v1.111.0

[1.111.0] — 2026-07-06

Security — CodeQL backlog closeout. Three defense-in-depth hardenings that close the remaining static-analysis findings at the source instead of dismissing them. stripDangerousMarkdown now escapes the < of any truncated dangerous-tag opener (a payload ending in <script/<iframe/…) so its output provably contains no live dangerous tag. CV import reads an uploaded buffer's size through an explicit Number() coercion — a type-confusion barrier. Mode role-lines are now template strings interpolated with String.replace instead of stored functions, removing the dynamic-dispatch call entirely. No user-facing behavior change.

• server/lib/security.mjs (final escape belt), server/lib/cv-import.mjs (coerced size), server/lib/prompts.mjs (string role-lines). Tests: tests/security-hardening-v1111.test.mjs (7) + updated v1108 guard test. No i18n/help/route changes.

New: none.