---
scope: org
organization: uploads
release_count: 36
last_release: 2026-11-01
generated: 2026-08-03
updated: 2026-11-02
canonical: https://releases.sh/uploads/overview.md
---

Recently shipped a review step for sensitive uploads, plus captions and screen labels that organize screenshots in pull request comments.

**Images that may show secrets are held before they go public.**

- The classifier can hold an upload it thinks shows a secret or sensitive personal data, and the PR comment shows a held count in its place.
- `uploads approve --pr <n>` lists held files, `--all` approves them, and `uploads approve <key>` approves one.
- Hosted MCP uploads are classified the same way, and `uploads mcp` gained `list_held` and `approve`.
- Only identity documents and payment or bank numbers hold for personal data.

**Pull request comments are easier to scan.**

- `--caption <text>` adds a line saying what a shot shows, and `--screen <name>` labels app screens that have no route.
- Phone screenshots share rows, up to three across, grouped under a heading per screen.
- Before/after pairs share one table with a Before and After header.

**Each comment links to a live feed of the PR's files.** The comment opens with a line such as `12 files · View all on uploads.sh →`, linking to every file tagged with the pull request. The feed pages past 50 files with **Older files**.

**Repo config and staging got more control.** `.uploads.yml` `noUploadsComment` takes `auto`, `always`, or `never`, and `check.ai` adds advisory AI notes to the visuals check. `uploads unstage` clears a branch's staged files without deleting them.

The API client now ships as `@buildinternet/uploads-sdk`, and sharp 0.35.5 is required for image-processing security fixes.