--- name: Changelog slug: changelog type: feed source_url: https://uploads.sh/changelog organization: uploads organization_slug: uploads total_releases: 83 latest_version: 0.55.1 latest_date: 2026-09-15 last_updated: 2026-09-15 tracking_since: 2026-07-11 canonical: https://releases.sh/uploads/changelog organization_url: https://releases.sh/uploads --- ## CLI 0.55.1 ### Patch Changes - 9f2ec7c: Skip the stale "update available" hint after `uploads update`, and do not re-run `mcp add` (which can open a browser) when `mcp list` already shows the server. ## Change-feed URLs use /c/ Public change feeds now follow the same capability-URL rule as galleries: `/{short-collection}/{typed_id}`. - Galleries stay at `/g/gal_…` - Files stay at `/f/{workspace}/{key}` - Feeds are at `/c/feed_…` and `/c/feed_…/{item}` `/c/` is for change feeds because `/f/` is already files. The `feed_` prefix on the id stays. Older `/feed/…` links redirect permanently. ## CLI 0.55.0 ### Minor Changes - 44b86b6: PR managed-comment image clicks open the change-feed pager (`/c//`). Feed items now include `pageUrl`. - 472787c: Let `uploads feed create` (and MCP `feed_create`) scope a change feed to one pull request or issue with `--pr` / `--issue` / `--github`. - fec7133: Add `uploads feed` (and MCP `feed_create` / `feed_get`) to share a public newest-first screenshot feed for a GitHub repo. ### Patch Changes - 8d6b346: Public change-feed pages now live at `/c/` and `/c//` (same house rule as `/g/gal_…`). Old `/feed/…` links redirect. ## Share a live feed of repo screenshots ![A public change feed showing newest-first screenshots for a GitHub repo](https://storage.uploads.sh/default/screenshots/changelog/change-feeds.jpg) You can now share a live feed of screenshots for a GitHub `owner/repo` behind one public URL. The page lives at `/c/`, newest first, and updates as new shots land. Anyone with the link can view it — the same privacy model as galleries. Create a feed from the CLI. Omit `--repo` and it uses the current git remote. Pass `--path` to keep the feed to one page. Scope that same feed to one pull request or issue with `--pr` or `--github`. Creating the same scope again returns the existing URL. ```bash uploads feed create uploads feed create --repo owner/repo uploads feed create --repo owner/repo --path /settings uploads feed create --repo owner/repo --pr 123 uploads feed create --github owner/repo#123 ``` Agents can call `feed_create` / `feed_get` on stdio or hosted MCP. A feed is a live query, not a curated list. Galleries stay hand-built ordered lists you add to yourself. Use a feed when you want what changed in this repo lately, or on one pull request. Use a gallery when you want to pick and order shots. The [Change feeds](/docs/feeds) guide has the full workflow. What this does not include: daily digest email, Slack webhooks, or a merged-only filter. ## Page through a PR's screenshots A change feed now has an item page at `/c//` — previous / next, and a 1 of N count. Syncing the managed PR comment creates that PR-scoped feed if needed and points each image's click-through there. The image itself still loads from the embed URL. Standalone `/f/…` pages stay for one-off shares. Curated galleries are unchanged. ## CLI 0.54.0 ### Minor Changes - 40322e7: Add `uploads docs` to search public uploads.sh documentation (and fetch one page as markdown). Also available as the MCP `search_docs` tool. ## CLI 0.53.0 ### Minor Changes - f590a79: Add `uploads changelog` to print recent product updates and a link to [https://uploads.sh/changelog](https://uploads.sh/changelog). Also available as the MCP `changelog` tool. ### Patch Changes - 5fc4a8c: Bump files-sdk to 2.3.1 and drop the local pnpm patch; the Workers-safe S3 adapter now comes from the public files-sdk/s3-fetch entry. ## Read the changelog from the CLI `uploads changelog` prints the latest product updates in your terminal, then a link to the full list at [uploads.sh/changelog](/changelog). Agents get the same feed from `--json` or the MCP `changelog` tool. ```bash uploads changelog uploads changelog --limit 10 uploads changelog --json ``` ## CLI 0.52.1 ### Patch Changes - ec42d24: Render non-media attachments (PDF, zip, text, CSV, JSON, markdown, tgz) in the managed GitHub attachments comment as a small file table (name, type, size) instead of bare list links. - c5e4f9f: The public file page's card for non-media files now labels its link "Download " when it points at the forced-download URL. - b0f42da: Public file page shows a proper file card (name, type, size, download link) instead of a generic "Preview unavailable" fallback for non-media files, and inline-previews small text/markdown/csv/json files as server-rendered plain text. ## CLI 0.52.0 ### Minor Changes - 286cafc: `put` and `attach` accept non-media files: PDF, zip, gzip, MOV, and text (plain, markdown, CSV, JSON, logs). They upload as-is, skip image optimization, and appear in the managed comment as links. Requires the matching platform release. - 99340ec: `put` and `attach` accept SVG and XML (`image/svg+xml`, `application/xml`, `text/xml`) on a storage lane once its public host is verified to serve them behind a sandboxing Content-Security-Policy. An unverified lane keeps 415ing these types. The managed comment embeds SVG as ``. Requires the matching platform release. ### Patch Changes - 3bdadcf: The active-content host probe now retries a failed `REGISTRY` KV write once before giving up, so a stale prior-day `ok: true` record can't survive a one-off KV hiccup and keep the SVG/XML sandboxing gate open. - e3b1f85: Sharpen the server-side reputation pre-filter for gated SVG/XML uploads (`containsActiveMarkup`): event-handler attribute matching no longer false-positives on ordinary attributes like `online=`/`once=`, and entity-encoded evasions (`javascript:`, SMIL ``) are now rejected. The actual security control remains the sandboxing CSP on the serving lane; this filter is defense in depth. - 15d34d6: `put --help` now says uploads are public and to scrub secrets out of logs, JSON, and other text before uploading. - cada618: Read width/height for SVG uploads from the root ` ## Uploads take PDFs, logs, JSON, and zips The upload allowlist now covers PDF, zip, gzip, MOV, and text files (plain, markdown, CSV, JSON, logs) alongside images and video. Test reports, Lighthouse output, build logs, and bundles get the same stable URLs and appear in the PR's attachments comment as links. MOV uploads and plays on its file page. Size caps are the plan's file cap; MOV uses the video cap. Uploads are public. The text families — logs, CI JSON, env dumps — are the ones that tend to carry secrets in practice, so scrub those before uploading. SVG and HTML stay out: served inline, either can run script on our storage origin. SVG support is planned behind a sandboxing header. ## CLI 0.51.0 ### Minor Changes - 424b343: Follow branch renames when promoting staged uploads. The CLI reads `git branch -m` steps from the branch reflog and registers them with the server, so `attach --pr`, `attach --promote`, and files staged by `attach --branch`, `put`, or `screenshot` are still found after a rename. Promote output notes when a rename was followed. `--from-branch` remains the manual fallback for a branch renamed or deleted without a later `uploads` run. The stdio MCP `attach` tool now matches the CLI: with `pr`, it promotes the current branch's staged files and reports `promotion`/`promoteError`, with new `fromBranch` and `noPromote` arguments. ## CLI 0.50.1 ### Patch Changes - 74dfc83: Add `uploads attach --pr --from-branch ` to promote staged files after a branch is renamed or deleted. ## GitHub CLI can attach media now As of today, GitHub CLI supports attachments. `gh` 2.99 adds a repeatable `--attach` flag for images and video on issues, pull requests, and comments. Read [GitHub's changelog](https://github.blog/changelog/2026-09-01-github-cli-media-in-issues-pull-requests-and-comments/). Good news. If you have a PR open and a screenshot to drop on it, use `gh`. We've updated our docs and agent skills to say so. Media attached with `gh` still lands in Uploads: with the [GitHub App](/docs/github-app#ingest) installed, attachments in PR and issue text are imported into the workspace, so they show up in the Screenshots view next to CLI captures. What it doesn't change: - **Before the PR exists.** Agents capture screenshots mid-task. `uploads put` on a branch stages the file, and the PR gets one attachments comment the moment it opens. - **One comment that stays current.** Re-upload the same filename and every embed updates. The managed comment rewrites itself on each revision instead of piling up. - **Public URLs.** GitHub's attachments only render inside GitHub. Uploads URLs work in Slack, docs, changelogs, and for any other agent that needs to fetch them. - **Uploads without a shell.** GitHub has no public API (yet) for attachments, and `--attach` needs `gh` on a machine that has the file. The hosted MCP server at `agents.uploads.sh` takes files as base64 or a URL and posts them to the PR, so ChatGPT, Claude.ai, and cloud agents can attach too. - **Capture and context.** `uploads screenshot` takes the shot, `--annotate` marks it up, before/after pairs render side by side, and every capture carries metadata you can search with `uploads find` or browse on the Screenshots page across projects. ## CLI 0.50.0 ### Minor Changes - 4515259: Managed comment sizes images by their real dimensions: uploads now record server-derived `image.width`/`image.height`, small assets render at natural size instead of being upscaled into blurry tiles, and consecutive captionless icons flow on one line instead of stacking one per row. ### Patch Changes - 1fce158: Fix `usage`, `reconcile`, and `purge_expired` MCP tools failing with an output validation error. The two-lane storage work added `sharedBytes`, `sharedObjects`, and `storageBudgetBasis` to the usage payload, and the usage route separately stamps `scopes`, `plan`, and `storage`, but the MCP output schema didn't list them, so the strict (`additionalProperties: false`) schema rejected real responses. ## CLI 0.49.0 ### Minor Changes - 21b5aa9: Tighten MCP tool and parameter copy, add input schema examples, and replace the `health` ping with `whoami`. - d6ff396: `uploads put --url` and MCP `contentUrl` fetch a file and upload it. Filename comes from the URL path when omitted. The CLI and stdio MCP also fetch `http://localhost` (hosted MCP does not). ## CLI 0.48.1 ### Patch Changes - 5309b81: Publish the stdio MCP server (`uploads mcp`) and the hosted remote to the official MCP Registry as `sh.uploads/mcp`. - 14dc745: Advertise the uploads chevron as the MCP server icon so inspector UIs can show it. ## CLI 0.48.0 ### Minor Changes - 7ede14e: `uploads usage` is BYO-bucket aware: when a workspace's own bucket is active, the storage meter counts only hosted-storage residue (the number the quota actually enforces) and a note explains that storage in your own bucket is unmetered. - 90d442f: `uploads doctor` now reports the workspace's storage lanes: hosted storage vs your own bucket, how many previous lanes still serve old files, and whether the active lane is healthy — read from a new bearer-safe summary on the usage endpoint. Against older servers it keeps the honest "not checked from the CLI" line. ## CLI 0.47.0 ### Minor Changes - 5af793e: Page through file search. `findFiles` now returns an opaque `cursor` and accepts one back. The new `findFilesAll` follows that cursor, up to a page cap. `uploads find` and `uploads list --meta` gained `--cursor` and `--all`. The `find_files` MCP tool takes and returns the same cursor. - cac30d3: `list`/`listAll` now skip the server's per-key metadata hydration when the caller didn't request `metadata: true`, instead of fetching it and throwing it away. ### Patch Changes - d6e49f7: Mint workspace tokens safely on retry: `mintWorkspaceToken` now accepts an optional `idempotencyKey` so a retried request replays the original one-time token instead of minting a duplicate. - 5bd56dd: Upload files safely on retry: `put` now accepts an optional `idempotencyKey` so a retried request replays the original response instead of writing a duplicate object. - 5c27ee3: Retry gallery creation safely with caller-scoped idempotency keys. ## CLI 0.46.3 ### Patch Changes - 750f8c3: Default the CLI auth base to the same-origin app origin (`uploads.sh`) instead of the retired `auth.uploads.sh` subdomain. Since #731 the auth endpoints are served at `/api/auth`, so an `api.` base now derives its parent (`api.uploads.sh` → `uploads.sh`). Explicit `--auth-url` / `UPLOADS_AUTH_URL` still override, and `auth.uploads.sh` continues to serve during the transition, so pinned configs keep working.