Optimize incremental-sync pagination by selecting indexed page keys before fetching payloads, while retaining prepared statement reuse. Includes staged production autoscaling configuration and deployment guardrails. See #1840 for validation and rollout details.

This release uses the source commit validated in staging. Different server names may now share a remote URL; consumers should key listings by server name and version rather than assuming URL uniqueness. No database migration is required.

What's Changed

• Stage v1.8.7 in production with prepared reads disabled by @rdimitrov in #1769
• Enable prepared listing JSON after production backfill by @rdimitrov in #1770
• Prepare bounded app autoscaling with worker headroom by @rdimitrov in #1772
• Add sanitized apply diagnostics and a guarded retry path by @rdimitrov in #1774
• Filter deployment diagnostics to actual error events by @rdimitrov in #1775
• fix(deploy): preserve saved-plan checks across targeted dependency metadata by @rdimitrov in #1776
• fix(deploy): use explicit CRD dependencies for backup chart by @rdimitrov in #1777
• feat(deploy): activate bounded production app autoscaling by @rdimitrov in #1779
• Reduce idle staging capacity with guarded autoscaling minimums by @rdimitrov in #1781
• Handle removed chart budgets in staging capacity updates by @rdimitrov in #1782
• build(deps): bump the go-dependencies group with 2 updates by @dependabot[bot] in #1761
• build(deps): bump docker/login-action from 4.6.0 to 4.7.0 in the github-actions group by @dependabot[bot] in #1762
• build(deps): bump github.com/go-jose/go-jose/v4 from 4.1.4 to 4.1.6 by @dependabot[bot] in #1763
• build(deps): bump github.com/go-jose/go-jose/v4 from 4.1.4 to 4.1.6 in /deploy by @dependabot[bot] in #1764
• build(deps): bump the deploy-go-dependencies group across 1 directory with 2 updates by @dependabot[bot] in #1773
• Bound ingress scaling with matching worker headroom by @rdimitrov in #1790
• Restore ingress reservation while retaining scaling headroom by @rdimitrov in #1791
• Increase production burst ceilings without changing baseline capacity by @rdimitrov in #1793
• Prepare smaller always-on staging and guarded node rightsizing by @rdimitrov in #1794
• Resize prepared staging to two e2-standard-2 nodes by @rdimitrov in #1795
• Compress public listing JSON and sample successful access logs in staging by @rdimitrov in #1798
• Enable public listing compression and selective log retention in production by @rdimitrov in #1799
• docs: clarify production preview access by @rdimitrov in #1800
• fix(infra): qualify patched controllers and Grafana in staging by @rdimitrov in #1801
• fix(infra): exclude completed admission hooks from saved-plan upgrades by @rdimitrov in #1802
• fix(infra): constrain the new CRD reference in saved plans by @rdimitrov in #1804
• fix(infra): promote security patches to production by @rdimitrov in #1803
• Allow remote URLs to be shared across server names by @rdimitrov in #1806
• build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.272.0 to 3.273.0 in /deploy in the deploy-go-dependencies group by @dependabot[bot] in #1796
• Restore normal staging and production release flow by @rdimitrov in #1809
• Refresh state before applying saved deployment plans by @rdimitrov in #1810

Full Changelog: v1.8.7...v1.8.8

Adds prepared listing JSON to avoid repeated decoding and rebuilding of server payloads on listing reads. Prepared reads are disabled by default and support bounded backfill and flag rollback. Listing rows release their database connection before JSON processing; pool defaults remain 60/10.

Focused response/update/delete/backfill/rollback checks passed. Local encoding benchmarks over saved public records measured 63% less encoding time and 88% fewer allocations. These are encoding-cost results, not a peak-capacity guarantee. Broad staging replay remained inconclusive for capacity due to generator port exhaustion and losses.

This release improves registry search performance under mixed search, pagination and publishing traffic.

• Select search page keys through covering indexes before fetching complete records.
• Plan searches for their actual parameter values to handle broad and rare terms reliably.
• Optimize namespace suffix searches and require at least three Unicode characters for nonempty search terms (shorter searches return HTTP 422).
• Include reproducible cyclic-load benchmarks and repeated staging validation against a public production-data snapshot.

Deployment: prebuild and verify migrations 016/017 indexes concurrently on busy databases. The validated burst capacity uses a 3-CPU PostgreSQL quota on the existing nodes, with the application connection pool unchanged. See deploy/README.md and tools/readbench/STAGING_SEARCH_RESULTS.md for procedure, evidence and limitations.

This release adds production performance diagnostics: request arrivals and backlog, database pool/query metrics, and bounded slow-listing logs correlated with ingress request IDs. Slow-request logs separate connection acquisition, query/fetch waits, row decoding, and response processing, including snapshots while requests remain stuck.

It also includes publisher fixes for P-384 signatures and repository IDs, GitLab subgroup URL support, and stricter validation of incomplete repository metadata and invalid arguments. Previously stored invalid metadata may need correction when republishing or editing.

The ingress cache/timing log fields require the accompanying infrastructure rollout. Application release artifacts alone do not deploy the hosted registry. No new database migration is included.

What's Changed

• chore(deploy): promote production to 1.8.4 by @rdimitrov in #1732
• fix(publisher): pad ECDSA P-384 signature to fixed width by @JosephDoUrden in #1457
• fix(validators): reject incomplete repository metadata by @samrusani in #1555
• fix(validators): allow GitLab repository URLs with nested subgroups by @anneheartrecord in #1361
• fix(validators): reject invalid argument types and empty positional arguments by @JosephDoUrden in #1583
• fix(publisher): record repository.id at init so renames stay resolvable by @UgaTheDev in #1570
• docs(security): pin and verify mcp-publisher installer by @sys-ops-node in #1523
• docs(auth): document HTTP verification requirements and pin them with tests by @ump45nose in #1640
• docs(publishing): troubleshooting for DNS/HTTP auth (#845) by @rhinocap in #1268
• docs(api): clarify per-version listings and latest filtering by @rdimitrov in #1735
• docs: add ProtocolProbe to community projects by @Sultan57git in #1736
• fix(deploy): reduce ingress restarts under load by @rdimitrov in #1737
• deploy: promote ingress stability fixes to production by @rdimitrov in #1738
• deploy: upgrade GKE boot disks to 50 GB balanced storage by @rdimitrov in #1739
• deploy: promote balanced node disks to production by @rdimitrov in #1740
• feat(observability): expose request backlog and database waits by @rdimitrov in #1742
• feat(observability): diagnose individual slow listing requests by @rdimitrov in #1743

New Contributors

• @samrusani made their first contribution in #1555
• @anneheartrecord made their first contribution in #1361
• @UgaTheDev made their first contribution in #1570
• @sys-ops-node made their first contribution in #1523
• @ump45nose made their first contribution in #1640
• @Sultan57git made their first contribution in #1736

Full Changelog: v1.8.4...v1.8.5

What's Changed

• chore(deploy): promote production to 1.8.3 by @rdimitrov in #1731
• fix(publish): validate registries outside the transaction and time the pool wait by @rdimitrov in #1562

Full Changelog: v1.8.3...v1.8.4

What's Changed

• chore(deploy): promote production to 1.8.2 by @rdimitrov in #1729
• fix(publish): correct misleading org-namespace guidance in 403 and docs by @rdimitrov in #1483
• fix(database): index server name substring searches by @rdimitrov in #1730

Full Changelog: v1.8.2...v1.8.3

What's Changed

• chore(deploy): promote production to 1.8.1 by @rdimitrov in #1510
• Fix broken relative links in releasing docs by @latent-9 in #1517
• build(deps): bump github.com/go-git/go-git/v6 from 6.0.0-alpha.4 to 6.0.0-alpha.5 in /deploy by @dependabot[bot] in #1514
• docs: add cargo and crates.io to schema examples by @Wolfe-Jam in #1511
• fix(admin): use PATCH status endpoints in takedown script and runbook by @rdimitrov in #1518
• fix(publisher): document --algorithm for ECDSA login and fix validate --help by @rdimitrov in #1519
• docs(deploy): correct config parameter names in deploy README by @rdimitrov in #1521
• docs: correct contributor prerequisites and stale dev-env references by @rdimitrov in #1520
• docs: remove stale complete.md and fix remaining stale references by @rdimitrov in #1522
• build(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.0 by @dependabot[bot] in #1554
• build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.255.0 to 3.257.0 in /deploy by @dependabot[bot] in #1553
• build(deps): bump golang.org/x/mod from 0.38.0 to 0.40.0 by @dependabot[bot] in #1552
• ci: bump golangci-lint to v2.13.1 to fix panic on Go 1.27 by @rdimitrov in #1561
• ci: widen the publish-attempt path list by @rdimitrov in #1560
• build(deps): bump github.com/google/go-containerregistry from 0.21.8 to 0.21.9 by @dependabot[bot] in #1531
• build(deps): bump the opentelemetry group across 1 directory with 6 updates by @dependabot[bot] in #1530
• build(deps): bump anchore/sbom-action from 0.24.0 to 0.24.2 in the actions group by @dependabot[bot] in #1610
• build(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.1 in /deploy by @dependabot[bot] in #1617
• build(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.1 by @dependabot[bot] in #1616
• build(deps): bump github.com/pulumi/pulumi-kubernetes/sdk/v4 from 4.33.0 to 4.34.0 in /deploy by @dependabot[bot] in #1609
• build(deps): bump github.com/Azure/azure-sdk-for-go/sdk/azidentity from 1.14.0 to 1.14.1 by @dependabot[bot] in #1608
• build(deps): bump the opentelemetry group across 1 directory with 6 updates by @dependabot[bot] in #1607
• build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.259.0 to 3.261.0 in /deploy by @dependabot[bot] in #1606
• build(deps): bump github.com/google/go-containerregistry from 0.21.9 to 0.22.0 by @dependabot[bot] in #1576
• chore: group Dependabot updates by @rdimitrov in #1618
• build(deps): bump github.com/coreos/go-oidc/v3 from 3.20.0 to 3.21.0 in the go-dependencies group by @dependabot[bot] in #1619
• docs: carry two modelcontextprotocol.io fixes back upstream by @koic in #1590
• docs: add PulseFeed MCP Drift Watch to community projects by @Nikolife2016 in #1581
• ci: detect more invalid server publish paths by @rdimitrov in #1620
• fix: identify submitted server version in publish diagnostics by @rdimitrov in #1621
• test: isolates temp test fixtures by @yowainwright in #1569
• fix: fail safely in registry admin scripts by @rdimitrov in #1622
• build(deps): bump the go-dependencies group with 2 updates by @dependabot[bot] in #1634
• build(deps): bump google.golang.org/grpc from 1.83.1 to 1.83.2 in /deploy by @dependabot[bot] in #1630
• fix(publisher): treat GitHub device-flow slow_down as retriable by @developer-ishan in #1290
• fix(publisher): tolerate transient device-flow failures during login polling by @JosephDoUrden in #1588
• Add mcpscore to the list of community projects that can be used to assess the quality of mcp servers in the registry by @a-akimov in #1661
• build(deps): bump the deploy-go-dependencies group in /deploy with 2 updates by @dependabot[bot] in #1647
• build(deps): bump github.com/jackc/pgx/v5 from 5.10.0 to 5.11.0 in the go-dependencies group by @dependabot[bot] in #1646
• build(deps): bump the deploy-go-dependencies group across 1 directory with 2 updates by @dependabot[bot] in #1680
• build(deps): bump cloud.google.com/go/kms from 1.33.0 to 1.34.0 in the go-dependencies group by @dependabot[bot] in #1667
• docs: fix copy-paste path in publishing quickstart by @taekop in #1665
• docs(quickstart): document remote-only publishing by @baochipham942-eng in #1674
• docs: clarify remote-only ownership verification by @rdimitrov in #1687
• fix(ui): keep search above recently updated servers by @Shoryamishra61 in #1686
• fix(ui): collapse recently updated and hide it during search by @rdimitrov in #1690
• build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.265.0 to 3.267.0 in /deploy in the deploy-go-dependencies group by @dependabot[bot] in #1695
• build(deps): bump the go-dependencies group with 7 updates by @dependabot[bot] in #1696
• build(deps): bump anchore/sbom-action from 0.24.2 to 0.24.3 in the github-actions group by @dependabot[bot] in #1697
• Catch nested server.json publish PRs and clarify publishing guidance by @rdimitrov in #1702
• build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.267.0 to 3.268.0 in /deploy in the deploy-go-dependencies group by @dependabot[bot] in #1710
• build(deps): bump the github-actions group across 1 directory with 3 updates by @dependabot[bot] in #1723
• Add MCP Verify to community projects by @MCPVerifyLabs in #1714
• build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.268.0 to 3.270.0 in /deploy in the deploy-go-dependencies group across 1 directory by @dependabot[bot] in #1722
• build(deps): bump the go-dependencies group across 1 directory with 3 updates by @dependabot[bot] in #1721
• Make registry database backups consistent and verifiable by @rdimitrov in #1726
• docs: add PlugVet to community projects by @nucleus777 in #1716
• feat(ui): display server icons in the registry web client by @tounsils in #1586
• fix(deploy): remove retired K8up schedule to prevent operator crashes by @rdimitrov in #1727
• fix(ui): respect display density and default icon sizes by @rdimitrov in #1728

New Contributors

• @koic made their first contribution in #1590
• @Nikolife2016 made their first contribution in #1581
• @yowainwright made their first contribution in #1569
• @developer-ishan made their first contribution in #1290
• @a-akimov made their first contribution in #1661
• @taekop made their first contribution in #1665
• @baochipham942-eng made their first contribution in #1674
• @Shoryamishra61 made their first contribution in https://github.com/modelcontextproto...

What's Changed

• deploy: update prod to v1.8.0 by @rdimitrov in #1443
• build(deps): bump cloud.google.com/go/kms from 1.31.0 to 1.32.0 by @dependabot[bot] in #1447
• build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.251.0 to 3.253.0 in /deploy by @dependabot[bot] in #1448
• fix(deps): bump golang.org/x/text to v0.39.0 (GO-2026-5970) by @rdimitrov in #1481
• build(deps): bump google.golang.org/grpc from 1.81.1 to 1.82.1 in /deploy by @dependabot[bot] in #1480
• build(deps): consolidate open dependabot updates by @rdimitrov in #1482
• build(deps): bump github.com/google/go-containerregistry from 0.21.7 to 0.21.8 by @dependabot[bot] in #1507
• docs: remove Tadas as WG Lead by @tadasant in #1493
• build(deps): bump github.com/danielgtaylor/huma/v2 from 2.39.0 to 2.39.1 by @dependabot[bot] in #1489
• build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.253.0 to 3.255.0 in /deploy by @dependabot[bot] in #1490
• build(deps): bump cloud.google.com/go/kms from 1.32.0 to 1.33.0 by @dependabot[bot] in #1491
• build(deps): bump docker/login-action from 4.4.0 to 4.6.0 in the actions group by @dependabot[bot] in #1492
• fix(auth): reject github.io domains in DNS/HTTP token exchange (org namespace takeover) by @SashaMIT in #1506
• docs: remove stale build.sh reference from publisher Key Files by @latent-9 in #1504
• fix(deploy): cache bulk registry reads by @rdimitrov in #1509

New Contributors

• @SashaMIT made their first contribution in #1506
• @latent-9 made their first contribution in #1504

Full Changelog: v1.8.0...v1.8.1

What's Changed

• deploy: update prod to v1.7.9 by @rdimitrov in #1282
• build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.237.0 to 3.238.0 in /deploy by @dependabot[bot] in #1283
• chore(deps): reduce dependabot frequency from daily to weekly by @rdimitrov in #1284
• build(deps): bump github.com/go-git/go-git/v5 from 5.19.0 to 5.19.1 in /deploy by @dependabot[bot] in #1292
• build(deps): bump github.com/google/go-containerregistry from 0.21.5 to 0.21.6 by @dependabot[bot] in #1295
• build(deps): bump github.com/danielgtaylor/huma/v2 from 2.37.3 to 2.38.0 by @dependabot[bot] in #1296
• build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.238.0 to 3.242.0 in /deploy by @dependabot[bot] in #1297
• build(deps): bump goreleaser/goreleaser-action from 7.2.1 to 7.2.2 in the actions group by @dependabot[bot] in #1299
• build(deps): bump golang.org/x/net to v0.55.0 by @rdimitrov in #1308
• build(deps): bump github.com/pulumi/pulumi-kubernetes/sdk/v4 from 4.30.0 to 4.31.1 in /deploy by @dependabot[bot] in #1298
• docs: update maintainer/collaborator matrix in README by @tadasant in #1324
• build(deps): bump the actions group with 2 updates by @dependabot[bot] in #1314
• build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.242.0 to 3.243.0 in /deploy by @dependabot[bot] in #1313
• build(deps): bump github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys from 1.4.0 to 1.5.0 by @dependabot[bot] in #1312
• build(deps): bump the opentelemetry group with 5 updates by @dependabot[bot] in #1311
• feat: add cargo (crates.io) as a package registry type by @Wolfe-Jam in #1207
• build(deps): bump go.opentelemetry.io/contrib/instrumentation/runtime from 0.68.0 to 0.69.0 in the opentelemetry group by @dependabot[bot] in #1332
• build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.243.0 to 3.244.0 in /deploy by @dependabot[bot] in #1333
• build(deps): bump github.com/jackc/pgx/v5 from 5.9.2 to 5.10.0 by @dependabot[bot] in #1334
• fix(cargo): harden README fetch, clarify status handling, strengthen tests by @rdimitrov in #1330
• fix(validators): harden mcp-name matching (PyPI/NuGet anchoring, comment-form safe) + cargo follow-ups by @rdimitrov in #1331
• fix: client-cancelled GET /v0/servers returns 499 without error log by @advancedresearcharray in #1335
• fix: don't leak internal error detail in GET /v0/servers 500 response by @rdimitrov in #1338
• build(deps): bump the actions group with 2 updates by @dependabot[bot] in #1392
• build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.244.0 to 3.248.0 in /deploy by @dependabot[bot] in #1391
• build(deps): bump github.com/Azure/azure-sdk-for-go/sdk/azidentity from 1.13.1 to 1.14.0 by @dependabot[bot] in #1375
• build(deps): bump github.com/coreos/go-oidc/v3 from 3.18.0 to 3.19.0 by @dependabot[bot] in #1374
• build(deps): bump github.com/google/go-containerregistry from 0.21.6 to 0.21.7 by @dependabot[bot] in #1373
• Fix broken reference documentation links by @kriptoburak in #1387
• build(deps): bump github.com/pulumi/pulumi-kubernetes/sdk/v4 from 4.31.1 to 4.32.0 in /deploy by @dependabot[bot] in #1353
• ci: auto-close PRs that try to publish servers via the repo by @rdimitrov in #1393
• build(deps): bump golang.org/x/mod from 0.37.0 to 0.38.0 by @dependabot[bot] in #1428
• build(deps): bump github.com/coreos/go-oidc/v3 from 3.19.0 to 3.20.0 by @dependabot[bot] in #1429
• build(deps): bump the actions group across 1 directory with 4 updates by @dependabot[bot] in #1430
• build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.248.0 to 3.251.0 in /deploy by @dependabot[bot] in #1431
• fix(auth): grant org namespace only to org Owners, not all members by @tadasant in #1383
• build(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0 by @dependabot[bot] in #1433
• docs(auth): document fine-grained PAT permission for org publishing (+ pagination-cap test) by @rdimitrov in #1435
• docs: add polygraph to community projects by @RubenSousaDinis in #1421
• fix(ci): re-validate author association via REST in close-invalid-publish-prs by @rdimitrov in #1440
• fix: reject mangled publisher metadata by @he-yufeng in #1310
• fix(api): allow PATCH in CORS so browsers can call the status endpoints by @JosephDoUrden in #1436
• test(api): remove placeholder CORS test superseded by #1436 by @rdimitrov in #1441
• fix(validators): distinguish a missing package from a missing version on PyPI/NPM by @sronix in #1411

New Contributors

• @Wolfe-Jam made their first contribution in #1207
• @advancedresearcharray made their first contribution in #1335
• @kriptoburak made their first contribution in #1387
• @RubenSousaDinis made their first contribution in #1421
• @he-yufeng made their first contribution in #1310
• @sronix made their first contribution in #1411

Full Changelog: v1.7.9...v1.8.0