# Changelog

> **This is the PUBLIC form of this artifact. Findings are listed in full, but the details of SECURITY findings — which rule fired, in which file, on which line, and how to fix it — are deliberately withheld, and any secret-scanner results are excluded entirely. Where detail is absent here it was REMOVED FOR PUBLICATION; it is not missing from the analysis. The complete artifact is available from the repository owner.**

## Score

- CAI 52 → 49 (-3.2)
- Rubric changed (rubric-2026.10.1 → rubric-2026.10.5) — scores are not directly comparable.

## Lenses

- Code Health 70 → 56 (-14.7)
- Architecture 62 → 62 (-0.3)
- Maturity 59 → 54 (-4.7)
- Readiness 76 → 54 (-21.8)
- Security 65 → 52 (-12.9)
- Accessibility 39 → 42 (+3.0)
- Performance 100 → 100 (+0.0)

## Resolved (5)

- Inconsistent boolean configuration patterns: `autoHide` sets the value directly, `disableAutoHide` inverts the logic, and `persistent` sets a different boolean state. This forces users to guess the intent of the parameter.
- Inconsistent static factory methods: `asComponent` and `usingComponent` appear to do the same thing. Additionally, `render` is used as a static factory here, which is confusing compared to its typical instance usage.
- PR-triggered workflow without a permissions block
- Semantic duplication: Both methods likely set the auto-hide delay duration.
- Workflow holding a long-lived secret is unscoped

## New (23)

- Cross-context type Attachment (Attachment → Platform)
- Cross-context type Attachment (Attachment → Platform)
- Cross-context type Attachment (Attachment → Platform)
- Cross-context type Attachment (Attachment → Platform) (src/Platform/Events/ReplicateFileEvent.php)
- Cross-context type Attachment (Attachment → Platform) (src/Platform/Events/UploadFileEvent.php)
- Cross-context type Attachment (Attachment → Platform) (src/Platform/Events/UploadedFileEvent.php)
- High: security finding (details withheld)
- High: security finding (details withheld)
- Inconsistent boolean parameter semantics: `autoHide` sets the value directly, while `disableAutoHide` implies a toggle/inversion logic, and `persistent` is a positive assertion. This forces users to guess whether passing `true` enables or disables the feature.
- Inconsistent factory/static method naming: `make`, `render`, `component`, `asComponent`, and `usingComponent` are all static factory methods for creating Cell instances, but the naming convention is inconsistent and unclear about their specific use cases.
- Inconsistent verb usage: `registerMenu` uses the verb 'register', while `icons`, `menu`, `permissions` are noun-like getters. The distinction between `registerMenu` and the others is unclear.
- Leaked secret: hardcoded-credential (phpunit.xml)
- Leaked secret: hardcoded-credential (src/Platform/Http/Controllers/LoginController.php)
- Leaked secret: hardcoded-credential (stubs/app/Orchid/Screens/User/UserProfileScreen.php)
- Leaked secret: hardcoded-credential (stubs/app/Orchid/Screens/User/UserProfileScreen.php)
- Medium: security finding (details withheld)
- Medium: security finding (details withheld)
- PR-triggered workflow without a permissions block (.github/workflows/coverage.yml)
- PR-triggered workflow without a permissions block (.github/workflows/phpunit.yml)
- PR-triggered workflow without a permissions block (.github/workflows/quality.yml)
- …and 3 more

## Changes since last survey

- 4 commits — 4 feature/other, 0 fixes

## By area

- .github/workflows — 2 commits
- (root) — 1 commit
- resources/js — 1 commit

## Notable commits

- change: Add Semgrep scan workflow (#3157)
- change: Bump crate-ci/typos from 1.50.2 to 1.50.3 (#3156)
- change: Bump prettier from 3.9.8 to 3.9.9 (#3155)
- change: Remove stale change listeners in Listener controller (#2794) (#3148)

## Architecture

- 0 containers · 1 bounded contexts · 0 dependency edges (baseline)