# Changelog

## Score

- CAI 49 → 50 (+1.4)
- Rubric changed (rubric-2026.08.18 → rubric-2026.08.19) — scores are not directly comparable.

## Lenses

- Code Health 89 → 89 (-0.1)
- Architecture 81 → 81 (+0.0)
- Maturity 70 → 70 (+0.0)
- Readiness 35 → 35 (+0.2)
- Security 56 → 66 (+10.8)
- Accessibility 53 → 54 (+0.7)
- Performance 68 → 68 (+0.0)

## Resolved (7)

- Boundary-crossing change coupling: AdminService.cs ↔ AdminController.cs (src/backend/MyProject.Infrastructure/Features/Admin/Services/AdminService.cs)
- High CVE: [GHSA redacted] (src/frontend/pnpm-lock.yaml)
- High CVE: [GHSA redacted] (src/frontend/pnpm-lock.yaml)
- LLM evaluation failed
- Medium CVE: [GHSA redacted] (src/frontend/pnpm-lock.yaml)
- Medium CVE: [GHSA redacted] (src/frontend/pnpm-lock.yaml)
- Off-boarding risk: anonymized user #1

## New (28)

- Change coupling: ProfileForm.svelte ↔ DeleteAccountDialog.svelte (src/frontend/src/lib/components/profile/ProfileForm.svelte)
- High CVE: [GHSA redacted] (src/frontend/pnpm-lock.yaml)
- High CVE: [GHSA redacted] (src/frontend/pnpm-lock.yaml)
- High CVE: [GHSA redacted] (src/frontend/pnpm-lock.yaml)
- High CVE: [GHSA redacted] (src/frontend/pnpm-lock.yaml)
- High CVE: [GHSA redacted] (src/frontend/pnpm-lock.yaml)
- High CVE: [GHSA redacted] (src/frontend/pnpm-lock.yaml)
- High CVE: [GHSA redacted] (src/frontend/pnpm-lock.yaml)
- Medium CVE: [GHSA redacted] (src/frontend/pnpm-lock.yaml)
- Medium CVE: [GHSA redacted] (src/frontend/pnpm-lock.yaml)
- Medium IaC: CKV2_GHA_1 (.github/workflows/claude-code-review.yml)
- Medium IaC: CKV2_GHA_1 (.github/workflows/claude.yml)
- Medium IaC: CKV_DOCKER_2 (src/backend/MyProject.WebApi/Dockerfile)
- Medium IaC: CKV_DOCKER_2 (src/frontend/Dockerfile)
- Medium IaC: CKV_DOCKER_3 (src/frontend/Dockerfile.local)
- Medium IaC: CKV_SECRET_6 (src/backend/MyProject.AppHost/appsettings.json)
- Off-boarding risk: anonymized user #1
- The parameter name `x` is used for `ExternalCallbackRequest` in multiple methods (`MyProject.WebApi.Features.Authentication.Dtos.External.ExternalCallbackRequest x`), which is a common test/mock convention but inconsistent with the explicit naming `request` used elsewhere (e.g., `DisableTwoFactorRequest request`).
- The type `AdminUserResponse` is used for admin-related user data, but there is also a `UserResponse` type (`MyProject.WebApi.Features.Users.Dtos.UserResponse`) and an `UpdateUserRequest` DTO. While not strictly the same, the naming convention for user-related DTOs is inconsistent: some use `User` (e.g., `UserResponse`, `UpdateUserRequest`), while others use `AdminUser` or just `User` in different contexts. Specifically, `AdminUserResponse` vs `UserResponse` suggests a split between admin-specific and general user data, but the naming doesn't clearly reflect this distinction (e.g., `AdminUser` vs `User`).
- There are two distinct response types for user data: `AdminUserResponse` and `UserResponse`. This indicates a duplication of concepts (User data) split by audience (Admin vs General).
- …and 8 more

## API surface

- Unchanged — 56 HTTP endpoints