This release includes breaking changes for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
Topics
+6 more
Affected surfaces
Summary
AI summaryPreserve explicit nulls for nullable preview and subscription inputs and retain deepLink, linked-product, and target-plan response data.
Full changelog
[3.11.0] - 2026-07-20
Changed
- Custom Product Pages now expose visibility, version-state, and locale filters, the custom-page template relationship, and nullable version deep links.
- Product Page Optimization exposes experiment-state and treatment-locale filters; screenshot and preview collections expose Apple's display-type and owning-localization filters.
- App preview uploads preserve Apple's nullable poster-frame and MIME attributes, including explicit nulls, while retaining the existing
video/mp4default whenmime_typeis omitted. - Subscription writes preserve nullable introductory-offer dates and target plan type, price plan type and preservation state, and subscription period; introductory-offer listings also return the target plan type.
- Bound or explicitly classified all 63 remaining optional Apple 4.4.1 query and request-body inputs: 21 bound, 2 internally controlled, and 40 intentionally omitted with reviewed reasons.
Fixed
- Validate every
next_urlacross the 11 affected Custom Product Page, Product Page Optimization, promoted-purchase, screenshot, and preview collections against its concrete parent, non-empty cursor, and complete originating query. - Reject missing or changed continuation controls, unexpected or duplicate query names, comma-injected relationship IDs, unsupported Apple media types, malformed dates, invalid plan or period values, and whitespace-normalized filters before network access.
- Preserve value, explicit null, and omission as distinct states for nullable preview and subscription inputs, and retain
deepLink, linked-product, and target-plan response data in public results.
Compatibility
- No public MCP tool or required input was added, removed, or renamed; this release adds optional inputs and widens existing nullable inputs without invalidating existing first-page calls.
- Existing app preview uploads that omit
mime_typecontinue to sendvideo/mp4; callers may now pass null to let Apple infer the value. - Continuation calls for the affected collections must preserve the complete originating query and Apple's non-empty cursor in
next_url. - The strict contract pin records all 2,154 optional Apple inputs: 809 bound, 40 internally controlled, 1,305 intentionally omitted, and 0 unclassified.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About zelentsov-dev/asc-mcp
App Store Connect API server with 208 tools for managing apps, builds, TestFlight, subscriptions, reviews, and more — directly from any MCP client.
Related context
Related tools
Earlier breaking changes
- v3.1.0 `app_versions_set_review_details.attachment_file_id` replaced by separate `review_attachments_upload` call.
- v3.1.0 Moved app-level TestFlight contact and policy metadata from `builds_set_beta_localization` to corresponding `beta_app_*_localization` tools.
- v3.1.0 `builds_update_beta_detail` no longer accepts read-only fields `internal_build_state` or `external_build_state`.
- v3.0.0 Removed public prefixes `offer_codes_*`, `intro_offers_*`, `promo_offers_*`, and `winback_*` from v3 worker schema.
Beta — feedback welcome: [email protected]