Visitar URL original
Update dependency modelcontextprotocol/registry to v1.8.9 by renovate[bot] · Pull Request #451 · claytono/go-unifi-mcp · GitHub
Skip to content

Update dependency modelcontextprotocol/registry to v1.8.9 - #451

Open
renovate[bot] wants to merge 2 commits into
mainfrom
renovate/modelcontextprotocol-registry-1.x
Open

Update dependency modelcontextprotocol/registry to v1.8.9#451
renovate[bot] wants to merge 2 commits into
mainfrom
renovate/modelcontextprotocol-registry-1.x

Conversation

@renovate

@renovate renovate Bot commented Oct 29, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Update Change
modelcontextprotocol/registry patch 1.8.4 → 1.8.9

Release Notes

modelcontextprotocol/registry

v1.8.9

Compare Source

Optimize incremental-sync pagination by selecting indexed page keys before fetching payloads, while retaining prepared statement reuse. Includes staged production autoscaling configuration and deployment guardrails. See #​1840 for validation and rollout details.

v1.8.8

Compare Source

This release uses the source commit validated in staging. Different server names may now share a remote URL; consumers should key listings by server name and version rather than assuming URL uniqueness. No database migration is required.

What's Changed

Full Changelog: modelcontextprotocol/registry@v1.8.7...v1.8.8

v1.8.7

Compare Source

Adds prepared listing JSON to avoid repeated decoding and rebuilding of server payloads on listing reads. Prepared reads are disabled by default and support bounded backfill and flag rollback. Listing rows release their database connection before JSON processing; pool defaults remain 60/10.

Focused response/update/delete/backfill/rollback checks passed. Local encoding benchmarks over saved public records measured 63% less encoding time and 88% fewer allocations. These are encoding-cost results, not a peak-capacity guarantee. Broad staging replay remained inconclusive for capacity due to generator port exhaustion and losses.

v1.8.6

Compare Source

This release improves registry search performance under mixed search, pagination and publishing traffic.

  • Select search page keys through covering indexes before fetching complete records.
  • Plan searches for their actual parameter values to handle broad and rare terms reliably.
  • Optimize namespace suffix searches and require at least three Unicode characters for nonempty search terms (shorter searches return HTTP 422).
  • Include reproducible cyclic-load benchmarks and repeated staging validation against a public production-data snapshot.

Deployment: prebuild and verify migrations 016/017 indexes concurrently on busy databases. The validated burst capacity uses a 3-CPU PostgreSQL quota on the existing nodes, with the application connection pool unchanged. See deploy/README.md and tools/readbench/STAGING_SEARCH_RESULTS.md for procedure, evidence and limitations.

v1.8.5

Compare Source

This release adds production performance diagnostics: request arrivals and backlog, database pool/query metrics, and bounded slow-listing logs correlated with ingress request IDs. Slow-request logs separate connection acquisition, query/fetch waits, row decoding, and response processing, including snapshots while requests remain stuck.

It also includes publisher fixes for P-384 signatures and repository IDs, GitLab subgroup URL support, and stricter validation of incomplete repository metadata and invalid arguments. Previously stored invalid metadata may need correction when republishing or editing.

The ingress cache/timing log fields require the accompanying infrastructure rollout. Application release artifacts alone do not deploy the hosted registry. No new database migration is included.

What's Changed

New Contributors

Full Changelog: modelcontextprotocol/registry@v1.8.4...v1.8.5

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@github-actions

github-actions Bot commented Oct 29, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

modelcontextprotocol/registry (mcp-publisher) (dependency) 1.8.4 -> 1.8.9

Risk: 🟢 Safe

The Deep Dive

Update Scope

Bumps the prebuilt mcp-publisher CLI in the Nix dev shell (mkMcpPublisher in flake.nix) from 1.8.4 to 1.8.9. It changes the version and the three platform tarball hashes (darwin_arm64, linux_amd64, linux_arm64). I downloaded all three v1.8.9 assets and their SRI hashes match the diff. In this repo the only consumer is the tag-triggered Publish to MCP Registry step in .github/workflows/release.yml, which runs mcp-publisher login github-oidc && mcp-publisher publish. The Go server, the Docker image, go.mod, and every other flake tool are unchanged. Both binaries are built with go1.27.3. Most of the 82 upstream commits (compare) change the hosted registry service and its deployment, not the publisher CLI.

Features & UX

  • mcp-publisher init now records repository.id (#1570): init asks the GitHub API for the numeric repository ID so the listing still resolves after a repo rename. It only works when init runs, and this repo never runs init: server.json is checked in and has only url and source. To get the benefit you would have to add "id" to server.json by hand. Optional; nothing changes if you don't.

Security

Net effect: one vulnerability fixed and none introduced. Both binaries use the same go1.27.3 toolchain.

  • Fixed, bundled dependency: github.com/klauspost/compress goes from v1.20.1 to v1.20.3, which fixes GO-2026-6865 / GHSA-fpmh-frq8-7rj8 (panic on two-block frames, fixed in 1.20.2). I ran a source-mode govulncheck -show traces ./cmd/publisher/... at v1.8.4. It reports the vulnerable symbols as reachable, but only through a dynamic-dispatch chain (NoneProvider.GetToken → http body.Close → io.Copy → zstd.Encoder.ReadFrom → huff0/fse). I could not confirm that this path actually runs during this repo's login github-oidc + publish flow. The worst case is a crash of a one-shot CLI step in CI, which shows up as a failed release step. Because the fixed version is in 1.8.9, merging removes this exposure either way.
  • No new vulnerabilities: I ran govulncheck -mode=binary and an OSV batch lookup over all 52 embedded modules plus stdlib for both binaries. 1.8.4 reports 5 vulnerabilities and 1.8.9 reports 4, and every one in 1.8.9 is also in 1.8.4.
  • Already present in both versions (context only): GO-2026-6859 (stdlib net/http, fixed in go1.27.4), GO-2026-6860 and GO-2026-6866 (x/net/html), and GO-2026-5932 (x/crypto/openpgp). These do not affect the verdict.
  • The registry's own security advisories were all published in May 2026 and apply to the hosted service. None fall in this version range.

Key Fixes

  • ECDSA P-384 signatures are now fixed-width (#1457): roughly 1 in 128 publishes using an in-process P-384 key were rejected. Not relevant here because this repo logs in with github-oidc.
  • Stricter validation happens on the registry, not in the CLI (#1555, #1583, #1361): the registry now rejects a repository block with an empty url/source, bad argument types, and positional arguments with no value; it also accepts GitLab subgroup URLs. The CLI imports the validators package only for result types and sends the actual validation to the registry API (validateViaAPI), so these checks apply no matter which CLI version you use. This repo's server.json has both url and source and no arguments keys. It passes mcp-publisher validate against the live registry with both 1.8.4 and 1.8.9.
  • Other registry-side changes that don't affect this repo: v1.8.6 requires search terms of at least 3 characters (shorter ones get HTTP 422), which only matters to API search clients; the CLI doesn't search. #1806 lets different server names share a remote URL; this repo publishes an OCI package with no remotes.

Newer Versions

v1.8.9 is the newest release (2026-11-10), so nothing newer exists to compare against.

Hazards & Risks

None identified. The upstream behavior changes in this range are on the registry side and are covered under Key Fixes. The two CLI code changes (P-384 signing, init repository ID) are not on this repo's login github-oidc + publish path.

Sources

🟢 Verdict: Safe

Patch bump of a release-only CLI. The hashes are verified, the build toolchain is the same, no vulnerabilities are introduced and one is fixed, and the new binary validates this repo's server.json against the live registry. Routine update.

@renovate
renovate Bot force-pushed the renovate/modelcontextprotocol-registry-1.x branch 3 times, most recently from 2f189fa to 5af3f2b Compare October 30, 2026 15:27
@renovate renovate Bot changed the title Update dependency modelcontextprotocol/registry to v1.8.5 Update dependency modelcontextprotocol/registry to v1.8.6 Oct 30, 2026
@renovate
renovate Bot force-pushed the renovate/modelcontextprotocol-registry-1.x branch 12 times, most recently from 1818f49 to be9034f Compare November 2, 2026 18:13
@renovate renovate Bot changed the title Update dependency modelcontextprotocol/registry to v1.8.6 Update dependency modelcontextprotocol/registry to v1.8.7 Nov 2, 2026
@renovate
renovate Bot force-pushed the renovate/modelcontextprotocol-registry-1.x branch 10 times, most recently from 3b564d3 to d7149e2 Compare November 6, 2026 06:15
@renovate
renovate Bot force-pushed the renovate/modelcontextprotocol-registry-1.x branch from eaec33c to c3193e9 Compare November 9, 2026 15:33
@renovate renovate Bot changed the title Update dependency modelcontextprotocol/registry to v1.8.7 Update dependency modelcontextprotocol/registry to v1.8.8 Nov 9, 2026
@renovate
renovate Bot force-pushed the renovate/modelcontextprotocol-registry-1.x branch 14 times, most recently from 83e3c24 to 33c0a54 Compare November 13, 2026 17:39
@renovate renovate Bot changed the title Update dependency modelcontextprotocol/registry to v1.8.8 Update dependency modelcontextprotocol/registry to v1.8.9 Nov 13, 2026
@renovate
renovate Bot force-pushed the renovate/modelcontextprotocol-registry-1.x branch 10 times, most recently from 83902d6 to d9078fe Compare November 15, 2026 13:43
@renovate
renovate Bot force-pushed the renovate/modelcontextprotocol-registry-1.x branch from 24d0beb to 16be050 Compare November 15, 2026 17:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

renovate:evaluated renovate:safe

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants