **`--token` was undocumented** despite `github-actions.mdx:123` depending on it. Now documented, noting it is `login github` only. - **`init` takes no flags** and does not prompt; it writes `TODO:` placeholders. The reference said `init [options]` and "Prompts for missing required fields". - **Refreshed the `--help` transcript** in `quickstart.mdx`, which listed only 4 of 6 commands. Now byte-for-byte identical to real output (diffed). - **Added `validate`** to the command list in `cmd/publisher/README.md`. ## Verification `go build` and `go test ./cmd/...` pass. All four help paths exercised with exit codes checked. The 23 `goconst` findings in `validate_test.go` are pre-existing — identical count on pristine `main`, none in `main.go`. Quickstart transcript diffed against real output. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5 <noreply@anthropic.com> |
||
|
Radoslav Dimitrov
|
43fbc1dcbd |
fix(admin): use PATCH status endpoints in takedown script and runbook (#1518)
The admin takedown script cannot work as written, and the runbook that
documents it has the same problem.
## The bug
`tools/admin/takedown.sh` sent `PUT` with a `?status=deleted` query
parameter to two routes:
| What the script sent | Reality |
|---|---|
| `PUT /v0/servers/{name}/versions/{version}?status=deleted` | Route
exists, but requires a full `ServerJSON` body and has no `status` query
parameter |
| `PUT /v0/servers/{name}?status=deleted` | **Not registered at all** —
the whole-server takedown path 404s |
The real endpoints are `PATCH
/v0/servers/{name}/versions/{version}/status` and `PATCH
/v0/servers/{name}/status`
([status.go:83](https://github.com/modelcontextprotocol/registry/blob/main/internal/api/handlers/v0/status.go#L83),
[:198](https://github.com/modelcontextprotocol/registry/blob/main/internal/api/handlers/v0/status.go#L198)),
both taking `{"status": ..., "statusMessage": ...}`. `edit.go` even says
so in its own description: use the status endpoint for status changes.
## Script changes
- Send `PATCH` with a JSON body built via `jq`
- **Require `VERSION` or `ALL_VERSIONS=true` explicitly.** Previously a
missing `VERSION` meant "entire server". Since `PATCH .../status`
updates *every* version, an operator who simply forgot `VERSION` would
have taken down the whole server. Now that needs saying out loud.
- Support `STATUS` (default `deleted`) and `STATUS_MESSAGE`, so a
takedown can record its reason
- `set -euo pipefail`, non-zero exit on HTTP errors, and print the
response body so huma error detail is visible instead of being swallowed
## Runbook changes
- `GET /v0/servers/{name}` is not a route — use `GET
.../versions/latest` (which is supported, see
[servers.go:155-178](https://github.com/modelcontextprotocol/registry/blob/main/internal/api/handlers/v0/servers.go#L155))
- Replace the per-version `?status=deleted` loop with the single
all-versions `PATCH .../status` call, which reports `updatedCount`
- Keep the per-version `PUT` loop for *content* edits, which genuinely
has no bulk endpoint, and show that it needs the full body
- Correct the closing note claiming server-wide changes must be applied
per version — true for content, not for status
- Fix the broken `moderation-guidelines.md` link (dead since the docs
restructuring; the file is now
`modelcontextprotocol-io/moderation-policy.mdx`)
## Verification
`shellcheck` clean, `bash -n` clean, and all three guard paths exercised
(no args / neither VERSION nor ALL_VERSIONS / both set). Both `PATCH`
paths confirmed present in `docs/reference/api/openapi.yaml`. I did not
run a live takedown against production.
Kept on `/v0` rather than `/v0.1` to match the existing admin/deploy
convention — happy to switch if you would rather admin tooling target
the frozen version.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
|
||
Wolfe-James
|
69374b08de |
docs: add cargo and crates.io to schema examples (#1511)
The cargo registry type has been live since v1.8.0 (#1207). This PR only updates the schema examples so they match reality. - Add "cargo" to registryType.examples - Add "https://crates.io" to registryBaseUrl.examples No behaviour change. Note: versioned schemas are synced from modelcontextprotocol/static. A follow-up there keeps this durable across schema sync. Co-authored-by: Wolfe-Jam <wolfejam77@gmail.com> |
||
|
dependabot[bot]
|
03aeca562f |
build(deps): bump github.com/go-git/go-git/v6 from 6.0.0-alpha.4 to 6.0.0-alpha.5 in /deploy (#1514)
Bumps [github.com/go-git/go-git/v6](https://github.com/go-git/go-git) from 6.0.0-alpha.4 to 6.0.0-alpha.5. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/go-git/go-git/releases">github.com/go-git/go-git/v6's releases</a>.</em></p> <blockquote> <h2>v6.0.0-alpha.5</h2> <h2>What's Changed</h2> <ul> <li>plumbing: format/packfile, allow injecting a custom ObjectSelector by <a href="https://github.com/Soph"><code>@Soph</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2142">go-git/go-git#2142</a></li> <li>storage: pool .pack file descriptors via internal/packhandle by <a href="https://github.com/hiddeco"><code>@hiddeco</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2132">go-git/go-git#2132</a></li> <li>build: Update module golang.org/x/crypto to v0.52.0 [SECURITY] (main) by <a href="https://github.com/go-git-renovate"><code>@go-git-renovate</code></a>[bot] in <a href="https://redirect.github.com/go-git/go-git/pull/2148">go-git/go-git#2148</a></li> <li>build: Update module golang.org/x/net to v0.55.0 [SECURITY] (main) by <a href="https://github.com/go-git-renovate"><code>@go-git-renovate</code></a>[bot] in <a href="https://redirect.github.com/go-git/go-git/pull/2151">go-git/go-git#2151</a></li> <li>plumbing, storage: add CloseIdleDescriptors soft-close primitive by <a href="https://github.com/hiddeco"><code>@hiddeco</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2133">go-git/go-git#2133</a></li> <li>*: harden format parsers against unbounded loops by <a href="https://github.com/hiddeco"><code>@hiddeco</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2162">go-git/go-git#2162</a></li> <li>storage: pack read optimisations and storage-wide LRU FD pool by <a href="https://github.com/hiddeco"><code>@hiddeco</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2134">go-git/go-git#2134</a></li> <li>plumbing: format/packfile, fix delta-base parsing bugs by <a href="https://github.com/hiddeco"><code>@hiddeco</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2163">go-git/go-git#2163</a></li> <li>git: worktree, hoist Config() calls out of per-file loops by <a href="https://github.com/cedric-appdirect"><code>@cedric-appdirect</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/1990">go-git/go-git#1990</a></li> <li>storage: filesystem, pool FSObject reads via PackHandle by <a href="https://github.com/hiddeco"><code>@hiddeco</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2154">go-git/go-git#2154</a></li> <li>plumbing: format/index, accept empty trailing checksum on decode by <a href="https://github.com/pjbgf"><code>@pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2181">go-git/go-git#2181</a></li> <li>build: Update golang (main) by <a href="https://github.com/go-git-renovate"><code>@go-git-renovate</code></a>[bot] in <a href="https://redirect.github.com/go-git/go-git/pull/2182">go-git/go-git#2182</a></li> <li>build: Update module golang.org/x/net to v0.56.0 (main) by <a href="https://github.com/go-git-renovate"><code>@go-git-renovate</code></a>[bot] in <a href="https://redirect.github.com/go-git/go-git/pull/2191">go-git/go-git#2191</a></li> <li>*: speed up multi-pack reads via Index fanout probes by <a href="https://github.com/hiddeco"><code>@hiddeco</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2147">go-git/go-git#2147</a></li> <li>Fix URL insteadOf to use longest match when multiple values exist by <a href="https://github.com/AriehSchneier"><code>@AriehSchneier</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2189">go-git/go-git#2189</a></li> <li>transport/http, backend, utils/ioutil: fix HTTP data races on the fetch and serve paths by <a href="https://github.com/georg"><code>@georg</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2128">go-git/go-git#2128</a></li> <li>plumbing: protocol/packp, handle shallow-only no-op push in UpdateRequests.Decode by <a href="https://github.com/yuzhuo"><code>@yuzhuo</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2172">go-git/go-git#2172</a></li> <li>git: signer, add context.Context to Sign by <a href="https://github.com/pjbgf"><code>@pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2202">go-git/go-git#2202</a></li> <li>plumbing: transport/http, Expose typed auth error for Azure DevOps /_signin redirects by <a href="https://github.com/jfjrh2014"><code>@jfjrh2014</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2201">go-git/go-git#2201</a></li> <li>plumbing: format, faster diff patch generation by <a href="https://github.com/pjbgf"><code>@pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2186">go-git/go-git#2186</a></li> <li>plumbing: transport, Protocol v2 for upload-pack by <a href="https://github.com/blmayer"><code>@blmayer</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2188">go-git/go-git#2188</a></li> <li>plumbing: pktline, use Scanner for decoding by <a href="https://github.com/aymanbagabas"><code>@aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2038">go-git/go-git#2038</a></li> <li>internal: server/git, Fix TestGitServer_Timeout flakiness on Windows CI by <a href="https://github.com/aymanbagabas"><code>@aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2129">go-git/go-git#2129</a></li> <li>plumbing: packp, validate push options to prevent invalid characters by <a href="https://github.com/aymanbagabas"><code>@aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2057">go-git/go-git#2057</a></li> <li>plumbing: packp/capability, Zero-value-safe types and capability cleanup (1/11) by <a href="https://github.com/aymanbagabas"><code>@aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2206">go-git/go-git#2206</a></li> <li>plumbing: object, skip path validation in tree diff walk by <a href="https://github.com/pjbgf"><code>@pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2222">go-git/go-git#2222</a></li> <li>plumbing: packp/transport, Slice-based AdvRefs and v1 handling (2/11) by <a href="https://github.com/aymanbagabas"><code>@aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2225">go-git/go-git#2225</a></li> <li>plumbing: transport, Add options and result struct to GetRemoteRefs (3/11) by <a href="https://github.com/aymanbagabas"><code>@aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2226">go-git/go-git#2226</a></li> <li>git: Expose AlternatesFS on PlainOpenOptions by <a href="https://github.com/andrew"><code>@andrew</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2101">go-git/go-git#2101</a></li> <li>plumbing: packp, Protocol v2 wire types with caller-owned packfile streaming (4/11) by <a href="https://github.com/aymanbagabas"><code>@aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2227">go-git/go-git#2227</a></li> <li>plumbing/transport: receive_pack, add ReceivePackHooks with PreReceive/PostReceive by <a href="https://github.com/andrew"><code>@andrew</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2236">go-git/go-git#2236</a></li> <li>plumbing: transport, Protocol v2 session handshake and Command (5/11) by <a href="https://github.com/aymanbagabas"><code>@aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2228">go-git/go-git#2228</a></li> <li>plumbing: transport, ls-refs over Protocol v2 for GetRemoteRefs (6/11) by <a href="https://github.com/aymanbagabas"><code>@aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2229">go-git/go-git#2229</a></li> <li>plumbing: transport, fetch over Protocol v2 with caller-owned packfile (7/11) by <a href="https://github.com/aymanbagabas"><code>@aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2230">go-git/go-git#2230</a></li> <li>plumbing: transport, Wire Protocol v2 across HTTP and share the client core (8/11) by <a href="https://github.com/aymanbagabas"><code>@aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2231">go-git/go-git#2231</a></li> <li>plumbing: transport, Refactor server-side Protocol v2 onto packp types (9/11) by <a href="https://github.com/aymanbagabas"><code>@aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2232">go-git/go-git#2232</a></li> <li>plumbing: transport, git archive over HTTP (10/11) by <a href="https://github.com/aymanbagabas"><code>@aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2233">go-git/go-git#2233</a></li> <li>plumbing: transport, Run the upload-pack suite across v0/v1/v2 (11/11) by <a href="https://github.com/aymanbagabas"><code>@aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2234">go-git/go-git#2234</a></li> <li>plumbing: optimize Tree.Decode with ReadSlice and io.ReadFull by <a href="https://github.com/Bluebugs"><code>@Bluebugs</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/1736">go-git/go-git#1736</a></li> <li>plumbing: object, Isolate tests from host git config. by <a href="https://github.com/cedric-appdirect"><code>@cedric-appdirect</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2122">go-git/go-git#2122</a></li> <li>plumbing: default to wire protocol v2 and close client/server conformance gaps by <a href="https://github.com/pjbgf"><code>@pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2237">go-git/go-git#2237</a></li> <li>build: Update module golang.org/x/text to v0.39.0 (main) by <a href="https://github.com/go-git-renovate"><code>@go-git-renovate</code></a>[bot] in <a href="https://redirect.github.com/go-git/go-git/pull/2241">go-git/go-git#2241</a></li> <li>build: Update golang (main) by <a href="https://github.com/go-git-renovate"><code>@go-git-renovate</code></a>[bot] in <a href="https://redirect.github.com/go-git/go-git/pull/2246">go-git/go-git#2246</a></li> <li>plumbing: object, include submodules in patches by <a href="https://github.com/upuddu"><code>@upuddu</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2243">go-git/go-git#2243</a></li> <li>storage: dotgit, reject path traversal in reference names by <a href="https://github.com/Sahana2524"><code>@Sahana2524</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2247">go-git/go-git#2247</a></li> <li>plumbing: transport/http, redact credentials in error messages by <a href="https://github.com/Sahana2524"><code>@Sahana2524</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2252">go-git/go-git#2252</a></li> <li>git: worktree, checkout reuse a single os.Root per reset. by <a href="https://github.com/cedric-appdirect"><code>@cedric-appdirect</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2259">go-git/go-git#2259</a></li> <li>git: Worktree: Add stores index entires with backslashes on Windows by <a href="https://github.com/joshblum"><code>@joshblum</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2253">go-git/go-git#2253</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
Recoordinate
|
4508c48f80 |
Fix broken relative links in releasing docs (#1517)
The three deployment links in `docs/contributing/releasing.md` use `../../../`, which resolves above the repository root and 404s on GitHub. The file lives in `docs/contributing/`, so the repo root is two levels up and `../../` is correct. This fixes the links to `deploy-production.yml`, `deploy-staging.yml`, and `deploy/README.md` (all three targets exist at the repo root). No content change. |
||
|
Radoslav Dimitrov
|
f36b7dd4af |
chore(deploy): promote production to 1.8.1 (#1510)
## Summary
Promote the production registry image from `1.8.0` to
[`1.8.1`](https://github.com/modelcontextprotocol/registry/releases/tag/v1.8.1).
This release includes #1509, which adds a short ingress cache and a
scoped rate-limit increase for the exact public registry-list endpoints.
## Staging verification
- release tag points to `
|
||
|
Radoslav Dimitrov
|
f52dc8525a |
fix(deploy): cache bulk registry reads (#1509)
v1.8.1
## Summary - cache successful public list responses for `/v0/servers` and `/v0.1/servers` at ingress-nginx for 30 seconds - give only those exact cached paths a 600 RPM per-controller budget - preserve the existing 180 RPM limit for publish, auth, mutation, detail, and other routes - expose `X-Registry-Cache` to make cache MISS/HIT behavior directly observable ## Why Production ingress logs show that the current 180 RPM per-controller limit rejects legitimate bulk pagination before it reaches the application. The affected traffic is overwhelmingly registry-list reads, not publishing. A ten-minute production sample contained 17,836 successful list responses but only 3,188 unique URLs: 82.1% were repeated requests, representing roughly 1 GB of duplicate response bodies. Raising the list limit without caching would increase pressure on the application and its shared PostgreSQL pool. The short ingress cache absorbs repeated cursor-page reads before raising their scoped client budget. Publish latency is a separate concern. Reducing read pressure may help indirectly, but slow external package validation is intentionally out of scope for this PR. Relates to #826. ## Safety - caching is limited to exact public GET list paths and keyed by host plus full request URI - only 200 responses are cached - cache lifetime is 30 seconds; newly published entries can therefore take up to 30 seconds to appear on a cached page - cache locking coalesces simultaneous misses - stale cached responses may be served while refreshing or during transient upstream 5xx/timeouts - each ingress replica uses at most 1 GB of ephemeral on-disk cache ## Validation - `go test ./...` in `deploy/` - `go vet ./...` in `deploy/` - `git diff --check` - ingress-nginx chart 4.13.0 in a disposable kind cluster - generated NGINX configuration passed `nginx -t` - repeated list request verified `X-Registry-Cache: MISS` followed by `HIT` - non-list route verified uncached - exact list locations verified with the higher rate zone while the catch-all retained 180 RPM Nothing was applied to production during investigation or validation. |
||
Recoordinate
|
2b09bde534 |
docs: remove stale build.sh reference from publisher Key Files (#1504)
The Key Files list in `cmd/publisher/README.md` includes a bullet for `build.sh`, but there is no `build.sh` anywhere in the repo. The publisher is built with `make publisher`, which runs `go build -o bin/mcp-publisher ./cmd/publisher` (Makefile), so there is no separate cross-platform build script. The other three entries in the same list (`main.go`, `commands/`, `auth/`) all exist. This removes the stale bullet so the list matches the actual files in the directory. |
||
Sash
|
5c19656cb9 |
fix(auth): reject github.io domains in DNS/HTTP token exchange (org namespace takeover) (#1506)
## Summary - The GitHub token method grants `io.github.<org>/*` publish rights **only to org Owners** (active `admin` membership — `github_at.go`). - The DNS/HTTP token methods grant `reversed(domain)/*` for any proven domain, with no `github.io` special-casing and an empty `BlockedNamespaces` list. - `<org>.github.io` is served by GitHub Pages from the `<org>/<org>.github.io` repository. **Push access to that one repository** — routinely held by ordinary org members, a much weaker bar than Owner — is enough to serve a key at `/.well-known/mcp-registry-auth`, exchange it for a JWT, and publish under the org's entire `io.github.<org>/*` namespace. - Reject `github.io` (and subdomains) at the shared `ValidateDomainAndTimestamp` seam used by both DNS and HTTP exchange; `io.github.*` publishers already have the GitHub method. ## Impact if unsolved Any org member with write access to the org's GitHub Pages repo (or an attacker compromising such a member) can mint MCP packages under the org's trusted namespace — supply-chain poisoning of every downstream user who installs `<org>`'s servers from the registry, bypassing the deliberate Owner-only gate. ## Test plan - New `TestValidateDomainAndTimestampRejectsGitHubPages`: rejects `my-org.github.io` (incl. mixed case and subdomains), still allows lookalikes (`github.io.evil-example.com`, `my-org.github.io.example.com`) and ordinary domains. - Full `internal/api/handlers/v0/auth` package passes. Made with [Cursor](https://cursor.com) Signed-off-by: SashaMIT <sash@ela.city> Co-authored-by: Cursor <cursoragent@cursor.com> |
||
|
dependabot[bot]
|
0f78916eee |
build(deps): bump docker/login-action from 4.4.0 to 4.6.0 in the actions group (#1492)
Bumps the actions group with 1 update: [docker/login-action](https://github.com/docker/login-action). Updates `docker/login-action` from 4.4.0 to 4.6.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/docker/login-action/releases">docker/login-action's releases</a>.</em></p> <blockquote> <h2>v4.6.0</h2> <ul> <li>Harden buildx scoped config path handling by <a href="https://github.com/crazy-max"><code>@crazy-max</code></a> in <a href="https://redirect.github.com/docker/login-action/pull/1059">docker/login-action#1059</a></li> <li>Bump <code>@aws-sdk/client-ecr</code> and <code>@aws-sdk/client-ecr-public</code> to 3.1095.0 in <a href="https://redirect.github.com/docker/login-action/pull/1051">docker/login-action#1051</a></li> <li>Bump js-yaml from 5.2.1 to 5.2.2 in <a href="https://redirect.github.com/docker/login-action/pull/1057">docker/login-action#1057</a></li> <li>Bump postcss from 8.5.10 to 8.5.22 in <a href="https://redirect.github.com/docker/login-action/pull/1056">docker/login-action#1056</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/docker/login-action/compare/v4.5.2...v4.6.0">https://github.com/docker/login-action/compare/v4.5.2...v4.6.0</a></p> <h2>v4.5.2</h2> <ul> <li>Surface Docker Hub OIDC error responses by <a href="https://github.com/crazy-max"><code>@crazy-max</code></a> in <a href="https://redirect.github.com/docker/login-action/pull/1058">docker/login-action#1058</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/docker/login-action/compare/v4.5.1...v4.5.2">https://github.com/docker/login-action/compare/v4.5.1...v4.5.2</a></p> <h2>v4.5.1</h2> <ul> <li>Support <code>dhi.io</code> as Docker Hub OIDC registry by <a href="https://github.com/crazy-max"><code>@crazy-max</code></a> in <a href="https://redirect.github.com/docker/login-action/pull/1054">docker/login-action#1054</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/docker/login-action/compare/v4.5.0...v4.5.1">https://github.com/docker/login-action/compare/v4.5.0...v4.5.1</a></p> <h2>v4.5.0</h2> <ul> <li><a href="https://github.com/docker/login-action#docker-hub">Docker Hub OIDC</a> login support by <a href="https://github.com/crazy-max"><code>@crazy-max</code></a> in <a href="https://redirect.github.com/docker/login-action/pull/1048">docker/login-action#1048</a></li> <li>Bump <code>@aws-sdk/client-ecr</code> and <code>@aws-sdk/client-ecr-public</code> to 3.1091.0 in <a href="https://redirect.github.com/docker/login-action/pull/1037">docker/login-action#1037</a></li> <li>Bump <code>@docker/actions-toolkit</code> from 0.92.0 to 0.94.0 in <a href="https://redirect.github.com/docker/login-action/pull/1044">docker/login-action#1044</a> <a href="https://redirect.github.com/docker/login-action/pull/1050">docker/login-action#1050</a></li> <li>Bump brace-expansion from 1.1.13 to 1.1.16 in <a href="https://redirect.github.com/docker/login-action/pull/1046">docker/login-action#1046</a></li> <li>Bump js-yaml from 5.2.0 to 5.2.1 in <a href="https://redirect.github.com/docker/login-action/pull/1038">docker/login-action#1038</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/docker/login-action/compare/v4.4.0...v4.5.0">https://github.com/docker/login-action/compare/v4.4.0...v4.5.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
34f0bb99f3 |
build(deps): bump cloud.google.com/go/kms from 1.32.0 to 1.33.0 (#1491)
Bumps [cloud.google.com/go/kms](https://github.com/googleapis/google-cloud-go) from 1.32.0 to 1.33.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/googleapis/google-cloud-go/releases">cloud.google.com/go/kms's releases</a>.</em></p> <blockquote> <h2>video: v1.33.0</h2> <h2><a href="https://github.com/googleapis/google-cloud-go/compare/video/v1.32.0...video/v1.33.0">1.33.0</a> (2026-07-13)</h2> <h3>Features</h3> <ul> <li><strong>o11y:</strong> Regenerate clients for LRO tracing (<a href="https://redirect.github.com/googleapis/google-cloud-go/issues/20107">#20107</a>) (<a href=" |
||
|
dependabot[bot]
|
ac340e0b88 |
build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.253.0 to 3.255.0 in /deploy (#1490)
Bumps [github.com/pulumi/pulumi/sdk/v3](https://github.com/pulumi/pulumi) from 3.253.0 to 3.255.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/pulumi/pulumi/releases">github.com/pulumi/pulumi/sdk/v3's releases</a>.</em></p> <blockquote> <h2>v3.255.0</h2> <h2>3.255.0 (2026-07-28)</h2> <h3>Features</h3> <ul> <li>[cli] Add an <code>--extension</code> flag to package commands for extension-parameterized packages, reinstalled from <code>Pulumi.yaml</code> on <code>pulumi install</code></li> <li>[cli] Project files to disk and surface their paths as environment variables for all output formats when opening an ESC environment <a href="https://redirect.github.com/pulumi/pulumi/pull/23993">#23993</a></li> <li>[engine] Resolve an invoke's provider from the <code>providers</code> option of the parent named on the request, matching the resolution applied to resource registrations <a href="https://redirect.github.com/pulumi/pulumi/pull/24016">#24016</a></li> <li>[cli/do] Add <code>--resources</code> to refer to existing resources in state in <code>do</code> input expressions <a href="https://redirect.github.com/pulumi/pulumi/pull/24037">#24037</a></li> </ul> <h3>Bug Fixes</h3> <ul> <li>[programgen/nodejs] Parent an invoke written inside a component to that component, so it resolves the component's providers <a href="https://redirect.github.com/pulumi/pulumi/pull/24017">#24017</a></li> <li>[pcl] Apply the <code>providers</code> option of a <code>component</code> block to the resources and invokes it declares <a href="https://redirect.github.com/pulumi/pulumi/pull/24016">#24016</a></li> <li>[cli/import] Fix import file generation when parent resources share names <a href="https://redirect.github.com/pulumi/pulumi/pull/24069">#24069</a></li> <li>[cli] Fix parallel <code>pulumi install</code> processes sharing a <code>PULUMI_HOME</code> intermittently failing with a missing provider executable error <a href="https://redirect.github.com/pulumi/pulumi/pull/24080">#24080</a></li> <li>[sdk/python] Allow Construct and Call methods to run concurrently in provider servers <a href="https://redirect.github.com/pulumi/pulumi/pull/24081">#24081</a></li> </ul> <h3>Improvements</h3> <ul> <li>[engine] Support strings containing non-UTF8 bytes flowing between providers, the engine, state, and languages that opt in (Go and PCL initially) <a href="https://redirect.github.com/pulumi/pulumi/pull/23856">#23856</a></li> <li>[cli] Add a <code>--summary</code> flag to <code>pulumi stack history events</code> that reduces a past update's events to the same summary shape as a live <code>pulumi up --output json</code>, extended with error diagnostics and failed-resource markers <a href="https://redirect.github.com/pulumi/pulumi/pull/23960">#23960</a></li> <li>[protobuf] Allow state converters to supply resource inputs and outputs in ConvertState responses <a href="https://redirect.github.com/pulumi/pulumi/pull/23987">#23987</a></li> <li>[engine] Allow policy packs to point to executable binaries, not just script folders <a href="https://redirect.github.com/pulumi/pulumi/pull/24052">#24052</a></li> <li>[cli/display] The Neo diagnostics link now suggests <code>pulumi neo --debug-update</code> or <code>pulumi neo --debug-preview</code> to investigate the failed operation <a href="https://redirect.github.com/pulumi/pulumi/pull/24075">#24075</a></li> <li>[sdk/python] Allow <code>UV_PROJECT_ENVIRONMENT</code> to override the virtualenv path if uv is used <a href="https://redirect.github.com/pulumi/pulumi/pull/24077">#24077</a></li> <li>[cli] Allow otel traces to be sent over https <a href="https://redirect.github.com/pulumi/pulumi/pull/24078">#24078</a></li> </ul> <h2>v3.254.0</h2> <h2>3.254.0 (2026-07-23)</h2> <h3>Features</h3> <ul> <li>[cli] Add <code>pulumi logs share</code> command for sharing logs with Pulumi <a href="https://redirect.github.com/pulumi/pulumi/pull/22546">#22546</a></li> <li>[cli] Add <code>pulumi stack migrate</code> to migrate a stack from another backend to the currently logged-in backend, including re-encrypting config secrets and stack state under the target secrets provider <a href="https://redirect.github.com/pulumi/pulumi/pull/22902">#22902</a></li> <li>[cli/config] Add an <code>--override-env</code> flag to <code>up</code>, <code>preview</code>, <code>destroy</code>, and <code>refresh</code> to substitute imported environments for a single run without editing the stack config <a href="https://redirect.github.com/pulumi/pulumi/pull/23562">#23562</a></li> <li>[cli] Add <code>pulumi neo acp</code> to run Neo as an Agent Client Protocol agent over stdio for ACP-capable editors, with read-only and plan mode exposed as session config options <a href="https://redirect.github.com/pulumi/pulumi/pull/23886">#23886</a></li> <li>[cli/neo] Retry transient <code>pulumi neo</code> stream and message-send failures, and add <code>pulumi neo resume</code> with chat history <a href="https://redirect.github.com/pulumi/pulumi/pull/23835">#23835</a></li> <li>[cli/neo] Make Ctrl+C clear typed text and preserve Ctrl+A/Ctrl+E line navigation in <code>pulumi neo</code> <a href="https://redirect.github.com/pulumi/pulumi/pull/23932">#23932</a></li> <li>[cli/do] Add <code>upsert</code> to do, allowing resources to be statefully created or updated in a stack <a href="https://redirect.github.com/pulumi/pulumi/pull/23813">#23813</a></li> <li>[sdk/python] Add <code>pulumi.run</code> for natively awaited Python program entrypoints that can return stack outputs <a href="https://redirect.github.com/pulumi/pulumi/pull/23945">#23945</a></li> <li>[cli/do] Allow expressions for number inputs <a href="https://redirect.github.com/pulumi/pulumi/pull/23954">#23954</a></li> <li>[cli/do] Allow expressions for boolean inputs <a href="https://redirect.github.com/pulumi/pulumi/pull/23967">#23967</a></li> <li>[cli/policy] Add <code>--runtime-options</code> to <code>pulumi policy new</code> <a href="https://redirect.github.com/pulumi/pulumi/pull/23992">#23992</a></li> <li>[cli/do] Add support for stateful create <a href="https://redirect.github.com/pulumi/pulumi/pull/23996">#23996</a></li> <li>[cli/do] Add support for stateful delete <a href="https://redirect.github.com/pulumi/pulumi/pull/24000">#24000</a></li> </ul> <h3>Bug Fixes</h3> <ul> <li>[sdkgen/go] Fix Go codegen for plain properties nested inside non-plain objects <a href="https://redirect.github.com/pulumi/pulumi/pull/22524">#22524</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/pulumi/pulumi/blob/master/CHANGELOG.md">github.com/pulumi/pulumi/sdk/v3's changelog</a>.</em></p> <blockquote> <h2>3.255.0 (2026-07-28)</h2> <h3>Features</h3> <ul> <li>[cli] Add an <code>--extension</code> flag to package commands for extension-parameterized packages, reinstalled from <code>Pulumi.yaml</code> on <code>pulumi install</code></li> <li>[cli] Project files to disk and surface their paths as environment variables for all output formats when opening an ESC environment <a href="https://redirect.github.com/pulumi/pulumi/pull/23993">#23993</a></li> <li>[engine] Resolve an invoke's provider from the <code>providers</code> option of the parent named on the request, matching the resolution applied to resource registrations <a href="https://redirect.github.com/pulumi/pulumi/pull/24016">#24016</a></li> <li>[cli/do] Add <code>--resources</code> to refer to existing resources in state in <code>do</code> input expressions <a href="https://redirect.github.com/pulumi/pulumi/pull/24037">#24037</a></li> </ul> <h3>Bug Fixes</h3> <ul> <li>[programgen/nodejs] Parent an invoke written inside a component to that component, so it resolves the component's providers <a href="https://redirect.github.com/pulumi/pulumi/pull/24017">#24017</a></li> <li>[pcl] Apply the <code>providers</code> option of a <code>component</code> block to the resources and invokes it declares <a href="https://redirect.github.com/pulumi/pulumi/pull/24016">#24016</a></li> <li>[cli/import] Fix import file generation when parent resources share names <a href="https://redirect.github.com/pulumi/pulumi/pull/24069">#24069</a></li> <li>[cli] Fix parallel <code>pulumi install</code> processes sharing a <code>PULUMI_HOME</code> intermittently failing with a missing provider executable error <a href="https://redirect.github.com/pulumi/pulumi/pull/24080">#24080</a></li> <li>[sdk/python] Allow Construct and Call methods to run concurrently in provider servers <a href="https://redirect.github.com/pulumi/pulumi/pull/24081">#24081</a></li> </ul> <h3>Improvements</h3> <ul> <li>[engine] Support strings containing non-UTF8 bytes flowing between providers, the engine, state, and languages that opt in (Go and PCL initially) <a href="https://redirect.github.com/pulumi/pulumi/pull/23856">#23856</a></li> <li>[cli] Add a <code>--summary</code> flag to <code>pulumi stack history events</code> that reduces a past update's events to the same summary shape as a live <code>pulumi up --output json</code>, extended with error diagnostics and failed-resource markers <a href="https://redirect.github.com/pulumi/pulumi/pull/23960">#23960</a></li> <li>[protobuf] Allow state converters to supply resource inputs and outputs in ConvertState responses <a href="https://redirect.github.com/pulumi/pulumi/pull/23987">#23987</a></li> <li>[engine] Allow policy packs to point to executable binaries, not just script folders <a href="https://redirect.github.com/pulumi/pulumi/pull/24052">#24052</a></li> <li>[cli/display] The Neo diagnostics link now suggests <code>pulumi neo --debug-update</code> or <code>pulumi neo --debug-preview</code> to investigate the failed operation <a href="https://redirect.github.com/pulumi/pulumi/pull/24075">#24075</a></li> <li>[sdk/python] Allow <code>UV_PROJECT_ENVIRONMENT</code> to override the virtualenv path if uv is used <a href="https://redirect.github.com/pulumi/pulumi/pull/24077">#24077</a></li> <li>[cli] Allow otel traces to be sent over https <a href="https://redirect.github.com/pulumi/pulumi/pull/24078">#24078</a></li> </ul> <h2>3.254.0 (2026-07-23)</h2> <h3>Features</h3> <ul> <li>[cli] Add <code>pulumi logs share</code> command for sharing logs with Pulumi <a href="https://redirect.github.com/pulumi/pulumi/pull/22546">#22546</a></li> <li>[cli] Add <code>pulumi stack migrate</code> to migrate a stack from another backend to the currently logged-in backend, including re-encrypting config secrets and stack state under the target secrets provider <a href="https://redirect.github.com/pulumi/pulumi/pull/22902">#22902</a></li> <li>[cli/config] Add an <code>--override-env</code> flag to <code>up</code>, <code>preview</code>, <code>destroy</code>, and <code>refresh</code> to substitute imported environments for a single run without editing the stack config <a href="https://redirect.github.com/pulumi/pulumi/pull/23562">#23562</a></li> <li>[cli] Add <code>pulumi neo acp</code> to run Neo as an Agent Client Protocol agent over stdio for ACP-capable editors, with read-only and plan mode exposed as session config options <a href="https://redirect.github.com/pulumi/pulumi/pull/23886">#23886</a></li> <li>[cli/neo] Retry transient <code>pulumi neo</code> stream and message-send failures, and add <code>pulumi neo resume</code> with chat history <a href="https://redirect.github.com/pulumi/pulumi/pull/23835">#23835</a></li> <li>[cli/neo] Make Ctrl+C clear typed text and preserve Ctrl+A/Ctrl+E line navigation in <code>pulumi neo</code> <a href="https://redirect.github.com/pulumi/pulumi/pull/23932">#23932</a></li> <li>[cli/do] Add <code>upsert</code> to do, allowing resources to be statefully created or updated in a stack <a href="https://redirect.github.com/pulumi/pulumi/pull/23813">#23813</a></li> <li>[sdk/python] Add <code>pulumi.run</code> for natively awaited Python program entrypoints that can return stack outputs <a href="https://redirect.github.com/pulumi/pulumi/pull/23945">#23945</a></li> <li>[cli/do] Allow expressions for number inputs <a href="https://redirect.github.com/pulumi/pulumi/pull/23954">#23954</a></li> <li>[cli/do] Allow expressions for boolean inputs <a href="https://redirect.github.com/pulumi/pulumi/pull/23967">#23967</a></li> <li>[cli/policy] Add <code>--runtime-options</code> to <code>pulumi policy new</code> <a href="https://redirect.github.com/pulumi/pulumi/pull/23992">#23992</a></li> <li>[cli/do] Add support for stateful create <a href="https://redirect.github.com/pulumi/pulumi/pull/23996">#23996</a></li> <li>[cli/do] Add support for stateful delete <a href="https://redirect.github.com/pulumi/pulumi/pull/24000">#24000</a></li> </ul> <h3>Bug Fixes</h3> <ul> <li>[sdkgen/go] Fix Go codegen for plain properties nested inside non-plain objects <a href="https://redirect.github.com/pulumi/pulumi/pull/22524">#22524</a></li> <li>[cli/neo] Keep <code>pulumi neo</code> connected during quiet periods when the event stream only receives keep-alive heartbeats <a href="https://redirect.github.com/pulumi/pulumi/pull/23935">#23935</a></li> <li>[engine] Validate snippets before persisting them <a href="https://redirect.github.com/pulumi/pulumi/pull/23920">#23920</a></li> <li>[backend] Fix dangling ReplaceWith references in the journal replayer <a href="https://redirect.github.com/pulumi/pulumi/pull/23927">#23927</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
4e1f96a716 |
build(deps): bump github.com/danielgtaylor/huma/v2 from 2.39.0 to 2.39.1 (#1489)
Bumps [github.com/danielgtaylor/huma/v2](https://github.com/danielgtaylor/huma) from 2.39.0 to 2.39.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/danielgtaylor/huma/releases">github.com/danielgtaylor/huma/v2's releases</a>.</em></p> <blockquote> <h1>v2.39.1</h1> <h2>Overview</h2> <p>A patch release: correctness fixes for resolvers, validation, and response handling, plus a dependency refresh.</p> <h3>Response Status Visible to Middleware Again</h3> <p><code>WithContext</code> context propagation in v2.39.0 copied the response status by value, so middleware that called <code>WithContext</code> and then read <code>Status()</code> after <code>next()</code> always saw <code>0</code> instead of the status the handler set, breaking access logging and telemetry. The status is now shared by every context copy across all adapters, restoring the pre-2.39 invariant while keeping context propagation intact. (<a href="https://redirect.github.com/danielgtaylor/huma/issues/1081">#1081</a>)</p> <h3>Resolvers & Defaults in Arrays and Maps</h3> <ul> <li>Nested resolvers now run for fixed-size arrays (<code>[2]Item</code>), not just slices (<a href="https://redirect.github.com/danielgtaylor/huma/issues/1076">#1076</a>)</li> <li>A resolver on a named collection type (e.g. <code>type Coords [2]float64</code>) no longer panics, and is no longer conflated with a resolver on its element type, which previously ran the element's resolver twice and the collection's never (<a href="https://redirect.github.com/danielgtaylor/huma/issues/1082">#1082</a>)</li> <li>Values reached through a map are now written back after being walked, so applying a default no longer panics with <code>reflect: reflect.Value.Set using unaddressable value</code> and resolver mutations are no longer silently discarded (<a href="https://redirect.github.com/danielgtaylor/huma/issues/1082">#1082</a>)</li> </ul> <h3>Stricter <code>email</code> and <code>uri</code> Formats</h3> <p>Validation for two string formats is tighter, so payloads that previously passed may now return <code>422</code>:</p> <ul> <li><code>email</code> / <code>idn-email</code> accept an addr-spec only; full mailbox forms with a display name (<code>Name <user@example.com></code>) are rejected</li> <li><code>uri</code> / <code>iri</code> require an absolute URI with a non-empty scheme, while relative references remain valid under <code>uri-reference</code> / <code>iri-reference</code> (<a href="https://redirect.github.com/danielgtaylor/huma/issues/1068">#1068</a>)</li> </ul> <h3>Validation Robustness</h3> <ul> <li>An unresolvable schema <code>$ref</code> during <code>Validate</code> now reports <code>expected schema $ref to resolve: ...</code> instead of panicking on a nil dereference, covering discriminators and <code>map[string]any</code> / <code>map[any]any</code> values (<a href="https://redirect.github.com/danielgtaylor/huma/issues/1065">#1065</a>)</li> <li>Named numeric slice parameters (e.g. <code>type IDs []int64</code>) are built with their declared element type and validated with item, length, and uniqueness constraints intact (<a href="https://redirect.github.com/danielgtaylor/huma/issues/1074">#1074</a>)</li> </ul> <h2>Other Fixes</h2> <ul> <li>Resolver errors that wrap a <code>HeadersError</code> now contribute their headers to the response, matching the handler error path (<a href="https://redirect.github.com/danielgtaylor/huma/issues/1070">#1070</a>)</li> <li>A nil interface response body no longer panics in the schema link transformer (<a href="https://redirect.github.com/danielgtaylor/huma/issues/1072">#1072</a>)</li> <li>Dependencies updated (<a href="https://redirect.github.com/danielgtaylor/huma/issues/1066">#1066</a>)</li> </ul> <h2>What's Changed</h2> <ul> <li>fix: do not panic on unresolved schema $ref during Validate by <a href="https://github.com/baiyuxi930826"><code>@baiyuxi930826</code></a> in <a href="https://redirect.github.com/danielgtaylor/huma/pull/1065">danielgtaylor/huma#1065</a></li> <li>chore: update dependencies by <a href="https://github.com/wolveix"><code>@wolveix</code></a> in <a href="https://redirect.github.com/danielgtaylor/huma/pull/1066">danielgtaylor/huma#1066</a></li> <li>fix: tighten format email and uri validation by <a href="https://github.com/baiyuxi930826"><code>@baiyuxi930826</code></a> in <a href="https://redirect.github.com/danielgtaylor/huma/pull/1068">danielgtaylor/huma#1068</a></li> <li>fix: preserve wrapped resolver error metadata by <a href="https://github.com/ggmolly"><code>@ggmolly</code></a> in <a href="https://redirect.github.com/danielgtaylor/huma/pull/1070">danielgtaylor/huma#1070</a></li> <li>fix: handle nil interface response bodies by <a href="https://github.com/ggmolly"><code>@ggmolly</code></a> in <a href="https://redirect.github.com/danielgtaylor/huma/pull/1072">danielgtaylor/huma#1072</a></li> <li>fix: parse named numeric slice parameters by <a href="https://github.com/ggmolly"><code>@ggmolly</code></a> in <a href="https://redirect.github.com/danielgtaylor/huma/pull/1074">danielgtaylor/huma#1074</a></li> <li>fix: share response status across WithContext copies by <a href="https://github.com/wolveix"><code>@wolveix</code></a> in <a href="https://redirect.github.com/danielgtaylor/huma/pull/1081">danielgtaylor/huma#1081</a></li> <li>fix: run nested resolvers in fixed arrays by <a href="https://github.com/ggmolly"><code>@ggmolly</code></a> in <a href="https://redirect.github.com/danielgtaylor/huma/pull/1076">danielgtaylor/huma#1076</a></li> <li>fix: distinguish collection and element matches when walking input by <a href="https://github.com/wolveix"><code>@wolveix</code></a> in <a href="https://redirect.github.com/danielgtaylor/huma/pull/1082">danielgtaylor/huma#1082</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/baiyuxi930826"><code>@baiyuxi930826</code></a> made their first contribution in <a href="https://redirect.github.com/danielgtaylor/huma/pull/1065">danielgtaylor/huma#1065</a></li> <li><a href="https://github.com/ggmolly"><code>@ggmolly</code></a> made their first contribution in <a href="https://redirect.github.com/danielgtaylor/huma/pull/1070">danielgtaylor/huma#1070</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/danielgtaylor/huma/compare/v2.39.0...v2.39.1">https://github.com/danielgtaylor/huma/compare/v2.39.0...v2.39.1</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
Tadas Antanavicius
|
2a28830156 |
docs: remove Tadas as WG Lead (#1493)
Per discussion with @rdimitrov, removing my listing as WG Lead of Registry so I can free up some time to work on [AI Catalog](https://github.com/Agent-Card/ai-catalog) and [Server Cards](https://github.com/modelcontextprotocol/experimental-ext-server-card). FYI @BobDickinson @pree-dew Co-authored-by: Tadas Antanavicius <jon@tadasant.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> |
||
|
dependabot[bot]
|
4000b09953 |
build(deps): bump github.com/google/go-containerregistry from 0.21.7 to 0.21.8 (#1507)
Bumps [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry) from 0.21.7 to 0.21.8. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/google/go-containerregistry/releases">github.com/google/go-containerregistry's releases</a>.</em></p> <blockquote> <h2>v0.21.8</h2> <p>The artifacts attached to this release are missing SLSA provenance, see <a href="https://redirect.github.com/google/go-containerregistry/issues/2390">#2390</a>.</p> <h2>What's Changed</h2> <ul> <li>build(deps): bump the go-deps group across 1 directory with 3 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/google/go-containerregistry/pull/2353">google/go-containerregistry#2353</a></li> <li>build(deps): bump golang.org/x/crypto from 0.45.0 to 0.52.0 in /cmd/krane by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/google/go-containerregistry/pull/2367">google/go-containerregistry#2367</a></li> <li>build(deps): bump golang.org/x/crypto from 0.50.0 to 0.52.0 in /pkg/authn/k8schain by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/google/go-containerregistry/pull/2368">google/go-containerregistry#2368</a></li> <li>build(deps): bump golang.org/x/net from 0.49.0 to 0.55.0 in /pkg/authn/kubernetes by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/google/go-containerregistry/pull/2363">google/go-containerregistry#2363</a></li> <li>build(deps): bump the go-deps group across 3 directories with 7 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/google/go-containerregistry/pull/2377">google/go-containerregistry#2377</a></li> <li>build(deps): bump the actions group across 1 directory with 5 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/google/go-containerregistry/pull/2375">google/go-containerregistry#2375</a></li> <li>Reject unsafe Windows archive paths in Extract by <a href="https://github.com/Haihan-Jiang"><code>@Haihan-Jiang</code></a> in <a href="https://redirect.github.com/google/go-containerregistry/pull/2330">google/go-containerregistry#2330</a></li> <li>feat(goreleaser): add loong64 build support for crane/gcrane/krane by <a href="https://github.com/xuxiaowei-com-cn"><code>@xuxiaowei-com-cn</code></a> in <a href="https://redirect.github.com/google/go-containerregistry/pull/2358">google/go-containerregistry#2358</a></li> <li>Document tag and digest reference semantics by <a href="https://github.com/Haihan-Jiang"><code>@Haihan-Jiang</code></a> in <a href="https://redirect.github.com/google/go-containerregistry/pull/2325">google/go-containerregistry#2325</a></li> <li>remote: release pull limiter slot when body is read to EOF by <a href="https://github.com/knQzx"><code>@knQzx</code></a> in <a href="https://redirect.github.com/google/go-containerregistry/pull/2373">google/go-containerregistry#2373</a></li> <li>tarball: bounds-check layer index in uncompressed LayerByDiffID by <a href="https://github.com/arpitjain099"><code>@arpitjain099</code></a> in <a href="https://redirect.github.com/google/go-containerregistry/pull/2370">google/go-containerregistry#2370</a></li> <li>authn: read Podman auth from XDG config by <a href="https://github.com/vigneshakaviki"><code>@vigneshakaviki</code></a> in <a href="https://redirect.github.com/google/go-containerregistry/pull/2379">google/go-containerregistry#2379</a></li> <li>transport: per-host bearer token exchange on cross-host redirect by <a href="https://github.com/amitzig"><code>@amitzig</code></a> in <a href="https://redirect.github.com/google/go-containerregistry/pull/2360">google/go-containerregistry#2360</a></li> <li>mutate: bounds-check layer index when building rebase addendums by <a href="https://github.com/arpitjain099"><code>@arpitjain099</code></a> in <a href="https://redirect.github.com/google/go-containerregistry/pull/2371">google/go-containerregistry#2371</a></li> <li>fix(daemon): copy ExposedPorts from source config in computeImageConfig by <a href="https://github.com/x64vps"><code>@x64vps</code></a> in <a href="https://redirect.github.com/google/go-containerregistry/pull/2356">google/go-containerregistry#2356</a></li> <li>feat(remote): add WithReferrersTagFallback option by <a href="https://github.com/kevinmdavis"><code>@kevinmdavis</code></a> in <a href="https://redirect.github.com/google/go-containerregistry/pull/2366">google/go-containerregistry#2366</a></li> <li>mutate: apply opaque-directory whiteouts (.wh..wh..opq) in Extract by <a href="https://github.com/sadmanf"><code>@sadmanf</code></a> in <a href="https://redirect.github.com/google/go-containerregistry/pull/2372">google/go-containerregistry#2372</a></li> <li>tarball: use correct file extension for zstd/uncompressed by <a href="https://github.com/milas"><code>@milas</code></a> in <a href="https://redirect.github.com/google/go-containerregistry/pull/2382">google/go-containerregistry#2382</a></li> <li>build(deps): bump github.com/moby/moby/client from 0.5.0 to 0.5.1 in the go-deps group across 1 directory by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/google/go-containerregistry/pull/2380">google/go-containerregistry#2380</a></li> <li>actions: update actions to be pinned by hash by <a href="https://github.com/Subserial"><code>@Subserial</code></a> in <a href="https://redirect.github.com/google/go-containerregistry/pull/2384">google/go-containerregistry#2384</a></li> <li>Bump go version to 1.26.5 by <a href="https://github.com/Subserial"><code>@Subserial</code></a> in <a href="https://redirect.github.com/google/go-containerregistry/pull/2388">google/go-containerregistry#2388</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/xuxiaowei-com-cn"><code>@xuxiaowei-com-cn</code></a> made their first contribution in <a href="https://redirect.github.com/google/go-containerregistry/pull/2358">google/go-containerregistry#2358</a></li> <li><a href="https://github.com/knQzx"><code>@knQzx</code></a> made their first contribution in <a href="https://redirect.github.com/google/go-containerregistry/pull/2373">google/go-containerregistry#2373</a></li> <li><a href="https://github.com/arpitjain099"><code>@arpitjain099</code></a> made their first contribution in <a href="https://redirect.github.com/google/go-containerregistry/pull/2370">google/go-containerregistry#2370</a></li> <li><a href="https://github.com/vigneshakaviki"><code>@vigneshakaviki</code></a> made their first contribution in <a href="https://redirect.github.com/google/go-containerregistry/pull/2379">google/go-containerregistry#2379</a></li> <li><a href="https://github.com/amitzig"><code>@amitzig</code></a> made their first contribution in <a href="https://redirect.github.com/google/go-containerregistry/pull/2360">google/go-containerregistry#2360</a></li> <li><a href="https://github.com/x64vps"><code>@x64vps</code></a> made their first contribution in <a href="https://redirect.github.com/google/go-containerregistry/pull/2356">google/go-containerregistry#2356</a></li> <li><a href="https://github.com/kevinmdavis"><code>@kevinmdavis</code></a> made their first contribution in <a href="https://redirect.github.com/google/go-containerregistry/pull/2366">google/go-containerregistry#2366</a></li> <li><a href="https://github.com/sadmanf"><code>@sadmanf</code></a> made their first contribution in <a href="https://redirect.github.com/google/go-containerregistry/pull/2372">google/go-containerregistry#2372</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/google/go-containerregistry/compare/v0.21.7...v0.21.8">https://github.com/google/go-containerregistry/compare/v0.21.7...v0.21.8</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
Radoslav Dimitrov
|
0b5cc0f6a9 |
build(deps): consolidate open dependabot updates (#1482)
Consolidates the five open dependabot PRs into a single change so they can be reviewed and merged together. Each bump was reproduced against current `main` (`go get` + `go mod tidy` for Go modules; the exact SHA pins applied for the actions group), rather than merging the individual branches, to avoid stale `go.sum` conflicts. ## Root module (`go.mod`) | Dependency | From | To | Supersedes | |---|---|---|---| | `google.golang.org/grpc` | 1.82.0 | 1.82.1 | #1479 | | `github.com/prometheus/client_golang` | 1.23.2 | 1.24.1 | #1475 | | `github.com/danielgtaylor/huma/v2` | 2.38.0 | 2.39.0 | #1474 | ## Deploy module (`deploy/go.mod`) | Dependency | From | To | Supersedes | |---|---|---|---| | `github.com/pulumi/pulumi-kubernetes/sdk/v4` | 4.32.0 | 4.33.0 | #1449 | ## GitHub Actions (#1476) - `actions/setup-go` SHA bumped across `ci.yml`, `release.yml`, `deploy-production.yml`, `deploy-staging.yml` - `actions/download-artifact` v4 → v8.0.1 in `close-invalid-publish-prs.yml` `go mod tidy` re-resolved transitive dependencies in both modules accordingly. ## Verification - `go build ./...` passes (root + deploy) - `go vet ./...` passes - `govulncheck ./...` reports no `golang.org/x/text` finding (the GO-2026-5970 fix from #1481 is preserved; tidy pulled x/text to v0.40.0) ## Follow-up Once this merges, the five superseded PRs (#1479, #1475, #1474, #1449, #1476) can be closed. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> |
||
|
dependabot[bot]
|
b25ab9b93a |
build(deps): bump google.golang.org/grpc from 1.81.1 to 1.82.1 in /deploy (#1480)
Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.81.1 to 1.82.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/grpc/grpc-go/releases">google.golang.org/grpc's releases</a>.</em></p> <blockquote> <h2>Release 1.82.1</h2> <h1>Security</h1> <ul> <li>server: Stop reading from the connection when flooded by HTTP/2 frames. The default value for this limit is 100 frames, excluding DATA and HEADERS, and may be changed by setting environment variable <code>GRPC_GO_EXPERIMENTAL_CONTROL_BUFFER_THROTTLE_LIMIT</code>.</li> <li>xds/rbac: Support <code>Metadata</code> and <code>RequestedServerName</code> permissions matcher fields. If present in a DENY rule, previously these would be ignored and fail-open.</li> <li>xds/rbac: Fix panic when parsing unsupported fields in <code>NotRule</code>/<code>NotId</code> permissions.</li> <li>xds/rbac: Support the deprecated <code>source_ip</code> principal identifier by treating it as equivalent to <code>direct_remote_ip</code>.</li> </ul> <h2>Release 1.82.0</h2> <h1>Behavior Changes</h1> <ul> <li>server: Remove support for <code>GRPC_GO_EXPERIMENTAL_DISABLE_STRICT_PATH_CHECKING</code> environment varibale. Strict incoming RPC path validation (which has been the default since <code>v1.79.3</code>) can no longer be disabled. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9112">#9112</a>)</li> <li>transport: Add environment variable to change the default max header list size from <code>16MB</code> to <code>8KB</code>. This may be enabled by setting <code>GRPC_GO_EXPERIMENTAL_ENABLE_8KB_DEFAULT_HEADER_LIST_SIZE=true</code>. This will be enabled by default in a subsequent release. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9019">#9019</a>)</li> <li>balancer: Load Balancing policy registry is now case-sensitive. Set <code>GRPC_GO_EXPERIMENTAL_CASE_SENSITIVE_BALANCER_REGISTRIES=false</code> (and file an issue) to revert to case-insensitive behavior. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9017">#9017</a>)</li> </ul> <h1>New Features</h1> <ul> <li>experimental/stats: Expose a new API, <code>NewContextWithLabelCallback</code>, to register a callback that is invoked when telemetry labels are added. (<a href="https://redirect.github.com/grpc/grpc-go/issues/8877">#8877</a>) <ul> <li>Special Thanks: <a href="https://github.com/seth-epps"><code>@seth-epps</code></a></li> </ul> </li> <li>client: Return a portion of the response body in the error message, when the client receives an unexpected non-gRPC HTTP response, to make debugging easier. (<a href="https://redirect.github.com/grpc/grpc-go/issues/8929">#8929</a>) <ul> <li>Special Thanks: <a href="https://github.com/chengxilo"><code>@chengxilo</code></a></li> </ul> </li> <li>server: Add environment variable <code>GRPC_GO_SERVER_GOROUTINE_LABELS</code> that controls setting <code>runtime/pprof.Labels</code> on goroutines spawned by the server. Set <code>GRPC_GO_SERVER_GOROUTINE_LABELS=grpc.method=true</code> to add the <code>grpc.method</code> label on goroutines spawned to handle incoming requests. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9082">#9082</a>) <ul> <li>Special Thanks: <a href="https://github.com/dfinkel"><code>@dfinkel</code></a></li> </ul> </li> </ul> <h1>Bug Fixes</h1> <ul> <li>xds/server: Fix a memory leak of HTTP filter instances occurring when route configurations are updated in-place during a Route Discovery Service (RDS) update. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9138">#9138</a>)</li> <li>grpc: In the deprecated <code>gzip</code> Compressor (used via the deprecated <code>WithCompressor</code> dial option), enforce the <code>MaxRecvMsgSize</code> limit on the decompressed message buffer, preventing excessive memory allocation from highly compressed payloads. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9114">#9114</a>) <ul> <li>Special Thanks: <a href="https://github.com/evilgensec"><code>@evilgensec</code></a></li> </ul> </li> <li>stats/opentelemetry: Record retry attempts, <code>grpc.previous-rpc-attempts</code>, at the call level and not the attempt level. (<a href="https://redirect.github.com/grpc/grpc-go/issues/8923">#8923</a>)</li> <li>encoding: Ensure <code>Close()</code> is always called on readers returned from <code>Compressor.Decompress</code> if possible. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9135">#9135</a>)</li> <li>channelz: Fix the <code>LastMessageSentTimestamp</code> and <code>LastMessageReceivedTimestamp</code> fields in <code>SocketMetrics</code> to ensure they contain correct timestamp values. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9109">#9109</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
Radoslav Dimitrov
|
8d3517519f |
fix(deps): bump golang.org/x/text to v0.39.0 (GO-2026-5970) (#1481)
## Problem The **Build, Lint, and Validate** CI job is failing on every open PR (#1480, #1474, #1449) and on `main`. The failing step is `govulncheck`: ``` Vulnerability #1: GO-2026-5970 Infinite loop on invalid input in golang.org/x/text Found in: golang.org/x/text@v0.38.0 Fixed in: golang.org/x/text@v0.39.0 ``` This is **not** caused by any of those PRs' changes — `govulncheck-action` fetches the live vulnerability database at runtime, so when GO-2026-5970 was published, every branch based on the current `main` started failing. The vulnerable symbol is reachable via: - `auth.DefaultHTTPKeyFetcher.FetchKey` → `http.Client.Do` - `database.NewTestDB` → `pgx.Connect` so the scan exits with code 3. ## Fix Bump the (indirect) `golang.org/x/text` dependency from `v0.38.0` to the fixed `v0.39.0` and `go mod tidy`. ## Verification - `govulncheck ./...` no longer reports GO-2026-5970 (confirmed locally). - `go build ./...` passes. ## Note The `deploy/` module pins `golang.org/x/text@v0.37.0`, which is also < v0.39.0. It is a separate module and is **not** scanned by this CI job (govulncheck runs `./...` in the root module only), so it does not block CI. Worth a follow-up bump for hygiene, but out of scope here. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> |
||
|
dependabot[bot]
|
5cbf3320e8 |
build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.251.0 to 3.253.0 in /deploy (#1448)
Bumps [github.com/pulumi/pulumi/sdk/v3](https://github.com/pulumi/pulumi) from 3.251.0 to 3.253.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/pulumi/pulumi/releases">github.com/pulumi/pulumi/sdk/v3's releases</a>.</em></p> <blockquote> <h2>v3.253.0</h2> <h2>3.253.0 (2026-07-14)</h2> <h3>Features</h3> <ul> <li>[auto/go] Support --import-pending-creates for refresh command in Go Automation API for preview refresh and refresh operations <a href="https://redirect.github.com/pulumi/pulumi/pull/23833">#23833</a></li> </ul> <h3>Bug Fixes</h3> <ul> <li>[sdk] Precompose filenames to NFC on macOS when matching ignore patterns during archive creation, mirroring git's core.precomposeunicode so composed patterns match decomposed filenames <a href="https://redirect.github.com/pulumi/pulumi/pull/23566">#23566</a></li> <li>[cli] Respect the -v log level again so that without -v only warnings and errors are written to stderr <a href="https://redirect.github.com/pulumi/pulumi/pull/23910">#23910</a></li> <li>[codegen] Correctly generate provider resources declared inside PCL components for Node.js, Python and Go <a href="https://redirect.github.com/pulumi/pulumi/pull/23904">#23904</a></li> </ul> <h3>Improvements</h3> <ul> <li>[cli] Add a <code>--version</code> flag to the <code>pulumi</code> command that prints the version, same as <code>pulumi version</code> <a href="https://redirect.github.com/pulumi/pulumi/pull/23898">#23898</a></li> <li>[cli] Align <code>env</code> commands with the CLI naming guidelines, making <code>list</code>, <code>remove</code> and <code>move</code> the canonical names with <code>ls</code>, <code>rm</code>, <code>delete</code> and <code>mv</code> kept as aliases <a href="https://redirect.github.com/pulumi/pulumi/pull/23901">#23901</a></li> </ul> <h2>v3.252.0</h2> <h2>3.252.0 (2026-07-13)</h2> <h3>Features</h3> <ul> <li>[auto] Add <code>import</code> to the generated automation APIs for NodeJS, Python and Go <a href="https://redirect.github.com/pulumi/pulumi/pull/23876">#23876</a></li> <li>[cli] Improve the error message when using Pulumi ESC with a DIY backend to suggest logging into Pulumi Cloud <a href="https://redirect.github.com/pulumi/pulumi/pull/23811">#23811</a></li> <li>[cli] Show command name for cli commands when running any command that lists logs <a href="https://redirect.github.com/pulumi/pulumi/pull/23889">#23889</a></li> <li>[cli/display] Render strings containing non-UTF8 bytes as b"<!-- raw HTML omitted -->" in diffs and JSON output <a href="https://redirect.github.com/pulumi/pulumi/pull/23870">#23870</a></li> <li>[cli/env] Add a <code>--reason</code> flag to <code>pulumi env open-request</code> to explain the request to approvers <a href="https://redirect.github.com/pulumi/pulumi/pull/23802">#23802</a></li> <li>[cli/state] Improve the error message when a resource URN is not found in the state for <code>pulumi state</code> commands, suggesting close-matching URNs and how to list the URNs in the stack <a href="https://redirect.github.com/pulumi/pulumi/pull/23812">#23812</a></li> <li>[pcl] Allow binding hooks to a resource's <code>onError</code> option <a href="https://redirect.github.com/pulumi/pulumi/pull/23838">#23838</a></li> <li>[sdk/nodejs] Add a <code>production</code> runtime option for Node.js projects. When set to <code>true</code> in <code>Pulumi.yaml</code>, <code>pulumi install</code> skips <code>devDependencies</code> (npm <code>--production</code>, pnpm <code>--production</code>, yarn <code>--production</code>). <a href="https://redirect.github.com/pulumi/pulumi/pull/23849">#23849</a></li> </ul> <h3>Bug Fixes</h3> <ul> <li>[cli] Exit with a non-zero code when a command group such as <code>pulumi env</code> is given an unknown subcommand or no subcommand at all <a href="https://redirect.github.com/pulumi/pulumi/pull/23814">#23814</a></li> <li>[cli] Fix a panic when displaying a stack-level policy violation <a href="https://redirect.github.com/pulumi/pulumi/pull/23692">#23692</a></li> <li>[cli] Make reading non-secret stack outputs and running <code>pulumi about</code> no longer require the passphrase for passphrase-encrypted stacks <a href="https://redirect.github.com/pulumi/pulumi/pull/23820">#23820</a></li> <li>[cli] Avoid <code>pulumi logs <command></code> showing the log for the currently running command <a href="https://redirect.github.com/pulumi/pulumi/pull/23887">#23887</a></li> <li>[cli/do] Fix calling delete on PF resources that need read called first <a href="https://redirect.github.com/pulumi/pulumi/pull/23837">#23837</a></li> <li>[cli/env] Submit the change request created by <code>pulumi env open-request</code> so it is pending approval instead of being left as an unsubmitted draft <a href="https://redirect.github.com/pulumi/pulumi/pull/23802">#23802</a></li> <li>[cli/neo] Fix the initial prompt sometimes rendering above the welcome banner in <code>pulumi neo</code> <a href="https://redirect.github.com/pulumi/pulumi/pull/23831">#23831</a></li> <li>[engine] Fix importing a resource whose import identifier differs from its canonical ID causes the resource to be deleted on a subsequent update <a href="https://redirect.github.com/pulumi/pulumi/pull/23834">#23834</a></li> <li>[programgen] Deduplicate identical apply arguments to avoid unnecessary Promise.all/pulumi.all/Output.All in generated code <a href="https://redirect.github.com/pulumi/pulumi/pull/22293">#22293</a></li> <li>[sdk] Failed resource registrations will return faulted outputs, not unknown outputs <a href="https://redirect.github.com/pulumi/pulumi/pull/23844">#23844</a></li> <li>[sdk/nodejs] Fix empty node_modules folders in serialized function archives when using pnpm or symlinked workspace packages <a href="https://redirect.github.com/pulumi/pulumi/pull/23866">#23866</a></li> </ul> <h3>Miscellaneous</h3> <ul> <li>[sdk/nodejs] Report the TypeScript version in <code>pulumi about</code> <a href="https://redirect.github.com/pulumi/pulumi/pull/23850">#23850</a></li> <li>[sdk/nodejs] Update OpenTelemetry dependencies <a href="https://redirect.github.com/pulumi/pulumi/pull/23855">#23855</a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/pulumi/pulumi/blob/master/CHANGELOG.md">github.com/pulumi/pulumi/sdk/v3's changelog</a>.</em></p> <blockquote> <h2>3.253.0 (2026-07-14)</h2> <h3>Features</h3> <ul> <li>[auto/go] Support --import-pending-creates for refresh command in Go Automation API for preview refresh and refresh operations <a href="https://redirect.github.com/pulumi/pulumi/pull/23833">#23833</a></li> </ul> <h3>Bug Fixes</h3> <ul> <li>[sdk] Precompose filenames to NFC on macOS when matching ignore patterns during archive creation, mirroring git's core.precomposeunicode so composed patterns match decomposed filenames <a href="https://redirect.github.com/pulumi/pulumi/pull/23566">#23566</a></li> <li>[cli] Respect the -v log level again so that without -v only warnings and errors are written to stderr <a href="https://redirect.github.com/pulumi/pulumi/pull/23910">#23910</a></li> <li>[codegen] Correctly generate provider resources declared inside PCL components for Node.js, Python and Go <a href="https://redirect.github.com/pulumi/pulumi/pull/23904">#23904</a></li> </ul> <h3>Improvements</h3> <ul> <li>[cli] Add a <code>--version</code> flag to the <code>pulumi</code> command that prints the version, same as <code>pulumi version</code> <a href="https://redirect.github.com/pulumi/pulumi/pull/23898">#23898</a></li> <li>[cli] Align <code>env</code> commands with the CLI naming guidelines, making <code>list</code>, <code>remove</code> and <code>move</code> the canonical names with <code>ls</code>, <code>rm</code>, <code>delete</code> and <code>mv</code> kept as aliases <a href="https://redirect.github.com/pulumi/pulumi/pull/23901">#23901</a></li> </ul> <h2>3.252.0 (2026-07-13)</h2> <h3>Features</h3> <ul> <li>[auto] Add <code>import</code> to the generated automation APIs for NodeJS, Python and Go <a href="https://redirect.github.com/pulumi/pulumi/pull/23876">#23876</a></li> </ul> <h3>Bug Fixes</h3> <ul> <li>[cli] Exit with a non-zero code when a command group such as <code>pulumi env</code> is given an unknown subcommand or no subcommand at all <a href="https://redirect.github.com/pulumi/pulumi/pull/23814">#23814</a></li> <li>[cli] Fix a panic when displaying a stack-level policy violation <a href="https://redirect.github.com/pulumi/pulumi/pull/23692">#23692</a></li> <li>[cli] Make reading non-secret stack outputs and running <code>pulumi about</code> no longer require the passphrase for passphrase-encrypted stacks <a href="https://redirect.github.com/pulumi/pulumi/pull/23820">#23820</a></li> <li>[cli] Avoid <code>pulumi logs <command></code> showing the log for the currently running command <a href="https://redirect.github.com/pulumi/pulumi/pull/23887">#23887</a></li> </ul> <h3>Improvements</h3> <ul> <li>[cli] Improve the error message when using Pulumi ESC with a DIY backend to suggest logging into Pulumi Cloud <a href="https://redirect.github.com/pulumi/pulumi/pull/23811">#23811</a></li> <li>[cli] Show command name for cli commands when running any command that lists logs <a href="https://redirect.github.com/pulumi/pulumi/pull/23889">#23889</a></li> <li>[cli/display] Render strings containing non-UTF8 bytes as b"<!-- raw HTML omitted -->" in diffs and JSON output <a href="https://redirect.github.com/pulumi/pulumi/pull/23870">#23870</a></li> </ul> <h3>Bug Fixes</h3> <ul> <li>[cli/do] Fix calling delete on PF resources that need read called first <a href="https://redirect.github.com/pulumi/pulumi/pull/23837">#23837</a></li> <li>[cli/env] Submit the change request created by <code>pulumi env open-request</code> so it is pending approval instead of being left as an unsubmitted draft <a href="https://redirect.github.com/pulumi/pulumi/pull/23802">#23802</a></li> </ul> <h3>Improvements</h3> <ul> <li>[cli/env] Add a <code>--reason</code> flag to <code>pulumi env open-request</code> to explain the request to approvers <a href="https://redirect.github.com/pulumi/pulumi/pull/23802">#23802</a></li> </ul> <h3>Bug Fixes</h3> <ul> <li>[cli/neo] Fix the initial prompt sometimes rendering above the welcome banner in <code>pulumi neo</code> <a href="https://redirect.github.com/pulumi/pulumi/pull/23831">#23831</a></li> </ul> <h3>Improvements</h3> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
2271214bd8 |
build(deps): bump cloud.google.com/go/kms from 1.31.0 to 1.32.0 (#1447)
Bumps [cloud.google.com/go/kms](https://github.com/googleapis/google-cloud-go) from 1.31.0 to 1.32.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/googleapis/google-cloud-go/releases">cloud.google.com/go/kms's releases</a>.</em></p> <blockquote> <h2>kms: v1.32.0</h2> <h2><a href="https://github.com/googleapis/google-cloud-go/compare/kms/v1.31.0...kms/v1.32.0">1.32.0</a> (2026-07-13)</h2> <h3>Features</h3> <ul> <li><strong>o11y:</strong> Regenerate clients for LRO tracing (<a href="https://redirect.github.com/googleapis/google-cloud-go/issues/20107">#20107</a>) (<a href=" |