# Changelog

## Score

- CAI 57 → 58 (+1.6)
- Rubric changed (rubric-2026.09.11 → rubric-2026.09.18) — scores are not directly comparable.

## Lenses

- Code Health 66 → 66 (+0.0)
- Architecture 73 → 73 (-0.1)
- Maturity 64 → 64 (+0.2)
- Readiness 53 → 53 (+0.7)
- Security 55 → 64 (+9.1)
- Performance 60 (new)

## Resolved (7)

- Hotspot: packages/transformers/src/backends/onnx.js (packages/transformers/src/backends/onnx.js)
- Hotspot: packages/transformers/src/models/modeling_utils.js (packages/transformers/src/models/modeling_utils.js)
- Hotspot: packages/transformers/src/tokenization_utils.js (packages/transformers/src/tokenization_utils.js)
- Hotspot: packages/transformers/src/utils/audio.js (packages/transformers/src/utils/audio.js)
- Hotspot: packages/transformers/src/utils/image.js (packages/transformers/src/utils/image.js)
- Hotspot: packages/transformers/src/utils/tensor.js (packages/transformers/src/utils/tensor.js)
- Workflow token permissions not restricted

## New (5)

- Base-context workflow trigger runs with an unscoped token
- Outdated (npm): sharp
- PR-triggered workflow without a permissions block
- Split packages/transformers
- Workflow holding a long-lived secret is unscoped

## Changes since last survey

- 2 commits — 2 feature/other, 0 fixes

## By area

- .github/workflows — 2 commits

## Notable commits

- change: Bump the actions group across 1 directory with 6 updates (#1703)
- change: Scope GITHUB_TOKEN permissions per job (#1777)