This release includes 3 breaking changes for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
Topics
+1 more
Affected surfaces
ReleasePort's take
Moderate signalv5.1.4 requires ENCRYPTION_SECRET, REDIS_URL, and S3 storage for self-hosted deployments running AI features. Saved providers, Agent workspace, and attachments now enforce these infrastructure dependencies with no local-filesystem fallback.
Why it matters: Self-hosted operators must configure Redis, add ENCRYPTION_SECRET, and provision S3 storage before upgrading. These are blocking requirements; configure now to prevent upgrade failures.
Summary
AI summarySelf‑hosted AI features now require ENCRYPTION_SECRET for provider credentials, a Redis instance via REDIS_URL, and S3 storage for private agent attachments.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Breaking | Medium |
Saved AI providers now require ENCRYPTION_SECRET for self-hosted deployments Saved AI providers now require ENCRYPTION_SECRET for self-hosted deployments Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Breaking | Medium |
AI Agent workspace requires REDIS_URL for self-hosted deployments AI Agent workspace requires REDIS_URL for self-hosted deployments Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Breaking | Medium |
Private agent attachments require S3-compatible storage; local filesystem rejected Private agent attachments require S3-compatible storage; local filesystem rejected Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Feature | Medium |
Added dedicated AI Agent workspace with chat, threads, and resume preview Added dedicated AI Agent workspace with chat, threads, and resume preview Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Feature | Medium |
Added server-side encrypted AI provider management with testing Added server-side encrypted AI provider management with testing Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Feature | Medium |
Added attachment rate limits, S3 ACLs, validation, and transactional writes Added attachment rate limits, S3 ACLs, validation, and transactional writes Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Feature | Medium |
Agent edits display as reviewable patches with raw JSON details and revert support Agent edits display as reviewable patches with raw JSON details and revert support Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Feature | Medium |
Added Agent tools for resume reading, attachment access, and JSON Patch updates Added Agent tools for resume reading, attachment access, and JSON Patch updates Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Feature | Medium |
Public resume pages now render using PDF.js viewer for parity Public resume pages now render using PDF.js viewer for parity Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Feature | Medium |
Improved resume preview spacing normalization across viewers Improved resume preview spacing normalization across viewers Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Feature | Medium |
Added archive and delete actions for Agent threads with ownership checks Added archive and delete actions for Agent threads with ownership checks Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Feature | Medium |
Added FLAG_ALLOW_UNSAFE_AI_BASE_URL for trusted self-hosted deployments Added FLAG_ALLOW_UNSAFE_AI_BASE_URL for trusted self-hosted deployments Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Feature | Medium |
Added metric-compatible font aliases for Times New Roman, Cambria, Arial, Garamond, Calibri Added metric-compatible font aliases for Times New Roman, Cambria, Arial, Garamond, Calibri Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Bugfix | Medium |
Restored legacy font names with metric-compatible mappings preventing layout shifts Restored legacy font names with metric-compatible mappings preventing layout shifts Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Refactor | Medium |
Added development Dockerfile and improved Compose services with health checks Added development Dockerfile and improved Compose services with health checks Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Refactor | Medium |
Updated self-hosting documentation for Redis, encryption, S3, and Agent features Updated self-hosting documentation for Redis, encryption, S3, and Agent features Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Refactor | Medium |
Added comprehensive guides for AI Agent workspace, tools, and related features Added comprehensive guides for AI Agent workspace, tools, and related features Source: llm_adapter@2026-05-21 Confidence: low |
— |
Full changelog
[!IMPORTANT]
Self-hosters using AI features: saved AI providers now requireENCRYPTION_SECRET, and the new AI Agent workspace also requiresREDIS_URL. Agent attachments require S3-compatible storage for private objects; local filesystem storage still works for the rest of the app, but rejects private agent attachments.
Highlights
- New AI Agent workspace. Added a dedicated full-screen Agent workspace for working on isolated AI draft copies of resumes. Threads include a sidebar, chat, tool activity, file attachments, and a read-only resume preview with PDF download support. #3062
- Reviewable and reversible agent edits. Agent-applied resume patches now appear as expandable tool activity, with raw JSON Patch details, operation summaries, revert support, and clear conflict handling when the resume has changed. #3062
- Public resumes now render with PDF.js. Public resume pages now use the PDF.js-based viewer path, improving parity between the public page, builder preview, and exported PDF. #3061
AI & Agent Workflows
- Added server-side AI provider management with encrypted credentials, provider testing, and provider/model capability checks. This replaces the old local AI store and keeps AI configuration centralized. #3062
- Added Agent tools for reading resume drafts, fetching public URLs, reading supported attachments, asking follow-up questions, and applying JSON Patch updates to the AI draft. #3062
- Added archive and delete actions for Agent threads, including read-only archived states, in-flight run cleanup when archiving, and ownership checks before destructive deletion. #3062
- Added attachment upload rate limits, private S3 ACLs for Agent attachments, runtime validation for streamed messages, transactional patch/action writes, and a unique message sequence index for safer Agent runs. #3062
- Added
FLAG_ALLOW_UNSAFE_AI_BASE_URLfor trusted self-hosted deployments that need private or local AI provider URLs, while still restricting provider URLs tohttporhttps. Thanks to @SirSKillz. #3059
Resume Rendering & Fonts
- Restored legacy local font names from v5.0.x by mapping them to metric-compatible bundled web fonts, preventing upgraded resumes from unexpectedly changing line breaks, page counts, or overall layout. Thanks to @JamesGoslings. #3057
- Added metric-compatible aliases for
Times New Roman,Cambria,Arial,Garamond, andCalibri, including Carlito as the Calibri-compatible target. #3057 - Improved resume preview spacing normalization and added focused coverage for the public PDF viewer and preview helpers. #3061, #3062
Self-Hosting, Docs & Maintenance
- Added a development Dockerfile plus improved Compose development services and health checks for running Reactive Resume with local dependencies. 1294d3354
- Updated self-hosting documentation for Redis, encrypted AI provider credentials, optional Cloudflare URL extraction, private Agent attachments, S3 path-style storage, and unsafe AI base URL behavior. #3062, #3059
- Added new and refreshed guides for the AI Agent workspace, Agent tools, AI setup, builder dock, dashboard management, importing, exporting, public sharing, and private notes. #3062, affa1d664
- Removed a stale Custom CSS documentation link now that custom CSS is no longer part of the v5.1 renderer flow. #3056
- Added a Reactive Resume design system reference and updated dependencies across the workspace. #3062
Full Changelog: v5.1.3...v5.1.4
Breaking Changes
- Saved AI provider credentials must be encrypted; `ENCRYPTION_SECRET` is now required.
- AI Agent workspace requires a Redis instance via the `REDIS_URL` environment variable.
- Private agent attachments must use S3‑compatible storage; local filesystem rejects them.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About reactive-resume
A one-of-a-kind resume builder that keeps your privacy in mind. Completely secure, customizable, portable, open-source and free forever. Try it out today!
Related context
Related tools
Beta — feedback welcome: [email protected]