# Changelog

## Score

- CAI 44 → 42 (-1.4)
- Rubric changed (rubric-2026.10.1 → rubric-2026.10.5) — scores are not directly comparable.

## Lenses

- Code Health 41 → 34 (-6.8)
- Architecture 55 → 60 (+5.0)
- Maturity 67 → 59 (-8.1)
- Readiness 33 → 34 (+0.7)
- Security 81 → 81 (+0.3)
- Performance 81 → 81 (+0.0)

## Resolved (7)

- Off-boarding risk: anonymized user #1
- Outdated: org.eclipse.jetty.compression:jetty-compression-gzip
- Outdated: org.eclipse.jetty.compression:jetty-compression-server
- Outdated: org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-javax-server
- Outdated: org.eclipse.jetty:jetty-client
- Outdated: org.eclipse.jetty:jetty-rewrite
- Workflow holding a long-lived secret is unscoped

## New (4)

- High CVE: [GHSA redacted] (package-lock.json)
- Off-boarding risk: anonymized user #1
- Outdated: org.seleniumhq.selenium:selenium-java
- Workflow holding a long-lived secret is unscoped (.github/workflows/ci.yml)

## Changes since last survey

- 5 commits — 5 feature/other, 0 fixes

## By area

- project/Dependencies.scala — 2 commits
- project/plugins.sbt — 2 commits
- rest/src — 1 commit

## Notable commits

- change: Contextual REST companions (#1513)
- change: Update jetty-client to 12.1.14 (#1560)
- change: Update monix to 3.5.2 (#1563)
- change: Update sbt-native-packager to 1.13.0 (#1561)
- change: Update sbt-updates to 0.7.1 (#1562)