What's New

MCP clients can now complete OAuth authorization — resource-request validation and a column encoding bug were blocking scope grants — and sessions issue refresh tokens so clients stay connected past the one-hour expiry. The docs site adds how-to guides for locating changelog sources, converting changelogs to RSS/Atom feeds, and setting up release notifications.

OpenAPI spec now registers the error envelope as a named ErrorEnvelope component, replacing anonymous inline definitions so code generators and API tooling can reference the shape directly. Nonexistent API and docs paths return a text/markdown 404 body with pointers to llms.txt, the docs index, the REST API base, and the OpenAPI spec, and llms.txt gains a "When to use" section.

Unified feedback, submit, and keys command network calls onto the shared apiFetch transport, adding an opt-in skipDefaultAuth flag so keys' session-token Authorization header isn't overwritten by a configured admin/API key. Error messages, idempotency, and command output are unchanged.

Published @buildinternet/releases-api-types@0.51.0 to npm from 5ffcb358dc397383ad05b325e8fc0db997169755.

API writes now support Idempotency-Key headers for token, API key, and webhook operations, returning the same response on retries within 24 hours. Rate limit errors use the standard structured error envelope with Retry-After and policy headers.

Search timeframe filters open as a popover on the search bar, reused across org, source, and collection timeline views. Webhook settings use proper selects, and destructive actions open a confirmation dialog instead of a browser prompt.

Release title links across org and product pages, the homepage ticker, /updates, live stream, following, collection timelines, and digest emails now go directly to the upstream changelog entry. The on-site release detail page remains accessible via a secondary "Read more" or "Details" link on each card.

Verified owners now receive a confirmation email when their domain claim is accepted, and the claim panel shows promotion eligibility. Fixed CORS gaps breaking sign-in, domain claim, and listing promote flows, and broken media thumbnails now hide cleanly across the feed.

Incremental extraction now escalates to a full-page pass when a scrape window returns zero results, preventing silent stalls on sources with long entries. Video sources now trigger site revalidation and route through configured AI models on initial ingest, and the staleness digest no longer re-reports provider outages that have been cleared.

MCP server now implements the 2026-07-28 spec, returning plain JSON to modern clients while maintaining SSE framing for 2025-era clients. The new POST /v1/ai/lanes/:lane endpoint invokes ingest-time AI lanes and can write results back.

getApiUrl() no longer memoizes the API base URL process-wide, fixing a test isolation bug that caused 22 failing tests under bun test. The releases stats command now reads the server's real values instead of returning zeroed-out fields, and source backfill --dry-run reports how much history is not yet stored.

Published @buildinternet/releases-api-types@0.50.0 to npm from 239cc6dc8f29cd74c42ed78a79bcf4a674954f87.

Admin status page gains a Health tab that ranks sources by last successful check timestamp, with amber/red alerts for stalled providers. Operator staleness digest now leads with AI provider quota alerts. Backfill dry runs report honest inserted and notStored counts instead of fabricated zeros.

Digest, magic link, password reset, verification, and operator alert emails now use a unified branded shell, and digest emails render markdown in release bodies instead of raw asterisks. Email subject lines now include more context — leading orgs in digests, expiry times in magic links and password resets, and source or org names in operator alerts.

Published @buildinternet/releases-core@0.29.0 to npm from b1a39d30ae3d2ee58e80a702d047c9099053f87d.

App Store release cards in related rails and the homepage ticker now display as compact entries with only app icon, name, iOS/macOS label, and date. Routine App Store updates are filtered from cross-product discovery surfaces unless the release carries an AI importance score of 4 or higher.

Org pages now open on the Releases feed, with Overview moved to /:org/overview and /:org/releases redirecting to the org root. Copy buttons on /docs code blocks are always visible, and text blocks soft-wrap instead of scrolling horizontally.

Org overviews now prioritize releases with importance ≥ 4, preventing landmark updates from being buried by routine churn. Site footer reorganized with a new Collections column, Webhooks moved under Docs, and an uploads.sh cross-link added.

Search results now include an AI-scored importance field (1–5) in JSON output, with the TTY table marking high-importance hits. Added a TLS certificate verification hint and custom-CA documentation for proxy environments.

Published @buildinternet/releases-api-types@0.48.0 to npm.

Blume self-hosted Astro changelog sites are now auto-detected and ingested via RSS feed. Collection weekly digests are available in Markdown, JSON, and Atom formats, with recent digests surfaced in the collection right rail. AI-scored importance now reaches feeds, search, and MCP results.

Site wordmark, entity page titles, and social-share OG images now render in the Geist Pixel font.

Published @buildinternet/releases-api-types@0.47.0 to npm from eb15f11d506c683f69a813848d320b8425b230d2.

Weekly collection digests now available, with AI-written summaries published at /collections/[slug]/digest/[week] and exposed via REST API. Release sitemap at /v1/sitemap/releases surfaces importance-gated releases for search engine indexing. Release pages show a labeled divider between AI summary and original note.

Removed the deprecated get_source_changelog MCP tool, replaced by get_catalog_entry with changelog params. Search now supports --category and --collection filters, and the release importance score is surfaced in tail/latest output.

Published @buildinternet/releases-api-types@0.45.1 to npm from 93617c90db064b5576fa0ad696f4fd5bdedc92bd.

Local stdio MCP bridge's get_catalog_entry tool now accepts changelog parameters to inline a source entry's CHANGELOG in the same call, matching the hosted server. The standalone get_source_changelog tool is deprecated. Also added releases admin release refetch command and consolidated agent skills by moving operator skills to the backend monorepo.

All newly ingested releases now receive an AI-scored significance rating (1–5), with high-impact releases marked by a flame glyph. The /updates page is redesigned with a timeline rail and composition glyphs, and digest emails now bias toward higher-importance releases.

Published @buildinternet/releases-api-types@0.43.0 to npm.

Homepage features an interactive CLI preview with job-led tabs and live vitals strip. Digest emails are redesigned for scannability with grouped org blocks. A new in-place release re-fetch endpoint and auto-materialization for domain lookups are added. Search hits no longer include full markdown by default; pass ?include_content=true to opt in.

Fixed overview stale warning to use content write time (updatedAt) instead of original generation time, so amended overviews no longer appear months-old when recently rewritten.

Published @buildinternet/releases-api-types@0.41.0 to npm from d859f38f12905bdea2cd09294b4e6067e2416a87.

The releases json validate <domain> command now validates live against the registry's listing endpoint and returns the materialization plan (identity, products, release locators with classification). Exit code 0 for valid, 1 for invalid or check failed. Added --url flag to releases admin release update to set or clear a release's canonical URL, and new stub-tier org verbs: create-stub, create-stub-from-domain, and promote with --dry-run support.

Added GET /v1/orgs/:slug/manifest to export tracked orgs as releases.json v2 manifests, and a creating-releases-json Claude Code skill providing agent-guided manifest authoring. The /submit listing check now previews richer details including org identity, per-product source counts, and detected release locations with kind and tier badges.

Published @buildinternet/releases-api-types@0.40.0 to npm.

Domain ownership claims let signed-in users prove control via .well-known/releases-verify.txt or DNS TXT record and enable live release tracking without curator review. Slack notifications now have a dedicated setup guide and UI at /docs/integrations/slack. Fixed a caching bug where auth sessions were served from shared cache, causing signed-in users to appear signed out for up to two hours, and closed a gap where admin and authorization-required API responses could be served to anonymous callers.

Published @buildinternet/releases-api-types@0.39.0 to npm from 71a8a26cc8aa536a0c94afe32c405193992b8102.

Self-serve listing is now available on /submit — enter your domain to validate your releases.json manifest and activate listing immediately, with plain-language previews and field-level error feedback. Changelog pages now render markdown server-side, eliminating shiki and react-markdown from the browser.

Added releases json validate <path> to validate a releases.json v2 owner manifest against the published schema before publishing, with support for file paths, stdin, and machine-readable JSON output. Upgraded to @buildinternet/releases-api-types 0.37.0 and migrated the repo-root releases.json to v2 manifest format.

Organizations known from a releases.json manifest but not yet ingested now appear in the registry catalog with a stub badge, and their declared source locations are surfaced via API and MCP. The org overview citation style was rebuilt to link to release pages on releases.sh instead of inline superscripts, with JSON-LD metadata for SEO; the fenced-JSON citation format is retired.

Removed the releases admin overview batch command whose API route was retired. Added releases admin org update --overview-cadence to pin an org's automated overview-regen cadence (1–90 days) or clear back to the velocity-tiered automatic default; releases admin org get now shows the override when set.

Release URLs now include human-readable slugs (e.g., /release/rel_...-whats-new-in-v2) with permanent redirects from old bare-ID links; the slugged canonical URL flows through MCP tool outputs, Atom feeds, webhooks, Slack cards, and digest emails. A new releases.json v2 manifest at /.well-known/releases.json lets you declare where release notes live and auto-creates sources from feed, github, and appstore locators while reconciling metadata without overwriting curator edits. Also added deep links and "On this page" rail for docs pages, mobile app discovery from Apple's app-site-association file, adaptive org overview refresh rates, and server-side markdown rendering to speed up list pages.

Release cards now display a "Breaking" severity badge on feed cards, org pages, and search results, with a migration notes block added to detail pages when present. The breaking and migrationNotes fields are now returned on all release read API endpoints and search results. releases.sh is now listed on integrations.sh with REST API, MCP server, and CLI declared as integration surfaces.

Added --auto-generate-content / --no-auto-generate-content to releases admin org update, replacing the raw API call previously needed to toggle AI overviews and per-release summaries. Also surfaces current value in releases admin org get and shows an opted_out action in releases admin overview plan for orgs the batch skips.

Discovery agents and search queries now use Claude Sonnet 5 for higher-quality changelog extraction and keyword search. Webhook delivery activity now displays the delivery format (Slack or standard JSON), and new orgs have AI content generation enabled by default.

API and MCP reads are now cached for anonymous traffic on catalog, org, and collection endpoints. Placeholder controls for Bio, Instant release alerts, and Default visibility have been removed from active settings pages.

Sign-in, sign-up, forgot-password, and reset-password pages have been unified with the centered card layout introduced for OAuth and device flows, with consistent typography, button styles, and dark-mode support.

Added user and workspace avatar uploads with editable company website, changelog URL, and GitHub handle fields. Account settings rebuilt with two-pane layout and workspace selector; org pages redesigned with "Copy for agent" split-button, product sparklines, and last-visit dot indicator. Fixed mobile layout on org pages and corrected several account setting copy errors.

The releases webhook add and edit commands now support --format slack to deliver releases as formatted Slack messages via a Slack incoming webhook URL.

Webhook subscriptions now support a slack format option for Block Kit card delivery, and workspaces ship with user invitation, role management, and join/leave controls. Digest email subjects now include the covered date for easier inbox search.

CLI reference docs now document --page-all streaming output, --fields field projection, --input JSON payloads, and --dry-run for write commands. The stale "Summaries & Comparisons" page documenting removed commands has been removed.

Homepage hero stat counts use tabular digits to prevent layout shift, image borders are now neutral instead of tinted, and interactive controls across the site respond with subtle scale-on-press.

Digest email delivery and webhook release fan-out are now queue-backed, giving each recipient an independent retry budget so a transient failure no longer silently drops messages.

New whats_changed MCP tool and GET /v1/whats-changed API endpoint return changelog entries plus per-release breaking-change verdicts (none, minor, major) and migration notes for any package version range. SDK, tool, and platform releases are now classified at ingest for immediate results.

New user-facing releases webhook commands let users manage webhooks directly via CLI, including list, add, show, edit, remove, test, rotate-secret, and deliveries. Patch adds --product, --type, and --clear-* filter flags to webhook add and edit commands for per-event filtering.

Self-serve webhook management now allows creating, listing, updating, and deleting subscriptions with per-event filters and auto-pause on repeated failures. The personalized feed API has switched to cursor pagination, and product/source bylines now omit codename version labels.

New batch release management endpoints — DELETE /v1/releases/batch and POST /v1/releases/batch-suppress — and a rebuilt account settings section with individually-addressable pages. Collection daily summaries now incorporate actual changelog text for SDK version-tag releases.

Digest emails now include real release notes in SDK version-tag rollups, with the most substantive tags rendered as version — one-liner plus a +N more overflow link, while pure dependency-bump entries are ranked out.

New "Get Listed" docs page at releases.sh/docs/listing explains how changelog owners declare their source via releases.json or .well-known/releases.json. Social preview cards now appear on org sub-pages and changelog detail pages, docs and legal pages have correct heading structure, and the JSON Schema URL at releases.sh/schemas/releases.json no longer returns a 404.

Signed-in admin users can now edit orgs, sources, products, and releases inline in production, and view the Status dashboard and fetch logs—previously only available in local dev. The /live feed now shows rich release cards with org identity, descriptive AI titles, and inline media previews.

Collection daily summaries now appear above each day's releases on collection pages, and account settings allow email address changes and social sign-in management. The collection timeline has been rebuilt to group same-product releases, display AI-generated titles, and only show "Show more" when content overflows. Fixed RSS feed parsing for markdown, placeholder display on blank release pages, wrapping for long commands, and an explanation for sign-in forms on incompatible origins.

Passkey sign-in is now available, allowing authentication via Face ID, Touch ID, or a hardware security key. Relative links in ingested release notes now resolve against the vendor's domain, and coverage-side release URLs redirect to the canonical page.

The homepage now features a "What agents ask" section with example prompts, and coverage siblings in the "N other posts cover this launch" rail no longer link to suppressed pages. Homepage refreshes include a "Featured" heading in the org table, compact release counts, and a signup link for signed-out visitors, while status has been removed from the top navigation.

Fixed releases admin source fetch to no longer silently drop a source identifier when combined with --org, matching the behavior of releases latest. Releases import now dedups org accounts on the exact (platform, handle) pair instead of platform alone. Added releases admin source show to inspect a single source's config.

Site-wide notices with configurable colors and optional dismiss buttons are now available, along with avatar facepile previews on category pages and collection search results. Search entity matching has been improved to use word boundaries and relevance ranking, and release detail API responses are now stale for approximately 90 seconds.

Releases.sh now publishes its own product changelog at releases.sh/updates, with daily entries and per-day permalink pages going back to March. The account page now shows when each read-only API key was last used, or marks it as never used.

The release reader ergonomics for get, latest/tail, and list commands have been improved. The README has been trimmed to a leaner npm landing page.

Daily and weekly digest emails are now sent for followed organizations and products, and inline video cards render for Loom, Wistia, Vimeo, and YouTube links. Search results visuals have been clarified, and version-tagged releases now collapse into a per-product rollup.

The CLI now includes verbs to register and manage OAuth clients, including create, list, get, disable, enable, rotate-secret, and delete operations. New verbs also allow for setting, getting, and listing user roles, with options for managing read, curator, and admin privileges.

A personalized feed of organization and product updates is now available, which can be subscribed to via RSS/Atom with a private feed token. Release breadcrumbs now show the organization logo and product name.

Releases is now an OAuth/OIDC provider, enabling other apps and MCP clients to authenticate users through it.

Added releases keys verbs (create/list/revoke) for self-serve, read-only user API keys. These are authenticated via the device-flow session token persisted at login, with transparent re-authentication on expiry.

A new releases login command authenticates the CLI via OAuth 2.0 Device Authorization Grant, storing a read-only API key. The admin org avatar command now allows one-step ingestion of an organization's avatar from a URL, GitHub handle, favicon, or App Store artwork.

Sign in from your browser using device authorization with releases login and create read-only API keys for your account from the web dashboard. The homepage has been refreshed and now features an animated backdrop.

Sign in with Google, including Google One Tap and avatar sync, and magic-link passwordless login are now available.