# Changelog

> **This is the PUBLIC form of this artifact. Findings are listed in full, but the details of SECURITY findings — which rule fired, in which file, on which line, and how to fix it — are deliberately withheld, and any secret-scanner results are excluded entirely. Where detail is absent here it was REMOVED FOR PUBLICATION; it is not missing from the analysis. The complete artifact is available from the repository owner.**

## Score

- CAI 63 → 57 (-5.6)

## Lenses

- Code Health 64 → 63 (-0.3)
- Architecture 69 → 69 (+0.0)
- Maturity 75 → 74 (-0.4)
- Readiness 55 → 43 (-11.8)
- Security 80 → 79 (-1.1)
- Performance 100 → 100 (+0.0)

## Resolved (10)

- Documentation: written for insiders (docs/native-javascript-dialog-requirement.md)
- No ADRs found
- Off-boarding risk: anonymized user #1
- PR-triggered workflow without a permissions block
- Repeated repair: package/ego-browser/src/driver/nav.ts (package/ego-browser/src/driver/nav.ts)
- Repeated repair: package/ego-browser/src/driver/waits.ts (package/ego-browser/src/driver/waits.ts)
- Repeated repair: package/ego-browser/src/format.ts (package/ego-browser/src/format.ts)
- cdp-eval.hasReturnStatement (cognitive 48) (package/ego-browser/src/cdp-eval.ts)
- cdp-eval.hasReturnStatement (cyclomatic 24) (package/ego-browser/src/cdp-eval.ts)
- public-api-schema.publicApiMarkdown (cognitive 32) (package/ego-browser/src/public-api-schema.ts)

## New (14)

- FunctionTooLong: package-plugins.packagePlugin (plugins/scripts/package-plugins.mjs)
- High: security finding (details withheld)
- High: security finding (details withheld)
- Low CVE: [GHSA redacted] (package/ego-browser/package-lock.json)
- Medium: security finding (details withheld)
- Off-boarding risk: anonymized user #1
- PR-triggered workflow without a permissions block (.github/workflows/main-pr-source.yml)
- Repeated repair: package/ego-browser/src/clipboard.ts (package/ego-browser/src/clipboard.ts)
- Repeated repair: package/ego-browser/src/ego-errors.ts (package/ego-browser/src/ego-errors.ts)
- Secret passed as a command-line argument
- Workflow token permissions not restricted (.github/workflows/purge-camo-cache.yml)
- package-plugins.packagePlugin (cognitive 43) (plugins/scripts/package-plugins.mjs)
- package-plugins.packagePlugin (cyclomatic 24) (plugins/scripts/package-plugins.mjs)
- package-plugins.parseArguments (cognitive 16) (plugins/scripts/package-plugins.mjs)

## Changes since last survey

- 7 commits — 4 feature/other, 3 fixes

## By area

- (repo) — 3 commits
- .github/star-history — 3 commits
- (root) — 1 commit

## Notable commits

- fix: Merge pull request #572 from citrolabs/fix/restore-star-history-axis
- fix: fix(ci): restore star history updates and round Y axis bounds
- fix: fix(ci): update star history actions to Node 24 and pin Ubuntu
- change: Merge pull request #472 from citrolabs/release/v2.1.0
- change: Merge pull request #486 from citrolabs/docs/readme-bench-windows
- change: docs: sync README benchmarks and comparison table with lite.ego.app, add a Windows download
- change: fix(ci): remove trailing whitespace from renderer patch