chore: release main

[github-actions]

🤖 I have created a release beep boop

career-ops: 1.27.0

1.27.0 (2026-08-13)

Features

• cli: add --help / -h usage block to stats.mjs (#2556) (3d8b53d)
• providers: Eightfold AI talent-acquisition boards (#2684) (e991d58)
• rank: opt-in LLM relevance re-ranker for pipeline.md (#2579) (03fc92b)
• scan: AND-groups in title_filter.positive (#2552) (5483083)
• scan: record failed runs in scan-runs.tsv so trends exclude survivorship bias (713a6b0)
• tracker-sync-check: flag applications.md rows that active-interviews.md has already moved past (a1304a4)
• update: restore locally deleted system files instead of preserving the deletion (#2448) (bfcaaba)

Bug Fixes

• agent-inbox: serialize concurrent adds through the shared lock (#2777) (a7f65b6)
• agent-inbox: stop dropping requests queued during an add (#2614) (ad382c0)
• archive: key JD captures to report numbers so they resolve after capture day (#2701) (81d7b06)
• batch: retry state updates and lock reservations to prevent worker silent drops (#2417) (5404185)
• ci: only greet a first-time contributor when it is actually their first (a0d45aa)
• ci: skip the upgrade leg when nothing managed changed, instead of failing (#2697) (9dcfd2f)
• company-history: record response dates via --on, not --note free text (9b17a8a)
• csod: replay bootstrap session cookies and repair fetchResponse() (#2769) (7aee3b9)
• cv-facts: treat a k/M/B magnitude suffix as part of the number (#2612) (18d245a)
• cv: Korean and Traditional Chinese CVs had no font rule (#2616) (994552d)
• dedup-tracker: reject unrecognized flags instead of silently live-running (#2746) (429b0dc)
• deps: make js-yaml imports work on both 4.x and 5.x (#2656) (6466b18)
• deps: patch both HIGH advisories in web (js-yaml 4.3.1, nanoid 3.3.18) (a094ec9)
• deps: raise the js-yaml floor to ^4.3.1 and guard it (#2767) (5b18a96)
• doctor: detect Playwright MCP servers provided by Claude Code plugins (#2753) (49d20f2)
• eval: merge openrouter tracker TSVs and send Ollama options to the native /api/chat (#2647) (a86f776)
• find: reject mistyped flags instead of searching for them (9265e08)
• followup-cadence: parse annotated pins, and add a retire directive (#2514) (b4f6b2d)
• jd-similarity: the seniority gate fired on JD boilerplate (#2661) (772ea35)
• jd-skill-gap: recognize sentence-form requirement headings (#2686) (fd9ca41)
• jobvite: migrate to the public XML feed after the JSON API retirement (#2623) (0c7522b)
• keys: stop the dotted-I fix from collapsing Polish, Lithuanian and Maltese (5df43e7)
• keys: stop the Turkish dotted capital from splitting one employer in two (462d276)
• liveness: classify a rate-limited posting as uncertain, not expired (#2613) (c65afe6)
• liveness: treat an api.lever.co 404 as inconclusive, not proof of removal (#2649) (84fe20f)
• merge-tracker: re-eval no longer inherits the superseded report's checkmark (#2595) (c85d02f)
• ollama: include profile context in evaluations (#2664) (ef2a82f)
• oraclecloud: accept Oracle's numbered tenant apexes (oraclecloud1-99.com) (#2683) (a23ebc1)
• providers: fill in the docs and vendor-detection gaps (#2658) (7152907)
• providers: harden workable with retry, headers, and serialization (#2675) (feabcd4)
• providers: isRetryableError no longer misclassifies a refused redirect (#2657) (f8feaa5)
• providers: personio falls back to HTML scrape when the XML feed is disabled (5fe2784)
• providers: phenom pagination/retry fixes, drop dead auto-detection (#2669) (1331ebf)
• providers: reject numeric entities outside the XML 1.0 Char set (#2713) (a050631)
• reply-matcher: require corroboration for partial role-title matches (#2672) (3215fa3)
• reply-watch: reject unrecognized CLI flags instead of treating them as a path (#2745) (ba2b634)
• scan: take the shared lock for scan-history.tsv appends (#2639) (8e264c4)
• set-status: stop the --role guard from folding every non-Latin title to the same key (#2736) (437da7a)
• states: aliases the engine accepts were missing from states.yml (#2615) (04ef492)
• status: fold Turkish dotted capitals so uppercase tracker rows resolve to canonical states (0834e72)
• theme-style: a $-pattern in a profile style value splices the body into the CV's <head> (1798f3a)
• verify-cv-facts: treat a period as a thousands separator too (#2722) (dceaddb)
• web: finish Unicode company keys for explore + registry (#2668) (c294242)
• web: let the pipeline table scroll horizontally instead of clipping on narrow screens (#2363) (632031c)
• web: prevent Codex run jobs from waiting on stdin (#1973) (9a139a2)
• web: skip {n}-RESERVED.md sentinels when looking up reports (#1967) (5f4842e)
• workday: key the cap-hit warning on entry provenance, not on --since (#2763) (7f067bc)

Performance Improvements

• analytics: drop redundant existsSync probes before report reads (#2655) (f06cbf8)
• scan: read each dedup source once per scan run (d68c4c9)

web: 0.6.2

0.6.2 (2026-08-13)

Bug Fixes

• deps: make js-yaml imports work on both 4.x and 5.x (#2656) (6466b18)
• deps: patch both HIGH advisories in web (js-yaml 4.3.1, nanoid 3.3.18) (a094ec9)
• deps: raise the js-yaml floor to ^4.3.1 and guard it (#2767) (5b18a96)
• keys: stop the dotted-I fix from collapsing Polish, Lithuanian and Maltese (5df43e7)
• keys: stop the Turkish dotted capital from splitting one employer in two (462d276)
• scan: take the shared lock for scan-history.tsv appends (#2639) (8e264c4)
• web: finish Unicode company keys for explore + registry (#2668) (c294242)
• web: let the pipeline table scroll horizontally instead of clipping on narrow screens (#2363) (632031c)
• web: prevent Codex run jobs from waiting on stdin (#1973) (9a139a2)
• web: skip {n}-RESERVED.md sentinels when looking up reports (#1967) (5f4842e)

---

This PR was generated with Release Please. See documentation.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None