Starstruk Logo MarkStarstruk

v1.7.7

underpig1/octosv1.7.7May 4, 2026by rdimitrov

AI Summary

This release includes dependency updates, OIDC improvements, security fixes, and refactoring of request handling code.

Key Highlights

  • Bumped cloud.google.com/go/kms and Go versions.
  • Added support for slice-typed extra claims via overlap match in OIDC.
  • Refactored `readBody` helper to remove duplicate I/O calls.
  • Fixed encoding of publisher-controlled URLs.
  • Extended SSRF blocklist to include IPv6 6to4/NAT64/site-local prefixes.
  • Added validation to reject HTML metacharacters in websiteUrl.

New Features

  • OIDC slice-typed extra claims support
  • Refactored readBody helper
  • URL encoding fix
  • HTML metacharacter validation
  • IPv6 SSRF blocklist extension

Full Release Notes

## What's Changed
* deploy: update prod to v1.7.6 by @rdimitrov in https://github.com/modelcontextprotocol/registry/pull/1232
* build(deps): bump cloud.google.com/go/kms from 1.29.0 to 1.30.0 by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/1233
* build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.232.0 to 3.233.0 in /deploy by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/1234
* build(deps): bump github.com/caarlos0/env/v11 from 11.4.0 to 11.4.1 by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/1236
* build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.233.0 to 3.234.0 in /deploy by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/1237
* auth/oidc: support slice-typed extra claims via overlap match by @SAY-5 in https://github.com/modelcontextprotocol/registry/pull/1238
* auth/oidc: test slice-typed extra claims comparison by @rdimitrov in https://github.com/modelcontextprotocol/registry/pull/1245
* refactor: extract readBody helper to remove duplicate io.ReadAll calls by @mesutoezdil in https://github.com/modelcontextprotocol/registry/pull/1241
* refactor: rename readBody to readErrorBody and cap body size by @rdimitrov in https://github.com/modelcontextprotocol/registry/pull/1246
* fix(ui): encode publisher-controlled URLs for href attribute context by @rdimitrov in https://github.com/modelcontextprotocol/registry/pull/1248
* fix(validators): reject HTML metacharacters and whitespace in websiteUrl by @rdimitrov in https://github.com/modelcontextprotocol/registry/pull/1249
* fix(auth/http): extend SSRF blocklist to IPv6 6to4/NAT64/site-local prefixes by @rdimitrov in https://github.com/modelcontextprotocol/registry/pull/1250

## New Contributors
* @SAY-5 made their first contribution in https://github.com/modelcontextprotocol/registry/pull/1238
* @mesutoezdil made their first contribution in https://github.com/modelcontextprotocol/registry/pull/1241

**Full Changelog**: https://github.com/modelcontextprotocol/registry/compare/v1.7.6...v1.7.7