# Changelog

## Score

- CAI 64 → 62 (-1.9)
- Rubric changed (rubric-2026.10.1 → rubric-2026.10.5) — scores are not directly comparable.

## Lenses

- Code Health 99 → 73 (-25.8)
- Architecture 83 → 83 (+0.0)
- Maturity 52 → 56 (+3.6)
- Readiness 67 → 64 (-3.0)
- Security 82 → 64 (-17.4)
- Accessibility 72 → 68 (-3.3)

## Resolved (3)

- Outdated: spatie/laravel-webhook-server
- PR-triggered workflow without a permissions block
- Workflow holding a long-lived secret is unscoped

## New (12)

- Documentation: no architecture or design documentation (README.md)
- High CVE: [GHSA redacted] (package-lock.json)
- High CVE: [GHSA redacted] (package-lock.json)
- Leaked secret: hardcoded-credential (database/factories/UserFactory.php)
- Medium CVE: [GHSA redacted] (composer.lock)
- Medium CVE: [GHSA redacted] (package-lock.json)
- Outdated: dragonmantank/cron-expression
- Outdated: spatie/laravel-settings
- Outdated: spatie/ping
- PR-triggered workflow without a permissions block (.github/workflows/ci.yml)
- PR-triggered workflow without a permissions block (.github/workflows/validate-openapi.yml)
- Workflow holding a long-lived secret is unscoped (.github/workflows/cd.yml)