Trading Card API Changelog
Stay up-to-date with the latest changes, improvements, and new features in the Trading Card API itself.
API vs Documentation Changes
This page shows changes to the Trading Card API service. For changes to this documentation site, see the Documentation Changelog.
Latest Releases
All notable changes to the Trading Card API are documented here. The API follows Semantic Versioning and maintains a Keep a Changelog format.
🚀 Recent Updates
📦 [0.4.7] - September 18, 2025
Latest Release
This is the current production version of the Trading Card API.
📦 [0.4.7] - September 18, 2025
Latest Release
This is the current production version of the Trading Card API.
Fixed
- Fix JSON escaping in trigger-docs-update.yaml workflow
🔗 Release Information
🔗 Release Information
📦 [0.4.6] - September 18, 2025
📦 [0.4.6] - September 18, 2025
Added
- Add workflow to trigger documentation updates on releases
Changed
- Trigger CI after cleaning up test tags
🔗 Release Information
🔗 Release Information
📦 [0.4.5] - September 7, 2025
🔄 Latest API Release
✨ Key API Features
- Comprehensive rate limiting with Redis backend
- OAuth2 authentication with Laravel Passport
- JSON:API specification compliance
- UUID primary keys for all resources
- Polymorphic relationships and advanced querying
- OpenAPI/Swagger documentation with interactive explorer
📚 Additional Resources
- API Endpoints - Complete endpoint reference
- Authentication Guide - Setup instructions
- First Request Tutorial - Quick start guide
- Rate Limits Guide - Usage limits and best practices
🔗 Release Information
📦 [0.4.4] - September 5, 2025
📦 [0.4.4] - September 5, 2025
Added
- Add commit deduplication to changelog script
- Add token fallback for Dependabot PRs
Changed
- github-actions(deps): bump actions/download-artifact from 4 to 5
🔗 Release Information
🔗 Release Information
📦 [0.4.3] - September 5, 2025
📦 [0.4.3] - September 5, 2025
Changed
- Use actual committer's name and email for automation commits
- Use DEPLOY_APP_TOKEN to trigger status checks on automation commits
- Replace manual git commands with git-auto-commit-action
- Improve auto-version-bump exclusion logic
- Disable auto-version-bump for workflow development branches
- Restore content to empty 0.4.3 changelog section
Fixed
- Fix git-auto-commit-action configuration issues
🔗 Release Information
🔗 Release Information
📦 [0.4.2] - September 5, 2025
📦 [0.4.2] - September 5, 2025
Added
- Document new automated PR version management system
Changed
- Update CLAUDE.md with new automated PR workflow documentation
- Start fresh: remove entire 0.4.2 section for clean automation test
- Resolve changelog conflict - accept clean automated version
- Re-enable automation for all release PRs including workflow development
- Automate version bump workflow for release PRs
Removed
- Remove useless automatic version updates comment from workflow
- Remove manual changelog entry to let automation handle everything
- Remove outdated manual workflow instructions from PR comments
Fixed
- Fix PR status checks by forcing CI run on final commit
- Fix all remaining markdown linting issues in documentation
- Fix corrupted changelog structure after merge conflict
- Final fix: disable auto-version-bump for workflow development branches
🔗 Release Information
🔗 Release Information
📦 [0.4.1] - September 5, 2025
📦 [0.4.1] - September 5, 2025
Changed
- Updated GitHub Actions dependencies
- Bump actions/checkout from v4 to v5 (Dependabot)
🔗 Release Information
🔗 Release Information
📦 [0.4.0] - September 5, 2025
📦 [0.4.0] - September 5, 2025
🔒 Major Security & Rate Limiting Features
- Comprehensive Rate Limiting System with Redis backend and tiered limits (Issues #678, #680, #681)
- Anonymous rate limits: 100 requests/hour
- Authenticated rate limits: 2000 requests/hour
- OAuth client rate limits: 1000 requests/hour
- OAuth token endpoint: 10 requests/minute
- Rate limit headers in all responses
- Comprehensive test suite with performance and edge case testing
📊 API Usage Analytics & Monitoring
- Comprehensive API usage logging system for rollout analytics (Issue #735)
ApiUsageLogging
middleware for automatic request trackingLogApiUsage
job for asynchronous database logging- Database migration for
api_usage_logs
table with optimized indexes - Complete test coverage with 20 test cases (unit and feature tests)
- Analytics queries for endpoint popularity, response times, and error rates
- Endpoint normalization for ID and UUID parameters
🔧 Infrastructure & Dependencies
- Updated all PHP and Node.js dependencies to latest secure versions (Issue #791)
- Laravel framework 12.21.0 → 12.28.1
- Laravel Passport 13.0.6 → 13.2.0
- PHPUnit 11.5.27 → 11.5.36
- Node.js 22 → 23
- Security fixes for @usebruno/cli and newman packages
- Updated GitHub Actions to latest versions
📚 Enhanced Documentation & Testing
- Comprehensive rate limiting documentation across all relevant files
- Manual rate limiting testing command (
php artisan test:rate-limiting
) - Bruno CLI integration tests for rate limiting scenarios
- Troubleshooting procedures and debugging guides
- Enhanced documentation generation with preserved manual content
- Fixed documentation template formatting issues
⚠️ Breaking Changes
- New rate limiting may affect high-volume API consumers:
- Anonymous users now limited to 100 requests/hour (previously unlimited)
- OAuth token generation limited to 10 requests/minute
- New rate limit headers in all responses
🐛 Bug Fixes
- Resolved API usage logging content removal during version bumps
🔗 Release Information
🔗 Release Information
📦 [0.3.9] - August 13, 2025
📦 [0.3.9] - August 13, 2025
Fixed
- Documentation workflow not triggering when workflow file itself is updated
🔗 Release Information
🔗 Release Information
📦 [0.3.8] - August 12, 2025
📦 [0.3.8] - August 12, 2025
Fixed
- Documentation generation workflow references to non-existent docs/generated/ directory
🔗 Release Information
🔗 Release Information
📦 [0.3.7] - August 12, 2025
📦 [0.3.7] - August 12, 2025
Fixed
- Documentation generation workflow failing due to incorrect npm script name
🔗 Release Information
🔗 Release Information
📦 [0.3.6] - August 12, 2025
📦 [0.3.6] - August 12, 2025
Fixed
- OAuth key file ownership issues causing "Key path does not exist or is not readable" errors (Issue #689)
🔗 Release Information
🔗 Release Information
📦 [0.3.5] - August 12, 2025
📦 [0.3.5] - August 12, 2025
Fixed
- OAuth client authentication failures with "This password does not use the Bcrypt algorithm" error (Issue #675)
- Laravel Passport 13 client secret validation by updating plain text secrets to bcrypt format
- Production API authentication issues for OAuth clients with legacy plain text secrets
- Docker builds failing on Debian Trixie due to nginx.org repository compatibility
- Integration test failures by adding HTTP support alongside HTTPS in nginx configuration
Added
oauth:fix-client-secrets
artisan command to safely update OAuth client secrets to bcrypt format- Database migration to automatically fix OAuth client secret format during deployment
- Dry-run mode for OAuth client secret fix command with safety confirmations
🔗 Release Information
🔗 Release Information
📦 [0.3.4] - August 8, 2025
📦 [0.3.4] - August 8, 2025
Added
- Comprehensive PROJECT_OVERVIEW.md markdown description file with strategic business and technical analysis (Issue #648)