App updates without re-consent

Ship an app update without asking every merchant to re-approve it. An approved version now needs the merchant only when it adds a required scope.

Changed for app developers

• Updates move installs automatically. When a new version is approved, every install whose granted scopes already cover the version's required scopes moves to it and stays installed: its token keeps working, the store serves the new version's extensions, and your webhook subscription switches to the new version's topics. Skill apps' agents get the new SKILL.md. See Scope changes.
• Dropped scopes are removed. If the new version no longer lists a scope, moved installs and their tokens lose it, and app/scopes_update fires.
• Added scopes still need consent. Installs missing a new required scope go to pending_reauth as before.

Fixed

• Approving any new version put every install into pending_reauth, even when the scopes had not changed. The app lost its extensions and script tags on every store until each merchant re-authorized.