# Changelog

> **This is the PUBLIC form of this artifact. Findings are listed in full, but the details of SECURITY findings — which rule fired, in which file, on which line, and how to fix it — are deliberately withheld, and any secret-scanner results are excluded entirely. Where detail is absent here it was REMOVED FOR PUBLICATION; it is not missing from the analysis. The complete artifact is available from the repository owner.**

## Score

- CAI 40 → 52 (+11.9)
- Rubric changed (rubric-2026.08.15 → rubric-2026.09.15) — scores are not directly comparable.

## Lenses

- Code Health 51 → 52 (+0.5)
- Architecture 56 (new)
- Maturity 58 → 58 (-0.0)
- Readiness 27 → 47 (+20.2)
- Security 53 → 80 (+27.2)

## Resolved (94)

- Change coupling: check-props.js ↔ debug.js (debug/src/check-props.js)
- Change coupling: children.js ↔ index.js (src/diff/children.js)
- Change coupling: client.js ↔ client.mjs (compat/client.js)
- Change coupling: debug.js ↔ index.js (debug/src/debug.js)
- Change coupling: index.d.ts ↔ index.js (test-utils/src/index.d.ts)
- Change coupling: index.js ↔ index.js (src/diff/index.js)
- Change coupling: index.js ↔ render.js (src/diff/index.js)
- Critical CVE: [GHSA redacted] (package-lock.json)
- Critical CVE: [GHSA redacted] (demo/package-lock.json)
- Critical CVE: [GHSA redacted] (package-lock.json)
- Critical CVE: [GHSA redacted] (package-lock.json)
- Critical CVE: [GHSA redacted] (package-lock.json)
- Dimension evaluation failed
- FileTooLong: diff/children.js (src/diff/children.js)
- FileTooLong: diff/index.js (src/diff/index.js)
- FileTooLong: src/debug.js (debug/src/debug.js)
- FileTooLong: src/index.js (hooks/src/index.js)
- High CVE: [GHSA redacted] (package-lock.json)
- High CVE: [GHSA redacted] (demo/package-lock.json)
- High CVE: [GHSA redacted] (package-lock.json)
- …and 74 more

## New (89)

- Base-context workflow trigger runs with an unscoped token
- Coverage not measured — JavaScript/TypeScript suite
- Documentation: no installation or build instructions (README.md)
- FunctionTooLong: children.constructNewChildrenArray (src/diff/children.js)
- FunctionTooLong: debug.initDebug (debug/src/debug.js)
- FunctionTooLong: index.diff (src/diff/index.js)
- FunctionTooLong: index.diffElementNodes (src/diff/index.js)
- High CVE: [GHSA redacted] (pnpm-lock.yaml)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- Hotspot: jsx-runtime/src/index.js (jsx-runtime/src/index.js)
- No assertions: should handle a promise thrown from a layout effect (compat/test/browser/suspense.test.jsx)
- No assertions: should not crash when effect throws and component is unmounted by render(null) during flush (hooks/test/browser/useEffect.test.jsx)
- No checksums published for release artifacts
- No dependency advisory monitoring
- Off-boarding risk: anonymized user #1
- Outdated (npm): @material-ui/core
- …and 69 more

## Changes since last survey

- 111 commits — 91 feature/other, 20 fixes

## By area

- (repo) — 56 commits
- (root) — 15 commits
- compat/src — 8 commits
- src/diff — 8 commits
- .github/workflows — 6 commits
- compat/test — 4 commits
- hooks/src — 3 commits
- src/dom.d.ts — 3 commits
- debug/src — 2 commits
- jsx-runtime/src — 2 commits
- demo/package-lock.json — 1 commit
- src/constants.js — 1 commit
- src/create-portal.js — 1 commit
- src/jsx.d.ts — 1 commit

## Notable commits

- fix: FIx parameter description in getHookState function
- fix: Fix compat element tag validation
- fix: Fix compressed size comparison with pnpm
- fix: Fix hook state loss when Suspense re-suspends
- fix: Fix perf regression from the attribute/unmount loop golfing
- fix: Merge branch 'main' into JoviDeCroock/fix-catch-error-dirty-ancestor
- fix: Merge branch 'main' into JoviDeCroock/fix-error-boundary-retry-loop
- fix: Merge branch 'main' into JoviDeCroock/fix-mathml-token-elements
- fix: Merge pull request #5206 from upupming/fix/demo-declare-sass
- fix: Merge pull request #5226 from preactjs/JoviDeCroock/fix-catch-error-dirty-ancestor
- fix: Merge pull request #5227 from preactjs/JoviDeCroock/fix-error-boundary-retry-loop
- fix: Merge pull request #5228 from preactjs/JoviDeCroock/fix-mathml-token-elements
- fix: Merge pull request #5239 from preactjs/fix/suspense-preserve-mounted-hooks
- fix: Merge pull request #5254 from preactjs/JoviDeCroock/fix-compressed-size-build
- fix: Revert "Golf encodeEntities down to chained replaces"
- fix: fix(demo): declare the sass dependency vite's scss compilation needs
- fix: fix: anchor the MathML token element regex
- fix: fix: keep the pending error flag until the boundary's retry render
- fix: fix: only treat components with error handlers as error boundaries
- fix: fix: resolve preact dist build in minified tests
- …and 91 more