CVForge 1.3.1 — security update

Security update — please upgrade from 1.3.0.

• Next.js 16.3.0 → 16.3.5: fixes two critical remote-code-execution advisories (the image optimizer with AVIF files, and servers running on Windows, which the Windows launcher is).
• sharp 0.35.3 → 0.35.4: fixes the libheif vulnerabilities it bundles.

No other changes. Your data folder (datos/) carries over: copy it into the new folder.

Try it first without installing: cvforge.korven.dev (sample data, no key).

Install

1. Download cvforge-v1.3.1.zip below and check it: shasum -a 256 -c checksums.txt
2. Unzip it, then double-click CVForge (macOS) or CVForge (Windows). On Linux: ./programa/start.sh (Node.js 20+).
3. It opens at http://localhost:3000 and asks for your Anthropic API key.

One zip for every system: the macOS (Apple Silicon and Intel) and Windows Node runtimes ship inside, so nothing gets installed on your system.

macOS: the app isn't notarized yet. If macOS blocks it, open System Settings → Privacy & Security and click Open Anyway (macOS 15+), or right-click → Open (macOS 14 and earlier).

Windows: the launcher hasn't been tested on a physical Windows machine yet. Reports welcome.

Full notes: CHANGELOG.md.

CVForge 1.3.0 — first public release

First public release. CVForge is now open source under the MIT license.

Try it first without installing: cvforge.korven.dev (sample data, no key).

Install

1. Download cvforge-v1.3.0.zip below and check it: shasum -a 256 -c checksums.txt
2. Unzip it, then double-click CVForge (macOS) or CVForge (Windows). On Linux: ./programa/start.sh (Node.js 20+).
3. It opens at http://localhost:3000 and asks for your Anthropic API key.

One zip for every system: the macOS (Apple Silicon and Intel) and Windows Node runtimes ship inside, so nothing gets installed on your system.

macOS: the app isn't notarized yet. If macOS blocks it, open System Settings → Privacy & Security and click Open Anyway (macOS 15+), or right-click → Open (macOS 14 and earlier).

Windows: the launcher hasn't been tested on a physical Windows machine yet. Reports welcome.

What's in it

• Evidence base: import a CV (PDF or text), then a short interview per role to recover what the CV left out.
• Triage: paste a posting and get a verdict, with what you have, what you don't, and which requirement would be a guess.
• Gap filling: a requirement you meet but never recorded becomes permanent evidence, and the posting is re-scored.
• Kit: CV, cover letter, screening answers and recruiter message in Spanish or English. Every claim cites evidence, numbers are verified in code, and a final pass checks for overstatement and tense. Exports to PDF and Word.
• Outcomes and stats, backups and restore, and spend recorded for every model call.
• Fixed: importing a CV no longer fails, or forces an invented month, when a degree or achievement has no date.

Full notes: CHANGELOG.md.