# Changelog

> **This is the PUBLIC form of this artifact. Findings are listed in full, but the details of SECURITY findings — which rule fired, in which file, on which line, and how to fix it — are deliberately withheld, and any secret-scanner results are excluded entirely. Where detail is absent here it was REMOVED FOR PUBLICATION; it is not missing from the analysis. The complete artifact is available from the repository owner.**

## Score

- CAI 44 → 42 (-2.8)
- Rubric changed (rubric-2026.10.1 → rubric-2026.10.5) — scores are not directly comparable.

## Lenses

- Code Health 73 → 71 (-1.6)
- Architecture 65 → 65 (-0.0)
- Maturity 61 → 46 (-15.2)
- Readiness 29 → 29 (-0.0)
- Security 60 → 62 (+2.2)
- Accessibility 53 → 53 (+0.0)
- Performance 60 → 60 (+0.0)

## Resolved (6)

- Change coupling: IntlProvider.tsx ↔ index.ts (frontend/src/locale/IntlProvider.tsx)
- Change coupling: check-locales.cjs ↔ IntlProvider.tsx (frontend/check-locales.cjs)
- Critical CVE: [GHSA redacted] (backend/yarn.lock)
- Documentation: other issue (docs/src/public/robots.txt)
- Off-boarding risk: anonymized user #1
- Workflow token permissions not restricted

## New (31)

- Change coupling clique: check-locales.cjs, IntlProvider.tsx, index.ts (frontend/check-locales.cjs)
- Deprecated: prebuild-install (backend/yarn.lock)
- Deprecated: querystring (backend/yarn.lock)
- High CVE: [GHSA redacted] (frontend/yarn.lock)
- High secret: WD-SECRET-0005 (frontend/js/app/ui/header/main.js)
- High secret: WD-SECRET-0005 (frontend/js/app/users/list/item.js)
- High secret: WD-SECRET-0005 (src/frontend/js/app/audit-log/list/item.js)
- High secret: WD-SECRET-0005 (src/frontend/js/app/nginx/dead/list/item.js)
- High secret: WD-SECRET-0005 (src/frontend/js/app/nginx/proxy/list/item.js)
- High secret: WD-SECRET-0005 (src/frontend/js/app/nginx/redirection/list/item.js)
- High secret: WD-SECRET-0005 (src/frontend/js/app/nginx/stream/list/item.js)
- High secret: WD-SECRET-0005 (src/frontend/js/app/ui/header/main.js)
- High secret: WD-SECRET-0005 (src/frontend/js/app/users/list/item.js)
- High secret: WD-SECRET-0005 (src/frontend/js/app/users/list/item.js)
- Leaked secret: hardcoded-credential (backend/certbot/dns-plugins.json)
- Leaked secret: hardcoded-credential (backend/certbot/dns-plugins.json)
- Leaked secret: hardcoded-credential (backend/certbot/dns-plugins.json)
- Leaked secret: high-entropy-secret (backend/schema/paths/tokens/2fa/post.json)
- Leaked secret: private-key (backend/schema/paths/nginx/certificates/certID/upload/post.json)
- Medium: security finding (details withheld)
- …and 11 more

## Changes since last survey

- 15 commits — 11 feature/other, 4 fixes

## By area

- (repo) — 7 commits
- frontend/src — 3 commits
- test/cypress — 3 commits
- backend/certbot — 1 commit
- backend/internal — 1 commit

## Notable commits

- fix: Fix flakey cypress test
- fix: Merge branch 'develop' into fix/5919-access-list-render
- fix: Merge pull request #5935 from NginxProxyManager/fix/5919-access-list-render
- fix: fix(certbot): update Akamai Edge DNS plugin and credentials for v0.3.0
- change: Add missing FR translations
- change: Add missing German (de) and Italian (it) translations
- change: Add test for certificate validation with view-only permission
- change: Add test for unauthenticated certificate validation
- change: Improve existing french translations
- change: Merge pull request #5929 from NginxProxyManager/dependabot/npm_and_yarn/backend/proxy-addr-2.0.8
- change: Merge pull request #5930 from Juice-de-Orange/i18n/de-it-missing
- change: Merge pull request #5938 from Alexis-Loskoutoff/Update-FR-translations
- change: Merge pull request #5944 from jeezat/develop
- change: Merge pull request #5946 from Alexis-Loskoutoff/require-authentication-to-validate-certificates
- change: Require certificates:create permission to validate certificates