From 775d4502727a15bc18878a7adc733592267669b8 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 26 Oct 2026 12:19:34 +0000 Subject: [PATCH] build(deps): bump ExaDev/mcp-registry-publish from 1.0.4 to 1.0.6 Bumps [ExaDev/mcp-registry-publish](https://github.com/exadev/mcp-registry-publish) from 1.0.4 to 1.0.6. - [Release notes](https://github.com/exadev/mcp-registry-publish/releases) - [Changelog](https://github.com/ExaDev/mcp-registry-publish/blob/main/CHANGELOG.md) - [Commits](https://github.com/exadev/mcp-registry-publish/compare/438589653ab51681ce140c2dec1ee58798ed16cd...d625f35c3afdc0a0624f1fd6cb6d4e176f44b613) --- updated-dependencies: - dependency-name: ExaDev/mcp-registry-publish dependency-version: 1.0.6 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 4269c8e7..2e370b67 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -237,5 +237,5 @@ jobs: git fetch --depth=1 origin "refs/tags/${REGISTRY_REF}" git show FETCH_HEAD:server.json > server.json # Pinned to the commit of the release, not the moving major tag: GitHub's secure use guidance is a full-length SHA, since a tag can be moved, and this step holds the registry publishing identity. Dependabot's github-actions updates keep the pin current. - - uses: ExaDev/mcp-registry-publish@438589653ab51681ce140c2dec1ee58798ed16cd # v1.0.4 + - uses: ExaDev/mcp-registry-publish@d625f35c3afdc0a0624f1fd6cb6d4e176f44b613 # v1.0.6