Check the application before storing uploaded files, and apply the sign-in and reCAPTCHA settings to application submissions.
Check resume ownership when applying with a resume.
Restrict status changes on the employer dashboard to application statuses.
Escape application data in the admin list and templates, and keep notification email headers and subjects to a single line.
New application upload directories get random names. Existing directories are unchanged.
CSV export values that start with =, +, -, @, a tab or a carriage return now get a leading apostrophe, so spreadsheet apps don’t treat them as formulas.
Fix application form field labels containing special characters, such as apostrophes, not appearing in application emails.
Fix the label of Output Content fields not showing on application forms.
Fix a PHP warning when applying with a resume to a job that uses an application URL.
Fix a deprecation notice from WP Job Manager when reCAPTCHA is enabled on the application form.
Template change: application-form.php, job-application-header.php and job-application-footer.php now escape their output. Themes that override these templates should update their copies.
Developer note: the application_form_validate_fields filter now runs before uploaded files are stored, and receives file fields as $_FILES-style arrays instead of uploaded file objects. Custom validation that reads uploaded file URLs needs updating.