# Changelog

## Score

- CAI 56 → 55 (-0.7)

## Lenses

- Code Health 55 → 51 (-3.7)
- Architecture 98 → 98 (+0.0)
- Maturity 53 → 55 (+2.2)
- Readiness 55 → 55 (-0.0)
- Security 81 → 81 (-0.3)
- Performance 60 → 60 (+0.0)

## Resolved (16)

- Documentation: no installation or build instructions (docs/recipes/babel.md)
- High CVE: [GHSA redacted] (pnpm-lock.yaml)
- Medium CVE: [GHSA redacted] (pnpm-lock.yaml)
- MethodTooLong: Assertions.constructor (lib/assert.js)
- Off-boarding risk: anonymized user #1
- Outdated (npm): pretty-ms
- Skipped (documented): baz (test/snapshot-workflow/fixtures/invalid-snapfile/test.js)
- Skipped (documented): some snapshots (test/snapshot-removal/fixtures/skipped-tests/test.js)
- Test project verifies nothing: test/test-timeouts/fixtures (test/test-timeouts/fixtures/invalid-message.js)
- Workflow holding a long-lived secret is unscoped
- constructor (cognitive 78) (lib/assert.js)
- constructor (cyclomatic 71) (lib/assert.js)
- run (cognitive 32) (lib/worker/base.js)
- run (cognitive 47) (lib/api.js)
- run (cyclomatic 26) (lib/worker/base.js)
- run (cyclomatic 45) (lib/api.js)

## New (17)

- High secret: WD-SECRET-0005 (package-lock.json)
- Hotspot: lib/api.js (lib/api.js)
- Hotspot: lib/assert.js (lib/assert.js)
- Hotspot: lib/worker/base.js (lib/worker/base.js)
- Off-boarding risk: anonymized user #1
- Outdated (npm): cbor2
- Rotate the exposed credentials — git history can't be un-committed
- Skipped test: baz (test/snapshot-workflow/fixtures/invalid-snapfile/test.js)
- Skipped test: some snapshots (test/snapshot-removal/fixtures/skipped-tests/test.js)
- Test project verifies nothing: test/test-timeouts/fixtures (test/test-timeouts/fixtures/custom-message.js)
- Workflow holding a long-lived secret is unscoped (.github/workflows/ci.yml)
- constructor (cognitive 105) (lib/assert.js)
- constructor (cyclomatic 82) (lib/assert.js)
- run (cognitive 34) (lib/worker/base.js)
- run (cognitive 48) (lib/api.js)
- run (cyclomatic 27) (lib/worker/base.js)
- run (cyclomatic 46) (lib/api.js)

## Changes since last survey

- 16 commits — 15 feature/other, 1 fixes

## By area

- (root) — 8 commits
- test-tap/reporters — 2 commits
- test/assertions — 2 commits
- .github/workflows — 1 commit
- lib/api.js — 1 commit
- lib/assert.js — 1 commit
- test/snapshot-tests — 1 commit

## Notable commits

- fix: Fix TAP reporter assertion locations (#3485)
- change: Don't perform git checks when publishing
- change: Fix typos in source code and comments (#3465)
- change: Guard against undefined variable when test file selection throws
- change: Improve startup and test-run performance (#3460)
- change: Improve t.throws message when function doesn't throw (#3462)
- change: Report timeouts without crashing the TAP reporter
- change: Support code block formatting for string snapshots (#3449)
- change: Switch back to long-hand form for the package.json repository field (#3502)
- change: Update dependencies (#3500)
- change: Update release process docs to account for staged publishing (#3497)
- change: v8.0.2
- change: v8.1.0
- change: v8.1.1
- change: v8.1.2
- change: v8.2.0