Releases

Public API calls now route through @buildinternet/releases-sdk, and releases feed pages with --cursor instead of --page, which the API rejects. Org, product and source lookups plus releases publish also moved to the SDK, surfacing real Created/Updated times in org get, fetch priority in source show, and replacing org list's always-empty Updated column with the last release date.

The releases admin source create command with --feed-url now stores an inferred feed type of rss, atom, or jsonfeed instead of unknown.

Published @buildinternet/releases-core@0.35.3 to npm from 764ca21be2f6508003bbb8c1df2c36e56ccda272.

A new @buildinternet/releases-sdk npm package calls the public API from Node, Deno, or any bundler, and releases-core plus releases-api-types now ship as compiled ES modules. The releases feed CLI paginates with --cursor instead of --page, which the API always rejected with a 400, and org and source commands now display real timestamps and fetch priority instead of "—".

Compiled CLI binaries are now built with Bun 1.4.4, which no longer trusts the compromised eMudhra intermediate certificates tracked as CVE-2026-111943.

The live release stream and releases tail now complete the WebSocket handshake reliably instead of failing nine times out of ten, and release list pages no longer go blank when a source contains a release with an unrecognized type from AI extraction. Search recency ranking falls back to fetch date for undated releases, the database health probe returns a retryable 503 instead of "run migrations first" during brief outages, and CLI binaries were rebuilt with Bun 1.4.4 to drop trust for a compromised intermediate certificate.

Published @buildinternet/releases-api-types@0.59.0 to npm from 96aba0dbcb4c2b83e73773e5583db4c8518a42ee.

Patched four Next.js security advisories affecting the web frontend, including SVG RCE via Image Optimization, a use cache typed-array RCE, a Server Action DoS, and an Image Optimization SSRF, plus four MCP server/client advisories affecting the remote MCP server.

Atom feed releases now record the date first published instead of last edited, and GitHub-sourced changelogs keep releases collected before a rate limit by treating 403 like 429 to return partial results. Also: sign-in no longer fails on transient KV storage errors, duplicate release URLs return 409 with the conflicting release ID instead of 500, and health probes return a retryable 503 with Retry-After instead of a misleading "run migrations first" message.

Feed validators (ETag / Last-Modified) are now saved only after new releases are stored, so a partial write on one poll no longer causes subsequent polls to skip that content.

Added a pricing page at /pricing covering the free tier, how a free account raises the API rate limit, and which personal features require sign-in, also available as /pricing.md. Static pages now serve Markdown via Accept: text/markdown or the .md URL with a link rel="alternate" tag in the head, fixing a "View .md" button that pointed to a nonexistent path.

Published @buildinternet/releases-core@0.35.2 to npm from 2246048b7c771f6e5a27d30d46d92caf41b888be.

Selected source histories — Anthropic Claude Code, OpenAI, xAI, Cloudflare, and Vercel changelogs — are now published as indexed dataset pages with descriptions, making them discoverable in search engines. MCP release results now put the original source URL first, and release cards link directly to the upstream post when one is available.

When a source republishes the same content under a new title or anchor URL, the duplicate is now dropped and release candidates, backports, and sibling packages are linked as related coverage instead. Bulk-published releases over 20 items now receive AI headlines and summaries, and OAuth discovery documents correctly reflect the authorization code plus PKCE flow.

Published @buildinternet/releases-api-types@0.58.3 to npm from c137bfe82bd8df6a82b7156d786e6e2125b21cb3.

Verified domain owners can copy a Markdown or HTML snippet to add a Release Notes Index badge linking to their org page, and /release/<id>.json now returns application/json instead of Markdown. Pages also gained Markdown alternate links in the head, and /google-gemini URLs now redirect permanently to /google.

Source pages for push-fed sources now display the time of the last published update instead of a last-polled time, which doesn't apply to sources updated via the GitHub Action publisher.