From f36b7dd4afe2d540a4ceb9b64d3627085bf5db03 Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Fri, 7 Aug 2026 02:43:14 +0300 Subject: [PATCH 01/36] chore(deploy): promote production to 1.8.1 (#1510) ## Summary Promote the production registry image from `1.8.0` to [`1.8.1`](https://github.com/modelcontextprotocol/registry/releases/tag/v1.8.1). This release includes #1509, which adds a short ingress cache and a scoped rate-limit increase for the exact public registry-list endpoints. ## Staging verification - release tag points to `f52dc8525a441a3abf5fedc9912152d95af5aab1`, the commit deployed to staging - staging deployment and CI workflows completed successfully - both registry replicas became ready with zero restarts - rendered NGINX configuration kept the root route at 180 RPM with buffering off - exact `/v0/servers` and `/v0.1/servers` routes rendered at 600 RPM with buffering on - live cache probe returned `MISS`, then `HIT` - health and unrelated routes remained uncached - no application 5xx, serious NGINX errors, or application error logs were observed after rollout ## Release artifact - release workflow completed successfully - `ghcr.io/modelcontextprotocol/registry:1.8.1` is available for `linux/amd64` and `linux/arm64` ## Deployment and rollback Merging this PR triggers the production Pulumi deployment automatically. Monitor registry pod readiness, NGINX reloads, cache behavior, origin request volume, 429/499/5xx responses, and publish requests exceeding 10 seconds. Rollback by restoring `mcp-registry:imageTag` to `1.8.0`. --- deploy/Pulumi.gcpProd.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/deploy/Pulumi.gcpProd.yaml b/deploy/Pulumi.gcpProd.yaml index d4eaaee..6645551 100644 --- a/deploy/Pulumi.gcpProd.yaml +++ b/deploy/Pulumi.gcpProd.yaml @@ -1,7 +1,7 @@ config: mcp-registry:environment: prod mcp-registry:provider: gcp - mcp-registry:imageTag: 1.8.0 # Set specific image tag for production (change this to deploy different versions) + mcp-registry:imageTag: 1.8.1 # Set specific image tag for production (change this to deploy different versions) gcp:project: mcp-registry-prod mcp-registry:githubClientId: Iv23liUydBbI7Z2Q9bOZ mcp-registry:githubClientSecret: From 4508c48f801189648879fd0cdf7989910b437ee3 Mon Sep 17 00:00:00 2001 From: Recoordinate <296084221+latent-9@users.noreply.github.com> Date: Tue, 11 Aug 2026 00:18:22 +1200 Subject: [PATCH 02/36] Fix broken relative links in releasing docs (#1517) The three deployment links in `docs/contributing/releasing.md` use `../../../`, which resolves above the repository root and 404s on GitHub. The file lives in `docs/contributing/`, so the repo root is two levels up and `../../` is correct. This fixes the links to `deploy-production.yml`, `deploy-staging.yml`, and `deploy/README.md` (all three targets exist at the repo root). No content change. --- docs/contributing/releasing.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/contributing/releasing.md b/docs/contributing/releasing.md index bbf9345..d7b625f 100644 --- a/docs/contributing/releasing.md +++ b/docs/contributing/releasing.md @@ -27,13 +27,13 @@ Releases do not automatically deploy to production. To deploy a release: 1. Update `mcp-registry:imageTag` in `deploy/Pulumi.gcpProd.yaml` to the desired version (e.g., `1.2.3` - note: no 'v' prefix) 2. Commit and push the change to the `main` branch (either through a PR or by pushing directly to main) -3. The [deploy-production.yml](../../../.github/workflows/deploy-production.yml) workflow will automatically trigger and deploy the specified version +3. The [deploy-production.yml](../../.github/workflows/deploy-production.yml) workflow will automatically trigger and deploy the specified version -See the [deployment documentation](../../../deploy/README.md) for more details. +See the [deployment documentation](../../deploy/README.md) for more details. ## Staging -Staging auto-deploys from `main` via [deploy-staging.yml](../../../.github/workflows/deploy-staging.yml). It always runs the latest `main` branch code. +Staging auto-deploys from `main` via [deploy-staging.yml](../../.github/workflows/deploy-staging.yml). It always runs the latest `main` branch code. ## Rollback From 03aeca562f72cf1444cde2d0afd5b0a77f03911a Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 10 Aug 2026 15:18:42 +0300 Subject: [PATCH 03/36] build(deps): bump github.com/go-git/go-git/v6 from 6.0.0-alpha.4 to 6.0.0-alpha.5 in /deploy (#1514) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [github.com/go-git/go-git/v6](https://github.com/go-git/go-git) from 6.0.0-alpha.4 to 6.0.0-alpha.5.
Release notes

Sourced from github.com/go-git/go-git/v6's releases.

v6.0.0-alpha.5

What's Changed

... (truncated)

Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/go-git/go-git/v6&package-manager=go_modules&previous-version=6.0.0-alpha.4&new-version=6.0.0-alpha.5)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/modelcontextprotocol/registry/network/alerts).
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- deploy/go.mod | 20 ++++++++++---------- deploy/go.sum | 40 ++++++++++++++++++++-------------------- 2 files changed, 30 insertions(+), 30 deletions(-) diff --git a/deploy/go.mod b/deploy/go.mod index b2365a5..d0c5488 100644 --- a/deploy/go.mod +++ b/deploy/go.mod @@ -34,8 +34,8 @@ require ( github.com/emirpasic/gods v1.18.1 // indirect github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f // indirect github.com/go-git/gcfg/v2 v2.0.2 // indirect - github.com/go-git/go-billy/v6 v6.0.0-alpha.1 // indirect - github.com/go-git/go-git/v6 v6.0.0-alpha.4 // indirect + github.com/go-git/go-billy/v6 v6.0.0-alpha.2 // indirect + github.com/go-git/go-git/v6 v6.0.0-alpha.5 // indirect github.com/go-logr/logr v1.4.3 // indirect github.com/go-logr/stdr v1.2.2 // indirect github.com/gogo/protobuf v1.3.2 // indirect @@ -99,14 +99,14 @@ require ( go.opentelemetry.io/proto/otlp v1.10.0 // indirect go.uber.org/atomic v1.11.0 // indirect go.uber.org/multierr v1.11.0 // indirect - golang.org/x/crypto v0.52.0 // indirect - golang.org/x/mod v0.35.0 // indirect - golang.org/x/net v0.55.0 // indirect - golang.org/x/sync v0.20.0 // indirect - golang.org/x/sys v0.45.0 // indirect - golang.org/x/term v0.43.0 // indirect - golang.org/x/text v0.37.0 // indirect - golang.org/x/tools v0.44.0 // indirect + golang.org/x/crypto v0.54.0 // indirect + golang.org/x/mod v0.37.0 // indirect + golang.org/x/net v0.57.0 // indirect + golang.org/x/sync v0.22.0 // indirect + golang.org/x/sys v0.47.0 // indirect + golang.org/x/term v0.45.0 // indirect + golang.org/x/text v0.40.0 // indirect + golang.org/x/tools v0.47.0 // indirect google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa // indirect google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa // indirect google.golang.org/grpc v1.82.1 // indirect diff --git a/deploy/go.sum b/deploy/go.sum index f55881a..a5e4f9a 100644 --- a/deploy/go.sum +++ b/deploy/go.sum @@ -62,12 +62,12 @@ github.com/gliderlabs/ssh v0.3.8 h1:a4YXD1V7xMF9g5nTkdfnja3Sxy1PVDCj1Zg4Wb8vY6c= github.com/gliderlabs/ssh v0.3.8/go.mod h1:xYoytBv1sV0aL3CavoDuJIQNURXkkfPA/wxQ1pL1fAU= github.com/go-git/gcfg/v2 v2.0.2 h1:MY5SIIfTGGEMhdA7d7JePuVVxtKL7Hp+ApGDJAJ7dpo= github.com/go-git/gcfg/v2 v2.0.2/go.mod h1:/lv2NsxvhepuMrldsFilrgct6pxzpGdSRC13ydTLSLs= -github.com/go-git/go-billy/v6 v6.0.0-alpha.1 h1:xVjAR4oUvrKy7/Xuw/lLlV3gkxR3KO2H8W+MamuVVsQ= -github.com/go-git/go-billy/v6 v6.0.0-alpha.1/go.mod h1:eaCUpHbedW7//EwcYmUDfJe2N6sJC9O12AT0OTqJR1E= +github.com/go-git/go-billy/v6 v6.0.0-alpha.2 h1:1Sv5WemXL8CxKrAx1gioJ+uHNb2bZJhiQLfwSZ4Et8c= +github.com/go-git/go-billy/v6 v6.0.0-alpha.2/go.mod h1:r/bsv9i/iDyyEU8/Z6mjC+YraOVwie1ddfUqBCElKXQ= github.com/go-git/go-git-fixtures/v6 v6.0.0-alpha.1 h1:gmqi2jvsreu0s8JMLylYDFq4sbjHwwlhktMw0DUg3mA= github.com/go-git/go-git-fixtures/v6 v6.0.0-alpha.1/go.mod h1:ECf1MqJlBdYpKggBrOXjo/0EnvRZx6D++I86UYjPgAQ= -github.com/go-git/go-git/v6 v6.0.0-alpha.4 h1:aDTc2UGanmaE7FkGLSlBEB9nohMnQ+RKXcfq/D+esDQ= -github.com/go-git/go-git/v6 v6.0.0-alpha.4/go.mod h1:4ODa/G7hPWrh4Y+7lmt59Ij3zW38IEfvRoAZxLYYBhc= +github.com/go-git/go-git/v6 v6.0.0-alpha.5 h1:sE+OlkHgYWNMVmN1s9sR7uyFgsWLtxcNWse/vBYKxRE= +github.com/go-git/go-git/v6 v6.0.0-alpha.5/go.mod h1:3IjhiZnM+uBmUrOGSeqrJpsmi4Vd0H2NZO/uK2a7d0s= github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A= github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI= github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= @@ -261,28 +261,28 @@ go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg= golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w= golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI= golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto= -golang.org/x/crypto v0.52.0 h1:RMs7fP2rXdep0CftQlK8Uf+kibLm7qkCcradZWYz988= -golang.org/x/crypto v0.52.0/go.mod h1:1QgfPxDqh0T2M/elOJtp9RvuR95kVjir0e6/BvEmGbc= +golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw= +golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk= golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f h1:W3F4c+6OLc6H2lb//N1q4WpJkhzJCK5J6kUi1NTVXfM= golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f/go.mod h1:J1xhfL/vlindoeF/aINzNzt2Bket5bjo9sdOYzOsU80= golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY= golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg= golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= -golang.org/x/mod v0.35.0 h1:Ww1D637e6Pg+Zb2KrWfHQUnH2dQRLBQyAtpr/haaJeM= -golang.org/x/mod v0.35.0/go.mod h1:+GwiRhIInF8wPm+4AoT6L0FA1QWAad3OMdTRx4tFYlU= +golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ= +golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0= golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= golang.org/x/net v0.0.0-20200421231249-e086a090c8fd/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A= golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU= -golang.org/x/net v0.55.0 h1:bcvxaJn3e1U6InsFWt1JUq1aSjnRxLzT2rtD2KfkDF8= -golang.org/x/net v0.55.0/go.mod h1:L5U2KuzuOe1lY7Z+aWVIKK6qEeJXnXV9yzGA+WCHJww= +golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE= +golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU= golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= -golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4= -golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0= +golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek= +golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0= golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= @@ -291,22 +291,22 @@ golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7w golang.org/x/sys v0.0.0-20200909081042-eff7692f9009/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20210809222454-d867a43fc93e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY= -golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= -golang.org/x/term v0.43.0 h1:S4RLU2sB31O/NCl+zFN9Aru9A/Cq2aqKpTZJ6B+DwT4= -golang.org/x/term v0.43.0/go.mod h1:lrhlHNdQJHO+1qVYiHfFKVuVioJIheAc3fBSMFYEIsk= +golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs= +golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= +golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0= +golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= -golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc= -golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38= +golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs= +golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY= golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= golang.org/x/tools v0.0.0-20181030221726-6c7e314b6563/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo= golang.org/x/tools v0.0.0-20200130002326-2f3ba24bd6e7/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28= golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE= golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA= -golang.org/x/tools v0.44.0 h1:UP4ajHPIcuMjT1GqzDWRlalUEoY+uzoZKnhOjbIPD2c= -golang.org/x/tools v0.44.0/go.mod h1:KA0AfVErSdxRZIsOVipbv3rQhVXTnlU6UhKxHd1seDI= +golang.org/x/tools v0.47.0 h1:7Kn5x/d1svx/PzryTsqeoZN4TZwqeH5pGWjefhLi/1Q= +golang.org/x/tools v0.47.0/go.mod h1:dFHnyTvFWY212G+h7ZY4Vsp/K3U4/7W9TyVaAul8uCA= golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= From 69374b08deb479d65028236405683c94d67280fc Mon Sep 17 00:00:00 2001 From: Wolfe-James Date: Mon, 10 Aug 2026 08:19:06 -0400 Subject: [PATCH 04/36] docs: add cargo and crates.io to schema examples (#1511) The cargo registry type has been live since v1.8.0 (#1207). This PR only updates the schema examples so they match reality. - Add "cargo" to registryType.examples - Add "https://crates.io" to registryBaseUrl.examples No behaviour change. Note: versioned schemas are synced from modelcontextprotocol/static. A follow-up there keeps this durable across schema sync. Co-authored-by: Wolfe-Jam --- internal/validators/schemas/2025-12-11.json | 2 ++ 1 file changed, 2 insertions(+) diff --git a/internal/validators/schemas/2025-12-11.json b/internal/validators/schemas/2025-12-11.json index 70902ed..718aaca 100644 --- a/internal/validators/schemas/2025-12-11.json +++ b/internal/validators/schemas/2025-12-11.json @@ -239,6 +239,7 @@ "examples": [ "https://registry.npmjs.org", "https://pypi.org", + "https://crates.io", "https://docker.io", "https://api.nuget.org/v3/index.json", "https://github.com", @@ -252,6 +253,7 @@ "examples": [ "npm", "pypi", + "cargo", "oci", "nuget", "mcpb" From 43fbc1dcbd86f4df447c64e7bd6e08a6cff44cc6 Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Mon, 10 Aug 2026 16:24:06 +0300 Subject: [PATCH 05/36] fix(admin): use PATCH status endpoints in takedown script and runbook (#1518) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The admin takedown script cannot work as written, and the runbook that documents it has the same problem. ## The bug `tools/admin/takedown.sh` sent `PUT` with a `?status=deleted` query parameter to two routes: | What the script sent | Reality | |---|---| | `PUT /v0/servers/{name}/versions/{version}?status=deleted` | Route exists, but requires a full `ServerJSON` body and has no `status` query parameter | | `PUT /v0/servers/{name}?status=deleted` | **Not registered at all** — the whole-server takedown path 404s | The real endpoints are `PATCH /v0/servers/{name}/versions/{version}/status` and `PATCH /v0/servers/{name}/status` ([status.go:83](https://github.com/modelcontextprotocol/registry/blob/main/internal/api/handlers/v0/status.go#L83), [:198](https://github.com/modelcontextprotocol/registry/blob/main/internal/api/handlers/v0/status.go#L198)), both taking `{"status": ..., "statusMessage": ...}`. `edit.go` even says so in its own description: use the status endpoint for status changes. ## Script changes - Send `PATCH` with a JSON body built via `jq` - **Require `VERSION` or `ALL_VERSIONS=true` explicitly.** Previously a missing `VERSION` meant "entire server". Since `PATCH .../status` updates *every* version, an operator who simply forgot `VERSION` would have taken down the whole server. Now that needs saying out loud. - Support `STATUS` (default `deleted`) and `STATUS_MESSAGE`, so a takedown can record its reason - `set -euo pipefail`, non-zero exit on HTTP errors, and print the response body so huma error detail is visible instead of being swallowed ## Runbook changes - `GET /v0/servers/{name}` is not a route — use `GET .../versions/latest` (which is supported, see [servers.go:155-178](https://github.com/modelcontextprotocol/registry/blob/main/internal/api/handlers/v0/servers.go#L155)) - Replace the per-version `?status=deleted` loop with the single all-versions `PATCH .../status` call, which reports `updatedCount` - Keep the per-version `PUT` loop for *content* edits, which genuinely has no bulk endpoint, and show that it needs the full body - Correct the closing note claiming server-wide changes must be applied per version — true for content, not for status - Fix the broken `moderation-guidelines.md` link (dead since the docs restructuring; the file is now `modelcontextprotocol-io/moderation-policy.mdx`) ## Verification `shellcheck` clean, `bash -n` clean, and all three guard paths exercised (no args / neither VERSION nor ALL_VERSIONS / both set). Both `PATCH` paths confirmed present in `docs/reference/api/openapi.yaml`. I did not run a live takedown against production. Kept on `/v0` rather than `/v0.1` to match the existing admin/deploy convention — happy to switch if you would rather admin tooling target the frozen version. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5 --- docs/administration/admin-operations.md | 91 +++++++++++++++++------- tools/admin/takedown.sh | 93 +++++++++++++++++++------ 2 files changed, 138 insertions(+), 46 deletions(-) diff --git a/docs/administration/admin-operations.md b/docs/administration/admin-operations.md index 6b3a04d..f3131bf 100644 --- a/docs/administration/admin-operations.md +++ b/docs/administration/admin-operations.md @@ -1,6 +1,6 @@ # Admin Operations -This is a brief guide for admins and moderators managing content on the registry. All actions should be taken in line with the [moderation guidelines](moderation-guidelines.md). +This is a brief guide for admins and moderators managing content on the registry. All actions should be taken in line with the [moderation policy](../modelcontextprotocol-io/moderation-policy.mdx). ## Prerequisites @@ -33,8 +33,8 @@ ENCODED_SERVER_NAME=$(echo "$SERVER_NAME" | sed 's|/|%2F|g') # Get specific version curl -s "https://registry.modelcontextprotocol.io/v0/servers/${ENCODED_SERVER_NAME}/versions/${VERSION}" > server.json -# Or get latest version (omit /versions/VERSION) -curl -s "https://registry.modelcontextprotocol.io/v0/servers/${ENCODED_SERVER_NAME}" > server.json +# Or get the latest version (use the special version "latest") +curl -s "https://registry.modelcontextprotocol.io/v0/servers/${ENCODED_SERVER_NAME}/versions/latest" > server.json ``` ### Step 2: Make Changes @@ -44,19 +44,46 @@ Open `server.json` and edit the specific version details. You cannot change the ### Step 3: Update Version ```bash -# Update specific version +# Update specific version (requires the full server.json body) curl -X PUT "https://registry.modelcontextprotocol.io/v0/servers/${ENCODED_SERVER_NAME}/versions/${VERSION}" \ -H "Authorization: Bearer ${REGISTRY_TOKEN}" \ -H "Content-Type: application/json" \ -d "$(cat server.json)" +``` +To change **only** the status of a version, use the status endpoint instead — it does not require +the full server configuration: + +```bash +curl -X PATCH "https://registry.modelcontextprotocol.io/v0/servers/${ENCODED_SERVER_NAME}/versions/${VERSION}/status" \ + -H "Authorization: Bearer ${REGISTRY_TOKEN}" \ + -H "Content-Type: application/json" \ + -d '{"status": "deprecated", "statusMessage": "Superseded by v2"}' ``` ## Edit an Entire Server (All Versions) -Use this when you need to apply changes across all versions of a server (e.g., mark entire server as deleted, apply content scrubbing). +### Status Changes Across All Versions -### Step 1: List All Versions +A status change applies to every version of a server in a single request. The response reports +how many versions were updated in `updatedCount`. + +```bash +export SERVER_NAME="" # e.g., "com.example/my-server" +ENCODED_SERVER_NAME=$(echo "$SERVER_NAME" | sed 's|/|%2F|g') + +curl -X PATCH "https://registry.modelcontextprotocol.io/v0/servers/${ENCODED_SERVER_NAME}/status" \ + -H "Authorization: Bearer ${REGISTRY_TOKEN}" \ + -H "Content-Type: application/json" \ + -d '{"status": "deleted", "statusMessage": "Removed per moderation policy"}' +``` + +### Content Changes Across All Versions + +Content edits (e.g. scrubbing sensitive text from descriptions) have no bulk endpoint and must be +applied per version using the edit endpoint, which takes the full server configuration. + +#### Step 1: List All Versions ```bash export SERVER_NAME="" # e.g., "com.example/my-server" @@ -65,29 +92,32 @@ ENCODED_SERVER_NAME=$(echo "$SERVER_NAME" | sed 's|/|%2F|g') curl -s "https://registry.modelcontextprotocol.io/v0/servers/${ENCODED_SERVER_NAME}/versions" > all_versions.json ``` -### Step 2: Extract Versions +#### Step 2: Extract Versions ```bash # Extract all versions from the server jq -r '.servers[].server.version' all_versions.json > versions.txt ``` -### Step 3: Apply Changes to All Versions +#### Step 3: Apply Changes to Each Version ```bash -# For each version, apply changes using the edit endpoint while read VERSION; do echo "Processing version: $VERSION" - # Apply your changes here (e.g., set status to "deleted") - curl -X PUT "https://registry.modelcontextprotocol.io/v0/servers/${ENCODED_SERVER_NAME}/versions/${VERSION}?status=deleted" \ + # Download the version, edit it, then send the full body back + curl -s "https://registry.modelcontextprotocol.io/v0/servers/${ENCODED_SERVER_NAME}/versions/${VERSION}" > version.json + + # Apply your changes to version.json here, then: + curl -X PUT "https://registry.modelcontextprotocol.io/v0/servers/${ENCODED_SERVER_NAME}/versions/${VERSION}" \ -H "Authorization: Bearer ${REGISTRY_TOKEN}" \ - -H "Content-Type: application/json" + -H "Content-Type: application/json" \ + -d "$(cat version.json)" done < versions.txt # Clean up temporary files -rm versions.txt all_versions.json +rm -f versions.txt all_versions.json version.json ``` ## Quick Operations @@ -98,7 +128,7 @@ rm versions.txt all_versions.json export SERVER_NAME="" # e.g., "com.example/my-server" ENCODED_SERVER_NAME=$(echo "$SERVER_NAME" | sed 's|/|%2F|g') -curl -s "https://registry.modelcontextprotocol.io/v0/servers/${ENCODED_SERVER_NAME}" > latest_version.json +curl -s "https://registry.modelcontextprotocol.io/v0/servers/${ENCODED_SERVER_NAME}/versions/latest" > latest_version.json export VERSION=$(jq -r '.server.version' latest_version.json) echo "Latest version: $VERSION" ``` @@ -113,30 +143,37 @@ export REGISTRY_TOKEN="" REGISTRY_TOKEN="$REGISTRY_TOKEN" SERVER_NAME="$SERVER_NAME" VERSION="$VERSION" ./tools/admin/takedown.sh ``` -### Takedown Latest Version (Entire Server) +### Takedown All Versions of a Server + +`ALL_VERSIONS=true` marks every version as deleted in a single request. The script requires either +`VERSION` or `ALL_VERSIONS` to be set explicitly, so a forgotten `VERSION` cannot take down a whole +server by accident. ```bash export SERVER_NAME="" # e.g., "com.example/my-server" export REGISTRY_TOKEN="" -# This marks the latest version as deleted -REGISTRY_TOKEN="$REGISTRY_TOKEN" SERVER_NAME="$SERVER_NAME" ./tools/admin/takedown.sh +REGISTRY_TOKEN="$REGISTRY_TOKEN" SERVER_NAME="$SERVER_NAME" ALL_VERSIONS=true ./tools/admin/takedown.sh ``` -### Takedown All Versions of a Server +### Takedown the Latest Version Only ```bash export SERVER_NAME="" # e.g., "com.example/my-server" export REGISTRY_TOKEN="" ENCODED_SERVER_NAME=$(echo "$SERVER_NAME" | sed 's|/|%2F|g') -# Get all versions and takedown each one -curl -s "https://registry.modelcontextprotocol.io/v0/servers/${ENCODED_SERVER_NAME}/versions" | \ - jq -r '.servers[].server.version' | \ - while read VERSION; do - echo "Taking down version: $VERSION" - REGISTRY_TOKEN="$REGISTRY_TOKEN" SERVER_NAME="$SERVER_NAME" VERSION="$VERSION" ./tools/admin/takedown.sh - done +# Resolve the latest version, then take down that specific version +VERSION=$(curl -s "https://registry.modelcontextprotocol.io/v0/servers/${ENCODED_SERVER_NAME}/versions/latest" | jq -r '.server.version') + +REGISTRY_TOKEN="$REGISTRY_TOKEN" SERVER_NAME="$SERVER_NAME" VERSION="$VERSION" ./tools/admin/takedown.sh +``` + +### Record a Reason with a Takedown + +```bash +REGISTRY_TOKEN="$REGISTRY_TOKEN" SERVER_NAME="$SERVER_NAME" ALL_VERSIONS=true \ + STATUS_MESSAGE="Removed per moderation policy" ./tools/admin/takedown.sh ``` ## Connecting to the Production Database @@ -179,6 +216,8 @@ Any write attempts will fail with an error until you disconnect. ## Notes - **Version-specific changes**: Only affect that particular version -- **Server-wide changes**: Must be applied to each version individually +- **Server-wide status changes**: `PATCH /v0/servers/{serverName}/status` updates every version in one request +- **Server-wide content changes**: Have no bulk endpoint and must be applied to each version individually +- **Status vs. edit**: Use `PATCH .../status` to change status alone; the `PUT` edit endpoint requires the full server configuration - **Content scrubbing**: Use the version-specific edit workflow to scrub sensitive content - **Server name**: Cannot be changed in any version (it's the immutable identifier) diff --git a/tools/admin/takedown.sh b/tools/admin/takedown.sh index d53babf..d6b7dff 100755 --- a/tools/admin/takedown.sh +++ b/tools/admin/takedown.sh @@ -1,30 +1,83 @@ #!/bin/bash -# Simple takedown script +# Set the lifecycle status of an MCP server, either for one version or for every version. + +set -euo pipefail REGISTRY_URL="${REGISTRY_URL:-https://registry.modelcontextprotocol.io}" +STATUS="${STATUS:-deleted}" +SERVER_NAME="${SERVER_NAME:-}" +VERSION="${VERSION:-}" +ALL_VERSIONS="${ALL_VERSIONS:-}" +STATUS_MESSAGE="${STATUS_MESSAGE:-}" -if [ -z "$SERVER_NAME" ] || [ -z "$REGISTRY_TOKEN" ]; then - echo "Usage: REGISTRY_TOKEN= SERVER_NAME= [VERSION=] $0" - echo "Example: REGISTRY_TOKEN=token SERVER_NAME=com.example/my-server ./takedown.sh" - echo "Example: REGISTRY_TOKEN=token SERVER_NAME=com.example/my-server VERSION=1.0.0 ./takedown.sh" +usage() { + cat <<'EOF' +Usage: + REGISTRY_TOKEN= SERVER_NAME= VERSION= ./takedown.sh + REGISTRY_TOKEN= SERVER_NAME= ALL_VERSIONS=true ./takedown.sh + +Examples: + REGISTRY_TOKEN=token SERVER_NAME=com.example/my-server VERSION=1.0.0 ./takedown.sh + REGISTRY_TOKEN=token SERVER_NAME=com.example/my-server ALL_VERSIONS=true ./takedown.sh + +Optional environment variables: + STATUS active | deprecated | deleted (default: deleted) + STATUS_MESSAGE reason recorded alongside the status change (max 500 characters) + REGISTRY_URL registry base URL (default: https://registry.modelcontextprotocol.io) +EOF +} + +if [ -z "$SERVER_NAME" ] || [ -z "${REGISTRY_TOKEN:-}" ]; then + usage exit 1 fi -# URL encode the server name (replace / with %2F) -ENCODED_SERVER_NAME=$(echo "$SERVER_NAME" | sed 's|/|%2F|g') - -# Determine the endpoint based on whether VERSION is provided -if [ -n "$VERSION" ]; then - # Mark specific version as deleted - ENDPOINT="${REGISTRY_URL}/v0/servers/${ENCODED_SERVER_NAME}/versions/${VERSION}?status=deleted" - echo "Marking version $VERSION of server $SERVER_NAME as deleted..." -else - # Mark entire server as deleted (latest version) - ENDPOINT="${REGISTRY_URL}/v0/servers/${ENCODED_SERVER_NAME}?status=deleted" - echo "Marking server $SERVER_NAME as deleted..." +# Require an explicit choice, so that a forgotten VERSION cannot silently take +# down every version of a server. +if [ -n "$VERSION" ] && [ -n "$ALL_VERSIONS" ]; then + echo "Error: set either VERSION or ALL_VERSIONS, not both." >&2 + exit 1 +fi +if [ -z "$VERSION" ] && [ -z "$ALL_VERSIONS" ]; then + echo "Error: set VERSION= for a single version, or ALL_VERSIONS=true for every version." >&2 + echo >&2 + usage + exit 1 fi -# Update server status to deleted -curl -X PUT "$ENDPOINT" \ +# URL encode the server name and version (replace / with %2F) +ENCODED_SERVER_NAME="${SERVER_NAME//\//%2F}" + +if [ -n "$VERSION" ]; then + ENCODED_VERSION="${VERSION//\//%2F}" + ENDPOINT="${REGISTRY_URL}/v0/servers/${ENCODED_SERVER_NAME}/versions/${ENCODED_VERSION}/status" + echo "Setting version ${VERSION} of ${SERVER_NAME} to '${STATUS}'..." +else + ENDPOINT="${REGISTRY_URL}/v0/servers/${ENCODED_SERVER_NAME}/status" + echo "Setting ALL versions of ${SERVER_NAME} to '${STATUS}'..." +fi + +if [ -n "$STATUS_MESSAGE" ]; then + BODY=$(jq -n --arg status "$STATUS" --arg message "$STATUS_MESSAGE" \ + '{status: $status, statusMessage: $message}') +else + BODY=$(jq -n --arg status "$STATUS" '{status: $status}') +fi + +RESPONSE_BODY=$(mktemp) +trap 'rm -f "$RESPONSE_BODY"' EXIT + +HTTP_CODE=$(curl -sS -X PATCH "$ENDPOINT" \ -H "Authorization: Bearer ${REGISTRY_TOKEN}" \ - -H "Content-Type: application/json" \ No newline at end of file + -H "Content-Type: application/json" \ + -d "$BODY" \ + -o "$RESPONSE_BODY" \ + -w '%{http_code}') + +cat "$RESPONSE_BODY" +echo + +if [ "$HTTP_CODE" -lt 200 ] || [ "$HTTP_CODE" -ge 300 ]; then + echo "Request failed with HTTP ${HTTP_CODE}" >&2 + exit 1 +fi From 43402d8f6fc728dc027be96b7218fcb2495517dc Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Mon, 10 Aug 2026 16:25:00 +0300 Subject: [PATCH 06/36] fix(publisher): document --algorithm for ECDSA login and fix validate --help (#1519) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Two real defects, plus the CLI reference claims that go with them. ## 1. ECDSA P-384 login instructions cannot work Every "ECDSA P-384" tab ran the *identical* command to the Ed25519 tab. Since `--algorithm` defaults to ed25519 ([login.go:100](https://github.com/modelcontextprotocol/registry/blob/main/cmd/publisher/commands/login.go#L100)), a 96-hex key is rejected outright. Verified against a freshly generated P-384 key: ``` $ mcp-publisher login dns --domain=example.com --private-key=$KEY Signing in process using key algorithm ed25519 Error: failed to get token: failed to sign timestamp: invalid seed length: expected 32 bytes, got 48 $ mcp-publisher login dns --algorithm ecdsap384 --domain=example.com --private-key=$KEY Signing in process using key algorithm ecdsap384 Expected proof record: # works ``` `--algorithm` is registered at [login.go:129](https://github.com/modelcontextprotocol/registry/blob/main/cmd/publisher/commands/login.go#L129) and described correctly by the CLI's own help, but `grep -rn algorithm docs/` had **zero** hits for it. Anyone following the ECDSA path in the docs hit that error with nothing to tell them why. Fixed at all four in-process ECDSA sites (2 in `authentication.mdx`, 2 in `cli/commands.md`), with a note that cloud signing providers derive the algorithm from the key itself so the flag does not apply to them. ## 2. `mcp-publisher validate --help` was broken ``` $ mcp-publisher validate --help Unknown command: validate ... Use 'mcp-publisher --help' for more information about a command. ``` It printed the very instruction that had just failed. `main.go` intercepted `--help` for all subcommands and called `printCommandHelp`, whose switch had no `validate` case — making `ValidateCommand`'s own help block ([validate.go:120-129](https://github.com/modelcontextprotocol/registry/blob/main/cmd/publisher/commands/validate.go#L120)) unreachable. Rather than paste a third copy of the help text, `printCommandHelp` now returns whether it handled the command, and the caller falls through to normal dispatch when it did not. Commands own their own `--help`, and any future command with this shape works automatically. | Command | Before | After | |---|---|---| | `validate --help` | `Unknown command`, exit 0 | prints its help, exit 0 | | `publish --help` | works | works | | `init -h` | works | works | | `bogus --help` | `Unknown command`, exit 0 | `Unknown command`, **exit 1** | ## 3. CLI reference corrections - **`--registry` is not global.** It exists only on `login`; other commands read the URL from the stored token. `publish --registry=URL` silently treats the flag as the `server.json` path. `cmd/publisher/README.md` had exactly this broken example. - **`--token` was undocumented** despite `github-actions.mdx:123` depending on it. Now documented, noting it is `login github` only. - **`init` takes no flags** and does not prompt; it writes `TODO:` placeholders. The reference said `init [options]` and "Prompts for missing required fields". - **Refreshed the `--help` transcript** in `quickstart.mdx`, which listed only 4 of 6 commands. Now byte-for-byte identical to real output (diffed). - **Added `validate`** to the command list in `cmd/publisher/README.md`. ## Verification `go build` and `go test ./cmd/...` pass. All four help paths exercised with exit codes checked. The 23 `goconst` findings in `validate_test.go` are pre-existing — identical count on pristine `main`, none in `main.go`. Quickstart transcript diffed against real output. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5 --- cmd/publisher/README.md | 6 +++- cmd/publisher/main.go | 18 +++++++---- .../authentication.mdx | 4 +-- docs/modelcontextprotocol-io/quickstart.mdx | 4 +++ docs/reference/cli/commands.md | 30 ++++++++++++++----- 5 files changed, 45 insertions(+), 17 deletions(-) diff --git a/cmd/publisher/README.md b/cmd/publisher/README.md index 235d189..3a5a792 100644 --- a/cmd/publisher/README.md +++ b/cmd/publisher/README.md @@ -14,9 +14,12 @@ make publisher make dev-compose # Start local registry ./bin/mcp-publisher init ./bin/mcp-publisher login none --registry=http://localhost:8080 -./bin/mcp-publisher publish --registry=http://localhost:8080 +./bin/mcp-publisher publish ``` +`publish` takes the registry URL from the token saved by `login`, so it accepts no `--registry` +flag — passing one would be read as the `server.json` path. + ## Architecture ### Commands @@ -24,6 +27,7 @@ make dev-compose # Start local registry - **`login`** - Handle authentication (github, dns, http, none) - **`publish`** - Validate and upload servers to registry - **`status`** - Update server lifecycle status (active, deprecated, deleted) +- **`validate`** - Validate server.json without publishing - **`logout`** - Clear stored credentials ### Authentication Providers diff --git a/cmd/publisher/main.go b/cmd/publisher/main.go index 20cea2b..8f7de09 100644 --- a/cmd/publisher/main.go +++ b/cmd/publisher/main.go @@ -27,10 +27,12 @@ func main() { os.Exit(1) } - // Check for help flag for subcommands + // Check for help flag for subcommands. Commands without an entry in + // printCommandHelp handle --help themselves, so fall through to dispatch. if len(os.Args) >= 3 && (os.Args[2] == "--help" || os.Args[2] == "-h") { - printCommandHelp(os.Args[1]) - return + if printCommandHelp(os.Args[1]) { + return + } } var err error @@ -81,7 +83,10 @@ func printUsage() { _, _ = fmt.Fprintln(os.Stdout, "Use 'mcp-publisher --help' for more information about a command.") } -func printCommandHelp(command string) { +// printCommandHelp prints help for a specific command and reports whether it had +// an entry here. Commands without one parse --help themselves, so the caller +// should fall through to normal dispatch when this returns false. +func printCommandHelp(command string) bool { switch command { case "init": _, _ = fmt.Fprintln(os.Stdout, "Create a server.json file template") @@ -165,7 +170,8 @@ func printCommandHelp(command string) { _, _ = fmt.Fprintln(os.Stdout, "You must be logged in before updating status. Run 'mcp-publisher login' first.") default: - fmt.Fprintf(os.Stderr, "Unknown command: %s\n", command) - printUsage() + return false } + + return true } diff --git a/docs/modelcontextprotocol-io/authentication.mdx b/docs/modelcontextprotocol-io/authentication.mdx index 9812fcc..59d7218 100644 --- a/docs/modelcontextprotocol-io/authentication.mdx +++ b/docs/modelcontextprotocol-io/authentication.mdx @@ -174,7 +174,7 @@ mcp-publisher login dns --domain "${MY_DOMAIN}" --private-key "${PRIVATE_KEY}" MY_DOMAIN="example.com" PRIVATE_KEY="$(openssl ec -in key.pem -noout -text | grep -A4 "priv:" | tail -n +2 | tr -d ' :\n')" -mcp-publisher login dns --domain "${MY_DOMAIN}" --private-key "${PRIVATE_KEY}" +mcp-publisher login dns --algorithm ecdsap384 --domain "${MY_DOMAIN}" --private-key "${PRIVATE_KEY}" ``` ```bash Google KMS @@ -298,7 +298,7 @@ mcp-publisher login http --domain "${MY_DOMAIN}" --private-key "${PRIVATE_KEY}" ```bash ECDSA P-384 MY_DOMAIN="example.com" PRIVATE_KEY="$(openssl ec -in key.pem -noout -text | grep -A4 "priv:" | tail -n +2 | tr -d ' :\n')" -mcp-publisher login http --domain "${MY_DOMAIN}" --private-key "${PRIVATE_KEY}" +mcp-publisher login http --algorithm ecdsap384 --domain "${MY_DOMAIN}" --private-key "${PRIVATE_KEY}" ``` ```bash Google KMS diff --git a/docs/modelcontextprotocol-io/quickstart.mdx b/docs/modelcontextprotocol-io/quickstart.mdx index 41bc8fc..6988689 100644 --- a/docs/modelcontextprotocol-io/quickstart.mdx +++ b/docs/modelcontextprotocol-io/quickstart.mdx @@ -135,6 +135,10 @@ Commands: login Authenticate with the registry logout Clear saved authentication publish Publish server.json to the registry + status Update the status of a server version + validate Validate server.json without publishing + +Use 'mcp-publisher --help' for more information about a command. ``` ## Step 4: Create `server.json` diff --git a/docs/reference/cli/commands.md b/docs/reference/cli/commands.md index e077019..c8d7615 100644 --- a/docs/reference/cli/commands.md +++ b/docs/reference/cli/commands.md @@ -16,7 +16,10 @@ $ brew install mcp-publisher All commands support: - `--help`, `-h` - Show command help -- `--registry` - Registry URL (default: `https://registry.modelcontextprotocol.io`) + +`--registry` is a flag on `login` only (default: `https://registry.modelcontextprotocol.io`). The +other commands read the registry URL from the stored login token, so passing `--registry` to +`publish` would be interpreted as the `server.json` path. ## Commands @@ -26,14 +29,14 @@ Generate a `server.json` template with automatic detection. **Usage:** ```bash -mcp-publisher init [options] +mcp-publisher init ``` **Behavior:** - Creates `server.json` in current directory - Auto-detects package managers (`package.json`, `setup.py`, etc.) - Pre-fills fields where possible -- Prompts for missing required fields +- Writes `TODO:` placeholders for fields it cannot detect — it is non-interactive and takes no flags **Example output:** ```json @@ -59,10 +62,13 @@ Authenticate with the registry. #### GitHub Interactive ```bash -mcp-publisher login github [--registry=URL] +mcp-publisher login github [--token=PAT] [--registry=URL] ``` - Opens browser for GitHub OAuth flow - Grants access to `io.github.{username}/*` and `io.github.{org}/*` namespaces +- `--token` supplies a GitHub Personal Access Token instead of the interactive flow, which is how + [publishing from GitHub Actions](../../modelcontextprotocol-io/github-actions.mdx) authenticates + without a browser. This flag is accepted by `login github` only. #### GitHub OIDC (CI/CD) ```bash @@ -83,12 +89,13 @@ Also see [the guide to publishing from GitHub Actions](../../modelcontextprotoco #### DNS Verification ```bash -mcp-publisher login dns --domain=example.com --private-key=HEX_KEY [--registry=URL] +mcp-publisher login dns --domain=example.com --private-key=HEX_KEY [--algorithm=ed25519|ecdsap384] [--registry=URL] ``` - Verifies domain ownership via DNS TXT record - Grants access to `com.example.*` namespaces - Requires Ed25519 private key (64-character hex) or ECDSA P-384 private key (96-character hex) - - The private key can be stored in a cloud signing provider like Google KMS or Azure Key Vault. + - `--algorithm` defaults to `ed25519`. **For an ECDSA P-384 key you must pass `--algorithm ecdsap384`**, otherwise the key is rejected with `invalid seed length: expected 32 bytes, got 48`. + - The private key can be stored in a cloud signing provider like Google KMS or Azure Key Vault. Cloud providers derive the algorithm from the key itself, so `--algorithm` does not apply to them. **Setup:** (for Ed25519, recommended) ```bash @@ -118,6 +125,9 @@ openssl ec -in key.pem -text -noout -conv_form compressed | grep -A4 "pub:" | ta # Extract private key for login openssl ec -in -noout -text | grep -A4 "priv:" | tail -n +2 | tr -d ' :\n' + +# Log in, selecting the ECDSA P-384 algorithm explicitly +mcp-publisher login dns --algorithm ecdsap384 --domain=example.com --private-key=HEX_KEY ``` **Setup:** (for Google KMS signing) @@ -178,12 +188,13 @@ mcp-publisher login dns azure-key-vault --domain=example.com --vault MyKeyVault #### HTTP Verification ```bash -mcp-publisher login http --domain=example.com --private-key=HEX_KEY [--registry=URL] +mcp-publisher login http --domain=example.com --private-key=HEX_KEY [--algorithm=ed25519|ecdsap384] [--registry=URL] ``` - Verifies domain ownership via HTTPS endpoint - Grants access to `com.example.*` namespaces - Requires Ed25519 private key (64-character hex) or ECDSA P-384 private key (96-character hex) - - The private key can be stored in a cloud signing provider like Google KMS or Azure Key Vault. + - `--algorithm` defaults to `ed25519`. **For an ECDSA P-384 key you must pass `--algorithm ecdsap384`**. + - The private key can be stored in a cloud signing provider like Google KMS or Azure Key Vault. Cloud providers derive the algorithm from the key itself, so `--algorithm` does not apply to them. **Setup:** (for Ed25519, recommended) ```bash @@ -203,6 +214,9 @@ openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:secp384r1 -out key.pem # Host public key at: # https://example.com/.well-known/mcp-registry-auth # Content: v=MCPv1; k=ecdsap384; p=PUBLIC_KEY + +# Log in, selecting the ECDSA P-384 algorithm explicitly +mcp-publisher login http --algorithm ecdsap384 --domain=example.com --private-key=HEX_KEY ``` Cloud signing is also supported for HTTP authentication, similar to the DNS examples above. Just swap out the `dns` positional argument for `http`. From 988b078e0241ae04b20922c01659a8224b11b92a Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Mon, 10 Aug 2026 16:25:56 +0300 Subject: [PATCH 07/36] docs(deploy): correct config parameter names in deploy README (#1521) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The deploy configuration table named two parameters that **no code reads**, and omitted two that a deploy cannot succeed without. ## Wrong names | Documented | Actual | Evidence | |---|---|---| | `gcpProjectId` | `gcp:project` | [provider.go:30](https://github.com/modelcontextprotocol/registry/blob/main/deploy/pkg/providers/gcp/provider.go#L30) — its error text literally says `Set gcp:project` | | `gcpRegion` | `gcp:region` | [provider.go:36](https://github.com/modelcontextprotocol/registry/blob/main/deploy/pkg/providers/gcp/provider.go#L36), default `us-central1` | `gcpProjectId` and `gcpRegion` appear **nowhere** in `deploy/` outside this table. All three stack files (`Pulumi.gcpProd.yaml`, `Pulumi.gcpStaging.yaml`, `Pulumi.local.yaml`) already use `gcp:project`. ## Missing required secrets Both are `RequireSecret`, so a deploy fails outright without them — yet neither was in the table: - `mcp-registry:jwtPrivateKey` — [registry.go:56](https://github.com/modelcontextprotocol/registry/blob/main/deploy/pkg/k8s/registry.go#L56) - `mcp-registry:googleOauthClientSecret` — [monitoring.go:463](https://github.com/modelcontextprotocol/registry/blob/main/deploy/pkg/k8s/monitoring.go#L463) ## Also - Documents `gcp:credentials` (read at [provider.go:42](https://github.com/modelcontextprotocol/registry/blob/main/deploy/pkg/providers/gcp/provider.go#L42), set in the staging and prod stacks) - Marks which values are secrets - **Adds the namespace prefixes.** The table listed bare names, which is part of why the two wrong ones survived: `gcpProjectId` reads as plausible right up until you notice the real key lives in a different config namespace altogether. ## Verification Checked both directions: - every key now in the table is read by code in `deploy/` (reference counts confirmed per key) - every `conf.*("...")` key found anywhere in `deploy/` now appears in the table 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5 --- deploy/README.md | 19 ++++++++++++------- 1 file changed, 12 insertions(+), 7 deletions(-) diff --git a/deploy/README.md b/deploy/README.md index 392b244..7b407e7 100644 --- a/deploy/README.md +++ b/deploy/README.md @@ -147,15 +147,20 @@ Pre-requisites: ## Configuration +Configuration keys are namespaced. Set them with `pulumi config set [--secret]`. + | Parameter | Description | Required | |-----------|-------------|----------| -| `environment` | Deployment environment (local/staging/prod) | Yes | -| `provider` | Kubernetes provider (local/gcp) | No (default: local) | -| `githubClientId` | GitHub OAuth Client ID | Yes | -| `githubClientSecret` | GitHub OAuth Client Secret | Yes | -| `imageTag` | Docker image tag for production environment | Yes (prod only) | -| `gcpProjectId` | GCP Project ID (required when provider=gcp) | No | -| `gcpRegion` | GCP Region (default: us-central1) | No | +| `mcp-registry:environment` | Deployment environment (local/staging/prod) | Yes | +| `mcp-registry:provider` | Kubernetes provider (local/gcp) | No (default: local) | +| `mcp-registry:githubClientId` | GitHub OAuth Client ID | Yes | +| `mcp-registry:githubClientSecret` | GitHub OAuth Client Secret | Yes (secret) | +| `mcp-registry:jwtPrivateKey` | Ed25519 seed used to sign registry JWTs | Yes (secret) | +| `mcp-registry:googleOauthClientSecret` | Google OAuth client secret for Grafana login | Yes (secret) | +| `mcp-registry:imageTag` | Docker image tag for production environment | Yes (prod only) | +| `gcp:project` | GCP Project ID | Yes when `provider=gcp` | +| `gcp:region` | GCP Region | No (default: us-central1) | +| `gcp:credentials` | GCP service account credentials JSON | No (secret; set in staging/prod) | ## Database Backups From 3e463e52bbd17167f1b5bff1ba49c3259bd7ed0f Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Mon, 10 Aug 2026 16:32:25 +0300 Subject: [PATCH 08/36] docs: correct contributor prerequisites and stale dev-env references (#1520) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The README prerequisites were both stale, and the docs restated the Go version in three places. ## Prerequisites: name the source, do not restate the version | README said | Reality | |---|---| | `Go 1.24.x` | `go 1.26` in [go.mod](https://github.com/modelcontextprotocol/registry/blob/main/go.mod) | | `golangci-lint v2.4.0` | `v2.11.4` pinned in [ci.yml:30](https://github.com/modelcontextprotocol/registry/blob/main/.github/workflows/ci.yml#L30) | Rather than swap in fresher numbers — which only resets the clock on the same drift — this **removes the numbers** and names the authoritative file: ``` - **Go** - version per the `go` directive in go.mod; the Go toolchain fetches it for you - **golangci-lint** - version per the `golangci-lint-action` pin in ci.yml, so local lint matches CI ``` The Go version was stated in **three** places, which is exactly why all three drifted together. All three now point at a single source, so the prerequisites list cannot go stale. Two notes on why the numbers earn so little in prose: - **Go corrects itself.** `go.mod` has no `toolchain` directive, so under the default `GOTOOLCHAIN=auto` the toolchain downloads the required version automatically. A contributor on an older Go gets an upgrade, not a failure — it only hard-errors under `GOTOOLCHAIN=local`. (An earlier version of this description said such a contributor "cannot build"; that was too strong.) - **golangci-lint does not.** Version skew here genuinely changes what you see: running CI's config under a newer golangci-lint (2.12.2) surfaces 23 `goconst` findings in `cmd/publisher/commands/validate_test.go` that CI's pinned 2.11.4 does not report. That is why the README now points at the pin rather than a number someone has to keep in sync. ## `make check` does more than documented Documented in three files as "lint, unit tests and integration tests". Actually [`check: dev-down lint validate test-all`](https://github.com/modelcontextprotocol/registry/blob/main/Makefile#L85) — it also runs schema validation and **stops your running `dev-compose` environment**. Worth knowing before running it mid-session. The Makefile's own `##` help string already said this correctly; only the prose was stale. ## Other verified corrections - **README project structure** omitted `cmd/registry/` — the server entry point and ko/goreleaser build target — and `internal/importer/`. - **`tests/integration/README.md`** said the suite launches **MongoDB**. It launches PostgreSQL (`postgres-integration-test`), as the same file admits nine lines later. It also cited `/v0/servers/{server_id}`, a path removed a while ago; the test actually calls `GET /v0/servers` and `GET /v0/servers/{serverName}/versions/latest` ([main.go:210,255](https://github.com/modelcontextprotocol/registry/blob/main/tests/integration/main.go#L210)). - **`scripts/mirror_data/README.md`** pointed at `internal/database/migrations/008_separate_official_metadata.sql`, which does not exist — that migration is `009_`, while `008_` is `clean_invalid_data.sql`. (Migration 008's own header still calls itself "007a", which is how the numbering slipped.) Also swapped two "edit line NN" pointers for identifier names, since both had already drifted (`maxMigration` is at :30 not :24; the connection string at :23 not :17), and corrected the fetch URL from `/v0.1/servers` to the `/v0/servers` the script actually requests. - **`.env.example`** was missing `MCP_REGISTRY_ENABLE_REGISTRY_VALIDATION`, even though the config reads it ([config.go:18](https://github.com/modelcontextprotocol/registry/blob/main/internal/config/config.go#L18)) and README:50 tells contributors to set it while pointing at `.env.example` as *the* reference. - **`docker-compose.yml`** set `MCP_REGISTRY_ENVIRONMENT`, which nothing reads — no `ENVIRONMENT` env tag in `internal/config`, and no other occurrence in the repo. Removed. (The Pulumi-side `mcp-registry:environment` key is a separate, real thing and is untouched.) - **Deleted `CHANGES.md`** — 0 bytes, untouched since the squashed history base, zero references anywhere. ## Verification `docker compose config` validates. `grep` for `Go 1.x` / `golangci-lint vX` across all `.md`/`.mdx` now returns nothing outside `complete.md` (which #1522 deletes). Both `../../README.md#pre-requisites` links resolve and the anchor matches the real `#### Pre-requisites` heading. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5 --- .env.example | 5 +++++ .github/copilot-instructions.md | 2 +- CHANGES.md | 0 CONTRIBUTING.md | 3 ++- README.md | 11 +++++++---- docker-compose.yml | 1 - scripts/mirror_data/README.md | 20 ++++++++++---------- tests/integration/README.md | 6 +++--- 8 files changed, 28 insertions(+), 20 deletions(-) delete mode 100644 CHANGES.md diff --git a/.env.example b/.env.example index 786fc1b..6deabd0 100644 --- a/.env.example +++ b/.env.example @@ -11,6 +11,11 @@ MCP_REGISTRY_DATABASE_URL=postgres://username:password@localhost:5432/mcp-regist # For offline development, use: data/seed.json MCP_REGISTRY_SEED_FROM=https://registry.modelcontextprotocol.io/v0/servers +# Validate seed data against the registry rules on import (default: true) +# Set to false for offline development when seeding from a local file, since +# data/seed.json is not guaranteed to pass validation +MCP_REGISTRY_ENABLE_REGISTRY_VALIDATION=true + # GitHub OAuth configuration # These creds are for local development with the 'MCP Registry Login (Local)' GitHub App # They don't provide any real privileged access, hence why it's okay that they're here diff --git a/.github/copilot-instructions.md b/.github/copilot-instructions.md index b37dd38..e373661 100644 --- a/.github/copilot-instructions.md +++ b/.github/copilot-instructions.md @@ -9,5 +9,5 @@ To publish an MCP server to the registry, use the `mcp-publisher` CLI tool. See ## Development - Use `make` targets where possible (run `make help` to see available targets) -- Run `make check` to run lint, unit tests, and integration tests +- Run `make check` to run lint, schema validation, and all tests (this also stops any running dev-compose environment) - Run `make dev-compose` to start the local development environment \ No newline at end of file diff --git a/CHANGES.md b/CHANGES.md deleted file mode 100644 index e69de29..0000000 diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index a5a42cb..7a1e1b5 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -32,7 +32,8 @@ See the [README](README.md#quick-start) for prerequisites and instructions on ru ### Running checks ```bash -# Run lint, unit tests and integration tests +# Run lint, schema validation, and all tests +# Note: this also runs `make dev-down`, stopping any running dev-compose environment make check ``` diff --git a/README.md b/README.md index 5424e0d..8178365 100644 --- a/README.md +++ b/README.md @@ -32,9 +32,9 @@ Often (but not always) ideas flow through this pipeline: #### Pre-requisites - **Docker** -- **Go 1.24.x** +- **Go** - version per the `go` directive in [go.mod](./go.mod); the Go toolchain fetches it for you - **ko** - Container image builder for Go ([installation instructions](https://ko.build/install/)) -- **golangci-lint v2.4.0** +- **golangci-lint** - version per the `golangci-lint-action` pin in [ci.yml](./.github/workflows/ci.yml), so local lint matches CI #### Running the server @@ -94,7 +94,8 @@ See [the publisher guide](./docs/modelcontextprotocol-io/quickstart.mdx) for mor #### Other commands ```bash -# Run lint, unit tests and integration tests +# Run lint, schema validation, and all tests +# Note: this also runs `make dev-down`, stopping any running dev-compose environment make check ``` @@ -110,7 +111,8 @@ For Claude and other AI tools: Always prefer make targets over custom commands w ``` ├── cmd/ # Application entry points -│ └── publisher/ # Server publishing tool +│ ├── publisher/ # Server publishing tool +│ └── registry/ # Registry API server ├── data/ # Seed data ├── deploy/ # Deployment configuration (Pulumi) ├── docs/ # Documentation @@ -119,6 +121,7 @@ For Claude and other AI tools: Always prefer make targets over custom commands w │ ├── auth/ # Authentication (GitHub OAuth, JWT, namespace blocking) │ ├── config/ # Configuration management │ ├── database/ # Data persistence (PostgreSQL) +│ ├── importer/ # Seed data import │ ├── service/ # Business logic │ ├── telemetry/ # Metrics and monitoring │ └── validators/ # Input validation diff --git a/docker-compose.yml b/docker-compose.yml index 7eb71c2..3fff7bc 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -10,7 +10,6 @@ services: # See .env.example for more documentation environment: - MCP_REGISTRY_DATABASE_URL=${MCP_REGISTRY_DATABASE_URL:-postgres://mcpregistry:mcpregistry@postgres:5432/mcp-registry} - - MCP_REGISTRY_ENVIRONMENT=${MCP_REGISTRY_ENVIRONMENT:-test} - MCP_REGISTRY_GITHUB_CLIENT_ID=${MCP_REGISTRY_GITHUB_CLIENT_ID:-Iv23licy3GSiM9Km5jtd} - MCP_REGISTRY_GITHUB_CLIENT_SECRET=${MCP_REGISTRY_GITHUB_CLIENT_SECRET:-0e8db54879b02c29adef51795586f3c510a9341d} - MCP_REGISTRY_JWT_PRIVATE_KEY=${MCP_REGISTRY_JWT_PRIVATE_KEY:-8103179d8ef955f6d3de6d6217224a909ec4060529dfeb1d4ca5a994537658cd} diff --git a/scripts/mirror_data/README.md b/scripts/mirror_data/README.md index 3237211..2cc3a87 100644 --- a/scripts/mirror_data/README.md +++ b/scripts/mirror_data/README.md @@ -14,7 +14,7 @@ These scripts help you: ## Prerequisites -- Go 1.24.x +- Go — see the [prerequisites in the root README](../../README.md#pre-requisites) for the required version - PostgreSQL (via Docker or local installation) - Required Go packages: ```bash @@ -31,7 +31,7 @@ go run scripts/mirror_data/fetch_production_data.go ``` This will: -- Fetch all servers from https://registry.modelcontextprotocol.io/v0.1/servers +- Fetch all servers from https://registry.modelcontextprotocol.io/v0/servers - Handle pagination automatically - Save data to `scripts/mirror_data/production_servers.json` - Be respectful to the API with rate limiting @@ -71,7 +71,7 @@ This will: 4. Analyze the data and report statistics 5. Show sample servers with NULL status values -To test a different migration, edit `maxMigration` in the script (line 24) +To test a different migration, edit `maxMigration` in `load_production_data.go` ### 4. Test Migrations @@ -80,8 +80,8 @@ After loading the data, you can test migrations against real production data. #### Testing a Single Migration ```bash -# Test migration 008 -cat internal/database/migrations/008_separate_official_metadata.sql | \ +# Test the separate_official_metadata migration +cat internal/database/migrations/009_separate_official_metadata.sql | \ docker exec -i test-postgres psql -U postgres -d registry_test ``` @@ -90,7 +90,7 @@ cat internal/database/migrations/008_separate_official_metadata.sql | \ 1. **Check the error output:** ```bash # Run migration and capture all output -cat internal/database/migrations/008_separate_official_metadata.sql | \ +cat internal/database/migrations/009_separate_official_metadata.sql | \ docker exec -i test-postgres psql -U postgres -d registry_test 2>&1 | \ grep -E "(ERROR|NOTICE|WARNING)" ``` @@ -126,7 +126,7 @@ EOF # Start a transaction to test and rollback docker exec test-postgres psql -U postgres -d registry_test < Date: Mon, 10 Aug 2026 16:32:37 +0300 Subject: [PATCH 09/36] docs: remove stale complete.md and fix remaining stale references (#1522) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Deletes `complete.md` and cleans up the last references to the pre-restructuring docs layout. ## Why `complete.md` goes It is 2,944 lines (31% of all documentation lines in the repo) self-described as *"all documentation from the docs/ directory compiled into a single markdown file"*. But: - **No generator exists.** No make target, no workflow, no script. `grep -rn "complete\.md"` finds **zero** references anywhere in the repo. - **It mirrors a docs tree that no longer exists** — `docs/guides/`, `docs/explanations/`, `docs/concepts/`. - **All 72 of its relative links are broken**, and six of the basenames it references exist nowhere in the repo. - **~14 current docs are missing from it entirely** (`about.mdx`, `authentication.mdx`, `package-types.mdx`, both CHANGELOGs, ...). - **Its `server.json` examples pin the superseded `2025-07-09` schema** (current is `2025-12-11`). The strongest argument is its own last commit. [PR #1278](https://github.com/modelcontextprotocol/registry/pull/1278) closed [issue #767](https://github.com/modelcontextprotocol/registry/issues/767) — a real user-reported CLI flag bug — by editing **only `complete.md`**. A genuine fix landed in a file nobody reads, while the docs a reader would actually find stayed wrong. A generated file with no generator degrades into a trap: authoritative enough that people edit it, with nothing validating it. If the LLM-consumption use case is worth keeping, the right shape is a `make docs-bundle` target plus a `check-docs-bundle` CI job mirroring the existing `check-schema` pattern — happy to do that instead if you would rather keep it. ## Remaining stale references | File | Was | Now | |---|---|---| | `contributing/add-package-registry.md` | Add `docs/guides/publishing/publish-[yourregistry].md`, update `docs/guides/publishing/README.md` | Add a section to `package-types.mdx`. These were the **last live references** to the obsolete `docs/guides/` layout outside `complete.md` | | `administration/maintainer-onboarding.md` | Add them to "Current key maintainers" in README | "Registry Working Group" — the section that actually exists | | `reference/README.md` | Omitted 6 reference docs | Adds `api/extensions.md`, `api/openapi.yaml`, `api/CHANGELOG.md`, `server-json/CHANGELOG.md`, `server-json/CONTRIBUTING.md`, `server-json/draft/` | | `docs/README.md` | Index omitted `community-projects.md` | Listed | | `reference/api/generic-registry-api.md` | `PUT .../versions/{version}` "not implemented by official registry" | It **is** implemented ([edit.go:36](https://github.com/modelcontextprotocol/registry/blob/main/internal/api/handlers/v0/edit.go#L36)), and `official-registry-api.md` already lists it as an admin endpoint | | `reference/api/official-registry-api.md` | Omitted 3 registered routes | Adds `POST /v0.1/validate` (which `mcp-publisher validate` calls), `GET /v0.1/ping`, `GET /v0.1/version`, and notes these plus `/health` are absent from `openapi.yaml` | | `server-json/official-registry-requirements.md` | Per-registry verification → `quickstart.mdx` | → `package-types.mdx`, which has an Ownership Verification section per registry | | `design/design-principles.md` | Sections 1,2,3,4,**6**,7 | Renumbered 1–6 | | `contributing/releasing.md` | Steps 1,2,3,**5**,6 | Renumbered 1–5 | I left the sibling `DELETE` claim in `generic-registry-api.md` alone — it is accurate, no DELETE route is registered (the `http.MethodDelete` hit in `server.go` is CORS config, not a route). ## Staleness banners rather than rewrites **`design/tech-architecture.md`** is substantially fictional. Rather than a vague "may be outdated", the banner lists what I verified is wrong: - Describes Helm-chart deployment; the registry is a plain `Deployment` ([registry.go:65](https://github.com/modelcontextprotocol/registry/blob/main/deploy/pkg/k8s/registry.go#L65)). Helm is used only for third-party components. - Diagram shows a `StatefulSet` on port **27017** — MongoDB's port. The DB is PostgreSQL on 5432 via the CloudNativePG operator. - Documents a `verify-domain` challenge flow (`POST /verify-domain`, `/verify-domain/check`, server-issued tokens) that **was never built**. - Documents `/admin/*` routes that are not registered. - Says the DB stores user auth state and DNS verification records; only `servers` and `server_extensions` tables exist. **`design/roadmap.md`** still says "Phase 1: MVP/Go-Live (Current Focus)" ~11 months after launch. I added a dated note rather than inventing a current phase — that is a working-group call. ## Verification All **101** remaining relative links across every `.md`/`.mdx` in the repo resolve. The only two non-resolving matches are the intentional `[project-name](link)` template placeholder and the moderation link fixed in #1518. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5 --- complete.md | 2945 ----------------- docs/README.md | 1 + docs/administration/maintainer-onboarding.md | 2 +- docs/contributing/add-package-registry.md | 5 +- docs/contributing/releasing.md | 4 +- docs/design/design-principles.md | 4 +- docs/design/roadmap.md | 8 +- docs/design/tech-architecture.md | 21 + docs/reference/README.md | 6 + docs/reference/api/generic-registry-api.md | 2 +- docs/reference/api/official-registry-api.md | 10 + .../official-registry-requirements.md | 2 +- 12 files changed, 54 insertions(+), 2956 deletions(-) delete mode 100644 complete.md diff --git a/complete.md b/complete.md deleted file mode 100644 index e9040fa..0000000 --- a/complete.md +++ /dev/null @@ -1,2945 +0,0 @@ -# Complete Documentation - -This file contains all documentation from the docs/ directory compiled into a single markdown file. - ---- - -## File: docs/README.md - -# MCP Registry Documentation - -The MCP registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. - -## I want to... - -- **📤 Publish my MCP server** → [Publishing Guide](guides/publishing/publish-server.md) -- **📥 Consume registry data** → [API Usage Guide](guides/consuming/use-rest-api.md) -- **🔌 Understand the registry's purpose** → [Ecosystem vision](explanations/ecosystem-vision.md) -- **📋 Look up specific information** → [server.json spec](reference/server-json/generic-server-json.md) | [API spec](reference/api/generic-registry-api.md) | [CLI reference](reference/cli/commands.md) - -## Documentation Index - -- 🛠️ [How-To Guides: Task-focused instructions](./guides/) -- 💡 [Explanations: Understanding-oriented content](./explanations/) -- 📖 [Reference: Technical specifications and lookup material](./reference/) - ---- - -## File: docs/explanations/README.md - -# Explanations - -Understanding-oriented documentation that clarifies and illuminates the MCP Registry. - -- [Design principles](design-principles.md) -- [Ecosystem vision](ecosystem-vision.md) -- [Roadmap](roadmap.md) -- [Tech architecture](tech-architecture.md) -- [Namespacing](namespacing.md) -- [Versioning](versioning.md) - ---- - -## File: docs/explanations/design-principles.md - -# MCP Registry Design Principles - -These are the core constraints that guide the design of the MCP Registry. They are not exhaustive, but they are the most important principles that we will use to evaluate design decisions. - -## 1. Single Source of Truth - -The registry serves as the authoritative metadata repository for publicly-available MCP servers, both locally-run and remote, open source and closed source. Server creators publish once, and all consumers (MCP clients, aggregators, etc.) reference the same canonical data. - -## 2. Minimal Operational Burden - -- Design for low maintenance and operational overhead -- Delegate complexity to existing services where possible (GitHub for auth, npm/PyPI/NuGet for packages) -- Avoid features that require constant human intervention or moderation -- Build for reasonable downtime tolerance (24h acceptable) by having consumers cache data for their end-users - -## 3. Vendor Neutrality - -- No preferential treatment for specific servers or organizations -- No built-in ranking, curation, or quality judgments -- Let consumers (MCP clients, aggregators) make their own curation decisions - -## 4. Meets Industry Security Standards - -- Leverage existing package registries (npm, PyPI, NuGet, Docker Hub, etc.) for source code distribution, obviating the need to reinvent source code security -- Use mechanisms like DNS verification, OAuth to provide base layer of authentication and trust -- Implement rate limiting, field validation, and blacklisting to prevent abuse - -## 6. Reusable, Extensible Shapes; Not Infrastructure - -- API shapes (OpenAPI, server.json) designed for reuse -- Enable private/internal registries using same formats -- Don't mandate infrastructure reuse - focus on interface compatibility - -## 7. Progressive Enhancement - -- Start with MVP that provides immediate value -- Build foundation that supports future features -- Don't over-engineer for hypothetical needs -- Each milestone should be independently valuable - ---- - -## File: docs/explanations/ecosystem-vision.md - -# Ecosystem Vision - -How the MCP Registry fits into the broader ecosystem and our vision for the future. - -## The Registry Ecosystem - -The MCP registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. (In the future it might do more, like also hosting a list of clients). - -There are two parts to the registry project: - -1. 🟦 **The MCP registry spec**: An [API specification](../reference/api/) that allows anyone to implement a registry. -2. 🟥 **The Official MCP registry**: A hosted registry following the MCP registry spec at [`registry.modelcontextprotocol.io`](https://registry.modelcontextprotocol.io). This serves as the **authoritative repository** for publicly-available MCP servers. Server creators publish once, and all consumers (MCP clients, aggregators, marketplaces) reference the same canonical data. This is owned by the MCP open-source community, backed by major trusted contributors to the MCP ecosystem such as Anthropic, GitHub, PulseMCP and Microsoft. - -The registry is built around the [`server.json`](../reference/server-json/) format - a standardized way to describe MCP servers that works across discovery, initialization, and packaging scenarios. - -In time, we expect the ecosystem to look a bit like this: - -![](./ecosystem-diagram.excalidraw.svg) - -Note that MCP registries are _metaregistries_. They host metadata about packages, but not the package code or binaries. Instead, they reference other package registries (like NPM, PyPi or Docker) for this. - -Additionally, we expect clients pull from _subregistries_. These subregistries add value to the registry ecosystem by providing curation, or extending it with additional metadata. The Official MCP registry expects a lot of API requests from ETL jobs from these subregistries. - -## Registry vs Package Registry - -Key distinction: MCP Registries are **metaregistries**. - -- **Package registries** (npm, PyPI, Docker Hub) host actual code/binaries -- **The MCP Registry** hosts metadata pointing to those packages - -``` -MCP Registry: "weather-server v1.2.0 is at npm:weather-mcp" -NPM Registry: [actual weather-mcp package code] -``` - -## Official vs Community Registries - -**Official MCP Registry** (`registry.modelcontextprotocol.io`): -- Canonical source for publicly-available servers -- Community-owned, backed by trusted contributors -- Focuses on discoverability and basic metadata - -**Subregistries** (Smithery, PulseMCP, etc.): -- Add value through curation, ratings, enhanced metadata -- ETL from official registry + additional annotations -- Serve specific communities or use cases - -## How Servers Are Represented - -Each server entry contains: -- **Identity**: Unique name (`io.github.user/server-name`) -- **Packages**: Where to download it (`npm`, `pypi`, `docker`, etc.) -- **Runtime**: How to execute it (args, env vars) -- **Metadata**: Description, capabilities, version - -This is stored in a standardized `server.json` format that works across discovery, installation, and execution. - ---- - -## File: docs/explanations/roadmap.md - -# MCP Registry Roadmap - -This is a high-level roadmap for the MCP Registry. It is subject to change and not exhaustive, but it outlines the general thinking of the sequencing and scope of our work in this repository. - -This roadmap may occasionally drift out of date. Please review [Issues](https://github.com/modelcontextprotocol/registry/issues) (and corresponding Labels) for the most current work in progress. - -## Current Status - -The initial version of the MCP Registry is actively being developed. The initial focus is on delivering a REST API to which server creators can publish, and aggregator/marketplace consumers can ETL. - -## Phase 1: MVP/Go-Live (Current Focus) - -See the [go-live blocker issues](https://github.com/modelcontextprotocol/registry/issues?q=is%3Aissue%20state%3Aopen%20label%3A%22go-live%20blocker%22). - -## Backlog (Future Work, may be moved to out of scope) - -- [ ] UI implementation -- [ ] Store and surface other data besides servers (e.g. [clients](https://modelcontextprotocol.io/clients), resources) -- [ ] Download count tracking -- [ ] Internationalization (i18n) - -## Out of Scope (Not Planned) - -- **Source code hosting**: The registry will never host actual server code -- **Quality rankings**: No built-in server quality assessments or rankings -- **Curation**: No editorial decisions about which servers are "better" -- **Unified runtime**: Not solving how servers are executed -- **Server hosting**: The registry does not provide hosting for servers -- **Search engine**: The registry will not provide a commercial grade search engine for servers -- **Server tags or categories**: Not supported, to reduce moderation burden -- **Server rankings**: The registry will not rank servers by subjective measures of quality - ---- - -## File: docs/explanations/tech-architecture.md - -# MCP Registry Technical Architecture - -This document describes the technical architecture of the MCP Registry, including system components, deployment strategies, and data flows. - -## System Overview - -The MCP Registry is designed as a lightweight metadata service that bridges MCP server creators with consumers (MCP clients and aggregators). - -## Core Components - -### REST API (Go) - -The main application server implemented in Go, providing: -- Public read endpoints for server discovery -- Authenticated write endpoints for server publication -- GitHub OAuth integration (extensible to other providers) -- DNS verification system (optional for custom namespaces) - -### Database (PostgreSQL) - -Primary data store for: -- Versioned server metadata (server.json contents) -- User authentication state -- DNS verification records - -### CDN Layer - -Critical for scalability: -- Caches all public read endpoints -- Reduces load on origin servers -- Enables global distribution -- Designed for daily consumer polling patterns - -### CLI Tool - -Developer interface for: -- Server publication workflow -- GitHub OAuth flow -- DNS verification - -## Deployment Architecture - -### Kubernetes Deployment (Helm) - -The registry is designed to run on Kubernetes using Helm charts: - -```mermaid -graph TB - subgraph "Kubernetes Cluster" - subgraph "Namespace: mcp-registry" - subgraph "Registry Service" - LB[Load Balancer
:80] - RS[Registry Service
:8080] - RP1[Registry Pod 1] - RP2[Registry Pod 2] - RP3[Registry Pod N] - end - - subgraph "Database Service" - DBS[DB Service
:27017] - SS[StatefulSet] - PV[Persistent Volume] - end - - subgraph "Secrets" - GHS[GitHub OAuth Secret] - end - end - end - - LB --> RS - RS --> RP1 - RS --> RP2 - RS --> RP3 - RP1 --> DBS - RP2 --> DBS - RP3 --> DBS - DBS --> SS - SS --> PV - RP1 -.-> GHS - RP2 -.-> GHS - RP3 -.-> GHS -``` - -## Data Flow Patterns - -### 1. Server Publication Flow - -```mermaid -sequenceDiagram - participant Dev as Developer - participant CLI as CLI Tool - participant API as Registry API - participant DB as Database - participant GH as GitHub - participant DNS as DNS Provider - - Dev->>CLI: mcp publish server.json - CLI->>CLI: Validate server.json - CLI->>GH: OAuth flow - GH-->>CLI: Access token - CLI->>API: POST /servers - API->>GH: Verify token - API->>DNS: Verify domain (if applicable) - API->>DB: Store metadata - API-->>CLI: Success - CLI-->>Dev: Published! -``` - -### 2. Consumer Discovery Flow - -```mermaid -sequenceDiagram - participant Client as MCP Client Host App - participant INT as Intermediary
(Marketplace/Aggregator) - participant CDN as CDN Cache - participant API as Registry API - participant DB as Database - - Note over INT,CDN: Daily ETL Process - INT->>CDN: GET /servers - alt Cache Hit - CDN-->>INT: Cached response - else Cache Miss - CDN->>API: GET /servers - API->>DB: Query servers - DB-->>API: Server list - API-->>CDN: Response + cache headers - CDN-->>INT: Response - end - INT->>INT: Process & enhance data - INT->>INT: Store in local cache - - Note over Client,INT: Real-time Client Access - Client->>INT: Request server list - INT-->>Client: Curated/enhanced data -``` - -### 3. DNS Verification Flow - -```mermaid -sequenceDiagram - participant User as User - participant CLI as CLI Tool - participant API as Registry API - participant DNS as DNS Provider - participant DB as Database - - User->>CLI: mcp verify-domain example.com - CLI->>API: POST /verify-domain - API->>API: Generate verification token - API->>DB: Store pending verification - API-->>CLI: TXT record: mcp-verify=abc123 - CLI-->>User: Add TXT record to DNS - User->>DNS: Configure TXT record - User->>CLI: Confirm added - CLI->>API: POST /verify-domain/check - API->>DNS: Query TXT records - DNS-->>API: TXT records - API->>API: Validate token - API->>DB: Store verification - API-->>CLI: Domain verified - CLI-->>User: Success! -``` - -### 4. Admin OIDC Authentication Flow - -For registry administration, users with @modelcontextprotocol.io Google Cloud Identity accounts can authenticate using OIDC: - -```mermaid -sequenceDiagram - participant Admin as Admin User - participant CLI as Admin CLI - participant GCP as Google Cloud Identity - participant API as Registry API - - Admin->>CLI: Request admin token - CLI->>GCP: gcloud auth print-identity-token --audiences=mcp-registry - GCP-->>CLI: ID Token (with hd: "modelcontextprotocol.io") - CLI->>API: POST /v0/auth/oidc {"oidc_token": "eyJ..."} - API->>GCP: Verify token signature (JWKS) - API->>API: Validate claims (issuer, audience, hd) - API->>API: Grant admin permissions (edit: *, publish: *) - API-->>CLI: Registry JWT Token - CLI->>API: POST /admin/* (with Registry JWT) - API->>API: Validate JWT + permissions - API-->>CLI: Admin operation success -``` - -**Usage:** -```bash -# Get Google Cloud Identity token -ID_TOKEN=$(gcloud auth print-identity-token) - -# Exchange for Registry JWT token -REGISTRY_TOKEN=$(curl -X POST /v0/auth/oidc \ - -H "Content-Type: application/json" \ - -d '{"oidc_token": "'$ID_TOKEN'"}' | jq -r .registry_token) - -# Use for admin operations -curl -H "Authorization: Bearer $REGISTRY_TOKEN" /v0/... -``` - ---- - -## File: docs/guides/README.md - -# How-To Guides - -Problem-oriented guides for specific tasks with the MCP Registry. - -## Publishing Servers - -- [Publish a server](publishing/publish-server.md) -- [GitHub Actions](publishing/github-actions.md) - -## Consuming Registry Data - -- [Use the REST API](consuming/use-rest-api.md) - -## Contributing - -- [Add package registry](contributing/add-package-registry.md) - -## Administration - -- [Admin operations](administration/admin-operations.md) -- [Moderation guidelines](administration/moderation-guidelines.md) - ---- - -## File: docs/guides/administration/admin-operations.md - -# Admin Operations - -This is a brief guide for admins and moderators managing content on the registry. All actions should be taken in line with the [moderation guidelines](moderation-guidelines.md). - -## Prerequisites - -- Admin account with @modelcontextprotocol.io email - - If you are a maintainer and would like an account, ask in the Discord -- `gcloud` CLI installed and configured -- `curl` and `jq` installed - -## Authentication - -```bash -# Run this, then run the export command it outputs -./tools/admin/auth.sh -``` - -## Edit a Server - -Step 1: Download Server - -```bash -export SERVER_ID="" -curl -s "https://registry.modelcontextprotocol.io/v0/servers/${SERVER_ID}" > server.json -``` - -Step 2: Open `server.json` and make changes. You cannot change the server name. - -Step 3: Push Changes - -```bash -curl -X PUT "https://registry.modelcontextprotocol.io/v0/servers/${SERVER_ID}" \ - -H "Authorization: Bearer ${REGISTRY_TOKEN}" \ - -H "Content-Type: application/json" \ - -d "{\"server\": $(cat server.json)}" -``` - -## Takedown a Server - -```bash -export SERVER_ID="" -./tools/admin/takedown.sh -``` - -This soft deletes the server. If you need to delete the content of a server (usually only where legally necessary), use the edit workflow above to scrub it all. - ---- - -## File: docs/guides/administration/moderation-guidelines.md - -# Moderation Guidelines - -Guidelines for server publishers on the Official MCP Registry. - -## TL;DR - -We're quite permissive! We only remove illegal content, malware, spam and completely broken servers. - -We don't make guarantees about our moderation, and subregistries should take our data "as is", assuming minimal to no moderation. - -## Scope - -These guidelines apply to the **Official MCP Registry** at `registry.modelcontextprotocol.io`. - -Subregistries may have their own moderation policies. If you have questions about content on a specific subregistry, please contact them directly. - -## Disclaimer - -We have limited active moderation capabilities, and this is a community supported projects. We largely rely on upstream package registries (like NPM, PyPi, and Docker) or downstream subregistries (like the GitHub MCP Registry) to do more in-depth moderation. - -This means there may be content in the registry that should be removed under these guidelines, which we haven't yet removed. You should treat registry data accordingly. - -## What We Remove - -We'll remove servers that contain: - -- Illegal content, which includes obscene content, copyright violations, and hacking tools -- Malware, regardless of intentions -- Spam, especially mass-created servers that disrupt the registry. Examples: - - The same server being submitted multiple times under different names. - - The server doesn't do anything but provide a fixed response with some marketing copy. - - The server description is stuffed with marketing copy, and its implementation is unrelated to its name or description. -- Non-functioning servers - -## What We Don't Remove - -Generally, we believe in keeping the registry open and pushing moderation to subregistries. We therefore **won't** remove servers that are: - -- Low quality or buggy servers -- Servers with security vulnerabilities -- Do the same thing as other servers -- Provide or contain adult content - -## How Removal Works - -When we remove a server: - -- It's set to "deleted" status but remains accessible via the API -- This allows subregistries to remove it from their indexes -- In extreme cases, we may overwrite or erase details of a server, e.g. where the metadata itself is unlawful - -## Appeals - -Think we made a mistake? Open an issue on our [GitHub repository](https://github.com/modelcontextprotocol/registry) with: -- The ID and name of your server -- Why you believe it doesn't meet the criteria for removal above - -## Changes to this policy - -We're still learning how to best run the MCP registry! As such, we might end up changing this policy in the future. - ---- - -## File: docs/guides/contributing/add-package-registry.md - -# Adding a new package registry - -The MCP Registry project is a **metaregistry**, meaning that it hosts metadata for MCP servers but does not host the code for the servers directly. - -For local MCP servers, the MCP Registry has pointers in the `packages` node of the [`server.json`](../../reference/server-json/generic-server-json.md) schema that refer to packages in supported package managers. - -The list of supported package managers for hosting MCP servers is defined by the `properties.packages[N].properties.registry_type` string enum in the [`server.json` schema](../../reference/server-json/draft/server.schema.json). For example, this could be "npm" (for npmjs.com packages) or "pypi" (for PyPI packages). - -For remote MCP servers, the package registry is not relevant. The MCP client consumes the server via a URL instead of by downloading and running a package. In other words, this document only applies to local MCP servers. - -For the sake of illustration, this document will use npm (the Node.js package manager) as an example at each step. - -## Prerequisites - -The package registry must meet the following requirements: - -1. The package registry supports packaging and executing CLI apps. Local MCP servers use the [stdio transport](https://modelcontextprotocol.io/docs/concepts/transports#standard-input%2Foutput-stdio). - - npm CLI tools typically express their CLI commands in the [`bin` property of the package.json](https://docs.npmjs.com/cli/v11/configuring-npm/package-json#bin) -1. The package registry (or associated client tooling) has a widely accepted **single-shot** CLI command. - - npm's `npx` tool executes CLI commands using a [documented execution heuristic](https://docs.npmjs.com/cli/v11/commands/npx#description) - - For example, the MCP client can map the `server.json` metadata to an `npx` CLI execution, with args and environment variables populated via user input. -1. The package registry supports anonymous package downloads. This allows the MCP client software to use the metadata found in the MCP registry to discover, download, and execute package-based local MCP servers with minimal user intervention. - - `npx` by default connects to the public npmjs.com registry, allowing simple consumption of public npm packages. -1. The package registry should support a validation mechanism to verify ownership of the server name. This prevents misattribution and ensures that only the actual package owner can reference their packages in server registrations. For example: - - npm requires an `mcpName` field in `package.json` that matches the server name being registered - - PyPI requires a `mcp-name:` line in the package README/description - - Each registry type must implement a validation mechanism accessible via public API - -## Steps - -These steps may evolve as additional validations or details are discovered and mandated. - -1. [Create a feature request issue](https://github.com/modelcontextprotocol/registry/issues/new?template=feature_request.md) on the MCP Registry repository to begin the discussion about adding the package registry. - - Example for NuGet: https://github.com/modelcontextprotocol/registry/issues/126 -1. Open a PR with the following changes: - - Update the [`server.json` schema](../../reference/server-json/draft/server.schema.json) - - Add your package registry name to the `registry_type` example array. - - Add your package registry base url to the `registry_base_url` example array. - - Add the single-shot CLI command name to the `runtime_hint` example value array. - - Update the [`openapi.yaml`](../../reference/api/openapi.yaml) - - Add your package registry name to the `registry_type` enum value array. - - Add your package registry base url to the `registry_base_url` enum value array. - - Add the single-shot CLI command name to the `runtime_hint` example value array. - - Add a sample, minimal `server.json` to the [`server.json` examples](../../reference/server-json/generic-server-json.md). - - Implement a registry validator: - - Create a new validator file: `internal/validators/registries/yourregistry.go`, following the pattern of existing validators. Examples: - - **npm**: Checks for an `mcpName` field in `package.json` that matches the server name - - **PyPI**: Searches for `mcp-name: server-name` format in the package README content - - **NuGet**: Looks for `mcp-name: server-name` format in the package README file - - **Docker/OCI**: Validates a Docker image label `io.modelcontextprotocol.server.name` in the image manifest - - Add corresponding unit tests: `internal/validators/registries/yourregistry_test.go` - - Register your validator in `internal/validators/validators.go` - - Update the publishing documentation: - - Add a new publishing guide: `docs/guides/publishing/publish-[yourregistry].md`, following the pattern of existing publishing guides (e.g., `publish-npm.md`, `publish-pypi.md`) - - Include instructions on how to prepare packages for your registry, including any specific validation requirements - - Update `docs/guides/publishing/README.md` to reference your new publishing guide - ---- - -## File: docs/reference/README.md - -# Reference Documentation - -Technical specifications and quick lookups for the MCP Registry. - -## API Reference - -- [Generic Registry API](./api/generic-registry-api.md) -- [Official Registry API](./api/official-registry-api.md) - -## server.json Reference - -- [Generic server.json Format](./server-json/generic-server-json.md) -- [Official Registry Requirements](./server-json/official-registry-requirements.md) - -## CLI Reference - -- [Commands](./cli/commands.md) - -## Quick Reference - -- [FAQ](./faq.md) - ---- - -## File: docs/reference/server-json/official-registry-requirements.md - -# Official Registry Server.json Requirements - -This document describes the additional requirements and validation rules that apply when publishing to the official MCP Registry at `registry.modelcontextprotocol.io`. - -For step-by-step publishing instructions, see the [publishing guide](../../guides/publishing/publish-server.md). - -## Overview - -While the [generic server.json format](./generic-server-json.md) defines the base specification, the official registry enforces additional validation to ensure: - -- **Namespace authentication** - Servers are published under appropriate namespaces -- **Package ownership verification** - Publishers actually control referenced packages -- **Remote server URL match** - Remote server base urls match namespaces -- **Restricted registry base urls** - Packages are from trusted public registries -- **`_meta` namespace restrictions** - Restricted to `publisher` key only - -## Namespace Authentication - -Publishers must prove ownership of their namespace. For example to publish to `com.example/server`, the publisher must prove they own the `example.com` domain. - -See the [publishing guide](../../guides/publishing/publish-server.md) for authentication details for GitHub and domain namespaces. - -## Package Ownership Verification - -All packages must include metadata proving the publisher owns them. This prevents impersonation and ensures authenticity (see more reasoning in [#96](https://github.com/modelcontextprotocol/registry/issues/96)). - -For detailed verification requirements for each registry type, see the [publishing guide](../../guides/publishing/publish-server.md). - -## Remote Server URL Match - -Remote servers must use URLs that match the publisher's domain from their namespace. For example, `com.example/server` can only use remote URLs on `example.com` or its subdomains. - -## Restricted Registry Base URLs - -Only trusted public registries are supported. Private registries and alternative mirrors are not allowed. - -**Supported registries:** -- **NPM**: `https://registry.npmjs.org` only -- **PyPI**: `https://pypi.org` only -- **NuGet**: `https://api.nuget.org/v3/index.json` -- **Docker/OCI**: `https://docker.io` only -- **MCPB**: `https://github.com` releases and `https://gitlab.com` releases only - -## `_meta` Namespace Restrictions - -The `_meta` field is restricted to the `publisher` key only during publishing. This `_meta.publisher` extension is currently limited to 4KB. - -Registry metadata is added automatically and cannot be overridden. - ---- - -## File: docs/terms.md - -# Official MCP Registry Terms - -Effective date: 2025-09-02 - -## Overview - -These terms ("Terms") govern your access to and use of the official MCP Registry (the service hosted at [https://registry.modelcontextprotocol.io/](https://registry.modelcontextprotocol.io/) or a successor location) ("Registry"), including submissions or publications of MCP servers, references to MCP servers or to data about such servers and/or their developers ("Registry Data"), and related conduct. The Registry is intended to be a centralized repository of MCP servers developed by community members to facilitate easy access by AI applications. - -These terms are governed by the laws of the State of California. - -## For All Users - -1. No Warranties. The Registry is provided "as is" with no warranties of any kind. That means we don't guarantee the accuracy, completeness, safety, durability, or availability of the Registry, servers included in the registry, or Registry Data. In short, we're also not responsible for any MCP servers or Registry Data, and we highly recommend that you evaluate each MCP server and its suitability for your intended use case(s) before deciding whether to use it. - -2. Access and Use Requirements. To access or use the Registry, you must: - 1. Be at least 18 years old. - 2. Use the Registry, MCP servers in the Registry, and Registry Data only in ways that are legal under the applicable laws of the United States or other countries including the country in which you are a resident or from which you access and use the Registry, and not be barred from accessing or using the Registry under such laws. You will comply with all applicable law, regulation, and third party rights (including, without limitation, laws regarding the import or export of data or software, privacy, intellectual property, and local laws). You will not use the Registry, MCP servers, or Registry Data to encourage or promote illegal activity or the violation of third party rights or terms of service. - 3. Log in via method(s) approved by the Registry maintainers, which may involve using applications or other software owned by third parties. - -3. Entity Use. If you are accessing or using the Registry on behalf of an entity, you represent and warrant that you have authority to bind that entity to these Terms. By accepting these Terms, you are doing so on behalf of that entity (and all references to "you" in these Terms refer to that entity). - -4. Account Information. In order to access or use the Registry, you may be required to provide certain information (such as identification or contact details) as part of a registration process or in connection with your access or use of the Registry or MCP servers therein. Any information you give must be accurate and up-to-date, and you agree to inform us promptly of any updates. You understand that your use of the Registry may be monitored to ensure quality and verify your compliance with these Terms. - -5. Feedback. You are under no obligation to provide feedback or suggestions. If you provide feedback or suggestions about the Registry or the Model Context Protocol, then we (and those we allow) may use such information without obligation to you. - -6. Branding. Only use the term "Official MCP Registry" where it is clear it refers to the Registry, and does not imply affiliation, endorsement, or sponsorship. For example, you can permissibly say "Acme Inc. keeps its data up to date by automatically pulling data from the Official MCP Registry" or "This data comes from the Official MCP Registry," but cannot say "This is the website for the Official MCP Registry," "We're the premier destination to view Official MCP Registry data," or "We've partnered with the Official MCP Registry to provide this data." - -7. Modification. We may modify the Terms or any portion to, for example, reflect changes to the law or changes to the Model Context Protocol. We'll post notice of modifications to the Terms to this website or a successor location. If you do not agree to the modified Terms, you should discontinue your access to and/or use of the Registry. Your continued access to and/or use of the Registry constitutes your acceptance of any modified Terms. - -8. Additional Terms. Depending on your intended use case(s), you must also abide by applicable terms below. - -## For MCP Developers - -9. Prohibitions. By accessing and using the Registry, including by submitting MCP servers and/or Registry Data, you agree not to: - 1. Share malicious or harmful content, such as malware, even in good faith or for research purposes, or perform any action with the intent of introducing any viruses, worms, defects, Trojan horses, malware, or any items of a destructive nature; - 2. Defame, abuse, harass, stalk, or threaten others; - 3. Interfere with or disrupt the Registry or any associated servers or networks; - 4. Submit data with the intent of confusing or misleading others, including but not limited to via spam, posting off-topic marketing content, posting MCP servers in a way that falsely implies affiliation with or endorsement by a third party, or repeatedly posting the same or similar MCP servers under different names; - 5. Promote or facilitate unlawful online gambling or disruptive commercial messages or advertisements; - 6. Use the Registry for any activities where the use or failure of the Registry could lead to death, personal injury, or environmental damage; - 7. Use the Registry to process or store any data that is subject to the International Traffic in Arms Regulations maintained by the U.S. Department of State. - -10. License. You agree that metadata about MCP servers you submit (e.g., schema name and description, URLs, identifiers) and other Registry Data is intended to be public, and will be dedicated to the public domain under [CC0 1.0 Universal](https://creativecommons.org/publicdomain/zero/1.0/). By submitting such data, you agree that you have the legal right to make this dedication (i.e., you own the copyright to these submissions or have permission from the copyright owner(s) to do so) and intend to do so. You understand that this dedication is perpetual, irrevocable, and worldwide, and you waive any moral rights you may have in your contributions to the fullest extent permitted by law. This dedication applies only to Registry Data and not to packages in third party registries that you might point to. - -11. Privacy and Publicity. You understand that any MCP server metadata you publish may be made public. This includes personal data such as your GitHub username, domain name, or details from your server description. Moreover, you understand that others may process personal information included in your MCP server metadata. For example, subregistries might enrich this data by adding how many stars your GitHub repository has, or perform automated security scanning on your code. By publishing a server, you agree that others may engage in this sort of processing, and you waive rights you might have in some jurisdictions to access, rectify, erase, restrict, or object to such processing. - ---- - -## File: docs/guides/contributing/releasing.md - -# Release Guide - -## Creating a Release - -1. **Go to GitHub**: Navigate to https://github.com/modelcontextprotocol/registry/releases -2. **Click "Draft a new release"** -3. **Choose a tag**: Click "Choose a tag" and type a new semantic version that follows the last one available (e.g., `v1.0.0`) -5. **Generate notes**: Click "Generate release notes" to auto-populate the name and description -6. **Publish**: Click "Publish release" - -The release workflow will automatically: -- Build binaries for 6 platforms (Linux, macOS, Windows × amd64, arm64) -- Create and push Docker images with `:latest` and `:vX.Y.Z` tags -- Attach all artifacts to the GitHub release -- Generate checksums and signatures - -## After Release - -- Docker images will be available at: - - `ghcr.io/modelcontextprotocol/registry:latest` - Latest stable release - - `ghcr.io/modelcontextprotocol/registry:vX.Y.Z` - Specific release version -- Binaries can be downloaded from the GitHub release page - -## Docker Image Tags - -The registry publishes different Docker image tags for different use cases: - -- **`:latest`** - Latest stable release (updated only on releases) -- **`:vX.Y.Z`** - Specific release versions (e.g., `:v1.0.0`) -- **`:main`** - Rolling tag updated on every push to main branch (continuous deployment) -- **`:main-YYYYMMDD-sha`** - Specific development builds from main branch - -## Versioning - -We use semantic versioning (SemVer): -- `v1.0.0` - Major release with breaking changes -- `v1.1.0` - Minor release with new features -- `v1.0.1` - Patch release with bug fixes - ---- - -## File: docs/reference/api/official-registry-api.md - -# Official MCP Registry API - -This document describes the API for the official MCP Registry hosted at `registry.modelcontextprotocol.io`. - -This API is based on the [generic registry API](./generic-registry-api.md) with additional endpoints and authentication. For practical examples of consuming the API, see the [API usage guide](../../guides/consuming/use-rest-api.md). For publishing servers using the API, see the [publishing guide](../../guides/publishing/publish-server.md). - -## Base URLs - -- **Production**: `https://registry.modelcontextprotocol.io` -- **Staging**: `https://staging.registry.modelcontextprotocol.io` - -## Interactive Documentation - -- **[Live API Docs](https://registry.modelcontextprotocol.io/docs)** - Stoplight elements with try-it-now functionality -- **[OpenAPI Spec](https://registry.modelcontextprotocol.io/openapi.yaml)** - Complete machine-readable specification - -## Extensions - -The official registry implements the [Generic Registry API](./generic-registry-api.md) with the following specific configurations and extensions: - -### Authentication - -Publishing requires namespace-based authentication: - -- **GitHub OAuth** - For `io.github.*` namespaces -- **GitHub OIDC** - For publishing from GitHub Actions -- **DNS verification** - For domain-based namespaces (`com.example.*`) -- **HTTP verification** - For domain-based namespaces (`com.example.*`) - -See [Publisher Commands](../cli/commands.md) for authentication setup. - -### Package Validation - -The official registry enforces additional [package validation requirements](../server-json/official-registry-requirements.md) when publishing. - -### Server List Filtering - -The official registry extends the `GET /v0/servers` endpoint with additional query parameters for improved discovery and synchronization: - -- `updated_since` - Filter servers updated after RFC3339 timestamp (e.g., `2025-08-07T13:15:04.280Z`) -- `search` - Case-insensitive substring search on server names (e.g., `filesystem`) - - This is intentionally simple. For more advanced searching and filtering, use a subregistry. -- `version` - Filter by version (currently supports `latest` for latest versions only) - -These extensions enable efficient incremental synchronization for downstream registries and improved server discovery. Parameters can be combined and work with standard cursor-based pagination. - -Example: `GET /v0/servers?search=filesystem&updated_since=2025-08-01T00:00:00Z&version=latest` - -### Additional endpoints -- POST `/v0/auth/dns` - Exchange signed DNS challenge for auth token -- POST `/v0/auth/http` - Exchange signed HTTP challenge for auth token -- POST `/v0/auth/github-at` - Exchange GitHub access token for auth token -- POST `/v0/auth/github-oidc` - Exchange GitHub OIDC token for auth token -- POST `/v0/auth/oidc` - Exchange Google OIDC token for auth token (for admins) - -#### Admin endpoints -- GET `/metrics` - Prometheus metrics endpoint -- GET `/v0/health` - Basic health check endpoint -- PUT `/v0/servers/{id}` - Edit existing server - ---- - -## File: docs/explanations/namespacing.md - -# Namespacing and Security - -Namespacing prevents name squatting, makes impersonation and typo squatting much harder, and provides attribution through domain-based identity. - -For practical steps on how to authenticate for different namespaces, see the [publishing guide](../guides/publishing/publish-server.md#authenticate). - -## Namespace Format - -All server names follow reverse-DNS format. Examples: -- `io.github.alice/weather-server` - GitHub user `alice` -- `com.acme/internal-tool` - Company domain `acme.com` -- `org.nonprofit.research/data-analyzer` - Subdomain `research.nonprofit.org` - -## Security Model - -### Ownership Verification - -Publishing to a namespace requires proving you control the corresponding identity: - -**GitHub namespaces** (`io.github.*`): -- OAuth login to GitHub account/organization -- OIDC tokens in GitHub Actions workflows - -**Domain namespaces** (`com.company.*`): -- DNS verification: TXT record at `company.com` -- HTTP verification: File at `https://company.com/.well-known/mcp-registry-auth` - -## Namespace Scoping - -Different authentication methods grant different namespace access: - -**GitHub OAuth/OIDC**: -- `io.github.username/*` (for personal accounts) -- `io.github.orgname/*` (for organizations) - -**DNS verification**: -- `com.domain/*` and `com.domain.*/*` (domain + all subdomains) - -**HTTP verification**: -- `com.domain/*` only (exact domain, no subdomains) - -## Limitations - -**Domain ownership changes**: If someone loses/sells a domain, they lose publishing rights. Similarly if someone gains a domain, they gain publishing rights. -**Package validation**: Registry validates namespace ownership, but actual packages may still be malicious etc. - ---- - -## File: docs/explanations/versioning.md - -# Server Versioning Guide - -This document describes the versioning approach for MCP servers published to the registry. - -## Overview - -The MCP Registry supports flexible versioning while encouraging semantic versioning best practices. The registry attempts to parse versions as semantic versions for ordering and comparison, but falls back gracefully for non-semantic versions. - -## Version Requirements - -1. **Version String**: `version` MUST be a string up to 255 characters -2. **Uniqueness**: Each version for a given server name must be unique -3. **Immutability**: Once published, version metadata cannot be changed - -## Best Practices - -### 1. Use Semantic Versioning -Server authors SHOULD use [semantic versions](https://semver.org/) following the `MAJOR.MINOR.PATCH` format: - -```json -{ - "version": "1.2.3" -} -``` - -### 2. Align with Package Versions -Server authors SHOULD use versions aligned with their underlying packages to reduce confusion: - -```json -{ - "version": "1.2.3", - "packages": [{ - "registry_name": "npm", - "name": "@myorg/my-server", - "version": "1.2.3" - }] -} -``` - -### 3. Multiple Registry Versions -If server authors expect to have multiple registry versions for the same package version, they SHOULD follow the semantic version spec using the prerelease label: - -```json -{ - "version": "1.2.3-1", - "packages": [{ - "registry_name": "npm", - "name": "@myorg/my-server", - "version": "1.2.3" - }] -} -``` - -**Note**: According to semantic versioning, `1.2.3-1` is considered lower than `1.2.3`, so if you expect to need a `1.2.3-1`, you should publish that before `1.2.3`. - -## Version Ordering and "Latest" Determination - -### For Semantic Versions -The registry attempts to parse versions as semantic versions. If successful, it uses semantic version comparison rules to determine: -- Version ordering in lists -- Which version is marked as `is_latest` - -### For Non-Semantic Versions -If version parsing as semantic version fails: -- The registry will always mark the version as latest (overriding any previous version) -- Clients should fall back to using publish timestamp for ordering - -**Important Note**: This behavior means that for servers with mixed semantic and non-semantic versions, the `is_latest` flag may not align with the total ordering. A non-semantic version published after semantic versions will be marked as latest, even if semantic versions are considered "higher" in the ordering. - -## Implementation Details - -### Registry Behavior -1. **Validation**: Versions are validated for uniqueness within a server name -2. **Parsing**: The registry attempts to parse each version as semantic version -3. **Comparison**: Uses semantic version rules when possible, falls back to timestamp -4. **Latest Flag**: The `is_latest` field is set based on the comparison results - -### Client Recommendations -Registry clients SHOULD: -1. Attempt to interpret versions as semantic versions when possible -2. Use the following ordering rules: - - If one version is marked as is_latest: it is later - - If both versions are valid semver: use semver comparison - - If neither are valid semver: use publish timestamp - - If one is semver and one is not: semver version is considered higher - -## Examples - -### Valid Semantic Versions -```javascript -"1.0.0" // Basic semantic version -"2.1.3-alpha" // Prerelease version -"1.0.0-beta.1" // Prerelease with numeric suffix -"3.0.0-rc.2" // Release candidate -``` - -### Non-Semantic Versions (Allowed) -```javascript -"v1.0" // Version with prefix -"2021.03.15" // Date-based versioning -``` - -### Not Allowed: Version Ranges -The registry requires specific versions for both the top-level `version` and any `packages[].version`. Version ranges or wildcard versions are rejected during publish, including but not limited to: - -```javascript -"^1.2.3" -"~1.2.3" -">=1.2.3" -"<=1.2.3" -">1.2.3" -"<1.2.3" -"1.x" -"1.2.*" -"1 - 2" -"1.2 || 1.3" -``` - -### Alignment Examples -```json -{ - "version": "1.2.3-1", - "packages": [{ - "registry_name": "npm", - "name": "@myorg/k8s-server", - "version": "1.2.3" - }] -} -``` - -## Migration Path - -Existing servers with non-semantic versions will continue to work without changes. However, to benefit from proper version ordering, server maintainers are encouraged to: - -1. Adopt semantic versioning for new releases -2. Consider the ordering implications when transitioning from non-semantic to semantic versions -3. Use prerelease labels for registry-specific versioning needs - -## Common Scenarios - -### Standard Releases -**Package and server versions aligned**: -```json -{ - "version": "1.2.3", - "packages": [ - { - "registry_type": "npm", - "identifier": "@myorg/server", - "version": "1.2.3" - } - ] -} -``` - -### Registry-Only Updates -**Server metadata changes without package updates**: -```json -{ - "version": "1.2.3-1", - "packages": [ - { - "registry_type": "npm", - "identifier": "@myorg/server", - "version": "1.2.3" - } - ] -} -``` - -Note: `1.2.3-1` is considered lower than `1.2.3` in semver ordering. Publish prerelease versions first. - -### Remote Server Versioning -**Remote servers without package dependencies**: -```json -{ - "version": "2.1.0", - "remotes": [ - { - "transport_type": "sse", - "url": "https://api.myservice.com/mcp/v2.1" - } - ] -} -``` - -Version strategy options: -- **API versioning**: Match your service API version -- **Semantic versioning**: Standard semver for feature changes -- **Date-based**: `2024.03.15` for regular releases - -### Multi-Package Versioning -**Different package versions**: -```json -{ - "version": "1.3.0", - "packages": [ - { - "registry_type": "npm", - "identifier": "@myorg/server", - "version": "1.3.0" - }, - { - "registry_type": "oci", - "identifier": "myorg/server", - "version": "1.2.5" - } - ] -} -``` - -Use server version to indicate the overall release. - -## Decision Guide - -**Which version strategy should I use?** - -``` -Do you have underlying packages? -├─ Yes: Align with package version -│ ├─ Same package version → Use package version -│ └─ Different package versions → Use highest + indicate relationship -└─ No (remote server): Choose versioning scheme - ├─ API versioning → Match service API version - ├─ Feature-based → Use semantic versioning - └─ Regular releases → Consider date-based versioning -``` - -## Future Considerations - -This versioning approach is designed to be compatible with potential future changes to the MCP specification's `Implementation.version` field. Any SHOULD requirements introduced here may be proposed as updates to the specification through the SEP (Specification Enhancement Proposal) process. - ---- - -## File: docs/guides/consuming/use-rest-api.md - -# Consuming Registry Data via REST API - -Integration patterns and best practices for building applications that consume MCP registry data. - -## Key details - -**Base URL**: `https://registry.modelcontextprotocol.io` - -**Authentication**: Not required for read-only access - -- **`GET /v0/servers`** - List all servers with pagination -- **`GET /v0/servers/{id}`** - Get server details by UUID - -See the [interactive API documentation](https://registry.modelcontextprotocol.io/docs) for complete request/response schemas. - -**Disclaimer**: The official registry provides no uptime or data durability guarantees. You should design your applications to handle service downtime via caching. - -## Building a subregistry -**Create enhanced registries** - ETL official registry data and add your own metadata like ratings, security scans, or compatibility info. - -For now we recommend scraping the `GET /v0/servers` endpoint on some regular basis. In the future we might provide a filter for updated_at ([#291](https://github.com/modelcontextprotocol/registry/issues/291)) to get only recently changed servers. - -Servers are generally immutable, except for the `status` field which can be updated to `deleted` (among other states). For these packages, we recommend you also update the status field to `deleted` or remove the package from your registry quickly. This is because this status generally indicates it has violated our permissive [moderation guidelines](../administration/moderation-guidelines.md), suggesting it is illegal, malware or spam. - -### Filtering & Enhancement - -The official registry has a [permissive moderation policy](../administration/moderation-guidelines.md), so you may want to implement your own filtering on top of registry data. - -You can also add custom metadata to servers using the `_meta` field. For example, user ratings, download counts, or security scan results. If you do this, we recommend you put this under a key that is namespaced to your organization, for example: - -```json -{ - "$schema": "https://static.modelcontextprotocol.io/schemas/2025-07-09/server.schema.json", - "name": "io.github.yourname/weather-server", - "description": "MCP server for weather data access", - "status": "active", - "version": "1.0.0", - "packages": [ - { - "registry_type": "npm", - "identifier": "weather-mcp-server", - "version": "1.0.0" - } - ], - "_meta": { - "com.example.subregistry/custom": { - "user_rating": 4.5, - "download_count": 12345, - "security_scan": { - "last_scanned": "2024-06-01T12:00:00Z", - "vulnerabilities_found": 0 - } - } - } -} -``` - -### Providing an API - -We recommend that your subregistry provides an API meeting the registry API specification, so it's easy for clients to switch between registries. See the [registry API documentation](../../reference/api/) for details. - -## MCP Client Integration -**Convert registry data to client configuration** - Fetch servers and transform package information into your MCP client's config format. - -We highly recommend using a subregistry rather than fetching data from the official registry directly. You might want to make this configurable so that users of your client can choose their preferred registry, for example we expect that some enterprise users may have their own registry. - -Your client should gracefully handle registries that meet the minimum spec, i.e. avoid hard dependencies on `_meta` fields. - -### Filtering - -You likely should filter out servers that are not `active` in the `status` field. - -### Running servers - -You can use the `packages` or `remotes` field to determine how to run a server. More details of these fields are in the [server.json documentation](../../reference/server-json/generic-server-json.md). - ---- - -## File: docs/guides/publishing/github-actions.md - -# Automate Publishing with GitHub Actions - -Set up automated MCP server publishing using GitHub Actions. - -## What You'll Learn - -By the end of this tutorial, you'll have: - -- A GitHub Actions workflow that automatically publishes your server -- Understanding of GitHub OIDC authentication -- Knowledge of best practices for automated publishing -- Working examples for Node.js, Python, and Docker projects - -## Prerequisites - -- Understand general publishing requirements like package verification (see the [publishing guide](publish-server.md)) -- GitHub repository with your MCP server code - -## GitHub Actions Setup - -### Step 1: Create Workflow File - -Create `.github/workflows/publish-mcp.yml`. Here's an example for NPM-based packages, but the MCP registry publishing steps are the same for all package types: - -```yaml -name: Publish to MCP Registry - -on: - push: - tags: ["v*"] # Triggers on version tags like v1.0.0 - -jobs: - publish: - runs-on: ubuntu-latest - permissions: - id-token: write # Required for OIDC authentication - contents: read - - steps: - - name: Checkout code - uses: actions/checkout@v5 - - - name: Setup Node.js # Adjust for your language - uses: actions/setup-node@v5 - with: - node-version: "lts/*" - - - name: Install dependencies - run: npm ci - - - name: Run tests - run: npm run test --if-present - - - name: Build package - run: npm run build --if-present - - - name: Publish to npm - run: npm publish - env: - NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} - - - name: Install MCP Publisher - run: | - curl -L "https://github.com/modelcontextprotocol/registry/releases/latest/download/mcp-publisher_$(uname -s | tr '[:upper:]' '[:lower:]')_$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/').tar.gz" | tar xz mcp-publisher - - - name: Login to MCP Registry - run: ./mcp-publisher login github-oidc - - - name: Publish to MCP Registry - run: ./mcp-publisher publish -``` - -### Step 2: Configure Secrets - -You don't need any secrets for publishing to the MCP Registry using GitHub OIDC. - -However you might need to add secrets for your package registry. For example the workflow above needs a `NPM_TOKEN` (which you can add in Settings → Secrets and variables → Actions). - -### Step 3: Tag and Release - -Create a version tag to trigger the workflow: - -```bash -git tag v1.0.0 -git push origin v1.0.0 -``` - -The workflow runs tests, builds your package, publishes to npm, and publishes to the MCP Registry. - -## Authentication Methods - -### GitHub Actions OIDC (Recommended) - -```yaml -- name: Login to MCP Registry - run: mcp-publisher login github-oidc -``` - -### GitHub Personal Access Token - -```yaml -- name: Login to MCP Registry - run: mcp-publisher login github --token ${{ secrets.GITHUB_TOKEN }} - env: - GITHUB_TOKEN: ${{ secrets.MCP_GITHUB_TOKEN }} -``` - -Add `MCP_GITHUB_TOKEN` secret with a GitHub PAT that has repo access. - -### DNS Authentication - -For custom domain namespaces (`com.yourcompany/*`): - -```yaml -- name: Login to MCP Registry - run: | - echo "${{ secrets.MCP_PRIVATE_KEY }}" > key.pem - mcp-publisher login dns --domain yourcompany.com --private-key-file key.pem -``` - -Add your Ed25519 private key as `MCP_PRIVATE_KEY` secret. - -## Examples - -See these real-world examples of automated publishing workflows: -- [NPM, Docker and MCPB](https://github.com/domdomegg/airtable-mcp-server) -- [NuGet](https://github.com/domdomegg/time-mcp-nuget) -- [PyPI](https://github.com/domdomegg/time-mcp-pypi) - -## Tips - -You can keep your package version and server.json version in sync automatically with something like: -```yaml -- run: | - VERSION=${GITHUB_REF#refs/tags/v} - jq --arg v "$VERSION" '.version = $v' server.json > tmp && mv tmp server.json -``` - -## Troubleshooting -- **"Authentication failed"**: Ensure `id-token: write` permission is set for OIDC, or check secrets -- **"Package validation failed"**: Verify your package published to your registry (NPM, PyPi etc.) successfully first, and that you have done the necessary validation steps in the [Publishing Tutorial](publish-server.md) - ---- - -## File: docs/guides/publishing/publish-server.md - -# Publish Your MCP Server - -Complete guide to publishing an MCP server to the registry. - -> [!TIP] -> Using an agentic AI coding assistant? Just use this prompt: -> ``` -> Read https://raw.githubusercontent.com/modelcontextprotocol/registry/refs/heads/main/docs/guides/publishing/publish-server.md and https://raw.githubusercontent.com/modelcontextprotocol/registry/refs/heads/main/docs/guides/publishing/github-actions.md. Evaluate the best way to publish this server to the registry (prefer automated CI flows over manual flows where possible), and implement that. If possible, validate the server.json against the $schema before telling the user you are done, using a proper json schema library or tool available on the user's machine. If you get stuck, guide the user through the parts of the publishing process they need to do (e.g. logging into the publisher CLI if doing manual pubishing). -> ``` - -## What You'll Learn - -By the end of this tutorial, you'll have: -- Created a server.json file for your MCP server -- Authenticated with the registry -- Successfully published your server -- Verified your server appears in the registry - -## Prerequisites - -- An MCP server you've already built ([follow this guide if you don't have one already](https://modelcontextprotocol.io/quickstart/server)) - -## Deployment Options - -You can make your MCP server available in multiple ways: - -- **📦 Package deployment**: Published to registries (npm, PyPI, Docker Hub, etc.) and run locally by clients -- **🌐 Remote deployment**: Hosted as a web service that clients connect to directly -- **🔄 Hybrid deployment**: Offer both package and remote options for maximum flexibility - -Learn more about [MCP server architecture](https://modelcontextprotocol.io/docs/concepts/servers) in the official docs. - -## Step 1: Install the Publisher CLI - -
-🍺 macOS/Linux/WSL: With Homebrew (recommended) - -Requires [Homebrew](https://brew.sh): - -```bash -brew install mcp-publisher -``` - -
- -
-⬇️ macOS/Linux/WSL: Pre-built binaries - -```bash -curl -L "https://github.com/modelcontextprotocol/registry/releases/latest/download/mcp-publisher_$(uname -s | tr '[:upper:]' '[:lower:]')_$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/').tar.gz" | tar xz mcp-publisher && sudo mv mcp-publisher /usr/local/bin/ -``` - -
- -
-🏗️ macOS/Linux/WSL: From source - -Requires Git, Make and Go 1.24+: - -```bash -# Clone the registry repository -git clone https://github.com/modelcontextprotocol/registry -cd registry -make publisher - -# The binary will be at bin/mcp-publisher -export PATH=$PATH:$(pwd)/bin -``` - -
- -
-🪟 Windows PowerShell: Pre-built binaries - -```powershell -$arch = if ([System.Runtime.InteropServices.RuntimeInformation]::ProcessArchitecture -eq "Arm64") { "arm64" } else { "amd64" }; Invoke-WebRequest -Uri "https://github.com/modelcontextprotocol/registry/releases/latest/download/mcp-publisher_windows_$arch.tar.gz" -OutFile "mcp-publisher.tar.gz"; tar xf mcp-publisher.tar.gz mcp-publisher.exe; rm mcp-publisher.tar.gz -# Move mcp-publisher.exe to a directory in your PATH -``` - -
- -## Step 2: Initialize Your server.json - -Navigate to your server's directory and create a template: - -```bash -cd /path/to/your/mcp-server -mcp-publisher init -``` - -This creates a `server.json` with auto-detected values. You'll see something like: - -```json -{ - "$schema": "https://static.modelcontextprotocol.io/schemas/2025-07-09/server.schema.json", - "name": "io.github.yourname/your-server", - "description": "A description of your MCP server", - "version": "1.0.0", - "packages": [ - { - "registry_type": "npm", - "identifier": "your-package-name", - "version": "1.0.0" - } - ] -} -``` - -## Step 3: Configure Your Server Details - -Edit the generated `server.json`: - -### Choose Your Namespace - -The `name` field determines authentication requirements: - -- **`io.github.yourname/*`** - Requires GitHub authentication -- **`com.yourcompany/*`** - Requires DNS or HTTP domain verification - -### Configure Deployment Methods - -Configure your server to support packages, remotes, or both: - -#### Package Deployment - -Add package validation metadata to prove ownership of your packages. - - -
-📦 NPM Packages - -### Requirements -Add an `mcpName` field to your `package.json`: - -```json -{ - "name": "your-npm-package", - "version": "1.0.0", - "mcpName": "io.github.username/server-name" -} -``` - -### How It Works -- Registry fetches `https://registry.npmjs.org/your-npm-package` -- Checks that `mcpName` field matches your server name -- Fails if field is missing or doesn't match - -### Example server.json -```json -{ - "name": "io.github.username/server-name", - "packages": [ - { - "registry_type": "npm", - "identifier": "your-npm-package", - "version": "1.0.0" - } - ] -} -``` - -The official MCP registry currently only supports the NPM public registry (`https://registry.npmjs.org`). - -
- -
-🐍 PyPI Packages - -### Requirements -Include your server name in your package README file using this format: - -**MCP name format**: `mcp-name: io.github.username/server-name` - -Add it to your README.md file (which becomes the package description on PyPI). This can be in a comment if you want to hide it from display elsewhere. - -### How It Works -- Registry fetches `https://pypi.org/pypi/your-package/json` -- Passes if `mcp-name: server-name` is in the README content - -### Example server.json -```json -{ - "name": "io.github.username/server-name", - "packages": [ - { - "registry_type": "pypi", - "identifier": "your-pypi-package", - "version": "1.0.0" - } - ] -} -``` - -The official MCP registry currently only supports the official PyPI registry (`https://pypi.org`). - -
- -
-📋 NuGet Packages - -### Requirements -Include your server name in your package's README using this format: - -**MCP name format**: `mcp-name: io.github.username/server-name` - -Add a README file to your NuGet package that includes the server name. This can be in a comment if you want to hide it from display elsewhere. - -### How It Works -- Registry fetches and cached service index `https://api.nuget.org/v3/index.json` -- Registry uses `ReadmeUriTemplate/6.13.0` URL template in service index to fetch README -- Passes if `mcp-name: server-name` is found in the README content - -### Example server.json -```json -{ - "name": "io.github.username/server-name", - "packages": [ - { - "registry_type": "nuget", - "identifier": "Your.NuGet.Package", - "version": "1.0.0" - } - ] -} -``` - -The official MCP registry currently only supports the official NuGet registry (`https://api.nuget.org/v3/index.json`). - -
- -
-🐳 Docker/OCI Images - -### Requirements -Add an annotation to your Docker image: - -```dockerfile -LABEL io.modelcontextprotocol.server.name="io.github.username/server-name" -``` - -### How It Works -- Registry authenticates with Docker Hub using public token -- Fetches image manifest using Docker Registry v2 API -- Checks that `io.modelcontextprotocol.server.name` annotation matches your server name -- Fails if annotation is missing or doesn't match - -### Example server.json -```json -{ - "name": "io.github.username/server-name", - "packages": [ - { - "registry_type": "oci", - "identifier": "yourusername/your-mcp-server", - "version": "1.0.0" - } - ] -} -``` - -The identifier is `namespace/repository`, and version is the tag and optionally digest. - -The official MCP registry currently only supports the official Docker registry (`https://docker.io`). - -
- -
-📁 MCPB Packages - -### Requirements -**MCP reference** - MCPB package URLs must contain "mcp" somewhere within them, to ensure the correct artifact has been uploaded. This may be with the `.mcpb` extension or in the name of your repository. - -**File integrity** - MCPB packages must include a SHA-256 hash for file integrity verification. This is required at publish time and MCP clients will validate this hash before installation. - -### How to Generate File Hashes -Calculate the SHA-256 hash of your MCPB file: - -```bash -openssl dgst -sha256 server.mcpb -``` - -### Example server.json -```json -{ - "name": "io.github.username/server-name", - "packages": [ - { - "registry_type": "mcpb", - "identifier": "https://github.com/you/your-repo/releases/download/v1.0.0/server.mcpb", - "file_sha256": "fe333e598595000ae021bd27117db32ec69af6987f507ba7a63c90638ff633ce" - } - ] -} -``` - -### File Hash Validation -- **Authors** are responsible for generating correct SHA-256 hashes when creating server.json -- **MCP clients** validate the hash before installing packages to ensure file integrity -- **The official registry** stores hashes but does not validate them -- **Subregistries** may choose to implement their own validation. This enables them to perform security scanning on MCPB files, and ensure clients get the same security scanned content. - -The official MCP registry currently only supports artifacts hosted on GitHub or GitLab releases. - -
- -#### Remote Deployment - -Add the `remotes` field to your `server.json` (can coexist with `packages`): - -
-🌐 Remote Server Configuration - -### Requirements - -- **Service endpoint**: Your MCP server must be accessible at the specified URL -- **Transport protocol**: Choose from `sse` (Server-Sent Events) or `streamable-http` -- **URL validation**: For domain namespaces only (see URL requirements below) - -### Example server.json - -```json -{ - "$schema": "https://static.modelcontextprotocol.io/schemas/2025-07-09/server.schema.json", - "name": "com.yourcompany/api-server", - "description": "Cloud-hosted MCP server for API operations", - "version": "2.0.0", - "remotes": [ - { - "type": "sse", - "url": "https://mcp.yourcompany.com/sse" - } - ] -} -``` - -### Multiple Transport Options - -You can offer multiple connection methods: - -```json -{ - "remotes": [ - { - "type": "sse", - "url": "https://mcp.yourcompany.com/sse" - }, - { - "type": "streamable-http", - "url": "https://mcp.yourcompany.com/http" - } - ] -} -``` - -### URL Validation Requirements - -- For `com.yourcompany/*` namespaces: URLs must be on `yourcompany.com` or its subdomains -- For `io.github.username/*` namespaces: No URL restrictions (but you must authenticate via GitHub) - -### Authentication Headers (Optional) - -Configure headers that clients should send when connecting: - -```json -{ - "remotes": [ - { - "type": "sse", - "url": "https://mcp.yourcompany.com/sse", - "headers": [ - { - "name": "X-API-Key", - "description": "API key for authentication", - "is_required": true, - "is_secret": true - } - ] - } - ] -} -``` - -
- -## Step 4: Authenticate - -Choose your authentication method based on your namespace: - -### GitHub Authentication (for io.github.* namespaces) - -```bash -mcp-publisher login github -``` - -This opens your browser for OAuth authentication. - -### DNS Authentication (for custom domains) - -```bash -# Generate keypair -openssl genpkey -algorithm Ed25519 -out key.pem - -# Get public key for DNS record -echo "yourcompany.com. IN TXT \"v=MCPv1; k=ed25519; p=$(openssl pkey -in key.pem -pubout -outform DER | tail -c 32 | base64)\"" - -# Add the TXT record to your DNS, then login -mcp-publisher login dns --domain yourcompany.com --private-key $(openssl pkey -in key.pem -noout -text | grep -A3 "priv:" | tail -n +2 | tr -d ' :\n') -``` - -## Step 5: Publish Your Server - -With authentication complete, publish your server: - -```bash -mcp-publisher publish -``` - -You'll see output like: -``` -✓ Successfully published -``` - -## Step 6: Verify Publication - -Check that your server appears in the registry by searching for it: - -```bash -curl "https://registry.modelcontextprotocol.io/v0/servers?search=io.github.yourname/weather-server" -``` - -You should see your server metadata returned in the JSON response. - -## Troubleshooting - -**"Package validation failed"** - Ensure your package includes the required validation metadata (mcpName field, README mention, or Docker label). - -**"Authentication failed"** - Verify you've correctly set up DNS records or are logged into the right GitHub account. - -**"Namespace not authorized"** - Your authentication method doesn't match your chosen namespace format. - -## Examples - -See these real-world examples of published servers: -- [NPM, Docker and MCPB example](https://github.com/domdomegg/airtable-mcp-server) -- [NuGet example](https://github.com/domdomegg/time-mcp-nuget) -- [PyPI example](https://github.com/domdomegg/time-mcp-pypi) - -## Next Steps - -- **Update your server**: Publish new versions with updated server.json files -- **Set up CI/CD**: Automate publishing with [GitHub Actions](github-actions.md) -- **Learn more**: Understand [server.json format](../../reference/server-json/generic-server-json.md) in depth -- **More examples**: See [remote server configurations](../../reference/server-json/generic-server-json.md#remote-server-example) and [hybrid deployments](../../reference/server-json/generic-server-json.md#server-with-remote-and-package-options) in the schema documentation - -## What You've Accomplished - -You've successfully published your first MCP server to the registry! Your server is now discoverable by MCP clients and can be installed by users worldwide. - ---- - -## File: docs/reference/api/generic-registry-api.md - -# Generic Registry API Specification - -A standardized RESTful HTTP API for MCP registries to provide consistent endpoints for discovering and retrieving MCP servers. - -Also see: -- For guidance consuming the API, see the [consuming guide](../../guides/consuming/use-rest-api.md). - -## Browse the Complete API Specification - -**📋 View the full API specification interactively**: Open [openapi.yaml](./openapi.yaml) in an OpenAPI viewer like [Stoplight Elements](https://elements-demo.stoplight.io/?spec=https://raw.githubusercontent.com/modelcontextprotocol/registry/refs/heads/main/docs/reference/api/openapi.yaml). - -The official registry has some more endpoints and restrictions on top of this. See the [official registry API spec](./official-registry-api.md) for details. - -## Quick Reference - -### Core Endpoints -- **`GET /v0/servers`** - List all servers with pagination -- **`GET /v0/servers/{id}`** - Get server details by UUID -- **`POST /v0/publish`** - Publish new server (optional, registry-specific authentication) - -### Authentication -- **Read operations**: No authentication required -- **Write operations**: Registry-specific authentication (if supported) - -### Content Type -All requests and responses use `application/json` - -### Basic Example: List Servers - -```bash -curl https://registry.example.com/v0/servers?limit=10 -``` - -```json -{ - "servers": [ - { - "name": "io.modelcontextprotocol/filesystem", - "description": "Filesystem operations server", - "status": "active", - "version": "1.0.2" - } - ], - "metadata": { - "count": 10, - "next_cursor": "eyJ..." - } -} -``` - -For complete endpoint documentation, view the OpenAPI specification in a schema viewer. - ---- - -## File: docs/reference/cli/commands.md - -# Publisher CLI Commands Reference - -Complete command reference for the `mcp-publisher` CLI tool. - -See the [publishing guide](../../guides/publishing/publish-server.md) for a walkthrough of using the CLI to publish a server. - -## Installation - -Install via Homebrew (macOS/Linux): - -```bash -$ brew install mcp-publisher -``` - -## Global Options - -All commands support: -- `--help`, `-h` - Show command help -- `--registry` - Registry URL (default: `https://registry.modelcontextprotocol.io`) - -## Commands - -### `mcp-publisher init` - -Generate a `server.json` template with automatic detection. - -**Usage:** -```bash -mcp-publisher init [options] -``` - -**Behavior:** -- Creates `server.json` in current directory -- Auto-detects package managers (`package.json`, `setup.py`, etc.) -- Pre-fills fields where possible -- Prompts for missing required fields - -**Example output:** -```json -{ - "name": "io.github.username/server-name", - "description": "TODO: Add server description", - "version": "1.0.0", - "packages": [ - { - "registry_type": "npm", - "identifier": "detected-package-name", - "version": "1.0.0" - } - ] -} -``` - -### `mcp-publisher login ` - -Authenticate with the registry. - -**Authentication Methods:** - -#### GitHub Interactive -```bash -mcp-publisher login github [--registry=URL] -``` -- Opens browser for GitHub OAuth flow -- Grants access to `io.github.{username}/*` and `io.github.{org}/*` namespaces - -#### GitHub OIDC (CI/CD) -```bash -mcp-publisher login github-oidc [--registry=URL] -``` -- Uses GitHub Actions OIDC tokens automatically -- Requires `id-token: write` permission in workflow -- No browser interaction needed - -Also see [the guide to publishing from GitHub Actions](../../guides/publishing/github-actions.md). - -#### DNS Verification -```bash -mcp-publisher login dns --domain=example.com --private-key=HEX_KEY [--registry=URL] -``` -- Verifies domain ownership via DNS TXT record -- Grants access to `com.example.*` namespaces -- Requires Ed25519 private key (64-character hex) - -**Setup:** -```bash -# Generate keypair -openssl genpkey -algorithm Ed25519 -out key.pem - -# Get public key for DNS record -openssl pkey -in key.pem -pubout -outform DER | tail -c 32 | base64 - -# Add DNS TXT record: -# example.com. IN TXT "v=MCPv1; k=ed25519; p=PUBLIC_KEY" - -# Extract private key for login -openssl pkey -in key.pem -noout -text | grep -A3 "priv:" | tail -n +2 | tr -d ' :\n' -``` - -#### HTTP Verification -```bash -mcp-publisher login http --domain=example.com --private-key=HEX_KEY [--registry=URL] -``` -- Verifies domain ownership via HTTPS endpoint -- Grants access to `com.example.*` namespaces -- Requires Ed25519 private key (64-character hex) - -**Setup:** -```bash -# Generate keypair (same as DNS) -openssl genpkey -algorithm Ed25519 -out key.pem - -# Host public key at: -# https://example.com/.well-known/mcp-registry-auth -# Content: v=MCPv1; k=ed25519; p=PUBLIC_KEY -``` - -#### Anonymous (Testing) -```bash -mcp-publisher login none [--registry=URL] -``` -- No authentication - for local testing only -- Only works with local registry instances - -### `mcp-publisher publish` - -Publish server to the registry. - -For detailed guidance on the publishing process, see the [publishing guide](../../guides/publishing/publish-server.md). - -**Usage:** -```bash -mcp-publisher publish [PATH] -``` - -**Options:** -- `PATH` - Path to server.json (default: `./server.json`) - -**Process:** -1. Validates `server.json` against schema -2. Publishes the `server.json` to the registry server URL specified in the login token -3. Server: Verifies package ownership (see [Official Registry Requirements](../server-json/official-registry-requirements.md)) -4. Server: Checks namespace authentication -5. Server: Publishes to registry - -**Example:** -```bash -# Basic publish -mcp-publisher publish - -# Custom file location -mcp-publisher publish ./config/server.json -``` - -### `mcp-publisher logout` - -Clear stored authentication credentials. - -**Usage:** -```bash -mcp-publisher logout -``` - -**Behavior:** -- Removes `~/.config/mcp-publisher/token.json` -- Also cleans up legacy token files (`~/.mcp_publisher_token`, `.mcpregistry_*`) -- Does not revoke tokens on server side - -## Configuration - -### Token Storage -Authentication tokens are stored in `~/.config/mcp-publisher/token.json` as JSON: -```json -{ - "token": "jwt-token-here", - "method": "github", - "registry": "https://registry.modelcontextprotocol.io" -} -``` - -> **Note:** Tokens were previously stored in `~/.mcp_publisher_token`. If you are upgrading, run `mcp-publisher logout` followed by `mcp-publisher login` to migrate to the new location. - ---- - -## File: docs/reference/faq.md - -# MCP Registry FAQ - -These questions come up often in discussions about the MCP Registry. If you have a question that isn't answered here, please start a discussion on the [MCP Registry Discussions page](https://github.com/modelcontextprotocol/registry/discussions). - -## General Questions - -### What is the MCP Registry? - -The MCP Registry is the official centralized metadata repository for publicly-accessible MCP servers. It provides: - -- A single place for server creators to publish metadata about their servers -- A REST API for MCP clients and aggregators to discover available servers -- Standardized installation and configuration information -- Namespace management through DNS verification - -### What is the difference between "Official MCP Registry", "MCP Registry", "MCP registry", "MCP Registry API", etc? - -There are four underlying concepts: -- "MCP Server Registry API" (or "MCP Registry API"): The OpenAPI specification defined in [openapi.yaml](./api/openapi.yaml). This is a reusable API specification that anyone building any sort of "MCP server registry" should consider adopting / aligning with. -- "Official MCP Registry" (or "MCP Registry"): The application that lives at `https://registry.modelcontextprotocol.io`. This registry currently only catalogs MCP servers, but may be extended in the future to also catalog MCP client/host apps and frameworks. -- "Official MCP Registry API": The REST API served at `https://registry.modelcontextprotocol.io`, which is a superset of the MCP Registry API. Its OpenAPI specification can be downloaded from [https://registry.modelcontextprotocol.io/openapi.yaml](https://registry.modelcontextprotocol.io/openapi.yaml) -- "MCP server registry" (or "MCP registry"): A third party, likely commercial, implementation of the MCP Server Registry API or derivative specification. - -### Is the MCP Registry a package registry? - -No. The MCP Registry stores metadata about MCP servers and references to where they're hosted (npm, PyPI, NuGet, Docker Hub, etc.), but does not host the actual source code or packages. - -### Who should use the MCP Registry directly? - -The registry is primarily designed for programmatic consumption by subregistries (Smithery, PulseMCP, Docker Hub, Anthropic, GitHub, etc.). It is NOT currently intended for individual clients or end-users (they should use subregistries). - -### Will there be feature X? - -See [roadmap.md](../explanations/roadmap.md). - -## Publishing Servers - -### How do I publish my MCP server? - -See the [publisher README](../../cmd/publisher/README.md) - -### What namespaces are available? - -- **With GitHub verification**: `io.github.yourusername/server-name`, `io.github.yourorg/server-name` -- **With DNS verification**: `com.yourcompany.*`, `com.yourcompany.*/*` -- **With HTTP verification**: `com.yourcompany/*` - -### Is open source required? - -No. While open source code is encouraged, it is not required for either locally or remotely run servers. - -### What package registries are supported? - -- npm (Node.js packages) -- PyPI (Python packages) -- NuGet.org (.NET packages) -- GitHub Container Registry (GHCR) -- Docker Hub - -More can be added as the community desires; feel free to open an issue if you are interested in building support for another registry. - -### Can I publish multiple versions? - -Yes, versioning is supported: - -- Each version gets its own immutable metadata -- Version strings must be unique for each server -- Old versions remain accessible for compatibility -- The registry tracks which version is "latest" based on semantic version ordering when possible - -### How do I update my server metadata? - -Submit a new `server.json` with a unique version string. Once published, version metadata is immutable (similar to npm). - -### What version format should I use? - -The registry accepts any version string up to 255 characters, but we recommend: - -- **SHOULD use semantic versioning** (e.g., "1.0.2", "2.1.0-alpha") for predictable ordering -- **SHOULD align with package versions** to reduce confusion -- **MAY use prerelease labels** (e.g., "1.0.0-1") for registry-specific versions - -The registry attempts to parse versions as semantic versions for proper ordering. Non-semantic versions are allowed but will be ordered by publication timestamp. Version ranges (e.g., `^1.2.3`, `~1.2.3`, `>=1.2.3`, `1.x`, `1.*`) are rejected; publish a specific version instead. See the [versioning guide](../explanations/versioning.md) for detailed guidance. - -### Can I add custom metadata when publishing? - -Yes, extensions under the `x-publisher` property are preserved when publishing to the registry. This allows you to include custom metadata specific to your publishing process. - -### Can I delete/unpublish my server? - -At time of last update, this was open for discussion in [#104](https://github.com/modelcontextprotocol/registry/issues/104). - -### Can I publish a private server? - -Private servers are those that are only accessible to a narrow set of users. For example, servers published on a private network (like `mcp.acme-corp.internal`) or on private package registries (e.g. `npx -y @acme/mcp --registry https://artifactory.acme-corp.internal/npm`). - -These are generally not supported on the official MCP registry, which is designed for publicly accessible MCP servers. - -If you want to publish private servers we recommend you host your own MCP subregistry, and add them there. - -## Security & Trust - -### How do I know a server is from the claimed organization? - -DNS verification ensures namespace ownership. For example: - -- `com.microsoft/server` requires DNS verification of microsoft.com -- `io.github.name/server` is tied to a GitHub account or GitHub organization `name` - -### Is there security scanning? - -The MVP delegates security scanning to: -- underlying package registries; and -- subregistries - -### How is spam prevented? - -- Namespace authentication requirements -- Character limits and regex validation on free-form fields -- Manual takedown of spam or malicious servers - -In future we might explore: -- Stricter rate limiting (e.g., 10 new servers per user per day) -- Potential AI-based spam detection -- Community reporting and admin blacklisting capabilities - -## API & Integration - -### How often should I poll the registry? - -Recommended polling frequency: - -- `/servers` endpoint: once per hour -- `/servers/:id` endpoint: once per version (results are immutable) -- Design assumes CDN caching between registry and consumers - -Also see [#291](https://github.com/modelcontextprotocol/registry/issues/291), which might mean the above can be more regular. - -### Will there be webhooks? - -Not in the initial MVP, but the architecture supports adding webhooks for update notifications in the future. - -### Can I run my own registry instance? - -Yes! The API shapes and data formats are intentionally designed for reuse by subregistries. Organizations needing private registries should: - -- Implement the same API shape -- Use the same `server.json` format -- Potentially mirror/filter the official registry data - -### Can I extend the registry API? - -Yes, we support `x-com.example` style extensions in a bunch of places - see the official MCP registry API spec. This can be used to add annotations to many objects, e.g. add security scanning details, enrich package metadata, etc. - -If you have a use case that can't be addressed here, raise a GitHub issue! - -### Can I use the code here to run my own registry instance? - -The registry implementation here is not designed for self-hosting, but you're welcome to try to use it/fork it as necessary. Note that this is not an intended use, and the registry maintainers cannot provide any support for this at this time. - -## Operations & Maintenance - -### What's the expected reliability? - -- This is a community maintained project without full time staffing. You should therefore expect downtime periods of up to 1 business day. No strict guarantees are provided. (Also see discussion in [#150](https://github.com/modelcontextprotocol/registry/issues/150)) -- Ideally clients should use subregistries with higher availability guarantees, to avoid direct end-user impact (as subregistries can cache data). - -### What if I need to report a spam or malicious server? - -1. Report it as abuse to the underlying package registry (e.g. NPM, PyPi, DockerHub, etc.); and -2. Raise a GitHub issue on the registry repo with a title beginning `Abuse report: ` - -### What if I need to report a security vulnerability in the registry itself? - -Follow [the MCP community SECURITY.md](https://github.com/modelcontextprotocol/.github/blob/main/SECURITY.md). - ---- - -## File: docs/reference/server-json/generic-server-json.md - -# server.json Format Specification - -A `server.json` file is a standardized way to describe MCP servers for registry publishing, client discovery, and package management. - -Also see: -- For step-by-step instructions on creating and using server.json files, see the [publishing guide](../../guides/publishing/publish-server.md). -- For understanding the validation requirements when publishing to the official registry, see [official registry requirements](./official-registry-requirements.md). - -## Browse the Complete Schema - -**📋 View the full specification interactively**: Open [server.schema.json](./server.schema.json) in a schema viewer like [json-schema.app](https://json-schema.app/view/%23?url=https%3A%2F%2Fstatic.modelcontextprotocol.io%2Fschemas%2F2025-07-09%2Fserver.schema.json). - -The schema contains all field definitions, validation rules, examples, and detailed descriptions. - -The official registry has some more restrictions on top of this. See the [official registry requirements](./official-registry-requirements.md) for details. - -## Examples - - - -### Basic Server with NPM Package - -```json -{ - "$schema": "https://static.modelcontextprotocol.io/schemas/2025-07-09/server.schema.json", - "name": "io.modelcontextprotocol.anonymous/brave-search", - "description": "MCP server for Brave Search API integration", - "status": "active", - "website_url": "https://anonymous.modelcontextprotocol.io/examples", - "repository": { - "url": "https://github.com/modelcontextprotocol/servers", - "source": "github" - }, - "version": "1.0.2", - "packages": [ - { - "registry_type": "npm", - "registry_base_url": "https://registry.npmjs.org", - "identifier": "@modelcontextprotocol/server-brave-search", - "version": "1.0.2", - "transport": { - "type": "stdio" - }, - "environment_variables": [ - { - "name": "BRAVE_API_KEY", - "description": "Brave Search API Key", - "is_required": true, - "is_secret": true - } - ] - } - ], - "_meta": { - "io.modelcontextprotocol.registry/publisher-provided": { - "tool": "npm-publisher", - "version": "1.0.1", - "build_info": { - "timestamp": "2023-12-01T10:30:00Z" - } - } - } -} -``` - -### Server in a Monorepo with Subfolder - -For MCP servers located within a subdirectory of a larger repository (monorepo structure), use the `subfolder` field to specify the relative path: - -```json -{ - "$schema": "https://static.modelcontextprotocol.io/schemas/2025-07-09/server.schema.json", - "name": "io.modelcontextprotocol/everything", - "description": "MCP server that exercises all the features of the MCP protocol", - "status": "active", - "repository": { - "url": "https://github.com/modelcontextprotocol/servers", - "source": "github", - "subfolder": "src/everything" - }, - "version": "0.6.2", - "packages": [ - { - "registry_type": "npm", - "registry_base_url": "https://registry.npmjs.org", - "identifier": "@modelcontextprotocol/everything", - "version": "0.6.2", - "transport": { - "type": "stdio" - } - } - ], - "_meta": { - "io.modelcontextprotocol.registry/publisher-provided": { - "tool": "npm-publisher", - "version": "1.0.1", - "build_info": { - "timestamp": "2023-12-01T10:30:00Z" - } - } - } -} -``` - -### Constant (fixed) arguments needed to start the MCP server - -Suppose your MCP server application requires a `mcp start` CLI arguments to start in MCP server mode. Express these as positional arguments like this: - -```json -{ - "name": "io.github.joelverhagen/knapcode-samplemcpserver", - "description": "Sample NuGet MCP server for a random number and random weather", - "version": "0.4.0-beta", - "packages": [ - { - "registry_type": "nuget", - "registry_base_url": "https://api.nuget.org/v3/index.json", - "identifier": "Knapcode.SampleMcpServer", - "version": "0.4.0-beta", - "transport": { - "type": "stdio" - }, - "package_arguments": [ - { - "type": "positional", - "value": "mcp" - }, - { - "type": "positional", - "value": "start" - } - ] - } - ], - "_meta": { - "io.modelcontextprotocol.registry/publisher-provided": { - "tool": "nuget-publisher", - "version": "2.1.0", - "build_info": { - "timestamp": "2023-11-15T14:22:00Z", - "pipeline_id": "nuget-build-456" - } - } - } -} -``` - -This will essentially instruct the MCP client to execute `dnx Knapcode.SampleMcpServer@0.4.0-beta -- mcp start` instead of the default `dnx Knapcode.SampleMcpServer@0.4.0-beta` (when no `package_arguments` are provided). - -### Filesystem Server with Multiple Packages - -```json -{ - "$schema": "https://static.modelcontextprotocol.io/schemas/2025-07-09/server.schema.json", - "name": "io.github.modelcontextprotocol/filesystem", - "description": "Node.js server implementing Model Context Protocol (MCP) for filesystem operations.", - "status": "active", - "repository": { - "url": "https://github.com/modelcontextprotocol/servers", - "source": "github", - "id": "b94b5f7e-c7c6-d760-2c78-a5e9b8a5b8c9" - }, - "version": "1.0.2", - "packages": [ - { - "registry_type": "npm", - "registry_base_url": "https://registry.npmjs.org", - "identifier": "@modelcontextprotocol/server-filesystem", - "version": "1.0.2", - "transport": { - "type": "stdio" - }, - "package_arguments": [ - { - "type": "positional", - "value_hint": "target_dir", - "description": "Path to access", - "default": "/Users/username/Desktop", - "is_required": true, - "is_repeated": true - } - ], - "environment_variables": [ - { - "name": "LOG_LEVEL", - "description": "Logging level (debug, info, warn, error)", - "default": "info" - } - ] - }, - { - "registry_type": "oci", - "registry_base_url": "https://docker.io", - "identifier": "mcp/filesystem", - "version": "1.0.2", - "transport": { - "type": "stdio" - }, - "runtime_arguments": [ - { - "type": "named", - "description": "Mount a volume into the container", - "name": "--mount", - "value": "type=bind,src={source_path},dst={target_path}", - "is_required": true, - "is_repeated": true, - "variables": { - "source_path": { - "description": "Source path on host", - "format": "filepath", - "is_required": true - }, - "target_path": { - "description": "Path to mount in the container. It should be rooted in `/project` directory.", - "is_required": true, - "default": "/project" - } - } - } - ], - "package_arguments": [ - { - "type": "positional", - "value_hint": "target_dir", - "value": "/project" - } - ], - "environment_variables": [ - { - "name": "LOG_LEVEL", - "description": "Logging level (debug, info, warn, error)", - "default": "info" - } - ] - } - ], - "_meta": { - "io.modelcontextprotocol.registry/publisher-provided": { - "tool": "ci-publisher", - "version": "3.2.1", - "build_info": { - "commit": "a1b2c3d4e5f6789", - "timestamp": "2023-12-01T10:30:00Z", - "pipeline_id": "filesystem-build-789", - "environment": "production" - } - } - } -} -``` - -### Remote Server Example - -```json -{ - "name": "io.modelcontextprotocol.anonymous/mcp-fs", - "description": "Cloud-hosted MCP filesystem server", - "repository": { - "url": "https://github.com/example/remote-fs", - "source": "github", - "id": "xyz789ab-cdef-0123-4567-890ghijklmno" - }, - "version": "2.0.0", - "remotes": [ - { - "type": "sse", - "url": "http://mcp-fs.anonymous.modelcontextprotocol.io/sse" - } - ], - "_meta": { - "io.modelcontextprotocol.registry/publisher-provided": { - "tool": "cloud-deployer", - "version": "2.4.0", - "build_info": { - "commit": "f7e8d9c2b1a0", - "timestamp": "2023-12-05T08:45:00Z", - "deployment_id": "remote-fs-deploy-456", - "region": "us-west-2" - } - } - } -} -``` - -### Python Package Example - -```json -{ - "name": "io.github.example/weather-mcp", - "description": "Python MCP server for weather data access", - "repository": { - "url": "https://github.com/example/weather-mcp", - "source": "github", - "id": "def456gh-ijkl-7890-mnop-qrstuvwxyz12" - }, - "version": "0.5.0", - "packages": [ - { - "registry_type": "pypi", - "registry_base_url": "https://pypi.org", - "identifier": "weather-mcp-server", - "version": "0.5.0", - "runtime_hint": "uvx", - "transport": { - "type": "stdio" - }, - "environment_variables": [ - { - "name": "WEATHER_API_KEY", - "description": "API key for weather service", - "is_required": true, - "is_secret": true - }, - { - "name": "WEATHER_UNITS", - "description": "Temperature units (celsius, fahrenheit)", - "default": "celsius" - } - ] - } - ], - "_meta": { - "io.modelcontextprotocol.registry/publisher-provided": { - "tool": "poetry-publisher", - "version": "1.8.3", - "build_info": { - "python_version": "3.11.5", - "timestamp": "2023-11-28T16:20:00Z", - "build_id": "pypi-weather-123", - "dependencies_hash": "sha256:a9b8c7d6e5f4" - } - } - } -} -``` - -### NuGet (.NET) Package Example - -The `dnx` tool ships with the .NET 10 SDK, starting with Preview 6. - -```json -{ - "name": "io.github.joelverhagen/knapcode-samplemcpserver", - "description": "Sample NuGet MCP server for a random number and random weather", - "repository": { - "url": "https://github.com/joelverhagen/Knapcode.SampleMcpServer", - "source": "github", - "id": "example-nuget-id-0000-1111-222222222222" - }, - "version": "0.5.0", - "packages": [ - { - "registry_type": "nuget", - "registry_base_url": "https://api.nuget.org/v3/index.json", - "identifier": "Knapcode.SampleMcpServer", - "version": "0.5.0", - "runtime_hint": "dnx", - "transport": { - "type": "stdio" - }, - "environment_variables": [ - { - "name": "WEATHER_CHOICES", - "description": "Comma separated list of weather descriptions to randomly select.", - "is_required": true, - "is_secret": false - } - ] - } - ], - "_meta": { - "io.modelcontextprotocol.registry/publisher-provided": { - "tool": "dotnet-publisher", - "version": "8.0.100", - "build_info": { - "dotnet_version": "8.0.0", - "timestamp": "2023-12-10T12:15:00Z", - "configuration": "Release", - "target_framework": "net8.0", - "build_number": "20231210.1" - } - } - } -} -``` - -### Complex Docker Server with Multiple Arguments - -```json -{ - "name": "io.github.example/database-manager", - "description": "MCP server for database operations with support for multiple database types", - "repository": { - "url": "https://github.com/example/database-manager-mcp", - "source": "github", - "id": "ghi789jk-lmno-1234-pqrs-tuvwxyz56789" - }, - "version": "3.1.0", - "packages": [ - { - "registry_type": "oci", - "registry_base_url": "https://docker.io", - "identifier": "example/database-manager-mcp", - "version": "3.1.0", - "transport": { - "type": "stdio" - }, - "runtime_arguments": [ - { - "type": "named", - "name": "--network", - "value": "host", - "description": "Use host network mode" - }, - { - "type": "named", - "name": "-e", - "value": "DB_TYPE={db_type}", - "description": "Database type to connect to", - "is_repeated": true, - "variables": { - "db_type": { - "description": "Type of database", - "choices": [ - "postgres", - "mysql", - "mongodb", - "redis" - ], - "is_required": true - } - } - } - ], - "package_arguments": [ - { - "type": "named", - "name": "--host", - "description": "Database host", - "default": "localhost", - "is_required": true - }, - { - "type": "named", - "name": "--port", - "description": "Database port", - "format": "number" - }, - { - "type": "positional", - "value_hint": "database_name", - "description": "Name of the database to connect to", - "is_required": true - } - ], - "environment_variables": [ - { - "name": "DB_USERNAME", - "description": "Database username", - "is_required": true - }, - { - "name": "DB_PASSWORD", - "description": "Database password", - "is_required": true, - "is_secret": true - }, - { - "name": "SSL_MODE", - "description": "SSL connection mode", - "default": "prefer", - "choices": [ - "disable", - "prefer", - "require" - ] - } - ] - } - ], - "_meta": { - "io.modelcontextprotocol.registry/publisher-provided": { - "tool": "docker-buildx", - "version": "0.12.1", - "build_info": { - "docker_version": "24.0.7", - "timestamp": "2023-12-08T14:30:00Z", - "platform": "linux/amd64,linux/arm64", - "registry": "docker.io", - "image_digest": "sha256:1a2b3c4d5e6f7890" - } - } - } -} -``` - -### Server with Remote and Package Options - -```json -{ - "$schema": "https://static.modelcontextprotocol.io/schemas/2025-07-09/server.schema.json", - "name": "io.modelcontextprotocol.anonymous/hybrid-mcp", - "description": "MCP server available as both local package and remote service", - "repository": { - "url": "https://github.com/example/hybrid-mcp", - "source": "github", - "id": "klm012no-pqrs-3456-tuvw-xyz789abcdef" - }, - "version": "1.5.0", - "packages": [ - { - "registry_type": "npm", - "registry_base_url": "https://registry.npmjs.org", - "identifier": "@example/hybrid-mcp-server", - "version": "1.5.0", - "runtime_hint": "npx", - "transport": { - "type": "stdio" - }, - "package_arguments": [ - { - "type": "named", - "name": "--mode", - "description": "Operation mode", - "default": "local", - "choices": [ - "local", - "cached", - "proxy" - ] - } - ] - } - ], - "remotes": [ - { - "type": "sse", - "url": "https://mcp.anonymous.modelcontextprotocol.io/sse", - "headers": [ - { - "name": "X-API-Key", - "description": "API key for authentication", - "is_required": true, - "is_secret": true - }, - { - "name": "X-Region", - "description": "Service region", - "default": "us-east-1", - "choices": [ - "us-east-1", - "eu-west-1", - "ap-southeast-1" - ] - } - ] - }, - { - "type": "streamable-http", - "url": "https://mcp.anonymous.modelcontextprotocol.io/http" - } - ], - "_meta": { - "io.modelcontextprotocol.registry/publisher-provided": { - "tool": "hybrid-deployer", - "version": "1.7.2", - "build_info": { - "timestamp": "2023-12-03T11:00:00Z", - "deployment_strategy": "blue-green", - "npm_version": "10.2.4", - "node_version": "20.10.0", - "service_endpoints": { - "sse": "deployed", - "streamable": "deployed" - } - } - } - } -} -``` - -### MCP Bundle (MCPB) Package Example - -```json -{ - "name": "io.modelcontextprotocol/text-editor", - "description": "MCP Bundle server for advanced text editing capabilities", - "repository": { - "url": "https://github.com/modelcontextprotocol/text-editor-mcpb", - "source": "github" - }, - "version": "1.0.2", - "packages": [ - { - "registry_type": "mcpb", - "registry_base_url": "https://github.com", - "identifier": "https://github.com/modelcontextprotocol/text-editor-mcpb/releases/download/v1.0.2/text-editor.mcpb", - "version": "1.0.2", - "file_sha256": "fe333e598595000ae021bd27117db32ec69af6987f507ba7a63c90638ff633ce", - "transport": { - "type": "stdio" - } - } - ], - "_meta": { - "io.modelcontextprotocol.registry/publisher-provided": { - "tool": "mcpb-publisher", - "version": "1.0.0", - "build_info": { - "timestamp": "2023-12-02T09:15:00Z", - "bundle_format": "mcpb-v1" - } - } - } -} -``` - -This example shows an MCPB (MCP Bundle) package that: -- Is hosted on GitHub Releases (an allowlisted provider) -- Includes a SHA-256 hash for integrity verification -- Can be downloaded and executed directly by MCP clients that support MCPB - -### Embedded MCP inside a CLI tool - -Some CLI tools bundle an MCP server, without a standalone MCP package or a public repository. In these cases, reuse the existing `packages` shape by pointing at the host CLI package and supplying the `package_arguments` and `runtime_hint` if needed to start the MCP server. - -```json -{ - "$schema": "https://static.modelcontextprotocol.io/schemas/2025-07-09/server.schema.json", - "name": "io.snyk/cli-mcp", - "description": "MCP server provided by the Snyk CLI", - "status": "active", - "version": "1.1298.0", - "packages": [ - { - "registry_type": "npm", - "registry_base_url": "https://registry.npmjs.org", - "identifier": "snyk", - "version": "1.1298.0", - "transport": { - "type": "stdio" - }, - "package_arguments": [ - { "type": "positional", "value": "mcp" }, - { - "type": "named", - "name": "-t", - "description": "Transport type for MCP server", - "default": "stdio", - "choices": ["stdio", "sse"] - } - ] - } - ] -} -``` - -### Server with Custom Installation Path - -For MCP servers that follow a custom installation path or are embedded in applications without standalone packages, use the `website_url` field to direct users to setup documentation: - -```json -{ - "$schema": "https://static.modelcontextprotocol.io/schemas/2025-07-09/server.schema.json", - "name": "io.modelcontextprotocol.anonymous/embedded-mcp", - "description": "MCP server embedded in a Desktop app", - "status": "active", - "website_url": "https://anonymous.modelcontextprotocol.io/embedded-mcp-guide", - "version": "0.1.0" -} -``` - -### Deprecated Server Example - -```json -{ - "name": "io.github.example/old-weather", - "description": "Legacy weather server - DEPRECATED: Use weather-v2 instead for new projects", - "status": "deprecated", - "repository": { - "url": "https://github.com/example/old-weather", - "source": "github", - "id": "legacy-abc123-def456-789012-345678-901234567890" - }, - "version": "0.9.5", - "packages": [ - { - "registry_type": "npm", - "registry_base_url": "https://registry.npmjs.org", - "identifier": "@legacy/old-weather-server", - "version": "0.9.5", - "transport": { - "type": "stdio" - }, - "environment_variables": [ - { - "name": "WEATHER_API_KEY", - "description": "Weather API key", - "is_required": true, - "is_secret": true - } - ] - } - ], - "_meta": { - "io.modelcontextprotocol.registry/publisher-provided": { - "tool": "legacy-publisher", - "version": "0.8.1", - "build_info": { - "timestamp": "2023-06-15T09:30:00Z", - "deprecation_notice": "This publisher is deprecated. Use npm-publisher v2.0+ for new projects.", - "maintenance_mode": true, - "final_version": true - } - } - } -} -``` \ No newline at end of file diff --git a/docs/README.md b/docs/README.md index cb06d3e..d276482 100644 --- a/docs/README.md +++ b/docs/README.md @@ -17,3 +17,4 @@ The MCP registry provides MCP clients with a list of MCP servers, like an app st - 📖 [Reference](./reference/) - Technical specifications - 🔧 [Contributing guides](./contributing/) - How to contribute - 🔒 [Administration](./administration/) - Admin operations +- 🤝 [Community projects](./community-projects.md) - Notable registry-related work from the community diff --git a/docs/administration/maintainer-onboarding.md b/docs/administration/maintainer-onboarding.md index f6e3871..aab0bea 100644 --- a/docs/administration/maintainer-onboarding.md +++ b/docs/administration/maintainer-onboarding.md @@ -16,7 +16,7 @@ When onboarding a new maintainer, complete the following steps: ### 3. README.md -- [ ] Add them to the "Current key maintainers" section in [README.md](../../README.md) +- [ ] Add them to the "Registry Working Group" section in [README.md](../../README.md) ### 4. Discord diff --git a/docs/contributing/add-package-registry.md b/docs/contributing/add-package-registry.md index 170c2d2..f6e07c8 100644 --- a/docs/contributing/add-package-registry.md +++ b/docs/contributing/add-package-registry.md @@ -51,6 +51,5 @@ These steps may evolve as additional validations or details are discovered and m - Add corresponding unit tests: `internal/validators/registries/yourregistry_test.go` - Register your validator in `internal/validators/validators.go` - Update the publishing documentation: - - Add a new publishing guide: `docs/guides/publishing/publish-[yourregistry].md`, following the pattern of existing publishing guides (e.g., `publish-npm.md`, `publish-pypi.md`) - - Include instructions on how to prepare packages for your registry, including any specific validation requirements - - Update `docs/guides/publishing/README.md` to reference your new publishing guide + - Add a section for your registry to `docs/modelcontextprotocol-io/package-types.mdx`, following the pattern of the existing registries (npm, PyPI, NuGet, ...) + - Include instructions on how to prepare packages for your registry, and an `### Ownership Verification` subsection describing the validation your registry requires diff --git a/docs/contributing/releasing.md b/docs/contributing/releasing.md index d7b625f..56f205b 100644 --- a/docs/contributing/releasing.md +++ b/docs/contributing/releasing.md @@ -5,8 +5,8 @@ 1. **Go to GitHub**: Navigate to https://github.com/modelcontextprotocol/registry/releases 2. **Click "Draft a new release"** 3. **Choose a tag**: Click "Choose a tag" and type a new semantic version that follows the last one available (e.g., `v1.0.0`) -5. **Generate notes**: Click "Generate release notes" to auto-populate the name and description -6. **Publish**: Click "Publish release" +4. **Generate notes**: Click "Generate release notes" to auto-populate the name and description +5. **Publish**: Click "Publish release" The release workflow will automatically: - Build binaries for 6 platforms (Linux, macOS, Windows × amd64, arm64) diff --git a/docs/design/design-principles.md b/docs/design/design-principles.md index d76627a..7d805be 100644 --- a/docs/design/design-principles.md +++ b/docs/design/design-principles.md @@ -25,13 +25,13 @@ The registry serves as the authoritative metadata repository for publicly-availa - Use mechanisms like DNS verification, OAuth to provide base layer of authentication and trust - Implement rate limiting, field validation, and blacklisting to prevent abuse -## 6. Reusable, Extensible Shapes; Not Infrastructure +## 5. Reusable, Extensible Shapes; Not Infrastructure - API shapes (OpenAPI, server.json) designed for reuse - Enable private/internal registries using same formats - Don't mandate infrastructure reuse - focus on interface compatibility -## 7. Progressive Enhancement +## 6. Progressive Enhancement - Start with MVP that provides immediate value - Build foundation that supports future features diff --git a/docs/design/roadmap.md b/docs/design/roadmap.md index 93b552b..8a14ca1 100644 --- a/docs/design/roadmap.md +++ b/docs/design/roadmap.md @@ -6,9 +6,15 @@ This roadmap may occasionally drift out of date. Please review [Issues](https:// ## Current Status +> [!NOTE] +> **The phase labelling below is out of date as of 2026-08-10.** The registry launched in preview on +> 2025-09-08 and the v0.1 API entered a freeze on 2025-10-24, so "Go-Live" has already happened. The +> phases are retained for historical context. See +> [Issues](https://github.com/modelcontextprotocol/registry/issues) for current work. + The initial version of the MCP Registry is actively being developed. The initial focus is on delivering a REST API to which server creators can publish, and aggregator/marketplace consumers can ETL. -## Phase 1: MVP/Go-Live (Current Focus) +## Phase 1: MVP/Go-Live See the [go-live blocker issues](https://github.com/modelcontextprotocol/registry/issues?q=is%3Aissue%20state%3Aopen%20label%3A%22go-live%20blocker%22). diff --git a/docs/design/tech-architecture.md b/docs/design/tech-architecture.md index 03097f7..f7fab72 100644 --- a/docs/design/tech-architecture.md +++ b/docs/design/tech-architecture.md @@ -1,5 +1,26 @@ # MCP Registry Technical Architecture +> [!WARNING] +> **This document has drifted from the shipped system and is kept as a design record.** +> For the architecture as deployed, see [deploy/README.md](../../deploy/README.md); for the API as +> implemented, see the [API reference](../reference/api/official-registry-api.md). +> +> Known inaccuracies below, as of 2026-08-10: +> - The registry is not deployed via a Helm chart. It is a plain Kubernetes `Deployment` created by +> Pulumi; Helm is used only for third-party components (ingress-nginx, cert-manager, +> cloudnative-pg, k8up, monitoring). +> - The database diagram shows a `StatefulSet` on port `27017` (MongoDB). The database is PostgreSQL +> on `5432`, provisioned by the CloudNativePG operator. +> - The DNS verification sequence (`mcp verify-domain`, `POST /verify-domain`, +> `POST /verify-domain/check`, server-issued challenge tokens) describes a design that was never +> built. The shipped flow signs a timestamp with the operator's key and posts it to +> `POST /v0/auth/dns`, with the public key published in a `v=MCPv1; k=...; p=...` TXT record. +> - No `/admin/*` routes exist. Admin actions use the regular server endpoints with an +> admin-permissioned token. +> - The CLI is `mcp-publisher`, not `mcp`, and publishing posts to `/v0/publish`. +> - The database stores servers and server extensions only; it holds no user authentication state +> and no DNS verification records. + This document describes the technical architecture of the MCP Registry, including system components, deployment strategies, and data flows. ## System Overview diff --git a/docs/reference/README.md b/docs/reference/README.md index ea77b30..5e5b0b0 100644 --- a/docs/reference/README.md +++ b/docs/reference/README.md @@ -7,11 +7,17 @@ Technical specifications and quick lookups for the MCP Registry. - [Generic Registry API](./api/generic-registry-api.md) - [Registry Authorization](./api/registry-authorization.md) - [Official Registry API](./api/official-registry-api.md) +- [API Extensions](./api/extensions.md) - The `_meta` extension namespaces +- [OpenAPI Specification](./api/openapi.yaml) +- [API Changelog](./api/CHANGELOG.md) ## server.json Reference - [Generic server.json Format](./server-json/generic-server-json.md) - [Official Registry Requirements](./server-json/official-registry-requirements.md) +- [Schema Changelog](./server-json/CHANGELOG.md) +- [Schema Change Process](./server-json/CONTRIBUTING.md) - How to propose a schema change +- [Draft Schema](./server-json/draft/) - The in-progress next schema version ## CLI Reference diff --git a/docs/reference/api/generic-registry-api.md b/docs/reference/api/generic-registry-api.md index f351021..a4476bd 100644 --- a/docs/reference/api/generic-registry-api.md +++ b/docs/reference/api/generic-registry-api.md @@ -18,7 +18,7 @@ The official registry has some more endpoints and restrictions on top of this. S - **`GET /v0.1/servers/{serverName}/versions`** - List all versions of a server - **`GET /v0.1/servers/{serverName}/versions/{version}`** - Get specific version of server. Use the special version `latest` to get the latest version. - **`POST /v0.1/publish`** - Publish new server (optional, registry-specific authentication) -- **`PUT /v0.1/servers/{serverName}/versions/{version}`** - Update specific server version (optional, not implemented by official registry) +- **`PUT /v0.1/servers/{serverName}/versions/{version}`** - Update specific server version (optional; the official registry implements this as an admin endpoint) - **`DELETE /v0.1/servers/{serverName}/versions/{version}`** - Delete specific server version (optional, not implemented by official registry) - **`PATCH /v0.1/servers/{serverName}/versions/{version}/status`** - Update server version status (optional) - **`PATCH /v0.1/servers/{serverName}/status`** - Update status for all versions (optional) diff --git a/docs/reference/api/official-registry-api.md b/docs/reference/api/official-registry-api.md index 2012885..47e461d 100644 --- a/docs/reference/api/official-registry-api.md +++ b/docs/reference/api/official-registry-api.md @@ -109,7 +109,17 @@ The `GET /v0.1/servers/{serverName}/versions` endpoint returns all versions of a **Authentication:** Requires `publish` or `edit` permission for the server namespace. +#### Validation endpoint +- POST `/v0.1/validate` - Validate a `server.json` without publishing it. Used by `mcp-publisher validate`. + +#### Service endpoints +- GET `/v0.1/ping` - Liveness check +- GET `/v0.1/version` - Registry version information + #### Admin endpoints - GET `/metrics` - Prometheus metrics endpoint - GET `/v0.1/health` - Basic health check endpoint - PUT `/v0.1/servers/{serverName}/versions/{version}` - Edit specific server version + +Note that `/v0.1/validate`, `/v0.1/ping`, `/v0.1/version` and `/v0.1/health` are not described in +[openapi.yaml](./openapi.yaml), which covers the server and publish endpoints only. diff --git a/docs/reference/server-json/official-registry-requirements.md b/docs/reference/server-json/official-registry-requirements.md index 886aee0..ac87d85 100644 --- a/docs/reference/server-json/official-registry-requirements.md +++ b/docs/reference/server-json/official-registry-requirements.md @@ -23,7 +23,7 @@ See the [publishing guide](../../modelcontextprotocol-io/quickstart.mdx) for aut All packages must include metadata proving the publisher owns them. This prevents impersonation and ensures authenticity (see more reasoning in [#96](https://github.com/modelcontextprotocol/registry/issues/96)). -For detailed verification requirements for each registry type, see the [publishing guide](../../modelcontextprotocol-io/quickstart.mdx). +For detailed verification requirements for each registry type, see [package types](../../modelcontextprotocol-io/package-types.mdx), which has an "Ownership Verification" section per registry. ## Restricted Registry Base URLs From 91cc4aed20aac1ab8da25b5830d4e78f8c98a878 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 20 Aug 2026 22:47:02 +0300 Subject: [PATCH 10/36] build(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.0 (#1554) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [github.com/stretchr/testify](https://github.com/stretchr/testify) from 1.11.1 to 1.12.0.
Release notes

Sourced from github.com/stretchr/testify's releases.

v1.12.0

What's Changed

Functional Changes

Fixes

Documentation, Build & CI

New Contributors

... (truncated)

Commits
  • 001eb79 Merge pull request #1905 from Kentzo/patch-1
  • ad40f38 Merge pull request #1906 from stretchr/dependabot/github_actions/actions/chec...
  • 3bae017 build(deps): bump actions/checkout from 6.0.2 to 6.0.3
  • f8c01f3 mock: Mock.Return does not exist anymore
  • 12f8b56 Merge pull request #1563 from stretchr/make-AssertionFunc-types-aliases
  • a11649e assert: make *AssertionFunc type just aliases
  • dc20f41 Merge pull request #1890 from stretchr/dolmen/codegen-modernize
  • 098f8d7 _codegen: use strings.Builder
  • d2699be _codegen: modernize
  • a463c8c Merge pull request #1885 from stretchr/dolmen/ci-check-ghactions-hashes
  • Additional commits viewable in compare view

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/stretchr/testify&package-manager=go_modules&previous-version=1.11.1&new-version=1.12.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 4 +--- go.sum | 8 ++------ 2 files changed, 3 insertions(+), 9 deletions(-) diff --git a/go.mod b/go.mod index ce6ad8a..42dda3a 100644 --- a/go.mod +++ b/go.mod @@ -15,7 +15,7 @@ require ( github.com/prometheus/client_golang v1.24.1 github.com/rs/cors v1.11.1 github.com/santhosh-tekuri/jsonschema/v5 v5.3.1 - github.com/stretchr/testify v1.11.1 + github.com/stretchr/testify v1.12.0 go.opentelemetry.io/contrib/instrumentation/runtime v0.69.0 go.opentelemetry.io/otel v1.44.0 go.opentelemetry.io/otel/exporters/prometheus v0.66.0 @@ -39,7 +39,6 @@ require ( github.com/AzureAD/microsoft-authentication-library-for-go v1.7.2 // indirect github.com/beorn7/perks v1.0.1 // indirect github.com/cespare/xxhash/v2 v2.3.0 // indirect - github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect github.com/docker/cli v29.6.2+incompatible // indirect github.com/docker/docker-credential-helpers v0.9.3 // indirect github.com/felixge/httpsnoop v1.0.4 // indirect @@ -59,7 +58,6 @@ require ( github.com/opencontainers/go-digest v1.0.0 // indirect github.com/opencontainers/image-spec v1.1.1 // indirect github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c // indirect - github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect github.com/prometheus/client_model v0.6.2 // indirect github.com/prometheus/common v0.70.1 // indirect github.com/prometheus/otlptranslator v1.0.0 // indirect diff --git a/go.sum b/go.sum index 3c731e5..efb5d96 100644 --- a/go.sum +++ b/go.sum @@ -41,8 +41,6 @@ github.com/coreos/go-oidc/v3 v3.20.0/go.mod h1:DYCf24+ncYi+XkIH97GY1+dqoRlbaSI26 github.com/danielgtaylor/huma/v2 v2.39.1 h1:0kwF4ltQoYZ+IU55VPy+BcGekzgF44R64daTGde1H+g= github.com/danielgtaylor/huma/v2 v2.39.1/go.mod h1:zcnQ38duIJ3VUHwFaBoZ6x8T+KN/mr33oyqxcj0HTug= github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= -github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM= -github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/docker/cli v29.6.2+incompatible h1:/bjePvcbbFTnRrMfWJBY7AjfICdsiLVgHn6LwTVOcqw= github.com/docker/cli v29.6.2+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8= github.com/docker/docker-credential-helpers v0.9.3 h1:gAm/VtF9wgqJMoxzT3Gj5p4AqIjCBS4wrsOh9yRqcz8= @@ -110,8 +108,6 @@ github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c/go.mod h1:7rwL4CYBLnjL github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 h1:GFCKgmp0tecUJ0sJuv4pzYCqS9+RGSn52M3FUwPs+uo= github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10/go.mod h1:t/avpk3KcrXxUnYOhZhMXJlSEyie6gQbtLq5NM3loB8= github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= -github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U= -github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= github.com/prometheus/client_golang v1.24.1 h1:JnJkREXzWxUdCuPFpIWZiPispT9xVV59uiuyR2bPlnU= github.com/prometheus/client_golang v1.24.1/go.mod h1:F+oSRECHg4sse5ucfYpYDeIv/hu68Zo0uoHKetWnzcE= github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk= @@ -133,8 +129,8 @@ github.com/sirupsen/logrus v1.9.4/go.mod h1:ftWc9WdOfJ0a92nsE2jF5u5ZwH8Bv2zdeOC4 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI= github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= -github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U= -github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U= +github.com/stretchr/testify v1.12.0 h1:K6Mr6jO9JICuend/5xzTM03ydSV3vdNRYAdPSukj8uI= +github.com/stretchr/testify v1.12.0/go.mod h1:bOYBZb5qJ00vPzWfIqBUZPaxK8jWiXc6d3ErP4Ca9Gw= github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM= github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg= go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64= From 17dec17a41f547b438195eff3e7e90bb7eb1530e Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 20 Aug 2026 22:47:18 +0300 Subject: [PATCH 11/36] build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.255.0 to 3.257.0 in /deploy (#1553) Bumps [github.com/pulumi/pulumi/sdk/v3](https://github.com/pulumi/pulumi) from 3.255.0 to 3.257.0.
Release notes

Sourced from github.com/pulumi/pulumi/sdk/v3's releases.

v3.257.0

3.257.0 (2026-08-13)

Features

  • [cli] Offer to create a first project after logging in to an account with no stacks #24133
  • [cli/do] Auto-assign identifiers to existing stack resources in pulumi do input expressions, and add pulumi do show-resources to list them #24184
  • [cli/do] Make "pulumi do <pkg> <resource> patch <name> work in stateful mode, overlaying the supplied inputs onto the existing snippet" #24295
  • [cli/state] Implement pulumi state get to show individual resources #24191
  • [cli/do] Fall back to an auto-created project and stack under PULUMI_HOME when pulumi do is invoked outside of a Pulumi project #24231

Bug Fixes

  • [sdkgen/go] Generated output-form invokes pass their arguments to the core SDK without resolving them first, so invoke dependencies can be inferred from arguments; generated SDKs now require pulumi SDK v3.255.0 or later #24060
  • [cli] Make 'pulumi stack history events --summary report the program errors from the language host #24111
  • [cli/cloud] pulumi api: repeated -H/--header values for the same header name now all reach the wire, instead of each one silently overwriting the last #24180
  • [cli/package] Maintain --server when adding to the packages section of Pulumi.yaml #24189
  • [sdk/go] Fix panics in hooks to not crash the entire process #24218
  • [programgen/go] for expressions are now generated as Go loops #24228
  • [programgen/go] Fix invalid _ := index statement emitted for resources with a numeric range whose value variable is unused #24227
  • [sdk/python] Report an error instead of hanging when a Python resource depends on its own parent #24230
  • [sdkgen/go] Generate the missing Go input types for resource input properties that are deeply nested collections of object types #24236
  • [programgen/go] Rename properties that collide with reserved names (e.g. elementType) the same way SDK codegen does, instead of emitting uncompilable code #24235
  • [cli/display] Show the value being added when a refresh or provider diff reports an added property #24245
  • [cli/plugin] Track when a plugin was last run so pulumi plugin ls reports an accurate last-used time on all platforms #24251
  • [engine] Show secrets in diff display when --show-secrets is passed #24253
  • [cli] Exit promptly when a command is cancelled while an HTTP request is being retried #24276

Improvements

  • [sdk/nodejs] Improve error message when resource registrations are still pending when pulumi exits #24082
  • [cli] Pass the invoked command (e.g. pulumi new) to the browser-based login/signup flow so Pulumi Cloud can attribute signups to the command that triggered them #24192

Miscellaneous

  • [sdkgen] Extension-parameterized packages now namespace their resource and function tokens under their own package name rather than the base provider's #24143
  • [java] Upgrade java to v1.35.0 #24202
  • [backend/diy] The deprecation warning is now an error. PULUMI_DIY_BACKEND_IGNORE_DEPRECATION_WARNING is now PULUMI_DIY_BACKEND_IGNORE_DEPRECATION_ERROR. #24216
  • [java] Upgrade java to v1.36.0 #24243
  • [sdk/dotnet] Upgrade dotnet to v3.111.1 #24249

v3.256.0

3.256.0 (2026-08-04)

Features

  • [cli] Add --ignore-protect flag to pulumi up, pulumi preview and pulumi destroy to allow deleting protected resources without unprotecting them in the state first #24053
  • [cli/env] Add an optional --export-env-vars flag to the env provider {aws,azure,gcp}-login commands to also set the standard SDK environment variables referencing the login outputs #24055
  • [cli] Add a --server flag to pulumi package add, publish, get-schema, get-mapping, gen-sdk, info and pulumi schema check that skips package resolution and uses the given URL as the plugin download URL #24107

... (truncated)

Changelog

Sourced from github.com/pulumi/pulumi/sdk/v3's changelog.

3.257.0 (2026-08-13)

Features

  • [cli] Offer to create a first project after logging in to an account with no stacks #24133
  • [cli/do] Auto-assign identifiers to existing stack resources in pulumi do input expressions, and add pulumi do show-resources to list them #24184
  • [cli/do] Make "pulumi do <pkg> <resource> patch <name> work in stateful mode, overlaying the supplied inputs onto the existing snippet" #24295
  • [cli/state] Implement pulumi state get to show individual resources #24191
  • [cli/do] Fall back to an auto-created project and stack under PULUMI_HOME when pulumi do is invoked outside of a Pulumi project #24231

Bug Fixes

  • [sdkgen/go] Generated output-form invokes pass their arguments to the core SDK without resolving them first, so invoke dependencies can be inferred from arguments; generated SDKs now require pulumi SDK v3.255.0 or later #24060
  • [cli] Make 'pulumi stack history events --summary report the program errors from the language host #24111
  • [cli/cloud] pulumi api: repeated -H/--header values for the same header name now all reach the wire, instead of each one silently overwriting the last #24180
  • [cli/package] Maintain --server when adding to the packages section of Pulumi.yaml #24189
  • [sdk/go] Fix panics in hooks to not crash the entire process #24218
  • [programgen/go] for expressions are now generated as Go loops #24228
  • [programgen/go] Fix invalid _ := index statement emitted for resources with a numeric range whose value variable is unused #24227
  • [sdk/python] Report an error instead of hanging when a Python resource depends on its own parent #24230
  • [sdkgen/go] Generate the missing Go input types for resource input properties that are deeply nested collections of object types #24236
  • [programgen/go] Rename properties that collide with reserved names (e.g. elementType) the same way SDK codegen does, instead of emitting uncompilable code #24235
  • [cli/display] Show the value being added when a refresh or provider diff reports an added property #24245
  • [cli/plugin] Track when a plugin was last run so pulumi plugin ls reports an accurate last-used time on all platforms #24251
  • [engine] Show secrets in diff display when --show-secrets is passed #24253
  • [cli] Exit promptly when a command is cancelled while an HTTP request is being retried #24276

Improvements

  • [sdk/nodejs] Improve error message when resource registrations are still pending when pulumi exits #24082
  • [cli] Pass the invoked command (e.g. pulumi new) to the browser-based login/signup flow so Pulumi Cloud can attribute signups to the command that triggered them #24192

Miscellaneous

  • [sdkgen] Extension-parameterized packages now namespace their resource and function tokens under their own package name rather than the base provider's #24143
  • [java] Upgrade java to v1.35.0 #24202
  • [backend/diy] The deprecation warning is now an error. PULUMI_DIY_BACKEND_IGNORE_DEPRECATION_WARNING is now PULUMI_DIY_BACKEND_IGNORE_DEPRECATION_ERROR. #24216
  • [java] Upgrade java to v1.36.0 #24243
  • [sdk/dotnet] Upgrade dotnet to v3.111.1 #24249

3.256.0 (2026-08-04)

Features

  • [cli] Add --ignore-protect flag to pulumi up, pulumi preview and pulumi destroy to allow deleting protected resources without unprotecting them in the state first #24053
  • [cli/env] Add an optional --export-env-vars flag to the env provider {aws,azure,gcp}-login commands to also set the standard SDK environment variables referencing the login outputs #24055
  • [cli] Add a --server flag to pulumi package add, publish, get-schema, get-mapping, gen-sdk, info and pulumi schema check that skips package resolution and uses the given URL as the plugin download URL #24107

Bug Fixes

  • [backend/service] Fix pulumi login --insecure not being reflected in the stack's service secrets manager state, which caused TLS verification failures against self-hosted backends using self-signed certificates #24134

... (truncated)

Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/pulumi/pulumi/sdk/v3&package-manager=go_modules&previous-version=3.255.0&new-version=3.257.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- deploy/go.mod | 6 +++--- deploy/go.sum | 12 ++++++------ 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/deploy/go.mod b/deploy/go.mod index d0c5488..48df63a 100644 --- a/deploy/go.mod +++ b/deploy/go.mod @@ -5,7 +5,7 @@ go 1.26 require ( github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.33.0 - github.com/pulumi/pulumi/sdk/v3 v3.255.0 + github.com/pulumi/pulumi/sdk/v3 v3.257.0 gopkg.in/yaml.v2 v2.4.0 ) @@ -50,7 +50,7 @@ require ( github.com/inconshreveable/mousetrap v1.1.0 // indirect github.com/json-iterator/go v1.1.12 // indirect github.com/kevinburke/ssh_config v1.6.0 // indirect - github.com/klauspost/compress v1.18.0 // indirect + github.com/klauspost/compress v1.18.7 // indirect github.com/klauspost/cpuid/v2 v2.3.0 // indirect github.com/lucasb-eyer/go-colorful v1.4.0 // indirect github.com/mattn/go-isatty v0.0.22 // indirect @@ -100,7 +100,7 @@ require ( go.uber.org/atomic v1.11.0 // indirect go.uber.org/multierr v1.11.0 // indirect golang.org/x/crypto v0.54.0 // indirect - golang.org/x/mod v0.37.0 // indirect + golang.org/x/mod v0.38.0 // indirect golang.org/x/net v0.57.0 // indirect golang.org/x/sync v0.22.0 // indirect golang.org/x/sys v0.47.0 // indirect diff --git a/deploy/go.sum b/deploy/go.sum index a5e4f9a..3a1ce8f 100644 --- a/deploy/go.sum +++ b/deploy/go.sum @@ -107,8 +107,8 @@ github.com/kevinburke/ssh_config v1.6.0/go.mod h1:q2RIzfka+BXARoNexmF9gkxEX7Dmvb github.com/kisielk/errcheck v1.2.0/go.mod h1:/BMXB+zMLi60iA8Vv6Ksmxu/1UDYcXs4uQLJ+jE2L00= github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8= github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck= -github.com/klauspost/compress v1.18.0 h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zttxdo= -github.com/klauspost/compress v1.18.0/go.mod h1:2Pp+KzxcywXVXMr50+X0Q/Lsb43OQHYWRCY2AiWywWQ= +github.com/klauspost/compress v1.18.7 h1:aUyZsS4kH3QTKurYhAOwAHxllVPnOthb3vPfnF1Ehjw= +github.com/klauspost/compress v1.18.7/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= github.com/klauspost/cpuid/v2 v2.3.0 h1:S4CRMLnYUhGeDFDqkGriYKdfoFlDnMtqTiI/sFzhA9Y= github.com/klauspost/cpuid/v2 v2.3.0/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0= github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo= @@ -172,8 +172,8 @@ github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 h1:w6OnO3d4j5yVf2vpm8OzXFC/xHOEGqt+9 github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1/go.mod h1:UyZyv7hz4knpFx6/Sh+SkZe6hT6sJHtDvw9A0TbvEsk= github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.33.0 h1:fFP72Q6/GfyI7BII3hUS7vn45Eg16zKIIS3I3R9bNEY= github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.33.0/go.mod h1:sIZVlvi6oFQMEgTa+XkYfr/sAXRfrprPo3Ja6UYpGEU= -github.com/pulumi/pulumi/sdk/v3 v3.255.0 h1:G872L4M1EPW3l60yEc52GgLpFRdXAVf0rn96q3MwDVQ= -github.com/pulumi/pulumi/sdk/v3 v3.255.0/go.mod h1:b99ZkmEGjVyW55blOwL94IfPLcaajhOfV8OTePZrRJM= +github.com/pulumi/pulumi/sdk/v3 v3.257.0 h1:75TpjUHz7rA8azrEOpTAD1Ox2f6Aj1pkxwzq+ufKQXM= +github.com/pulumi/pulumi/sdk/v3 v3.257.0/go.mod h1:pyYSaOHxk1R0bYiSzpcbYzeN3MBtlyckup9tvImBjjo= github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ= github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88= github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ= @@ -269,8 +269,8 @@ golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPI golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg= golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= -golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ= -golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0= +golang.org/x/mod v0.38.0 h1:MECBjubtXD7yj4HrhIUcywNaGeNVUdfVnxmPajOk4yk= +golang.org/x/mod v0.38.0/go.mod h1:V6Xz0pq8TQ3dGqVQ1FVHuelZpAL0uNhSkk9ogYP3c40= golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= From 4ec2ed3f9fe691fb42174a3bebfa1df59694b7a3 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 20 Aug 2026 22:47:32 +0300 Subject: [PATCH 12/36] build(deps): bump golang.org/x/mod from 0.38.0 to 0.40.0 (#1552) Bumps [golang.org/x/mod](https://github.com/golang/mod) from 0.38.0 to 0.40.0.
Commits
  • d3398d0 go.mod: update golang.org/x dependencies
  • 57549bf sumdb: ignore unrelated hashes in Lookup
  • 96f62ae sumdb/tlog: fix TileHashReader authentication bypass
  • 13be902 go.mod: update golang.org/x dependencies
  • See full diff in compare view

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=golang.org/x/mod&package-manager=go_modules&previous-version=0.38.0&new-version=0.40.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 42dda3a..457ba7a 100644 --- a/go.mod +++ b/go.mod @@ -22,7 +22,7 @@ require ( go.opentelemetry.io/otel/metric v1.44.0 go.opentelemetry.io/otel/sdk v1.44.0 go.opentelemetry.io/otel/sdk/metric v1.44.0 - golang.org/x/mod v0.38.0 + golang.org/x/mod v0.40.0 gopkg.in/yaml.v3 v3.0.1 ) diff --git a/go.sum b/go.sum index efb5d96..e4cd0cf 100644 --- a/go.sum +++ b/go.sum @@ -161,8 +161,8 @@ go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ= go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ= golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw= golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk= -golang.org/x/mod v0.38.0 h1:MECBjubtXD7yj4HrhIUcywNaGeNVUdfVnxmPajOk4yk= -golang.org/x/mod v0.38.0/go.mod h1:V6Xz0pq8TQ3dGqVQ1FVHuelZpAL0uNhSkk9ogYP3c40= +golang.org/x/mod v0.40.0 h1:hUv+3cXcdRHz08UmSiOob7sadHig73uo5bkXxQ/tvUs= +golang.org/x/mod v0.40.0/go.mod h1:0/weTWkPWGBikyTWAX3dkjVztMmBA5hM0DH6BElSupE= golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE= golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU= golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs= From 8759d9d8c05993cc18663ec7d4b9f81136c29ae6 Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Fri, 21 Aug 2026 00:14:13 +0300 Subject: [PATCH 13/36] ci: bump golangci-lint to v2.13.1 to fix panic on Go 1.27 (#1561) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit CI is red on `main` and on every open PR (including the Dependabot PRs #1531, #1552–#1554) with: ``` panic: file requires newer Go version go1.27 (application built with go1.26) golangci-lint exit with code 2 ``` ## Cause `actions/setup-go` with `go-version: 'stable'` started resolving to **go1.27.0**. The pinned golangci-lint **v2.11.4** release binary is built with **go1.26**, and its `go/types` refuses to typecheck source files declaring a newer language version. Nothing in the failing PRs is at fault. ## Fix Bump to **golangci-lint v2.13.1**, whose release binaries are built with go1.27, so linting works under `stable` again. That bump also pulls in newer linter versions, which surface 57 findings this tree did not have before. Handled as follows: | Linter | Count | Resolution | |---|---|---| | `goconst` | 50 | 39 were repeated literals in `_test.go` files — goconst started counting those in v2.12.0 (golangci-lint#6480 exposed `ignore-tests`). Fixture data like `"1.0.0"` (89 occurrences) is not a missing constant, so `goconst.ignore-tests: true`. The other 11 were real duplication in production code (OpenAPI tags, the `bearer` security scheme name, `$ref`, `http`/`https`) and became named constants. | | `gosec` G710 | 1 | **True positive, fixed.** See below. | | `staticcheck` SA1019 | 6 | Go 1.26 deprecated `ecdsa.PublicKey.X/Y` and `PrivateKey.D`. Annotated with the same targeted `nolint` + rationale already used for `ScalarBaseMult` in `cmd/publisher/auth/common.go`. | ### The open redirect is real `TrailingSlashMiddleware` copied the entire `*url.URL` before rewriting the path. For an absolute-form request URI — legal for a Go HTTP server to parse, e.g. `GET http://evil.com/foo/ HTTP/1.1` — `r.URL.Scheme` and `r.URL.Host` are populated, and they were echoed straight back in the `Location` header. The redirect target is now built from the cleaned path and query alone. The existing `path.Clean` hardening for GHSA-v8vw-gw5j-w7m6 (protocol-relative `//evil.com/`) is unchanged. ### Also Switched `gomodguard` → `gomodguard_v2`; the former is deprecated as of v2.12.0 and was emitting a warning on every run. ## Verification - `golangci-lint v2.13.1` against this tree: **0 issues**, no deprecation warnings - `make validate`: all validations passed - `go build ./...` and tests for every touched package pass (DB-backed tests need Postgres; left to CI) ## Note on migrating the ecdsa key paths Moving those six sites to `PublicKey.Bytes` / `ParseUncompressedPublicKey` / `crypto/ecdh` touches key parsing and signature verification. It should be its own reviewed PR rather than riding along on a CI unblock. Happy to open one. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5 (1M context) --- .github/workflows/ci.yml | 2 +- .golangci.yml | 6 +++++- cmd/publisher/auth/azurekeyvault/common.go | 4 ++-- cmd/publisher/auth/common.go | 6 +++--- internal/api/handlers/v0/auth/common.go | 2 +- internal/api/handlers/v0/auth/dns.go | 2 +- internal/api/handlers/v0/auth/github_at.go | 2 +- internal/api/handlers/v0/auth/github_oidc.go | 2 +- internal/api/handlers/v0/auth/http.go | 2 +- internal/api/handlers/v0/auth/main.go | 3 +++ internal/api/handlers/v0/auth/none.go | 2 +- internal/api/handlers/v0/auth/oidc.go | 2 +- internal/api/handlers/v0/edit.go | 4 ++-- internal/api/handlers/v0/openapi.go | 12 ++++++++++++ internal/api/handlers/v0/publish.go | 2 +- internal/api/handlers/v0/servers.go | 6 +++--- internal/api/handlers/v0/status.go | 8 ++++---- internal/api/server.go | 12 ++++++++++-- internal/validators/utils.go | 13 +++++++++---- tools/extract-server-schema/main.go | 9 ++++++--- 20 files changed, 68 insertions(+), 33 deletions(-) create mode 100644 internal/api/handlers/v0/openapi.go diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 87a36bd..4e42207 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -27,7 +27,7 @@ jobs: - name: Run lint uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a with: - version: v2.11.4 + version: v2.13.1 - name: Validate schemas and examples run: make validate diff --git a/.golangci.yml b/.golangci.yml index 5f3ad3c..571ead5 100644 --- a/.golangci.yml +++ b/.golangci.yml @@ -22,7 +22,7 @@ linters: - gocyclo - godox - gomoddirectives - - gomodguard + - gomodguard_v2 - goprintffuncname - gosec - grouper @@ -55,6 +55,10 @@ linters: max-complexity: 20 dupl: threshold: 300 + goconst: + # Repeated literals in tests are fixture data ("1.0.0", "Test server", ...); + # hoisting them into constants hurts readability more than it helps. + ignore-tests: true gocognit: min-complexity: 51 nestif: diff --git a/cmd/publisher/auth/azurekeyvault/common.go b/cmd/publisher/auth/azurekeyvault/common.go index d1e9501..776ed14 100644 --- a/cmd/publisher/auth/azurekeyvault/common.go +++ b/cmd/publisher/auth/azurekeyvault/common.go @@ -64,8 +64,8 @@ func (d Signer) GetSignedTimestamp(ctx context.Context) (*string, []byte, error) fmt.Fprintln(os.Stdout, "Successfully read the public key from Key Vault.") auth.PrintEcdsaP384KeyInfo(ecdsa.PublicKey{ Curve: elliptic.P384(), - X: new(big.Int).SetBytes(keyResp.Key.X), - Y: new(big.Int).SetBytes(keyResp.Key.Y), + X: new(big.Int).SetBytes(keyResp.Key.X), //nolint:staticcheck // SA1019: needs crypto/ecdh refactor + Y: new(big.Int).SetBytes(keyResp.Key.Y), //nolint:staticcheck // SA1019: needs crypto/ecdh refactor }) timestamp := auth.GetTimestamp() diff --git a/cmd/publisher/auth/common.go b/cmd/publisher/auth/common.go index 053b543..c12386a 100644 --- a/cmd/publisher/auth/common.go +++ b/cmd/publisher/auth/common.go @@ -164,10 +164,10 @@ func parseRawPrivateKey(curve elliptic.Curve, privateKeyBytes []byte) (*ecdsa.Pr return &ecdsa.PrivateKey{ PublicKey: ecdsa.PublicKey{ Curve: curve, - X: x, - Y: y, + X: x, //nolint:staticcheck // SA1019: needs crypto/ecdh refactor + Y: y, //nolint:staticcheck // SA1019: needs crypto/ecdh refactor }, - D: d, + D: d, //nolint:staticcheck // SA1019: needs crypto/ecdh refactor }, nil } diff --git a/internal/api/handlers/v0/auth/common.go b/internal/api/handlers/v0/auth/common.go index 4c79bfc..f1665e4 100644 --- a/internal/api/handlers/v0/auth/common.go +++ b/internal/api/handlers/v0/auth/common.go @@ -372,7 +372,7 @@ func ParsePublicKey(algorithm, publicKey string) (*PublicKeyInfo, error) { } return &PublicKeyInfo{ Algorithm: AlgorithmECDSAP384, - Key: ecdsa.PublicKey{Curve: curve, X: x, Y: y}, + Key: ecdsa.PublicKey{Curve: curve, X: x, Y: y}, //nolint:staticcheck // SA1019: needs crypto/ecdh refactor }, nil } diff --git a/internal/api/handlers/v0/auth/dns.go b/internal/api/handlers/v0/auth/dns.go index cc18082..73508c9 100644 --- a/internal/api/handlers/v0/auth/dns.go +++ b/internal/api/handlers/v0/auth/dns.go @@ -62,7 +62,7 @@ func RegisterDNSEndpoint(api huma.API, pathPrefix string, cfg *config.Config) { Path: pathPrefix + "/auth/dns", Summary: "Exchange DNS signature for Registry JWT", Description: "Authenticate using DNS TXT record public key and signed timestamp", - Tags: []string{"auth"}, + Tags: []string{tagAuth}, }, func(ctx context.Context, input *DNSTokenExchangeInput) (*v0.Response[auth.TokenResponse], error) { response, err := handler.ExchangeToken(ctx, input.Body.Domain, input.Body.Timestamp, input.Body.SignedTimestamp) if err != nil { diff --git a/internal/api/handlers/v0/auth/github_at.go b/internal/api/handlers/v0/auth/github_at.go index 868ea8e..e11d4f0 100644 --- a/internal/api/handlers/v0/auth/github_at.go +++ b/internal/api/handlers/v0/auth/github_at.go @@ -54,7 +54,7 @@ func RegisterGitHubATEndpoint(api huma.API, pathPrefix string, cfg *config.Confi Path: pathPrefix + "/auth/github-at", Summary: "Exchange GitHub OAuth access token for Registry JWT", Description: "Exchange a GitHub OAuth access token for a short-lived Registry JWT token", - Tags: []string{"auth"}, + Tags: []string{tagAuth}, }, func(ctx context.Context, input *GitHubTokenExchangeInput) (*v0.Response[auth.TokenResponse], error) { response, err := handler.ExchangeToken(ctx, input.Body.GitHubToken) if err != nil { diff --git a/internal/api/handlers/v0/auth/github_oidc.go b/internal/api/handlers/v0/auth/github_oidc.go index 5ce38ac..de95c67 100644 --- a/internal/api/handlers/v0/auth/github_oidc.go +++ b/internal/api/handlers/v0/auth/github_oidc.go @@ -235,7 +235,7 @@ func RegisterGitHubOIDCEndpoint(api huma.API, pathPrefix string, cfg *config.Con Path: pathPrefix + "/auth/github-oidc", Summary: "Exchange GitHub OIDC token for Registry JWT", Description: "Exchange a GitHub Actions OIDC token for a short-lived Registry JWT token", - Tags: []string{"auth"}, + Tags: []string{tagAuth}, }, func(ctx context.Context, input *GitHubOIDCTokenExchangeInput) (*v0.Response[auth.TokenResponse], error) { response, err := handler.ExchangeToken(ctx, input.Body.OIDCToken) if err != nil { diff --git a/internal/api/handlers/v0/auth/http.go b/internal/api/handlers/v0/auth/http.go index 8f438b7..5392762 100644 --- a/internal/api/handlers/v0/auth/http.go +++ b/internal/api/handlers/v0/auth/http.go @@ -242,7 +242,7 @@ func RegisterHTTPEndpoint(api huma.API, pathPrefix string, cfg *config.Config) { Path: pathPrefix + "/auth/http", Summary: "Exchange HTTP signature for Registry JWT", Description: "Authenticate using HTTP-hosted public key and signed timestamp", - Tags: []string{"auth"}, + Tags: []string{tagAuth}, }, func(ctx context.Context, input *HTTPTokenExchangeInput) (*v0.Response[auth.TokenResponse], error) { response, err := handler.ExchangeToken(ctx, input.Body.Domain, input.Body.Timestamp, input.Body.SignedTimestamp) if err != nil { diff --git a/internal/api/handlers/v0/auth/main.go b/internal/api/handlers/v0/auth/main.go index 26a566b..62d9883 100644 --- a/internal/api/handlers/v0/auth/main.go +++ b/internal/api/handlers/v0/auth/main.go @@ -5,6 +5,9 @@ import ( "github.com/modelcontextprotocol/registry/internal/config" ) +// tagAuth is the OpenAPI tag grouping all token exchange operations. +const tagAuth = "auth" + // RegisterAuthEndpoints registers all authentication endpoints with a custom path prefix func RegisterAuthEndpoints(api huma.API, pathPrefix string, cfg *config.Config) { // Register GitHub access token authentication endpoint diff --git a/internal/api/handlers/v0/auth/none.go b/internal/api/handlers/v0/auth/none.go index 9f373c1..2549208 100644 --- a/internal/api/handlers/v0/auth/none.go +++ b/internal/api/handlers/v0/auth/none.go @@ -43,7 +43,7 @@ func RegisterNoneEndpoint(api huma.API, pathPrefix string, cfg *config.Config) { Path: pathPrefix + "/auth/none", Summary: "Get anonymous Registry JWT (Development/Testing Only)", Description: "Get a short-lived Registry JWT token for publishing and editing servers in the io.modelcontextprotocol.anonymous/* namespace. This endpoint is intended for local development and automated testing only.", - Tags: []string{"auth"}, + Tags: []string{tagAuth}, }, func(ctx context.Context, _ *struct{}) (*v0.Response[auth.TokenResponse], error) { response, err := handler.GetAnonymousToken(ctx) if err != nil { diff --git a/internal/api/handlers/v0/auth/oidc.go b/internal/api/handlers/v0/auth/oidc.go index 98526e1..1b63daf 100644 --- a/internal/api/handlers/v0/auth/oidc.go +++ b/internal/api/handlers/v0/auth/oidc.go @@ -159,7 +159,7 @@ func RegisterOIDCEndpoints(api huma.API, pathPrefix string, cfg *config.Config) Path: pathPrefix + "/auth/oidc", Summary: "Exchange OIDC ID token for Registry JWT", Description: "Exchange an OIDC ID token from any configured provider for a short-lived Registry JWT token", - Tags: []string{"auth"}, + Tags: []string{tagAuth}, }, func(ctx context.Context, input *OIDCTokenExchangeInput) (*v0.Response[auth.TokenResponse], error) { response, err := handler.ExchangeToken(ctx, input.Body.OIDCToken) if err != nil { diff --git a/internal/api/handlers/v0/edit.go b/internal/api/handlers/v0/edit.go index a927e7b..e552bbe 100644 --- a/internal/api/handlers/v0/edit.go +++ b/internal/api/handlers/v0/edit.go @@ -37,9 +37,9 @@ func RegisterEditEndpoints(api huma.API, pathPrefix string, registry service.Reg Path: pathPrefix + "/servers/{serverName}/versions/{version}", Summary: "Edit MCP server", Description: "Update the configuration of a specific version of an existing MCP server. Requires edit permission for the server. Use PATCH /servers/{serverName}/versions/{version}/status to update status metadata.", - Tags: []string{"servers"}, + Tags: []string{tagServers}, Security: []map[string][]string{ - {"bearer": {}}, + {securitySchemeBearer: {}}, }, }, func(ctx context.Context, input *EditServerInput) (*Response[apiv0.ServerResponse], error) { // Extract bearer token diff --git a/internal/api/handlers/v0/openapi.go b/internal/api/handlers/v0/openapi.go new file mode 100644 index 0000000..2dee9fd --- /dev/null +++ b/internal/api/handlers/v0/openapi.go @@ -0,0 +1,12 @@ +package v0 + +// Shared OpenAPI operation metadata, kept in one place so the generated spec +// groups operations consistently. +const ( + // tagServers groups the server CRUD and status operations. + tagServers = "servers" + + // securitySchemeBearer is the name of the Registry JWT bearer security + // scheme declared in the OpenAPI spec. + securitySchemeBearer = "bearer" +) diff --git a/internal/api/handlers/v0/publish.go b/internal/api/handlers/v0/publish.go index 5bd371e..bc01591 100644 --- a/internal/api/handlers/v0/publish.go +++ b/internal/api/handlers/v0/publish.go @@ -32,7 +32,7 @@ func RegisterPublishEndpoint(api huma.API, pathPrefix string, registry service.R Description: "Publish a new MCP server to the registry or update an existing one", Tags: []string{"publish"}, Security: []map[string][]string{ - {"bearer": {}}, + {securitySchemeBearer: {}}, }, }, func(ctx context.Context, input *PublishServerInput) (*Response[apiv0.ServerResponse], error) { // Extract bearer token diff --git a/internal/api/handlers/v0/servers.go b/internal/api/handlers/v0/servers.go index 059095d..7b14452 100644 --- a/internal/api/handlers/v0/servers.go +++ b/internal/api/handlers/v0/servers.go @@ -90,7 +90,7 @@ func RegisterServersEndpoints(api huma.API, pathPrefix string, registry service. Path: pathPrefix + "/servers", Summary: "List MCP servers", Description: "Get a paginated list of MCP servers from the registry", - Tags: []string{"servers"}, + Tags: []string{tagServers}, }, func(ctx context.Context, input *ListServersInput) (*Response[apiv0.ServerListResponse], error) { // Build filter from input parameters filter := &database.ServerFilter{} @@ -159,7 +159,7 @@ func RegisterServersEndpoints(api huma.API, pathPrefix string, registry service. Path: pathPrefix + "/servers/{serverName}/versions/{version}", Summary: "Get specific MCP server version", Description: "Get detailed information about a specific version of an MCP server. Use the special version 'latest' to get the latest version.", - Tags: []string{"servers"}, + Tags: []string{tagServers}, }, func(ctx context.Context, input *ServerVersionDetailInput) (*Response[apiv0.ServerResponse], error) { // URL-decode the server name serverName, err := url.PathUnescape(input.ServerName) @@ -201,7 +201,7 @@ func RegisterServersEndpoints(api huma.API, pathPrefix string, registry service. Path: pathPrefix + "/servers/{serverName}/versions", Summary: "Get all versions of an MCP server", Description: "Get all available versions for a specific MCP server", - Tags: []string{"servers"}, + Tags: []string{tagServers}, }, func(ctx context.Context, input *ServerVersionsInput) (*Response[apiv0.ServerListResponse], error) { // URL-decode the server name serverName, err := url.PathUnescape(input.ServerName) diff --git a/internal/api/handlers/v0/status.go b/internal/api/handlers/v0/status.go index 3f03fc2..f3cca85 100644 --- a/internal/api/handlers/v0/status.go +++ b/internal/api/handlers/v0/status.go @@ -83,9 +83,9 @@ func RegisterStatusEndpoints(api huma.API, pathPrefix string, registry service.R Path: pathPrefix + "/servers/{serverName}/versions/{version}/status", Summary: "Update MCP server status", Description: "Update the status metadata of a specific version of an MCP server. Requires publish or edit permission for the server. This endpoint allows changing status and status message without requiring the full server configuration.", - Tags: []string{"servers"}, + Tags: []string{tagServers}, Security: []map[string][]string{ - {"bearer": {}}, + {securitySchemeBearer: {}}, }, }, func(ctx context.Context, input *UpdateServerStatusInput) (*Response[apiv0.ServerResponse], error) { // Extract bearer token @@ -198,9 +198,9 @@ func RegisterAllVersionsStatusEndpoints(api huma.API, pathPrefix string, registr Path: pathPrefix + "/servers/{serverName}/status", Summary: "Update status for all versions of an MCP server", Description: "Update the status metadata of all versions of an MCP server in a single transaction. Requires publish or edit permission for the server. Either all versions are updated or none on failure.", - Tags: []string{"servers"}, + Tags: []string{tagServers}, Security: []map[string][]string{ - {"bearer": {}}, + {securitySchemeBearer: {}}, }, }, func(ctx context.Context, input *UpdateAllVersionsStatusInput) (*Response[UpdateAllVersionsStatusResponse], error) { // Extract bearer token diff --git a/internal/api/server.go b/internal/api/server.go index 3cb8a7f..c8ce97c 100644 --- a/internal/api/server.go +++ b/internal/api/server.go @@ -5,6 +5,7 @@ import ( "encoding/json" "log" "net/http" + "net/url" "path" "strings" "time" @@ -72,11 +73,18 @@ func TrailingSlashMiddleware(next http.Handler) http.Handler { return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { // Only redirect if the path is not "/" and ends with a "/" if r.URL.Path != "/" && strings.HasSuffix(r.URL.Path, "/") { + // Build the target from the path and query alone, dropping any + // scheme/host the client may have supplied in an absolute-form + // request URI ("GET http://evil.com/foo/ HTTP/1.1"), which would + // otherwise be echoed back as an off-site redirect. + // // path.Clean both removes the trailing slash and collapses any // leading "//" to "/", which prevents an open-redirect via a // protocol-relative path like "//evil.com/" (GHSA-v8vw-gw5j-w7m6). - newURL := *r.URL - newURL.Path = path.Clean(r.URL.Path) + newURL := url.URL{ + Path: path.Clean(r.URL.Path), + RawQuery: r.URL.RawQuery, + } // Use 308 Permanent Redirect to preserve the request method http.Redirect(w, r, newURL.String(), http.StatusPermanentRedirect) diff --git a/internal/validators/utils.go b/internal/validators/utils.go index 035132d..2e1aea7 100644 --- a/internal/validators/utils.go +++ b/internal/validators/utils.go @@ -6,6 +6,11 @@ import ( "strings" ) +const ( + schemeHTTP = "http" + schemeHTTPS = "https" +) + var ( // Regular expressions for validating repository URLs // These regex patterns ensure the URL is in the format of a valid GitHub or GitLab repository @@ -52,8 +57,8 @@ func replaceTemplateVariables(rawURL string) string { "{host}": "example.com", "{port}": "8080", "{path}": "api", - "{protocol}": "http", - "{scheme}": "http", + "{protocol}": schemeHTTP, + "{scheme}": schemeHTTP, } result := rawURL @@ -86,7 +91,7 @@ func IsValidURL(rawURL string) bool { } // Check if scheme is present (http or https) - if u.Scheme != "http" && u.Scheme != "https" { + if u.Scheme != schemeHTTP && u.Scheme != schemeHTTPS { return false } @@ -153,7 +158,7 @@ func IsValidRemoteURL(rawURL string) bool { return false } - if u.Scheme != "https" { + if u.Scheme != schemeHTTPS { return false } diff --git a/tools/extract-server-schema/main.go b/tools/extract-server-schema/main.go index a90aa2d..e7e5bd1 100644 --- a/tools/extract-server-schema/main.go +++ b/tools/extract-server-schema/main.go @@ -14,6 +14,9 @@ import ( const ( openAPIPath = "docs/reference/api/openapi.yaml" schemaOutputDir = "docs/reference/server-json/draft" + + // refKey is the JSON Schema reference key. + refKey = "$ref" ) func main() { @@ -99,7 +102,7 @@ func main() { "$schema": "http://json-schema.org/draft-07/schema#", "$id": schemaID, "title": "server.json defining a Model Context Protocol (MCP) server", - "$ref": "#/definitions/ServerDetail", + refKey: "#/definitions/ServerDetail", "definitions": definitions, } @@ -148,7 +151,7 @@ func findReferencedSchemas(obj interface{}, found map[string]bool) { switch v := obj.(type) { case map[string]interface{}: for key, value := range v { - if key == "$ref" { + if key == refKey { if ref, ok := value.(string); ok { // Extract schema name from #/components/schemas/SchemaName if strings.HasPrefix(ref, "#/components/schemas/") { @@ -173,7 +176,7 @@ func replaceComponentRefs(obj interface{}) interface{} { case map[string]interface{}: result := make(map[string]interface{}) for key, value := range v { - if key == "$ref" { + if key == refKey { if ref, ok := value.(string); ok { // Replace the reference path result[key] = strings.ReplaceAll(ref, "#/components/schemas/", "#/definitions/") From 5022e04399793e40f678ce003e22f1a4b623ba41 Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Fri, 21 Aug 2026 01:43:05 +0300 Subject: [PATCH 14/36] ci: widen the publish-attempt path list (#1560) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit #1524 tried to publish by adding `data/servers/io.decisionrules/server.json`. The detector ran fine and logged: ``` Non-publish file changed: data/servers/io.decisionrules/server.json PR #1524 match=false ``` The path list only knew `servers/**` at the repo root and exactly `data/seed.json`. Putting the file under `data/servers/` is a natural guess given `data/seed.json` exists, and it fell straight through. Adds `data/servers/**` plus root-level `server.json` / `servers.json`. `find` confirms nothing legitimate lives at any of those paths today. The list stays explicit rather than becoming a broad `**/server.json` glob. The classifier only flags a PR when *every* changed file matches, which makes widening asymmetric: too narrow silently misses spam, too broad auto-closes a legitimate single-file PR. Both copies of the list (stage 1 and stage 2) are updated identically, with a comment on each pointing at the other. ## Testing `actionlint` clean. macOS ships bash 3.2, so I extracted the literal `if [[ ... ]]` condition from each workflow file and ran it under bash 5 in Docker — testing the shipped text rather than a retyped copy. Both copies are byte-identical and agree: ``` MATCH data/servers/io.decisionrules/server.json # PR 1524 MATCH servers/com.aradia/x.json # PR 1549 MATCH data/seed.json MATCH server.json MATCH servers.json keep internal/api/handler.go keep internal/servers/service.go keep data/servers.md keep docs/README.md ``` Also dry-ran the full classifier against all 35 currently-open PRs from untrusted authors: **0 would be closed**. No legitimate open PR is affected. ## Known remaining gap (deliberately not fixed here) The detector does not run at all for authors new to GitHub. This repo's Actions approval policy is `first_time_contributors_new_to_github`, so their fork PRs sit in `action_required` until a maintainer approves the run. That is why #1549 was never flagged. I'm leaving that alone for now because the numbers don't justify the fix. Since the automation landed on 2026-07-09 it has had **71 detect runs: 70 ran, 1 was gated**. It has correctly closed 3 publish attempts (SAGE, Diagram Generation API, Kairos Signal) and missed 2 — one to the path bug this PR fixes, one to the gate. So the gate costs roughly one missed PR every six weeks, and those get closed manually within a day. The only ways around it are `pull_request_target` (runs untrusted PRs in a privileged context — one future `actions/checkout` from being a privilege-escalation hole) or a scheduled sweep (works, but trades the two-stage design for cron semantics and a ~15 min delay). Neither seems worth it at that rate. Happy to open a follow-up if you'd rather close the gap. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5 (1M context) --- .../workflows/close-invalid-publish-prs.yml | 9 +++++++-- .../workflows/detect-invalid-publish-prs.yml | 18 +++++++++++++++--- 2 files changed, 22 insertions(+), 5 deletions(-) diff --git a/.github/workflows/close-invalid-publish-prs.yml b/.github/workflows/close-invalid-publish-prs.yml index 934421b..8666c3b 100644 --- a/.github/workflows/close-invalid-publish-prs.yml +++ b/.github/workflows/close-invalid-publish-prs.yml @@ -34,7 +34,7 @@ jobs: COMMENT_BODY: | Hi @__AUTHOR__ 👋 — thanks for your interest in the MCP Registry! - It looks like this PR is trying to publish an MCP server by adding or editing files in this repository (under `servers/` or in `data/seed.json`). That isn't how servers get published, so I'm closing this PR automatically. + It looks like this PR is trying to publish an MCP server by adding or editing server files in this repository (under `servers/`, `data/servers/`, or in `data/seed.json`). That isn't how servers get published, so I'm closing this PR automatically. **Servers are published with the [`mcp-publisher`](https://github.com/modelcontextprotocol/registry/blob/main/docs/modelcontextprotocol-io/quickstart.mdx) CLI**, not by opening a pull request against this repo. The CLI verifies that you own your namespace and submits your `server.json` directly to the live registry API. @@ -121,10 +121,15 @@ jobs: echo "No files for PR #$PR_NUMBER; skipping." exit 0 fi + # Keep this list in sync with the copy in stage 1. publish_attempt=0 other=0 for f in "${FILES[@]}"; do - if [[ "$f" == servers/* || "$f" == "data/seed.json" ]]; then + if [[ "$f" == servers/* \ + || "$f" == data/servers/* \ + || "$f" == "data/seed.json" \ + || "$f" == "server.json" \ + || "$f" == "servers.json" ]]; then publish_attempt=1 else other=1 diff --git a/.github/workflows/detect-invalid-publish-prs.yml b/.github/workflows/detect-invalid-publish-prs.yml index 355521b..c200f86 100644 --- a/.github/workflows/detect-invalid-publish-prs.yml +++ b/.github/workflows/detect-invalid-publish-prs.yml @@ -48,12 +48,24 @@ jobs: mapfile -t FILES < <(gh api --paginate "repos/$GH_REPO/pulls/$PR_NUMBER/files" --jq '.[].filename') if [ "${#FILES[@]}" -gt 0 ]; then # Flag only if the PR touches *exclusively* publish-attempt files - # (servers/** and/or data/seed.json) and nothing else, so that - # legit PRs touching seed data alongside real code are left alone. + # and nothing else, so that legit PRs touching seed data + # alongside real code are left alone. + # + # Keep this list in sync with the copy in stage 2. It stays an + # explicit list rather than a broad `**/server.json` glob: + # because we require *every* file to match, an over-broad + # pattern would auto-close a legitimate single-file PR. + # data/servers/** is here because #1524 put its server.json + # there - a natural guess next to data/seed.json - and slipped + # through the original servers/**-only list. publish_attempt=0 other=0 for f in "${FILES[@]}"; do - if [[ "$f" == servers/* || "$f" == "data/seed.json" ]]; then + if [[ "$f" == servers/* \ + || "$f" == data/servers/* \ + || "$f" == "data/seed.json" \ + || "$f" == "server.json" \ + || "$f" == "servers.json" ]]; then publish_attempt=1 else echo "Non-publish file changed: $f" From 3c1ee7d27227a30d40dffa7ab2bc558a907462d3 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 21 Aug 2026 01:48:09 +0300 Subject: [PATCH 15/36] build(deps): bump github.com/google/go-containerregistry from 0.21.8 to 0.21.9 (#1531) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry) from 0.21.8 to 0.21.9.
Release notes

Sourced from github.com/google/go-containerregistry's releases.

v0.21.9

What's Changed

Full Changelog: https://github.com/google/go-containerregistry/compare/v0.21.8...v0.21.9

Commits
  • 7b32099 build(deps): bump the actions group with 3 updates (#2398)
  • 2a4447d fix: remove '.' from unsafe path prefixes (#2400)
  • 43cc3e8 fix: prevent data race on scope refreshes within remote.writer (#2396)
  • 7775aab actions: pin slsa generator version following linter exception (#2395)
  • See full diff in compare view

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/google/go-containerregistry&package-manager=go_modules&previous-version=0.21.8&new-version=0.21.9)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Radoslav Dimitrov --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 457ba7a..bb46065 100644 --- a/go.mod +++ b/go.mod @@ -10,7 +10,7 @@ require ( github.com/coreos/go-oidc/v3 v3.20.0 github.com/danielgtaylor/huma/v2 v2.39.1 github.com/golang-jwt/jwt/v5 v5.3.1 - github.com/google/go-containerregistry v0.21.8 + github.com/google/go-containerregistry v0.21.9 github.com/jackc/pgx/v5 v5.10.0 github.com/prometheus/client_golang v1.24.1 github.com/rs/cors v1.11.1 diff --git a/go.sum b/go.sum index e4cd0cf..904ff2b 100644 --- a/go.sum +++ b/go.sum @@ -69,8 +69,8 @@ github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps= github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8= github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU= -github.com/google/go-containerregistry v0.21.8 h1:Ig/zIsnztdCUNaiNNczE+MoP5xcyUMfvpvfOr1xyMLE= -github.com/google/go-containerregistry v0.21.8/go.mod h1:dP5XNKcL7kMFF/TB3LfvWmVhAcv7iqkHb3oDK8aauTo= +github.com/google/go-containerregistry v0.21.9 h1:F+D4uZ3iA3DLMJLfhaqMdHJbzeqm/216WGQq2dokuLs= +github.com/google/go-containerregistry v0.21.9/go.mod h1:dP5XNKcL7kMFF/TB3LfvWmVhAcv7iqkHb3oDK8aauTo= github.com/google/s2a-go v0.1.9 h1:LGD7gtMgezd8a/Xak7mEWL0PjoTQFvpRudN895yqKW0= github.com/google/s2a-go v0.1.9/go.mod h1:YA0Ei2ZQL3acow2O62kdp9UlnvMmU7kA6Eutn0dXayM= github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= From 6036804f1c62633b5e7d2927f411a6f4127f148a Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 21 Aug 2026 01:48:19 +0300 Subject: [PATCH 16/36] build(deps): bump the opentelemetry group across 1 directory with 6 updates (#1530) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps the opentelemetry group with 2 updates in the / directory: [go.opentelemetry.io/contrib/instrumentation/runtime](https://github.com/open-telemetry/opentelemetry-go-contrib) and [go.opentelemetry.io/otel/exporters/prometheus](https://github.com/open-telemetry/opentelemetry-go). Updates `go.opentelemetry.io/contrib/instrumentation/runtime` from 0.69.0 to 0.70.0
Changelog

Sourced from go.opentelemetry.io/contrib/instrumentation/runtime's changelog.

[1.45.0/2.5.2/0.70.0/0.37.2/0.25.0/0.20.0/0.16.2/0.17.0] - 2026-08-03

Added

  • Add go.opentelemetry.io/contrib/detectors/ibmcloud/vpc, a new resource detector for IBM Cloud VPC virtual server instances, ported from github.com/open-telemetry/opentelemetry-collector-contrib/processor/resourcedetectionprocessor/internal/ibmcloud/vpc. Detects cloud.provider, cloud.platform, cloud.region, cloud.availability_zone, cloud.account.id, cloud.resource_id, host.id, host.image.id, host.image.name, host.name, and host.type. (#9011)
  • Add go.opentelemetry.io/contrib/detectors/k8sapi, a new resource detector that queries the Kubernetes API. Detects k8s.node.name and k8s.node.uid when K8S_NODE_NAME is set via the downward API, and k8s.cluster.uid derived from the kube-system namespace UID (works on any Kubernetes distribution). (#9108)
  • Add new elasticbeanstalk resource detector for AWS Elastic Beanstalk, ported from processor/resourcedetectionprocessor/internal/aws/elasticbeanstalk in opentelemetry-collector-contrib. (#8993)
  • The resource created by go.opentelemetry.io/contrib/otelconf now includes default SDK attributes. (#8990)
  • Add support for the aws.ecs resource detector in go.opentelemetry.io/contrib/otelconf/x. (#8915)
  • Add support for the aws.eks resource detector in go.opentelemetry.io/contrib/otelconf/x. (#9138)
  • Add support for the azure.vm resource detector in go.opentelemetry.io/contrib/otelconf/x. (#9074)
  • Add support for the gcp resource detector in go.opentelemetry.io/contrib/otelconf/x. (#9137)
  • Add go.opentelemetry.io/contrib/detectors/azure/azureappservice, a new resource detector for Azure App Service. Detects cloud.*, service.name, azure.resource_group.name, azure.app_service.instance.id, and deployment.environment.name from the WEBSITE_* and REGION_NAME environment variables. (#9289)
  • Add azurecontainerapps resource detector for Azure Container Apps. (#8939)
  • Add go.opentelemetry.io/contrib/detectors/azure/azurefunctions, a new resource detector for Azure Functions. Detects cloud.*, service.name, azure.resource_group.name, faas.instance, and deployment.environment.name from the FUNCTIONS_*, WEBSITE_*, CONTAINER_NAME, and REGION_NAME environment variables. (#9290)
  • Add NewResourceDetector along with the WithAttributeFilter and WithTagKeyFilter options in go.opentelemetry.io/contrib/detectors/azure/azurevm. WithAttributeFilter restricts the returned resource to the attributes the filter accepts. WithTagKeyFilter opts in to azure.tag.<name> attributes for the VM tags whose keys satisfy the provided predicate; no VM tags are emitted without it. (#9162)
  • Add go.opentelemetry.io/contrib/detectors/vultr — a new resource detector for Vultr Cloud Compute instances, ported from processor/resourcedetectionprocessor/internal/vultr in opentelemetry-collector-contrib. Detects cloud.provider, cloud.platform, cloud.region, host.id, and host.name. (#8995)

Changed

  • Upgrade go.opentelemetry.io/otel/semconv to v1.43.0, including updates across instrumentation and detector modules. See semantic-conventions v1.43.0 release for complete details. (#9337)
  • Upgrade go.opentelemetry.io/otel/semconv to v1.42.0, including updates across instrumentation and detector modules. See semantic-conventions v1.42.0 release for complete details. (#9196)
  • Use direct normalized-key lookups in Carrier.Get and Carrier.Keys in go.opentelemetry.io/contrib/propagators/envcar. (#9112)
  • Update log bridge conversions to use attribute key-values instead of the removed log key-values in go.opentelemetry.io/contrib/bridges/otellogr, go.opentelemetry.io/contrib/bridges/otellogrus, go.opentelemetry.io/contrib/bridges/otelslog, and go.opentelemetry.io/contrib/bridges/otelzap. (#9180)
  • The Version() function in go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux has been replaced by const Version. (#9076)
  • Set error.type attribute instead of adding exception span events in go.opentelemetry.io/contrib/instrumentation/github.com/gin-gonic/gin/otelgin. (#8977)
  • Prefer the gRPC dial target over the resolved peer IP for the server.address and server.port attributes in go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc. (#8904)
  • The detector in go.opentelemetry.io/contrib/detectors/azure/azurevm now also detects cloud.account.id, cloud.availability_zone, azure.vm.name, azure.vm.size, azure.vm.scaleset.name, and azure.resource_group.name, and prefers osProfile.computerName for host.name (falling back to the VM name), reconciling it with the collector-contrib Azure resource detector. (#9162)

Fixed

  • Fix Prometheus reader resource label filter configuration in go.opentelemetry.io/contrib/otelconf/v0.2.0. (#9062)
  • Apply resource.detection/development.attributes.included and excluded filtering to resource detector attributes in go.opentelemetry.io/contrib/otelconf/x. (#9131)
  • Honor the context configured with WithContext when constructing resources in go.opentelemetry.io/contrib/otelconf and go.opentelemetry.io/contrib/otelconf/x. (#9160)
  • Handle nil response bodies from custom RoundTripper implementations in go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp without panicking. (#9184)
  • Fix incorrect (overestimated) sum calculation for runtime histograms in go.opentelemetry.io/contrib/instrumentation/runtime. (#9063)
  • Fix Severity.UnmarshalText round trip for positive FATAL offsets above the named range in go.opentelemetry.io/contrib/processors/minsev. (#9197)
  • Reduce binary size by fetching ConfigMaps via rest.HTTPClientFor instead of the Kubernetes clientset in go.opentelemetry.io/contrib/detectors/aws/eks. (#9284)
  • TextMapPropagator in go.opentelemetry.io/contrib/propagators/autoprop returns the no-op propagator for empty input, matching the behavior of none. An unknown OTEL_PROPAGATORS value still returns an error with a nil propagator so NewTextMapPropagator falls back to the default TraceContext and Baggage propagators instead of disabling propagation. (#9163)
  • Preserve error-valued attributes nested in a group as grouped attributes instead of silently dropping them in go.opentelemetry.io/contrib/bridges/otelslog. (#9238)
  • Fix a data race in go.opentelemetry.io/contrib/bridges/otelslog where concurrent Handle calls could corrupt each other's log attributes because kvBuffer.KeyValues returned a slice aliasing a shared buffer. (#9229)
  • Avoid a panic in go.opentelemetry.io/contrib/bridges/otelzap when a malformed error field contains a nil or non-error value. (#9068)
  • Use azure.container_app.instance.id instead of service.instance.id for the replica name detected by go.opentelemetry.io/contrib/detectors/azure/azurecontainerapps. (#9208)
  • Preserve the underlying metadata errors returned with partial resources from go.opentelemetry.io/contrib/detectors/gcp. (#9069)
  • Copy MultipartForm back to the request otelmux.Middleware was given after the wrapped handler returns, so net/http can find and remove the temp files ParseMultipartForm created on the context-derived request copy, when otelmux.Middleware wraps a handler directly, in go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux. This does not cover a handler panic, nor the common router.Use(...) integration, where gorilla/mux's own routing step makes an additional request copy the middleware cannot write back through; see gorilla/mux#777. (#9361)
  • Report the b3 header from Fields() for the default B3Unspecified single-header injection encoding, matching what Inject writes, in go.opentelemetry.io/contrib/propagators/b3. (#9273)
  • Fix go.opentelemetry.io/contrib/propagators/aws/xray producing deterministic trace and span IDs when the seed read from crypto/rand silently failed, by switching to math/rand/v2's concurrency-safe top-level generator. (#9359)
  • Strip connection number suffix from connection ID in go.opentelemetry.io/contrib/instrumentation/go.mongodb.org/mongo-driver/v2/mongo/otelmongo to prevent unbounded metric cardinality. (#9352)

... (truncated)

Commits
  • c8a87a6 Release v1.45.0/v2.5.2/v0.70.0/v0.37.2/v0.25.0/v0.20.0/v0.16.2/v0.17.0 (#9413)
  • cde125c fix(deps): update aws-sdk-go-v2 monorepo (#9384)
  • 88572a7 chore(deps): update googleapis to 6ac0973 (#9409)
  • e4f511a chore(deps): update github/codeql-action action to v4.37.5 (#9410)
  • 265eb0b fix(deps): update go.opentelemetry.io/otel digest to 48db2c6 (#9317)
  • 941ba46 chore(deps): update github.com/charmbracelet/ultraviolet digest to 8b69304 (#...
  • ededd3b chore(deps): update module github.com/lucasb-eyer/go-colorful to v1.4.1 (#9406)
  • 7c6e819 fix(deps): update module github.com/atombender/go-jsonschema to v0.24.1 (#9405)
  • ec1e544 chore(deps): update github.com/lufia/plan9stats digest to 341c2f0 (#9403)
  • 5d7e16a chore(deps): update github.com/golangci/rowserrcheck digest to d2031e3 (#9402)
  • Additional commits viewable in compare view

Updates `go.opentelemetry.io/otel` from 1.44.0 to 1.45.0
Release notes

Sourced from go.opentelemetry.io/otel's releases.

Release v1.45.0/v0.67.0/v0.21.0/v0.0.18

Overview

Added

  • Add experimental observability metrics to BatchProcessor in go.opentelemetry.io/otel/sdk/log. (#7124)
  • Add the experimental WithUnsafeAttributes no-copy attribute option to go.opentelemetry.io/otel/metric/x for future performance improvements. This API is a work in progress. (#8251)
  • Add Map and MapValue functions for the new MAP attribute type in go.opentelemetry.io/otel/attribute. (#8445)
  • Support MAP attributes in go.opentelemetry.io/otel/exporters/otlp/otlptrace. (#8453)
  • Support MAP attributes in go.opentelemetry.io/otel/exporters/otlp/otlplog. (#8453)
  • Support MAP attributes in go.opentelemetry.io/otel/exporters/otlp/otlpmetric. (#8453)
  • Support MAP attributes in go.opentelemetry.io/otel/exporters/zipkin. (#8453)
  • Apply AttributeValueLengthLimit recursively to values contained in attribute.MAP attributes in go.opentelemetry.io/otel/sdk/trace. (#8454)
  • Remove duplicate keys from attribute.MAP values in go.opentelemetry.io/otel/sdk/resource using last-value-wins semantics. (#8471)
  • Remove duplicate keys by default from attribute.MAP values in instrumentation scope attributes in go.opentelemetry.io/otel/sdk/log using last-value-wins semantics. (#8471)
  • Remove duplicate keys by default from attribute.MAP values in span, event, link, and instrumentation scope attributes in go.opentelemetry.io/otel/sdk/trace using last-value-wins semantics. (#8471)
  • Remove duplicate keys by default from attribute.MAP values in measurement and instrumentation scope attributes in go.opentelemetry.io/otel/sdk/metric using last-value-wins semantics. (#8471)
  • Extend WithAllowKeyDuplication in go.opentelemetry.io/otel/sdk/log to disable duplicate-key removal in attribute.MAP values for instrumentation scope attributes. (#8471)
  • Add the go.opentelemetry.io/otel/semconv/v1.42.0 package. The package contains semantic conventions from the v1.42.0 version of the OpenTelemetry Semantic Conventions. See the migration documentation for information on how to upgrade from go.opentelemetry.io/otel/semconv/v1.41.0. (#8484)
  • Add WithoutPanicRecording as a TracerProviderOption in go.opentelemetry.io/otel/sdk/trace to disable exception event recording for panics. (#8532)
  • Add the go.opentelemetry.io/otel/semconv/v1.43.0 package. The package contains semantic conventions from the v1.43.0 version of the OpenTelemetry Semantic Conventions. See the migration documentation for information on how to upgrade from go.opentelemetry.io/otel/semconv/v1.42.0. (#8628)

Changed

  • HistogramReservoir in go.opentelemetry.io/otel/sdk/metric/exemplar now uses a time-unbiased sampling algorithm for exemplars. (#8306)
  • ⚠️ Breaking Change: Use go.opentelemetry.io/otel/attribute.Value and go.opentelemetry.io/otel/attribute.KeyValue for log bodies and attributes in go.opentelemetry.io/otel/log, go.opentelemetry.io/otel/log/logtest, go.opentelemetry.io/otel/sdk/log, and go.opentelemetry.io/otel/sdk/log/logtest. (#8490)
  • Encode log bodies and attributes as go.opentelemetry.io/otel/attribute.Value JSON in go.opentelemetry.io/otel/exporters/stdout/stdoutlog. (#8490)
  • Improve the performance of hashing BOOLSLICE, INT64SLICE, FLOAT64SLICE, and STRINGSLICE attribute values by avoiding reflection for short slices in go.opentelemetry.io/otel/attribute. (#8511)
  • ⚠️ Breaking Change: WithEndpointURL in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp no longer appends the default signal path when an endpoint URL has no path, making the behavior consistent with go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp and with setting the endpoint through OTEL_EXPORTER_OTLP_METRICS_ENDPOINT. If the URL has no path component, the root path (/) is used. Use WithEndpointURL(url.JoinPath(endpoint, "/v1/metrics")) to preserve the previous behavior. (#8538)
  • ⚠️ Breaking Change: WithEndpointURL in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp no longer appends the default signal path when an endpoint URL has no path, making the behavior consistent with go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp and with setting the endpoint through OTEL_EXPORTER_OTLP_TRACES_ENDPOINT. If the URL has no path component, the root path (/) is used. Use WithEndpointURL(url.JoinPath(endpoint, "/v1/traces")) to preserve the previous behavior. (#8538)

Deprecated

  • Deprecate WithExportBufferSize in go.opentelemetry.io/otel/sdk/log. The option remains available for source compatibility but no longer affects behavior; BatchProcessor no longer maintains a separate export-request buffer. (#8620)

Removed

  • ⚠️ Breaking Change: Remove Kind, Value, KeyValue, their constructors, and attribute conversion helpers from go.opentelemetry.io/otel/log. (#8490)
  • ⚠️ Breaking Change: Remove the AttributeValueLengthLimit and AttributeCountLimit fields from RecordFactory in go.opentelemetry.io/otel/sdk/log/logtest; records produced by the factory now keep attribute limits disabled so test code can append exact attributes. (#8556)

Fixed

  • Apply TLS certificates configured through environment variables to gRPC connections in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc.
  • Prevent panics in go.opentelemetry.io/otel/bridge/opentracing when OpenTracing baggage is propagated concurrently with Span.SetBaggageItem.
  • Fix an off-by-one error in FixedSizeReservoir in go.opentelemetry.io/otel/sdk/metric/exemplar that prevented the first exemplar from being sampled after the reservoir was filled. (#8309)
  • Interpret HTTP Retry-After header values as seconds instead of nanoseconds when retrying OTLP HTTP exports in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp, go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp, and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#8383)

... (truncated)

Changelog

Sourced from go.opentelemetry.io/otel's changelog.

[1.45.0/0.67.0/0.21.0/0.0.18] - 2026-08-03

Added

  • Add experimental observability metrics to BatchProcessor in go.opentelemetry.io/otel/sdk/log. (#7124)
  • Add the experimental WithUnsafeAttributes no-copy attribute option to go.opentelemetry.io/otel/metric/x for future performance improvements. This API is a work in progress. (#8251)
  • Add Map and MapValue functions for the new MAP attribute type in go.opentelemetry.io/otel/attribute. (#8445)
  • Support MAP attributes in go.opentelemetry.io/otel/exporters/otlp/otlptrace. (#8453)
  • Support MAP attributes in go.opentelemetry.io/otel/exporters/otlp/otlplog. (#8453)
  • Support MAP attributes in go.opentelemetry.io/otel/exporters/otlp/otlpmetric. (#8453)
  • Support MAP attributes in go.opentelemetry.io/otel/exporters/zipkin. (#8453)
  • Apply AttributeValueLengthLimit recursively to values contained in attribute.MAP attributes in go.opentelemetry.io/otel/sdk/trace. (#8454)
  • Remove duplicate keys from attribute.MAP values in go.opentelemetry.io/otel/sdk/resource using last-value-wins semantics. (#8471)
  • Remove duplicate keys by default from attribute.MAP values in instrumentation scope attributes in go.opentelemetry.io/otel/sdk/log using last-value-wins semantics. (#8471)
  • Remove duplicate keys by default from attribute.MAP values in span, event, link, and instrumentation scope attributes in go.opentelemetry.io/otel/sdk/trace using last-value-wins semantics. (#8471)
  • Remove duplicate keys by default from attribute.MAP values in measurement and instrumentation scope attributes in go.opentelemetry.io/otel/sdk/metric using last-value-wins semantics. (#8471)
  • Extend WithAllowKeyDuplication in go.opentelemetry.io/otel/sdk/log to disable duplicate-key removal in attribute.MAP values for instrumentation scope attributes. (#8471)
  • Add the go.opentelemetry.io/otel/semconv/v1.42.0 package. The package contains semantic conventions from the v1.42.0 version of the OpenTelemetry Semantic Conventions. See the migration documentation for information on how to upgrade from go.opentelemetry.io/otel/semconv/v1.41.0. (#8484)
  • Add WithoutPanicRecording as a TracerProviderOption in go.opentelemetry.io/otel/sdk/trace to disable exception event recording for panics. (#8532)
  • Add the go.opentelemetry.io/otel/semconv/v1.43.0 package. The package contains semantic conventions from the v1.43.0 version of the OpenTelemetry Semantic Conventions. See the migration documentation for information on how to upgrade from go.opentelemetry.io/otel/semconv/v1.42.0. (#8628)

Changed

  • HistogramReservoir in go.opentelemetry.io/otel/sdk/metric/exemplar now uses a time-unbiased sampling algorithm for exemplars. (#8306)
  • ⚠️ Breaking Change: Use go.opentelemetry.io/otel/attribute.Value and go.opentelemetry.io/otel/attribute.KeyValue for log bodies and attributes in go.opentelemetry.io/otel/log, go.opentelemetry.io/otel/log/logtest, go.opentelemetry.io/otel/sdk/log, and go.opentelemetry.io/otel/sdk/log/logtest. (#8490)
  • Encode log bodies and attributes as go.opentelemetry.io/otel/attribute.Value JSON in go.opentelemetry.io/otel/exporters/stdout/stdoutlog. (#8490)
  • Improve the performance of hashing BOOLSLICE, INT64SLICE, FLOAT64SLICE, and STRINGSLICE attribute values by avoiding reflection for short slices in go.opentelemetry.io/otel/attribute. (#8511)
  • ⚠️ Breaking Change: WithEndpointURL in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp no longer appends the default signal path when an endpoint URL has no path, making the behavior consistent with go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp and with setting the endpoint through OTEL_EXPORTER_OTLP_METRICS_ENDPOINT. If the URL has no path component, the root path (/) is used. Use WithEndpointURL(url.JoinPath(endpoint, "/v1/metrics")) to preserve the previous behavior. (#8538)
  • ⚠️ Breaking Change: WithEndpointURL in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp no longer appends the default signal path when an endpoint URL has no path, making the behavior consistent with go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp and with setting the endpoint through OTEL_EXPORTER_OTLP_TRACES_ENDPOINT. If the URL has no path component, the root path (/) is used. Use WithEndpointURL(url.JoinPath(endpoint, "/v1/traces")) to preserve the previous behavior. (#8538)

Deprecated

  • Deprecate WithExportBufferSize in go.opentelemetry.io/otel/sdk/log. The option remains available for source compatibility but no longer affects behavior; BatchProcessor no longer maintains a separate export-request buffer. (#8620)

Removed

  • ⚠️ Breaking Change: Remove Kind, Value, KeyValue, their constructors, and attribute conversion helpers from go.opentelemetry.io/otel/log. (#8490)
  • ⚠️ Breaking Change: Remove the AttributeValueLengthLimit and AttributeCountLimit fields from RecordFactory in go.opentelemetry.io/otel/sdk/log/logtest; records produced by the factory now keep attribute limits disabled so test code can append exact attributes. (#8556)

Fixed

  • Apply TLS certificates configured through environment variables to gRPC connections in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc.
  • Prevent panics in go.opentelemetry.io/otel/bridge/opentracing when OpenTracing baggage is propagated concurrently with Span.SetBaggageItem.
  • Fix an off-by-one error in FixedSizeReservoir in go.opentelemetry.io/otel/sdk/metric/exemplar that prevented the first exemplar from being sampled after the reservoir was filled. (#8309)
  • Interpret HTTP Retry-After header values as seconds instead of nanoseconds when retrying OTLP HTTP exports in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp, go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp, and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#8383)
  • Fix a memory leak in the Reservoir implementation in go.opentelemetry.io/otel/sdk/metric/exemplar, where storing the full context.Context pinned large objects such as gRPC transport buffers. (#8389)

... (truncated)

Commits
  • 93a693e Release v1.45.0 (#8693)
  • c65d435 Merge commit from fork
  • 223f9fd sdk/metric: remove obsolete randomFloat64 TODO (#8685)
  • 06272bc fix(deps): update googleapis to 6ac0973 (#8694)
  • a4f238f chore(deps): update github.com/charmbracelet/ultraviolet digest to 8b69304 (#...
  • 37140e7 chore(deps): update codspeedhq/action action to v5.0.2 (#8690)
  • cef0855 chore(deps): update module github.com/lucasb-eyer/go-colorful to v1.4.1 (#8689)
  • e814a72 Merge commit from fork
  • bfd8eb7 chore(deps): update github.com/golangci/rowserrcheck digest to d2031e3 (#8687)
  • 48db2c6 chore(deps): update github/codeql-action action to v4.37.5 (#8692)
  • Additional commits viewable in compare view

Updates `go.opentelemetry.io/otel/exporters/prometheus` from 0.66.0 to 0.67.0
Changelog

Sourced from go.opentelemetry.io/otel/exporters/prometheus's changelog.

[1.45.0/0.67.0/0.21.0/0.0.18] - 2026-08-03

Added

  • Add experimental observability metrics to BatchProcessor in go.opentelemetry.io/otel/sdk/log. (#7124)
  • Add the experimental WithUnsafeAttributes no-copy attribute option to go.opentelemetry.io/otel/metric/x for future performance improvements. This API is a work in progress. (#8251)
  • Add Map and MapValue functions for the new MAP attribute type in go.opentelemetry.io/otel/attribute. (#8445)
  • Support MAP attributes in go.opentelemetry.io/otel/exporters/otlp/otlptrace. (#8453)
  • Support MAP attributes in go.opentelemetry.io/otel/exporters/otlp/otlplog. (#8453)
  • Support MAP attributes in go.opentelemetry.io/otel/exporters/otlp/otlpmetric. (#8453)
  • Support MAP attributes in go.opentelemetry.io/otel/exporters/zipkin. (#8453)
  • Apply AttributeValueLengthLimit recursively to values contained in attribute.MAP attributes in go.opentelemetry.io/otel/sdk/trace. (#8454)
  • Remove duplicate keys from attribute.MAP values in go.opentelemetry.io/otel/sdk/resource using last-value-wins semantics. (#8471)
  • Remove duplicate keys by default from attribute.MAP values in instrumentation scope attributes in go.opentelemetry.io/otel/sdk/log using last-value-wins semantics. (#8471)
  • Remove duplicate keys by default from attribute.MAP values in span, event, link, and instrumentation scope attributes in go.opentelemetry.io/otel/sdk/trace using last-value-wins semantics. (#8471)
  • Remove duplicate keys by default from attribute.MAP values in measurement and instrumentation scope attributes in go.opentelemetry.io/otel/sdk/metric using last-value-wins semantics. (#8471)
  • Extend WithAllowKeyDuplication in go.opentelemetry.io/otel/sdk/log to disable duplicate-key removal in attribute.MAP values for instrumentation scope attributes. (#8471)
  • Add the go.opentelemetry.io/otel/semconv/v1.42.0 package. The package contains semantic conventions from the v1.42.0 version of the OpenTelemetry Semantic Conventions. See the migration documentation for information on how to upgrade from go.opentelemetry.io/otel/semconv/v1.41.0. (#8484)
  • Add WithoutPanicRecording as a TracerProviderOption in go.opentelemetry.io/otel/sdk/trace to disable exception event recording for panics. (#8532)
  • Add the go.opentelemetry.io/otel/semconv/v1.43.0 package. The package contains semantic conventions from the v1.43.0 version of the OpenTelemetry Semantic Conventions. See the migration documentation for information on how to upgrade from go.opentelemetry.io/otel/semconv/v1.42.0. (#8628)

Changed

  • HistogramReservoir in go.opentelemetry.io/otel/sdk/metric/exemplar now uses a time-unbiased sampling algorithm for exemplars. (#8306)
  • ⚠️ Breaking Change: Use go.opentelemetry.io/otel/attribute.Value and go.opentelemetry.io/otel/attribute.KeyValue for log bodies and attributes in go.opentelemetry.io/otel/log, go.opentelemetry.io/otel/log/logtest, go.opentelemetry.io/otel/sdk/log, and go.opentelemetry.io/otel/sdk/log/logtest. (#8490)
  • Encode log bodies and attributes as go.opentelemetry.io/otel/attribute.Value JSON in go.opentelemetry.io/otel/exporters/stdout/stdoutlog. (#8490)
  • Improve the performance of hashing BOOLSLICE, INT64SLICE, FLOAT64SLICE, and STRINGSLICE attribute values by avoiding reflection for short slices in go.opentelemetry.io/otel/attribute. (#8511)
  • ⚠️ Breaking Change: WithEndpointURL in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp no longer appends the default signal path when an endpoint URL has no path, making the behavior consistent with go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp and with setting the endpoint through OTEL_EXPORTER_OTLP_METRICS_ENDPOINT. If the URL has no path component, the root path (/) is used. Use WithEndpointURL(url.JoinPath(endpoint, "/v1/metrics")) to preserve the previous behavior. (#8538)
  • ⚠️ Breaking Change: WithEndpointURL in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp no longer appends the default signal path when an endpoint URL has no path, making the behavior consistent with go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp and with setting the endpoint through OTEL_EXPORTER_OTLP_TRACES_ENDPOINT. If the URL has no path component, the root path (/) is used. Use WithEndpointURL(url.JoinPath(endpoint, "/v1/traces")) to preserve the previous behavior. (#8538)

Deprecated

  • Deprecate WithExportBufferSize in go.opentelemetry.io/otel/sdk/log. The option remains available for source compatibility but no longer affects behavior; BatchProcessor no longer maintains a separate export-request buffer. (#8620)

Removed

  • ⚠️ Breaking Change: Remove Kind, Value, KeyValue, their constructors, and attribute conversion helpers from go.opentelemetry.io/otel/log. (#8490)
  • ⚠️ Breaking Change: Remove the AttributeValueLengthLimit and AttributeCountLimit fields from RecordFactory in go.opentelemetry.io/otel/sdk/log/logtest; records produced by the factory now keep attribute limits disabled so test code can append exact attributes. (#8556)

Fixed

  • Apply TLS certificates configured through environment variables to gRPC connections in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc.
  • Prevent panics in go.opentelemetry.io/otel/bridge/opentracing when OpenTracing baggage is propagated concurrently with Span.SetBaggageItem.
  • Fix an off-by-one error in FixedSizeReservoir in go.opentelemetry.io/otel/sdk/metric/exemplar that prevented the first exemplar from being sampled after the reservoir was filled. (#8309)
  • Interpret HTTP Retry-After header values as seconds instead of nanoseconds when retrying OTLP HTTP exports in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp, go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp, and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#8383)
  • Fix a memory leak in the Reservoir implementation in go.opentelemetry.io/otel/sdk/metric/exemplar, where storing the full context.Context pinned large objects such as gRPC transport buffers. (#8389)

... (truncated)

Commits
  • 93a693e Release v1.45.0 (#8693)
  • c65d435 Merge commit from fork
  • 223f9fd sdk/metric: remove obsolete randomFloat64 TODO (#8685)
  • 06272bc fix(deps): update googleapis to 6ac0973 (#8694)
  • a4f238f chore(deps): update github.com/charmbracelet/ultraviolet digest to 8b69304 (#...
  • 37140e7 chore(deps): update codspeedhq/action action to v5.0.2 (#8690)
  • cef0855 chore(deps): update module github.com/lucasb-eyer/go-colorful to v1.4.1 (#8689)
  • e814a72 Merge commit from fork
  • bfd8eb7 chore(deps): update github.com/golangci/rowserrcheck digest to d2031e3 (#8687)
  • 48db2c6 chore(deps): update github/codeql-action action to v4.37.5 (#8692)
  • Additional commits viewable in compare view

Updates `go.opentelemetry.io/otel/metric` from 1.44.0 to 1.45.0
Release notes

Sourced from go.opentelemetry.io/otel/metric's releases.

Release v1.45.0/v0.67.0/v0.21.0/v0.0.18

Overview

Added

  • Add experimental observability metrics to BatchProcessor in go.opentelemetry.io/otel/sdk/log. (#7124)
  • Add the experimental WithUnsafeAttributes no-copy attribute option to go.opentelemetry.io/otel/metric/x for future performance improvements. This API is a work in progress. (#8251)
  • Add Map and MapValue functions for the new MAP attribute type in go.opentelemetry.io/otel/attribute. (#8445)
  • Support MAP attributes in go.opentelemetry.io/otel/exporters/otlp/otlptrace. (#8453)
  • Support MAP attributes in go.opentelemetry.io/otel/exporters/otlp/otlplog. (#8453)
  • Support MAP attributes in go.opentelemetry.io/otel/exporters/otlp/otlpmetric. (#8453)
  • Support MAP attributes in go.opentelemetry.io/otel/exporters/zipkin. (#8453)
  • Apply AttributeValueLengthLimit recursively to values contained in attribute.MAP attributes in go.opentelemetry.io/otel/sdk/trace. (#8454)
  • Remove duplicate keys from attribute.MAP values in go.opentelemetry.io/otel/sdk/resource using last-value-wins semantics. (#8471)
  • Remove duplicate keys by default from attribute.MAP values in instrumentation scope attributes in go.opentelemetry.io/otel/sdk/log using last-value-wins semantics. (#8471)
  • Remove duplicate keys by default from attribute.MAP values in span, event, link, and instrumentation scope attributes in go.opentelemetry.io/otel/sdk/trace using last-value-wins semantics. (#8471)
  • Remove duplicate keys by default from attribute.MAP values in measurement and instrumentation scope attributes in go.opentelemetry.io/otel/sdk/metric using last-value-wins semantics. (#8471)
  • Extend WithAllowKeyDuplication in go.opentelemetry.io/otel/sdk/log to disable duplicate-key removal in attribute.MAP values for instrumentation scope attributes. (#8471)
  • Add the go.opentelemetry.io/otel/semconv/v1.42.0 package. The package contains semantic conventions from the v1.42.0 version of the OpenTelemetry Semantic Conventions. See the migration documentation for information on how to upgrade from go.opentelemetry.io/otel/semconv/v1.41.0. (#8484)
  • Add WithoutPanicRecording as a TracerProviderOption in go.opentelemetry.io/otel/sdk/trace to disable exception event recording for panics. (#8532)
  • Add the go.opentelemetry.io/otel/semconv/v1.43.0 package. The package contains semantic conventions from the v1.43.0 version of the OpenTelemetry Semantic Conventions. See the migration documentation for information on how to upgrade from go.opentelemetry.io/otel/semconv/v1.42.0. (#8628)

Changed

  • HistogramReservoir in go.opentelemetry.io/otel/sdk/metric/exemplar now uses a time-unbiased sampling algorithm for exemplars. (#8306)
  • ⚠️ Breaking Change: Use go.opentelemetry.io/otel/attribute.Value and go.opentelemetry.io/otel/attribute.KeyValue for log bodies and attributes in go.opentelemetry.io/otel/log, go.opentelemetry.io/otel/log/logtest, go.opentelemetry.io/otel/sdk/log, and go.opentelemetry.io/otel/sdk/log/logtest. (#8490)
  • Encode log bodies and attributes as go.opentelemetry.io/otel/attribute.Value JSON in go.opentelemetry.io/otel/exporters/stdout/stdoutlog. (#8490)
  • Improve the performance of hashing BOOLSLICE, INT64SLICE, FLOAT64SLICE, and STRINGSLICE attribute values by avoiding reflection for short slices in go.opentelemetry.io/otel/attribute. (#8511)
  • ⚠️ Breaking Change: WithEndpointURL in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp no longer appends the default signal path when an endpoint URL has no path, making the behavior consistent with go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp and with setting the endpoint through OTEL_EXPORTER_OTLP_METRICS_ENDPOINT. If the URL has no path component, the root path (/) is used. Use WithEndpointURL(url.JoinPath(endpoint, "/v1/metrics")) to preserve the previous behavior. (#8538)
  • ⚠️ Breaking Change: WithEndpointURL in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp no longer appends the default signal path when an endpoint URL has no path, making the behavior consistent with go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp and with setting the endpoint through OTEL_EXPORTER_OTLP_TRACES_ENDPOINT. If the URL has no path component, the root path (/) is used. Use WithEndpointURL(url.JoinPath(endpoint, "/v1/traces")) to preserve the previous behavior. (#8538)

Deprecated

  • Deprecate WithExportBufferSize in go.opentelemetry.io/otel/sdk/log. The option remains available for source compatibility but no longer affects behavior; BatchProcessor no longer maintains a separate export-request buffer. (#8620)

Removed

  • ⚠️ Breaking Change: Remove Kind, Value, KeyValue, their constructors, and attribute conversion helpers from go.opentelemetry.io/otel/log. (#8490)
  • ⚠️ Breaking Change: Remove the AttributeValueLengthLimit and AttributeCountLimit fields from RecordFactory in go.opentelemetry.io/otel/sdk/log/logtest; records produced by the factory now keep attribute limits disabled so test code can append exact attributes. (#8556)

Fixed

  • Apply TLS certificates configured through environment variables to gRPC connections in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc.
  • Prevent panics in go.opentelemetry.io/otel/bridge/opentracing when OpenTracing baggage is propagated concurrently with Span.SetBaggageItem.
  • Fix an off-by-one error in FixedSizeReservoir in go.opentelemetry.io/otel/sdk/metric/exemplar that prevented the first exemplar from being sampled after the reservoir was filled. (#8309)
  • Interpret HTTP Retry-After header values as seconds instead of nanoseconds when retrying OTLP HTTP exports in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp, go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp, and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#8383)

... (truncated)

Changelog

Sourced from go.opentelemetry.io/otel/metric's changelog.

[1.45.0/0.67.0/0.21.0/0.0.18] - 2026-08-03

Added

  • Add experimental observability me... _Description has been truncated_ Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Radoslav Dimitrov --- go.mod | 16 ++++++++-------- go.sum | 36 ++++++++++++++++++------------------ 2 files changed, 26 insertions(+), 26 deletions(-) diff --git a/go.mod b/go.mod index bb46065..aba4b8e 100644 --- a/go.mod +++ b/go.mod @@ -16,12 +16,12 @@ require ( github.com/rs/cors v1.11.1 github.com/santhosh-tekuri/jsonschema/v5 v5.3.1 github.com/stretchr/testify v1.12.0 - go.opentelemetry.io/contrib/instrumentation/runtime v0.69.0 - go.opentelemetry.io/otel v1.44.0 - go.opentelemetry.io/otel/exporters/prometheus v0.66.0 - go.opentelemetry.io/otel/metric v1.44.0 - go.opentelemetry.io/otel/sdk v1.44.0 - go.opentelemetry.io/otel/sdk/metric v1.44.0 + go.opentelemetry.io/contrib/instrumentation/runtime v0.70.0 + go.opentelemetry.io/otel v1.45.0 + go.opentelemetry.io/otel/exporters/prometheus v0.67.0 + go.opentelemetry.io/otel/metric v1.45.0 + go.opentelemetry.io/otel/sdk v1.45.0 + go.opentelemetry.io/otel/sdk/metric v1.45.0 golang.org/x/mod v0.40.0 gopkg.in/yaml.v3 v3.0.1 ) @@ -43,7 +43,7 @@ require ( github.com/docker/docker-credential-helpers v0.9.3 // indirect github.com/felixge/httpsnoop v1.0.4 // indirect github.com/go-jose/go-jose/v4 v4.1.4 // indirect - github.com/go-logr/logr v1.4.3 // indirect + github.com/go-logr/logr v1.4.4 // indirect github.com/go-logr/stdr v1.2.2 // indirect github.com/google/s2a-go v0.1.9 // indirect github.com/google/uuid v1.6.0 // indirect @@ -66,7 +66,7 @@ require ( go.opentelemetry.io/auto/sdk v1.2.1 // indirect go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.67.0 // indirect go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0 // indirect - go.opentelemetry.io/otel/trace v1.44.0 // indirect + go.opentelemetry.io/otel/trace v1.45.0 // indirect golang.org/x/crypto v0.54.0 // indirect golang.org/x/net v0.57.0 // indirect golang.org/x/oauth2 v0.36.0 // indirect diff --git a/go.sum b/go.sum index 904ff2b..d906141 100644 --- a/go.sum +++ b/go.sum @@ -59,8 +59,8 @@ github.com/go-chi/chi/v5 v5.3.1/go.mod h1:R+tYY2hNuVUUjxoPtqUdgBqevM9s9njzkTLutV github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA= github.com/go-jose/go-jose/v4 v4.1.4/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08= github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A= -github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI= -github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= +github.com/go-logr/logr v1.4.4 h1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8= +github.com/go-logr/logr v1.4.4/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag= github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE= github.com/golang-jwt/jwt/v5 v5.3.1 h1:kYf81DTWFe7t+1VvL7eS+jKFVWaUnK9cB1qbwn63YCY= @@ -139,22 +139,22 @@ go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.6 go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.67.0/go.mod h1:NoUCKYWK+3ecatC4HjkRktREheMeEtrXoQxrqYFeHSc= go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0 h1:OyrsyzuttWTSur2qN/Lm0m2a8yqyIjUVBZcxFPuXq2o= go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0/go.mod h1:C2NGBr+kAB4bk3xtMXfZ94gqFDtg/GkI7e9zqGh5Beg= -go.opentelemetry.io/contrib/instrumentation/runtime v0.69.0 h1:MtkMsuRo3zEXTTMALfyrszwCDZTkB6wolyPjbwFAdq0= -go.opentelemetry.io/contrib/instrumentation/runtime v0.69.0/go.mod h1:FYTxnpsm+UPD0erZNq20GvnM8T2YQHiHtT2vokdpoac= -go.opentelemetry.io/otel v1.44.0 h1:JjwHmHpA4iZ3wBxluu2fbbE7j4kqlE8jXyAyPXH7HqU= -go.opentelemetry.io/otel v1.44.0/go.mod h1:BMgjTHL9WPRlRjL2oZCBTL4whCGtXch2H4BhOPIAyYc= -go.opentelemetry.io/otel/exporters/prometheus v0.66.0 h1:vkrK8PAznv2NKt2r+kdu252ccGzkEqLc2aSXbQIALYQ= -go.opentelemetry.io/otel/exporters/prometheus v0.66.0/go.mod h1:V/UB6D3vMF/UBOL5igAsAYnk1nG/bzYYTzvsB16cy7o= -go.opentelemetry.io/otel/metric v1.44.0 h1:1w0gILTcHdr3YI+ixLyjemwrVnsMURbTZFrSYCdDdmc= -go.opentelemetry.io/otel/metric v1.44.0/go.mod h1:8O7hanEPBNgEMmybD3s2VBKcgWOCsA6tzHBPODAiquo= -go.opentelemetry.io/otel/metric/x v0.66.0 h1:YkCrx1zLOChi9ZcZ6euupOcsgzbVlec7D/xoEU1+cTA= -go.opentelemetry.io/otel/metric/x v0.66.0/go.mod h1:d1+BDj9t96do0/1LoU1ayfCv79ZgNE41qbhBvnMOBZk= -go.opentelemetry.io/otel/sdk v1.44.0 h1:nHYwb9lK+fJPU/dnT6s7W7Z8itMWyqrnVfbheVYrZ58= -go.opentelemetry.io/otel/sdk v1.44.0/go.mod h1:Osuydd3Se74nqjAKxid74N5eC+jfEqfTegHRnq58oK0= -go.opentelemetry.io/otel/sdk/metric v1.44.0 h1:3LlKgI+VjbVsjNRFZJZAJ30WjXC5VkNRks6si09iEfI= -go.opentelemetry.io/otel/sdk/metric v1.44.0/go.mod h1:5B5pMARnXxKhltooO4xUuCBorl65a4EpnTalObqOigA= -go.opentelemetry.io/otel/trace v1.44.0 h1:jxF5CsGYCe74MCRx2X4g7WsY/VBKRqqpNvXlX/6gtIk= -go.opentelemetry.io/otel/trace v1.44.0/go.mod h1:oLl1jrMQAVo6v3GAggN+1VH9VIz9iUSvW53sW1Q8PIE= +go.opentelemetry.io/contrib/instrumentation/runtime v0.70.0 h1:1+WLVYezXA9tkuVzKQri8zgB1cEIVYKUSoYIRjsBiMU= +go.opentelemetry.io/contrib/instrumentation/runtime v0.70.0/go.mod h1:rbAXUUXqQDMxpSnmof4VtcZ+7YpZQEtjXSCIfdvR0Go= +go.opentelemetry.io/otel v1.45.0 h1:pdrWmLHofpubmArBv1LgFSv1Z0Ie/ppdZzu+kUN5EeU= +go.opentelemetry.io/otel v1.45.0/go.mod h1:XZxIqPapzEYnhNSScF5DIqXhm/rYi0FzCe2XddAwZfQ= +go.opentelemetry.io/otel/exporters/prometheus v0.67.0 h1:7IefDa35e6V3NoiqIeLDMDxMFyZDk5qcoC0Ax4cC16E= +go.opentelemetry.io/otel/exporters/prometheus v0.67.0/go.mod h1:nsPI1awTg5Vmg1YrommL2mVarVGlqc4yXOoKAkPRD0c= +go.opentelemetry.io/otel/metric v1.45.0 h1:7Eg1uH7CJ5cXv9is6tnBe1FI6rj1nwUdbFypRm3br/M= +go.opentelemetry.io/otel/metric v1.45.0/go.mod h1:HAPbm1nd3p1PmFH7v2dR+6BjXxw+Lq4a2+pndMAm08s= +go.opentelemetry.io/otel/metric/x v0.67.0 h1:PcicCNZFkZ4bXfSooXdo3WN7RBOVOtjVdo1wD358Uns= +go.opentelemetry.io/otel/metric/x v0.67.0/go.mod h1:FBjCWZe6wgcqxcMtjdGiClDKXb2YxxXii0CXftE4QtI= +go.opentelemetry.io/otel/sdk v1.45.0 h1:4VVSMgQ83dUgW2aoX5f6JgLvHwIvzcuLnF9lUdCSpCw= +go.opentelemetry.io/otel/sdk v1.45.0/go.mod h1:Sr40LgXV7DsKMMJMKOhUWOgMWTfAaqvm2kF0g7ilwuA= +go.opentelemetry.io/otel/sdk/metric v1.45.0 h1:oVFszMfyj1Am6s24Vtc7wBb8BKLcwepJjNEYILuiE3o= +go.opentelemetry.io/otel/sdk/metric v1.45.0/go.mod h1:vUWUxDZvu1WVRj8JA8S0AdhsPrZoDpA2DdZauIh4mDA= +go.opentelemetry.io/otel/trace v1.45.0 h1:l/mP6Uv7oNO7/TblbhpbgMidxhq1uO/rPsikOyVhxag= +go.opentelemetry.io/otel/trace v1.45.0/go.mod h1:qoJJA2xNMnxRrdISU/kLtfUH2wNeQbiv+jhs/CxI8bc= go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto= go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE= go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ= From 71f3a1b62e3819774ae0ba7b267a7a1fd6c32d20 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sat, 5 Sep 2026 20:30:25 +0300 Subject: [PATCH 17/36] build(deps): bump anchore/sbom-action from 0.24.0 to 0.24.2 in the actions group (#1610) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps the actions group with 1 update: [anchore/sbom-action](https://github.com/anchore/sbom-action). Updates `anchore/sbom-action` from 0.24.0 to 0.24.2
    Release notes

    Sourced from anchore/sbom-action's releases.

    v0.24.2

    Added Features

    Additional Changes

    (Full Changelog)

    Commits
    • 3ad7283 ops: update write permissions for release (#723)
    • 31f5287 chore(deps-dev): bump eslint from 10.8.1 to 10.9.0 (#724)
    • aa80c8c chore(deps): update Syft to latest release (#722)
    • 74b54e9 chore(deps): bump lodash from 4.17.23 to 4.18.1 (#623)
    • 6b92ff5 chore(deps-dev): bump tsx from 4.23.11 to 4.23.12 (#721)
    • 4f8983b chore(deps-dev): bump typescript-eslint from 8.65.0 to 8.67.0 (#719)
    • 10f27f4 chore(deps-dev): bump eslint from 10.5.0 to 10.8.1 (#720)
    • 249403a chore(deps-dev): bump @​types/node from 26.1.0 to 26.2.0 (#718)
    • cbf8daa chore(deps): bump anchore/workflows/.github/workflows/check-gate.yaml (#693)
    • 6afc793 fix: pin syft install.sh to the release tag being installed (#716)
    • Additional commits viewable in compare view

    [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=anchore/sbom-action&package-manager=github_actions&previous-version=0.24.0&new-version=0.24.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
    Dependabot commands and options
    You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore ` will remove the ignore condition of the specified dependency and ignore conditions
    Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/release.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 4405b31..8285c08 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -28,7 +28,7 @@ jobs: uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2 - name: Install Syft - uses: anchore/sbom-action/download-syft@v0.24.0 + uses: anchore/sbom-action/download-syft@v0.24.2 - name: Run GoReleaser uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 From da98ceced30a32172a968406286ca8689fdbf0cf Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sat, 5 Sep 2026 20:52:50 +0300 Subject: [PATCH 18/36] build(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.1 in /deploy (#1617) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.82.1 to 1.83.1.
    Release notes

    Sourced from google.golang.org/grpc's releases.

    Release 1.83.1

    Security

    • xds/rbac: Fix a bug where nested Principal or Permission rules with :scheme or grpc- prefixed header matchers were not rejected, which could cause DENY rules to fail open. (#9258)
    • xds/rbac: Fix a bug where the host header matcher was not being replaced with :authority in nested Principal or Permission rules. (#9258)
    • xds/rbac: Fix a bug where a header matcher whose name was not lowercase, such as X-Role, matched no header, which could cause DENY rules to fail open. (#9332)
    • xds/rbac: Fix a bug where a :scheme or grpc- prefixed header matcher was accepted when its name was not lowercase. (#9332)
    • xds/rbac: Fix a bug where a Host header matcher was not replaced with :authority. (#9332)

    Performance

    • transport: Restrict memory overhead of buffering small data frames. (#9331)

    Release 1.83.0

    Security

    • server: Stop reading from connections when flooded by HTTP/2 frames to mitigate resource exhaustion. The default value for this limit is 100 frames, excluding DATA and HEADERS, and may be changed by setting environment variable GRPC_GO_EXPERIMENTAL_CONTROL_BUFFER_THROTTLE_LIMIT.
    • xds/rbac: Support Metadata and RequestedServerName permissions matcher fields. If present in a DENY rule, previously these would be ignored and fail-open.
    • xds/rbac: Fix panic when parsing unsupported fields in NotRule/NotId permissions.
    • xds/rbac: Support the deprecated source_ip principal identifier by treating it as equivalent to direct_remote_ip.
    • xds: Fix panic when parsing route header matchers configured with empty exact_match, prefix_match, or suffix_match strings. (#9223)

    New Features

    • xds/googlec2p: Enable DirectPath over Interconnect support for on-premises clients via the force-xds target URI query parameter. (#9133)
    • xds: Enable xDS configuration to control which fields get propagated from ORCA backend metric reports to LRS load reports. (#9145)
    • authz: Add OnPolicyUpdate callback to FileWatcherOptions to notify when an authz policy is loaded or updated. (#9142)
    • xds: Add support for the GCP Authentication HTTP Filter, which automatically fetches and attaches GCP Service Account Identity JWT tokens to outgoing RPCs.
      • This feature can be enabled by setting environment variable GRPC_EXPERIMENTAL_XDS_GCP_AUTHENTICATION_FILTER=true. (#9119)
    • xds: Add support for xDS-based HTTP CONNECT proxies.
      • This feature can be enabled by setting environment variable GRPC_EXPERIMENTAL_XDS_HTTP_CONNECT=true. (#9151)
    • xds: Add support for contains_match in route header matchers. (#9223)

    Bug Fixes

    • credentials/alts: Fix panic when processing malformed frames by validating that the message frame length exceeds the message type field size. (#9197)
    • grpc: Fix compilation on Plan 9 targets (GOOS=plan9), broken since v1.81.0. (#9255)

    Release 1.82.2

    Security

    • server: Reject requests missing both :authority and Host headers with HTTP 400 and status Internal. (grpc/grpc-go#9365)

    ... (truncated)

    Commits

    [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=google.golang.org/grpc&package-manager=go_modules&previous-version=1.82.1&new-version=1.83.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
    Dependabot commands and options
    You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/modelcontextprotocol/registry/network/alerts).
    Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- deploy/go.mod | 2 +- deploy/go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/deploy/go.mod b/deploy/go.mod index 48df63a..ae44ac5 100644 --- a/deploy/go.mod +++ b/deploy/go.mod @@ -109,7 +109,7 @@ require ( golang.org/x/tools v0.47.0 // indirect google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa // indirect google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa // indirect - google.golang.org/grpc v1.82.1 // indirect + google.golang.org/grpc v1.83.1 // indirect google.golang.org/protobuf v1.36.11 // indirect gopkg.in/yaml.v3 v3.0.1 // indirect lukechampine.com/frand v1.5.1 // indirect diff --git a/deploy/go.sum b/deploy/go.sum index 3a1ce8f..cd58b14 100644 --- a/deploy/go.sum +++ b/deploy/go.sum @@ -317,8 +317,8 @@ google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa h1: google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa/go.mod h1:q4lMZS6kskjT5HvCPrnnypcDPVJqT/f4nfxmkE7gryY= google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa h1:mZHHdPZl0dbGHCflZgAq/Q468DWVFcU2whhB2KAo8fk= google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8= -google.golang.org/grpc v1.82.1 h1:NnAxzGRA0677vCa4BUkOAnO5+FfQqVl9iUXeD0IqcGE= -google.golang.org/grpc v1.82.1/go.mod h1:yzTZ1TB1Z3SG+LIYaI+WiE8D5+PZ3ArnrSp8zF3+/ZA= +google.golang.org/grpc v1.83.1 h1:HIO0+BEtBP6soyqvqC8sNUjZ7bTs+0hFQuFF+RAy++Y= +google.golang.org/grpc v1.83.1/go.mod h1:kDyl6SKsiHKt0uylY5gtn5cEjkrIOhQOGDgIc4JGwzQ= google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE= google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= From 57b19e27d220d2d426bd609d45abd1a5ebe03756 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sat, 5 Sep 2026 21:03:44 +0300 Subject: [PATCH 19/36] build(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.1 (#1616) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.82.1 to 1.83.1.
    Release notes

    Sourced from google.golang.org/grpc's releases.

    Release 1.83.1

    Security

    • xds/rbac: Fix a bug where nested Principal or Permission rules with :scheme or grpc- prefixed header matchers were not rejected, which could cause DENY rules to fail open. (#9258)
    • xds/rbac: Fix a bug where the host header matcher was not being replaced with :authority in nested Principal or Permission rules. (#9258)
    • xds/rbac: Fix a bug where a header matcher whose name was not lowercase, such as X-Role, matched no header, which could cause DENY rules to fail open. (#9332)
    • xds/rbac: Fix a bug where a :scheme or grpc- prefixed header matcher was accepted when its name was not lowercase. (#9332)
    • xds/rbac: Fix a bug where a Host header matcher was not replaced with :authority. (#9332)

    Performance

    • transport: Restrict memory overhead of buffering small data frames. (#9331)

    Release 1.83.0

    Security

    • server: Stop reading from connections when flooded by HTTP/2 frames to mitigate resource exhaustion. The default value for this limit is 100 frames, excluding DATA and HEADERS, and may be changed by setting environment variable GRPC_GO_EXPERIMENTAL_CONTROL_BUFFER_THROTTLE_LIMIT.
    • xds/rbac: Support Metadata and RequestedServerName permissions matcher fields. If present in a DENY rule, previously these would be ignored and fail-open.
    • xds/rbac: Fix panic when parsing unsupported fields in NotRule/NotId permissions.
    • xds/rbac: Support the deprecated source_ip principal identifier by treating it as equivalent to direct_remote_ip.
    • xds: Fix panic when parsing route header matchers configured with empty exact_match, prefix_match, or suffix_match strings. (#9223)

    New Features

    • xds/googlec2p: Enable DirectPath over Interconnect support for on-premises clients via the force-xds target URI query parameter. (#9133)
    • xds: Enable xDS configuration to control which fields get propagated from ORCA backend metric reports to LRS load reports. (#9145)
    • authz: Add OnPolicyUpdate callback to FileWatcherOptions to notify when an authz policy is loaded or updated. (#9142)
    • xds: Add support for the GCP Authentication HTTP Filter, which automatically fetches and attaches GCP Service Account Identity JWT tokens to outgoing RPCs.
      • This feature can be enabled by setting environment variable GRPC_EXPERIMENTAL_XDS_GCP_AUTHENTICATION_FILTER=true. (#9119)
    • xds: Add support for xDS-based HTTP CONNECT proxies.
      • This feature can be enabled by setting environment variable GRPC_EXPERIMENTAL_XDS_HTTP_CONNECT=true. (#9151)
    • xds: Add support for contains_match in route header matchers. (#9223)

    Bug Fixes

    • credentials/alts: Fix panic when processing malformed frames by validating that the message frame length exceeds the message type field size. (#9197)
    • grpc: Fix compilation on Plan 9 targets (GOOS=plan9), broken since v1.81.0. (#9255)

    Release 1.82.2

    Security

    • server: Reject requests missing both :authority and Host headers with HTTP 400 and status Internal. (grpc/grpc-go#9365)

    ... (truncated)

    Commits

    [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=google.golang.org/grpc&package-manager=go_modules&previous-version=1.82.1&new-version=1.83.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
    Dependabot commands and options
    You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/modelcontextprotocol/registry/network/alerts).
    Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Radoslav Dimitrov --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index aba4b8e..daeff49 100644 --- a/go.mod +++ b/go.mod @@ -78,7 +78,7 @@ require ( google.golang.org/genproto v0.0.0-20260319201613-d00831a3d3e7 // indirect google.golang.org/genproto/googleapis/api v0.0.0-20260630182238-925bb5da69e7 // indirect google.golang.org/genproto/googleapis/rpc v0.0.0-20260630182238-925bb5da69e7 // indirect - google.golang.org/grpc v1.82.1 // indirect + google.golang.org/grpc v1.83.1 // indirect google.golang.org/protobuf v1.36.11 // indirect gotest.tools/v3 v3.5.2 // indirect ) diff --git a/go.sum b/go.sum index d906141..029e79d 100644 --- a/go.sum +++ b/go.sum @@ -186,8 +186,8 @@ google.golang.org/genproto/googleapis/api v0.0.0-20260630182238-925bb5da69e7 h1: google.golang.org/genproto/googleapis/api v0.0.0-20260630182238-925bb5da69e7/go.mod h1:KqHwBx2upmfa1XSi1WuRvC+2VGCLtooKkfmyvRbUmqA= google.golang.org/genproto/googleapis/rpc v0.0.0-20260630182238-925bb5da69e7 h1:eM/YSd5bBFagF51o1E745Ta7RwzpW0h+z+QDNZOgmQ8= google.golang.org/genproto/googleapis/rpc v0.0.0-20260630182238-925bb5da69e7/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8= -google.golang.org/grpc v1.82.1 h1:NnAxzGRA0677vCa4BUkOAnO5+FfQqVl9iUXeD0IqcGE= -google.golang.org/grpc v1.82.1/go.mod h1:yzTZ1TB1Z3SG+LIYaI+WiE8D5+PZ3ArnrSp8zF3+/ZA= +google.golang.org/grpc v1.83.1 h1:HIO0+BEtBP6soyqvqC8sNUjZ7bTs+0hFQuFF+RAy++Y= +google.golang.org/grpc v1.83.1/go.mod h1:kDyl6SKsiHKt0uylY5gtn5cEjkrIOhQOGDgIc4JGwzQ= google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE= google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= From 00d5aaad7905648e493ed9b86bf7074d4561d947 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sat, 5 Sep 2026 21:13:09 +0300 Subject: [PATCH 20/36] build(deps): bump github.com/pulumi/pulumi-kubernetes/sdk/v4 from 4.33.0 to 4.34.0 in /deploy (#1609) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [github.com/pulumi/pulumi-kubernetes/sdk/v4](https://github.com/pulumi/pulumi-kubernetes) from 4.33.0 to 4.34.0.
    Release notes

    Sourced from github.com/pulumi/pulumi-kubernetes/sdk/v4's releases.

    v4.34.0

    What's Changed

    New Contributors

    Full Changelog: https://github.com/pulumi/pulumi-kubernetes/compare/v4.33.0...v4.34.0

    Changelog

    Sourced from github.com/pulumi/pulumi-kubernetes/sdk/v4's changelog.

    4.34.0 (August 27, 2026)

    Added

    • Support adding CustomResourceDefinitions as an extension of the base kubernetes provider via pulumi package add <provider> --extension. Extension-served resources alias their kubernetes:-namespaced token, so state written by a crd2pulumi-generated SDK is adopted rather than replaced.

    Changed

    • Upgrade Kubernetes schema and libraries to v1.36.3.
    • Upgrade Kubernetes schema and libraries to v1.36.4.
    • Upgrade Kubernetes schema and libraries to v1.37.0. See the Kubernetes 1.37 release notes for upstream API changes.

    Fixed

    • Restore scheduling.k8s.io/v1alpha1 Workload, which the Kubernetes 1.36 upgrade dropped from the SDKs, and retain scheduling.k8s.io/v1alpha2 PodGroup and Workload, which Kubernetes 1.37 removes from its OpenAPI specification. Both remain available to clusters that still serve them, and scheduling.k8s.io/v1beta1 now aliases the older versions so that existing resources migrate in place rather than being replaced.

    • #4524 Fix pulumi.com/waitFor rejecting JSONPath filters that use !=, >= or <=. The expression was split on every = that was not part of ==, so jsonpath={.status.conditions[?(@.type!="Failed")].status}=True failed to parse. The path and value are now separated structurally, which also allows braces inside string literals. Comparing one path against another (jsonpath={.status.readyReplicas}={.spec.replicas}) is still unsupported, but now reports an error instead of silently never matching.

    Commits

    Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Radoslav Dimitrov --- deploy/go.mod | 64 +++++++++++--------- deploy/go.sum | 165 +++++++++++++++++++++++++------------------------- 2 files changed, 116 insertions(+), 113 deletions(-) diff --git a/deploy/go.mod b/deploy/go.mod index ae44ac5..8f054ab 100644 --- a/deploy/go.mod +++ b/deploy/go.mod @@ -4,8 +4,8 @@ go 1.26 require ( github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 - github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.33.0 - github.com/pulumi/pulumi/sdk/v3 v3.257.0 + github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.34.0 + github.com/pulumi/pulumi/sdk/v3 v3.259.0 gopkg.in/yaml.v2 v2.4.0 ) @@ -23,25 +23,28 @@ require ( github.com/charmbracelet/bubbletea v1.3.10 // indirect github.com/charmbracelet/colorprofile v0.4.3 // indirect github.com/charmbracelet/lipgloss v1.1.0 // indirect - github.com/charmbracelet/x/ansi v0.11.7 // indirect + github.com/charmbracelet/x/ansi v0.11.8 // indirect github.com/charmbracelet/x/cellbuf v0.0.15 // indirect github.com/charmbracelet/x/term v0.2.2 // indirect - github.com/cheggaaa/pb v1.0.29 // indirect github.com/clipperhouse/displaywidth v0.11.0 // indirect github.com/clipperhouse/uax29/v2 v2.7.0 // indirect github.com/cloudflare/circl v1.6.3 // indirect + github.com/danieljoos/wincred v1.2.3 // indirect github.com/djherbis/times v1.5.0 // indirect + github.com/ebitengine/purego v0.10.2 // indirect github.com/emirpasic/gods v1.18.1 // indirect github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f // indirect github.com/go-git/gcfg/v2 v2.0.2 // indirect github.com/go-git/go-billy/v6 v6.0.0-alpha.2 // indirect github.com/go-git/go-git/v6 v6.0.0-alpha.5 // indirect - github.com/go-logr/logr v1.4.3 // indirect + github.com/go-logr/logr v1.4.4 // indirect github.com/go-logr/stdr v1.2.2 // indirect + github.com/godbus/dbus/v5 v5.2.2 // indirect github.com/gogo/protobuf v1.3.2 // indirect github.com/golang/glog v1.2.5 // indirect + github.com/google/go-tpm v0.9.8 // indirect github.com/google/uuid v1.6.0 // indirect - github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0 // indirect + github.com/grpc-ecosystem/grpc-gateway/v2 v2.30.0 // indirect github.com/grpc-ecosystem/grpc-opentracing v0.0.0-20180507213350-8e809c8a8645 // indirect github.com/hashicorp/errwrap v1.1.0 // indirect github.com/hashicorp/go-multierror v1.1.1 // indirect @@ -52,10 +55,10 @@ require ( github.com/kevinburke/ssh_config v1.6.0 // indirect github.com/klauspost/compress v1.18.7 // indirect github.com/klauspost/cpuid/v2 v2.3.0 // indirect - github.com/lucasb-eyer/go-colorful v1.4.0 // indirect - github.com/mattn/go-isatty v0.0.22 // indirect + github.com/lucasb-eyer/go-colorful v1.4.1 // indirect + github.com/mattn/go-isatty v0.0.24 // indirect github.com/mattn/go-localereader v0.0.1 // indirect - github.com/mattn/go-runewidth v0.0.24 // indirect + github.com/mattn/go-runewidth v0.0.28 // indirect github.com/mitchellh/go-ps v1.0.0 // indirect github.com/mitchellh/go-wordwrap v1.0.1 // indirect github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect @@ -81,36 +84,37 @@ require ( github.com/texttheater/golang-levenshtein v1.0.1 // indirect github.com/uber/jaeger-client-go v2.30.0+incompatible // indirect github.com/uber/jaeger-lib v2.4.1+incompatible // indirect - github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect + github.com/xo/terminfo v1.0.0 // indirect + github.com/zalando/go-keyring v0.2.8 // indirect github.com/zclconf/go-cty v1.16.3 // indirect go.opentelemetry.io/auto/sdk v1.2.1 // indirect - go.opentelemetry.io/collector/featuregate v1.59.0 // indirect - go.opentelemetry.io/collector/pdata v1.59.0 // indirect - go.opentelemetry.io/contrib/bridges/otelslog v0.18.0 // indirect - go.opentelemetry.io/otel v1.44.0 // indirect - go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.19.0 // indirect - go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.44.0 // indirect - go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.44.0 // indirect - go.opentelemetry.io/otel/log v0.19.0 // indirect - go.opentelemetry.io/otel/metric v1.44.0 // indirect - go.opentelemetry.io/otel/sdk v1.44.0 // indirect - go.opentelemetry.io/otel/sdk/log v0.19.0 // indirect - go.opentelemetry.io/otel/trace v1.44.0 // indirect - go.opentelemetry.io/proto/otlp v1.10.0 // indirect + go.opentelemetry.io/collector/featuregate v1.65.0 // indirect + go.opentelemetry.io/collector/pdata v1.65.0 // indirect + go.opentelemetry.io/contrib/bridges/otelslog v0.20.0 // indirect + go.opentelemetry.io/otel v1.45.0 // indirect + go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.21.0 // indirect + go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.45.0 // indirect + go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.45.0 // indirect + go.opentelemetry.io/otel/log v0.21.0 // indirect + go.opentelemetry.io/otel/metric v1.45.0 // indirect + go.opentelemetry.io/otel/sdk v1.45.0 // indirect + go.opentelemetry.io/otel/sdk/log v0.21.0 // indirect + go.opentelemetry.io/otel/trace v1.45.0 // indirect + go.opentelemetry.io/proto/otlp v1.11.0 // indirect go.uber.org/atomic v1.11.0 // indirect go.uber.org/multierr v1.11.0 // indirect - golang.org/x/crypto v0.54.0 // indirect + golang.org/x/crypto v0.55.0 // indirect golang.org/x/mod v0.38.0 // indirect - golang.org/x/net v0.57.0 // indirect + golang.org/x/net v0.58.0 // indirect golang.org/x/sync v0.22.0 // indirect golang.org/x/sys v0.47.0 // indirect golang.org/x/term v0.45.0 // indirect - golang.org/x/text v0.40.0 // indirect - golang.org/x/tools v0.47.0 // indirect - google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa // indirect - google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa // indirect + golang.org/x/text v0.41.0 // indirect + golang.org/x/tools v0.48.0 // indirect + google.golang.org/genproto/googleapis/api v0.0.0-20260819154853-08b0e4226688 // indirect + google.golang.org/genproto/googleapis/rpc v0.0.0-20260819154853-08b0e4226688 // indirect google.golang.org/grpc v1.83.1 // indirect - google.golang.org/protobuf v1.36.11 // indirect + google.golang.org/protobuf v1.36.12 // indirect gopkg.in/yaml.v3 v3.0.1 // indirect lukechampine.com/frand v1.5.1 // indirect ) diff --git a/deploy/go.sum b/deploy/go.sum index cd58b14..3e7be55 100644 --- a/deploy/go.sum +++ b/deploy/go.sum @@ -30,14 +30,12 @@ github.com/charmbracelet/colorprofile v0.4.3 h1:QPa1IWkYI+AOB+fE+mg/5/4HRMZcaXex github.com/charmbracelet/colorprofile v0.4.3/go.mod h1:/zT4BhpD5aGFpqQQqw7a+VtHCzu+zrQtt1zhMt9mR4Q= github.com/charmbracelet/lipgloss v1.1.0 h1:vYXsiLHVkK7fp74RkV7b2kq9+zDLoEU4MZoFqR/noCY= github.com/charmbracelet/lipgloss v1.1.0/go.mod h1:/6Q8FR2o+kj8rz4Dq0zQc3vYf7X+B0binUUBwA0aL30= -github.com/charmbracelet/x/ansi v0.11.7 h1:kzv1kJvjg2S3r9KHo8hDdHFQLEqn4RBCb39dAYC84jI= -github.com/charmbracelet/x/ansi v0.11.7/go.mod h1:9qGpnAVYz+8ACONkZBUWPtL7lulP9No6p1epAihUZwQ= +github.com/charmbracelet/x/ansi v0.11.8 h1:JMFwp0CgDC2+jcOB162HH5k7I3FVbgFSMMYg7dSPBQQ= +github.com/charmbracelet/x/ansi v0.11.8/go.mod h1:ZNN+3mXny/516oTQPLMPIBeSINvNJJQ8uQXDgbeJxY0= github.com/charmbracelet/x/cellbuf v0.0.15 h1:ur3pZy0o6z/R7EylET877CBxaiE1Sp1GMxoFPAIztPI= github.com/charmbracelet/x/cellbuf v0.0.15/go.mod h1:J1YVbR7MUuEGIFPCaaZ96KDl5NoS0DAWkskup+mOY+Q= github.com/charmbracelet/x/term v0.2.2 h1:xVRT/S2ZcKdhhOuSP4t5cLi5o+JxklsoEObBSgfgZRk= github.com/charmbracelet/x/term v0.2.2/go.mod h1:kF8CY5RddLWrsgVwpw4kAa6TESp6EB5y3uxGLeCqzAI= -github.com/cheggaaa/pb v1.0.29 h1:FckUN5ngEk2LpvuG0fw1GEFx6LtyY2pWI/Z2QgCnEYo= -github.com/cheggaaa/pb v1.0.29/go.mod h1:W40334L7FMC5JKWldsTWbdGjLo0RxUKK73K+TuPxX30= github.com/clipperhouse/displaywidth v0.11.0 h1:lBc6kY44VFw+TDx4I8opi/EtL9m20WSEFgwIwO+UVM8= github.com/clipperhouse/displaywidth v0.11.0/go.mod h1:bkrFNkf81G8HyVqmKGxsPufD3JhNl3dSqnGhOoSD/o0= github.com/clipperhouse/uax29/v2 v2.7.0 h1:+gs4oBZ2gPfVrKPthwbMzWZDaAFPGYK72F0NJv2v7Vk= @@ -45,19 +43,20 @@ github.com/clipperhouse/uax29/v2 v2.7.0/go.mod h1:EFJ2TJMRUaplDxHKj1qAEhCtQPW2tJ github.com/cloudflare/circl v1.6.3 h1:9GPOhQGF9MCYUeXyMYlqTR6a5gTrgR/fBLXvUgtVcg8= github.com/cloudflare/circl v1.6.3/go.mod h1:2eXP6Qfat4O/Yhh8BznvKnJ+uzEoTQ6jVKJRn81BiS4= github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g= +github.com/danieljoos/wincred v1.2.3 h1:v7dZC2x32Ut3nEfRH+vhoZGvN72+dQ/snVXo/vMFLdQ= +github.com/danieljoos/wincred v1.2.3/go.mod h1:6qqX0WNrS4RzPZ1tnroDzq9kY3fu1KwE7MRLQK4X0bs= github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM= github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/djherbis/times v1.5.0 h1:79myA211VwPhFTqUk8xehWrsEO+zcIZj0zT8mXPVARU= github.com/djherbis/times v1.5.0/go.mod h1:5q7FDLvbNg1L/KaBmPcWlVR9NmoKo3+ucqUA3ijQhA0= +github.com/ebitengine/purego v0.10.2 h1:W809HbnvzAxgdm+aOvlSekrM16wGCdT/e76+9tS7gzE= +github.com/ebitengine/purego v0.10.2/go.mod h1:iIjxzd6CiRiOG0UyXP+V1+jWqUXVjPKLAI0mRfJZTmQ= github.com/emirpasic/gods v1.18.1 h1:FXtiHYKDGKCW2KzwZKx0iC0PQmdlorYgdFG9jPXJ1Bc= github.com/emirpasic/gods v1.18.1/go.mod h1:8tpGGwCnJ5H4r6BWwaV6OrWmMoPhUl5jm/FMNAnJvWQ= github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f h1:Y/CXytFA4m6baUTXGLOoWe4PQhGxaX0KpnayAqC48p4= github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f/go.mod h1:vw97MGsxSvLiUE2X8qFplwetxpGLQrlU1Q9AUEIzCaM= -github.com/fatih/color v1.9.0/go.mod h1:eQcE1qtQxscV5RaZvpXrrb8Drkc3/DdQ+uUYCNjL+zU= -github.com/fatih/color v1.18.0 h1:S8gINlzdQ840/4pfAwic/ZE0djQEH3wM94VfqLTZcOM= -github.com/fatih/color v1.18.0/go.mod h1:4FelSpRwEGDpQ12mAdzqdOukCy4u8WUtOY6lkT/6HfU= github.com/gliderlabs/ssh v0.3.8 h1:a4YXD1V7xMF9g5nTkdfnja3Sxy1PVDCj1Zg4Wb8vY6c= github.com/gliderlabs/ssh v0.3.8/go.mod h1:xYoytBv1sV0aL3CavoDuJIQNURXkkfPA/wxQ1pL1fAU= github.com/go-git/gcfg/v2 v2.0.2 h1:MY5SIIfTGGEMhdA7d7JePuVVxtKL7Hp+ApGDJAJ7dpo= @@ -69,10 +68,12 @@ github.com/go-git/go-git-fixtures/v6 v6.0.0-alpha.1/go.mod h1:ECf1MqJlBdYpKggBrO github.com/go-git/go-git/v6 v6.0.0-alpha.5 h1:sE+OlkHgYWNMVmN1s9sR7uyFgsWLtxcNWse/vBYKxRE= github.com/go-git/go-git/v6 v6.0.0-alpha.5/go.mod h1:3IjhiZnM+uBmUrOGSeqrJpsmi4Vd0H2NZO/uK2a7d0s= github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A= -github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI= -github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= +github.com/go-logr/logr v1.4.4 h1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8= +github.com/go-logr/logr v1.4.4/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag= github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE= +github.com/godbus/dbus/v5 v5.2.2 h1:TUR3TgtSVDmjiXOgAAyaZbYmIeP3DPkld3jgKGV8mXQ= +github.com/godbus/dbus/v5 v5.2.2/go.mod h1:3AAv2+hPq5rdnr5txxxRwiGjPXamgoIHgz9FPBfOp3c= github.com/gogo/protobuf v1.3.1/go.mod h1:SlYgWuQ5SjCEi6WLHjHCa1yvBfUnHcTbrrZtXPKa29o= github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q= github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q= @@ -82,11 +83,15 @@ github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps= github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8= github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU= +github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo= +github.com/google/go-tpm v0.9.8/go.mod h1:h9jEsEECg7gtLis0upRBQU+GhYVH6jMjrFxI8u6bVUY= +github.com/google/go-tpm-tools v0.3.13-0.20230620182252-4639ecce2aba h1:qJEJcuLzH5KDR0gKc0zcktin6KSAwL7+jWKBYceddTc= +github.com/google/go-tpm-tools v0.3.13-0.20230620182252-4639ecce2aba/go.mod h1:EFYHy8/1y2KfgTAsx7Luu7NGhoxtuVHnNo8jE7FikKc= github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg= github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= -github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0 h1:5VipnvEpbqr2gA2VbM+nYVbkIF28c5ZQfqCBQ5g2xfk= -github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0/go.mod h1:Hyl3n6Twe1hvtd9XUXDec4pTvgMSEixRuQKPTMH2bNs= +github.com/grpc-ecosystem/grpc-gateway/v2 v2.30.0 h1:/Tnpcb2E0Pz/tN9s3bfEY2Q8ePCEX9iuS+cneUwncnw= +github.com/grpc-ecosystem/grpc-gateway/v2 v2.30.0/go.mod h1:zOBXOsUaBSjKgmH4OGzV1esUpR3oUSCPYVd2cUBjKYY= github.com/grpc-ecosystem/grpc-opentracing v0.0.0-20180507213350-8e809c8a8645 h1:MJG/KsmcqMwFAkh8mTnAwhyKoB+sTAnY4CACC110tbU= github.com/grpc-ecosystem/grpc-opentracing v0.0.0-20180507213350-8e809c8a8645/go.mod h1:6iZfnjpejD4L/4DwD7NryNaJyCQdzwWwH2MWhCA90Kw= github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4= @@ -118,20 +123,14 @@ github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ= github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI= github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY= github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE= -github.com/lucasb-eyer/go-colorful v1.4.0 h1:UtrWVfLdarDgc44HcS7pYloGHJUjHV/4FwW4TvVgFr4= -github.com/lucasb-eyer/go-colorful v1.4.0/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0= -github.com/mattn/go-colorable v0.1.4/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE= -github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE= -github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8= -github.com/mattn/go-isatty v0.0.8/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s= -github.com/mattn/go-isatty v0.0.11/go.mod h1:PhnuNfih5lzO57/f3n+odYbM4JtupLOxQOAqxQCu2WE= -github.com/mattn/go-isatty v0.0.22 h1:j8l17JJ9i6VGPUFUYoTUKPSgKe/83EYU2zBC7YNKMw4= -github.com/mattn/go-isatty v0.0.22/go.mod h1:ZXfXG4SQHsB/w3ZeOYbR0PrPwLy+n6xiMrJlRFqopa4= +github.com/lucasb-eyer/go-colorful v1.4.1 h1:1EO+WB73+EH8EVbzlrG3KLAfEypQWVHIBqlTf+2hNss= +github.com/lucasb-eyer/go-colorful v1.4.1/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0= +github.com/mattn/go-isatty v0.0.24 h1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI= +github.com/mattn/go-isatty v0.0.24/go.mod h1:nMCL3Zebbrt45jsMDgnfIwz6ydEQApk5oEI3HqDio6A= github.com/mattn/go-localereader v0.0.1 h1:ygSAOl7ZXTx4RdPYinUpg6W99U8jWvWi9Ye2JC/oIi4= github.com/mattn/go-localereader v0.0.1/go.mod h1:8fBrzywKY7BI3czFoHkuzRoWE9C+EiG4R1k4Cjx5p88= -github.com/mattn/go-runewidth v0.0.4/go.mod h1:LwmH8dsx7+W8Uxz3IHJYH5QSwggIsqBzpuz5H//U1FU= -github.com/mattn/go-runewidth v0.0.24 h1:cpokDiIn0MGnhdHwuWnJBITySJ20QyNGnY2kR/ay2DU= -github.com/mattn/go-runewidth v0.0.24/go.mod h1:XBkDxAl56ILZc9knddidhrOlY5R/pDhgLpndooCuJAs= +github.com/mattn/go-runewidth v0.0.28 h1:rPyg2ybwEKPebvpzVWe1gKBkH8EQFkxO4Y0hjBeLaBU= +github.com/mattn/go-runewidth v0.0.28/go.mod h1:3qAiGCV4Koz/yuveO58qUefmUTRm8r0IGEXZ9jeHp/8= github.com/mitchellh/go-ps v1.0.0 h1:i6ampVEEF4wQFF+bkYfwYgY+F/uYJDktmvLPf7qIgjc= github.com/mitchellh/go-ps v1.0.0/go.mod h1:J4lOc8z8yJs6vUwklHw2XEIiT4z4C40KtWVN3nvg8Pg= github.com/mitchellh/go-wordwrap v1.0.1 h1:TLuKupo69TCn6TQSyGxwI1EblZZEsQ0vMlAFQflz0v0= @@ -170,10 +169,10 @@ github.com/pulumi/appdash v0.0.0-20231130102222-75f619a67231 h1:vkHw5I/plNdTr435 github.com/pulumi/appdash v0.0.0-20231130102222-75f619a67231/go.mod h1:murToZ2N9hNJzewjHBgfFdXhZKjY3z5cYC1VXk+lbFE= github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 h1:w6OnO3d4j5yVf2vpm8OzXFC/xHOEGqt+9FjWCUBCq6U= github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1/go.mod h1:UyZyv7hz4knpFx6/Sh+SkZe6hT6sJHtDvw9A0TbvEsk= -github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.33.0 h1:fFP72Q6/GfyI7BII3hUS7vn45Eg16zKIIS3I3R9bNEY= -github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.33.0/go.mod h1:sIZVlvi6oFQMEgTa+XkYfr/sAXRfrprPo3Ja6UYpGEU= -github.com/pulumi/pulumi/sdk/v3 v3.257.0 h1:75TpjUHz7rA8azrEOpTAD1Ox2f6Aj1pkxwzq+ufKQXM= -github.com/pulumi/pulumi/sdk/v3 v3.257.0/go.mod h1:pyYSaOHxk1R0bYiSzpcbYzeN3MBtlyckup9tvImBjjo= +github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.34.0 h1:r00p17ecoDVWqBg38/Is/9jU/JsWLPxnWzhfYqKitx0= +github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.34.0/go.mod h1:/klrd3ib4AMRlFMjrxkv5r76x3Bdr68wIMEKfRkRzHU= +github.com/pulumi/pulumi/sdk/v3 v3.259.0 h1:mJP9tXF9oxcfwidBgteXkUUchIz2L59SbGS5byZBo1w= +github.com/pulumi/pulumi/sdk/v3 v3.259.0/go.mod h1:DPK83ZiPYy55hY0MoaFAbl95Yee/dCGc6cQAqI7/ctw= github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ= github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88= github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ= @@ -205,52 +204,54 @@ github.com/uber/jaeger-client-go v2.30.0+incompatible h1:D6wyKGCecFaSRUpo8lCVbaO github.com/uber/jaeger-client-go v2.30.0+incompatible/go.mod h1:WVhlPFC8FDjOFMMWRy2pZqQJSXxYSwNYOkTr/Z6d3Kk= github.com/uber/jaeger-lib v2.4.1+incompatible h1:td4jdvLcExb4cBISKIpHuGoVXh+dVKhn2Um6rjCsSsg= github.com/uber/jaeger-lib v2.4.1+incompatible/go.mod h1:ComeNDZlWwrWnDv8aPp0Ba6+uUTzImX/AauajbLI56U= -github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e h1:JVG44RsyaB9T2KIHavMF/ppJZNG9ZpyihvCd0w101no= -github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e/go.mod h1:RbqR21r5mrJuqunuUZ/Dhy/avygyECGrLceyNeo4LiM= +github.com/xo/terminfo v1.0.0 h1:2ZpYzqWzyyytjk3TP6aJVDhkMAkc99/1xKQdA3TDTBY= +github.com/xo/terminfo v1.0.0/go.mod h1:RbqR21r5mrJuqunuUZ/Dhy/avygyECGrLceyNeo4LiM= github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74= github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74= +github.com/zalando/go-keyring v0.2.8 h1:6sD/Ucpl7jNq10rM2pgqTs0sZ9V3qMrqfIIy5YPccHs= +github.com/zalando/go-keyring v0.2.8/go.mod h1:tsMo+VpRq5NGyKfxoBVjCuMrG47yj8cmakZDO5QGii0= github.com/zclconf/go-cty v1.16.3 h1:osr++gw2T61A8KVYHoQiFbFd1Lh3JOCXc/jFLJXKTxk= github.com/zclconf/go-cty v1.16.3/go.mod h1:VvMs5i0vgZdhYawQNq5kePSpLAoz8u1xvZgrPIxfnZE= go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64= go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y= -go.opentelemetry.io/collector/featuregate v1.59.0 h1:pu70/9eWRjAjzGnr3VmqwY+k6fmU3esLp15AqxfBBz0= -go.opentelemetry.io/collector/featuregate v1.59.0/go.mod h1:4ga1QBMPEejXXmpyJS8lmaRpknJ3Lb9Bvk6e420bUFU= -go.opentelemetry.io/collector/internal/testutil v0.153.0 h1:GJEaPLohao+7wtm08yGf73RGi1rpIHvqzxOb7Xn8sP0= -go.opentelemetry.io/collector/internal/testutil v0.153.0/go.mod h1:Jkjs6rkqs973LqgZ0Fe3zrokQRKULYXPIf4HuqStiEE= -go.opentelemetry.io/collector/pdata v1.59.0 h1:lO1IcaO9+HUVdFh+RATCUG3oTP+uCZzsE7HJ0MjmzRc= -go.opentelemetry.io/collector/pdata v1.59.0/go.mod h1:AH6M14C6qhesnUpcvigkvFMiX9KtdSWQENMBNyNhe7I= -go.opentelemetry.io/contrib/bridges/otelslog v0.18.0 h1:hhPGP3zvvy1xWT9RTy970wlniSxFttBIsAK1gvMguJM= -go.opentelemetry.io/contrib/bridges/otelslog v0.18.0/go.mod h1:twJF7inoMza6kxMcF8JOdL3mPmtOZu7GEr34CUNE6Dg= -go.opentelemetry.io/otel v1.44.0 h1:JjwHmHpA4iZ3wBxluu2fbbE7j4kqlE8jXyAyPXH7HqU= -go.opentelemetry.io/otel v1.44.0/go.mod h1:BMgjTHL9WPRlRjL2oZCBTL4whCGtXch2H4BhOPIAyYc= -go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.19.0 h1:Dn8rkudDzY6KV9dr/D/bTUuWgqDf9xe0rr4G2elrn0Y= -go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.19.0/go.mod h1:gMk9F0xDgyN9M/3Ed5Y1wKcx/9mlU91NXY2SNq7RQuU= -go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.44.0 h1:4YsVu3B8+3qtWYYrsUYgn0OG78pN0rnNPRGX4SbokQI= -go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.44.0/go.mod h1:+wnlSn0mD1ADVMe3v9Z/WIaiz6q6gL2J/ejaAmdmv80= -go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.44.0 h1:qazEJlUOQzhCpzQpFETGby7EdqjI1wsd0W+6Gg1SCTU= -go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.44.0/go.mod h1:fOD2Yefuxixkx3ahVNf0O/PERb6r4OlbxfATVnYvzCo= -go.opentelemetry.io/otel/log v0.19.0 h1:KUZs/GOsw79TBBMfDWsXS+KZ4g2Ckzksd1ymzsIEbo4= -go.opentelemetry.io/otel/log v0.19.0/go.mod h1:5DQYeGmxVIr4n0/BcJvF4upsraHjg6vudJJpnkL6Ipk= -go.opentelemetry.io/otel/metric v1.44.0 h1:1w0gILTcHdr3YI+ixLyjemwrVnsMURbTZFrSYCdDdmc= -go.opentelemetry.io/otel/metric v1.44.0/go.mod h1:8O7hanEPBNgEMmybD3s2VBKcgWOCsA6tzHBPODAiquo= -go.opentelemetry.io/otel/sdk v1.44.0 h1:nHYwb9lK+fJPU/dnT6s7W7Z8itMWyqrnVfbheVYrZ58= -go.opentelemetry.io/otel/sdk v1.44.0/go.mod h1:Osuydd3Se74nqjAKxid74N5eC+jfEqfTegHRnq58oK0= -go.opentelemetry.io/otel/sdk/log v0.19.0 h1:scYVLqT22D2gqXItnWiocLUKGH9yvkkeql5dBDiXyko= -go.opentelemetry.io/otel/sdk/log v0.19.0/go.mod h1:vFBowwXGLlW9AvpuF7bMgnNI95LiW10szrOdvzBHlAg= -go.opentelemetry.io/otel/sdk/log/logtest v0.19.0 h1:BEbF7ZBB6qQloV/Ub1+3NQoOUnVtcGkU3XX4Ws3GQfk= -go.opentelemetry.io/otel/sdk/log/logtest v0.19.0/go.mod h1:Lua81/3yM0wOmoHTokLj9y9ADeA02v1naRrVrkAZuKk= -go.opentelemetry.io/otel/sdk/metric v1.44.0 h1:3LlKgI+VjbVsjNRFZJZAJ30WjXC5VkNRks6si09iEfI= -go.opentelemetry.io/otel/sdk/metric v1.44.0/go.mod h1:5B5pMARnXxKhltooO4xUuCBorl65a4EpnTalObqOigA= -go.opentelemetry.io/otel/trace v1.44.0 h1:jxF5CsGYCe74MCRx2X4g7WsY/VBKRqqpNvXlX/6gtIk= -go.opentelemetry.io/otel/trace v1.44.0/go.mod h1:oLl1jrMQAVo6v3GAggN+1VH9VIz9iUSvW53sW1Q8PIE= -go.opentelemetry.io/proto/otlp v1.10.0 h1:IQRWgT5srOCYfiWnpqUYz9CVmbO8bFmKcwYxpuCSL2g= -go.opentelemetry.io/proto/otlp v1.10.0/go.mod h1:/CV4QoCR/S9yaPj8utp3lvQPoqMtxXdzn7ozvvozVqk= -go.opentelemetry.io/proto/slim/otlp v1.10.0 h1:iR97Vs/ZDR+y9TfuP9b1XBtdPWeC+OMslIBmhcLU7jM= -go.opentelemetry.io/proto/slim/otlp v1.10.0/go.mod h1:lV9250stpjYLPNA5viFabIgP2QlUGRT1GdTgAf8SIUk= -go.opentelemetry.io/proto/slim/otlp/collector/profiles/v1development v0.3.0 h1:RUF5rO0hAlgiJt1fzQVzcVs3vZVNHIcMLgOgG4rWNcQ= -go.opentelemetry.io/proto/slim/otlp/collector/profiles/v1development v0.3.0/go.mod h1:I89cynRj8y+383o7tEQVg2SVA6SRgDVIouWPUVXjx0U= -go.opentelemetry.io/proto/slim/otlp/profiles/v1development v0.3.0 h1:CQvJSldHRUN6Z8jsUeYv8J0lXRvygALXIzsmAeCcZE0= -go.opentelemetry.io/proto/slim/otlp/profiles/v1development v0.3.0/go.mod h1:xSQ+mEfJe/GjK1LXEyVOoSI1N9JV9ZI923X5kup43W4= +go.opentelemetry.io/collector/featuregate v1.65.0 h1:Dh+uYVB+POc5DTebZRWjtKJolGhevkiIpbHn+zhkq2o= +go.opentelemetry.io/collector/featuregate v1.65.0/go.mod h1:4ga1QBMPEejXXmpyJS8lmaRpknJ3Lb9Bvk6e420bUFU= +go.opentelemetry.io/collector/internal/testutil v0.159.0 h1:/OfAv3ZRIc3eVFFq4bFc+Ju5HQBebiWywgvAcysIX4M= +go.opentelemetry.io/collector/internal/testutil v0.159.0/go.mod h1:Jkjs6rkqs973LqgZ0Fe3zrokQRKULYXPIf4HuqStiEE= +go.opentelemetry.io/collector/pdata v1.65.0 h1:6bQ3sIrEzOdapetxYFjdCns90kKXg1qCoIZ3la1aR5E= +go.opentelemetry.io/collector/pdata v1.65.0/go.mod h1:r5vRY0p7nZcEif06twUW09Sf6vaNsyPzij+EpwI/xeI= +go.opentelemetry.io/contrib/bridges/otelslog v0.20.0 h1:oEl2Pw/i4OQwhAuda2pAHFAcOMivA+Xa+iTccBfab/g= +go.opentelemetry.io/contrib/bridges/otelslog v0.20.0/go.mod h1:yMSQaiiq5dpfrSJCYLBcqFeJkFFI67seT4ngvx6jfVo= +go.opentelemetry.io/otel v1.45.0 h1:pdrWmLHofpubmArBv1LgFSv1Z0Ie/ppdZzu+kUN5EeU= +go.opentelemetry.io/otel v1.45.0/go.mod h1:XZxIqPapzEYnhNSScF5DIqXhm/rYi0FzCe2XddAwZfQ= +go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.21.0 h1:WseeVYf5dJZTsyPiyW5L14k5qsSibqXAMTSiFEDiWr0= +go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.21.0/go.mod h1:SiLZnQS6Qk2eCpvr2CH/XMAOa64TWGXxEZJZCpD2Lmc= +go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.45.0 h1:QRefszxJmfPdjXUUm3j6iDzY03mTPXMjqErFqQ67vUg= +go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.45.0/go.mod h1:Tiz03lTBVBrm7eWZBOidzEaYaJa8tjwGUGv6d8mlTyk= +go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.45.0 h1:fG5MCxGz8+2VtrN/WgqSpJFctVz24gpxj8CxkKmc8Ww= +go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.45.0/go.mod h1:BmAYTn+3ysbRe+IU2msxmf5Rx3g6DHvex+tWI3LdhYI= +go.opentelemetry.io/otel/log v0.21.0 h1:SLsVDGmtyBrdw8/a2Z0bOIxou/+bN4z56GebH7T0LvA= +go.opentelemetry.io/otel/log v0.21.0/go.mod h1:iReetQrZL9Wyg84cCkOoCmqDHS5RCFfyxC7J+r8fn8g= +go.opentelemetry.io/otel/metric v1.45.0 h1:7Eg1uH7CJ5cXv9is6tnBe1FI6rj1nwUdbFypRm3br/M= +go.opentelemetry.io/otel/metric v1.45.0/go.mod h1:HAPbm1nd3p1PmFH7v2dR+6BjXxw+Lq4a2+pndMAm08s= +go.opentelemetry.io/otel/sdk v1.45.0 h1:4VVSMgQ83dUgW2aoX5f6JgLvHwIvzcuLnF9lUdCSpCw= +go.opentelemetry.io/otel/sdk v1.45.0/go.mod h1:Sr40LgXV7DsKMMJMKOhUWOgMWTfAaqvm2kF0g7ilwuA= +go.opentelemetry.io/otel/sdk/log v0.21.0 h1:QsE7XSR0ktQdKmRKGnR+f1ObGF32WG+7MER/P9KgmYc= +go.opentelemetry.io/otel/sdk/log v0.21.0/go.mod h1:m9mApjCoD2/1QuKCAptjv+BrG9WKOvQLVdNx+iBldTo= +go.opentelemetry.io/otel/sdk/log/logtest v0.21.0 h1:X+JBBgKlswCGYsmgL0CnoUUtlE//VB345c84jYAYkdQ= +go.opentelemetry.io/otel/sdk/log/logtest v0.21.0/go.mod h1:HD1575K8e6sIFBBDd5tZB3t9DlMytWXq9FuR+Y4rfjE= +go.opentelemetry.io/otel/sdk/metric v1.45.0 h1:oVFszMfyj1Am6s24Vtc7wBb8BKLcwepJjNEYILuiE3o= +go.opentelemetry.io/otel/sdk/metric v1.45.0/go.mod h1:vUWUxDZvu1WVRj8JA8S0AdhsPrZoDpA2DdZauIh4mDA= +go.opentelemetry.io/otel/trace v1.45.0 h1:l/mP6Uv7oNO7/TblbhpbgMidxhq1uO/rPsikOyVhxag= +go.opentelemetry.io/otel/trace v1.45.0/go.mod h1:qoJJA2xNMnxRrdISU/kLtfUH2wNeQbiv+jhs/CxI8bc= +go.opentelemetry.io/proto/otlp v1.11.0 h1:5rrYs0Ykyj50sdU/JU0x8etU+LubXWb+gED6TbEdMIk= +go.opentelemetry.io/proto/otlp v1.11.0/go.mod h1:SmVizdCOAm3XBtG1g1NnOdhW6jtddT72hLMhv8VwA8E= +go.opentelemetry.io/proto/slim/otlp v1.11.0 h1:zB37f+f99+y6UIZR4h7UpwbXd5kFNyip35U7GaJ/Jik= +go.opentelemetry.io/proto/slim/otlp v1.11.0/go.mod h1:mI3DeND+VXZuA4keqFPKDJ3BklwveYm1JqBcEWKDEOM= +go.opentelemetry.io/proto/slim/otlp/collector/profiles/v1development v0.4.0 h1:mt+DWtks0biKnz0jXMpDbxWN0CHJi6OJDKe4GcREkcs= +go.opentelemetry.io/proto/slim/otlp/collector/profiles/v1development v0.4.0/go.mod h1:7UXaX/7uT+kumUHd3LIWyjMlklEp0mPlrE9xmtbG6/8= +go.opentelemetry.io/proto/slim/otlp/profiles/v1development v0.4.0 h1:rLHkdB6eHDiRSIoz0cvNuTJsVJBxaL6IyS1e9BSaXLY= +go.opentelemetry.io/proto/slim/otlp/profiles/v1development v0.4.0/go.mod h1:BrX0dmOGsMuWNXXbFafTD7Gb6F3yK+2czVQ6+c24Cnk= go.uber.org/atomic v1.11.0 h1:ZvwS0R+56ePWxUNi+Atn9dWONBPp/AUETXlHW0DxSjE= go.uber.org/atomic v1.11.0/go.mod h1:LUxbIzbOniOlMKjJjyPfpl4v+PKK2cNJn91OQbhoJI0= go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto= @@ -261,8 +262,8 @@ go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg= golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w= golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI= golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto= -golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw= -golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk= +golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M= +golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis= golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f h1:W3F4c+6OLc6H2lb//N1q4WpJkhzJCK5J6kUi1NTVXfM= golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f/go.mod h1:J1xhfL/vlindoeF/aINzNzt2Bket5bjo9sdOYzOsU80= golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY= @@ -276,17 +277,15 @@ golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLL golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= golang.org/x/net v0.0.0-20200421231249-e086a090c8fd/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A= golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU= -golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE= -golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU= +golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To= +golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU= golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek= golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0= golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= -golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20200909081042-eff7692f9009/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= @@ -297,30 +296,30 @@ golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0= golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= -golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs= -golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY= +golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8= +golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M= golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= golang.org/x/tools v0.0.0-20181030221726-6c7e314b6563/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo= golang.org/x/tools v0.0.0-20200130002326-2f3ba24bd6e7/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28= golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE= golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA= -golang.org/x/tools v0.47.0 h1:7Kn5x/d1svx/PzryTsqeoZN4TZwqeH5pGWjefhLi/1Q= -golang.org/x/tools v0.47.0/go.mod h1:dFHnyTvFWY212G+h7ZY4Vsp/K3U4/7W9TyVaAul8uCA= +golang.org/x/tools v0.48.0 h1:3+hClM1aLL5mjMKm5ovokw9epgRXPuu2tILgismM6RE= +golang.org/x/tools v0.48.0/go.mod h1:08xX0orndb/F7jJxGDicx061tyd5pcMto75YMAXr6lk= golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4= gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E= -google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa h1:Kjn0N0tCrDgiAFW+lGO4JZ3ck44CehvJQMAwj9QF0G8= -google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa/go.mod h1:q4lMZS6kskjT5HvCPrnnypcDPVJqT/f4nfxmkE7gryY= -google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa h1:mZHHdPZl0dbGHCflZgAq/Q468DWVFcU2whhB2KAo8fk= -google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8= +google.golang.org/genproto/googleapis/api v0.0.0-20260819154853-08b0e4226688 h1:ax2KzoSRIZU/M0cIxri3pKxy99vniH1PVxWC6si/eZI= +google.golang.org/genproto/googleapis/api v0.0.0-20260819154853-08b0e4226688/go.mod h1:1RJ9BQGyNdZwkGc1eTqkErfRZ6RJyYPHZo73BZ1vQqI= +google.golang.org/genproto/googleapis/rpc v0.0.0-20260819154853-08b0e4226688 h1:cYNAzI2sUwhmCcoj9TxvihSrqsxt6uIkj3rDRhSDmW4= +google.golang.org/genproto/googleapis/rpc v0.0.0-20260819154853-08b0e4226688/go.mod h1:DjtHYE8FKJLivXcBEjGwndXfIC23G0VpXiXKqG179uA= google.golang.org/grpc v1.83.1 h1:HIO0+BEtBP6soyqvqC8sNUjZ7bTs+0hFQuFF+RAy++Y= google.golang.org/grpc v1.83.1/go.mod h1:kDyl6SKsiHKt0uylY5gtn5cEjkrIOhQOGDgIc4JGwzQ= -google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE= -google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= +google.golang.org/protobuf v1.36.12 h1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o/fwxc= +google.golang.org/protobuf v1.36.12/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk= From d08e70b32a40bae010399b6ee53e30a20f1d7e8d Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sat, 5 Sep 2026 21:14:11 +0300 Subject: [PATCH 21/36] build(deps): bump github.com/Azure/azure-sdk-for-go/sdk/azidentity from 1.14.0 to 1.14.1 (#1608) Bumps [github.com/Azure/azure-sdk-for-go/sdk/azidentity](https://github.com/Azure/azure-sdk-for-go) from 1.14.0 to 1.14.1.
    Release notes

    Sourced from github.com/Azure/azure-sdk-for-go/sdk/azidentity's releases.

    sdk/azidentity/v1.14.1

    1.14.1 (2026-08-27)

    Other Changes

    • Upgraded dependencies
    Commits
    • 920e79a Prep azidentity for release (#27473)
    • d86ae78 Prep azcore for release (#27471)
    • 33dd768 [azwebpubsub] Fix GenerateClientAccessURL on the TokenCredential path (#27422)
    • a27ca57 Upgrade TypeSpec Go emitter dependencies (#27466)
    • af75eb0 [AutoPR sdk-resourcemanager/purestorageblock/armpurestorageblock]-generated-f...
    • 8dcff8c [AutoPR sdk-resourcemanager/redisenterprise/armredisenterprise]-generated-fro...
    • e4569f1 [AutoPR sdk-resourcemanager/chaos/armchaos]-generated-from-SDK Generation - G...
    • 7069bf8 [AutoPR sdk-resourcemanager/horizondb/armhorizondb]-generated-from-SDK Genera...
    • 5ceffce Bump gh-aw to v0.86.2 for mgmt review workflow (#27460)
    • 663b6ce Enhance azblob perf tests with OAuth, parallel setup, and profiling (#27324)
    • Additional commits viewable in compare view

    [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/Azure/azure-sdk-for-go/sdk/azidentity&package-manager=go_modules&previous-version=1.14.0&new-version=1.14.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
    Dependabot commands and options
    You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 15 ++++++++------- go.sum | 30 ++++++++++++++++-------------- 2 files changed, 24 insertions(+), 21 deletions(-) diff --git a/go.mod b/go.mod index daeff49..e06be91 100644 --- a/go.mod +++ b/go.mod @@ -4,7 +4,7 @@ go 1.26 require ( cloud.google.com/go/kms v1.33.0 - github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.14.0 + github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.14.1 github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.5.0 github.com/caarlos0/env/v11 v11.4.1 github.com/coreos/go-oidc/v3 v3.20.0 @@ -15,7 +15,7 @@ require ( github.com/prometheus/client_golang v1.24.1 github.com/rs/cors v1.11.1 github.com/santhosh-tekuri/jsonschema/v5 v5.3.1 - github.com/stretchr/testify v1.12.0 + github.com/stretchr/testify v1.12.1 go.opentelemetry.io/contrib/instrumentation/runtime v0.70.0 go.opentelemetry.io/otel v1.45.0 go.opentelemetry.io/otel/exporters/prometheus v0.67.0 @@ -33,10 +33,10 @@ require ( cloud.google.com/go/compute/metadata v0.9.0 // indirect cloud.google.com/go/iam v1.11.0 // indirect cloud.google.com/go/longrunning v1.2.0 // indirect - github.com/Azure/azure-sdk-for-go/sdk/azcore v1.22.0 // indirect + github.com/Azure/azure-sdk-for-go/sdk/azcore v1.23.1 // indirect github.com/Azure/azure-sdk-for-go/sdk/internal v1.12.0 // indirect github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.2.0 // indirect - github.com/AzureAD/microsoft-authentication-library-for-go v1.7.2 // indirect + github.com/AzureAD/microsoft-authentication-library-for-go v1.8.0 // indirect github.com/beorn7/perks v1.0.1 // indirect github.com/cespare/xxhash/v2 v2.3.0 // indirect github.com/docker/cli v29.6.2+incompatible // indirect @@ -67,12 +67,13 @@ require ( go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.67.0 // indirect go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0 // indirect go.opentelemetry.io/otel/trace v1.45.0 // indirect - golang.org/x/crypto v0.54.0 // indirect - golang.org/x/net v0.57.0 // indirect + go.yaml.in/yaml/v3 v3.0.5 // indirect + golang.org/x/crypto v0.55.0 // indirect + golang.org/x/net v0.58.0 // indirect golang.org/x/oauth2 v0.36.0 // indirect golang.org/x/sync v0.22.0 // indirect golang.org/x/sys v0.47.0 // indirect - golang.org/x/text v0.40.0 // indirect + golang.org/x/text v0.41.0 // indirect golang.org/x/time v0.15.0 // indirect google.golang.org/api v0.287.1 // indirect google.golang.org/genproto v0.0.0-20260319201613-d00831a3d3e7 // indirect diff --git a/go.sum b/go.sum index 029e79d..fde75f5 100644 --- a/go.sum +++ b/go.sum @@ -12,10 +12,10 @@ cloud.google.com/go/kms v1.33.0 h1:pG0X78m212b2pv9N4fdMoUO69LuZGQ9kSvn8sHBOFAo= cloud.google.com/go/kms v1.33.0/go.mod h1:CSGvW6GnMQbY+1nOHcIzhMtHSbExXlOmCKjWtYVjcpA= cloud.google.com/go/longrunning v1.2.0 h1:WjYH3YHBGCxGJP9M4dWGHBfXr/cFIjMkNgWcJj7/iMM= cloud.google.com/go/longrunning v1.2.0/go.mod h1:5KMQALFGOCtFoi2xSOA1u3H7WKlhmckgiyFw7+LGQp0= -github.com/Azure/azure-sdk-for-go/sdk/azcore v1.22.0 h1:aokoqcHvaGjiM3VpjKDfMMnF/8epJ+Q1HLJ7CudztqE= -github.com/Azure/azure-sdk-for-go/sdk/azcore v1.22.0/go.mod h1:/WYEx9pcM9Y+Dd/APJaNlSvVSvzl54rrMdZT5+Oi2LM= -github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.14.0 h1:CU4+EJeJi3TKYWEcYuSdWsjzw0nVsK/H0MSQOiPcymU= -github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.14.0/go.mod h1:q0+UTSRvShwUCrR/s5HtyInYphN7Wvxb7snFM3u+SLA= +github.com/Azure/azure-sdk-for-go/sdk/azcore v1.23.1 h1:zvXfGJCWvywnCA814d8ZiVyt+fm9nnTE8xSb99zRyfo= +github.com/Azure/azure-sdk-for-go/sdk/azcore v1.23.1/go.mod h1:iptorS+VYKFL2N6PnebpS91dubG35eAOEERnT4PJbQU= +github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.14.1 h1:u93s+zU2JD62im61Bm5CZIc1ZrOJaIAWEg0WOrMVkEo= +github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.14.1/go.mod h1:oXtinPO4OLj9d1DOTrqrL1oRwGhcqadvAmrl6wTeGlk= github.com/Azure/azure-sdk-for-go/sdk/azidentity/cache v0.4.0 h1:xFaZZ+IubdftrDHnGGwZ6QvQ3KHTtWl2MCK+GMt2vxs= github.com/Azure/azure-sdk-for-go/sdk/azidentity/cache v0.4.0/go.mod h1:mCBhUhlMjLLJKr5aqw2TNS/VqJOie8MzWq3DAMJeKso= github.com/Azure/azure-sdk-for-go/sdk/internal v1.12.0 h1:fhqpLE3UEXi9lPaBRpQ6XuRW0nU7hgg4zlmZZa+a9q4= @@ -26,8 +26,8 @@ github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.2.0 h1:nCYfg github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.2.0/go.mod h1:ucUjca2JtSZboY8IoUqyQyuuXvwbMBVwFOm0vdQPNhA= github.com/AzureAD/microsoft-authentication-extensions-for-go/cache v0.1.1 h1:WJTmL004Abzc5wDB5VtZG2PJk5ndYDgVacGqfirKxjM= github.com/AzureAD/microsoft-authentication-extensions-for-go/cache v0.1.1/go.mod h1:tCcJZ0uHAmvjsVYzEFivsRTN00oz5BEsRgQHu5JZ9WE= -github.com/AzureAD/microsoft-authentication-library-for-go v1.7.2 h1:RHK7bS+HQMslb1sZpAokUt+zTVmue0hKSs2C791hhzU= -github.com/AzureAD/microsoft-authentication-library-for-go v1.7.2/go.mod h1:HKpQxkWaGLJ+D/5H8QRpyQXA1eKjxkFlOMwck5+33Jk= +github.com/AzureAD/microsoft-authentication-library-for-go v1.8.0 h1:Nljr4q1GRA/5vCrMONS+g4u4LRHNgOXVSh3O43J2CnI= +github.com/AzureAD/microsoft-authentication-library-for-go v1.8.0/go.mod h1:Y33QHnf0FfdVewFFISOGe20mkZbxX4H839o955/PoeI= github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM= github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw= github.com/caarlos0/env/v11 v11.4.1 h1:fYwH0sWEsBSMPG7t4e/PEfTFzrWrpjyygXyUnWiSwEw= @@ -129,8 +129,8 @@ github.com/sirupsen/logrus v1.9.4/go.mod h1:ftWc9WdOfJ0a92nsE2jF5u5ZwH8Bv2zdeOC4 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI= github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= -github.com/stretchr/testify v1.12.0 h1:K6Mr6jO9JICuend/5xzTM03ydSV3vdNRYAdPSukj8uI= -github.com/stretchr/testify v1.12.0/go.mod h1:bOYBZb5qJ00vPzWfIqBUZPaxK8jWiXc6d3ErP4Ca9Gw= +github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE= +github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg= github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM= github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg= go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64= @@ -159,12 +159,14 @@ go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto= go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE= go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ= go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ= -golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw= -golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk= +go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw= +go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg= +golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M= +golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis= golang.org/x/mod v0.40.0 h1:hUv+3cXcdRHz08UmSiOob7sadHig73uo5bkXxQ/tvUs= golang.org/x/mod v0.40.0/go.mod h1:0/weTWkPWGBikyTWAX3dkjVztMmBA5hM0DH6BElSupE= -golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE= -golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU= +golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To= +golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU= golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs= golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q= golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek= @@ -172,8 +174,8 @@ golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0= golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs= golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= -golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs= -golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY= +golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8= +golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M= golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U= golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno= gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4= From e166f76f06c0ba2e9ab6958e511ab43dd1e9ec29 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sat, 5 Sep 2026 21:39:42 +0300 Subject: [PATCH 22/36] build(deps): bump the opentelemetry group across 1 directory with 6 updates (#1607) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps the opentelemetry group with 2 updates in the / directory: [go.opentelemetry.io/contrib/instrumentation/runtime](https://github.com/open-telemetry/opentelemetry-go-contrib) and [go.opentelemetry.io/otel/exporters/prometheus](https://github.com/open-telemetry/opentelemetry-go). Updates `go.opentelemetry.io/contrib/instrumentation/runtime` from 0.70.0 to 0.71.0
    Changelog

    Sourced from go.opentelemetry.io/contrib/instrumentation/runtime's changelog.

    [1.46.0/2.5.3/0.71.0/0.37.3/0.26.0/0.20.1/0.16.3/0.18.0] - 2026-08-25

    This release is the last to support [Go 1.25]. The next release will require at least [Go 1.26].

    Added

    • Add support for the aws.ec2 resource detector in go.opentelemetry.io/contrib/otelconf/x. (#9139)
    • Support testing of [Go 1.27]. (#9524)
    • Add go.opentelemetry.io/contrib/detectors/docker, a resource detector for Docker, ported from processor/resourcedetectionprocessor/internal/docker in opentelemetry-collector-contrib. (#9001)
    • Add S3AttributeBuilder to go.opentelemetry.io/contrib/instrumentation/github.com/aws/aws-sdk-go-v2/otelaws that sets S3-specific span attributes following the OpenTelemetry S3 semantic conventions. (#9292)

    Deprecated

    • Deprecate go.opentelemetry.io/contrib/instrumentation/github.com/labstack/echo/otelecho. Use github.com/labstack/echo-opentelemetry instead. (#9136)

    Fixed

    • Record error.type attribute on server spans in go.opentelemetry.io/contrib/instrumentation/github.com/emicklei/go-restful/otelrestful when a request is cancelled or ends in a 5xx error. (#9387)
    • Report ot-baggage-* extraction errors from go.opentelemetry.io/contrib/propagators/ot to otel.Handle instead of silently discarding them, while still attaching the successfully parsed baggage members to the context. (#9395)
    • Set error.type on the rpc.client.call.duration and rpc.server.call.duration metrics in go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc when the RPC fails with a non-OK status, per the RPC semantic conventions. (#9429)
    • Reject OTLP exporter headers with an empty name in go.opentelemetry.io/contrib/otelconf, go.opentelemetry.io/contrib/otelconf/x, and go.opentelemetry.io/contrib/otelconf/v0.3.0, instead of forwarding invalid header names to OTLP exporters. (#9102)
    • go.opentelemetry.io/contrib/detectors/aws/lambda no longer returns an error when run outside of an AWS Lambda environment, matching the no-op behavior of other resource detectors. (#9464)
    • Convert Prometheus untyped metrics to OTLP Gauges in go.opentelemetry.io/contrib/bridges/prometheus. (#9099)
    Commits
    • c4c6248 Release v1.46.0/v2.5.3/v0.71.0/v0.37.3/v0.26.0/v0.20.1/v0.16.3/v0.18.0 (#9563)
    • 11c8a13 fix(deps): update aws-sdk-go-v2 monorepo
    • 0458b9d chore(deps): update module go.opentelemetry.io/contrib/instrumentation/net/ht...
    • 638a0d5 fix(deps): update module github.com/moby/moby/api to v1.55.0
    • 5089aa5 chore(deps): update googleapis to da73d73
    • a50857b chore(deps): update jaegertracing/jaeger docker tag to v2.20.0
    • aa4f4a5 chore(deps): update open-telemetry/shared-workflows action to v0.11.0
    • ccbbc14 fix(deps): update module github.com/aws/smithy-go to v1.28.0
    • 9312464 chore(deps): update module github.com/docker/go-connections to v0.8.1
    • 36c3b00 chore(deps): update module github.com/felixge/httpsnoop to v1.1.0
    • Additional commits viewable in compare view

    Updates `go.opentelemetry.io/otel` from 1.45.0 to 1.46.0
    Release notes

    Sourced from go.opentelemetry.io/otel's releases.

    v1.46.0/v0.68.0/v0.22.0/v0.0.19

    This release is the last to support Go 1.25. The next release will require at least Go 1.26.

    Added

    • Support testing of Go 1.27. (#8811)
    • Support http/json protocol in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp. (#8273, #8775, #8831)
    • Add Hasher struct and methods in go.opentelemetry.io/otel/attribute to compute authoritative Distinct hashes incrementally for attribute filtering and deduplication. (#8598)

    Changed

    • Lazily evaluate filtered and dropped attributes on measurement hot paths in go.opentelemetry.io/otel/sdk/metric to avoid unnecessary attribute set allocations. (#8598)
    • Add ErrExporterShutdown to go.opentelemetry.io/otel/sdk/log and return it from the go.opentelemetry.io/otel/exporters/stdout/stdoutlog, go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc, and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp exporters when Export is called after Shutdown. (#8773)
    • Clarify in go.opentelemetry.io/otel/log that calling Logger.Enabled is optional and that cached results can become stale. (#8764)

    Fixed

    • Export dropped attribute counts in OTLP log records from go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#8829)
    • Name span events created from OpenTracing logs after the event log field, falling back to log, instead of always using an empty name in go.opentelemetry.io/otel/bridge/opentracing. (#8648)
    • Count exception attributes omitted due to the attribute count limit as dropped in go.opentelemetry.io/otel/sdk/log. (#8796)
    • Prevent log record and instrumentation scope attributes with empty keys from reaching processors and exporters in go.opentelemetry.io/otel/sdk/log. (#8797)
    • Fix a data race when span attributes are read concurrently in go.opentelemetry.io/otel/sdk/trace. (#8706)
    • Prevent a panic in (*Set).Filter when called on a nil receiver in go.opentelemetry.io/otel/attribute. (#8792)
    • The simple span and log processors record otel.sdk.processor.{span,log}.processed when the record is submitted to the exporter instead of after the export completes, and no longer set error.type from the export outcome, in go.opentelemetry.io/otel/sdk/trace and go.opentelemetry.io/otel/sdk/log. (#8705)
    • Prevent Resource.MarshalLog from panicking on nil resources in go.opentelemetry.io/otel/sdk/resource. (#8758)

    What's Changed

    ... (truncated)

    Changelog

    Sourced from go.opentelemetry.io/otel's changelog.

    [1.46.0/0.68.0/0.22.0/0.0.19] - 2026-08-25

    This release is the last to support [Go 1.25]. The next release will require at least [Go 1.26].

    Added

    • Support testing of [Go 1.27]. (#8811)
    • Support http/json protocol in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp. (#8273, #8775, #8831)
    • Add Hasher struct and methods in go.opentelemetry.io/otel/attribute to compute authoritative Distinct hashes incrementally for attribute filtering and deduplication. (#8598)

    Changed

    • Lazily evaluate filtered and dropped attributes on measurement hot paths in go.opentelemetry.io/otel/sdk/metric to avoid unnecessary attribute set allocations. (#8598)
    • Add ErrExporterShutdown to go.opentelemetry.io/otel/sdk/log and return it from the go.opentelemetry.io/otel/exporters/stdout/stdoutlog, go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc, and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp exporters when Export is called after Shutdown. (#8773)
    • Clarify in go.opentelemetry.io/otel/log that calling Logger.Enabled is optional and that cached results can become stale. (#8764)

    Fixed

    • Export dropped attribute counts in OTLP log records from go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#8829)
    • Name span events created from OpenTracing logs after the event log field, falling back to log, instead of always using an empty name in go.opentelemetry.io/otel/bridge/opentracing. (#8648)
    • Count exception attributes omitted due to the attribute count limit as dropped in go.opentelemetry.io/otel/sdk/log. (#8796)
    • Prevent log record and instrumentation scope attributes with empty keys from reaching processors and exporters in go.opentelemetry.io/otel/sdk/log. (#8797)
    • Fix a data race when span attributes are read concurrently in go.opentelemetry.io/otel/sdk/trace. (#8706)
    • Prevent a panic in (*Set).Filter when called on a nil receiver in go.opentelemetry.io/otel/attribute. (#8792)
    • The simple span and log processors record otel.sdk.processor.{span,log}.processed when the record is submitted to the exporter instead of after the export completes, and no longer set error.type from the export outcome, in go.opentelemetry.io/otel/sdk/trace and go.opentelemetry.io/otel/sdk/log. (#8705)
    • Prevent Resource.MarshalLog from panicking on nil resources in go.opentelemetry.io/otel/sdk/resource. (#8758)
    Commits
    • 58db4c8 Release v1.46.0 (#8858)
    • 524fc3c chore(deps): update golang.org/x/telemetry digest to 1f5465a (#8853)
    • 3b8ef6f chore(deps): update codspeedhq/action action to v5.2.1 (#8854)
    • cfbeab5 attribute: clarify xxhash test purpose (#8753)
    • 3599b59 sdk/log: Add interface stability markers (#8855)
    • 08d52dc otlptracehttp: Accept quoted finite doubles in OTLP JSON (#8831)
    • d720f5a otlplog: export dropped attribute count (#8829)
    • 80fe23b chore(deps): update module honnef.co/go/tools to v0.8.1 (#8816)
    • 5337812 chore(deps): update codspeedhq/action action to v5.2.0 (#8851)
    • 2f73a3e chore(deps): update module github.com/uudashr/iface to v1.5.1 (#8841)
    • Additional commits viewable in compare view

    Updates `go.opentelemetry.io/otel/exporters/prometheus` from 0.67.0 to 0.68.0
    Changelog

    Sourced from go.opentelemetry.io/otel/exporters/prometheus's changelog.

    [1.46.0/0.68.0/0.22.0/0.0.19] - 2026-08-25

    This release is the last to support [Go 1.25]. The next release will require at least [Go 1.26].

    Added

    • Support testing of [Go 1.27]. (#8811)
    • Support http/json protocol in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp. (#8273, #8775, #8831)
    • Add Hasher struct and methods in go.opentelemetry.io/otel/attribute to compute authoritative Distinct hashes incrementally for attribute filtering and deduplication. (#8598)

    Changed

    • Lazily evaluate filtered and dropped attributes on measurement hot paths in go.opentelemetry.io/otel/sdk/metric to avoid unnecessary attribute set allocations. (#8598)
    • Add ErrExporterShutdown to go.opentelemetry.io/otel/sdk/log and return it from the go.opentelemetry.io/otel/exporters/stdout/stdoutlog, go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc, and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp exporters when Export is called after Shutdown. (#8773)
    • Clarify in go.opentelemetry.io/otel/log that calling Logger.Enabled is optional and that cached results can become stale. (#8764)

    Fixed

    • Export dropped attribute counts in OTLP log records from go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#8829)
    • Name span events created from OpenTracing logs after the event log field, falling back to log, instead of always using an empty name in go.opentelemetry.io/otel/bridge/opentracing. (#8648)
    • Count exception attributes omitted due to the attribute count limit as dropped in go.opentelemetry.io/otel/sdk/log. (#8796)
    • Prevent log record and instrumentation scope attributes with empty keys from reaching processors and exporters in go.opentelemetry.io/otel/sdk/log. (#8797)
    • Fix a data race when span attributes are read concurrently in go.opentelemetry.io/otel/sdk/trace. (#8706)
    • Prevent a panic in (*Set).Filter when called on a nil receiver in go.opentelemetry.io/otel/attribute. (#8792)
    • The simple span and log processors record otel.sdk.processor.{span,log}.processed when the record is submitted to the exporter instead of after the export completes, and no longer set error.type from the export outcome, in go.opentelemetry.io/otel/sdk/trace and go.opentelemetry.io/otel/sdk/log. (#8705)
    • Prevent Resource.MarshalLog from panicking on nil resources in go.opentelemetry.io/otel/sdk/resource. (#8758)
    Commits
    • 58db4c8 Release v1.46.0 (#8858)
    • 524fc3c chore(deps): update golang.org/x/telemetry digest to 1f5465a (#8853)
    • 3b8ef6f chore(deps): update codspeedhq/action action to v5.2.1 (#8854)
    • cfbeab5 attribute: clarify xxhash test purpose (#8753)
    • 3599b59 sdk/log: Add interface stability markers (#8855)
    • 08d52dc otlptracehttp: Accept quoted finite doubles in OTLP JSON (#8831)
    • d720f5a otlplog: export dropped attribute count (#8829)
    • 80fe23b chore(deps): update module honnef.co/go/tools to v0.8.1 (#8816)
    • 5337812 chore(deps): update codspeedhq/action action to v5.2.0 (#8851)
    • 2f73a3e chore(deps): update module github.com/uudashr/iface to v1.5.1 (#8841)
    • Additional commits viewable in compare view

    Updates `go.opentelemetry.io/otel/metric` from 1.45.0 to 1.46.0
    Release notes

    Sourced from go.opentelemetry.io/otel/metric's releases.

    v1.46.0/v0.68.0/v0.22.0/v0.0.19

    This release is the last to support Go 1.25. The next release will require at least Go 1.26.

    Added

    • Support testing of Go 1.27. (#8811)
    • Support http/json protocol in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp. (#8273, #8775, #8831)
    • Add Hasher struct and methods in go.opentelemetry.io/otel/attribute to compute authoritative Distinct hashes incrementally for attribute filtering and deduplication. (#8598)

    Changed

    • Lazily evaluate filtered and dropped attributes on measurement hot paths in go.opentelemetry.io/otel/sdk/metric to avoid unnecessary attribute set allocations. (#8598)
    • Add ErrExporterShutdown to go.opentelemetry.io/otel/sdk/log and return it from the go.opentelemetry.io/otel/exporters/stdout/stdoutlog, go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc, and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp exporters when Export is called after Shutdown. (#8773)
    • Clarify in go.opentelemetry.io/otel/log that calling Logger.Enabled is optional and that cached results can become stale. (#8764)

    Fixed

    • Export dropped attribute counts in OTLP log records from go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#8829)
    • Name span events created from OpenTracing logs after the event log field, falling back to log, instead of always using an empty name in go.opentelemetry.io/otel/bridge/opentracing. (#8648)
    • Count exception attributes omitted due to the attribute count limit as dropped in go.opentelemetry.io/otel/sdk/log. (#8796)
    • Prevent log record and instrumentation scope attributes with empty keys from reaching processors and exporters in go.opentelemetry.io/otel/sdk/log. (#8797)
    • Fix a data race when span attributes are read concurrently in go.opentelemetry.io/otel/sdk/trace. (#8706)
    • Prevent a panic in (*Set).Filter when called on a nil receiver in go.opentelemetry.io/otel/attribute. (#8792)
    • The simple span and log processors record otel.sdk.processor.{span,log}.processed when the record is submitted to the exporter instead of after the export completes, and no longer set error.type from the export outcome, in go.opentelemetry.io/otel/sdk/trace and go.opentelemetry.io/otel/sdk/log. (#8705)
    • Prevent Resource.MarshalLog from panicking on nil resources in go.opentelemetry.io/otel/sdk/resource. (#8758)

    What's Changed

    ... (truncated)

    Changelog

    Sourced from go.opentelemetry.io/otel/metric's changelog.

    [1.46.0/0.68.0/0.22.0/0.0.19] - 2026-08-25

    This release is the last to support [Go 1.25]. The next release will require at least [Go 1.26].

    Added

    • Support testing of [Go 1.27]. (#8811)
    • Support http/json protocol in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp. (#8273, #8775, #8831)
    • Add Hasher struct and methods in go.opentelemetry.io/otel/attribute to compute authoritative Distinct hashes incrementally for attribute filtering and deduplication. (#8598)

    Changed

    • Lazily evaluate filtered and dropped attributes on measurement hot paths in go.opentelemetry.io/otel/sdk/metric to avoid unnecessary attribute set allocations. (#8598)
    • Add ErrExporterShutdown to go.opentelemetry.io/otel/sdk/log and return it from the go.opentelemetry.io/otel/exporters/stdout/stdoutlog, go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc, and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp exporters when Export is called after Shutdown. (#8773)
    • Clarify in go.opentelemetry.io/otel/log that calling Logger.Enabled is optional and that cached results can become stale. (#8764)

    Fixed

    • Export dropped attribute counts in OTLP log records from go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#8829)
    • Name span events created from OpenTracing logs after the event log field, falling back to log, instead of always using an empty name in go.opentelemetry.io/otel/bridge/opentracing. (#8648)
    • Count exception attributes omitted due to the attribute count limit as dropped in go.opentelemetry.io/otel/sdk/log. (#8796)
    • Prevent log record and instrumentation scope attributes with empty keys from reaching processors and exporters in go.opentelemetry.io/otel/sdk/log. (#8797)
    • Fix a data race when span attributes are read concurrently in go.opentelemetry.io/otel/sdk/trace. (#8706)
    • Prevent a panic in (*Set).Filter when called on a nil receiver in go.opentelemetry.io/otel/attribute. (#8792)
    • The simple span and log processors record otel.sdk.processor.{span,log}.processed when the record is submitted to the exporter instead of after the export completes, and no longer set error.type from the export outcome, in go.opentelemetry.io/otel/sdk/trace and go.opentelemetry.io/otel/sdk/log. (#8705)
    • Prevent Resource.MarshalLog from panicking on nil resources in go.opentelemetry.io/otel/sdk/resource. (#8758)
    Commits
    • 58db4c8 Release v1.46.0 (#8858)
    • 524fc3c chore(deps): update golang.org/x/telemetry digest to 1f5465a (#8853)
    • 3b8ef6f chore(deps): update codspeedhq/action action to v5.2.1 (#8854)
    • cfbeab5 attribute: clarify xxhash test purpose (#8753)
    • 3599b59 sdk/log: Add interface stability markers (#8855)
    • 08d52dc otlptracehttp: Accept quoted finite doubles in OTLP JSON (#8831)
    • d720f5a otlplog: export dropped attribute count (#8829)
    • 80fe23b chore(deps): update module honnef.co/go/tools to v0.8.1 (#8816)
    • 5337812 chore(deps): update codspeedhq/action action to v5.2.0 (#8851)
    • 2f73a3e chore(deps): update module github.com/uudashr/iface to v1.5.1 (#8841)
    • Additional commits viewable in compare view

    Updates `go.opentelemetry.io/otel/sdk` from 1.45.0 to 1.46.0
    Release notes

    Sourced from go.opentelemetry.io/otel/sdk's releases.

    v1.46.0/v0.68.0/v0.22.0/v0.0.19

    This release is the last to support Go 1.25. The next release will require at least Go 1.26.

    Added

    • Support testing of Go 1.27. (#8811)
    • Support http/json protocol in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp. (#8273, #8775, #8831)
    • Add Hasher struct and methods in go.opentelemetry.io/otel/attribute to compute authoritative Distinct hashes incrementally for attribute filtering and deduplication. (#8598)

    Changed

    • Lazily evaluate filtered and dropped attributes on measurement hot paths in go.opentelemetry.io/otel/sdk/metric to avoid unnecessary attribute set allocations. (#8598)
    • Add ErrExporterShutdown to go.opentelemetry.io/otel/sdk/log and return it from the go.opentelemetry.io/otel/exporters/stdout/stdoutlog, go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc, and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp exporters when Export is called after Shutdown. (#8773)
    • Clarify in go.opentelemetry.io/otel/log that calling Logger.Enabled is optional and that cached results can become stale. (#8764)

    Fixed

    • Export dropped attribute counts in OTLP log records from go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#8829)
    • Name span events created from OpenTracing logs after the event log field, falling back to log, instead of always using an empty name in go.opentelemetry.io/otel/bridge/opentracing. (#8648)
    • Count exception attributes omitted due to the attribute count limit as dropped in go.opentelemetry.io/otel/sdk/log. (#8796)
    • Prevent log record and instrumentation scope attributes with empty keys from reaching processors and exporters in go.opentelemetry.io/otel/sdk/log. (#8797)
    • Fix a data race when span attributes are read concurrently in go.opentelemetry.io/otel/sdk/trace. (#8706)
    • Prevent a panic in (*Set).Filter when called on a nil receiver in go.opentelemetry.io/otel/attribute. (#8792)
    • The simple span and log processors record otel.sdk.processor.{span,log}.processed when the record is submitted to the exporter instead of after the export completes, and no longer set error.type from the export outcome, in go.opentelemetry.io/otel/sdk/trace and go.opentelemetry.io/otel/sdk/log. (#8705)
    • Prevent Resource.MarshalLog from panicking on nil resources in go.opentelemetry.io/otel/sdk/resource. (#8758)

    What's Changed

    ... (truncated)

    Changelog

    Sourced from go.opentelemetry.io/otel/sdk's changelog.

    [1.46.0/0.68.0/0.22.0/0.0.19] - 2026-08-25

    This release is the last to support [Go 1.25]. The next release will require at least [Go 1.26].

    Added

    • Support testing of [Go 1.27]. (#8811)
    • Support http/json protocol in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp. (#8273, #8775, #8831)
    • Add Hasher struct and methods in go.opentelemetry.io/otel/attribute to compute authoritative Distinct hashes incrementally for attribute filtering and deduplication. (#8598)

    Changed

    • Lazily evaluate filtered and dropped attributes on measurement hot paths in go.opentelemetry.io/otel/sdk/metric to avoid unnecessary attribute set allocations. (#8598)
    • Add ErrExporterShutdown to go.opentelemetry.io/otel/sdk/log and return it from the go.opentelemetry.io/otel/exporters/stdout/stdoutlog, go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc, and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp exporters when Export is called after Shutdown. (#8773)
    • Clarify in go.opentelemetry.io/otel/log that calling Logger.Enabled is optional and that cached results can become stale. (#8764)

    Fixed

    • Export dropped attribute counts in OTLP log records from go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#8829)
    • Name span events created from OpenTracing logs after the event log field, falling back to log, instead of always using an empty name in go.opentelemetry.io/otel/bridge/opentracing. (#8648)
    • Count exception attributes omitted due to the attribute count limit as dropped in go.opentelemetry.io/otel/sdk/log. (#8796)
    • Prevent log record and instrumentation scope attributes with empty keys from reaching processors and exporters in go.opentelemetry.io/otel/sdk/log. (#8797)
    • Fix a data race when span attributes are read concurrently in go.opentelemetry.io/otel/sdk/trace. (#8706)
    • Prevent a panic in (*Set).Filter when called on a nil receiver in go.opentelemetry.io/otel/attribute. (#8792)
    • The simple span and log processors record otel.sdk.processor.{span,log}.processed when the record is submitted to the exporter instead of after the export completes, and no longer set error.type from the export outcome, in go.opentelemetry.io/otel/sdk/trace and go.opentelemetry.io/otel/sdk/log. (#8705)
    • Prevent Resource.MarshalLog from panicking on nil resources in go.opentelemetry.io/otel/sdk/resource. (#8758)
    Commits
    • 58db4c8 Release v1.46.0 (#8858)
    • 524fc3c chore(deps): update golang.org/x/telemetry digest to 1f5465a (#8853)
    • 3b8ef6f chore(deps): update codspeedhq/action action to v5.2.1 (#8854)
    • cfbeab5 attribute: clarify xxhash test purpose (#8753)
    • 3599b59 sdk/log: Add interface stability markers (#8855)
    • 08d52dc otlptracehttp: Accept quoted finite doubles in OTLP JSON ( Date: Sat, 5 Sep 2026 21:40:40 +0300 Subject: [PATCH 23/36] build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.259.0 to 3.261.0 in /deploy (#1606) Bumps [github.com/pulumi/pulumi/sdk/v3](https://github.com/pulumi/pulumi) from 3.259.0 to 3.261.0.
      Release notes

      Sourced from github.com/pulumi/pulumi/sdk/v3's releases.

      v3.261.0

      3.261.0 (2026-09-02)

      Features

      • [engine] Support state migration callbacks on resource registrations #24328
      • [cli/env] Add pulumi env setup {aws,azure,gcp} to configure cloud OIDC trust and create the ESC environments that use it #23911

      Bug Fixes

      • [engine] Report a clear error instead of panicking when the stack's state contains a custom resource with no ID #24438
      • [cli] Show the agent account's claim URL instead of an inaccessible View Live link when running on ephemeral agent credentials #24476
      • [pcl] Fix a crash when binding a schema property with an integer constant value #24480
      • [cli/policy] Avoid hanging when policy pack fails to start up #24492
      • [pkg/testing] Fix ProgramTest for providers whose Go module or NuGet package has a double-digit major version #24499
      • [sdk] Fix serialization of secret unknowns in NodeJS, Python and PCL #24500
      • [engine] Ignore internal property keys (those starting with an underscore) when generating and checking update plans #24532

      Improvements

      • [sdkgen] Generate precise Python output types for discriminated unions. An array of a union was typed Sequence[Any] and a scalar union Any, while the matching getters on the generated Args classes were already typed #24485
      • [sdk/python] Resolve a union value to its member by matching the value's wire shape, so unions whose members carry no constant properties serialize and translate with the right member's property names #24484
      • [sdkgen/python] Accept a generated output type wherever the classes-and-dicts input types accept its Args class or TypedDict, so a resource's output can be passed to another resource's input without a type error #24507
      • [engine] Send previously persisted outputs to a provider's Check on update, gated by a new sends_old_outputs_to_check handshake capability #24524
      • [sdk/python] Add helper methods to transform ResourceOptions to InvokeOptions #24533

      Miscellaneous

      • [java] Upgrade java to v1.36.3 #24509
      • [yaml] Upgrade yaml to v1.38.5 #24509
      • [sdk/dotnet] Upgrade dotnet to v3.113.1 #24512

      v3.260.0

      3.260.0 (2026-08-28)

      Features

      • [cli/deployment] Make pulumi deployment settings get render every source kind and show environment variable values, changing the --output=json shape of environmentVariables from a list of names to a list of objects #24284
      • [sdk/go] Support Go 1.27 #24401
      • [cli/state] Add pulumi state promote to turn stateful snippets into Pulumi program code #24453

      Bug Fixes

      • [engine] Replace resources whose deletedWith target is being replaced, instead of leaving them orphaned in state #23818
      • [sdk/python] Serialize typed object stack outputs with their wire-format (camelCase) property names, matching other language SDKs #24246
      • [cli/neo] Cancelling a task now interrupts a running local tool call instead of waiting for it to finish #24268
      • [programgen/python] Access schema properties whose names contain hyphens as attributes under their Python names instead of subscripting #24300
      • [programgen/go] Generate valid struct field names for properties whose names contain hyphens #24300
      • [sdkgen/nodejs] Quote property names that are not legal identifiers (e.g. kebab-case) in generated declarations and use bracket access for them #24300
      • [cli/neo] Cancelling a local tool call no longer leaves the TUI stuck on "Thinking..." with input blocked #24318

      ... (truncated)

      Changelog

      Sourced from github.com/pulumi/pulumi/sdk/v3's changelog.

      3.261.0 (2026-09-02)

      Features

      • [engine] Support state migration callbacks on resource registrations #24328
      • [cli/env] Add pulumi env setup {aws,azure,gcp} to configure cloud OIDC trust and create the ESC environments that use it #23911

      Bug Fixes

      • [engine] Report a clear error instead of panicking when the stack's state contains a custom resource with no ID #24438
      • [cli] Show the agent account's claim URL instead of an inaccessible View Live link when running on ephemeral agent credentials #24476
      • [pcl] Fix a crash when binding a schema property with an integer constant value #24480
      • [cli/policy] Avoid hanging when policy pack fails to start up #24492
      • [pkg/testing] Fix ProgramTest for providers whose Go module or NuGet package has a double-digit major version #24499
      • [sdk] Fix serialization of secret unknowns in NodeJS, Python and PCL #24500
      • [engine] Ignore internal property keys (those starting with an underscore) when generating and checking update plans #24532

      Improvements

      • [sdkgen] Generate precise Python output types for discriminated unions. An array of a union was typed Sequence[Any] and a scalar union Any, while the matching getters on the generated Args classes were already typed #24485
      • [sdk/python] Resolve a union value to its member by matching the value's wire shape, so unions whose members carry no constant properties serialize and translate with the right member's property names #24484
      • [sdkgen/python] Accept a generated output type wherever the classes-and-dicts input types accept its Args class or TypedDict, so a resource's output can be passed to another resource's input without a type error #24507
      • [engine] Send previously persisted outputs to a provider's Check on update, gated by a new sends_old_outputs_to_check handshake capability #24524
      • [sdk/python] Add helper methods to transform ResourceOptions to InvokeOptions #24533

      Miscellaneous

      • [java] Upgrade java to v1.36.3 #24509
      • [yaml] Upgrade yaml to v1.38.5 #24509
      • [sdk/dotnet] Upgrade dotnet to v3.113.1 #24512

      3.260.0 (2026-08-28)

      Features

      • [cli/deployment] Make pulumi deployment settings get render every source kind and show environment variable values, changing the --output=json shape of environmentVariables from a list of names to a list of objects #24284
      • [sdk/go] Support Go 1.27 #24401
      • [cli/state] Add pulumi state promote to turn stateful snippets into Pulumi program code #24453

      Bug Fixes

      • [engine] Replace resources whose deletedWith target is being replaced, instead of leaving them orphaned in state #23818
      • [sdk/python] Serialize typed object stack outputs with their wire-format (camelCase) property names, matching other language SDKs #24246
      • [cli/neo] Cancelling a task now interrupts a running local tool call instead of waiting for it to finish #24268
      • [programgen/python] Access schema properties whose names contain hyphens as attributes under their Python names instead of subscripting #24300
      • [programgen/go] Generate valid struct field names for properties whose names contain hyphens #24300
      • [sdkgen/nodejs] Quote property names that are not legal identifiers (e.g. kebab-case) in generated declarations and use bracket access for them #24300
      • [cli/neo] Cancelling a local tool call no longer leaves the TUI stuck on "Thinking..." with input blocked #24318
      • [sdk/go] Use resolved environment names when evaluating ESC imports #24375
      • [codegen/pcl] Allow output-typed values for the id attribute of a read resource #24386
      • [sdkgen/nodejs] Register resolvers for output-only properties in generated Resource.get so they resolve as unknown during preview when the id is unknown #24386

      ... (truncated)

      Commits
      • de0633d Fix ProgramTest for double-digit major versions (#24499)
      • 1e5b60a Migrate ConstructResult to property.Map (#24463)
      • a2b96b4 Ignore internal property keys in update plans (#24532)
      • 4d41278 python: add helper methods to transform ResourceOptions to InvokeOptions (#24...
      • 3081504 Execute component state migrations (#24328)
      • 710f0f8 [Python] Use codegen.IsWireDiscriminatableUnionType in outputs (#24485)
      • f05eae6 Send OldOutputs to provider Check (#24524)
      • ecabf85 Preserve secret marker when serializing unknown Outputs (#24500)
      • f0535f9 [sdkgen/python] Accept output types in resource and function inputs (#24507)
      • 7dc7023 ESC OIDC Onboarding in the CLI (#23911)
      • Additional commits viewable in compare view

      Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- deploy/go.mod | 5 +++-- deploy/go.sum | 6 ++++-- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/deploy/go.mod b/deploy/go.mod index 8f054ab..c989c83 100644 --- a/deploy/go.mod +++ b/deploy/go.mod @@ -1,11 +1,11 @@ module github.com/modelcontextprotocol/registry/deploy/infra -go 1.26 +go 1.26.6 require ( github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.34.0 - github.com/pulumi/pulumi/sdk/v3 v3.259.0 + github.com/pulumi/pulumi/sdk/v3 v3.261.0 gopkg.in/yaml.v2 v2.4.0 ) @@ -30,6 +30,7 @@ require ( github.com/clipperhouse/uax29/v2 v2.7.0 // indirect github.com/cloudflare/circl v1.6.3 // indirect github.com/danieljoos/wincred v1.2.3 // indirect + github.com/deckarep/golang-set/v2 v2.5.0 // indirect github.com/djherbis/times v1.5.0 // indirect github.com/ebitengine/purego v0.10.2 // indirect github.com/emirpasic/gods v1.18.1 // indirect diff --git a/deploy/go.sum b/deploy/go.sum index 3e7be55..032a0f1 100644 --- a/deploy/go.sum +++ b/deploy/go.sum @@ -49,6 +49,8 @@ github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSs github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM= github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= +github.com/deckarep/golang-set/v2 v2.5.0 h1:hn6cEZtQ0h3J8kFrHR/NrzyOoTnjgW1+FmNJzQ7y/sA= +github.com/deckarep/golang-set/v2 v2.5.0/go.mod h1:VAky9rY/yGXJOLEDv3OMci+7wtDpOF4IN+y82NBOac4= github.com/djherbis/times v1.5.0 h1:79myA211VwPhFTqUk8xehWrsEO+zcIZj0zT8mXPVARU= github.com/djherbis/times v1.5.0/go.mod h1:5q7FDLvbNg1L/KaBmPcWlVR9NmoKo3+ucqUA3ijQhA0= github.com/ebitengine/purego v0.10.2 h1:W809HbnvzAxgdm+aOvlSekrM16wGCdT/e76+9tS7gzE= @@ -171,8 +173,8 @@ github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 h1:w6OnO3d4j5yVf2vpm8OzXFC/xHOEGqt+9 github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1/go.mod h1:UyZyv7hz4knpFx6/Sh+SkZe6hT6sJHtDvw9A0TbvEsk= github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.34.0 h1:r00p17ecoDVWqBg38/Is/9jU/JsWLPxnWzhfYqKitx0= github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.34.0/go.mod h1:/klrd3ib4AMRlFMjrxkv5r76x3Bdr68wIMEKfRkRzHU= -github.com/pulumi/pulumi/sdk/v3 v3.259.0 h1:mJP9tXF9oxcfwidBgteXkUUchIz2L59SbGS5byZBo1w= -github.com/pulumi/pulumi/sdk/v3 v3.259.0/go.mod h1:DPK83ZiPYy55hY0MoaFAbl95Yee/dCGc6cQAqI7/ctw= +github.com/pulumi/pulumi/sdk/v3 v3.261.0 h1:1C2V6bxzO9UBe91PRebO/zeiUIQ2C05eRNkVFvJuuqc= +github.com/pulumi/pulumi/sdk/v3 v3.261.0/go.mod h1:xlOo55i2hj5tDyMY8diTS5LfFAn2sFew+50d67sVNdg= github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ= github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88= github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ= From 30ca36e42e39ff8d1527cf501442590920308d9b Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sat, 5 Sep 2026 21:46:07 +0300 Subject: [PATCH 24/36] build(deps): bump github.com/google/go-containerregistry from 0.21.9 to 0.22.0 (#1576) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry) from 0.21.9 to 0.22.0.
      Release notes

      Sourced from github.com/google/go-containerregistry's releases.

      v0.22.0

      What's Changed

      New Contributors

      Full Changelog: https://github.com/google/go-containerregistry/compare/v0.21.9...v0.21.10

      Commits
      • 3f4ff3c fix(build): unify new build flow into cloudbuild_v2.yaml (#2419)
      • c6b5acd fix(build): correct Cloud Build schema options and source provenance hash (#2...
      • 8f4a85d go.mod: bump Go version + add toolchain directive to replace .go-version file...
      • 5481560 build(deps): bump the go-deps group across 1 directory with 3 updates (#2415)
      • 5b5c272 build(deps): bump the actions group across 1 directory with 8 updates (#2405)
      • 66dd454 remote: retry failed Puller and Pusher initialization (#2406)
      • 3f47f91 fix: add missing substitutions and workspace cleanup to new build files (#2413)
      • 4cb3583 Allow single-character repository paths (#2407)
      • 82cc428 remote: resolve push-check credentials against the repository (#2411)
      • 97815aa build: add multi-architecture Cloud Build configurations for crane, gcrane, a...
      • Additional commits viewable in compare view

      Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 6 +++--- go.sum | 12 ++++++------ 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/go.mod b/go.mod index c336644..9d7f5ce 100644 --- a/go.mod +++ b/go.mod @@ -10,7 +10,7 @@ require ( github.com/coreos/go-oidc/v3 v3.20.0 github.com/danielgtaylor/huma/v2 v2.39.1 github.com/golang-jwt/jwt/v5 v5.3.1 - github.com/google/go-containerregistry v0.21.9 + github.com/google/go-containerregistry v0.22.0 github.com/jackc/pgx/v5 v5.10.0 github.com/prometheus/client_golang v1.24.1 github.com/rs/cors v1.11.1 @@ -39,7 +39,7 @@ require ( github.com/AzureAD/microsoft-authentication-library-for-go v1.8.0 // indirect github.com/beorn7/perks v1.0.1 // indirect github.com/cespare/xxhash/v2 v2.3.0 // indirect - github.com/docker/cli v29.6.2+incompatible // indirect + github.com/docker/cli v29.7.2+incompatible // indirect github.com/docker/docker-credential-helpers v0.9.3 // indirect github.com/felixge/httpsnoop v1.0.4 // indirect github.com/go-jose/go-jose/v4 v4.1.4 // indirect @@ -52,7 +52,7 @@ require ( github.com/jackc/pgpassfile v1.0.0 // indirect github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect github.com/jackc/puddle/v2 v2.2.2 // indirect - github.com/klauspost/compress v1.19.1 // indirect + github.com/klauspost/compress v1.19.2 // indirect github.com/kr/text v0.2.0 // indirect github.com/kylelemons/godebug v1.1.0 // indirect github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect diff --git a/go.sum b/go.sum index 31930d5..76173d7 100644 --- a/go.sum +++ b/go.sum @@ -42,8 +42,8 @@ github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ3 github.com/danielgtaylor/huma/v2 v2.39.1 h1:0kwF4ltQoYZ+IU55VPy+BcGekzgF44R64daTGde1H+g= github.com/danielgtaylor/huma/v2 v2.39.1/go.mod h1:zcnQ38duIJ3VUHwFaBoZ6x8T+KN/mr33oyqxcj0HTug= github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= -github.com/docker/cli v29.6.2+incompatible h1:/bjePvcbbFTnRrMfWJBY7AjfICdsiLVgHn6LwTVOcqw= -github.com/docker/cli v29.6.2+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8= +github.com/docker/cli v29.7.2+incompatible h1:dlkwallR8XqfeVnA2ELEhdwvb4lsSwuB4IgsG8Q9cLY= +github.com/docker/cli v29.7.2+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8= github.com/docker/docker-credential-helpers v0.9.3 h1:gAm/VtF9wgqJMoxzT3Gj5p4AqIjCBS4wrsOh9yRqcz8= github.com/docker/docker-credential-helpers v0.9.3/go.mod h1:x+4Gbw9aGmChi3qTLZj8Dfn0TD20M/fuWy0E5+WDeCo= github.com/envoyproxy/go-control-plane v0.14.0 h1:hbG2kr4RuFj222B6+7T83thSPqLjwBIfQawTkC++2HA= @@ -70,8 +70,8 @@ github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps= github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8= github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU= -github.com/google/go-containerregistry v0.21.9 h1:F+D4uZ3iA3DLMJLfhaqMdHJbzeqm/216WGQq2dokuLs= -github.com/google/go-containerregistry v0.21.9/go.mod h1:dP5XNKcL7kMFF/TB3LfvWmVhAcv7iqkHb3oDK8aauTo= +github.com/google/go-containerregistry v0.22.0 h1:eGbCiPeYxAH/7WLLq6zTBALP0tUIFsoyRauhxXDJ53I= +github.com/google/go-containerregistry v0.22.0/go.mod h1:bJR35SK8XgisYmhg/FMQ/5RK0S/XrOAqLBV5/LR2XE0= github.com/google/s2a-go v0.1.9 h1:LGD7gtMgezd8a/Xak7mEWL0PjoTQFvpRudN895yqKW0= github.com/google/s2a-go v0.1.9/go.mod h1:YA0Ei2ZQL3acow2O62kdp9UlnvMmU7kA6Eutn0dXayM= github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= @@ -90,8 +90,8 @@ github.com/jackc/puddle/v2 v2.2.2 h1:PR8nw+E/1w0GLuRFSmiioY6UooMp6KJv0/61nB7icHo github.com/jackc/puddle/v2 v2.2.2/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4= github.com/keybase/go-keychain v0.0.1 h1:way+bWYa6lDppZoZcgMbYsvC7GxljxrskdNInRtuthU= github.com/keybase/go-keychain v0.0.1/go.mod h1:PdEILRW3i9D8JcdM+FmY6RwkHGnhHxXwkPPMeUgOK1k= -github.com/klauspost/compress v1.19.1 h1:VsB4HPswih7mmZ8WleSFQ75c/Ui1M4trX5oAsJnhSlk= -github.com/klauspost/compress v1.19.1/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= +github.com/klauspost/compress v1.19.2 h1:hMRETovs/pu/dVWN7zIT1PGG8t509MwT6bO7XSi26R8= +github.com/klauspost/compress v1.19.2/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE= github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk= github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY= From 99c9439d6ffcc38adf14505e70c41f77ac738246 Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Sat, 5 Sep 2026 22:33:43 +0300 Subject: [PATCH 25/36] chore: group Dependabot updates (#1618) ## Summary - group all root Go module updates into one weekly PR - group all deployment Go module updates into a separate weekly PR - keep GitHub Actions updates in their own weekly group - leave Docker updates independent ## Validation - parsed `.github/dependabot.yml` successfully as YAML - `git diff --check` passes Co-authored-by: Radoslav Dimitrov --- .github/dependabot.yml | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 775df1b..ee01027 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -3,28 +3,28 @@ updates: - package-ecosystem: gomod directory: / groups: - opentelemetry: + go-dependencies: patterns: - - "go.opentelemetry.io/*" + - "*" schedule: interval: weekly - package-ecosystem: gomod directory: /deploy groups: - opentelemetry: + deploy-go-dependencies: patterns: - - "go.opentelemetry.io/*" + - "*" schedule: interval: weekly - package-ecosystem: github-actions directory: / groups: - actions: + github-actions: patterns: - "*" schedule: interval: weekly - - package-ecosystem: "docker" - directory: "/" + - package-ecosystem: docker + directory: / schedule: - interval: "weekly" + interval: weekly From 1d1eb91e51e1f4ae2e5c7d9f11b9d009884ecc91 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sat, 5 Sep 2026 22:44:08 +0300 Subject: [PATCH 26/36] build(deps): bump github.com/coreos/go-oidc/v3 from 3.20.0 to 3.21.0 in the go-dependencies group (#1619) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps the go-dependencies group with 1 update: [github.com/coreos/go-oidc/v3](https://github.com/coreos/go-oidc). Updates `github.com/coreos/go-oidc/v3` from 3.20.0 to 3.21.0
      Release notes

      Sourced from github.com/coreos/go-oidc/v3's releases.

      v3.21.0

      What's Changed

      New Contributors

      Full Changelog: https://github.com/coreos/go-oidc/compare/v3.20.0...v3.21.0

      Commits
      • c914bd3 oidc: ignore JWKs with unsupported key types rather than failing
      • See full diff in compare view

      [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/coreos/go-oidc/v3&package-manager=go_modules&previous-version=3.20.0&new-version=3.21.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
      Dependabot commands and options
      You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore ` will remove the ignore condition of the specified dependency and ignore conditions
      Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 9d7f5ce..3c08ceb 100644 --- a/go.mod +++ b/go.mod @@ -7,7 +7,7 @@ require ( github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.14.1 github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.5.0 github.com/caarlos0/env/v11 v11.4.1 - github.com/coreos/go-oidc/v3 v3.20.0 + github.com/coreos/go-oidc/v3 v3.21.0 github.com/danielgtaylor/huma/v2 v2.39.1 github.com/golang-jwt/jwt/v5 v5.3.1 github.com/google/go-containerregistry v0.22.0 diff --git a/go.sum b/go.sum index 76173d7..0ca4b4d 100644 --- a/go.sum +++ b/go.sum @@ -36,8 +36,8 @@ github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UF github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs= github.com/cncf/xds/go v0.0.0-20260202195803-dba9d589def2 h1:aBangftG7EVZoUb69Os8IaYg++6uMOdKK83QtkkvJik= github.com/cncf/xds/go v0.0.0-20260202195803-dba9d589def2/go.mod h1:qwXFYgsP6T7XnJtbKlf1HP8AjxZZyzxMmc+Lq5GjlU4= -github.com/coreos/go-oidc/v3 v3.20.0 h1:EtE0WIBHk03N+DqGkY4+UONzzZHk7amKt6IyNd7OsZE= -github.com/coreos/go-oidc/v3 v3.20.0/go.mod h1:DYCf24+ncYi+XkIH97GY1+dqoRlbaSI26KVTCI9SrY4= +github.com/coreos/go-oidc/v3 v3.21.0 h1:wZo4Q9Pum8dYEj0eMUPrqR+kvuGkeUplbLpNCkBqoWM= +github.com/coreos/go-oidc/v3 v3.21.0/go.mod h1:DYCf24+ncYi+XkIH97GY1+dqoRlbaSI26KVTCI9SrY4= github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E= github.com/danielgtaylor/huma/v2 v2.39.1 h1:0kwF4ltQoYZ+IU55VPy+BcGekzgF44R64daTGde1H+g= github.com/danielgtaylor/huma/v2 v2.39.1/go.mod h1:zcnQ38duIJ3VUHwFaBoZ6x8T+KN/mr33oyqxcj0HTug= From 974a523857c497d81b4eed1ef77592eef3c6a3da Mon Sep 17 00:00:00 2001 From: Koichi ITO Date: Sun, 6 Sep 2026 04:45:05 +0900 Subject: [PATCH 27/36] docs: carry two modelcontextprotocol.io fixes back upstream (#1590) Both were already fixed on https://modelcontextprotocol.io; this copy is behind. - `faq.mdx`: capitalize PyPI correctly in the abuse reporting steps. https://github.com/modelcontextprotocol/modelcontextprotocol/pull/3153 - `remote-servers.mdx`: recommend Streamable HTTP and link the deprecated features page. The 2026-07-28 draft reclassifies the HTTP+SSE transport as deprecated under the feature lifecycle policy, so SSE should no longer be presented as an equal option. https://github.com/modelcontextprotocol/modelcontextprotocol/pull/3064 ## Types of changes - [ ] Bug fix (non-breaking change which fixes an issue) - [ ] New feature (non-breaking change which adds functionality) - [ ] Breaking change (fix or feature that would cause existing functionality to change) - [x] Documentation update ## Checklist - [x] I have read the [MCP Documentation](https://modelcontextprotocol.io) - [x] My code follows the repository's style guidelines - [x] New and existing tests pass locally - [x] I have added appropriate error handling - [x] I have added or updated documentation as needed --- docs/modelcontextprotocol-io/faq.mdx | 2 +- docs/modelcontextprotocol-io/remote-servers.mdx | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/modelcontextprotocol-io/faq.mdx b/docs/modelcontextprotocol-io/faq.mdx index 078ae45..d6c8aab 100644 --- a/docs/modelcontextprotocol-io/faq.mdx +++ b/docs/modelcontextprotocol-io/faq.mdx @@ -52,7 +52,7 @@ There is a 4KB size limit (4096 bytes of JSON). Publishing will fail if this lim ### What if I need to report a spam or malicious server? -1. Report it as abuse to the underlying package registry (e.g. NPM, PyPi, DockerHub, etc.); and +1. Report it as abuse to the underlying package registry (e.g. NPM, PyPI, DockerHub, etc.); and 2. Raise a GitHub issue on the registry repo with a title beginning `Abuse report: ` ### What if I need to report a security vulnerability in the registry itself? diff --git a/docs/modelcontextprotocol-io/remote-servers.mdx b/docs/modelcontextprotocol-io/remote-servers.mdx index be2bdc5..eecad51 100644 --- a/docs/modelcontextprotocol-io/remote-servers.mdx +++ b/docs/modelcontextprotocol-io/remote-servers.mdx @@ -29,7 +29,7 @@ A remote server **MUST** be publicly accessible at its specified URL. ## Transport Type -Remote servers can use the Streamable HTTP transport (recommended) or the SSE transport. Remote servers can also support both transports simultaneously at different URLs. +Remote servers should use the Streamable HTTP transport. The SSE transport is [deprecated](/specification/draft/deprecated), so publish an `"sse"` remote only to support existing clients. Remote servers can also support both transports simultaneously at different URLs. Specify the transport by setting the `type` property of the `remotes` entry to either `"streamable-http"` or `"sse"`: From 5271ba507514a82c1b136077ed9e78fb8b37596a Mon Sep 17 00:00:00 2001 From: Nikolife2016 <139212778+Nikolife2016@users.noreply.github.com> Date: Sun, 6 Sep 2026 02:47:31 +0700 Subject: [PATCH 28/36] docs: add PulseFeed MCP Drift Watch to community projects (#1581) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit One line in `docs/community-projects.md` under **Other**, following the format in *Adding Your Project*. **What it is.** A daily external diff of the whole registry population — 25,122 entries as of today — recording what changed in a server *after* it was listed rather than whether it is safe right now: package ownership transferred, an install script added in a later version, repository link removed, package unpublished, a removed name republished by someone else. **Why the distinction matters.** A rug pull is clean at review time by construction: the package collects installs for weeks, then ships the patch. Detecting that needs yesterday's snapshot to exist, which is why the series starts on 2026-07-30 and cannot be reconstructed after the fact. The registry's own moderation policy notes it relies on downstream consumers for this kind of check. **Free, no key, no account:** JSON and RSS feeds filterable to your own package list, a README badge, and webhook alerts. Every day's manifest of dataset digests is timestamped into Bitcoin via OpenTimestamps, so the series can be shown to have existed on a given date by anyone, without trusting us. Placed next to `polygraph` as the nearest precedent for an independent security project in this list. All links in the entry were checked before opening this PR. Nothing else in the file is touched. --- docs/community-projects.md | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/community-projects.md b/docs/community-projects.md index a177ad0..2708839 100644 --- a/docs/community-projects.md +++ b/docs/community-projects.md @@ -36,6 +36,7 @@ Self-hostable servers that implement the MCP Registry API specification. - [mcp-registry-cli](https://pypi.org/project/mcp-registry-cli/) - CLI tool to navigate the MCP registry servers - [OtherVibes/mcp-publish-action](https://github.com/OtherVibes/mcp-publish-action) - GitHub Action for publishing MCP servers to the official registry - [polygraph](https://polygraph.so) - Independent behavioral security grades (A–F) for MCP servers from an open, reproducible harness, published as an adoption-ranked index with per-server reports +- [PulseFeed MCP Drift Watch](https://pulsefeed.dev/mcp/drift) - Daily external diff of the whole registry population, recording what changed in a server *after* it was listed: package ownership transferred, install script added in a later version, repository removed, package unpublished, a removed name republished by someone else. Free JSON/RSS feed filterable to your own packages, a README badge, and webhook alerts; series runs from 2026-07-30 and each day's manifest is timestamped into Bitcoin. ## Adding Your Project From d3fbdc61ce48bae51c6014ffdd442522cef72a7c Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Sat, 5 Sep 2026 22:48:16 +0300 Subject: [PATCH 29/36] ci: detect more invalid server publish paths (#1620) ## Summary - detect publish attempts under `data/data/servers/` - detect server-looking JSON files directly under `data/` - keep the stage-one and privileged stage-two classifiers in sync ## Testing - verified both new patterns against PRs #1600 and #1589 - verified ordinary files such as `data/example.json` remain unmatched - ran `git diff --check` --- .github/workflows/close-invalid-publish-prs.yml | 2 ++ .github/workflows/detect-invalid-publish-prs.yml | 2 ++ 2 files changed, 4 insertions(+) diff --git a/.github/workflows/close-invalid-publish-prs.yml b/.github/workflows/close-invalid-publish-prs.yml index 8666c3b..53ce498 100644 --- a/.github/workflows/close-invalid-publish-prs.yml +++ b/.github/workflows/close-invalid-publish-prs.yml @@ -127,6 +127,8 @@ jobs: for f in "${FILES[@]}"; do if [[ "$f" == servers/* \ || "$f" == data/servers/* \ + || "$f" == data/data/servers/* \ + || "$f" =~ ^data/[^/]*server\.json$ \ || "$f" == "data/seed.json" \ || "$f" == "server.json" \ || "$f" == "servers.json" ]]; then diff --git a/.github/workflows/detect-invalid-publish-prs.yml b/.github/workflows/detect-invalid-publish-prs.yml index c200f86..816e169 100644 --- a/.github/workflows/detect-invalid-publish-prs.yml +++ b/.github/workflows/detect-invalid-publish-prs.yml @@ -63,6 +63,8 @@ jobs: for f in "${FILES[@]}"; do if [[ "$f" == servers/* \ || "$f" == data/servers/* \ + || "$f" == data/data/servers/* \ + || "$f" =~ ^data/[^/]*server\.json$ \ || "$f" == "data/seed.json" \ || "$f" == "server.json" \ || "$f" == "servers.json" ]]; then From 068a97a2f8b60d24dc62886bbe92f4257666cd35 Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Sun, 6 Sep 2026 00:18:27 +0300 Subject: [PATCH 30/36] fix: identify submitted server version in publish diagnostics (#1621) Publishing a manifest with a stale version currently produces a duplicate-version error without identifying the version that was submitted. This made a request containing `0.4.5` look like a rejected publication of `0.4.6` in #1615. Include the submitted `name@version` in the CLI output before sending the request and in the API duplicate-version error. HTTP 400, the response structure, and duplicate-rejection behavior remain unchanged. The service wraps the existing error sentinel so `errors.Is` continues to work. Adds a CLI regression test for a failed publication and updates the API duplicate-error assertion. Validation: - Publish command tests passed (`go test ./cmd/publisher/commands -run TestPublishCommand -count=1`). - `git diff --check` passed. - API endpoint tests were attempted but could not run because PostgreSQL was unavailable on localhost:5432; Docker was also unavailable locally. Related to #1615. --- cmd/publisher/commands/publish.go | 2 +- cmd/publisher/commands/publish_test.go | 30 ++++++++++++++++++++++++ internal/api/handlers/v0/publish_test.go | 4 ++-- internal/service/registry_service.go | 2 +- 4 files changed, 34 insertions(+), 4 deletions(-) diff --git a/cmd/publisher/commands/publish.go b/cmd/publisher/commands/publish.go index 902c421..cccf2c8 100644 --- a/cmd/publisher/commands/publish.go +++ b/cmd/publisher/commands/publish.go @@ -64,7 +64,7 @@ func PublishCommand(args []string) error { } // Publish to registry - _, _ = fmt.Fprintf(os.Stdout, "Publishing to %s...\n", registryURL) + _, _ = fmt.Fprintf(os.Stdout, "Publishing %s@%s to %s...\n", serverJSON.Name, serverJSON.Version, registryURL) response, statusCode, err := publishToRegistry(registryURL, serverData, token) if err != nil { // If publish failed with 422, call validate endpoint to show detailed errors diff --git a/cmd/publisher/commands/publish_test.go b/cmd/publisher/commands/publish_test.go index 98c19a3..745198d 100644 --- a/cmd/publisher/commands/publish_test.go +++ b/cmd/publisher/commands/publish_test.go @@ -39,6 +39,36 @@ func TestPublishCommand_Success(t *testing.T) { assert.NoError(t, err) } +func TestPublishCommand_PrintsSubmittedIdentityOnFailure(t *testing.T) { + server := SetupMockRegistryServer(t, func(w http.ResponseWriter, _ *http.Request) { + http.Error(w, "duplicate version", http.StatusBadRequest) + }, nil) + SetupTestToken(t, server.URL, "test-token") + CreateTestServerJSON(t, apiv0.ServerJSON{ + Schema: model.CurrentSchemaURL, + Name: "io.github.BargLabs/cejel", + Description: "A test server", + Version: "0.4.5", + }) + + output, err := os.CreateTemp(t.TempDir(), "stdout") + require.NoError(t, err) + originalStdout := os.Stdout + os.Stdout = output + t.Cleanup(func() { + os.Stdout = originalStdout + _ = output.Close() + }) + + err = commands.PublishCommand(nil) + require.ErrorContains(t, err, "duplicate version") + _, err = output.Seek(0, io.SeekStart) + require.NoError(t, err) + data, err := io.ReadAll(output) + require.NoError(t, err) + assert.Equal(t, "Publishing io.github.BargLabs/cejel@0.4.5 to "+server.URL+"...\n", string(data)) +} + func TestPublishCommand_PreservesNonASCIIDescription(t *testing.T) { server := SetupMockRegistryServer(t, func(w http.ResponseWriter, r *http.Request) { diff --git a/internal/api/handlers/v0/publish_test.go b/internal/api/handlers/v0/publish_test.go index 94502be..6b5c68c 100644 --- a/internal/api/handlers/v0/publish_test.go +++ b/internal/api/handlers/v0/publish_test.go @@ -168,7 +168,7 @@ func TestPublishEndpoint(t *testing.T) { expectedError: "You do not have permission to publish this server", }, { - name: "registry service error", + name: "duplicate version includes submitted server identity", requestBody: apiv0.ServerJSON{ Schema: model.CurrentSchemaURL, Name: "example/test-server", @@ -202,7 +202,7 @@ func TestPublishEndpoint(t *testing.T) { _, _ = registry.CreateServer(context.Background(), &existingServer) }, expectedStatus: http.StatusBadRequest, - expectedError: "invalid version: cannot publish duplicate version", + expectedError: "invalid version: cannot publish duplicate version: example/test-server@1.0.0 already exists", }, { name: "package validation success - MCPB package", diff --git a/internal/service/registry_service.go b/internal/service/registry_service.go index 16a9100..4bf6e19 100644 --- a/internal/service/registry_service.go +++ b/internal/service/registry_service.go @@ -190,7 +190,7 @@ func (s *registryServiceImpl) createServerInTransaction(ctx context.Context, tx return e } if versionExists { - return database.ErrInvalidVersion + return fmt.Errorf("%w: %s@%s already exists", database.ErrInvalidVersion, serverJSON.Name, serverJSON.Version) } currentLatest, e = s.db.GetCurrentLatestVersion(ctx, tx, serverJSON.Name) if e != nil && !errors.Is(e, database.ErrNotFound) { From dd4b2939e3e946ba0e5c42cdd1f5a9eb96e7628b Mon Sep 17 00:00:00 2001 From: Jeff Wainwright <1074042+yowainwright@users.noreply.github.com> Date: Sat, 5 Sep 2026 14:31:12 -0700 Subject: [PATCH 31/36] test: isolates temp test fixtures (#1569) ## Motivation and Context Replace shared temp paths with `t.TempDir()`` so each test gets its own cleanup-scoped directory. - This avoids leftover files and cross-test interference. No production code changed. ## How Has This Been Tested? GitHub CI passed. - https://github.com/yowainwright/registry/pull/1 ## Breaking Changes No breaking changes; just tests. ## Types of changes - [x] chore ## Checklist - [x] I have read the [MCP Documentation](https://modelcontextprotocol.io) - [x] My code follows the repository's style guidelines - [x] New and existing tests pass locally - [x] I have added appropriate error handling - [x] I have added or updated documentation as needed ## Additional context Small test-only cleanup. No production code paths are changed. Co-authored-by: Radoslav Dimitrov --- cmd/publisher/commands/testutil_test.go | 4 +--- cmd/publisher/commands/validate_test.go | 13 ++++------ internal/importer/importer_test.go | 32 +++++++++---------------- 3 files changed, 16 insertions(+), 33 deletions(-) diff --git a/cmd/publisher/commands/testutil_test.go b/cmd/publisher/commands/testutil_test.go index 416b192..c103f82 100644 --- a/cmd/publisher/commands/testutil_test.go +++ b/cmd/publisher/commands/testutil_test.go @@ -95,9 +95,7 @@ func SetupTestToken(t *testing.T, registryURL, token string) string { func CreateTestServerJSON(t *testing.T, serverJSON apiv0.ServerJSON) (string, string) { t.Helper() - tempDir, err := os.MkdirTemp("", "mcp-publisher-test") - require.NoError(t, err) - t.Cleanup(func() { os.RemoveAll(tempDir) }) + tempDir := t.TempDir() jsonData, err := json.MarshalIndent(serverJSON, "", " ") require.NoError(t, err) diff --git a/cmd/publisher/commands/validate_test.go b/cmd/publisher/commands/validate_test.go index b56b22d..1827ffe 100644 --- a/cmd/publisher/commands/validate_test.go +++ b/cmd/publisher/commands/validate_test.go @@ -140,16 +140,13 @@ func TestValidateCommand_NoServerFile(t *testing.T) { server := SetupMockRegistryServer(t, nil, nil) SetupTestToken(t, server.URL, "test-token") - // Don't create server.json - tempDir, err := os.MkdirTemp("", "mcp-publisher-test") - require.NoError(t, err) - defer os.RemoveAll(tempDir) + tempDir := t.TempDir() originalDir, err := os.Getwd() require.NoError(t, err) defer func() { _ = os.Chdir(originalDir) }() - _ = os.Chdir(tempDir) + require.NoError(t, os.Chdir(tempDir)) err = commands.ValidateCommand([]string{}) @@ -161,15 +158,13 @@ func TestValidateCommand_InvalidJSON(t *testing.T) { server := SetupMockRegistryServer(t, nil, nil) SetupTestToken(t, server.URL, "test-token") - tempDir, err := os.MkdirTemp("", "mcp-publisher-test") - require.NoError(t, err) - defer os.RemoveAll(tempDir) + tempDir := t.TempDir() originalDir, err := os.Getwd() require.NoError(t, err) defer func() { _ = os.Chdir(originalDir) }() - _ = os.Chdir(tempDir) + require.NoError(t, os.Chdir(tempDir)) // Create invalid JSON file err = os.WriteFile("server.json", []byte("{ invalid json }"), 0600) diff --git a/internal/importer/importer_test.go b/internal/importer/importer_test.go index db0cc2a..ed5ed05 100644 --- a/internal/importer/importer_test.go +++ b/internal/importer/importer_test.go @@ -20,8 +20,7 @@ import ( ) func TestImportService_LocalFile(t *testing.T) { - // Create a temporary seed file - tempFile := filepath.Join(os.TempDir(), "test_import_seed.json") + tempFile := filepath.Join(t.TempDir(), "test_import_seed.json") seedData := []*apiv0.ServerJSON{ { Schema: model.CurrentSchemaURL, @@ -41,7 +40,6 @@ func TestImportService_LocalFile(t *testing.T) { err = os.WriteFile(tempFile, jsonData, 0600) require.NoError(t, err) - defer os.Remove(tempFile) // Create registry service testDB := database.NewTestDB(t) @@ -187,6 +185,14 @@ func TestImportService_ErrorHandling(t *testing.T) { registryService := service.NewRegistryService(testDB, &config.Config{EnableRegistryValidation: false}) importerService := importer.NewService(registryService) + errorDir := t.TempDir() + missingFile := filepath.Join(errorDir, "non-existent-file.json") + invalidFile := filepath.Join(errorDir, "invalid.json") + + invalidJSON := []byte("{invalid json}") + err := os.WriteFile(invalidFile, invalidJSON, 0600) + require.NoError(t, err) + tests := []struct { name string path string @@ -195,13 +201,13 @@ func TestImportService_ErrorHandling(t *testing.T) { }{ { name: "non-existent local file", - path: "/tmp/non-existent-file.json", + path: missingFile, expectError: true, errorMsg: "failed to read seed data", }, { name: "invalid JSON file", - path: "/tmp/invalid.json", + path: invalidFile, expectError: true, errorMsg: "failed to read seed data", }, @@ -213,22 +219,6 @@ func TestImportService_ErrorHandling(t *testing.T) { }, } - // Create invalid JSON file for testing - invalidJSON := []byte("{invalid json}") - tempFile, err := os.CreateTemp("", "invalid-*.json") - require.NoError(t, err) - defer os.Remove(tempFile.Name()) - err = os.WriteFile(tempFile.Name(), invalidJSON, 0600) - require.NoError(t, err) - - // Update test case to use temp file - for i := range tests { - if tests[i].path == "/tmp/invalid.json" { - tests[i].path = tempFile.Name() - break - } - } - for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { err := importerService.ImportFromPath(context.Background(), tt.path) From 739b70e8bc1bea203c5a35ab699f1df51d091568 Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Sun, 6 Sep 2026 01:13:09 +0300 Subject: [PATCH 32/36] fix: fail safely in registry admin scripts (#1622) The takedown script previously treated any nonempty `ALL_VERSIONS` value, including `false`, as permission to delete every version. Require exactly `true` when the variable is set, and reject other values before sending a request. Enable strict shell error handling in the auth helper so a failed identity-token command stops execution before exchanging an empty token. Validation: `bash -n` and `git diff --check` passed. Mocked command checks confirmed that `false`, `1`, and `TRUE` are rejected before network access, and that identity-token retrieval failure stops before the token exchange. The updated scripts also completed the authorized takedown associated with #1563; public API reads confirmed the deleted record and removal from default results. --- tools/admin/auth.sh | 14 ++++++++++---- tools/admin/takedown.sh | 4 ++++ 2 files changed, 14 insertions(+), 4 deletions(-) diff --git a/tools/admin/auth.sh b/tools/admin/auth.sh index 1d4324b..8062e44 100755 --- a/tools/admin/auth.sh +++ b/tools/admin/auth.sh @@ -1,6 +1,8 @@ #!/bin/bash # Simple OIDC authentication helper using gcloud +set -euo pipefail + REGISTRY_URL="${REGISTRY_URL:-https://registry.modelcontextprotocol.io}" if ! gcloud projects list &> /dev/null; then @@ -11,19 +13,23 @@ fi OIDC_TOKEN=$(gcloud auth print-identity-token) # Exchange for registry token -RESPONSE=$(curl -s -X POST "${REGISTRY_URL}/v0/auth/oidc" \ +RESPONSE=$(curl -sS -X POST "${REGISTRY_URL}/v0/auth/oidc" \ -H "Content-Type: application/json" \ -d "{\"oidc_token\": \"${OIDC_TOKEN}\"}") # Check if successful -REGISTRY_TOKEN=$(echo "$RESPONSE" | jq -r '.registry_token // empty') +if ! REGISTRY_TOKEN=$(printf '%s\n' "$RESPONSE" | jq -r '.registry_token // empty' 2>/dev/null); then + REGISTRY_TOKEN="" +fi if [ -z "$REGISTRY_TOKEN" ]; then echo "Error: Authentication failed" >&2 - echo "$RESPONSE" | jq '.' >&2 + if ! printf '%s\n' "$RESPONSE" | jq '.' >&2 2>/dev/null; then + printf '%s\n' "$RESPONSE" >&2 + fi exit 1 fi # Output the export command echo "# Successfully authenticated! Now run this to use your token:" >&2 -echo "export REGISTRY_TOKEN='${REGISTRY_TOKEN}'" \ No newline at end of file +echo "export REGISTRY_TOKEN='${REGISTRY_TOKEN}'" diff --git a/tools/admin/takedown.sh b/tools/admin/takedown.sh index d6b7dff..f9fceed 100755 --- a/tools/admin/takedown.sh +++ b/tools/admin/takedown.sh @@ -34,6 +34,10 @@ fi # Require an explicit choice, so that a forgotten VERSION cannot silently take # down every version of a server. +if [ -n "$ALL_VERSIONS" ] && [ "$ALL_VERSIONS" != "true" ]; then + echo "Error: ALL_VERSIONS must be exactly true when set." >&2 + exit 1 +fi if [ -n "$VERSION" ] && [ -n "$ALL_VERSIONS" ]; then echo "Error: set either VERSION or ALL_VERSIONS, not both." >&2 exit 1 From c7411aeababbc05d733b6dc6cb24c61a4213d08e Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 16 Sep 2026 18:01:34 +0300 Subject: [PATCH 33/36] build(deps): bump the go-dependencies group with 2 updates (#1634) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps the go-dependencies group with 2 updates: [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry) and [golang.org/x/mod](https://github.com/golang/mod). Updates `github.com/google/go-containerregistry` from 0.22.0 to 0.22.1
      Release notes

      Sourced from github.com/google/go-containerregistry's releases.

      v0.22.1

      What's Changed

      New Contributors

      Full Changelog: https://github.com/google/go-containerregistry/compare/v0.22.0...v0.22.1

      Commits
      • 8a72a42 remote: copy manifest annotations to referrers fallback tag descriptors (#2441)
      • 5765c35 build(deps): bump the go-deps group across 2 directories with 3 updates (#2439)
      • 969402f fix(mutate): make Time layer updates lazy (#2429)
      • 25c682e flatten: preserve config and layer media types when flattening (#2438)
      • 79af990 remote: add SSRF redirect protection to writer-side HTTP clients (#2432)
      • 4b9b3c7 fix(release): honor declared Go toolchain (#2435)
      • e033b9c fix(build): install binaries to /ko-app and add to PATH (#2424) (#2436)
      • 8bd7902 name: return a helpful error when a reference contains a URL scheme (#2431)
      • 163134d validate: support index attestation manifests and empty configs (#2414)
      • 44f7ea3 fix(build): Use dependencies.gitSource in cloudbuild_v2.yaml (#2434)
      • Additional commits viewable in compare view

      Updates `golang.org/x/mod` from 0.40.0 to 0.41.0
      Commits
      • d0a27b2 modfile: fix Cleanup and DropTool documentation
      • d12008c all: upgrade go directive to at least 1.26.0 [generated]
      • See full diff in compare view

      Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
      Dependabot commands and options
      You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore ` will remove the ignore condition of the specified dependency and ignore conditions
      Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 6 +++--- go.sum | 8 ++++---- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/go.mod b/go.mod index 3c08ceb..b482a15 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/modelcontextprotocol/registry -go 1.26 +go 1.26.0 require ( cloud.google.com/go/kms v1.33.0 @@ -10,7 +10,7 @@ require ( github.com/coreos/go-oidc/v3 v3.21.0 github.com/danielgtaylor/huma/v2 v2.39.1 github.com/golang-jwt/jwt/v5 v5.3.1 - github.com/google/go-containerregistry v0.22.0 + github.com/google/go-containerregistry v0.22.1 github.com/jackc/pgx/v5 v5.10.0 github.com/prometheus/client_golang v1.24.1 github.com/rs/cors v1.11.1 @@ -22,7 +22,7 @@ require ( go.opentelemetry.io/otel/metric v1.46.0 go.opentelemetry.io/otel/sdk v1.46.0 go.opentelemetry.io/otel/sdk/metric v1.46.0 - golang.org/x/mod v0.40.0 + golang.org/x/mod v0.41.0 gopkg.in/yaml.v3 v3.0.1 ) diff --git a/go.sum b/go.sum index 0ca4b4d..2a677e7 100644 --- a/go.sum +++ b/go.sum @@ -70,8 +70,8 @@ github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps= github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8= github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU= -github.com/google/go-containerregistry v0.22.0 h1:eGbCiPeYxAH/7WLLq6zTBALP0tUIFsoyRauhxXDJ53I= -github.com/google/go-containerregistry v0.22.0/go.mod h1:bJR35SK8XgisYmhg/FMQ/5RK0S/XrOAqLBV5/LR2XE0= +github.com/google/go-containerregistry v0.22.1 h1:RZuuSYhTvlDvtsK+NkutoCZ//C0X2ebLK8X8l3ULs84= +github.com/google/go-containerregistry v0.22.1/go.mod h1:bJR35SK8XgisYmhg/FMQ/5RK0S/XrOAqLBV5/LR2XE0= github.com/google/s2a-go v0.1.9 h1:LGD7gtMgezd8a/Xak7mEWL0PjoTQFvpRudN895yqKW0= github.com/google/s2a-go v0.1.9/go.mod h1:YA0Ei2ZQL3acow2O62kdp9UlnvMmU7kA6Eutn0dXayM= github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= @@ -164,8 +164,8 @@ go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw= go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg= golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M= golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis= -golang.org/x/mod v0.40.0 h1:hUv+3cXcdRHz08UmSiOob7sadHig73uo5bkXxQ/tvUs= -golang.org/x/mod v0.40.0/go.mod h1:0/weTWkPWGBikyTWAX3dkjVztMmBA5hM0DH6BElSupE= +golang.org/x/mod v0.41.0 h1:qJmnOUb4YB+FsEuM3HcWucdZASCPGhsX6uljO6pog0c= +golang.org/x/mod v0.41.0/go.mod h1:Ek9pY8RKWXwsWvd3rQiHYtMqkjSUV+s1Rj7j4H5Ur6o= golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To= golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU= golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs= From cabf0607b61a37c5be163dce3309dd7a5b9928ce Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 16 Sep 2026 18:02:08 +0300 Subject: [PATCH 34/36] build(deps): bump google.golang.org/grpc from 1.83.1 to 1.83.2 in /deploy (#1630) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.83.1 to 1.83.2.
      Release notes

      Sourced from google.golang.org/grpc's releases.

      Release 1.83.2

      Security

      • server: Reject requests missing both :authority and Host headers with HTTP 400 and status Internal. (grpc/grpc-go#9365)
      Commits

      [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=google.golang.org/grpc&package-manager=go_modules&previous-version=1.83.1&new-version=1.83.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
      Dependabot commands and options
      You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/modelcontextprotocol/registry/network/alerts).
      Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- deploy/go.mod | 2 +- deploy/go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/deploy/go.mod b/deploy/go.mod index c989c83..031069c 100644 --- a/deploy/go.mod +++ b/deploy/go.mod @@ -114,7 +114,7 @@ require ( golang.org/x/tools v0.48.0 // indirect google.golang.org/genproto/googleapis/api v0.0.0-20260819154853-08b0e4226688 // indirect google.golang.org/genproto/googleapis/rpc v0.0.0-20260819154853-08b0e4226688 // indirect - google.golang.org/grpc v1.83.1 // indirect + google.golang.org/grpc v1.83.2 // indirect google.golang.org/protobuf v1.36.12 // indirect gopkg.in/yaml.v3 v3.0.1 // indirect lukechampine.com/frand v1.5.1 // indirect diff --git a/deploy/go.sum b/deploy/go.sum index 032a0f1..14ce36c 100644 --- a/deploy/go.sum +++ b/deploy/go.sum @@ -318,8 +318,8 @@ google.golang.org/genproto/googleapis/api v0.0.0-20260819154853-08b0e4226688 h1: google.golang.org/genproto/googleapis/api v0.0.0-20260819154853-08b0e4226688/go.mod h1:1RJ9BQGyNdZwkGc1eTqkErfRZ6RJyYPHZo73BZ1vQqI= google.golang.org/genproto/googleapis/rpc v0.0.0-20260819154853-08b0e4226688 h1:cYNAzI2sUwhmCcoj9TxvihSrqsxt6uIkj3rDRhSDmW4= google.golang.org/genproto/googleapis/rpc v0.0.0-20260819154853-08b0e4226688/go.mod h1:DjtHYE8FKJLivXcBEjGwndXfIC23G0VpXiXKqG179uA= -google.golang.org/grpc v1.83.1 h1:HIO0+BEtBP6soyqvqC8sNUjZ7bTs+0hFQuFF+RAy++Y= -google.golang.org/grpc v1.83.1/go.mod h1:kDyl6SKsiHKt0uylY5gtn5cEjkrIOhQOGDgIc4JGwzQ= +google.golang.org/grpc v1.83.2 h1:EManeRomTObA0BU7I8vXgg/78uE5MJ9M8B39EX2WscU= +google.golang.org/grpc v1.83.2/go.mod h1:YPI1hK3kDked6iHvgX3tR0y+nX/qpMFKhPgFsokw1S8= google.golang.org/protobuf v1.36.12 h1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o/fwxc= google.golang.org/protobuf v1.36.12/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= From 73aebc1526a3dc165e9492233e16a5de838abc95 Mon Sep 17 00:00:00 2001 From: Ishan Gupta <62565307+developer-ishan@users.noreply.github.com> Date: Wed, 16 Sep 2026 20:44:51 +0530 Subject: [PATCH 35/36] fix(publisher): treat GitHub device-flow `slow_down` as retriable (#1290) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Summary - Handle GitHub's OAuth device-flow `slow_down` response per [RFC 8628 §3.5](https://datatracker.ietf.org/doc/html/rfc8628#section-3.5) — treat it as retriable and bump the polling interval by 5 seconds, instead of bailing with a fatal error. Fixes #1289. ## Why `pollForToken` in `cmd/publisher/auth/github-at.go` only treats `authorization_pending` as retriable. Every other response from GitHub's token endpoint — including the non-terminal `slow_down` signal — falls through to: ```go return "", fmt.Errorf("token request failed: %s", tokenResp.Error) ``` So users hitting GitHub's polling rate-limit get: ``` Error: login failed: error polling for token: token request failed: slow_down ``` …and have to re-run `mcp-publisher login github` from scratch, which is especially painful because `slow_down` is more likely when the user takes more than a few seconds to enter and authorize the device code. Per RFC 8628 §3.5, `slow_down` is defined as: > A variant of "authorization_pending", the authorization request is still pending and polling should continue, but the interval MUST be increased by 5 seconds for this and all subsequent requests. ## Change Treat `slow_down` the same as `authorization_pending` but increase `interval` by 5 seconds before sleeping, matching the RFC exactly. A possible follow-up (not in this PR, to keep the diff minimal): seed the initial `interval` from `DeviceCodeResponse.Interval` (already parsed but currently unused) instead of hardcoding `5`. Happy to do that here or as a separate PR if preferred. ## Test plan - [x] `go build ./cmd/publisher/...` — clean - [x] `go test ./cmd/publisher/auth/...` — passes - [x] `gofmt -d` and `go vet ./cmd/publisher/auth/...` — clean - [ ] CI `make check` (lint + integration tests) I could not exercise `pollForToken` from a unit test without refactoring `GitHubAccessTokenURL` to be injectable, which felt out of scope for a bug-fix PR. Glad to add that refactor + a table-driven test for `authorization_pending` / `slow_down` / fatal errors in a follow-up if maintainers want it. --------- Co-authored-by: developer-ishan Co-authored-by: Claude Opus 4.8 (1M context) --- cmd/publisher/auth/github-at.go | 46 +++++- .../auth/github_at_poll_internal_test.go | 131 ++++++++++++++++++ 2 files changed, 170 insertions(+), 7 deletions(-) create mode 100644 cmd/publisher/auth/github_at_poll_internal_test.go diff --git a/cmd/publisher/auth/github-at.go b/cmd/publisher/auth/github-at.go index 3e53529..0da68a4 100644 --- a/cmd/publisher/auth/github-at.go +++ b/cmd/publisher/auth/github-at.go @@ -17,6 +17,17 @@ const ( GitHubAccessTokenURL = "https://github.com/login/oauth/access_token" // #nosec:G101 ) +const ( + // defaultPollInterval is the initial device-flow polling interval in + // seconds, per RFC 8628 §3.5. + defaultPollInterval = 5 + // maxPollInterval caps how large the polling interval may grow. RFC 8628 + // §3.5 mandates a 5-second increase on each slow_down but leaves the + // maximum to the implementation; this prevents a misbehaving auth server + // from growing the interval unboundedly. + maxPollInterval = 60 +) + // DeviceCodeResponse represents the response from GitHub's device code endpoint type DeviceCodeResponse struct { DeviceCode string `json:"device_code"` @@ -46,6 +57,16 @@ type GitHubATProvider struct { registryURL string providedToken string // Token provided via --token flag or MCP_GITHUB_TOKEN env var githubToken string // In-memory GitHub token set by Login() + + // accessTokenURL is the GitHub access-token polling endpoint. It is a field + // (rather than the package constant) so tests can point it at a mock server. + accessTokenURL string + // pollInterval is the initial polling interval in seconds. Defaults to + // defaultPollInterval; overridable in tests to avoid real delays. + pollInterval int + // sleep abstracts time.Sleep so tests can run without real delays and + // assert the back-off sequence. Defaults to time.Sleep. + sleep func(time.Duration) } // ServerHealthResponse represents the response from the health endpoint @@ -62,8 +83,11 @@ func NewGitHubATProvider(registryURL, token string) Provider { } return &GitHubATProvider{ - registryURL: registryURL, - providedToken: token, + registryURL: registryURL, + providedToken: token, + accessTokenURL: GitHubAccessTokenURL, + pollInterval: defaultPollInterval, + sleep: time.Sleep, } } @@ -199,12 +223,12 @@ func (g *GitHubATProvider) pollForToken(ctx context.Context, deviceCode string) } // Default polling interval and expiration time - interval := 5 // seconds + interval := g.pollInterval expiresIn := 900 // 15 minutes deadline := time.Now().Add(time.Duration(expiresIn) * time.Second) for time.Now().Before(deadline) { - req, err := http.NewRequestWithContext(ctx, http.MethodPost, GitHubAccessTokenURL, bytes.NewBuffer(jsonData)) + req, err := http.NewRequestWithContext(ctx, http.MethodPost, g.accessTokenURL, bytes.NewBuffer(jsonData)) if err != nil { return "", err } @@ -229,9 +253,17 @@ func (g *GitHubATProvider) pollForToken(ctx context.Context, deviceCode string) return "", err } - if tokenResp.Error == "authorization_pending" { - // User hasn't authorized yet, wait and retry - time.Sleep(time.Duration(interval) * time.Second) + // Per RFC 8628 §3.5, both authorization_pending and slow_down indicate + // the client should keep polling. slow_down additionally requires that + // the polling interval be increased by 5 seconds. + if tokenResp.Error == "authorization_pending" || tokenResp.Error == "slow_down" { + if tokenResp.Error == "slow_down" { + interval += 5 + if interval > maxPollInterval { + interval = maxPollInterval + } + } + g.sleep(time.Duration(interval) * time.Second) continue } diff --git a/cmd/publisher/auth/github_at_poll_internal_test.go b/cmd/publisher/auth/github_at_poll_internal_test.go new file mode 100644 index 0000000..41de749 --- /dev/null +++ b/cmd/publisher/auth/github_at_poll_internal_test.go @@ -0,0 +1,131 @@ +package auth + +import ( + "context" + "encoding/json" + "net/http" + "net/http/httptest" + "testing" + "time" + + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" +) + +// newMockTokenServer returns an httptest.Server that serves the given sequence +// of AccessTokenResponse values, one per request. Once the sequence is +// exhausted the final response is reused for any extra requests. +func newMockTokenServer(t *testing.T, responses []AccessTokenResponse) *httptest.Server { + t.Helper() + var i int + srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) { + resp := responses[len(responses)-1] + if i < len(responses) { + resp = responses[i] + } + i++ + w.Header().Set("Content-Type", "application/json") + _ = json.NewEncoder(w).Encode(resp) // #nosec G117 -- test fixture token, not a real secret + })) + t.Cleanup(srv.Close) + return srv +} + +// newPollTestProvider builds a provider wired to a mock token endpoint. The +// initial poll interval is 0 (so the back-off starts from a known base) and +// sleeps are captured rather than performed, making the tests deterministic and +// instant. The returned slice records every interval passed to sleep. +func newPollTestProvider(tokenURL string) (*GitHubATProvider, *[]time.Duration) { + slept := &[]time.Duration{} + p := &GitHubATProvider{ + clientID: "test-client-id", + accessTokenURL: tokenURL, + pollInterval: 0, + sleep: func(d time.Duration) { *slept = append(*slept, d) }, + } + return p, slept +} + +// TestPollForToken_SlowDownThenSuccess confirms that a slow_down response is +// treated as retriable: polling continues and the success path is reached. +func TestPollForToken_SlowDownThenSuccess(t *testing.T) { + srv := newMockTokenServer(t, []AccessTokenResponse{ + {Error: "slow_down"}, + {AccessToken: "gh-token"}, + }) + p, slept := newPollTestProvider(srv.URL) + + token, err := p.pollForToken(context.Background(), "device-code") + require.NoError(t, err) + assert.Equal(t, "gh-token", token) + + // One slow_down => one back-off, interval bumped 0 -> 5. + require.Len(t, *slept, 1) + assert.Equal(t, 5*time.Second, (*slept)[0]) +} + +// TestPollForToken_MixedRetryableErrorsCompoundInterval confirms the interval +// increment compounds correctly across mixed retryable errors. Per RFC 8628 +// §3.5 the interval is increased by 5 seconds on each slow_down and is NOT +// reset between slow_down instances, while authorization_pending leaves it +// unchanged. +func TestPollForToken_MixedRetryableErrorsCompoundInterval(t *testing.T) { + srv := newMockTokenServer(t, []AccessTokenResponse{ + {Error: "slow_down"}, // 0 -> 5 + {Error: "authorization_pending"}, // stays 5 + {Error: "slow_down"}, // 5 -> 10 + {AccessToken: "gh-token"}, + }) + p, slept := newPollTestProvider(srv.URL) + + token, err := p.pollForToken(context.Background(), "device-code") + require.NoError(t, err) + assert.Equal(t, "gh-token", token) + + require.Len(t, *slept, 3) + assert.Equal(t, 5*time.Second, (*slept)[0]) // after first slow_down + assert.Equal(t, 5*time.Second, (*slept)[1]) // authorization_pending: unchanged + assert.Equal(t, 10*time.Second, (*slept)[2]) // second slow_down: compounded +} + +// TestPollForToken_IntervalCappedAtMax confirms the polling interval is capped +// so a misbehaving auth server returning slow_down repeatedly cannot grow it +// without bound. +func TestPollForToken_IntervalCappedAtMax(t *testing.T) { + // 13 slow_downs starting from interval 0 would otherwise reach 65s + // (5, 10, ..., 60, 65); the cap holds it at 60. + responses := make([]AccessTokenResponse, 0, 14) + for range [13]struct{}{} { + responses = append(responses, AccessTokenResponse{Error: "slow_down"}) + } + responses = append(responses, AccessTokenResponse{AccessToken: "gh-token"}) + + srv := newMockTokenServer(t, responses) + p, slept := newPollTestProvider(srv.URL) + + token, err := p.pollForToken(context.Background(), "device-code") + require.NoError(t, err) + assert.Equal(t, "gh-token", token) + + require.Len(t, *slept, 13) + for _, d := range *slept { + assert.LessOrEqual(t, d, time.Duration(maxPollInterval)*time.Second) + } + // The last two back-offs are both pinned at the cap. + assert.Equal(t, time.Duration(maxPollInterval)*time.Second, (*slept)[11]) + assert.Equal(t, time.Duration(maxPollInterval)*time.Second, (*slept)[12]) +} + +// TestPollForToken_FatalErrorStopsPolling confirms a non-retryable error ends +// polling immediately with an error. +func TestPollForToken_FatalErrorStopsPolling(t *testing.T) { + srv := newMockTokenServer(t, []AccessTokenResponse{ + {Error: "access_denied"}, + }) + p, slept := newPollTestProvider(srv.URL) + + _, err := p.pollForToken(context.Background(), "device-code") + require.Error(t, err) + assert.Contains(t, err.Error(), "access_denied") + assert.Empty(t, *slept, "fatal error should not trigger a back-off sleep") +} From d1dcaf3fb36338d45ccdba98b5b8aea915e7d50d Mon Sep 17 00:00:00 2001 From: Yusufhan Sacak <67666222+JosephDoUrden@users.noreply.github.com> Date: Wed, 16 Sep 2026 16:42:30 +0100 Subject: [PATCH 36/36] fix(publisher): tolerate transient device-flow failures during login polling (#1588) Follow-up to my analysis on #1543. Heads up on the shape first: this builds on #1290's poll-loop seams and github wont let me target a fork branch, so the diff shows its two commits too. Review only the last commit, the first two are #1290 unchanged, credit to @developer-ishan. Happy to rebase whichever way #1290 goes, or split differently if that's easier to review. What it does. pollForToken treats every non-pending answer as terminal, so one flaky response kills a login the user may already have approved in the browser. This spends a small grace budget (2 polls) on incorrect_device_code before giving up, retries 5xx with a growing backoff, and returns status plus body on other non-200s instead of dying inside json.Unmarshal on an html error page. Terminal errors now carry error_description and error_uri, and a timeout that happens after polling recovered reports a plain timeout, not a stale error from minutes earlier. Also honours the interval and expires_in GitHub returns with the device code (RFC 8628 3.2) instead of hardcoding 5/900, clamped (60s / 3600s) so a misbehaving response can't stall the CLI or overflow the duration math. One thing I changed my mind on from the issue comment: I wrote there that the client should wait one interval before the first poll. Dropped that. My own repro test showed 40s of clean polling before authorize, so the propagation theory doesn't hold, and the grace retry covers the same window without taxing every fast login. First poll stays immediate, pinned by a test. Root cause note: I can't prove the GitHub-side race (cli/cli#9302 is the same error class but was closed on an unconfirmed "platform race"). So this isn't claimed as a root-cause fix, it makes the login recoverable if the condition is transient and diagnosable if it isn't. Btw incorrect_device_code is a GitHub extension, not an RFC 8628 3.5 code, so there's no spec retry semantic being violated by the grace polls. ## Test 12 new tests in github_at_device_flow_internal_test.go, all green with -race (33 in the package). #1290's four tests pass unmodified. golangci-lint clean in the touched files under both v2.11.4 (this branch's CI pin) and v2.13.1 (what main pins now). ## AI Disclosure AI assistance (Claude) was used for issue research and during development. All changes were reviewed and tested by the author. Fixes #1543 --------- Co-authored-by: developer-ishan Co-authored-by: Ishan Gupta <62565307+developer-ishan@users.noreply.github.com> Co-authored-by: developer-ishan Co-authored-by: Claude Opus 4.8 (1M context) Co-authored-by: Radoslav Dimitrov Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- cmd/publisher/auth/github-at.go | 129 ++++- .../github_at_device_flow_internal_test.go | 532 ++++++++++++++++++ docs/reference/cli/commands.md | 4 + 3 files changed, 658 insertions(+), 7 deletions(-) create mode 100644 cmd/publisher/auth/github_at_device_flow_internal_test.go diff --git a/cmd/publisher/auth/github-at.go b/cmd/publisher/auth/github-at.go index 0da68a4..fef3774 100644 --- a/cmd/publisher/auth/github-at.go +++ b/cmd/publisher/auth/github-at.go @@ -26,6 +26,20 @@ const ( // maximum to the implementation; this prevents a misbehaving auth server // from growing the interval unboundedly. maxPollInterval = 60 + // defaultExpiresIn is the device-code lifetime in seconds used when the + // device-code response omits expires_in. + defaultExpiresIn = 900 + // maxExpiresIn caps the device-code lifetime a response may claim. It sits + // well past GitHub's documented 15 minutes; the cap stops a misbehaving or + // hostile response from pushing the deadline (and the polling loop) far + // into the future. + maxExpiresIn = 3600 + // incorrectDeviceCodeGraceRetries is the total number of extra polls a + // single login may spend on incorrect_device_code before giving up — a + // budget for the whole login, not per occurrence. cli/cli#9302 reports the + // same error for a code that had just been issued; a genuinely invalid code + // still fails, only a few seconds later. + incorrectDeviceCodeGraceRetries = 2 ) // DeviceCodeResponse represents the response from GitHub's device code endpoint @@ -43,6 +57,38 @@ type AccessTokenResponse struct { TokenType string `json:"token_type"` Scope string `json:"scope"` Error string `json:"error,omitempty"` + // ErrorDescription and ErrorURI accompany Error in GitHub's responses; + // surfacing them turns opaque failures like "incorrect_device_code" into + // diagnosable reports. + ErrorDescription string `json:"error_description,omitempty"` + ErrorURI string `json:"error_uri,omitempty"` +} + +// errorDetail renders Error together with any error_description and error_uri +// GitHub returned, so failures reach the user diagnosable rather than opaque. +func (r AccessTokenResponse) errorDetail() string { + detail := r.Error + if r.ErrorDescription != "" { + detail += ": " + r.ErrorDescription + } + if r.ErrorURI != "" { + detail += " (" + r.ErrorURI + ")" + } + return detail +} + +func decodeAccessTokenResponse(statusCode int, body []byte) (AccessTokenResponse, error) { + var tokenResp AccessTokenResponse + // OAuth errors may use HTTP 400 (RFC 6749 §5.2), not just HTTP 200. + if statusCode != http.StatusOK && statusCode != http.StatusBadRequest { + return tokenResp, fmt.Errorf("token endpoint returned %d: %s", statusCode, body) + } + + err := json.Unmarshal(body, &tokenResp) + if statusCode == http.StatusBadRequest && (err != nil || tokenResp.Error == "") { + return tokenResp, fmt.Errorf("token endpoint returned %d: %s", statusCode, body) + } + return tokenResp, err } // RegistryTokenResponse represents the response from registry's token exchange endpoint @@ -61,9 +107,17 @@ type GitHubATProvider struct { // accessTokenURL is the GitHub access-token polling endpoint. It is a field // (rather than the package constant) so tests can point it at a mock server. accessTokenURL string + // deviceCodeURL is the GitHub device-code endpoint, a field for the same + // reason as accessTokenURL. + deviceCodeURL string // pollInterval is the initial polling interval in seconds. Defaults to - // defaultPollInterval; overridable in tests to avoid real delays. + // defaultPollInterval; overridable in tests to avoid real delays. Updated + // from the device-code response's interval when GitHub returns one. pollInterval int + // expiresIn is the device-code lifetime in seconds. Defaults to + // defaultExpiresIn; updated from the device-code response's expires_in + // when GitHub returns one. + expiresIn int // sleep abstracts time.Sleep so tests can run without real delays and // assert the back-off sequence. Defaults to time.Sleep. sleep func(time.Duration) @@ -86,7 +140,9 @@ func NewGitHubATProvider(registryURL, token string) Provider { registryURL: registryURL, providedToken: token, accessTokenURL: GitHubAccessTokenURL, + deviceCodeURL: GitHubDeviceCodeURL, pollInterval: defaultPollInterval, + expiresIn: defaultExpiresIn, sleep: time.Sleep, } } @@ -173,7 +229,7 @@ func (g *GitHubATProvider) requestDeviceCode(ctx context.Context) (string, strin return "", "", "", err } - req, err := http.NewRequestWithContext(ctx, http.MethodPost, GitHubDeviceCodeURL, bytes.NewBuffer(jsonData)) + req, err := http.NewRequestWithContext(ctx, http.MethodPost, g.deviceCodeURL, bytes.NewBuffer(jsonData)) if err != nil { return "", "", "", err } @@ -202,6 +258,21 @@ func (g *GitHubATProvider) requestDeviceCode(ctx context.Context) (string, strin return "", "", "", err } + // Per RFC 8628 §3.2 interval and expires_in are bound to this device code, + // so reset any pacing left over from a previous code before adopting them. + // Clamp both: a hostile or buggy response must not grow the interval past + // maxPollInterval (the invariant maxPollInterval exists for) nor push the + // deadline unboundedly into the future, and clamping also keeps the + // derived time.Duration well clear of int64 overflow. + g.pollInterval = defaultPollInterval + g.expiresIn = defaultExpiresIn + if deviceCodeResp.Interval > 0 { + g.pollInterval = min(deviceCodeResp.Interval, maxPollInterval) + } + if deviceCodeResp.ExpiresIn > 0 { + g.expiresIn = min(deviceCodeResp.ExpiresIn, maxExpiresIn) + } + return deviceCodeResp.DeviceCode, deviceCodeResp.UserCode, deviceCodeResp.VerificationURI, nil } @@ -222,11 +293,26 @@ func (g *GitHubATProvider) pollForToken(ctx context.Context, deviceCode string) return "", err } - // Default polling interval and expiration time + // Pacing comes from the device-code response (via requestDeviceCode), + // falling back to GitHub's documented defaults. interval := g.pollInterval - expiresIn := 900 // 15 minutes + expiresIn := g.expiresIn + // Zero-value fallback: providers built directly rather than through + // requestDeviceCode (the test seam) carry no lifetime. Keep this guard. + if expiresIn <= 0 { + expiresIn = defaultExpiresIn + } deadline := time.Now().Add(time.Duration(expiresIn) * time.Second) + graceRetries := 0 + // serverErrorInterval grows the wait between consecutive 5xx retries and is + // reset by any other response. + serverErrorInterval := interval + // lastErr holds the most recent retryable failure so a deadline reached + // mid-retry reports that diagnostic instead of a bare "timed out". It is + // cleared whenever polling recovers, so a genuine user timeout after a + // recovered blip still reports plainly. + var lastErr error for time.Now().Before(deadline) { req, err := http.NewRequestWithContext(ctx, http.MethodPost, g.accessTokenURL, bytes.NewBuffer(jsonData)) if err != nil { @@ -247,8 +333,20 @@ func (g *GitHubATProvider) pollForToken(ctx context.Context, deviceCode string) return "", err } - var tokenResp AccessTokenResponse - err = json.Unmarshal(body, &tokenResp) + // A transient 5xx must not abandon a login the user may already have + // approved in the browser. Each consecutive 5xx grows the wait by 5s up + // to maxPollInterval, so a sustained outage costs a couple of dozen + // requests rather than hundreds; the deadline bounds the number of + // these retries. + if resp.StatusCode >= http.StatusInternalServerError { + lastErr = fmt.Errorf("token endpoint returned %d", resp.StatusCode) + serverErrorInterval = min(serverErrorInterval+5, maxPollInterval) + g.sleep(time.Duration(serverErrorInterval) * time.Second) + continue + } + serverErrorInterval = interval + + tokenResp, err := decodeAccessTokenResponse(resp.StatusCode, body) if err != nil { return "", err } @@ -263,12 +361,26 @@ func (g *GitHubATProvider) pollForToken(ctx context.Context, deviceCode string) interval = maxPollInterval } } + lastErr = nil g.sleep(time.Duration(interval) * time.Second) continue } if tokenResp.Error != "" { - return "", fmt.Errorf("token request failed: %s", tokenResp.Error) + failure := fmt.Errorf("token request failed: %s", tokenResp.errorDetail()) + + // incorrect_device_code has been reported for codes that were in + // fact valid (cli/cli#9302; cause never confirmed), so spend a + // couple of grace polls before abandoning a login the user may + // have approved. + if tokenResp.Error == "incorrect_device_code" && graceRetries < incorrectDeviceCodeGraceRetries { + graceRetries++ + lastErr = failure + g.sleep(time.Duration(interval) * time.Second) + continue + } + + return "", failure } if tokenResp.AccessToken != "" { @@ -279,6 +391,9 @@ func (g *GitHubATProvider) pollForToken(ctx context.Context, deviceCode string) return "", fmt.Errorf("failed to obtain access token") } + if lastErr != nil { + return "", fmt.Errorf("device code authorization timed out; last response: %w", lastErr) + } return "", fmt.Errorf("device code authorization timed out") } diff --git a/cmd/publisher/auth/github_at_device_flow_internal_test.go b/cmd/publisher/auth/github_at_device_flow_internal_test.go new file mode 100644 index 0000000..b1e13ac --- /dev/null +++ b/cmd/publisher/auth/github_at_device_flow_internal_test.go @@ -0,0 +1,532 @@ +package auth + +import ( + "context" + "encoding/json" + "fmt" + "net/http" + "net/http/httptest" + "sync" + "testing" + "time" + + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" +) + +// seqTokenServer serves a fixed sequence of (status, body) responses, one per +// request, reusing the last one once the sequence is exhausted. Unlike +// newMockTokenServer it can serve non-200 statuses and non-JSON bodies, which +// the transient-5xx path needs. +type seqTokenServer struct { + srv *httptest.Server + mu sync.Mutex + seen int + items []seqResp +} + +type seqResp struct { + status int + body string +} + +func newSeqTokenServer(t *testing.T, items ...seqResp) *seqTokenServer { + t.Helper() + s := &seqTokenServer{items: items} + s.srv = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) { + s.mu.Lock() + item := s.items[len(s.items)-1] + if s.seen < len(s.items) { + item = s.items[s.seen] + } + s.seen++ + s.mu.Unlock() + w.Header().Set("Content-Type", "application/json") + w.WriteHeader(item.status) + _, _ = w.Write([]byte(item.body)) + })) + t.Cleanup(s.srv.Close) + return s +} + +func (s *seqTokenServer) requests() int { + s.mu.Lock() + defer s.mu.Unlock() + return s.seen +} + +func okResp(body string) seqResp { return seqResp{status: http.StatusOK, body: body} } + +// serverErrorResp is a 502 carrying an HTML body rather than JSON, the shape a +// transient edge failure takes. +func serverErrorResp() seqResp { + return seqResp{status: http.StatusBadGateway, body: `Server Error`} +} + +const ( + testClientID = "test-client-id" + + pendingBody = `{"error":"authorization_pending"}` + incorrectBody = `{"error":"incorrect_device_code"}` + // The full shape GitHub sends for this error, description and URI included. + incorrectVerboseBody = `{"error":"incorrect_device_code","error_description":"The device_code provided is not valid.","error_uri":"https://docs.github.com/developers/apps/authorizing-oauth-apps#error-codes-for-the-device-flow"}` + tokenBody = `{"access_token":"gho_test_token","token_type":"bearer","scope":"read:org,read:user"}` // #nosec G101 -- test fixture, not a real secret +) + +// TestPollForToken_IncorrectDeviceCodeIsTerminalAfterGrace confirms a code that +// stays invalid past the grace polls still fails, and fails with the error +// GitHub reported rather than a rewritten one. +func TestPollForToken_IncorrectDeviceCodeIsTerminalAfterGrace(t *testing.T) { + gh := newSeqTokenServer(t, okResp(pendingBody), okResp(pendingBody), okResp(incorrectBody)) + p, _ := newPollTestProvider(gh.srv.URL) + + _, err := p.pollForToken(context.Background(), "issued-device-code") + require.Error(t, err) + assert.Equal(t, "token request failed: incorrect_device_code", err.Error()) + // 2 pending + 1 incorrect + 2 grace polls that also answer incorrect. + assert.Equal(t, 5, gh.requests()) +} + +// TestPollForToken_TransientIncorrectDeviceCodeRecovered covers the case the +// grace retries exist for: one incorrect_device_code between a pending poll and +// a successful one must not discard a token the user already authorised. +func TestPollForToken_TransientIncorrectDeviceCodeRecovered(t *testing.T) { + gh := newSeqTokenServer(t, okResp(pendingBody), okResp(incorrectBody), okResp(tokenBody)) + p, _ := newPollTestProvider(gh.srv.URL) + + token, err := p.pollForToken(context.Background(), "issued-device-code") + require.NoError(t, err, "one transient incorrect_device_code must not be fatal") + assert.Equal(t, "gho_test_token", token) + assert.Equal(t, 3, gh.requests()) +} + +func TestPollForToken_OAuthErrorsRetryOnBadRequest(t *testing.T) { + for _, status := range []int{http.StatusOK, http.StatusBadRequest} { + for _, code := range []string{"authorization_pending", "slow_down", "incorrect_device_code"} { + t.Run(fmt.Sprintf("%d/%s", status, code), func(t *testing.T) { + gh := newSeqTokenServer(t, + seqResp{status: status, body: fmt.Sprintf(`{"error":%q}`, code)}, + okResp(tokenBody), + ) + p, slept := newPollTestProvider(gh.srv.URL) + p.pollInterval = defaultPollInterval + + token, err := p.pollForToken(context.Background(), "issued-device-code") + require.NoError(t, err) + assert.Equal(t, "gho_test_token", token) + assert.Equal(t, 2, gh.requests()) + wait := time.Duration(defaultPollInterval) * time.Second + if code == "slow_down" { + wait += 5 * time.Second + } + assert.Equal(t, []time.Duration{wait}, *slept) + }) + } + } +} + +func TestPollForToken_BadRequestOAuthErrorsRemainTerminal(t *testing.T) { + for _, code := range []string{"access_denied", "expired_token", "unknown_error", "incorrect_device_code"} { + t.Run(code, func(t *testing.T) { + gh := newSeqTokenServer(t, seqResp{ + status: http.StatusBadRequest, + body: fmt.Sprintf(`{"error":%q,"error_description":"Request rejected","error_uri":"https://github.com/error"}`, code), + }) + p, slept := newPollTestProvider(gh.srv.URL) + + token, err := p.pollForToken(context.Background(), "issued-device-code") + require.EqualError(t, err, "token request failed: "+code+": Request rejected (https://github.com/error)") + assert.Empty(t, token) + retries := 0 + if code == "incorrect_device_code" { + retries = incorrectDeviceCodeGraceRetries + } + assert.Equal(t, 1+retries, gh.requests()) + assert.Len(t, *slept, retries) + }) + } +} + +// TestPollForToken_ErrorDescriptionAndURISurfaced confirms the grace budget is +// spent in full against a persistently invalid code, and that GitHub's +// error_description and error_uri reach the user instead of being discarded. +func TestPollForToken_ErrorDescriptionAndURISurfaced(t *testing.T) { + gh := newSeqTokenServer(t, okResp(incorrectVerboseBody)) + p, _ := newPollTestProvider(gh.srv.URL) + + _, err := p.pollForToken(context.Background(), "issued-device-code") + require.Error(t, err) + assert.Contains(t, err.Error(), "incorrect_device_code") + assert.Contains(t, err.Error(), "The device_code provided is not valid.") + assert.Contains(t, err.Error(), "error-codes-for-the-device-flow") + assert.Equal(t, 1+incorrectDeviceCodeGraceRetries, gh.requests()) +} + +// TestPollForToken_TransientServerErrorRetried confirms a 5xx (which carries an +// HTML body, not JSON) is retried rather than ending the login. +func TestPollForToken_TransientServerErrorRetried(t *testing.T) { + gh := newSeqTokenServer(t, + serverErrorResp(), + okResp(tokenBody), + ) + p, slept := newPollTestProvider(gh.srv.URL) + + token, err := p.pollForToken(context.Background(), "issued-device-code") + require.NoError(t, err) + assert.Equal(t, "gho_test_token", token) + assert.Equal(t, 2, gh.requests()) + assert.Len(t, *slept, 1, "the 5xx must be followed by one back-off") +} + +// TestPollForToken_FirstPollIsImmediate pins the polling schedule: the first +// request goes out without a preceding sleep, so a user who authorises quickly +// is not made to wait an interval for nothing. +func TestPollForToken_FirstPollIsImmediate(t *testing.T) { + gh := newSeqTokenServer(t, okResp(tokenBody)) + p, slept := newPollTestProvider(gh.srv.URL) + + _, err := p.pollForToken(context.Background(), "issued-device-code") + require.NoError(t, err) + assert.Equal(t, 1, gh.requests()) + assert.Empty(t, *slept, "an immediately successful poll must not sleep") +} + +// TestRequestDeviceCode_HonoursServerIntervalAndExpiry confirms the interval and +// expires_in in the device-code response are adopted rather than dropped. +func TestRequestDeviceCode_HonoursServerIntervalAndExpiry(t *testing.T) { + device := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) { + w.Header().Set("Content-Type", "application/json") + _, _ = w.Write([]byte(`{"device_code":"dc-1","user_code":"AAAA-BBBB","verification_uri":"https://github.com/login/device","expires_in":60,"interval":7}`)) + })) + t.Cleanup(device.Close) + + p := &GitHubATProvider{ + clientID: testClientID, + deviceCodeURL: device.URL, + pollInterval: defaultPollInterval, + expiresIn: defaultExpiresIn, + } + + deviceCode, userCode, uri, err := p.requestDeviceCode(context.Background()) + require.NoError(t, err) + assert.Equal(t, "dc-1", deviceCode) + assert.Equal(t, "AAAA-BBBB", userCode) + assert.Equal(t, "https://github.com/login/device", uri) + assert.Equal(t, 7, p.pollInterval, "interval from the response must be adopted") + assert.Equal(t, 60, p.expiresIn, "expires_in from the response must be adopted") +} + +// TestRequestDeviceCode_KeepsDefaultsWhenOmitted confirms a response without +// interval or expires_in leaves the documented defaults in place. +func TestRequestDeviceCode_KeepsDefaultsWhenOmitted(t *testing.T) { + device := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) { + w.Header().Set("Content-Type", "application/json") + _, _ = w.Write([]byte(`{"device_code":"dc-2","user_code":"EEEE-FFFF","verification_uri":"https://github.com/login/device"}`)) + })) + t.Cleanup(device.Close) + + p := &GitHubATProvider{ + clientID: testClientID, + deviceCodeURL: device.URL, + pollInterval: defaultPollInterval, + expiresIn: defaultExpiresIn, + } + + _, _, _, err := p.requestDeviceCode(context.Background()) + require.NoError(t, err) + assert.Equal(t, defaultPollInterval, p.pollInterval) + assert.Equal(t, defaultExpiresIn, p.expiresIn) +} + +// deviceCodeServerReturning serves a single device-code response with the given +// raw JSON body, for exercising interval/expires_in handling. +func deviceCodeServerReturning(t *testing.T, body string) string { + t.Helper() + srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) { + w.Header().Set("Content-Type", "application/json") + _, _ = w.Write([]byte(body)) + })) + t.Cleanup(srv.Close) + return srv.URL +} + +// TestRequestDeviceCode_ClampsExcessiveInterval confirms an interval far above +// maxPollInterval is clamped, protecting the same invariant maxPollInterval +// enforces on the slow_down path. +func TestRequestDeviceCode_ClampsExcessiveInterval(t *testing.T) { + url := deviceCodeServerReturning(t, + `{"device_code":"dc","user_code":"AAAA-BBBB","verification_uri":"https://github.com/login/device","expires_in":900,"interval":86400}`) + + p := &GitHubATProvider{clientID: testClientID, deviceCodeURL: url, pollInterval: defaultPollInterval, expiresIn: defaultExpiresIn} + _, _, _, err := p.requestDeviceCode(context.Background()) + require.NoError(t, err) + assert.Equal(t, maxPollInterval, p.pollInterval, "interval above the cap must be clamped") +} + +// TestRequestDeviceCode_ClampsOverflowValues covers the overflow pair: values +// large enough that time.Duration(n)*time.Second wraps negative would make +// sleep return instantly (spinning the loop) and put the deadline in the past +// (yielding zero polls). Clamping keeps both within safe bounds. +func TestRequestDeviceCode_ClampsOverflowValues(t *testing.T) { + url := deviceCodeServerReturning(t, + `{"device_code":"dc","user_code":"AAAA-BBBB","verification_uri":"https://github.com/login/device","expires_in":10000000000,"interval":10000000000}`) + + p := &GitHubATProvider{clientID: testClientID, deviceCodeURL: url, pollInterval: defaultPollInterval, expiresIn: defaultExpiresIn} + _, _, _, err := p.requestDeviceCode(context.Background()) + require.NoError(t, err) + + assert.Equal(t, maxPollInterval, p.pollInterval) + assert.Equal(t, maxExpiresIn, p.expiresIn) +} + +// TestRequestDeviceCode_IgnoresNegativeValues confirms negative interval and +// expires_in are rejected in favour of the defaults, so neither can produce a +// negative sleep or a deadline already in the past. +func TestRequestDeviceCode_IgnoresNegativeValues(t *testing.T) { + url := deviceCodeServerReturning(t, + `{"device_code":"dc","user_code":"AAAA-BBBB","verification_uri":"https://github.com/login/device","expires_in":-1,"interval":-1}`) + + p := &GitHubATProvider{clientID: testClientID, deviceCodeURL: url, pollInterval: defaultPollInterval, expiresIn: defaultExpiresIn} + _, _, _, err := p.requestDeviceCode(context.Background()) + require.NoError(t, err) + + assert.Equal(t, defaultPollInterval, p.pollInterval, "negative interval must fall back to the default") + assert.Equal(t, defaultExpiresIn, p.expiresIn, "negative expires_in must fall back to the default") +} + +// TestPollForToken_TimeoutSurfacesLastError covers F2: when the deadline lands +// mid-retry, the timeout must carry the last retryable diagnostic instead of a +// bare "timed out". The grace poll records the full-shape incorrect_device_code +// and its following sleep crosses the (1-second) deadline. +func TestPollForToken_TimeoutSurfacesLastError(t *testing.T) { + gh := newSeqTokenServer(t, okResp(incorrectVerboseBody)) + p := &GitHubATProvider{ + clientID: testClientID, + accessTokenURL: gh.srv.URL, + pollInterval: 1, + expiresIn: 1, // deadline ~1s out + sleep: func(time.Duration) { time.Sleep(1100 * time.Millisecond) }, + } + + _, err := p.pollForToken(context.Background(), "issued-device-code") + require.Error(t, err) + assert.Contains(t, err.Error(), "timed out") + assert.Contains(t, err.Error(), "The device_code provided is not valid.", + "the last retryable diagnostic must survive the timeout") +} + +// TestPollForToken_TimeoutAfterRecoveryIsBare confirms lastErr is cleared when +// polling recovers: one transient 502 followed by healthy pending polls and +// then a genuine user timeout must report plainly, not blame the stale 502. +func TestPollForToken_TimeoutAfterRecoveryIsBare(t *testing.T) { + gh := newSeqTokenServer(t, + serverErrorResp(), + okResp(pendingBody), + ) + p := &GitHubATProvider{ + clientID: testClientID, + accessTokenURL: gh.srv.URL, + pollInterval: 1, + expiresIn: 1, // deadline ~1s out + sleep: func(time.Duration) { time.Sleep(400 * time.Millisecond) }, + } + + _, err := p.pollForToken(context.Background(), "issued-device-code") + require.Error(t, err) + assert.Equal(t, "device code authorization timed out", err.Error(), + "a recovered 502 must not be reported as the cause of a user timeout") +} + +// Non-OAuth failures retain HTTP diagnostics rather than JSON parsing errors. +func TestPollForToken_NonOKStatusSurfacesStatusAndBody(t *testing.T) { + for _, tt := range []struct { + name string + resp seqResp + }{ + {"rate_limited", seqResp{status: http.StatusTooManyRequests, body: "rate limited"}}, + {"bad_request_html", seqResp{status: http.StatusBadRequest, body: "bad request"}}, + {"bad_request_invalid_json", seqResp{status: http.StatusBadRequest, body: `{"error":`}}, + {"bad_request_empty_error", seqResp{status: http.StatusBadRequest, body: `{"error":""}`}}, + {"bad_request_token", seqResp{status: http.StatusBadRequest, body: tokenBody}}, + {"pending_on_other_status", seqResp{status: http.StatusForbidden, body: pendingBody}}, + } { + t.Run(tt.name, func(t *testing.T) { + gh := newSeqTokenServer(t, tt.resp) + p, slept := newPollTestProvider(gh.srv.URL) + + token, err := p.pollForToken(context.Background(), "issued-device-code") + require.EqualError(t, err, fmt.Sprintf("token endpoint returned %d: %s", tt.resp.status, tt.resp.body)) + assert.Empty(t, token) + assert.Equal(t, 1, gh.requests(), "a non-retryable status must stop polling") + assert.Empty(t, *slept) + }) + } +} + +// TestPollForToken_ConsecutiveServerErrorsBackOff confirms the 5xx wait grows by +// 5s per consecutive failure and is capped, so a sustained outage costs a +// bounded number of requests rather than hammering the endpoint. +func TestPollForToken_ConsecutiveServerErrorsBackOff(t *testing.T) { + responses := make([]seqResp, 0, 4) + for range [3]struct{}{} { + responses = append(responses, serverErrorResp()) + } + responses = append(responses, okResp(tokenBody)) + + gh := newSeqTokenServer(t, responses...) + p, slept := newPollTestProvider(gh.srv.URL) + + token, err := p.pollForToken(context.Background(), "issued-device-code") + require.NoError(t, err) + assert.Equal(t, "gho_test_token", token) + + // Base interval is 0 in the test provider, so the waits are 5, 10, 15. + require.Len(t, *slept, 3) + assert.Equal(t, 5*time.Second, (*slept)[0]) + assert.Equal(t, 10*time.Second, (*slept)[1]) + assert.Equal(t, 15*time.Second, (*slept)[2]) +} + +// TestPollForToken_ServerErrorBackOffResetsOnRecovery confirms the 5xx growth is +// reset by any non-5xx response, so an intermittent endpoint does not +// accumulate an ever-longer wait across separate blips. +func TestPollForToken_ServerErrorBackOffResetsOnRecovery(t *testing.T) { + serverError := serverErrorResp() + gh := newSeqTokenServer(t, + serverError, + okResp(pendingBody), + serverError, + okResp(tokenBody), + ) + p, slept := newPollTestProvider(gh.srv.URL) + + token, err := p.pollForToken(context.Background(), "issued-device-code") + require.NoError(t, err) + assert.Equal(t, "gho_test_token", token) + + // 5s for the first 5xx, 0s for the pending poll (base interval), then 5s + // again — not 10s — because the pending response reset the growth. + require.Len(t, *slept, 3) + assert.Equal(t, 5*time.Second, (*slept)[0]) + assert.Equal(t, 0*time.Second, (*slept)[1]) + assert.Equal(t, 5*time.Second, (*slept)[2]) +} + +// TestRequestDeviceCode_PacingDoesNotLeakAcrossCodes covers F4: interval and +// expires_in are bound to the code they were issued with, so a second request +// that omits them must fall back to defaults rather than inherit the first. +func TestRequestDeviceCode_PacingDoesNotLeakAcrossCodes(t *testing.T) { + var call int + srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) { + w.Header().Set("Content-Type", "application/json") + if call == 0 { + _, _ = w.Write([]byte(`{"device_code":"dc1","user_code":"AAAA-BBBB","verification_uri":"https://github.com/login/device","expires_in":120,"interval":55}`)) + } else { + _, _ = w.Write([]byte(`{"device_code":"dc2","user_code":"CCCC-DDDD","verification_uri":"https://github.com/login/device"}`)) + } + call++ + })) + t.Cleanup(srv.Close) + + p := &GitHubATProvider{clientID: testClientID, deviceCodeURL: srv.URL, pollInterval: defaultPollInterval, expiresIn: defaultExpiresIn} + + _, _, _, err := p.requestDeviceCode(context.Background()) + require.NoError(t, err) + assert.Equal(t, 55, p.pollInterval) + assert.Equal(t, 120, p.expiresIn) + + _, _, _, err = p.requestDeviceCode(context.Background()) + require.NoError(t, err) + assert.Equal(t, defaultPollInterval, p.pollInterval, "second code must not inherit the first's interval") + assert.Equal(t, defaultExpiresIn, p.expiresIn, "second code must not inherit the first's expires_in") +} + +// TestLogin_ClientIDStableAcrossDeviceCodeAndPolls covers the whole device flow +// end to end and pins the one invariant that makes incorrect_device_code +// meaningful: the health endpoint is read once, and the client_id the device +// code was issued under is the one every poll carries. The mock token endpoint +// answers incorrect_device_code for any other pairing. +func TestLogin_ClientIDStableAcrossDeviceCodeAndPolls(t *testing.T) { + var mu sync.Mutex + healthCalls := 0 + deviceClientID := "" + pollClientIDs := []string{} + pollCount := 0 + const issued = "dc-login" + + registry := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + if r.URL.Path != "/v0/health" { + http.NotFound(w, r) + return + } + mu.Lock() + healthCalls++ + id := fmt.Sprintf("Iv23liCLIENT%04d", healthCalls) + mu.Unlock() + w.Header().Set("Content-Type", "application/json") + _, _ = fmt.Fprintf(w, `{"status":"ok","github_client_id":"%s"}`, id) + })) + t.Cleanup(registry.Close) + + device := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + var req map[string]string + // assert, not require: t.FailNow from a handler goroutine is unsupported. + if !assert.NoError(t, json.NewDecoder(r.Body).Decode(&req)) { + http.Error(w, "bad request body", http.StatusBadRequest) + return + } + mu.Lock() + deviceClientID = req["client_id"] + mu.Unlock() + w.Header().Set("Content-Type", "application/json") + _, _ = fmt.Fprintf(w, `{"device_code":"%s","user_code":"CCCC-DDDD","verification_uri":"https://github.com/login/device","expires_in":900,"interval":5}`, issued) + })) + t.Cleanup(device.Close) + + tokenSrv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + var req map[string]string + // assert, not require: t.FailNow from a handler goroutine is unsupported. + if !assert.NoError(t, json.NewDecoder(r.Body).Decode(&req)) { + http.Error(w, "bad request body", http.StatusBadRequest) + return + } + mu.Lock() + pollClientIDs = append(pollClientIDs, req["client_id"]) + bound := req["client_id"] == deviceClientID && req["device_code"] == issued + pollCount++ + first := pollCount == 1 + mu.Unlock() + + w.Header().Set("Content-Type", "application/json") + switch { + case !bound: + _, _ = w.Write([]byte(incorrectBody)) + case first: + _, _ = w.Write([]byte(pendingBody)) + default: + _, _ = w.Write([]byte(tokenBody)) + } + })) + t.Cleanup(tokenSrv.Close) + + p := &GitHubATProvider{ + registryURL: registry.URL, + deviceCodeURL: device.URL, + accessTokenURL: tokenSrv.URL, + pollInterval: defaultPollInterval, + expiresIn: defaultExpiresIn, + sleep: func(time.Duration) {}, + } + + require.NoError(t, p.Login(context.Background())) + assert.Equal(t, "gho_test_token", p.githubToken) + + mu.Lock() + defer mu.Unlock() + assert.Equal(t, 1, healthCalls, "Login must read the health endpoint exactly once") + assert.Equal(t, "Iv23liCLIENT0001", deviceClientID) + for _, id := range pollClientIDs { + assert.Equal(t, deviceClientID, id, + "every poll must carry the client_id the device code was issued under") + } +} diff --git a/docs/reference/cli/commands.md b/docs/reference/cli/commands.md index c8d7615..690a7f4 100644 --- a/docs/reference/cli/commands.md +++ b/docs/reference/cli/commands.md @@ -70,6 +70,10 @@ mcp-publisher login github [--token=PAT] [--registry=URL] [publishing from GitHub Actions](../../modelcontextprotocol-io/github-actions.mdx) authenticates without a browser. This flag is accepted by `login github` only. +Interactive login handles retryable OAuth errors in both HTTP 200 and HTTP 400 responses. +Access denial, expired codes, and unrecognized OAuth errors still stop polling; an +`incorrect_device_code` error receives at most two additional attempts per login. + #### GitHub OIDC (CI/CD) ```bash mcp-publisher login github-oidc [--registry=URL]