Career Ops UI

v1.108.0 Security

This release includes 3 security fixes for security teams reviewing exposed deployments.

Published 21d Productivity & Wikis

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 3 known CVEs

Topics

airbnb-style ashby ats career-ops claude-code cv

+11 more

express greenhouse-api hh-ru job-application job-search lever local-first no-telemetry resume self-hosted sse

Summary

AI summary

Security hardening fixes three low-severity issues without altering valid behavior.

Full changelog

[1.108.0] — 2026-07-06

Security hardening (CodeQL triage, round 2). Three more low-severity findings fixed: the mode-prompt builder resolves the locale role-line by own key + typeof === function so a tampered locale can't dispatch to a prototype method (unvalidated-dynamic-method-call); the PDF-filename slug is capped to 200 chars before the dash-trim regex so an all-dash input can't backtrack (polynomial ReDoS); and document import coerces an array filename (a repeated header) to a string (type-confusion). No behavior change for valid input.

server/lib/prompts.mjs, server/lib/routes/runners.mjs, server/lib/cv-import.mjs + tests/security-hardening-v1108.test.mjs (3). Over v1.106–v1.108 the static-analysis backlog went from 167 to ~14, with every genuinely security-relevant finding fixed and the remainder (guarded/sanitized false positives + note-level lint) dismissed with rationale.

New: none.

Security Fixes

Locale role-line resolution now requires `typeof === function` to prevent unvalidated dynamic method calls.
PDF filename slug capped at 200 characters before dash-trim regex to avoid polynomial ReDoS from all-dash input.
Document import coerces repeated `filename` header array to string, fixing type‑confusion.

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track Career Ops UI

Get notified when new releases ship.

About Career Ops UI

All releases →