# Changelog

> **This is the PUBLIC form of this artifact. Findings are listed in full, but the details of SECURITY findings — which rule fired, in which file, on which line, and how to fix it — are deliberately withheld, and any secret-scanner results are excluded entirely. Where detail is absent here it was REMOVED FOR PUBLICATION; it is not missing from the analysis. The complete artifact is available from the repository owner.**

## Score

- CAI 45 → 45 (-0.2)
- Rubric changed (rubric-2026.08.18 → rubric-2026.08.19) — scores are not directly comparable.

## Lenses

- Code Health 61 → 60 (-1.1)
- Architecture 100 → 100 (+0.0)
- Maturity 42 → 42 (+0.0)
- Readiness 31 → 31 (+0.0)
- Security 77 → 77 (+0.0)

## Resolved (4)

- High: security finding (details withheld)
- High: security finding (details withheld)
- The README links only to releases ('下载使用') without any user-facing content; it describes CLI usage but does not explain how to run the tool or what output one gets. (README.md)
- Typo in resource key: 'Verison' is used instead of 'Version' in both instances.

## New (8)

- EmptyCatchBlock (N_m3u8DL-CLI/LOGGER.cs)
- EmptyCatchBlock (N_m3u8DL-CLI/ProgressReporter.cs)
- High: security finding (details withheld)
- High: security finding (details withheld)
- Inconsistent naming for download-related properties in the DownloadManager class. Some use 'Download' prefix (e.g. DownDir, DownName) while others use 'Download' or no prefix. Specifically, 'TimeOut' is inconsistent with 'Timeout' (common spelling) and 'ToDO' vs 'ToDo' casing.
- The README claims a simple CLI but gives no usage example or command-line option list for the actual tool. (README.md)
- The concept of disabling integrity checks is named 'DisableIntegrityCheck' in MyOptions and DownloadManager, but 'disableIntegrityCheck' (lowercase d) in strings. While casing differences are often intentional (properties vs fields/strings), the inconsistency in the string resource key casing compared to the property name is notable.
- Typo in resource string keys: 'Verison' is used instead of 'Version'.

## Architecture

- Unchanged — 1 containers · 0 contexts · 0 edges