Added schema validation and support for exhaustive and more detailed
validation to existing validators. Added new `mcp-publisher validate`
command. No change to any existing tests or behavior other than the new
command.
## Motivation and Context
Many currently published servers fail schema validation. Of those that
pass, many have semantic/logical errors or other errors that make them
impossible to configure, or their configuration when applied doesn't
generate correct MCP server configuration (per their own documentation).
To address this, we need better tooling to validate servers and to
inform server publishers of errors, issues, and best practices in a way
that is clear and actionable, both during server development and at time
of publishing.
I have started a discussion about the broader topic:
https://github.com/modelcontextprotocol/registry/discussions/635
There is also a fairly detailed document describing the design,
architecture, implementation, future plans, etc. See [Enhanced
Validation Design](docs/explanations/proposed-enhanced-validation.md)
This PR is the first step in the process of improving validation. It
adds schema validation and updates all existing validators to use a new
model that allows them to track context and return rich and exhaustive
results. This has been done in a way that is backward compatible
(ValidateServerJSON is unchanged as are all existing validation unit
tests).
There is a new `mcp-publisher` command called `validate` that is
currenty the only place that schema validation and enhanced
(exhaustive/rich) validation results are exposed.
### Changes
Internal Validation improvements
- Schema validation has been implemented and is available as an option
in validation methods (defaults to off)
- Existing validators track the JSON path (context) of the attribute
they're evaluating, passing it to any child validators
- Existing validators are exhaustive (return all issues, not failing
fast on the first error)
- Existing validators return rich validation results, including:
- type (schema, semantic, linter)
- severity (error, warn, info)
- path (JSON path to server.json element)
- reference (to the schema element or rule that triggered the result)
- message (currently the same as previous error message)
A new `validate` command has been added to `mcp-publisher` so publishers
can evaluate their server.json before publishing
- Includes new schema validation and previous semantic validation
- Shows full details of all issues encountered during validation
### Usage
Given a server.json that looks like this:
```json
{
"$schema": "https://static.modelcontextprotocol.io/schemas/2025-09-29/server.schema.json",
"name": "io.github.BobDickinson/registry",
"description": "An MCP server that provides [describe what your server does]",
"repository": {
"url": "",
"source": ""
},
"version": "=1.0.0",
"packages": [
{
"registryType": "oci",
"registryBaseUrl": "https://docker.io",
"identifier": "registry",
"version": "1.0.0",
"transport": {
"type": "sse"
},
"packageArguments": [
{
"type": "named",
"name": "--mode",
"description": "Operation mode",
"format": "foo"
}
],
"environmentVariables": [
{
"description": "Your API key for the service",
"isRequired": true,
"format": "string",
"isSecret": true,
"name": "YOUR_API_KEY"
}
]
}
]
}
```
Run the command:
`mcp-publisher validate server.json`
Which will produce the output:
```bash
❌ Validation failed with 5 issue(s):
1. [error] packages.0.packageArguments.0.format (schema)
value must be one of "string", "number", "boolean", "filepath"
Reference: #/definitions/Input/properties/format/enum from: [#/definitions/ServerDetail]/properties/packages/items/[#/definitions/Package]/properties/packageArguments/items/[#/definitions/Argument]/else/[#/definitions/NamedArgument]/allOf/0/[#/definitions/InputWithVariables]/allOf/0/[#/definitions/Input]/properties/format/enum
2. [error] packages.0.transport (schema)
missing required fields: 'url'
Reference: #/definitions/SseTransport/required from: [#/definitions/ServerDetail]/properties/packages/items/[#/definitions/Package]/properties/transport/else/else/[#/definitions/SseTransport]/required
3. [error] repository.url (schema)
'' has invalid format 'uri'
Reference: #/definitions/Repository/properties/url/format from: [#/definitions/ServerDetail]/properties/repository/[#/definitions/Repository]/properties/url/format
4. [error] version (semantic)
version must be a specific version, not a range: "=1.0.0"
Reference: version-looks-like-range
5. [error] packages[0].transport.url (semantic)
url is required for sse transport type
Reference: streamable-transport-url-required
Error: validation failed
```
Note in the results above:
- All errors contain the JSON path of the triggering element from
server.json.
- The first three errors are schema errors detected during schema
validation. The `Reference` provided contains an absolute path to the
schema rule that was violated, followed by the full schema path that
enforced that rule (with $ref redirect values substited and enclosed in
square brackets).
- The error messages provided by the existing semantic validators are
exactly the same as the previous error messages those validators
produced.
In the final solution we would remove semantic validators that are
redundant to schema validation (as in number 5 above). We have the
option to use the structured data produced by schema validation to
replace the generic schema validation message with a more descriptive
message if that is an issue (in particular, if the only argument for an
ad-hoc validator is that is produces a better/cleaner message, we would
just move that message creation code to the schema error result
formatter and special case it as opposed to having a redundant
validator).
### What's Next
If this general direction is supported and this PR is accepted, a fast
follow would include:
- Add new validators (infliuenced by observed issues) for both semantic
errors and best practices
- Require passing schema validation (in addition to improved semantic
validation) in order to publish
- Remove existing validation code that is redundant to schema validation
(ensuring error messages remain intelligible)
- Update validation client code and tests to handle the new rich return
types natively
### Issues
Schema validation requires embedding the `server.schema.json` file into
the validators package via `go:embed`, which is restricted from
embedding files outside of the package. For this reason we copy the
schema file into a schema subdir (via a prep target in the makefile) and
we .gitignore it. I tried cleaning up the copy in the make clean target,
but then the linter would complain about the embed target being missing
if it wasn't there during development. I also considered just checking
in the schema file and assuming a separate workflow for updating the
embedded schema file, but it's not clear what that workflow would be or
how it would be maintained. I'm open to a different approach, but the
schema file does need to be embedded somehow for schema validation to
work.
## How Has This Been Tested?
All existing validation tests pass, new tests implemented and all pass.
## Breaking Changes
No breaking changes, no behavior change except new `validate` command
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [X] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [X] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [X] My code follows the repository's style guidelines
- [X] New and existing tests pass locally
- [X] I have added appropriate error handling
- [X] I have added or updated documentation as needed
---------
Co-authored-by: GitHub Action <action@github.com>
<!-- Provide a brief summary of your changes -->
## Motivation and Context
Added a fully client-side browser for MCP registry APIs to the
`community-projects.md` documentation page:
https://vemonet.github.io/mcp-registry
I built it because I was missing a way to easily configure a server and
export the configuration (existing browsers I have found show the
available parameters, but you still need to manually build the JSON):
- It shows a user friendly form that enables to configure MCP servers
based on their registry entry, making it easier to understand and fill
the configuration required for deploying a server (instead of having to
read through JSON, and manually build another JSON). Then users can
either copy the generated config or install in client with custom URL
handler like VSCode/cursor in 1 click
- It is a thin client UI layer over the existing registry API, it does
not offer additional classification, complex filtering, or semantic
search (we don't use an additional server or database). So it is more of
a tool to make it user friendly to directly access a raw registry
content and inspects available servers, than an opinionated browser with
advanced search capabilities
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [x] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [x] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [x] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [x] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
<!-- Provide a brief summary of your changes -->
## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
Follow up on #869
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>
Bumps [golang.org/x/mod](https://github.com/golang/mod) from 0.31.0 to
0.32.0.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="4c04067938"><code>4c04067</code></a>
go.mod: update golang.org/x dependencies</li>
<li>See full diff in <a
href="https://github.com/golang/mod/compare/v0.31.0...v0.32.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps
[github.com/pulumi/pulumi/sdk/v3](https://github.com/pulumi/pulumi) from
3.214.0 to 3.215.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pulumi/pulumi/releases">github.com/pulumi/pulumi/sdk/v3's
releases</a>.</em></p>
<blockquote>
<h2>v3.215.0</h2>
<h2>3.215.0 (2026-01-07)</h2>
<h3>Features</h3>
<ul>
<li>[cli/plugin] Allow plugins to specify a supported version range for
the CLI
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21335">#21335</a></li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>
<p>[cli] Filter internal properties like __defaults from diff display
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21359">#21359</a></p>
</li>
<li>
<p>[cli/config] Make <code>config set --type bool</code> accept
different spellings of boolean values instead of only lowercase
"true"
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21314">#21314</a></p>
</li>
<li>
<p>[sdk/python] Fix import_resources with converter failing due to
--stack argument placement
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21373">#21373</a></p>
</li>
</ul>
<h3>Miscellaneous</h3>
<ul>
<li>
<p>[cli] Update pulumi-dotnet to 3.96.1</p>
</li>
<li>
<p>[cli/package] Remove superfluous version string
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21351">#21351</a></p>
</li>
</ul>
<h2>v3.214.1</h2>
<h2>3.214.1 (2026-01-03)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>
<p>[cli/package] Preserve existing behavior when <code>pulumi package
add</code> is used with a local provider
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21350">#21350</a></p>
</li>
<li>
<p>[pkg] Create namespace aliases to avoid Pulumi namespace collisions
during codegen
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21325">#21325</a></p>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pulumi/pulumi/blob/master/CHANGELOG.md">github.com/pulumi/pulumi/sdk/v3's
changelog</a>.</em></p>
<blockquote>
<h2>3.215.0 (2026-01-07)</h2>
<h3>Features</h3>
<ul>
<li>[cli/plugin] Allow plugins to specify a supported version range for
the CLI
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21335">#21335</a></li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>
<p>[cli] Filter internal properties like __defaults from diff display
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21359">#21359</a></p>
</li>
<li>
<p>[cli/config] Make <code>config set --type bool</code> accept
different spellings of boolean values instead of only lowercase
"true"
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21314">#21314</a></p>
</li>
<li>
<p>[sdk/python] Fix import_resources with converter failing due to
--stack argument placement
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21373">#21373</a></p>
</li>
</ul>
<h3>Miscellaneous</h3>
<ul>
<li>
<p>[cli] Update pulumi-dotnet to 3.96.1</p>
</li>
<li>
<p>[cli/package] Remove superfluous version string
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21351">#21351</a></p>
</li>
</ul>
<h2>3.214.1 (2026-01-03)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>
<p>[cli/package] Preserve existing behavior when <code>pulumi package
add</code> is used with a local provider
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21350">#21350</a></p>
</li>
<li>
<p>[pkg] Create namespace aliases to avoid Pulumi namespace collisions
during codegen
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21325">#21325</a></p>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="2ff3425c8f"><code>2ff3425</code></a>
Update pulumi-dotnet to 3.96.1 (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21382">#21382</a>)</li>
<li><a
href="628bf0b636"><code>628bf0b</code></a>
fuzzing: expand targeted dependency rule (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21380">#21380</a>)</li>
<li><a
href="2f90313e05"><code>2f90313</code></a>
fix: Insert <code>--stack</code> before <code>--</code> separator in
<code>_run_pulumi_cmd_sync</code> (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21373">#21373</a>)</li>
<li><a
href="137b72ba9f"><code>137b72b</code></a>
Use unittest.IsolatedAsyncioTestCase (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21376">#21376</a>)</li>
<li><a
href="6d92edd52e"><code>6d92edd</code></a>
Allow plugins to set supported CLI versions (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21335">#21335</a>)</li>
<li><a
href="3d12eb1182"><code>3d12eb1</code></a>
Always use <code>packageresolution.Resolve</code> for resource plugin
downloads (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21317">#21317</a>)</li>
<li><a
href="54b8cd9884"><code>54b8cd9</code></a>
Filter internal properties from diff display (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21359">#21359</a>)</li>
<li><a
href="0d3bb719fe"><code>0d3bb71</code></a>
Fix python test coverage (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21365">#21365</a>)</li>
<li><a
href="64c53a5bc1"><code>64c53a5</code></a>
show DestroyV2 failures when parent of provider is updated (<a
href="https://redirect.github.com/pulumi/pulumi/issues/20758">#20758</a>)</li>
<li><a
href="30cfc54973"><code>30cfc54</code></a>
Update dependency urllib3 to v2.6.2 (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21360">#21360</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/pulumi/pulumi/compare/v3.214.0...v3.215.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
As part of MCP joining the Linux Foundation, this PR updates licensing
to Apache 2.0 for new contributions while grandfathering existing MIT
code. See modelcontextprotocol/modelcontextprotocol#1994
## Summary
- Added `printCommandHelp()` function to display help for each
subcommand
- `mcp-publisher init --help` now shows init command help instead of
running init
- `mcp-publisher login --help` now shows login methods instead of error
- `mcp-publisher publish --help` now shows publish usage instead of
attempting publish
Fixes#735
Signed-off-by: majiayu000 <1835304752@qq.com>
Co-authored-by: Radoslav Dimitrov <radoslav@stacklok.com>
Bumps [github.com/jackc/pgx/v5](https://github.com/jackc/pgx) from 5.7.6
to 5.8.0.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/jackc/pgx/blob/master/CHANGELOG.md">github.com/jackc/pgx/v5's
changelog</a>.</em></p>
<blockquote>
<h1>5.8.0 (December 26, 2025)</h1>
<ul>
<li>Require Go 1.24+</li>
<li>Remove golang.org/x/crypto dependency</li>
<li>Add OptionShouldPing to control ResetSession ping behavior
(ilyam8)</li>
<li>Fix: Avoid overflow when MaxConns is set to MaxInt32</li>
<li>Fix: Close batch pipeline after a query error (Anthonin
Bonnefoy)</li>
<li>Faster shutdown of pgxpool.Pool background goroutines (Blake
Gentry)</li>
<li>Add pgxpool ping timeout (Amirsalar Safaei)</li>
<li>Fix: Rows.FieldDescriptions for empty query</li>
<li>Scan unknown types into *any as string or []byte based on format
code</li>
<li>Optimize pgtype.Numeric (Philip Dubé)</li>
<li>Add AfterNetConnect hook to pgconn.Config</li>
<li>Fix: Handle for preparing statements that fail during the Describe
phase</li>
<li>Fix overflow in numeric scanning (Ilia Demianenko)</li>
<li>Fix: json/jsonb sql.Scanner source type is []byte</li>
<li>Migrate from math/rand to math/rand/v2 (Mathias Bogaert)</li>
<li>Optimize internal iobufpool (Mathias Bogaert)</li>
<li>Optimize stmtcache invalidation (Mathias Bogaert)</li>
<li>Fix: missing error case in interval parsing (Maxime Soulé)</li>
<li>Fix: invalidate statement/description cache in Exec (James
Hartig)</li>
<li>ColumnTypeLength method return the type length for varbit type
(DengChan)</li>
<li>Array and Composite codecs handle typed nils</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="fe8740aa06"><code>fe8740a</code></a>
Release v5.8.0</li>
<li><a
href="e5dde5a511"><code>e5dde5a</code></a>
Skip test on CockroachDB</li>
<li><a
href="06f2d82cac"><code>06f2d82</code></a>
Remove trailing space</li>
<li><a
href="2cf78dd906"><code>2cf78dd</code></a>
Merge pull request <a
href="https://redirect.github.com/jackc/pgx/issues/2448">#2448</a> from
DengChan/column_type_lenth_varbit</li>
<li><a
href="2d1c4ef1aa"><code>2d1c4ef</code></a>
Skip tests on CockroachDB</li>
<li><a
href="1a5fa7fc7f"><code>1a5fa7f</code></a>
Array and Composite codecs handle typed nils</li>
<li><a
href="5736d0976d"><code>5736d09</code></a>
ColumnTypeLength method return the type length for varbit type.</li>
<li><a
href="4c1308c14b"><code>4c1308c</code></a>
Revert "stdlib matches native pgx scanning support"</li>
<li><a
href="14ce2b7a62"><code>14ce2b7</code></a>
Skip test on CockroachDB</li>
<li><a
href="65b2724ea5"><code>65b2724</code></a>
Merge pull request <a
href="https://redirect.github.com/jackc/pgx/issues/2443">#2443</a> from
jameshartig/x-invalidate-cache-in-exec</li>
<li>Additional commits viewable in <a
href="https://github.com/jackc/pgx/compare/v5.7.6...v5.8.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps the actions group with 1 update:
[anchore/sbom-action](https://github.com/anchore/sbom-action).
Updates `anchore/sbom-action` from 0.20.11 to 0.21.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/anchore/sbom-action/releases">anchore/sbom-action's
releases</a>.</em></p>
<blockquote>
<h2>v0.21.0</h2>
<ul>
<li>chore(deps): update Syft to v1.39.0 (<a
href="https://redirect.github.com/anchore/sbom-action/issues/561">#561</a>)</li>
<li>chore(deps): bump <code>@octokit/request-error</code>,
<code>@octokit/core</code> and <code>@octokit/webhooks</code> (<a
href="https://redirect.github.com/anchore/sbom-action/issues/560">#560</a>)</li>
<li>chore(deps): bump peter-evans/create-pull-request from 7.0.11 to
8.0.0 (<a
href="https://redirect.github.com/anchore/sbom-action/issues/558">#558</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="a930d0ac43"><code>a930d0a</code></a>
chore(deps): update Syft to v1.39.0 (<a
href="https://redirect.github.com/anchore/sbom-action/issues/561">#561</a>)</li>
<li><a
href="e4b2532819"><code>e4b2532</code></a>
chore(deps): bump <code>@octokit/request-error</code>,
<code>@octokit/core</code> and <code>@octokit/webhooks</code>...</li>
<li><a
href="481b254e1d"><code>481b254</code></a>
chore(deps): bump peter-evans/create-pull-request from 7.0.11 to 8.0.0
(<a
href="https://redirect.github.com/anchore/sbom-action/issues/558">#558</a>)</li>
<li>See full diff in <a
href="https://github.com/anchore/sbom-action/compare/v0.20.11...v0.21.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps
[github.com/pulumi/pulumi/sdk/v3](https://github.com/pulumi/pulumi) from
3.212.0 to 3.213.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pulumi/pulumi/releases">github.com/pulumi/pulumi/sdk/v3's
releases</a>.</em></p>
<blockquote>
<h2>v3.213.0</h2>
<h2>3.213.0 (2025-12-17)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>[sdkgen/go] Generate three-level nested builtin output types for Go
SDK
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21248">#21248</a></li>
</ul>
<h3>Miscellaneous</h3>
<ul>
<li>[pkg] Move plugin downloading from pkg into sdk
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21220">#21220</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pulumi/pulumi/blob/master/CHANGELOG.md">github.com/pulumi/pulumi/sdk/v3's
changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="b5f037ab6d"><code>b5f037a</code></a>
Bump SDK versions for 3.213.0 (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21269">#21269</a>)</li>
<li><a
href="e317952bf1"><code>e317952</code></a>
add infrastructure to exclude known issues from fuzzing (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21267">#21267</a>)</li>
<li><a
href="312929faea"><code>312929f</code></a>
Do not assert that the pulumi/templates repo contains aws-javascript (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21280">#21280</a>)</li>
<li><a
href="777230ba86"><code>777230b</code></a>
add fuzzing failures to gitignore (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21264">#21264</a>)</li>
<li><a
href="fe2c4cb31d"><code>fe2c4cb</code></a>
catch panics in the engine, and turn them into errors for fuzzing (<a
href="https://redirect.github.com/pulumi/pulumi/issues/20955">#20955</a>)</li>
<li><a
href="de5e586f87"><code>de5e586</code></a>
python auto api tests: fix flakes because of existing stacks (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21265">#21265</a>)</li>
<li><a
href="6d4aa06fc3"><code>6d4aa06</code></a>
Add doc for sdk/go/pulumi-internal/ (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21263">#21263</a>)</li>
<li><a
href="a3350dac5f"><code>a3350da</code></a>
Add a backporting of type-alias of <code>workspace.PluginSpec</code> (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21262">#21262</a>)</li>
<li><a
href="27f635e1dd"><code>27f635e</code></a>
Remove sdk/go/pulumi/internals/empty.s (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21261">#21261</a>)</li>
<li><a
href="29b4e67ea3"><code>29b4e67</code></a>
Expand <code>PackageSpec</code> allow representing a full
<code>PluginDescriptor</code> (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21254">#21254</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/pulumi/pulumi/compare/v3.212.0...v3.213.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
<!-- Provide a brief summary of your changes -->
Change the UI default to the locally hosted registry.
## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
Was quite confusing at first :)
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [x] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [x] My code follows the repository's style guidelines
- [x] New and existing tests pass locally
- [x] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
<!-- Provide a brief summary of your changes -->
## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
The following PR ensures we don't have downtime when we are doing
rollouts during deployment/promotions.
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>
<!-- Provide a brief summary of your changes -->
## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
The following PR promotes the version of the registry in prod to 1.4.0
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>
<!-- Provide a brief summary of your changes -->
## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
Seems that per ingress annotations were not working, so had to put them
in the ingress configmap. Did tested this manually on staging so it's
confirmed it's working (I was getting 429s instead of 503s) and no
traffic was getting into the registry pod.
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>
<!-- Provide a brief summary of your changes -->
## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
A few changes related to configuring the rate limiting:
* Set `externalTrafficPolicy: Local` to preserve real client IPs
(otherwise we only see the cluster IPs)
* Disable `use-forwarded-headers` (L4 LB doesn't set `X-Forwarded-For`,
prevents spoofing)
* Scale NGINX to 2 replicas in prod (costs nothing, gives us
zero-downtime deploys to prod)
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>
<!-- Provide a brief summary of your changes -->
## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
The following is an alternative solution to #833
Goal is to deploy and promote it to prod, then monitor the alerts for a
week to see its effect and reassess. In case it's actual traffic that
we've started blocking we can also up the replicas. I thought it doesn't
make sense to up them now since it would be nice to isolate the result
of this change first.
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
---------
Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>
<!-- Provide a brief summary of your changes -->
## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
The following PR adds a PUT method for updating a server version
(optional, not implemented by the registry but still provides the
ability for other registry implementations to standardise on it)
**Details:**
- Path: PUT /v0.1/servers/{serverName}/versions/{version}
- Purpose: Update a specific version of an MCP server in the registry
- Authentication: Uses bearer token authentication (registry-specific)
- Request Body: Accepts a ServerDetail schema
- Response: Returns a ServerResponse on success (200)
- Error Handling: Includes proper HTTP status codes:
- 401: Unauthorized
- 403: Forbidden - Insufficient permissions
- 404: Server or version not found
- 500: Internal server error
- 501: Not Implemented - Registry doesn't support updates
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>
Prepared by Claude Code, iterated and reviewed by me.
## Summary
This PR releases the server.json schema version `2025-12-11`,
incorporating URL template variables for remote servers from #570.
### What's New
- **URL Template Variables for Remote Servers** - Remote servers can now
define configurable variables in URLs using `{curly_braces}` notation,
enabling multi-tenant deployments.
### Schema Version
- `2025-10-17` → `2025-12-11`
## Release Sequence
1. ~~**First: Merge static repo PR** -
https://github.com/modelcontextprotocol/static/pull/11 (publishes schema
to versioned URL)~~
2. **Then: Merge this PR** - Updates registry code to reference the new
schema version
## Changes in This PR
- [x] Update CHANGELOG.md with release notes
- [x] Update `CurrentSchemaVersion` in `pkg/model/constants.go`
- [x] Update schema example URL in `docs/reference/api/openapi.yaml`
- [x] Update schema URL in `pkg/api/v0/types.go`
- [x] Update all documentation examples to use new schema version
- [x] Regenerate `server.schema.json`
## Test Plan
- [x] `make check` passes (lint, schema validation, example validation)
- [x] Unit tests pass for validators and publisher commands
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Co-authored with Claude Code, but I've closely reviewed/modified/vetted
all changes; ready for final review.
## Summary
This PR adds LocalTransport and RemoteTransport separation with URL
template variable support for remote servers, enabling e.g. multi-tenant
deployments with configurable endpoints.
**Key additions:**
- LocalTransport (for Packages) and RemoteTransport (for Remotes)
- URL template variables for remote transports (e.g., `{tenant_id}` in
URLs)
- Pattern validation ensuring URLs are URL-like while allowing templates
- Full test coverage via Go validator tests and documentation examples
## ⚠️ server.json Update
This PR updates the `server.json` schema. A new schema version will be
cut after this lands.
## Problem
The current schema describes URL templating with `{curly_braces}` for
transports but provides no mechanism for Remote contexts to define what
those variables should resolve to, making the feature unusable for
remote servers.
Referenced issue: #394
- Users need multi-tenant remote servers with different endpoints per
deployment
- Each tenant/region has its own URL (e.g., `us-cell1.example.com`,
`emea-cell1.example.com`)
- Current schema doesn't support parameterized remote URLs
## Solution
### Schema Architecture
**LocalTransport** (for Package context):
```typescript
LocalTransport = StdioTransport | StreamableHttpTransport | SseTransport
```
- Used in Package context (non-breaking rename of existing behavior)
- Variables in `{curly_braces}` reference parent Package
arguments/environment variables
- Supports all three transport types including stdio
**RemoteTransport** (for Remote context):
```typescript
RemoteTransport = (StreamableHttpTransport | SseTransport) + { variables: object }
```
- Extends StreamableHttp/Sse via `allOf` composition - no duplication!
- Adds `variables` object for URL templating
- Only supports streamable-http and sse (stdio not valid for remotes)
### Key Changes
**1. Schema Updates** (`openapi.yaml`, `server.schema.json`):
- Added `LocalTransport` union type for Package context
- Added `RemoteTransport` with `allOf` composition extending base
transports
- Updated Package to reference `LocalTransport`
- Updated remotes to reference `RemoteTransport`
- Added URL pattern validation: `^https?://[^\\s]+$` to both
StreamableHttp and SSE
- Removed `format: uri` from SSE (was blocking template variables)
**2. Go Types** (`pkg/model/types.go`):
- Base `Transport` struct unchanged for Package context
- `RemoteTransport` struct for remotes with `Variables` field
- Both work with existing validation infrastructure
**3. Validators** (`internal/validators/`):
- `validateRemoteTransport()` validates Remote-specific constraints
- `collectRemoteTransportVariables()` extracts available variables
- `IsValidTemplatedURL()` validates template variables reference defined
variables
- `IsValidRemoteURL()` handles template variable substitution before
localhost check
- 6 new test cases for remote transport variable validation
**4. Documentation Examples** (`generic-server-json.md`):
- Remote Server with URL Templating (StreamableHttp with `{tenant_id}`)
- SSE Remote with URL Templating (SSE with `{tenant_id}`)
- Local Server with URL Templating (Package with `{port}`)
- All examples validate via existing `validate-examples` tool
## Example: Remote Transport with Variables
```json
{
"remotes": [
{
"type": "streamable-http",
"url": "https://api.example.com/mcp/{tenant_id}/{region}",
"variables": {
"tenant_id": {
"description": "Tenant identifier",
"isRequired": true,
"choices": ["us-cell1", "emea-cell1", "apac-cell1"]
},
"region": {
"description": "Deployment region",
"isRequired": true
}
}
}
]
}
```
Clients configure the variables, and `{tenant_id}` and `{region}` get
replaced to connect to tenant-specific endpoints like
`https://api.example.com/mcp/us-cell1/east`.
## Architecture Details
**Context-based variable resolution:**
- **Package + LocalTransport**: `{port}` references `--port` argument or
`PORT` env var from parent Package
- **Remote + RemoteTransport**: `{tenant_id}` references
`variables.tenant_id` defined in the transport itself
- **Code reuse**: StreamableHttp/Sse definitions shared via `allOf`, not
duplicated
- **Validation**: Template variables validated against available
variables for each context
---
## Follow-on Work
Follow-on work will be done to adopt the feedback in
https://github.com/modelcontextprotocol/registry/pull/570#issuecomment-3367417636
regarding variable naming/prioritzation/scoping conventions, but should
not have any impact on the shape being introduced here (just
validations).
---------
Co-authored-by: yuna0x0 <yuna@yuna0x0.com>
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Connor Peet <connor@peet.io>
<!-- Provide a brief summary of your changes -->
## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
The following PR bumps cosign and updates Goreleaser to reflect that.
Follows
https://goreleaser.com/blog/cosign-v3/#updating-your-goreleaser-configuration
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>
Prepared by Claude Code, reviewed by me.
## Summary
- Update all API endpoint paths from `/v0/` to `/v0.1/` in the OpenAPI
spec
- Bump OpenAPI spec version from `2025-10-17` to `2025-12-01` (in `$id`
and `info.version`)
## Rationale
This ensures sub-registries implementing the spec are adhering to the
stable v0.1 version rather than the unstable v0. The API freeze (v0.1)
provides stability guarantees that sub-registries need.
## Additional cleanup
### Make `_meta` optional in `ServerResponse`
The `_meta` field (and its `io.modelcontextprotocol.registry/official`
extension) were never intended to be required parts of the spec.
Sub-registries may not use these registry-specific metadata fields, so
they should be optional.
### Move extensions docs to use /v0.1/ instead of /v0/
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude <noreply@anthropic.com>
The DNS auth endpoint was vulnerable to resource exhaustion if an
attacker controlled a domain with a slow/non-responding authoritative
DNS server. Without a timeout, handler goroutines would block on DNS
resolution indefinitely, allowing an attacker to pile up goroutines
until OOM.
Production is protected by NGINX ingress's default 60s proxy timeout,
but this adds defense-in-depth with a tighter 5s bound.
[//]: # (dependabot-start)
⚠️ **Dependabot is rebasing this PR** ⚠️
Rebasing might not happen immediately, so don't worry if this takes some
time.
Note: if you make any changes to this PR yourself, they will take
precedence over the rebase.
---
[//]: # (dependabot-end)
Bumps
[go.opentelemetry.io/otel](https://github.com/open-telemetry/opentelemetry-go)
from 1.38.0 to 1.39.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/open-telemetry/opentelemetry-go/releases">go.opentelemetry.io/otel's
releases</a>.</em></p>
<blockquote>
<h2>v1.39.0</h2>
<h2>Overview</h2>
<h3>Added</h3>
<ul>
<li>Greatly reduce the cost of recording metrics in
<code>go.opentelemetry.io/otel/sdk/metric</code> using hashing for map
keys. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7175">#7175</a>)</li>
<li>Add <code>WithInstrumentationAttributeSet</code> option to
<code>go.opentelemetry.io/otel/log</code>,
<code>go.opentelemetry.io/otel/metric</code>, and
<code>go.opentelemetry.io/otel/trace</code> packages. This provides a
concurrent-safe and performant alternative to
<code>WithInstrumentationAttributes</code> by accepting a
pre-constructed <code>attribute.Set</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7287">#7287</a>)</li>
<li>Add experimental observability for the Prometheus exporter in
<code>go.opentelemetry.io/otel/exporters/prometheus</code>. Check the
<code>go.opentelemetry.io/otel/exporters/prometheus/internal/x</code>
package documentation for more information. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7345">#7345</a>)</li>
<li>Add experimental observability metrics in
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7353">#7353</a>)</li>
<li>Add temporality selector functions
<code>DeltaTemporalitySelector</code>,
<code>CumulativeTemporalitySelector</code>,
<code>LowMemoryTemporalitySelector</code> to
<code>go.opentelemetry.io/otel/sdk/metric</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7434">#7434</a>)</li>
<li>Add experimental observability metrics for simple log processor in
<code>go.opentelemetry.io/otel/sdk/log</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7548">#7548</a>)</li>
<li>Add experimental observability metrics in
<code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7459">#7459</a>)</li>
<li>Add experimental observability metrics in
<code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7486">#7486</a>)</li>
<li>Add experimental observability metrics for simple span processor in
<code>go.opentelemetry.io/otel/sdk/trace</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7374">#7374</a>)</li>
<li>Add experimental observability metrics in
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7512">#7512</a>)</li>
<li>Add experimental observability metrics for manual reader in
<code>go.opentelemetry.io/otel/sdk/metric</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7524">#7524</a>)</li>
<li>Add experimental observability metrics for periodic reader in
<code>go.opentelemetry.io/otel/sdk/metric</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7571">#7571</a>)</li>
<li>Support <code>OTEL_EXPORTER_OTLP_LOGS_INSECURE</code> and
<code>OTEL_EXPORTER_OTLP_INSECURE</code> environmental variables in
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7608">#7608</a>)</li>
<li>Add <code>Enabled</code> method to the <code>Processor</code>
interface in <code>go.opentelemetry.io/otel/sdk/log</code>. All
<code>Processor</code> implementations now include an
<code>Enabled</code> method. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7639">#7639</a>)</li>
<li>The <code>go.opentelemetry.io/otel/semconv/v1.38.0</code> package.
The package contains semantic conventions from the <code>v1.38.0</code>
version of the OpenTelemetry Semantic Conventions. See the <a
href="https://github.com/open-telemetry/opentelemetry-go/blob/HEAD/semconv/v1.38.0/MIGRATION.md">migration
documentation</a> for information on how to upgrade from
<code>go.opentelemetry.io/otel/semconv/v1.37.0.</code>(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7648">#7648</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li><code>Distinct</code> in
<code>go.opentelemetry.io/otel/attribute</code> is no longer guaranteed
to uniquely identify an attribute set. Collisions between
<code>Distinct</code> values for different Sets are possible with
extremely high cardinality (billions of series per instrument), but are
highly unlikely. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7175">#7175</a>)</li>
<li><code>WithInstrumentationAttributes</code> in
<code>go.opentelemetry.io/otel/trace</code> synchronously de-duplicates
the passed attributes instead of delegating it to the returned
<code>TracerOption</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7266">#7266</a>)</li>
<li><code>WithInstrumentationAttributes</code> in
<code>go.opentelemetry.io/otel/meter</code> synchronously de-duplicates
the passed attributes instead of delegating it to the returned
<code>MeterOption</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7266">#7266</a>)</li>
<li><code>WithInstrumentationAttributes</code> in
<code>go.opentelemetry.io/otel/log</code> synchronously de-duplicates
the passed attributes instead of delegating it to the returned
<code>LoggerOption</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7266">#7266</a>)</li>
<li>Rename the <code>OTEL_GO_X_SELF_OBSERVABILITY</code> environment
variable to <code>OTEL_GO_X_OBSERVABILITY</code> in
<code>go.opentelemetry.io/otel/sdk/trace</code>,
<code>go.opentelemetry.io/otel/sdk/log</code>, and
<code>go.opentelemetry.io/otel/exporters/stdout/stdouttrace</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7302">#7302</a>)</li>
<li>Improve performance of histogram <code>Record</code> in
<code>go.opentelemetry.io/otel/sdk/metric</code> when min and max are
disabled using <code>NoMinMax</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7306">#7306</a>)</li>
<li>Improve error handling for dropped data during translation by using
<code>prometheus.NewInvalidMetric</code> in
<code>go.opentelemetry.io/otel/exporters/prometheus</code>. ⚠️
<strong>Breaking Change:</strong> Previously, these cases were only
logged and scrapes succeeded. Now, when translation would drop data
(e.g., invalid label/value), the exporter emits a
<code>NewInvalidMetric</code>, and Prometheus scrapes <strong>fail with
HTTP 500</strong> by default. To preserve the prior behavior (scrapes
succeed while errors are logged), configure your Prometheus HTTP handler
with: <code>promhttp.HandlerOpts{ ErrorHandling:
promhttp.ContinueOnError }</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7363">#7363</a>)</li>
<li>Replace fnv hash with xxhash in
<code>go.opentelemetry.io/otel/attribute</code> for better performance.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7371">#7371</a>)</li>
<li>The default <code>TranslationStrategy</code> in
<code>go.opentelemetry.io/exporters/prometheus</code> is changed from
<code>otlptranslator.NoUTF8EscapingWithSuffixes</code> to
<code>otlptranslator.UnderscoreEscapingWithSuffixes</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7421">#7421</a>)</li>
<li>Improve performance of concurrent measurements in
<code>go.opentelemetry.io/otel/sdk/metric</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7427">#7427</a>)</li>
<li>Include W3C TraceFlags (bits 0–7) in the OTLP
<code>Span.Flags</code> field in
<code>go.opentelemetry.io/exporters/otlp/otlptrace/otlptracehttp</code>
and
<code>go.opentelemetry.io/exporters/otlp/otlptrace/otlptracegrpc</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7438">#7438</a>)</li>
<li>The <code>ErrorType</code> function in
<code>go.opentelemetry.io/otel/semconv/v1.37.0</code> now handles custom
error types.
If an error implements an <code>ErrorType() string</code> method, the
return value of that method will be used as the error type. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7442">#7442</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Fix <code>WithInstrumentationAttributes</code> options in
<code>go.opentelemetry.io/otel/trace</code>,
<code>go.opentelemetry.io/otel/metric</code>, and
<code>go.opentelemetry.io/otel/log</code> to properly merge attributes
when passed multiple times instead of replacing them. Attributes with
duplicate keys will use the last value passed. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7300">#7300</a>)</li>
<li>The equality of <code>attribute.Set</code> when using the
<code>Equal</code> method is not affected by the user overriding the
empty set pointed to by <code>attribute.EmptySet</code> in
<code>go.opentelemetry.io/otel/attribute</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7357">#7357</a>)</li>
<li>Return partial OTLP export errors to the caller in
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7372">#7372</a>)</li>
<li>Return partial OTLP export errors to the caller in
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7372">#7372</a>)</li>
<li>Return partial OTLP export errors to the caller in
<code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7372">#7372</a>)</li>
<li>Return partial OTLP export errors to the caller in
<code>go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7372">#7372</a>)</li>
<li>Return partial OTLP export errors to the caller in
<code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7372">#7372</a>)</li>
<li>Return partial OTLP export errors to the caller in
<code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7372">#7372</a>)</li>
<li>Fix <code>AddAttributes</code>, <code>SetAttributes</code>,
<code>SetBody</code> on <code>Record</code> in
<code>go.opentelemetry.io/otel/sdk/log</code> to not mutate input. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7403">#7403</a>)</li>
<li>Do not double record measurements of <code>RecordSet</code> methods
in <code>go.opentelemetry.io/otel/semconv/v1.37.0</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7655">#7655</a>)</li>
<li>Do not double record measurements of <code>RecordSet</code> methods
in <code>go.opentelemetry.io/otel/semconv/v1.36.0</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7656">#7656</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md">go.opentelemetry.io/otel's
changelog</a>.</em></p>
<blockquote>
<h2>[1.39.0/0.61.0/0.15.0/0.0.14] 2025-12-05</h2>
<h3>Added</h3>
<ul>
<li>Greatly reduce the cost of recording metrics in
<code>go.opentelemetry.io/otel/sdk/metric</code> using hashing for map
keys. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7175">#7175</a>)</li>
<li>Add <code>WithInstrumentationAttributeSet</code> option to
<code>go.opentelemetry.io/otel/log</code>,
<code>go.opentelemetry.io/otel/metric</code>, and
<code>go.opentelemetry.io/otel/trace</code> packages.
This provides a concurrent-safe and performant alternative to
<code>WithInstrumentationAttributes</code> by accepting a
pre-constructed <code>attribute.Set</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7287">#7287</a>)</li>
<li>Add experimental observability for the Prometheus exporter in
<code>go.opentelemetry.io/otel/exporters/prometheus</code>.
Check the
<code>go.opentelemetry.io/otel/exporters/prometheus/internal/x</code>
package documentation for more information. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7345">#7345</a>)</li>
<li>Add experimental observability metrics in
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7353">#7353</a>)</li>
<li>Add temporality selector functions
<code>DeltaTemporalitySelector</code>,
<code>CumulativeTemporalitySelector</code>,
<code>LowMemoryTemporalitySelector</code> to
<code>go.opentelemetry.io/otel/sdk/metric</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7434">#7434</a>)</li>
<li>Add experimental observability metrics for simple log processor in
<code>go.opentelemetry.io/otel/sdk/log</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7548">#7548</a>)</li>
<li>Add experimental observability metrics in
<code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7459">#7459</a>)</li>
<li>Add experimental observability metrics in
<code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7486">#7486</a>)</li>
<li>Add experimental observability metrics for simple span processor in
<code>go.opentelemetry.io/otel/sdk/trace</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7374">#7374</a>)</li>
<li>Add experimental observability metrics in
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7512">#7512</a>)</li>
<li>Add experimental observability metrics for manual reader in
<code>go.opentelemetry.io/otel/sdk/metric</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7524">#7524</a>)</li>
<li>Add experimental observability metrics for periodic reader in
<code>go.opentelemetry.io/otel/sdk/metric</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7571">#7571</a>)</li>
<li>Support <code>OTEL_EXPORTER_OTLP_LOGS_INSECURE</code> and
<code>OTEL_EXPORTER_OTLP_INSECURE</code> environmental variables in
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7608">#7608</a>)</li>
<li>Add <code>Enabled</code> method to the <code>Processor</code>
interface in <code>go.opentelemetry.io/otel/sdk/log</code>.
All <code>Processor</code> implementations now include an
<code>Enabled</code> method. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7639">#7639</a>)</li>
<li>The <code>go.opentelemetry.io/otel/semconv/v1.38.0</code> package.
The package contains semantic conventions from the <code>v1.38.0</code>
version of the OpenTelemetry Semantic Conventions.
See the <a
href="https://github.com/open-telemetry/opentelemetry-go/blob/main/semconv/v1.38.0/MIGRATION.md">migration
documentation</a> for information on how to upgrade from
<code>go.opentelemetry.io/otel/semconv/v1.37.0.</code>(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7648">#7648</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li><code>Distinct</code> in
<code>go.opentelemetry.io/otel/attribute</code> is no longer guaranteed
to uniquely identify an attribute set.
Collisions between <code>Distinct</code> values for different Sets are
possible with extremely high cardinality (billions of series per
instrument), but are highly unlikely. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7175">#7175</a>)</li>
<li><code>WithInstrumentationAttributes</code> in
<code>go.opentelemetry.io/otel/trace</code> synchronously de-duplicates
the passed attributes instead of delegating it to the returned
<code>TracerOption</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7266">#7266</a>)</li>
<li><code>WithInstrumentationAttributes</code> in
<code>go.opentelemetry.io/otel/meter</code> synchronously de-duplicates
the passed attributes instead of delegating it to the returned
<code>MeterOption</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7266">#7266</a>)</li>
<li><code>WithInstrumentationAttributes</code> in
<code>go.opentelemetry.io/otel/log</code> synchronously de-duplicates
the passed attributes instead of delegating it to the returned
<code>LoggerOption</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7266">#7266</a>)</li>
<li>Rename the <code>OTEL_GO_X_SELF_OBSERVABILITY</code> environment
variable to <code>OTEL_GO_X_OBSERVABILITY</code> in
<code>go.opentelemetry.io/otel/sdk/trace</code>,
<code>go.opentelemetry.io/otel/sdk/log</code>, and
<code>go.opentelemetry.io/otel/exporters/stdout/stdouttrace</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7302">#7302</a>)</li>
<li>Improve performance of histogram <code>Record</code> in
<code>go.opentelemetry.io/otel/sdk/metric</code> when min and max are
disabled using <code>NoMinMax</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7306">#7306</a>)</li>
<li>Improve error handling for dropped data during translation by using
<code>prometheus.NewInvalidMetric</code> in
<code>go.opentelemetry.io/otel/exporters/prometheus</code>.
⚠️ <strong>Breaking Change:</strong> Previously, these cases were only
logged and scrapes succeeded.
Now, when translation would drop data (e.g., invalid label/value), the
exporter emits a <code>NewInvalidMetric</code>, and Prometheus scrapes
<strong>fail with HTTP 500</strong> by default.
To preserve the prior behavior (scrapes succeed while errors are
logged), configure your Prometheus HTTP handler with:
<code>promhttp.HandlerOpts{ ErrorHandling: promhttp.ContinueOnError
}</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7363">#7363</a>)</li>
<li>Replace fnv hash with xxhash in
<code>go.opentelemetry.io/otel/attribute</code> for better performance.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7371">#7371</a>)</li>
<li>The default <code>TranslationStrategy</code> in
<code>go.opentelemetry.io/exporters/prometheus</code> is changed from
<code>otlptranslator.NoUTF8EscapingWithSuffixes</code> to
<code>otlptranslator.UnderscoreEscapingWithSuffixes</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7421">#7421</a>)</li>
<li>Improve performance of concurrent measurements in
<code>go.opentelemetry.io/otel/sdk/metric</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7427">#7427</a>)</li>
<li>Include W3C TraceFlags (bits 0–7) in the OTLP
<code>Span.Flags</code> field in
<code>go.opentelemetry.io/exporters/otlp/otlptrace/otlptracehttp</code>
and
<code>go.opentelemetry.io/exporters/otlp/otlptrace/otlptracegrpc</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7438">#7438</a>)</li>
<li>The <code>ErrorType</code> function in
<code>go.opentelemetry.io/otel/semconv/v1.37.0</code> now handles custom
error types.
If an error implements an <code>ErrorType() string</code> method, the
return value of that method will be used as the error type. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7442">#7442</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Fix <code>WithInstrumentationAttributes</code> options in
<code>go.opentelemetry.io/otel/trace</code>,
<code>go.opentelemetry.io/otel/metric</code>, and
<code>go.opentelemetry.io/otel/log</code> to properly merge attributes
when passed multiple times instead of replacing them.
Attributes with duplicate keys will use the last value passed. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7300">#7300</a>)</li>
<li>The equality of <code>attribute.Set</code> when using the
<code>Equal</code> method is not affected by the user overriding the
empty set pointed to by <code>attribute.EmptySet</code> in
<code>go.opentelemetry.io/otel/attribute</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7357">#7357</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="6ce14298b9"><code>6ce1429</code></a>
Release v1.39.0 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7676">#7676</a>)</li>
<li><a
href="12e421a706"><code>12e421a</code></a>
sdk/log: move Enabled method from FilterProcessor to Processor (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7639">#7639</a>)</li>
<li><a
href="5982f16d24"><code>5982f16</code></a>
fix(deps): update module golang.org/x/sys to v0.39.0 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7684">#7684</a>)</li>
<li><a
href="928837830d"><code>9288378</code></a>
chore(deps): update module golang.org/x/sync to v0.19.0 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7683">#7683</a>)</li>
<li><a
href="ee3dfef45d"><code>ee3dfef</code></a>
chore(deps): update github.com/securego/gosec/v2 digest to 41f28e2 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7682">#7682</a>)</li>
<li><a
href="9345d1f64d"><code>9345d1f</code></a>
fix(deps): update module github.com/golangci/golangci-lint/v2 to v2.7.2
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7680">#7680</a>)</li>
<li><a
href="d03b03395d"><code>d03b033</code></a>
Check context prior to delaying retry in OTLP exporters (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7678">#7678</a>)</li>
<li><a
href="61765e78a6"><code>61765e7</code></a>
Fix flaky <code>TestClientInstrumentation</code> (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7677">#7677</a>)</li>
<li><a
href="a54721cc80"><code>a54721c</code></a>
chore(deps): update module github.com/go-git/go-billy/v5 to v5.7.0 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7679">#7679</a>)</li>
<li><a
href="746d0860d7"><code>746d086</code></a>
chore(deps): update github/codeql-action action to v4.31.7 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/7675">#7675</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/open-telemetry/opentelemetry-go/compare/v1.38.0...v1.39.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [golang.org/x/mod](https://github.com/golang/mod) from 0.30.0 to
0.31.0.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="d271cf332f"><code>d271cf3</code></a>
go.mod: update golang.org/x dependencies</li>
<li><a
href="269c237cf3"><code>269c237</code></a>
sumdb/note: delete chop</li>
<li><a
href="3f03020ad5"><code>3f03020</code></a>
x/mod: apply go fix and go vet</li>
<li>See full diff in <a
href="https://github.com/golang/mod/compare/v0.30.0...v0.31.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
<!-- Provide a brief summary of your changes -->
## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
This resolves
https://github.com/modelcontextprotocol/registry/issues/738. There are
two issues with the NuGet.org integration today:
1. Change the `registryBaseUrl` for NuGet to
`https://api.nuget.org/v3/index.json`. `https://api.nuget.org` is not
the entry point for our service and is not specific enough.
`https://api.nuget.org/v3/index.json` is the value that users put into
their tooling to connect to our public registry (it is installed by
default in .NET client tooling).
2. Use the service index API to get the URL pattern for package READMEs.
- This URL is not guaranteed to be stable. The service index URL
(`registryBaseUrl`) is, however.
Additionally, I polished up the error messages so various error modes
are clearer. When packages are published to NuGet.org, they take 2-5
minutes to become available due to validations we run.
Some possible states that are now handled and described more helpfully
are:
- Version exists, but the package has no README
- The ID exists, but the version does not
- The ID does not exist at all
There are only 3 authors (me, another MSFT person, and a community
member) explicitly setting the old value. The DB migration will fix the
issue. A future publish will fail with the validation error but the
error message is clear.
`registry type and base URL do not match: 'https://api.nuget.org' is not
valid for registry type 'nuget'. Expected:
https://api.nuget.org/v3/index.json`
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
- Unit tests, new and existing
- Manual test locally
- Set old data in the DB, `docker compose up`, confirm the migration
updates the specific package
## Breaking Changes
Yes, but minimal impact expected, unless there is a dependency on the
specific `https://api.nuget.org` value downstream. I am not aware of any
such dependency, and the new value is more proper and specific.
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [x] New feature (non-breaking change which adds functionality)
- [x] Breaking change (fix or feature that would cause existing
functionality to change)
- [x] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [x] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [x] My code follows the repository's style guidelines
- [x] New and existing tests pass locally
- [x] I have added appropriate error handling
- [x] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
For more information about the NuGet API see:
https://learn.microsoft.com/en-us/nuget/api/overview#service-index (I
wrote most of the docs).
Update Documentation Index section to reflect the current directory
structure after the docs reorganization in #728. The old links to
./guides/ and ./explanations/ no longer exist.
Fixes#821🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude <noreply@anthropic.com>
Written by Claude Code, reviewed by me.
## Summary
Fixes `@claude` to work on external fork PRs by:
1. Restricting triggers to modelcontextprotocol org members only
2. Properly checking out fork PR code via `refs/pull/N/head`
## Background
The `@claude` GitHub app was failing on external forks
([example](https://github.com/modelcontextprotocol/registry/actions/runs/19938435814/job/57169634431))
because the action tried to fetch branches by name, which doesn't work
for forks.
## Changes
### Org membership check
- Fetches the member list from
[`modelcontextprotocol/access`](https://github.com/modelcontextprotocol/access)
repo's `users.ts`
- Only org members can trigger `@claude` (prevents strangers from using
it)
- Uses `github.triggering_actor` so the person commenting must be an org
member
### Fork PR checkout fix
- Detects when a comment is on a fork PR
- Uses `refs/pull/{number}/head` to checkout fork code (instead of
branch name)
- This works because GitHub exposes all PRs via special refs on the base
repo
## How it works
1. Org member comments `@claude` on a fork PR
2. Workflow checks if commenter is in the `modelcontextprotocol/access`
member list
3. Workflow detects it's a fork PR and checks out via `refs/pull/N/head`
4. Claude runs with access to the fork's code
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude <noreply@anthropic.com>
Drafted by Claude Code, reviewed and tested by me.
Add instructions for maintainers to connect to the production PostgreSQL
database, including Cloud Shell (recommended) and local machine methods,
plus read-only session configuration for safety.
---------
Co-authored-by: Claude <noreply@anthropic.com>
Introduces a standardized way for registries to provide experimental or
community-driven features without committing them to the core API
specification.
## Summary
- Extensions live under `/v0/x/<namespace>/<extension>` URL structure
- Simple conventions: REST, JSON responses, cursor pagination, optional
auth
- Composable design building on core APIs where possible
This enables experimentation with features like search (#389) and MCP
server integration (#24) while keeping the core API minimal and stable.
Fixes#776
<!-- Provide a brief summary of your changes -->
## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
The `--file=PATH` pattern does not work. The path is an optional,
positional argument not a named option.
The `--dry-run` option is not supported.
Look at the implementation:
d092dd6390/cmd/publisher/commands/publish.go (L19)
## How Has This Been Tested?
Try these options yourself, they are ignored.
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [x] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [x] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [x] My code follows the repository's style guidelines
- [x] New and existing tests pass locally
- [x] I have added appropriate error handling
- [x] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
Update all documentation to reference the stable `/v0.1/` API version
instead of the development `/v0/` version.
Didn't update internal references (e.g. in admin-only docs) as that
probably make sense to keep pointed at v0 as the "dev" option.
Authored by Claude Code, reviewed by me.
---------
Co-authored-by: Claude <noreply@anthropic.com>
<!-- Provide a brief summary of your changes -->
This PR aims to fix
https://github.com/modelcontextprotocol/registry/issues/743#event-20985516896
## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
This is needed to ensure we are sanitizing the URL before creating
server.json to be inline with the validations.
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
Tested via UTs and also tested CLI locally to ensure the expected
behavior.
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [x] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
Co-authored-by: Avish Porwal <avishporwal@microsoft.com>
Bumps
[github.com/pulumi/pulumi/sdk/v3](https://github.com/pulumi/pulumi) from
3.208.0 to 3.210.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pulumi/pulumi/releases">github.com/pulumi/pulumi/sdk/v3's
releases</a>.</em></p>
<blockquote>
<h2>v3.210.0</h2>
<h2>3.210.0 (2025-12-03)</h2>
<h3>Features</h3>
<ul>
<li>
<p>[cli/about] Print python toolchain information in <code>pulumi
about</code></p>
</li>
<li>
<p>[sdk/java] Update java to v1.18</p>
</li>
<li>
<p>[components/nodejs] Local components will use the version from
package.json rather than 0.0.0
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21100">#21100</a></p>
</li>
<li>
<p>[cli/package] Add <code>pulumi package delete</code> command to
delete package versions from the Pulumi Registry
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21069">#21069</a></p>
</li>
<li>
<p>[cli/package] Always print the schema first in <code>package
get-schema</code>, then print any binding errors
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21080">#21080</a></p>
</li>
<li>
<p>[sdk/python] Require <code>grpcio>=1.75.1</code> on Python 3.14
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21113">#21113</a></p>
</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>[sdk/nodejs] Fix ComponentResources transfering input arguments to
output properties automatically
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21094">#21094</a></li>
</ul>
<h3>Miscellaneous</h3>
<ul>
<li>[sdk/nodejs] Remove <code>@types/uuid</code> type declarations dev
dependency
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21077">#21077</a></li>
</ul>
<h2>v3.209.0</h2>
<h2>3.209.0 (2025-11-26)</h2>
<h3>Features</h3>
<ul>
<li>
<p>[cli] Add native support for OIDC token exchange when logging into
Pulumi Cloud. Run <code>pulumi login --help</code> for more information.
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20974">#20974</a></p>
</li>
<li>
<p>[sdk/python] Allow older grpcio and protobuf dependencies
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21007">#21007</a></p>
</li>
<li>
<p>[sdkgen/{dotnet,go,nodejs,python}] Generate .gitignore and
.gitattributes files for generated SDKs
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21034">#21034</a></p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pulumi/pulumi/blob/master/CHANGELOG.md">github.com/pulumi/pulumi/sdk/v3's
changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<h2>3.209.0 (2025-11-26)</h2>
<h3>Features</h3>
<ul>
<li>
<p>[cli] Add native support for OIDC token exchange when logging into
Pulumi Cloud. Run <code>pulumi login --help</code> for more information.
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20974">#20974</a></p>
</li>
<li>
<p>[sdk/python] Allow older grpcio and protobuf dependencies
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21007">#21007</a></p>
</li>
<li>
<p>[sdkgen/{dotnet,go,nodejs,python}] Generate .gitignore and
.gitattributes files for generated SDKs
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21034">#21034</a></p>
</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>
<p>[cli/install] Correctly install non-standard plugins. See <a
href="https://redirect.github.com/pulumi/pulumi/issues/20953">pulumi/pulumi#20953</a>
for more information
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20983">#20983</a></p>
</li>
<li>
<p>[cli/new] Create pyproject.toml for uv and poetry projects when using
--generate-only
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20979">#20979</a></p>
</li>
<li>
<p>[sdk/nodejs] Fix serialization errors due to SxS copies of the SDK
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21029">#21029</a></p>
</li>
<li>
<p>[sdk/python] Add <code>PropertyValue</code> runtime validation checks
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21058">#21058</a></p>
</li>
</ul>
<h3>Miscellaneous</h3>
<ul>
<li>
<p>[engine] Don't send root directory and runtime options to language
plugins as command line arguments
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21054">#21054</a></p>
</li>
<li>
<p>[sdk/{dotnet,java,yaml}] Bump language runtimes for yaml, dotnet and
java</p>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="43bb5ff53c"><code>43bb5ff</code></a>
Print python toolchain information in <code>pulumi about</code> (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21122">#21122</a>)</li>
<li><a
href="bbe721d42f"><code>bbe721d</code></a>
Update java to v1.18.0 (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21121">#21121</a>)</li>
<li><a
href="f770d66d60"><code>f770d66</code></a>
journaler: unlock the lock if the journaler is already closed (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21117">#21117</a>)</li>
<li><a
href="9217663c03"><code>9217663</code></a>
Add pulumi package delete command (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21069">#21069</a>)</li>
<li><a
href="749c6722ba"><code>749c672</code></a>
fix: use independent <code>http.Client</code> in pair with
<code>http.Server</code> (<a
href="https://redirect.github.com/pulumi/pulumi/issues/20942">#20942</a>)</li>
<li><a
href="43bd0a8687"><code>43bd0a8</code></a>
enable journaling in testing (<a
href="https://redirect.github.com/pulumi/pulumi/issues/20990">#20990</a>)</li>
<li><a
href="c0c4dfe970"><code>c0c4dfe</code></a>
Replace deprecated is-finite dependency in test (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21108">#21108</a>)</li>
<li><a
href="220cccd368"><code>220cccd</code></a>
Require <code>grpcio>=1.75.1</code> on Python 3.14 (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21113">#21113</a>)</li>
<li><a
href="d6277b37b3"><code>d6277b3</code></a>
[journal] Add comments, support multiple Close() (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21112">#21112</a>)</li>
<li><a
href="df6ef98165"><code>df6ef98</code></a>
Remove construct_component_configure_provider binary (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21110">#21110</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/pulumi/pulumi/compare/v3.208.0...v3.210.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Radoslav Dimitrov <radoslav@stacklok.com>
Prepared by Claude Code, reviewd by me.
## Summary
- Upgrade Go from 1.24.9 to 1.24.11 in the main `go.mod` to fix
govulncheck CI failure
- Upgrade Go from 1.24.7 to 1.24.11 in `deploy/go.mod` for the same
vulnerability fix
## Details
This PR addresses the failing `govulncheck` check in CI caused by
vulnerability **GO-2025-4155**:
- **Vulnerability**: Excessive resource consumption when printing error
string for host certificate validation in `crypto/x509`
- **Found in**: `crypto/x509@go1.24.9` (and earlier versions like
go1.24.7)
- **Fixed in**: `crypto/x509@go1.24.11`
- **More info**: https://pkg.go.dev/vuln/GO-2025-4155
Both Go module files in the repository are updated to 1.24.11 to ensure
consistent vulnerability remediation.
## Test plan
- [x] CI passes govulncheck after the Go version upgrade
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude <noreply@anthropic.com>
The schema in this repo may contain unreleased changes, so labeling it
with a dated version URL is misleading. Change to use a `draft` URL
instead, and add documentation for the schema contribution process.
- Update $id in server.schema.json to use draft URL
- Update example $schema URL in openapi.yaml
- Add Draft (Unreleased) section to CHANGELOG.md
- Add CONTRIBUTING.md with process for making/releasing schema changes
Written by Claude Code, reviewed and tweaked by me.
Co-authored-by: Claude <noreply@anthropic.com>
## What this fixes
The API changelog had a section header dated `2025-11-17`, but the
openapi.yaml version is `2025-10-17`. This was confusing because they
appeared to be tracking the same thing but didn't match.
## What happened
1. Various API changes (v0.1 introduction, endpoint removal) were made
in early-to-mid October
2. On **Oct 17**, commit 0828bc4 bumped the openapi.yaml version to
`2025-10-17`
3. These changes sat under an "Unreleased" section in the changelog
4. On **Nov 17**, commit 7b3f01a converted "Unreleased" → `2025-11-17`
as part of the v1.3.9 release process
The problem: `2025-11-17` was the date the release was cut, not the API
version. Since there were no openapi.yaml changes between Oct 17 and Nov
17, the changelog section should match the API version (`2025-10-17`),
not the internal release date.
## The fix
Change the changelog header from `## 2025-11-17` to `## 2025-10-17` to
align with the openapi.yaml version that consumers actually use.
@domdomegg am I correct in thinking this was just a typo? Or was the
distinction intentional?
Authored by Claude Code, reviewed by me.
Co-authored-by: Claude <noreply@anthropic.com>
dependabot[bot]
Bob Dickinson
Vincent Emonet
Radoslav Dimitrov
adam jones
lif
Benedikt Reinartz
Tadas Antanavicius
Joel Verhagen
Jonathan Hefner
Avish Porwal