Career Ops UI

v1.111.0 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 21d Productivity & Wikis

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 1 known CVE

Topics

airbnb-style ashby ats career-ops claude-code cv

+11 more

express greenhouse-api hh-ru job-application job-search lever local-first no-telemetry resume self-hosted sse

Summary

AI summary

CodeQL backlog closed with three defense‑in‑depth hardenings, including escaping truncated dangerous HTML tags.

Full changelog

[1.111.0] — 2026-07-06

Security — CodeQL backlog closeout. Three defense-in-depth hardenings that close the remaining static-analysis findings at the source instead of dismissing them. stripDangerousMarkdown now escapes the < of any truncated dangerous-tag opener (a payload ending in <script/<iframe/…) so its output provably contains no live dangerous tag. CV import reads an uploaded buffer's size through an explicit Number() coercion — a type-confusion barrier. Mode role-lines are now template strings interpolated with String.replace instead of stored functions, removing the dynamic-dispatch call entirely. No user-facing behavior change.

server/lib/security.mjs (final escape belt), server/lib/cv-import.mjs (coerced size), server/lib/prompts.mjs (string role-lines). Tests: tests/security-hardening-v1111.test.mjs (7) + updated v1108 guard test. No i18n/help/route changes.

New: none.

Security Fixes

Implemented three defense‑in‑depth hardenings to close remaining CodeQL static‑analysis findings; `stripDangerousMarkdown` now escapes the `<` character in truncated dangerous tag openers.

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track Career Ops UI

Get notified when new releases ship.

About Career Ops UI

All releases →