Changelog

All notable changes to SimplePost are recorded here. The SDK and CLI follow Semantic Versioning; repository-wide entries also cover the Scheduler, MCP server, and self-hosted HTTP server.

Unreleased

[1.3.3] - 2026-09-09

Fixed

• Shared pre-send validation across all eleven platforms checks actual media dimensions, aspect ratios, duration, frame rate, container and encoding, plus final text and platform options. Caller-supplied size, MIME and duration cannot bypass inspection.
• Instagram rejects unsupported image and carousel ratios before submission. TikTok single-chunk uploads declare the complete video size.
• Telegram validates HTML, Markdown and MarkdownV2 formatting and parsed text length. YouTube and Bluesky enforce UTF-8 byte limits; Pinterest and Forem validate final metadata and overrides.
• Publishing checks exposed account eligibility, permissions and quotas before sending. Known violations block publication; unavailable provider checks remain explicit warnings.
• Extra attachments and oversized derived titles are rejected rather than silently dropped or truncated. End-to-end regressions cover these validation boundaries and ensure invalid API submissions create no publishing attempts.
• CLI 1.3.3 requires SDK ^1.3.3 and inherits these fixes for local publishing. Hosted publishing uses the deployed scheduler validation.

Upgrade notes

• Local video validation requires FFmpeg's ffprobe on PATH, or an absolute FFPROBE_PATH. Missing or failed inspection rejects the video before sending. Node.js 20+ remains supported; see migration notes and validation coverage.

[1.3.2] - 2026-09-08

Fixed

• SDK media validation inspects actual downloaded bytes, rejects inaccessible or invalid images before publishing, and explains Instagram's JPEG requirement without converting images. Downloads retain bounded sizes, timeouts, and SSRF protection.
• TikTok video uploads calculate chunk counts correctly. Photo preflight accepts hosts that support GET but reject HEAD; failures before submission are distinguishable from uncertain publishing outcomes.
• YouTube preserves caption-derived titles and conclusive upload-limit rejections. Custom-thumbnail failures return a warning with the successful video result, preventing retries from uploading duplicate videos. Unsupported playlist assignment is rejected before upload, and CLI authorization uses the approved scopes.
• Threads publishes complete, ordered carousels of up to twenty images or videos, including mixed media, and allows more time for media processing.
• Bluesky checks video eligibility before upload and reuses completed video-processing jobs when an upload was already processed.
• Pinterest video publishing handles upload registration, processing failures, and timeouts more reliably. Facebook video descriptions fall back to the post text.
• X validates weighted text lengths, including Japanese characters and URLs, and rejects ineligible long posts before publishing.
• CLI HTTP errors preserve actionable server validation messages, and CLI 1.3.2 requires SDK 1.3.2 or newer within 1.x.
• Scheduler and MCP fixes in the same source revision preserve OAuth continuations, expose trial allowances, stop futile credential-refresh polling, and improve validation and error diagnostics. Hosted availability depends on deployment.

[1.3.1] - 2026-09-06

Added

• Bluesky MP4 video publishing across the SDK, Scheduler, MCP, CLI, and HTTP APIs, including replies and quotes. Supports one video up to 300 MB and 10 minutes, OAuth and app passwords, streaming uploads, processing timeouts, and reuse of previously processed videos.
• Shared Bluesky video validation, duration metadata in MCP inputs, and video duration limits in API validation responses.

1.3.0 - 2026-09-05

Added

• Telegram albums containing up to 10 photos and videos, including mixed media, captions, and reply support. The first album message is returned as the post ID.
• TikTok photo carousels, optional recommended music, photo titles and descriptions, cover selection, and uploads to the TikTok inbox for manual editing and publishing.
• CLI flags and interactive prompts for TikTok photo and privacy settings.
• Public SDK helpers for resolving remote media sizes and validating media across account targets.
• WebMCP access to the Scheduler Create Post workflow.

Fixed

• CLI posts to hosted accounts now upload local files, forward platform settings, preserve media metadata and provider result messages, and correctly handle mixed local and hosted targets.
• SDK publishing preserves other destinations' results when one publisher cannot initialize, and merges environment defaults with explicit platform options.
• Remote media sizes are checked before publishing, with clearer validation for X cashtags and invalid Telegram bot destinations.
• Provider requests have bounded timeouts, and Instagram media processing stops after 10 minutes instead of polling indefinitely.
• TikTok photo staging preserves media while TikTok downloads it, and account settings are retained through Scheduler and MCP publishing.
• Scheduler publishing retries, quota enforcement, scheduled post mutations, and shared media cleanup are more durable.
• Scheduler startup resolves its CLIs from workspace dependencies.

1.2.1 - 2026-08-07

Fixed

• simplepost -v and simplepost --version now both print only the CLI version number.

1.2.0 - 2026-08-07

Added

• DEV/Forem article publishing across the SDK, CLI, HTTP API, Scheduler app, and examples, including drafts, tags, series, canonical URLs, organizations, and self-hosted instances.
• Cross-platform media-size validation, including optional byte-size metadata for URL-backed media.
• X account and subscription context in publishing errors, with clearer guidance when long posts require Premium access.

Fixed

• Telegram media uploads now use multipart requests and enforce the correct upload limits for photos and videos.
• Threads preview links now use the current threads.com domain.
• Bluesky and YouTube validate resolved media sizes before attempting provider uploads.

1.1.0 - 2026-07-10

Added

• One-time CLI authorization codes, expiring CLI tokens, remote CLI revocation, and configurable loopback callback ports.
• MCP OAuth token revocation and authorization-server revocation metadata.
• Direct S3/R2 uploads for both the Scheduler and self-hosted HTTP server.
• Streaming multipart uploads, media signature checks, bounded downloads, and storage-key ownership checks.
• Generated Scheduler and self-hosted server OpenAPI documents.
• Account and data deletion pages for the Scheduler, consumer website, and developer website.
• SDK compatibility, API versioning, and deployment migration policies.

Changed

• Post and connected-account quota checks now run atomically with their writes.
• Duplicate account targets are normalized before validation, persistence, and dispatch across the SDK schemas, HTTP APIs, Scheduler, and MCP tools.
• CLI posts sent through the hosted Scheduler include an idempotency key.
• The SDK's exported validation surface now uses Zod 4 directly.
• The root yarn test command runs the SDK, Scheduler, and CLI test suites.
• CLI boolean options use --flag and --no-flag forms.
• The public npm registry is the documented install source for the SDK and CLI.
• ChatGPT onboarding now uses the working remote MCP connector flow.
• Legal and privacy copy now distinguishes the hosted service from the MIT-licensed self-hosted software.

Security

• Better Auth, Axios, and form-data were upgraded past their OAuth replay, multipart injection, proxy-bypass SSRF, and resource-exhaustion advisory ranges.
• API-key authentication in the self-hosted server uses constant-time comparison.
• MCP media uploads stream temporary files into object storage instead of buffering the full file in memory.
• Media cleanup only deletes objects under the authenticated user's storage prefix.
• Stripe webhook subscription updates reconcile against the current Stripe object, including invoice payment lifecycle events, instead of writing potentially stale event payloads directly.
• Stripe webhook processing is replay-safe.
• Outbound webhooks and MCP media downloads reject private, loopback, metadata, and unsafe redirect targets.
• CLI bearer tokens no longer pass through browser URLs or browser history.
• Uploads enforce limits while streaming and reject content that does not match its declared supported media type.
• Browser sessions, rather than bearer credentials, are required to approve new CLI and MCP credentials.

1.0.0 - 2026-07-02

Added

• First stable release of @simple-post/sdk and @simple-post/cli.
• Unified posting support for X, Telegram, YouTube, Instagram, Facebook, TikTok, Bluesky, Threads, LinkedIn, and Pinterest.
• Self-hosted HTTP server, Scheduler application, and remote MCP server.
• Public MIT-licensed source, examples, platform guides, and release tooling.