# Changelog

> **This is the PUBLIC form of this artifact. Findings are listed in full, but the details of SECURITY findings — which rule fired, in which file, on which line, and how to fix it — are deliberately withheld, and any secret-scanner results are excluded entirely. Where detail is absent here it was REMOVED FOR PUBLICATION; it is not missing from the analysis. The complete artifact is available from the repository owner.**

## Score

- CAI 54 → 43 (-11.1)
- Rubric changed (rubric-2026.08.18 → rubric-2026.08.15) — scores are not directly comparable.

## Lenses

- Code Health 53 → 58 (+4.5)
- Architecture 99 → 97 (-1.9)
- Maturity 65 → 59 (-6.2)
- Readiness 83 → 30 (-52.8)
- Security 55 → 44 (-10.6)

## Resolved (162)

- App::apply_filters (cognitive 47) (llmfit-tui/src/tui_app.rs)
- App::apply_filters (cyclomatic 46) (llmfit-tui/src/tui_app.rs)
- App::available_download_providers (cognitive 16) (llmfit-tui/src/tui_app.rs)
- App::available_download_providers (cyclomatic 17) (llmfit-tui/src/tui_app.rs)
- App::plan_input (cognitive 16) (llmfit-tui/src/tui_app.rs)
- App::tick_bench (cognitive 19) (llmfit-tui/src/tui_app.rs)
- App::with_specs_and_context (cognitive 19) (llmfit-tui/src/tui_app.rs)
- App::with_specs_and_context (cyclomatic 19) (llmfit-tui/src/tui_app.rs)
- Capability::infer (cyclomatic 16) (llmfit-core/src/models.rs)
- Change coupling: tui_events.rs ↔ tui_ui.rs (llmfit-tui/src/tui_events.rs)
- Coverage not included — suite not readable by the collector
- Dependency hygiene not measured — dependency manifest found but not parsed for hygiene
- FileTooLong: src/benchmarks.rs (llmfit-core/src/benchmarks.rs)
- FileTooLong: src/display.rs (llmfit-tui/src/display.rs)
- FileTooLong: src/fit.rs (llmfit-core/src/fit.rs)
- FileTooLong: src/hardware.rs (llmfit-core/src/hardware.rs)
- FileTooLong: src/models.rs (llmfit-core/src/models.rs)
- FileTooLong: src/plan.rs (llmfit-core/src/plan.rs)
- FileTooLong: src/providers.rs (llmfit-core/src/providers.rs)
- FileTooLong: src/serve_api.rs (llmfit-tui/src/serve_api.rs)
- …and 142 more

## New (47)

- Coverage not measured — test suite did not build
- Dimension evaluation failed
- High CVE: [GHSA redacted] (Cargo.lock)
- High CVE: [GHSA redacted] (llmfit-web/package-lock.json)
- Low CVE: [GHSA redacted] (llmfit-python/uv.lock)
- Low IaC: DS-0026 (Dockerfile)
- Low: security finding (details withheld)
- Low: security finding (details withheld)
- Low: security finding (details withheld)
- Low: security finding (details withheld)
- Low: security finding (details withheld)
- Medium CVE: [GHSA redacted] (llmfit-web/package-lock.json)
- Medium CVE: [GHSA redacted] (llmfit-web/package-lock.json)
- Medium CVE: [GHSA redacted] (llmfit-web/package-lock.json)
- Medium CVE: [GHSA redacted] (Cargo.lock)
- Medium CVE: [GHSA redacted] (llmfit-web/package-lock.json)
- Medium CVE: [GHSA redacted] (llmfit-web/package-lock.json)
- Medium CVE: [GHSA redacted] (llmfit-web/package-lock.json)
- Medium CVE: [GHSA redacted] (Cargo.lock)
- Medium CVE: PYSEC-2026-1845 (llmfit-python/uv.lock)
- …and 27 more

## Changes since last survey

- 22 commits — 13 feature/other, 9 fixes

## By area

- llmfit-core/src — 7 commits
- llmfit-core/data — 5 commits
- .github/workflows — 4 commits
- (root) — 3 commits
- llmfit-tui/src — 2 commits
- scripts/scrape_hf_models.py — 1 commit

## Notable commits

- fix: fix(hardware): match adapter names through OEM-mangled trademark symbols
- fix: fix(hardware): read 64-bit registry VRAM and full DIMM total for AMD APU UMA carveouts (#817)
- fix: fix(hardware): read true Windows VRAM from the display driver registry (#831)
- fix: fix(plan): grade run_paths fit_level against the machine's real memory pools (#813)
- fix: fix(plan): route speed estimates through fit.rs so MoE models aren't 4x underestimated (#807)
- fix: fix(scraper): drop catalog entries carrying credential-shaped strings
- fix: fix(share): give the declared memory tier a floor below 8 GB (#818)
- fix: fix(tui): keep UI responsive while fetching the benchmark leaderboard
- fix: fix: normalize llama.cpp GGUF model IDs (#833)
- change: bench: community results for apple-m5-pro (#811)
- change: chore(data): Weekly benchmark cache refresh (#828)
- change: chore(deps): bump astral-sh/setup-uv from 8.2.0 to 9.0.0 (#826)
- change: chore(deps): bump clap from 4.6.1 to 4.6.4 (#800)
- change: chore(deps): bump docker/login-action from 4.4.0 to 4.5.1 (#825)
- change: chore(main): release 1.1.7 (#784)
- change: chore(main): release 1.1.8 (#827)
- change: chore(models): Weekly model data refresh (#829)
- change: ci: make the weekly HF model scrape finish inside its timeout
- change: ci: split benchmark-cache refresh into its own weekly job
- change: community: add Apple M4 Pro (40 models, llama.cpp Metal) (#812)
- …and 2 more