Starstruk Logo MarkStarstruk

v1.8.0

Vanilagy/mediabunnyv1.8.0Jul 13, 2026by rdimitrov

AI Summary

This release introduces Cargo as a new package registry type, enhances authentication security by restricting org namespace access to Owners only, and fixes several API bugs including client cancellation handling and CORS configuration.

Key Highlights

  • Added Cargo (crates.io) as a supported package registry type
  • Improved security by restricting org namespace access to org Owners only
  • Fixed API issues: client-cancelled requests now return 499 without error logs, and internal errors no longer leak in 500 responses
  • Enabled PATCH method in CORS for browser compatibility with status endpoints
  • Updated dependencies across Pulumi SDK, Go libraries, and OpenTelemetry

New Features

  • Cargo registry support
  • Org namespace permission restriction to Owners
  • CORS PATCH support for browsers

Full Release Notes

## What's Changed
* deploy: update prod to v1.7.9 by @rdimitrov in https://github.com/modelcontextprotocol/registry/pull/1282
* build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.237.0 to 3.238.0 in /deploy by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/1283
* chore(deps): reduce dependabot frequency from daily to weekly by @rdimitrov in https://github.com/modelcontextprotocol/registry/pull/1284
* build(deps): bump github.com/go-git/go-git/v5 from 5.19.0 to 5.19.1 in /deploy by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/1292
* build(deps): bump github.com/google/go-containerregistry from 0.21.5 to 0.21.6 by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/1295
* build(deps): bump github.com/danielgtaylor/huma/v2 from 2.37.3 to 2.38.0 by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/1296
* build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.238.0 to 3.242.0 in /deploy by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/1297
* build(deps): bump goreleaser/goreleaser-action from 7.2.1 to 7.2.2 in the actions group by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/1299
* build(deps): bump golang.org/x/net to v0.55.0 by @rdimitrov in https://github.com/modelcontextprotocol/registry/pull/1308
* build(deps): bump github.com/pulumi/pulumi-kubernetes/sdk/v4 from 4.30.0 to 4.31.1 in /deploy by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/1298
* docs: update maintainer/collaborator matrix in README by @tadasant in https://github.com/modelcontextprotocol/registry/pull/1324
* build(deps): bump the actions group with 2 updates by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/1314
* build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.242.0 to 3.243.0 in /deploy by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/1313
* build(deps): bump github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys from 1.4.0 to 1.5.0 by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/1312
* build(deps): bump the opentelemetry group with 5 updates by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/1311
* feat: add cargo (crates.io) as a package registry type by @Wolfe-Jam in https://github.com/modelcontextprotocol/registry/pull/1207
* build(deps): bump go.opentelemetry.io/contrib/instrumentation/runtime from 0.68.0 to 0.69.0 in the opentelemetry group by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/1332
* build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.243.0 to 3.244.0 in /deploy by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/1333
* build(deps): bump github.com/jackc/pgx/v5 from 5.9.2 to 5.10.0 by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/1334
* fix(cargo): harden README fetch, clarify status handling, strengthen tests by @rdimitrov in https://github.com/modelcontextprotocol/registry/pull/1330
* fix(validators): harden mcp-name matching (PyPI/NuGet anchoring, comment-form safe) + cargo follow-ups by @rdimitrov in https://github.com/modelcontextprotocol/registry/pull/1331
* fix: client-cancelled GET /v0/servers returns 499 without error log by @advancedresearcharray in https://github.com/modelcontextprotocol/registry/pull/1335
* fix: don't leak internal error detail in GET /v0/servers 500 response by @rdimitrov in https://github.com/modelcontextprotocol/registry/pull/1338
* build(deps): bump the actions group with 2 updates by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/1392
* build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.244.0 to 3.248.0 in /deploy by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/1391
* build(deps): bump github.com/Azure/azure-sdk-for-go/sdk/azidentity from 1.13.1 to 1.14.0 by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/1375
* build(deps): bump github.com/coreos/go-oidc/v3 from 3.18.0 to 3.19.0 by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/1374
* build(deps): bump github.com/google/go-containerregistry from 0.21.6 to 0.21.7 by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/1373
* Fix broken reference documentation links by @kriptoburak in https://github.com/modelcontextprotocol/registry/pull/1387
* build(deps): bump github.com/pulumi/pulumi-kubernetes/sdk/v4 from 4.31.1 to 4.32.0 in /deploy by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/1353
* ci: auto-close PRs that try to publish servers via the repo by @rdimitrov in https://github.com/modelcontextprotocol/registry/pull/1393
* build(deps): bump golang.org/x/mod from 0.37.0 to 0.38.0 by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/1428
* build(deps): bump github.com/coreos/go-oidc/v3 from 3.19.0 to 3.20.0 by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/1429
* build(deps): bump the actions group across 1 directory with 4 updates by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/1430
* build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.248.0 to 3.251.0 in /deploy by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/1431
* fix(auth): grant org namespace only to org Owners, not all members by @tadasant in https://github.com/modelcontextprotocol/registry/pull/1383
* build(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0 by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/1433
* docs(auth): document fine-grained PAT permission for org publishing (+ pagination-cap test) by @rdimitrov in https://github.com/modelcontextprotocol/registry/pull/1435
* docs: add polygraph to community projects by @RubenSousaDinis in https://github.com/modelcontextprotocol/registry/pull/1421
* fix(ci): re-validate author association via REST in close-invalid-publish-prs by @rdimitrov in https://github.com/modelcontextprotocol/registry/pull/1440
* fix: reject mangled publisher metadata by @he-yufeng in https://github.com/modelcontextprotocol/registry/pull/1310
* fix(api): allow PATCH in CORS so browsers can call the status endpoints by @JosephDoUrden in https://github.com/modelcontextprotocol/registry/pull/1436
* test(api): remove placeholder CORS test superseded by #1436 by @rdimitrov in https://github.com/modelcontextprotocol/registry/pull/1441
* fix(validators): distinguish a missing package from a missing version on PyPI/NPM by @sronix in https://github.com/modelcontextprotocol/registry/pull/1411

## New Contributors
* @Wolfe-Jam made their first contribution in https://github.com/modelcontextprotocol/registry/pull/1207
* @advancedresearcharray made their first contribution in https://github.com/modelcontextprotocol/registry/pull/1335
* @kriptoburak made their first contribution in https://github.com/modelcontextprotocol/registry/pull/1387
* @RubenSousaDinis made their first contribution in https://github.com/modelcontextprotocol/registry/pull/1421
* @he-yufeng made their first contribution in https://github.com/modelcontextprotocol/registry/pull/1310
* @sronix made their first contribution in https://github.com/modelcontextprotocol/registry/pull/1411

**Full Changelog**: https://github.com/modelcontextprotocol/registry/compare/v1.7.9...v1.8.0