v1.8.0

What's Changed

• deploy: update prod to v1.7.9 by @rdimitrov in #1282
• build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.237.0 to 3.238.0 in /deploy by @dependabot[bot] in #1283
• chore(deps): reduce dependabot frequency from daily to weekly by @rdimitrov in #1284
• build(deps): bump github.com/go-git/go-git/v5 from 5.19.0 to 5.19.1 in /deploy by @dependabot[bot] in #1292
• build(deps): bump github.com/google/go-containerregistry from 0.21.5 to 0.21.6 by @dependabot[bot] in #1295
• build(deps): bump github.com/danielgtaylor/huma/v2 from 2.37.3 to 2.38.0 by @dependabot[bot] in #1296
• build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.238.0 to 3.242.0 in /deploy by @dependabot[bot] in #1297
• build(deps): bump goreleaser/goreleaser-action from 7.2.1 to 7.2.2 in the actions group by @dependabot[bot] in #1299
• build(deps): bump golang.org/x/net to v0.55.0 by @rdimitrov in #1308
• build(deps): bump github.com/pulumi/pulumi-kubernetes/sdk/v4 from 4.30.0 to 4.31.1 in /deploy by @dependabot[bot] in #1298
• docs: update maintainer/collaborator matrix in README by @tadasant in #1324
• build(deps): bump the actions group with 2 updates by @dependabot[bot] in #1314
• build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.242.0 to 3.243.0 in /deploy by @dependabot[bot] in #1313
• build(deps): bump github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys from 1.4.0 to 1.5.0 by @dependabot[bot] in #1312
• build(deps): bump the opentelemetry group with 5 updates by @dependabot[bot] in #1311
• feat: add cargo (crates.io) as a package registry type by @Wolfe-Jam in #1207
• build(deps): bump go.opentelemetry.io/contrib/instrumentation/runtime from 0.68.0 to 0.69.0 in the opentelemetry group by @dependabot[bot] in #1332
• build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.243.0 to 3.244.0 in /deploy by @dependabot[bot] in #1333
• build(deps): bump github.com/jackc/pgx/v5 from 5.9.2 to 5.10.0 by @dependabot[bot] in #1334
• fix(cargo): harden README fetch, clarify status handling, strengthen tests by @rdimitrov in #1330
• fix(validators): harden mcp-name matching (PyPI/NuGet anchoring, comment-form safe) + cargo follow-ups by @rdimitrov in #1331
• fix: client-cancelled GET /v0/servers returns 499 without error log by @advancedresearcharray in #1335
• fix: don't leak internal error detail in GET /v0/servers 500 response by @rdimitrov in #1338
• build(deps): bump the actions group with 2 updates by @dependabot[bot] in #1392
• build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.244.0 to 3.248.0 in /deploy by @dependabot[bot] in #1391
• build(deps): bump github.com/Azure/azure-sdk-for-go/sdk/azidentity from 1.13.1 to 1.14.0 by @dependabot[bot] in #1375
• build(deps): bump github.com/coreos/go-oidc/v3 from 3.18.0 to 3.19.0 by @dependabot[bot] in #1374
• build(deps): bump github.com/google/go-containerregistry from 0.21.6 to 0.21.7 by @dependabot[bot] in #1373
• Fix broken reference documentation links by @kriptoburak in #1387
• build(deps): bump github.com/pulumi/pulumi-kubernetes/sdk/v4 from 4.31.1 to 4.32.0 in /deploy by @dependabot[bot] in #1353
• ci: auto-close PRs that try to publish servers via the repo by @rdimitrov in #1393
• build(deps): bump golang.org/x/mod from 0.37.0 to 0.38.0 by @dependabot[bot] in #1428
• build(deps): bump github.com/coreos/go-oidc/v3 from 3.19.0 to 3.20.0 by @dependabot[bot] in #1429
• build(deps): bump the actions group across 1 directory with 4 updates by @dependabot[bot] in #1430
• build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.248.0 to 3.251.0 in /deploy by @dependabot[bot] in #1431
• fix(auth): grant org namespace only to org Owners, not all members by @tadasant in #1383
• build(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0 by @dependabot[bot] in #1433
• docs(auth): document fine-grained PAT permission for org publishing (+ pagination-cap test) by @rdimitrov in #1435
• docs: add polygraph to community projects by @RubenSousaDinis in #1421
• fix(ci): re-validate author association via REST in close-invalid-publish-prs by @rdimitrov in #1440
• fix: reject mangled publisher metadata by @he-yufeng in #1310
• fix(api): allow PATCH in CORS so browsers can call the status endpoints by @JosephDoUrden in #1436
• test(api): remove placeholder CORS test superseded by #1436 by @rdimitrov in #1441
• fix(validators): distinguish a missing package from a missing version on PyPI/NPM by @sronix in #1411

New Contributors

• @Wolfe-Jam made their first contribution in #1207
• @advancedresearcharray made their first contribution in #1335
• @kriptoburak made their first contribution in #1387
• @RubenSousaDinis made their first contribution in #1421
• @he-yufeng made their first contribution in #1310
• @sronix made their first contribution in #1411

Full Changelog: v1.7.9...v1.8.0