# Changelog

> **This is the PUBLIC form of this artifact. Findings are listed in full, but the details of SECURITY findings — which rule fired, in which file, on which line, and how to fix it — are deliberately withheld, and any secret-scanner results are excluded entirely. Where detail is absent here it was REMOVED FOR PUBLICATION; it is not missing from the analysis. The complete artifact is available from the repository owner.**

## Score

- CAI 56 → 56 (+0.1)
- Rubric changed (rubric-2026.08.18 → rubric-2026.08.19) — scores are not directly comparable.

## Lenses

- Architecture 97 → 97 (+0.1)
- Maturity 71 → 72 (+0.6)
- Readiness 56 → 56 (+0.0)
- Security 40 → 40 (+0.0)
- Domain Modelling 100 → 100 (+0.0)

## Resolved (11)

- High CVE: [GHSA redacted] (site/package-lock.json)
- High CVE: [GHSA redacted] (site/package-lock.json)
- High CVE: [GHSA redacted] (site/package-lock.json)
- High CVE: [GHSA redacted] (site/package-lock.json)
- High CVE: [GHSA redacted] (site/package-lock.json)
- High CVE: [GHSA redacted] (site/package-lock.json)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- Off-boarding risk: anonymized user #1
- The SPDX License brick's usage notes mention that the generated SPDX brick is not published at Brick Hub and should not be used by the general public, but there is no guidance on how to handle license selection when a user explicitly selects one of the listed licenses. (tool/spdx_license/README.md)

## New (9)

- High CVE: [GHSA redacted] (site/package-lock.json)
- High CVE: [GHSA redacted] (site/package-lock.json)
- High CVE: [GHSA redacted] (site/package-lock.json)
- High CVE: [GHSA redacted] (site/package-lock.json)
- High CVE: [GHSA redacted] (site/package-lock.json)
- High CVE: [GHSA redacted] (site/package-lock.json)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)

## Changes since last survey

- 6 commits — 6 feature/other, 0 fixes

## By area

- lib/src — 2 commits
- site/package-lock.json — 2 commits
- (root) — 1 commit
- .github/workflows — 1 commit

## Notable commits

- change: chore(deps): bump dart-lang/setup-dart from 1 to 1.7.2 (#1674)
- change: chore(deps): bump package_config from 2.2.0 to 3.0.0 (#1673)
- change: chore(deps-dev): bump @types/react from 19.2.17 to 19.2.18 in /site (#1672)
- change: chore(deps-dev): bump eslint from 10.7.0 to 10.8.0 in /site (#1671)
- change: chore: update SPDX licenses (#1668)
- change: feat(licenses): add workspace support (#1657)