<!-- Provide a brief summary of your changes -->
## Motivation and Context
Currently the `dns` and `http` based auth flows share code well in the
publisher tool. However there is a lot of duplication in the auth
endpoint. This on it's own is not a problem but it does make
enhancements to the proof record (the `v=MCPv1; ...` string) harder to
keep in sync.
This PR adds a `common.go` file to share logic between the two.
This supports work I am prototyping for
https://github.com/modelcontextprotocol/registry/issues/482.
## How Has This Been Tested?
Added new test cases for the permissions. Ran them before and after the
refactoring to ensure no behavior change.
Ran existing UTs.
Ran the integration tests.
Manually exercised the flows locally.
## Breaking Changes
None.
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [x] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [x] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [x] My code follows the repository's style guidelines
- [x] New and existing tests pass locally
- [x] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
<!-- Provide a brief summary of your changes -->
## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
The following PR adds more clarity to the docs around what's considered
open source, closed source, public and private in the context of MCP
servers.
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [x] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>
Add three new community projects to the community-projects.md reference:
- mcp-registry-cli: CLI tool for navigating registry servers
- mcp-insights: Analytics and insights platform
- Open Chat MCP Registry Client: TypeScript client implementation
## Summary
- Remove the `status` field from all server.json examples in
documentation
- Remove the deprecated server example that was primarily about
demonstrating the status field
- Update example count validation from 13 to 12
## Context
The `status` field was removed from the server.json schema in commit
b21c6f5 (#562). This PR cleans up the documentation to reflect that
change.
## Why didn't tests catch this?
The schema validation didn't catch the invalid `status` field because
the JSON schema doesn't have `additionalProperties: false` set. This
means the schema allows arbitrary additional properties by default.
## Test plan
- [x] All validation checks pass (`make check`)
- [x] Example count updated to match the new total (12 examples)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude <noreply@anthropic.com>
## Summary
Add Community Resources section to GitHub Actions guide referencing
OtherVibes/mcp-publish-action as requested in discussion #518.
## Changes
- Add "Community Resources" section to
`docs/guides/publishing/github-actions.md`
- Include reference to OtherVibes/mcp-publish-action with appropriate
disclaimers
- Provide example usage and key features
- Position after Tips section for discoverability
- Structure allows for future community tool additions
## Context
This addresses the community request in discussion #518 where
@OtherVibes suggested adding a reference to their reusable GitHub Action
in the publishing docs. The maintainers (@tadasant, @domdomegg) approved
adding a community resources section with appropriate disclaimers.
The implementation follows the original request to add the reference
specifically to the GitHub Actions guide
(`docs/guides/publishing/github-actions.md`) rather than creating a
separate page.
## Benefits
- Provides users with a streamlined, community-built option for MCP
server publishing
- Reduces workflow boilerplate for developers
- Includes clear disclaimers about third-party tools
- Maintains documentation cohesion by keeping everything in the relevant
file
Closes#518
---------
Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>
Co-authored-by: OtherVibes <othervibes@users.noreply.github.com>
Co-authored-by: Radoslav Dimitrov <radoslav@stacklok.com>
<!-- Provide a brief summary of your changes -->
## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
The following PR adds a simple unit test to ensure the served API
handlers are a superset of the reference OpenAPI schema.
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
Fixes: https://github.com/modelcontextprotocol/registry/issues/567
---------
Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>
<!-- Provide a brief summary of your changes -->
## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
The following adds a doc to reference community projects.
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [x] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>
<!-- Provide a brief summary of your changes -->
## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
This seems to be a regresion after rename, those fields were originally
required:
8d7e471fd3/docs/server-registry-api/openapi.yaml (L247-L252)
In
https://static.modelcontextprotocol.io/schemas/2025-09-16/server.schema.json,
those fields are also required.
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
No
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [x] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [x] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
This pull request makes a minor update to the documentation for
installing the MCP Publisher in GitHub Actions workflows. The change
updates the installation command to use version 1.1.0 of the MCP
Publisher instead of version 1.0.0.
## Motivation and Context
The `mcp-publisher` version in GitHub Actions has to be updated so it
can publish the MCP server to the newest version of MCP Registry.
## How Has This Been Tested?
Documentation update only. No test needed.
## Breaking Changes
No
## Types of changes
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [x] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [x] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [x] My code follows the repository's style guidelines
- [x] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [x] I have added or updated documentation as needed
## Additional context
None
## Motivation and Context
The diagram looks horrible when viewed in dark mode. Re-exported with
white background enabled, preserving Excalidraw diagram source embedded.
## How Has This Been Tested?
N/A
## Breaking Changes
N/A
## Types of changes
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [x] Documentation update
## Motivation and Context
Replace server-only `http.MaxBytesReader(nil, ...)` with
`io.LimitReader` to cap the fetched body to 4KB in key fetcher. This
avoids passing a `nil` ResponseWriter and aligns with Go idioms. If more
than 4KB is received, return a clear error. Previously `MaxBytesReader`
returned a misleading `http: request body too large` error, which is
server-oriented. With this change the error becomes `HTTP auth key
response too large`.
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
Add tests covering success, oversized bodies, connection failure,
non-200 status, and read failures. This covers almost all lines of
`FetchKey` method of `DefaultHTTPKeyFetcher`. For tests, I also added a
new initialiser `NewDefaultHTTPKeyFetcherWithClient` so that the HTTP
client could be modified for test use.
Tests use `httptest.NewTLSServer` plus a helper to construct a client
pinned to the test server.
`auth` package test coverage increased from 56.8% to 59.3%.
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
None.
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [x] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [x] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [x] My code follows the repository's style guidelines
- [x] New and existing tests pass locally
- [x] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
Signed-off-by: Ville Vesilehto <ville@vesilehto.fi>
Bumps the actions group with 1 update:
[actions/cache](https://github.com/actions/cache).
Updates `actions/cache` from 4.2.4 to 4.3.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/cache/releases">actions/cache's
releases</a>.</em></p>
<blockquote>
<h2>v4.3.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Add note on runner versions by <a
href="https://github.com/GhadimiR"><code>@GhadimiR</code></a> in <a
href="https://redirect.github.com/actions/cache/pull/1642">actions/cache#1642</a></li>
<li>Prepare <code>v4.3.0</code> release by <a
href="https://github.com/Link"><code>@Link</code></a>- in <a
href="https://redirect.github.com/actions/cache/pull/1655">actions/cache#1655</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/GhadimiR"><code>@GhadimiR</code></a>
made their first contribution in <a
href="https://redirect.github.com/actions/cache/pull/1642">actions/cache#1642</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/cache/compare/v4...v4.3.0">https://github.com/actions/cache/compare/v4...v4.3.0</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/actions/cache/blob/main/RELEASES.md">actions/cache's
changelog</a>.</em></p>
<blockquote>
<h1>Releases</h1>
<h3>4.3.0</h3>
<ul>
<li>Bump <code>@actions/cache</code> to <a
href="https://redirect.github.com/actions/toolkit/pull/2132">v4.1.0</a></li>
</ul>
<h3>4.2.4</h3>
<ul>
<li>Bump <code>@actions/cache</code> to v4.0.5</li>
</ul>
<h3>4.2.3</h3>
<ul>
<li>Bump <code>@actions/cache</code> to v4.0.3 (obfuscates SAS token in
debug logs for cache entries)</li>
</ul>
<h3>4.2.2</h3>
<ul>
<li>Bump <code>@actions/cache</code> to v4.0.2</li>
</ul>
<h3>4.2.1</h3>
<ul>
<li>Bump <code>@actions/cache</code> to v4.0.1</li>
</ul>
<h3>4.2.0</h3>
<p>TLDR; The cache backend service has been rewritten from the ground up
for improved performance and reliability. <a
href="https://github.com/actions/cache">actions/cache</a> now integrates
with the new cache service (v2) APIs.</p>
<p>The new service will gradually roll out as of <strong>February 1st,
2025</strong>. The legacy service will also be sunset on the same date.
Changes in these release are <strong>fully backward
compatible</strong>.</p>
<p><strong>We are deprecating some versions of this action</strong>. We
recommend upgrading to version <code>v4</code> or <code>v3</code> as
soon as possible before <strong>February 1st, 2025.</strong> (Upgrade
instructions below).</p>
<p>If you are using pinned SHAs, please use the SHAs of versions
<code>v4.2.0</code> or <code>v3.4.0</code></p>
<p>If you do not upgrade, all workflow runs using any of the deprecated
<a href="https://github.com/actions/cache">actions/cache</a> will
fail.</p>
<p>Upgrading to the recommended versions will not break your
workflows.</p>
<h3>4.1.2</h3>
<ul>
<li>Add GitHub Enterprise Cloud instances hostname filters to inform API
endpoint choices - <a
href="https://redirect.github.com/actions/cache/pull/1474">#1474</a></li>
<li>Security fix: Bump braces from 3.0.2 to 3.0.3 - <a
href="https://redirect.github.com/actions/cache/pull/1475">#1475</a></li>
</ul>
<h3>4.1.1</h3>
<ul>
<li>Restore original behavior of <code>cache-hit</code> output - <a
href="https://redirect.github.com/actions/cache/pull/1467">#1467</a></li>
</ul>
<h3>4.1.0</h3>
<ul>
<li>Ensure <code>cache-hit</code> output is set when a cache is missed -
<a
href="https://redirect.github.com/actions/cache/pull/1404">#1404</a></li>
<li>Deprecate <code>save-always</code> input - <a
href="https://redirect.github.com/actions/cache/pull/1452">#1452</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="0057852bfa"><code>0057852</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/cache/issues/1655">#1655</a>
from actions/Link-/prepare-4.3.0</li>
<li><a
href="4f5ea67f1c"><code>4f5ea67</code></a>
Update licensed cache</li>
<li><a
href="9fcad95d03"><code>9fcad95</code></a>
Upgrade actions/cache to 4.1.0 and prepare 4.3.0 release</li>
<li><a
href="638ed79f9d"><code>638ed79</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/cache/issues/1642">#1642</a>
from actions/GhadimiR-patch-1</li>
<li><a
href="3862dccb17"><code>3862dcc</code></a>
Add note on runner versions</li>
<li>See full diff in <a
href="0400d5f644...0057852bfa">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
<!-- Provide a brief summary of your changes -->
## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
The following PR updates production to automatically receive new stable
releases when GitHub releases are cut while staging will continue
testing the latest main branch builds
Deails:
- Configures production deployment to **use latest stable** releases
instead of main branch
-`ghcr.io/modelcontextprotocol/registry:latest`(stable releases).
Released CLI matches version of the prod service API.
- Staging continues to **use main branch** for testing latest
development code - `ghcr.io/modelcontextprotocol/registry:main` (latest
development). Building the CLI from main would match the version of the
staging service API.
- Added environment-based Docker image tag selection logic
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
No
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
No
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>
<!-- Provide a brief summary of your changes -->
## Motivation and Context
Update download link of mcp-publisher from 1.0.0 to 1.1.0
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [x] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
## Summary
Fixes a race condition where a server could have no version marked as
`isLatest` if the database operations failed independently.
## Changes
- **CreateServer signature**: Now accepts `oldLatestVersionID` parameter
to atomically unmark previous latest version
- **PostgreSQL implementation**: Uses a transaction to ensure UPDATE
(unmark old latest) and INSERT (create new version) happen atomically
- **Service layer**: Maintains `WithPublishLock` for concurrent
operation serialization
- **Two-level protection**: Advisory lock prevents races, transaction
ensures atomicity
## Test plan
- [x] Existing race condition tests pass
- [x] Integration tests pass
- [x] Unit tests pass
🤖 Generated with [Claude Code](https://claude.ai/code)
---------
Co-authored-by: Claude <noreply@anthropic.com>
<!-- Provide a brief summary of your changes -->
## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
Housekeeping on leftover psql references
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>
<!-- Provide a brief summary of your changes -->
Package identifier and version are required for some of the registries
else we won't be able to pull the meta data to validate the packages.
## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
This is in continuation to
https://github.com/modelcontextprotocol/registry/pull/424
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
Unit test.
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
No
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
Co-authored-by: Avish Porwal <avishporwal@microsoft.com>
<!-- Provide a brief summary of your changes -->
## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
The follow PR removes the in-memory database option from the registry.
We had a chat about this with @domdomegg and although it is supposed to
be convenient, it isn't that useful in reality. We want to test and
develop the registry in a setup that is closer to the environment it is
supposed to be run. One of the main reasons are:
* We don't use it anywhere else besides unit testing and potentially
local development. Instead we should use postgresql for reliable results
(in-memory was actually giving false positive results)
* We have to keep maintaining it and make sure it mimics the behaviour
we have for postgresql which is not yielding a lot of value
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
Yes, I've updated the test unit make target to run in the postgresql
environment and now we can see the race condition issue happening.
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
No
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
---------
Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>
- Add missing required fields (description, transport) to all
server.json examples
- Add $schema field to examples that were missing it
- Add version field to MCPB example
- Create validation tool for guide examples with $schema
- Integrate guide validation into Makefile and CI
Fixes#507🤖 Generated with [Claude Code](https://claude.ai/code)
---------
Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>
Co-authored-by: adam jones <domdomegg@users.noreply.github.com>
Co-authored-by: Claude <noreply@anthropic.com>
## Summary
Fixes a concurrent map access vulnerability in the OIDC handler that
could cause remote unauthenticated DoS.
## Changes
- Removed OIDC authorization flow endpoints ( and )
- Removed the unsynchronized map that caused the data race
- Kept only the OIDC token exchange endpoint ()
- Simplified by removing OAuth2 flow dependencies
The map was being accessed concurrently by the start (write) and
callback (read/delete) endpoints without synchronization, causing
runtime panics. Since the token exchange flow doesn't require session
state, removing the authorization flow eliminates the vulnerability
entirely.
## Summary
Fixes race conditions in concurrent server publishing that could result
in data integrity violations:
- Multiple versions marked as `isLatest=true` for the same server
- Duplicate (serverId, version) combinations
- Same server name assigned different serverIDs
## Solution
Uses two complementary approaches for correctness:
### 1. PostgreSQL Advisory Locks
- Serializes concurrent publishes per server name using
`pg_advisory_xact_lock`
- Uses FNV-1a hash to convert server name to lock ID
- Transaction-scoped locks auto-release on commit/rollback
- **Required after #465**: The serverId introduction means concurrent
publishes must atomically coordinate whether to reuse an existing
serverId (for additional versions) or generate a new one (for first
version). Without locks, race conditions would assign different
serverIDs to versions of the same server.
### 2. Unique Constraints (Migration 007)
Two new indexes provide data integrity guarantees:
- **idx_unique_server_version**: Ensures (serverId, version) is unique
across all versions
- **idx_unique_latest_version**: Partial index ensuring only one version
per serverId has `isLatest=true`
These constraints serve as defense-in-depth safety nets. Even if lock
logic had a bug, the database would reject integrity violations.
Also drops redundant `idx_servers_version_id` since `version_id` is
already the primary key.
## Why WithPublishLock validation is needed after #465
The `ctx.Err()` check at the start of `WithPublishLock` is critical
because:
1. After #465 introduced serverId, the publish flow must atomically
check existing versions and assign/reuse serverId
2. If the context is cancelled during lock acquisition, we could
deadlock
3. Checking ctx validity before acquiring locks prevents these deadlocks
## Testing
Added `TestPublishConcurrentVersionsNoRace` with 100 concurrent
goroutines publishing different versions of the same server. All succeed
with:
- Exactly one version marked as latest
- All versions sharing the same serverId
- No duplicate (serverId, version) combinations
NB: this only covers the in memory db, not the postgres db. It'd be nice
to write tests for this one as well, but our current setup is a bit
annoying for this. Separately looking into ways to easily run all our
tests with real postgres and ideally scrap memory.go completely.
## Motivation and Context
- Make all entries in current database matching the new schema
## How Has This Been Tested?
- locally
## Breaking Changes
- Yes
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [X] Breaking change (fix or feature that would cause existing
functionality to change)
- [X] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [X] My code follows the repository's style guidelines
- [X] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [X] I have added or updated documentation as needed
Before migration:
```
{
"name": "io.github.kenjihikmatullah/productboard-mcp",
"description": "Integrate the Productboard API into agentic workflows via MCP",
"status": "active",
"repository": {
"url": "https://github.com/kenjihikmatullah/productboard-mcp",
"source": "github",
"id": "939104710"
},
"version": "0.0.1-seed",
"packages": [
{
"registry_type": "npm",
"identifier": "productboard-mcp",
"version": "1.0.1",
"transport": {
"type": "stdio"
}
}
],
"_meta": {
"io.modelcontextprotocol.registry/official": {
"id": "00613acb-73e2-4f93-8b96-296df17316c8",
"published_at": "0001-01-01T00:00:00Z",
"updated_at": "0001-01-01T00:00:00Z",
"is_latest": true
}
}
}
```
After migration:
```
{
"name": "io.github.kenjihikmatullah/productboard-mcp",
"description": "Integrate the Productboard API into agentic workflows via MCP",
"status": "active",
"repository": {
"url": "https://github.com/kenjihikmatullah/productboard-mcp",
"source": "github",
"id": "939104710"
},
"version": "0.0.1-seed",
"packages": [
{
"registryType": "npm",
"identifier": "productboard-mcp",
"version": "1.0.1",
"transport": {
"type": "stdio"
},
}
],
"_meta": {
"io.modelcontextprotocol.registry/official": {
"serverId": "83cfe55c-55c5-4e7e-b9c0-6d7d369f52ed",
"versionId": "00613acb-73e2-4f93-8b96-296df17316c8",
"publishedAt": "0001-01-01T00:00:00Z",
"updatedAt": "0001-01-01T00:00:00Z",
"isLatest": true
}
}
}
Wielded Claude Code to do this; across many iterations and have reviewed
all the code + largely rewritten the PR commentary here.
This PR implements the server ID consistency changes from
[#396](https://github.com/modelcontextprotocol/registry/issues/396). Our
goal is to:
- Rename `id` to `versionId` to make it clear that it is the ID for a
specific version, not a server
- Introduce `serverId` as a net new concept. This will be 1:1 with
`name`. While not strictly necessary (we could just use name as a PK),
the convention of having a UUID as an ID on our objects is just a
helpful subjective architecture decision. Plus also leaves open the door
to reconsidering the "should we allow renames" question.
## Key Changes
### 🗄️ Database Schema Changes
- **Renamed**: `id` column → `version_id` (unique identifier for each
server version)
### 📋 Metadata Structure Updates
- **JSON Schema**: Updated
`_meta.io.modelcontextprotocol.registry/official` to include:
- `serverId`: Consistent ID across all versions of a server
- `versionId`: Unique ID for this specific version (renamed from `id`)
### 🔧 API Endpoint Updates
- **New endpoint structure**: Changed from version-ID-based to
server-ID-based URLs:
- `GET /v0/servers/{server_id}` - Get latest version of server
- `GET /v0/servers/{server_id}?version=X.X.X` - Get specific version
- `GET /v0/servers/{server_id}/versions` - List all versions of a server
- `PUT /v0/servers/{server_id}?version=X.X.X` - Edit specific version
- **Consistent URL patterns**: All server endpoints now use `server_id`
as the primary identifier
### Database Migration Strategy
The migration (`005_add_server_id_rename_version_id.sql`):
1. Adds new `version_id` column
2. Generates deterministic UUIDs for servers with the same name
3. Updates JSON metadata to add `serverId` and rename `id` to
`versionId`
4. Copies existing `id` values to `version_id` column
5. Drops old `id` column and makes `version_id` the new primary key
## Testing
Besides of course automated tests passing, I:
1. Set up my local db with the pre-005-migration state, imported all the
production data
2. Ran the migration
3. Spot checked some diffs of the data that resulted --
```json
// before
{
"name": "io.github.ruvnet/ruv-swarm",
"_meta": {
"io.modelcontextprotocol.registry/official": {
"id": "0a9cda7f-2b73-4839-844b-6582f335de42",
"is_latest": false,
"updated_at": "2025-09-10T17:21:34.92137012Z",
"published_at": "2025-09-10T17:15:32.69690433Z"
}
},
"version": "1.0.18",
"repository": {
"url": "",
"source": ""
},
"description": "Neural network swarm orchestration with WebAssembly acceleration and MCP integration"
}
// after
{
"name": "io.github.ruvnet/ruv-swarm",
"_meta": {
"io.modelcontextprotocol.registry/official": {
"serverId": "e8538952-96af-4a33-9e31-7fbed012521e",
"is_latest": false,
"versionId": "0a9cda7f-2b73-4839-844b-6582f335de42",
"updated_at": "2025-09-10T17:21:34.92137012Z",
"published_at": "2025-09-10T17:15:32.69690433Z"
}
},
"version": "1.0.18",
"repository": {
"url": "",
"source": ""
},
"description": "Neural network swarm orchestration with WebAssembly acceleration and MCP integration"
}
```
Servers that have multiple versions stayed consistent in their
`serverId`:
```json
// First version
{
"name": "app.getdialer/dialer",
"_meta": {
"io.modelcontextprotocol.registry/official": {
"serverId": "80f08bdb-f3e4-4f19-b072-1676ae49b663",
"is_latest": false,
"versionId": "04f25b17-331d-48d7-b08b-37baece208a7",
"updated_at": "2025-09-09T00:16:49.162620072Z",
"published_at": "2025-09-08T23:47:09.452137971Z"
}
},
"status": "active",
"$schema": "https://static.modelcontextprotocol.io/schemas/2025-07-09/server.schema.json",
"remotes": [
{
"url": "https://getdialer.app/mcp",
"type": "streamable-http"
},
{
"url": "https://getdialer.app/sse",
"type": "sse"
}
],
"version": "1.0.0",
"repository": {
"url": "",
"source": ""
},
"description": "An MCP server that provides your you make outbound phone calls using your own phone number"
}
// Second version
{
"name": "app.getdialer/dialer",
"_meta": {
"io.modelcontextprotocol.registry/official": {
"serverId": "80f08bdb-f3e4-4f19-b072-1676ae49b663",
"is_latest": true,
"versionId": "faa26cb9-3aad-415e-aece-f715fff5fe5e",
"updated_at": "2025-09-09T00:16:49.107842808Z",
"published_at": "2025-09-09T00:16:49.107842808Z"
}
},
"status": "active",
"$schema": "https://static.modelcontextprotocol.io/schemas/2025-07-09/server.schema.json",
"remotes": [
{
"url": "https://getdialer.app/mcp",
"type": "streamable-http"
},
{
"url": "https://getdialer.app/sse",
"type": "sse"
}
],
"version": "1.0.1",
"repository": {
"url": "",
"source": ""
},
"description": "An MCP server that provides lets you make outbound phone calls using your own phone number"
}
```
And I also tried publishing a test server anew; looked good:
```bash
⏺ Bash(curl -s "http://localhost:8080/v0/servers/102dc4e4-6ca8-40e6-aa11-cd45763d3352" | jq '.')
⎿ {
"$schema": "https://static.modelcontextprotocol.io/schemas/2025-07-09/server.schema.json",
"name": "io.modelcontextprotocol.anonymous/test-claude-migration-server",
"description": "A test server to verify the new migration and API endpoints work correctly",
"status": "active",
"repository": {
"url": "https://github.com/example/test-claude-migration-server",
"source": "github",
"id": "example/test-claude-migration-server"
},
"version": "1.0.0",
"_meta": {
"io.modelcontextprotocol.registry/official": {
"serverId": "102dc4e4-6ca8-40e6-aa11-cd45763d3352",
"versionId": "48c9cd55-7bc4-4ac2-896e-59e81eb653e4",
"published_at": "2025-09-12T18:33:23.264203-07:00",
"updated_at": "2025-09-12T18:33:23.264203-07:00",
"is_latest": true
}
}
}
⏺ Bash(curl -s "http://localhost:8080/v0/servers/102dc4e4-6ca8-40e6-aa11-cd45763d3352/versions" | jq '.')
⎿ {
"servers": [
{
"$schema": "https://static.modelcontextprotocol.io/schemas/2025-07-09/server.schema.json",
"name": "io.modelcontextprotocol.anonymous/test-claude-migration-server",
"description": "A test server to verify the new migration and API endpoints work correctly",
"status": "active",
"repository": {
"url": "https://github.com/example/test-claude-migration-server",
"source": "github",
"id": "example/test-claude-migration-server"
},
"version": "1.0.0",
"_meta": {
"io.modelcontextprotocol.registry/official": {
"serverId": "102dc4e4-6ca8-40e6-aa11-cd45763d3352",
"versionId": "48c9cd55-7bc4-4ac2-896e-59e81eb653e4",
"published_at": "2025-09-12T18:33:23.264203-07:00",
"updated_at": "2025-09-12T18:33:23.264203-07:00",
"is_latest": true
}
}
}
],
"metadata": {
"count": 1
}
}
```
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Preeti Dewani <preetidewani1990@gmail.com>
Co-authored-by: adam jones <adamj+git@anthropic.com>
Co-authored-by: Adam Jones <adamj@anthropic.com>
## Summary
- Fixed `Remote` schema in OpenAPI spec to use correct field name `type`
instead of `transport_type`
- Updated enum values from `[streamable, sse]` to `[streamable-http,
sse]` to match actual API
## Context
The OpenAPI spec was inconsistent with the actual API implementation.
The live API at https://registry.modelcontextprotocol.io/v0/servers
returns `type: 'sse'` and `type: 'streamable-http'`, but the spec
defined `transport_type` with values `streamable` and `sse`.
This now matches:
- The Go constants in pkg/model/constants.go
- The actual API responses
## Summary
Bumps the node machine type from e2-small to e2-standard-2 to provide
more CPU and memory headroom for the cluster.
Also disables PodDisruptionBudgets (PDBs) for single-instance PostgreSQL
clusters to prevent node upgrade operations from becoming blocked.
## Changes
- Increase GKE node machine type from e2-small to e2-standard-2
- Set `enablePDB: false` for registry and Grafana PostgreSQL clusters
## Context
The machine type increase addresses resource constraints causing
deployment failures.
The PDB change prevents a specific issue where GKE node upgrades get
stuck when trying to drain nodes containing single-instance PostgreSQL
pods. With `minAvailable: 1` PDBs, evicting the only database instance
violates the availability requirement, blocking the drain operation
indefinitely. Disabling PDBs for these development/staging
single-instance databases allows node maintenance to proceed smoothly.
For production deployments requiring high availability, the instances
count should be increased to 3 with PDBs enabled.
---------
Co-authored-by: Claude <noreply@anthropic.com>
<!-- Provide a brief summary of your changes -->
## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
The following resolves warnings raised by CodeQL by setting the
appropriate permissions for each workflow.
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
---------
Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>
## Motivation and Context
Logs will help in fixing issues quickly, thereby reducing the downtime
and MTTD.
## How Has This Been Tested?
End to end local setup is tested
## Breaking Changes
No
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [x] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [x] My code follows the repository's style guidelines
- [x] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
- It handles container logs for mcp-registry pods.
- It supports k8sattributes resources which helps in identifying from
where the logs are coming.
- Supports victorialogs and it's plugin in grafana.
<img width="1129" height="383" alt="Screenshot 2025-09-15 at 1 43 51 AM"
src="https://github.com/user-attachments/assets/a560c541-721d-415c-a0a8-8cbe008c3af6"
/>
<img width="1134" height="703" alt="Screenshot 2025-09-15 at 1 44 34 AM"
src="https://github.com/user-attachments/assets/8b5b4132-9fc3-4b8e-8027-27c7787070f1"
/>
<img width="1134" height="727" alt="Screenshot 2025-09-15 at 1 46 10 AM"
src="https://github.com/user-attachments/assets/bcdb4d9d-cea1-4d88-8dd5-fa4cdb51031f"
/>
---------
Co-authored-by: Radoslav Dimitrov <radoslav@stacklok.com>
This commit implements support for publishing MCP servers to GitHub
Container
Registry (ghcr.io) in addition to the existing Docker Hub support,
addressing
Docker Hub rate limiting concerns as requested in #393.
Key changes:
- Add RegistryURLGHCR constant for https://ghcr.io
- Refactor OCI validation to support multiple container registries with
extensible RegistryConfig system
- Implement registry-agnostic authentication system that handles:
- Docker Hub token-based authentication via auth.docker.io
- GHCR token-based authentication via ghcr.io/token service
- Update Accept headers to support OCI image indexes for multi-arch
images
- Extract helper functions to reduce cyclomatic complexity and improve
code maintainability
- Add comprehensive test coverage for both Docker Hub and GHCR scenarios
- Include real image testing with github/github-mcp-server and
nkapila6/mcp-local-rag
- Update publishing documentation with GHCR examples and authentication
details
The implementation maintains backward compatibility with existing Docker
Hub
usage while providing a future-proof architecture for adding additional
container registries. All authentication is now handled through proper
token
services for both registries.
Fixes#393
## Motivation and Context
Docker Hub rate limiting has been causing issues for the MCP registry
when validating OCI images. Adding GHCR support provides an alternative
container registry that many MCP server authors are already using,
reducing the load on Docker Hub and providing more options for the
community.
## How Has This Been Tested?
- All existing unit tests continue to pass
- Added comprehensive test coverage for GHCR scenarios including:
- Non-existent images (proper error handling)
- Real images without MCP annotations (github/github-mcp-server)
- Real images with proper MCP annotations (nkapila6/mcp-local-rag)
- Registry URL validation for both supported registries
- Tested authentication flow manually using curl commands
- Verified multi-arch image support with OCI index manifests
## Breaking Changes
None. This is a purely additive change that maintains full backward
compatibility with existing Docker Hub configurations.
## Types of changes
- [x] New feature (non-breaking change which adds functionality)
- [x] Documentation update
## Checklist
- [x] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [x] My code follows the repository's style guidelines
- [x] New and existing tests pass locally
- [x] I have added appropriate error handling
- [x] I have added or updated documentation as needed
## Additional context
The implementation uses a RegistryConfig struct to abstract
registry-specific details like API endpoints, authentication URLs, and
token services. This design makes it straightforward to add support for
additional container registries in the future (such as AWS ECR, Azure
Container Registry, etc.) by simply adding new cases to the
getRegistryConfig function.
The authentication system properly handles the different token services
used by each registry:
- Docker Hub: auth.docker.io with service=registry.docker.io
- GHCR: ghcr.io/token with service=ghcr.io
Both registries now support the full OCI specification including
multi-arch images via OCI image indexes.
<!-- Provide a brief summary of your changes -->
## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
NuGet package deployment option is mentioned in the
[guidelines](https://github.com/modelcontextprotocol/registry/blob/main/docs/guides/publishing/publish-server.md#configure-deployment-methods)
for publishing MCP Server to the registry, but `NuGet` is not mentioned
in the top of the page.
<img width="617" height="134" alt="image (3)"
src="https://github.com/user-attachments/assets/e64559f4-5ab5-44f3-922b-82dda1e781db"
/>
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
Documentation update
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
No breaking changes
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [x] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [x] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
Bumps the actions group with 1 update:
[anchore/sbom-action](https://github.com/anchore/sbom-action).
Updates `anchore/sbom-action` from 0.20.5 to 0.20.6
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/anchore/sbom-action/releases">anchore/sbom-action's
releases</a>.</em></p>
<blockquote>
<h2>v0.20.6</h2>
<h2>Changes in v0.20.6</h2>
<ul>
<li>chore(deps): update Syft to v1.33.0 (<a
href="https://redirect.github.com/anchore/sbom-action/issues/537">#537</a>)
[[<a
href="https://github.com/apps/anchore-actions-token-generator">anchore-actions-token-generator[bot]</a>](<a
href="https://github.com/%5Banchore-actions-token-generator%5Bbot%5D%5D(https://github.com/apps/anchore-actions-token-generator))%5D">https://github.com/[anchore-actions-token-generator[bot]](https://github.com/apps/anchore-actions-token-generator))]</a></li>
<li>chore: update actions library to resolve critical vulnerability (<a
href="https://redirect.github.com/anchore/sbom-action/issues/536">#536</a>)
[<a href="https://github.com/spiffcs">spiffcs</a>]</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="f8bdd1d8ac"><code>f8bdd1d</code></a>
chore(deps): update Syft to v1.33.0 (<a
href="https://redirect.github.com/anchore/sbom-action/issues/537">#537</a>)</li>
<li><a
href="c2c9a6de90"><code>c2c9a6d</code></a>
chore: update actions library to resolve critical sec (<a
href="https://redirect.github.com/anchore/sbom-action/issues/536">#536</a>)</li>
<li><a
href="039eeb235f"><code>039eeb2</code></a>
chore(deps): update Syft to v1.32.0 (<a
href="https://redirect.github.com/anchore/sbom-action/issues/533">#533</a>)</li>
<li>See full diff in <a
href="https://github.com/anchore/sbom-action/compare/v0.20.5...v0.20.6">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
## Summary
Added validation to reject server names with multiple slashes, ensuring
consistency between JSON schema pattern and API validation.
- Count slashes in parseServerName() and reject if > 1
- Add ErrMultipleSlashesInServerName error constant
- Add unit tests in validators_test.go
- Add integration test in publish_test.go
## Motivation and Context
Fixes#471. The JSON schema regex pattern `^[^/]+/[^/]+$` only allows a
single slash in server names, but the API validation was not enforcing
this constraint. This inconsistency
allowed invalid server names like `com.example/server/path` to be
published.
## How Has This Been Tested?
- Unit tests added to verify slash validation logic
- Integration tests added to verify the publish endpoint rejects
multi-slash names
- Tested various edge cases: trailing slashes, consecutive slashes,
URL-like paths
- All existing tests pass
## Breaking Changes
None. This change only adds validation to reject previously invalid
server names that shouldn't have been accepted.
## Types of changes
- [x] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
- [x] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [x] My code follows the repository's style guidelines
- [x] New and existing tests pass locally
- [x] I have added appropriate error handling
- [x] I have added or updated documentation as needed
## Additional context
- The fix ensures server names follow the intended format:
`namespace/name` (e.g., `com.example/my-server`)
- This validation aligns the API behavior with the existing JSON schema
regex pattern
- Test coverage includes edge cases like `com.example//server`,
`com.example/server/`, and `a/b/c/d/e/f`
- The error message clearly indicates the issue: "server name cannot
contain multiple slashes"
Bumps the actions group with 1 update:
[sigstore/cosign-installer](https://github.com/sigstore/cosign-installer).
Updates `sigstore/cosign-installer` from 3.9.2 to 3.10.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/sigstore/cosign-installer/releases">sigstore/cosign-installer's
releases</a>.</em></p>
<blockquote>
<h2>v3.10.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Bump default Cosign to v2.6.0 in <a
href="https://redirect.github.com/sigstore/cosign-installer/pull/200">sigstore/cosign-installer#200</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/sigstore/cosign-installer/compare/v3.9.2...v3.10.0">https://github.com/sigstore/cosign-installer/compare/v3.9.2...v3.10.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="d7543c93d8"><code>d7543c9</code></a>
Bump default Cosign to v2.6.0 (<a
href="https://redirect.github.com/sigstore/cosign-installer/issues/200">#200</a>)</li>
<li><a
href="920f20f8c1"><code>920f20f</code></a>
Bump actions/setup-go from 5.5.0 to 6.0.0 (<a
href="https://redirect.github.com/sigstore/cosign-installer/issues/199">#199</a>)</li>
<li><a
href="bb9dfc10d2"><code>bb9dfc1</code></a>
Bump actions/github-script from 7.0.1 to 8.0.0 (<a
href="https://redirect.github.com/sigstore/cosign-installer/issues/198">#198</a>)</li>
<li><a
href="074636bf86"><code>074636b</code></a>
Bump actions/checkout from 4.2.2 to 5.0.0 (<a
href="https://redirect.github.com/sigstore/cosign-installer/issues/197">#197</a>)</li>
<li>See full diff in <a
href="d58896d6a1...d7543c93d8">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [golang.org/x/oauth2](https://github.com/golang/oauth2) from
0.30.0 to 0.31.0.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="014cf778b4"><code>014cf77</code></a>
all: upgrade go directive to at least 1.24.0 [generated]</li>
<li><a
href="3c76ce5d23"><code>3c76ce5</code></a>
endpoints: correct Naver OAuth2 endpoint URLs</li>
<li>See full diff in <a
href="https://github.com/golang/oauth2/compare/v0.30.0...v0.31.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps
[github.com/prometheus/client_golang](https://github.com/prometheus/client_golang)
from 1.23.0 to 1.23.2.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/prometheus/client_golang/releases">github.com/prometheus/client_golang's
releases</a>.</em></p>
<blockquote>
<h2>v1.23.2 - 2025-09-05</h2>
<p>This release is made to upgrade to prometheus/common v0.66.1, which
drops the dependencies github.com/grafana/regexp and go.uber.org/atomic
and replaces gopkg.in/yaml.v2 with go.yaml.in/yaml/v2 (a drop-in
replacement). There are no functional changes.</p>
<!-- raw HTML omitted -->
<ul>
<li>[release-1.23] Upgrade to prometheus/common@v0.66.1 by <a
href="https://github.com/aknuds1"><code>@aknuds1</code></a> in <a
href="https://redirect.github.com/prometheus/client_golang/pull/1869">prometheus/client_golang#1869</a></li>
<li>[release-1.23] Cut v1.23.2 by <a
href="https://github.com/aknuds1"><code>@aknuds1</code></a> in <a
href="https://redirect.github.com/prometheus/client_golang/pull/1870">prometheus/client_golang#1870</a></li>
</ul>
<!-- raw HTML omitted -->
<p><strong>Full Changelog</strong>: <a
href="https://github.com/prometheus/client_golang/compare/v1.23.1...v1.23.2">https://github.com/prometheus/client_golang/compare/v1.23.1...v1.23.2</a></p>
<h2>v1.23.1 - 2025-09-04</h2>
<p>This release is made to be compatible with a backwards incompatible
API change in prometheus/common v0.66.0. There are no functional
changes.</p>
<!-- raw HTML omitted -->
<ul>
<li>[release-1.23] Upgrade to prometheus/common v0.66 by <a
href="https://github.com/aknuds1"><code>@aknuds1</code></a> in <a
href="https://redirect.github.com/prometheus/client_golang/pull/1866">prometheus/client_golang#1866</a></li>
<li>[release-1.23] Cut v1.23.1 by <a
href="https://github.com/aknuds1"><code>@aknuds1</code></a> in <a
href="https://redirect.github.com/prometheus/client_golang/pull/1867">prometheus/client_golang#1867</a></li>
</ul>
<!-- raw HTML omitted -->
<p><strong>Full Changelog</strong>: <a
href="https://github.com/prometheus/client_golang/compare/v1.23.0...v1.23.1">https://github.com/prometheus/client_golang/compare/v1.23.0...v1.23.1</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/prometheus/client_golang/blob/main/CHANGELOG.md">github.com/prometheus/client_golang's
changelog</a>.</em></p>
<blockquote>
<h2>1.23.2 / 2025-09-05</h2>
<p>This release is made to upgrade to prometheus/common v0.66.1, which
drops the dependencies github.com/grafana/regexp and go.uber.org/atomic
and replaces gopkg.in/yaml.v2 with go.yaml.in/yaml/v2 (a drop-in
replacement).
There are no functional changes.</p>
<h2>1.23.1 / 2025-09-04</h2>
<p>This release is made to be compatible with a backwards incompatible
API change
in prometheus/common v0.66.0. There are no functional changes.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="8179a56081"><code>8179a56</code></a>
Cut v1.23.2 (<a
href="https://redirect.github.com/prometheus/client_golang/issues/1870">#1870</a>)</li>
<li><a
href="4142b5908b"><code>4142b59</code></a>
Merge pull request <a
href="https://redirect.github.com/prometheus/client_golang/issues/1869">#1869</a>
from prometheus/arve/upgrade-common</li>
<li><a
href="4ff40f0d91"><code>4ff40f0</code></a>
Cut v1.23.1 (<a
href="https://redirect.github.com/prometheus/client_golang/issues/1867">#1867</a>)</li>
<li><a
href="989b029894"><code>989b029</code></a>
Upgrade to prometheus/common v0.66 (<a
href="https://redirect.github.com/prometheus/client_golang/issues/1866">#1866</a>)</li>
<li>See full diff in <a
href="https://github.com/prometheus/client_golang/compare/v1.23.0...v1.23.2">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
## Summary
- Removes version comment tags (e.g. `#v4`, `#v5`) from all GitHub
Actions workflow files
- These tags become incorrect when Dependabot updates the action SHAs
- The SHA pins are sufficient for version control
## Context
This addresses @domdomegg's comment in #453 about these tags becoming
outdated when using Dependabot. The SHAs already provide version
pinning, making the comment tags redundant and potentially misleading.
## Changes
- Removed version tags from all `uses:` statements in
`.github/workflows/*.yml`
- No functional changes to workflows
<!-- Provide a brief summary of your changes -->
## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
The following PR:
* Bumps Go to the latest stable version
* Moves away from setting the Go version as an env var in favour of
reading it automatically from the go.mod file (better consistency)
Closes: #447
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
Locally
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
No
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
---------
Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>
<!-- Provide a brief summary of your changes -->
## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
The following PR updates the publishing docs with information about
remote MCP servers.
Motivated by
https://github.com/modelcontextprotocol/registry/discussions/438
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
No
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [x] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
---------
Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>
Simplifies the GitHub Actions publishing guide to be more concise and
easier to follow:
## Changes
- Streamlined MCP publisher installation with single-line curl command
(no more chmod/directory operations)
- Condensed authentication methods into compact sections
- Reduced language-specific examples to essential steps only
- Updated GitHub Actions to use latest versions (v5)
- Made test/build steps optional with `--if-present` flag
- Added helpful AI assistant prompt tip to publish-server.md
## Result
The guide is now much more succinct while maintaining all essential
information, following the same simplified approach as the main
publishing guide.
Bumps
[go.opentelemetry.io/contrib/instrumentation/runtime](https://github.com/open-telemetry/opentelemetry-go-contrib)
from 0.62.0 to 0.63.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/open-telemetry/opentelemetry-go-contrib/releases">go.opentelemetry.io/contrib/instrumentation/runtime's
releases</a>.</em></p>
<blockquote>
<h2>Release
v1.38.0/v2.0.0/v0.63.0/v0.32.0/v0.18.0/v0.13.0/v0.11.0/v0.10.0</h2>
<h2>Overview</h2>
<p>This release is the last to support [Go 1.23]. The next release will
require at least [Go 1.24].</p>
<h3>Added</h3>
<ul>
<li>Add v2 version of AWS EC2 detector
<code>go.opentelemetry.io/contrib/detectors/aws/ec2/v2</code> due to
deprecation of <code>github.com/aws/aws-sdk-go</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/6961">#6961</a>)</li>
<li>Add the unit <code>ns</code> to deprecated runtime metrics
<code>process.runtime.go.gc.pause_total_ns</code> and
<code>process.runtime.go.gc.pause_ns</code> in
<code>go.opentelemetry.io/contrib/instrumentation/runtime</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7490">#7490</a>)</li>
<li>The <code>go.opentelemetry.io/contrib/detectors/autodetect</code>
package is added to automatically compose user defined
<code>resource.Detector</code>s at runtime. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7522">#7522</a>)</li>
<li>Add the <code>WithLoggerProviderOptions</code>,
<code>WithMeterProviderOptions</code> and
<code>WithTracerProviderOptions</code> options to <code>NewSDK</code> to
allow passing custom options to providers in
<code>go.opentelemetry.io/contrib/otelconf</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7552">#7552</a>)</li>
<li>Set <code>SeverityText</code> field to logrus hook in
<code>go.opentelemetry.io/contrib/bridges/otellogrus</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7553">#7553</a>)</li>
<li>Add the <code>WithTraceAttributeFn</code> option to
<code>go.opentelemetry.io/contrib/instrumentation/github.com/aws/aws-lambda-go/otellambda</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7556">#7556</a>)</li>
<li>Add support for HTTP server metrics in
<code>go.opentelemetry.io/contrib/instrumentation/github.com/labstack/echo/otelecho</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7668">#7668</a>)</li>
<li>Support testing of [Go 1.25]. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7732">#7732</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Change the default span name to be <code>GET /path</code> so it
complies with the HTTP semantic conventions in
<code>go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7551">#7551</a>)</li>
<li>Transform attribute values of
<code>go.opentelemetry.io/otel/attribute.Value</code> and
<code>go.opentelemetry.io/otel/log.Value</code> types to appropriate
<code>go.opentelemetry.io/otel/log.Value</code> type instead of
<code>log.StringValue</code> in the modules below. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7660">#7660</a>)
<ul>
<li><code>go.opentelemetry.io/contrib/bridges/otellogr</code></li>
<li><code>go.opentelemetry.io/contrib/bridges/otellogrus</code></li>
<li><code>go.opentelemetry.io/contrib/bridges/otelslog</code></li>
<li><code>go.opentelemetry.io/contrib/bridges/otelzap</code></li>
</ul>
</li>
<li>The <code>Severity</code> type from
<code>go.opentelemetry.io/contrib/processors/minsev</code> now
implements the <code>fmt.Stringer</code>,
<code>encoding.TextMarshaler</code>,
<code>encoding.TextUnmarshaler</code>,
<code>encoding.TextAppender</code>, <code>json.Marshaler</code>, and
<code>json.Unmarshaler</code> interfaces. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7652">#7652</a>)</li>
<li>The <code>SeverityVar</code> type from
<code>go.opentelemetry.io/contrib/processors/minsev</code> now
implements the <code>fmt.Stringer</code>,
<code>encoding.TextMarshaler</code>,
<code>encoding.TextUnmarshaler</code>, and
<code>encoding.TextAppender</code> interfaces. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7652">#7652</a>)</li>
<li>Change the faas.max_memory unit to be bytes instead of MB to comply
with the semantic conventions in
<code>go.opentelemetry.io/contrib/detectors/aws/lambda</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7745">#7745</a>)</li>
<li><code>Severity.Severity()</code> in
<code>go.opentelemetry.io/contrib/processors/minsev</code> now returns
<code>log.SeverityTrace1</code> for severities less than
<code>minsev.SeverityTrace1</code> and <code>log.SeverityFatal4</code>
for severities greater than <code>minsev.SeverityFatal4</code> instead
of <code>log.SeverityUndefined</code>. All other conversions are the
same. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7748">#7748</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Improve the ECS detector correctness in
<code>go.opentelemetry.io/contrib/detectors/aws/ecs</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7607">#7607</a>)</li>
</ul>
<h3>Deprecated</h3>
<ul>
<li><code>WithSpanOptions</code> in
<code>go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc</code>
is deprecated. It is only used by the deprecated interceptor, and is
unused by <code>NewClientHandler</code> and
<code>NewServerHandler</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7601">#7601</a>)</li>
<li><code>Extract</code> and <code>Inject</code> in
<code>go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc</code>
are deprecated. These functions were initially exposed in the public
API, but are now considered unnecessary. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7689">#7689</a>)</li>
<li>The <code>go.opentelemetry.io/contrib/detectors/aws/ec2</code>
package is deprecated, use
<code>go.opentelemetry.io/contrib/detectors/aws/ec2/v2</code> instead.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7725">#7725</a>)</li>
</ul>
<h3>Removed</h3>
<ul>
<li>Remove support for the <code>OTEL_SEMCONV_STABILITY_OPT_IN</code>
environment variable as well as support for semantic conventions v1.20.0
in the modules below. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7584">#7584</a>)
<ul>
<li><code>go.opentelemetry.io/contrib/instrumentation/github.com/emicklei/go-restful/otelrestful</code></li>
<li><code>go.opentelemetry.io/contrib/instrumentation/github.com/gin-gonic/gin/otelgin</code></li>
<li><code>go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux</code></li>
<li><code>go.opentelemetry.io/contrib/instrumentation/github.com/labstack/echo/otelecho</code></li>
<li><code>go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace</code></li>
<li><code>go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp</code></li>
</ul>
</li>
<li>The deprecated <code>StreamClientInterceptor</code> function from
<code>go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc</code>
is removed. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7646">#7646</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/open-telemetry/opentelemetry-go-contrib/blob/main/CHANGELOG.md">go.opentelemetry.io/contrib/instrumentation/runtime's
changelog</a>.</em></p>
<blockquote>
<h2>[1.38.0/2.0.0/0.63.0/0.32.0/0.18.0/0.13.0/0.11.0/0.10.0] -
2025-08-29</h2>
<p>This release is the last to support [Go 1.23].
The next release will require at least [Go 1.24].</p>
<h3>Added</h3>
<ul>
<li>Add v2 version of AWS EC2 detector
<code>go.opentelemetry.io/contrib/detectors/aws/ec2/v2</code> due to
deprecation of <code>github.com/aws/aws-sdk-go</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/6961">#6961</a>)</li>
<li>Add the unit <code>ns</code> to deprecated runtime metrics
<code>process.runtime.go.gc.pause_total_ns</code> and
<code>process.runtime.go.gc.pause_ns</code> in
<code>go.opentelemetry.io/contrib/instrumentation/runtime</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7490">#7490</a>)</li>
<li>The <code>go.opentelemetry.io/contrib/detectors/autodetect</code>
package is added to automatically compose user defined
<code>resource.Detector</code>s at runtime. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7522">#7522</a>)</li>
<li>Add the <code>WithLoggerProviderOptions</code>,
<code>WithMeterProviderOptions</code> and
<code>WithTracerProviderOptions</code> options to <code>NewSDK</code> to
allow passing custom options to providers in
<code>go.opentelemetry.io/contrib/otelconf</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7552">#7552</a>)</li>
<li>Set <code>SeverityText</code> field to logrus hook in
<code>go.opentelemetry.io/contrib/bridges/otellogrus</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7553">#7553</a>)</li>
<li>Add the <code>WithTraceAttributeFn</code> option to
<code>go.opentelemetry.io/contrib/instrumentation/github.com/aws/aws-lambda-go/otellambda</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7556">#7556</a>)</li>
<li>Add support for HTTP server metrics in
<code>go.opentelemetry.io/contrib/instrumentation/github.com/labstack/echo/otelecho</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7668">#7668</a>)</li>
<li>Support testing of [Go 1.25]. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7732">#7732</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Change the default span name to be <code>GET /path</code> so it
complies with the HTTP semantic conventions in
<code>go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7551">#7551</a>)</li>
<li>Transform attribute values of
<code>go.opentelemetry.io/otel/attribute.Value</code> and
<code>go.opentelemetry.io/otel/log.Value</code> types to appropriate
<code>go.opentelemetry.io/otel/log.Value</code> type instead of
<code>log.StringValue</code> in the modules below. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7660">#7660</a>)
<ul>
<li><code>go.opentelemetry.io/contrib/bridges/otellogr</code></li>
<li><code>go.opentelemetry.io/contrib/bridges/otellogrus</code></li>
<li><code>go.opentelemetry.io/contrib/bridges/otelslog</code></li>
<li><code>go.opentelemetry.io/contrib/bridges/otelzap</code></li>
</ul>
</li>
<li>The <code>Severity</code> type from
<code>go.opentelemetry.io/contrib/processors/minsev</code> now
implements the <code>fmt.Stringer</code>,
<code>encoding.TextMarshaler</code>,
<code>encoding.TextUnmarshaler</code>,
<code>encoding.TextAppender</code>, <code>json.Marshaler</code>, and
<code>json.Unmarshaler</code> interfaces. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7652">#7652</a>)</li>
<li>The <code>SeverityVar</code> type from
<code>go.opentelemetry.io/contrib/processors/minsev</code> now
implements the <code>fmt.Stringer</code>,
<code>encoding.TextMarshaler</code>,
<code>encoding.TextUnmarshaler</code>, and
<code>encoding.TextAppender</code> interfaces. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7652">#7652</a>)</li>
<li>Change the faas.max_memory unit to be bytes instead of MB to comply
with the semantic conventions in
<code>go.opentelemetry.io/contrib/detectors/aws/lambda</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7745">#7745</a>)</li>
<li><code>Severity.Severity()</code> in
<code>go.opentelemetry.io/contrib/processors/minsev</code> now returns
<code>log.SeverityTrace1</code> for severities less than
<code>minsev.SeverityTrace1</code> and <code>log.SeverityFatal4</code>
for severities greater than <code>minsev.SeverityFatal4</code> instead
of <code>log.SeverityUndefined</code>.
All other conversions are the same. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7748">#7748</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Improve the ECS detector correctness in
<code>go.opentelemetry.io/contrib/detectors/aws/ecs</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7607">#7607</a>)</li>
</ul>
<h3>Deprecated</h3>
<ul>
<li><code>WithSpanOptions</code> in
<code>go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc</code>
is deprecated.
It is only used by the deprecated interceptor, and is unused by
<code>NewClientHandler</code> and <code>NewServerHandler</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7601">#7601</a>)</li>
<li><code>Extract</code> and <code>Inject</code> in
<code>go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc</code>
are deprecated.
These functions were initially exposed in the public API, but are now
considered unnecessary. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7689">#7689</a>)</li>
<li>The <code>go.opentelemetry.io/contrib/detectors/aws/ec2</code>
package is deprecated, use
<code>go.opentelemetry.io/contrib/detectors/aws/ec2/v2</code> instead.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7725">#7725</a>)</li>
</ul>
<h3>Removed</h3>
<ul>
<li>Remove support for the <code>OTEL_SEMCONV_STABILITY_OPT_IN</code>
environment variable as well as support for semantic conventions v1.20.0
in the modules below. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7584">#7584</a>)
<ul>
<li><code>go.opentelemetry.io/contrib/instrumentation/github.com/emicklei/go-restful/otelrestful</code></li>
<li><code>go.opentelemetry.io/contrib/instrumentation/github.com/gin-gonic/gin/otelgin</code></li>
<li><code>go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux</code></li>
<li><code>go.opentelemetry.io/contrib/instrumentation/github.com/labstack/echo/otelecho</code></li>
<li><code>go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace</code></li>
</ul>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="80c9316336"><code>80c9316</code></a>
Release v1.38.0 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7827">#7827</a>)</li>
<li><a
href="e84e5f0d33"><code>e84e5f0</code></a>
fix(deps): update aws-sdk-go-v2 monorepo (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7825">#7825</a>)</li>
<li><a
href="621dff0c68"><code>621dff0</code></a>
Upgrade to go.opentelemetry.io/otel dependencies (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7808">#7808</a>)</li>
<li><a
href="00d0862286"><code>00d0862</code></a>
chore(deps): update module go.opentelemetry.io/build-tools to v0.27.0
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7822">#7822</a>)</li>
<li><a
href="63dd859ea7"><code>63dd859</code></a>
chore(deps): update module github.com/gordonklaus/ineffassign to v0.2.0
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7820">#7820</a>)</li>
<li><a
href="45f7b9d732"><code>45f7b9d</code></a>
chore(deps): update module github.com/mgechev/revive to v1.12.0 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7821">#7821</a>)</li>
<li><a
href="cb554a651f"><code>cb554a6</code></a>
fix(deps): update module github.com/stretchr/testify to v1.11.1 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7817">#7817</a>)</li>
<li><a
href="fcb2c96de6"><code>fcb2c96</code></a>
fix(deps): update aws-sdk-go-v2 monorepo (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7815">#7815</a>)</li>
<li><a
href="7ac87bd923"><code>7ac87bd</code></a>
fix(deps): update aws-sdk-go-v2 monorepo (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7812">#7812</a>)</li>
<li><a
href="38fe9803bf"><code>38fe980</code></a>
chore(deps): update github.com/lufia/plan9stats digest to 24949be (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7809">#7809</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/open-telemetry/opentelemetry-go-contrib/compare/zpages/v0.62.0...zpages/v0.63.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Radoslav Dimitrov <radoslav@stacklok.com>
Bumps [github.com/jackc/pgx/v5](https://github.com/jackc/pgx) from 5.7.5
to 5.7.6.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/jackc/pgx/blob/master/CHANGELOG.md">github.com/jackc/pgx/v5's
changelog</a>.</em></p>
<blockquote>
<h1>5.7.6 (September 8, 2025)</h1>
<ul>
<li>Use ParseConfigError in pgx.ParseConfig and pgxpool.ParseConfig
(Yurasov Ilia)</li>
<li>Add PrepareConn hook to pgxpool (Jonathan Hall)</li>
<li>Reduce allocations in QueryContext (Dominique Lefevre)</li>
<li>Add MarshalJSON and UnmarshalJSON for pgtype.Uint32 (Panos
Koutsovasilis)</li>
<li>Configure ping behavior on pgxpool with ShouldPing (Christian
Kiely)</li>
<li>zeronull int types implement Int64Valuer and Int64Scanner (Li
Zeghong)</li>
<li>Fix panic when receiving terminate connection message during
CopyFrom (Michal Drausowski)</li>
<li>Fix statement cache not being invalidated on error during batch
(Muhammadali Nazarov)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="a2fca03743"><code>a2fca03</code></a>
Release v5.7.6</li>
<li><a
href="95fc31294f"><code>95fc312</code></a>
Add link to github.com/KoNekoD/pgx-colon-query-rewriter</li>
<li><a
href="5534fa9a02"><code>5534fa9</code></a>
Improve Rows docs</li>
<li><a
href="a295d68811"><code>a295d68</code></a>
Merge pull request <a
href="https://redirect.github.com/jackc/pgx/issues/2368">#2368</a> from
zeghong/zeronull-int-valuer</li>
<li><a
href="03f32c06bd"><code>03f32c0</code></a>
Merge branch 'master' into zeronull-int-valuer</li>
<li><a
href="82fbe49fec"><code>82fbe49</code></a>
Merge pull request <a
href="https://redirect.github.com/jackc/pgx/issues/2372">#2372</a> from
WGH-/improve-batch-doc</li>
<li><a
href="594d9d65dc"><code>594d9d6</code></a>
Merge pull request <a
href="https://redirect.github.com/jackc/pgx/issues/2367">#2367</a> from
zeghong/zeronull-int-scanner</li>
<li><a
href="5a18241971"><code>5a18241</code></a>
Merge branch 'master' into zeronull-int-scanner</li>
<li><a
href="cc34da5884"><code>cc34da5</code></a>
Merge pull request <a
href="https://redirect.github.com/jackc/pgx/issues/2370">#2370</a> from
Saurabh2402/improvement/setup-linters</li>
<li><a
href="dd81f81e2f"><code>dd81f81</code></a>
Merge pull request <a
href="https://redirect.github.com/jackc/pgx/issues/2369">#2369</a> from
zeghong/go-doc-links</li>
<li>Additional commits viewable in <a
href="https://github.com/jackc/pgx/compare/v5.7.5...v5.7.6">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [golang.org/x/mod](https://github.com/golang/mod) from 0.27.0 to
0.28.0.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="1759e969da"><code>1759e96</code></a>
go.mod: update golang.org/x dependencies</li>
<li><a
href="f060e16ef6"><code>f060e16</code></a>
all: upgrade go directive to at least 1.24.0 [generated]</li>
<li>See full diff in <a
href="https://github.com/golang/mod/compare/v0.27.0...v0.28.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
<!-- Provide a brief summary of your changes -->
## Motivation and Context
Previously running `docker-compose up` the first time, Docker would pull
the official Docker Hub registry container, instead of building the MCP
registry locally. This PR ensures the registry image is never pulled,
and that it has a descriptive name locally without clashing with
existing local container images.
The `make dev-compose` command already enforces container build. This
change only helps those who interface with the `docker-compose`
configuration through other means.
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
To validate the issue, clone the repository locally. Ensure none of the
images referenced by `docker-compose` exist locally:
```bash
docker rm -f registry postgres
docker rmi registry postgres:16-alpine
```
Run `docker-compose up` without the `--build` flag. Notice that both
`registry` and `postgres` images are pulled from Docker Hub. Registry
prints the following start up logs - showing it's _a_ registry but of
the wrong kind :)
```
registry | time="2025-09-11T11:16:23.966357009Z" level=debug msg="using \"text\" logging formatter"
registry | time="2025-09-11T11:16:23.967075675Z" level=warning msg="No HTTP secret provided - generated random secret. This may cause problems with uploads if multiple registries are behind a load-balancer. To provide a shared secret, fill in http.secret in the configuration file or set the REGISTRY_HTTP_SECRET environment variable." environment=development go.version=go1.23.7 instance.id=566edec9-5208-4bd9-ab38-9e97d3f3b5b5 service=registry version=3.0.0
registry | time="2025-09-11T11:16:23.9671568Z" level=info msg="redis not configured" environment=development go.version=go1.23.7 instance.id=566edec9-5208-4bd9-ab38-9e97d3f3b5b5 service=registry version=3.0.0
registry | time="2025-09-11T11:16:23.967193342Z" level=info msg="Starting upload purge in 31m0s" environment=development go.version=go1.23.7 instance.id=566edec9-5208-4bd9-ab38-9e97d3f3b5b5 service=registry version=3.0.0
registry | time="2025-09-11T11:16:23.967215509Z" level=info msg="using inmemory blob descriptor cache" environment=development go.version=go1.23.7 instance.id=566edec9-5208-4bd9-ab38-9e97d3f3b5b5 service=registry version=3.0.0
registry | time="2025-09-11T11:16:23.967348634Z" level=info msg="providing prometheus metrics on /metrics"
registry | time="2025-09-11T11:16:23.968138634Z" level=info msg="debug server listening :5001"
registry | time="2025-09-11T11:16:23.9681758Z" level=info msg="listening on [::]:5000" environment=development go.version=go1.23.7 instance.id=566edec9-5208-4bd9-ab38-9e97d3f3b5b5 service=registry version=3.0.0
```
Checkout the proposed change. When `docker-compose up` is ran it builds
the registry container and launches it.
```
$ docker-compose up
[+] Running 0/0
[+] Running 0/1stry Building 0.1s
[+] Building 8.7s (18/18) FINISHED docker:desktop-linux
...
registry | 2025/09/11 11:20:12 Starting MCP Registry Application vdev (commit: unknown)
...
```
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
None.
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [x] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [x] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [x] My code follows the repository's style guidelines
- [x] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
Signed-off-by: Ville Vesilehto <ville@vesilehto.fi>
Co-authored-by: Radoslav Dimitrov <radoslav@stacklok.com>
1. Pins the Github Action workflow hashes under `.github/workflows` to
full-length commit SHAs.
2. Adds a base level `.github/dependabot.yml` config to keep these (and
other go/Docker) deps up to date.
## Motivation and Context
- Github's [security
guide](https://docs.github.com/en/actions/reference/security/secure-use#using-third-party-actions)
recommends using the immutable SHA of an action when consuming third
party actions.
- Depdendabot makes ongoing dep house keeping manageable.
## Summary
- Move package version 'remarks' to 'description' field in JSON schema
(remarks is not a standard JSON schema field)
- Confirmed non-semver version test coverage already exists
Addresses followup comments from #435.
Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>
Co-authored-by: adam jones <domdomegg@users.noreply.github.com>
Joel Verhagen
Radoslav Dimitrov
adam jones
Tadas Antanavicius
OtherVibes
Jun Han
yuna0x0
Ian Mckay
Ville Vesilehto
dependabot[bot]
Avish Porwal
Preeti Dewani
Gaurav Gosain
Kartheek Penagamuri
Ossama Lafhel
Frenchie