App Store Connect CLI 5.4.0 ships 68 changes aimed at safer agent automation

rudrank · x · 2026-09-19

App Store Connect CLI (rorkai, 7.3k GitHub stars) released v5.4.0 with 68 changes focused on safer agent-driven automation:

Fail-closed review submissions: any uncertainty in discovery, pagination, envelopes, or item inspection stops the mutation. Apple can return a "successful" create with top-level errors; 5.4.0 preserves the validated ID and follows per-command policy (keep, roll back, or print exact inspect/cancel guidance). Blank, wrong-type, and non-2xx IDs fail closed. Preflight/rollback rules now cover background-asset submissions.
Web session hardening: rejects symlinked, oversized, FIFO, and directory cache entries; staged writes via private exclusive files; fallback from stale file sessions; attachment credentials protected across redirects.
Cookie semantics: positive Max-Age beats stale Expires, absolute deadlines survive cache serialization, ambiguous same-name cookies are dropped.
Bounded pagination: build lookups stop replaying exhausted pages or retrying permanent app-scoped 404s; late pagination errors surface instead of partial results; --since cursors can't spin forever.
Migration export: verifies version-to-app ownership before reading localizations; preserves privacy policy URLs in fastlane privacyurl.txt.
IAP screenshots: checksum bound to uploaded bytes, replacement doesn't delete the good screenshot first, shell-quoting for provider-controlled values.
Ratings retries: preserve the real storefront error when a 429/5xx retry misses the deadline; queued country work is cancelled to keep asc reviews ratings --all bounded.

More from coding & agent