Skip to content

reactive-resume

v5.2.3 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 18d Productivity & Wikis
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 1 known CVE

Topics

better-auth react resume resume-builder self-hosted tailwindcss
+1 more
tanstack-start

Affected surfaces

crypto_tls

Summary

AI summary

Updates Reliability & Self-Hosting, Resume Builder & Exports, and Highlights across a mixed release.

Full changelog

Highlights

  • More AI provider choices. The AI settings page now supports Mistral AI, Cohere, xAI Grok, Groq, DeepSeek, Together.ai, Fireworks, Cerebras, and Perplexity, with provider defaults filled in for each. Ollama is now labeled as Ollama Cloud to make the hosted integration clearer.
  • Cleaner cover-letter exports. Cover-letter PDF, DOCX, and Markdown downloads now export the letter without resume header chrome by default, and PDF downloads include a new toggle for adding the resume header back when needed. 8570c1c70
  • More accurate public resume statistics. Rapid repeat views from the same client are now de-duplicated before incrementing public resume view counts. 97ab3c973

AI & Integrations

  • Added first-class AI SDK support for Mistral AI, Cohere, xAI, Groq, DeepSeek, Together.ai, Fireworks, Cerebras, and Perplexity across saved provider settings and AI service calls.
  • Made AI provider connection tests work with OpenAI-compatible models that do not support structured output, with a clearer error when a model returns too much text during the test.
  • Published Reactive Resume MCP registry metadata so MCP clients and directories can discover the hosted remote server. 73daf22b2

Resume Builder & Exports

  • Fixed cover-letter-only exports across PDF, DOCX, and Markdown so they no longer include resume contact details or a redundant cover-letter heading. 8570c1c70
  • Added an Include resume header option for cover-letter PDF downloads.
  • Improved the layout page header so the Full Width and Delete Page controls fit better in narrow builder sidebars.
  • Simplified the current-template card by removing its hover live preview; template switching still opens the full template gallery.

Reliability & Self-Hosting

  • Added report-only CSP, frame blocking, nosniff, and stricter referrer headers to web app shell responses, and tightened public upload headers to rely on same-site resource policy instead of an unconditional CORS header. 9bde7d544
  • Limited application bulk update and delete requests to 200 selected items per operation to avoid oversized bulk actions. c9b3fa5c1
  • Resume lock and password mutations now return NOT_FOUND when the resume is missing instead of silently succeeding. e47cf6e77
  • Reduced repeated work in the font picker by computing the font family options once per app process. 7e0657946
  • Refreshed workspace dependencies, including AI SDK provider packages, Lingui, oRPC, Hono, Tiptap, and test tooling.

Documentation & Localization

  • Tightened SEO titles and descriptions across the documentation site. 5270a2a9a
  • Corrected the README feature list to describe structured Style Rules instead of custom CSS. 66078609a
  • Synced Crowdin translation catalogs and added locale strings for the new AI providers and cover-letter export option. b87a9d828, 25021507a

Full Changelog: v5.2.2...v5.2.3

Security Fixes

  • Added report‑only CSP, frame‑blocking, nosniff, and stricter referrer headers; tightened upload response security in Reliability & Self‑Hosting

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track reactive-resume

Get notified when new releases ship.

Sign up free

About reactive-resume

A one-of-a-kind resume builder that keeps your privacy in mind. Completely secure, customizable, portable, open-source and free forever. Try it out today!

All releases →

Related context

Earlier breaking changes

  • v5.1.4 Private agent attachments require S3-compatible storage; local filesystem rejected
  • v5.1.4 AI Agent workspace requires REDIS_URL for self-hosted deployments
  • v5.1.4 Saved AI providers now require ENCRYPTION_SECRET for self-hosted deployments

Beta — feedback welcome: [email protected]