releases.sh Release Notes

Minor Changes

• e68e6ac: Add --format discord to releases webhook add/edit to deliver releases as formatted Discord embeds via a Discord incoming webhook URL. Human-readable webhook output redacts the delivery URL (the secret for Slack/Discord); --json still includes it.

Minor Changes

• a279404: Add releases admin recommendations notify-added so operators can opt in to emailing a submitter that their suggested source was added to the registry.

**Changed** - The product is now presented as "Release Notes Index" — new primary name on the homepage hero, header wordmark, OG metadata, and `llms.txt`; "Releases Index" is used in page titles, footer, and emails. Domain, API paths, and CLI binary are unchanged. - The MCP server's primary URL is now `https://agents.releases.sh/mcp\` — docs, installer cards, `llms.txt`, and the MCP Registry all point here; `https://mcp.releases.sh/mcp\` remains a working alias and existing tokens and client configs continue to work.

Minor Changes

• a060d4d: Add releases changelog to print recent product updates from releases.sh (the self-published releases-sh feed) and a link to https://releases.sh/updates. Also available as the local MCP changelog tool.

**Fixed** - Source changelog pages — the `/org/source` routes such as `/prisma/prisma-changelog` — were returning 500 errors sitewide and flagging as server errors in search-engine crawls; they now load correctly.

**Added** - Docs site gains three how-to guides: locating a changelog source for a product, converting any changelog to an RSS/Atom feed, and setting up release notifications. **Fixed** - MCP clients can now complete OAuth authorization — resource-request validation was incorrectly blocking clients that hadn't pre-declared their target resource, and a column encoding bug was silently discarding scope grants on new OAuth client registrations. - MCP OAuth sessions now issue refresh tokens so authenticated clients stay connected past the one-hour access-token expiry; concurrent token refreshes from multiple tabs or agent processes no longer trigger a forced re-authorization.

**Fixed** - Generic MCP clients (MCPJam and similar) can now complete OAuth against the hosted MCP server — extra grant types are intersected rather than rejected, unrecognized scopes are dropped, and both the origin and `/mcp` path are accepted as valid resource identifiers. Follow tools that forward the caller's Bearer token to the REST API now work end-to-end.

**Added** - API writes now support `Idempotency-Key` — send the header on token creation, API key creation, webhook creation/rotation, webhook test dispatches, recommendations, and feedback requests to get the same response on any retry within 24 hours. **Fixed** - Rate limit error responses now use the standard structured error envelope and include `Retry-After` and rate limit policy headers.

Patch Changes

• 17b9d2d: Route feedback, submit, and keys through the shared apiFetch transport instead of each rolling its own fetch call. apiFetch gained an opt-in skipDefaultAuth flag so a caller-supplied Authorization header (used by keys' session-token flow) isn't overwritten by a configured admin/API key. Error messages, idempotency behavior, and command output are unchanged.

Minor Changes

• a19a535: Send an Idempotency-Key header on effectful write requests (feedback submit, webhook create/rotate-secret/test, API-key mint) so a retry after a network failure replays the original response instead of double-submitting. A key reused with a different payload now surfaces a clear idempotency_conflict message instead of a raw 409.

**Fixed** - Hovering a link in a collection digest no longer underlines every link on the page simultaneously; the current-week digest byline is now visually distinct instead of rendering in the dimmest text tier. - Docs tables are now readable at typical viewport widths — wide tables scroll horizontally instead of overflowing onto the TOC rail, and the `/docs/api/rest` pagination table has been reformatted to fit the column cleanly.

**Changed** - Search timeframe filters now open as a popover on the search bar — the same control is reused on org, source, and collection timeline views. - Webhook settings now use proper selects for format and type, and destructive actions (delete, rotate, revoke) open a confirmation dialog instead of a browser prompt.

**Fixed** - Releases ingested through the batch API now have AI-generated titles and summaries before they are indexed for search — they previously embedded without generated content and had to wait for a background summarization pass.

**Changed** - Release title links now go directly to the upstream changelog entry across all feed surfaces — org and product pages, the homepage ticker, `/updates`, live stream, following, and collection timelines — as well as in digest emails. The on-site release detail page remains reachable via a secondary "Read more" or "Details" link on each card.

**Changed** - New releases appear on the site sooner — page revalidation is now triggered at ingest time rather than waiting for a background schedule. **Fixed** - Incremental extraction now escalates to a full-page pass when a scrape window returns zero results on a page whose content has changed — sources with long individual entries no longer silently stall between fetch cycles. - Video sources now trigger site revalidation and route through the configured AI models on initial ingest; both were silently skipped before.

**Added** - MCP server now implements MCP spec `2026-07-28` — modern clients receive plain JSON responses; 2025-era clients continue receiving SSE framing unchanged.