# Changelog

> **This is the PUBLIC form of this artifact. Findings are listed in full, but the details of SECURITY findings — which rule fired, in which file, on which line, and how to fix it — are deliberately withheld, and any secret-scanner results are excluded entirely. Where detail is absent here it was REMOVED FOR PUBLICATION; it is not missing from the analysis. The complete artifact is available from the repository owner.**

## Score

- CAI 69 → 52 (-16.7)
- Rubric changed (rubric-2026.08.18 → rubric-2026.08.15) — scores are not directly comparable.

## Lenses

- Code Health 89 → 81 (-8.1)
- Maturity 66 → 67 (+0.9)
- Readiness 59 → 32 (-27.3)
- Security 84 → 78 (-6.2)

## Resolved (16)

- Coverage not included — suite not readable by the collector
- Dependency hygiene not measured — dependency manifest found but not parsed for hygiene
- FileTooLong: src/McpContext.ts (src/McpContext.ts)
- FileTooLong: src/McpPage.ts (src/McpPage.ts)
- FileTooLong: src/McpResponse.ts (src/McpResponse.ts)
- Further sole-owners (lower concentration)
- High: security finding (details withheld)
- Hotspot: src/McpResponse.ts (src/McpResponse.ts)
- Hotspot: src/ToolHandler.ts (src/ToolHandler.ts)
- Hotspot: src/formatters/IssueFormatter.ts (src/formatters/IssueFormatter.ts)
- Medium vulnerability: [GHSA redacted] (package-lock.json)
- Off-boarding risk: anonymized user #1
- The Specific problems section lists a problem (`Chrome crashes on macOS when using Web Bluetooth`) but does not explain what exactly causes the crash or how to reproduce it, leaving readers unable to determine whether their case is covered. (docs/troubleshooting.md)
- TooManyMethods: BaseMcpHostBindingAdapter (src/devtools/McpHostBindingAdapter.ts)
- TooManyMethods: McpContext (src/McpContext.ts)
- TooManyMethods: McpResponse (src/McpResponse.ts)

## New (18)

- Change coupling: McpContext.ts ↔ snapshot.ts (src/McpContext.ts)
- Change coupling: input.ts ↔ screenshot.ts (src/tools/input.ts)
- Change coupling: input.ts ↔ snapshot.ts (src/tools/input.ts)
- Change coupling: screenshot.ts ↔ snapshot.ts (src/tools/screenshot.ts)
- Dimension evaluation failed
- High CVE: [GHSA redacted] (package-lock.json)
- High: security finding (details withheld)
- Hotspot: src/index.ts (src/index.ts)
- Low CVE: [GHSA redacted] (package-lock.json)
- Medium CVE: [GHSA redacted] (package-lock.json)
- Medium CVE: [GHSA redacted] (package-lock.json)
- Medium CVE: [GHSA redacted] (package-lock.json)
- Medium CVE: [GHSA redacted] (package-lock.json)
- No automated tests
- No build provenance
- No tests found
- The README does not mention how to install or configure the CLI separately from the MCP server. (README.md)
- The troubleshooting guide is focused on client-side problems but does not cover the common requirement that the CLI and MCP share compatible node/npm versions. (docs/troubleshooting.md)

## Changes since last survey

- 32 commits — 25 feature/other, 7 fixes

## By area

- (root) — 15 commits
- .github/workflows — 2 commits
- scripts/profile — 2 commits
- skills/memory-leak-debugging — 2 commits
- src/daemon — 2 commits
- src/devtools — 2 commits
- src/telemetry — 2 commits
- .github/dependabot.yml — 1 commit
- src/HeapSnapshotManager.ts — 1 commit
- src/McpPage.ts — 1 commit
- src/third_party — 1 commit
- tests/tools — 1 commit

## Notable commits

- fix: chore: fix Explicit resource management polyfill (#2496)
- fix: fix(cli): validate session ids (#2475)
- fix: fix(cli): warn about version mismatch between cli and daemon (#2461)
- fix: fix(memory): dispose the heap-snapshot worker when loading fails (#2449)
- fix: fix: do not throw synchronously when a CDP session is gone (#2466)
- fix: fix: regression after the #2443 (#2462)
- fix: fix: toggle lazy loading for source maps. (#2486)
- change: build: consume devtools-frontend as a submodule (#2481)
- change: build: split mcp publishing into a separate workflow (#2474)
- change: chore(deps): bump devtools-frontend from `7d89440` to `9e09851` (#2483)
- change: chore(deps): bump devtools-frontend from `9e09851` to `8b2c725` (#2494)
- change: chore(deps): bump fast-uri from 3.1.4 to 3.1.5 (#2468)
- change: chore(deps): bump ip-address from 10.2.0 to 10.4.0 (#2467)
- change: chore(deps): bump sigstore/cosign-installer from 4.1.0 to 4.1.2 in the all group across 1 directory (#2484)
- change: chore(deps-dev): bump chrome-devtools-frontend from 1.0.1666631 to 1.0.1668390 in the bundled-devtools group across 1 directory (#2417)
- change: chore(deps-dev): bump chrome-devtools-frontend from 1.0.1672388 to 1.0.1672557 in the bundled-devtools group (#2478)
- change: chore(deps-dev): bump the bundled group across 1 directory with 3 updates (#2479)
- change: chore(dev-deps): bump devtools-frontend (#2498)
- change: chore: add a new profiler scenario for get_console_messages. (#2491)
- change: chore: add a script to capture memory snapshots (#2464)
- …and 12 more