# Changelog

## Score

- CAI 42 → 39 (-3.4)
- Rubric changed (rubric-2026.08.18 → rubric-2026.08.15) — scores are not directly comparable.

## Lenses

- Code Health 87 → 96 (+9.0)
- Architecture 100 → 96 (-4.4)
- Maturity 51 → 52 (+1.1)
- Readiness 34 → 14 (-19.4)
- Security 47 → 48 (+1.0)

## Resolved (42)

- ApplicationHelper.endpoint_options_for_select (cognitive 18) (app/helpers/application_helper.rb)
- Client.data (cognitive 35) (app/lib/smtp_server/client.rb)
- Client.data (cyclomatic 18) (app/lib/smtp_server/client.rb)
- Client.rcpt_to (cognitive 63) (app/lib/smtp_server/client.rb)
- Client.rcpt_to (cyclomatic 30) (app/lib/smtp_server/client.rb)
- Coverage not included — suite not readable by the collector
- Dependency hygiene not measured — dependency manifest found but not parsed for hygiene
- DomainsController.verify (cognitive 20) (app/controllers/domains_controller.rb)
- Duplicated block (9 lines × 2) (app/controllers/messages_controller.rb)
- Further orphaned files (smaller)
- HTTP.request (cognitive 25) (lib/postal/http.rb)
- HTTP.request (cyclomatic 18) (lib/postal/http.rb)
- HTTPSender.parameters (cognitive 25) (app/senders/http_sender.rb)
- High CVE: [GHSA redacted] (Gemfile.lock)
- High CVE: [GHSA redacted] (Gemfile.lock)
- High CVE: [GHSA redacted] (Gemfile.lock)
- High CVE: [GHSA redacted] (Gemfile.lock)
- High CVE: [GHSA redacted] (Gemfile.lock)
- High CVE: [GHSA redacted] (Gemfile.lock)
- High CVE: [GHSA redacted] (Gemfile.lock)
- …and 22 more

## New (6)

- Coverage not measured — test suite did not build
- Dimension evaluation failed
- Leaked secret: hardcoded-credential (spec/examples/full_legacy_config_file.yml)
- Low IaC: DS-0026 (Dockerfile)
- No tests found
- The environment-variable table lists POSTAL_DEFAULT_MAXIMUM_HOLD_EXPIRY_DAYS as 7 days but the default suppression removal period is 30 days, which appears in a later row and needs to be cross-referenced. (doc/config/environment-variables.md)