Jobsmith v0.1.6
What's Changed
- Protect the local API with Trusted Host validation, loopback Origin checks, and a process-local HttpOnly session cookie.
- Enforce TLS certificate verification for LinkedIn, Yourator, and Cake job sources.
- Make background task cancellation terminate active CLI subprocesses instead of only stopping UI updates.
- Fix the privacy-clear race so cancelled workers cannot write personal data back after deletion.
- Snapshot backend, model, endpoint, and credential settings per pipeline run.
- Bundle required conda runtime DLLs in the Windows build so the packaged app starts reliably.
Downloads
- Windows:
Jobsmith.exe - macOS Apple Silicon:
Jobsmith-macOS-arm64-unsigned.dmg - macOS Intel:
Jobsmith-macOS-x64-unsigned.dmg
SHA-256
Jobsmith.exe cd8db89fd980f3a72a9012f92a685df748f4d63f0b1b7832fa3c2176d12d92ea
Jobsmith-macOS-arm64-unsigned.dmg f5903c3790581f4d4ca08fec968d62979792a9e6031841c3083bd4d314e14901
Jobsmith-macOS-x64-unsigned.dmg df9c2e8e7d10a95505cca1bf30a88613cb7a25dc336f6a0d31b1dfd2bca58326
Notes
This is a security and reliability patch. Existing user data locations and formats are unchanged; upgrading does not require migration.
The macOS builds are unsigned and not notarized. On first launch, open the DMG, drag Jobsmith.app to Applications, then right-click Jobsmith.app and choose Open.
Privacy notes: https://github.com/kevin333353/jobsmith/blob/master/docs/PRIVACY.md
macOS DMG workflow: https://github.com/kevin333353/jobsmith/actions/runs/29143568181