# Changelog

## Score

- CAI 63 → 40 (-22.9)
- Rubric changed (rubric-2026.08.18 → rubric-2026.08.15) — scores are not directly comparable.

## Lenses

- Code Health 100 → 100 (+0.0)
- Maturity 59 → 57 (-1.8)
- Readiness 55 → 26 (-29.4)
- Security 58 → 38 (-20.0)

## Resolved (5)

- Coverage not included — suite not readable by the collector
- Dependency hygiene not measured — dependency manifest found but not parsed for hygiene
- Off-boarding risk: anonymized user #1
- Workflow token permissions not restricted
- complexity unreadable for .swift — churn × complexity hotspots could not be measured

## New (54)

- Critical CVE: [GHSA redacted] (Tests/JS-A+/package-lock.json)
- Critical CVE: [GHSA redacted] (Tests/JS-A+/package-lock.json)
- Critical CVE: [GHSA redacted] (Tests/JS-A+/package-lock.json)
- Critical CVE: [GHSA redacted] (Tests/JS-A+/package-lock.json)
- Critical CVE: [GHSA redacted] (Tests/JS-A+/package-lock.json)
- Critical CVE: [GHSA redacted] (Tests/JS-A+/package-lock.json)
- Critical CVE: [GHSA redacted] (Tests/JS-A+/package-lock.json)
- Critical CVE: [GHSA redacted] (Tests/JS-A+/package-lock.json)
- Critical CVE: [GHSA redacted] (Tests/JS-A+/package-lock.json)
- Critical CVE: [GHSA redacted] (Tests/JS-A+/package-lock.json)
- Critical CVE: [GHSA redacted] (Tests/JS-A+/package-lock.json)
- Critical CVE: [GHSA redacted] (Tests/JS-A+/package-lock.json)
- Critical CVE: [GHSA redacted] (Tests/JS-A+/package-lock.json)
- Critical CVE: [GHSA redacted] (Tests/JS-A+/package-lock.json)
- Critical CVE: [GHSA redacted] (Tests/JS-A+/package-lock.json)
- Critical CVE: [GHSA redacted] (Tests/JS-A+/package-lock.json)
- Critical CVE: [GHSA redacted] (Tests/JS-A+/package-lock.json)
- Critical CVE: [GHSA redacted] (Tests/JS-A+/package-lock.json)
- Critical CVE: [GHSA redacted] (Tests/JS-A+/package-lock.json)
- Critical CVE: [GHSA redacted] (Tests/JS-A+/package-lock.json)
- …and 34 more