shapi-cli 0.1.0 → 0.3.0

package/advisories/twilio-conference-list-default-in-progress.json

@@ -0,0 +1,27 @@
+{
+  "id": "twilio-conference-list-default-in-progress",
+  "provider": "twilio",
+  "title": "Twilio Conference list returns only in-progress conferences by default from 2026-09-30",
+  "summary": "Starting September 30, 2026 (rollout delayed from July 13, 2026), GET /2010-04-01/Accounts/{AccountSid}/Conferences.json without a Status filter returns only in-progress conferences instead of in-progress and completed ones. Code that lists conferences without Status and expects completed ones gets silently incomplete results.",
+  "endpoint": {
+    "method": "GET",
+    "path": "/2010-04-01/Accounts/{AccountSid}/Conferences.json"
+  },
+  "changeClass": "required-field",
+  "trigger": {
+    "any": true
+  },
+  "firstObserved": null,
+  "publishedNotice": {
+    "date": "2026-09-23",
+    "url": "https://www.twilio.com/en-us/changelog/conference-list-endpoint-july-2026"
+  },
+  "effectiveDate": "2026-09-30",
+  "severity": "critical",
+  "migrationNote": "Pass Status=completed explicitly when you need completed conferences (reporting, billing or cleanup jobs), and make a second request without it for in-progress ones if you need both; do not rely on the unfiltered list containing completed conferences.",
+  "sources": [
+    "https://www.twilio.com/en-us/changelog/conference-list-endpoint-july-2026",
+    "https://www.twilio.com/en-us/changelog/conference-list-endpoint-rollout-extended"
+  ],
+  "status": "verified"
+}

package/advisories/twilio-notify-end-of-life.json

@@ -0,0 +1,28 @@
+{
+  "id": "twilio-notify-end-of-life",
+  "provider": "twilio",
+  "title": "Twilio Notify reaches end of life (reported for 2027-01-31)",
+  "summary": "Twilio Notify (notify.twilio.com, e.g. POST /v1/Services/{ServiceSid}/Notifications) has been unsupported and closed to new customers since October 2022, and is reported to reach end of life for existing customers on January 31, 2027, after which Notify API requests are expected to fail. That date comes from Twilio's help-center article as quoted by a third party; Twilio's own January 2024 changelog gave December 31, 2025, so the exact date is not confirmed on a primary page.",
+  "endpoint": {
+    "method": "POST",
+    "path": "/v1/Services/{ServiceSid}/Notifications"
+  },
+  "changeClass": "version-sunset",
+  "trigger": {
+    "any": true
+  },
+  "firstObserved": null,
+  "publishedNotice": {
+    "date": "2024-01-23",
+    "url": "https://www.twilio.com/en-us/changelog/notify-api-end-of-life-further-extension-notice"
+  },
+  "effectiveDate": "2027-01-31",
+  "severity": "critical",
+  "migrationNote": "Move bulk SMS sends to the Messaging API (or Twilio's Bulk Messaging API) and push notifications to a direct APNs/FCM integration or another push provider, then remove Notify Services and Bindings. Confirm the final shutdown date with Twilio support or the Console before planning around it.",
+  "sources": [
+    "https://www.courier.com/blog/twilio-notify-end-of-life",
+    "https://www.twilio.com/en-us/changelog/notify-api-end-of-life-further-extension-notice",
+    "https://www.twilio.com/docs/notify/api/notification-resource"
+  ],
+  "status": "unverified"
+}

package/advisories/twilio-rcs-undelivered-error-code-30046.json

@@ -0,0 +1,27 @@
+{
+  "id": "twilio-rcs-undelivered-error-code-30046",
+  "provider": "twilio",
+  "title": "Twilio RCS unconfirmed-delivery error code changed from 30036 to 30046",
+  "summary": "Since August 10, 2026, an RCS message that cannot be delivered to an unreachable device fails with error code 30046 (Message delivery not confirmed) instead of 30036 (Validity Period Expired). Custom SMS failover logic that checks error_code or ErrorCode for 30036 no longer fires; Twilio's native SMS fallback is not affected.",
+  "endpoint": {
+    "method": "GET",
+    "path": "/2010-04-01/Accounts/{AccountSid}/Messages/{Sid}.json"
+  },
+  "changeClass": "enum-added",
+  "trigger": {
+    "enums": [{ "field": "error_code" }]
+  },
+  "firstObserved": null,
+  "publishedNotice": {
+    "date": "2026-07-09",
+    "url": "https://www.twilio.com/en-us/changelog/rcs-error-code-changing"
+  },
+  "effectiveDate": "2026-08-10",
+  "severity": "medium",
+  "migrationNote": "Wherever you branch on error_code (Message resource) or ErrorCode (status callbacks) to trigger SMS failover for RCS, treat 30046 the same as 30036, and test the fallback path.",
+  "sources": [
+    "https://www.twilio.com/en-us/changelog/rcs-error-code-changing",
+    "https://www.twilio.com/docs/messaging/api/message-resource"
+  ],
+  "status": "verified"
+}

package/advisories/twilio-voice-insights-conference-participant-removed.json

@@ -0,0 +1,28 @@
+{
+  "id": "twilio-voice-insights-conference-participant-removed",
+  "provider": "twilio",
+  "title": "Twilio Voice Insights Call Summary drops attributes.conference_participant on 2026-08-01",
+  "summary": "On August 1, 2026 Twilio removed the conference_participant attribute from the Voice Insights Call Summary (GET /v1/Voice/{CallSid}/Summary on insights.twilio.com) and the matching Event Streams event; attributes now returns null for every call. Code that reads attributes.conference_participant gets nothing, and code that dereferences attributes can throw.",
+  "endpoint": {
+    "method": "GET",
+    "path": "/v1/Voice/{CallSid}/Summary"
+  },
+  "changeClass": "field-rename",
+  "trigger": {
+    "fields": ["attributes.conference_participant"]
+  },
+  "firstObserved": null,
+  "publishedNotice": {
+    "date": "2026-07-01",
+    "url": "https://www.twilio.com/en-us/changelog/voice-insights-removal-conference-participant-field"
+  },
+  "effectiveDate": "2026-08-01",
+  "severity": "medium",
+  "migrationNote": "Stop reading attributes.conference_participant and treat attributes as nullable. Get conference data from the Conference Insights API or Conference Insights Event Streams instead.",
+  "sources": [
+    "https://www.twilio.com/en-us/changelog/voice-insights-removal-conference-participant-field",
+    "https://www.twilio.com/docs/voice/voice-insights/api/call/details-call-summary",
+    "https://www.twilio.com/docs/voice/voice-insights/api/call/call-summary-resource"
+  ],
+  "status": "verified"
+}

package/advisories/x-activity-api-pascalcase-event-types-removed.json

@@ -0,0 +1,31 @@
+{
+  "id": "x-activity-api-pascalcase-event-types-removed",
+  "provider": "x",
+  "title": "X Activity API event types renamed from PascalCase to dot-separated lowercase",
+  "summary": "From 2026-03-18 the X Activity API (XAA) uses dot-separated lowercase event_type values such as profile.update.bio instead of PascalCase names such as ProfileBioUpdate. Subscriptions created with, or event handlers that switch on, the old names stop matching.",
+  "endpoint": {
+    "method": "*",
+    "path": "/2/activity/**"
+  },
+  "changeClass": "enum-added",
+  "trigger": {
+    "enums": [
+      {
+        "field": "event_type"
+      }
+    ]
+  },
+  "firstObserved": null,
+  "publishedNotice": {
+    "date": "2026-03-13",
+    "url": "https://docs.x.com/changelog"
+  },
+  "effectiveDate": "2026-03-18",
+  "severity": "high",
+  "migrationNote": "Send the new lowercase names (for example profile.update.bio, follow.follow, post.create) in POST /2/activity/subscriptions and update every filter, switch statement and deserializer that reads event_type from the activity stream or webhook payloads.",
+  "sources": [
+    "https://docs.x.com/changelog",
+    "https://docs.x.com/x-api/activity/introduction"
+  ],
+  "status": "verified"
+}

package/advisories/x-self-serve-follow-writes-removed.json

@@ -0,0 +1,27 @@
+{
+  "id": "x-self-serve-follow-writes-removed",
+  "provider": "x",
+  "title": "Following users removed from X API self-serve tiers",
+  "summary": "X's 2026-04-16 changelog says Following via the API has been removed from all self-serve tiers (Free, Basic, Pro, pay-per-use), leaving it to Enterprise. POST /2/users/{id}/following calls with self-serve credentials are rejected; X does not document the status code.",
+  "endpoint": {
+    "method": "POST",
+    "path": "/2/users/{id}/following"
+  },
+  "changeClass": "scope-change",
+  "trigger": {
+    "any": true
+  },
+  "firstObserved": null,
+  "publishedNotice": {
+    "date": "2026-04-16",
+    "url": "https://docs.x.com/changelog"
+  },
+  "effectiveDate": "2026-04-16",
+  "severity": "critical",
+  "migrationNote": "Remove or feature-flag follow actions for self-serve apps and show users a clear message (for example a link to the profile so they can follow in the X app), or move to an Enterprise agreement.",
+  "sources": [
+    "https://docs.x.com/changelog",
+    "https://opentweet.io/how-to/fix-x-api-like-follow-endpoint-removed"
+  ],
+  "status": "verified"
+}

package/advisories/x-self-serve-like-writes-removed.json

@@ -0,0 +1,27 @@
+{
+  "id": "x-self-serve-like-writes-removed",
+  "provider": "x",
+  "title": "Liking Posts removed from X API self-serve tiers",
+  "summary": "X's 2026-04-16 changelog says Following, Likes and Quote-Posts via the API have been removed from all self-serve tiers (Free, Basic, Pro, pay-per-use), leaving them to Enterprise. POST /2/users/{id}/likes calls with self-serve credentials are rejected; X does not document the status code. Quote-Posts (POST /2/tweets with quote_tweet_id) are also removed but cannot be matched by path.",
+  "endpoint": {
+    "method": "POST",
+    "path": "/2/users/{id}/likes"
+  },
+  "changeClass": "scope-change",
+  "trigger": {
+    "any": true
+  },
+  "firstObserved": null,
+  "publishedNotice": {
+    "date": "2026-04-16",
+    "url": "https://docs.x.com/changelog"
+  },
+  "effectiveDate": "2026-04-16",
+  "severity": "critical",
+  "migrationNote": "Remove or feature-flag like actions for self-serve apps and surface a clear error to users, or move to an Enterprise agreement. Also drop quote_tweet_id from POST /2/tweets on self-serve keys.",
+  "sources": [
+    "https://docs.x.com/changelog",
+    "https://opentweet.io/how-to/fix-x-api-like-follow-endpoint-removed"
+  ],
+  "status": "verified"
+}

package/advisories/xero-allocations-contact-mismatch-rejected.json

@@ -0,0 +1,27 @@
+{
+  "id": "xero-allocations-contact-mismatch-rejected",
+  "provider": "xero",
+  "title": "Allocations between documents of different contacts are rejected",
+  "summary": "Xero now requires a credit note, prepayment or overpayment to belong to the same contact as the invoice or bill it is allocated to. Allocation requests with a contact mismatch return a validation error. The notice is dated 2026-10-08 and gives no separate enforcement date.",
+  "endpoint": {
+    "method": "PUT",
+    "path": "/api.xro/2.0/*/{id}/Allocations"
+  },
+  "changeClass": "status-code",
+  "trigger": {
+    "any": true
+  },
+  "firstObserved": null,
+  "publishedNotice": {
+    "date": "2026-10-08",
+    "url": "https://developer.xero.com/changelog"
+  },
+  "effectiveDate": "2026-10-08",
+  "severity": "medium",
+  "migrationNote": "Before calling PUT /CreditNotes/{CreditNoteID}/Allocations, /Prepayments/{PrepaymentID}/Allocations or /Overpayments/{OverpaymentID}/Allocations, check that Contact.ContactID is the same on the source document and on the target invoice or bill. On a validation error, show the user the mismatch instead of retrying, because the unchanged request keeps failing.",
+  "sources": [
+    "https://developer.xero.com/changelog",
+    "https://raw.githubusercontent.com/XeroAPI/Xero-OpenAPI/master/xero_accounting.yaml"
+  ],
+  "status": "unverified"
+}

package/advisories/xero-au-payroll-isqualifyingearnings-required.json

@@ -0,0 +1,28 @@
+{
+  "id": "xero-au-payroll-isqualifyingearnings-required",
+  "provider": "xero",
+  "title": "AU Payroll pay item and earnings rate writes require IsQualifyingEarnings",
+  "summary": "Since 2026-09-10, AU Payroll create and update requests for Earnings Rates and Pay Items must include IsQualifyingEarnings. Requests without it return a 400 validation error, and when it is true the matching super flag must agree. The same rule applies to the v2 endpoint POST /payroll.xro/2.0/earningsRates.",
+  "endpoint": {
+    "method": "POST",
+    "path": "/payroll.xro/1.0/PayItems"
+  },
+  "changeClass": "required-field",
+  "trigger": {
+    "any": true
+  },
+  "firstObserved": null,
+  "publishedNotice": {
+    "date": "2026-09-10",
+    "url": "https://developer.xero.com/changelog"
+  },
+  "effectiveDate": "2026-09-10",
+  "severity": "critical",
+  "migrationNote": "Add IsQualifyingEarnings to every earnings rate sent to POST /payroll.xro/1.0/PayItems, and isQualifyingEarnings to POST /payroll.xro/2.0/earningsRates. Keep it consistent with the super flags: when it is true, Pay Items need IsExemptFromSuper false and Earnings Rates need IsSubjectToSuper true. For rates you read and write back, keep the value Xero returned.",
+  "sources": [
+    "https://developer.xero.com/changelog",
+    "https://developer.xero.com/documentation/api/payrollau/payitems",
+    "https://developer.xero.com/documentation/api/payrollau/earningsrates"
+  ],
+  "status": "verified"
+}

package/advisories/xero-finance-accounting-activities-decommissioned.json

@@ -0,0 +1,28 @@
+{
+  "id": "xero-finance-accounting-activities-decommissioned",
+  "provider": "xero",
+  "title": "Finance API Accounting Activities endpoints decommissioned",
+  "summary": "On 2026-05-04 Xero decommissioned the Finance API's Accounting Activities API: Account Usage, Lock History, Report History and User Activities. All of these endpoints now return errors. Xero suggests the Bank Statements API for cash flow and financial analysis.",
+  "endpoint": {
+    "method": "GET",
+    "path": "/finance.xro/1.0/AccountingActivities/**"
+  },
+  "changeClass": "version-sunset",
+  "trigger": {
+    "any": true
+  },
+  "firstObserved": null,
+  "publishedNotice": {
+    "date": "2026-05-04",
+    "url": "https://developer.xero.com/changelog"
+  },
+  "effectiveDate": "2026-05-04",
+  "severity": "critical",
+  "migrationNote": "Remove calls to /finance.xro/1.0/AccountingActivities/AccountUsage, LockHistory, ReportHistory and UserActivities, along with the features built on them. For cash-flow or transaction analysis, move to the Finance API Bank Statements endpoint (/finance.xro/1.0/BankStatementsPlus/statements). Lock history and user activity data have no direct replacement.",
+  "sources": [
+    "https://developer.xero.com/changelog",
+    "https://raw.githubusercontent.com/XeroAPI/Xero-OpenAPI/2.29.1/xero-finance.yaml",
+    "https://raw.githubusercontent.com/XeroAPI/Xero-OpenAPI/master/xero-finance.yaml"
+  ],
+  "status": "verified"
+}

package/advisories/xero-invoices-email-daily-limit-429.json

@@ -0,0 +1,32 @@
+{
+  "id": "xero-invoices-email-daily-limit-429",
+  "provider": "xero",
+  "title": "Invoice email daily limit returns 429 instead of 500 from 2027-01-14",
+  "summary": "From 2027-01-14, POST Invoices/{InvoiceID}/Email returns 429 Too Many Requests instead of a generic 500 when the organisation reaches its daily invoice-email limit. The 429 has no Retry-After header. Code that treats 500 as a retryable server error, or retries a 429 at once with a short backoff, will mishandle the limit.",
+  "endpoint": {
+    "method": "POST",
+    "path": "/api.xro/2.0/Invoices/{InvoiceID}/Email"
+  },
+  "changeClass": "status-code",
+  "trigger": {
+    "statusCodes": [
+      500
+    ],
+    "newStatusCodes": [
+      429
+    ]
+  },
+  "firstObserved": null,
+  "publishedNotice": {
+    "date": "2026-10-15",
+    "url": "https://developer.xero.com/changelog"
+  },
+  "effectiveDate": "2027-01-14",
+  "severity": "medium",
+  "migrationNote": "Handle a 429 from the invoice Email endpoint separately from the per-minute rate limit. It is a daily limit with no Retry-After header, so don't retry immediately. Queue the send for after the daily reset, or tell the user sending was delayed. Stop relying on a 500 to detect this case.",
+  "sources": [
+    "https://developer.xero.com/changelog",
+    "https://raw.githubusercontent.com/XeroAPI/Xero-OpenAPI/master/xero_accounting.yaml"
+  ],
+  "status": "verified"
+}

package/advisories/xero-nz-payroll-employee-tax-kiwisaverstatus-required.json

@@ -0,0 +1,27 @@
+{
+  "id": "xero-nz-payroll-employee-tax-kiwisaverstatus-required",
+  "provider": "xero",
+  "title": "NZ Payroll employee tax requests without KiwiSaverStatus return 400 from 2026-11-05",
+  "summary": "From 2026-11-05, KiwiSaverStatus is required when creating or updating employee tax details in NZ Payroll, for every tax code except WT and NSW. Requests that omit it return 400 Bad Request. Xero says it will not provide test instances or workarounds.",
+  "endpoint": {
+    "method": "POST",
+    "path": "/payroll.xro/2.0/Employees/{EmployeeID}/Tax"
+  },
+  "changeClass": "required-field",
+  "trigger": {
+    "any": true
+  },
+  "firstObserved": null,
+  "publishedNotice": {
+    "date": "2026-08-06",
+    "url": "https://developer.xero.com/changelog"
+  },
+  "effectiveDate": "2026-11-05",
+  "severity": "critical",
+  "migrationNote": "Send KiwiSaverStatus explicitly in every POST to /payroll.xro/2.0/Employees/{EmployeeID}/Tax whose tax code is not WT or NSW. Get it from your own employee record or read the current tax details with a GET before updating. Treat a 400 on this call as a data error to show the user, not a reason to retry.",
+  "sources": [
+    "https://developer.xero.com/changelog",
+    "https://raw.githubusercontent.com/XeroAPI/Xero-OpenAPI/master/xero-payroll-nz.yaml"
+  ],
+  "status": "verified"
+}

package/advisories/xero-organisation-class-ultra-enum.json

@@ -0,0 +1,31 @@
+{
+  "id": "xero-organisation-class-ultra-enum",
+  "provider": "xero",
+  "title": "Organisation Class enum gains ULTRA",
+  "summary": "Since 2026-06-30 the Organisation endpoint can return Class ULTRA for Australian organisations on the new Xero Ultra plan. Xero warns that integrations assuming only the existing values may fail to keep their connection to Xero. Strict enum parsing, including older SDK enums, can throw on the new value.",
+  "endpoint": {
+    "method": "GET",
+    "path": "/api.xro/2.0/Organisation"
+  },
+  "changeClass": "enum-added",
+  "trigger": {
+    "enums": [
+      {
+        "field": "Class"
+      }
+    ]
+  },
+  "firstObserved": null,
+  "publishedNotice": {
+    "date": "2026-06-30",
+    "url": "https://developer.xero.com/changelog"
+  },
+  "effectiveDate": "2026-06-30",
+  "severity": "medium",
+  "migrationNote": "Accept unknown Organisation Class values instead of failing, and map ULTRA wherever you branch on plan type. If you use a generated SDK, upgrade to a version whose Class enum includes ULTRA, or deserialize Class as a plain string.",
+  "sources": [
+    "https://developer.xero.com/changelog",
+    "https://raw.githubusercontent.com/XeroAPI/Xero-OpenAPI/master/xero_accounting.yaml"
+  ],
+  "status": "verified"
+}