# Changelog

## Score

- CAI 51 → 37 (-14.3)
- Rubric changed (rubric-2026.08.18 → rubric-2026.08.15) — scores are not directly comparable.

## Lenses

- Code Health 44 → 44 (-0.2)
- Maturity 57 → 59 (+2.5)
- Readiness 50 → 26 (-23.7)
- Security 50 → 46 (-4.1)

## Resolved (13)

- Coverage not included — suite not readable by the collector
- Critical vulnerability: [GHSA redacted] (package-lock.json)
- Dependency hygiene not measured — dependency manifest found but not parsed for hygiene
- Further orphaned files (smaller)
- High CVE: [GHSA redacted] (package-lock.json)
- High CVE: [GHSA redacted] (package-lock.json)
- High CVE: [GHSA redacted] (package-lock.json)
- High CVE: [GHSA redacted] (package-lock.json)
- High CVE: [GHSA redacted] (package-lock.json)
- High CVE: [GHSA redacted] (package-lock.json)
- High CVE: [GHSA redacted] (package-lock.json)
- Off-boarding risk: anonymized user #1
- PR-triggered workflow without a permissions block

## New (32)

- Boundary-crossing change coupling: index.js ↔ duration.d.ts (src/plugin/duration/index.js)
- Boundary-crossing change coupling: index.js ↔ timezone.d.ts (src/plugin/timezone/index.js)
- Boundary-crossing change coupling: index.js ↔ utc.d.ts (src/plugin/utc/index.js)
- Change coupling: index.js ↔ en.js (src/index.js)
- Change coupling: index.js ↔ utc.d.ts (src/index.js)
- Change coupling: index.js ↔ utils.js (src/index.js)
- Critical CVE: [GHSA redacted] (package-lock.json)
- Critical CVE: [GHSA redacted] (package-lock.json)
- Critical CVE: [GHSA redacted] (package-lock.json)
- Dimension evaluation failed
- High CVE: [GHSA redacted] (package-lock.json)
- High CVE: [GHSA redacted] (package-lock.json)
- High CVE: [GHSA redacted] (package-lock.json)
- High CVE: [GHSA redacted] (package-lock.json)
- High CVE: [GHSA redacted] (package-lock.json)
- High CVE: [GHSA redacted] (package-lock.json)
- High CVE: [GHSA redacted] (package-lock.json)
- High CVE: [GHSA redacted] (package-lock.json)
- High CVE: [GHSA redacted] (package-lock.json)
- High CVE: [GHSA redacted] (package-lock.json)
- …and 12 more