# Changelog

> **This is the PUBLIC form of this artifact. Findings are listed in full, but the details of SECURITY findings — which rule fired, in which file, on which line, and how to fix it — are deliberately withheld, and any secret-scanner results are excluded entirely. Where detail is absent here it was REMOVED FOR PUBLICATION; it is not missing from the analysis. The complete artifact is available from the repository owner.**

## Score

- CAI 62 → 49 (-12.9)
- Rubric changed (rubric-2026.10.1 → rubric-2026.10.5) — scores are not directly comparable.

## Lenses

- Code Health 63 → 51 (-12.1)
- Architecture 90 → 89 (-0.3)
- Maturity 85 → 56 (-29.2)
- Readiness 71 → 71 (-0.1)
- Security 57 → 41 (-15.4)
- Domain Modelling 63 → 63 (+0.0)
- Accessibility 65 → 53 (-12.7)

## Resolved (12)

- ADR not followed: 8. Drop JSON schema for specifying document properties in favour of our own custom schema definition (docs/adr/0008-drop-json-schema-for-document-configuration.md)
- Base-context workflow trigger runs with an unscoped token
- Documentation: written for insiders (docs/email_delivery.md)
- Low CVE: [GHSA redacted] (yarn.lock)
- Low CVE: [GHSA redacted] (yarn.lock)
- Medium: security finding (details withheld)
- Medium: security finding (details withheld)
- Off-boarding risk: anonymized user #1
- Off-boarding risk: anonymized user #2
- Outdated: rails
- PR-triggered workflow without a permissions block
- Workflow holding a long-lived secret is unscoped

## New (74)

- Base-context workflow trigger runs with an unscoped token (.github/workflows/release.yml)
- Duplicated block (14–15 lines × 4) (db/data_migration/20230515143400_remove_central_african_republic_embassy_special_case.rb)
- Duplicated block (16–17 lines × 2) (db/data_migration/20230518160200_reinstate_independent_agricultural_appeals_panel_organisation.rb)
- Duplicated block (17 lines × 2) (db/data_migration/20250723151139_re_add_academy_for_social_justice_historical_orgs.rb)
- Duplicated block (17 lines × 4) (db/data_migration/20230516122000_remove_liechtenstein_embassy_special_case.rb)
- Duplicated block (5 lines × 2) (db/data_migration/20240416120548_rename_micronesia.rb)
- Duplicated block (6 lines × 2) (app/controllers/admin/contacts_controller.rb)
- Duplicated block (7 lines × 2) (db/data_migration/20260225122212_update_news_articles_images_to_lead_usage.rb)
- Duplicated block (8 lines × 2) (app/components/admin/features/featured_documents_table_component.rb)
- High: security finding (details withheld)
- Medium CVE: [GHSA redacted] (yarn.lock)
- Medium CVE: [GHSA redacted] (yarn.lock)
- Medium: security finding (details withheld)
- Members sharing a duplicated core (4 members, 50+ identical tokens) (db/data_migration/20230515143400_remove_central_african_republic_embassy_special_case.rb)
- Members sharing a duplicated core (4 members, 50+ identical tokens) (db/data_migration/20230516122000_remove_liechtenstein_embassy_special_case.rb)
- Off-boarding risk: anonymized user #1
- Off-boarding risk: anonymized user #2
- Orphaned file (app/components/admin/organisations/show/summary_list_component.rb)
- Orphaned file (app/components/admin/social_media_accounts/index/summary_card_component.rb)
- Orphaned file (app/components/admin/worldwide_offices/index/office_summary_card_component.rb)
- …and 54 more

## Changes since last survey

- 95 commits — 87 feature/other, 8 fixes

## By area

- (repo) — 39 commits
- (root) — 15 commits
- app/models — 13 commits
- app/controllers — 10 commits
- app/views — 3 commits
- .github/workflows — 2 commits
- test/unit — 2 commits
- app/components — 1 commit
- app/helpers — 1 commit
- app/services — 1 commit
- app/validators — 1 commit
- config/brakeman.ignore — 1 commit
- config/locales — 1 commit
- db/data_migration — 1 commit
- features/step_definitions — 1 commit
- lib/whitehall — 1 commit
- lib/whitehall.rb — 1 commit
- public/configurable-document-type.schema.json — 1 commit

## Notable commits

- fix: Attribute RFC-192 publication slug fixes to the robot
- fix: Fix document type for mini site child [WHIT-4137]
- fix: Fix issue where unrelated child-level edition slugs would clash
- fix: Merge pull request #11629 from alphagov/revert-political-permissions-extension
- fix: Merge pull request #11856 from alphagov/revert-11845-WHIT-4037-only-show-vaild-child-doc-types
- fix: Merge pull request #11891 from alphagov/fix-document-type
- fix: Revert "Allow Managing Editors to edit historical documents under a specific government"
- fix: Revert "Only show valid child documents [WHIT-4037]"
- change: Add "object" to the block_attribute type enum in document type schema
- change: Add NationApplicabilityHelper
- change: Add NationApplicabilityValidator
- change: Add `valid_parent_relationship` to child documents
- change: Add conditionally_reveal support to default_checkboxes
- change: Add default_checkboxes content block
- change: Add mini site child only when parent specified
- change: Add nation_applicability to the mini site landing document type
- change: Add nation_applicability to the test configurable document type fixture
- change: Add permission enforcer to Promotional Features actions
- change: Add publishing prerequisites to StandardEdition
- change: Add validation to `ParentChildRelationship`
- …and 75 more

## Architecture

- 0 containers · 1 bounded contexts · 0 dependency edges (baseline)