<!-- Provide a brief summary of your changes -->
## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
The following PR addresses the feedback from #634 around:
* Use a proper library - https://github.com/distribution/reference,
instead of the implementing the OCI parsing ourselves (note: left the
tests so we can ensure we are not breaking any existing behavior)
* Updating one of the error messages to now assume MCPB.
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>
Bumps [golang.org/x/mod](https://github.com/golang/mod) from 0.28.0 to
0.29.0.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="bba3e065a6"><code>bba3e06</code></a>
go.mod: update golang.org/x dependencies</li>
<li>See full diff in <a
href="https://github.com/golang/mod/compare/v0.28.0...v0.29.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [github.com/coreos/go-oidc/v3](https://github.com/coreos/go-oidc)
from 3.15.0 to 3.16.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/coreos/go-oidc/releases">github.com/coreos/go-oidc/v3's
releases</a>.</em></p>
<blockquote>
<h2>v3.16.0</h2>
<h2>What's Changed</h2>
<ul>
<li>refactor: Remove unused time injection from RemoteKeySet by <a
href="https://github.com/ponimas"><code>@ponimas</code></a> in <a
href="https://redirect.github.com/coreos/go-oidc/pull/466">coreos/go-oidc#466</a></li>
<li>bump go to 1.24, remove 1.23 support, bump go-jose dependency,
remove x/net dependency by <a
href="https://github.com/wardviaene"><code>@wardviaene</code></a> in <a
href="https://redirect.github.com/coreos/go-oidc/pull/467">coreos/go-oidc#467</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/wardviaene"><code>@wardviaene</code></a> made
their first contribution in <a
href="https://redirect.github.com/coreos/go-oidc/pull/467">coreos/go-oidc#467</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/coreos/go-oidc/compare/v3.15.0...v3.16.0">https://github.com/coreos/go-oidc/compare/v3.15.0...v3.16.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="e9584733f8"><code>e958473</code></a>
bump go to 1.24, remove 1.23 support, bump go-jose dependency, remove
x/net d...</li>
<li><a
href="69b167061f"><code>69b1670</code></a>
refactor: Remove unused time injection from RemoteKeySet</li>
<li>See full diff in <a
href="https://github.com/coreos/go-oidc/compare/v3.15.0...v3.16.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
## Summary
This PR adds two important improvements to ensure data integrity:
1. **Adds server name format validation at the API layer** to match the
database constraint from migration 008
2. **Includes migration 008 to clean up invalid data** before applying
strict constraints in migration 009
## Changes
### Server Name Validation
- Enforces validation at the API layer matching the database constraint
- **Namespace pattern**: `[a-zA-Z0-9][a-zA-Z0-9.-]*[a-zA-Z0-9]`
- Must start and end with alphanumeric characters
- Can contain dots and hyphens in the middle
- **Name pattern**: `[a-zA-Z0-9][a-zA-Z0-9._-]*[a-zA-Z0-9]`
- Must start and end with alphanumeric characters
- Can contain dots, underscores, and hyphens in the middle
- Provides clear, user-friendly error messages indicating which part is
invalid
- Uses DRY approach with composed regex patterns
### Migration 008: Data Cleanup
- Removes servers with invalid names or empty versions (5 servers
affected in production)
- Fixes invalid status values by setting them to 'active' (1 server
affected)
- Removes duplicate name+version combinations
- Includes comprehensive safety checks to prevent accidental data loss
- Must run before migration 009 which adds strict constraints
## Testing
- All validator tests pass
- Migration includes safety checks that match production data
- CI verification included
---------
Co-authored-by: Claude <noreply@anthropic.com>
Bumps [golang.org/x/oauth2](https://github.com/golang/oauth2) from
0.30.0 to 0.31.0.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="014cf778b4"><code>014cf77</code></a>
all: upgrade go directive to at least 1.24.0 [generated]</li>
<li><a
href="3c76ce5d23"><code>3c76ce5</code></a>
endpoints: correct Naver OAuth2 endpoint URLs</li>
<li>See full diff in <a
href="https://github.com/golang/oauth2/compare/v0.30.0...v0.31.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps
[github.com/prometheus/client_golang](https://github.com/prometheus/client_golang)
from 1.23.0 to 1.23.2.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/prometheus/client_golang/releases">github.com/prometheus/client_golang's
releases</a>.</em></p>
<blockquote>
<h2>v1.23.2 - 2025-09-05</h2>
<p>This release is made to upgrade to prometheus/common v0.66.1, which
drops the dependencies github.com/grafana/regexp and go.uber.org/atomic
and replaces gopkg.in/yaml.v2 with go.yaml.in/yaml/v2 (a drop-in
replacement). There are no functional changes.</p>
<!-- raw HTML omitted -->
<ul>
<li>[release-1.23] Upgrade to prometheus/common@v0.66.1 by <a
href="https://github.com/aknuds1"><code>@aknuds1</code></a> in <a
href="https://redirect.github.com/prometheus/client_golang/pull/1869">prometheus/client_golang#1869</a></li>
<li>[release-1.23] Cut v1.23.2 by <a
href="https://github.com/aknuds1"><code>@aknuds1</code></a> in <a
href="https://redirect.github.com/prometheus/client_golang/pull/1870">prometheus/client_golang#1870</a></li>
</ul>
<!-- raw HTML omitted -->
<p><strong>Full Changelog</strong>: <a
href="https://github.com/prometheus/client_golang/compare/v1.23.1...v1.23.2">https://github.com/prometheus/client_golang/compare/v1.23.1...v1.23.2</a></p>
<h2>v1.23.1 - 2025-09-04</h2>
<p>This release is made to be compatible with a backwards incompatible
API change in prometheus/common v0.66.0. There are no functional
changes.</p>
<!-- raw HTML omitted -->
<ul>
<li>[release-1.23] Upgrade to prometheus/common v0.66 by <a
href="https://github.com/aknuds1"><code>@aknuds1</code></a> in <a
href="https://redirect.github.com/prometheus/client_golang/pull/1866">prometheus/client_golang#1866</a></li>
<li>[release-1.23] Cut v1.23.1 by <a
href="https://github.com/aknuds1"><code>@aknuds1</code></a> in <a
href="https://redirect.github.com/prometheus/client_golang/pull/1867">prometheus/client_golang#1867</a></li>
</ul>
<!-- raw HTML omitted -->
<p><strong>Full Changelog</strong>: <a
href="https://github.com/prometheus/client_golang/compare/v1.23.0...v1.23.1">https://github.com/prometheus/client_golang/compare/v1.23.0...v1.23.1</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/prometheus/client_golang/blob/main/CHANGELOG.md">github.com/prometheus/client_golang's
changelog</a>.</em></p>
<blockquote>
<h2>1.23.2 / 2025-09-05</h2>
<p>This release is made to upgrade to prometheus/common v0.66.1, which
drops the dependencies github.com/grafana/regexp and go.uber.org/atomic
and replaces gopkg.in/yaml.v2 with go.yaml.in/yaml/v2 (a drop-in
replacement).
There are no functional changes.</p>
<h2>1.23.1 / 2025-09-04</h2>
<p>This release is made to be compatible with a backwards incompatible
API change
in prometheus/common v0.66.0. There are no functional changes.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="8179a56081"><code>8179a56</code></a>
Cut v1.23.2 (<a
href="https://redirect.github.com/prometheus/client_golang/issues/1870">#1870</a>)</li>
<li><a
href="4142b5908b"><code>4142b59</code></a>
Merge pull request <a
href="https://redirect.github.com/prometheus/client_golang/issues/1869">#1869</a>
from prometheus/arve/upgrade-common</li>
<li><a
href="4ff40f0d91"><code>4ff40f0</code></a>
Cut v1.23.1 (<a
href="https://redirect.github.com/prometheus/client_golang/issues/1867">#1867</a>)</li>
<li><a
href="989b029894"><code>989b029</code></a>
Upgrade to prometheus/common v0.66 (<a
href="https://redirect.github.com/prometheus/client_golang/issues/1866">#1866</a>)</li>
<li>See full diff in <a
href="https://github.com/prometheus/client_golang/compare/v1.23.0...v1.23.2">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps
[go.opentelemetry.io/contrib/instrumentation/runtime](https://github.com/open-telemetry/opentelemetry-go-contrib)
from 0.62.0 to 0.63.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/open-telemetry/opentelemetry-go-contrib/releases">go.opentelemetry.io/contrib/instrumentation/runtime's
releases</a>.</em></p>
<blockquote>
<h2>Release
v1.38.0/v2.0.0/v0.63.0/v0.32.0/v0.18.0/v0.13.0/v0.11.0/v0.10.0</h2>
<h2>Overview</h2>
<p>This release is the last to support [Go 1.23]. The next release will
require at least [Go 1.24].</p>
<h3>Added</h3>
<ul>
<li>Add v2 version of AWS EC2 detector
<code>go.opentelemetry.io/contrib/detectors/aws/ec2/v2</code> due to
deprecation of <code>github.com/aws/aws-sdk-go</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/6961">#6961</a>)</li>
<li>Add the unit <code>ns</code> to deprecated runtime metrics
<code>process.runtime.go.gc.pause_total_ns</code> and
<code>process.runtime.go.gc.pause_ns</code> in
<code>go.opentelemetry.io/contrib/instrumentation/runtime</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7490">#7490</a>)</li>
<li>The <code>go.opentelemetry.io/contrib/detectors/autodetect</code>
package is added to automatically compose user defined
<code>resource.Detector</code>s at runtime. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7522">#7522</a>)</li>
<li>Add the <code>WithLoggerProviderOptions</code>,
<code>WithMeterProviderOptions</code> and
<code>WithTracerProviderOptions</code> options to <code>NewSDK</code> to
allow passing custom options to providers in
<code>go.opentelemetry.io/contrib/otelconf</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7552">#7552</a>)</li>
<li>Set <code>SeverityText</code> field to logrus hook in
<code>go.opentelemetry.io/contrib/bridges/otellogrus</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7553">#7553</a>)</li>
<li>Add the <code>WithTraceAttributeFn</code> option to
<code>go.opentelemetry.io/contrib/instrumentation/github.com/aws/aws-lambda-go/otellambda</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7556">#7556</a>)</li>
<li>Add support for HTTP server metrics in
<code>go.opentelemetry.io/contrib/instrumentation/github.com/labstack/echo/otelecho</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7668">#7668</a>)</li>
<li>Support testing of [Go 1.25]. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7732">#7732</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Change the default span name to be <code>GET /path</code> so it
complies with the HTTP semantic conventions in
<code>go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7551">#7551</a>)</li>
<li>Transform attribute values of
<code>go.opentelemetry.io/otel/attribute.Value</code> and
<code>go.opentelemetry.io/otel/log.Value</code> types to appropriate
<code>go.opentelemetry.io/otel/log.Value</code> type instead of
<code>log.StringValue</code> in the modules below. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7660">#7660</a>)
<ul>
<li><code>go.opentelemetry.io/contrib/bridges/otellogr</code></li>
<li><code>go.opentelemetry.io/contrib/bridges/otellogrus</code></li>
<li><code>go.opentelemetry.io/contrib/bridges/otelslog</code></li>
<li><code>go.opentelemetry.io/contrib/bridges/otelzap</code></li>
</ul>
</li>
<li>The <code>Severity</code> type from
<code>go.opentelemetry.io/contrib/processors/minsev</code> now
implements the <code>fmt.Stringer</code>,
<code>encoding.TextMarshaler</code>,
<code>encoding.TextUnmarshaler</code>,
<code>encoding.TextAppender</code>, <code>json.Marshaler</code>, and
<code>json.Unmarshaler</code> interfaces. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7652">#7652</a>)</li>
<li>The <code>SeverityVar</code> type from
<code>go.opentelemetry.io/contrib/processors/minsev</code> now
implements the <code>fmt.Stringer</code>,
<code>encoding.TextMarshaler</code>,
<code>encoding.TextUnmarshaler</code>, and
<code>encoding.TextAppender</code> interfaces. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7652">#7652</a>)</li>
<li>Change the faas.max_memory unit to be bytes instead of MB to comply
with the semantic conventions in
<code>go.opentelemetry.io/contrib/detectors/aws/lambda</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7745">#7745</a>)</li>
<li><code>Severity.Severity()</code> in
<code>go.opentelemetry.io/contrib/processors/minsev</code> now returns
<code>log.SeverityTrace1</code> for severities less than
<code>minsev.SeverityTrace1</code> and <code>log.SeverityFatal4</code>
for severities greater than <code>minsev.SeverityFatal4</code> instead
of <code>log.SeverityUndefined</code>. All other conversions are the
same. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7748">#7748</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Improve the ECS detector correctness in
<code>go.opentelemetry.io/contrib/detectors/aws/ecs</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7607">#7607</a>)</li>
</ul>
<h3>Deprecated</h3>
<ul>
<li><code>WithSpanOptions</code> in
<code>go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc</code>
is deprecated. It is only used by the deprecated interceptor, and is
unused by <code>NewClientHandler</code> and
<code>NewServerHandler</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7601">#7601</a>)</li>
<li><code>Extract</code> and <code>Inject</code> in
<code>go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc</code>
are deprecated. These functions were initially exposed in the public
API, but are now considered unnecessary. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7689">#7689</a>)</li>
<li>The <code>go.opentelemetry.io/contrib/detectors/aws/ec2</code>
package is deprecated, use
<code>go.opentelemetry.io/contrib/detectors/aws/ec2/v2</code> instead.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7725">#7725</a>)</li>
</ul>
<h3>Removed</h3>
<ul>
<li>Remove support for the <code>OTEL_SEMCONV_STABILITY_OPT_IN</code>
environment variable as well as support for semantic conventions v1.20.0
in the modules below. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7584">#7584</a>)
<ul>
<li><code>go.opentelemetry.io/contrib/instrumentation/github.com/emicklei/go-restful/otelrestful</code></li>
<li><code>go.opentelemetry.io/contrib/instrumentation/github.com/gin-gonic/gin/otelgin</code></li>
<li><code>go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux</code></li>
<li><code>go.opentelemetry.io/contrib/instrumentation/github.com/labstack/echo/otelecho</code></li>
<li><code>go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace</code></li>
<li><code>go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp</code></li>
</ul>
</li>
<li>The deprecated <code>StreamClientInterceptor</code> function from
<code>go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc</code>
is removed. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7646">#7646</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/open-telemetry/opentelemetry-go-contrib/blob/main/CHANGELOG.md">go.opentelemetry.io/contrib/instrumentation/runtime's
changelog</a>.</em></p>
<blockquote>
<h2>[1.38.0/2.0.0/0.63.0/0.32.0/0.18.0/0.13.0/0.11.0/0.10.0] -
2025-08-29</h2>
<p>This release is the last to support [Go 1.23].
The next release will require at least [Go 1.24].</p>
<h3>Added</h3>
<ul>
<li>Add v2 version of AWS EC2 detector
<code>go.opentelemetry.io/contrib/detectors/aws/ec2/v2</code> due to
deprecation of <code>github.com/aws/aws-sdk-go</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/6961">#6961</a>)</li>
<li>Add the unit <code>ns</code> to deprecated runtime metrics
<code>process.runtime.go.gc.pause_total_ns</code> and
<code>process.runtime.go.gc.pause_ns</code> in
<code>go.opentelemetry.io/contrib/instrumentation/runtime</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7490">#7490</a>)</li>
<li>The <code>go.opentelemetry.io/contrib/detectors/autodetect</code>
package is added to automatically compose user defined
<code>resource.Detector</code>s at runtime. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7522">#7522</a>)</li>
<li>Add the <code>WithLoggerProviderOptions</code>,
<code>WithMeterProviderOptions</code> and
<code>WithTracerProviderOptions</code> options to <code>NewSDK</code> to
allow passing custom options to providers in
<code>go.opentelemetry.io/contrib/otelconf</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7552">#7552</a>)</li>
<li>Set <code>SeverityText</code> field to logrus hook in
<code>go.opentelemetry.io/contrib/bridges/otellogrus</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7553">#7553</a>)</li>
<li>Add the <code>WithTraceAttributeFn</code> option to
<code>go.opentelemetry.io/contrib/instrumentation/github.com/aws/aws-lambda-go/otellambda</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7556">#7556</a>)</li>
<li>Add support for HTTP server metrics in
<code>go.opentelemetry.io/contrib/instrumentation/github.com/labstack/echo/otelecho</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7668">#7668</a>)</li>
<li>Support testing of [Go 1.25]. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7732">#7732</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Change the default span name to be <code>GET /path</code> so it
complies with the HTTP semantic conventions in
<code>go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux</code>.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7551">#7551</a>)</li>
<li>Transform attribute values of
<code>go.opentelemetry.io/otel/attribute.Value</code> and
<code>go.opentelemetry.io/otel/log.Value</code> types to appropriate
<code>go.opentelemetry.io/otel/log.Value</code> type instead of
<code>log.StringValue</code> in the modules below. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7660">#7660</a>)
<ul>
<li><code>go.opentelemetry.io/contrib/bridges/otellogr</code></li>
<li><code>go.opentelemetry.io/contrib/bridges/otellogrus</code></li>
<li><code>go.opentelemetry.io/contrib/bridges/otelslog</code></li>
<li><code>go.opentelemetry.io/contrib/bridges/otelzap</code></li>
</ul>
</li>
<li>The <code>Severity</code> type from
<code>go.opentelemetry.io/contrib/processors/minsev</code> now
implements the <code>fmt.Stringer</code>,
<code>encoding.TextMarshaler</code>,
<code>encoding.TextUnmarshaler</code>,
<code>encoding.TextAppender</code>, <code>json.Marshaler</code>, and
<code>json.Unmarshaler</code> interfaces. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7652">#7652</a>)</li>
<li>The <code>SeverityVar</code> type from
<code>go.opentelemetry.io/contrib/processors/minsev</code> now
implements the <code>fmt.Stringer</code>,
<code>encoding.TextMarshaler</code>,
<code>encoding.TextUnmarshaler</code>, and
<code>encoding.TextAppender</code> interfaces. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7652">#7652</a>)</li>
<li>Change the faas.max_memory unit to be bytes instead of MB to comply
with the semantic conventions in
<code>go.opentelemetry.io/contrib/detectors/aws/lambda</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7745">#7745</a>)</li>
<li><code>Severity.Severity()</code> in
<code>go.opentelemetry.io/contrib/processors/minsev</code> now returns
<code>log.SeverityTrace1</code> for severities less than
<code>minsev.SeverityTrace1</code> and <code>log.SeverityFatal4</code>
for severities greater than <code>minsev.SeverityFatal4</code> instead
of <code>log.SeverityUndefined</code>.
All other conversions are the same. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7748">#7748</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Improve the ECS detector correctness in
<code>go.opentelemetry.io/contrib/detectors/aws/ecs</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7607">#7607</a>)</li>
</ul>
<h3>Deprecated</h3>
<ul>
<li><code>WithSpanOptions</code> in
<code>go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc</code>
is deprecated.
It is only used by the deprecated interceptor, and is unused by
<code>NewClientHandler</code> and <code>NewServerHandler</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7601">#7601</a>)</li>
<li><code>Extract</code> and <code>Inject</code> in
<code>go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc</code>
are deprecated.
These functions were initially exposed in the public API, but are now
considered unnecessary. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7689">#7689</a>)</li>
<li>The <code>go.opentelemetry.io/contrib/detectors/aws/ec2</code>
package is deprecated, use
<code>go.opentelemetry.io/contrib/detectors/aws/ec2/v2</code> instead.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7725">#7725</a>)</li>
</ul>
<h3>Removed</h3>
<ul>
<li>Remove support for the <code>OTEL_SEMCONV_STABILITY_OPT_IN</code>
environment variable as well as support for semantic conventions v1.20.0
in the modules below. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7584">#7584</a>)
<ul>
<li><code>go.opentelemetry.io/contrib/instrumentation/github.com/emicklei/go-restful/otelrestful</code></li>
<li><code>go.opentelemetry.io/contrib/instrumentation/github.com/gin-gonic/gin/otelgin</code></li>
<li><code>go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux</code></li>
<li><code>go.opentelemetry.io/contrib/instrumentation/github.com/labstack/echo/otelecho</code></li>
<li><code>go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace</code></li>
</ul>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="80c9316336"><code>80c9316</code></a>
Release v1.38.0 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7827">#7827</a>)</li>
<li><a
href="e84e5f0d33"><code>e84e5f0</code></a>
fix(deps): update aws-sdk-go-v2 monorepo (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7825">#7825</a>)</li>
<li><a
href="621dff0c68"><code>621dff0</code></a>
Upgrade to go.opentelemetry.io/otel dependencies (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7808">#7808</a>)</li>
<li><a
href="00d0862286"><code>00d0862</code></a>
chore(deps): update module go.opentelemetry.io/build-tools to v0.27.0
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7822">#7822</a>)</li>
<li><a
href="63dd859ea7"><code>63dd859</code></a>
chore(deps): update module github.com/gordonklaus/ineffassign to v0.2.0
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7820">#7820</a>)</li>
<li><a
href="45f7b9d732"><code>45f7b9d</code></a>
chore(deps): update module github.com/mgechev/revive to v1.12.0 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7821">#7821</a>)</li>
<li><a
href="cb554a651f"><code>cb554a6</code></a>
fix(deps): update module github.com/stretchr/testify to v1.11.1 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7817">#7817</a>)</li>
<li><a
href="fcb2c96de6"><code>fcb2c96</code></a>
fix(deps): update aws-sdk-go-v2 monorepo (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7815">#7815</a>)</li>
<li><a
href="7ac87bd923"><code>7ac87bd</code></a>
fix(deps): update aws-sdk-go-v2 monorepo (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7812">#7812</a>)</li>
<li><a
href="38fe9803bf"><code>38fe980</code></a>
chore(deps): update github.com/lufia/plan9stats digest to 24949be (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-go-contrib/issues/7809">#7809</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/open-telemetry/opentelemetry-go-contrib/compare/zpages/v0.62.0...zpages/v0.63.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Radoslav Dimitrov <radoslav@stacklok.com>
Bumps [github.com/jackc/pgx/v5](https://github.com/jackc/pgx) from 5.7.5
to 5.7.6.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/jackc/pgx/blob/master/CHANGELOG.md">github.com/jackc/pgx/v5's
changelog</a>.</em></p>
<blockquote>
<h1>5.7.6 (September 8, 2025)</h1>
<ul>
<li>Use ParseConfigError in pgx.ParseConfig and pgxpool.ParseConfig
(Yurasov Ilia)</li>
<li>Add PrepareConn hook to pgxpool (Jonathan Hall)</li>
<li>Reduce allocations in QueryContext (Dominique Lefevre)</li>
<li>Add MarshalJSON and UnmarshalJSON for pgtype.Uint32 (Panos
Koutsovasilis)</li>
<li>Configure ping behavior on pgxpool with ShouldPing (Christian
Kiely)</li>
<li>zeronull int types implement Int64Valuer and Int64Scanner (Li
Zeghong)</li>
<li>Fix panic when receiving terminate connection message during
CopyFrom (Michal Drausowski)</li>
<li>Fix statement cache not being invalidated on error during batch
(Muhammadali Nazarov)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="a2fca03743"><code>a2fca03</code></a>
Release v5.7.6</li>
<li><a
href="95fc31294f"><code>95fc312</code></a>
Add link to github.com/KoNekoD/pgx-colon-query-rewriter</li>
<li><a
href="5534fa9a02"><code>5534fa9</code></a>
Improve Rows docs</li>
<li><a
href="a295d68811"><code>a295d68</code></a>
Merge pull request <a
href="https://redirect.github.com/jackc/pgx/issues/2368">#2368</a> from
zeghong/zeronull-int-valuer</li>
<li><a
href="03f32c06bd"><code>03f32c0</code></a>
Merge branch 'master' into zeronull-int-valuer</li>
<li><a
href="82fbe49fec"><code>82fbe49</code></a>
Merge pull request <a
href="https://redirect.github.com/jackc/pgx/issues/2372">#2372</a> from
WGH-/improve-batch-doc</li>
<li><a
href="594d9d65dc"><code>594d9d6</code></a>
Merge pull request <a
href="https://redirect.github.com/jackc/pgx/issues/2367">#2367</a> from
zeghong/zeronull-int-scanner</li>
<li><a
href="5a18241971"><code>5a18241</code></a>
Merge branch 'master' into zeronull-int-scanner</li>
<li><a
href="cc34da5884"><code>cc34da5</code></a>
Merge pull request <a
href="https://redirect.github.com/jackc/pgx/issues/2370">#2370</a> from
Saurabh2402/improvement/setup-linters</li>
<li><a
href="dd81f81e2f"><code>dd81f81</code></a>
Merge pull request <a
href="https://redirect.github.com/jackc/pgx/issues/2369">#2369</a> from
zeghong/go-doc-links</li>
<li>Additional commits viewable in <a
href="https://github.com/jackc/pgx/compare/v5.7.5...v5.7.6">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [golang.org/x/mod](https://github.com/golang/mod) from 0.27.0 to
0.28.0.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="1759e969da"><code>1759e96</code></a>
go.mod: update golang.org/x dependencies</li>
<li><a
href="f060e16ef6"><code>f060e16</code></a>
all: upgrade go directive to at least 1.24.0 [generated]</li>
<li>See full diff in <a
href="https://github.com/golang/mod/compare/v0.27.0...v0.28.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
<!-- Provide a brief summary of your changes -->
## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
The following PR should fix the recent "conn busy" issue caused by the
PostgreSQL implementation using a single database connection (*pgx.Conn)
instead of a connection pool (*pgxpool.Pool). When multiple concurrent
requests try to access the endpoint, they would conflict trying to use
the same connection.
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
Builds locally
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
No
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [x] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
Related to #400, #405 and #407
---------
Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>
## Summary
This PR implements OIDC authentication support for admin users,
specifically configured for Google Cloud Identity. The implementation
includes:
- Configurable OIDC authentication endpoints and validation
- Google Cloud Identity integration for admin access
- JWT token validation and user session management
- Deployment configuration updates for OIDC provider settings
Fixes#283
This implements the versioning approach agreed upon in issue #158:
## Key Changes
### Documentation
- Added comprehensive versioning guide (docs/versioning.md)
- Updated FAQ with versioning guidance and best practices
- Enhanced schema description with SHOULD recommendations
### Schema Updates
- Added 255-character limit for version strings in schema.json
- Enhanced version field description with semantic versioning guidance
### Implementation
- New isSemanticVersion() function for proper semver detection
- Enhanced compareSemanticVersions() with prerelease support
- Implemented compareVersions() strategy:
* Both semver: use semantic comparison
* Neither semver: use timestamp comparison
* Mixed: semver versions always take precedence
- Updated publish logic to determine "latest" using new strategy
- Added version length validation (255 char max)
### Versioning Strategy
1. Version MUST be string up to 255 characters
2. SHOULD use semantic versioning for predictable ordering
3. SHOULD align with package versions to reduce confusion
4. MAY use prerelease labels for registry-specific versions
5. Registry attempts semver parsing, falls back to timestamp ordering
6. Clients SHOULD follow same comparison logic
Resolves#158
---------
Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>
Co-authored-by: adam jones <domdomegg@users.noreply.github.com>
Fixes#228
## Motivation and Context
See #19
## How Has This Been Tested?
- Run locally
- Run in docker compose
- Run infra in minikube
- Unit and integration tests all passing :)
## Breaking Changes
Yes: users will not be able to access any data they used to have in
custom mongodb. We are accepting this breaking change, given the
registry is in experimental development status.
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [x] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [x] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [x] My code follows the repository's style guidelines
- [x] New and existing tests pass locally
- [x] I have added appropriate error handling
- [x] I have added or updated documentation as needed
## Additional context
I have not implemented connection pooling support for simplicity, and
because cloudnative-pg already provides built-in connection pooling with
pgBouncer so if we want it later we can switch to this endpoint easily.
## Motivation and Context
- It is important to have basic observability in place so that
availability issues can be figured out easily
## How Has This Been Tested?
- Registration of metrics is tested
- Prometheus endpoint `/metrics` is included in test cases to test the
metrics exposed
- Test locally to understand any regression.
## Breaking Changes
- No
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [x] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [x] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [x] My code follows the repository's style guidelines
- [x] New and existing tests pass locally
- [x] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
- Telemetry implementation is currently done by keeping metrics in mind
as of now, other types of telemetry can be added on top of it later.
- Instrumentation takes care of these problems already:
- Cardinality control by limiting latency buckets and not including
labels that grows with throughput.
- Latency buckets are added as per SLA guidelines
- Each metric prefixed with `mcp` to easily identify.
- Pulling mechanism is used since the idea is to scrape metrics via an
agent like vmagent, prometheus agent or otel-collector.
- Metrics follow standard approach of defining counters, histogram and
gauges as per opentelemetry guidelines.
Fixes#264. Adds endpoints:
```
/v0/auth/github # exchange a github token for a registry token that gives you access to namespaces io.github.username and io.github.org for your orgs
/v0/auth/none # get a registry token for namespace io.modelcontextprotocol.anonymous (only for testing/local dev purposes)
```
Updates `/v0/publish` to accept one of these registry tokens.
## Motivation and Context
See #264
## How Has This Been Tested?
- Running locally and getting a token from `/v0/auth/none` and then
publishing to `/v0/publish`
- Updating the integration tests that get a token and then publish, and
them passing
## Breaking Changes
This is a breaking change to the auth API. This is fine for registry
given it's not deployed yet.
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [x] New feature (non-breaking change which adds functionality)
- [x] Breaking change (fix or feature that would cause existing
functionality to change)
- [x] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [x] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [x] My code follows the repository's style guidelines
- [x] New and existing tests pass locally
- [x] I have added appropriate error handling
- [x] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
---------
Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>
Co-authored-by: adam jones <domdomegg@users.noreply.github.com>
## Motivation and Context
Currently there's a lot of unsafe manual JSON unmarshalling/marshalling,
and we have to manually keep the openapi schema in sync.
This PR migrates the API to
[Huma](https://github.com/danielgtaylor/huma), which appears like a
popular, well-maintained way to build APIs in Golang. I'm not a Golang
expert, but seemed highly recommended by Reddit + Claude and has a
decent star count. It provides automatic openapi spec generation and
docs hosting, JSON parsing, as well as the ability to add auth
middlewares etc.
## How Has This Been Tested?
Running locally, and poking at the endpoints
## Breaking Changes
Docs are served at `/docs` rather than `/v0/swagger/index.html` now
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [x] New feature (non-breaking change which adds functionality)
- [x] Breaking change (fix or feature that would cause existing
functionality to change)
- [x] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [x] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [x] My code follows the repository's style guidelines
- [x] New and existing tests pass locally
- [x] I have added appropriate error handling
- [x] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
Original PR: #227
- Add Pulumi-based infrastructure as code for deploying MCP Registry to
Kubernetes
- Support for both local development (minikube) and Azure Kubernetes
Service (AKS)
- Complete deployment orchestration including:
- cluster setup: e.g. you point this at an Azure account, and it can set
up and manage the cluster for you. e.g. K8s version, number of nodes,
type of nodes, ...
- cloud agnostic K8s services: cert-manager, nginx-ingress
- app services: MongoDB, and registry application (currently using nginx
as a placeholder, blocked on #225 (as is #190). but should be a 1 line
change)
## How is this different to #190
- Supports cluster setup and management. This enables:
- Non-hosting maintainers managing many devops workflows (e.g. scaling
up the cluster, or bumping K8s versions). Without this, we'd need to
bug/page the organisation hosting the registry when we need these things
changed.
- Makes it easy to spin up things like staging/temporary clusters, as
well as enables contributors to replicate the stack exactly on their own
Azure accounts.
- Sets up cloud-agnostic services. For example, rather than using the
Azure-managed ingresses and CA, we install nginx-ingress and
cert-manager. This enables:
- Running the entire infra stack can also run locally (e.g. in minikube,
k3s, orbstack, colima) - making it much easier for contributors to test
changes to infra stuff.
- Moving between cloud providers much more easily, e.g. we could shift
from Azure to GCP/AWS/other with minimal hassle.
- Everything stays written in Go, rather than Helm templates. This means
we get things like type-checking etc. for free (which from my experience
makes AI tools wayyy better at editing K8s stuff), and contributors
don't need to learn a new language if they're already using Go.
## Testing
I've got this running well:
- locally in minikube
- on cloud in Azure (my personal Azure account)
<details><summary>Claude written architecture and security
review</summary>
<p>
## Deployment Review & Assessment
### Current Architecture Strengths
**Pulumi IaC Approach**
- Well-structured infrastructure as code using Pulumi
- Multi-provider support (AKS, local) with clean abstraction
- Good separation of concerns in `pkg/` directory
**Security Fundamentals**
- Non-root container execution (`appuser` with UID 10001)
- Secrets properly managed via Kubernetes secrets
- TLS/SSL certificate management with cert-manager and Let's Encrypt
### Critical Issues & High-Priority Improvements
**1. Production Deployment Not Ready** 🚨
The registry deployment uses `nginx:alpine` placeholder image instead of
the actual MCP registry:
- `deploy/pkg/k8s/registry.go:67` - TODO comments indicate incomplete
setup
- Health probes are commented out
- Port mapping doesn't match actual application (80 vs 8080)
**Fix:** Build and publish actual registry container image to GHCR,
update deployment
**2. Database Security Considerations** 🔒
- MongoDB deployed without authentication
- No backup/disaster recovery strategy
- Database credentials hardcoded
*Note: MongoDB is not exposed externally (ClusterIP service), so this is
not a critical security risk but should be addressed for production.*
**3. Monitoring & Observability Gaps** 📊
- No Prometheus/Grafana monitoring stack
- No log aggregation (ELK/Loki)
- No application metrics/health dashboards
- No alerting configured
**4. High Availability & Reliability** ⚠️
- Single MongoDB instance (no replication)
- No persistent volume backup strategy
- Fixed 10Gi storage without growth planning
- Only 2 replicas for registry service
- No pod disruption budgets
- No horizontal pod autoscaling
### Recommended Improvements
**Immediate (High Priority)**
1. Complete Registry Deployment - Build proper container image pipeline,
enable health checks
2. Secure MongoDB - Add authentication credentials, implement backup
strategy
**Medium Priority**
3. Add Monitoring Stack - Prometheus, Grafana deployment
4. Security Hardening (Nice to Have) - RBAC policies, Network Policies,
Pod Security Standards
5. CI/CD Pipeline Enhancement - Container image building/publishing,
automated deployment
**Lower Priority**
6. High Availability - MongoDB replica set, HPA for registry pods
7. Operational Excellence - Kubernetes dashboard, cost optimization
### Configuration Issues
- Production config has test credentials: `deploy/Pulumi.prod.yaml:4-5`
- Missing environment-specific resource sizing
- Hardcoded domain names (`example.com`)
The deployment setup shows good architectural foundations but needs
significant work before production readiness. The most critical issue is
the placeholder nginx container - priority should be completing the
actual registry application deployment before addressing the other
improvements. Security measures like RBAC and Network Policies are nice
to have but not strictly necessary given that MongoDB is not exposed
externally.
🤖 Generated with [Claude Code](https://claude.ai/code)
</p>
</details>
## Metadata
Working towards #91
---------
Co-authored-by: Claude <noreply@anthropic.com>
This is a first PR for #159 - adding some validation scripts. I want to
get to a place where we are confident that making schema changes is in
sync with the rest of our code. Step one is making sure the schemas are
in sync with our examples. Step two will be making sure the schemas are
in sync with our actual Registry implementation code.
This is just for the JSON right now; if we're feeling good about this
approach I'll do an analogous change for the OpenAPI schemas as well.
I'll also follow with adding usage of these scripts to our CI pipeline
so we have automated checks on them with every change.
## Summary
- Added CLI validation tools for JSON schemas and examples in
`docs/server-json/`
- Fixed some minor validation errors found in `examples.md`
- Ensures schema consistency and example validity in CI/CD pipelines
## Changes
### New Validation Tools
1. **`tools/validate-schemas`** - Validates that `schema.json` and
`registry-schema.json` are valid JSON Schema documents
2. **`tools/validate-examples`** - Validates all JSON examples in
`examples.md` against both schemas
### Key Features
- ✅ Validates JSON schema syntax and structure
- ✅ Validates all examples against both base and registry schemas
- ✅ Tracks validation counts to prevent silent failures
- ✅ Proper exit codes for CI integration
- ✅ Clear error messages for debugging
### Fixes to examples.md
- Added missing `repository.id` field in NuGet example
- Changed `repository.source` from "gitlab" to "github" in Docker
example
### Usage
```bash
# From repository root
./tools/validate-schemas.sh
./tools/validate-examples.sh
```
## Testing
I ran these scripts locally with minor (breaking) changes, which they
each correctly reported. As submitted, they are both passing.
🤖 Co-authored with [Claude Code](https://claude.ai/code)
---------
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Charles Lowell <10964656+chlowell@users.noreply.github.com>
Work in progress .
This commit adds the core registry service implementation with methods to:
- Retrieve all registry entries
- List entries with cursor-based pagination
- Fetch specific server details by ID
Radoslav Dimitrov
dependabot[bot]
Tadas Antanavicius
adam jones
pree-dew
Avinash Sridhar
Toby Padilla