Changelog

A new @buildinternet/releases-sdk npm package calls the public API from Node, Deno, or any bundler, and releases-core plus releases-api-types now ship as compiled ES modules. The releases feed CLI paginates with --cursor instead of --page, which the API always rejected with a 400, and org and source commands now display real timestamps and fetch priority instead of "—".

The live release stream and releases tail now complete the WebSocket handshake reliably instead of failing nine times out of ten, and release list pages no longer go blank when a source contains a release with an unrecognized type from AI extraction. Search recency ranking falls back to fetch date for undated releases, the database health probe returns a retryable 503 instead of "run migrations first" during brief outages, and CLI binaries were rebuilt with Bun 1.4.4 to drop trust for a compromised intermediate certificate.

Patched four Next.js security advisories affecting the web frontend, including SVG RCE via Image Optimization, a use cache typed-array RCE, a Server Action DoS, and an Image Optimization SSRF, plus four MCP server/client advisories affecting the remote MCP server.

Atom feed releases now record the date first published instead of last edited, and GitHub-sourced changelogs keep releases collected before a rate limit by treating 403 like 429 to return partial results. Also: sign-in no longer fails on transient KV storage errors, duplicate release URLs return 409 with the conflicting release ID instead of 500, and health probes return a retryable 503 with Retry-After instead of a misleading "run migrations first" message.

Feed validators (ETag / Last-Modified) are now saved only after new releases are stored, so a partial write on one poll no longer causes subsequent polls to skip that content.

Added a pricing page at /pricing covering the free tier, how a free account raises the API rate limit, and which personal features require sign-in, also available as /pricing.md. Static pages now serve Markdown via Accept: text/markdown or the .md URL with a link rel="alternate" tag in the head, fixing a "View .md" button that pointed to a nonexistent path.

Selected source histories — Anthropic Claude Code, OpenAI, xAI, Cloudflare, and Vercel changelogs — are now published as indexed dataset pages with descriptions, making them discoverable in search engines. MCP release results now put the original source URL first, and release cards link directly to the upstream post when one is available.

When a source republishes the same content under a new title or anchor URL, the duplicate is now dropped and release candidates, backports, and sibling packages are linked as related coverage instead. Bulk-published releases over 20 items now receive AI headlines and summaries, and OAuth discovery documents correctly reflect the authorization code plus PKCE flow.

Verified domain owners can copy a Markdown or HTML snippet to add a Release Notes Index badge linking to their org page, and /release/<id>.json now returns application/json instead of Markdown. Pages also gained Markdown alternate links in the head, and /google-gemini URLs now redirect permanently to /google.

Source pages for push-fed sources now display the time of the last published update instead of a last-polled time, which doesn't apply to sources updated via the GitHub Action publisher.

Collections now email a weekly summary to subscribers, with past digests replayable on the web, and collection, digest, source changelog, and updates pages refresh automatically when new releases land. GitHub tag filters now apply in production, and fixes cover AVIF/MP4 thumbnails, a releases list crash on unknown org slugs, and 404ing relative links in the CHANGELOG viewer.

GIFs transcoded to MP4 at ingest now render directly instead of being re-encoded a second time, so release pages with animated media load faster.

Bare date filters now include releases through the end of that day across the REST API, MCP tools, and CLI --until flag, and /updates/ day pages, the sitemap, and the digest archive now paginate through the full feed history instead of 404ing or truncating past 100 releases. A duplicate-identity issue blocking some Google sign-ins is cleared and rejected at the database level, and an auth library update closes an OAuth state / magic-link token confusion advisory.

The product name is now consistently "Release Notes Index" across sign-in screens, social preview images, the MCP server's display name in connected clients, and in-product copy.

The OAuth consent screen now displays where the access token is actually sent rather than the client's self-reported name and domain, labeling the destination as another website, an app on this device, or a named app-scheme app; unverified clients that redirect to an external site show an amber warning.

releases.json now supports declaring a GitHub Action-fed changelog in the domain manifest with "publish": "push" alongside the github and path fields; the listing flow returns the domain-verify, token-mint, and Action-wire-up steps automatically, with no separate manual source setup.

Connecting Claude to the MCP server using its published identity now registers automatically by fetching Claude's client metadata on first connect, with no manual pre-registration step. The OAuth consent screen now lists follows and webhooks to match the granted permissions, and dark mode no longer flashes light on first load because the theme bootstrap runs as an inline head script.

Connecting to https://agents.releases.sh/mcp was routing tokens to the wrong audience; tokens minted for either agents.releases.sh or mcp.releases.sh are now accepted on both. Account MCP tools called without a credential now return a proper OAuth challenge in clients like Claude, triggering sign-in instead of a plain error.

Verified domain owners can mint per-source publish tokens from Account → Webhooks & API, with mint and revoke commands available in the CLI, and set changelog-glob in publish-changelog to publish one-file-per-entry Markdown or MDX changelogs with frontmatter metadata. An "Own this domain?" link now lets owners claim any tracked org, CLI approval screens are distinct per command with releases login no longer keeping a long-lived session, and the per-user read-only API key cap rises from 5 to 25.

New GET /v1/collections/:slug/digests/latest returns the current week's digest without knowing the week date, and the collection page now loads it in parallel with the feed. MCP tools follow the REST API's visibility rules so deleted and hidden orgs, products, and sources no longer appear in lookups, search, the org directory, latest releases, or tab completion; weekly digest summaries now group a product's multiple updates into one account.