---
title: "Changelog"
description: "New features, fixes, and supported Flutter versions in Shorebird, newest first."
---

Each entry names the Shorebird CLI release that shipped it, if any; compare it with `shorebird --version`, and run `shorebird upgrade` to get newer changes. RSS feed: [/changelog.xml](/changelog.xml)

## November 2026

### Add an app collaborator to the organization

**New** in Console, 2026-11-03. Permalink: [/changelog/#console-add-collaborator-to-org](/changelog/#console-add-collaborator-to-org)

On an app's Collaborators page, Add to organization makes a per-app collaborator a Developer of the organization in one step.

- They then see every app the organization owns, and their per-app access is removed.

Docs: [Per-app collaborators](/account/orgs/#per-app-collaborators)

### Apple patches that link below 20% fail by default

**Changed** in CLI, 2026-11-02, Shorebird CLI 1.6.135 ([release notes](https://github.com/shorebirdtech/shorebird/blob/v1.6.135/RELEASE_NOTES.md)). Permalink: [/changelog/#apple-patch-min-link-percentage](/changelog/#apple-patch-min-link-percentage)

`--min-link-percentage` now defaults to 20, so an iOS or macOS patch that shares less than 20% of its Dart code with the release fails instead of publishing. Such a patch can run much slower than the release.

- The error is `The link percentage of this patch (<n>%) is below the minimum threshold (20%).`, followed by `Not publishing.` A `--dry-run` fails the same way.
- Pass `--min-link-percentage=0` to accept any link percentage, as before.

```sh
shorebird patch ios --min-link-percentage=0
```

Docs: [The failure below 20%](/code-push/performance/#the-failure-below-20)

### Builds no longer run your own Flutter's pub get

**Fixed** in CLI, 2026-11-02, Shorebird CLI 1.6.136 ([release notes](https://github.com/shorebirdtech/shorebird/blob/v1.6.136/RELEASE_NOTES.md)). Permalink: [/changelog/#builds-skip-system-flutter-pub-get](/changelog/#builds-skip-system-flutter-pub-get)

Shorebird no longer runs `flutter pub get` with the Flutter on your `PATH` after each build. That step could make Xcode's Product > Archive fail after `shorebird release`.

- With a Dart-Code (VS Code) extension older than v3.140, VS Code can pick Shorebird's Flutter after a Shorebird build. Update the extension, or run `flutter pub get` to switch back.

Docs: [Can't run your app in VS Code](/code-push/troubleshooting/#cant-run-your-app-in-vs-code)

### More CLI fixes in 1.6.135

**Fixed** in CLI, 2026-11-02, Shorebird CLI 1.6.135 ([release notes](https://github.com/shorebirdtech/shorebird/blob/v1.6.135/RELEASE_NOTES.md)). Permalink: [/changelog/#cli-fixes-1-6-135](/changelog/#cli-fixes-1-6-135)

CLI 1.6.135 also fixes these issues.

- With several platforms, `shorebird patch` checks that it can patch each one before building any, so one platform's failure no longer leaves another patched.
- Patching a release signed with your own key fails before the build when the signing flags are missing, instead of after it.
- An iOS or macOS `--flavor` with no matching Xcode scheme fails before the build, with an error that names the flavors you can build.
- Where the CLI can't prompt, a patch blocked by native or asset changes fails with an error that names the flag to publish anyway, or the command for a new release.
- `shorebird release ios` warns when the `--split-debug-info` dSYM has no Dart debug info, which happens with Xcode 27 and Flutter 3.47.5 to 3.47.9, so crash reports would have no Dart function names.
- For an app that also builds for iOS, `shorebird release android` warns when the Android version name has characters an iOS version can't, so the two platforms' releases won't be the same Shorebird release.
- `shorebird upgrade` sets up the new version before it exits, on every platform.
- iOS and macOS patches use the kernel their own build compiled, even when another build runs in the project at the same time.
- Android builds find the app bundle when `base.archivesName` renames it, and a `--save-obfuscation-map` you pass is honored.
- `shorebird init` with several flavor dimensions detects only flavors you can build.
- `shorebird auth token` takes no arguments and points you to `shorebird tokens` for API keys.
- A command run through an alias names the command it's an alias of.
- Errors for a missing app, a missing release, or a failed download name the next step.

### CLIs older than 1.6.87 are no longer supported

**Changed** in API, 2026-11-02. Permalink: [/changelog/#cli-minimum-1-6-87](/changelog/#cli-minimum-1-6-87)

The Shorebird server now refuses requests from Shorebird CLI versions older than 1.6.87, so run `shorebird upgrade` if you're on one. The oldest supported version used to be 1.4.0.

- An older CLI gets HTTP 426 with the code `upgrade_required` and the message `This version of the Shorebird CLI is no longer supported.`
- There's no longer an upper limit on the CLI version.
- In CI, install the latest CLI rather than a pinned old one.

```sh
shorebird upgrade
```

Docs: [Keeping Shorebird up to date](/getting-started/#keeping-shorebird-up-to-date)

### Organization, members, service account, audit log, and usage commands

**New** in CLI, 2026-11-02, Shorebird CLI 1.6.135 ([release notes](https://github.com/shorebirdtech/shorebird/blob/v1.6.135/RELEASE_NOTES.md)). Permalink: [/changelog/#cli-organization-commands](/changelog/#cli-organization-commands)

New commands manage your organizations from the command line. Each returns JSON with `--json`, except `shorebird service-accounts keys create`, which opens the console. Those that act on one organization take `--org-id`.

- `shorebird orgs` lists, shows, creates, and renames your organizations. `shorebird orgs list` replaces `shorebird account orgs`, which still works.
- `shorebird usage` shows an organization's patch installs this period, by app.
- `shorebird members` lists, invites, and removes members, and changes their roles.
- `shorebird service-accounts` creates, changes, and deletes service accounts, lists and revokes their keys, and adds and removes their trust rules.
- `shorebird audit-log` reads one page of the audit log, or exports all of it as OCSF events.

Docs: [Organization commands](/account/cli/#organization-commands)

### Turn usage alert emails off in the Console or from the email

**New** in Console, 2026-11-02. Permalink: [/changelog/#console-email-preferences](/changelog/#console-email-preferences)

The Console's Email notifications card has a Usage alerts switch for the emails that warn when an organization you're in nears or reaches its patch install limit. Each of these emails also has an unsubscribe link that works without signing in.

- Emails about invoices, payments, invitations, and account security are always sent.

Docs: [Turn email notifications on or off](/account/cli/#turn-email-notifications-on-or-off)

### API key, session, and account commands

**Changed** in CLI, 2026-11-02, Shorebird CLI 1.6.135 ([release notes](https://github.com/shorebirdtech/shorebird/blob/v1.6.135/RELEASE_NOTES.md)). Permalink: [/changelog/#console-handoff-commands](/changelog/#console-handoff-commands)

New commands cover API keys, sessions, and your account. Actions that are hard to undo or that create credentials open the Shorebird console, where you finish them, and `shorebird apps delete` no longer deletes the app.

- `shorebird tokens list` lists your API keys, and `shorebird account sessions` lists your sessions, when you're signed in with `shorebird login`.
- `shorebird tokens create`, `shorebird tokens delete`, and `shorebird account delete` open the console page that does each one.
- `shorebird logout --all` logs you out here, then opens the console to sign out your other sessions.
- `shorebird apps delete` no longer deletes the app. It opens the app's Settings page in the console. Older releases still delete with `--confirm-name`.
- Without a terminal, in CI, or with `--json`, these hand-offs exit with code 69 and a `console_required` error that holds the link.

Docs: [API keys and sessions](/account/cli/#api-keys-and-sessions)

### Enterprise commands

**New** in CLI, 2026-11-02, Shorebird CLI 1.6.136 ([release notes](https://github.com/shorebirdtech/shorebird/blob/v1.6.136/RELEASE_NOTES.md)). Permalink: [/changelog/#enterprise-commands](/changelog/#enterprise-commands)

`shorebird enterprise` works on your enterprise and across every organization in it. On its own, it shows the enterprise and your role in it.

- `members` lists the enterprise's directory and changes enterprise roles, and `guests` lists people in its organizations who aren't in the directory.
- `orgs list` and `apps list` cover every organization and app in the enterprise, including ones you aren't in.
- `audit-log`, `usage`, and `service-accounts list` work as their organization versions do, across the whole enterprise.
- What you can read or change depends on your enterprise role.

```sh
shorebird enterprise apps list
```

Docs: [Manage your enterprise from the CLI](/enterprise/#manage-your-enterprise-from-the-cli)

### Flutter 3.47.9 support

**New** in Flutter, 2026-11-02, Shorebird CLI 1.6.135 ([release notes](https://github.com/shorebirdtech/shorebird/blob/v1.6.135/RELEASE_NOTES.md)). Permalink: [/changelog/#flutter-3-47-9](/changelog/#flutter-3-47-9)

Shorebird now supports Flutter 3.47.9 and Dart 3.13.7, the default in Shorebird 1.6.135. In releases built with it, patch checks and downloads on iOS, macOS, and Android go through the platform's own HTTP stack.

- The device's proxy and VPN settings apply to patch checks and downloads.
- Android: your app's Network Security Config applies to them.
- iOS and macOS: App Transport Security and the system's trusted certificates, including ones installed by device management, apply to them.
- If your app restricts network traffic or pins certificates, check that it allows Shorebird's hosts.
- Windows: `flutter_tools` exits with an actionable error when a path is too long, instead of crashing.
- `flutter test` no longer crashes compiling native assets in pub workspaces, monorepos, and symlinked directories.

```sh
shorebird release android --flutter-version=3.47.9
```

Docs: [Your users are behind a proxy or VPN](/system/firewalls-and-mirrors/#your-users-are-behind-a-proxy-or-vpn)

### Warning when a release's Flutter has a known problem

**New** in CLI, 2026-11-02, Shorebird CLI 1.6.135 ([release notes](https://github.com/shorebirdtech/shorebird/blob/v1.6.135/RELEASE_NOTES.md)). Permalink: [/changelog/#flutter-revision-known-problem-warning](/changelog/#flutter-revision-known-problem-warning)

`shorebird patch` now warns when the release you're patching was built with a Flutter revision that has a known problem on that platform, such as the iOS crashes in Flutter 3.44.0 to 3.44.8 and the early 3.44.9 build `c2515c46c7`.

- The warning names the release's Flutter version and revision, and the problem.
- The patch is still created. A patch can't change the Flutter version a release was built with, so the fix is a new release on a Flutter version without the problem.

Docs: [App crashes after a patch installs](/code-push/troubleshooting/#app-crashes-after-a-patch-installs)

### Patching asks which track to publish to

**Changed** in CLI, 2026-11-02, Shorebird CLI 1.6.135 ([release notes](https://github.com/shorebirdtech/shorebird/blob/v1.6.135/RELEASE_NOTES.md)). Permalink: [/changelog/#patch-asks-for-track](/changelog/#patch-asks-for-track)

Without `--track`, `shorebird patch` in a terminal now asks whether to publish to `staging`, `beta`, or `stable`, with `staging` selected. Before, it published to `stable`, which reaches all users.

- Where it can't ask, such as in CI, it still publishes to `stable` and warns. Pass `--track` to choose.
- The track is checked before the build, so a bad `--track` fails early.

```sh
shorebird patch android --track=staging
```

Docs: [Publishing a patch to a track](/code-push/tracks/#publishing-a-patch-to-a-track)

### Preview starts from a clean install on Android

**Changed** in CLI, 2026-11-02, Shorebird CLI 1.6.135 ([release notes](https://github.com/shorebirdtech/shorebird/blob/v1.6.135/RELEASE_NOTES.md)). Permalink: [/changelog/#preview-fixes-1-6-135](/changelog/#preview-fixes-1-6-135)

On Android, `shorebird preview` now uninstalls the app before installing the release, instead of clearing its data. Anything the app kept outside its data paths goes too, and preview works on devices that don't let adb clear app data.

- When no iOS device is found, preview says it can't use the iOS simulator, as Shorebird releases are release builds. Use a physical iPhone or iPad.
- When an iOS device rejects the app, preview shows the device's reason. For a rejected provisioning profile, it explains how to fix the profile and make a new release.
- Apps with the same name are listed with their app ids, so you can tell them apart.

Docs: [Preview a release](/code-push/preview/)

### Notices about your plan after a release or patch

**New** in CLI, 2026-11-02, Shorebird CLI 1.6.135 ([release notes](https://github.com/shorebirdtech/shorebird/blob/v1.6.135/RELEASE_NOTES.md)). Permalink: [/changelog/#server-notices](/changelog/#server-notices)

When the account that pays for an app needs attention, `shorebird release` and `shorebird patch` end with a notice from Shorebird, for example when patch delivery is paused or nearing the plan's install limit. The notice says when a failed payment is the cause.

- The notice is printed last, after any error, and doesn't change the exit code.
- On GitHub Actions it's a warning annotation, so it shows on the run's summary page.
- With `--json`, it goes to stderr, and stdout holds only the JSON object.

Docs: [Notices from Shorebird](/code-push/ci/scripting/#notices-from-shorebird)

### Every member sees when an organization's patches are paused

**Fixed** in Console, 2026-11-01. Permalink: [/changelog/#console-delivery-banner-per-org](/changelog/#console-delivery-banner-per-org)

The `Patches are not being delivered.` banner now follows the organization you're viewing, so every member of a paused organization sees it. Before, only the plan's owner saw it, and in every organization they were in.

- The banner says what stopped delivery and who can fix it.

Docs: [Your organization reached its patch install limit](/code-push/troubleshooting/#your-organization-reached-its-patch-install-limit)

## October 2026

### Join your team when you first sign in

**Changed** in Console, 2026-10-31. Permalink: [/changelog/#console-join-your-team](/changelog/#console-join-your-team)

If you sign in to the Console while you're in no organization, it now shows the invitations waiting for you, to join or decline, before offering to create an organization.

- With no invitations, it offers to create an organization, and reminds you to ask your team for an invite if you expected one.
- Join your team first if you use the CLI, so `shorebird init` adds your app to their organization instead of a new one.

Docs: [Accept an invitation](/account/orgs/#accept-an-invitation)

### SCIM provisioning, and adding and deactivating people

**New** in Console, 2026-10-30. Permalink: [/changelog/#enterprise-scim-and-people](/changelog/#enterprise-scim-and-people)

Enterprises can now add and deactivate people from Okta or Microsoft Entra ID over SCIM 2.0, and from the People tab of the Enterprise page.

- Add person creates an account by email before the person first signs in.
- Deactivate removes a person from every organization and app in the enterprise, revokes their sessions and API keys, and blocks their sign-in. The account is kept. Make someone else the owner of any organization they own first.
- Make owner moves an organization's ownership to another member.
- An enterprise can have its own service accounts, including an auditor that reads the enterprise's audit log.

Docs: [SCIM provisioning](/enterprise/scim/)

### Account deletion and ownership fixes

**Fixed** in Console, 2026-10-29. Permalink: [/changelog/#account-deletion-and-owner-fixes](/changelog/#account-deletion-and-owner-fixes)

Three fixes for deleting your account and for an organization's owner.

- A plan you've canceled no longer blocks deleting your account. Only a subscription that will renew, or one with a failed payment, still does. Deleting the account ends what's left of it at once, with a final invoice for metered usage.
- Organizations where you're the only member are deleted with your account instead of blocking it.
- An organization's owner can no longer be given another role. Make someone else the owner instead. The API answers 409, with the details `An organization must have an owner. Transfer ownership to another member first.`

Docs: [What blocks deletion](/account/delete-account/#what-blocks-deletion)

### Releases built on a Flutter revision with a known problem are marked

**New** in Console, 2026-10-29. Permalink: [/changelog/#console-flutter-revision-alert](/changelog/#console-flutter-revision-alert)

When a release was built on a Flutter revision with a known problem on one of its platforms, such as the iOS crashes in Flutter 3.44.0 to 3.44.8 and the early 3.44.9 build `c2515c46c7`, the Console now says so.

- The release list shows an error sign next to the release, with the problem on hover.
- The release's page shows an alert naming the Flutter version, the first 10 characters of its revision, and the problem, with the platforms affected when the problem is limited to some.
- Through the API, the release's `flutter_revision_issue` holds the same details.

Docs: [App crashes after a patch installs](/code-push/troubleshooting/#app-crashes-after-a-patch-installs)

### Patch activity across an organization's apps

**New** in Console, 2026-10-29. Permalink: [/changelog/#console-org-patch-activity](/changelog/#console-org-patch-activity)

An organization's General settings page now shows a Patch activity chart of patch installs and downloads across all the organization's apps.

- It covers the apps the organization owns today. It isn't the number on the usage card, which counts installs across every organization the plan's owner owns over the billing period.

### A domain's Google or Microsoft requirement admits only accounts it manages

**Changed** in Console, 2026-10-29. Permalink: [/changelog/#enterprise-domain-accounts](/changelog/#enterprise-domain-accounts)

When an enterprise requires Google or Microsoft for a domain, only Google Workspace or Microsoft Entra accounts the domain manages can sign in. A personal Google or Microsoft account registered with a work email is refused, and its session ends at its next refresh.

- Every account with an email address at an enterprise's domain now counts as a member of the enterprise, not only those who had signed in recently.

Docs: [Require a sign-in method for your domains](/enterprise/saml/#require-a-sign-in-method-for-your-domains)

### More CLI fixes in 1.6.134

**Fixed** in CLI, 2026-10-28, Shorebird CLI 1.6.134 ([release notes](https://github.com/shorebirdtech/shorebird/blob/v1.6.134/RELEASE_NOTES.md)). Permalink: [/changelog/#cli-fixes-1-6-134](/changelog/#cli-fixes-1-6-134)

CLI 1.6.134 also fixes these issues.

- `shorebird patch` warns when `shorebird.yaml` sets `patch_verification: install_only` and the release's Flutter doesn't check signatures in that mode, since devices on that release install the patch without checking it.
- On Windows, installing Shorebird's Flutter no longer fails on paths longer than 260 characters.
- A build no longer reports success when the `flutter pub get` after it fails.
- GitHub Actions sign-in errors say what went wrong: a 5xx from GitHub is GitHub's error, and a refused request token may have expired or come from another job. Neither is a missing permission.

### Delete an app from its Settings page

**Changed** in Console, 2026-10-28. Permalink: [/changelog/#console-delete-app-from-settings](/changelog/#console-delete-app-from-settings)

Deleting an app in the Console now happens only on the app's Settings page, and you type the app's name to confirm. The app list's row menu no longer offers Delete.

- The dialog counts the releases it removes and warns that you'll never be able to patch the app again. Copies on users' devices keep working but get no more patches.

Docs: [Delete an app](/code-push/delete/#delete-an-app)

### Patches download and build less

**Changed** in CLI, 2026-10-28, Shorebird CLI 1.6.134 ([release notes](https://github.com/shorebirdtech/shorebird/blob/v1.6.134/RELEASE_NOTES.md)). Permalink: [/changelog/#patch-reuses-release-downloads](/changelog/#patch-reuses-release-downloads)

`shorebird patch` keeps the release artifacts it downloads and reuses them the next time you patch the same release, and builds Android patches only for the architectures the release has.

- A kept artifact is reused only while it still matches the hash recorded at release. One unused for a while is removed, along with other unused cache entries, and downloaded again when needed.
- An Android release built for one architecture no longer builds its patch for three. Passing your own `--target-platform` after `--` still builds what you ask for.

Docs: [Create a patch](/code-push/patch/)

### Personal organizations work like any other

**Changed** in Console, 2026-10-28. Permalink: [/changelog/#personal-orgs-are-ordinary](/changelog/#personal-orgs-are-ordinary)

A personal organization can now be renamed and deleted like any other organization, and on a plan with collaboration it can invite members and change their roles. The Members tab shows for every organization.

- New organizations are always regular organizations.

Docs: [Organizations](/account/orgs/)

### All-time patch installs and past billing periods

**New** in Console, 2026-10-27. Permalink: [/changelog/#console-all-time-installs](/changelog/#console-all-time-installs)

A release's Insights tab now lists each patch's installs since counting began, in an All-time installs card below the chart.

- The usage card on your plan opens a Usage history dialog with the total patch installs in each past billing period.

Docs: [Insights](/code-push/console/#insights)

### A notifications bell in the Console

**New** in Console, 2026-10-27. Permalink: [/changelog/#console-notifications-bell](/changelog/#console-notifications-bell)

A bell in the Console notifies you, across all your apps, when devices start reporting that a release isn't the build Shorebird released.

- A notification is marked read once you've seen it. You can dismiss it, and it expires after 30 days.

Docs: [The app isn't the build Shorebird released](/code-push/troubleshooting/#patches-cant-install-because-the-app-isnt-the-build-shorebird-released)

### Release links from the CLI open in the Console

**Fixed** in Console, 2026-10-27. Permalink: [/changelog/#console-release-links-redirect](/changelog/#console-release-links-redirect)

The release link `shorebird release` prints now opens the release in the Console instead of a page that wasn't found.

- Links of the form `https://console.shorebird.dev/apps/<appId>/<path>` redirect to the same page in the app's organization.

Docs: [View release details](/code-push/release/#view-release-details)

### Enterprise billing tab and Billing manager role

**New** in Console, 2026-10-27. Permalink: [/changelog/#enterprise-billing-tab](/changelog/#enterprise-billing-tab)

The Enterprise page has a Billing tab showing your contract and usage, the organizations your enterprise pays for with each one's installs this period, and your invoices with their PDFs.

- Owners can give someone the new Billing manager role, which sees the Billing tab and nothing else on the Enterprise page. Admins don't see it.
- The tab is read-only. It says whom to email to change billing details.

Docs: [Enterprise roles](/enterprise/roles/#enterprise-roles)

### Each patch install is counted once

**Fixed** in Code Push, 2026-10-27. Permalink: [/changelog/#installs-counted-once](/changelog/#installs-counted-once)

Each patch install is now counted once, by the install event's id, so a copy of the same event no longer adds to your usage and metrics twice.

- In releases built with Flutter 3.47.9 or newer, the device sends the id itself, so a device that sends the same install again, such as when it retries after a network error, is counted once.
- For older releases, the server gives each request its own id, so a retry from the device can still count twice.

Docs: [How Shorebird bills](/account/billing/#how-shorebird-bills)

### More API lists can be paged, and apps searched

**New** in API, 2026-10-26. Permalink: [/changelog/#api-numbered-pages](/changelog/#api-numbered-pages)

Lists of organizations, an organization's apps, members and service accounts, a service account's keys and trust rules, and a release's artifacts can now be read a page at a time, by number.

- Ask for a page with `page` and `per_page`. The response carries `total_count` and `next_cursor`.
- Without paging parameters, these lists still return everything.
- An organization's app list also takes `q` to search by name, `sort` (`updated`, `created`, or `name`), `direction`, and `platform`.
- The Console's app list now pages, sorts, and filters by platform on the server, and its platform filter lists only the platforms the organization ships to.

Docs: [Common patterns](/account/api/#common-patterns)

### See when devices run a build Shorebird didn't release

**New** in Console, 2026-10-26. Permalink: [/changelog/#console-store-build-mismatch](/changelog/#console-store-build-mismatch)

When devices report that the app installed from the store isn't the build `shorebird release` uploaded, the release's page now shows an alert, `Patches can't install on <n> devices`, so you know why its patches aren't installing.

- The alert explains the cause and links to the troubleshooting guide.
- An error sign next to the release's title shows and hides the alert, and the release list marks affected releases.

Docs: [The app isn't the build Shorebird released](/code-push/troubleshooting/#patches-cant-install-because-the-app-isnt-the-build-shorebird-released)

### Inviting members needs a paid plan

**Fixed** in API, 2026-10-26. Permalink: [/changelog/#invitations-need-paid-plan](/changelog/#invitations-need-paid-plan)

Inviting anyone to an organization now needs the owner's plan to include collaboration, as the docs said. Before, an invitation with the Developer role went through on the Hobby plan.

- The API answers 403 with the code `shorebird_plan_insufficient_tier`.

Docs: [Account requirements](/account/orgs/#account-requirements)

### More CLI fixes in 1.6.132

**Fixed** in CLI, 2026-10-25, Shorebird CLI 1.6.132 ([release notes](https://github.com/shorebirdtech/shorebird/blob/v1.6.132/RELEASE_NOTES.md)). Permalink: [/changelog/#cli-fixes-1-6-132](/changelog/#cli-fixes-1-6-132)

CLI 1.6.132 also fixes these issues.

- On Windows, `shorebird` passes every argument through, keeps `--` when run from PowerShell, and exits with the command's own exit code, so a failing command no longer looks like a success to a script.
- `shorebird preview` on Android shows the logs your app writes as it starts, not only the ones after the CLI attaches.
- A private key passed where the public key belongs is refused, and the key isn't printed.
- `shorebird flutter versions list` no longer prints `Cancelled` when it succeeds.
- `shorebird release ios-framework` passes `--no-codesign` on to Flutter.
- `shorebird init` skips Android flavor detection, instead of failing, when the Android SDK or Java is missing.

### Flutter 3.47.8 support

**New** in Flutter, 2026-10-25, Shorebird CLI 1.6.133 ([release notes](https://github.com/shorebirdtech/shorebird/blob/v1.6.133/RELEASE_NOTES.md)). Permalink: [/changelog/#flutter-3-47-8](/changelog/#flutter-3-47-8)

Shorebird now supports Flutter 3.47.8 and Dart 3.13.7. It includes a Dart security fix, so rebuild Android, Windows, and Linux apps with it.

- Android 14 and newer: `dart:io` trusts the root certificates the system updates, not only the ones the device shipped with.
- The Dart runtime's BoringSSL now blocks compromised intermediate certificates.
- Windows, Linux, and macOS: when a patch fails to load, the app starts on the release's own code and reports the patch as failed, so the device stops trying it.
- Windows: patches install when the user's profile folder name has non-ASCII characters.
- `patch_verification: install_only` checks patch signatures again.
- `flutter build ios-framework` always regenerates `Generated.xcconfig`, and broken plugin symlinks no longer crash `flutter pub get`.

```sh
shorebird release android --flutter-version=3.47.8
```

Docs: [Flutter versions](/getting-started/flutter-version/)

### Releases refuse install_only on Flutter builds that skip its check

**Changed** in CLI, 2026-10-25, Shorebird CLI 1.6.132 ([release notes](https://github.com/shorebirdtech/shorebird/blob/v1.6.132/RELEASE_NOTES.md)). Permalink: [/changelog/#install-only-release-refused](/changelog/#install-only-release-refused)

Shorebird's builds of Flutter 3.41.9, 3.44.0 to 3.44.9, and 3.47.0 to 3.47.7 skip the patch signature check entirely when `shorebird.yaml` sets `patch_verification: install_only`. `shorebird release` now refuses that combination.

- The default, `strict`, is unaffected.
- Remove `patch_verification` from `shorebird.yaml`, or release with Flutter 3.47.8 or newer.
- A release already built this way keeps installing patches without checking their signatures. Only a new release changes that.

Docs: [Patch signing trade-offs](/code-push/guides/patch-signing/#trade-offs)

### New releases are signed by default

**New** in Code Push, 2026-10-25, Shorebird CLI 1.6.132 ([release notes](https://github.com/shorebirdtech/shorebird/blob/v1.6.132/RELEASE_NOTES.md)). Permalink: [/changelog/#managed-patch-signing](/changelog/#managed-patch-signing)

New releases are now signed by default with a key Shorebird manages for your organization, so someone tampering with your users' network can't push code to your app. Update the CLI and make a new release to turn it on.

- `shorebird release` builds your organization's public key into the release, and Shorebird signs every patch to it. Patching works as before, with no key flags.
- You don't need to change your Flutter version.
- The private key is kept in Google Cloud KMS and never leaves it. To keep Shorebird out of your trust base, sign with your own key instead, with `--public-key-path` or `--public-key-cmd`.
- `--no-patch-signing` releases without signing, which isn't recommended.
- Releases made before this without your own key stay unsigned, and patches to them keep installing.
- A CLI older than 1.6.132 can't patch a release signed this way; run `shorebird upgrade`.

```sh
shorebird upgrade
shorebird release android
```

Docs: [Managed signing](/code-push/guides/patch-signing/#managed-signing)

### The API answers 404 to callers outside an app or organization

**Changed** in API, 2026-10-24. Permalink: [/changelog/#api-outsiders-get-not-found](/changelog/#api-outsiders-get-not-found)

A request for an app or organization you have no role in now gets the same 404 as one that doesn't exist, so an id tells someone outside your organization nothing. Before, a request for someone else's app got 403.

- A member whose role doesn't allow the request still gets 403.
- Transferring an app you have no access to answers `app_not_found`.

Docs: [Common patterns](/account/api/#common-patterns)

### Download Flutter and engine tools from an internal mirror

**New** in CLI, 2026-10-23, Shorebird CLI 1.6.131 ([release notes](https://github.com/shorebirdtech/shorebird/blob/v1.6.131/RELEASE_NOTES.md)). Permalink: [/changelog/#cli-download-mirrors](/changelog/#cli-download-mirrors)

Three new environment variables point the CLI at an internal mirror, such as Artifactory, for Flutter, its engine artifacts and bundletool.

- `SHOREBIRD_DOWNLOAD_URL` replaces `https://download.shorebird.dev` for Flutter's artifacts, Shorebird's engine, and the tools used to build patches.
- `SHOREBIRD_FLUTTER_GIT_URL` replaces the GitHub URL of Shorebird's Flutter fork when the CLI clones it.
- `SHOREBIRD_BUNDLETOOL_URL` replaces the GitHub URL of the bundletool jar. The jar's checksum is still checked.

Docs: [Using an internal mirror](/system/firewalls-and-mirrors/#using-an-internal-mirror)

### More CLI fixes in 1.6.131

**Fixed** in CLI, 2026-10-23, Shorebird CLI 1.6.131 ([release notes](https://github.com/shorebirdtech/shorebird/blob/v1.6.131/RELEASE_NOTES.md)). Permalink: [/changelog/#cli-fixes-1-6-131](/changelog/#cli-fixes-1-6-131)

CLI 1.6.131 also fixes these issues.

- Options before the platform now parse, so `shorebird patch --release-version=1.0.0+1 android` works instead of failing with `Invalid argument(s)`.
- `shorebird release ios-framework --target` builds the target you pass instead of `lib/main.dart`.
- `shorebird preview` waits for a paired iOS device to become reachable, such as while you unlock it, instead of exiting.
- `shorebird init` only offers organizations you can create apps in, and adds a new flavor to the existing app's organization.
- `shorebird doctor` checks the hosts the CLI actually uses.
- A yes/no prompt asks again when it doesn't recognize the answer.
- When the server says the CLI is out of date, the CLI prints the server's message.

### The browser shows next steps after shorebird login

**New** in CLI, 2026-10-23, Shorebird CLI 1.6.131 ([release notes](https://github.com/shorebirdtech/shorebird/blob/v1.6.131/RELEASE_NOTES.md)). Permalink: [/changelog/#login-result-page](/changelog/#login-result-page)

When `shorebird login` finishes in the browser, the tab now says `You're signed in to the Shorebird CLI` and lists next steps, adding Shorebird to your app, creating a release, and shipping a patch, with commands you can copy.

- If sign-in didn't finish, the page says so and how to try again.

Docs: [Login](/account/cli/#login)

### New Android and iOS releases need Flutter 3.24.0 or newer

**Changed** in CLI, 2026-10-23, Shorebird CLI 1.6.131 ([release notes](https://github.com/shorebirdtech/shorebird/blob/v1.6.131/RELEASE_NOTES.md)). Permalink: [/changelog/#release-minimum-flutter-3-24](/changelog/#release-minimum-flutter-3-24)

`shorebird release` no longer creates an Android, AAR, iOS, or iOS framework release with a Flutter version older than 3.24.0.

- Patching a release built with an older Flutter works as before.
- To move an app forward, create a new release with `--flutter-version` set to 3.24.0 or newer.

```sh
shorebird release android --flutter-version=3.24.0
```

Docs: [Flutter version notes](/getting-started/flutter-version/#flutter-version-notes)

### Trust rules refuse pull_request_target runs

**Changed** in API, 2026-10-23. Permalink: [/changelog/#trust-rules-refuse-pull-request-target](/changelog/#trust-rules-refuse-pull-request-target)

GitHub Actions jobs started by `pull_request_target` can no longer sign in with a trust rule, because anyone who opens a pull request can start one, and it runs with the ref of the repository's default branch, such as `refs/heads/main`.

- The sign-in is refused before any rule is checked, with the message `pull_request_target runs cannot exchange tokens`.
- Run Shorebird from a workflow started by `push`, `release`, or `workflow_dispatch` instead.

Docs: [What a rule matches](/account/trust-rules/#what-a-rule-matches)

### Require a sign-in method for your enterprise's domains

**New** in Console, 2026-10-22. Permalink: [/changelog/#enterprise-require-sign-in-method](/changelog/#enterprise-require-sign-in-method)

On the Enterprise page, you can now require SAML SSO, Google, or Microsoft for each of your email domains, so people at that domain can sign in only that way.

- A method can be required only after someone at the domain has signed in with it, so a misconfigured method can't lock everyone out.
- You can lift the requirement again from the same page.

Docs: [Require a sign-in method for your domains](/enterprise/saml/#require-a-sign-in-method-for-your-domains)

### Organization access fixes

**Fixed** in API, 2026-10-22. Permalink: [/changelog/#org-access-fixes-2026-10-22](/changelog/#org-access-fixes-2026-10-22)

Four fixes tighten who can see and change an organization's apps.

- Removing a member from an organization also removes the access they were granted on its individual apps. Before, they kept it.
- Accepting an invitation checks again that the person who sent it can still invite, and that the plan still offers the role.
- An organization's usage lists per-app rows only for that organization's apps, except for an owner, who still sees rows for every organization they own.
- A role that can't view every app, such as an auditor service account, lists only the apps it was granted.

Docs: [What each role can do](/account/orgs/#what-each-role-can-do)

### Sign in once for the Console and the CLI

**New** in Console, 2026-10-21. Permalink: [/changelog/#sign-in-once](/changelog/#sign-in-once)

Once you've signed in to Shorebird in a browser, signing in again in that browser, from the Console, the CLI, or another app, finishes without going back to Google, Microsoft, or your identity provider.

- The approval page and terms still appear where they would before.
- An app can still ask you to sign in again, or to choose an account.

### Name an organization when you create it

**Changed** in Console, 2026-10-20. Permalink: [/changelog/#name-new-organizations](/changelog/#name-new-organizations)

Creating an organization now asks for its name. New organizations are no longer called "My Organization".

- Inviting someone to an organization that's still called "My Organization" suggests renaming it first.

Docs: [Creating an organization](/account/orgs/#creating-an-organization)

### Patch checks keep up with new patches and app transfers

**Fixed** in Code Push, 2026-10-20. Permalink: [/changelog/#patch-check-publish-race](/changelog/#patch-check-publish-race)

A patch check that ran while a patch was being published could leave "no patch" cached until the next change. The next check now sees the new patch.

- An app transferred to another organization follows the new organization's patch limit right away, instead of the old one's for up to an hour.

Docs: [Transfer an app](/account/orgs/#transfer-an-app)

### Personal API keys expire within a year

**Changed** in Console, 2026-10-20. Permalink: [/changelog/#personal-key-expiry](/changelog/#personal-key-expiry)

A new personal API key now expires within a year. The Console no longer offers Never as an expiration when you create or regenerate one.

- Keys you already have are unchanged. A key created without an expiration keeps working until you revoke it.
- For a key that never expires, or one that doesn't depend on any one person's account, use a service account.

Docs: [API key expiration](/account/api-keys/#expiration)

### Console fixes for yearly plans, account deletion, and app transfers

**Fixed** in Console, 2026-10-18. Permalink: [/changelog/#console-fixes-2026-10-18](/changelog/#console-fixes-2026-10-18)

The Console fixes three issues.

- Yearly plans show their price per year, `/yr`, instead of `/mo`.
- Deleting an account that has many apps no longer times out. Through the API, `DELETE /api/v1/users/me` now answers 202 with `remaining_app_count` while apps are left to delete. Repeat the request until it answers 204.
- When you transfer an app, organizations where you aren't an Admin or Owner are listed but can't be chosen. Before, choosing one failed after you submitted.

### Delete a track, and hide rolled-back patches

**New** in Console, 2026-10-18. Permalink: [/changelog/#delete-tracks-hide-rolled-back](/changelog/#delete-tracks-hide-rolled-back)

The Tracks page can delete tracks you added, and a release's patch list hides rolled-back and deactivated patches unless you ask to see them.

- `stable`, `beta`, `staging`, and `deactivated` have no delete button.
- A switch shows the hidden patches and how many there are.

Docs: [Delete a track](/code-push/tracks/#delete-a-track)

### Signing out a session takes effect right away

**Changed** in API, 2026-10-18. Permalink: [/changelog/#session-revoke-immediate](/changelog/#session-revoke-immediate)

An access token now stops working as soon as its session is revoked.

- Before, it kept working until it expired, up to 15 minutes later.

### See which credential the CLI is using

**New** in CLI, 2026-10-17, Shorebird CLI 1.6.130 ([release notes](https://github.com/shorebirdtech/shorebird/blob/v1.6.130/RELEASE_NOTES.md)). Permalink: [/changelog/#account-and-auth-status](/changelog/#account-and-auth-status)

`shorebird auth status` shows which credential the CLI signed in with and who it acts as, and `shorebird auth token` prints the access token it sends.

- The credential is an API key from `SHOREBIRD_TOKEN`, GitHub Actions OIDC, or your `shorebird login`, tried in that order.
- `shorebird account whoami` adds a `Credential` line, and `credential` in `--json`.
- Bare `shorebird account` now runs `shorebird account whoami`.
- Treat the output of `shorebird auth token` as a secret. It's left out of the run's log file.

```sh
shorebird auth status
shorebird account
```

Docs: [Check which credential is active](/account/cli/#check-which-credential-is-active)

### Apps are listed with apps list, not account apps

**Changed** in CLI, 2026-10-17, Shorebird CLI 1.6.130 ([release notes](https://github.com/shorebirdtech/shorebird/blob/v1.6.130/RELEASE_NOTES.md)). Permalink: [/changelog/#account-apps-moved](/changelog/#account-apps-moved)

`shorebird account apps` no longer lists apps. It prints `shorebird apps list`, which shows the same list, and exits with a usage error.

- Scripts that call `shorebird account apps` need to switch to `shorebird apps list`. Its output, including `--json`, is the same.

```sh
shorebird apps list
```

Docs: [List apps](/account/cli/#list-apps)

### Change your display name and email settings from the CLI

**New** in CLI, 2026-10-17, Shorebird CLI 1.6.130 ([release notes](https://github.com/shorebirdtech/shorebird/blob/v1.6.130/RELEASE_NOTES.md)). Permalink: [/changelog/#account-update-and-notifications](/changelog/#account-update-and-notifications)

`shorebird account update --name` changes your display name, and `shorebird account notifications` shows or changes whether Shorebird emails you.

- The emails Shorebird sends today warn that an app is near or over its plan's patch install limit.
- `--email on` and `--email off` change the setting. With `--json`, the output includes `email` set to `true` or `false`.

```sh
shorebird account update --name "Jane Doe"
shorebird account notifications --email off
```

Docs: [Change your display name](/account/cli/#change-your-display-name)

### The api command takes the method first and reads every page

**New** in CLI, 2026-10-17, Shorebird CLI 1.6.130 ([release notes](https://github.com/shorebirdtech/shorebird/blob/v1.6.130/RELEASE_NOTES.md)). Permalink: [/changelog/#api-method-and-paginate](/changelog/#api-method-and-paginate)

`shorebird api` accepts the HTTP method before the endpoint, and `--paginate` reads a whole paged list in one call. `--jq` also takes slices, and the command now handles a repeated `/api/v1` and explains a 405 after fields made a POST.

- The method can be GET, POST, PUT, PATCH, DELETE, or HEAD, in any case. If you also pass `-X`, it must name the same method.
- `--paginate` follows `next_cursor` and prints the pages as one JSON object, with list fields joined. `--jq` runs on the joined result.
- `--paginate` works only with GET. A failed page stops the command with exit status 1 instead of printing part of the list.
- `--jq` supports array and string slices, such as `.[1:3]`, `.[2:]`, and `.[:-1]`.
- An endpoint that repeats `/api/v1` is treated as the route under it, with a note on stderr.
- When `-f` or `-F` turns a request into a POST and the server answers 405, the CLI suggests adding `--method GET`.

```sh
shorebird api GET /apps
shorebird api /apps -f per_page=100 --paginate --jq '.apps[].app_id'
```

Docs: [Calling the API from the command line](/account/api/#calling-the-api-from-the-command-line)

### New per-app collaborators can no longer be added

**Deprecated** in Console, 2026-10-17. Permalink: [/changelog/#app-collaborators-frozen](/changelog/#app-collaborators-frozen)

To give someone access to an app, invite them to the organization that owns it. The app's "Collaborators" tab no longer has an invite button, and the API's endpoints for adding a collaborator or sending an app invitation now return `410 Gone`.

- Existing collaborators keep their access. You can still change their role or remove them.
- Invitations to an app that were already sent can still be accepted, and you can still revoke them.

Docs: [Member roles](/account/orgs/#member-roles)

### Use --channel wherever --track works

**New** in CLI, 2026-10-17, Shorebird CLI 1.6.130 ([release notes](https://github.com/shorebirdtech/shorebird/blob/v1.6.130/RELEASE_NOTES.md)). Permalink: [/changelog/#channel-flag-alias](/changelog/#channel-flag-alias)

`--channel` is now another name for `--track`.

- It works on `shorebird patch`, `shorebird preview`, `shorebird patches set-track`, and `shorebird patches promote`.
- The two flags mean the same thing, so existing scripts that use `--track` keep working.

```sh
shorebird patch android --channel staging
```

Docs: [Publishing a patch to a track](/code-push/tracks/#publishing-a-patch-to-a-track)

### More CLI fixes in 1.6.130

**Fixed** in CLI, 2026-10-17, Shorebird CLI 1.6.130 ([release notes](https://github.com/shorebirdtech/shorebird/blob/v1.6.130/RELEASE_NOTES.md)). Permalink: [/changelog/#cli-fixes-1-6-130](/changelog/#cli-fixes-1-6-130)

CLI 1.6.130 also fixes these issues.

- Prompts no longer crash with `No terminal attached to stdout` when stdout can't show a prompt, such as when it's redirected to `/dev/null`. The command runs as non-interactive and, when it needs a confirmation, asks for `--yes` or `--confirm-name`.
- Declining a prompt no longer prints the generic advice to re-run with `--verbose`.
- `shorebird doctor` and `shorebird upgrade` on a Shorebird checkout at a commit, a tag, or a branch with no upstream explain how to get back to `stable`.
- Every request the CLI makes identifies it with a `User-Agent: shorebird-cli/<version> (<os>; dart <version>)` header, which audit log entries record.

### See and answer invitations from the CLI

**New** in CLI, 2026-10-17, Shorebird CLI 1.6.130 ([release notes](https://github.com/shorebirdtech/shorebird/blob/v1.6.130/RELEASE_NOTES.md)). Permalink: [/changelog/#invitations-commands](/changelog/#invitations-commands)

`shorebird invitations list` shows the organization and app invitations sent to you, and `shorebird invitations accept` and `decline` answer one by its id.

- Before this, an invitation could only be answered from the link in its email.
- With `--json`, `list` returns each invitation's `id`, `kind` (`organization` or `app`), `organization_id`, `app_id`, `name`, `role`, `inviter_email`, `created_at` and `expires_at`.
- Sign in as the invited email address. Use your own login or a full access API key. Service account keys and release and patch only keys can't.

```sh
shorebird invitations list
shorebird invitations accept <id>
```

Docs: [Accept an invitation](/account/orgs/#accept-an-invitation)

### Android patch warnings show what changed code references

**New** in CLI, 2026-10-17, Shorebird CLI 1.6.130 ([release notes](https://github.com/shorebirdtech/shorebird/blob/v1.6.130/RELEASE_NOTES.md)). Permalink: [/changelog/#patch-dex-diff-details](/changelog/#patch-dex-diff-details)

When Java or Kotlin changes trigger the native changes warning on an Android patch, the output names the classes, methods, and fields that each changed method's differing instructions reference, so you can tell which dependency changed.

- By default it details up to 10 methods per DEX file and 4 instructions on each side. String literals are replaced by their length, and switch tables and array data are cut short.
- `shorebird patch --show-dex-diff` prints every changed method and instruction in full, including string constants.
- What the check accepts hasn't changed.

Docs: [Native changes warning](/code-push/troubleshooting/#your-app-contains-native-changes-warning-when-creating-a-patch-even-though-you-havent-changed-swiftobjective-ckotlinjava-code)

### The patches promote command is back as a set-track shortcut

**Changed** in CLI, 2026-10-17, Shorebird CLI 1.6.130 ([release notes](https://github.com/shorebirdtech/shorebird/blob/v1.6.130/RELEASE_NOTES.md)). Permalink: [/changelog/#patches-promote-shortcut](/changelog/#patches-promote-shortcut)

`shorebird patches promote` appears in help again and now runs `shorebird patches set-track` with the track defaulting to `stable`.

- It takes the same options as `set-track`, including `--track` for a track other than `stable`, `--app-id`, and `--json`.
- A patch that's already on the track now succeeds instead of failing.
- If the app has no `stable` channel yet, it offers to create it, as `set-track` does.

```sh
shorebird patches promote --release-version 1.0.0+1 --patch-number 1
```

Docs: [Promote a patch](/code-push/patch/#promote-a-patch)

### The release and patch commands no longer take --confirm

**Changed** in CLI, 2026-10-17, Shorebird CLI 1.6.130 ([release notes](https://github.com/shorebirdtech/shorebird/blob/v1.6.130/RELEASE_NOTES.md)). Permalink: [/changelog/#release-patch-confirm-removed](/changelog/#release-patch-confirm-removed)

The hidden `--confirm` flag is gone from `shorebird release` and `shorebird patch`. It made each command ask `Would you like to continue?` before publishing, and that prompt is gone.

- Passing `--confirm` is a usage error, with exit status 64.
- `--no-confirm` is still accepted and does nothing, so existing scripts keep working.

### Roles your plan no longer offers are marked

**Changed** in Console, 2026-10-17. Permalink: [/changelog/#roles-plan-no-longer-offers](/changelog/#roles-plan-no-longer-offers)

A member keeps a role that the organization's current plan no longer offers. The role picker now warns that changing it can't be undone without upgrading.

- Developer is always offered.

Docs: [Member roles](/account/orgs/#member-roles)

### First SSO sign-in keeps your existing account

**Changed** in Console, 2026-10-17. Permalink: [/changelog/#saml-first-sign-in-keeps-account](/changelog/#saml-first-sign-in-keeps-account)

Signing in with SAML SSO for the first time with an email at the connection's domain moves your existing account onto SSO instead of refusing it. Your organizations, app access, and billing carry over.

- The account's Google or Microsoft sign-in is replaced, and its existing sessions are signed out.

Docs: [How sign-in works](/enterprise/saml/#how-sign-in-works)

### Call the Shorebird API from the CLI

**New** in CLI, 2026-10-16, Shorebird CLI 1.6.129 ([release notes](https://github.com/shorebirdtech/shorebird/blob/v1.6.129/RELEASE_NOTES.md)). Permalink: [/changelog/#api-command](/changelog/#api-command)

`shorebird api` sends an authenticated request to the Shorebird API and prints the response. `--jq` filters a successful response before it's printed.

- Endpoints are relative to `https://api.shorebird.dev/api/v1`, and `{appId}` is filled in from `shorebird.yaml`.
- `-X` or `--method` sets the method. It defaults to GET, or POST when you pass fields with `-f` or `-F`, or a body with `--input`.
- A response outside the 2xx range still prints its body. The error goes to stderr and the command exits with status 1.
- Requests that change data are never retried.

```sh
shorebird api /apps --jq '.apps[].app_id'
```

Docs: [Calling the API from the command line](/account/api/#calling-the-api-from-the-command-line)

### Apple builds keep your .dart_tool caches

**Fixed** in CLI, 2026-10-16, Shorebird CLI 1.6.129 ([release notes](https://github.com/shorebirdtech/shorebird/blob/v1.6.129/RELEASE_NOTES.md)). Permalink: [/changelog/#apple-builds-keep-dart-tool](/changelog/#apple-builds-keep-dart-tool)

iOS, iOS framework, and macOS builds no longer delete the project's whole `.dart_tool` directory, so `build_runner` caches and native asset outputs survive a Shorebird build.

- Only `.dart_tool/flutter_build` and `.dart_tool/version` are cleared.

### Audit log entries say which key or session acted

**New** in Console, 2026-10-16. Permalink: [/changelog/#audit-log-actor-details](/changelog/#audit-log-actor-details)

Audit log entries now name the API key or sign-in session behind each action, and say whether the sign-in used multi-factor authentication when the sign-in provider reports it.

- Creating an app and editing a patch's notes are now recorded.
- Changes Shorebird staff make to your organization appear in its audit log as `Shorebird staff`.
- Reading the log oldest first leaves out the most recent minute, so a later read doesn't skip an event that was still being written.

Docs: [Event format](/enterprise/audit-logs/#event-format)

### More CLI fixes in 1.6.129

**Fixed** in CLI, 2026-10-16, Shorebird CLI 1.6.129 ([release notes](https://github.com/shorebirdtech/shorebird/blob/v1.6.129/RELEASE_NOTES.md)). Permalink: [/changelog/#cli-fixes-1-6-129](/changelog/#cli-fixes-1-6-129)

CLI 1.6.129 also fixes these issues.

- iOS, iOS framework, and macOS patches no longer leave copies of the app's binaries in the system temp directory.
- AAR releases and patches skip architectures that have no `libapp.so`, as Android releases do, and warn when a patch covers only some of them.
- iOS framework, Linux, and Windows patches check the release's minimum Flutter version before downloading the release's artifacts. On every platform that has a minimum, the message names the command that creates a new release.
- Commands run at the same time from one login no longer refresh with a stale token. A refresh uses the newest credentials on disk.
- Piping output into a command that exits early, such as `head -1`, exits with status 141 instead of crashing.
- Error and progress messages no longer name temporary paths that are deleted before the command finishes.
- The release picker shows one hint, and `shorebird patches promote --help` describes `--flavor` correctly.
- `shorebird account orgs --help` lists every role, including `none` for an organization where you only collaborate on apps.
- When a login can't be refreshed, the CLI says why. An OAuth error from the auth service asks you to run `shorebird login`. A network or server error leaves your login as it was and exits with status 75 instead of 70.
- iOS and iOS framework patches no longer read `SHOREBIRD_PATCH_DD_MAX_BYTES`. Pass `--dd-max-bytes` to `shorebird patch` instead.
- The error for an `--org-id` that isn't a number lists your organizations and their ids.

### Confirm deletes with --yes

**Changed** in CLI, 2026-10-16, Shorebird CLI 1.6.129 ([release notes](https://github.com/shorebirdtech/shorebird/blob/v1.6.129/RELEASE_NOTES.md)). Permalink: [/changelog/#delete-confirm-yes](/changelog/#delete-confirm-yes)

`shorebird channels delete` and `shorebird releases delete` ask you to confirm in a terminal, and `--yes` skips the question. Without a terminal, in CI, or with `--json`, `--yes` is required.

- `--confirm-name` is deprecated for these two commands and prints a warning.
- Before deleting, each command says what the delete removes, such as a release's patches.
- `shorebird apps delete` now asks you to type the app's display name in a terminal. Scripts still pass it with `--confirm-name`, and there's no `--yes`.
- Declining a prompt now exits with status 1 instead of 0. This covers `shorebird patches set-track`, the native and asset change prompts of `shorebird patch`, and the new delete prompts.

Docs: [Destructive commands](/code-push/ci/scripting/#destructive-commands)

### Sign in from GitHub Actions without a stored key

**New** in CLI, 2026-10-16, Shorebird CLI 1.6.129 ([release notes](https://github.com/shorebirdtech/shorebird/blob/v1.6.129/RELEASE_NOTES.md)). Permalink: [/changelog/#github-actions-oidc](/changelog/#github-actions-oidc)

On GitHub Actions, the CLI can now sign in as a service account with the OIDC token GitHub issues to each job, so there's no `SHOREBIRD_TOKEN` secret to leak or rotate.

- Add a trust rule to a service account naming the repository, the workflow file, and optionally a GitHub environment and a ref pattern. Only jobs that match sign in.
- In the workflow, grant the job `id-token: write` and set `SHOREBIRD_PROJECT_ID`.
- Adding a trust rule needs a Business or Enterprise plan. Existing rules keep working after a downgrade.
- When `SHOREBIRD_TOKEN` is set, the CLI uses it instead, so remove the secret once the workflow signs in with a trust rule.
- On the Enterprise plan, each sign-in is recorded in the audit log as `service_account.sign_in`, with the run it came from.

Docs: [Sign in with OIDC instead of a stored key](/code-push/ci/github/#sign-in-with-oidc-instead-of-a-stored-key)

### Every --json command prints one JSON object

**Changed** in CLI, 2026-10-16, Shorebird CLI 1.6.129 ([release notes](https://github.com/shorebirdtech/shorebird/blob/v1.6.129/RELEASE_NOTES.md)). Permalink: [/changelog/#json-envelope-every-command](/changelog/#json-envelope-every-command)

With `--json`, every command writes exactly one JSON object to stdout, including `--help` and commands that have no data to return.

- A command with no data prints `"data": {}` in its success object.
- When an API call fails, the error includes the server's `api_code` and `details`. Without `--json`, the CLI prints the code as `Error code: <code>`.

Docs: [Errors](/code-push/ci/scripting/#errors)

### See app metrics from the CLI

**New** in CLI, 2026-10-16, Shorebird CLI 1.6.129 ([release notes](https://github.com/shorebirdtech/shorebird/blob/v1.6.129/RELEASE_NOTES.md)). Permalink: [/changelog/#metrics-commands](/changelog/#metrics-commands)

`shorebird metrics` shows the metrics the Console shows under Insights, such as patch installs, downloads, adoption, and active devices.

- The subcommands are `active-hours`, `adoption`, `downloads`, `heatmap`, `installs`, `new-devices`, `users`, and `versions`.
- Pick the app with `--app-id` or `--flavor`. Depending on the metric, `--start`, `--end`, and `--release-version` narrow the results, and `--granularity` and `--group-by` break them down.
- With `--json`, `data` holds the API's response.

Docs: [Metrics commands](/account/cli/#metrics-commands)

### Delete a release from the CLI

**New** in CLI, 2026-10-16, Shorebird CLI 1.6.129 ([release notes](https://github.com/shorebirdtech/shorebird/blob/v1.6.129/RELEASE_NOTES.md)). Permalink: [/changelog/#releases-delete](/changelog/#releases-delete)

`shorebird releases delete` deletes a release, or one platform of it with `--platform`.

- Without `--platform`, it removes the release's artifacts for every platform and every patch of the release.
- With `--platform`, it removes that platform's release artifacts and the patch files built for it. The release and its other platforms stay.
- In a terminal it asks you to confirm. Without one, in CI, or with `--json`, pass `--yes`.

Docs: [Delete releases](/code-push/release/#delete-releases)

### The whoami command no longer prints a subscription line

**Changed** in CLI, 2026-10-16, Shorebird CLI 1.6.129 ([release notes](https://github.com/shorebirdtech/shorebird/blob/v1.6.129/RELEASE_NOTES.md)). Permalink: [/changelog/#whoami-plan-only](/changelog/#whoami-plan-only)

`shorebird account whoami` no longer prints a `Subscription:` line. `Plan:` shows your plan level.

- In `--json` output, `plan` is `free` on the free level, `paid` on any other level, and `null` when the server doesn't report a level.

Docs: [Current account](/account/cli/#current-account)

### API errors link to the docs, and lists can be paged

**New** in API, 2026-10-15. Permalink: [/changelog/#api-errors-and-paging](/changelog/#api-errors-and-paging)

Every JSON error from the API now carries a `documentation_url`, and the lists of apps, releases, and patches can be read a page at a time.

- Those lists accept `per_page` and `cursor` and return `next_cursor`. Without them, they still return everything.
- Lists of invitations and audit log events are always paged. An invalid `cursor` returns 400 with the code `invalid_cursor`.
- A 401 response to a bearer token, or a 403 because the token's scope doesn't allow the request, includes a `WWW-Authenticate` header that says why.

Docs: [Common patterns](/account/api/#common-patterns)

### Release and patch only API keys on every plan

**Changed** in Console, 2026-10-15. Permalink: [/changelog/#api-key-scopes-every-plan](/changelog/#api-key-scopes-every-plan)

API keys limited to releases and patches are now available on every plan, including Free. They used to need a paid plan.

- The console no longer disables the "Release and patch only" option on the Free plan. A service account's keys take no scope. They do what its role allows.

Docs: [API key permissions](/account/api-keys/#permissions)

### The API refuses what the Console refuses

**Changed** in API, 2026-10-15. Permalink: [/changelog/#api-plan-limits](/changelog/#api-plan-limits)

Some requests the Console refuses are now refused by the API too, so scripts and the CLI meet the same rules.

- Setting a spending limit other than 0 on the Free plan returns 403 with the code `shorebird_plan_insufficient_tier`.
- Inviting someone with, or changing a member to, a role the organization's plan doesn't offer returns the same error. Developer is always allowed.
- Creating or renaming an organization with a blank name returns 400 with the code `organization_name_blank`.

Docs: [Member roles](/account/orgs/#member-roles)

### Only Owners, Admins, and Auditors can read the audit log

**Changed** in Console, 2026-10-15. Permalink: [/changelog/#audit-log-roles](/changelog/#audit-log-roles)

Viewers, Developers, and App Managers can no longer read an Enterprise organization's audit log, in the Console or through the API. Before, every member could.

- Owners and Admins keep access, as does a service account with the Auditor role.

Docs: [Audit logs](/enterprise/audit-logs/)

### Export the audit log to a SIEM

**New** in API, 2026-10-15. Permalink: [/changelog/#audit-log-siem-export](/changelog/#audit-log-siem-export)

Enterprise organizations can read the audit log through the API oldest first and forward each event to a SIEM, using a service account with the Auditor role.

- Events are OCSF 1.9.0 API Activity events. Filter by event name with `operation`, such as `patch.rollback`.
- `order=asc` returns the oldest events first. Pages use `per_page` (30 by default, at most 100), `cursor`, and `next_cursor`.
- The endpoint's earlier, undocumented `limit`, `resourceType`, and `action` parameters and its `nextCursor` field were replaced.
- The Console's audit log shows and filters by event name.

Docs: [Export the audit log to a SIEM](/enterprise/audit-logs/#export-the-audit-log-to-a-siem)

### Patch checks catch up with deletes and rollbacks

**Fixed** in Code Push, 2026-10-15. Permalink: [/changelog/#patch-cache-cleared-on-delete](/changelog/#patch-cache-cleared-on-delete)

Deleting a track now takes effect on the next patch check, and deleting a release can no longer leave its patches cached. Running a rollback or roll forward again now clears the cache if the first run couldn't.

- Devices on a deleted track could keep receiving its last patch. That cached answer is now cleared.
- If clearing the cache fails during a rollback or roll forward, the request returns `patch_rollback_cache_error` or `patch_rollforward_cache_error`. Running it again clears the cache.
- After you delete one platform of a release, devices on that platform are no longer offered its patches. Before, they were, and the download failed because the patch files had been deleted with the platform.

Docs: [Delete a track](/code-push/tracks/#delete-a-track)

### Service accounts for CI and integrations

**New** in Console, 2026-10-15. Permalink: [/changelog/#service-accounts](/changelog/#service-accounts)

Organizations can now create service accounts: accounts that belong to the organization instead of a person, with keys that keep working when the person who set them up leaves or changes roles. They're available on every plan.

- Each service account holds one role: Viewer, Developer, App Manager, or Auditor. Its keys do what that role allows. A service account can't be an Admin or Owner.
- Keys expire after 1 year by default, or choose 30 days, 90 days, or never.
- The audit log shows a service account's actions as its name followed by `[bot]`, such as `GitHub Actions[bot]`, along with the key or trust rule it used.
- The new Auditor role reads the audit log and nothing else, for exporting it to a SIEM without an Admin's key. The audit log needs the Enterprise plan.
- The Owner and Admins manage service accounts, which don't appear on the Members page.

Docs: [Service accounts](/account/service-accounts/)

### Viewer role on the Pro plan

**Changed** in Console, 2026-10-15. Permalink: [/changelog/#viewer-role-on-pro](/changelog/#viewer-role-on-pro)

Organizations on the Pro plan can now give members the Viewer role. It used to need the Business plan or higher.

- Viewers can see apps, releases, and patches but can't change them.

Docs: [Member roles](/account/orgs/#member-roles)

### Sign-in names the method your account uses

**Changed** in Console, 2026-10-15. Permalink: [/changelog/#wrong-provider-message](/changelog/#wrong-provider-message)

Signing in with a different method than your account uses now names the one to use.

- For example, an account that signs in with Google sees "This email address signs in with Google".

### Canceled plans void their open invoices

**Fixed** in Console, 2026-10-14. Permalink: [/changelog/#failed-payment-invoices-voided](/changelog/#failed-payment-invoices-voided)

When a plan is canceled because a payment failed, its open invoices are now voided.

- The payment link in the billing email can no longer take a payment for a plan that has ended.

### Switch organizations from the sidebar

**New** in Console, 2026-10-14. Permalink: [/changelog/#org-switcher](/changelog/#org-switcher)

The top of the Console's sidebar names the organization you're in and opens a switcher with its plan, your role, its install usage, and your other organizations.

- Your account links and Log out moved to a menu in the header.
- On 2026-10-15, the theme toggle left the header. Choose a theme under Appearance on your account page.

Docs: [Creating an organization](/account/orgs/#creating-an-organization)

### SAML sign-in refuses SHA-1

**Changed** in Console, 2026-10-14. Permalink: [/changelog/#saml-sha1-refused](/changelog/#saml-sha1-refused)

SAML responses signed or digested with SHA-1 are now refused.

- Sign-in fails with "SSO login failed". Configure your identity provider to sign with RSA-SHA256 and digest with SHA-256.

Docs: [Troubleshooting](/enterprise/saml/#troubleshooting)

### Usage counts only organizations you own

**Fixed** in Console, 2026-10-13. Permalink: [/changelog/#usage-owned-orgs](/changelog/#usage-owned-orgs)

The usage shown on your plan page and in organization settings now counts installs only from organizations the plan holder owns.

- This matches what the patch limit counts. Before, an organization you were only a member of could add to it.

Docs: [Organizations & billing](/account/billing/#organizations--billing)

### Sessions are named after the app that holds them

**Changed** in Console, 2026-10-12. Permalink: [/changelog/#console-session-names](/changelog/#console-session-names)

The Sessions list on your Account page now names each session after the app that holds it, such as Shorebird Console, Shorebird CLI, or Claude Code, with the browser it was approved in underneath.

- Previously, sessions were named after the browser, or after an internal ID like `shorebird-cli (api)`.
- Existing sessions get the new names too, except Console sign-ins from before October 5, 2026, and sessions from CLIs older than 1.6.125, which keep the name they had.

### Invitations match emails in any letter case

**Fixed** in Console, 2026-10-12. Permalink: [/changelog/#invite-email-case-insensitive](/changelog/#invite-email-case-insensitive)

Inviting a member or collaborator now finds their account no matter how the email address is capitalized.

- Previously, an invitation could go to someone who was already a member or collaborator, and adding a collaborator through the API as `Abby@example.com` when the account was `abby@example.com` failed with `User with email ... not found`.
- If the address matches more than one account, the request is refused with a message asking you to contact support to merge them. The API returns 409 with a code ending in `ambiguous_email`.

Docs: [Add a member](/account/orgs/#add-a-member)

### Sign-in no longer creates a second account for a differently cased email

**Changed** in Console, 2026-10-12. Permalink: [/changelog/#sign-in-verified-email](/changelog/#sign-in-verified-email)

Signing in with an email that matches an existing account's except for letter case no longer creates a second account. It follows the same rules as an exact match.

- If that account uses a different sign-in provider, sign-in asks you to use the one you originally used.
- Creating an account, or linking a sign-in to an existing account by email, now needs an email your provider has verified. Otherwise sign-in shows `Email not verified`.
- If the email differs only in letter case from more than one existing account, sign-in is refused and asks you to contact support.
- Signing in with the same provider account as before is unchanged.

### The CLI refuses to delete built-in tracks

**Changed** in CLI, 2026-10-11, Shorebird CLI 1.6.128 ([release notes](https://github.com/shorebirdtech/shorebird/blob/v1.6.128/RELEASE_NOTES.md)). Permalink: [/changelog/#channels-delete-built-in](/changelog/#channels-delete-built-in)

`shorebird channels delete` now refuses `stable`, `beta`, and `staging` with a usage error before contacting the server, which already refuses them.

- With `--json`, the success object no longer includes `is_default_track`, since a successful delete can no longer involve a built-in track.

Docs: [Delete a track](/code-push/tracks/#delete-a-track)

### More CLI fixes in 1.6.128

**Fixed** in CLI, 2026-10-11, Shorebird CLI 1.6.128 ([release notes](https://github.com/shorebirdtech/shorebird/blob/v1.6.128/RELEASE_NOTES.md)). Permalink: [/changelog/#cli-fixes-1-6-128](/changelog/#cli-fixes-1-6-128)

CLI 1.6.128 also fixes these issues.

- Flavored macOS patches run without `--release-version` read the release version from the flavor's build.
- iOS framework patches honor `SHOREBIRD_PATCH_DD_MAX_BYTES`.
- Releases on iOS, iOS framework, macOS, and Linux continue when an artifact already exists, as Android and Windows did.
- `shorebird release`, `shorebird patch`, and `shorebird preview` no longer leave copies of the app in the system temp directory.
- A rate limit or other refusal from the auth service no longer counts as being logged out. Only expired or revoked credentials do.
- A malformed credentials file no longer crashes every command, and on macOS and Linux the file is now readable only by you.
- `shorebird doctor --fix` shows every issue a fix leaves, and the count of fixable issues is accurate. `--fix` with `--json` is now a usage error.
- The Android INTERNET permission check finds the permission when `android:name` isn't its first attribute, and reports a permission removed with `tools:node="remove"` instead of offering a fix that conflicts with it.
- `shorebird patch aar` without `--release-version` in a non-interactive shell fails before building instead of crashing after it.
- `shorebird patch ios-framework` without `--release-version` now lets you pick the release in an interactive terminal, like other platforms.
- After `shorebird preview` launches an app on a device running iOS 16 or earlier, Ctrl-C works normally for the rest of the run.

### Consistent flag names for set-track and init

**Changed** in CLI, 2026-10-11, Shorebird CLI 1.6.128 ([release notes](https://github.com/shorebirdtech/shorebird/blob/v1.6.128/RELEASE_NOTES.md)). Permalink: [/changelog/#consistent-flag-names](/changelog/#consistent-flag-names)

`shorebird patches set-track` and `shorebird init` now use the same flag names as the commands next to them. The old names still work, but no longer appear in `--help`.

- `shorebird patches set-track` takes `--release-version` and `--patch-number`, like the other `patches` commands, in place of `--release` and `--patch`.
- `shorebird init` takes `--org-id`, like `shorebird apps transfer`, in place of `--organization-id`.
- Names that are only whitespace are now rejected by `shorebird init`, `shorebird channels create`, and `shorebird patches set-track`, as `shorebird apps rename` already did. `shorebird patch` now also rejects a `--track` that is empty, only whitespace, or longer than 128 characters.

```sh
shorebird init --org-id 42
```

### JSON errors explain failed checks

**Changed** in CLI, 2026-10-11, Shorebird CLI 1.6.128 ([release notes](https://github.com/shorebirdtech/shorebird/blob/v1.6.128/RELEASE_NOTES.md)). Permalink: [/changelog/#json-precondition-failed](/changelog/#json-precondition-failed)

With `--json`, every failing command now prints an error object on stdout, and a failed check before the command runs reports `precondition_failed` with a message and, when there's a known fix, a hint.

- Checks that report `precondition_failed` include not being logged in and not being in a Shorebird project.
- Previously some of these failures left stdout empty, and the reason was only on stderr.
- `shorebird patches set-track` now reports `changed` and the patch, as `rollback` and `rollforward` already did, so a script can tell whether the run did anything.

### macOS patches install on re-signed apps

**Fixed** in Code Push, 2026-10-11, Shorebird CLI 1.6.128 ([release notes](https://github.com/shorebirdtech/shorebird/blob/v1.6.128/RELEASE_NOTES.md)). Permalink: [/changelog/#macos-patches-resigned-apps](/changelog/#macos-patches-resigned-apps)

macOS patches now install on apps that were re-signed after release, such as for Developer ID notarization or the Mac App Store.

- Previously, re-signing changed the binary that patches were built against, so every patch failed the device's check that the app matches its release.
- Patches are now built against only the app's Dart code, which re-signing doesn't change.
- The fix ships in the engine with CLI 1.6.128. Create a new macOS release with CLI 1.6.128 or later to pick it up. Releases built earlier, or with an older `--flutter-version`, keep the old behavior.

### Signed patches honor --public-key-cmd

**Fixed** in CLI, 2026-10-11, Shorebird CLI 1.6.128 ([release notes](https://github.com/shorebirdtech/shorebird/blob/v1.6.128/RELEASE_NOTES.md)). Permalink: [/changelog/#patch-public-key-cmd](/changelog/#patch-public-key-cmd)

`shorebird patch` now embeds the public key from `--public-key-cmd` in the patch build, as `shorebird release` already did.

- Previously only `--public-key-path` reached the patch build. Signing itself still worked.
- The `--public-key-cmd` command now runs once per `shorebird patch` or `shorebird release` run, instead of once per architecture or platform, so a command that prompts, such as for two-factor authentication, prompts once.

Docs: [Create a signed patch](/code-push/guides/patch-signing/#create-a-signed-patch)

### The patches promote command is hidden from help

**Deprecated** in CLI, 2026-10-11, Shorebird CLI 1.6.128 ([release notes](https://github.com/shorebirdtech/shorebird/blob/v1.6.128/RELEASE_NOTES.md)). Permalink: [/changelog/#patches-promote-hidden](/changelog/#patches-promote-hidden)

`shorebird patches promote` no longer appears in `shorebird patches --help`. Use `shorebird patches set-track` instead.

- `promote` has been deprecated since December 2025. It still runs, so existing scripts keep working until it's removed.

```sh
shorebird patches set-track --release-version 1.0.0+1 --patch-number 1 --track stable
```

Docs: [Set patch track](/code-push/patch/#set-patch-track)

### Preview a flavor without a prompt

**New** in CLI, 2026-10-11, Shorebird CLI 1.6.128 ([release notes](https://github.com/shorebirdtech/shorebird/blob/v1.6.128/RELEASE_NOTES.md)). Permalink: [/changelog/#preview-flavor](/changelog/#preview-flavor)

`shorebird preview` now takes `--flavor`, like other commands that act on an app, so it can pick the flavor's app without asking.

- An unknown flavor fails with the same error as other commands.
- `shorebird releases get-apks` now takes `--app-id`, and with it no longer needs to run in a Shorebird project. Pass `--out` in that case.

```sh
shorebird preview --flavor internal --release-version 1.0.0+1
```

Docs: [Preview options](/code-push/preview/#options)

### Releases no longer upload files from an earlier build

**Fixed** in CLI, 2026-10-11, Shorebird CLI 1.6.128 ([release notes](https://github.com/shorebirdtech/shorebird/blob/v1.6.128/RELEASE_NOTES.md)). Permalink: [/changelog/#release-clears-build-output](/changelog/#release-clears-build-output)

`shorebird release` now clears `build/<platform>/shorebird/` before building on every platform, so files left by an earlier build aren't uploaded with a new release.

- Previously only iOS and iOS framework releases cleared it.
- Nothing else in `build/` is touched.

### Retrying a release records the new upload

**Fixed** in Code Push, 2026-10-11. Permalink: [/changelog/#release-retry-updates-artifacts](/changelog/#release-retry-updates-artifacts)

Running `shorebird release` again after a release failed partway now records the artifacts from the retry instead of keeping the first attempt's details.

- Previously, the hash, size, and location from the failed attempt stayed on the release, so the Console could show the wrong size, and patches could be built against the wrong file if its name changed between attempts.
- This works with every CLI version, since the fix is on the server.
- Releases retried before this fix keep the first attempt's details.

### Setting a patch's track again succeeds

**Changed** in CLI, 2026-10-11, Shorebird CLI 1.6.128 ([release notes](https://github.com/shorebirdtech/shorebird/blob/v1.6.128/RELEASE_NOTES.md)). Permalink: [/changelog/#set-track-already-on-track](/changelog/#set-track-already-on-track)

`shorebird patches set-track` now succeeds when the patch is already on the requested track, instead of failing with a usage error.

- It says the patch is already on that track and doesn't promote it again.
- This matches `shorebird patches rollback` and `rollforward`, so a retried CI job doesn't fail.
- With `--json`, `changed` is `false` when nothing changed.

Docs: [Set patch track](/code-push/patch/#set-patch-track)

### An unknown flavor is an error

**Changed** in CLI, 2026-10-11, Shorebird CLI 1.6.128 ([release notes](https://github.com/shorebirdtech/shorebird/blob/v1.6.128/RELEASE_NOTES.md)). Permalink: [/changelog/#unknown-flavor-error](/changelog/#unknown-flavor-error)

Commands that act on an existing app now fail when `--flavor` names a flavor that `shorebird.yaml` doesn't define, instead of silently using the default app.

- For example, a mistyped `shorebird patches rollback --flavor` previously rolled back a patch on the default app.
- This covers the `patches`, `releases`, `channels`, and `apps` commands. The error lists the flavors that `shorebird.yaml` defines.
- `--app-id` still takes precedence over `--flavor`.

### Crash fixes for login, doctor, and set-track

**Fixed** in CLI, 2026-10-10, Shorebird CLI 1.6.127 ([release notes](https://github.com/shorebirdtech/shorebird/blob/v1.6.127/RELEASE_NOTES.md)). Permalink: [/changelog/#cli-crash-fixes-1-6-127](/changelog/#cli-crash-fixes-1-6-127)

Four commands that could crash now work or fail with a clear message.

- `shorebird login` no longer crashes with `Bad state: read(ScopedRef<Browser>)`, a bug introduced in 1.6.126.
- `shorebird doctor --verbose` shows Gradle as not detected when the Gradle version lookup fails, instead of crashing.
- `shorebird patches set-track` and `shorebird patches promote` report a patch number that isn't a number as a usage error instead of crashing.

### Linux patches build like Linux releases

**Fixed** in CLI, 2026-10-10, Shorebird CLI 1.6.127 ([release notes](https://github.com/shorebirdtech/shorebird/blob/v1.6.127/RELEASE_NOTES.md)). Permalink: [/changelog/#linux-patches-match-releases](/changelog/#linux-patches-match-releases)

`shorebird patch linux` now builds with `--target` and the arguments passed after `--`, so the patch matches the release it targets.

- Previously the patch was built from the default entrypoint and without the arguments after `--`, such as `--dart-define` values, so it could differ from its release.
- Before building, it now checks that you're logged in, that the project is initialized, and that the host is Linux, as `shorebird release linux` does.

### API keys hold exactly their permission level

**Changed** in API, 2026-10-10. Permalink: [/changelog/#personal-access-token-limits](/changelog/#personal-access-token-limits)

API keys now hold exactly what their permission level grants. A full access key can do everything your role allows, except delete your account, change your billing limits, or manage your sessions and API keys. Sign in to the Console to do these.

- Deleting the account or changing billing limits with a key returns 403 with the code `personal_access_token_forbidden`. Keys were already refused both, with other error codes.
- Full access keys gained what their old fixed permission list left out, such as reading audit logs and managing invitations.
- Release and patch only keys can no longer update your account details, create organizations, or accept or decline invitations.

Docs: [API key permissions](/account/api-keys/#permissions)

### Approve each app that signs in as you

**Changed** in Console, 2026-10-10. Permalink: [/changelog/#sign-in-approval-page](/changelog/#sign-in-approval-page)

Signing in from the CLI now stops at an approval page, as signing in from other apps such as Claude Code already did. The redesigned page says which app is asking, which account it signs in to, and what it gets. Choose Authorize to continue or Cancel to refuse.

- Only the Console skips this page. Previously, signing in to the CLI through the browser didn't ask.
- CLIs older than 1.6.125 appear on the page as `An app on this computer`.
- The page shows where you'll be sent next and links to your Account page, where you can remove the app's access later.
- To approve a CLI sign-in with a code, type the code shown on your device. A link with the code already filled in isn't accepted.
- Use a different account from the same page if you're signed in to the wrong one.

### Apps are listed once

**Fixed** in API, 2026-10-09. Permalink: [/changelog/#apps-listed-once](/changelog/#apps-listed-once)

The app list no longer shows an app twice when you have both a role in its organization and a role granted on the app itself.

- This affected `GET /api/v1/apps`, `shorebird account apps`, `shorebird apps list`, and the app picker in `shorebird preview`.
- The Console's app list wasn't affected.

Docs: [List apps](/account/cli/#list-apps)

### The Shorebird cache cleans up after itself

**New** in CLI, 2026-10-09, Shorebird CLI 1.6.126 ([release notes](https://github.com/shorebirdtech/shorebird/blob/v1.6.126/RELEASE_NOTES.md)). Permalink: [/changelog/#cache-prunes-unused](/changelog/#cache-prunes-unused)

Flutter installs, engine artifacts, and downloaded previews that you no longer use are now removed automatically, so they stop piling up across upgrades and `--flutter-version` builds.

- Flutter installs and engine artifacts are removed after 30 days without use.
- Only the 10 most recently used previews are kept, and each is removed after 30 days without use.
- The Flutter version your CLI is pinned to is never removed.
- `shorebird cache clean --unused` removes unused items right away, without clearing the rest of the cache.

```sh
shorebird cache clean --unused
```

### Size analysis says when a release can't be analyzed

**Fixed** in Console, 2026-10-09. Permalink: [/changelog/#console-size-analysis-desktop-releases](/changelog/#console-size-analysis-desktop-releases)

The Size tab for a release with no Android or iOS build now says that size analysis supports Android and iOS only, instead of saying to check back in a few minutes.

- This affects releases built only for macOS, Windows, or Linux, which are never analyzed.
- Releases with an Android or iOS build are unchanged.

### Flutter 3.47.7 support

**New** in Flutter, 2026-10-09, Shorebird CLI 1.6.126 ([release notes](https://github.com/shorebirdtech/shorebird/blob/v1.6.126/RELEASE_NOTES.md)). Permalink: [/changelog/#flutter-3-47-7](/changelog/#flutter-3-47-7)

Shorebird now supports Flutter 3.47.7 and Dart 3.13.5.

- iOS: fixes accessibility frames for `OverlayPortal`, which were shrunk and anchored top-left, so VoiceOver focus and XCUITest taps missed the visible controls.
- iOS: fixes VoiceOver focus jumping to the top left of the screen in a `ReorderableListView`.

```sh
shorebird release ios --flutter-version=3.47.7
```

Docs: [Flutter versions](/getting-started/flutter-version/)

### iOS previews show your app's logs again

**Fixed** in CLI, 2026-10-09, Shorebird CLI 1.6.126 ([release notes](https://github.com/shorebirdtech/shorebird/blob/v1.6.126/RELEASE_NOTES.md)). Permalink: [/changelog/#ios-preview-logs](/changelog/#ios-preview-logs)

With Xcode 26 or later, `shorebird preview` on an iOS device now shows the app's `print` output and `[shorebird]` updater lines, as Android and macOS previews do.

- Previously the app launched but none of its output appeared.
- The command stays attached until the app exits.

Docs: [Preview a release](/code-push/preview/)

### Sign in from any machine

**New** in CLI, 2026-10-09, Shorebird CLI 1.6.126 ([release notes](https://github.com/shorebirdtech/shorebird/blob/v1.6.126/RELEASE_NOTES.md)). Permalink: [/changelog/#login-browser-and-device-code](/changelog/#login-browser-and-device-code)

`shorebird login` now opens your browser, and when no browser can open, such as over SSH, in CI, or on Linux without a display, it shows a code to enter in a browser on any device.

- The login URL is still printed, in case the browser doesn't open.
- Pass `--device` to use a code even when a browser is available.
- On 1.6.126, `shorebird login` without `--device` crashes with `Bad state: read(ScopedRef<Browser>)`. Upgrade to 1.6.127 or later.

```sh
shorebird login --device
```

Docs: [Login](/account/cli/#login)

### Patch obfuscated Android releases built with older Flutter

**Fixed** in CLI, 2026-10-08, Shorebird CLI 1.6.125 ([release notes](https://github.com/shorebirdtech/shorebird/blob/v1.6.125/RELEASE_NOTES.md)). Permalink: [/changelog/#android-obfuscated-patches-older-flutter](/changelog/#android-obfuscated-patches-older-flutter)

Patching an Android release built with `--obfuscate` on a Flutter version older than 3.41.2 no longer fails with `Unrecognized flags: load_obfuscation_map`.

- Upgrade the CLI and patch as usual. Existing obfuscated releases become patchable without a new release.
- iOS patches still need the release to use Flutter 3.41.2 or later for obfuscation, and now fail up front with a clear error instead of a `gen_snapshot` failure.
- For an obfuscated iOS release, `shorebird release ios` and `shorebird release ios-framework` now check the Flutter version they actually build with, including `--flutter-version`.

### Errors say what to do next

**Changed** in CLI, 2026-10-08, Shorebird CLI 1.6.125 ([release notes](https://github.com/shorebirdtech/shorebird/blob/v1.6.125/RELEASE_NOTES.md)). Permalink: [/changelog/#cli-errors-name-next-step](/changelog/#cli-errors-name-next-step)

Errors from `shorebird init`, `shorebird patch`, `shorebird preview`, and the checks that run before a command now name the step that fixes them.

- `shorebird patch --force` explains that there's no `--force` flag and points to `--allow-native-diffs` and `--allow-asset-diffs`.
- With `--json`, the `--force` advice is in the error's `hint`.

### Warning for app extension versions that don't match the app

**New** in CLI, 2026-10-08, Shorebird CLI 1.6.125 ([release notes](https://github.com/shorebirdtech/shorebird/blob/v1.6.125/RELEASE_NOTES.md)). Permalink: [/changelog/#ios-extension-version-warning](/changelog/#ios-extension-version-warning)

`shorebird release ios` now warns when an app extension's version or build number differs from the app's, which App Store Connect rejects with ITMS-90473.

- The warning names each extension and the mismatched value, like `NotificationService.appex: CFBundleShortVersionString is "1.15.32", the app is "1.15.67"`.
- Shorebird doesn't change the versions for you. Update the extension targets in Xcode so they match the app.

### More secure CLI sign-in

**Changed** in CLI, 2026-10-08, Shorebird CLI 1.6.125 ([release notes](https://github.com/shorebirdtech/shorebird/blob/v1.6.125/RELEASE_NOTES.md)). Permalink: [/changelog/#login-oauth-pkce](/changelog/#login-oauth-pkce)

`shorebird login` now uses standard OAuth with PKCE and `state`, and `shorebird logout` now warns when the auth server can't confirm that your session was revoked.

- Google and Microsoft sign-in, and tokens from `shorebird login:ci`, are no longer supported. The server stopped accepting them on October 1, 2026. Run `shorebird login` to sign in again, and use an API key in `SHOREBIRD_TOKEN` for CI.
- If your stored credentials have expired, `shorebird login` signs you in again instead of reporting that you're already logged in.

Docs: [Authentication commands](/account/cli/#authentication-commands)

### Script releases and patches with JSON output

**New** in CLI, 2026-10-08, Shorebird CLI 1.6.125 ([release notes](https://github.com/shorebirdtech/shorebird/blob/v1.6.125/RELEASE_NOTES.md)). Permalink: [/changelog/#release-patch-json](/changelog/#release-patch-json)

`shorebird release` and `shorebird patch` now support `--json`, so a script gets the new release or patch as data instead of parsing log lines.

- `shorebird release --json` reports the app ID, the platforms, and each release with its version, Flutter version, and per-platform status.
- `shorebird patch --json` reports the app ID, the track, and each patch with its platform, release version, patch number, and link percentage.
- With `--dry-run`, both report what would have been published, with `dry_run` set to `true`.
- With `--json`, stdout holds only the JSON object. Progress and logs go to stderr.

```sh
shorebird patch android --release-version=latest --json
```

### Sign-ins last as long as you use them

**Changed** in Console, 2026-10-05. Permalink: [/changelog/#console-sessions-expire-when-unused](/changelog/#console-sessions-expire-when-unused)

Sign-ins no longer end at a fixed 90 days. A sign-in now lasts until it goes 30 days without use, so you stay signed in as long as you keep using Shorebird.

- Previously, a sign-in also ended 90 days after it began, even in daily use.
- You can still revoke any session from your Account page.

### The API now reports rate limits

**New** in API, 2026-10-04. Permalink: [/changelog/#api-rate-limits](/changelog/#api-rate-limits)

API responses now carry `RateLimit` and `RateLimit-Policy` headers, so scripts can see their limit and how close they are to it.

- Going over the limit returns 429 with a `Retry-After` header and the code `rate_limited`.
- Limits are counted per caller: per API key or token, or per IP address for unauthenticated requests.
- Patch checks from your app aren't rate limited.

Docs: [Shorebird API](/account/api/)

### Flutter 3.47.6 support

**New** in Flutter, 2026-10-02, Shorebird CLI 1.6.124 ([release notes](https://github.com/shorebirdtech/shorebird/blob/v1.6.124/RELEASE_NOTES.md)). Permalink: [/changelog/#flutter-3-47-6](/changelog/#flutter-3-47-6)

Shorebird now supports Flutter 3.47.6 and Dart 3.13.5.

- Windows: fixes a hang in production apps. The fix ships in the engine, so a Windows app picks it up only from a new release built with Flutter 3.47.6 or later.

```sh
shorebird release windows --flutter-version=3.47.6
```

Docs: [Flutter versions](/getting-started/flutter-version/)

### Android patches name the dependency changes behind DEX diffs

**New** in CLI, 2026-10-02, Shorebird CLI 1.6.124 ([release notes](https://github.com/shorebirdtech/shorebird/blob/v1.6.124/RELEASE_NOTES.md)). Permalink: [/changelog/#patch-dex-dependency-changes](/changelog/#patch-dex-dependency-changes)

When `shorebird patch android` finds DEX changes, it now lists the Android libraries whose versions differ from the release, which usually explains a native change you didn't make.

- Each changed library is shown with its release and patch versions, like `io.branch.sdk.android:library 5.21.2 -> 5.21.3`, along with added and removed libraries.
- The list comes from dependency metadata in both app bundles. If either bundle was built without it, nothing is listed.
- Pin dependency versions, or use Gradle dependency locking, so patch builds resolve the same versions as the release. If the listed changes explain every difference and your Dart code doesn't rely on them, `--allow-native-diffs` is safe for that patch.
- In CI and other non-interactive runs, the `--allow-native-diffs` and `--allow-asset-diffs` hints are now printed before the command fails.

Docs: [Native changes warning](/code-push/troubleshooting/#your-app-contains-native-changes-warning-when-creating-a-patch-even-though-you-havent-changed-swiftobjective-ckotlinjava-code)

### Legacy login tokens no longer work

**Changed** in API, 2026-10-01. Permalink: [/changelog/#legacy-login-tokens-retired](/changelog/#legacy-login-tokens-retired)

Since October 1, 2026, tokens from `shorebird login:ci` and logins from CLI versions older than 1.6.87 are rejected.

- Requests with a legacy token get a 401 with the code `legacy_auth_retired`.
- In CI, create an API key in the Console and set it as `SHOREBIRD_TOKEN`.
- On your own machine, run `shorebird upgrade`, then `shorebird logout` and `shorebird login`.

Docs: [Migrate from shorebird login:ci](/account/api-keys/#migrating-from-shorebird-loginci)

## September 2026

### Find apps faster in the Console

**New** in Console, 2026-09-24. Permalink: [/changelog/#console-app-list](/changelog/#console-app-list)

The sidebar now lists the active organization's apps, and the organization's app list can now be filtered, sorted, and paged.

- The sidebar shows up to 10 apps with their icons, with the open app and the ones you visited recently first.
- On the app list, filter by platform and sort by last updated, created date, or name. Long lists are split into pages.

### Pick a role when inviting a member

**New** in Console, 2026-09-24. Permalink: [/changelog/#console-invite-role](/changelog/#console-invite-role)

The invite dialog now has a role picker, so a new member joins with any role your plan offers instead of always as a Developer.

- The dialog lists what the selected role can do.
- Owner can't be picked. Ownership changes only through an ownership transfer.

Docs: [Member roles](/account/orgs/#member-roles)

### Move an older patch to another track

**Fixed** in Console, 2026-09-23. Permalink: [/changelog/#console-change-track-superseded-patch](/changelog/#console-change-track-superseded-patch)

Change Track is now offered on a patch that a newer patch has superseded on its track, so an older `staging` patch can still be promoted to `stable`.

- Previously the action was hidden on any patch with a newer patch on its track that wasn't rolled back.
- The dialog now explains what moving the patch will do.

Docs: [Promote a patch in the Console](/code-push/tracks/#via-the-shorebird-console)

### Copy a pending invitation's link

**New** in Console, 2026-09-21. Permalink: [/changelog/#console-copy-invitation-link](/changelog/#console-copy-invitation-link)

Each pending invitation in an organization's members list now has a button that shows its link, so you can send it yourself.

- Only the invited email address can accept the link, after signing in with it.

Docs: [Add a member](/account/orgs/#add-a-member)

### Flutter 3.47.5 support

**New** in Flutter, 2026-09-21, Shorebird CLI 1.6.123 ([release notes](https://github.com/shorebirdtech/shorebird/blob/v1.6.123/RELEASE_NOTES.md)). Permalink: [/changelog/#flutter-3-47-5](/changelog/#flutter-3-47-5)

Shorebird now supports Flutter 3.47.5 and Dart 3.13.4.

- iOS: fixes an occasional crash when debugging on physical iOS 27 devices.
- Widget Previewer: fixes a crash when re-expanding a preview group.
- A Dart Development Service startup failure is now handled instead of crashing.

```sh
shorebird release ios --flutter-version=3.47.5
```

Docs: [Flutter versions](/getting-started/flutter-version/)

### Release with the Flutter version you already use

**New** in CLI, 2026-09-21, Shorebird CLI 1.6.123 ([release notes](https://github.com/shorebirdtech/shorebird/blob/v1.6.123/RELEASE_NOTES.md)). Permalink: [/changelog/#flutter-version-fvm-and-system](/changelog/#flutter-version-fvm-and-system)

`--flutter-version` now accepts `fvm` and `system`, so you no longer have to look up and repeat your Flutter version number.

- `--flutter-version=fvm` uses the version fvm resolves for your project from its `.fvmrc`. It requires `fvm` on your `PATH`.
- `--flutter-version=system` uses the version reported by the `flutter` on your `PATH`.
- Shorebird still builds with its own fork of Flutter at that version, not with your fvm or system install. A version Shorebird doesn't support fails the same way as one you name explicitly.

```sh
shorebird release android --flutter-version=fvm
```

Docs: [Match the Flutter version you already use](/getting-started/flutter-version/#match-the-flutter-version-you-already-use)

### iOS debug symbols now upload to symbol servers

**Fixed** in CLI, 2026-09-21, Shorebird CLI 1.6.123 ([release notes](https://github.com/shorebirdtech/shorebird/blob/v1.6.123/RELEASE_NOTES.md)). Permalink: [/changelog/#ios-split-debug-info-dsym](/changelog/#ios-split-debug-info-dsym)

On iOS, `--split-debug-info` now writes a Mach-O dSYM, so symbol servers ingest it and Dart stack traces from production become readable.

- Previously the file was an ELF with no debug ID. Uploads reported finding nothing, while still exiting cleanly.
- The fix is in Shorebird's Flutter 3.47.5, the default in CLI 1.6.123. A release built with an older `--flutter-version` still gets the old file.

Docs: [Dart symbols for obfuscated builds](/code-push/crash-reporting/uploading-symbols/#dart-symbols-for-obfuscated-builds)

### See whose plan each organization runs on

**New** in Console, 2026-09-17. Permalink: [/changelog/#console-whose-plan](/changelog/#console-whose-plan)

The organizations list is split into Owned by you and Member of, and each organization shows its plan tier.

- Organization settings say whose plan the organization runs on, with a Manage link for the owner.

Docs: [Plans and upgrading](/account/plans/)

### Patch checks report the patch the device is running

**Fixed** in Code Push, 2026-09-16, Shorebird CLI 1.6.122 ([release notes](https://github.com/shorebirdtech/shorebird/blob/v1.6.122/RELEASE_NOTES.md)). Permalink: [/changelog/#failed-patch-checks-for-replacement](/changelog/#failed-patch-checks-for-replacement)

The automatic patch check now starts after the patch the device boots has loaded, instead of before, so it reports the patch the device is actually running. With `auto_update: false`, your app's own updater call decides when to check.

- Each device is now attributed to the patch it is running. Update delivery is unchanged.
- Installing a new patch can no longer retire a patch that is still booting for the first time.
- When a patch fails to load, the device still checks for a replacement patch on that same launch.
- These fixes are in the updater built into Shorebird's Flutter engine, so they apply to releases built with Shorebird's Flutter 3.47.4 or later, the default in CLI 1.6.122.

Docs: [Patch integrity and automatic rollback](/code-push/rollback/#patch-integrity-and-automatic-rollback)

### Flutter 3.47.4 support

**New** in Flutter, 2026-09-16, Shorebird CLI 1.6.122 ([release notes](https://github.com/shorebirdtech/shorebird/blob/v1.6.122/RELEASE_NOTES.md)). Permalink: [/changelog/#flutter-3-47-4](/changelog/#flutter-3-47-4)

Shorebird now supports Flutter 3.47.4 and Dart 3.13.3.

- iOS: native assets now require iOS 15, raised from iOS 13.
- iOS: when debugging with Xcode 27, a newly paired or upgraded device no longer hangs on a white screen for minutes. Flutter now prepares missing Device Support Symbols first, or warns with the steps to do it yourself.
- Windows: when Smart App Control or another security policy blocks Flutter's binaries, the tool now exits with an actionable error instead of crashing.

```sh
shorebird release ios --flutter-version=3.47.4
```

Docs: [Flutter versions](/getting-started/flutter-version/)

### Clear error when an Android build drops libapp.so

**Fixed** in CLI, 2026-09-14, Shorebird CLI 1.6.121 ([release notes](https://github.com/shorebirdtech/shorebird/blob/v1.6.121/RELEASE_NOTES.md)). Permalink: [/changelog/#android-missing-libapp](/changelog/#android-missing-libapp)

`shorebird release android` and `shorebird patch android` now stop with an explanation when the built app bundle has no `libapp.so`, your compiled Dart code, for any architecture.

- Previously this failed with a generic error about missing artifacts, which for `shorebird release android` pointed at ABI filters.
- The usual cause is a custom Gradle setup that relocates build directories, so the bundle is packaged before `libapp.so` is written.
- A patch that covers only some of the release's architectures now warns and lists the skipped ones, since devices on those architectures won't get it.

### More CLI fixes in 1.6.121

**Fixed** in CLI, 2026-09-14, Shorebird CLI 1.6.121 ([release notes](https://github.com/shorebirdtech/shorebird/blob/v1.6.121/RELEASE_NOTES.md)). Permalink: [/changelog/#cli-fixes-1-6-121](/changelog/#cli-fixes-1-6-121)

CLI 1.6.121 also fixes these issues.

- After an Xcode upgrade, iOS and macOS patches no longer report every asset catalog as changed when no asset changed.
- When an Android build fails and a plugin still references the legacy `flutter.jar`, the error names the plugin to upgrade.
- `shorebird init` no longer separates a comment in your pubspec's `flutter:` section from the key it describes when it adds the `assets:` entry.
- Mistakes in the signing flags of `shorebird release` and `shorebird patch` now name the flag to fix. For example, a key file that doesn't exist names the flag it was passed to, and `shorebird patch` with only one of `--public-key-path` and `--private-key-path` names the one that's missing.
- iOS patch errors, like a missing `.xcarchive` or a release built with Flutter older than 3.22.2, now say what to do next.
- An interrupted Flutter install, such as for `--flutter-version`, now resumes on the next run instead of needing `shorebird cache clean`.

### Flutter 3.47.3 support

**New** in Flutter, 2026-09-14, Shorebird CLI 1.6.121 ([release notes](https://github.com/shorebirdtech/shorebird/blob/v1.6.121/RELEASE_NOTES.md)). Permalink: [/changelog/#flutter-3-47-3](/changelog/#flutter-3-47-3)

Shorebird now supports Flutter 3.47.3 and Dart 3.13.3.

- Android: fixes license detection for cmdline-tools 23.0 and newer.
- iOS and macOS: a missing Xcode is now handled instead of failing hard.
- Dart: fixes Windows-to-Linux cross-compilation producing incorrect executables when build hooks link native code.
- Android: B-series PowerVR GPUs no longer use Vulkan.

```sh
shorebird release android --flutter-version=3.47.3
```

Docs: [Flutter versions](/getting-started/flutter-version/)

### Manage apps from the CLI

**New** in CLI, 2026-09-14, Shorebird CLI 1.6.121 ([release notes](https://github.com/shorebirdtech/shorebird/blob/v1.6.121/RELEASE_NOTES.md)). Permalink: [/changelog/#shorebird-apps-commands](/changelog/#shorebird-apps-commands)

New `shorebird apps` commands list, rename, delete, and transfer apps without opening the Console.

- `shorebird apps transfer --org-id <id>` moves an app into another organization. Run `shorebird account orgs` to find the id.
- `shorebird apps rename --name <name>` changes the display name.
- `shorebird apps delete` has no prompt. Pass `--confirm-name` with the app's current display name to confirm.

```sh
shorebird apps transfer --app-id <id> --org-id 42
```

Docs: [App management commands](/account/cli/#app-management-commands)

### Manage channels from the CLI

**New** in CLI, 2026-09-14, Shorebird CLI 1.6.121 ([release notes](https://github.com/shorebirdtech/shorebird/blob/v1.6.121/RELEASE_NOTES.md)). Permalink: [/changelog/#shorebird-channels-commands](/changelog/#shorebird-channels-commands)

New `shorebird channels` commands create, list, and delete the channels (tracks) an app can publish to.

- Publishing a patch with `--track=<name>` still creates that channel automatically.
- `shorebird channels delete` has no prompt. Pass `--confirm-name` with the channel name to confirm. Devices on a deleted channel stop receiving patches.
- The built-in `stable`, `beta`, and `staging` channels can't be deleted.

```sh
shorebird channels create --app-id <id> --name qa
```

Docs: [Manage tracks from the CLI](/code-push/tracks/#managing-tracks-from-the-cli)

### See your plan from the CLI

**New** in CLI, 2026-09-14, Shorebird CLI 1.6.121 ([release notes](https://github.com/shorebirdtech/shorebird/blob/v1.6.121/RELEASE_NOTES.md)). Permalink: [/changelog/#whoami-plan-level](/changelog/#whoami-plan-level)

`shorebird account whoami` now shows your plan level and whether you have an active subscription.

- The plan level is `free`, `pro`, `business`, or `enterprise`.
- With `--json`, the level is in a new `plan_level` field. The existing `plan` field still reads `paid` or `free`, so scripts that use it keep working.

```sh
shorebird account whoami
```

Docs: [Current account](/account/cli/#current-account)

### Manage your plan and billing in one place

**New** in Console, 2026-09-10. Permalink: [/changelog/#console-plan-page](/changelog/#console-plan-page)

The new Plan page under Account replaces the Plan tab in each organization's settings, since a plan belongs to your account and covers every organization you own.

- Change plan shows the prorated amount before you confirm. Upgrades take effect immediately, and downgrades are scheduled for the end of the billing period.
- Cancel plan keeps your plan until the period ends, and Resume plan undoes a scheduled cancellation.
- Set a monthly spending limit on overage installs, see past overage charges, and open or pay invoices from the same page.
- A past-due payment shows a banner that links to the Plan page.

Docs: [Plans and upgrading](/account/plans/)

### Size analysis is free on every plan during rollout

**Changed** in Console, 2026-09-02. Permalink: [/changelog/#size-analysis-free](/changelog/#size-analysis-free)

The Size tab is now available on every plan, including Free, and releases are analyzed whatever plan they're on. Pricing will come later.

- The upgrade prompt on the Size tab is replaced by a banner you can dismiss.
- The Size tab has a link for sending feedback.

### The built-in channels can't be deleted

**Changed** in API, 2026-09-01. Permalink: [/changelog/#default-channels-protected](/changelog/#default-channels-protected)

Deleting the `stable`, `beta`, or `staging` channel is now refused, since it would unpublish every patch on that track.

- The API returns 403 with the code `channels_delete_default_channel`.
- Channels you create yourself can still be deleted.

Docs: [Delete a track](/code-push/tracks/#delete-a-track)

## August 2026

### Layered app icons no longer count as asset changes

**Fixed** in CLI, 2026-08-28, Shorebird CLI 1.6.120 ([release notes](https://github.com/shorebirdtech/shorebird/blob/v1.6.120/RELEASE_NOTES.md)). Permalink: [/changelog/#apple-layered-icons-asset-changes](/changelog/#apple-layered-icons-asset-changes)

On iOS and macOS, `shorebird patch` no longer reports an asset change for a layered app icon (`.icon`) that you didn't change.

- Xcode gives a layered icon's images new generated names on every build, so every patch looked like it changed the app's asset catalog.

### Flutter 3.47.2 support

**New** in Flutter, 2026-08-28, Shorebird CLI 1.6.120 ([release notes](https://github.com/shorebirdtech/shorebird/blob/v1.6.120/RELEASE_NOTES.md)). Permalink: [/changelog/#flutter-3-47-2](/changelog/#flutter-3-47-2)

Shorebird now supports Flutter 3.47.2 and Dart 3.13.2.

- iOS and macOS: Swift package dependencies are always updated.
- Windows: fixes hot reload ignoring file edits made within the same second.
- Desktop: `--build-name` and `--build-number` are now forwarded to `version.json`.

```sh
shorebird release android --flutter-version=3.47.2
```

Docs: [Flutter versions](/getting-started/flutter-version/)

### Roll patches back and forward from the CLI

**New** in CLI, 2026-08-28, Shorebird CLI 1.6.120 ([release notes](https://github.com/shorebirdtech/shorebird/blob/v1.6.120/RELEASE_NOTES.md)). Permalink: [/changelog/#patches-rollback-and-rollforward](/changelog/#patches-rollback-and-rollforward)

`shorebird patches rollback` and `shorebird patches rollforward` do the same as the Rollback and Roll Forward actions in the Console.

- Both take `--release-version` and `--patch-number`.
- By default, a patch that is already in the requested state is reported and the command succeeds. Add `--require-change` to exit with an error instead.

```sh
shorebird patches rollback --release-version 1.0.0+1 --patch-number 1
```

Docs: [Roll back from the CLI](/code-push/rollback/#roll-back-from-the-cli)