New features, fixes, and supported Flutter versions in Shorebird. Expand an entry for the full detail, the command, and the doc it belongs to. Subscribe with the RSS feed.
On an app's Collaborators page, Add to organization makes a per-app collaborator a Developer of the organization in one step.
--min-link-percentage now defaults to 20, so an iOS or macOS patch that shares less than 20% of its Dart code with the release fails instead of publishing. Such a patch can run much slower than the release.
The link percentage of this patch (<n>%) is below the minimum threshold (20%)., followed by Not publishing. A --dry-run fails the same way.--min-link-percentage=0 to accept any link percentage, as before.shorebird patch ios --min-link-percentage=0Shorebird no longer runs flutter pub get with the Flutter on your PATH after each build. That step could make Xcode's Product > Archive fail after shorebird release.
flutter pub get to switch back.CLI 1.6.135 also fixes these issues.
shorebird patch checks that it can patch each one before building any, so one platform's failure no longer leaves another patched.--flavor with no matching Xcode scheme fails before the build, with an error that names the flavors you can build.shorebird release ios warns when the --split-debug-info dSYM has no Dart debug info, which happens with Xcode 27 and Flutter 3.47.5 to 3.47.9, so crash reports would have no Dart function names.shorebird release android warns when the Android version name has characters an iOS version can't, so the two platforms' releases won't be the same Shorebird release.shorebird upgrade sets up the new version before it exits, on every platform.base.archivesName renames it, and a --save-obfuscation-map you pass is honored.shorebird init with several flavor dimensions detects only flavors you can build.shorebird auth token takes no arguments and points you to shorebird tokens for API keys.The Shorebird server now refuses requests from Shorebird CLI versions older than 1.6.87, so run shorebird upgrade if you're on one. The oldest supported version used to be 1.4.0.
upgrade_required and the message This version of the Shorebird CLI is no longer supported.shorebird upgradeNew commands manage your organizations from the command line. Each returns JSON with --json, except shorebird service-accounts keys create, which opens the console. Those that act on one organization take --org-id.
shorebird orgs lists, shows, creates, and renames your organizations. shorebird orgs list replaces shorebird account orgs, which still works.shorebird usage shows an organization's patch installs this period, by app.shorebird members lists, invites, and removes members, and changes their roles.shorebird service-accounts creates, changes, and deletes service accounts, lists and revokes their keys, and adds and removes their trust rules.shorebird audit-log reads one page of the audit log, or exports all of it as OCSF events.The Console's Email notifications card has a Usage alerts switch for the emails that warn when an organization you're in nears or reaches its patch install limit. Each of these emails also has an unsubscribe link that works without signing in.
New commands cover API keys, sessions, and your account. Actions that are hard to undo or that create credentials open the Shorebird console, where you finish them, and shorebird apps delete no longer deletes the app.
shorebird tokens list lists your API keys, and shorebird account sessions lists your sessions, when you're signed in with shorebird login.shorebird tokens create, shorebird tokens delete, and shorebird account delete open the console page that does each one.shorebird logout --all logs you out here, then opens the console to sign out your other sessions.shorebird apps delete no longer deletes the app. It opens the app's Settings page in the console. Older releases still delete with --confirm-name.--json, these hand-offs exit with code 69 and a console_required error that holds the link.shorebird enterprise works on your enterprise and across every organization in it. On its own, it shows the enterprise and your role in it.
members lists the enterprise's directory and changes enterprise roles, and guests lists people in its organizations who aren't in the directory.orgs list and apps list cover every organization and app in the enterprise, including ones you aren't in.audit-log, usage, and service-accounts list work as their organization versions do, across the whole enterprise.shorebird enterprise apps listShorebird now supports Flutter 3.47.9 and Dart 3.13.7, the default in Shorebird 1.6.135. In releases built with it, patch checks and downloads on iOS, macOS, and Android go through the platform's own HTTP stack.
flutter_tools exits with an actionable error when a path is too long, instead of crashing.flutter test no longer crashes compiling native assets in pub workspaces, monorepos, and symlinked directories.shorebird release android --flutter-version=3.47.9shorebird patch now warns when the release you're patching was built with a Flutter revision that has a known problem on that platform, such as the iOS crashes in Flutter 3.44.0 to 3.44.8 and the early 3.44.9 build c2515c46c7.
Without --track, shorebird patch in a terminal now asks whether to publish to staging, beta, or stable, with staging selected. Before, it published to stable, which reaches all users.
stable and warns. Pass --track to choose.--track fails early.shorebird patch android --track=stagingOn Android, shorebird preview now uninstalls the app before installing the release, instead of clearing its data. Anything the app kept outside its data paths goes too, and preview works on devices that don't let adb clear app data.
When the account that pays for an app needs attention, shorebird release and shorebird patch end with a notice from Shorebird, for example when patch delivery is paused or nearing the plan's install limit. The notice says when a failed payment is the cause.
--json, it goes to stderr, and stdout holds only the JSON object.The Patches are not being delivered. banner now follows the organization you're viewing, so every member of a paused organization sees it. Before, only the plan's owner saw it, and in every organization they were in.
If you sign in to the Console while you're in no organization, it now shows the invitations waiting for you, to join or decline, before offering to create an organization.
shorebird init adds your app to their organization instead of a new one.Enterprises can now add and deactivate people from Okta or Microsoft Entra ID over SCIM 2.0, and from the People tab of the Enterprise page.
Three fixes for deleting your account and for an organization's owner.
An organization must have an owner. Transfer ownership to another member first.When a release was built on a Flutter revision with a known problem on one of its platforms, such as the iOS crashes in Flutter 3.44.0 to 3.44.8 and the early 3.44.9 build c2515c46c7, the Console now says so.
flutter_revision_issue holds the same details.An organization's General settings page now shows a Patch activity chart of patch installs and downloads across all the organization's apps.
When an enterprise requires Google or Microsoft for a domain, only Google Workspace or Microsoft Entra accounts the domain manages can sign in. A personal Google or Microsoft account registered with a work email is refused, and its session ends at its next refresh.
CLI 1.6.134 also fixes these issues.
shorebird patch warns when shorebird.yaml sets patch_verification: install_only and the release's Flutter doesn't check signatures in that mode, since devices on that release install the patch without checking it.flutter pub get after it fails.Deleting an app in the Console now happens only on the app's Settings page, and you type the app's name to confirm. The app list's row menu no longer offers Delete.
shorebird patch keeps the release artifacts it downloads and reuses them the next time you patch the same release, and builds Android patches only for the architectures the release has.
--target-platform after -- still builds what you ask for.A personal organization can now be renamed and deleted like any other organization, and on a plan with collaboration it can invite members and change their roles. The Members tab shows for every organization.
A release's Insights tab now lists each patch's installs since counting began, in an All-time installs card below the chart.
A bell in the Console notifies you, across all your apps, when devices start reporting that a release isn't the build Shorebird released.
The release link shorebird release prints now opens the release in the Console instead of a page that wasn't found.
https://console.shorebird.dev/apps/<appId>/<path> redirect to the same page in the app's organization.The Enterprise page has a Billing tab showing your contract and usage, the organizations your enterprise pays for with each one's installs this period, and your invoices with their PDFs.
Each patch install is now counted once, by the install event's id, so a copy of the same event no longer adds to your usage and metrics twice.
Lists of organizations, an organization's apps, members and service accounts, a service account's keys and trust rules, and a release's artifacts can now be read a page at a time, by number.
page and per_page. The response carries total_count and next_cursor.q to search by name, sort (updated, created, or name), direction, and platform.When devices report that the app installed from the store isn't the build shorebird release uploaded, the release's page now shows an alert, Patches can't install on <n> devices, so you know why its patches aren't installing.
Inviting anyone to an organization now needs the owner's plan to include collaboration, as the docs said. Before, an invitation with the Developer role went through on the Hobby plan.
shorebird_plan_insufficient_tier.CLI 1.6.132 also fixes these issues.
shorebird passes every argument through, keeps -- when run from PowerShell, and exits with the command's own exit code, so a failing command no longer looks like a success to a script.shorebird preview on Android shows the logs your app writes as it starts, not only the ones after the CLI attaches.shorebird flutter versions list no longer prints Cancelled when it succeeds.shorebird release ios-framework passes --no-codesign on to Flutter.shorebird init skips Android flavor detection, instead of failing, when the Android SDK or Java is missing.Shorebird now supports Flutter 3.47.8 and Dart 3.13.7. It includes a Dart security fix, so rebuild Android, Windows, and Linux apps with it.
dart:io trusts the root certificates the system updates, not only the ones the device shipped with.patch_verification: install_only checks patch signatures again.flutter build ios-framework always regenerates Generated.xcconfig, and broken plugin symlinks no longer crash flutter pub get.shorebird release android --flutter-version=3.47.8Shorebird's builds of Flutter 3.41.9, 3.44.0 to 3.44.9, and 3.47.0 to 3.47.7 skip the patch signature check entirely when shorebird.yaml sets patch_verification: install_only. shorebird release now refuses that combination.
strict, is unaffected.patch_verification from shorebird.yaml, or release with Flutter 3.47.8 or newer.New releases are now signed by default with a key Shorebird manages for your organization, so someone tampering with your users' network can't push code to your app. Update the CLI and make a new release to turn it on.
shorebird release builds your organization's public key into the release, and Shorebird signs every patch to it. Patching works as before, with no key flags.--public-key-path or --public-key-cmd.--no-patch-signing releases without signing, which isn't recommended.shorebird upgrade.shorebird upgrade
shorebird release androidA request for an app or organization you have no role in now gets the same 404 as one that doesn't exist, so an id tells someone outside your organization nothing. Before, a request for someone else's app got 403.
app_not_found.Three new environment variables point the CLI at an internal mirror, such as Artifactory, for Flutter, its engine artifacts and bundletool.
SHOREBIRD_DOWNLOAD_URL replaces https://download.shorebird.dev for Flutter's artifacts, Shorebird's engine, and the tools used to build patches.SHOREBIRD_FLUTTER_GIT_URL replaces the GitHub URL of Shorebird's Flutter fork when the CLI clones it.SHOREBIRD_BUNDLETOOL_URL replaces the GitHub URL of the bundletool jar. The jar's checksum is still checked.CLI 1.6.131 also fixes these issues.
shorebird patch --release-version=1.0.0+1 android works instead of failing with Invalid argument(s).shorebird release ios-framework --target builds the target you pass instead of lib/main.dart.shorebird preview waits for a paired iOS device to become reachable, such as while you unlock it, instead of exiting.shorebird init only offers organizations you can create apps in, and adds a new flavor to the existing app's organization.shorebird doctor checks the hosts the CLI actually uses.When shorebird login finishes in the browser, the tab now says You're signed in to the Shorebird CLI and lists next steps, adding Shorebird to your app, creating a release, and shipping a patch, with commands you can copy.
shorebird release no longer creates an Android, AAR, iOS, or iOS framework release with a Flutter version older than 3.24.0.
--flutter-version set to 3.24.0 or newer.shorebird release android --flutter-version=3.24.0GitHub Actions jobs started by pull_request_target can no longer sign in with a trust rule, because anyone who opens a pull request can start one, and it runs with the ref of the repository's default branch, such as refs/heads/main.
pull_request_target runs cannot exchange tokens.push, release, or workflow_dispatch instead.On the Enterprise page, you can now require SAML SSO, Google, or Microsoft for each of your email domains, so people at that domain can sign in only that way.
Four fixes tighten who can see and change an organization's apps.
Once you've signed in to Shorebird in a browser, signing in again in that browser, from the Console, the CLI, or another app, finishes without going back to Google, Microsoft, or your identity provider.
Creating an organization now asks for its name. New organizations are no longer called "My Organization".
A patch check that ran while a patch was being published could leave "no patch" cached until the next change. The next check now sees the new patch.
A new personal API key now expires within a year. The Console no longer offers Never as an expiration when you create or regenerate one.
The Console fixes three issues.
/yr, instead of /mo.DELETE /api/v1/users/me now answers 202 with remaining_app_count while apps are left to delete. Repeat the request until it answers 204.The Tracks page can delete tracks you added, and a release's patch list hides rolled-back and deactivated patches unless you ask to see them.
stable, beta, staging, and deactivated have no delete button.An access token now stops working as soon as its session is revoked.
shorebird auth status shows which credential the CLI signed in with and who it acts as, and shorebird auth token prints the access token it sends.
SHOREBIRD_TOKEN, GitHub Actions OIDC, or your shorebird login, tried in that order.shorebird account whoami adds a Credential line, and credential in --json.shorebird account now runs shorebird account whoami.shorebird auth token as a secret. It's left out of the run's log file.shorebird auth status
shorebird accountshorebird account apps no longer lists apps. It prints shorebird apps list, which shows the same list, and exits with a usage error.
shorebird account apps need to switch to shorebird apps list. Its output, including --json, is the same.shorebird apps listshorebird account update --name changes your display name, and shorebird account notifications shows or changes whether Shorebird emails you.
--email on and --email off change the setting. With --json, the output includes email set to true or false.shorebird account update --name "Jane Doe"
shorebird account notifications --email offshorebird api accepts the HTTP method before the endpoint, and --paginate reads a whole paged list in one call. --jq also takes slices, and the command now handles a repeated /api/v1 and explains a 405 after fields made a POST.
-X, it must name the same method.--paginate follows next_cursor and prints the pages as one JSON object, with list fields joined. --jq runs on the joined result.--paginate works only with GET. A failed page stops the command with exit status 1 instead of printing part of the list.--jq supports array and string slices, such as .[1:3], .[2:], and .[:-1]./api/v1 is treated as the route under it, with a note on stderr.-f or -F turns a request into a POST and the server answers 405, the CLI suggests adding --method GET.shorebird api GET /apps
shorebird api /apps -f per_page=100 --paginate --jq '.apps[].app_id'To give someone access to an app, invite them to the organization that owns it. The app's "Collaborators" tab no longer has an invite button, and the API's endpoints for adding a collaborator or sending an app invitation now return 410 Gone.
--channel is now another name for --track.
shorebird patch, shorebird preview, shorebird patches set-track, and shorebird patches promote.--track keep working.shorebird patch android --channel stagingCLI 1.6.130 also fixes these issues.
No terminal attached to stdout when stdout can't show a prompt, such as when it's redirected to /dev/null. The command runs as non-interactive and, when it needs a confirmation, asks for --yes or --confirm-name.--verbose.shorebird doctor and shorebird upgrade on a Shorebird checkout at a commit, a tag, or a branch with no upstream explain how to get back to stable.User-Agent: shorebird-cli/<version> (<os>; dart <version>) header, which audit log entries record.shorebird invitations list shows the organization and app invitations sent to you, and shorebird invitations accept and decline answer one by its id.
--json, list returns each invitation's id, kind (organization or app), organization_id, app_id, name, role, inviter_email, created_at and expires_at.shorebird invitations list
shorebird invitations accept <id>When Java or Kotlin changes trigger the native changes warning on an Android patch, the output names the classes, methods, and fields that each changed method's differing instructions reference, so you can tell which dependency changed.
shorebird patch --show-dex-diff prints every changed method and instruction in full, including string constants.shorebird patches promote appears in help again and now runs shorebird patches set-track with the track defaulting to stable.
set-track, including --track for a track other than stable, --app-id, and --json.stable channel yet, it offers to create it, as set-track does.shorebird patches promote --release-version 1.0.0+1 --patch-number 1The hidden --confirm flag is gone from shorebird release and shorebird patch. It made each command ask Would you like to continue? before publishing, and that prompt is gone.
--confirm is a usage error, with exit status 64.--no-confirm is still accepted and does nothing, so existing scripts keep working.A member keeps a role that the organization's current plan no longer offers. The role picker now warns that changing it can't be undone without upgrading.
Signing in with SAML SSO for the first time with an email at the connection's domain moves your existing account onto SSO instead of refusing it. Your organizations, app access, and billing carry over.
shorebird api sends an authenticated request to the Shorebird API and prints the response. --jq filters a successful response before it's printed.
https://api.shorebird.dev/api/v1, and {appId} is filled in from shorebird.yaml.-X or --method sets the method. It defaults to GET, or POST when you pass fields with -f or -F, or a body with --input.shorebird api /apps --jq '.apps[].app_id'iOS, iOS framework, and macOS builds no longer delete the project's whole .dart_tool directory, so build_runner caches and native asset outputs survive a Shorebird build.
.dart_tool/flutter_build and .dart_tool/version are cleared.Audit log entries now name the API key or sign-in session behind each action, and say whether the sign-in used multi-factor authentication when the sign-in provider reports it.
Shorebird staff.CLI 1.6.129 also fixes these issues.
libapp.so, as Android releases do, and warn when a patch covers only some of them.head -1, exits with status 141 instead of crashing.shorebird patches promote --help describes --flavor correctly.shorebird account orgs --help lists every role, including none for an organization where you only collaborate on apps.shorebird login. A network or server error leaves your login as it was and exits with status 75 instead of 70.SHOREBIRD_PATCH_DD_MAX_BYTES. Pass --dd-max-bytes to shorebird patch instead.--org-id that isn't a number lists your organizations and their ids.shorebird channels delete and shorebird releases delete ask you to confirm in a terminal, and --yes skips the question. Without a terminal, in CI, or with --json, --yes is required.
--confirm-name is deprecated for these two commands and prints a warning.shorebird apps delete now asks you to type the app's display name in a terminal. Scripts still pass it with --confirm-name, and there's no --yes.shorebird patches set-track, the native and asset change prompts of shorebird patch, and the new delete prompts.On GitHub Actions, the CLI can now sign in as a service account with the OIDC token GitHub issues to each job, so there's no SHOREBIRD_TOKEN secret to leak or rotate.
id-token: write and set SHOREBIRD_PROJECT_ID.SHOREBIRD_TOKEN is set, the CLI uses it instead, so remove the secret once the workflow signs in with a trust rule.service_account.sign_in, with the run it came from.With --json, every command writes exactly one JSON object to stdout, including --help and commands that have no data to return.
"data": {} in its success object.api_code and details. Without --json, the CLI prints the code as Error code: <code>.shorebird metrics shows the metrics the Console shows under Insights, such as patch installs, downloads, adoption, and active devices.
active-hours, adoption, downloads, heatmap, installs, new-devices, users, and versions.--app-id or --flavor. Depending on the metric, --start, --end, and --release-version narrow the results, and --granularity and --group-by break them down.--json, data holds the API's response.shorebird releases delete deletes a release, or one platform of it with --platform.
--platform, it removes the release's artifacts for every platform and every patch of the release.--platform, it removes that platform's release artifacts and the patch files built for it. The release and its other platforms stay.--json, pass --yes.shorebird account whoami no longer prints a Subscription: line. Plan: shows your plan level.
--json output, plan is free on the free level, paid on any other level, and null when the server doesn't report a level.Every JSON error from the API now carries a documentation_url, and the lists of apps, releases, and patches can be read a page at a time.
per_page and cursor and return next_cursor. Without them, they still return everything.cursor returns 400 with the code invalid_cursor.WWW-Authenticate header that says why.API keys limited to releases and patches are now available on every plan, including Free. They used to need a paid plan.
Some requests the Console refuses are now refused by the API too, so scripts and the CLI meet the same rules.
shorebird_plan_insufficient_tier.organization_name_blank.Viewers, Developers, and App Managers can no longer read an Enterprise organization's audit log, in the Console or through the API. Before, every member could.
Enterprise organizations can read the audit log through the API oldest first and forward each event to a SIEM, using a service account with the Auditor role.
operation, such as patch.rollback.order=asc returns the oldest events first. Pages use per_page (30 by default, at most 100), cursor, and next_cursor.limit, resourceType, and action parameters and its nextCursor field were replaced.Deleting a track now takes effect on the next patch check, and deleting a release can no longer leave its patches cached. Running a rollback or roll forward again now clears the cache if the first run couldn't.
patch_rollback_cache_error or patch_rollforward_cache_error. Running it again clears the cache.Organizations can now create service accounts: accounts that belong to the organization instead of a person, with keys that keep working when the person who set them up leaves or changes roles. They're available on every plan.
[bot], such as GitHub Actions[bot], along with the key or trust rule it used.Organizations on the Pro plan can now give members the Viewer role. It used to need the Business plan or higher.
Signing in with a different method than your account uses now names the one to use.
When a plan is canceled because a payment failed, its open invoices are now voided.
The top of the Console's sidebar names the organization you're in and opens a switcher with its plan, your role, its install usage, and your other organizations.
SAML responses signed or digested with SHA-1 are now refused.
The usage shown on your plan page and in organization settings now counts installs only from organizations the plan holder owns.
The Sessions list on your Account page now names each session after the app that holds it, such as Shorebird Console, Shorebird CLI, or Claude Code, with the browser it was approved in underneath.
shorebird-cli (api).Inviting a member or collaborator now finds their account no matter how the email address is capitalized.
Abby@example.com when the account was abby@example.com failed with User with email ... not found.ambiguous_email.Signing in with an email that matches an existing account's except for letter case no longer creates a second account. It follows the same rules as an exact match.
Email not verified.shorebird channels delete now refuses stable, beta, and staging with a usage error before contacting the server, which already refuses them.
--json, the success object no longer includes is_default_track, since a successful delete can no longer involve a built-in track.CLI 1.6.128 also fixes these issues.
--release-version read the release version from the flavor's build.SHOREBIRD_PATCH_DD_MAX_BYTES.shorebird release, shorebird patch, and shorebird preview no longer leave copies of the app in the system temp directory.shorebird doctor --fix shows every issue a fix leaves, and the count of fixable issues is accurate. --fix with --json is now a usage error.android:name isn't its first attribute, and reports a permission removed with tools:node="remove" instead of offering a fix that conflicts with it.shorebird patch aar without --release-version in a non-interactive shell fails before building instead of crashing after it.shorebird patch ios-framework without --release-version now lets you pick the release in an interactive terminal, like other platforms.shorebird preview launches an app on a device running iOS 16 or earlier, Ctrl-C works normally for the rest of the run.shorebird patches set-track and shorebird init now use the same flag names as the commands next to them. The old names still work, but no longer appear in --help.
shorebird patches set-track takes --release-version and --patch-number, like the other patches commands, in place of --release and --patch.shorebird init takes --org-id, like shorebird apps transfer, in place of --organization-id.shorebird init, shorebird channels create, and shorebird patches set-track, as shorebird apps rename already did. shorebird patch now also rejects a --track that is empty, only whitespace, or longer than 128 characters.shorebird init --org-id 42With --json, every failing command now prints an error object on stdout, and a failed check before the command runs reports precondition_failed with a message and, when there's a known fix, a hint.
precondition_failed include not being logged in and not being in a Shorebird project.shorebird patches set-track now reports changed and the patch, as rollback and rollforward already did, so a script can tell whether the run did anything.macOS patches now install on apps that were re-signed after release, such as for Developer ID notarization or the Mac App Store.
--flutter-version, keep the old behavior.shorebird patch now embeds the public key from --public-key-cmd in the patch build, as shorebird release already did.
--public-key-path reached the patch build. Signing itself still worked.--public-key-cmd command now runs once per shorebird patch or shorebird release run, instead of once per architecture or platform, so a command that prompts, such as for two-factor authentication, prompts once.shorebird preview now takes --flavor, like other commands that act on an app, so it can pick the flavor's app without asking.
shorebird releases get-apks now takes --app-id, and with it no longer needs to run in a Shorebird project. Pass --out in that case.shorebird preview --flavor internal --release-version 1.0.0+1shorebird release now clears build/<platform>/shorebird/ before building on every platform, so files left by an earlier build aren't uploaded with a new release.
build/ is touched.Running shorebird release again after a release failed partway now records the artifacts from the retry instead of keeping the first attempt's details.
shorebird patches set-track now succeeds when the patch is already on the requested track, instead of failing with a usage error.
shorebird patches rollback and rollforward, so a retried CI job doesn't fail.--json, changed is false when nothing changed.Commands that act on an existing app now fail when --flavor names a flavor that shorebird.yaml doesn't define, instead of silently using the default app.
shorebird patches rollback --flavor previously rolled back a patch on the default app.patches, releases, channels, and apps commands. The error lists the flavors that shorebird.yaml defines.--app-id still takes precedence over --flavor.Four commands that could crash now work or fail with a clear message.
shorebird login no longer crashes with Bad state: read(ScopedRef<Browser>), a bug introduced in 1.6.126.shorebird doctor --verbose shows Gradle as not detected when the Gradle version lookup fails, instead of crashing.shorebird patches set-track and shorebird patches promote report a patch number that isn't a number as a usage error instead of crashing.shorebird patch linux now builds with --target and the arguments passed after --, so the patch matches the release it targets.
--, such as --dart-define values, so it could differ from its release.shorebird release linux does.API keys now hold exactly what their permission level grants. A full access key can do everything your role allows, except delete your account, change your billing limits, or manage your sessions and API keys. Sign in to the Console to do these.
personal_access_token_forbidden. Keys were already refused both, with other error codes.Signing in from the CLI now stops at an approval page, as signing in from other apps such as Claude Code already did. The redesigned page says which app is asking, which account it signs in to, and what it gets. Choose Authorize to continue or Cancel to refuse.
An app on this computer.The app list no longer shows an app twice when you have both a role in its organization and a role granted on the app itself.
GET /api/v1/apps, shorebird account apps, shorebird apps list, and the app picker in shorebird preview.Flutter installs, engine artifacts, and downloaded previews that you no longer use are now removed automatically, so they stop piling up across upgrades and --flutter-version builds.
shorebird cache clean --unused removes unused items right away, without clearing the rest of the cache.shorebird cache clean --unusedThe Size tab for a release with no Android or iOS build now says that size analysis supports Android and iOS only, instead of saying to check back in a few minutes.
Shorebird now supports Flutter 3.47.7 and Dart 3.13.5.
OverlayPortal, which were shrunk and anchored top-left, so VoiceOver focus and XCUITest taps missed the visible controls.ReorderableListView.shorebird release ios --flutter-version=3.47.7With Xcode 26 or later, shorebird preview on an iOS device now shows the app's print output and [shorebird] updater lines, as Android and macOS previews do.
shorebird login now opens your browser, and when no browser can open, such as over SSH, in CI, or on Linux without a display, it shows a code to enter in a browser on any device.
--device to use a code even when a browser is available.shorebird login without --device crashes with Bad state: read(ScopedRef<Browser>). Upgrade to 1.6.127 or later.shorebird login --devicePatching an Android release built with --obfuscate on a Flutter version older than 3.41.2 no longer fails with Unrecognized flags: load_obfuscation_map.
gen_snapshot failure.shorebird release ios and shorebird release ios-framework now check the Flutter version they actually build with, including --flutter-version.Errors from shorebird init, shorebird patch, shorebird preview, and the checks that run before a command now name the step that fixes them.
shorebird patch --force explains that there's no --force flag and points to --allow-native-diffs and --allow-asset-diffs.--json, the --force advice is in the error's hint.shorebird release ios now warns when an app extension's version or build number differs from the app's, which App Store Connect rejects with ITMS-90473.
NotificationService.appex: CFBundleShortVersionString is "1.15.32", the app is "1.15.67".shorebird login now uses standard OAuth with PKCE and state, and shorebird logout now warns when the auth server can't confirm that your session was revoked.
shorebird login:ci, are no longer supported. The server stopped accepting them on October 1, 2026. Run shorebird login to sign in again, and use an API key in SHOREBIRD_TOKEN for CI.shorebird login signs you in again instead of reporting that you're already logged in.shorebird release and shorebird patch now support --json, so a script gets the new release or patch as data instead of parsing log lines.
shorebird release --json reports the app ID, the platforms, and each release with its version, Flutter version, and per-platform status.shorebird patch --json reports the app ID, the track, and each patch with its platform, release version, patch number, and link percentage.--dry-run, both report what would have been published, with dry_run set to true.--json, stdout holds only the JSON object. Progress and logs go to stderr.shorebird patch android --release-version=latest --jsonSign-ins no longer end at a fixed 90 days. A sign-in now lasts until it goes 30 days without use, so you stay signed in as long as you keep using Shorebird.
API responses now carry RateLimit and RateLimit-Policy headers, so scripts can see their limit and how close they are to it.
Retry-After header and the code rate_limited.Shorebird now supports Flutter 3.47.6 and Dart 3.13.5.
shorebird release windows --flutter-version=3.47.6When shorebird patch android finds DEX changes, it now lists the Android libraries whose versions differ from the release, which usually explains a native change you didn't make.
io.branch.sdk.android:library 5.21.2 -> 5.21.3, along with added and removed libraries.--allow-native-diffs is safe for that patch.--allow-native-diffs and --allow-asset-diffs hints are now printed before the command fails.Since October 1, 2026, tokens from shorebird login:ci and logins from CLI versions older than 1.6.87 are rejected.
legacy_auth_retired.SHOREBIRD_TOKEN.shorebird upgrade, then shorebird logout and shorebird login.The sidebar now lists the active organization's apps, and the organization's app list can now be filtered, sorted, and paged.
The invite dialog now has a role picker, so a new member joins with any role your plan offers instead of always as a Developer.
Change Track is now offered on a patch that a newer patch has superseded on its track, so an older staging patch can still be promoted to stable.
Each pending invitation in an organization's members list now has a button that shows its link, so you can send it yourself.
Shorebird now supports Flutter 3.47.5 and Dart 3.13.4.
shorebird release ios --flutter-version=3.47.5--flutter-version now accepts fvm and system, so you no longer have to look up and repeat your Flutter version number.
--flutter-version=fvm uses the version fvm resolves for your project from its .fvmrc. It requires fvm on your PATH.--flutter-version=system uses the version reported by the flutter on your PATH.shorebird release android --flutter-version=fvmOn iOS, --split-debug-info now writes a Mach-O dSYM, so symbol servers ingest it and Dart stack traces from production become readable.
--flutter-version still gets the old file.The organizations list is split into Owned by you and Member of, and each organization shows its plan tier.
The automatic patch check now starts after the patch the device boots has loaded, instead of before, so it reports the patch the device is actually running. With auto_update: false, your app's own updater call decides when to check.
Shorebird now supports Flutter 3.47.4 and Dart 3.13.3.
shorebird release ios --flutter-version=3.47.4shorebird release android and shorebird patch android now stop with an explanation when the built app bundle has no libapp.so, your compiled Dart code, for any architecture.
shorebird release android pointed at ABI filters.libapp.so is written.CLI 1.6.121 also fixes these issues.
flutter.jar, the error names the plugin to upgrade.shorebird init no longer separates a comment in your pubspec's flutter: section from the key it describes when it adds the assets: entry.shorebird release and shorebird patch now name the flag to fix. For example, a key file that doesn't exist names the flag it was passed to, and shorebird patch with only one of --public-key-path and --private-key-path names the one that's missing..xcarchive or a release built with Flutter older than 3.22.2, now say what to do next.--flutter-version, now resumes on the next run instead of needing shorebird cache clean.Shorebird now supports Flutter 3.47.3 and Dart 3.13.3.
shorebird release android --flutter-version=3.47.3New shorebird apps commands list, rename, delete, and transfer apps without opening the Console.
shorebird apps transfer --org-id <id> moves an app into another organization. Run shorebird account orgs to find the id.shorebird apps rename --name <name> changes the display name.shorebird apps delete has no prompt. Pass --confirm-name with the app's current display name to confirm.shorebird apps transfer --app-id <id> --org-id 42New shorebird channels commands create, list, and delete the channels (tracks) an app can publish to.
--track=<name> still creates that channel automatically.shorebird channels delete has no prompt. Pass --confirm-name with the channel name to confirm. Devices on a deleted channel stop receiving patches.stable, beta, and staging channels can't be deleted.shorebird channels create --app-id <id> --name qashorebird account whoami now shows your plan level and whether you have an active subscription.
free, pro, business, or enterprise.--json, the level is in a new plan_level field. The existing plan field still reads paid or free, so scripts that use it keep working.shorebird account whoamiThe new Plan page under Account replaces the Plan tab in each organization's settings, since a plan belongs to your account and covers every organization you own.
The Size tab is now available on every plan, including Free, and releases are analyzed whatever plan they're on. Pricing will come later.
Deleting the stable, beta, or staging channel is now refused, since it would unpublish every patch on that track.
channels_delete_default_channel.On iOS and macOS, shorebird patch no longer reports an asset change for a layered app icon (.icon) that you didn't change.
Shorebird now supports Flutter 3.47.2 and Dart 3.13.2.
--build-name and --build-number are now forwarded to version.json.shorebird release android --flutter-version=3.47.2shorebird patches rollback and shorebird patches rollforward do the same as the Rollback and Roll Forward actions in the Console.
--release-version and --patch-number.--require-change to exit with an error instead.shorebird patches rollback --release-version 1.0.0+1 --patch-number 1Nothing matches that search. Clear the field or pick a different area.