# Changelog

> **This is the PUBLIC form of this artifact. Findings are listed in full, but the details of SECURITY findings — which rule fired, in which file, on which line, and how to fix it — are deliberately withheld, and any secret-scanner results are excluded entirely. Where detail is absent here it was REMOVED FOR PUBLICATION; it is not missing from the analysis. The complete artifact is available from the repository owner.**

## Score

- CAI 39 → 35 (-3.9)
- Rubric changed (rubric-2026.08.18 → rubric-2026.08.15) — scores are not directly comparable.

## Lenses

- Code Health 64 → 65 (+1.5)
- Maturity 64 → 57 (-7.5)
- Readiness 25 → 13 (-11.7)
- Security 55 → 52 (-3.4)

## Resolved (27)

- Change coupling clique: index.d.ts, index.d.ts, index.d.ts (extras/exports/material-symbols-outlined/index.d.ts)
- Change coupling: custom-sw.js ↔ custom-sw.ts (app-vite/templates/pwa/js/sw/custom-sw.js)
- Change coupling: electron-main.js ↔ electron-main.ts (app-vite/templates/electron/js/electron-main.js)
- Change coupling: github.vue ↔ youtube.vue (docs/src/layouts/gallery/github.vue)
- Change coupling: google-news.vue ↔ youtube.vue (docs/src/layouts/gallery/google-news.vue)
- Coverage not included — suite not readable by the collector
- Dependency hygiene not measured — dependency manifest found but not parsed for hygiene
- Further orphaned files (smaller)
- Further sole-owners (lower concentration)
- High CVE: [GHSA redacted] (pnpm-lock.yaml)
- High CVE: [GHSA redacted] (pnpm-lock.yaml)
- High CVE: [GHSA redacted] (pnpm-lock.yaml)
- High CVE: [GHSA redacted] (ui/playground/src-ssr/pnpm-lock.yaml)
- High CVE: [GHSA redacted] (pnpm-lock.yaml)
- High CVE: [GHSA redacted] (pnpm-lock.yaml)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- …and 7 more

## New (45)

- (anonymous) (cognitive 19) (vite-plugin/src/scss-transform.js)
- (anonymous) (cyclomatic 16) (vite-plugin/src/scss-transform.js)
- Boundary-crossing change coupling: menu.js ↔ directives.js (docs/src/assets/menu.js)
- Change coupling: generator.composable.js ↔ generator.generic.js (ui/testing/specs/generators/generator.composable.js)
- Change coupling: quasar.config.js ↔ quasar.config.ts (app-vite/playground-js/quasar.config.js)
- Change coupling: svg-eva-icons.js ↔ svg-material-icons.js (ui/icon-set/svg-eva-icons.js)
- Change coupling: svg-material-symbols-outlined.js ↔ svg-material-symbols-rounded.js (ui/icon-set/svg-material-symbols-outlined.js)
- Change coupling: svg-material-symbols-outlined.js ↔ svg-material-symbols-sharp.js (ui/icon-set/svg-material-symbols-outlined.js)
- Change coupling: svg-material-symbols-rounded.js ↔ svg-material-symbols-sharp.js (ui/icon-set/svg-material-symbols-rounded.js)
- Dimension evaluation failed
- FileTooLong: components/DocApiEntry.js (docs/src/components/DocApiEntry.js)
- FileTooLong: lib/quasar-config-file.js (app-vite/lib/quasar-config-file.js)
- FileTooLong: specs/astParser.js (ui/testing/specs/astParser.js)
- FileTooLong: specs/specs.utils.js (ui/testing/specs/specs.utils.js)
- FileTooLong: specs/testFile.js (ui/testing/specs/testFile.js)
- High CVE: [GHSA redacted] (pnpm-lock.yaml)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- …and 25 more

## Changes since last survey

- 92 commits — 54 feature/other, 38 fixes

## By area

- ui/src — 24 commits
- app-vite/lib — 14 commits
- (root) — 10 commits
- .github/workflows — 8 commits
- vite-plugin/testing — 5 commits
- create-quasar/templates — 4 commits
- vite-plugin/src — 4 commits
- create-quasar/test — 3 commits
- utils/update-notifier — 3 commits
- app-vite/test — 2 commits
- cli/lib — 2 commits
- ui/playground — 2 commits
- ui/testing — 2 commits
- app-vite/package.json — 1 commit
- cli/package.json — 1 commit
- cli/test — 1 commit
- create-quasar/lib — 1 commit
- docs/src — 1 commit
- docs/src-ssr — 1 commit
- icongenie/pnpm-workspace.yaml — 1 commit

## Notable commits

- fix: feat(app-vite): non-interactive "quasar mode add" + CLI correctness fixes
- fix: fix(QCheckbox;QToggle;QRadio): label wrapped components do not work as expected anymore #18500
- fix: fix(QDate): events rendered no marker unless event-color was also set
- fix: fix(QDate): undefined model rejected by the validator
- fix: fix(QEditor): a toolbar dropdown crashed the render on an unknown option token
- fix: fix(QFile): file/selected slot scopes "ref" value
- fix: fix(QRange): handle "null" as model value
- fix: fix(QTable): non-virtual scrollTo() threw on a non-numeric index
- fix: fix(QTable): scrollTo() was a no-op without virtual-scroll-sticky-size-start
- fix: fix(QTime): default value to match docs
- fix: fix(QTree): setTicked() did nothing unless ticked was v-model bound
- fix: fix(QUploader): factory() leaked the upload thread
- fix: fix(QUploader): no "failed" event when the URL was missing
- fix: fix(TouchPan;TouchSwipe): stop shielding the page from pointer events after the mouse gesture ended #18496
- fix: fix(app-vite): AE api.registerDescribeApi() -> "quasar describe" could not resolve relative API file paths
- fix: fix(app-vite): AE detection of a missing package -> unbounded recursion, ~20-45s stall
- fix: fix(app-vite): Electron dev on Windows -> UNRESOLVED_ENTRY on the virtual main entry #18504
- fix: fix(app-vite): Electron dev on macOS -> possible deadlock when app code has circular imports #18505
- fix: fix(app-vite): PWA -> navigateFallbackDenylist never matched the workbox runtime chunk
- fix: fix(app-vite): SSR/SSG dev server corrupted rendered HTML containing "$" patterns
- …and 72 more