# Changelog

## Score

- CAI 46 → 43 (-3.2)
- Rubric changed (rubric-2026.10.1 → rubric-2026.10.5) — scores are not directly comparable.

## Lenses

- Code Health 69 → 66 (-3.2)
- Architecture 54 → 54 (+0.0)
- Maturity 56 → 51 (-5.1)
- Readiness 38 → 34 (-3.4)
- Security 62 → 63 (+1.2)
- Domain Modelling 55 → 55 (+0.0)
- Accessibility 50 → 46 (-4.5)
- Performance 100 → 100 (+0.0)

## Resolved (18)

- Banned license: crontab
- High CVE: [GHSA redacted] (pnpm-lock.yaml)
- High CVE: [GHSA redacted] (pnpm-lock.yaml)
- High CVE: [GHSA redacted] (pnpm-lock.yaml)
- High CVE: [GHSA redacted] (pnpm-lock.yaml)
- High CVE: [GHSA redacted] (pnpm-lock.yaml)
- High CVE: [GHSA redacted] (pnpm-lock.yaml)
- High CVE: [GHSA redacted] (pnpm-lock.yaml)
- Low CVE: [GHSA redacted] (pnpm-lock.yaml)
- Medium CVE: [GHSA redacted] (pnpm-lock.yaml)
- Medium CVE: [GHSA redacted] (pnpm-lock.yaml)
- Medium CVE: [GHSA redacted] (pnpm-lock.yaml)
- Medium CVE: PYSEC-2026-2132 (uv.lock)
- Off-boarding risk: anonymized user #1
- PR-triggered workflow without a permissions block
- Secret: generic-api-key (.circleci/config.yml)
- Skipped (documented): onChange correct result (client/app/components/queries/ScheduleDialog.test.js)
- Workflow holding a long-lived secret is unscoped

## New (32)

- Critical CVE: [GHSA redacted] (pnpm-lock.yaml)
- High CVE: [GHSA redacted] (uv.lock)
- High CVE: [GHSA redacted] (pnpm-lock.yaml)
- High CVE: [GHSA redacted] (pnpm-lock.yaml)
- High CVE: [GHSA redacted] (pnpm-lock.yaml)
- High CVE: [GHSA redacted] (pnpm-lock.yaml)
- High CVE: [GHSA redacted] (pnpm-lock.yaml)
- High CVE: [GHSA redacted] (pnpm-lock.yaml)
- High CVE: [GHSA redacted] (pnpm-lock.yaml)
- High CVE: [GHSA redacted] (pnpm-lock.yaml)
- High CVE: [GHSA redacted] (uv.lock)
- High CVE: [GHSA redacted] (pnpm-lock.yaml)
- Leaked secret: hardcoded-credential (.ci/compose.ci.yaml)
- Leaked secret: hardcoded-credential (.ci/compose.ci.yaml)
- Leaked secret: hardcoded-credential (.ci/compose.cypress.yaml)
- Leaked secret: hardcoded-credential (.ci/compose.cypress.yaml)
- Leaked secret: high-entropy-secret (.ci/compose.ci.yaml)
- Leaked secret: high-entropy-secret (.ci/compose.cypress.yaml)
- Medium CVE: [GHSA redacted] (pnpm-lock.yaml)
- Medium CVE: [GHSA redacted] (pnpm-lock.yaml)
- …and 12 more

## Architecture

- 0 containers · 1 bounded contexts · 0 dependency edges (baseline)