chore(release): v0.9.91

yasserstudio · yasserstudio · commit b3b683240470 · 2026-07-18T13:33:37.000+01:00
Cut v0.9.91: July 15, 2026 Play policy tracking, dependency health, and a docs/SEO refresh.

- bump @gpc-cli/cli 0.9.90 -&gt; 0.9.91, @gpc-cli/core 0.9.75 -&gt; 0.9.76 (changed packages only; api/auth/config/plugins unchanged)
- stamp version and test count (2,498) across README, docs, config JSON-LD, CLAUDE.md, and the LLM-facing files; historical entries left as-is
- add v0.9.91 changelog entries (root, docs, cli package)

Feature work landed in the prior commits this cycle: July 15 policy preflight + verify checklist, safe dependency minors, e2e assertion fix, and the docs/SEO pass.
diff --git a/.changeset/july-2026-policy-update.md b/.changeset/july-2026-policy-update.md
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -7,6 +7,16 @@ Versioning: `0.9.x` pre-release series → `1.0.0` public launch.
 
 ---
 
+## v0.9.91
+
+Google Play July 15, 2026 policy update, dependency health, and a docs refresh.
+
+- feat: `gpc preflight` and `gpc verify checklist` track Google's July 15, 2026 policy update. The `READ_CALL_LOG` finding notes that account verification via phone call is no longer an accepted use case and points to the Digital Credentials API (or SMS Retriever API). A new advisory and checklist step cover the mandate that every app on your account be registered in Play Console, since unregistered apps risk removal.
+- chore: safe dependency updates (google-auth-library, protobufjs, yauzl, and dev tooling).
+- docs: outcome-led homepage, answer-first intros on the Games and Android CLI pages, and benefit-led page metadata.
+
+---
+
 ## v0.9.90
 
 Release readiness, review insight, and Play Games sync.
diff --git a/CLAUDE.md b/CLAUDE.md
@@ -44,7 +44,8 @@ e2e/               → End-to-end tests
 - Phase 9 ✓ — Security audit, interactive mode, VitePress docs, standalone binary, Homebrew tap, npm publish, README/CHANGELOG
 - Phase 10 ✓ — `gpc preflight` pre-submission compliance scanner (9 scanners, offline AAB policy checks)
 - Published to npm: `npm install -g @gpc-cli/cli`
-- Current version: v0.9.90 — pre-release series (`0.9.x` → `1.0.0` public launch)
+- Current version: v0.9.91 — pre-release series (`0.9.x` → `1.0.0` public launch)
+- v0.9.91: Google Play July 15, 2026 policy update + dependency health + docs/SEO refresh. Preflight's `READ_CALL_LOG` finding now notes that account verification via phone call is no longer an accepted use case (points to the Digital Credentials API + SMS Retriever API); the `policy-developer-verification` advisory and `gpc verify checklist` add the mandate that every app on your account be registered in Play Console (unregistered apps risk removal). Safe dev/prod dependency minor bumps (google-auth-library 10.9, protobufjs 8.6.5, yauzl 3.4.0, eslint/vitest/turbo/tsx/prettier). Docs: outcome-led homepage, answer-first AEO intros, benefit-led meta. Dep majors (typescript 6, commander 15, ai 7) held to post-1.0.0. 2,498 tests.
 - v0.9.90: release readiness, review insight, and Play Games sync. `gpc doctor --score` (A–F release-readiness grade) + `--badge` (shareable shields.io README badge). `gpc reviews list --sort newest|oldest|rating` presets + `gpc status --full` local review topic/sentiment breakdown. Games icon upload (`gpc games … set-icon`) and directory bulk sync (`gpc games … push/pull`); Games Management reset deferred (needs player-consent OAuth). Developer-verification advisory in preflight + `gpc verify checklist` (Sept 30 2026 enforcement). CI: Socket scan skips Dependabot PRs. Pre-soak security audit passed (Claude senior-security skill, this cycle). Last release before the stability soak. 2,495 tests.
 - v0.9.89: preflight scanner reliability fix (GH #89). `gpc preflight` (and `preflight manifest` / `preflight permissions`) crashed with a `TypeError` and then hung when scanning an AAB/APK on the standalone (Homebrew) binary — yauzl's file-descriptor reader was handed a null fd under the Bun-compiled binary. The offline reader now loads the archive with `yauzl.fromBuffer` (no fd), so the standalone binary behaves the same as the npm (Node) install, and the ZIP read is guaranteed to settle with a bounded timeout backstop so it can never hang. 2,421 tests.
 - v0.9.88: preflight compliance refresh for Google Play's October 28 2026 sensitive-permission deadlines (apps targeting Android 17/API 37+). Contacts check now cites the Oct 28 2026 date + Android Contact Picker (`Intent.ACTION_PICK_CONTACTS`); new `location-minimal-scope` rule flags `ACCESS_FINE_LOCATION` (info; warning at API 37+); geofencing date corrected from the stale May 15 2026 to Oct 28 2026; `gpc init` scaffolds `targetSdkMinimum: 36` (was 35, below the current Play floor). 2,418 tests.
@@ -66,7 +67,7 @@ e2e/               → End-to-end tests
 - v0.9.72: API compliance patch (error reports endpoint, input validation).
 - v0.9.71: `gpc doctor` quota proximity check (warns at >80% daily/per-minute API usage) and plugin health check (discovers, loads, reports each plugin).
 - v0.9.70: `--in-app-update-priority <0-5>` and `--retain-version-codes <csv>` flags on upload, `default.txt` Fastlane-style changelog fallback via `--notes-dir`, promote preserves `inAppUpdatePriority` + `name`, GitHub Actions Node.js 22.
-- 2,495 total tests, 7 packages building, 90%+ line coverage on all core packages
+- 2,498 total tests, 7 packages building, 90%+ line coverage on all core packages
 - Changelog-generation series (v0.9.61 → v0.9.64): complete. `gpc changelog generate --target play-store --locales auto --ai --apply` does commit → translated Play Store notes → written into draft release, one command.
 - v0.9.63 highlight: AI-assisted Play Store translation. `gpc changelog generate --target play-store --locales auto --ai` translates non-source locales via the user's own LLM key. Auto-detects env priority `AI_GATEWAY_API_KEY` → `ANTHROPIC_API_KEY` → `OPENAI_API_KEY` → `GOOGLE_GENERATIVE_AI_API_KEY`. Non-reasoning model defaults. Gateway path unlocks cost-per-run in USD. All 4 AI SDK deps lazy-loaded (cold-start preserved).
 - v0.9.62 highlight: multilingual Play Store release notes. `gpc changelog generate --target play-store --locales <csv|auto>` emits per-locale "What's new" text with 500-char budget enforcement.
@@ -76,7 +77,7 @@ e2e/               → End-to-end tests
 
 ## Testing
 
-- Vitest for all tests (2,495 total across 7 packages + e2e)
+- Vitest for all tests (2,498 total across 7 packages + e2e)
 - Tests in `tests/` directory per package
 - Mock external APIs — never call real Google APIs in tests
 - Mock fetch with `vi.stubGlobal("fetch", mockFn)` for API tests
diff --git a/README.md b/README.md
@@ -84,7 +84,7 @@ GPC covers the **entire Google Play Developer API** in one CLI. 227 endpoints. N
 | CI/CD native            | JSON + exit codes + env vars           | Partial         | Gradle tasks          | No           |
 | Preflight scanner       | **9 offline policy checks**            | No              | No                    | No           |
 | Interactive mode        | Yes (guided prompts)                   | No              | No                    | N/A          |
-| Test suite              | 2,495 tests, 90%+ coverage             |                 |                       |              |
+| Test suite              | 2,498 tests, 90%+ coverage             |                 |                       |              |
 
 Already on Fastlane? See the [migration guide](https://yasserstudio.github.io/gpc/migration/from-fastlane) — most commands map one-to-one.
 
diff --git a/apps/docs/.vitepress/config.ts b/apps/docs/.vitepress/config.ts
@@ -353,7 +353,7 @@ export default defineConfig({
         codeRepository: "https://github.com/yasserstudio/gpc",
 
         programmingLanguage: "TypeScript",
-        softwareVersion: "0.9.90",
+        softwareVersion: "0.9.91",
         releaseNotes: "https://yasserstudio.github.io/gpc/reference/changelog",
         documentation: "https://yasserstudio.github.io/gpc/",
         author: {
@@ -491,7 +491,7 @@ export default defineConfig({
             name: "Is it stable enough for production CI/CD?",
             acceptedAnswer: {
               "@type": "Answer",
-              text: "2,495 tests across 7 packages at 90%+ line coverage. Every write operation supports --dry-run. Semantic exit codes for CI branching.",
+              text: "2,498 tests across 7 packages at 90%+ line coverage. Every write operation supports --dry-run. Semantic exit codes for CI branching.",
             },
           },
           {
diff --git a/apps/docs/alternatives/fastlane.md b/apps/docs/alternatives/fastlane.md
@@ -21,7 +21,7 @@ If you are evaluating alternatives to Fastlane for Google Play automation, here
 | Plugin system           | Yes (lifecycle hooks)                                      | Actions (different) |
 | Interactive mode        | Yes (guided prompts)                                       | No                  |
 | Release notes generator | **`gpc changelog generate`** (clusters, lints, LLM prompt) | No                  |
-| Test suite              | 2,495 tests, 90%+ coverage                                 | --                  |
+| Test suite              | 2,498 tests, 90%+ coverage                                 | --                  |
 
 ## What GPC Covers That Fastlane Does Not
 
diff --git a/apps/docs/alternatives/index.md b/apps/docs/alternatives/index.md
@@ -27,7 +27,7 @@ This page compares every actively maintained option as of May 2026.
 | CI/CD integration            | JSON + exit codes (0-6)                | Partial              | Gradle tasks              | Basic             |
 | Plugin system                | Yes (lifecycle hooks, SDK)             | Actions              | No                        | No                |
 | SDK / library use            | Yes (@gpc-cli/api)                     | No                   | No                        | No                |
-| Test suite                   | 2,495 tests, 90%+ coverage             | Community-maintained | Kotlin tests              | Minimal           |
+| Test suite                   | 2,498 tests, 90%+ coverage             | Community-maintained | Kotlin tests              | Minimal           |
 | Image sync (SHA-256 diffing) | Yes (shipped v0.9.69)                  | Yes                  | No                        | No                |
 | Upload progress reporting    | Yes (shipped v0.9.69)                  | No                   | Yes (progress callbacks)  | No                |
 
diff --git a/apps/docs/commands/utility.md b/apps/docs/commands/utility.md
@@ -255,7 +255,7 @@ Run: gpc update
 **Already on latest:**
 
 ```
-Already on latest version: v0.9.90
+Already on latest version: v0.9.91
 ```
 
 **`--output json` (update available):**
diff --git a/apps/docs/guide/faq.md b/apps/docs/guide/faq.md
@@ -77,7 +77,7 @@ See the [CI/CD guide](../ci-cd/) for copy-pasteable GitHub Actions, GitLab CI, B
 
 ### Is it stable enough for production CI/CD?
 
-2,495 tests across 7 packages. 90%+ line coverage on all core packages. Every write operation supports `--dry-run`. Semantic exit codes for CI branching. Validated against production apps. The CLI is in a pre-release stability soak before v1.0.
+2,498 tests across 7 packages. 90%+ line coverage on all core packages. Every write operation supports `--dry-run`. Semantic exit codes for CI branching. Validated against production apps. The CLI is in a pre-release stability soak before v1.0.
 
 ## Configuration
 
diff --git a/apps/docs/guide/free-to-use.md b/apps/docs/guide/free-to-use.md
@@ -97,7 +97,7 @@ Not required. You may display a "Uses GPC" badge if you want (see `/users/` once
 
 ### What happens if the maintainer stops shipping?
 
-The source is on GitHub. Forks are permitted for internal use. The current approach is single-maintainer by design — that gives us quality control today and succession risk tomorrow. We mitigate the succession risk by keeping the project fully documented, heavily tested (2,495 tests at 90%+ coverage), and publicly versioned.
+The source is on GitHub. Forks are permitted for internal use. The current approach is single-maintainer by design — that gives us quality control today and succession risk tomorrow. We mitigate the succession risk by keeping the project fully documented, heavily tested (2,498 tests at 90%+ coverage), and publicly versioned.
 
 ### Can I sponsor the project?
 
diff --git a/apps/docs/index.md b/apps/docs/index.md
@@ -48,7 +48,7 @@ features:
     <span class="stat-label">API Endpoints</span>
   </div>
   <div class="stat-item">
-    <span class="stat-number">2,495</span>
+    <span class="stat-number">2,498</span>
     <span class="stat-label">Tests</span>
   </div>
   <div class="stat-item">
diff --git a/apps/docs/public/llms-full.txt b/apps/docs/public/llms-full.txt
@@ -11,12 +11,13 @@ GPC is a TypeScript CLI for the Google Play Developer API v3. It replaces the Pl
 
 - Install: `npm install -g @gpc-cli/cli`
 - Binary: `gpc`
-- Version: 0.9.90
+- Version: 0.9.91
 - API endpoints covered: 227 (Android Publisher v3 + Play Developer Reporting v1beta1 + Play Custom App Publishing v1 + Games Configuration v1configuration)
-- Tests: 2,495 (90%+ coverage)
+- Tests: 2,498 (90%+ coverage)
 - Licensing: Free to use. Source code is on GitHub.
 - Repo: https://github.com/yasserstudio/gpc
 - GitHub Action: yasserstudio/gpc-action on the GitHub Actions Marketplace (one-step Play publishing from CI with built-in preflight gate, drop-in r0adkll migration)
+- Notable v0.9.91: Google Play's July 15, 2026 policy update, plus dependency health and a docs refresh. The preflight `READ_CALL_LOG` finding now notes that account verification via phone call is no longer an accepted use case and points to the Digital Credentials API or SMS Retriever API instead. The developer-verification advisory (`policy-developer-verification`) and `gpc verify checklist` add the mandate that every app on your account must be registered in Play Console, since unregistered apps risk removal. Safe dependency minor bumps and an outcome-led docs homepage with answer-first intros.
 - Notable v0.9.90: Release readiness, review insight, and Play Games sync. `gpc doctor --score` grades release-readiness A–F with a shareable shields.io README badge (`--badge`). `gpc reviews list --sort newest|oldest|rating` and `gpc status --full` (local topic/sentiment/keyword breakdown, no external NLP). `gpc games … set-icon` icon upload and `push`/`pull` directory bulk sync for achievement/leaderboard configs. Developer-verification advisory (Sept 30 2026 enforcement) in preflight and `gpc verify checklist`. Last release before the stability soak.
 - Notable v0.9.89: Preflight scanner reliability fix. `gpc preflight` (and `preflight manifest` / `preflight permissions`) no longer crashes and then hangs when scanning an AAB or APK on the standalone binary installed via Homebrew; the offline scanner now reads archives the same way on the standalone binary and the npm (Node) install, and can never hang on a corrupt or truncated file.
 - Notable v0.9.87: Consistent list output. `grants`, `testers`, and `tracks` list commands now return the same `--json` envelope as the other list commands (breaking for those three; table output unchanged). Docs: third-party US app-store opt-out (July 22 2026), Play Billing Library v8 deadline, Android 17/API 37 preflight note.
diff --git a/apps/docs/public/llms.txt b/apps/docs/public/llms.txt
@@ -14,8 +14,8 @@ GPC is a TypeScript CLI that covers 227 Google Play Developer API endpoints. It
 - Exit codes: 0 success, 1 error, 2 usage, 3 auth, 4 API, 5 network, 6 threshold breach, 10 plugin
 - Config: `.gpcrc.json` (project), `~/.config/gpc/config.json` (user), `GPC_*` env vars
 - Uploads: Resumable protocol (8 MB chunks, auto-resume on failure, real-time progress bar)
-- Tests: 2,495 total, 90%+ line coverage on all core packages
-- Version: 0.9.90 (pre-release series → 1.0.0 public launch)
+- Tests: 2,498 total, 90%+ line coverage on all core packages
+- Version: 0.9.91 (pre-release series → 1.0.0 public launch)
 - GitHub Action: yasserstudio/gpc-action on the GitHub Actions Marketplace (one-step Play publishing from CI with built-in preflight gate)
 - Licensing: Free to use. Source code is on GitHub.
 - Managed Google Play: GPC is the first Android publishing CLI to support the Play Custom App Publishing API (gpc enterprise publish)
diff --git a/apps/docs/reference/changelog.md b/apps/docs/reference/changelog.md
@@ -11,7 +11,19 @@ head:
 
 All notable user-facing changes to GPC are documented here. For full release details, see the [GitHub Releases](https://github.com/yasserstudio/gpc/releases) page.
 
-## v0.9.90 <Badge type="tip" text="latest" />
+## v0.9.91 <Badge type="tip" text="latest" />
+
+Google Play July 15, 2026 policy update, dependency health, and a docs refresh.
+
+- feat: `gpc preflight` and `gpc verify checklist` track Google's July 15, 2026 policy update. The `READ_CALL_LOG` finding notes that account verification via phone call is no longer an accepted use case and points to the Digital Credentials API (or SMS Retriever API). A new advisory and checklist step cover the mandate that every app on your account be registered in Play Console, since unregistered apps risk removal.
+- chore: safe dependency updates (google-auth-library, protobufjs, yauzl, and dev tooling).
+- docs: outcome-led homepage, answer-first intros on the Games and Android CLI pages, and benefit-led page metadata.
+
+**Tests:** 2,498 (+3).
+
+---
+
+## v0.9.90
 
 Release readiness, review insight, and Play Games sync.
 
diff --git a/packages/cli/CHANGELOG.md b/packages/cli/CHANGELOG.md
@@ -1,5 +1,13 @@
 # @gpc-cli/cli
 
+## 0.9.91
+
+### Patch Changes
+
+- feat: `gpc preflight` and `gpc verify checklist` track Google Play's July 15, 2026 policy update. The `READ_CALL_LOG` finding points account-verification use cases to the Digital Credentials and SMS Retriever APIs, and a new advisory plus checklist step cover registering every app on your account in Play Console. Safe dependency updates and a docs/SEO refresh.
+- Updated dependencies [13b3736]
+  - @gpc-cli/core@0.9.76
+
 ## 0.9.90
 
 ### Patch Changes
diff --git a/packages/cli/package.json b/packages/cli/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@gpc-cli/cli",
-  "version": "0.9.90",
+  "version": "0.9.91",
   "description": "GPC — Google Play Console CLI. 227 API endpoints including Managed Google Play. Upload AABs, manage releases, monitor vitals, publish private enterprise apps. Fastlane alternative for Android.",
   "type": "module",
   "bin": {
diff --git a/packages/core/CHANGELOG.md b/packages/core/CHANGELOG.md
@@ -1,5 +1,11 @@
 # @gpc-cli/core
 
+## 0.9.76
+
+### Patch Changes
+
+- 13b3736: feat: preflight and verify checklist track Google Play's July 15, 2026 policy update. The `READ_CALL_LOG` permission finding now notes that account verification via phone call is no longer an accepted use case and points to the Digital Credentials API (or SMS Retriever API) instead. The developer-verification advisory (`policy-developer-verification`) and `gpc verify checklist` add the mandate that every app on your account must be registered in Play Console, since unregistered apps risk removal from Google Play.
+
 ## 0.9.74
 
 ### Patch Changes
diff --git a/packages/core/package.json b/packages/core/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@gpc-cli/core",
-  "version": "0.9.75",
+  "version": "0.9.76",
   "description": "Core business logic for GPC. Releases, rollouts, vitals, preflight scanner, AI changelog, metadata sync for Google Play Developer API.",
   "type": "module",
   "main": "./dist/index.js",
