shapi-cli 0.0.0-stage → 0.2.0

package/advisories/meta-graph-commerce-order-management-removed.json

@@ -0,0 +1,26 @@
+{
+  "id": "meta-graph-commerce-order-management-removed",
+  "provider": "meta-graph",
+  "title": "Commerce Order Management API removed on all versions on 2026-10-27",
+  "summary": "Meta deprecated the Commerce Order Management API (47 endpoints, including GET /{page-id}/commerce_orders and GET /{commerce-merchant-settings-id}/commerce_orders) with no replacement. Calls on v26.0+ are blocked since 2026-07-29, and the endpoints are removed from all remaining versions on 2026-10-27. Order sub-resources (items, shipments, refunds, cancellations, payments, tax_settings) by object id go too, but only the commerce_orders list edge is matched here.",
+  "endpoint": {
+    "method": "GET",
+    "path": "/*/*/commerce_orders"
+  },
+  "changeClass": "version-sunset",
+  "trigger": {
+    "any": true
+  },
+  "firstObserved": null,
+  "publishedNotice": {
+    "date": "2026-07-29",
+    "url": "https://developers.facebook.com/docs/graph-api/changelog/version26.0"
+  },
+  "effectiveDate": "2026-10-27",
+  "severity": "critical",
+  "migrationNote": "There is no replacement API. Stop calling commerce_orders, commerce_returns, tax_settings and the order, shipment, refund and cancellation object reads, and handle orders in Commerce Manager or your own order system. Guard any remaining calls so the error does not break sync jobs.",
+  "sources": [
+    "https://developers.facebook.com/docs/graph-api/changelog/version26.0"
+  ],
+  "status": "verified"
+}

package/advisories/meta-graph-date-format-param-removed.json

@@ -0,0 +1,30 @@
+{
+  "id": "meta-graph-date-format-param-removed",
+  "provider": "meta-graph",
+  "title": "date_format query parameter returns an error from 2026-10-27",
+  "summary": "Requests that include the legacy date_format parameter return an error on Graph API v26.0+ since 2026-07-29 and on all supported versions from 2026-10-27. The same change makes pretty and debug ignored and removes ETag/304 Not Modified behaviour.",
+  "endpoint": {
+    "method": "*",
+    "path": "/**"
+  },
+  "changeClass": "version-sunset",
+  "trigger": {
+    "query": [
+      {
+        "name": "date_format"
+      }
+    ]
+  },
+  "firstObserved": null,
+  "publishedNotice": {
+    "date": "2026-07-29",
+    "url": "https://developers.facebook.com/docs/graph-api/changelog/version26.0"
+  },
+  "effectiveDate": "2026-10-27",
+  "severity": "critical",
+  "migrationNote": "Remove date_format from every Graph API request and parse the default ISO 8601 timestamps in your own code. While you are there, drop any reliance on If-None-Match/304 caching and on pretty or debug output.",
+  "sources": [
+    "https://developers.facebook.com/docs/graph-api/changelog/version26.0"
+  ],
+  "status": "verified"
+}

package/advisories/meta-graph-delivery-estimate-fields-removed.json

@@ -0,0 +1,30 @@
+{
+  "id": "meta-graph-delivery-estimate-fields-removed",
+  "provider": "meta-graph",
+  "title": "Delivery Estimate drops daily_outcomes_curve, budget_guardrail and estimate_dau",
+  "summary": "The daily_outcomes_curve, budget_guardrail and estimate_dau fields are removed from GET /{ad-account-id}/delivery_estimate and GET /{adset-id}/delivery_estimate responses because the service behind them was shut down. The removal applies to Marketing API v26.0 and to all remaining versions on 2026-10-27; the calls still succeed but the fields are missing.",
+  "endpoint": {
+    "method": "GET",
+    "path": "/*/*/delivery_estimate"
+  },
+  "changeClass": "field-rename",
+  "trigger": {
+    "fields": [
+      "daily_outcomes_curve",
+      "budget_guardrail",
+      "estimate_dau"
+    ]
+  },
+  "firstObserved": null,
+  "publishedNotice": {
+    "date": "2026-07-29",
+    "url": "https://developers.facebook.com/docs/graph-api/changelog/version26.0"
+  },
+  "effectiveDate": "2026-10-27",
+  "severity": "critical",
+  "migrationNote": "Stop requesting and reading daily_outcomes_curve, budget_guardrail and estimate_dau; treat them as absent. Meta offers no replacement, so remove any forecasting or budget UI that depends on them or derive it from the remaining estimate fields.",
+  "sources": [
+    "https://developers.facebook.com/docs/graph-api/changelog/version26.0"
+  ],
+  "status": "verified"
+}

package/advisories/meta-graph-instagram-oembed-fields-removed.json

@@ -0,0 +1,33 @@
+{
+  "id": "meta-graph-instagram-oembed-fields-removed",
+  "provider": "meta-graph",
+  "title": "oEmbed responses no longer return author and thumbnail fields",
+  "summary": "Since 2025-11-03, on all API versions, Instagram post oEmbed responses (GET /{version}/instagram_oembed) no longer include author_name, author_url, thumbnail_url, thumbnail_width or thumbnail_height. The same fields were removed from Facebook post and video oEmbed (oembed_post, oembed_video), and the Facebook page oEmbed endpoint was deprecated.",
+  "endpoint": {
+    "method": "GET",
+    "path": "/*/instagram_oembed"
+  },
+  "changeClass": "field-rename",
+  "trigger": {
+    "fields": [
+      "author_name",
+      "author_url",
+      "thumbnail_url",
+      "thumbnail_width",
+      "thumbnail_height"
+    ]
+  },
+  "firstObserved": null,
+  "publishedNotice": {
+    "date": "2025-04-08",
+    "url": "https://developers.facebook.com/docs/instagram-platform/changelog"
+  },
+  "effectiveDate": "2025-11-03",
+  "severity": "high",
+  "migrationNote": "Stop reading author and thumbnail fields from oEmbed and render the returned html instead. If you need a thumbnail or author, read them from the Instagram Graph API media object for media your app can access, and treat the oEmbed fields as absent.",
+  "sources": [
+    "https://developers.facebook.com/docs/instagram-platform/changelog",
+    "https://developers.facebook.com/docs/instagram-platform/oembed"
+  ],
+  "status": "verified"
+}

package/advisories/meta-graph-marketing-api-v24-sunset.json

@@ -0,0 +1,34 @@
+{
+  "id": "meta-graph-marketing-api-v24-sunset",
+  "provider": "meta-graph",
+  "title": "Marketing API v24.0 available until 2026-11-10",
+  "summary": "Marketing API v24.0 is available until 2026-11-10, much earlier than Graph API v24.0. After that, ads calls pinned to v24.0 either fail or are auto-upgraded to the next version; endpoints that changed between versions fail. This matches ad account edges (/v24.0/act_{id}/...); calls to campaign, ad set and ad objects by numeric id on v24.0 are affected too but cannot be told apart from other Graph calls by path.",
+  "endpoint": {
+    "method": "*",
+    "path": "/v24.0/act_*/**"
+  },
+  "changeClass": "version-sunset",
+  "trigger": {
+    "any": true
+  },
+  "firstObserved": null,
+  "publishedNotice": {
+    "date": null,
+    "url": "https://developers.facebook.com/docs/marketing-api/marketing-api-changelog/"
+  },
+  "effectiveDate": "2026-11-10",
+  "severity": "critical",
+  "migrationNote": "Move all Marketing API calls (ad accounts, campaigns, ad sets, ads, creatives, insights) to v25.0 or, better, v26.0, and re-test against the v25.0 and v26.0 changelogs (for example the Advantage+ campaign and targeting_automation changes) before 2026-11-10.",
+  "recipeId": "apply-fix",
+  "fix": {
+    "path": {
+      "from": "/v24.0/",
+      "to": "/v26.0/"
+    }
+  },
+  "sources": [
+    "https://developers.facebook.com/docs/marketing-api/marketing-api-changelog/",
+    "https://developers.facebook.com/documentation/ads-commerce/marketing-api/overview/versioning"
+  ],
+  "status": "verified"
+}

package/advisories/meta-graph-marketing-api-v25-sunset.json

@@ -0,0 +1,35 @@
+{
+  "id": "meta-graph-marketing-api-v25-sunset",
+  "provider": "meta-graph",
+  "title": "Marketing API v25.0 available until 2027-02-23",
+  "summary": "Marketing API v25.0 is available until 2027-02-23 (Graph API v25.0 itself runs to 2028). After that, ads calls pinned to v25.0 fail or are auto-upgraded, and endpoints that changed in v26.0 fail. Meta also says the explicit targeting_automation.advantage_audience flag becomes mandatory on all versions once v25.0 is deprecated.",
+  "endpoint": {
+    "method": "*",
+    "path": "/v25.0/act_*/**"
+  },
+  "changeClass": "version-sunset",
+  "trigger": {
+    "any": true
+  },
+  "firstObserved": null,
+  "publishedNotice": {
+    "date": null,
+    "url": "https://developers.facebook.com/docs/marketing-api/marketing-api-changelog/"
+  },
+  "effectiveDate": "2027-02-23",
+  "severity": "high",
+  "migrationNote": "Upgrade Marketing API calls to v26.0, set targeting_automation.advantage_audience to 1 or 0 explicitly on ad set targeting, and review the v26.0 changelog (poll ads, Messenger Stories, Explore placement, delivery estimate fields) before 2027-02-23.",
+  "recipeId": "apply-fix",
+  "fix": {
+    "path": {
+      "from": "/v25.0/",
+      "to": "/v26.0/"
+    }
+  },
+  "sources": [
+    "https://developers.facebook.com/docs/marketing-api/marketing-api-changelog/",
+    "https://developers.facebook.com/documentation/ads-commerce/marketing-api/overview/versioning",
+    "https://developers.facebook.com/docs/graph-api/changelog/version26.0"
+  ],
+  "status": "verified"
+}

package/advisories/meta-graph-page-insights-impressions-fans-removed.json

@@ -0,0 +1,51 @@
+{
+  "id": "meta-graph-page-insights-impressions-fans-removed",
+  "provider": "meta-graph",
+  "title": "Page Insights impressions and page fans metrics removed on 2025-11-15",
+  "summary": "Since 2025-11-15, on all API versions, requesting the Page and post impressions metrics (page_impressions, page_impressions_paid, page_impressions_viral, page_impressions_nonviral, post_impressions, post_impressions_paid, post_impressions_fan, post_impressions_organic, post_impressions_viral, post_impressions_nonviral) or the fans metrics (page_fans, page_fans_locale, page_fans_city, page_fans_country, page_fan_adds, page_fan_adds_unique, page_fan_removes, page_fan_removes_unique) returns an invalid metric error. SHAPI flags calls that request one of these metrics.",
+  "endpoint": {
+    "method": "GET",
+    "path": "/*/*/insights"
+  },
+  "changeClass": "version-sunset",
+  "trigger": {
+    "query": [
+      {
+        "name": "metric",
+        "values": [
+          "page_fans",
+          "page_fans_locale",
+          "page_fans_city",
+          "page_fans_country",
+          "page_fan_adds",
+          "page_fan_adds_unique",
+          "page_fan_removes",
+          "page_fan_removes_unique",
+          "page_impressions",
+          "page_impressions_paid",
+          "page_impressions_viral",
+          "page_impressions_nonviral",
+          "post_impressions",
+          "post_impressions_paid",
+          "post_impressions_fan",
+          "post_impressions_organic",
+          "post_impressions_viral",
+          "post_impressions_nonviral"
+        ]
+      }
+    ]
+  },
+  "firstObserved": null,
+  "publishedNotice": {
+    "date": "2025-08-15",
+    "url": "https://developers.facebook.com/blog/post/2025/08/15/page-insights-api-updates/"
+  },
+  "effectiveDate": "2025-11-15",
+  "severity": "critical",
+  "migrationNote": "Replace page_impressions with page_media_view and post_impressions with post_media_view (use the is_from_ads or is_from_followers breakdowns for the paid, organic and fan splits), and replace page_fans/page_fans_city/page_fans_country with page_follows/page_follows_city/page_follows_country. Remove the other listed metrics; one invalid metric fails the whole insights request.",
+  "sources": [
+    "https://developers.facebook.com/blog/post/2025/08/15/page-insights-api-updates/",
+    "https://developers.facebook.com/docs/platforminsights/page/deprecated-metrics"
+  ],
+  "status": "verified"
+}

package/advisories/meta-graph-page-insights-reach-video-views-removed.json

@@ -0,0 +1,57 @@
+{
+  "id": "meta-graph-page-insights-reach-video-views-removed",
+  "provider": "meta-graph",
+  "title": "Page Insights reach and 3-second video viewer metrics removed on 2026-06-15",
+  "summary": "By 2026-06-15, on all API versions, the Page/post reach metrics (page_impressions_unique, post_impressions_unique and their paid, viral, nonviral, organic and fan variants, the page_posts_impressions family, page_posts_served_impressions_organic_unique) and the 3-second viewer metrics (page_video_views_unique, post_video_views_unique) return an invalid metric error. SHAPI flags calls that request one of these metrics.",
+  "endpoint": {
+    "method": "GET",
+    "path": "/*/*/insights"
+  },
+  "changeClass": "version-sunset",
+  "trigger": {
+    "query": [
+      {
+        "name": "metric",
+        "values": [
+          "page_impressions_unique",
+          "page_impressions_paid_unique",
+          "page_impressions_viral_unique",
+          "page_impressions_nonviral_unique",
+          "page_posts_impressions",
+          "page_posts_impressions_unique",
+          "page_posts_impressions_paid",
+          "page_posts_impressions_paid_unique",
+          "page_posts_impressions_organic_unique",
+          "page_posts_served_impressions_organic_unique",
+          "page_posts_impressions_viral",
+          "page_posts_impressions_viral_unique",
+          "page_posts_impressions_nonviral",
+          "page_posts_impressions_nonviral_unique",
+          "post_impressions_unique",
+          "post_impressions_paid_unique",
+          "post_impressions_fan_unique",
+          "post_impressions_organic_unique",
+          "post_impressions_viral_unique",
+          "post_impressions_nonviral_unique",
+          "page_video_views_unique",
+          "post_video_views_unique"
+        ]
+      }
+    ]
+  },
+  "firstObserved": null,
+  "publishedNotice": {
+    "date": "2026-02-18",
+    "url": "https://developers.facebook.com/blog/post/2026/02/18/introducing-graph-api-v25-and-marketing-api-v25/"
+  },
+  "effectiveDate": "2026-06-15",
+  "severity": "critical",
+  "migrationNote": "Switch reach and unique-viewer reporting to page_total_media_view_unique and post_total_media_view_unique (and page_media_view/post_media_view with is_from_ads for paid vs organic). The numbers use a different method, so do not splice them onto historical reach series, and drop metrics that have no replacement (viral/nonviral reach).",
+  "sources": [
+    "https://developers.facebook.com/docs/graph-api/reference/v22.0/insights",
+    "https://developers.facebook.com/blog/post/2026/02/18/introducing-graph-api-v25-and-marketing-api-v25/",
+    "https://developers.facebook.com/docs/platforminsights/page/deprecated-metrics",
+    "https://docs.supermetrics.com/docs/facebook-insights-field-changes-june-30-2026.md"
+  ],
+  "status": "verified"
+}

package/advisories/meta-graph-root-ids-lookup-removed.json

@@ -0,0 +1,30 @@
+{
+  "id": "meta-graph-root-ids-lookup-removed",
+  "provider": "meta-graph",
+  "title": "Root GET /?ids= multi-object lookup returns an error from 2026-10-27",
+  "summary": "Graph API dropped legacy protocol features: root requests of the form GET /?ids=a,b (or /{version}/?ids=) return an error on v26.0+ since 2026-07-29 and on all supported versions from 2026-10-27. Meta does not state the error code.",
+  "endpoint": {
+    "method": "GET",
+    "path": "/*"
+  },
+  "changeClass": "version-sunset",
+  "trigger": {
+    "query": [
+      {
+        "name": "ids"
+      }
+    ]
+  },
+  "firstObserved": null,
+  "publishedNotice": {
+    "date": "2026-07-29",
+    "url": "https://developers.facebook.com/docs/graph-api/changelog/version26.0"
+  },
+  "effectiveDate": "2026-10-27",
+  "severity": "critical",
+  "migrationNote": "Replace each GET /?ids=... call with one request per object, or send the per-object requests in a single batch request (POST / with a batch parameter), and merge the results in your code.",
+  "sources": [
+    "https://developers.facebook.com/docs/graph-api/changelog/version26.0"
+  ],
+  "status": "verified"
+}

package/advisories/meta-graph-v20-sunset.json

@@ -0,0 +1,33 @@
+{
+  "id": "meta-graph-v20-sunset",
+  "provider": "meta-graph",
+  "title": "Graph API v20.0 removed; calls fall forward to the next version",
+  "summary": "Graph API v20.0 was deprecated and removed on 2026-09-24. Calls pinned to v20.0 do not fail: they are served by the next oldest usable version, so response shapes can change silently.",
+  "endpoint": {
+    "method": "*",
+    "path": "/v20.0/**"
+  },
+  "changeClass": "version-sunset",
+  "trigger": {
+    "any": true
+  },
+  "firstObserved": null,
+  "publishedNotice": {
+    "date": null,
+    "url": "https://developers.facebook.com/docs/graph-api/changelog/versions"
+  },
+  "effectiveDate": "2026-09-24",
+  "severity": "high",
+  "migrationNote": "Move the version segment to a supported version (v22.0 or later) and re-test the fields you read.",
+  "recipeId": "apply-fix",
+  "fix": {
+    "path": {
+      "from": "/v20.0/",
+      "to": "/v26.0/"
+    }
+  },
+  "sources": [
+    "https://developers.facebook.com/docs/graph-api/changelog/versions"
+  ],
+  "status": "verified"
+}

package/advisories/meta-graph-v21-sunset.json

@@ -0,0 +1,33 @@
+{
+  "id": "meta-graph-v21-sunset",
+  "provider": "meta-graph",
+  "title": "Graph API v21.0 removed on 2027-01-21",
+  "summary": "Graph API v21.0 is deprecated and removed on 2027-01-21. After that, calls pinned to v21.0 are served by the next oldest usable version without an error.",
+  "endpoint": {
+    "method": "*",
+    "path": "/v21.0/**"
+  },
+  "changeClass": "version-sunset",
+  "trigger": {
+    "any": true
+  },
+  "firstObserved": null,
+  "publishedNotice": {
+    "date": null,
+    "url": "https://developers.facebook.com/docs/graph-api/changelog/versions"
+  },
+  "effectiveDate": "2027-01-21",
+  "severity": "high",
+  "migrationNote": "Move the version segment to a supported version (v22.0 or later) and re-test the fields you read.",
+  "recipeId": "apply-fix",
+  "fix": {
+    "path": {
+      "from": "/v21.0/",
+      "to": "/v26.0/"
+    }
+  },
+  "sources": [
+    "https://developers.facebook.com/docs/graph-api/changelog/versions"
+  ],
+  "status": "verified"
+}

package/advisories/openai-assistants-api-shutdown.json

@@ -0,0 +1,27 @@
+{
+  "id": "openai-assistants-api-shutdown",
+  "provider": "openai",
+  "title": "Assistants API removed on 2026-08-26",
+  "summary": "OpenAI removed the Assistants API on 2026-08-26, one year after its 2025-08-26 deprecation notice. Calls to the assistants endpoints, and to the threads, messages and runs endpoints that go with them (/v1/threads/**), no longer work. The replacement is the Responses API plus the Conversations API.",
+  "endpoint": {
+    "method": "*",
+    "path": "/v1/assistants/**"
+  },
+  "changeClass": "version-sunset",
+  "trigger": {
+    "any": true
+  },
+  "firstObserved": null,
+  "publishedNotice": {
+    "date": "2025-08-26",
+    "url": "https://developers.openai.com/api/docs/deprecations"
+  },
+  "effectiveDate": "2026-08-26",
+  "severity": "critical",
+  "migrationNote": "Move assistants to prompts (configuration created in the dashboard), threads to Conversations, and runs to Responses (send input items or a conversation id to the Responses API), and run the tool-call loop in your own code. Thread messages can no longer be fetched from the API, so read history from your own stored copy.",
+  "sources": [
+    "https://developers.openai.com/api/docs/deprecations",
+    "https://developers.openai.com/api/docs/assistants/migration"
+  ],
+  "status": "verified"
+}

package/advisories/openai-audio-translations-endpoint-shutdown.json

@@ -0,0 +1,27 @@
+{
+  "id": "openai-audio-translations-endpoint-shutdown",
+  "provider": "openai",
+  "title": "/v1/audio/translations shuts down on 2027-02-26",
+  "summary": "OpenAI deprecated the audio translations endpoint on 2026-08-26 and shuts it down on 2027-02-26, together with whisper-1 and the gpt-4o transcribe models. After that date every call to POST /v1/audio/translations fails.",
+  "endpoint": {
+    "method": "POST",
+    "path": "/v1/audio/translations"
+  },
+  "changeClass": "version-sunset",
+  "trigger": {
+    "any": true
+  },
+  "firstObserved": null,
+  "publishedNotice": {
+    "date": "2026-08-26",
+    "url": "https://developers.openai.com/api/docs/deprecations"
+  },
+  "effectiveDate": "2027-02-26",
+  "severity": "high",
+  "migrationNote": "Replace calls to POST /v1/audio/translations with the Realtime translations interface (v1/realtime/translations) that OpenAI names as the replacement, and move transcription off whisper-1 to gpt-live-transcribe or gpt-transcribe before 2027-02-26.",
+  "sources": [
+    "https://developers.openai.com/api/docs/deprecations",
+    "https://developers.openai.com/api/reference/resources/audio"
+  ],
+  "status": "verified"
+}

package/advisories/openai-evals-api-shutdown.json

@@ -0,0 +1,27 @@
+{
+  "id": "openai-evals-api-shutdown",
+  "provider": "openai",
+  "title": "Evals API shuts down on 2026-11-30",
+  "summary": "OpenAI is retiring the Evals platform: existing evals become read-only on 2026-10-31, and the Evals dashboard and API shut down on 2026-11-30. After that, calls to /v1/evals and its runs fail.",
+  "endpoint": {
+    "method": "*",
+    "path": "/v1/evals/**"
+  },
+  "changeClass": "version-sunset",
+  "trigger": {
+    "any": true
+  },
+  "firstObserved": null,
+  "publishedNotice": {
+    "date": "2026-06-03",
+    "url": "https://developers.openai.com/api/docs/deprecations"
+  },
+  "effectiveDate": "2026-11-30",
+  "severity": "critical",
+  "migrationNote": "Export the eval definitions and results you need before 2026-11-30, stop creating or updating evals (they are read-only from 2026-10-31), and move eval runs to Promptfoo following OpenAI's \"Moving from OpenAI Evals to Promptfoo\" guide.",
+  "sources": [
+    "https://developers.openai.com/api/docs/deprecations",
+    "https://developers.openai.com/api/reference/resources/evals"
+  ],
+  "status": "verified"
+}

package/advisories/quickbooks-companyinfo-neoenabled-removed.json

@@ -0,0 +1,29 @@
+{
+  "id": "quickbooks-companyinfo-neoenabled-removed",
+  "provider": "quickbooks",
+  "title": "CompanyInfo no longer returns the NeoEnabled NameValue",
+  "summary": "Since 2026-01-27 in production (2025-12-10 in sandbox), the CompanyInfo entity no longer includes the NeoEnabled attribute in its NameValue list. Code that looks up NeoEnabled gets no entry, while the API reference samples still show it.",
+  "endpoint": {
+    "method": "GET",
+    "path": "/v3/company/{realmId}/companyinfo/{companyId}"
+  },
+  "changeClass": "field-rename",
+  "trigger": {
+    "fields": [
+      "NeoEnabled"
+    ]
+  },
+  "firstObserved": null,
+  "publishedNotice": {
+    "date": "2025-12-01",
+    "url": "https://medium.com/intuitdev/upcoming-changes-to-apis-and-tools-that-may-impact-your-application-df4680ae3535"
+  },
+  "effectiveDate": "2026-01-27",
+  "severity": "low",
+  "migrationNote": "Treat a missing NeoEnabled entry in CompanyInfo.NameValue as normal, and stop deciding behavior from it. The same applies to CompanyInfo returned by the query endpoint.",
+  "sources": [
+    "https://medium.com/intuitdev/upcoming-changes-to-apis-and-tools-that-may-impact-your-application-df4680ae3535",
+    "https://developer.intuit.com/app/developer/qbo/docs/api/accounting/most-commonly-used/companyinfo"
+  ],
+  "status": "verified"
+}

package/advisories/quickbooks-minorversion-below-75-ignored.json

@@ -0,0 +1,40 @@
+{
+  "id": "quickbooks-minorversion-below-75-ignored",
+  "provider": "quickbooks",
+  "title": "Minor versions below 75 are silently answered as minor version 75",
+  "summary": "Since 2025-08-01 the QuickBooks Online Accounting API ignores any minorversion below 75 and responds with minor version 75 data, without an error. Code pinned to an older minor version receives a different response shape with no signal.",
+  "endpoint": {
+    "method": "*",
+    "path": "/v3/company/{realmId}/**"
+  },
+  "changeClass": "version-sunset",
+  "trigger": {
+    "query": [
+      {
+        "name": "minorversion",
+        "below": 75
+      }
+    ]
+  },
+  "firstObserved": "2025-08-01",
+  "publishedNotice": {
+    "date": null,
+    "url": "https://blogs.intuit.com/?p=34635"
+  },
+  "effectiveDate": "2025-08-01",
+  "severity": "high",
+  "migrationNote": "Set minorversion=75 (or remove it) and re-test parsing against minor version 75 responses.",
+  "recipeId": "apply-fix",
+  "fix": {
+    "query": {
+      "name": "minorversion",
+      "value": "75"
+    }
+  },
+  "sources": [
+    "https://blogs.intuit.com/?p=34635",
+    "https://www.apideck.com/blog/ai-built-accounting-integrations-maintenance",
+    "https://docs.codat.io/updates/250401-qbo-minor-versions-update"
+  ],
+  "status": "verified"
+}

package/advisories/quickbooks-refresh-token-five-year-hard-expiry.json

@@ -0,0 +1,29 @@
+{
+  "id": "quickbooks-refresh-token-five-year-hard-expiry",
+  "provider": "quickbooks",
+  "title": "Refresh tokens hard-expire after five years, first ones in February 2027",
+  "summary": "Intuit refresh tokens now have a maximum lifetime of five years, even if they are used regularly. For apps on restricted or granular scopes, tokens issued from February 2022 start expiring in February 2027. For com.quickbooks.accounting and com.quickbooks.payments, tokens issued from October 2023 start expiring in October 2028. Intuit gives only the month, so the effective date here is the first day of that month.",
+  "endpoint": {
+    "method": "POST",
+    "path": "/oauth2/v1/tokens/bearer"
+  },
+  "changeClass": "auth",
+  "trigger": {
+    "any": true
+  },
+  "firstObserved": null,
+  "publishedNotice": {
+    "date": "2025-11-12",
+    "url": "https://medium.com/intuitdev/important-changes-to-refresh-token-policy-8443779d40db"
+  },
+  "effectiveDate": "2027-02-01",
+  "severity": "high",
+  "migrationNote": "On refresh, send x_refresh_token_hard_expires_in=true and store the returned x_refresh_token_hard_expires_in (seconds left in the five-year lifetime) alongside the token. Treat invalid_grant from /oauth2/v1/tokens/bearer as a disconnect that needs the user to reconnect, not as a retryable error. Prompt users to re-authorize before the hard expiry, and set the Reconnect URL in the developer portal app settings.",
+  "sources": [
+    "https://medium.com/intuitdev/important-changes-to-refresh-token-policy-8443779d40db",
+    "https://developer.intuit.com/app/developer/qbo/docs/develop/authentication-and-authorization/oauth-2.0",
+    "https://developer.intuit.com/app/developer/qbo/docs/develop/authentication-and-authorization/faq",
+    "https://developer.intuit.com/app/developer/qbo/docs/release-notes/general-release-notes"
+  ],
+  "status": "unverified"
+}

package/advisories/reddit-logged-out-json-403.json

@@ -0,0 +1,25 @@
+{
+  "id": "reddit-logged-out-json-403",
+  "provider": "reddit",
+  "title": "Logged-out .json endpoints return 403",
+  "summary": "Unauthenticated requests to Reddit's public .json listing endpoints (for example /r/{subreddit}/top.json) started returning 403 Forbidden around 2026-05-30. OAuth (oauth.reddit.com) and logged-in access were reported as unaffected. No primary Reddit announcement was found.",
+  "endpoint": {
+    "method": "GET",
+    "path": "/**/*.json",
+    "hosts": ["reddit.com", "www.reddit.com", "old.reddit.com"]
+  },
+  "changeClass": "auth",
+  "trigger": {
+    "any": true
+  },
+  "firstObserved": "2026-05-30",
+  "publishedNotice": null,
+  "effectiveDate": "2026-05-30",
+  "severity": "high",
+  "migrationNote": "Move to an approved OAuth app and call oauth.reddit.com with a bearer token.",
+  "sources": [
+    "https://dev.to/tonywangca/why-reddit-blocked-unauthenticated-json-in-2026-and-how-to-still-get-reddit-data-58b9",
+    "https://bigideasdb.com/reddit-json-403-forbidden"
+  ],
+  "status": "unverified"
+}