# Changelog

> **This is the PUBLIC form of this artifact. Findings are listed in full, but the details of SECURITY findings — which rule fired, in which file, on which line, and how to fix it — are deliberately withheld, and any secret-scanner results are excluded entirely. Where detail is absent here it was REMOVED FOR PUBLICATION; it is not missing from the analysis. The complete artifact is available from the repository owner.**

## Score

- CAI 48 → 41 (-6.9)
- Rubric changed (rubric-2026.10.1 → rubric-2026.10.5) — scores are not directly comparable.

## Lenses

- Code Health 57 → 47 (-9.9)
- Architecture 60 → 60 (+0.0)
- Maturity 65 → 41 (-24.1)
- Readiness 48 → 48 (+0.0)
- Security 83 → 90 (+7.2)
- Accessibility 41 → 35 (-6.0)

## Resolved (7)

- #createBatchActions (cyclomatic 18) (assets/js/app.js)
- FileUploadType.mapFormsToData (cognitive 17) (src/Form/Type/FileUploadType.php)
- Hotspot: src/Field/Configurator/AssociationConfigurator.php (src/Field/Configurator/AssociationConfigurator.php)
- Hotspot: src/Form/EventListener/CrudAutocompleteSubscriber.php (src/Form/EventListener/CrudAutocompleteSubscriber.php)
- Hotspot: src/Twig/EasyAdminTwigExtension.php (src/Twig/EasyAdminTwigExtension.php)
- Low CVE: [GHSA redacted] (yarn.lock)
- Off-boarding risk: anonymized user #1

## New (17)

- #createActionConfirmationModals (cyclomatic 16) (assets/js/app.js)
- App.#createBatchActions (cyclomatic 19) (assets/js/app.js)
- Boundary-crossing change coupling: FilterFactory.php ↔ EntityRepository.php (src/Factory/FilterFactory.php)
- ComponentDocumentationReader.readClassProps (cognitive 18) (src/UiKit/ComponentDocumentationReader.php)
- Documentation: no architecture or design documentation (README.md)
- Medium CVE: [GHSA redacted] (yarn.lock)
- Medium CVE: [GHSA redacted] (yarn.lock)
- Medium: security finding (details withheld)
- Medium: security finding (details withheld)
- Medium: security finding (details withheld)
- Medium: security finding (details withheld)
- Medium: security finding (details withheld)
- Medium: security finding (details withheld)
- Medium: security finding (details withheld)
- Off-boarding risk: anonymized user #1
- Orphaned file (src/Factory/ControllerFactory.php)
- Orphaned file (src/Form/Filter/Type/DateTimeFilterType.php)

## Changes since last survey

- 55 commits — 29 feature/other, 26 fixes

## By area

- (repo) — 23 commits
- tests/Functional — 8 commits
- assets/css — 5 commits
- tests/Unit — 4 commits
- (root) — 3 commits
- doc/fields — 2 commits
- src/EasyAdminBundle.php — 2 commits
- templates/ui_kit — 2 commits
- assets/js — 1 commit
- src/Context — 1 commit
- src/EventListener — 1 commit
- src/Field — 1 commit
- templates/components — 1 commit
- templates/crud — 1 commit

## Notable commits

- fix: Add FormField::setTabId() to set a fixed tab ID
- fix: Fix #7827: return 404 instead of 500 for unknown ?routeName= values
- fix: Fix a failing test
- fix: Fix file deletion from the filesystem
- fix: Fix null values when saving empty file fields
- fix: Fix placeholders in translated exception messages
- fix: Fix tab icon and label spacing for custom tab markup
- fix: Fix tests
- fix: Fix the design of errored fieldsets
- fix: Fix the uneven padding of the tabs
- fix: Tweaks and fixes
- fix: bug #7782 Make `createEntity` return nullable entity type (zmitic)
- fix: bug #7825 Fix null values when saving empty file fields (Seb33300)
- fix: bug #7828 Return a 404 instead of a 500 when the ?routeName= query parameter references a route that does not exist (wanjinhao1)
- fix: bug #7833 Use the event dispatcher contract in CRUD pages (tacman)
- fix: bug #7841 Fix the design of errored fieldsets (javiereguiluz)
- fix: bug #7843 Remove the leftover ea global Twig variable (javiereguiluz)
- fix: bug #7844 fix: preserve disabled dropdown item color (Sean)
- fix: bug #7851 Make sidebar submenus toggle outside the main menu (javiereguiluz)
- fix: bug #7852 Fix the uneven padding of the tabs (javiereguiluz)
- …and 35 more

## Architecture

- 0 containers · 1 bounded contexts · 0 dependency edges (baseline)