What rorkai/App-Store-Connect-CLI shipped
Written by FoxPlug from the repository's own releases; not affiliated with Asccli. Paste your own repository in the box below and FoxPlug writes the same weekly update for your product. This page is an automatic summary of the releases, pull requests and commits in github.com/rorkai/App-Store-Connect-CLI; Asccli did not write it and does not use or endorse FoxPlug. Every line links to the change it describes.
Get a weekly update like this for your product, free
Week of November 2, 2026
What shipped
- Xcode archive --overwrite now builds the replacement in a private sibling directory and swaps it into place only after success, restoring a backup if publishing fails. Pull request #3418
- Inline App Store Connect keys are resolved as PEM in memory for regular CLI signing instead of being written to the system temp directory first. Pull request #3416
- Builds upload now starts a fresh API timeout after the file commits when --wait or --test-notes needs build discovery, so a successful transfer is not cut short by the reservation deadline. Pull request #3411
- Release stage now checks the selected build's audience during preflight and rejects internal-only TestFlight builds before any version or metadata writes. Pull request #3423
- Metadata commands now verify that an explicit --app-info belongs to the selected app before planning or applying, preventing patches to another app's localization. Pull request #3420
- Screenshot processing and checksum status polling now retries transient errors under the existing bounded transient-wait policy. Pull request #3431
- Versions create --if-exists update now sends version attributes and the build relationship in a single PATCH when recovering an existing version. Pull request #3427
- Latest-build lookup now follows continuation links through empty pages instead of treating an empty page as the end of the collection. Pull request #3441
- Asset library image commit responses that already identify the reserved image with a ready state are reused instead of polled again. Pull request #3413
- Localizations update now rejects --version in app-info mode and --app-info in version mode instead of silently dropping those selectors. Pull request #3436
Why it matters
This week tightened several places where the CLI could send a request aimed at one app, build or report and get back or act on another, especially around cursors, explicit app-info and app flags. It also made long operations safer: archive overwrites keep the old archive until the new one is in place, build upload waits get a fresh deadline after commit, and screenshot and asset polling retries transient failures.
Changelog entry
- Xcode archive --overwrite keeps the existing archive until the replacement is built and published, with a backup on filesystems without atomic directory exchange. Pull request #3418
- Regular CLI signing resolves inline ASC_PRIVATE_KEY and ASC_PRIVATE_KEY_B64 values as PEM in memory; altool keeps private file creation. Pull request #3416
- Builds upload with --wait or --test-notes starts a fresh API timeout after the build file commits. Pull request #3411
- Release stage rejects builds restricted to internal TestFlight during preflight, before creating a version or applying metadata. Pull request #3423
- Metadata planning and apply verify that an explicit --app-info belongs to the selected app. Pull request #3420
- Screenshot processing and checksum polling retries transient errors with the bounded transient-wait policy. Pull request #3431
- Versions create --if-exists update sends attributes and the build relationship in one version PATCH when recovering an existing version. Pull request #3427
- Latest-build lookup follows continuation links through empty pages. Pull request #3441
- Asset library image commit responses that identify the reserved image and show its ready state are reused. Pull request #3413
- Localizations update rejects --version in app-info mode and --app-info in version mode. Pull request #3436
- Builds list rejects --app with --next, and subscription listing and price listing reject selectors that a cursor already supplies. Pull request #3421
- Analytics download stops listing segments once an exact --segment-id match is found. Pull request #3438
This week: archive overwrites keep the old archive until the new one is in place, build upload waits get a fresh timeout after commit, and cursors that conflict with explicit app or app-info flags now fail instead of silently overriding them.
This week's changes focus on making failure modes predictable. xcode archive --overwrite now builds the replacement in a sibling directory and only swaps it in after success, restoring a backup if publishing fails. Build upload waits get a fresh timeout after the file commits, so a successful transfer isn't cut short. Several commands now reject conflicting selectors: pagination cursors that override an explicit app, and an --app-info that belongs to a different app. Screenshot status polling retries transient errors under the existing bounded policy.
Week of October 26, 2026
What shipped
- Version 6.3.0 was released. Release
- Authentication now supports Enterprise Program API keys, including a key type option at login and the ASC_KEY_TYPE variable. Pull request #3250
- A client can now target the Enterprise Program API host and JWT audience. Pull request #3249
- Private key handling accepts keys flattened by a secret store instead of failing with invalid PEM data. Pull request #3260
- Version release reads the version back after an ambiguous failure, so a release that went out no longer leaves CI red. Pull request #3261
- Signing fetch now prefers the active profile with the latest expiry when renewed profiles overlap. Pull request #3258
- Default profile names no longer collide when a second bundle ID is created on the same day. Pull request #3254
- Xcode version and signing gained experimental support for the JSON project format used by newer Xcode project files. Pull request #3268
- Screenshot and preview upload gained an opt-in Asset Library path, proven only against test transports and not yet run against App Store Connect. Pull request #3271
- Notarization log can fetch the log content as JSON or save it to a file with a receipt. Pull request #3267
Why it matters
This week's release and fixes target the failures that break CI and signing runs: flattened private keys, ambiguous release errors, profile and name collisions, and Retry-After handling. Enterprise Program API keys and hosts open a second API surface for teams that need it. Several validation and upload changes add checks or opt-in paths rather than changing defaults.
Changelog entry
- Release 6.3.0. Release
- Auth: support Enterprise Program API keys with a key type option and ASC_KEY_TYPE. Pull request #3250
- Asc: let a client target the Enterprise Program API host and JWT audience. Pull request #3249
- Auth: accept private keys flattened by a secret store. Pull request #3260
- Versions: read the version back after an ambiguous release failure. Pull request #3261
- Signing: prefer the active profile with the latest expiry. Pull request #3258
- Signing: keep default profile names from colliding. Pull request #3254
- Xcode: support the JSON project format in xcode version. Pull request #3268
- Notarization: fetch the developer log content with fetch and path. Pull request #3267
- Pricing: support a temporary price with a return price point in schedule create. Pull request #3266
- Validate: require Apple TV privacy policy text for tvOS versions. Pull request #3273
- Xcode: warn about literal plist bundle versions in version edit and bump receipts. Pull request #3240
Version 6.3.0 is out. Enterprise Program API keys and hosts are supported, flattened private keys no longer fail with invalid PEM data, and version release reads the version back after an ambiguous failure. Profile name collisions and expired-profile selection are fixed too.
Version 6.3.0 is out. This week's work focuses on the failures that break CI and signing runs: private keys flattened by a secret store are now accepted instead of failing with invalid PEM data, version release reads the version back after an ambiguous failure instead of leaving CI red, and signing fetch prefers the active profile with the latest expiry. Default profile names no longer collide on a second bundle ID the same day, and phased-release polling honors Retry-After. Enterprise Program API keys and hosts are now supported. An opt-in Asset Library upload path has been added but has not run against App Store Connect yet, so no defaults changed.
Week of October 19, 2026
What shipped
- Version 5.17.0 shipped, adding apps wall entries and new --include flags to builds info and iap view and iap list, plus screenshot reordering. Release
- Typed read commands now keep Apple attributes returned as null, false, empty string or empty array instead of dropping them from JSON output. Pull request #3178
- Typed reads now redact unmodeled secret-like attributes so credential-shaped fields Apple adds do not appear in output. Pull request #3190
- The default TestFlight group now resolves even though Apple spells it with a non-breaking space, and group builds and testers reads were added. Pull request #3181
- Merged --paginate output no longer carries the stale nextCursor from page one. Pull request #3189
- Versions view now prints Apple's appStoreVersions attributes unfiltered, and the flat summary form is deprecated. Pull request #3174
- Validation now warns when custom product page keywords are missing from the version's keyword list. Pull request #3175
- Pricing territory-availabilities can now be listed by app with --app or ASC_APP_ID. Pull request #3179
- Screenshots gained set reorder, listing a single set, and including screenshots in set listings. Pull request #3182
- Subscription introductory offers gained a territory filter and include flags, with hints added for removed submit commands. Pull request #3177
Why it matters
This week closes a gap in typed reads so the JSON output matches Apple's response again, including null, false and empty values, while unmodeled secret-like attributes are redacted. It also brings several commands people previously had to cover with raw API calls into native flags: build and in-app purchase includes, TestFlight group reads, screenshot set operations, and subscription territory filters. Validation and versions behavior also changed to warn about custom product page keyword loss and to print full version attributes.
Changelog entry
- Release 5.17.0. Release
- Builds info: add --include. Pull request #3173
- Iap view and iap list: add --include. Pull request #3176
- Screenshots: reorder a set, list one set, include screenshots in set listings. Pull request #3182
- TestFlight: resolve the default group with Apple's non-breaking space and add group builds and testers reads. Pull request #3181
- Localizations view: read one localization by ID. Pull request #3180
- Subscriptions: add territory and include read flags and hints for removed submit commands. Pull request #3177
- Pricing territory-availabilities: list by app with --app or ASC_APP_ID. Pull request #3179
- Typed reads keep null, false and empty Apple attributes. Pull request #3178
- Typed reads redact unmodeled secret-like attributes. Pull request #3190
- Merged --paginate output drops the stale nextCursor. Pull request #3189
- Validate: warn when custom product page keywords are missing from the version's keywords. Pull request #3175
5.17.0 is out. Typed reads keep Apple's null, false and empty attributes and redact unmodeled secret-like ones. New --include for builds info and iap, TestFlight group resolution that handles Apple's non-breaking space, screenshots set reorder, and pricing territory-availabilitie
5.17.0 is out. Typed reads now keep Apple's null, false and empty attributes instead of dropping them, and unmodeled secret-like attributes are redacted. Builds info and iap view and iap list gained --include, TestFlight's default group resolves despite the non-breaking space in Apple's name, and group builds and testers reads were added. Screenshots now support set reorder, single set listing and screenshots in set listings, pricing territory-availabilities can be listed by app, and subscriptions gained territory and include flags. Validation warns when custom product page keywords are missing from a version's keywords.
Week of October 12, 2026
What shipped
- Web auth now supports requesting an SMS two-factor code with the sms two-factor method option. Pull request #3084
- Added an experimental macOS-only helper that reads the SMS code from Messages and can be used as the two-factor code command during web auth login. Pull request #3085
- Released version 5.15.0 with new apps added to the apps wall. Release
- Added 你的话 - 懂你的人在这 to the Wall of Apps. Pull request #3082
- Added Pollenomics to the Wall of Apps. Pull request #3083
- Added World Clock Time Zones - Timo to the Wall of Apps. Pull request #3072
- Added Phoo - Public Toilet Finder to the Wall of Apps. Pull request #3071
- Added PPL Exam Prep - PilotTestZone to the Wall of Apps. Pull request #3070
- Added Fridgea: Fridge & Grocery List to the Wall of Apps. Pull request #3069
- Added Fogged: Travel Photo Map to the Wall of Apps. Pull request #3068
Why it matters
People signing in with an Apple Account that has trusted devices can now ask Apple to send the code by SMS instead of deliberately entering a wrong trusted-device code, and macOS users have an experimental way to read that code automatically. The apps wall also grew by a large number of community-submitted apps this week, with the changes included in version 5.15.0.
Changelog entry
- Release 5.15.0 with new apps wall entries. Release
- Web auth: request SMS two-factor verification with --two-factor-method sms. Pull request #3084
- Web auth: add experimental macOS Messages SMS code reader usable as the 2FA code command. Pull request #3085
- Apps wall: add 你的话 - 懂你的人在这. Pull request #3082
- Apps wall: add Pollenomics. Pull request #3083
- Apps wall: add World Clock Time Zones - Timo. Pull request #3072
- Apps wall: add Phoo - Public Toilet Finder. Pull request #3071
- Apps wall: add PPL Exam Prep - PilotTestZone. Pull request #3070
- Apps wall: add Fridgea: Fridge & Grocery List. Pull request #3069
- Apps wall: add Fogged: Travel Photo Map. Pull request #3068
- Apps wall: add Aida Simple Fast Daily Planner. Pull request #3066
- Apps wall: add Swayni: Custom Workout Timer. Pull request #3065
This week: web auth can request an SMS two-factor code with --two-factor-method sms, plus an experimental macOS helper that reads the code from Messages. Version 5.15.0 is out, and the Wall of Apps keeps growing with community submissions.
This week the CLI gained two related web auth changes. You can now ask Apple to send your sign-in code by SMS using the sms two-factor method, instead of entering a wrong trusted-device code on purpose. On macOS there is also an experimental helper that reads the SMS code from Messages and can be used as the two-factor code command during web auth login. Version 5.15.0 shipped this week, and the Wall of Apps added a large batch of community-submitted apps.
Week of October 5, 2026
What shipped
- Added asc builds compile and asc builds package so iOS apps can be compiled and packaged on Linux hosts using the installed xtool and rcodesign. Pull request #2949
- Xcode version edits now change only the requested build-setting tokens, preserving quoting, indentation, key order and comments, so an eight-configuration bump produces eight changed lines. Pull request #3024
- Bumped the go directive to 1.27.2 to resolve GO-2026-6617 in net/http/internal/http2, moving every workflow to the patched standard library. Pull request #3018
- Signing plan builds now reuse rooted directories instead of calling rootfs.New for every xcconfig path check, read and stat. Pull request #2983
- Signing xcconfig paths are now indexed instead of being rescanned and re-normalized on every comparison. Pull request #3000
- Video preview downloads now save HLS master playlists as.m3u8 files instead of.mp4 files. Pull request #2987
- Metadata push no longer fails when a locale is new in both the app-info and version families, since version localizations auto-created by app-info creates are now updated. Pull request #2986
- Date-only profile expiration dates are now treated as end of day UTC rather than midnight, so profiles dated today are not skipped or renewed early. Pull request #3008
- Signing plan and apply now tolerate clock skew on newly created provisioning profiles. Pull request #3011
- Web sessions now honor ASC_BYPASS_KEYCHAIN instead of falling back to the system keychain. Pull request #3010
Why it matters
This week covers two broad areas: Linux users can now compile and package iOS builds without a Mac, and a long list of correctness fixes landed for Xcode version edits, signing plans, provisioning profile dates, metadata push and video preview downloads. The remaining changes make the test suite deterministic and faster, so the same behavior is checked without wall-clock flakiness.
Changelog entry
- Feat(builds): add asc builds compile and asc builds package for compiling and packaging iOS apps on Linux hosts Pull request #2949
- Fix(xcode): preserve project formatting when editing version build settings Pull request #3024
- Build: bump Go to 1.27.2 to clear GO-2026-6617 Pull request #3018
- Perf: reuse rooted directories while building a signing plan Pull request #2983
- Perf(xcode): index signing xcconfig paths instead of rescanning them Pull request #3000
- Fix(video-previews): save HLS preview playlists as.m3u8 Pull request #2987
- Fix(metadata): update version localizations auto-created by app-info creates Pull request #2986
- Fix(signing): treat date-only profile expiry as end of day Pull request #3008
- Fix(xcode): tolerate clock skew on new provisioning profiles Pull request #3011
- Fix(web): honor ASC_BYPASS_KEYCHAIN for web sessions Pull request #3010
- Fix(assets): keep App Store order in set fallbacks and explain preview migration Pull request #3013
- Fix(builds): keep iOS build output anchored to the selected directory Pull request #3012
This week: asc builds compile and asc builds package bring iOS compile and packaging to Linux. Xcode version edits keep formatting, signing plans reuse rooted directories, profile expiry treats date-only as end of day, and video previews download as.m3u8.
This week the project added asc builds compile and asc builds package, so Linux hosts can compile and package iOS apps using the installed xtool and rcodesign instead of only uploading builds. Correctness work landed across several areas: Xcode version edits now touch only the requested build-setting tokens and keep quoting, indentation, key order and comments; signing plan builds reuse rooted directories and index xcconfig paths instead of rescanning them; date-only provisioning profile expiration is treated as end of day; metadata push handles locales auto-created by app-info creates; and video preview downloads save HLS playlists as.m3u8. The go directive moved to 1.27.2 to clear GO-2026-6617.
Week of September 28, 2026
What shipped
- App Store Server API reads added to storekit commands, enabling queries about customer purchases, subscription status, and notifications without custom scripts. Pull request #2871
- Status command now waits for release outcomes with --until flag and suggests next actions from the API response. Pull request #2872
- Builds can now be selected by number or latest when attaching to versions, eliminating the need to copy opaque build IDs. Pull request #2870
- In-app purchases and subscriptions now support importing version localizations from JSON files for bulk localization updates. Pull request #2869
- Xcode validate command now passes resolved credentials to altool instead of only forwarding flags. Pull request #2876
- Apple Ads and web status errors now map to proper exit codes matching the documented error handling rules. Pull request #2875
- TestFlight add-testers now classifies unknown and ambiguous email addresses instead of reporting them as internal errors. Pull request #2874
- Subscriptions setup failures now report to stderr with clear error messages instead of silent stdout JSON. Pull request #2873
- Pricing availability create now accepts --all-territories flag to make an app available everywhere in one command. Pull request #2832
- In-app purchase and subscription review screenshots are validated for dimensions and format before upload. Pull request #2840
Why it matters
This week added three significant new capabilities: App Store Server API support for subscription and purchase queries, build selection by number, and JSON-based localization imports. The week also focused heavily on improving error reporting and validation across multiple commands, ensuring users get actionable messages instead of silent failures or internal errors.
Changelog entry
- 5.10.0: App Store Server API reads for storekit, build selection by number, localization JSON import, improved error reporting Release
- Feat(storekit): add App Store Server API reads for subscriptions and purchases Pull request #2871
- Feat(versions): select builds by number or latest when attaching Pull request #2870
- Feat(iap,subscriptions): import version localizations from JSON file Pull request #2869
- Feat(status): wait for release outcomes with --until and suggest nextCommands Pull request #2872
- Fix(xcode): pass resolved credentials to altool validate Pull request #2876
- Fix(cli): map Apple Ads and web status errors to exit codes Pull request #2875
- Fix(testflight): classify unknown and ambiguous add-testers emails Pull request #2874
- Fix(subscriptions): report setup failures on stderr Pull request #2873
- Feat(pricing): add --all-territories to availability create Pull request #2832
- Fix(iap,subscriptions): check review screenshots before uploading Pull request #2840
- Fix(pricing): evaluate prices on US Pacific day with exclusive end dates Pull request #2836
Asccli 5.10.0 shipped: App Store Server API reads for subscriptions, builds selectable by number, localizations importable from JSON, and fixes across validate, status, testflight, subscriptions, pricing, and more.
Asccli 5.10.0 is out. New: query App Store Server API for subscriptions and purchases. Select builds by number when attaching versions. Import localizations from JSON. Improved error reporting across xcode validate, subscriptions setup, testflight add-testers, pricing, review details, and version resolution. Better handling of TestFlight build states and pricing date calculations.
Week of September 21, 2026
What shipped
- Version 5.7.0 released with raw authenticated request passthrough, dSYM download selection and waiting, global read-only mode, and value indirection for environment variables and files. Release
- Signing sync adds lifecycle operations: profile deletion, certificate revocation, device refresh, and Mac inclusion via asc signing sync nuke. Pull request #2777
- Signing sync now supports S3-compatible object storage as a backend alongside Git for storing encrypted signing artifacts. Pull request #2778
- Screenshots framing expands to iPad, Apple Watch, and Apple TV devices with per-device colors, text overlays, and resumable batch processing. Pull request #2776
- OpenAPI schema updated to version 4.5 with new endpoints for performance overviews, game-center blocking and score moderation, subscription organization markets, and Korean age ratings. Pull request #2761
- Device registration gains --via-url to serve a loopback page for collecting remote device identifiers from iOS devices. Pull request #2698
- Resource ID flags across 399 flag declarations now accept App Store Connect self-links in addition to bare IDs. Pull request #2591
- Web service domain updates for Sign in with Apple now function instead of rejecting every update attempt. Pull request #2705
- Offline metadata inspection added with asc ipa-info and asc pkg-info for local IPA and flat package artifacts. Pull request #2680
- Migration includes App Clip and preview files in the canonical layout during import, export, and validation. Pull request #2704
Why it matters
Version 5.7.0 consolidates months of work on signing infrastructure, screenshots, and API expansion. Object storage for signing, device registration over HTTPS, and new OpenAPI 4.5 endpoints for game-center, subscriptions, and performance data mean the tool handles larger teams and modern app features. Self-link support simplifies piping between commands.
Changelog entry
- Feat(api): raw authenticated request passthrough Release
- Feat(builds): select and wait for dSYM downloads Release
- Feat(cli): global read-only mode (ASC_READ_ONLY / --read-only) Release
- Feat(cli): @env: and @file: value indirection for string flags Release
- Feat(signing): add sync nuke, profile renewal, device refresh, and Mac inclusion Pull request #2777
- Feat(signing): add object storage backend for signing sync Pull request #2778
- Feat(screenshots): add iPad, watch, and TV frames with colors, text, and batches on Koubou 0.20.0 Pull request #2776
- Feat(cli): accept self-links on the remaining resource ID flags Pull request #2591
- Docs(openapi): update schema to 4.5 Pull request #2761
- Feat(performance): read API 4.5 performance overviews Pull request #2763
- Feat(subscriptions): support organization markets and multi-seat settings Pull request #2764
- Feat(game-center): add leaderboard score moderation Pull request #2765
- Feat(game-center): add blocked player management Pull request #2766
- Feat(age-rating): support API 4.5 Korea ratings and GRAC numbers Pull request #2762
- Feat(devices): collect remote UDIDs from a registration URL Pull request #2698
- Feat(cli): inspect local IPA and flat package artifacts Pull request #2680
- Feat(screenshots): add deterministic frame overlays and resume Pull request #2734
- Feat(migrate): keep App Clip and preview files in the canonical layout Pull request #2704
- Feat(artifacts): report signer identity in ipa-info and pkg-info Pull request #2769
- Fix(devices): single-use --via-url callback tokens and streamed arrival receipts Pull request #2770
Asccli 5.7.0: raw API passthrough, dSYM waits, signing nuke, object storage, S3 backends, iPad/Watch/TV frames, self-link IDs, read-only mode, and @env/@file indirection.
Asccli 5.7.0 ships: signing sync with lifecycle operations (nuke, revoke, refresh), S3-compatible object storage backends, device registration via HTTPS, screenshots on iPad/Watch/TV with text overlays, OpenAPI 4.5 support (game-center, subscriptions, performance), raw API passthrough, self-link resource IDs, and global read-only mode for safer automation.
Week of September 14, 2026
What shipped
- Release 5.4.0 shipped with web session defaults, environment variable fallbacks for Apple ID, and documentation for web login. Release
- Apps can now configure App Store Server Notification endpoints directly in asc apps update with subscription status URL flags. Pull request #2716
- Custom product page creation now fetches the app primary locale and sends Apple's required compound payload with initial version and localization. Pull request #2724
- Review submission creation errors are now handled by preserving validated IDs when responses contain both success and top-level errors. Pull request #2714
- Build and pre-release pagination used by --since selection is now capped at 1000 pages to prevent unbounded requests. Pull request #2710
- Session credentials are now protected during attachment redirects by sending the authentication cookie exactly once on the initial request. Pull request #2665
- App-scoped build-upload 404s no longer retry indefinitely; the parent app is verified once to distinguish permanent from transient failures. Pull request #2664
- Review submission creation now fails closed when discovery or pagination is uncertain instead of silently creating new submissions. Pull request #2662
- Beta group assignments are now preflight-checked to stop before POST if builds are processing, expired, or blocked by export compliance. Pull request #2658
- Ambiguity diagnostics are now bounded and the tool fails closed on incomplete pagination instead of choosing from partial selector responses. Pull request #2639
Why it matters
This week focused on hardening session handling, validation, and pagination across the CLI. Multiple fixes prevent silent failures when App Store Connect returns incomplete data or errors, ensuring the tool fails closed and provides clear diagnostics. Security improvements protect credentials during redirects and reject symlinked cache files.
Changelog entry
- Release: 5.4.0 with web session defaults and environment variable fallbacks Release
- Feat: configure App Store Server Notification endpoints via asc apps update Pull request #2716
- Fix: create custom product pages with required compound payload and initial version Pull request #2724
- Fix: preserve validated review submission IDs when create responses contain errors Pull request #2714
- Fix: cap build pagination at 1000 pages in --since selection Pull request #2710
- Fix: protect session credentials during attachment redirects Pull request #2665
- Fix: verify parent app before retrying app-scoped build-upload 404s Pull request #2664
- Fix: fail closed before creating review submissions on uncertain state Pull request #2662
- Fix: preflight beta group assignments to check build readiness Pull request #2658
- Fix: fail closed on incomplete pagination instead of mutating from partial responses Pull request #2639
Asc 5.4.0 ships with App Store Server Notification configuration, stricter validation on review submissions and beta assignments, bounded pagination, and hardened session security.
Asc 5.4.0 is out. This release hardens validation across the board: review submissions now fail closed instead of silently creating duplicates, pagination is bounded to prevent runaway requests, session credentials are protected during redirects, and beta group assignments are preflight-checked. More than 30 fixes address security, reliability, and correctness in the CLI's interaction with App Store Connect APIs.