# Changelog

> **This is the PUBLIC form of this artifact. Findings are listed in full, but the details of SECURITY findings — which rule fired, in which file, on which line, and how to fix it — are deliberately withheld, and any secret-scanner results are excluded entirely. Where detail is absent here it was REMOVED FOR PUBLICATION; it is not missing from the analysis. The complete artifact is available from the repository owner.**

## Score

- CAI 54 → 39 (-15.0)
- Rubric changed (rubric-2026.08.18 → rubric-2026.08.15) — scores are not directly comparable.

## Lenses

- Code Health 66 → 50 (-16.3)
- Architecture 95 → 92 (-3.8)
- Maturity 87 → 90 (+2.8)
- Readiness 35 → 16 (-19.2)
- Security 59 → 49 (-9.7)

## Resolved (17)

- Boundary-crossing change coupling: albums_controller.rb ↔ artist.rb (app/controllers/albums_controller.rb)
- Change coupling: albums_controller.rb ↔ artists_controller.rb (app/controllers/albums_controller.rb)
- Change coupling: development.rb ↔ production.rb (config/environments/development.rb)
- Change coupling: media_session_controller.js ↔ songs_controller.js (app/javascript/controllers/media_session_controller.js)
- Change coupling: player_controller.js ↔ player.js (app/javascript/controllers/player_controller.js)
- Change coupling: scoped_setting_concern.rb ↔ setting.rb (app/models/concerns/scoped_setting_concern.rb)
- Change coupling: songs_controller.js ↔ playlist.js (app/javascript/controllers/songs_controller.js)
- ClientDetection.need_transcode? (cognitive 17) (app/controllers/concerns/client_detection.rb)
- Coverage not included — suite not readable by the collector
- Dependency hygiene not measured — dependency manifest found but not parsed for hygiene
- High vulnerability: [GHSA redacted] (package-lock.json)
- Medium vulnerability: [GHSA redacted] (Gemfile.lock)
- Medium vulnerability: [GHSA redacted] (Gemfile.lock)
- Off-boarding risk: anonymized user #1
- The README's Try The Demo note mentions Free Music Archive licenses but does not link to that file, so license compliance cannot be verified from the demo alone. (README.md)
- The request/response format and error-table sections are clipped mid-sentence ("| 403 Forbidden | ...") before covering pagination, which is an important API detail. (docs/api/README.md)
- Workflow token permissions not restricted

## New (36)

- Change coupling: index.js ↔ helper.js (app/javascript/controllers/index.js)
- Change coupling: media_session_controller.js ↔ playlist.js (app/javascript/controllers/media_session_controller.js)
- Change coupling: media_session_controller.js ↔ playlist_sortable_controller.js (app/javascript/controllers/media_session_controller.js)
- Change coupling: mini_player_controller.js ↔ playlist.js (app/javascript/controllers/mini_player_controller.js)
- Change coupling: mini_player_controller.js ↔ playlist_sortable_controller.js (app/javascript/controllers/mini_player_controller.js)
- Change coupling: player.js ↔ playlist.js (app/javascript/player.js)
- Change coupling: player_controller.js ↔ playlist_sortable_controller.js (app/javascript/controllers/player_controller.js)
- Coverage not measured — test suite did not build
- Critical CVE: [GHSA redacted] (Gemfile.lock)
- Dimension evaluation failed
- High CVE: [GHSA redacted] (package-lock.json)
- High CVE: [GHSA redacted] (package-lock.json)
- High CVE: [GHSA redacted] (package-lock.json)
- High CVE: [GHSA redacted] (package-lock.json)
- High CVE: [GHSA redacted] (package-lock.json)
- High CVE: [GHSA redacted] (package-lock.json)
- High: security finding (details withheld)
- LLM evaluation failed
- Low CVE: [GHSA redacted] (Gemfile.lock)
- Low CVE: [GHSA redacted] (Gemfile.lock)
- …and 16 more

## Changes since last survey

- 1 commits — 0 feature/other, 1 fixes

## By area

- test/controllers — 1 commit

## Notable commits

- fix: fix: keep dialogs from reopening after a redirect back (#497)