# Changelog

> **This is the PUBLIC form of this artifact. Findings are listed in full, but the details of SECURITY findings — which rule fired, in which file, on which line, and how to fix it — are deliberately withheld, and any secret-scanner results are excluded entirely. Where detail is absent here it was REMOVED FOR PUBLICATION; it is not missing from the analysis. The complete artifact is available from the repository owner.**

## Score

- CAI 52 → 37 (-14.3)
- Rubric changed (rubric-2026.08.18 → rubric-2026.08.15) — scores are not directly comparable.

## Lenses

- Code Health 60 → 61 (+0.9)
- Architecture 89 → 69 (-20.3)
- Maturity 54 → 58 (+4.5)
- Readiness 46 → 12 (-34.0)
- Security 63 → 62 (-1.2)

## Resolved (23)

- Change coupling: auth.js ↔ api-key-socket-handler.js (server/auth.js)
- Change coupling: clear-old-data.js ↔ server.js (server/jobs/clear-old-data.js)
- Change coupling: config.js ↔ api-router.js (server/config.js)
- Change coupling: group.js ↔ monitor.js (server/model/group.js)
- Change coupling: notification.js ↔ NotificationDialog.vue (server/notification.js)
- Change coupling: notification.js ↔ index.js (server/notification.js)
- Change coupling: setup-database.js ↔ SetupDatabase.vue (server/setup-database.js)
- Coverage not included — suite not readable by the collector
- Dependency hygiene not measured — dependency manifest found but not parsed for hygiene
- FileTooLong: server/database.js (server/database.js)
- High vulnerability: [GHSA redacted] (package-lock.json)
- High vulnerability: [GHSA redacted] (package-lock.json)
- Hotspot: src/util.ts (src/util.ts)
- Low CVE: [GHSA redacted] (package-lock.json)
- Medium CVE: [GHSA redacted] (package-lock.json)
- Medium CVE: [GHSA redacted] (package-lock.json)
- Medium vulnerability: [GHSA redacted] (package-lock.json)
- Medium: security finding (details withheld)
- Medium: security finding (details withheld)
- Secret passed as a command-line argument
- …and 3 more

## New (140)

- (anonymous) (cognitive 17) (server/routers/api-router.js)
- (anonymous) (cognitive 17) (server/server.js)
- (anonymous) (cognitive 19) (extra/simple-dns-server.js)
- (anonymous) (cognitive 20) (server/routers/api-router.js)
- (anonymous) (cognitive 24) (server/socket-handlers/status-page-socket-handler.js)
- (anonymous) (cognitive 26) (server/routers/status-page-router.js)
- (anonymous) (cognitive 28) (server/setup-database.js)
- (anonymous) (cognitive 33) (server/server.js)
- (anonymous) (cyclomatic 18) (server/routers/api-router.js)
- (anonymous) (cyclomatic 18) (server/server.js)
- (anonymous) (cyclomatic 18) (server/setup-database.js)
- (anonymous) (cyclomatic 19) (server/routers/status-page-router.js)
- A Node.js test runner guide exists, but there is no mention of how tests are written or run in the context of a backend project. (test/backend-test/README.md)
- Boundary-crossing change coupling: 2025-12-29-0000-remove-line-notify.js ↔ NotificationDialog.vue (db/knex_migrations/2025-12-29-0000-remove-line-notify.js)
- Boundary-crossing change coupling: 2025-12-29-0000-remove-line-notify.js ↔ index.js (db/knex_migrations/2025-12-29-0000-remove-line-notify.js)
- Boundary-crossing change coupling: 2025-12-29-0000-remove-line-notify.js ↔ websocket-upgrade.js (db/knex_migrations/2025-12-29-0000-remove-line-notify.js)
- Boundary-crossing change coupling: ActionSelect.vue ↔ EditMonitor.vue (src/components/ActionSelect.vue)
- Boundary-crossing change coupling: monitor.js ↔ mssql.js (server/model/monitor.js)
- Boundary-crossing change coupling: resend.js ↔ NotificationDialog.vue (server/notification-providers/resend.js)
- Boundary-crossing change coupling: resend.js ↔ Resend.vue (server/notification-providers/resend.js)
- …and 120 more

## Changes since last survey

- 6 commits — 5 feature/other, 1 fixes

## By area

- src/components — 5 commits
- test/backend-test — 1 commit

## Notable commits

- fix: chore: fix random fail tests, make all external tests optional (#7678)
- change: feat(notification): add BearSMS SMS provider for Israel (#7638)
- change: feat: Add ClickUp notification provider (#7677)
- change: feat: Add Pinglet notification provider (#7632)
- change: feat: Add openwa notification (#7555)
- change: feat: add TurboSMTP email notification provider (#7640)