# Changelog

## Score

- CAI 67 → 54 (-13.3)
- Rubric changed (rubric-2026.10.1 → rubric-2026.10.5) — scores are not directly comparable.

## Lenses

- Code Health 76 → 81 (+4.9)
- Architecture 84 → 88 (+4.2)
- Maturity 65 → 62 (-3.1)
- Readiness 62 → 50 (-11.1)
- Security 77 → 44 (-32.5)
- Performance 85 → 85 (+0.0)

## Resolved (3)

- Hotspot: lib/src/entrypoint.dart (lib/src/entrypoint.dart)
- Off-boarding risk: anonymized user #1
- TodoComment (lib/src/io.dart)

## New (88)

- ClassTooLong: LishCommand (lib/src/command/lish.dart)
- Documentation: no usage examples (README.md)
- FileTooLong: src/pubspec.dart (lib/src/pubspec.dart)
- Leaked secret: aws-access-key (lib/src/validator/leak_detection.dart)
- Leaked secret: aws-access-key (lib/src/validator/leak_detection.dart)
- Leaked secret: aws-access-key (lib/src/validator/leak_detection.dart)
- Leaked secret: aws-access-key (lib/src/validator/leak_detection.dart)
- Leaked secret: aws-access-key (lib/src/validator/leak_detection.dart)
- Leaked secret: aws-access-key (lib/src/validator/leak_detection.dart)
- Leaked secret: aws-access-key (lib/src/validator/leak_detection.dart)
- Leaked secret: aws-access-key (lib/src/validator/leak_detection.dart)
- Leaked secret: aws-access-key (lib/src/validator/leak_detection.dart)
- Leaked secret: gcp-api-key (lib/src/validator/leak_detection.dart)
- Leaked secret: gcp-api-key (lib/src/validator/leak_detection.dart)
- Leaked secret: gcp-api-key (lib/src/validator/leak_detection.dart)
- Leaked secret: gcp-api-key (lib/src/validator/leak_detection.dart)
- Leaked secret: gcp-api-key (lib/src/validator/leak_detection.dart)
- Leaked secret: gcp-api-key (lib/src/validator/leak_detection.dart)
- Leaked secret: gcp-api-key (lib/src/validator/leak_detection.dart)
- Leaked secret: gcp-api-key (lib/src/validator/leak_detection.dart)
- …and 68 more

## Changes since last survey

- 11 commits — 11 feature/other, 0 fixes

## By area

- lib/src — 7 commits
- .github/workflows — 2 commits
- test/lish — 1 commit
- test/testdata — 1 commit

## Notable commits

- change: Always emit NoVersionsIncompatibilityCause when bestVersion returns null (#4921)
- change: Avoid incomplete AbiSpecificInteger in chmod_ffi.dart (#4924)
- change: Detect modern dartdoc output in CompiledDartdocValidator (#4928)
- change: Embed native assets in the integration test snapshot (#4888)
- change: Emit positive incompatibilities for forbidden package constraints (#4919)
- change: Make PartialSolution._positive non-nullable (#4920)
- change: Make package archives reproducible with deterministic timestamps and entry ordering (#4885)
- change: Reformat each range of a VersionUnion in solver error messages (#4923)
- change: Run Chrome browser tests in a dedicated CI job (#4926)
- change: Stop routing subprocesses through cmd.exe on Windows and validate git refs (#4941)
- change: Support uploading package attestations during publish --from-archive (#4876)