# Changelog

## Score

- CAI 57 → 39 (-18.1)
- Rubric changed (rubric-2026.08.18 → rubric-2026.08.15) — scores are not directly comparable.

## Lenses

- Code Health 48 → 44 (-4.2)
- Maturity 59 → 57 (-2.3)
- Readiness 61 → 28 (-32.8)
- Security 66 → 61 (-5.0)

## Resolved (4)

- Coverage not included — suite not readable by the collector
- Dependency hygiene not measured — dependency manifest found but not parsed for hygiene
- Further orphaned files (smaller)
- PR-triggered workflow without a permissions block

## New (10)

- Dimension evaluation failed
- High CVE: [GHSA redacted] (package-lock.json)
- High CVE: [GHSA redacted] (package-lock.json)
- Hotspot: lib/application.js (lib/application.js)
- Hotspot: lib/response.js (lib/response.js)
- Low CVE: [GHSA redacted] (package-lock.json)
- Medium CVE: [GHSA redacted] (package-lock.json)
- Medium CVE: [GHSA redacted] (package-lock.json)
- No automated tests
- No tests found

## Changes since last survey

- 1 commits — 1 feature/other, 0 fixes

## By area

- docs/api — 1 commit

## Notable commits

- change: docs: improve JSDoc parameter descriptions for `Application` constructor (#1941)