Starstruk Logo MarkStarstruk

v1.8.0

underpig1/octosv1.8.0Jul 13, 2026by rdimitrov

AI Summary

This release introduces Cargo (crates.io) as a new package registry type, updates various dependencies including Pulumi SDK and Go libraries, and includes several security hardening and bug fixes related to validation, authentication, and API error handling.

Key Highlights

  • Added Cargo (crates.io) as a package registry type
  • Harden security: grant org namespace only to Owners, not all members
  • Fixed API CORS to allow PATCH requests so browsers can call status endpoints
  • Fixed client-cancelled GET requests returning 499 without error log
  • Updated dependencies (Pulumi SDK, Go libraries, OpenTelemetry)

New Features

  • Support for Cargo package registry
  • CORS support for PATCH requests
  • Org namespace permission restriction to Owners

Full Release Notes

## What's Changed
* deploy: update prod to v1.7.9 by @rdimitrov in https://github.com/modelcontextprotocol/registry/pull/1282
* build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.237.0 to 3.238.0 in /deploy by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/1283
* chore(deps): reduce dependabot frequency from daily to weekly by @rdimitrov in https://github.com/modelcontextprotocol/registry/pull/1284
* build(deps): bump github.com/go-git/go-git/v5 from 5.19.0 to 5.19.1 in /deploy by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/1292
* build(deps): bump github.com/google/go-containerregistry from 0.21.5 to 0.21.6 by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/1295
* build(deps): bump github.com/danielgtaylor/huma/v2 from 2.37.3 to 2.38.0 by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/1296
* build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.238.0 to 3.242.0 in /deploy by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/1297
* build(deps): bump goreleaser/goreleaser-action from 7.2.1 to 7.2.2 in the actions group by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/1299
* build(deps): bump golang.org/x/net to v0.55.0 by @rdimitrov in https://github.com/modelcontextprotocol/registry/pull/1308
* build(deps): bump github.com/pulumi/pulumi-kubernetes/sdk/v4 from 4.30.0 to 4.31.1 in /deploy by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/1298
* docs: update maintainer/collaborator matrix in README by @tadasant in https://github.com/modelcontextprotocol/registry/pull/1324
* build(deps): bump the actions group with 2 updates by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/1314
* build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.242.0 to 3.243.0 in /deploy by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/1313
* build(deps): bump github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys from 1.4.0 to 1.5.0 by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/1312
* build(deps): bump the opentelemetry group with 5 updates by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/1311
* feat: add cargo (crates.io) as a package registry type by @Wolfe-Jam in https://github.com/modelcontextprotocol/registry/pull/1207
* build(deps): bump go.opentelemetry.io/contrib/instrumentation/runtime from 0.68.0 to 0.69.0 in the opentelemetry group by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/1332
* build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.243.0 to 3.244.0 in /deploy by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/1333
* build(deps): bump github.com/jackc/pgx/v5 from 5.9.2 to 5.10.0 by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/1334
* fix(cargo): harden README fetch, clarify status handling, strengthen tests by @rdimitrov in https://github.com/modelcontextprotocol/registry/pull/1330
* fix(validators): harden mcp-name matching (PyPI/NuGet anchoring, comment-form safe) + cargo follow-ups by @rdimitrov in https://github.com/modelcontextprotocol/registry/pull/1331
* fix: client-cancelled GET /v0/servers returns 499 without error log by @advancedresearcharray in https://github.com/modelcontextprotocol/registry/pull/1335
* fix: don't leak internal error detail in GET /v0/servers 500 response by @rdimitrov in https://github.com/modelcontextprotocol/registry/pull/1338
* build(deps): bump the actions group with 2 updates by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/1392
* build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.244.0 to 3.248.0 in /deploy by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/1391
* build(deps): bump github.com/Azure/azure-sdk-for-go/sdk/azidentity from 1.13.1 to 1.14.0 by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/1375
* build(deps): bump github.com/coreos/go-oidc/v3 from 3.18.0 to 3.19.0 by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/1374
* build(deps): bump github.com/google/go-containerregistry from 0.21.6 to 0.21.7 by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/1373
* Fix broken reference documentation links by @kriptoburak in https://github.com/modelcontextprotocol/registry/pull/1387
* build(deps): bump github.com/pulumi/pulumi-kubernetes/sdk/v4 from 4.31.1 to 4.32.0 in /deploy by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/1353
* ci: auto-close PRs that try to publish servers via the repo by @rdimitrov in https://github.com/modelcontextprotocol/registry/pull/1393
* build(deps): bump golang.org/x/mod from 0.37.0 to 0.38.0 by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/1428
* build(deps): bump github.com/coreos/go-oidc/v3 from 3.19.0 to 3.20.0 by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/1429
* build(deps): bump the actions group across 1 directory with 4 updates by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/1430
* build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.248.0 to 3.251.0 in /deploy by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/1431
* fix(auth): grant org namespace only to org Owners, not all members by @tadasant in https://github.com/modelcontextprotocol/registry/pull/1383
* build(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0 by @dependabot[bot] in https://github.com/modelcontextprotocol/registry/pull/1433
* docs(auth): document fine-grained PAT permission for org publishing (+ pagination-cap test) by @rdimitrov in https://github.com/modelcontextprotocol/registry/pull/1435
* docs: add polygraph to community projects by @RubenSousaDinis in https://github.com/modelcontextprotocol/registry/pull/1421
* fix(ci): re-validate author association via REST in close-invalid-publish-prs by @rdimitrov in https://github.com/modelcontextprotocol/registry/pull/1440
* fix: reject mangled publisher metadata by @he-yufeng in https://github.com/modelcontextprotocol/registry/pull/1310
* fix(api): allow PATCH in CORS so browsers can call the status endpoints by @JosephDoUrden in https://github.com/modelcontextprotocol/registry/pull/1436
* test(api): remove placeholder CORS test superseded by #1436 by @rdimitrov in https://github.com/modelcontextprotocol/registry/pull/1441
* fix(validators): distinguish a missing package from a missing version on PyPI/NPM by @sronix in https://github.com/modelcontextprotocol/registry/pull/1411

## New Contributors
* @Wolfe-Jam made their first contribution in https://github.com/modelcontextprotocol/registry/pull/1207
* @advancedresearcharray made their first contribution in https://github.com/modelcontextprotocol/registry/pull/1335
* @kriptoburak made their first contribution in https://github.com/modelcontextprotocol/registry/pull/1387
* @RubenSousaDinis made their first contribution in https://github.com/modelcontextprotocol/registry/pull/1421
* @he-yufeng made their first contribution in https://github.com/modelcontextprotocol/registry/pull/1310
* @sronix made their first contribution in https://github.com/modelcontextprotocol/registry/pull/1411

**Full Changelog**: https://github.com/modelcontextprotocol/registry/compare/v1.7.9...v1.8.0