# Changelog

## Score

- CAI 33 → 34 (+0.8)
- Rubric changed (rubric-2026.08.18 → rubric-2026.08.19) — scores are not directly comparable.

## Lenses

- Code Health 61 → 62 (+1.1)
- Architecture 91 → 91 (+0.0)
- Maturity 46 → 46 (+0.0)
- Readiness 16 → 18 (+1.9)
- Security 48 → 39 (-9.1)
- Domain Modelling 100 → 100 (+0.0)
- Accessibility 39 → 46 (+7.0)

## Resolved (24)

- Dependency hygiene not measured — this repository's dependencies are not NuGet
- High CVE: [GHSA redacted] (QuickStartUI/package-lock.json)
- High CVE: [GHSA redacted] (QuickStartUI/package-lock.json)
- High CVE: [GHSA redacted] (QuickStartUI/package-lock.json)
- High CVE: [GHSA redacted] (QuickStartUI/package-lock.json)
- High CVE: [GHSA redacted] (QuickStartUI/package-lock.json)
- Inconsistent naming for audit log retrieval. Some methods are named 'GetAuditLogsAsync' while others are 'GetTotalAuditForSingleMonthAsync'. While the latter is specific, the general pattern for getting logs is inconsistent with the rest of the codebase which uses 'Get...Async' for single items and 'GetAll...Async' for collections.
- Inconsistent naming for deletion. IAccountService uses 'DeleteAccountForCustomerAsync' while ICustomerService uses 'DeleteCustomerAsync'.
- Inconsistent naming for list retrieval operations. IAccountService uses 'GetAccountsAync' (typo: Aync) and omits 'Async' suffix in the verb, while ICustomerService uses 'GetAllCustomersAsync'.
- Inconsistent naming for repository/service interfaces and implementations. The codebase uses 'Customer' for some entities and 'Account' for others, but the pattern of 'Get' vs 'GetAll' vs 'GetAsync' is not uniform. Specifically, 'GetAllCustomersAsync' is used for a list, while 'GetCustomerAsync' is used for a single item. However, 'GetAccountAsync' is used for a single item. The inconsistency is primarily in the pluralization and the 'Async' suffix usage across different entity types.
- Inconsistent naming for single-item retrieval. IAccountService and ICustomerService use 'Get...Async' with a customerId parameter, while IUserService uses 'GetUserById'.
- Inconsistent naming for update operations. IAccountService uses 'UpdateAccountForCustomerAsync', while others use 'Update...Async'.
- Inconsistent use of 'Async' suffix in method names. Some methods follow the standard C# convention of appending 'Async' to indicate asynchronous operations (e.g., GetCustomerAsync), while others do not (e.g., GetAccountsAync - note the typo 'Aync' as well, but primarily the inconsistency lies in the presence/absence of the suffix for similar operations).
- Low CVE: [GHSA redacted] (QuickStartUI/package-lock.json)
- Medium CVE: [GHSA redacted] (QuickStartUI/package-lock.json)
- Medium CVE: [GHSA redacted] (QuickStartUI/package-lock.json)
- Medium CVE: [GHSA redacted] (QuickStartUI/package-lock.json)
- Medium CVE: [GHSA redacted] (QuickStartUI/package-lock.json)
- Medium CVE: [GHSA redacted] (QuickStartUI/package-lock.json)
- Medium CVE: [GHSA redacted] (QuickStartUI/package-lock.json)
- …and 4 more

## New (25)

- Dependency hygiene not measured — no packages were read
- High CVE: [GHSA redacted] (QuickStartUI/package-lock.json)
- High CVE: [GHSA redacted] (QuickStartUI/package-lock.json)
- High CVE: [GHSA redacted] (QuickStartUI/package-lock.json)
- High CVE: [GHSA redacted] (QuickStartUI/package-lock.json)
- High CVE: [GHSA redacted] (QuickStartUI/package-lock.json)
- High CVE: [GHSA redacted] (QuickStartUI/package-lock.json)
- High CVE: [GHSA redacted] (QuickStartUI/package-lock.json)
- High CVE: [GHSA redacted] (QuickStartUI/package-lock.json)
- High CVE: [GHSA redacted] (QuickStartUI/package-lock.json)
- High CVE: [GHSA redacted] (QuickStartUI/package-lock.json)
- High CVE: [GHSA redacted] (QuickStartUI/package-lock.json)
- High CVE: [GHSA redacted] (QuickStartUI/package-lock.json)
- Inconsistent method signatures for single-item retrieval. AccountService requires both customerId and id, while CustomerService only requires customerId (implying the current user's context or a different routing strategy).
- Inconsistent naming for 'get all' operations. One uses 'GetAccountsAync' (typo in Async) while the other uses 'GetAllCustomersAsync'.
- Inconsistent naming for delete operations. One uses 'Delete...ForCustomer' while the other uses 'Delete...Async' directly.
- Inconsistent naming for single-item retrieval. RoleService uses 'GetRoleById' while UserService uses 'GetUserById'.
- Inconsistent naming for update operations. Some methods use 'Update' (e.g., UpdateCustomerAsync), while others use 'Update...For...Async' (e.g., UpdateAccountForCustomerAsync).
- Inconsistent use of 'Async' suffix for asynchronous methods. Some methods correctly use 'Async' (e.g., CreateCustomerAsync, GetAuditLogsAsync), while others do not (e.g., CreateRole).
- Inconsistent use of 'Async' suffix in method names. Some methods use the standard 'Async' suffix (e.g., GetCustomerAsync), while others use the misspelled 'Aync' (e.g., GetAccountsAync).
- …and 5 more

## API surface

- Unchanged — 28 HTTP endpoints

## Architecture

- Unchanged — 2 containers · 0 contexts · 0 edges