Releases

Published @buildinternet/releases-api-types@0.58.3 to npm from c137bfe82bd8df6a82b7156d786e6e2125b21cb3.

Source pages for push-fed sources now display the time of the last published update instead of a last-polled time, which doesn't apply to sources updated via the GitHub Action publisher.

releases feedback now opens issues on buildinternet/releases, where the CLI lives.

releases list --org <unknown> and --product <unknown> now print "No sources configured." instead of crashing with a pageItems.length error, because the sources client normalizes bare-array responses from older API deploys. The CLI is also now built and published from the buildinternet/releases monorepo, with install commands unchanged.

Collections now email a weekly summary to subscribers, with past digests replayable on the web, and collection, digest, source changelog, and updates pages refresh automatically when new releases land. GitHub tag filters now apply in production, and fixes cover AVIF/MP4 thumbnails, a releases list crash on unknown org slugs, and 404ing relative links in the CHANGELOG viewer.

GIFs transcoded to MP4 at ingest now render directly instead of being re-encoded a second time, so release pages with animated media load faster.

Published @buildinternet/releases-core@0.35.1 to npm from 5a227591a296fcfea18a08ce93f3d3479c6f7be7.

Bare date filters now include releases through the end of that day across the REST API, MCP tools, and CLI --until flag, and /updates/ day pages, the sitemap, and the digest archive now paginate through the full feed history instead of 404ing or truncating past 100 releases. A duplicate-identity issue blocking some Google sign-ins is cleared and rejected at the database level, and an auth library update closes an OAuth state / magic-link token confusion advisory.

New releases publish command lets GitLab CI, Buildkite, and local docs builds push changelog updates with RELEASES_API_TOKEN, reusing the plan from the publish-changelog GitHub Action. releases json validate now accepts publish: "push" changelog locators from the current releases.json schema.

The product name is now consistently "Release Notes Index" across sign-in screens, social preview images, the MCP server's display name in connected clients, and in-product copy.

Adds --official / --no-official to releases admin oauth client create and a new releases admin oauth client update command for the official, trusted, and disabled flags, with official now shown in client list and get output. The flag controls the Verified by Releases Index badge and requires an API with buildinternet/releases#2421; older APIs ignore official on create and reject an update that sets only official.

The OAuth consent screen now displays where the access token is actually sent rather than the client's self-reported name and domain, labeling the destination as another website, an app on this device, or a named app-scheme app; unverified clients that redirect to an external site show an amber warning.

releases.json now supports declaring a GitHub Action-fed changelog in the domain manifest with "publish": "push" alongside the github and path fields; the listing flow returns the domain-verify, token-mint, and Action-wire-up steps automatically, with no separate manual source setup.

Connecting Claude to the MCP server using its published identity now registers automatically by fetching Claude's client metadata on first connect, with no manual pre-registration step. The OAuth consent screen now lists follows and webhooks to match the granted permissions, and dark mode no longer flashes light on first load because the theme bootstrap runs as an inline head script.

Agent skills now live in the self-contained Claude plugin folder at plugins/claude/releases/skills/ so the plugin passes Claude plugin directory validation, with npx skills add buildinternet/releases-cli finding them at the new path and the skills update check reading it. The Claude plugin also points at the agents.releases.sh/mcp endpoint, with documentation, support and terms links added to its manifest.

Connecting to https://agents.releases.sh/mcp was routing tokens to the wrong audience; tokens minted for either agents.releases.sh or mcp.releases.sh are now accepted on both. Account MCP tools called without a credential now return a proper OAuth challenge in clients like Claude, triggering sign-in instead of a plain error.