# Changelog

## Score

- CAI 32 → 33 (+0.8)
- Rubric changed (rubric-2026.09.11 → rubric-2026.09.18) — scores are not directly comparable.

## Lenses

- Code Health 58 → 58 (-0.1)
- Architecture 60 → 66 (+5.4)
- Maturity 72 → 72 (+0.0)
- Readiness 8 → 10 (+1.9)
- Security 73 → 67 (-6.5)
- Accessibility 40 → 40 (-0.8)
- Performance 100 (new)

## Resolved (367)

- Critical CVE: [CVE redacted] (1_solana sniper bot(node) using gRPC/package-lock.json)
- Critical CVE: [CVE redacted] (1_solana sniper bot(node) using gRPC/package-lock.json)
- Critical CVE: [CVE redacted] (2_copy trading bot(node) using gRPC/package-lock.json)
- Critical CVE: [CVE redacted] (2_copy trading bot(node) using gRPC/package-lock.json)
- Critical CVE: [CVE redacted] (3_sniper bot(node) using using Helius websocket/package-lock.json)
- Critical CVE: [CVE redacted] (3_sniper bot(node) using using Helius websocket/package-lock.json)
- Critical CVE: [CVE redacted] (1_solana sniper bot(node) using gRPC/package-lock.json)
- Critical CVE: [CVE redacted] (2_copy trading bot(node) using gRPC/package-lock.json)
- Critical CVE: [CVE redacted] (3_sniper bot(node) using using Helius websocket/package-lock.json)
- Critical CVE: [GHSA redacted] (1_solana sniper bot(node) using gRPC/package-lock.json)
- Critical CVE: [GHSA redacted] (1_solana sniper bot(node) using gRPC/package-lock.json)
- Dependency hygiene PARTLY measured — npm pinning read, dependency currency not (no pnpm-resolved versions to grade)
- High CVE: [CVE redacted] (1_solana sniper bot(node) using gRPC/package-lock.json)
- High CVE: [CVE redacted] (2_copy trading bot(node) using gRPC/package-lock.json)
- High CVE: [CVE redacted] (3_sniper bot(node) using using Helius websocket/package-lock.json)
- High CVE: [CVE redacted] (1_solana sniper bot(node) using gRPC/package-lock.json)
- High CVE: [CVE redacted] (2_copy trading bot(node) using gRPC/package-lock.json)
- High CVE: [CVE redacted] (3_sniper bot(node) using using Helius websocket/package-lock.json)
- High CVE: [CVE redacted] (1_solana sniper bot(node) using gRPC/package-lock.json)
- High CVE: [CVE redacted] (2_copy trading bot(node) using gRPC/package-lock.json)
- …and 347 more

## New (28)

- Banned license: @raydium-io/raydium-sdk
- Critical CVE: [GHSA redacted] (1_solana sniper bot(node) using gRPC/package-lock.json)
- Critical CVE: [GHSA redacted] (1_solana sniper bot(node) using gRPC/package-lock.json)
- Dependency hygiene PARTLY measured — Cargo dependencies read, no committed lock to grade for currency
- Duplicate RPC client instances. Both `AppState` and `Pump` structs maintain two separate fields for RPC clients: one blocking (`rpc_client`) and one non-blocking (`rpc_nonblocking_client`). This duplicates state management and initialization logic across multiple structs.
- High CVE: [GHSA redacted] (1_solana sniper bot(node) using gRPC/package-lock.json)
- High CVE: [GHSA redacted] (1_solana sniper bot(node) using gRPC/package-lock.json)
- High CVE: [GHSA redacted] (1_solana sniper bot(node) using gRPC/package-lock.json)
- High CVE: [GHSA redacted] (1_solana sniper bot(node) using gRPC/package-lock.json)
- High CVE: [GHSA redacted] (1_solana sniper bot(node) using gRPC/package-lock.json)
- High CVE: [GHSA redacted] (1_solana sniper bot(node) using gRPC/package-lock.json)
- High CVE: [GHSA redacted] (1_solana sniper bot(node) using gRPC/package-lock.json)
- High CVE: [GHSA redacted] (1_solana sniper bot(node) using gRPC/package-lock.json)
- Identical types defined in multiple service modules. `BundleStatus` is defined identically in `jito` and `zeroslot` services.
- Identical types defined in multiple service modules. `TipAccountResult` is defined identically in `jito`, `nextblock`, and `zeroslot` services, violating DRY principles and creating maintenance overhead.
- Malicious package: MAL-2025-21003 (1_solana sniper bot(node) using gRPC/package-lock.json)
- Massive redundancy in instruction generation methods. For every action (initialize, set_params, create, buy, sell, withdraw), there are 6 distinct methods differing only by whether they take a program_id, keys vs accounts, or require signing seeds. This creates a 6x explosion of API surface for identical logical operations.
- Medium CVE: [GHSA redacted] (1_solana sniper bot(node) using gRPC/package-lock.json)
- Medium CVE: [GHSA redacted] (1_solana sniper bot(node) using gRPC/package-lock.json)
- Medium CVE: [GHSA redacted] (1_solana sniper bot(node) using gRPC/package-lock.json)
- …and 8 more

## Changes since last survey

- 1 commits — 1 feature/other, 0 fixes

## By area

- (root) — 1 commit

## Notable commits

- change: Update README.md