v0.9.91 — July 15 Play Compliance, Dependency Health & Docs Refresh

What's Changed

Compliance

• feat: gpc preflight and gpc verify checklist now track Google Play's July 15, 2026 policy update. The READ_CALL_LOG permission finding notes that account verification via a phone call is no longer an accepted use case, and points to the Digital Credentials API (or the SMS Retriever API) instead.
• feat: a new advisory and checklist step cover the mandate that every app on your account be registered in Play Console. Unregistered apps risk removal from Google Play; apps using Play App Signing are auto-registered.

Dependencies

• chore: safe dependency updates, including google-auth-library, protobufjs, and yauzl, plus dev tooling. No breaking major upgrades (those are held until after 1.0.0).

Docs

• docs: an outcome-led homepage, answer-first intros on the Games and Android CLI pages, and benefit-led page metadata.
• test: fixed a stale end-to-end assertion for the CLI help description.

Tests: 2,498 across 7 packages, 90%+ line coverage.

Full Changelog: v0.9.90...v0.9.91

v0.9.90 — Release Readiness, Review Insight & Play Games Sync

What's Changed

Release Readiness

• feat: gpc doctor --score grades how ready your app is to publish on an A to F scale, with a weighted breakdown and fix suggestions. Hard failures outside the graded set are surfaced so a top grade never hides a problem.
• feat: gpc doctor --badge prints a shareable readiness badge (a shields.io URL plus markdown) you can commit straight into your README.

Reviews

• feat: gpc reviews list --sort newest|oldest|rating sorts reviews by recency or star rating.
• feat: gpc status --full adds a topic, sentiment, and keyword breakdown of recent reviews. The analysis runs locally, so no review text leaves your machine.

Play Games

• feat: gpc games achievements set-icon and gpc games leaderboards set-icon upload achievement and leaderboard icons.
• feat: gpc games achievements push/pull and the leaderboard equivalents bulk-sync configurations to and from a directory of JSON files, with --dry-run support.

Compliance

• feat: gpc preflight and gpc verify checklist now surface Google's September 30, 2026 developer-verification enforcement and its first markets (Brazil, Indonesia, Singapore, Thailand), noting that Play App Signing apps are auto-registered.

CI

• ci: the Socket Security scan no longer reports a spurious failure on Dependabot pull requests.

Full Changelog: v0.9.89...v0.9.90

v0.9.89 — Preflight Scanner Reliability Fix

What's Changed

• fix: gpc preflight (and preflight manifest / preflight permissions) no longer crashes and then hangs when scanning an AAB or APK on the standalone binary installed via Homebrew. The offline scanner now reads archives the same way on the standalone binary and the npm install, and can never hang on a corrupt or truncated file.

Full Changelog: v0.9.88...v0.9.89

v0.9.88 — Preflight Compliance Refresh

What's Changed

Preflight now tracks Google Play's October 28, 2026 sensitive-permission deadlines for apps targeting Android 17 (API 37+).

• preflight: the contacts check cites the correct October 28, 2026 deadline and points to the Android Contact Picker (Intent.ACTION_PICK_CONTACTS) as the minimum-scope alternative.
• preflight: new location-minimal-scope check flags broad ACCESS_FINE_LOCATION and recommends the Android location button for one-time precise location.
• preflight: the geofencing check now reflects the October 28, 2026 enforcement window and points to the Geofencing API for migration.
• fix: gpc init scaffolds .preflightrc.json with targetSdkMinimum: 36, matching Google Play's current floor (was 35).

Full Changelog: v0.9.87...v0.9.88

v0.9.87 — Consistent List Output

What's Changed

• breaking: gpc grants list, gpc testers list, and gpc tracks list now return the same JSON shape as every other list command — { <key>, nextPageToken, meta.count, message? }. If you parse these with --json, read the named key (grants, googleGroups, tracks) instead of a bare array. Table output is unchanged.
• docs: new FAQ entry on Google's third-party US app-store listing syndication and the July 22, 2026 opt-out.
• docs: subscriptions page notes the Play Billing Library v8 requirement (August 31, 2026 deadline).
• docs: refreshed the Android 17 (API 37) large-screen resizability note on the preflight page.

Full Changelog: v0.9.86...v0.9.87

v0.9.86 — Complete Google Play Games API

What's Changed

• feat: full CRUD for Play Games achievement and leaderboard configurations via the Games Configuration API (10 new endpoints)
• feat: gpc games achievements diff and gpc games leaderboards diff for sync workflows
• feat: --game-id flag, GPC_GAME_ID env var, and games.applicationId config for numeric application ID resolution
• breaking: gpc games events removed (runtime-only, no publisher equivalent)
• breaking: existing runtime commands moved under gpc games runtime

Endpoint count: 217 to 227. 2,408 tests.

Resolves #80.

Full Changelog: v0.9.85...v0.9.86

v0.9.85 — Install Fix (Completed)

What's Changed

• fix: npm install -g @gpc-cli/cli now installs cleanly. v0.9.84 resolved the internal workspace references in the CLI and its core package, but a shared dependency was left on its previous version and so kept a reference a fresh install could not resolve. That package and the ones depending on it are now republished with concrete versions.

If you hit the install error on v0.9.84, upgrade with npm install -g @gpc-cli/cli@latest.

Full Changelog: v0.9.84...v0.9.85

v0.9.84 — Install Fix & Regional Pricing Control

What's Changed

• fix: npm install -g @gpc-cli/cli no longer fails with EUNSUPPORTEDPROTOCOL. Packages published from v0.9.77 to v0.9.83 carried internal workspace references that a fresh install could not resolve; publishing now writes concrete versions. If you hit this, upgrade with npm install -g @gpc-cli/cli@latest.
• fix: --regions-version is now applied on subscriptions and one-time-products create, update, and offer create/update — it selects the regional pricing version sent to Google Play (for example, opting in to a newer region/currency list). It was previously accepted but ignored, so updates always used the default.

Thanks to @softlion for reporting and fixing the regional pricing flag.

Full Changelog: v0.9.83...v0.9.84

v0.9.83 — Response & Usage Quality

What's Changed

• fix: long lists now page correctly. reviews list, users list, subscriptions list, iap list, and purchases voided can fetch the next page with --next-page when you use --limit. Before, they stopped after the first batch.
• feat: list commands print a "more results" hint when another page is available, so you know when to paginate.
• breaking: --json output for list commands is now a consistent object instead of a bare array. gpc reviews list --json now returns { "reviews": [...], "nextPageToken": ..., "meta": { "count": N } }. If you parse it with jq, change jq '.[]' to jq '.reviews[]' (or the matching key). Empty results now include a clear message.
• fix: clearer errors. A wrong or inaccessible app now returns "This app was not found in your Google Play developer account" with next steps, instead of a generic not-found. Unexpected API responses now include a message and a suggestion.
• feat: prices show the correct number of decimals per currency (yen shows none, Kuwaiti dinar shows three) instead of always two.
• feat: reviews list shows whether each review has a developer reply and the reviewer's language, with a clear marker when text is shortened. Use --full-text for complete review text.
• fix: CSV and TSV exports are protected against spreadsheet formula injection.

Full Changelog: v0.9.82...v0.9.83

v0.9.82 — Dependency Health, Docs Alignment, Lint Cleanup

What's Changed

• AI SDK v6 migration: bumped ai 5 to 6, @ai-sdk/anthropic 2 to 3, @ai-sdk/openai 2 to 3, @ai-sdk/google 2 to 3. Zero code changes needed -- all v6 breaking changes are N/A for GPC's usage.
• Production audit cleared: google-auth-library 10.6.2 to 10.7.0 resolves the only tracked production audit finding (brace-expansion transitive via gaxios > rimraf > glob). Zero production findings remain.
• Security: turbo 2.9.6 to 2.9.16 fixes CSRF and Yarn Berry code execution (dev-only).
• Lint cleanup: 30 warnings eliminated in packages/cli/src/ -- 18 no-explicit-any replaced with proper API types, 12 no-non-null-assertion replaced with safe fallbacks.
• Bug fix: vitals gate crash-rate extraction on rollout increase now reads the correct MetricSetResponse shape (was silently skipping the check since the feature was introduced).
• Config type: added VitalsThresholds to GpcConfig schema (eliminates floating inline cast).
• Routine bumps: eslint 10.4.1, vitest 4.1.8, typescript-eslint 8.60.1, prettier 3.8.3, protobufjs 8.6.0, yauzl 3.3.2.

Tests: 2,345 (unchanged). Endpoints: 217 (unchanged).

Full Changelog: v0.9.81...v0.9.82