finalerock44 · Nov 5, 2026 · Nov 5, 2026 · Nov 5, 2026 · Nov 5, 2026
diff --git a/advanced/cancel-previous.md b/advanced/cancel-previous.md
@@ -5,7 +5,6 @@ nobody is waiting on their verdict, but they still sit in the queue and still
 cost you. `--cancel-previous` cancels them when the newer run is submitted.
 
 It is opt-in and off by default. Without it, nothing about your runs changes.
-Requires DeviceCloud CLI 5.6.0 or later.
 
 ## What it does
 

diff --git a/advanced/visual-testing.md b/advanced/visual-testing.md
@@ -9,8 +9,6 @@ Maestro's `assertScreenshot` command compares the current screen against a refer
 DeviceCloud runs these assertions like any other command. The one thing you need to set up is getting your baseline images onto the device.
 
 ::: warning
-**Requires DeviceCloud CLI 5.6.0 or later**, the first version that uploads your baselines.
-
 **Use Maestro 2.10.0**, the default version. Maestro 2.2.0 resolves the baseline path against a different working directory and reports `Screenshot file not found` no matter where you put the file, so don't pin `--maestro-version` to it — see [Maestro Versions](../configuration/maestro-versions.md).
 :::
 

diff --git a/cli/dcd-cloud.md b/cli/dcd-cloud.md
@@ -34,7 +34,7 @@ See [Authentication](../getting-started/api-keys.md) for the full picture.
 | `--app-url <url>` | Signed URL to an Expo iOS build (`.tar.gz`). The archive is downloaded and extracted automatically. Expo signed URLs expire after ~1 hour. Mutually exclusive with `--app-file` |
 | `--app-file <path>` | Path to the app binary (alternative to the positional `<app-file>` argument) |
 | `--ignore-sha-check` | Force re-upload even if a binary with the same SHA already exists |
-| `--encrypt` / `--no-encrypt` | Encryption is on by default (CLI 5.7.0 and later): the app binary, flow files and `--env` values are encrypted on your machine before upload, each with its own key. Pass `--no-encrypt` (or set `DCD_ENCRYPT=0`) to upload them unencrypted. An unchanged binary is still deduplicated, so it isn't uploaded again. See [Data Encryption](../security/security-overview.md#data-encryption) |
+| `--encrypt` / `--no-encrypt` | Envelope encryption is on by default: the app binary, flow files and `--env` values are encrypted on your machine before upload, each with its own key. Pass `--no-encrypt` (or set `DCD_ENCRYPT=0`) to turn it off; the upload is still encrypted in transit. An unchanged binary is still deduplicated, so it isn't uploaded again. See [Data Encryption](../security/security-overview.md#data-encryption) |
 
 ### Device
 

diff --git a/cli/dcd-upload.md b/cli/dcd-upload.md
@@ -2,7 +2,7 @@
 
 Upload an app binary to DeviceCloud and get back a binary ID. Use the binary ID in subsequent `dcd cloud` runs to skip re-uploading the same binary.
 
-DeviceCloud deduplicates binaries by SHA checksum — if you upload the same binary twice, the existing ID is returned and no upload occurs. Encrypted uploads are only matched against your earlier encrypted uploads, so a binary you previously uploaded unencrypted is uploaded once more the first time it's encrypted.
+DeviceCloud deduplicates binaries by SHA checksum — if you upload the same binary twice, the existing ID is returned and no upload occurs. An envelope-encrypted upload is only matched against your earlier envelope-encrypted uploads, so a binary you previously uploaded with `--no-encrypt` is uploaded once more the first time it's envelope-encrypted.
 
 ```bash
 dcd upload <app-file> [flags]
@@ -21,7 +21,7 @@ dcd upload <app-file> [flags]
 | `--api-key <key>` | Your DeviceCloud API key. Defaults to `DEVICE_CLOUD_API_KEY` env var |
 | `--app-url <url>` | Signed URL to an Expo iOS build (`.tar.gz`), used instead of `<app-file>`. The archive is downloaded and extracted automatically |
 | `--ignore-sha-check` | Force re-upload even if a binary with the same SHA already exists |
-| `--encrypt` / `--no-encrypt` | Encryption is on by default (CLI 5.7.0 and later): the binary is encrypted on your machine before upload. Pass `--no-encrypt` (or set `DCD_ENCRYPT=0`) to upload it unencrypted |
+| `--encrypt` / `--no-encrypt` | Envelope encryption is on by default: the binary is encrypted on your machine before upload, with its own key. Pass `--no-encrypt` (or set `DCD_ENCRYPT=0`) to turn it off; the upload is still encrypted in transit. See [Data Encryption](../security/security-overview.md#data-encryption) |
 | `--json` | Output the binary ID as JSON |
 | `--debug` | Enable verbose debug logging |
 

diff --git a/cli/overview.md b/cli/overview.md
@@ -94,7 +94,7 @@ When both are present, precedence is: `--api-key` flag → `DEVICE_CLOUD_API_KEY
 |----------|-------------|
 | `DEVICE_CLOUD_API_KEY` | API key to use when `--api-key` isn't passed. Takes precedence over a `dcd login` session |
 | `DCD_CONFIG_DIR` | Directory for the `dcd login` session file (default `$XDG_CONFIG_HOME/dcd`, or `~/.dcd`) |
-| `DCD_ENCRYPT` | `dcd cloud`, `dcd upload` and the MCP server encrypt the app binary, flows and `--env` values on your machine before upload by default. Set to `0` to turn this off, the same as passing `--no-encrypt`. A flag on the command line takes precedence |
+| `DCD_ENCRYPT` | `dcd cloud`, `dcd upload` and the MCP server apply envelope encryption to the app binary, flows and `--env` values on your machine before upload by default. Set to `0` to turn it off, the same as passing `--no-encrypt`; uploads are still encrypted in transit. A flag on the command line takes precedence |
 | `DCD_TELEMETRY_DISABLED` | Set to `1` to turn off [telemetry](#telemetry) |
 | `DCD_API_URL` | MCP server only. The API base URL to use (CLI commands take `--api-url` instead) |
 | `DCD_MCP_READONLY` | MCP server only. Set to `1` for [read-only mode](../mcp/overview.md#read-only-mode) |
@@ -103,12 +103,12 @@ The standalone binary installers also read these:
 
 | Variable | Description |
 |----------|-------------|
-| `DCD_VERSION` | Install a specific version instead of the latest stable release, e.g. `5.5.0` |
+| `DCD_VERSION` | Install a specific version instead of the latest stable release, e.g. `5.11.1` |
 | `DCD_BETA` | Set to `1` to install the latest beta |
 | `DCD_INSTALL_DIR` | Where to install the binary (default `~/.dcd/bin`, or `$env:USERPROFILE\.dcd\bin` on Windows) |
 
 ```bash
-curl -fsSL https://get.devicecloud.dev/install.sh | DCD_VERSION=5.5.0 sh
+curl -fsSL https://get.devicecloud.dev/install.sh | DCD_VERSION=5.11.1 sh
 ```
 
 ## Telemetry

diff --git a/configuration/app-management.md b/configuration/app-management.md
@@ -51,7 +51,7 @@ The URL must point to an Expo iOS simulator build (`.tar.gz`). The CLI downloads
 
 ### SHA Hash Checking
 
-By default, Device Cloud checks the SHA hash of your binary to avoid redundant uploads (it will automatically work out the app-binary-id for you). Encrypted uploads (the default) are only matched against your earlier encrypted uploads, so a binary you previously uploaded unencrypted is uploaded once more the first time it's encrypted. To override:
+By default, Device Cloud checks the SHA hash of your binary to avoid redundant uploads (it will automatically work out the app-binary-id for you). Envelope-encrypted uploads (the default) are only matched against your earlier envelope-encrypted uploads, so a binary you previously uploaded with `--no-encrypt` is uploaded once more the first time it's envelope-encrypted. To override:
 
 ```bash
 dcd cloud --app-file ./app.apk flows/ --ignore-sha-check

diff --git a/configuration/environment-variables.md b/configuration/environment-variables.md
@@ -40,7 +40,7 @@ dcd cloud app.apk flows/ -e USERNAME=${CI_USERNAME} \
           -e PASSWORD=${CI_PASSWORD}
 ```
 
-The CLI encrypts `--env` values on your machine before they're uploaded, along with the app binary and your flow files. This is on by default (CLI 5.7.0 and later); `--no-encrypt` or `DCD_ENCRYPT=0` turns it off. Because the values are encrypted, the console doesn't list them on the test result.
+The CLI applies envelope encryption to `--env` values on your machine before they're uploaded, along with the app binary and your flow files. This is on by default; `--no-encrypt` or `DCD_ENCRYPT=0` turns it off, and the values are still encrypted in transit. Because the values are envelope-encrypted, the console doesn't list them on the test result. See [Data Encryption](../security/security-overview.md#data-encryption).
 
 ## iOS: SIMCTL Variable Passthrough
 

diff --git a/configuration/google-play-apis.md b/configuration/google-play-apis.md
@@ -65,7 +65,7 @@ Pass the device and API level together on Google Play runs:
 dcd cloud ... --google-play --android-device pixel-8 --android-api-level 34
 ```
 
-If you pass only one of them, DeviceCloud picks the other so the pair has a Google Play image: a device runs on its Google Play API level, and an API level runs on a Google Play device that offers it. If you pass neither, the run uses the default Android device, Pixel 10 on API 36, which has a Google Play image. A device with no Google Play image, or an API level no Google Play device offers, is rejected. Older CLI versions check a single value against an older default device instead, so update the CLI if one of these is refused.
+If you pass only one of them, DeviceCloud picks the other so the pair has a Google Play image: a device runs on its Google Play API level, and an API level runs on a Google Play device that offers it. If you pass neither, the run uses the default Android device, Pixel 10 on API 36, which has a Google Play image. A device with no Google Play image, or an API level no Google Play device offers, is rejected.
 
 If only some flows opt in with `DEVICECLOUD_OVERRIDE_GOOGLE_PLAY`, those flows are resolved the same way, from the device and API level the flow names, then the ones the upload names. A flow that opts in and names neither runs on Pixel 10 on API 36. To choose the device, pin it on the upload, or on those flows with [per-flow devices](per-flow-devices.md).
 

diff --git a/configuration/workspace-config.md b/configuration/workspace-config.md
@@ -35,7 +35,7 @@ If `flows` is omitted, all `.yaml` / `.yml` files at the top level of the direct
 
 ### `includedPaths`
 
-Glob patterns selecting extra **non-flow** files to upload alongside your flows. Requires DeviceCloud CLI 5.6.0 or later; older versions warn that the key is unknown and upload nothing extra.
+Glob patterns selecting extra **non-flow** files to upload alongside your flows.
 
 The CLI works out what to upload by reading your flows, so it only picks up files a command actually references by a literal path — `addMedia`, `assertScreenshot`, `runFlow` and `runScript` arguments. A path that contains a variable (`screenshots/${DCD_DEVICE}/home.png`), and anything else your test needs on the device, is invisible to it and silently absent from the run. `includedPaths` is how you declare those files.
 
@@ -108,7 +108,7 @@ executionOrder:
     - checkout
 ```
 
-The bare-list form is not valid Maestro either. Older CLI versions accepted it and silently ignored it, so the flows ran **in parallel** while the run still reported success — the only symptom was flows executing out of order. The CLI now fails with an error naming the expected shape instead.
+The bare-list form is not valid Maestro either. The CLI rejects it with an error naming the expected shape.
 :::
 
 ::: info

diff --git a/getting-started/flows-and-workspaces.md b/getting-started/flows-and-workspaces.md
@@ -58,4 +58,4 @@ See [Workspace Configuration](../configuration/workspace-config.md) for more inf
 
 ### Referencing flows
 
-As of version 2.0.0, the CLI will search for all nested dependencies referenced by your YAML flows using Maestro keywords (`addMedia`, `runFlow`, `runScript`). From version 5.6.0 it also picks up `assertScreenshot` baselines named by a literal path. Files it can't find this way, such as a path containing a variable, can be added with [`includedPaths`](../configuration/workspace-config.md#includedpaths).
+The CLI searches for all nested dependencies referenced by your YAML flows using Maestro keywords (`addMedia`, `runFlow`, `runScript`), and picks up `assertScreenshot` baselines named by a literal path. Files it can't find this way, such as a path containing a variable, can be added with [`includedPaths`](../configuration/workspace-config.md#includedpaths).
diff --git a/mcp/tools.md b/mcp/tools.md
@@ -86,7 +86,7 @@ This tool consumes test credits. It's annotated as destructive so clients can pr
 | `priority` | `low` \| `normal` \| `high` | [Run priority](../configuration/run-priority.md) (default `normal`). Reorders only your organisation's own queued runs. |
 | `configFile` | string | Path to a [workspace config](../configuration/workspace-config.md) |
 | `ignoreShaCheck` | boolean | Force re-upload of the binary even if an identical one already exists |
-| `encrypt` | boolean | Encrypt the binary, flows and `env` values on your machine before upload. Omit it to follow `DCD_ENCRYPT`, then the default, which is on; pass `false` to upload them unencrypted. See [Data Encryption](../security/security-overview.md#data-encryption) |
+| `encrypt` | boolean | Apply envelope encryption to the binary, flows and `env` values on your machine before upload. Omit it to follow `DCD_ENCRYPT`, then the default, which is on; pass `false` to turn it off (the upload is still encrypted in transit). See [Data Encryption](../security/security-overview.md#data-encryption) |
 | `dryRun` | boolean | Preview which flows would run, without submitting |
 | `wait` | boolean | Block until the run completes instead of returning immediately (default `false`) |
 | `waitTimeoutSeconds` | integer | Max seconds to wait when `wait` is true, 30–3600 (default `600`). A flow with [extended runtime](../configuration/extended-runtime.md) can run for up to 20 minutes, so raise this when the run includes one |

diff --git a/security/security-overview.md b/security/security-overview.md
@@ -24,7 +24,7 @@ DeviceCloud stores customer data and performs processing using Supabase and Rail
 
 Data held by our database and file storage providers is encrypted at rest with AES-256, and data sent over the internet is encrypted in transit via TLS. Credentials get additional protection at the application level: API keys are stored only as a one-way hash, and access tokens for connected services (such as Slack) are encrypted before being stored in the database.
 
-Your uploads are also encrypted end to end by default. The CLI (5.7.0 and later) encrypts your app binary, flows and environment variables on your machine before they are uploaded, each with its own key, so the copies held in our storage and caches are encrypted. Only our API holds the key needed to decrypt them. To upload without this encryption, pass `--no-encrypt` or set `DCD_ENCRYPT=0`. Older CLI versions encrypt only when you pass `--encrypt` or set `DCD_ENCRYPT=1`.
+On top of TLS, your uploads get envelope encryption by default. Before anything is uploaded, the CLI encrypts your app binary, flows and environment variables on your machine, each with its own random key (AES-256-GCM). It then encrypts each of those keys with DeviceCloud's public key (X25519), so the copies held in our storage and caches are ciphertext, and only our API can recover the keys that decrypt them. To turn envelope encryption off, pass `--no-encrypt` or set `DCD_ENCRYPT=0`. The upload is still encrypted in transit.
 
 ### Data Retention <a href="#data-retention" id="data-retention"></a>
Original file line number	Diff line number	Diff line change
Expand Up		@@ -58,4 +58,4 @@ See [Workspace Configuration](../configuration/workspace-config.md) for more inf

		### Referencing flows

		As of version 2.0.0, the CLI will search for all nested dependencies referenced by your YAML flows using Maestro keywords (`addMedia`, `runFlow`, `runScript`). From version 5.6.0 it also picks up `assertScreenshot` baselines named by a literal path. Files it can't find this way, such as a path containing a variable, can be added with [`includedPaths`](../configuration/workspace-config.md#includedpaths).
		The CLI searches for all nested dependencies referenced by your YAML flows using Maestro keywords (`addMedia`, `runFlow`, `runScript`), and picks up `assertScreenshot` baselines named by a literal path. Files it can't find this way, such as a path containing a variable, can be added with [`includedPaths`](../configuration/workspace-config.md#includedpaths).