This release adds 3 notable features for engineering teams evaluating rollout.
✓ No known CVEs patched in this version
Topics
+14 more
Affected surfaces
ReleasePort's take
Moderate signalThe release adds macOS Keychain credential source support and honors the EXCLUDE_SOURCES environment variable to filter source counts and pipeline steps.
Why it matters: Enables secure credential storage on macOS and gives operators explicit control over included sources via EXCLUDE_SOURCES, improving both security and configurability.
Summary
AI summaryAdd macOS Keychain credential source, support Brave browser cookie extraction, and expose EXCLUDE_SOURCES env var.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Security | High |
Replace unsafe eval with declare in check-config.sh hook for configuration validation. Replace unsafe eval with declare in check-config.sh hook for configuration validation. Source: granite4.1:30b@2026-05-21-audit Confidence: low |
— |
| Breaking | Medium |
Claim contributor entry — @thinkun. Claim contributor entry — @thinkun. Source: granite4.1:8b-q6_K@2026-05-21 Confidence: low |
— |
| Feature | Medium |
Rename digg to 'Digg' and bump per-cluster post limits. Rename digg to 'Digg' and bump per-cluster post limits. Source: granite4.1:8b-q6_K@2026-05-21 Confidence: high |
— |
| Feature | Medium |
Add macOS Keychain credential source support. Add macOS Keychain credential source support. Source: granite4.1:8b-q6_K@2026-05-21 Confidence: high |
— |
| Feature | Medium |
Honor EXCLUDE_SOURCES env var in source count and pipeline filter. Honor EXCLUDE_SOURCES env var in source count and pipeline filter. Source: granite4.1:8b-q6_K@2026-05-21 Confidence: high |
— |
| Feature | Medium |
Route yt-dlp through SSH host for residential IP egress (youtube). Route yt-dlp through SSH host for residential IP egress (youtube). Source: granite4.1:8b-q6_K@2026-05-21 Confidence: high |
— |
| Bugfix | Medium |
Bump sync cache target to 3.2.1 to match SKILL.md. Bump sync cache target to 3.2.1 to match SKILL.md. Source: granite4.1:8b-q6_K@2026-05-21 Confidence: high |
— |
| Bugfix | Medium |
Point sync.sh at this repo's plugin cache, not private repo's. Point sync.sh at this repo's plugin cache, not private repo's. Source: granite4.1:8b-q6_K@2026-05-21 Confidence: high |
— |
| Bugfix | Medium |
Write --plan / --competitors-plan to tmpfile. Write --plan / --competitors-plan to tmpfile. Source: granite4.1:8b-q6_K@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
Make ScrapeCreators key optional in openclaw. Make ScrapeCreators key optional in openclaw. Source: granite4.1:8b-q6_K@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
Save comparison HTML artifacts. Save comparison HTML artifacts. Source: granite4.1:8b-q6_K@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
Unblock SC YouTube and multi-token HN searches. Unblock SC YouTube and multi-token HN searches. Source: granite4.1:8b-q6_K@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
Align SC source gating between code and docs. Align SC source gating between code and docs. Source: granite4.1:8b-q6_K@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
Retry subprocess on non-JSON stdout (HTML anti-bot interstitial) in bird_x. Retry subprocess on non-JSON stdout (HTML anti-bot interstitial) in bird_x. Source: granite4.1:8b-q6_K@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
Expand retry budget and exponential backoff on DNS resolution failure (http). Expand retry budget and exponential backoff on DNS resolution failure (http). Source: granite4.1:8b-q6_K@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
Write --plan / --competitors-plan output to a temporary file. Write --plan / --competitors-plan output to a temporary file. Source: granite4.1:30b@2026-05-21-audit Confidence: low |
— |
| Refactor | Medium |
Drop requests dependency, route providers through stdlib http wrapper. Drop requests dependency, route providers through stdlib http wrapper. Source: granite4.1:8b-q6_K@2026-05-21 Confidence: low |
— |
| Refactor | Medium |
SKILL.md-relative path resolver, drop Codex native plugin. SKILL.md-relative path resolver, drop Codex native plugin. Source: granite4.1:8b-q6_K@2026-05-21 Confidence: low |
— |
| Refactor | Medium |
Replace SKILL_ROOT resolver with SKILL_DIR substitution. Replace SKILL_ROOT resolver with SKILL_DIR substitution. Source: granite4.1:8b-q6_K@2026-05-21 Confidence: low |
— |
| Refactor | Medium |
Consolidate SKILL.md version regex into lib/skill_meta.py. Consolidate SKILL.md version regex into lib/skill_meta.py. Source: granite4.1:8b-q6_K@2026-05-21 Confidence: low |
— |
| Other | Medium |
Modernize install story everywhere, delete sync.sh. Modernize install story everywhere, delete sync.sh. Source: granite4.1:8b-q6_K@2026-05-21 Confidence: low |
— |
| Other | Medium |
Add gogcli #589 zoom demo asset. Add gogcli #589 zoom demo asset. Source: granite4.1:8b-q6_K@2026-05-21 Confidence: low |
— |
| Other | Medium |
Reframe as multi-harness Agent Skills package, flip CLAUDE.md ↔ AGENTS.md. Reframe as multi-harness Agent Skills package, flip CLAUDE.md ↔ AGENTS.md. Source: granite4.1:8b-q6_K@2026-05-21 Confidence: low |
— |
| Other | Medium |
Compound learning on release-time consistency-test cascade failures documented. Compound learning on release-time consistency-test cascade failures documented. Source: granite4.1:8b-q6_K@2026-05-21 Confidence: low |
— |
| Other | Medium |
Bump pytest from 9.0.2 to 9.0.3 for dev dependencies. Bump pytest from 9.0.2 to 9.0.3 for dev dependencies. Source: granite4.1:8b-q6_K@2026-05-21 Confidence: low |
— |
| Other | Medium |
Run full pytest suite, repair 13 rotted tests. Run full pytest suite, repair 13 rotted tests. Source: granite4.1:8b-q6_K@2026-05-21 Confidence: low |
— |
| Other | Medium |
Migrate to gemini-3.1-flash-lite GA model. Migrate to gemini-3.1-flash-lite GA model. Source: granite4.1:8b-q6_K@2026-05-21 Confidence: low |
— |
| Other | Medium |
Capture eval-not-in-CI design decision under docs/solutions/. Capture eval-not-in-CI design decision under docs/solutions/. Source: granite4.1:8b-q6_K@2026-05-21 Confidence: low |
— |
| Other | Low |
affected_surface affected_surface Source: granite4.1:8b-q6_K@2026-05-21 Confidence: low |
— |
Full changelog
What's Changed
- feat(digg): rename to 'Digg' and bump per-cluster post limits by @mvanhorn in https://github.com/mvanhorn/last30days-skill/pull/372
- fix(sync): bump cache target to 3.2.1 to match SKILL.md by @mvanhorn in https://github.com/mvanhorn/last30days-skill/pull/397
- refactor: drop requests dep, route all providers through stdlib http wrapper by @tmchow in https://github.com/mvanhorn/last30days-skill/pull/393
- fix(sync): point sync.sh at this repo's plugin cache, not the private repo's by @tmchow in https://github.com/mvanhorn/last30days-skill/pull/402
- refactor(skill): SKILL.md-relative path resolver, drop Codex native plugin by @tmchow in https://github.com/mvanhorn/last30days-skill/pull/400
- fix(skill): write --plan / --competitors-plan to tmpfile (closes #403) by @tmchow in https://github.com/mvanhorn/last30days-skill/pull/404
- docs+refactor: modernize install story everywhere, delete sync.sh by @tmchow in https://github.com/mvanhorn/last30days-skill/pull/405
- chore: add gogcli #589 zoom demo asset by @mvanhorn in https://github.com/mvanhorn/last30days-skill/pull/408
- refactor(skill): replace SKILL_ROOT resolver with SKILL_DIR substitution by @tmchow in https://github.com/mvanhorn/last30days-skill/pull/409
- docs: reframe as multi-harness Agent Skills package, flip CLAUDE.md ↔ AGENTS.md by @tmchow in https://github.com/mvanhorn/last30days-skill/pull/410
- refactor: consolidate SKILL.md version regex into lib/skill_meta.py by @tmchow in https://github.com/mvanhorn/last30days-skill/pull/412
- Claim contributor entry — @thinkun by @thinkun in https://github.com/mvanhorn/last30days-skill/pull/363
- fix(openclaw): make ScrapeCreators key optional by @Gujiassh in https://github.com/mvanhorn/last30days-skill/pull/392
- docs: compound learning on release-time consistency-test cascade failures by @tmchow in https://github.com/mvanhorn/last30days-skill/pull/413
- feat(env): macOS Keychain credential source by @DamienStevens in https://github.com/mvanhorn/last30days-skill/pull/407
- chore(deps-dev): bump pytest from 9.0.2 to 9.0.3 by @dependabot[bot] in https://github.com/mvanhorn/last30days-skill/pull/414
- feat: honor EXCLUDE_SOURCES env var in source count + pipeline filter by @spiky02plateau in https://github.com/mvanhorn/last30days-skill/pull/399
- fix: save comparison HTML artifacts by @kuyua9 in https://github.com/mvanhorn/last30days-skill/pull/389
- fix(sources): unblock SC YouTube + multi-token HN searches by @bradferguson in https://github.com/mvanhorn/last30days-skill/pull/388
- fix(sources): align SC source gating between code and docs by @tmchow in https://github.com/mvanhorn/last30days-skill/pull/415
- fix(bird_x): retry subprocess on non-JSON stdout (HTML anti-bot interstitial) by @lustrousgorilla in https://github.com/mvanhorn/last30days-skill/pull/383
- fix(ci): run full pytest suite, repair 13 rotted tests by @tmchow in https://github.com/mvanhorn/last30days-skill/pull/416
- fix(http): expand retry budget + exponential backoff on DNS resolution failure by @lustrousgorilla in https://github.com/mvanhorn/last30days-skill/pull/382
- chore: migrate to gemini-3.1-flash-lite GA model by @j-sperling in https://github.com/mvanhorn/last30days-skill/pull/378
- feat(youtube): route yt-dlp through SSH host for residential IP egress by @shoobee in https://github.com/mvanhorn/last30days-skill/pull/376
- docs: capture eval-not-in-CI design decision under docs/solutions/ by @tmchow in https://github.com/mvanhorn/last30days-skill/pull/417
- docs: correct ScrapeCreators free tier to 100 credits (closes #367) by @voidborne-d in https://github.com/mvanhorn/last30days-skill/pull/369
- fix: skip POSIX secret warning on Windows by @dinakars777 in https://github.com/mvanhorn/last30days-skill/pull/357
- chore: add greptile.json (triggerOnUpdates + statusCheck) by @tmchow in https://github.com/mvanhorn/last30days-skill/pull/418
- feat(store): record per-run finding sightings by @hnshah in https://github.com/mvanhorn/last30days-skill/pull/373
- ci: add advisory security workflow by @hnshah in https://github.com/mvanhorn/last30days-skill/pull/368
- fix(version): replace hardcoded v3.0.0 with dynamic _skill_version() by @davemorin in https://github.com/mvanhorn/last30days-skill/pull/365
- fix: initialize OpenClaw poll timing once by @dinakars777 in https://github.com/mvanhorn/last30days-skill/pull/358
- feat(web): auto-enrich Reddit URLs from web search via JSON API by @davemorin in https://github.com/mvanhorn/last30days-skill/pull/366
- fix(hooks): replace unsafe eval with declare in check-config.sh by @davemorin in https://github.com/mvanhorn/last30days-skill/pull/364
- chore: remove orphaned SPEC.md and TASKS.md by @tmchow in https://github.com/mvanhorn/last30days-skill/pull/419
- docs: fix runtime skill spec link by @dinakars777 in https://github.com/mvanhorn/last30days-skill/pull/348
- Fix path-quoting in SessionStart check-config hook (handles spaces in… by @UncleMike1988 in https://github.com/mvanhorn/last30days-skill/pull/337
- docs: fix bug report repro command by @dinakars777 in https://github.com/mvanhorn/last30days-skill/pull/346
- docs: correct changelog skill link note by @dinakars777 in https://github.com/mvanhorn/last30days-skill/pull/351
- docs: update search key file paths by @dinakars777 in https://github.com/mvanhorn/last30days-skill/pull/347
- fix(render): use forward slashes in save-path footer for Windows by @dzivkovi in https://github.com/mvanhorn/last30days-skill/pull/338
- fix(planner): register xquik in SOURCE_CAPABILITIES (#319) by @davemorin in https://github.com/mvanhorn/last30days-skill/pull/336
- fix: honor explicit optional source requests by @dinakars777 in https://github.com/mvanhorn/last30days-skill/pull/356
- fix: route parallel web backend through grounding by @dinakars777 in https://github.com/mvanhorn/last30days-skill/pull/354
- fix(grounding): align Parallel AI search with current API schema by @flyingice in https://github.com/mvanhorn/last30days-skill/pull/341
- fix(youtube): surface transcript-fetch ratio + add degraded nudge for stale yt-dlp by @dzivkovi in https://github.com/mvanhorn/last30days-skill/pull/340
- chore: sync gemini extension version by @dinakars777 in https://github.com/mvanhorn/last30days-skill/pull/349
- docs: fix stale script paths by @dinakars777 in https://github.com/mvanhorn/last30days-skill/pull/345
- test: cover parallel grounding backend by @dinakars777 in https://github.com/mvanhorn/last30days-skill/pull/355
- fix: prefer sandboxed Safari cookie path by @Bortlesboat in https://github.com/mvanhorn/last30days-skill/pull/343
- Preserve clean mode for last run state by @iamitp in https://github.com/mvanhorn/last30days-skill/pull/334
- Add Brave browser support for X/Twitter cookie extraction by @kaushikgopal in https://github.com/mvanhorn/last30days-skill/pull/320
- fix: Canonicalize ambiguous GitHub repo resolution for product comparisons by @nidhi-singh02 in https://github.com/mvanhorn/last30days-skill/pull/302
- docs: add CONFIGURATION.md + README pointers by @dzivkovi in https://github.com/mvanhorn/last30days-skill/pull/339
- fix: correct invalid OPENROUTER_DEFAULT model ID by @GAOJIAN-0106 in https://github.com/mvanhorn/last30days-skill/pull/323
- feat: configuration enablement — env-var defaults + source resilience by @dzivkovi in https://github.com/mvanhorn/last30days-skill/pull/344
- fix: make hooks.json polyglot for Gemini CLI and Claude Code compatibility by @flyingnobita in https://github.com/mvanhorn/last30days-skill/pull/318
New Contributors
- @thinkun made their first contribution in https://github.com/mvanhorn/last30days-skill/pull/363
- @DamienStevens made their first contribution in https://github.com/mvanhorn/last30days-skill/pull/407
- @dependabot[bot] made their first contribution in https://github.com/mvanhorn/last30days-skill/pull/414
- @spiky02plateau made their first contribution in https://github.com/mvanhorn/last30days-skill/pull/399
- @kuyua9 made their first contribution in https://github.com/mvanhorn/last30days-skill/pull/389
- @bradferguson made their first contribution in https://github.com/mvanhorn/last30days-skill/pull/388
- @lustrousgorilla made their first contribution in https://github.com/mvanhorn/last30days-skill/pull/383
- @shoobee made their first contribution in https://github.com/mvanhorn/last30days-skill/pull/376
- @voidborne-d made their first contribution in https://github.com/mvanhorn/last30days-skill/pull/369
- @dinakars777 made their first contribution in https://github.com/mvanhorn/last30days-skill/pull/357
- @UncleMike1988 made their first contribution in https://github.com/mvanhorn/last30days-skill/pull/337
- @dzivkovi made their first contribution in https://github.com/mvanhorn/last30days-skill/pull/338
- @flyingice made their first contribution in https://github.com/mvanhorn/last30days-skill/pull/341
- @Bortlesboat made their first contribution in https://github.com/mvanhorn/last30days-skill/pull/343
- @iamitp made their first contribution in https://github.com/mvanhorn/last30days-skill/pull/334
- @kaushikgopal made their first contribution in https://github.com/mvanhorn/last30days-skill/pull/320
- @nidhi-singh02 made their first contribution in https://github.com/mvanhorn/last30days-skill/pull/302
- @GAOJIAN-0106 made their first contribution in https://github.com/mvanhorn/last30days-skill/pull/323
- @flyingnobita made their first contribution in https://github.com/mvanhorn/last30days-skill/pull/318
Full Changelog: https://github.com/mvanhorn/last30days-skill/compare/v3.2.0...v3.3.0
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Last30Days Skill
All releases →Related context
Related tools
Beta — feedback welcome: [email protected]