skillshare v0.30.2 Release Notes
TL;DR
- Python docstrings that mention credential paths no longer block installs. A credential-access match in a Python comment or docstring is now HIGH instead of CRITICAL.
- Update now restarts the dashboard on Homebrew installs. The dashboard no longer stays on the old version after upgrading through Homebrew.
- Root-scope commit and push no longer stop at tracked repos. Tracked repos that Git ignores are skipped by the nested repo check.
Audit: credential paths in Python comments and docstrings
The credential-access-* rules match whole lines. A Python docstring that only mentioned ~/.aws/credentials, for example in a cat example, counted as a CRITICAL read and blocked the skill at the default threshold. Now:
- In
.pyfiles, a match on a comment-only line or inside a docstring is HIGH. It still shows, and it still blocks when the threshold is HIGH. - Strings that code can use stay CRITICAL: arguments, assignments, strings inside brackets, f-strings, and code before a trailing comment. Every line of a file that reads
__doc__stays CRITICAL too. - A severity you set for the rule applies everywhere, including comments and docstrings.
auditoutput, the audit TUIs, install and update warnings and the dashboard say the finding was lowered from CRITICAL. JSON and SARIF carryseverityContext: "python-inert". (#817, #819)
Dashboard: Update now on Homebrew
On a Homebrew install, Update now runs brew upgrade, which removes the versioned folder the dashboard was running from. The restart then failed and the old version kept running. The dashboard now restarts through Homebrew's skillshare link, which points at the new version. Other installs restart as before. (#815, #816)
Git: root scope and tracked repos
With git_root: root, skillshare commit and push aborted with "nested git repositories must be disabled first" for every tracked repo. Tracked repos are listed in the managed .gitignore block, so Git never uploads them, and renaming their .git as suggested broke skillshare update.
Nested repos that Git ignores are now skipped, so they no longer appear in the warning or on the dashboard's Git Sync page. A nested repo that Git would still commit, such as a skill you cloned by hand or one already committed as a submodule, still stops the push. (#820, #821)