# Changelog

> **This is the PUBLIC form of this artifact. Findings are listed in full, but the details of SECURITY findings — which rule fired, in which file, on which line, and how to fix it — are deliberately withheld, and any secret-scanner results are excluded entirely. Where detail is absent here it was REMOVED FOR PUBLICATION; it is not missing from the analysis. The complete artifact is available from the repository owner.**

## Score

- CAI 57 → 58 (+1.3)
- Rubric changed (rubric-2026.09.8 → rubric-2026.09.16) — scores are not directly comparable.

## Lenses

- Code Health 85 → 85 (+0.0)
- Architecture 98 → 90 (-7.7)
- Maturity 63 → 63 (+0.0)
- Readiness 62 → 62 (+0.0)
- Security 59 → 66 (+7.2)
- Domain Modelling 48 → 48 (+0.0)
- Performance 85 (new)

## Resolved (15)

- Change coupling: CameraWidget.kt ↔ MediaPlayerControlsWidget.kt (app/src/main/kotlin/io/homeassistant/companion/android/widgets/camera/CameraWidget.kt)
- Critical CVE: [GHSA redacted] (app/gradle.lockfile)
- Duplicated block (12–13 lines × 2) (app/src/main/kotlin/io/homeassistant/companion/android/assist/AssistViewModel.kt)
- Hotspot: app/src/main/kotlin/io/homeassistant/companion/android/frontend/gesture/FrontendGestureManager.kt (app/src/main/kotlin/io/homeassistant/companion/android/frontend/gesture/FrontendGestureManager.kt)
- Hotspot: app/src/main/kotlin/io/homeassistant/companion/android/frontend/matterthread/FrontendMatterThreadHandler.kt (app/src/main/kotlin/io/homeassistant/companion/android/frontend/matterthread/FrontendMatterThreadHandler.kt)
- Hotspot: app/src/main/kotlin/io/homeassistant/companion/android/sensors/CarSensorManager.kt (app/src/main/kotlin/io/homeassistant/companion/android/sensors/CarSensorManager.kt)
- Hotspot: common/src/main/kotlin/io/homeassistant/companion/android/common/data/integration/FriendlyState.kt (common/src/main/kotlin/io/homeassistant/companion/android/common/data/integration/FriendlyState.kt)
- Hotspot: common/src/main/kotlin/io/homeassistant/companion/android/common/data/integration/impl/IntegrationRepositoryImpl.kt (common/src/main/kotlin/io/homeassistant/companion/android/common/data/integration/impl/IntegrationRepositoryImpl.kt)
- Hotspot: common/src/main/kotlin/io/homeassistant/companion/android/common/data/websocket/impl/WebSocketCoreImpl.kt (common/src/main/kotlin/io/homeassistant/companion/android/common/data/websocket/impl/WebSocketCoreImpl.kt)
- Medium CVE: [GHSA redacted] (app/gradle.lockfile)
- Medium CVE: [GHSA redacted] (app/gradle.lockfile)
- Members sharing a duplicated core (4 members, 50+ identical tokens) (app/src/main/kotlin/io/homeassistant/companion/android/frontend/FrontendScreen.kt)
- Near-duplicate member pair (38 shared lines) (app/src/main/kotlin/io/homeassistant/companion/android/assist/AssistViewModel.kt)
- Off-boarding risk: anonymized user #1
- SensorDetailViewKt.SensorDetailSettingDialog (cognitive 24) (app/src/main/kotlin/io/homeassistant/companion/android/settings/sensor/views/SensorDetailView.kt)

## New (54)

- Critical CVE: [GHSA redacted] (app/gradle.lockfile)
- Duplicated block (12–13 lines × 2) (app/src/main/kotlin/io/homeassistant/companion/android/assist/AssistViewModel.kt)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- …and 34 more

## Changes since last survey

- 64 commits — 59 feature/other, 5 fixes

## By area

- app/src — 19 commits
- .github/workflows — 12 commits
- app/gradle.lockfile — 12 commits
- (root) — 7 commits
- common/src — 6 commits
- .github/actions — 4 commits
- .agents/skills — 1 commit
- .github/aw — 1 commit
- gradle/libs.versions.toml — 1 commit
- wear/src — 1 commit

## Notable commits

- fix: Fix bitmap encoding config for Shortcut tiles (#7490)
- fix: Fix blur logic (#7530)
- fix: Fix unavailable SSID comparisons (#7444)
- fix: Manually fix version of logback for ktlint (#7479)
- fix: Regenerate some ConnectivityChecksSection screenshots to fix CI (#7458)
- change: Add "Open page in browser" gesture (#7485)
- change: Add error screen no connection on Automotive (#6857)
- change: Add screenshot tests for Compose-based HTML -> annotated strings (#7441)
- change: Add search filter to sensor setting allow list dialog (#6567)
- change: Adjust brand bottom padding (#7481)
- change: Apply zizmor suggestion regarding how to access repo actions (#7484)
- change: Avoid AI using validate screenshot when not needed (#7451)
- change: Build x86 APK again for instrumentation tests (#7514)
- change: Check legacy changelog off the main thread (#7507)
- change: Clean up Detekt clarity findings (#7469)
- change: Clean up Detekt exception idioms (#7498)
- change: Control statusBar and navBar theme based on container color (#7480)
- change: Drop x86 for emulator wtf and update to 1.2.0 (#7482)
- change: Expose entity subtitle separator (#7486)
- change: Forbid usage of org.json in favor of Kotlinx.serialization (#7473)
- …and 44 more

## Architecture

- Containers 0 added · 0 removed · contexts 3 added · 0 removed · edges 4 added · 0 removed

## Added bounded contexts (3)

- app
- common
- testing-unit

## Added dependency edges (4)

- app → common
- app → testing-unit
- wear → app
- wear → common