# Changelog

## Score

- CAI 53 → 56 (+2.9)
- Rubric changed (rubric-2026.08.17 → rubric-2026.09.15) — scores are not directly comparable.

## Lenses

- Code Health 100 → 100 (+0.0)
- Architecture 69 → 69 (+0.0)
- Maturity 75 → 75 (+0.0)
- Readiness 26 → 33 (+6.9)
- Security 100 → 96 (-4.4)

## Resolved (7)

- Dependency hygiene not measured — no supported dependency manifest was read
- No exposed public API
- Test reliability not included
- early-stage repository — too little history to judge knowledge freshness
- git history depth insufficient
- git history depth insufficient
- single-maintainer — knowledge-concentration (bus factor) risk

## New (20)

- Critical CVE: [GHSA redacted] (requirements-dev.txt)
- Documentation: no installation or build instructions (README.md)
- Documentation: no usage examples (README.md)
- High CVE: [GHSA redacted] (requirements-dev.txt)
- Medium CVE: [GHSA redacted] (requirements-dev.txt)
- Medium CVE: [GHSA redacted] (requirements-dev.txt)
- Medium CVE: PYSEC-2024-38 (requirements-dev.txt)
- Medium IaC: WD-DOCKER-0003 (Dockerfile)
- Medium IaC: WD-DOCKER-0003 (Dockerfile)
- Outdated: alembic
- Outdated: email-validator
- Outdated: fastapi
- Outdated: psycopg2-binary
- Outdated: pydantic
- Outdated: python-jose
- Outdated: python-multipart
- Outdated: typer
- Outdated: types-passlib
- Outdated: types-python-jose
- Outdated: uvicorn