Starstruk Logo MarkStarstruk

v3.23.1

mvanhorn/last30days-skillv3.23.1Sep 8, 2026by github-actions[bot]

AI Summary

This maintenance release focuses on reliability and security, introducing fixes for Bluesky session management, credential handling on redirects, and creator provenance tracking. It also includes dependency updates and documentation refinements.

Key Highlights

  • Bluesky sessions now correctly refresh using refresh tokens to handle expiration.
  • Credential headers are stripped on cross-origin redirects to enhance security.
  • Named Instagram and TikTok creators now retain first-party provenance in search results.
  • Keychain checks now verify entry existence without requesting plaintext passwords.
  • Citation handling has been updated for Cursor agent chat interactions.

New Features

  • Bluesky refresh token integration for expired sessions.
  • Stripping of credential headers on cross-origin redirects.
  • First-party provenance preservation for named creators.
  • Keychain presence checks without password prompts.
  • Cursor agent chat citation handling.

Full Release Notes

## v3.23.1 — reliability and security fixes

This maintenance release brings together the reviewed PR cleanup. No new research sources or authentication defaults are introduced.

### Highlights

- **More reliable research:** Bluesky refreshes expired sessions correctly, explicit research plans retain their selected sources, and named Instagram/TikTok creators retain first-party provenance in results.
- **Safer execution:** cross-origin redirects strip credential headers, the Claude Code hook no longer falls back to the current directory, and automatically discovered MCP Python interpreters must resolve to absolute paths.
- **Quieter Keychain checks:** setup and listing check whether entries exist without requesting plaintext passwords. The existing credential writer is unchanged; this is not a complete fix for command-line credential exposure.
- **Maintenance:** clearer hookless-install guidance, portable Amazon test dates, citation handling for Cursor agent chat, and security-tool updates.

Codex authentication and momentum analysis remain future proposals, not features shipped in this release.

Thanks to @Comradery64 for the original Keychain contribution in [#1061](https://github.com/mvanhorn/last30days-skill/pull/1061); the safe presence-check subset shipped through [#1111](https://github.com/mvanhorn/last30days-skill/pull/1111).

## What's Changed
* fix(skill): Grok Bot / Cursor agent chat is a hidden-link citation host (LAW 8 detects CURSOR_AGENT) by @mvanhorn in https://github.com/mvanhorn/last30days-skill/pull/1095
* chore(deps): bump github/codeql-action/upload-sarif from 4.37.6 to 4.37.9 by @dependabot[bot] in https://github.com/mvanhorn/last30days-skill/pull/1106
* chore(deps): bump zizmorcore/zizmor-action from 0.6.2 to 0.6.3 by @dependabot[bot] in https://github.com/mvanhorn/last30days-skill/pull/1105
* chore(deps): bump google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml from 2.5.0 to 2.5.1 by @dependabot[bot] in https://github.com/mvanhorn/last30days-skill/pull/1079
* docs: add Validate workflow status badge to README by @SomSamantray in https://github.com/mvanhorn/last30days-skill/pull/1098
* docs(skill): correct LAW count in SKILL.md (five -> eleven) by @khsaurabh in https://github.com/mvanhorn/last30days-skill/pull/1102
* fix(http): drop credential headers on cross-origin redirects by @khsaurabh in https://github.com/mvanhorn/last30days-skill/pull/1069
* fix(hooks): use bare CLAUDE_PLUGIN_ROOT in SessionStart by @khsaurabh in https://github.com/mvanhorn/last30days-skill/pull/1092
* docs(skill): note config hook ships only with Claude Code plugin install by @khsaurabh in https://github.com/mvanhorn/last30days-skill/pull/1103
* test: keep Amazon date fixture portable on Windows by @dajiaohuang in https://github.com/mvanhorn/last30days-skill/pull/1080
* harden: detected non-static command inside command in run.go by @anupamme in https://github.com/mvanhorn/last30days-skill/pull/1109
* fix: named creator accounts (--ig-creators / --creators) count as first-party provenance by @khsaurabh in https://github.com/mvanhorn/last30days-skill/pull/1104
* fix(planner): honor operator --plan subquery sources at default/deep by @TheGusishere in https://github.com/mvanhorn/last30days-skill/pull/1093
* fix(bluesky): use refresh tokens for expired sessions by @huyua9 in https://github.com/mvanhorn/last30days-skill/pull/1065
* fix(keychain): check presence without requesting passwords by @mvanhorn in https://github.com/mvanhorn/last30days-skill/pull/1111
* chore(deps): bump trufflesecurity/trufflehog from 3.96.0 to 3.97.1 by @dependabot[bot] in https://github.com/mvanhorn/last30days-skill/pull/1107
* fix(ci): restore scheduled OSV scanner startup by @mvanhorn in https://github.com/mvanhorn/last30days-skill/pull/1112
* chore(release): bump version to 3.23.1 by @github-actions[bot] in https://github.com/mvanhorn/last30days-skill/pull/1113

## New Contributors
* @dajiaohuang made their first contribution in https://github.com/mvanhorn/last30days-skill/pull/1080
* @TheGusishere made their first contribution in https://github.com/mvanhorn/last30days-skill/pull/1093
* @huyua9 made their first contribution in https://github.com/mvanhorn/last30days-skill/pull/1065

**Full Changelog**: https://github.com/mvanhorn/last30days-skill/compare/v3.23.0...v3.23.1