Skip to main content

Changelog

Stay up-to-date with the latest changes, improvements, and new features in the Trading Card API documentation site.

Version History​

All notable changes to the Trading Card API Documentation are documented here. We follow Semantic Versioning and the Keep a Changelog format.

🚧 Unreleased​

What's Coming Next

These features are currently in development and will be included in the next release.

📦 0.3.44 - 2026-08-28​

🔧 Changed​

  • [Issue #672] Preserve nested model fields, request-body schemas, example responses, and per-endpoint authentication when generating the API reference from the OpenAPI spec.
    • Regenerates docs/api/models.md and docs/api/endpoints.md; per-endpoint OAuth scopes and missing per-field descriptions remain API-repo work.

📦 0.3.43 - 2026-08-28​

✨ Added​

  • [Issue #668] Add a daily scheduled watcher that escalates standing drift in the published OpenAPI spec and API changelog to a single tracking issue.
    • Detection only — refreshing the committed pages remains the job of openapi-sync.yaml and api-changelog-update.yml.

📦 0.3.42 - 2026-08-28​

🐛 Fixed​

  • [Issue #657] File healthcheck failure issues with a PAT so they trigger assign-sprint and reach the project board.
    • Requires PROJECT_TOKEN to carry issues: write; without it the reporter warns and falls back to github.token, filing the issue off-board as before.

📦 0.3.41 - 2026-08-28​

🐛 Fixed​

  • [Issue #642] Stop the documented pre-PR build gate from dirtying the generated OpenAPI artefacts by adding a DOCS_SKIP_OPENAPI_SYNC=1 opt-out.
    • The workflow failure originally reported in #642 was fixed separately by #656; CI generation is deliberately unaffected by the new flag.

📦 0.3.40 - 2026-08-27​

🐛 Fixed​

  • [Issue #669] Pass an explicit source="founding-list" to the EarlyAccessForm mount so GA4 early_access_application events report a real form_source instead of unknown, and guard against the prop being dropped again.

📦 0.3.39 - 2026-08-27​

🐛 Fixed​

  • [Issue #560] Stop the OpenAPI Spec Sync workflow adding a changelog fragment its docs-only PR does not need.
    • The 453 fragment could never collate (issue #473 already-released guard) and would wedge a sync-only release via issue #583's empty-collation hard fail.

📦 0.3.38 - 2026-08-27​

🐛 Fixed​

  • [Issue #671] Point the /api page's Interactive Docs button at the site's own published OpenAPI spec instead of a localhost dev URL, and guard against dev URLs reaching shipped markup.

📦 0.3.37 - 2026-08-27​

🐛 Fixed​

  • [Issue #708] Exempt the generated changelogs from the #487 community-claims guard, which had been failing on every branch since the #582 entry shipped.
    • The offending line describes removing an unbacked claim, but the guard is a substring scan and could not tell the difference. A changelog is a historical record, not a live claim, so docs/changelog.md and docs/api/changelog.md are now allowlisted — matching the exemption that beta-framing.test.js and docs-signup-links.test.js already carry for the same two files.

📦 0.3.36 - 2026-08-25​

🐛 Fixed​

  • [Issue #582] Replace the repo README's unbacked Community support-channel bullet with the support email, and extend the #487 community-claims guard to cover README.md.

📦 0.3.35 - 2026-08-25​

🐛 Fixed​

  • [Issue #559] Build each generated curl example from the OpenAPI operation so public endpoints drop the Bearer header, body-carrying endpoints show a Content-Type and payload, and Accept matches the documented response type.
    • Regenerates docs/api/endpoints.md, producing a large mechanical diff across all documented paths.

📦 0.3.34 - 2026-08-24​

🐛 Fixed​

  • [Issue #656] Fix the OpenAPI Spec Sync workflow, which had failed on every run since Aug 17 because an organization ruleset blocks force-pushing the sync branch.
    • The sync branch is now append-only, so in-progress commits on it are preserved instead of overwritten.

📦 0.3.33 - 2026-08-22​

🐛 Fixed​

  • [Issue #666] Stop the healthcheck reporter's test suite from writing the real /tmp/probe-failures.txt, which raced the #509 probe harness and failed deterministically once both files ran in the same suite.

📦 0.3.32 - 2026-08-22​

🐛 Fixed​

  • [Issue #633] Correct the card, set and player response examples that documented year, description, total_cards and birth_date attributes the OpenAPI schema does not define, and state that release year lives on the set's year relationship.
    • The long-form guides under docs/guides/ carry the same drift and are exempted in the new guard test pending a follow-up sweep.

📦 0.3.31 - 2026-08-22​

✨ Added​

  • [Issue #551] Document pull-request conventions in .claude/CLAUDE.md — base-branch selection, the changelog-fragment obligation, the pre-PR gate, and the private-link ratchet.
    • Written against the post-#561 rules: no PR bumps the version, and a hand-written ## [X.Y.Z] section on a PR to main is a hard CI failure.

📦 0.3.30 - 2026-08-22​

🔧 Changed​

  • [Issue #627] Move the failing-probe read, join and empty-file fallback out of both healthcheck workflows and into scripts/ci/report-healthcheck-failure.sh, so the expression that caused #456 has one home and is covered by execution rather than by string matching.
    • The first-failure issue template now carries a {{FAILING}} placeholder the reporter substitutes; workflows no longer pass FAILING.

📦 0.3.29 - 2026-08-22​

🐛 Fixed​

  • [Issue #659] Stop the stats and founding proxy healthchecks from re-commenting an unchanged failure on every hourly run; a repeat with the same failing-probe set now updates a single rolling state comment in place.
    • A changed failing-probe set still posts a new comment, so a snapshots-only regression keeps its notification. Both workflows now check the repo out to run the shared scripts/ci/report-healthcheck-failure.sh.
    • Corrects the stats healthcheck triage template, which told operators to reissue TRADING_CARD_API_TOKEN "with the stats scope" — no such scope exists, /v1/stats/* requires none, and a Passport scope failure is a 403 rather than the 401 seen here. It now shows how to decode the token JWT to rule expiry in or out and check the token row and client before rotating any secret.

📦 0.3.28 - 2026-08-22​

🐛 Fixed​

  • [Issue #462] The stats proxy now mints its own short-lived access tokens from TCAPI_CLIENT_ID / TCAPI_CLIENT_SECRET via the client-credentials grant, instead of carrying a hand-minted TRADING_CARD_API_TOKEN that expires.
    • A client secret does not expire, so there is nothing left to rotate on a schedule — which is what the nine-day outage in #462 cost. Tokens are cached on the warm container and re-minted a few minutes before they lapse.
    • A failed exchange is now reported as a 500 configuration error naming the OAuth error code in the function log, rather than being indistinguishable from the upstream's 401.
    • TRADING_CARD_API_TOKEN is still honoured when no client credentials are configured, so this deploys without a flag day.

📦 0.3.27 - 2026-08-21​

✨ Added​

  • [Issue #617] Document the query-parameter conventions, the like: partial-match prefix, the root-sets-only default listing, the parallels-as-child-sets model, the checklist response shape, and the API key minted at signup, and correct the quickstart examples that named parameters the API silently ignores.

📦 0.3.26 - 2026-08-20​

🔧 Changed​

  • [Issue #491] Route EarlyAccessForm analytics through the shared AnalyticsEvents module instead of an inline window.gtag call.
    • early_access_application events now respect the production gate and no longer fire in local development.

📦 0.3.25 - 2026-08-18​

✨ Added​

  • [Issue #615] State in the Terms of Service that API data may be stored, and that a 90-day wind-down period follows the end of a subscription, alongside the redistribution, sublicensing, derivative-works, and attribution terms that apply.
    • The wind-down is the deliberately reversible choice pending the data-sourcing self-assessment; it can be extended or made permanent later without clawing rights back.

📦 0.3.24 - 2026-08-18​

🔐 Security​

  • [Issue #595] Withhold query strings and fragments from Google Analytics, so the founding invite code and the email-verification token are no longer sent to Google; campaign parameters are still reported.
    • Requires one operator action: GA4 Enhanced Measurement's "Page changes based on browser history events" must be turned off, or GA sends its own pageviews carrying the raw URL.

📦 0.3.23 - 2026-08-18​

🐛 Fixed​

  • [Issue #609] State the refund terms once in the Terms of Service, pointing at the Refund Policy as authoritative, instead of twice in two places.
    • The consumer-protection savings clause from the removed section now lives on the Refund Policy page.

📦 0.3.22 - 2026-08-18​

🐛 Fixed​

  • [Issue #610] Name Utah as the governing-law jurisdiction in the Terms of Service, and disclose Loops as the transactional-email processor in the Privacy Policy.

📦 0.3.21 - 2026-08-18​

🐛 Fixed​

  • [Issue #596] Render cached homepage stats independently so a partial cache or an unavailable stats API no longer blanks the counters or strands the loading spinner.
    • Does not restore the live numbers — the production 401 requires rotating TRADING_CARD_API_TOKEN on the DigitalOcean stats function, which is an operator action outside this change.

📦 0.3.20 - 2026-08-18​

🐛 Fixed​

  • [Issue #607] Restore self-service signup and the founding-slot counter, which were unreachable in production, and add an hourly healthcheck on both so the next outage is detected rather than discovered.
    • The signup function now receives SIGNUP_INVITE_CODE, without which it rejected every signup.

📦 0.3.19 - 2026-08-17​

🔧 Changed​

  • [Issue #489] Make the Programming Languages, Intended Use Case, Project Description, and Developer Experience fields on the founding-list form optional so only name and email gate submission.
    • Brevo attributes and the early_access_application GA4 dimensions are unchanged; unfilled fields are now omitted from the contact payload instead of sent empty.

📦 0.3.18 - 2026-08-17​

🔧 Changed​

  • [Issue #546] Route the pricing-tier and founding-slot CTAs through @docusaurus/Link so internal navigation is client-side and prefetched.
    • The Enterprise mailto: CTA intentionally stays a plain <a>; only hrefs beginning with / are converted.

📦 0.3.17 - 2026-08-17​

🔐 Security​

  • [Issue #500] Stop the /verify page leaking the verification token through the Referer header and browser history.
    • The token is now scrubbed from the address bar after it is read, so refreshing /verify shows the missing-token state instead of re-verifying.

📦 0.3.16 - 2026-08-17​

🐛 Fixed​

  • [Issue #600] Send a founding-list confirmation email when someone joins the list, instead of creating the contact and sending nothing.
    • The send is best-effort: a Brevo failure is logged rather than reported as a failed signup, since the contact write is what actually records the signup.

📦 0.3.15 - 2026-08-17​

🔧 Changed​

  • [Issue #552] Retire the beta framing from the documented Brevo email templates and extend the beta-framing guard to cover src/api.
    • The Brevo templates themselves must still be updated in Brevo to match the doc; the PR cannot apply them.

📦 0.3.14 - 2026-08-17​

🔐 Security​

  • [Issue #566] Gate account creation behind an invite link during founding access: remove every public signup CTA and validate the invite server-side in the signup proxy.
    • The proxy also forwards the code upstream as data.attributes.invite_code, which api#2282 makes a required attribute, so the API can enforce the invite itself. A rejected invite reads the same to the user whichever layer refuses it.
    • The API's POST /v1/signup is public, so until api#2282 deploys a request sent straight to it still bypasses the proxy gate.

📦 0.3.13 - 2026-08-17​

🔧 Changed​

  • [Issue #562] Rename the founding-list signup pages from /early-access and /early-access-submitted to /founding-list and /founding-list-submitted, and add client-side redirects so the old URLs keep working.
    • Adds @docusaurus/plugin-client-redirects; the redirects are emitted at build time only and do not exist under npm start.

📦 0.3.12 - 2026-08-17​

🐛 Fixed​

  • [Issue #486] Remove all published links to the non-existent status.tradingcardapi.com domain and add a regression guard.

📦 0.3.11 - 2026-08-17​

✨ Added​

  • [Issue #482] Add a published Refund Policy page at /refunds and link it from the site footer and the Terms of Service.

📦 0.3.10 - 2026-08-17​

🔧 Changed​

  • [Issue #481] Rewrite the Terms of Service for a paid subscription, adding plans and pricing, monthly billing and auto-renewal, the 14-day no-card trial and its 402 suspension behavior, cancellation, refunds, price-change notice, and non-payment versus acceptable-use termination.

📦 0.3.9 - 2026-08-17​

🐛 Fixed​

  • [Issue #545] Drop the redundant brand suffix from the /pricing and /api page titles so the site name is no longer duplicated in the browser tab and search results.

📦 0.3.8 - 2026-08-17​

🐛 Fixed​

📦 0.3.7 - 2026-08-17​

🐛 Fixed​

  • [Issue #487] Remove community claims and dead Discord/forum links from the site, docs, and blog, replacing them with the support email.

📦 0.3.6 - 2026-08-17​

🔧 Changed​

  • [Issue #483] Rewrite the Privacy Policy to name every third-party processor, disclose the analytics cookies the site sets and how to opt out, and state GDPR/CCPA data-subject rights and concrete retention periods.
    • Publishes specific retention periods and a no-sale/no-share commitment — confirm both against actual practice before merging, since they become binding representations.

📦 0.3.5 - 2026-08-16​

🐛 Fixed​

  • [Issue #583] Stop the changelog collator from silently discarding a fragment when its issue number is merely mentioned in prose inside an already-released section, and refuse to delete fragments when collation would leave the version section empty.

📦 0.3.4 - 2026-08-16​

🐛 Fixed​

  • [Issue #485] Correct the published rate limits, which matched neither the pricing page nor what the API enforces: the docs now state the per-plan daily allowances, document the 402 returned when a subscription lapses, and stop promising Retry-After and X-RateLimit-Reset headers the API never sends.

📦 0.3.3 - 2026-08-16​

🔧 Changed​

  • [Issue #561] Collate changelog.d/ fragments into the versioned CHANGELOG.md section after the merge, in the Build Release workflow, instead of on the pull request. Version assignment is now serialized by main's commit order, so two concurrent PRs can no longer claim the same version, and the release commit-back also updates docs/changelog.md and package.json.

📦 0.3.2 - 2026-08-15​

🔧 Changed​

  • [Issue #484] Retire the sitewide beta framing ahead of the paid launch: the beta notice and announcement bar become a founding-access call to action, and the beta disclaimers are removed from the homepage, introduction, support, terms, privacy, and rate-limit pages.
    • The full paid-subscription Terms of Service rewrite (#481) and the rate-limit reconciliation with the pricing page (#485) remain open.

📦 0.3.1 - 2026-08-15​

✨ Added​

  • [Issue #548] Add a blocking CI gate that fails a pull request when project.yml interpolates a function environment variable that is not declared as configured on the DigitalOcean app.
    • App Platform hard-fails the entire deploy on an unconfigured variable, so the previous failure mode was a tagged release that never shipped while the site kept serving the prior build. The declared list is an assertion about production — configure the variable upstream first, then add its line.

🐛 Fixed​

  • [Issue #548] Widen the changelog-fragment CI exemption so it covers every release-collating pull request to main, not only release/* promotions.
    • The 0.3.0 exemption keyed on the branch name, which left the ordinary hotfix flow unmergeable: collation deletes the fragment it consumes, so a PR that follows the documented version-bump process adds none and the gate failed it. Detection now keys on the added ## [X.Y.Z] section, which survives even when a fragment is authored and collated before the first commit and therefore never appears in the diff at all.

📦 0.3.0 - 2026-08-15​

✨ Added​

  • [Issue #389] Add CI guardrail that fails PRs containing unpinned GitHub Actions references.
  • [Issue #408] Document the changelog.d/ per-PR fragment convention in-repo and add a CI check that flags PRs missing a fragment.
    • The check became a required gate under #447, which also automated release-time collation of fragments into CHANGELOG.md; the remaining release-workflow wiring is tracked in #473.
  • [Issue #410] Add a back-merge-stable-to-develop GitHub Actions workflow that back-merges main into develop on every push to main, pushing directly when the merge is clean and opening a conflict PR otherwise, so develop never silently falls behind the stable branch.
    • The sync is one-way by design: develop -> main promotion stays a deliberate release step and is not automated.
  • [Issue #414] Add a self-service /signup page and serverless proxy that forwards new signups to the API's POST /v1/signup.
  • [Issue #415] Add the /verify email-verification landing page that completes signup and routes users into the portal.
  • [Issue #416] Add a public pricing page with the finalized Starter/Pro/Enterprise tiers and a live founding-slots indicator that swaps the signup CTA for a waitlist CTA when the combined launch pool is full.
  • [Issue #422] Track /signup CTA clicks and route signup form events through the shared AnalyticsEvents module.
    • Signup events are now gated by the module's production check, so they no longer fire in local development.
  • [Issue #424] Add a one-click "resend verification email" action to the /verify expired-token state.
    • Off by default behind the SIGNUP_RESEND_ENABLED flag; enable only once POST /v1/signup/resend is live in the API.
  • [Issue #426] Document the PORTAL_LOGIN_URL deployment variable that turns the /verify success state into a direct portal login link.
    • Build-time only: Docusaurus reads it during npm run build, so the value must be set with build scope and a redeploy is required for a change to take effect.
  • [Issue #431] Add a CI guardrail that fails PRs to main when CHANGELOG.md has unreleased changes but no version section for the next release, pointing the author at /version-bump.
  • [Issue #437] Extend the changelog release-readiness gate to block PRs to main while un-collated changelog.d/ fragments are pending.
    • Release PRs must now collate and delete pending fragments before merge; the gate lists the offending files.
  • [Issue #438] Warn (non-blocking) when the CHANGELOG compare-link footer is missing the next release's version entry.
  • [Issue #442] Document the main → develop back-merge as an explicit step in the release runbook, covering the automated back-merge-stable-to-develop workflow, the operator verification check, and the manual fallback.
  • [Issue #447] Collate changelog.d/ fragments into the new versioned section of CHANGELOG.md automatically at release time, delete the consumed fragments, and fail CI when a PR adds no fragment.
    • The changelog.d/ CI check changes from advisory to a required gate; dependabot and docs-only PRs are exempt.
  • [Issue #451] Add a public data-coverage page documenting what the catalog contains, what is explicitly out of scope, access limits, and /v1 versioning, with counts fetched live from /v1/stats/counts.
  • [Issue #452] Add a scheduled synthetic healthcheck for the public stats proxy that auto-files an issue when live counts stop resolving.
    • Detection only — the production 401 itself requires an operator to reissue TRADING_CARD_API_TOKEN and redeploy the DigitalOcean Functions.
  • [Issue #456] Extend the scheduled stats-proxy healthcheck to probe the snapshots reads behind the homepage growth charts, not just the headline counts.
    • All probes run in one job so a combined outage still files a single issue.
  • [Issue #473] Skip and remove changelog.d/ fragments whose issue already shipped in a released version section, so a stale fragment cannot double-list an entry at release time.
    • Adds scripts/version/commit-changelog-back.sh for persisting the collated CHANGELOG back to the release branch; wiring it into build-release.yaml is still outstanding.
  • [Issue #474] Add a blocking CI check that fails when a private-repo GitHub URL appears in published docs.
    • Existing violations are grandfathered in scripts/validation/known-private-link-files.txt; a PR that fixes one must delete its entry or the check fails.
  • [Issue #478] Add a real ESLint 9 flat-config lint gate, replacing the no-op lint placeholder and wiring it into CI.
    • Deletes the orphaned legacy .eslintrc.js; no-console remains a non-blocking warning, so only errors fail the build.

🔧 Changed​

  • Add Issue Creation section to CLAUDE.md (#382) - Direct agents to use the create_cross_repo_issues MCP tool instead of raw gh issue create.
  • [Issue #307] Add natural "sports card" coverage to the homepage, social/meta tags, /api and /early-access pages, getting-started overview, and a new keyword-targeted blog post.
  • [Issue #420] Align the early-access form's submit, success, and error copy with the founding-list framing, and link the founding-list confirmation page from the success state.
    • The early_access_application analytics event name is intentionally unchanged, so GA4 reporting stays continuous across the copy change.
  • [Issue #425] Reconcile the signup verification client mapping with the shipped POST /v1/signup/verify contract and handle the already-verified response.
  • [Issue #434] Centralize the public launch date in siteConfig.customFields.launchDate and render it through a shared LaunchDate component.
    • The description frontmatter on /early-access cannot interpolate and stays literal; a guard test fails if it drifts from the config value.
  • [Issue #450] Extend "sports card" keyword coverage to the generated code-example pages and rendered image alt text.
    • Code-example copy must be edited in scripts/content/generate-api-docs.js; edits made only to docs/examples/*.md are overwritten by prestart/prebuild.
  • [Issue #457] Gitignore the CI-layout tradingcardapi-api/ checkout and document the API-repo build prerequisite and its env vars in README.md.
  • [Issue #466] Fail the docs build on broken links, broken anchors, and broken Markdown links instead of warning.
    • onBrokenMarkdownLinks moves from the deprecated top-level config key to markdown.hooks; a PR that breaks an internal link or heading anchor now fails CI rather than building green.
  • [Issue #467] Retire the stale duplicate API changelog generator so the configurable-path resolution from #464 applies to the api-changelog-update workflow too.
    • That workflow now hard-fails under CI when the API repo is missing instead of emitting fallback stub content, so it checks out cardtechie/tradingcardapi-api like ci.yaml already does.

🐛 Fixed​

  • [Issue #427] Repoint the docs "create an account" links from the 404ing api.tradingcardapi.com/register to the live /early-access founding-reservation page and remove the free-tier claim.
  • [Issue #440] Validate release notes against [Unreleased] on non-main PRs so develop PRs no longer fail with "No changelog content found" after a hotfix-to-main lands a new tag.
  • [Issue #443] Reconcile the signup and verify serverless proxies with the API's JSON:API contract and add a waitlist state to email verification.
  • [Issue #445] Render a distinct waitlist state in the signup form when the API returns a signup-time waitlist outcome instead of misreporting it as "check your email to verify".
  • [Issue #455] Document that the signup and slots function packages are develop-only and that their production 404s are expected until launch.
    • Documentation only — no runtime or deploy behavior changes; the reported routing defect was a false alarm.
  • [Issue #459] Stop requiring a pre-claimed ## [X.Y.Z] CHANGELOG section on PRs to main so concurrent PRs can no longer collide on the same version number.
    • The release-readiness gate now warns instead of failing on a missing version section, but newly hard-fails on a duplicated or already-tagged one.
  • [Issue #461] Correct the published API rate limits to match what the API enforces — anonymous 100/hour, authenticated 2,000/hour, and custom per-client limits — replacing the Free/Premium/Enterprise tiers, monthly quotas, and burst limits that were never implemented.
    • Also removes the duplicated and contradictory figures from the getting-started overview, which now links to the rate-limits guide and /pricing instead of restating numbers.
  • [Issue #464] Make npm run build runnable in a runner workspace clone by resolving the API CHANGELOG.md from the <owner>__<repo> pool layout or an API_CHANGELOG_PATH override, degrading to a warning outside CI, and skipping regeneration of the tracked generated changelogs when DOCS_SKIP_GENERATED_CHANGELOG=1.
    • CI behavior is unchanged: with CI=true a missing API source still hard-fails the build.
  • [Issue #468] Maintain the CHANGELOG compare-link footer programmatically in update-changelog.sh instead of via a manual release step, and backfill the missing 0.2.66 and 0.2.67 compare links.
  • [Issue #475] Remove all private-repo GitHub links from the published API changelog page and its generator.
  • [Issue #476] Replace the eight private-repo GitHub CTAs in the published docs changelog footer with public destinations (/docs/support/, /blog/, and email), drop the sections that have no public equivalent, and point the "current version" reference at the on-page version history instead of a private package.json.
    • scripts/content/generate-docs-changelog.sh is the source of truth; docs/changelog.md is regenerated from it, so a fix applied only to the tracked file would be reverted by the next npm run prebuild.
  • [Issue #480] Derive the API changelog workflow's changes_detected from git state instead of an unreachable exit-code branch, so a run that changes nothing no longer opens a pull request with an empty diff.
  • [Issue #542] Exempt release promotions (release/* → main) from the changelog-fragment CI gate, which no promotion could ever satisfy.
    • A promotion deletes the accumulated fragments rather than adding one, and the release-readiness gate hard-fails a PR to main while any fragment is pending — so the two gates contradicted each other on this path. The release-readiness gate still runs and stays authoritative.

🔐 Security​

  • [Issue #535] Upgrade the dependency tree and clear the Dependabot backlog in one lockfile regeneration, taking npm audit from 43 advisories to 2 and resolving both criticals (websocket-driver, shell-quote) along with every moderate and low alert.
    • The two that remain are high-severity image-size denial-of-service alerts, accepted rather than fixed: no patched version exists and Docusaurus still depends on ^2.0.2.

📦 0.2.67 - 2026-08-10​

🐛 Fixed​

  • Regenerate the published OpenAPI spec (#453) - Replaced the frozen 0.7.18 / 37-path static/openapi.json snapshot with the shipped 61-path spec stamped at the released API version, and made regeneration automatic: the docs generator now resolves the spec from an API repository checkout (or the live API) instead of silently reading the committed snapshot, a chore/openapi-sync workflow opens a sync PR on API release, and CI reports drift between the published spec and the API.

📦 0.2.66 - 2026-07-03​

🔧 Changed​

  • Founding-access site copy (#432, #433) - Removed the "reserved" overpromise across the funnel (early-access page, submission confirmation, homepage) in favor of accurate priority-notification framing: applying joins a founding list that is notified ahead of the public when a slot opens. States the 5 initial founding slots (expanding as the API scales), replaces the permanent price-lock language with founding + grace-period wording, links cardalmanac.com as a live proof point, and adds "teams" to the data-model list.
  • Extend founding reframe to shared components and docs (#432, #433) - Applied the same "founding list" framing to the BetaNotice and HomepageFeatures components, the EarlyAccessForm success message, and the support/rate-limit docs, replacing the "Early Access Program" and "Grandfathered Terms / lock in pricing" language.

📦 0.2.65 - 2026-07-03​

🔧 Changed​

  • Re-point /early-access to founding reservation page (#417) - Replaced the stale $99/month pricing with the finalized Starter $19/mo (1,000 req/day) and Pro $49/mo (10,000 req/day) tiers, and re-messaged the page as a founding reservation with founding + grace-period framing (no "price lock for life"). Brevo List 9 capture wiring is unchanged.

📦 0.2.64 - 2026-04-12​

🔐 Security​

  • Pin GitHub Actions to commit SHAs (#371) - Replaced all mutable @vN tag references with pinned @<commit-sha> # vN format across all workflow files for supply chain security hardening.

📦 0.2.63 - 2026-04-11​

✨ Added​

  • Add auto-assign sprint workflow (#368) - New GitHub Actions workflow that automatically assigns newly opened issues to the current sprint iteration on the org project board.

📦 0.2.62 - 2026-04-02​

🔒 Security​

  • Resolve all security vulnerabilities (#364) - Fixed all 32 npm audit vulnerabilities (13 high, 19 moderate) by upgrading dependencies and adding npm overrides for lodash-es and path-to-regexp. Supersedes Dependabot PRs #347, #351, #352.

📦 0.2.61 - 2026-04-02​

🔧 Improvements​

  • Upgrade actions/setup-node to v5 (#363) - Updated actions/setup-node from v4 to v5 in all GitHub Actions workflows (CI, Build Release, API Changelog Update) to support the Node.js 24 runtime before the June 2, 2026 enforcement date.

📦 0.2.60 - 2026-04-02​

🔧 Improvements​

  • Fix deploy workflow deprecation warnings (#350) - Replaced unmaintained avakar/set-deployment-status@v1 and avakar/create-deployment@v1 with actively maintained chrnorm/deployment-status@v2 and chrnorm/deployment-action@v2 across both deploy workflows, eliminating all 5 deprecation warnings (Node.js runtime and set-output command).
  • Remove unnecessary checkout from deploy workflow (#350) - Removed the actions/checkout step from the deployment workflow since no subsequent steps use checked-out files, reducing workflow runtime.

📦 0.2.59 - 2026-04-02​

🔒 Security​

  • Prevent shell injection in changelog PR script (#360) - Replaced all execSync shell string interpolation with execFileSync using argv arrays in create-changelog-pr.js to prevent shell command injection from attacker-controlled repository_dispatch payload values. Removed unreferenced vulnerable copy in scripts/automation/.

✨ Features​

  • Shell injection safety tests (#360) - Added 60 tests covering execFileSync argv safety, shell metacharacter injection payloads, orchestration logic, and module exports for the changelog PR creation script.

📦 0.2.58 - 2026-04-02​

🔒 Security​

  • Remediate expression injection in CI workflow (#345, #359) - Moved all ${{ }} expressions out of shell run: blocks into env: blocks in api-changelog-update.yml to prevent GitHub Actions expression injection attacks via crafted repository_dispatch payloads.
  • Remove duplicate workflow file (#345, #359) - Deleted duplicate .yaml variant of the changelog workflow that would have executed alongside the fixed .yml version, leaving the vulnerability open.

✨ Features​

  • Workflow security regression tests (#345, #359) - Added 30 automated tests to prevent reintroduction of expression injection vulnerabilities in GitHub Actions workflow files.

📦 0.2.57 - 2026-04-02​

🐛 Bug Fixes​

  • DO Functions entry point naming (#357, #358) - Renamed function files from brevo-proxy.js / stats-proxy.js to index.js. DO Functions require the entry point to be named index.js, causing all invocations to fail with "The function did not initialize properly."

📦 0.2.56 - 2026-04-01​

🐛 Bug Fixes​

  • Revert DO Functions runtime to nodejs:18 (#356) - Reverted from nodejs:22 back to nodejs:18, the runtime that was in use when the functions last worked. The built-in https module works on all Node.js versions.

📦 0.2.55 - 2026-04-01​

🐛 Bug Fixes​

  • DO Functions zero-dependency rewrite (#355) - Replaced axios with Node.js built-in https module in both proxy functions. Neither fetch nor axios work reliably in the DO Functions runtime — the built-in https module requires zero external dependencies and is guaranteed to be available.

📦 0.2.54 - 2026-04-01​

🐛 Bug Fixes​

  • DO Functions axios dependency (#354) - Added package.json to both proxy function directories to explicitly install axios. Pre-installed runtime packages are not available when Functions are deployed via App Platform.

📦 0.2.53 - 2026-03-30​

🐛 Bug Fixes​

  • DO Functions proxy crash (#353) - Replaced fetch with axios in both brevo-proxy and stats-proxy DigitalOcean Functions. The DO Functions runtime does not provide the native fetch API, causing both proxies to crash on every invocation.

🔧 Improvements​

  • Runtime upgrade (#353) - Upgraded DigitalOcean Functions runtime from nodejs:18 (EOL) to nodejs:22.

📦 0.2.52 - 2026-03-29​

🐛 Bug Fixes​

  • Early Access Form Error Display (#348) - Fixed unreadable error message caused by OS dark mode CSS conflicting with the light-only Docusaurus theme. Error text is now clearly visible regardless of OS settings.
  • Early Access Form Brevo Integration (#348) - Added retry logic with exponential backoff for transient proxy failures (502/503/504), a fallback email contact option when the form is unavailable, and diagnostic logging to speed up debugging future issues.

🔒 Security​

  • Removed PII from mailto fallback link (#348) - User form data is no longer embedded in the mailto URL, preventing exposure via browser history and referrer headers.

📦 0.2.51 - 2026-03-21​

🔐 Security​

  • Updated axios, react/react-dom, and dev dependencies (babel-jest, jest, jest-environment-jsdom, dotenv) to latest secure versions via a combination of Dependabot PRs (#335, #337, #338, #339, #341) and follow-up npm audit fix changes (#343)
  • Resolved security vulnerabilities via npm audit fix: svgo (CVE-2026-29074), minimatch (CVE-2026-27904, CVE-2026-27903, CVE-2026-26996), axios (CVE-2026-25639), dompurify (CVE-2026-0540), ajv (CVE-2025-69873), lodash-es (CVE-2025-13465), qs (CVE-2026-2391), webpack (CVE-2025-68157, CVE-2025-68458) (#343)
  • Added serialize-javascript override to ^7.0.3 to resolve RCE vulnerability (GHSA-5c6j-r48x-rmvq) in Docusaurus transitive dependency (#343)
  • Updated actions/upload-artifact from v4 to v7 in CI workflow (PR #340) (#343)

📦 0.2.50 - 2026-03-22​

🔄 API Updates​

  • Updated Trading Card API documentation to match the 0.2.50 backend release and regenerated the changelog to reflect new and updated endpoints.

📦 0.2.49 - 2026-02-02​

🔧 Changed​

  • Renamed CI workflow jobs for clarity: "Build and Deploy" → "Build and Release", "Deploy" → "Trigger Deployment" (#328)

📦 0.2.48 - 2026-02-02​

🐛 Fixed​

  • Fix timezone-related test flakiness in StatsCounter date parsing (#318)

📦 0.2.47 - 2026-02-02​

🐛 Fixed​

  • Fixed inconsistent emoji handling in changelog generator script for Improved, Security, Dependencies, and Deprecated categories (#331)

📦 0.2.46 - 2026-02-02​

🔐 Security​

  • Update lodash from 4.17.21 to 4.17.23 to fix prototype pollution vulnerability (#327)

🔧 Changed​

  • Update axios from 1.13.2 to 1.13.3
  • Update @babel/preset-env from 7.26.0 to 7.28.6
  • Update @testing-library/react from 16.1.0 to 16.3.2
  • Update jest from 29.7.0 to 30.2.0
  • Update jest-environment-jsdom from 29.7.0 to 30.2.0

📦 0.2.45 - 2026-02-02​

✨ Added​

  • Unit test coverage for brevo-proxy DigitalOcean Function (#326)

📦 0.2.44 - 2026-02-02​

🐛 Fixed​

  • Fixed Brevo proxy returning HTTP 204 which caused frontend JSON parse failures (#324)

📦 0.2.43 - 2026-01-05​

🔧 Changed​

  • CI workflow now runs Jest unit tests before building (#317)
    • Added npm test step with TZ=UTC for consistent date handling across timezones

🐛 Fixed​

  • Fixed Brevo API tests to use new proxy-based architecture (#317)
  • Fixed escapeMdxBraces tests to use exported function instead of local copy (#317)
  • Fixed StatsCounter date filtering test to not rely on specific sort order (#317)
  • Fixed Jest config typo: coverageThresholds → coverageThreshold (#317)

📦 0.2.42 - 2026-01-05​

💎 Improved​

  • Implemented stale-while-revalidate caching for StatsCounter (#315)
    • Shows cached stats immediately on page load, refreshes in background
    • Only shows error if no cached data exists AND API fetch fails
    • Eliminates "Unable to load stats" errors when API is slow or temporarily unavailable

📦 0.2.41 - 2026-01-05​

🔐 Security​

  • Moved Brevo API key to server-side proxy to prevent client-side exposure (#305)
    • Created DigitalOcean Function proxy at packages/brevo/brevo-proxy/brevo-proxy.js
    • Added security hardening: email validation, attribute whitelisting, input sanitization
    • Updated NewsletterForm and EarlyAccessForm to use proxy
    • Removed BREVO_API_KEY from customFields in docusaurus.config.js

📦 0.2.40 - 2026-01-04​

🐛 Fixed​

  • Fixed Growth Over Time chart x-axis showing dates in reverse order (#306)

📦 0.2.39 - 2026-01-04​

🔧 Changed​

  • Updated React from 18.x to 19.x (#308)
  • Updated GitHub Actions (checkout v6, setup-node v6, upload-artifact v6) (#308)

🐛 Fixed​

  • Fixed MDX build error in API changelog by escaping curly braces in URL path parameters (#308)

🔐 Security​

  • Fixed security vulnerabilities in mdast-util-to-hast, qs, express, node-forge (#308)

📦 0.2.38 - 2025-12-19​

✨ Added​

  • Set Types concept documentation explaining base, parallel, variation, insert, and other set types (#298)
  • Synced full OpenAPI specification from API repository with complete Set schema
    • Set type flags: is_parallel, is_insert, is_autograph, is_relic, is_variation
    • Additional fields: title, card_count, current_card_count, serial, number_prefix, parent_set
    • Relationship IDs: genre_id, manufacturer_id, brand_id, year_id

📦 0.2.37 - 2025-12-12​

🐛 Fixed​

  • Fixed StatsCounter proxy endpoint path for DigitalOcean Functions (#294)
    • Changed path from /api/stats/stats-proxy to /api/stats/stats/stats-proxy
    • Matches DigitalOcean Functions path structure: /$namespace/$package/$function

📦 0.2.36 - 2025-12-12​

✨ Added​

  • Added DigitalOcean Function proxy for stats API authentication (#290)
    • Created serverless proxy function at packages/stats/stats-proxy/stats-proxy.js
    • API token kept server-side, never exposed to client code
    • Function accessible via /api/stats/stats/stats-proxy when deployed with App Platform
    • Updated StatsCounter to use proxy endpoints instead of direct API calls

🔐 Security​

  • API authentication tokens no longer exposed in client-side code (#290)
    • Stats proxy uses environment variable TRADING_CARD_API_TOKEN
    • Proxy validates endpoints to prevent open proxy abuse (only counts, snapshots, growth allowed)
    • Query parameters filtered to only allow expected values per endpoint

📦 0.2.35 - 2025-12-03​

✨ Added​

  • Added public stats counter component to homepage (#285)
    • Displays real-time published cards and sets counts from the API
    • Includes 90-day growth chart showing database growth over time
    • Fetches data from /v1/stats/counts and /v1/stats/snapshots endpoints
    • Responsive design with loading and error states

🔧 Changed​

  • Replaced static "Early Access" Stats section with dynamic StatsCounter (#285)

📦 Dependencies​

  • Added chart.js and react-chartjs-2 for growth visualization (#285)

📦 0.2.34 - 2025-11-23​

🐛 Fixed​

  • Fixed newsletter subscription failing with "Template id is missing" error (#278)
    • Switched to Template 14 for Brevo double opt-in confirmation
    • Template 6 was not recognized as valid DOI template despite correct configuration
    • Newsletter signups now successfully send confirmation email
  • Fixed unreadable newsletter success message in dark mode (#278)
    • Success message had dark green text on dark green background
    • Added CSS overrides to force light mode styling for better contrast
  • Fixed API changelog date conversion causing off-by-one errors (#278)
    • Dates were being converted from UTC which shifted them to previous day
    • Now parses date components manually to preserve correct dates
    • Dates display in readable format (e.g., "November 22, 2025") with correct values
  • Fixed React 18 deprecation warning for createRoot (#278)
    • Changed import from 'react-dom' to 'react-dom/client'
    • Removes console warning in development

🔐 Security​

  • Removed sensitive API key exposure from production console logs (#278)
    • Created safe logger utility that sanitizes API keys
    • Replaced all console.log/error/warn with logger utility
    • API keys no longer visible in browser console

✨ Added​

  • Created unit tests for Brevo API integration (#278)
    • Tests verify templateId is always included in subscribe()
    • Tests verify no console.log statements execute
    • Regression tests to prevent future breaks
  • Added ESLint configuration with no-console rule (#278)
    • Warns on console usage in development
    • Errors on console usage in production builds
  • Created safe logging utility (src/utils/logger.js) (#278)
    • Dev-only logging with automatic API key sanitization
    • Production-safe error logging

📦 0.2.33 - 2025-11-22​

🔧 Changed​

  • Made "Tell Us About Your Project" field required in early access application form (#276)
  • Updated early access messaging to rolling basis acceptance instead of fixed capacity
  • Updated API access description to clarify read-only beta access

📦 0.2.32 - 2025-11-22​

🔄 API Updates​

  • API Release 0.7.5 - Updated documentation with latest API release information and synchronized changelog

📦 0.2.31 - 2025-11-16​

🐛 Fixed​

  • Fixed backticks still being interpreted in build-release workflow (#271)
    • Changed from echo to printf to prevent ALL shell interpretation
    • Resolves backticks being stripped from release notes
    • Resolves validation script being accidentally executed during release note generation
    • Fixes command substitution errors that occurred despite using --notes-file
  • Fixed wrong version comparison link in release notes (#271)
    • Changed auto-detection to use most recent tag (not 2nd most recent)
    • Script runs before new tag exists, so it should compare against the current latest
    • Fixes comparison links showing wrong previous version (e.g., 0.2.28 instead of 0.2.29)

📦 0.2.30 - 2025-11-16​

🐛 Fixed​

  • Fixed build-release workflow failing with backticks in release notes (#267)
    • Updated GitHub Actions workflow to use --notes-file instead of inline --notes
    • Prevents shell interpretation of markdown backticks as command substitution
    • Resolves "command not found" errors during automated releases
  • Fixed update-changelog.sh creating CHANGELOG.md in wrong location (#267)
    • Corrected PROJECT_ROOT path calculation (now goes up 2 levels instead of 1)
    • CHANGELOG.md now correctly updates in project root instead of scripts/ directory

✨ Added​

  • Added release notes validation script (#267)
    • New scripts/validation/validate-release-notes.sh validates changelog structure
    • Checks for shell-unsafe characters in release notes
    • Verifies release notes can be generated successfully
    • Runs automatically in CI on all PRs to main/develop/release branches
    • Prevents merge if validation fails

📦 0.2.29 - 2025-11-16​

✨ Added​

  • OAuth scopes and authorization documentation for v0.6.0 (#244)
    • NEW: Authorization and OAuth Scopes concepts page - Comprehensive 700+ line guide covering:
      • Five granular OAuth scopes: read:published, read:draft, read:all-status, write, delete
      • Status-based access control and automatic filtering
      • Scope combinations for different use cases (public apps, admin tools, CMS)
      • Requesting scopes with code examples in 4 languages (PHP, JavaScript, Python, cURL)
      • Security best practices and principle of least privilege
      • Troubleshooting scope errors (insufficient_scope, not seeing expected data)
      • Migration guide from simple read/write scopes to granular scopes
    • Enhanced Getting Started authentication guide with "Understanding OAuth Scopes" section
    • Updated all OAuth authentication examples to use granular scopes (read:published write)
    • Added to Concepts section in navigation
    • Clarified scope selection for Personal Access Tokens
  • NEW: How-To section - Task-focused step-by-step tutorials (#243)
    • Created new "How-To" documentation category positioned between Concepts and Guides
    • Clear separation: Concepts (reference) → How-To (tasks) → Guides (applications)
    • NEW: Upload Card Images tutorial - Comprehensive 900+ line step-by-step guide covering:
      • Image preparation and validation requirements
      • Complete upload workflow for front and back images
      • Code examples in 4 languages (PHP, JavaScript, Python, cURL) with error handling
      • Retrieving and verifying uploaded images with ?include=images
      • Responsive display techniques using automatic thumbnails
      • Update and delete operations
      • Inline troubleshooting at each step (file size, dimensions, MIME types, duplicates, auth errors)
      • Cross-links to advanced guides (responsive images, CDN integration, building card tracker)
    • How-To index page with section overview and navigation
    • Scalable structure for future task-focused tutorials
  • Card Images highlighted in Getting Started guide (#242)
    • Added Card Images to core resources table in introduction.md
    • Added Card Images to Core Resources diagram in overview.md
    • Enhanced "Image Delivery" section to "Card Images & Delivery" with upload/management capabilities
    • Linked to Working with Images guide for detailed documentation
    • Card Images now prominently featured as a core API capability (v0.7.0)
  • Card model documentation updates for v0.6.0 and v0.7.0 (#240)
    • NEW: Card code examples section - Comprehensive examples showing image_uuid field and ?include=images parameter
    • Code examples in all 4 languages (PHP, JavaScript, Python, cURL) demonstrating:
      • Fetching cards with image_uuid field (v0.6.0+)
      • Including card images in responses using ?include=images (v0.7.0+)
      • Listing cards with images and processing included resources
    • Updated Building Card Tracker guide:
      • Added image_uuid to Card data structure example
      • Added images relationship to Card data structure
      • NEW: "Fetching Cards with Images" section - Practical examples showing efficient image fetching patterns
    • Created API repo issue #1089 for OpenAPI spec updates (missing images relationship documentation)
  • Set Sources API documentation for v0.6.0 (#239)
    • NEW: Data Provenance and Set Sources concepts page - Comprehensive guide explaining what Set Sources are, why to use them, and best practices
    • Comprehensive code examples in all 4 languages (PHP, JavaScript, Python, cURL)
    • Create, list, retrieve, update, and delete set source operations
    • Filter sources by set ID examples
    • Include sources in set requests (?include=sources)
    • Source verification tracking examples
    • Track multiple source types (checklist, metadata, images)
    • Added "Set Source Tracking and Data Attribution" section to Collection Management guide
    • Practical integration examples for data provenance and verification
    • Best practices for source management and attribution
    • Added Data Quality section to Concepts index
  • Comprehensive card images code examples for all languages (#238)
    • NEW: cURL examples - Complete command-line examples for all Card Images operations
    • Enhanced PHP examples with file validation, error handling, update/delete operations
    • Enhanced JavaScript examples with upload progress tracking using axios
    • Enhanced Python examples with progress tracking using requests-toolbelt
    • Upload examples with file size and type validation in all languages
    • List card images examples for filtering by card ID
    • Download examples with CDN redirect handling and error checking
    • Update image metadata examples (changing front/back type)
    • Delete card image examples with error handling
    • Batch download examples for all size variants
    • Added cURL to code examples index and navigation sidebar
    • All examples include comprehensive error handling and best practices
  • Personal Access Token (PAT) authentication documentation for v0.6.0 (#241)
    • Comprehensive PAT authentication guide with step-by-step token generation
    • Comparison table between OAuth 2.0 and PAT authentication methods
    • Code examples for PAT initialization in PHP, JavaScript, and Python
    • Security best practices for token management and storage
    • Token management guide (viewing, revoking, rotating)
    • PAT troubleshooting section with common issues and solutions
    • Updated authentication overview to include both OAuth and PAT methods
    • Updated Getting Started guide to mention PAT as development-friendly option
    • Enhanced all code examples with PAT authentication alongside OAuth
  • Card Images API documentation for v0.7.0 (#234)
    • Complete endpoint reference for all 6 Card Images endpoints
    • Comprehensive "Working with Images" guide with upload, download, and management examples
    • File upload examples in PHP, JavaScript, and Python code examples
    • Card image management section in Building Card Tracker guide
    • Image validation, caching, and best practices documentation
    • Support for front/back images with size variants (thumbnails)
  • Image thumbnails and responsive images documentation (#235)
    • New "Responsive Card Images" comprehensive guide with srcset, sizes, picture element, and lazy loading
    • Responsive image code examples in PHP, JavaScript, and Python
    • Detailed thumbnail size specifications (small 150px, medium 300px, large 600px)
    • Enhanced download endpoint documentation with size variant details
    • Performance best practices for responsive image delivery
    • Framework integration examples (React, Vue, vanilla JS)
  • CDN integration documentation for v0.7.0 (#236)
    • Comprehensive "CDN Integration" guide with versioned URLs and cache invalidation
    • CDN redirect behavior documentation (302 to CDN, not proxied)
    • Cache header documentation (1-year TTL, immutable directive)
    • Global edge delivery and performance optimization guide
    • URL structure and version parameter documentation
    • Complete integration examples in PHP, JavaScript, and Python
    • Troubleshooting guide for CDN-related issues
    • Performance expectations and monitoring best practices

🔧 Changed​

  • Simplified release notes generation to use CHANGELOG.md content directly (#228)
  • Updated GitHub release v0.2.23 with actual changelog content instead of generic placeholders
  • Updated OpenAPI specification from API repository (includes Card Images API)
  • Enhanced documentation generator script with multipart/form-data file upload examples
  • Enhanced documentation generator with responsive image examples (#235)
  • Updated "Working with Images" guide with cross-references to responsive images guide (#235)
  • Updated code examples to use versioned CDN URLs (#236)
    • PHP examples show fetching metadata with versioned URLs
    • JavaScript examples include React component with CDN URLs
    • Python examples demonstrate Flask/Django integration with versioned URLs
  • Enhanced "Responsive Card Images" guide with versioned URL documentation (#236)
  • Updated "Working with Images" guide with CDN delivery information (#236)
  • Added CDN integration to Getting Started overview (#236)
  • Added CDN Integration to Concepts index (#236)

🐛 Fixed​

  • Corrected image size specifications in "Working with Images" guide (was 400px/800px/1200px, now correctly 150px/300px/600px) (#235)

🗑️ Removed​

  • Automatic git commit parsing from release notes generation (#228)
  • Generic placeholder content from release notes generator
  • Deployment information section from release notes
  • Contributing links section from release notes

📦 0.2.28 - 2025-11-15​

🔧 Changed​

  • Updated API changelog documentation to include version 0.7.3
  • Updated release statistics to reflect latest API version 0.7.3
  • Updated version information throughout API changelog

🔄 API Updates​

  • API Release 0.7.3 - Updated documentation with latest API release information and synchronized changelog

📦 0.2.27 - 2025-11-15​

🔧 Changed​

  • Updated API changelog documentation to include version 0.7.2
  • Updated release statistics to reflect latest API version 0.7.2
  • Updated version information throughout API changelog

🔄 API Updates​

  • API Release 0.7.2 - Updated documentation with latest API release information and synchronized changelog

📦 0.2.26 - 2025-11-15​

🔧 Changed​

  • Updated API changelog documentation to include version 0.7.1
  • Updated release statistics to reflect latest API version 0.7.1
  • Updated version information throughout API changelog

🔄 API Updates​

  • API Release 0.7.1 - Updated documentation with latest API release information and synchronized changelog

📦 0.2.25 - 2025-11-15​

🔧 Changed​

  • Updated API changelog documentation to include version 0.7.0
  • Updated release statistics to reflect latest API version 0.7.0
  • Updated version information throughout API changelog

🔄 API Updates​

  • API Release 0.7.0 - Updated documentation with latest API release information and synchronized changelog

📦 0.2.24 - 2025-11-11​

🔧 Changed​

  • Updated API changelog documentation to include versions 0.6.0 and 0.6.1
  • Updated release statistics to reflect latest API version 0.6.1
  • Updated version information throughout API changelog

🔄 API Updates​

  • API Release 0.6.1 - Updated documentation with API version 0.6.1 changelog (version script hotfix)
  • API Release 0.6.0 - Updated documentation with API version 0.6.0 changelog (major feature release)

📦 0.2.23 - 2025-11-08​

✨ Added​

  • Brevo API integration for email marketing (#207)
  • NewsletterForm component with double opt-in (#209)
  • EarlyAccessForm component with 6 fields and Brevo integration (#210)
  • Homepage newsletter signup section (#211)
  • Footer newsletter form (all pages) (#212)
  • Blog post newsletter section (#213)
  • Early Access application page at /early-access (#214)
  • Newsletter confirmation page at /newsletter-confirmed (#215)
  • Early access submitted page at /early-access-submitted (#215)
  • Newsletter subscription opt-in for early access applicants
  • First and last name capture in forms
  • Comprehensive form validation and analytics tracking
  • Comprehensive versioning and release system similar to API repository
  • Automated semantic version generation based on git history and branch types
  • Version management scripts (version.sh, version-bump.sh, version-preview.sh)
  • Automated changelog generation with commit categorization
  • GitHub Actions workflows for automated releases and deployments
  • CI workflow for build validation and script testing
  • Release notes generation for GitHub releases
  • GitHub deployment integration with DigitalOcean App Platform
  • Professional deployment tracking and status updates
  • Comprehensive PHP SDK documentation suite with detailed guides
  • SDK overview page with feature comparison and roadmap
  • Complete PHP SDK installation and setup guide
  • PHP SDK quick start guide with all usage patterns (facade, helper, direct class)
  • Detailed API resources reference covering all 10+ available resources
  • Comprehensive error handling documentation with exception hierarchy
  • Real-world PHP SDK examples (price tracking, collection management, marketplace integration)
  • Laravel-specific integration patterns (controllers, commands, jobs, testing)

🔧 Changed​

  • Simplified release workflows - removed unnecessary beta/RC workflows for documentation site
  • Reorganized version scripts with consistent .sh file extensions
  • Streamlined deployment process with controlled releases (auto-deploy disabled)
  • Updated PHP SDK documentation with correct package name and installation steps
  • Streamlined PHP SDK overview page to eliminate redundancy with sub-pages

🐛 Fixed​

  • Corrected PHP SDK package name from tradingcardapi/php-sdk to cardtechie/tradingcardapi-sdk-php
  • Fixed PHP SDK installation instructions to include Laravel-specific setup
  • Updated minimum requirements to PHP 8.1+ and Laravel 10.0+
  • Corrected GitHub repository links throughout PHP SDK documentation
  • Fixed PROJECT_ROOT path calculation in version-bump.sh script
  • Removed redundant lint step from CI workflow

🗑️ Removed​

  • Non-existent PHP SDK documentation site link from support section

📦 0.2.22 - 2025-11-05​

🔄 API Updates​

  • API Release 0.5.0 - Updated documentation with latest API release information and synchronized changelog

📦 0.2.21 - 2025-10-19​

🐛 Bug Fixes​

  • Documentation Changelog Missing Releases (#196) - Updated docs/changelog.md with missing release versions (0.2.18, 0.2.19, 0.2.20) that were previously only documented in CHANGELOG.md

🔧 Improvements​

  • Version Bump Automation - Added version-bump slash command for automated changelog management with git commit and push capabilities

📦 0.2.20 - 2025-10-19​

🐛 Bug Fixes​

  • DigitalOcean Production Build (#193, #195) - Added build:production script that bypasses prebuild hook for DigitalOcean deployments, preventing API changelog generation failures in production environment

📦 0.2.19 - 2025-10-19​

🐛 Bug Fixes​

  • API Changelog Automation Data Loss Prevention (#192) - Fixed API changelog automation to prevent data loss by removing fallback content generation, adding safety checks against mass deletions, and ensuring all workflows clone the API repository with proper authentication

📦 0.2.18 - 2025-10-10​

🐛 Bug Fixes​

  • Production URL in Release Notes (#181) - Re-fixed incorrect production URL in release notes generation after reverting initial fix

📦 0.2.17 - 2025-10-10​

🐛 Bug Fixes​

  • Production URL in Release Notes - Initial fix for incorrect production URL in release notes generation (reverted in next release)

📦 0.2.16 - 2025-10-09​

🐛 Bug Fixes​

  • Duplicate API Changelog Entries (#178, #179) - Fixed API changelog generation script that was creating duplicate entries for each release. Simplified mergeChangelog() to use API repository as single source of truth, eliminating duplication issues in docs/api/changelog.md

📦 0.2.15 - 2025-09-24​

✨ Features​

  • OAuth vs API Keys Blog Post (#170) - Added comprehensive blog post comparing OAuth 2.0 and API Key authentication methods, explaining rationale for current OAuth implementation and announcing upcoming API key support

📦 0.2.14 - 2025-09-19​

🔧 Improvements​

  • Automation PR Enhancement (#158) - Enhanced API changelog automation to include site changelog updates and version bumps, uses hotfix branch prefix, and provides comprehensive PRs with all necessary site maintenance

📦 0.2.13 - 2025-09-19​

🐛 Bug Fixes​

  • API Changelog File Replacement (#155) - Fixed API changelog generation script to preserve historical data instead of replacing entire file, maintaining all previous release information while adding new releases

📦 0.2.12 - 2025-09-19​

🐛 Bug Fixes​

  • Script Force Flag and Workflow Token (#150) - Fixed --force flag handling in PR creation script and updated workflow to use CHANGELOG_UPDATE_TOKEN for proper PR creation permissions

📦 0.2.11 - 2025-09-19​

🐛 Bug Fixes​

  • PR Creation Label Requirements (#147) - Removed label requirements from create-changelog-pr.js to fix PR creation failures

📦 0.2.10 - 2025-09-19​

🐛 Bug Fixes​

  • runCommand Null Reference Error (#145) - Fixed null reference error in create-changelog-pr.js script when execSync returns null with stdio inherit

📦 0.2.9 - 2025-09-19​

🐛 Bug Fixes​

  • PR Creation Script Path (#143) - Fixed script path and internal path issues in create-changelog-pr.js preventing automated PR creation

📦 0.2.8 - 2025-09-19​

🐛 Bug Fixes​

  • API Changelog Script Path (#141, #142) - Fixed incorrect script path in api-changelog-update.yaml workflow preventing changelog generation

📦 0.2.7 - 2025-09-19​

🐛 Bug Fixes​

  • Webhook Validation for Repository Dispatch (#139, #140) - Fixed webhook secret validation for repository_dispatch events to work with GitHub's webhook system

📦 0.2.6 - 2025-09-18​

🐛 Bug Fixes​

  • Deployment Creation Token (#137) - Fixed deployment creation to use DEPLOY_APP_TOKEN instead of GITHUB_TOKEN for proper permissions

📦 0.2.5 - 2025-09-18​

🐛 Bug Fixes​

  • Deployment Workflow Not Triggering (#135, #136) - Fixed deployment workflow to actually trigger using DEPLOY_APP_TOKEN and proper deployment event pattern

📦 0.2.4 - 2025-09-18​

🐛 Bug Fixes​

  • Version Calculation and Release Notes Debugging (#132, #133) - Fixed version calculation and added release notes visibility to build logs

📦 0.2.3 - 2025-09-18​

🐛 Bug Fixes​

  • Build Release Workflow Versioning (#130, #131) - Fixed semantic versioning and improved release notes extraction from CHANGELOG.md

📦 0.2.2 - 2025-09-18​

🐛 Bug Fixes​

  • Build Release Workflow Permissions (#128, #129) - Fixed workflow permissions and modernized release creation using GitHub CLI

📦 0.2.1 - 2025-09-18​

🐛 Bug Fixes​

  • Build Release Workflow (#126, #127) - Fixed script paths to use new scripts/version/ directory structure

📦 0.2.0 - 2025-09-18​

🚀 Major Features Added​

  • Automated API Changelog System (#100, #101, #102)
    • Webhook-based automation for zero-maintenance API changelog updates
    • Intelligent change detection preventing unnecessary PRs
    • Enterprise-grade security with webhook secret validation
    • Comprehensive error handling with retry logic and debugging artifacts
    • Structured JSON output for advanced automation consumption
  • Blog Featured Images (#88)
    • Professional responsive featured image support for all blog posts
    • Mobile-first design with breakpoints (300px → 200px → 150px)
    • Manual BlogImage component with professional styling
    • Featured images for all existing blog posts
  • Live API Changelog Integration (#86, #99, #103)
    • Real-time API release information display
    • Complete integration with API repository changelog
    • Automatic synchronization with API releases
  • Comprehensive PHP SDK Documentation (#83, #91, #92, #95)
    • Complete PHP SDK documentation suite with guides and examples
    • SDK overview page with feature comparison and roadmap
    • Installation, quickstart, and advanced usage documentation
    • PHP SDK changelog integration and display
  • Professional Documentation Infrastructure (#82, #85, #97, #98)
    • API rate limits and quotas comprehensive documentation
    • Public changelog page with user-friendly formatting
    • Enhanced documentation structure and navigation

🔧 Technical Infrastructure Added​

  • Versioning and Release System (#84, #90)
    • Automated semantic version generation based on git history
    • Version management scripts (version.sh, version-bump.sh, version-preview.sh)
    • Automated changelog generation with commit categorization
    • GitHub Actions workflows for automated releases and deployments
  • CI/CD Pipeline Enhancements
    • Comprehensive CI workflow for build validation and script testing
    • Release notes generation for GitHub releases
    • GitHub deployment integration with DigitalOcean App Platform
    • Enhanced error handling and debugging capabilities

📝 Content and Documentation Added​

  • Professional Blog Content (#28, #43, #87, #89)
    • Trading Card API v0.4.0 release announcement blog post
    • Initial blog posts improving blog page display
    • Professional blog structure and formatting
  • Comprehensive Developer Guides (#29, #30, #31, #32, #33, #34, #44, #45, #46, #47, #48, #50)
    • Card price tracking application development guide
    • Collection management application development guide
    • Marketplace integration comprehensive guide
    • Mobile application integration guide
    • Data analysis applications development guide
    • Authentication services implementation guide
  • Enhanced Site Infrastructure (#35, #36, #49, #65, #66, #67)
    • Beta notice/disclaimer system for documentation pages
    • Comprehensive Google Analytics setup for production site
    • Fixed and updated all footer links with proper navigation

🔧 System Improvements and Optimizations​

  • API Reference and Navigation (#25, #27, #39, #40, #41, #42)
    • Updated and fixed API reference page functionality
    • Renamed master branch to main with updated workflows
    • Added admin site link to header navigation
    • Enhanced API reference structure and usability
  • Site Performance and User Experience (#23, #24, #37, #38)
    • Removed Algolia search to simplify site architecture
    • Removed dark/light mode toggle to fix styling issues
    • Streamlined site functionality for better performance
  • Deployment and Infrastructure (#12, #13, #14, #15, #16, #17, #18, #19, #20, #21)
    • Removed logo from site header for cleaner design
    • Removed GitHub link from header navigation
    • Removed Netlify from deployment options
    • Added Google Analytics integration
    • Homepage redesign from ready API to early access/beta
    • Enhanced deployment infrastructure

🐛 Critical Bug Fixes​

  • Production Stability (#68, #69)
    • Fixed production crash from undefined process variable
    • Resolved process undefined error affecting site stability
  • Documentation Links and Navigation (#93, #96)
    • Fixed broken links throughout documentation
    • Corrected anchor references to match Docusaurus generation
    • Updated all cross-references and internal linking
  • Infrastructure and Build Issues
    • Fixed featured image layout and positioning issues
    • Resolved CI workflow validation and build problems
    • Fixed PROJECT_ROOT path calculation in version management
    • Corrected PHP SDK installation and usage documentation

🗑️ Cleanup and Modernization​

  • Removed obsolete .cache/api-releases.json from repository
  • Removed redundant CI workflow steps and unused build processes
  • Removed GitHub Pages deployment (DigitalOcean handles deployment)
  • Removed unnecessary workflow files (build-develop.yaml, build-release-candidate.yaml)
  • Cleaned up version preview workflow (not needed for core functionality)
  • Streamlined build processes and removed redundant lint steps

📦 0.1.0 - 2025-09-16​

Initial Release

This marks the first major release of the Trading Card API documentation site with full feature parity.

✨ Added​

🏗️ Core Documentation Site​

  • Complete Docusaurus-based documentation site for Trading Card API
  • Responsive design with mobile-first approach
  • Custom styling and branding for Trading Card API

🏗️ Documentation Content​

  • Introduction and overview pages
  • Getting started guides (authentication, first request, overview)
  • Comprehensive API documentation (endpoints, models)
  • Code examples in JavaScript, PHP, and Python
  • Conceptual guides and filtering documentation

🏗️ Developer Guides​

  • Building card price tracker applications
  • Collection management system guides
  • Marketplace integration documentation
  • Mobile app integration guides
  • Data analysis and filtering guides
  • Authentication service documentation

🏗️ Interactive Features​

  • Live API explorer at /api endpoint
  • Interactive code examples with syntax highlighting
  • Beta notice system for user notifications
  • Google Analytics integration for usage tracking

🏗️ Blog System​

  • Blog posts about API updates and best practices
  • Author management system
  • RSS feed support for blog content
  • Welcome post and getting started tutorials

🏗️ Components and Features​

  • Custom React components (CodeExample, Stats, BetaNotice)
  • Homepage with hero section and feature highlights
  • Use case showcase (6 primary use cases)
  • Early access program integration
  • Contact forms and email integration

🏗️ Technical Infrastructure​

  • OpenAPI specification integration
  • Automatic API documentation generation
  • Static site generation and deployment
  • SEO optimization and meta tags
  • Privacy policy and terms of service pages

🏗️ Development Tools​

  • npm scripts for build, serve, and development
  • Hot reloading for development
  • Clear documentation structure
  • Version management system (this release)

🔗 Additional Resources​

📖 Related Documentation​

🏷️ Version Information​

  • Current Version: The most recent entry in Version History above
  • Release Schedule: New versions are released as features are completed
  • Breaking Changes: We'll always provide migration guides for any breaking changes

🔔 Stay Updated​

📧 Get Notified​

  • Blog - Release announcements and product updates
  • Email Newsletter - Monthly updates and feature announcements

💬 Questions & Feedback​

Questions or Feedback?

Have questions about a specific change or want to suggest improvements? We'd love to hear from you! Visit Support or email us.