# Changelog

> **This is the PUBLIC form of this artifact. Findings are listed in full, but the details of SECURITY findings — which rule fired, in which file, on which line, and how to fix it — are deliberately withheld, and any secret-scanner results are excluded entirely. Where detail is absent here it was REMOVED FOR PUBLICATION; it is not missing from the analysis. The complete artifact is available from the repository owner.**

## Score

- CAI 49 → 42 (-6.5)

## Lenses

- Code Health 51 → 47 (-4.3)
- Architecture 89 → 87 (-2.0)
- Maturity 45 → 53 (+7.9)
- Readiness 38 → 28 (-9.9)
- Security 99 → 80 (-19.2)
- Performance 85 → 60 (-25.0)

## Resolved (43)

- Documentation: no project overview (docs/investigations/scale-range-issue-review.md)
- Documentation: no project overview (docs/investigations/scale-range-policy.md)
- Documentation: no project overview (docs/investigations/uplot-extraction-notes.md)
- Hotspot: demos/grouped-bars.js (demos/grouped-bars.js)
- Hotspot: src/opts.js (src/opts.js)
- Hotspot: test/bar-chart-plugin.mjs (test/bar-chart-plugin.mjs)
- Low CVE: [GHSA redacted] (bun.lock)
- Medium CVE: [GHSA redacted] (bun.lock)
- Skipped (documented): clears obsolete marker styles and preserves rows, headers, and lazy bindings across marker modes (test/legend-contracts.mjs)
- Skipped (documented): delSeries accepts a custom cursor points.show returning no HTMLElement (test/master-lifecycle-bugs.mjs)
- Skipped (documented): delSeries clears focus opacity after deleting the focused Y series and committing matching data (test/master-lifecycle-bugs.mjs)
- Skipped (documented): delSeries preserves the shared cursor point when deleting a null point slot (test/master-lifecycle-bugs.mjs)
- Skipped (documented): derives markers only from the final coalesced index and marker mode (test/legend-contracts.mjs)
- Skipped (documented): destroy during a drag detaches the document mouseup listener (test/master-lifecycle-bugs.mjs)
- Skipped (documented): destroy in drawClear stops the active commit before subsequent paint or draw hooks (test/master-lifecycle-bugs.mjs)
- Skipped (documented): discards a mounted-row update when a marker mode refresh callback destroys the renderer (test/legend-contracts.mjs)
- Skipped (documented): does not mount or retain a table when an initial marker callback destroys the renderer (test/legend-contracts.mjs)
- Skipped (documented): exposes isolate and restore state in hooks and renders once per frame in mode ${mode} (test/legend-contracts.mjs)
- Skipped (documented): paints changed cursor-derived focus in the same data commit (test/cursor-focus.mjs)
- Skipped (documented): preserves outer hook deferral across an inner nondeferred batch (test/master-scheduler-bugs.mjs)
- …and 23 more

## New (196)

- FileTooLong: scripts/benchmarks-trace-browser.mjs (scripts/benchmarks-trace-browser.mjs)
- FileTooLong: src/utils.js (src/utils.js)
- Fixed-sleep synchronisation: SciChart: waits for native license validation, then still requires GPU completion (test/integration/bench-scientific-adapters.mjs)
- Fixed-sleep synchronisation: bounds a stalled ${phase} poll drain and skips destruction (test/tooling/benchmarks-samples.mjs)
- FunctionTooLong: analyze-benchmarks-trace.createTraceAnalyzer (scripts/analyze-benchmarks-trace.mjs)
- FunctionTooLong: bench-instrument.main (scripts/bench-instrument.mjs)
- FunctionTooLong: bench-webgl.createWebGLCapture (scripts/bench-webgl.mjs)
- FunctionTooLong: benchmarks-paths-browser.runCase (scripts/benchmarks-paths-browser.mjs)
- FunctionTooLong: benchmarks-samples.captureBenchmarkSamples (scripts/benchmarks-samples.mjs)
- FunctionTooLong: benchmarks-trace-browser.reportMetadata (scripts/benchmarks-trace-browser.mjs)
- FunctionTooLong: benchmarks-trace.captureBenchmarkTrace (scripts/benchmarks-trace.mjs)
- FunctionTooLong: investigate-g2-webgl-fill.sample (scripts/investigate-g2-webgl-fill.mjs)
- FunctionTooLong: points.points (src/paths/points.js)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- …and 176 more

## Changes since last survey

- 66 commits — 64 feature/other, 2 fixes

## By area

- test/tooling — 13 commits
- (root) — 10 commits
- test/integration — 6 commits
- dist/uPlot.cjs.js — 5 commits
- demos/lib — 4 commits
- test/demos — 4 commits
- demos/heatmap-cells.html — 3 commits
- docs/investigations — 3 commits
- bench/dashboard — 2 commits
- demos/heatmap-cells-bokeh.js — 2 commits
- scripts/vendor — 2 commits
- src/uPlot.js — 2 commits
- bench/demo-dependencies.mjs — 1 commit
- demos/axis-range-aligned.html — 1 commit
- demos/focus-cursor.html — 1 commit
- demos/high-low-bands.js — 1 commit
- demos/index.html — 1 commit
- demos/scatter.html — 1 commit
- demos/timeline-discrete.html — 1 commit
- scripts/benchmarks-display.mjs — 1 commit

## Notable commits

- fix: Fix deadlink in README.md (#1129)
- fix: fix tests, shorten grid-template-areas
- change: Add ink-uplot (terminal renderer) to Third-party Integrations (#1139)
- change: Keep axis ticks at magnitudes of 1e17 and up (#1157)
- change: add 1.6.32 to bench
- change: add dashboard benchmarks
- change: add hover bench
- change: add more libs to bench
- change: add one-sided bands (to infinity or -infinity)
- change: add points.shape, support square points.
- change: add resize to bench
- change: add scale padding controls to demo
- change: add scatter with per-point discrete color demo. close #1076.
- change: add small tolerance to point hiding. close #1156.
- change: add some more investogations
- change: avoid eager init of Intl, reduce mem use
- change: bench chartgpu
- change: bench more libs
- change: bench scales
- change: bench updates
- …and 46 more