# Changelog

## Score

- CAI 50 → 46 (-3.2)
- Rubric changed (rubric-2026.10.1 → rubric-2026.10.5) — scores are not directly comparable.

## Lenses

- Code Health 77 → 53 (-24.0)
- Architecture 45 → 46 (+1.2)
- Maturity 75 → 73 (-1.7)
- Readiness 37 → 35 (-2.8)
- Security 76 → 74 (-1.9)
- Performance 100 (new)

## Resolved (3)

- High CVE: [GHSA redacted] (cdk/yarn.lock)
- High CVE: [GHSA redacted] (apps/rule-manager/client/package-lock.json)
- Off-boarding risk: anonymized user #1

## New (60)

- Documentation: contradicts the code (docs/decision-records/001-management-service.md)
- High CVE: [GHSA redacted] (apps/rule-manager/client/package-lock.json)
- High CVE: [GHSA redacted] (apps/rule-manager/client/package-lock.json)
- High CVE: [GHSA redacted] (cdk/package.json)
- High secret: WD-SECRET-0005 (apps/rule-audit-client/package-lock.json)
- High secret: WD-SECRET-0005 (rule-audit-client/package-lock.json)
- Leaked secret: hardcoded-credential (apps/rule-manager/conf/application.conf)
- Leaked secret: hardcoded-credential (docker-compose.yml)
- Leaked secret: hardcoded-credential (project/scalikejdbc.properties)
- Leaked secret: hardcoded-credential (script/js/dump-db.ts)
- Medium CVE: [GHSA redacted] (apps/rule-manager/client/package-lock.json)
- Most significant orphaned file (apps/rule-manager/app/db/DbRuleDraft.scala)
- Off-boarding risk: anonymized user #1
- Orphaned file (apps/checker/app/AppComponents.scala)
- Orphaned file (apps/checker/app/controllers/ApiController.scala)
- Orphaned file (apps/checker/app/matchers/DictionaryMatcher.scala)
- Orphaned file (apps/checker/app/matchers/LanguageToolMatcher.scala)
- Orphaned file (apps/checker/app/services/MatcherPool.scala)
- Orphaned file (apps/checker/app/services/MatcherProvisionerService.scala)
- Orphaned file (apps/checker/app/services/collins/DictionaryBuilder.scala)
- …and 40 more

## Changes since last survey

- 4 commits — 4 feature/other, 0 fixes

## By area

- (repo) — 2 commits
- (root) — 2 commits

## Notable commits

- change: Bump jawn to patched version for rule manager as well
- change: Bump vulnerable dependencies
- change: Merge pull request #678 from guardian/ld/oct-2026-vulns
- change: Merge pull request #679 from guardian/ld/oct-2026-vulns-mkii

## Architecture

- 1 containers · 1 bounded contexts · 0 dependency edges (baseline)