# Changelog

> **This is the PUBLIC form of this artifact. Findings are listed in full, but the details of SECURITY findings — which rule fired, in which file, on which line, and how to fix it — are deliberately withheld, and any secret-scanner results are excluded entirely. Where detail is absent here it was REMOVED FOR PUBLICATION; it is not missing from the analysis. The complete artifact is available from the repository owner.**

## Score

- CAI 52 → 52 (+0.1)

## Lenses

- Code Health 54 → 52 (-2.0)
- Architecture 89 → 89 (+0.4)
- Maturity 70 → 74 (+3.6)
- Readiness 52 → 55 (+3.3)
- Security 44 → 43 (-0.8)
- Performance 85 → 85 (+0.0)

## Resolved (30)

- AAC.getSilentFrame (cognitive 19) (packages/xgplayer-transmuxer/src/codec/aac.js)
- AVC.parseSPS (cyclomatic 49) (packages/xgplayer-transmuxer/src/codec/avc.js)
- ClassTooLong: MSE (packages/xgplayer-streaming-shared/src/mse.js)
- Concentrated knowledge decay
- Critical CVE: [GHSA redacted] (yarn.lock)
- Documentation: no installation or build instructions (docs/ai-harness/quality-gates.md)
- Documentation: no project overview (README.md)
- Documentation: no project overview (docs/bvc2-main-merge-assessment.md)
- High CVE: [GHSA redacted] (yarn.lock)
- High CVE: [GHSA redacted] (yarn.lock)
- High CVE: [GHSA redacted] (yarn.lock)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- Hotspot: packages/xgplayer-streaming-shared/src/net/fetch.js (packages/xgplayer-streaming-shared/src/net/fetch.js)
- Job token omits the `contents` scope its checkout needs
- MPEG.parseHeader (cyclomatic 18) (packages/xgplayer-transmuxer/src/codec/mpeg.js)
- …and 10 more

## New (183)

- AAC.getSilentFrame (cognitive 19) (packages/xgplayer-transmuxer/src/codec/aac.ts)
- AVC.parseSPS (cognitive 47) (packages/xgplayer-transmuxer/src/codec/avc.ts)
- AVC.parseSPS (cyclomatic 49) (packages/xgplayer-transmuxer/src/codec/avc.ts)
- ClassTooLong: MSE (packages/xgplayer-streaming-shared/src/mse.ts)
- Deprecated: @babel/plugin-proposal-async-generator-functions (yarn.lock)
- Deprecated: @babel/plugin-proposal-class-properties (yarn.lock)
- Deprecated: @babel/plugin-proposal-class-static-block (yarn.lock)
- Deprecated: @babel/plugin-proposal-dynamic-import (yarn.lock)
- Deprecated: @babel/plugin-proposal-export-namespace-from (yarn.lock)
- Deprecated: @babel/plugin-proposal-json-strings (yarn.lock)
- Deprecated: @babel/plugin-proposal-logical-assignment-operators (yarn.lock)
- Deprecated: @babel/plugin-proposal-nullish-coalescing-operator (yarn.lock)
- Deprecated: @babel/plugin-proposal-numeric-separator (yarn.lock)
- Deprecated: @babel/plugin-proposal-object-rest-spread (yarn.lock)
- Deprecated: @babel/plugin-proposal-optional-catch-binding (yarn.lock)
- Deprecated: @babel/plugin-proposal-optional-chaining (yarn.lock)
- Deprecated: @babel/plugin-proposal-private-methods (yarn.lock)
- Deprecated: @babel/plugin-proposal-private-property-in-object (yarn.lock)
- Deprecated: @babel/plugin-proposal-unicode-property-regex (yarn.lock)
- Deprecated: abab (yarn.lock)
- …and 163 more

## Changes since last survey

- 20 commits — 12 feature/other, 8 fixes

## By area

- packages/xgplayer-mp3 — 6 commits
- (root) — 3 commits
- scripts/workflow — 3 commits
- packages/xgplayer — 2 commits
- packages/xgplayer-transmuxer — 2 commits
- .github/release-guideline.md — 1 commit
- packages/xgplayer-ads — 1 commit
- packages/xgplayer-music — 1 commit
- packages/xgplayer-streaming-shared — 1 commit

## Notable commits

- fix: fix(monorepo): include changelogs in npm packages
- fix: fix(monorepo): keep release changelogs and packages consistent
- fix: fix(monorepo): reject outdated release tags before preparation
- fix: fix(monorepo): use release app for stable metadata writes
- fix: fix(xgplayer-mp3): address mp3 loader review issues
- fix: fix(xgplayer-mp3): correct EOF handling and source switching
- fix: fix(xgplayer-mp3): improve loader logging and fixture UX
- fix: fix(xgplayer-transmuxer): drop malformed ADTS AAC frames
- change: chore(release): release version v3.0.27
- change: ci(monorepo): streamline release workflow setup
- change: docs(monorepo): define maintainable code change principles
- change: docs(monorepo): keep script regression checks outside the repository
- change: docs(monorepo): make commit intent clear to reviewers
- change: docs(monorepo): unify package changelogs through 3.0.26
- change: docs(mp3): focus README on public usage
- change: docs(music): refresh v3 usage and MP3 guidance
- change: feat(mp3): add standalone MSE playback plugin
- change: feat(xgplayer-mp3): add standalone mp3 streaming support
- change: feat(xgplayer-streaming-shared): expose MMS buffer changes
- change: refactor(xgplayer-transmuxer): migrate codec entrypoints to ts