npx @buildinternet/releases get releases-cliPublic API calls now route through @buildinternet/releases-sdk, and releases feed pages with --cursor instead of --page, which the API rejects. Org, product and source lookups plus releases publish also moved to the SDK, surfacing real Created/Updated times in org get, fetch priority in source show, and replacing org list's always-empty Updated column with the last release date.
The releases admin source create command with --feed-url now stores an inferred feed type of rss, atom, or jsonfeed instead of unknown.
Compiled CLI binaries are now built with Bun 1.4.4, which no longer trusts the compromised eMudhra intermediate certificates tracked as CVE-2026-111943.
releases feedback now opens issues on buildinternet/releases, where the CLI lives.
releases list --org <unknown> and --product <unknown> now print "No sources configured." instead of crashing with a pageItems.length error, because the sources client normalizes bare-array responses from older API deploys. The CLI is also now built and published from the buildinternet/releases monorepo, with install commands unchanged.
New releases publish command lets GitLab CI, Buildkite, and local docs builds push changelog updates with RELEASES_API_TOKEN, reusing the plan from the publish-changelog GitHub Action. releases json validate now accepts publish: "push" changelog locators from the current releases.json schema.
Adds --official / --no-official to releases admin oauth client create and a new releases admin oauth client update command for the official, trusted, and disabled flags, with official now shown in client list and get output. The flag controls the Verified by Releases Index badge and requires an API with buildinternet/releases#2421; older APIs ignore official on create and reject an update that sets only official.
Agent skills now live in the self-contained Claude plugin folder at plugins/claude/releases/skills/ so the plugin passes Claude plugin directory validation, with npx skills add buildinternet/releases-cli finding them at the new path and the skills update check reading it. The Claude plugin also points at the agents.releases.sh/mcp endpoint, with documentation, support and terms links added to its manifest.
releases login now persists only the read-only API key it mints, and releases keys and releases publish-token open a fresh one-time browser approval per command that is signed out when the command finishes; every subcommand accepts --no-browser to print the URL and code instead. releases auth logout revokes the stored key directly and always removes the local credential, and pre-existing credential files are upgraded in place by signing out and stripping any leftover session token.
releases login no longer leaks a new relu_ key on every run: it remembers the minted key's id and revokes the key it replaces once the new one is safely stored, and hitting the server's active-key limit now returns an error naming the commands to list and revoke keys. releases auth logout also revokes the stored key server-side, best-effort.
Added releases publish-token create/list/revoke commands to mint relk_ tokens scoped to one source, for use with the publish-changelog GitHub Action via RELEASES_API_TOKEN environment variable.
releases admin discovery onboard no longer starts a remote discovery session, as the discovery worker and POST /v1/workflows/discover were retired; the command now exits 1 with a pointer to releases admin org create, releases admin source create, and the local-ingest skill. The onboard apply subcommand and the --managed-agents and --sandbox engine flags are removed.
macOS binaries are now built on macOS and ad-hoc code-signed; v0.77.0 and v0.78.0 shipped with invalid signatures that macOS 27 rejects, which caused brew upgrade to fail while generating shell completions.
Webhook list/add/show/edit/remove/test/rotate-secret commands accept a new --workspace <id-or-slug> flag for managing a shared workspace-owned webhook instead of your own. A new releases workspace list command shows a workspace's id, slug, and your role in it.
releases webhook add and edit now accept --format discord to deliver releases as formatted Discord embeds via a Discord incoming webhook URL. Human-readable webhook output redacts the delivery URL, while --json still includes it.
New releases admin recommendations notify-added command lets operators opt in to emailing a submitter that their suggested source was added to the registry.
New releases changelog command prints recent product updates from releases.sh and links to https://releases.sh/updates. The same capability is exposed as the local MCP changelog tool.
Unified feedback, submit, and keys command network calls onto the shared apiFetch transport, adding an opt-in skipDefaultAuth flag so keys' session-token Authorization header isn't overwritten by a configured admin/API key. Error messages, idempotency, and command output are unchanged.
Effectful write requests (feedback submit, webhook create/rotate-secret/test, API-key mint) now send an Idempotency-Key header, so retries after network failures replay the original response instead of double-submitting. Reusing a key with a different payload returns a clear idempotency_conflict message instead of a raw 409.
getApiUrl() no longer memoizes the API base URL process-wide, fixing a test isolation bug that caused 22 failing tests under bun test. The releases stats command now reads the server's real values instead of returning zeroed-out fields, and source backfill --dry-run reports how much history is not yet stored.
