# Changelog

> **This is the PUBLIC form of this artifact. Findings are listed in full, but the details of SECURITY findings — which rule fired, in which file, on which line, and how to fix it — are deliberately withheld, and any secret-scanner results are excluded entirely. Where detail is absent here it was REMOVED FOR PUBLICATION; it is not missing from the analysis. The complete artifact is available from the repository owner.**

## Score

- CAI 44 → 43 (-0.7)
- Rubric changed (rubric-2026.08.18 → rubric-2026.08.19) — scores are not directly comparable.

## Lenses

- Code Health 67 → 68 (+0.5)
- Architecture 70 → 76 (+5.9)
- Maturity 57 → 58 (+1.6)
- Readiness 20 → 20 (+0.2)
- Security 72 → 69 (-3.3)

## Resolved (16)

- AttachmentView (cognitive 39) (BuildAnIntelligentBot/src/ChatBot/wwwroot/built/Attachment.js)
- AttachmentView (cyclomatic 44) (BuildAnIntelligentBot/src/ChatBot/wwwroot/built/Attachment.js)
- BareSuppressMessage (Snip-Insights/SnipInsight/Util/NativeMethods.cs)
- High CVE: [GHSA redacted] (GoogleAssistantConnector/GoogleAssistant/DirectLineToActionsOnGoogleLib/package-lock.json)
- Low CVE: [GHSA redacted] (GoogleAssistantConnector/GoogleAssistant/DirectLineToActionsOnGoogleLib/package-lock.json)
- Low cohesion: LogUploader (LCOM4 4) (Snip-Insights/SnipInsight/Util/LogUploader.cs)
- Low cohesion: SnipInsightLink (LCOM4 4) (Snip-Insights/SnipInsight/Package/SnipInsightLink.cs)
- TooManyMethods: NativeMethods (Snip-Insights/SnipInsight/Util/NativeMethods.cs)
- history (cognitive 32) (BuildAnIntelligentBot/src/ChatBot/wwwroot/built/Store.js)
- history (cyclomatic 28) (BuildAnIntelligentBot/src/ChatBot/wwwroot/built/Store.js)
- mapLocale (cognitive 30) (BuildAnIntelligentBot/src/ChatBot/wwwroot/built/Strings.js)
- mapLocale (cyclomatic 29) (BuildAnIntelligentBot/src/ChatBot/wwwroot/built/Strings.js)
- mountAdaptiveCards (cognitive 22) (BuildAnIntelligentBot/src/ChatBot/wwwroot/built/AdaptiveCardContainer.js)
- processNodes (cognitive 17) (BuildAnIntelligentBot/src/ChatBot/wwwroot/built/SpeechModule.js)
- processNodes (cyclomatic 18) (BuildAnIntelligentBot/src/ChatBot/wwwroot/built/SpeechModule.js)
- speakFromMsg (cyclomatic 17) (BuildAnIntelligentBot/src/ChatBot/wwwroot/built/Store.js)

## New (31)

- High CVE: [GHSA redacted] (Sketch2Code/Sketch2Code.AI/packages.config)
- High CVE: [GHSA redacted] (GoogleAssistantConnector/GoogleAssistant/DirectLineToActionsOnGoogleLib/package-lock.json)
- High CVE: [GHSA redacted] (GoogleAssistantConnector/GoogleAssistant/DirectLineToActionsOnGoogleLib/package-lock.json)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- Low: security finding (details withheld)
- Low: security finding (details withheld)
- Low: security finding (details withheld)
- Medium IaC: CKV_DOCKER_3 (Pix2Story/source/config_deploy/Dockerfile)
- Medium IaC: CKV_K8S_8 (Pix2Story/source/config_deploy/nvidia.yaml)
- Medium: security finding (details withheld)
- Medium: security finding (details withheld)
- Medium: security finding (details withheld)
- Medium: security finding (details withheld)
- Medium: security finding (details withheld)
- Medium: security finding (details withheld)
- Medium: security finding (details withheld)
- …and 11 more

## API surface

- Unchanged — 2 HTTP endpoints