# Changelog

## Score

- CAI 37 → 39 (+1.9)
- Rubric changed (rubric-2026.08.17 → rubric-2026.08.18) — scores are not directly comparable.

## Lenses

- Code Health 60 → 60 (+0.3)
- Architecture 93 → 93 (-0.0)
- Maturity 57 → 60 (+3.0)
- Readiness 26 → 24 (-1.6)
- Security 43 → 61 (+18.3)
- Domain Modelling 100 → 100 (+0.0)
- Accessibility 37 → 37 (+0.0)

## Resolved (25)

- Critical CVE: [GHSA redacted] (Distributed-eStore.UI/src/ClientApp/package-lock.json)
- Critical CVE: [GHSA redacted] (Distributed-eStore.UI/src/ClientApp/package-lock.json)
- High CVE: [GHSA redacted] (Distributed-eStore.UI/src/ClientApp/package-lock.json)
- High CVE: [GHSA redacted] (Distributed-eStore.UI/src/ClientApp/package-lock.json)
- High CVE: [GHSA redacted] (Distributed-eStore.UI/src/ClientApp/package-lock.json)
- High CVE: [GHSA redacted] (Distributed-eStore.UI/src/ClientApp/package-lock.json)
- High CVE: [GHSA redacted] (Distributed-eStore.UI/src/ClientApp/package-lock.json)
- High CVE: [GHSA redacted] (Distributed-eStore.UI/src/ClientApp/package-lock.json)
- High CVE: [GHSA redacted] (Distributed-eStore.UI/src/ClientApp/package-lock.json)
- High CVE: [GHSA redacted] (Distributed-eStore.UI/src/ClientApp/package-lock.json)
- High CVE: [GHSA redacted] (Distributed-eStore.UI/src/ClientApp/package-lock.json)
- High CVE: [GHSA redacted] (Distributed-eStore.UI/src/ClientApp/package-lock.json)
- High CVE: [GHSA redacted] (Distributed-eStore.UI/src/ClientApp/package-lock.json)
- High CVE: [GHSA redacted] (Distributed-eStore.UI/src/ClientApp/package-lock.json)
- High CVE: [GHSA redacted] (Distributed-eStore.UI/src/ClientApp/package-lock.json)
- High CVE: [GHSA redacted] (Distributed-eStore.UI/src/ClientApp/package-lock.json)
- High CVE: [GHSA redacted] (Distributed-eStore.UI/src/ClientApp/package-lock.json)
- High CVE: [GHSA redacted] (Distributed-eStore.UI/src/ClientApp/package-lock.json)
- Inconsistent naming for commands. Some commands are named with the action and entity (e.g., `CreateProduct`), while others use the pattern `[Entity]Command` (e.g., `SignUpCommand`, `SignInCommand`). This creates a mixed naming convention for the same type of object (a command).
- Inconsistent naming for domain entities. One is named `User` (singular), while another is `RefreshToken` (singular). However, looking at the broader context, `User` is a core identity entity, while `RefreshToken` is a related but distinct concept. The inconsistency lies in the fact that `User` is a simple name, whereas other entities like `Product` or `Order` might follow different patterns. More critically, `User` is often referred to as `Account` or `Customer` in other systems, but here it is `User`. If `User` is the standard, it should be consistent. However, a more glaring inconsistency is between `DistributedEStore.Services.Identity.Domain.User` and `DistributedEStore.Services.Identity.Domain.RefreshToken`. While different concepts, the naming style differs: `User` is a noun, `RefreshToken` is a noun phrase. This is minor. A stronger inconsistency is between `DistributedEStore.Common.Models.RegisterUserResponse` and `DistributedEStore.Common.Models.OrderItems`. The former uses `RegisterUser` while the latter uses `OrderItems`. This is acceptable. Let's look at `DistributedEStore.Services.Identity.Messages.Events.SignedUp` vs `DistributedEStore.Services.Identity.Messages.Events.AccessTokenRefreshed`. One is a past participle (`SignedUp`), the other is a noun phrase (`AccessTokenRefreshed`). This is an inconsistency in event naming.
- …and 5 more

## New (30)

- Change coupling: products.ts ↔ productsReducers.ts (Distributed-eStore.UI/src/ClientApp/src/services/api/products.ts)
- Critical CVE: [GHSA redacted] (Distributed-eStore.UI/src/ClientApp/package-lock.json)
- High CVE: [GHSA redacted] (Distributed-eStore.UI/src/ClientApp/package-lock.json)
- High CVE: [GHSA redacted] (Distributed-eStore.UI/src/ClientApp/package-lock.json)
- High CVE: [GHSA redacted] (Distributed-eStore.UI/src/ClientApp/package-lock.json)
- High CVE: [GHSA redacted] (Distributed-eStore.UI/src/ClientApp/package-lock.json)
- High CVE: [GHSA redacted] (Distributed-eStore.UI/src/ClientApp/package-lock.json)
- High CVE: [GHSA redacted] (Distributed-eStore.UI/src/ClientApp/package-lock.json)
- High CVE: [GHSA redacted] (Distributed-eStore.UI/src/ClientApp/package-lock.json)
- High CVE: [GHSA redacted] (Distributed-eStore.UI/src/ClientApp/package-lock.json)
- High CVE: [GHSA redacted] (Distributed-eStore.UI/src/ClientApp/package-lock.json)
- High CVE: [GHSA redacted] (Distributed-eStore.UI/src/ClientApp/package-lock.json)
- High CVE: [GHSA redacted] (Distributed-eStore.UI/src/ClientApp/package-lock.json)
- High CVE: [GHSA redacted] (Distributed-eStore.UI/src/ClientApp/package-lock.json)
- High CVE: [GHSA redacted] (Distributed-eStore.UI/src/ClientApp/package-lock.json)
- High CVE: [GHSA redacted] (Distributed-eStore.UI/src/ClientApp/package-lock.json)
- High CVE: [GHSA redacted] (Distributed-eStore.UI/src/ClientApp/package-lock.json)
- High CVE: [GHSA redacted] (Distributed-eStore.UI/src/ClientApp/package-lock.json)
- High vulnerability: [GHSA redacted] (Distributed-eStore.UI/src/ClientApp/package-lock.json)
- Medium CVE: SharpCompress 0.23.0
- …and 10 more

## API surface

- Unchanged — 12 HTTP endpoints