# Changelog

## Score

- CAI 50 → 51 (+1.8)
- Rubric changed (rubric-2026.08.18 → rubric-2026.08.19) — scores are not directly comparable.

## Lenses

- Code Health 86 → 80 (-6.1)
- Architecture 69 → 69 (+0.0)
- Maturity 82 → 86 (+4.4)
- Readiness 38 → 42 (+4.2)
- Security 76 → 76 (-0.4)
- Domain Modelling 43 → 43 (+0.0)

## Resolved (9)

- Critical CVE: [GHSA redacted] (package-lock.json)
- High CVE: [GHSA redacted] (package-lock.json)
- High CVE: [GHSA redacted] (package-lock.json)
- Medium CVE: [GHSA redacted] (package-lock.json)
- Medium CVE: [GHSA redacted] (package-lock.json)
- Medium CVE: [GHSA redacted] (package-lock.json)
- Medium CVE: [GHSA redacted] (package-lock.json)
- The Access section is cut mid-table at 'credentials' and the outline promises credentials, clean up, both commands equivalent, database setup, running the app, development/watch/debug modes, test coverage, Built With, Future Goals, Contributing, License. (README.md)
- The Usage section lists default ports for App, EventStore Admin UI, and Adminer without specifying how to change them (e.g. editing evVAr.sh vs changing in a config file). (README.md)

## New (21)

- Critical CVE: [GHSA redacted] (package-lock.json)
- Critical CVE: [GHSA redacted] (package-lock.json)
- Critical CVE: [GHSA redacted] (package-lock.json)
- High CVE: [GHSA redacted] (package-lock.json)
- High CVE: [GHSA redacted] (package-lock.json)
- High CVE: [GHSA redacted] (package-lock.json)
- High CVE: [GHSA redacted] (package-lock.json)
- High CVE: [GHSA redacted] (package-lock.json)
- High CVE: [GHSA redacted] (package-lock.json)
- High CVE: [GHSA redacted] (package-lock.json)
- High CVE: [GHSA redacted] (package-lock.json)
- Medium CVE: [GHSA redacted] (package-lock.json)
- Medium CVE: [GHSA redacted] (package-lock.json)
- Medium CVE: [GHSA redacted] (package-lock.json)
- Medium CVE: [GHSA redacted] (package-lock.json)
- Medium CVE: [GHSA redacted] (package-lock.json)
- Medium CVE: [GHSA redacted] (package-lock.json)
- Medium CVE: [GHSA redacted] (package-lock.json)
- Medium IaC: CKV_DOCKER_2 (Dockerfile)
- Medium IaC: CKV_DOCKER_3 (scripts/dev/Dockerfile)
- …and 1 more