# Changelog

## Score

- CAI 59 → 39 (-19.8)
- Rubric changed (rubric-2026.08.18 → rubric-2026.08.15) — scores are not directly comparable.

## Lenses

- Code Health 52 (new)
- Architecture 98 → 69 (-28.7)
- Maturity 65 → 48 (-17.0)
- Readiness 61 → 24 (-36.4)
- Security 67 → 56 (-10.6)

## Resolved (17)

- Change coupling: Api.scala ↔ react18.scala (library/coreGeneric/src/main/scala/japgolly/scalajs/react/hooks/Api.scala)
- Change coupling: JsFn.scala ↔ Template.scala (library/coreGeneric/src/main/scala/japgolly/scalajs/react/component/JsFn.scala)
- Change coupling: JsForwardRef.scala ↔ Template.scala (library/coreGeneric/src/main/scala/japgolly/scalajs/react/component/JsForwardRef.scala)
- Change coupling: ReactDOM.scala ↔ ReactDOMServer.scala (library/facadeMain/src/main/scala/japgolly/scalajs/react/facade/ReactDOM.scala)
- Change coupling: VdomNode.scala ↔ Template.scala (library/coreGeneric/src/main/scala-2/japgolly/scalajs/react/vdom/VdomNode.scala)
- Coverage not included — suite not readable by the collector
- Dependency hygiene not measured — dependency manifest found but not parsed for hygiene
- Further orphaned files (smaller)
- Further sole-owners (lower concentration)
- Low vulnerability: [GHSA redacted] (react-umd/package-lock.json)
- Off-boarding risk: anonymized user #1
- Orphaned knowledge (library/coreGeneric/src/main/scala/japgolly/scalajs/react/vdom/SvgAttrs.scala)
- Orphaned knowledge (library/coreGeneric/src/main/scala/japgolly/scalajs/react/vdom/SvgTags.scala)
- Orphaned knowledge (library/extra/src/main/scala/japgolly/scalajs/react/extra/router/Dsl.scala)
- The Contents outline lists 'Gotchas' but the Usage document does not yet cover this topic, so readers will miss a troubleshooting section. (doc/USAGE.md)
- Workflow token permissions not restricted
- complexity unreadable for .scala — churn × complexity hotspots could not be measured

## New (18)

- Dimension evaluation failed
- High CVE: [GHSA redacted] (react-umd/package-lock.json)
- High CVE: [GHSA redacted] (react-umd/package-lock.json)
- High CVE: [GHSA redacted] (react-umd/package-lock.json)
- Hotspot: downstream-tests/js-cbio/src/test/resources/react.umd.js (downstream-tests/js-cbio/src/test/resources/react.umd.js)
- Hotspot: downstream-tests/js-ce/src/test/resources/react.umd.js (downstream-tests/js-ce/src/test/resources/react.umd.js)
- Hotspot: downstream-tests/js/src/test/resources/react.umd.js (downstream-tests/js/src/test/resources/react.umd.js)
- Hotspot: library/tests/src/test/resources/react.umd.js (library/tests/src/test/resources/react.umd.js)
- Low CVE: [GHSA redacted] (react-umd/package-lock.json)
- Medium CVE: [GHSA redacted] (react-umd/package-lock.json)
- Medium CVE: [GHSA redacted] (library/package-lock.json)
- Medium CVE: [GHSA redacted] (react-umd/package-lock.json)
- Medium CVE: [GHSA redacted] (react-umd/package-lock.json)
- Medium CVE: [GHSA redacted] (react-umd/package-lock.json)
- No artifact signing
- No automated tests
- No tests found
- The top-level 'Usage & Getting Started' section links to MODULES.md, VDOM.md, HOOKS.md, and so on but does not mention where to find a quick runnable example or a minimal working snippet. (README.md)