# Changelog

## Score

- CAI 46 → 47 (+0.7)

## Lenses

- Code Health 50 → 50 (+0.0)
- Architecture 78 → 78 (+0.0)
- Maturity 55 → 55 (+0.0)
- Readiness 42 → 43 (+0.6)
- Security 71 → 74 (+2.9)
- Domain Modelling 53 → 60 (+6.6)
- Performance 43 → 43 (+0.0)

## Resolved (12)

- High CVE: System.Security.Cryptography.Xml 9.0.0
- High CVE: System.Security.Cryptography.Xml 9.0.0
- High CVE: System.Security.Cryptography.Xml 9.0.0
- High CVE: System.Security.Cryptography.Xml 9.0.0
- High CVE: System.Security.Cryptography.Xml 9.0.0
- High CVE: System.Security.Cryptography.Xml 9.0.0
- High CVE: System.Security.Cryptography.Xml 9.0.0
- High CVE: System.Security.Cryptography.Xml 9.0.0
- Inconsistent naming for event-related components. Some use 'Event' (e.g., AsyncEventSequencer, AsyncEventQueueDispatchListener), while others use 'EventStore' or 'EventStream'. The term 'Event' is used in multiple contexts (async processing, storage, upgrades). Specifically, 'EventStore' is used for the storage abstraction, while 'EventUpgrade' is used for migrations. The term 'Event' is also used in 'EventMessage', 'EventSourceState', 'EventStreamRow'. This creates a mix of 'Event' and 'EventStore' terminology.
- Inconsistent naming for job scheduling components. 'IJob' is used for the job definition, while 'JobScheduler' is used for the scheduler. However, 'HangfireJobScheduler' and 'InMemoryJobScheduler' implement the scheduler, but the interface for the scheduler is not explicitly named 'IJobScheduler' in the list (though it might be implied). More importantly, 'JobsModule' is a configuration class, while others are interfaces or implementations. The term 'Job' is used, but 'Scheduler' is also used. A more consistent pattern would be 'IJob' vs 'IJobScheduler' vs 'JobDefinition'.
- ObsoleteWithoutCallers (Providers/AspNetCore/Revo.AspNetCore/Core/HangfireJobActivator.cs)
- Off-boarding risk: anonymized user #1

## New (12)

- High CVE: System.Security.Cryptography.Xml 9.0.0
- High CVE: System.Security.Cryptography.Xml 9.0.0
- High CVE: System.Security.Cryptography.Xml 9.0.0
- High CVE: System.Security.Cryptography.Xml 9.0.0
- High CVE: System.Security.Cryptography.Xml 9.0.0
- High CVE: System.Security.Cryptography.Xml 9.0.0
- High CVE: System.Security.Cryptography.Xml 9.0.0
- High CVE: System.Security.Cryptography.Xml 9.0.0
- Off-boarding risk: anonymized user #1
- The concept of a soft-delete flag is named 'IsDeleted' in the Saga test class, but 'IsDeleted' is also used for the IAggregateRoot interface. While this is consistent, the test class naming 'Saga1' is a generic placeholder name that differs from the specific domain concept 'Saga1' in the test, which is acceptable for tests but worth noting if it appears in production code.
- The identifier for a Saga is referred to as 'Id' in the test class 'Saga1' but as 'Keys' in the 'ISaga' interface. This suggests a potential inconsistency between the concrete implementation/test and the interface definition.
- The property 'IsDeleted' is used in both the test class and the interface, which is consistent. However, the test class 'Saga1' uses 'IsDeleted' while the interface 'IAggregateRoot' also uses 'IsDeleted'. This is consistent.

## API surface

- Unchanged — 5 HTTP endpoints

## Architecture

- Unchanged — 2 containers · 3 contexts · 2 edges