What rorkai/App-Store-Connect-CLI shipped
Generated by FoxPlug from public activity — not affiliated with Asccli.
Week of September 14, 2026
What shipped
- Release 5.4.0 shipped with web session defaults, environment variable fallbacks for Apple ID, and documentation for web login. Release
- Apps can now configure App Store Server Notification endpoints directly in asc apps update with subscription status URL flags. Pull request #2716
- Custom product page creation now fetches the app primary locale and sends Apple's required compound payload with initial version and localization. Pull request #2724
- Review submission creation errors are now handled by preserving validated IDs when responses contain both success and top-level errors. Pull request #2714
- Build and pre-release pagination used by --since selection is now capped at 1000 pages to prevent unbounded requests. Pull request #2710
- Session credentials are now protected during attachment redirects by sending the authentication cookie exactly once on the initial request. Pull request #2665
- App-scoped build-upload 404s no longer retry indefinitely; the parent app is verified once to distinguish permanent from transient failures. Pull request #2664
- Review submission creation now fails closed when discovery or pagination is uncertain instead of silently creating new submissions. Pull request #2662
- Beta group assignments are now preflight-checked to stop before POST if builds are processing, expired, or blocked by export compliance. Pull request #2658
- Ambiguity diagnostics are now bounded and the tool fails closed on incomplete pagination instead of choosing from partial selector responses. Pull request #2639
Why it matters
This week focused on hardening session handling, validation, and pagination across the CLI. Multiple fixes prevent silent failures when App Store Connect returns incomplete data or errors, ensuring the tool fails closed and provides clear diagnostics. Security improvements protect credentials during redirects and reject symlinked cache files.
Changelog entry
- release: 5.4.0 with web session defaults and environment variable fallbacks Release
- feat: configure App Store Server Notification endpoints via asc apps update Pull request #2716
- fix: create custom product pages with required compound payload and initial version Pull request #2724
- fix: preserve validated review submission IDs when create responses contain errors Pull request #2714
- fix: cap build pagination at 1000 pages in --since selection Pull request #2710
- fix: protect session credentials during attachment redirects Pull request #2665
- fix: verify parent app before retrying app-scoped build-upload 404s Pull request #2664
- fix: fail closed before creating review submissions on uncertain state Pull request #2662
- fix: preflight beta group assignments to check build readiness Pull request #2658
- fix: fail closed on incomplete pagination instead of mutating from partial responses Pull request #2639
asc 5.4.0 ships with App Store Server Notification configuration, stricter validation on review submissions and beta assignments, bounded pagination, and hardened session security.
asc 5.4.0 is out. This release hardens validation across the board: review submissions now fail closed instead of silently creating duplicates, pagination is bounded to prevent runaway requests, session credentials are protected during redirects, and beta group assignments are preflight-checked. More than 30 fixes address security, reliability, and correctness in the CLI's interaction with App Store Connect APIs.