# Changelog

> **This is the PUBLIC form of this artifact. Findings are listed in full, but the details of SECURITY findings — which rule fired, in which file, on which line, and how to fix it — are deliberately withheld, and any secret-scanner results are excluded entirely. Where detail is absent here it was REMOVED FOR PUBLICATION; it is not missing from the analysis. The complete artifact is available from the repository owner.**

## Score

- CAI 69 → 44 (-24.4)
- Rubric changed (rubric-2026.08.18 → rubric-2026.08.15) — scores are not directly comparable.

## Lenses

- Code Health 70 → 100 (+29.7)
- Maturity 70 → 52 (-17.7)
- Readiness 63 → 22 (-40.5)
- Security 83 → 73 (-9.2)

## Resolved (74)

- Coverage not included — suite not readable by the collector
- Dependency hygiene not measured — dependency manifest found but not parsed for hygiene
- FileTooLong: gmail/mod.rs (crates/google-workspace-cli/src/helpers/gmail/mod.rs)
- FileTooLong: helpers/workflows.rs (crates/google-workspace-cli/src/helpers/workflows.rs)
- FileTooLong: src/auth_commands.rs (crates/google-workspace-cli/src/auth_commands.rs)
- FileTooLong: src/executor.rs (crates/google-workspace-cli/src/executor.rs)
- FileTooLong: src/generate_skills.rs (crates/google-workspace-cli/src/generate_skills.rs)
- FileTooLong: src/setup.rs (crates/google-workspace-cli/src/setup.rs)
- FileTooLong: src/setup_tui.rs (crates/google-workspace-cli/src/setup_tui.rs)
- High vulnerability: [GHSA redacted] (Cargo.lock)
- LLM evaluation failed
- Medium advisory (unsound): RUSTSEC-2026-0097 (Cargo.lock)
- Medium advisory (unsound): RUSTSEC-2026-0190 (Cargo.lock)
- Medium advisory (unsound): RUSTSEC-2026-0205 (Cargo.lock)
- Off-boarding risk: anonymized user #1
- PR-triggered workflow without a permissions block
- PickerState::handle_key (cognitive 55) (crates/google-workspace-cli/src/setup_tui.rs)
- PickerState::handle_key (cyclomatic 25) (crates/google-workspace-cli/src/setup_tui.rs)
- PickerState::toggle_current (cognitive 60) (crates/google-workspace-cli/src/setup_tui.rs)
- PickerState::toggle_current (cyclomatic 17) (crates/google-workspace-cli/src/setup_tui.rs)
- …and 54 more

## New (22)

- Dimension evaluation failed
- High CVE: [GHSA redacted] (pnpm-lock.yaml)
- High CVE: [GHSA redacted] (Cargo.lock)
- High: security finding (details withheld)
- Low CVE: [GHSA redacted] (Cargo.lock)
- Low CVE: [GHSA redacted] (Cargo.lock)
- Low CVE: [GHSA redacted] (Cargo.lock)
- Medium CVE: [GHSA redacted] (pnpm-lock.yaml)
- Medium CVE: [GHSA redacted] (pnpm-lock.yaml)
- Medium CVE: RUSTSEC-2026-0097 (Cargo.lock)
- Medium CVE: RUSTSEC-2026-0098 (Cargo.lock)
- Medium CVE: RUSTSEC-2026-0099 (Cargo.lock)
- Medium CVE: RUSTSEC-2026-0104 (Cargo.lock)
- Medium CVE: RUSTSEC-2026-0185 (Cargo.lock)
- Medium CVE: RUSTSEC-2026-0190 (Cargo.lock)
- Medium CVE: RUSTSEC-2026-0205 (Cargo.lock)
- No artifact signing
- No automated tests
- No tests found
- Rotate the exposed credentials — git history can't be un-committed
- …and 2 more