# Changelog

> **This is the PUBLIC form of this artifact. Findings are listed in full, but the details of SECURITY findings — which rule fired, in which file, on which line, and how to fix it — are deliberately withheld, and any secret-scanner results are excluded entirely. Where detail is absent here it was REMOVED FOR PUBLICATION; it is not missing from the analysis. The complete artifact is available from the repository owner.**

## Score

- CAI 47 → 50 (+2.8)
- Rubric changed (rubric-2026.08.17 → rubric-2026.08.18) — scores are not directly comparable.

## Lenses

- Code Health 72 → 75 (+3.4)
- Architecture 64 → 64 (-0.1)
- Maturity 59 → 59 (+0.0)
- Readiness 45 → 52 (+6.8)
- Security 40 → 42 (+2.1)
- Performance 60 → 60 (+0.0)

## Resolved (27)

- Ambiguous method overloading. The interface ILiquidContext has two methods named 'Get' with different signatures (one returns object, one returns T). While technically valid, it can be confusing for consumers who might expect 'Get' to return a specific type or require explicit casting. More importantly, the implementation LiquidContext also has these methods, but the interface does not include the 'Upsert' method, which is present in the implementation and the other interface ILiquidContextNotifications has 'InsertNotification' vs 'InsertNotifications'.
- Coverage not measured — test suite did not build
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- Inconsistent naming convention for synchronous vs asynchronous methods. The class uses 'Get' for sync and 'GetAsync' for async, which is standard, but the interface ILiquidCache only exposes the async 'GetAsync' and 'SetAsync' methods, while the implementation LiquidCache exposes both sync and async versions. This creates a discrepancy between the contract and the concrete implementation.
- Inconsistent query method naming. The repository interface uses 'FindByIdAsync' for single item retrieval and 'WhereAsync' for filtered queries. However, 'FindAllAsync' is also present. The naming 'Find' vs 'Where' is inconsistent with common ORM patterns (often 'GetById' or 'GetAsync' for single items). Additionally, 'WhereAsync' returning an IEnumerable suggests a memory collection, while 'FindByIdAsync' suggests a database call. This creates confusion about whether operations are in-memory or database-backed.
- Inconsistent verb usage in storage operations. The interface uses 'Upload', 'Delete', 'GetAll', 'Read' (for both tags and name), and 'Get' (for SAS URI). The use of 'Read' for specific blob retrieval and 'GetAll' for collections is inconsistent with 'Upload' and 'Delete'. 'Read' is typically used for streams or low-level access, while 'Get' is used for higher-level retrieval. Also, 'GetBlobSasUri' breaks the pattern of using 'Get' for retrieval while 'Read' is used elsewhere.
- Monorepo: only 1 of 10 solutions was scored
- No assertions: AddElasticApmTelemetry_WhenEnvironement_Enabled (test/Liquid.Core.Telemetry.ElasticApm.Tests/IServiceCollectionExtensionsTests.cs)
- No assertions: AddElasticApmTelemetry_WhenEnvironement_NotEnabled (test/Liquid.Core.Telemetry.ElasticApm.Tests/IServiceCollectionExtensionsTests.cs)
- No assertions: MessageHandler_WhenProcessExecutedSucessfully (test/Liquid.Messaging.RabbitMq.Tests/RabbitMqConsumerTest.cs)
- ObsoleteWithoutCallers (src/Liquid.Core/Localization/ILocalization.cs)
- …and 7 more

## New (37)

- BarePragmaDisable repeated across 11 files (src/Liquid.Repository.EntityFramework/EntityFrameworkRepository.cs)
- Boundary-crossing change coupling: DatabaseContextException.cs ↔ EntityFrameworkRepository.cs (src/Liquid.Core/Exceptions/DatabaseContextException.cs)
- Boundary-crossing change coupling: IServiceCollectionExtensions.cs ↔ MongoRepository.cs (src/Liquid.Repository.EntityFramework/Extensions/IServiceCollectionExtensions.cs)
- Boundary-crossing change coupling: LiquidCultureDecorator.cs ↔ ServiceBusConsumer.cs (src/Liquid.Core/Decorators/LiquidCultureDecorator.cs)
- Build action pinned to a mutable branch
- Change coupling: IMongoClientFactory.cs ↔ MongoRepository.cs (src/Liquid.Repository.Mongo/IMongoClientFactory.cs)
- Change coupling: LiquidCultureDecorator.cs ↔ LiquidScopedLoggingDecorator.cs (src/Liquid.Core/Decorators/LiquidCultureDecorator.cs)
- Change coupling: MongoClientFactory.cs ↔ MongoRepository.cs (src/Liquid.Repository.Mongo/MongoClientFactory.cs)
- Coverage not measured — test suite did not build
- High CVE: System.Security.Cryptography.Xml 8.0.2
- High CVE: System.Security.Cryptography.Xml 8.0.2
- High CVE: System.Security.Cryptography.Xml 8.0.2
- High CVE: System.Security.Cryptography.Xml 8.0.2
- High CVE: System.Security.Cryptography.Xml 8.0.2
- High CVE: System.Security.Cryptography.Xml 8.0.2
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- …and 17 more

## API surface

- Unchanged — 7 HTTP endpoints

## Architecture

- Unchanged — 3 containers · 0 contexts · 0 edges