# Changelog

## Score

- CAI 49 → 50 (+1.1)
- Rubric changed (rubric-2026.08.18 → rubric-2026.08.19) — scores are not directly comparable.

## Lenses

- Code Health 66 → 66 (+0.1)
- Architecture 90 → 90 (+0.0)
- Maturity 71 → 71 (+0.0)
- Readiness 50 → 51 (+0.4)
- Security 57 → 56 (-0.5)
- Domain Modelling 100 → 100 (+0.0)
- Accessibility 37 → 39 (+2.3)

## Resolved (3)

- Off-boarding risk: anonymized user #1
- The Quick Start example uses the class constructor with a destructured auth option but does not show how to configure authentication middleware or route protection for protected endpoints. (README.md)
- The README lists features like SAML support, but no dedicated security guide explains how to set up SAML integration or configure the auth middleware. (README.md)

## New (5)

- High CVE: [GHSA redacted] (package-lock.json)
- High CVE: [GHSA redacted] (package-lock.json)
- Off-boarding risk: anonymized user #1
- The Quick Start example uses `tenso()` without importing the module (``import {tenso} from ...``), which is not shown in the code block and appears to be clipped by the scanner rather than a defect. (README.md)
- The README lists 'TypeScript Support' but does not show any TypeScript usage in the example, leaving this feature unverifiable from the visible content. (README.md)