# Changelog

> **This is the PUBLIC form of this artifact. Findings are listed in full, but the details of SECURITY findings — which rule fired, in which file, on which line, and how to fix it — are deliberately withheld, and any secret-scanner results are excluded entirely. Where detail is absent here it was REMOVED FOR PUBLICATION; it is not missing from the analysis. The complete artifact is available from the repository owner.**

## Score

- CAI 55 → 59 (+3.7)
- Rubric changed (rubric-2026.10.1 → rubric-2026.10.5) — scores are not directly comparable.

## Lenses

- Code Health 100 → 88 (-11.5)
- Architecture 69 → 100 (+30.8)
- Maturity 46 → 46 (-0.7)
- Readiness 51 → 51 (+0.0)
- Security 71 → 88 (+16.4)

## Resolved (15)

- Documentation: no project overview (README.md)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- Outdated: Microsoft.SourceLink.GitHub
- Outdated: Velopack
- PR-triggered workflow without a permissions block
- Unpinned build actions

## New (4)

- Outdated: FSharp.Core
- Outdated: Revit_All_Main_Versions_API_x64
- XML-doc coverage: Fesh.Revit.Loader (Fesh.Revit.Loader/Fesh.Revit.Loader.csproj)
- misleading comment (Fesh.Revit.Loader/FeshLoader.cs)

## Changes since last survey

- 23 commits — 22 feature/other, 1 fixes

## By area

- (root) — 9 commits
- .github/workflows — 5 commits
- Fesh.Revit/Src — 4 commits
- (repo) — 2 commits
- .github/InstallNotes-revit.md — 1 commit
- Fesh.Revit.Bootstrapper/Revit.fs — 1 commit
- Fesh.Revit/Fesh.Revit.fsproj — 1 commit

## Notable commits

- fix: CHANGELOG: the changes and fixes since 0.34.0
- change: Bootstrapper like the one of Caddis: .NET 4.8, per user, shows what it did
- change: Bootstrapper window closes after 30 s and shows the installer to delete
- change: CI: only delete failed and cancelled runs in the 30 day cleanup step
- change: CI: pin the actions of the disabled outdatedNuget workflow to commits
- change: CI: read-only token for Build and Check Links, don't persist it
- change: Check for and install updates in the bootstrapper, not in Revit
- change: Default code: run the code in a transaction, as its comment says
- change: Docs: how to install Fesh.Revit 0.32.3 side by side
- change: Docs: the Scripting functions queue the code, they don't wait for it
- change: Don't fail to run scripts when no document is open
- change: Example script: no Revit 2024 paths, no obsolete function
- change: Merge pull request #45 from goswinr/dependabot/github_actions/JustinBeckwith/linkinator-action-2.5.0
- change: Merge pull request #46 from goswinr/dependabot/github_actions/azure/login-3.1.0
- change: One installer for every Revit from 2018 on, like the one of Caddis
- change: Register only with a Revit that runs on .NET 10
- change: Release 0.34.0: Fesh 0.34.0, .NET 10 only for Revit 2026+, lib folders
- change: Release 0.35.0: Fesh 0.35.0, bootstrapper like Caddis
- change: Release 0.35.1: one installer for every Revit from 2018 on
- change: Roll back the transaction when the function in it fails
- …and 3 more