# Changelog

## Score

- CAI 41 → 42 (+0.3)
- Rubric changed (rubric-2026.09.11 → rubric-2026.09.18) — scores are not directly comparable.

## Lenses

- Code Health 28 → 28 (+0.0)
- Architecture 80 → 76 (-3.4)
- Maturity 71 → 71 (+0.1)
- Readiness 41 → 32 (-9.3)
- Security 54 → 68 (+14.3)
- Accessibility 77 → 77 (+0.0)
- Performance 100 (new)

## Resolved (5)

- Dependency hygiene PARTLY measured — npm pinning read, dependency currency not (no pnpm-resolved versions to grade)
- Documentation: no installation or build instructions (README.md)
- High CVE: [GHSA redacted] (package-lock.json)
- Hotspot: api/community/alipay/query.js (api/community/alipay/query.js)
- Hotspot: src/community.jsx (src/community.jsx)

## New (12)

- High CVE: [GHSA redacted] (package-lock.json)
- High CVE: [GHSA redacted] (package-lock.json)
- Outdated (npm): @google-analytics/data
- Outdated (npm): @supabase/supabase-js
- Outdated (npm): @vitejs/plugin-react
- Outdated (npm): google-auth-library
- Outdated (npm): lucide-react
- Outdated (npm): react
- Outdated (npm): react-dom
- Outdated (npm): stripe
- Outdated (npm): vite
- Projects may be oversized for their cohesion

## Changes since last survey

- 1 commits — 1 feature/other, 0 fixes

## By area

- (root) — 1 commit

## Notable commits

- change: docs: add Fluxion AI as project sponsor