# Changelog

## Score

- CAI 54 → 56 (+2.0)
- Rubric changed (rubric-2026.09.12 → rubric-2026.09.18) — scores are not directly comparable.

## Lenses

- Code Health 52 → 52 (-0.0)
- Architecture 94 → 92 (-2.0)
- Maturity 53 → 54 (+1.6)
- Readiness 65 → 64 (-0.6)
- Security 52 → 60 (+8.0)
- Accessibility 57 → 57 (+0.0)
- Performance 100 (new)

## Resolved (4)

- Dependency hygiene PARTLY measured — npm pinning read, dependency currency not (no pnpm-resolved versions to grade)
- Documentation: no installation or build instructions (README.md)
- Most significant orphaned file (src/web/Facemesh.tsx)
- Off-boarding risk: anonymized user #1

## New (20)

- Further sole-owners (lower concentration)
- High CVE: [GHSA redacted] (yarn.lock)
- High CVE: [GHSA redacted] (yarn.lock)
- High CVE: [GHSA redacted] (yarn.lock)
- Most significant orphaned file (src/core/Splat.tsx)
- Off-boarding risk: anonymized user #1
- Outdated (npm): @babel/runtime
- Outdated (npm): @mediapipe/tasks-vision
- Outdated (npm): @monogrid/gainmap-js
- Outdated (npm): camera-controls
- Outdated (npm): cross-env
- Outdated (npm): detect-gpu
- Outdated (npm): hls.js
- Outdated (npm): stats-gl
- Outdated (npm): three-mesh-bvh
- Outdated (npm): three-stdlib
- Outdated (npm): troika-three-text
- Outdated (npm): use-sync-external-store
- Outdated (npm): zustand
- Projects may be oversized for their cohesion

## Changes since last survey

- 7 commits — 5 feature/other, 2 fixes

## By area

- src/core — 2 commits
- .github/workflows — 1 commit
- docs/assets — 1 commit
- docs/getting-started — 1 commit
- docs/misc — 1 commit
- docs/staging — 1 commit

## Notable commits

- fix: fix(AccumulativeShadows): keep scene.environment out of the light map (#2833)
- fix: fix: keep SoftShadows compatible with newer three versions (#2846)
- change: ci: build the docs with pmndrs/docs@v4 (#2770)
- change: docs: add Codesandbox preview images (#2861)
- change: docs: embed the pmndrs/examples demo instead of the CodeSandbox link on the introduction (#2862)
- change: docs: explicit Badges instead of shields.io tags (#2864)
- change: docs: group the Codesandbox preview images in docs/assets/csb-thumbs (#2863)