Resume Designer 1.9.5

Resume Designer 1.9.5

• fix(security): escape recommendation index and impact label
• fix(security): escape recommendation impact and typography font fields
• fix(security): coerce matchScore to string before escaping
• fix(security): escape match-score and custom-palette swatch
• fix(security): escape remaining xss-through-dom interpolations
• fix(security): strip annotated example-URL placeholder on profile import
• fix(security): use crypto.getRandomValues for generated IDs
• fix(security): escape onboarding inputs and DOM text rendered into HTML
• fix(security): escape profile contact fields and validate example-URL by hostname
• fix(security): use escapeAttr for HTML attributes and consolidate escape helpers
• fix: pass --allow-same-version to npm version in release build

What's Changed

Maintenance

• build(deps): bump the npm_and_yarn group across 1 directory with 2 updates by @dependabot[bot] in #18

Other Changes

• ci: gate releases behind release-please (PR 2 of CI/CD redesign) by @SiriusA7 in #21
• chore: pin Node 20 and document npm 10 lockfile requirement by @SiriusA7 in #22
• ci: skip commitlint on dependabot commits by @SiriusA7 in #23
• fix(security): resolve CodeQL code-scanning alerts (XSS escaping, secure IDs, URL check) by @SiriusA7 in #24
• fix(security): clear remaining 4 xss-through-dom CodeQL alerts by @SiriusA7 in #25
• fix(security): escape last 2 xss-through-dom sinks (match-score, custom-palette swatch) by @SiriusA7 in #26
• fix(security): comprehensive escape pass for last 2 xss-through-dom alerts by @SiriusA7 in #27
• fix(security): escape last xss-through-dom sink (recommendation index) by @SiriusA7 in #28
• ci: replace release-please with next/main dual-channel release pipeline by @SiriusA7 in #29

New Contributors

• @dependabot[bot] made their first contribution in #18

Full Changelog: v1.9.4...v1.9.5