# Changelog

## Score

- CAI 49 → 57 (+7.4)
- Rubric changed (rubric-2026.09.8 → rubric-2026.09.16) — scores are not directly comparable.

## Lenses

- Code Health 95 → 95 (+0.0)
- Architecture 100 → 90 (-10.1)
- Maturity 52 → 52 (+0.0)
- Readiness 59 → 59 (+0.0)
- Security 33 → 47 (+14.6)
- Performance 100 (new)

## Resolved (75)

- Critical CVE: [CVE redacted] (kotlin-js-store/yarn.lock)
- Critical CVE: [CVE redacted] (kotlin-js-store/yarn.lock)
- Critical CVE: [GHSA redacted] (kotlin-js-store/yarn.lock)
- Critical CVE: [GHSA redacted] (kotlin-js-store/yarn.lock)
- High CVE: [CVE redacted] (kotlin-js-store/yarn.lock)
- High CVE: [CVE redacted] (kotlin-js-store/yarn.lock)
- High CVE: [CVE redacted] (kotlin-js-store/yarn.lock)
- High CVE: [CVE redacted] (kotlin-js-store/yarn.lock)
- High CVE: [CVE redacted] (kotlin-js-store/yarn.lock)
- High CVE: [CVE redacted] (kotlin-js-store/yarn.lock)
- High CVE: [CVE redacted] (kotlin-js-store/yarn.lock)
- High CVE: [CVE redacted] (kotlin-js-store/yarn.lock)
- High CVE: [CVE redacted] (kotlin-js-store/yarn.lock)
- High CVE: [CVE redacted] (kotlin-js-store/yarn.lock)
- High CVE: [CVE redacted] (kotlin-js-store/yarn.lock)
- High CVE: [CVE redacted] (kotlin-js-store/yarn.lock)
- High CVE: [CVE redacted] (kotlin-js-store/yarn.lock)
- High CVE: [CVE redacted] (kotlin-js-store/yarn.lock)
- High CVE: [CVE redacted] (kotlin-js-store/yarn.lock)
- High CVE: [CVE redacted] (kotlin-js-store/yarn.lock)
- …and 55 more

## New (9)

- Documentation: no installation or build instructions (README.md)
- Duplicate method signature for CartesianChart.copy
- High vulnerability: [GHSA redacted] (kotlin-js-store/yarn.lock)
- Inconsistent state management pattern in host constructors
- Low cohesion: Slice (LCOM4 4) (vico/compose/src/commonMain/kotlin/com/patrykandpatrick/vico/compose/pie/PieChart.kt)
- No ADRs found
- Off the main sequence: :vico:compose
- Off-boarding risk: anonymized user #1
- Projects may be oversized for their cohesion

## Changes since last survey

- 9 commits — 3 feature/other, 6 fixes

## By area

- gradle/libs.versions.toml — 6 commits
- buildSrc/src — 1 commit
- gradle/wrapper — 1 commit
- vico/compose — 1 commit

## Notable commits

- fix: fix(deps): update agp to v9.4.1 (#1612)
- fix: fix(deps): update compose to v1.12.1 (#1616)
- fix: fix(deps): update dependency androidx.annotation:annotation to v1.11.0 (#1618)
- fix: fix(deps): update dependency org.jetbrains.androidx.navigation:navigation-compose to v2.10.0-beta01 (#1608)
- fix: fix(deps): update dependency org.jetbrains.kotlin.android:org.jetbrains.kotlin.android.gradle.plugin to v2.4.20 (#1603)
- fix: fix: preserve the hole in single-slice doughnut charts
- change: build: raise Android minimum SDK to 24
- change: chore(deps): update dependency org.jetbrains.compose to v1.12.1 (#1615)
- change: chore(deps): update gradle to v9.8.0 (#1621)

## Architecture

- Containers 0 added · 0 removed · contexts 1 added · 0 removed · edges 1 added · 0 removed

## Added bounded contexts (1)

- shared

## Added dependency edges (1)

- shared → compose