# Changelog

## Score

- CAI 46 → 47 (+1.3)
- Rubric changed (rubric-2026.08.18 → rubric-2026.08.19) — scores are not directly comparable.

## Lenses

- Code Health 73 → 73 (+0.0)
- Architecture 83 → 83 (+0.0)
- Maturity 41 → 41 (+0.0)
- Readiness 45 → 53 (+7.7)
- Security 42 → 43 (+1.0)
- Accessibility 56 → 64 (+8.3)

## Resolved (14)

- High CVE: [GHSA redacted] (Client/package-lock.json)
- High CVE: [GHSA redacted] (Client/package-lock.json)
- High CVE: [GHSA redacted] (Client/package-lock.json)
- Medium CVE: [GHSA redacted] (Client/package-lock.json)
- Medium CVE: [GHSA redacted] (Client/package-lock.json)
- Medium CVE: [GHSA redacted] (Client/package-lock.json)
- Medium CVE: [GHSA redacted] (Client/package-lock.json)
- Medium CVE: [GHSA redacted] (Client/package-lock.json)
- Medium CVE: [GHSA redacted] (Client/package-lock.json)
- Medium CVE: [GHSA redacted] (Client/package-lock.json)
- Medium CVE: [GHSA redacted] (Client/package-lock.json)
- Medium CVE: [GHSA redacted] (Client/package-lock.json)
- Medium CVE: [GHSA redacted] (Client/package-lock.json)
- Medium vulnerability: [GHSA redacted] (Client/package-lock.json)

## New (23)

- Critical CVE: [GHSA redacted] (Client/package-lock.json)
- High CVE: [GHSA redacted] (Client/package-lock.json)
- High CVE: [GHSA redacted] (Client/package-lock.json)
- High CVE: [GHSA redacted] (Client/package-lock.json)
- High CVE: [GHSA redacted] (Client/package-lock.json)
- High CVE: [GHSA redacted] (Client/package-lock.json)
- High CVE: [GHSA redacted] (Client/package-lock.json)
- High CVE: [GHSA redacted] (Client/package-lock.json)
- High CVE: [GHSA redacted] (Client/package-lock.json)
- High CVE: [GHSA redacted] (Client/package-lock.json)
- High CVE: [GHSA redacted] (Client/package-lock.json)
- High CVE: [GHSA redacted] (Client/package-lock.json)
- Inconsistent naming for retrieval operations. 'Get' is used for generic repository retrieval, while 'GetItem' is used for cache retrieval. This creates a naming collision in intent (both retrieve data) but differs in specificity and genericity.
- Medium CVE: [GHSA redacted] (Client/package-lock.json)
- Medium CVE: [GHSA redacted] (Client/package-lock.json)
- Medium IaC: CKV2_GHA_1 (.github/workflows/docker-image.yml)
- Medium IaC: CKV2_GHA_1 (.github/workflows/dotnet.yml)
- Medium IaC: CKV_DOCKER_3 (API/Dockerfile)
- Medium IaC: CKV_DOCKER_3 (Client/Dockerfile)
- Medium IaC: CKV_DOCKER_7 (Client/Dockerfile)
- …and 3 more

## API surface

- Unchanged — 6 HTTP endpoints