isLatest not recalculated when latest version is deleted; new versions below deleted latest never promoted

[manusa]

Problem

When the version marked as isLatest=true is soft-deleted via mcp-publisher status --status deleted, no other version is promoted to latest. Additionally, publishing new versions with a lower semver than the deleted latest never fixes this, because GetCurrentLatestVersion() does not filter by status — the deleted version still wins the semver comparison.

Impact

• GET /v0/servers/{name}/versions/latest returns 404
• No version is marked as isLatest in search results or version listings
• All future publishes with versions below the deleted latest will have isLatest=false

Steps to Reproduce

1. Publish version 1.0.0 of a server
2. Publish version 0.0.59 (gets is_latest=false since 0.0.59 < 1.0.0)
3. Delete version 1.0.0: mcp-publisher status --status deleted ... 1.0.0
4. GET /v0/servers/{name}/versions/latest → 404
5. Publish version 0.0.60 — still gets is_latest=false because CompareVersions("0.0.60", "1.0.0") determines 0.0.60 is lower than the deleted 1.0.0
6. No version ever becomes latest unless version >= 1.0.0 is published

Affected Server

io.github.containers/kubernetes-mcp-server — version 1.0.0 was accidentally published during initial setup and has been deleted, but all active versions (0.0.50, 0.0.51, 0.0.59) have isLatest=false:

GET /v0/servers/io.github.containers%2Fkubernetes-mcp-server/versions/latest → 404

Root Cause

From code analysis of the registry source:

1. isLatest is only set at publish time — SetServerStatus, SetAllVersionsStatus, and UpdateServer never touch the is_latest column

2. GetCurrentLatestVersion() includes deleted versions — the query SELECT ... FROM servers WHERE server_name = $1 AND is_latest = true has no status filter, so deleted versions still win the semver comparison when new versions are published

3. CheckVersionExists blocks re-publishing deleted versions — SELECT EXISTS(SELECT 1 FROM servers WHERE server_name = $1 AND version = $2) has no status filter, so you can't fix this by re-publishing the deleted version either

Expected Behavior

When the isLatest version is deleted, the registry should recalculate isLatest by promoting the next highest active version. At minimum, GetCurrentLatestVersion() should filter out deleted versions so new publishes can become latest.

Suggested Fix

In SetServerStatus (and SetAllVersionsStatus), when a version with is_latest=true is being set to deleted:

1. Find the next highest active version (using the existing CompareVersions logic)
2. Promote it to is_latest=true
3. Set the deleted version's is_latest=false

Additionally, GetCurrentLatestVersion() should exclude deleted versions from comparison, so that new publishes are compared against the highest active version.

Workaround Request

In the meantime, could the is_latest flag for io.github.containers/kubernetes-mcp-server version 1.0.0 be cleared at the database level, and version 0.0.59 be promoted to latest? This server is actively used and currently has no version marked as latest.

Related Issues

• Allow publishers to mark servers as deprecated #637 — Allow publishers to mark servers as deprecated (implemented in Publisher-managed "deleted" support #893)
• Request to delete invalid version 1.0.0 of io.github.containers/kubernetes-mcp-server #858 — Original deletion request for this server's 1.0.0 version