Remove namespace match validation for websiteUrl and remote URL - #769

Deploys v1.3.9 to production.

## Changes in v1.3.9
- New web UI for browsing the registry (#757)
- Fixed namespace match validation for websiteUrl and remote URL (#769)
- Added releases administration guide (#764)
- Updated community projects documentation
- Multiple dependency updates

Release notes:
https://github.com/modelcontextprotocol/registry/releases/tag/v1.3.9

The [deploy-production
workflow](https://github.com/modelcontextprotocol/registry/actions/workflows/deploy-production.yml)
will automatically deploy once this PR is merged.

Follow-up to modelcontextprotocol#769, which removed the validation that remote server URLs
must match the server's namespace.

This commit updates `official-registry-requirements.md` to reflect the
current behavior.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <[email protected]>

…lcontextprotocol#769)

<!-- Provide a brief summary of your changes -->

## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->

Resolve modelcontextprotocol#768 and
modelcontextprotocol#494.

Require HTTPS for remote URLs. Currently all remote URLs on the MCP
Registry are HTTPS.
Also fix a test bug when running on Windows (bad temp path).

## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->

Unit tests.
Published a server.json locally with a website URL not matching the
server name.

## Breaking Changes
<!-- Will users need to update their code or configurations? -->

## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [x] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update

## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [x] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [x] My code follows the repository's style guidelines
- [x] New and existing tests pass locally
- [x] I have added appropriate error handling
- [ ] ~I have added or updated documentation as needed~ N/A

## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->

Deploys v1.3.9 to production.

## Changes in v1.3.9
- New web UI for browsing the registry (modelcontextprotocol#757)
- Fixed namespace match validation for websiteUrl and remote URL (modelcontextprotocol#769)
- Added releases administration guide (modelcontextprotocol#764)
- Updated community projects documentation
- Multiple dependency updates

Release notes:
https://github.com/modelcontextprotocol/registry/releases/tag/v1.3.9

The [deploy-production
workflow](https://github.com/modelcontextprotocol/registry/actions/workflows/deploy-production.yml)
will automatically deploy once this PR is merged.

A publisher can currently block an endpoint's operator from listing it
under their own namespace simply by registering the remote URL first.
The registry authenticates namespaces but does not verify remote URL
ownership, so registration order cannot establish the canonical
publisher.

This change allows different server names to reference the same remote
URL on both `/v0` and `/v0.1`. It removes the conflict check from
publication, admin metadata edits, single-version restores, and
all-version restores. Namespace authorization, URL validation,
name/version uniqueness, and per-name version history remain intact.
Existing records, response schemas, and database indexes are unchanged;
no data migration is needed. The existing `remotes_ms` log field is
retained at zero.

The original uniqueness rule accompanied namespace/hostname matching in
#180 and #306; #769 later removed hostname matching.

## Downstream compatibility

This changes a previously documented behavioral guarantee, even though
the API shape is unchanged. Consumers that use a remote URL as a unique
key, or resolve it to a single canonical listing, must support multiple
matching server names. Records should be keyed by name/version (and
registry when combining sources), with each listing's metadata, headers,
and template variables kept separate. A shared endpoint does not
establish publisher ownership or endorsement.

The publishing guide and changelog explain this change. Review the
compatibility implications and coordinate rollout with downstream
consumers. Re-enabling uniqueness after shared URLs have been accepted
could block those servers' subsequent publications, edits, and restores.
Discovery grouping and endpoint ownership verification are outside this
PR.

## Validation

Updates the indirect `github.com/klauspost/compress` dependency from
v1.20.1 to v1.20.2 to fix GO-2026-6865, which was reported by CI's
vulnerability scan. Local `govulncheck ./...` and the CI vulnerability
scan pass with the update.

- Added database-backed regressions for independent metadata, version
histories, latest-only pagination, encoded listings, admin edits, and
single/all-version restores to active or deprecated.
- Added HTTP publish coverage on both API versions proving shared URLs
succeed while unauthorized namespaces, duplicate name/version pairs, and
invalid remote URLs still fail.
- Confirmed the new publication, edit, and active-restore regressions
fail against the original service implementation and pass with this
change.
- Passed `go test -race -coverprofile=coverage.out -covermode=atomic
./internal/... ./cmd/...` using an isolated local PostgreSQL 17
instance.
- Passed `make lint` with golangci-lint v2.14.0, `make validate build`,
and `git diff --check`.
- CI passed all checks, including `make test-all` (with Docker/ko
integration tests), build/lint/validation, vulnerability scanning, and
CodeQL. The Docker/ko integration harness was not run locally.

---------

Co-authored-by: Copilot Autofix powered by AI <[email protected]>