What's Changed

• deploy: update prod to v1.7.9 by @rdimitrov in #1282
• build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.237.0 to 3.238.0 in /deploy by @dependabot[bot] in #1283
• chore(deps): reduce dependabot frequency from daily to weekly by @rdimitrov in #1284
• build(deps): bump github.com/go-git/go-git/v5 from 5.19.0 to 5.19.1 in /deploy by @dependabot[bot] in #1292
• build(deps): bump github.com/google/go-containerregistry from 0.21.5 to 0.21.6 by @dependabot[bot] in #1295
• build(deps): bump github.com/danielgtaylor/huma/v2 from 2.37.3 to 2.38.0 by @dependabot[bot] in #1296
• build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.238.0 to 3.242.0 in /deploy by @dependabot[bot] in #1297
• build(deps): bump goreleaser/goreleaser-action from 7.2.1 to 7.2.2 in the actions group by @dependabot[bot] in #1299
• build(deps): bump golang.org/x/net to v0.55.0 by @rdimitrov in #1308
• build(deps): bump github.com/pulumi/pulumi-kubernetes/sdk/v4 from 4.30.0 to 4.31.1 in /deploy by @dependabot[bot] in #1298
• docs: update maintainer/collaborator matrix in README by @tadasant in #1324
• build(deps): bump the actions group with 2 updates by @dependabot[bot] in #1314
• build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.242.0 to 3.243.0 in /deploy by @dependabot[bot] in #1313
• build(deps): bump github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys from 1.4.0 to 1.5.0 by @dependabot[bot] in #1312
• build(deps): bump the opentelemetry group with 5 updates by @dependabot[bot] in #1311
• feat: add cargo (crates.io) as a package registry type by @Wolfe-Jam in #1207
• build(deps): bump go.opentelemetry.io/contrib/instrumentation/runtime from 0.68.0 to 0.69.0 in the opentelemetry group by @dependabot[bot] in #1332
• build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.243.0 to 3.244.0 in /deploy by @dependabot[bot] in #1333
• build(deps): bump github.com/jackc/pgx/v5 from 5.9.2 to 5.10.0 by @dependabot[bot] in #1334
• fix(cargo): harden README fetch, clarify status handling, strengthen tests by @rdimitrov in #1330
• fix(validators): harden mcp-name matching (PyPI/NuGet anchoring, comment-form safe) + cargo follow-ups by @rdimitrov in #1331
• fix: client-cancelled GET /v0/servers returns 499 without error log by @advancedresearcharray in #1335
• fix: don't leak internal error detail in GET /v0/servers 500 response by @rdimitrov in #1338
• build(deps): bump the actions group with 2 updates by @dependabot[bot] in #1392
• build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.244.0 to 3.248.0 in /deploy by @dependabot[bot] in #1391
• build(deps): bump github.com/Azure/azure-sdk-for-go/sdk/azidentity from 1.13.1 to 1.14.0 by @dependabot[bot] in #1375
• build(deps): bump github.com/coreos/go-oidc/v3 from 3.18.0 to 3.19.0 by @dependabot[bot] in #1374
• build(deps): bump github.com/google/go-containerregistry from 0.21.6 to 0.21.7 by @dependabot[bot] in #1373
• Fix broken reference documentation links by @kriptoburak in #1387
• build(deps): bump github.com/pulumi/pulumi-kubernetes/sdk/v4 from 4.31.1 to 4.32.0 in /deploy by @dependabot[bot] in #1353
• ci: auto-close PRs that try to publish servers via the repo by @rdimitrov in #1393
• build(deps): bump golang.org/x/mod from 0.37.0 to 0.38.0 by @dependabot[bot] in #1428
• build(deps): bump github.com/coreos/go-oidc/v3 from 3.19.0 to 3.20.0 by @dependabot[bot] in #1429
• build(deps): bump the actions group across 1 directory with 4 updates by @dependabot[bot] in #1430
• build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.248.0 to 3.251.0 in /deploy by @dependabot[bot] in #1431
• fix(auth): grant org namespace only to org Owners, not all members by @tadasant in #1383
• build(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0 by @dependabot[bot] in #1433
• docs(auth): document fine-grained PAT permission for org publishing (+ pagination-cap test) by @rdimitrov in #1435
• docs: add polygraph to community projects by @RubenSousaDinis in #1421
• fix(ci): re-validate author association via REST in close-invalid-publish-prs by @rdimitrov in #1440
• fix: reject mangled publisher metadata by @he-yufeng in #1310
• fix(api): allow PATCH in CORS so browsers can call the status endpoints by @JosephDoUrden in #1436
• test(api): remove placeholder CORS test superseded by #1436 by @rdimitrov in #1441
• fix(validators): distinguish a missing package from a missing version on PyPI/NPM by @sronix in #1411

New Contributors

• @Wolfe-Jam made their first contribution in #1207
• @advancedresearcharray made their first contribution in #1335
• @kriptoburak made their first contribution in #1387
• @RubenSousaDinis made their first contribution in #1421
• @he-yufeng made their first contribution in #1310
• @sronix made their first contribution in #1411

Full Changelog: v1.7.9...v1.8.0

What's Changed

• deploy: update prod to v1.7.8 by @rdimitrov in #1256
• build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.234.0 to 3.235.0 in /deploy by @dependabot[bot] in #1259
• docs: add ToolHive Registry Server to community projects by @rdimitrov in #1261
• docs(authentication): note OpenSSL 3.x requirement for Ed25519 by @rhinocap in #1253
• build(deps): bump golang.org/x/net from v0.52.0 to v0.53.0 by @rdimitrov in #1269
• build(deps): bump cloud.google.com/go/kms from 1.30.0 to 1.31.0 by @dependabot[bot] in #1263
• build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.235.0 to 3.236.0 in /deploy by @dependabot[bot] in #1264
• build(deps): bump sigstore/cosign-installer from 4.1.1 to 4.1.2 in the actions group by @dependabot[bot] in #1265
• build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.236.0 to 3.237.0 in /deploy by @dependabot[bot] in #1272
• build(deps): bump golang.org/x/mod from 0.35.0 to 0.36.0 by @dependabot[bot] in #1271
• docs(complete): align publish CLI flags with implementation (closes #767) by @voidborne-d in #1278
• build(deps): bump github.com/go-git/go-git/v5 from 5.18.0 to 5.19.0 in /deploy by @dependabot[bot] in #1279
• fix(validators/oci): fail closed on upstream rate limiting by @rdimitrov in #1281

New Contributors

• @rhinocap made their first contribution in #1253
• @voidborne-d made their first contribution in #1278

Full Changelog: v1.7.8...v1.7.9

What's Changed

• deploy: update prod to v1.7.7 by @rdimitrov in #1251
• build(deps): bump pulumi/actions from 6.6.1 to 7.0.0 in the actions group by @dependabot[bot] in #1254
• metrics: stop counting client-cancelled requests as server errors by @rdimitrov in #1255

Full Changelog: v1.7.7...v1.7.8

What's Changed

• deploy: update prod to v1.7.6 by @rdimitrov in #1232
• build(deps): bump cloud.google.com/go/kms from 1.29.0 to 1.30.0 by @dependabot[bot] in #1233
• build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.232.0 to 3.233.0 in /deploy by @dependabot[bot] in #1234
• build(deps): bump github.com/caarlos0/env/v11 from 11.4.0 to 11.4.1 by @dependabot[bot] in #1236
• build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.233.0 to 3.234.0 in /deploy by @dependabot[bot] in #1237
• auth/oidc: support slice-typed extra claims via overlap match by @SAY-5 in #1238
• auth/oidc: test slice-typed extra claims comparison by @rdimitrov in #1245
• refactor: extract readBody helper to remove duplicate io.ReadAll calls by @mesutoezdil in #1241
• refactor: rename readBody to readErrorBody and cap body size by @rdimitrov in #1246
• fix(ui): encode publisher-controlled URLs for href attribute context by @rdimitrov in #1248
• fix(validators): reject HTML metacharacters and whitespace in websiteUrl by @rdimitrov in #1249
• fix(auth/http): extend SSRF blocklist to IPv6 6to4/NAT64/site-local prefixes by @rdimitrov in #1250

New Contributors

• @SAY-5 made their first contribution in #1238
• @mesutoezdil made their first contribution in #1241

Full Changelog: v1.7.6...v1.7.7

What's Changed

• deploy: update prod to v1.7.5 by @rdimitrov in #1228
• auth: bind GitHub OIDC token exchange to a per-deployment audience by @rdimitrov in #1229
• docs: document GitHub OIDC audience binding for self-hosters and CI users by @rdimitrov in #1230

Full Changelog: v1.7.5...v1.7.6

What's Changed

• deploy: update prod to v1.7.4 by @rdimitrov in #1226
• security: fix open redirect and add small hardening by @rdimitrov in #1227

Full Changelog: v1.7.4...v1.7.5

What's Changed

• deploy: update prod to v1.7.3 by @rdimitrov in #1223
• fix(deploy): bump registry pod memory to match doubled pgxpool size by @rdimitrov in #1225

Full Changelog: v1.7.3...v1.7.4

What's Changed

• deploy: update prod to v1.7.2 by @rdimitrov in #1216
• build(deps): bump github.com/pulumi/pulumi-kubernetes/sdk/v4 from 4.29.0 to 4.30.0 in /deploy by @dependabot[bot] in #1217
• build(deps): bump goreleaser/goreleaser-action from 7.1.0 to 7.2.1 in the actions group by @dependabot[bot] in #1218
• fix(list): use JSONB containment for RemoteURL filter (GIN-indexable) by @rdimitrov in #1220
• fix(db): raise pgxpool MaxConns + PG max_connections + set PG resources by @rdimitrov in #1221

Full Changelog: v1.7.2...v1.7.3

What's Changed

• fix(deploy): manage Cloud Resource Manager API enablement in Pulumi by @rdimitrov in #1213
• deploy: update prod to v1.7.1 by @rdimitrov in #1212
• fix(list): use row-constructor cursor + restore per-phase publish timings + enable pg_stat_statements by @rdimitrov in #1215

Full Changelog: v1.7.1...v1.7.2

What's Changed

• deploy: update prod to v1.7.0 by @rdimitrov in #1205
• fix: harden registry availability and add publish phase timings by @rdimitrov in #1211

Full Changelog: v1.7.0...v1.7.1