# Changelog

> **This is the PUBLIC form of this artifact. Findings are listed in full, but the details of SECURITY findings — which rule fired, in which file, on which line, and how to fix it — are deliberately withheld, and any secret-scanner results are excluded entirely. Where detail is absent here it was REMOVED FOR PUBLICATION; it is not missing from the analysis. The complete artifact is available from the repository owner.**

## Score

- CAI 53 → 53 (-0.5)
- Rubric changed (rubric-2026.10.1 → rubric-2026.10.5) — scores are not directly comparable.

## Lenses

- Code Health 66 → 57 (-8.9)
- Architecture 83 → 85 (+1.9)
- Maturity 62 → 62 (+0.3)
- Readiness 46 → 47 (+0.7)
- Security 62 → 58 (-4.0)
- Accessibility 53 → 54 (+0.9)

## Resolved (19)

- Boundary-crossing change coupling: device_templates.ex ↔ device_channel.ex (lib/nerves_hub/audit_logs/templates/device_templates.ex)
- Boundary-crossing change coupling: metrics.ex ↔ show.ex (lib/nerves_hub/devices/metrics.ex)
- Change coupling: device_certificate_controller.ex ↔ device_controller.ex (lib/nerves_hub_web/controllers/api/device_certificate_controller.ex)
- Duplicated block (16 lines × 2) (lib/nerves_hub/archives.ex)
- Duplicated block (5 lines × 2) (lib/nerves_hub_web/components/core_components.ex)
- Edited copy of a member (33 corresponding lines) (lib/nerves_hub_web/components/device_page/console_tab.ex)
- FileTooLong: deployment_groups/show.ex (lib/nerves_hub_web/live/deployment_groups/show.ex)
- High: security finding (details withheld)
- Medium IaC: WD-DOCKER-0003 (Dockerfile)
- Medium IaC: WD-DOCKER-0003 (Dockerfile)
- Medium IaC: WD-DOCKER-0003 (Dockerfile)
- Medium IaC: WD-DOCKER-0003 (Dockerfile)
- Medium IaC: WD-DOCKER-0003 (Dockerfile)
- Medium IaC: WD-DOCKER-0003 (Dockerfile)
- Medium IaC: WD-DOCKER-0005 (Dockerfile)
- Off-boarding risk: anonymized user #1
- Outdated: canonical_tailwind
- PR-triggered workflow without a permissions block
- TooManyFunctions: PubSub (lib/nerves_hub/consoles/pub_sub.ex)

## New (48)

- Change coupling: archives.ex ↔ firmware.ex (lib/nerves_hub_web/live/archives.ex)
- Change coupling: ca_certificate.ex ↔ ssl.ex (lib/nerves_hub/devices/ca_certificate.ex)
- Duplicated block (10 lines × 2) (lib/nerves_hub/integrations/discord/embeds.ex)
- Duplicated block (11 lines × 2) (lib/nerves_hub_web/components/device_page/details_tab.ex)
- Duplicated block (12 lines × 2) (lib/nerves_hub/integrations/cache.ex)
- Duplicated block (13–17 lines × 2) (lib/nerves_hub_web/live/org/integrations/chat_webhook_section.ex)
- Duplicated block (15 lines × 2) (lib/nerves_hub/integrations/chat_webhooks.ex)
- Duplicated block (4–6 lines × 3) (lib/nerves_hub/integrations/discord/embeds.ex)
- Duplicated block (5 lines × 2) (lib/nerves_hub/integrations/discord/embeds.ex)
- Duplicated block (5 lines × 2) (lib/nerves_hub/integrations/discord/embeds.ex)
- Duplicated block (5 lines × 2) (lib/nerves_hub_web/channels/user_console_channel.ex)
- Duplicated block (5 lines × 2) (lib/nerves_hub_web/live/org/integrations/chat_webhook_section.ex)
- Duplicated block (5 lines × 3) (lib/nerves_hub/integrations/discord/embeds.ex)
- Duplicated block (5 lines × 3) (lib/nerves_hub_web/live/org/integrations.ex)
- Duplicated block (6 lines × 2) (lib/nerves_hub/integrations/chat_webhooks.ex)
- Duplicated block (6 lines × 2) (lib/nerves_hub/workers/post_chat_webhook_events.ex)
- Duplicated block (6 lines × 2) (lib/nerves_hub_web/integrations/slack/device_cards.ex)
- Duplicated block (6 lines × 3) (lib/nerves_hub/integrations/discord/embeds.ex)
- Duplicated block (7 lines × 3) (lib/nerves_hub/integrations/chat_webhooks.ex)
- Duplicated block (8 lines × 2) (lib/nerves_hub_web/components/device_page/console_tab.ex)
- …and 28 more

## Changes since last survey

- 66 commits — 62 feature/other, 4 fixes

## By area

- (root) — 20 commits
- lib/nerves_hub — 20 commits
- lib/nerves_hub_web — 19 commits
- test/nerves_hub — 3 commits
- (repo) — 1 commit
- assets/js — 1 commit
- docs/cross_node_messaging.md — 1 commit
- test/nerves_hub_web — 1 commit

## Notable commits

- fix: Fix flaky tests (#3162)
- fix: Fix how the CA pages handle vertical overflow (#3116)
- fix: Fix timing flake in DeviceLink progress throttle tests (#3136)
- fix: Fix two partial writes when a device joins (#3155)
- change: Accept expired CA certificates when registering a CA (#3146)
- change: Add API endpoints for archives (#3139)
- change: Add API endpoints for per-device shared secrets (#3108)
- change: Add webhooks for device events (#3117)
- change: Announce a page to the paced extensions without a `:group` key (#3133)
- change: Answer /nerveshub slash commands in Slack (#3123)
- change: Build fwup 1.17.1, and say when firmware needs a newer fwup (#3111)
- change: Bump Bandit to 1.13.1 for two security advisories (#3169)
- change: Bump Elixir to 1.20.4 and OTP to 29.1.2 (#3166)
- change: Bump Sentry to 14 and keep SENTRY_ENABLE_LOGGING working (#3165)
- change: Bump canonical_tailwind from 0.3.2 to 0.3.3, format Tailwind classes (#3104)
- change: Bump canonical_tailwind from 0.3.3 to 0.3.4 (#3110)
- change: Bump canonical_tailwind from 0.3.4 to 0.3.5 (#3151)
- change: Bump crontab from 1.2.0 to 1.2.1 (#3126)
- change: Bump decimal from 3.1.1 to 3.2.0 (#3130)
- change: Bump hackney from 4.8.4 to 4.8.5 (#3106)
- …and 46 more