# Changelog

## Score

- CAI 63 → 60 (-3.0)
- Rubric changed (rubric-2026.10.1 → rubric-2026.10.5) — scores are not directly comparable.

## Lenses

- Code Health 100 → 76 (-24.2)
- Architecture 69 → 69 (+0.0)
- Maturity 55 → 50 (-5.2)
- Readiness 65 → 65 (+0.5)
- Security 73 → 80 (+7.0)

## Resolved (16)

- Ambiguous entry point: Both `call` and `respond` appear to trigger the response generation logic. In Ruby/Rails conventions, `call` is often used for object invocation (like a callable class), while `respond` is more descriptive. Having both suggests either one is an alias (which should be documented as such) or one is internal/private while the other is public, but the signature listing implies both are exposed.
- Critical CVE: [GHSA redacted] (Gemfile.lock)
- High CVE: [GHSA redacted] (Gemfile.lock)
- High CVE: [GHSA redacted] (Gemfile.lock)
- High CVE: [GHSA redacted] (Gemfile.lock)
- High CVE: [GHSA redacted] (Gemfile.lock)
- Inconsistent naming convention for format-specific rendering: `to_html` and `to_js` use the format name directly, while `to_format` is generic. This suggests `to_format` might be a fallback or a different kind of method (e.g., dynamic dispatch), but its presence alongside specific format methods creates confusion about when to use which. It is unclear if `to_format` is meant to be called directly or if it's an internal helper.
- Low CVE: [GHSA redacted] (Gemfile.lock)
- Medium CVE: [GHSA redacted] (Gemfile.lock)
- Medium CVE: [GHSA redacted] (Gemfile.lock)
- Outdated: actionpack
- Outdated: activemodel
- Outdated: railties
- Outdated: rake
- Outdated: rdoc
- Outdated: rubocop-performance

## New (4)

- Ambiguous entry point: Both `respond` and `call` appear to trigger the response logic. In Ruby/Rails conventions, `call` is often the standard for objects acting as responders (implementing `#call`), while `respond` is more descriptive. Having both suggests redundancy or unclear responsibility.
- Inconsistent method naming for format-specific rendering: Base `Responder` uses `to_html` and `to_js`, but also has `to_format`. Subclasses use `to_html`, `to_js`, and `to_format`. It is unclear if `to_format` is a generic fallback or a specific format handler. If `to_format` is meant to handle arbitrary formats, it conflicts with the explicit `to_html`/`to_js` pattern. If it's a specific format, the naming is inconsistent with `to_html`.
- Orphaned file (lib/action_controller/respond_with.rb)
- Orphaned file (lib/responders/flash_responder.rb)

## Changes since last survey

- 6 commits — 5 feature/other, 1 fixes

## By area

- (root) — 2 commits
- .github/workflows — 2 commits
- (repo) — 1 commit
- gemfiles/Gemfile-rails-main — 1 commit

## Notable commits

- fix: Revert "Test against Rails 8.1"
- change: Bundle update
- change: Dynamically generate routes for each controller
- change: Merge pull request #264 from heartcombo/ca-test
- change: Skip Ruby 3.2 on the main Gemfile
- change: Update changelog for v3.2.1