New features, fixes, and supported Flutter versions in Shorebird. Expand an entry for the full detail, the command, and the doc it belongs to. Subscribe with the RSS feed.
October 2026
CLI 1.6.132
New releases are signed by default
New releases are now signed by default with a key Shorebird manages for your organization, so someone tampering with your users' network can't push code to your app. Update the CLI and make a new release to turn it on.
shorebird release builds your organization's public key into the release, and Shorebird signs every patch to it. Patching works as before, with no key flags.
You don't need to change your Flutter version.
The private key is kept in Google Cloud KMS and never leaves it. To keep Shorebird out of your trust base, sign with your own key instead, with --public-key-path or --public-key-cmd.
--no-patch-signing releases without signing, which isn't recommended.
Releases made before this without your own key stay unsigned, and patches to them keep installing.
A CLI older than 1.6.132 can't patch a release signed this way; run shorebird upgrade.
shorebird upgradeshorebird release android
CLI 1.6.131
Download Flutter and engine tools from an internal mirror
Three new environment variables point the CLI at an internal mirror, such as Artifactory, for Flutter, its engine artifacts and bundletool.
SHOREBIRD_DOWNLOAD_URL replaces https://download.shorebird.dev for Flutter's artifacts, Shorebird's engine, and the tools used to build patches.
SHOREBIRD_FLUTTER_GIT_URL replaces the GitHub URL of Shorebird's Flutter fork when the CLI clones it.
SHOREBIRD_BUNDLETOOL_URL replaces the GitHub URL of the bundletool jar. The jar's checksum is still checked.
Trust rules refuse pull_request_target runs
GitHub Actions jobs started by pull_request_target can no longer sign in with a trust rule, because anyone who opens a pull request can start one, and it runs with the ref of the repository's default branch, such as refs/heads/main.
The sign-in is refused before any rule is checked, with the message pull_request_target runs cannot exchange tokens.
Run Shorebird from a workflow started by push, release, or workflow_dispatch instead.
Name an organization when you create it
Creating an organization now asks for its name. New organizations are no longer called "My Organization".
Inviting someone to an organization that's still called "My Organization" suggests renaming it first.
Patch checks keep up with new patches and app transfers
A patch check that ran while a patch was being published could leave "no patch" cached until the next change. The next check now sees the new patch.
An app transferred to another organization follows the new organization's patch limit right away, instead of the old one's for up to an hour.
Personal API keys expire within a year
A new personal API key now expires within a year. The Console no longer offers Never as an expiration when you create or regenerate one.
Keys you already have are unchanged. A key created without an expiration keeps working until you revoke it.
For a key that never expires, or one that doesn't depend on any one person's account, use a service account.
Console fixes for yearly plans, account deletion, and app transfers
The Console fixes three issues.
Yearly plans show their price per year, /yr, instead of /mo.
Deleting an account that has many apps no longer times out. Through the API, DELETE /api/v1/users/me now answers 202 with remaining_app_count while apps are left to delete. Repeat the request until it answers 204.
When you transfer an app, organizations where you aren't an Admin or Owner are listed but can't be chosen. Before, choosing one failed after you submitted.
Delete a track, and hide rolled-back patches
The Tracks page can delete tracks you added, and a release's patch list hides rolled-back and deactivated patches unless you ask to see them.
stable, beta, staging, and deactivated have no delete button.
A switch shows the hidden patches and how many there are.
Signing out a session takes effect right away
An access token now stops working as soon as its session is revoked.
Before, it kept working until it expired, up to 15 minutes later.
CLI 1.6.130
See which credential the CLI is using
shorebird auth status shows which credential the CLI signed in with and who it acts as, and shorebird auth token prints the access token it sends.
The credential is an API key from SHOREBIRD_TOKEN, GitHub Actions OIDC, or your shorebird login, tried in that order.
shorebird account whoami adds a Credential line, and credential in --json.
Bare shorebird account now runs shorebird account whoami.
Treat the output of shorebird auth token as a secret. It's left out of the run's log file.
shorebird auth statusshorebird account
CLI 1.6.130
Apps are listed with apps list, not account apps
shorebird account apps no longer lists apps. It prints shorebird apps list, which shows the same list, and exits with a usage error.
Scripts that call shorebird account apps need to switch to shorebird apps list. Its output, including --json, is the same.
shorebird apps list
CLI 1.6.130
Change your display name and email settings from the CLI
shorebird account update --name changes your display name, and shorebird account notifications shows or changes whether Shorebird emails you.
The emails Shorebird sends today warn that an app is near or over its plan's patch install limit.
--email on and --email off change the setting. With --json, the output includes email set to true or false.
shorebird account update --name "Jane Doe"shorebird account notifications --email off
CLI 1.6.130
The api command takes the method first and reads every page
shorebird api accepts the HTTP method before the endpoint, and --paginate reads a whole paged list in one call. --jq also takes slices, and the command now handles a repeated /api/v1 and explains a 405 after fields made a POST.
The method can be GET, POST, PUT, PATCH, DELETE, or HEAD, in any case. If you also pass -X, it must name the same method.
--paginate follows next_cursor and prints the pages as one JSON object, with list fields joined. --jq runs on the joined result.
--paginate works only with GET. A failed page stops the command with exit status 1 instead of printing part of the list.
--jq supports array and string slices, such as .[1:3], .[2:], and .[:-1].
An endpoint that repeats /api/v1 is treated as the route under it, with a note on stderr.
When -f or -F turns a request into a POST and the server answers 405, the CLI suggests adding --method GET.
shorebird api GET /appsshorebird api /apps -f per_page=100 --paginate --jq '.apps[].app_id'
New per-app collaborators can no longer be added
To give someone access to an app, invite them to the organization that owns it. The app's "Collaborators" tab no longer has an invite button, and the API's endpoints for adding a collaborator or sending an app invitation now return 410 Gone.
Existing collaborators keep their access. You can still change their role or remove them.
Invitations to an app that were already sent can still be accepted, and you can still revoke them.
CLI 1.6.130
Use --channel wherever --track works
--channel is now another name for --track.
It works on shorebird patch, shorebird preview, shorebird patches set-track, and shorebird patches promote.
The two flags mean the same thing, so existing scripts that use --track keep working.
shorebird patch android --channel staging
CLI 1.6.130
More CLI fixes in 1.6.130
CLI 1.6.130 also fixes these issues.
Prompts no longer crash with No terminal attached to stdout when stdout can't show a prompt, such as when it's redirected to /dev/null. The command runs as non-interactive and, when it needs a confirmation, asks for --yes or --confirm-name.
Declining a prompt no longer prints the generic advice to re-run with --verbose.
shorebird doctor and shorebird upgrade on a Shorebird checkout at a commit, a tag, or a branch with no upstream explain how to get back to stable.
Every request the CLI makes identifies it with a User-Agent: shorebird-cli/<version> (<os>; dart <version>) header, which audit log entries record.
CLI 1.6.130
See and answer invitations from the CLI
shorebird invitations list shows the organization and app invitations sent to you, and shorebird invitations accept and decline answer one by its id.
Before this, an invitation could only be answered from the link in its email.
With --json, list returns each invitation's id, kind (organization or app), organization_id, app_id, name, role, inviter_email, created_at and expires_at.
Sign in as the invited email address. Use your own login or a full access API key. Service account keys and release and patch only keys can't.
Android patch warnings show what changed code references
When Java or Kotlin changes trigger the native changes warning on an Android patch, the output names the classes, methods, and fields that each changed method's differing instructions reference, so you can tell which dependency changed.
By default it details up to 10 methods per DEX file and 4 instructions on each side. String literals are replaced by their length, and switch tables and array data are cut short.
shorebird patch --show-dex-diff prints every changed method and instruction in full, including string constants.
What the check accepts hasn't changed.
CLI 1.6.130
The patches promote command is back as a set-track shortcut
shorebird patches promote appears in help again and now runs shorebird patches set-track with the track defaulting to stable.
It takes the same options as set-track, including --track for a track other than stable, --app-id, and --json.
A patch that's already on the track now succeeds instead of failing.
If the app has no stable channel yet, it offers to create it, as set-track does.
The release and patch commands no longer take --confirm
The hidden --confirm flag is gone from shorebird release and shorebird patch. It made each command ask Would you like to continue? before publishing, and that prompt is gone.
Passing --confirm is a usage error, with exit status 64.
--no-confirm is still accepted and does nothing, so existing scripts keep working.
Roles your plan no longer offers are marked
A member keeps a role that the organization's current plan no longer offers. The role picker now warns that changing it can't be undone without upgrading.
Developer is always offered.
First SSO sign-in keeps your existing account
Signing in with SAML SSO for the first time with an email at the connection's domain moves your existing account onto SSO instead of refusing it. Your organizations, app access, and billing carry over.
The account's Google or Microsoft sign-in is replaced, and its existing sessions are signed out.
CLI 1.6.129
Call the Shorebird API from the CLI
shorebird api sends an authenticated request to the Shorebird API and prints the response. --jq filters a successful response before it's printed.
Endpoints are relative to https://api.shorebird.dev/api/v1, and {appId} is filled in from shorebird.yaml.
-X or --method sets the method. It defaults to GET, or POST when you pass fields with -f or -F, or a body with --input.
A response outside the 2xx range still prints its body. The error goes to stderr and the command exits with status 1.
Requests that change data are never retried.
shorebird api /apps --jq '.apps[].app_id'
CLI 1.6.129
Apple builds keep your .dart_tool caches
iOS, iOS framework, and macOS builds no longer delete the project's whole .dart_tool directory, so build_runner caches and native asset outputs survive a Shorebird build.
Only .dart_tool/flutter_build and .dart_tool/version are cleared.
Audit log entries say which key or session acted
Audit log entries now name the API key or sign-in session behind each action, and say whether the sign-in used multi-factor authentication when the sign-in provider reports it.
Creating an app and editing a patch's notes are now recorded.
Changes Shorebird staff make to your organization appear in its audit log as Shorebird staff.
Reading the log oldest first leaves out the most recent minute, so a later read doesn't skip an event that was still being written.
CLI 1.6.129
More CLI fixes in 1.6.129
CLI 1.6.129 also fixes these issues.
iOS, iOS framework, and macOS patches no longer leave copies of the app's binaries in the system temp directory.
AAR releases and patches skip architectures that have no libapp.so, as Android releases do, and warn when a patch covers only some of them.
iOS framework, Linux, and Windows patches check the release's minimum Flutter version before downloading the release's artifacts. On every platform that has a minimum, the message names the command that creates a new release.
Commands run at the same time from one login no longer refresh with a stale token. A refresh uses the newest credentials on disk.
Piping output into a command that exits early, such as head -1, exits with status 141 instead of crashing.
Error and progress messages no longer name temporary paths that are deleted before the command finishes.
The release picker shows one hint, and shorebird patches promote --help describes --flavor correctly.
shorebird account orgs --help lists every role, including none for an organization where you only collaborate on apps.
When a login can't be refreshed, the CLI says why. An OAuth error from the auth service asks you to run shorebird login. A network or server error leaves your login as it was and exits with status 75 instead of 70.
iOS and iOS framework patches no longer read SHOREBIRD_PATCH_DD_MAX_BYTES. Pass --dd-max-bytes to shorebird patch instead.
The error for an --org-id that isn't a number lists your organizations and their ids.
CLI 1.6.129
Confirm deletes with --yes
shorebird channels delete and shorebird releases delete ask you to confirm in a terminal, and --yes skips the question. Without a terminal, in CI, or with --json, --yes is required.
--confirm-name is deprecated for these two commands and prints a warning.
Before deleting, each command says what the delete removes, such as a release's patches.
shorebird apps delete now asks you to type the app's display name in a terminal. Scripts still pass it with --confirm-name, and there's no --yes.
Declining a prompt now exits with status 1 instead of 0. This covers shorebird patches set-track, the native and asset change prompts of shorebird patch, and the new delete prompts.
CLI 1.6.129
Sign in from GitHub Actions without a stored key
On GitHub Actions, the CLI can now sign in as a service account with the OIDC token GitHub issues to each job, so there's no SHOREBIRD_TOKEN secret to leak or rotate.
Add a trust rule to a service account naming the repository, the workflow file, and optionally a GitHub environment and a ref pattern. Only jobs that match sign in.
In the workflow, grant the job id-token: write and set SHOREBIRD_PROJECT_ID.
Adding a trust rule needs a Business or Enterprise plan. Existing rules keep working after a downgrade.
When SHOREBIRD_TOKEN is set, the CLI uses it instead, so remove the secret once the workflow signs in with a trust rule.
On the Enterprise plan, each sign-in is recorded in the audit log as service_account.sign_in, with the run it came from.
CLI 1.6.129
Every --json command prints one JSON object
With --json, every command writes exactly one JSON object to stdout, including --help and commands that have no data to return.
A command with no data prints "data": {} in its success object.
When an API call fails, the error includes the server's api_code and details. Without --json, the CLI prints the code as Error code: <code>.
CLI 1.6.129
See app metrics from the CLI
shorebird metrics shows the metrics the Console shows under Insights, such as patch installs, downloads, adoption, and active devices.
The subcommands are active-hours, adoption, downloads, heatmap, installs, new-devices, users, and versions.
Pick the app with --app-id or --flavor. Depending on the metric, --start, --end, and --release-version narrow the results, and --granularity and --group-by break them down.
With --json, data holds the API's response.
CLI 1.6.129
Delete a release from the CLI
shorebird releases delete deletes a release, or one platform of it with --platform.
Without --platform, it removes the release's artifacts for every platform and every patch of the release.
With --platform, it removes that platform's release artifacts and the patch files built for it. The release and its other platforms stay.
In a terminal it asks you to confirm. Without one, in CI, or with --json, pass --yes.
CLI 1.6.129
The whoami command no longer prints a subscription line
shorebird account whoami no longer prints a Subscription: line. Plan: shows your plan level.
In --json output, plan is free on the free level, paid on any other level, and null when the server doesn't report a level.
API errors link to the docs, and lists can be paged
Every JSON error from the API now carries a documentation_url, and the lists of apps, releases, and patches can be read a page at a time.
Those lists accept per_page and cursor and return next_cursor. Without them, they still return everything.
Lists of invitations and audit log events are always paged. An invalid cursor returns 400 with the code invalid_cursor.
A 401 response to a bearer token, or a 403 because the token's scope doesn't allow the request, includes a WWW-Authenticate header that says why.
Release and patch only API keys on every plan
API keys limited to releases and patches are now available on every plan, including Free. They used to need a paid plan.
The console no longer disables the "Release and patch only" option on the Free plan. A service account's keys take no scope. They do what its role allows.
The API refuses what the Console refuses
Some requests the Console refuses are now refused by the API too, so scripts and the CLI meet the same rules.
Setting a spending limit other than 0 on the Free plan returns 403 with the code shorebird_plan_insufficient_tier.
Inviting someone with, or changing a member to, a role the organization's plan doesn't offer returns the same error. Developer is always allowed.
Creating or renaming an organization with a blank name returns 400 with the code organization_name_blank.
Only Owners, Admins, and Auditors can read the audit log
Viewers, Developers, and App Managers can no longer read an Enterprise organization's audit log, in the Console or through the API. Before, every member could.
Owners and Admins keep access, as does a service account with the Auditor role.
Export the audit log to a SIEM
Enterprise organizations can read the audit log through the API oldest first and forward each event to a SIEM, using a service account with the Auditor role.
Events are OCSF 1.9.0 API Activity events. Filter by event name with operation, such as patch.rollback.
order=asc returns the oldest events first. Pages use per_page (30 by default, at most 100), cursor, and next_cursor.
The endpoint's earlier, undocumented limit, resourceType, and action parameters and its nextCursor field were replaced.
The Console's audit log shows and filters by event name.
Patch checks catch up with deletes and rollbacks
Deleting a track now takes effect on the next patch check, and deleting a release can no longer leave its patches cached. Running a rollback or roll forward again now clears the cache if the first run couldn't.
Devices on a deleted track could keep receiving its last patch. That cached answer is now cleared.
If clearing the cache fails during a rollback or roll forward, the request returns patch_rollback_cache_error or patch_rollforward_cache_error. Running it again clears the cache.
After you delete one platform of a release, devices on that platform are no longer offered its patches. Before, they were, and the download failed because the patch files had been deleted with the platform.
Service accounts for CI and integrations
Organizations can now create service accounts: accounts that belong to the organization instead of a person, with keys that keep working when the person who set them up leaves or changes roles. They're available on every plan.
Each service account holds one role: Viewer, Developer, App Manager, or Auditor. Its keys do what that role allows. A service account can't be an Admin or Owner.
Keys expire after 1 year by default, or choose 30 days, 90 days, or never.
The audit log shows a service account's actions as its name followed by [bot], such as GitHub Actions[bot], along with the key or trust rule it used.
The new Auditor role reads the audit log and nothing else, for exporting it to a SIEM without an Admin's key. The audit log needs the Enterprise plan.
The Owner and Admins manage service accounts, which don't appear on the Members page.
Viewer role on the Pro plan
Organizations on the Pro plan can now give members the Viewer role. It used to need the Business plan or higher.
Viewers can see apps, releases, and patches but can't change them.
Sign-in names the method your account uses
Signing in with a different method than your account uses now names the one to use.
For example, an account that signs in with Google sees "This email address signs in with Google".
Canceled plans void their open invoices
When a plan is canceled because a payment failed, its open invoices are now voided.
The payment link in the billing email can no longer take a payment for a plan that has ended.
Switch organizations from the sidebar
The top of the Console's sidebar names the organization you're in and opens a switcher with its plan, your role, its install usage, and your other organizations.
Your account links and Log out moved to a menu in the header.
On 2026-10-15, the theme toggle left the header. Choose a theme under Appearance on your account page.
SAML sign-in refuses SHA-1
SAML responses signed or digested with SHA-1 are now refused.
Sign-in fails with "SSO login failed". Configure your identity provider to sign with RSA-SHA256 and digest with SHA-256.
Usage counts only organizations you own
The usage shown on your plan page and in organization settings now counts installs only from organizations the plan holder owns.
This matches what the patch limit counts. Before, an organization you were only a member of could add to it.
Sessions are named after the app that holds them
The Sessions list on your Account page now names each session after the app that holds it, such as Shorebird Console, Shorebird CLI, or Claude Code, with the browser it was approved in underneath.
Previously, sessions were named after the browser, or after an internal ID like shorebird-cli (api).
Existing sessions get the new names too, except Console sign-ins from before October 5, 2026, and sessions from CLIs older than 1.6.125, which keep the name they had.
Invitations match emails in any letter case
Inviting a member or collaborator now finds their account no matter how the email address is capitalized.
Previously, an invitation could go to someone who was already a member or collaborator, and adding a collaborator through the API as Abby@example.com when the account was abby@example.com failed with User with email ... not found.
If the address matches more than one account, the request is refused with a message asking you to contact support to merge them. The API returns 409 with a code ending in ambiguous_email.
Sign-in no longer creates a second account for a differently cased email
Signing in with an email that matches an existing account's except for letter case no longer creates a second account. It follows the same rules as an exact match.
If that account uses a different sign-in provider, sign-in asks you to use the one you originally used.
Creating an account, or linking a sign-in to an existing account by email, now needs an email your provider has verified. Otherwise sign-in shows Email not verified.
If the email differs only in letter case from more than one existing account, sign-in is refused and asks you to contact support.
Signing in with the same provider account as before is unchanged.
CLI 1.6.128
The CLI refuses to delete built-in tracks
shorebird channels delete now refuses stable, beta, and staging with a usage error before contacting the server, which already refuses them.
With --json, the success object no longer includes is_default_track, since a successful delete can no longer involve a built-in track.
CLI 1.6.128
More CLI fixes in 1.6.128
CLI 1.6.128 also fixes these issues.
Flavored macOS patches run without --release-version read the release version from the flavor's build.
Releases on iOS, iOS framework, macOS, and Linux continue when an artifact already exists, as Android and Windows did.
shorebird release, shorebird patch, and shorebird preview no longer leave copies of the app in the system temp directory.
A rate limit or other refusal from the auth service no longer counts as being logged out. Only expired or revoked credentials do.
A malformed credentials file no longer crashes every command, and on macOS and Linux the file is now readable only by you.
shorebird doctor --fix shows every issue a fix leaves, and the count of fixable issues is accurate. --fix with --json is now a usage error.
The Android INTERNET permission check finds the permission when android:name isn't its first attribute, and reports a permission removed with tools:node="remove" instead of offering a fix that conflicts with it.
shorebird patch aar without --release-version in a non-interactive shell fails before building instead of crashing after it.
shorebird patch ios-framework without --release-version now lets you pick the release in an interactive terminal, like other platforms.
After shorebird preview launches an app on a device running iOS 16 or earlier, Ctrl-C works normally for the rest of the run.
CLI 1.6.128
Consistent flag names for set-track and init
shorebird patches set-track and shorebird init now use the same flag names as the commands next to them. The old names still work, but no longer appear in --help.
shorebird patches set-track takes --release-version and --patch-number, like the other patches commands, in place of --release and --patch.
shorebird init takes --org-id, like shorebird apps transfer, in place of --organization-id.
Names that are only whitespace are now rejected by shorebird init, shorebird channels create, and shorebird patches set-track, as shorebird apps rename already did. shorebird patch now also rejects a --track that is empty, only whitespace, or longer than 128 characters.
shorebird init --org-id 42
CLI 1.6.128
JSON errors explain failed checks
With --json, every failing command now prints an error object on stdout, and a failed check before the command runs reports precondition_failed with a message and, when there's a known fix, a hint.
Checks that report precondition_failed include not being logged in and not being in a Shorebird project.
Previously some of these failures left stdout empty, and the reason was only on stderr.
shorebird patches set-track now reports changed and the patch, as rollback and rollforward already did, so a script can tell whether the run did anything.
CLI 1.6.128
macOS patches install on re-signed apps
macOS patches now install on apps that were re-signed after release, such as for Developer ID notarization or the Mac App Store.
Previously, re-signing changed the binary that patches were built against, so every patch failed the device's check that the app matches its release.
Patches are now built against only the app's Dart code, which re-signing doesn't change.
The fix ships in the engine with CLI 1.6.128. Create a new macOS release with CLI 1.6.128 or later to pick it up. Releases built earlier, or with an older --flutter-version, keep the old behavior.
CLI 1.6.128
Signed patches honor --public-key-cmd
shorebird patch now embeds the public key from --public-key-cmd in the patch build, as shorebird release already did.
Previously only --public-key-path reached the patch build. Signing itself still worked.
The --public-key-cmd command now runs once per shorebird patch or shorebird release run, instead of once per architecture or platform, so a command that prompts, such as for two-factor authentication, prompts once.
CLI 1.6.128
The patches promote command is hidden from help
shorebird patches promote no longer appears in shorebird patches --help. Use shorebird patches set-track instead.
promote has been deprecated since December 2025. It still runs, so existing scripts keep working until it's removed.
Releases no longer upload files from an earlier build
shorebird release now clears build/<platform>/shorebird/ before building on every platform, so files left by an earlier build aren't uploaded with a new release.
Previously only iOS and iOS framework releases cleared it.
Nothing else in build/ is touched.
Retrying a release records the new upload
Running shorebird release again after a release failed partway now records the artifacts from the retry instead of keeping the first attempt's details.
Previously, the hash, size, and location from the failed attempt stayed on the release, so the Console could show the wrong size, and patches could be built against the wrong file if its name changed between attempts.
This works with every CLI version, since the fix is on the server.
Releases retried before this fix keep the first attempt's details.
CLI 1.6.128
Setting a patch's track again succeeds
shorebird patches set-track now succeeds when the patch is already on the requested track, instead of failing with a usage error.
It says the patch is already on that track and doesn't promote it again.
This matches shorebird patches rollback and rollforward, so a retried CI job doesn't fail.
With --json, changed is false when nothing changed.
CLI 1.6.128
An unknown flavor is an error
Commands that act on an existing app now fail when --flavor names a flavor that shorebird.yaml doesn't define, instead of silently using the default app.
For example, a mistyped shorebird patches rollback --flavor previously rolled back a patch on the default app.
This covers the patches, releases, channels, and apps commands. The error lists the flavors that shorebird.yaml defines.
--app-id still takes precedence over --flavor.
CLI 1.6.127
Crash fixes for login, doctor, and set-track
Four commands that could crash now work or fail with a clear message.
shorebird login no longer crashes with Bad state: read(ScopedRef<Browser>), a bug introduced in 1.6.126.
shorebird doctor --verbose shows Gradle as not detected when the Gradle version lookup fails, instead of crashing.
shorebird patches set-track and shorebird patches promote report a patch number that isn't a number as a usage error instead of crashing.
CLI 1.6.127
Linux patches build like Linux releases
shorebird patch linux now builds with --target and the arguments passed after --, so the patch matches the release it targets.
Previously the patch was built from the default entrypoint and without the arguments after --, such as --dart-define values, so it could differ from its release.
Before building, it now checks that you're logged in, that the project is initialized, and that the host is Linux, as shorebird release linux does.
API keys hold exactly their permission level
API keys now hold exactly what their permission level grants. A full access key can do everything your role allows, except delete your account, change your billing limits, or manage your sessions and API keys. Sign in to the Console to do these.
Deleting the account or changing billing limits with a key returns 403 with the code personal_access_token_forbidden. Keys were already refused both, with other error codes.
Full access keys gained what their old fixed permission list left out, such as reading audit logs and managing invitations.
Release and patch only keys can no longer update your account details, create organizations, or accept or decline invitations.
Approve each app that signs in as you
Signing in from the CLI now stops at an approval page, as signing in from other apps such as Claude Code already did. The redesigned page says which app is asking, which account it signs in to, and what it gets. Choose Authorize to continue or Cancel to refuse.
Only the Console skips this page. Previously, signing in to the CLI through the browser didn't ask.
CLIs older than 1.6.125 appear on the page as An app on this computer.
The page shows where you'll be sent next and links to your Account page, where you can remove the app's access later.
To approve a CLI sign-in with a code, type the code shown on your device. A link with the code already filled in isn't accepted.
Use a different account from the same page if you're signed in to the wrong one.
Apps are listed once
The app list no longer shows an app twice when you have both a role in its organization and a role granted on the app itself.
This affected GET /api/v1/apps, shorebird account apps, shorebird apps list, and the app picker in shorebird preview.
The Console's app list wasn't affected.
CLI 1.6.126
The Shorebird cache cleans up after itself
Flutter installs, engine artifacts, and downloaded previews that you no longer use are now removed automatically, so they stop piling up across upgrades and --flutter-version builds.
Flutter installs and engine artifacts are removed after 30 days without use.
Only the 10 most recently used previews are kept, and each is removed after 30 days without use.
The Flutter version your CLI is pinned to is never removed.
shorebird cache clean --unused removes unused items right away, without clearing the rest of the cache.
shorebird cache clean --unused
Size analysis says when a release can't be analyzed
The Size tab for a release with no Android or iOS build now says that size analysis supports Android and iOS only, instead of saying to check back in a few minutes.
This affects releases built only for macOS, Windows, or Linux, which are never analyzed.
Releases with an Android or iOS build are unchanged.
CLI 1.6.126
Flutter 3.47.7 support
Shorebird now supports Flutter 3.47.7 and Dart 3.13.5.
iOS: fixes accessibility frames for OverlayPortal, which were shrunk and anchored top-left, so VoiceOver focus and XCUITest taps missed the visible controls.
iOS: fixes VoiceOver focus jumping to the top left of the screen in a ReorderableListView.
shorebird release ios --flutter-version=3.47.7
CLI 1.6.126
iOS previews show your app's logs again
With Xcode 26 or later, shorebird preview on an iOS device now shows the app's print output and [shorebird] updater lines, as Android and macOS previews do.
Previously the app launched but none of its output appeared.
The command stays attached until the app exits.
CLI 1.6.126
Sign in from any machine
shorebird login now opens your browser, and when no browser can open, such as over SSH, in CI, or on Linux without a display, it shows a code to enter in a browser on any device.
The login URL is still printed, in case the browser doesn't open.
Pass --device to use a code even when a browser is available.
On 1.6.126, shorebird login without --device crashes with Bad state: read(ScopedRef<Browser>). Upgrade to 1.6.127 or later.
shorebird login --device
CLI 1.6.125
Patch obfuscated Android releases built with older Flutter
Patching an Android release built with --obfuscate on a Flutter version older than 3.41.2 no longer fails with Unrecognized flags: load_obfuscation_map.
Upgrade the CLI and patch as usual. Existing obfuscated releases become patchable without a new release.
iOS patches still need the release to use Flutter 3.41.2 or later for obfuscation, and now fail up front with a clear error instead of a gen_snapshot failure.
For an obfuscated iOS release, shorebird release ios and shorebird release ios-framework now check the Flutter version they actually build with, including --flutter-version.
CLI 1.6.125
Errors say what to do next
Errors from shorebird init, shorebird patch, shorebird preview, and the checks that run before a command now name the step that fixes them.
shorebird patch --force explains that there's no --force flag and points to --allow-native-diffs and --allow-asset-diffs.
With --json, the --force advice is in the error's hint.
CLI 1.6.125
Warning for app extension versions that don't match the app
shorebird release ios now warns when an app extension's version or build number differs from the app's, which App Store Connect rejects with ITMS-90473.
The warning names each extension and the mismatched value, like NotificationService.appex: CFBundleShortVersionString is "1.15.32", the app is "1.15.67".
Shorebird doesn't change the versions for you. Update the extension targets in Xcode so they match the app.
CLI 1.6.125
More secure CLI sign-in
shorebird login now uses standard OAuth with PKCE and state, and shorebird logout now warns when the auth server can't confirm that your session was revoked.
Google and Microsoft sign-in, and tokens from shorebird login:ci, are no longer supported. The server stopped accepting them on October 1, 2026. Run shorebird login to sign in again, and use an API key in SHOREBIRD_TOKEN for CI.
If your stored credentials have expired, shorebird login signs you in again instead of reporting that you're already logged in.
CLI 1.6.125
Script releases and patches with JSON output
shorebird release and shorebird patch now support --json, so a script gets the new release or patch as data instead of parsing log lines.
shorebird release --json reports the app ID, the platforms, and each release with its version, Flutter version, and per-platform status.
shorebird patch --json reports the app ID, the track, and each patch with its platform, release version, patch number, and link percentage.
With --dry-run, both report what would have been published, with dry_run set to true.
With --json, stdout holds only the JSON object. Progress and logs go to stderr.
Sign-ins no longer end at a fixed 90 days. A sign-in now lasts until it goes 30 days without use, so you stay signed in as long as you keep using Shorebird.
Previously, a sign-in also ended 90 days after it began, even in daily use.
You can still revoke any session from your Account page.
The API now reports rate limits
API responses now carry RateLimit and RateLimit-Policy headers, so scripts can see their limit and how close they are to it.
Going over the limit returns 429 with a Retry-After header and the code rate_limited.
Limits are counted per caller: per API key or token, or per IP address for unauthenticated requests.
Patch checks from your app aren't rate limited.
CLI 1.6.124
Flutter 3.47.6 support
Shorebird now supports Flutter 3.47.6 and Dart 3.13.5.
Windows: fixes a hang in production apps. The fix ships in the engine, so a Windows app picks it up only from a new release built with Flutter 3.47.6 or later.
shorebird release windows --flutter-version=3.47.6
CLI 1.6.124
Android patches name the dependency changes behind DEX diffs
When shorebird patch android finds DEX changes, it now lists the Android libraries whose versions differ from the release, which usually explains a native change you didn't make.
Each changed library is shown with its release and patch versions, like io.branch.sdk.android:library 5.21.2 -> 5.21.3, along with added and removed libraries.
The list comes from dependency metadata in both app bundles. If either bundle was built without it, nothing is listed.
Pin dependency versions, or use Gradle dependency locking, so patch builds resolve the same versions as the release. If the listed changes explain every difference and your Dart code doesn't rely on them, --allow-native-diffs is safe for that patch.
In CI and other non-interactive runs, the --allow-native-diffs and --allow-asset-diffs hints are now printed before the command fails.
Legacy login tokens no longer work
Since October 1, 2026, tokens from shorebird login:ci and logins from CLI versions older than 1.6.87 are rejected.
Requests with a legacy token get a 401 with the code legacy_auth_retired.
In CI, create an API key in the Console and set it as SHOREBIRD_TOKEN.
On your own machine, run shorebird upgrade, then shorebird logout and shorebird login.
September 2026
Find apps faster in the Console
The sidebar now lists the active organization's apps, and the organization's app list can now be filtered, sorted, and paged.
The sidebar shows up to 10 apps with their icons, with the open app and the ones you visited recently first.
On the app list, filter by platform and sort by last updated, created date, or name. Long lists are split into pages.
Pick a role when inviting a member
The invite dialog now has a role picker, so a new member joins with any role your plan offers instead of always as a Developer.
The dialog lists what the selected role can do.
Owner can't be picked. Ownership changes only through an ownership transfer.
Move an older patch to another track
Change Track is now offered on a patch that a newer patch has superseded on its track, so an older staging patch can still be promoted to stable.
Previously the action was hidden on any patch with a newer patch on its track that wasn't rolled back.
The dialog now explains what moving the patch will do.
Copy a pending invitation's link
Each pending invitation in an organization's members list now has a button that shows its link, so you can send it yourself.
Only the invited email address can accept the link, after signing in with it.
CLI 1.6.123
Flutter 3.47.5 support
Shorebird now supports Flutter 3.47.5 and Dart 3.13.4.
iOS: fixes an occasional crash when debugging on physical iOS 27 devices.
Widget Previewer: fixes a crash when re-expanding a preview group.
A Dart Development Service startup failure is now handled instead of crashing.
shorebird release ios --flutter-version=3.47.5
CLI 1.6.123
Release with the Flutter version you already use
--flutter-version now accepts fvm and system, so you no longer have to look up and repeat your Flutter version number.
--flutter-version=fvm uses the version fvm resolves for your project from its .fvmrc. It requires fvm on your PATH.
--flutter-version=system uses the version reported by the flutter on your PATH.
Shorebird still builds with its own fork of Flutter at that version, not with your fvm or system install. A version Shorebird doesn't support fails the same way as one you name explicitly.
shorebird release android --flutter-version=fvm
CLI 1.6.123
iOS debug symbols now upload to symbol servers
On iOS, --split-debug-info now writes a Mach-O dSYM, so symbol servers ingest it and Dart stack traces from production become readable.
Previously the file was an ELF with no debug ID. Uploads reported finding nothing, while still exiting cleanly.
The fix is in Shorebird's Flutter 3.47.5, the default in CLI 1.6.123. A release built with an older --flutter-version still gets the old file.
See whose plan each organization runs on
The organizations list is split into Owned by you and Member of, and each organization shows its plan tier.
Organization settings say whose plan the organization runs on, with a Manage link for the owner.
CLI 1.6.122
Patch checks report the patch the device is running
The automatic patch check now starts after the patch the device boots has loaded, instead of before, so it reports the patch the device is actually running. With auto_update: false, your app's own updater call decides when to check.
Each device is now attributed to the patch it is running. Update delivery is unchanged.
Installing a new patch can no longer retire a patch that is still booting for the first time.
When a patch fails to load, the device still checks for a replacement patch on that same launch.
These fixes are in the updater built into Shorebird's Flutter engine, so they apply to releases built with Shorebird's Flutter 3.47.4 or later, the default in CLI 1.6.122.
CLI 1.6.122
Flutter 3.47.4 support
Shorebird now supports Flutter 3.47.4 and Dart 3.13.3.
iOS: native assets now require iOS 15, raised from iOS 13.
iOS: when debugging with Xcode 27, a newly paired or upgraded device no longer hangs on a white screen for minutes. Flutter now prepares missing Device Support Symbols first, or warns with the steps to do it yourself.
Windows: when Smart App Control or another security policy blocks Flutter's binaries, the tool now exits with an actionable error instead of crashing.
shorebird release ios --flutter-version=3.47.4
CLI 1.6.121
Clear error when an Android build drops libapp.so
shorebird release android and shorebird patch android now stop with an explanation when the built app bundle has no libapp.so, your compiled Dart code, for any architecture.
Previously this failed with a generic error about missing artifacts, which for shorebird release android pointed at ABI filters.
The usual cause is a custom Gradle setup that relocates build directories, so the bundle is packaged before libapp.so is written.
A patch that covers only some of the release's architectures now warns and lists the skipped ones, since devices on those architectures won't get it.
CLI 1.6.121
More CLI fixes in 1.6.121
CLI 1.6.121 also fixes these issues.
After an Xcode upgrade, iOS and macOS patches no longer report every asset catalog as changed when no asset changed.
When an Android build fails and a plugin still references the legacy flutter.jar, the error names the plugin to upgrade.
shorebird init no longer separates a comment in your pubspec's flutter: section from the key it describes when it adds the assets: entry.
Mistakes in the signing flags of shorebird release and shorebird patch now name the flag to fix. For example, a key file that doesn't exist names the flag it was passed to, and shorebird patch with only one of --public-key-path and --private-key-path names the one that's missing.
iOS patch errors, like a missing .xcarchive or a release built with Flutter older than 3.22.2, now say what to do next.
An interrupted Flutter install, such as for --flutter-version, now resumes on the next run instead of needing shorebird cache clean.
CLI 1.6.121
Flutter 3.47.3 support
Shorebird now supports Flutter 3.47.3 and Dart 3.13.3.
Android: fixes license detection for cmdline-tools 23.0 and newer.
iOS and macOS: a missing Xcode is now handled instead of failing hard.
Dart: fixes Windows-to-Linux cross-compilation producing incorrect executables when build hooks link native code.
Android: B-series PowerVR GPUs no longer use Vulkan.
New shorebird apps commands list, rename, delete, and transfer apps without opening the Console.
shorebird apps transfer --org-id <id> moves an app into another organization. Run shorebird account orgs to find the id.
shorebird apps rename --name <name> changes the display name.
shorebird apps delete has no prompt. Pass --confirm-name with the app's current display name to confirm.
shorebird apps transfer --app-id <id> --org-id 42
CLI 1.6.121
Manage channels from the CLI
New shorebird channels commands create, list, and delete the channels (tracks) an app can publish to.
Publishing a patch with --track=<name> still creates that channel automatically.
shorebird channels delete has no prompt. Pass --confirm-name with the channel name to confirm. Devices on a deleted channel stop receiving patches.
The built-in stable, beta, and staging channels can't be deleted.
shorebird channels create --app-id <id> --name qa
CLI 1.6.121
See your plan from the CLI
shorebird account whoami now shows your plan level and whether you have an active subscription.
The plan level is free, pro, business, or enterprise.
With --json, the level is in a new plan_level field. The existing plan field still reads paid or free, so scripts that use it keep working.
shorebird account whoami
Manage your plan and billing in one place
The new Plan page under Account replaces the Plan tab in each organization's settings, since a plan belongs to your account and covers every organization you own.
Change plan shows the prorated amount before you confirm. Upgrades take effect immediately, and downgrades are scheduled for the end of the billing period.
Cancel plan keeps your plan until the period ends, and Resume plan undoes a scheduled cancellation.
Set a monthly spending limit on overage installs, see past overage charges, and open or pay invoices from the same page.
A past-due payment shows a banner that links to the Plan page.
Size analysis is free on every plan during rollout
The Size tab is now available on every plan, including Free, and releases are analyzed whatever plan they're on. Pricing will come later.
The upgrade prompt on the Size tab is replaced by a banner you can dismiss.
The Size tab has a link for sending feedback.
The built-in channels can't be deleted
Deleting the stable, beta, or staging channel is now refused, since it would unpublish every patch on that track.
The API returns 403 with the code channels_delete_default_channel.
Channels you create yourself can still be deleted.
August 2026
CLI 1.6.120
Layered app icons no longer count as asset changes
On iOS and macOS, shorebird patch no longer reports an asset change for a layered app icon (.icon) that you didn't change.
Xcode gives a layered icon's images new generated names on every build, so every patch looked like it changed the app's asset catalog.
CLI 1.6.120
Flutter 3.47.2 support
Shorebird now supports Flutter 3.47.2 and Dart 3.13.2.
iOS and macOS: Swift package dependencies are always updated.
Windows: fixes hot reload ignoring file edits made within the same second.
Desktop: --build-name and --build-number are now forwarded to version.json.
