v1.7.8

What's Changed

• deploy: update prod to v1.7.7 by @rdimitrov in #1251
• build(deps): bump pulumi/actions from 6.6.1 to 7.0.0 in the actions group by @dependabot[bot] in #1254
• metrics: stop counting client-cancelled requests as server errors by @rdimitrov in #1255

Full Changelog: v1.7.7...v1.7.8

v1.7.7

What's Changed

• deploy: update prod to v1.7.6 by @rdimitrov in #1232
• build(deps): bump cloud.google.com/go/kms from 1.29.0 to 1.30.0 by @dependabot[bot] in #1233
• build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.232.0 to 3.233.0 in /deploy by @dependabot[bot] in #1234
• build(deps): bump github.com/caarlos0/env/v11 from 11.4.0 to 11.4.1 by @dependabot[bot] in #1236
• build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.233.0 to 3.234.0 in /deploy by @dependabot[bot] in #1237
• auth/oidc: support slice-typed extra claims via overlap match by @SAY-5 in #1238
• auth/oidc: test slice-typed extra claims comparison by @rdimitrov in #1245
• refactor: extract readBody helper to remove duplicate io.ReadAll calls by @mesutoezdil in #1241
• refactor: rename readBody to readErrorBody and cap body size by @rdimitrov in #1246
• fix(ui): encode publisher-controlled URLs for href attribute context by @rdimitrov in #1248
• fix(validators): reject HTML metacharacters and whitespace in websiteUrl by @rdimitrov in #1249
• fix(auth/http): extend SSRF blocklist to IPv6 6to4/NAT64/site-local prefixes by @rdimitrov in #1250

New Contributors

• @SAY-5 made their first contribution in #1238
• @mesutoezdil made their first contribution in #1241

Full Changelog: v1.7.6...v1.7.7

v1.7.6

What's Changed

• deploy: update prod to v1.7.5 by @rdimitrov in #1228
• auth: bind GitHub OIDC token exchange to a per-deployment audience by @rdimitrov in #1229
• docs: document GitHub OIDC audience binding for self-hosters and CI users by @rdimitrov in #1230

Full Changelog: v1.7.5...v1.7.6

v1.7.5

What's Changed

• deploy: update prod to v1.7.4 by @rdimitrov in #1226
• security: fix open redirect and add small hardening by @rdimitrov in #1227

Full Changelog: v1.7.4...v1.7.5

v1.7.4

What's Changed

• deploy: update prod to v1.7.3 by @rdimitrov in #1223
• fix(deploy): bump registry pod memory to match doubled pgxpool size by @rdimitrov in #1225

Full Changelog: v1.7.3...v1.7.4

v1.7.3

What's Changed

• deploy: update prod to v1.7.2 by @rdimitrov in #1216
• build(deps): bump github.com/pulumi/pulumi-kubernetes/sdk/v4 from 4.29.0 to 4.30.0 in /deploy by @dependabot[bot] in #1217
• build(deps): bump goreleaser/goreleaser-action from 7.1.0 to 7.2.1 in the actions group by @dependabot[bot] in #1218
• fix(list): use JSONB containment for RemoteURL filter (GIN-indexable) by @rdimitrov in #1220
• fix(db): raise pgxpool MaxConns + PG max_connections + set PG resources by @rdimitrov in #1221

Full Changelog: v1.7.2...v1.7.3

v1.7.2

What's Changed

• fix(deploy): manage Cloud Resource Manager API enablement in Pulumi by @rdimitrov in #1213
• deploy: update prod to v1.7.1 by @rdimitrov in #1212
• fix(list): use row-constructor cursor + restore per-phase publish timings + enable pg_stat_statements by @rdimitrov in #1215

Full Changelog: v1.7.1...v1.7.2

v1.7.1

What's Changed

• deploy: update prod to v1.7.0 by @rdimitrov in #1205
• fix: harden registry availability and add publish phase timings by @rdimitrov in #1211

Full Changelog: v1.7.0...v1.7.1

v1.7.0

What's Changed

• deploy: update prod to v1.6.0 by @rdimitrov in #1172
• build(deps): bump goreleaser/goreleaser-action from 7.0.0 to 7.1.0 in the actions group by @dependabot[bot] in #1189
• build(deps): bump github.com/jackc/pgx/v5 from 5.9.1 to 5.9.2 by @dependabot[bot] in #1188
• build(deps): bump github.com/go-git/go-git/v5 from 5.17.2 to 5.18.0 in /deploy by @dependabot[bot] in #1180
• build(deps): bump github.com/pulumi/pulumi-kubernetes/sdk/v4 from 4.28.0 to 4.29.0 in /deploy by @dependabot[bot] in #1177
• build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.230.0 to 3.231.0 in /deploy by @dependabot[bot] in #1176
• fix: update openapi.yml to include statusChangedAt by @jeffmaury in #1187
• docs: signpost non-npm publishers to package-types from quickstart by @AshwanthramKL in #1192
• build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.231.0 to 3.232.0 in /deploy by @dependabot[bot] in #1194
• feat(publisher): copy version from package.json and prefer mcpName in init by @JosephDoUrden in #1145
• feat(oci): add support for Quay.io registry by @mikelolasagasti in #1150
• fix(publisher): honor mcpName as the authoritative server name in init by @rdimitrov in #1195
• docs: note PostgreSQL requirement for prebuilt Docker image by @rdimitrov in #1196
• docs: recommend namespaced subkeys inside publisher-provided by @rdimitrov in #1197
• fix(auth): better DNS verification errors and wrong-selector hint by @rdimitrov in #1202
• fix: recalculate isLatest after status changes (#1081) by @rdimitrov in #1201

New Contributors

• @jeffmaury made their first contribution in #1187
• @AshwanthramKL made their first contribution in #1192
• @mikelolasagasti made their first contribution in #1150

Full Changelog: v1.6.0...v1.7.0

v1.6.0

What's Changed

• build(deps): bump the opentelemetry group with 6 updates by @dependabot[bot] in #1044
• build(deps): bump github.com/google/go-containerregistry from 0.20.7 to 0.21.2 by @dependabot[bot] in #1026
• chore(deploy): bump production image tag to 1.5.0 by @tadasant in #1043
• build(deps): bump the actions group with 2 updates by @dependabot[bot] in #1049
• Remove .mdx suffixes from internal doc links for Mintlify by @jonathanhefner in #1052
• build(deps): bump golang.org/x/mod from 0.33.0 to 0.34.0 by @dependabot[bot] in #1054
• build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.225.1 to 3.226.0 in /deploy by @dependabot[bot] in #1057
• build(deps): bump github.com/pulumi/pulumi-kubernetes/sdk/v4 from 4.27.0 to 4.28.0 in /deploy by @dependabot[bot] in #1056
• build(deps): bump github.com/danielgtaylor/huma/v2 from 2.35.0 to 2.37.2 by @dependabot[bot] in #989
• build(deps): bump github.com/google/go-containerregistry from 0.21.2 to 0.21.3 by @dependabot[bot] in #1073
• build(deps): bump google.golang.org/grpc from 1.79.1 to 1.79.3 in /deploy by @dependabot[bot] in #1077
• build(deps): bump google.golang.org/grpc from 1.78.0 to 1.79.3 by @dependabot[bot] in #1076
• Add contributing guidelines to prevent seed.json PRs by @rdimitrov in #1079
• build(deps): bump anchore/sbom-action from 0.23.1 to 0.24.0 in the actions group by @dependabot[bot] in #1085
• build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.226.0 to 3.228.0 in /deploy by @dependabot[bot] in #1094
• build(deps): bump github.com/danielgtaylor/huma/v2 from 2.37.2 to 2.37.3 by @dependabot[bot] in #1098
• build(deps): bump github.com/go-git/go-git/v5 from 5.16.5 to 5.17.1 in /deploy by @dependabot[bot] in #1104
• build(deps): bump the actions group across 1 directory with 2 updates by @dependabot[bot] in #1105
• build(deps): bump github.com/jackc/pgx/v5 from 5.8.0 to 5.9.1 by @dependabot[bot] in #1092
• build(deps): bump github.com/google/go-containerregistry from 0.21.3 to 0.21.4 by @dependabot[bot] in #1131
• build(deps): bump the opentelemetry group across 1 directory with 6 updates by @dependabot[bot] in #1134
• build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.228.0 to 3.229.0 in /deploy by @dependabot[bot] in #1112
• build(deps): bump docker/login-action from 4.0.0 to 4.1.0 in the actions group by @dependabot[bot] in #1113
• Stop pinning Go to patch versions, use stable in CI by @rdimitrov in #1137
• build(deps): bump cloud.google.com/go/kms from 1.26.0 to 1.27.0 by @dependabot[bot] in #1111
• build(deps): bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 by @dependabot[bot] in #1114
• build(deps): bump go.opentelemetry.io/otel/sdk from 1.41.0 to 1.43.0 in /deploy by @dependabot[bot] in #1139
• build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.229.0 to 3.230.0 in /deploy by @dependabot[bot] in #1141
• build(deps): bump github.com/coreos/go-oidc/v3 from 3.17.0 to 3.18.0 by @dependabot[bot] in #1140
• build(deps): bump cloud.google.com/go/kms from 1.27.0 to 1.29.0 by @dependabot[bot] in #1163
• build(deps): bump github.com/google/go-containerregistry from 0.21.4 to 0.21.5 by @dependabot[bot] in #1162
• build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 in the actions group by @dependabot[bot] in #1154
• fix: store tokens in ~/.config/mcp-publisher/ instead of cwd by @rdimitrov in #1166
• fix(publisher): omit repository when URL cannot be detected by @JosephDoUrden in #1149

New Contributors

• @JosephDoUrden made their first contribution in #1149

Full Changelog: v1.5.0...v1.6.0