# Changelog

## Score

- CAI 61 → 63 (+1.9)
- Rubric changed (rubric-2026.08.18 → rubric-2026.08.19) — scores are not directly comparable.

## Lenses

- Code Health 93 → 94 (+0.5)
- Architecture 99 → 99 (-0.2)
- Maturity 74 → 74 (-0.1)
- Readiness 51 → 54 (+3.1)
- Security 64 → 65 (+1.0)
- Domain Modelling 100 → 100 (+0.0)
- Accessibility 64 → 65 (+1.3)

## Resolved (7)

- High CVE: [GHSA redacted] (yarn.lock)
- High CVE: [GHSA redacted] (yarn.lock)
- High CVE: [GHSA redacted] (yarn.lock)
- High vulnerability: [GHSA redacted] (yarn.lock)
- LLM evaluation failed
- Medium CVE: [GHSA redacted] (yarn.lock)
- Off-boarding risk: anonymized user #1

## New (7)

- Change coupling: contextActionsExecutor.ts ↔ threadActionsExecutor.ts (src/modules/review-execution/services/contextActionsExecutor.ts)
- High CVE: [GHSA redacted] (yarn.lock)
- High CVE: [GHSA redacted] (yarn.lock)
- High CVE: [GHSA redacted] (yarn.lock)
- Medium CVE: [GHSA redacted] (yarn.lock)
- Off-boarding risk: anonymized user #1
- The review-flow badge links to a security assessment, but the main site is VitePress at dgouron.github.io/review-flow with no badge. (README.md)

## Changes since last survey

- 10 commits — 6 feature/other, 4 fixes

## By area

- (root) — 6 commits
- src/tests — 3 commits
- src/frameworks — 1 commit

## Notable commits

- fix: fix: close follow-up threads and reply inside the conversation on GitHub (#369)
- fix: fix: scan manual follow-up output before it leaves the machine (#370)
- fix: fix: stop the test suite from destroying the running daemon's pid file (#371)
- fix: fix: trigger mode chip + macOS desktop notifications (#368)
- change: chore(deps): bump @fastify/static from 9.1.1 to 10.1.2 (#361)
- change: chore(deps): bump brace-expansion from 5.0.7 to 5.0.8 (#363)
- change: chore(deps): bump fast-uri from 3.1.2 to 3.1.4 (#353)
- change: chore(deps): bump hono from 4.12.26 to 4.12.32 (#354)
- change: chore(deps): bump postcss from 8.5.15 to 8.5.23 (#362)
- change: chore(master): release reviewflow 3.48.0 (#365)