This release includes 1 security fix for security teams reviewing exposed deployments.
Published 1mo
Productivity & Wikis
✓ No known CVEs patched
This release patches 1 known CVE
Topics
airbnb-style
ashby
ats
career-ops
claude-code
cv
+11 more
express
greenhouse-api
hh-ru
job-application
job-search
lever
local-first
no-telemetry
resume
self-hosted
sse
Affected surfaces
auth
rbac
Summary
AI summaryUpdates Tests, SSRF-safe, and regex across a mixed release.
Full changelog
[1.76.0] — 2026-06-26
Parent career-ops v1.13.0 parity — six new job sources, scanner hardening, and an uncapped results table.
Added
- Six per-tenant ATS sources — BambooHR, Breezy HR, Comeet, Personio, Recruitee, SolidJobs. They auto-detect from the
careers_urlhost (Comeet needs the fullapi:careers-api URL) and each pins its host with an anchored regex +redirect:'error'(SSRF-safe). All selectable in the#/scanSource dropdown — the registry now ships 25 adapters (20 EN + 5 RU). Adds afetchTexthelper for Personio's XML feed. trust_filter— optional, annotate-only trust scoring (0–100, level high/medium/low, flags) for each scanned posting. Sub-highrows get a language-neutral ⚠ badge in#/scan; nothing is ever dropped.- Arbeitsagentur
remoteMatch+remoteMaxPages— config-driven remote detection:title(regex),filter(server-sidehomeoffice=nv_true+ pagination), oroff.
Changed
- No scan result cap. The
MAX_STORED_RESULTSdisplay cap (2000) was removed — every matched posting is stored and the#/scantable pages through them (200/page). Large sweeps no longer lose their tail. - Title-filter robustness — short all-letter acronyms (COO, SDR…) now match on word boundaries (no more “COO” in “Coordinator”); malformed
title_filterconfig can no longer crash a scan. Both the ATS and regional scanners.
Tests
- +32 cases (1190 → 1222):
sources-ats-providers,title-filter,arbeitsagentur-remote,trust-validator, and a rewrittenscan-result-cap“no cap” guard.
Security Fixes
- Title-filter robustness fixes prevent crashes from malformed config and ensure acronym matches only on word boundaries; SSRF safety enforced via anchored regexes for ATS source detection
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Career Ops UI
All releases →Related context
Related tools
Beta — feedback welcome: [email protected]