# Changelog

## Score

- CAI 59 → 56 (-2.6)
- Rubric changed (rubric-2026.10.1 → rubric-2026.10.5) — scores are not directly comparable.

## Lenses

- Code Health 99 → 75 (-24.1)
- Architecture 69 → 69 (+0.0)
- Maturity 46 → 43 (-3.1)
- Readiness 65 → 65 (+0.0)
- Security 75 → 74 (-1.3)

## Resolved (1)

- PR-triggered workflow without a permissions block

## New (5)

- High CVE: [GHSA redacted] (Gemfile.lock)
- Orphaned file (lib/rails-footnotes/abstract_note.rb)
- Orphaned file (lib/rails-footnotes/filter.rb)
- Orphaned file (lib/rails-footnotes/notes/queries_note.rb)
- PR-triggered workflow without a permissions block (.github/workflows/ci.yml)

## Changes since last survey

- 4 commits — 4 feature/other, 0 fixes

## By area

- (repo) — 2 commits
- .github/workflows — 2 commits

## Notable commits

- change: Bump step-security/harden-runner from 2.21.1 to 2.22.0
- change: Bump step-security/harden-runner from 2.22.0 to 2.22.1
- change: Merge pull request #368 from indirect/dependabot/github_actions/step-security/harden-runner-2.22.0
- change: Merge pull request #369 from indirect/dependabot/github_actions/step-security/harden-runner-2.22.1