# Changelog

## Score

- CAI 37 → 31 (-6.2)
- Rubric changed (rubric-2026.08.18 → rubric-2026.08.15) — scores are not directly comparable.

## Lenses

- Code Health 43 → 33 (-9.6)
- Maturity 62 → 67 (+5.4)
- Readiness 20 → 14 (-6.0)
- Security 76 → 60 (-15.5)

## Resolved (27)

- (anonymous) (cognitive 19) (src/web/waiters/OutputWaiter.mjs)
- (anonymous) (cognitive 47) (src/core/operations/YARARules.mjs)
- Change coupling clique: AddTextToImage.mjs, BlurImage.mjs, ContainImage.mjs, CoverImage.mjs, CropImage.mjs, DitherImage.mjs, FlipImage.mjs, ImageBrightnessContrast.mjs, ImageFilter.mjs, ImageHueSaturationLightness.mjs, ImageOpacity.mjs, InvertImage.mjs, NormaliseImage.mjs, ResizeImage.mjs, RotateImage.mjs, SharpenImage.mjs (src/core/operations/AddTextToImage.mjs)
- Concentrated knowledge decay
- Dependency hygiene not measured — dependency manifest found but not parsed for hygiene
- FileTooLong: core/Utils.mjs (src/core/Utils.mjs)
- FileTooLong: lib/Magic.mjs (src/core/lib/Magic.mjs)
- FileTooLong: operations/CRCChecksum.mjs (src/core/operations/CRCChecksum.mjs)
- FileTooLong: operations/ELFInfo.mjs (src/core/operations/ELFInfo.mjs)
- FileTooLong: operations/Lorenz.mjs (src/core/operations/Lorenz.mjs)
- Further sole-owners (lower concentration)
- High CVE: [GHSA redacted] (package-lock.json)
- High vulnerability: [GHSA redacted] (package-lock.json)
- Largest orphaned file (src/core/lib/FileSignatures.mjs)
- Largest orphaned file (src/core/lib/Magic.mjs)
- Largest orphaned file (src/web/waiters/OutputWaiter.mjs)
- Off-boarding risk: anonymized user #1
- Off-boarding risk: anonymized user #2
- Off-boarding risk: anonymized user #3
- Secret: private-key (src/core/operations/RSASign.mjs)
- …and 7 more

## New (41)

- (anonymous) (cognitive 20) (src/web/waiters/OutputWaiter.mjs)
- (anonymous) (cognitive 48) (src/core/operations/YARARules.mjs)
- Change coupling: BLAKE2b.mjs ↔ BLAKE2s.mjs (src/core/operations/BLAKE2b.mjs)
- Change coupling: HeatmapChart.mjs ↔ HexDensityChart.mjs (src/core/operations/HeatmapChart.mjs)
- Change coupling: HeatmapChart.mjs ↔ ScatterChart.mjs (src/core/operations/HeatmapChart.mjs)
- Change coupling: JSONtoYAML.mjs ↔ YAMLToJSON.mjs (src/core/operations/JSONtoYAML.mjs)
- Change coupling: JWTSign.mjs ↔ ParseTLSRecord.mjs (src/core/operations/JWTSign.mjs)
- Change coupling: JWTVerify.mjs ↔ ParseTLSRecord.mjs (src/core/operations/JWTVerify.mjs)
- Change coupling: ParseTLSRecord.mjs ↔ generateNodeIndex.mjs (src/core/operations/ParseTLSRecord.mjs)
- Change coupling: Protocol.mjs ↔ ParseTLSRecord.mjs (src/core/lib/Protocol.mjs)
- Change coupling: Recipe.mjs ↔ OperationError.mjs (src/core/Recipe.mjs)
- Change coupling: SM2Decrypt.mjs ↔ SM2Encrypt.mjs (src/core/operations/SM2Decrypt.mjs)
- Dimension evaluation failed
- FileTooLong: browser/02_ops.js (tests/browser/02_ops.js)
- FileTooLong: tests/CRCChecksum.mjs (tests/operations/tests/CRCChecksum.mjs)
- FileTooLong: tests/Crypt.mjs (tests/operations/tests/Crypt.mjs)
- High CVE: [GHSA redacted] (package-lock.json)
- High CVE: [GHSA redacted] (package-lock.json)
- High CVE: [GHSA redacted] (package-lock.json)
- High CVE: [GHSA redacted] (package-lock.json)
- …and 21 more

## Changes since last survey

- 7 commits — 5 feature/other, 2 fixes

## By area

- (root) — 6 commits
- .github/workflows — 1 commit

## Notable commits

- fix: fix: replace `shasum` / `sha256sum` / `sed` calls with node built-ins (#2019)
- fix: fix: use js-yaml for both JSON to YAML and YAML to JSON (#2710)
- change: chore (deps): bump fast-uri from 3.1.4 to 3.1.5 (#2709)
- change: chore (deps): bump ip-address from 10.2.0 to 10.4.0 (#2708)
- change: chore (deps): bump the actions-dependencies group with 2 updates (#2703)
- change: chore (deps): bump the minor-updates group across 1 directory with 3 updates (#2705)
- change: chore (deps): bump the patch-updates group across 1 directory with 6 updates (#2712)