# Changelog

## Score

- CAI 39 → 36 (-3.8)
- Rubric changed (rubric-2026.08.18 → rubric-2026.08.19) — scores are not directly comparable.

## Lenses

- Code Health 58 → 36 (-22.3)
- Architecture 100 → 100 (+0.0)
- Maturity 42 → 42 (+0.0)
- Readiness 20 → 20 (+0.0)
- Security 75 → 74 (-0.6)
- Accessibility 80 → 80 (+0.0)

## Resolved (9)

- High CVE: [GHSA redacted] (composer.lock)
- High CVE: [GHSA redacted] (package-lock.json)
- High CVE: [GHSA redacted] (package-lock.json)
- High CVE: [GHSA redacted] (package-lock.json)
- High CVE: [GHSA redacted] (composer.lock)
- High CVE: [GHSA redacted] (composer.lock)
- High CVE: [GHSA redacted] (package-lock.json)
- High vulnerability: [GHSA redacted] (package-lock.json)
- The Requirements section lists PHP 7.2+ with no version range or minimum supported OS, which is a real dependency gap for someone running on an older server. (docs/local_environment.md)

## New (11)

- Critical CVE: [GHSA redacted] (package-lock.json)
- High CVE: [GHSA redacted] (package-lock.json)
- High CVE: [GHSA redacted] (package-lock.json)
- High CVE: [GHSA redacted] (package-lock.json)
- High CVE: [GHSA redacted] (package-lock.json)
- High CVE: [GHSA redacted] (package-lock.json)
- High CVE: [GHSA redacted] (package-lock.json)
- High CVE: [GHSA redacted] (package-lock.json)
- Medium IaC: CKV_DOCKER_2 (docker/php/Dockerfile)
- Medium IaC: CKV_DOCKER_3 (docker/cron/Dockerfile)
- Medium IaC: CKV_DOCKER_4 (docker/cron/Dockerfile)