releases.sh Release Notes

**Fixed** - `until` date filters — bare dates now include releases through the end of that day; the REST API, MCP tools, and CLI `--until` flag were cutting the day off at midnight, so single-day queries returned nothing. - `/updates/` pages — day pages, the sitemap, and the digest archive now follow pagination through the full feed history; they were 404ing or truncating once the feed exceeded 100 releases. - Google sign-in — a duplicate-identity issue left a small number of users unable to sign in with Google; affected rows are cleared and the condition is now rejected at the database level. - OAuth error page — sign-in failures now redirect to a proper page on releases.sh instead of a raw API error screen; the underlying auth library update also closes a security advisory for an OAuth state / magic-link token confusion issue (any in-flight flows at deploy time will need to be restarted).

**Added** - Connect Claude to the MCP server using its published identity — Claude's "Use Claude's published identity" option in the connector dialog now works; the server fetches Claude's client metadata on first connect and registers it automatically, with no manual pre-registration step. **Changed** - OAuth consent screen now lists follows and webhooks — connecting an app via OAuth shows that it can follow and unfollow orgs and products and manage your webhooks, matching what the grant actually allows. **Fixed** - Dark mode no longer flashes light on first load — the theme bootstrap now runs as an inline `` script, so the dark class applies before first paint whether you chose dark explicitly or follow your OS setting.

**Added** - Publish tokens — verified domain owners can mint a per-source token from Account → Webhooks & API, copy a ready-to-paste `publish-changelog` workflow step, and revoke it at any time; `releases publish-token` commands in the CLI can mint and manage tokens using the session from `releases login`. - GitHub Action directory mode — set `changelog-glob` (e.g. `changelog/**/*.mdx`) in `publish-changelog` to publish one-file-per-entry Markdown or MDX changelogs; title, date, version, slug, and canonical URL are read from frontmatter, and `draft: true` skips an entry. - Claim a tracked org — an "Own this domain?" link in the org sidebar lets the actual owner start a verification claim on any org the registry already tracks, not just stubs; owners and admins can revoke a claim when it's no longer needed. **Changed** - CLI approval screens now say what they're actually approving — `releases login`, `releases keys`, and `releases publish-token` each show a distinct confirmation screen; `releases login` no longer keeps a long-lived session after the key is created. - Read-only API key limit raised to 25 — the per-user cap for personal keys increases from 5 to 25, leaving room for multiple machines, CI environments, and scripts under one account.

Minor Changes

• 7237636: releases login no longer keeps a signed-in browser session on disk — only the read-only API key it mints. releases keys and releases publish-token now open a fresh one-time browser approval for each command and sign that session back out as soon as the command finishes, instead of reusing a stored session; every subcommand takes --no-browser (same as login) to print the URL + code instead. releases auth logout revokes the stored key directly (no browser approval needed) and always removes the local credential, even if the server-side revoke fails. A credential file saved before this change is upgraded in place: any leftover session token is signed out and stripped the next time it's touched.

**Added** - `GET /v1/collections/:slug/digests/latest` — fetch the current week's digest for a collection without knowing the week date; the collection page now loads it in parallel with the feed instead of sequentially. **Changed** - Weekly digest summaries now describe each product's week as one story — multiple updates from the same CLI, SDK, or app are grouped into a single account instead of being recapped version-by-version; a version number appears only when it is the news (a major release, or one worth skipping). - MCP tools now follow the same visibility rules as the REST API — deleted and hidden orgs, products, and sources no longer appear in lookups, search, the org directory, or latest releases, and tab completion skips them too. **Fixed** - Searching by product scope no longer drops live results when the product also has hidden or deleted sources. - Source detail no longer shows tombstoned slugs for a parent org or product that was soft-deleted — those fields return absent instead.

**Added** Interest alerts let you describe what you care about in plain language, and hear about it when a release you already follow matches. Write the interest the way you would say it — "Slack integrations with B2B software" is enough. Releases Index looks only at releases from the organizations and products you follow. When a new release matches, you get an email, a webhook, or both. The default confidence is 0.80, which you can raise or lower, and you can keep up to five interests. The words you write stay private to your account. Turn one on from Account → Notifications. Follows, the digest, and webhooks still cover every release you follow. An interest alert sits beside them, as the note for the release that is actually about the thing you named. - Interest alerts can now be edited and show recent match history — update the query, confidence level, or delivery channel from Account → Notifications and see how many times each alert matched in the last 7 and 30 days. - Weekly digests on the homepage — a full-width reel shows the latest issue from each collection with section rows, summaries on hover, and links that go directly to the upstream release; collection pages open with a latest-issue hero and week dividers in the feed. - Workspace webhooks — teams can add a shared Slack, Discord, or signed-JSON webhook under Account → Workspace → Webhooks; owners and admins manage it, members can view and test deliveries, and all owners and admins are notified on auto-pause.…

**Added** - GitHub Action for publishing changelogs — a new `publish-changelog` Action diffs a changelog file on each push, maps changed sections onto upserted releases, and posts them to your Releases Index source; re-running the same commit is a no-op, and URL templates support heading permalink, date, version, and key formats. **Fixed** - Release cards no longer show pixelated avatar crops as inline media — the media filter now rejects CDN transform thumbnails where both resolved dimensions are ≤128 px (Cloudinary path transforms and imgix/Vercel query params), so only full-resolution editorial images appear. - Sources that silently stopped polling now self-heal — a successful manual fetch or re-enable re-arms the actor, and the hourly heartbeat folds unmanaged active sources into its pass so dead alarms recover within one tick rather than waiting out a full polling window. - Sign-in and create-account headings no longer surface a technical aside about API tokens — copy is simplified to focus on the product value.