# Changelog

## Score

- CAI 51 → 51 (+0.0)
- Rubric changed (rubric-2026.08.18 → rubric-2026.08.19) — scores are not directly comparable.

## Lenses

- Code Health 62 → 63 (+0.3)
- Architecture 91 → 91 (+0.0)
- Maturity 56 → 56 (+0.0)
- Readiness 36 → 36 (+0.0)
- Security 69 → 69 (-0.3)
- Accessibility 80 → 80 (+0.0)

## Resolved (7)

- Medium CVE: Azure.Identity 1.7.0
- Medium CVE: Azure.Identity 1.7.0
- Medium CVE: BouncyCastle.Cryptography 2.2.1
- Medium CVE: BouncyCastle.Cryptography 2.2.1
- Medium CVE: BouncyCastle.Cryptography 2.2.1
- The method name 'FindNoTraking' contains a typo ('Traking' instead of 'Tracking'). This is inconsistent with the correctly spelled 'GetTableNoTracking' method in the same hierarchy.
- misleading comment (CleanArchitecture.Identity/IdentityDependencies.cs)

## New (15)

- Inconsistent use of 'Add' vs 'Assign' for similar operations. 'AddClaimToRoleCommand' uses 'Add', while 'AssignClaimToUserCommand' uses 'Assign'.
- Medium CVE: Azure.Identity 1.7.0
- Medium CVE: Azure.Identity 1.7.0
- Medium CVE: BouncyCastle.Cryptography 2.2.1
- Medium CVE: BouncyCastle.Cryptography 2.2.1
- Medium CVE: BouncyCastle.Cryptography 2.2.1
- Medium IaC: CKV2_GHA_1 (.github/workflows/dotnetcore.yml)
- Medium IaC: CKV2_GHA_1 (.github/workflows/main.yml)
- Medium IaC: CKV_DOCKER_2 (CleanArchitecture.Api/Dockerfile)
- Medium IaC: CKV_DOCKER_2 (CleanArchitecture.Mvc/Dockerfile)
- The .NET Core project has open-source third-party libraries (jQuery, jQuery Validation) under the OpenJS Foundation license but no LICENSE file for any of them in the wwwroot/lib/ directory. (CleanArchitecture.Mvc/wwwroot/lib/jquery/LICENSE.txt)
- The command for adding a claim to a role is named 'AddClaimToRoleCommand', and the service method is 'AddClaimToRole'. While consistent with each other, the verb 'Add' is used here, whereas 'Assign' is used for the similar 'Role' assignment operation.
- The command for assigning a claim to a user is named 'AssignClaimToUserCommand', but the service method is named 'AddClaimToUser'.
- The command for assigning a role to a user is named 'AssignRoleToUserCommand', but the corresponding service method is named 'AddRoleToUser'. The verb 'Assign' is used in the request model but 'Add' is used in the service implementation.
- The command for assigning a role to a user uses 'Assign', while the command for assigning a claim to a user also uses 'Assign'. However, the service methods differ ('Add' vs 'Assign').