# Changelog

> **This is the PUBLIC form of this artifact. Findings are listed in full, but the details of SECURITY findings — which rule fired, in which file, on which line, and how to fix it — are deliberately withheld, and any secret-scanner results are excluded entirely. Where detail is absent here it was REMOVED FOR PUBLICATION; it is not missing from the analysis. The complete artifact is available from the repository owner.**

## Score

- CAI 61 → 64 (+3.2)
- Rubric changed (rubric-2026.09.15 → rubric-2026.10.1) — scores are not directly comparable.

## Lenses

- Code Health 99 → 99 (-0.3)
- Architecture 99 → 100 (+0.1)
- Maturity 38 → 43 (+5.0)
- Readiness 68 → 71 (+2.3)
- Security 89 → 91 (+1.9)

## Resolved (3)

- Documentation: contradicts the code (bench/README.md)
- Duplicated block (12 lines × 2) (lib/phoenix_test/live.ex)
- Off-boarding risk: anonymized user #1

## New (7)

- Duplicated block (15 lines × 2) (lib/phoenix_test/live.ex)
- Duplicated block (9 lines × 2) (lib/phoenix_test/query.ex)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- Medium CVE: EEF-[CVE redacted] (mix.lock)
- Off-boarding risk: anonymized user #1

## Changes since last survey

- 16 commits — 15 feature/other, 1 fixes

## By area

- test/support — 10 commits
- test/verification — 3 commits
- lib/phoenix_test — 2 commits
- test/phoenix_test — 1 commit

## Notable commits

- fix: Fix flake: give `refute_has` more time
- change: Add verification infrastructure to compare PhoenixTest to browser (#326)
- change: Apply submitter overrides on implicit static submission
- change: Match browser GET form query serialization
- change: Match browser submitter behavior for Live and Static forms
- change: Support regex in assert_path and refute_path (#325)
- change: Verify Live click events and navigation against Chromium
- change: Verify `phx-change` and include `_unused_*` params
- change: Verify component and changeset form callbacks against Chromium
- change: Verify disabled and readonly input parity in Live and Static
- change: Verify dynamic Live form fields at submit boundaries
- change: Verify nested and repeated form names against Chromium
- change: Verify omission and default form values in Live and Static
- change: Verify static links and data-method navigation against Chromium
- change: Verify static method overrides against Chromium
- change: Verify static multipart and Live uploads against Chromium