# Changelog

## Score

- CAI 63 → 65 (+1.7)
- Rubric changed (rubric-2026.09.12 → rubric-2026.09.18) — scores are not directly comparable.

## Lenses

- Code Health 97 → 97 (+0.0)
- Architecture 100 → 100 (+0.0)
- Maturity 38 → 42 (+3.7)
- Readiness 73 → 72 (-0.3)
- Security 97 → 98 (+0.5)

## Resolved (6)

- Coverage not measured — no coverage collector is wired up
- Hotspot: src/oidcc_authorization.erl (src/oidcc_authorization.erl)
- Hotspot: src/oidcc_jwt_util.erl (src/oidcc_jwt_util.erl)
- Medium CVE: EEF-[CVE redacted] (mix.lock)
- Members sharing a duplicated core (4 members, 50+ identical tokens) (src/oidcc.erl)
- Off-boarding risk: anonymized user #1

## New (3)

- Medium CVE: EEF-[CVE redacted] (mix.lock)
- Members sharing a duplicated core (4 members, 50+ identical tokens) (src/oidcc.erl)
- Off-boarding risk: anonymized user #1

## Changes since last survey

- 2 commits — 2 feature/other, 0 fixes

## By area

- .github/workflows — 2 commits

## Notable commits

- change: Bump the github-actions group with 3 updates (#551)
- change: Bump the github-actions group with 4 updates (#549)