diff --git a/CHANGELOG.md b/CHANGELOG.md
index f0102a2..2b61cc3 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.7.0] - 2026-11-01
+
+### Highlights
+
+- Embed the exact `fetchkit` CLI in another program with `fetchkit_cli::run(args, &dyn CliHost)`; bashkit uses it for a sandboxed `fetchkit` builtin.
+- Fetch public TikTok, Vimeo, and SoundCloud metadata through oEmbed, and YouTube Shorts, live, and embed URLs.
+- Build without a TLS stack when you supply your own `HttpTransport`; require Markkit 0.3.
+
+### Breaking Changes
+
+- reqwest TLS, HTTP/2, proxy discovery, and body decompression are behind the new default `reqwest-tls` feature. Builds with `default-features = false` that use the built-in `ReqwestTransport` over HTTPS must enable `reqwest-tls`. `fetchkit-cli` gained matching `reqwest-tls` and `docs-pdf` features (on by default).
+
 ### Added
 
 - Public TikTok, Vimeo, and SoundCloud metadata fetching through oEmbed, available automatically in the library, CLI, MCP server, and Python bindings.
@@ -15,10 +27,15 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
-- **Breaking:** reqwest TLS, HTTP/2, proxy discovery, and body decompression are behind the new default `reqwest-tls` feature. Builds with `default-features = false` must enable it to use the built-in `ReqwestTransport` over HTTPS.
-- Require Markkit 0.2.
+- Require Markkit 0.3.
 - clap is built without color and suggestions; CLI help and errors are plain text.
 
+### What's Changed
+
+- feat(cli): embeddable CLI library + optional reqwest TLS ([#189](https://github.com/everruns/fetchkit/pull/189))
+- feat(fetchers): add public social media metadata support ([#188](https://github.com/everruns/fetchkit/pull/188))
+- ci: publish Rust crates with trusted OIDC ([#187](https://github.com/everruns/fetchkit/pull/187))
+
 ## [0.6.0] - 2026-10-23
 
 ### Highlights
diff --git a/Cargo.lock b/Cargo.lock
index 388cf9c..fa7fc60 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -913,7 +913,7 @@ checksum = "9f1f227452a390804cdb637b74a86990f2a7d7ba4b7d5693aac9b4dd6defd8d6"
 
 [[package]]
 name = "fetchkit"
-version = "0.6.0"
+version = "0.7.0"
 dependencies = [
  "async-trait",
  "base64",
@@ -948,7 +948,7 @@ dependencies = [
 
 [[package]]
 name = "fetchkit-cli"
-version = "0.6.0"
+version = "0.7.0"
 dependencies = [
  "async-trait",
  "bytes",
@@ -962,7 +962,7 @@ dependencies = [
 
 [[package]]
 name = "fetchkit-python"
-version = "0.6.0"
+version = "0.7.0"
 dependencies = [
  "fetchkit",
  "pyo3",
@@ -1742,9 +1742,9 @@ checksum = "c41e0c4fef86961ac6d6f8a82609f55f31b05e4fce149ac5710e439df7619ba4"
 
 [[package]]
 name = "markkit"
-version = "0.2.0"
+version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1d8fce8c0d6eda79af05de89944ed828693ca61ac117b19d79030f52e3f23ae8"
+checksum = "688329d19a51cc92a77ae70536ce55e9f5d45d86e542616066134cce8fd03b54"
 dependencies = [
  "calamine",
  "cfb",
diff --git a/Cargo.toml b/Cargo.toml
index 8912a21..bd3dc6f 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -3,7 +3,7 @@ resolver = "2"
 members = ["crates/*"]
 
 [workspace.package]
-version = "0.6.0"
+version = "0.7.0"
 edition = "2021"
 license = "MIT"
 authors = ["Everruns"]
@@ -61,7 +61,7 @@ tower = { version = "0.5", features = ["util"] }
 
 # Binary document extraction
 pdf-inspector = "0.1.8"
-markkit = { version = "0.2", default-features = false, features = ["docx", "spreadsheet"] }
+markkit = { version = "0.3", default-features = false, features = ["docx", "spreadsheet"] }
 calamine = { version = "0.37", default-features = false }
 zip = { version = "9", default-features = false, features = ["deflate"] }
 quick-xml = "0.41"
diff --git a/crates/fetchkit-cli/Cargo.toml b/crates/fetchkit-cli/Cargo.toml
index 5732629..bdc2dd1 100644
--- a/crates/fetchkit-cli/Cargo.toml
+++ b/crates/fetchkit-cli/Cargo.toml
@@ -21,7 +21,11 @@ path = "src/main.rs"
 doc = false
 
 [features]
-default = []
+# Same backends as the `fetchkit` crate's defaults. Embedders that supply their
+# own HttpTransport (bashkit) disable default features to drop reqwest's TLS.
+default = ["reqwest-tls", "docs-pdf", "docs-markkit"]
+reqwest-tls = ["fetchkit/reqwest-tls"]
+docs-pdf = ["fetchkit/docs-pdf"]
 bot-auth = ["fetchkit/bot-auth"]
 render-rakers = ["fetchkit/render-rakers"]
 docs-markkit = ["fetchkit/docs-markkit"]
@@ -31,7 +35,7 @@ docs-http = ["fetchkit/docs-http"]
 docs-all = ["fetchkit/docs-all"]
 
 [dependencies]
-fetchkit = { path = "../fetchkit", version = "0.6.0" }
+fetchkit = { path = "../fetchkit", version = "0.7.0", default-features = false }
 tokio = { workspace = true }
 clap = { workspace = true }
 serde = { workspace = true }
diff --git a/knowledge/log.md b/knowledge/log.md
index 3aa14eb..55d4091 100644
--- a/knowledge/log.md
+++ b/knowledge/log.md
@@ -2,6 +2,8 @@
 
 ## 2026-11-01
 
+* **Release 0.7.0**: ships the embeddable CLI library for bashkit's `fetchkit` builtin; Markkit 0.3 so bashkit links one Markkit. Minor bump for the `reqwest-tls` feature split.
+
 * **Embeddable CLI**: The CLI moved into the `fetchkit_cli` library (`run(args, &dyn CliHost)`) so bashkit can ship a `fetchkit` builtin with the identical interface. Hosts own stdio, env, MCP, and egress, and can refuse host-only flags. reqwest TLS/compression moved behind the default `reqwest-tls` feature; clap default features off; Markkit 0.2.
 
 ## 2026-10-27