Skip to content

v1.21.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 08 Aug 21:09
· 16 commits to main since this release
v1.21.0
6f15751
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

trvl 1.21.0

This release focuses on privacy, safer provider boundaries, booking-readiness evidence, and reliability under long-running searches. Default search still works without personal API keys.

Privacy and security

  • trvl share --format link no longer creates a public GitHub gist. It now prints or copies the trip card, leaving you in control of where it is shared. Existing gists remain in your GitHub account; use gh gist list and gh gist delete <id> to review or remove them.
  • Browser controls now make the coverage trade-off explicit. Cookie access remains enabled by default because protected hotel and rail sources rely on it; disabling it can materially reduce results. The headless fallback uses an empty profile only when a challenged source needs fresh cookies, without reading your existing browser sessions or taking focus. TRVL_NO_BROWSER_COOKIES disables access to your browser sessions, while TRVL_NO_TIER2_CDP disables the separate headless process. Visible-browser recovery remains a separate, provider-specific opt-in.
  • Provider definitions are now reviewed source embedded in the binary. Files under ~/.trvl/providers are left in place but no longer loaded or executed.
  • Private proxies can be enabled without allowing private destination addresses.
  • Local logs and error messages now sanitize optional webhook URLs when a service token is encoded in the URL.

Hotel booking evidence

  • trvl prices now distinguishes its source-level booking-readiness ceiling from property-specific downgrade reasons.
  • trvl rooms can reach ready when the source provides an exact room, a durable seller link, and explicit refundability evidence.
  • Seller cancellation terms and the upstream official-property-site flag are preserved when supplied. Missing evidence stays unknown rather than being inferred.

This work was based in part on feedback from Roberto Reale.

Reliability and correctness

  • Price watches now use a transactional database with bounded retention, cross-process locking, and a dry-run migration preview. Legacy files are backed up and retained.
  • Provider recovery, credential helpers, cookie extraction, and hack detection are bounded so they cannot stall later searches indefinitely.
  • Mixed-currency savings and cheapest-option comparisons now fail closed instead of attaching the wrong currency label or ranking incomparable values.
  • Wizz Air search uses the provider's current API version again.
  • Release automation and Homebrew checksum handling were hardened.

Before upgrading

If you use price watches, preview the migration first:

trvl watch migrate --dry-run

If you previously used custom provider JSON, move the provider definition into a reviewed source contribution or your own fork. The old files are not deleted, but v1.21.0 ignores them.

Install or upgrade

brew update
brew upgrade MikkoParkkola/tap/trvl
trvl version

Other published channels: GitHub binaries, npm (trvl-mcp), GHCR, the Go module proxy, and the official MCP Registry.

See the full changelog for all changes and migration details.

Assets 21
Loading