# Changelog

> **This is the PUBLIC form of this artifact. Findings are listed in full, but the details of SECURITY findings — which rule fired, in which file, on which line, and how to fix it — are deliberately withheld, and any secret-scanner results are excluded entirely. Where detail is absent here it was REMOVED FOR PUBLICATION; it is not missing from the analysis. The complete artifact is available from the repository owner.**

## Score

- CAI 53 → 54 (+0.5)

## Lenses

- Code Health 82 → 83 (+0.9)
- Architecture 86 → 86 (+0.0)
- Maturity 68 → 75 (+6.6)
- Readiness 41 → 41 (+0.0)
- Security 52 → 52 (+0.0)
- Domain Modelling 68 → 68 (+0.0)
- Event-Driven 100 → 100 (+0.0)

## Resolved (24)

- BarePragmaDisable (Src/Apps/Records.Countries.Api.V1/Countries/Controllers/GetCountriesSummary/GetCountriesSummaryController.cs)
- BarePragmaDisable (Src/Core/My.System.Extensions/CollectionExtensions.cs)
- BarePragmaDisable (Src/Core/My.System.Extensions/ConfigurationExtensions.cs)
- BarePragmaDisable (Src/Core/My.System.Extensions/ObjectExtensions.cs)
- BarePragmaDisable (Src/Services/Shared/Records.Shared.Contracts/ResultDto.cs)
- BarePragmaDisable (Src/Services/Shared/Records.Shared.Infra.Http/Extensions/DefaultValidatorExtensions.cs)
- BarePragmaDisable (Src/Services/Shared/Records.Shared.Infra.MessageBroker.MassTransit/CustomEndpointNameFormatter.cs)
- BarePragmaDisable (Src/Services/Shared/Records.Shared.Infra.MessageBroker.MassTransit/IdempotentConsumerFilter.cs)
- BarePragmaDisable (Src/Services/Shared/Records.Shared.Infra.Persistence/DbSession.cs)
- BarePragmaDisable (Src/Services/Shared/Records.Shared.Infra.Projection/DbSessionProjection.cs)
- BarePragmaDisable (Src/Services/Shared/Records.Shared.Infra.Quartz.DependencyInjection/QuartzExtensions.cs)
- BarePragmaDisable (Src/Services/Shared/Records.Shared.Infra.Rop/IError.cs)
- Conflicting success/error patterns. ResultDto<T> uses a 'Success' boolean and an 'Error' object, while ErrorResponse uses a 'Code' and 'Message' directly. This creates two different patterns for representing operation outcomes.
- High CVE: System.Text.Json 8.0.0
- High CVE: System.Text.Json 8.0.0
- High: security finding (details withheld)
- Layer violation: Application → Infrastructure
- Layer violation: Application → Infrastructure
- Medium CVE: Azure.Identity 1.7.0
- Medium CVE: Azure.Identity 1.7.0
- …and 4 more

## New (9)

- High CVE: System.Text.Json 8.0.0
- High CVE: System.Text.Json 8.0.0
- High: security finding (details withheld)
- Inconsistent naming for the Country projector interface/implementation. The interface is named 'ICountryCrearedProjector' (typo: 'Creared' instead of 'Created'), while the SQL implementation is named 'CountryProjector'. Other projectors follow the pattern 'XProjector' (e.g., PersonProjector, PersonDeletedProjector).
- Inconsistent naming for the database session abstraction. It is referred to as 'IDbSession' in some places, while the unit of work is 'IUnitOfWork'. Additionally, 'IDbSession' is used for what appears to be a database session/transaction scope, but the naming is not consistent with 'IUnitOfWork' or 'ISession'.
- Inconsistent naming for the payload property. CreatePersonRequest and UpdatePersonRequest expose the entity as 'Person', while CreateCountryRequest exposes it as 'Country'. This breaks the pattern where the property name matches the entity type name.
- Medium CVE: Azure.Identity 1.7.0
- Medium CVE: Azure.Identity 1.7.0
- Redundant error representation types. Both types expose ErrorCode/Code, Message, and LogId/LogId properties. ErrorResponse adds HTTP status and timestamp, but the core error payload is duplicated.

## API surface

- Unchanged — 4 HTTP endpoints