fix(validators): name the package version in ownership-failure errors - #1544
Open
sronix wants to merge 1 commit into
Open
fix(validators): name the package version in ownership-failure errors#1544sronix wants to merge 1 commit into
sronix wants to merge 1 commit into
Conversation
An ownership failure (mcpName mismatch, missing mcpName, missing or glued mcp-name token, OCI label mismatch) reported which value was found but not which package version it was read from. A publisher whose server.json still names an older release then reads the value as belonging to the release they just published and looks for the fault in the wrong place (modelcontextprotocol#1525). NuGet already says "ownership validation for version X failed". This brings npm, PyPI, cargo and OCI in line: npm, PyPI and cargo name the version, OCI names the full image reference, which carries the tag or digest. Message text only, no behavior change. Existing tests match on substrings and stay green; new hermetic cases assert the version is present.
sronix
marked this pull request as ready for review
August 18, 2026 12:07
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #1525.
Why
Ownership errors showed the expected and found values, but did not identify the package version that was checked.
In #1525,
packages[].versionstill named the previous release. The error therefore looked like stale package metadata. Including the validated version makes this cause clear.NuGet already includes the version in its ownership error.
What changed
This does not change validation behavior.
Test plan
go test -race ./internal/validators/...go vet ./...golangci-lintv2.11.4git diff --check