v1.107.0

[1.107.0] — 2026-07-06

Sanitizer hardening (at-rest XSS defense-in-depth). stripDangerousMarkdown — which neutralizes dangerous HTML in stored CV/JD markdown so any consumer that bypasses the escape-on-render client is still safe — now runs its tag strip to a fixed point (repeat-until-stable) so a removal that reforms a payload (e.g. <scr<script></script>ipt>) is caught, matches script/style/etc. end tags with trailing junk (</script foo>), and strips an unclosed executable opener (<script …> with no closing tag). Behavior for valid markdown is unchanged — it only ever removes more.

• server/lib/security.mjs: fixed-point loop (bounded 8 passes) + [^>]*> end-tag patterns + unclosed-opener strip. +3 regression cases in tests/cv-xss-bypasses.test.mjs (end-tag variants, single-pass-reveal, unclosed). The authoritative XSS boundary remains output-escaping (UI.md); this strengthens the at-rest guarantee and closes the matching CodeQL findings.

New: none.