# Changelog

## Score

- CAI 53 → 56 (+3.2)

## Lenses

- Code Health 98 → 98 (-0.2)
- Architecture 85 → 85 (+0.2)
- Maturity 70 → 70 (+0.0)
- Readiness 59 → 65 (+6.0)
- Security 39 → 44 (+4.9)
- Event-Driven 80 → 80 (+0.0)
- Performance 60 → 60 (+0.0)

## Resolved (19)

- Duplicate intent for file deletion requests. Both `FileDeleteRequestedEvent` and `PhotoDeleteRequestedEvent` represent a request to delete a file/photo, containing `FileId` and `BucketName`. The distinction between 'File' and 'Photo' is not reflected in the structure, suggesting a potential split in domain modeling that isn't supported by the data shape.
- High CVE: System.Security.Cryptography.Xml 9.0.0
- High CVE: System.Security.Cryptography.Xml 9.0.0
- High CVE: System.Security.Cryptography.Xml 9.0.0
- High CVE: System.Security.Cryptography.Xml 9.0.0
- High CVE: System.Security.Cryptography.Xml 9.0.0
- High CVE: System.Security.Cryptography.Xml 9.0.0
- High CVE: System.Security.Cryptography.Xml 9.0.0
- High CVE: System.Security.Cryptography.Xml 9.0.0
- Inconsistent naming for identifier types: some use the entity name plus 'Id' (e.g., PetId, VolunteerId), while others use the entity name plus 'Identifier' or similar. Specifically, 'PetId' is used in multiple places, but 'VolunteerId' is also used. However, looking at the list, they are actually consistent in using '[Entity]Id' pattern. Let's look for a different inconsistency.
- Low cohesion: Pet (LCOM4 4) (Solution/VolunteerManagement/VolunteerManagement.Domain/Aggregates/Volunteers/Entities/Pet.cs)
- Low cohesion: Shelter (LCOM4 4) (Solution/VolunteerManagement/VolunteerManagement.Domain/Aggregates/Shelters/Shelter.cs)
- Medium CVE: Azure.Identity 1.3.0
- Medium CVE: Azure.Identity 1.3.0
- Medium CVE: OpenTelemetry.Exporter.OpenTelemetryProtocol 1.15.0
- Medium CVE: OpenTelemetry.Exporter.OpenTelemetryProtocol 1.15.0
- Medium CVE: OpenTelemetry.Exporter.OpenTelemetryProtocol 1.15.0
- Redundant interface and implementation with identical signatures. The interface `IFileStorageClient` exposes `UploadAsync` with the exact same signature as the concrete class `FileStorageHttpClient`. This creates a duplicate contract for the same operation.
- The README does not mention how to run locally for development. (README.md)

## New (16)

- Duplicate intent: Both events represent a request to delete a file/photo. They share identical properties (FileId, BucketName) but have different names and types.
- High CVE: System.Security.Cryptography.Xml 9.0.0
- High CVE: System.Security.Cryptography.Xml 9.0.0
- High CVE: System.Security.Cryptography.Xml 9.0.0
- High CVE: System.Security.Cryptography.Xml 9.0.0
- High CVE: System.Security.Cryptography.Xml 9.0.0
- High CVE: System.Security.Cryptography.Xml 9.0.0
- High CVE: System.Security.Cryptography.Xml 9.0.0
- High CVE: System.Security.Cryptography.Xml 9.0.0
- Medium CVE: Azure.Identity 1.3.0
- Medium CVE: Azure.Identity 1.3.0
- Medium CVE: OpenTelemetry.Exporter.OpenTelemetryProtocol 1.15.0
- Medium CVE: OpenTelemetry.Exporter.OpenTelemetryProtocol 1.15.0
- Medium CVE: OpenTelemetry.Exporter.OpenTelemetryProtocol 1.15.0
- Redundant data in DTOs: Both types contain FileName, FileSize, and ContentType. FileInfoDto is a read-model, while FileUploadResponse is a write-result, but they share significant overlap in file metadata.
- redundant comment (Solution/VolunteerManagement/Tests/IntegrationTests/Handlers/AnimalKinds/SpeciesHandlerTests.cs)

## API surface

- Unchanged — 64 HTTP endpoints