# Changelog

> **This is the PUBLIC form of this artifact. Findings are listed in full, but the details of SECURITY findings — which rule fired, in which file, on which line, and how to fix it — are deliberately withheld, and any secret-scanner results are excluded entirely. Where detail is absent here it was REMOVED FOR PUBLICATION; it is not missing from the analysis. The complete artifact is available from the repository owner.**

## Score

- CAI 56 → 55 (-0.4)

## Lenses

- Code Health 46 → 47 (+0.4)
- Architecture 98 → 98 (+0.1)
- Maturity 75 → 78 (+3.1)
- Readiness 58 → 58 (+0.1)
- Security 74 → 65 (-9.2)
- Accessibility 56 → 56 (+0.0)
- Performance 100 → 100 (+0.0)

## Resolved (9)

- Duplicated block (9–13 lines × 2) (crates/liteparse/src/markdown_layout/tables.rs)
- Hotspot: crates/pdfium/src/page.rs (crates/pdfium/src/page.rs)
- Hotspot: packages/node/src/cli-json.ts (packages/node/src/cli-json.ts)
- Medium vulnerability: RUSTSEC-2026-0187 (Cargo.lock)
- Off-boarding risk: anonymized user #1
- Outdated: pyo3
- Workflow token grant is wider than its jobs use
- liteparse::figure_cluster::detect_figure_rects (cognitive 31) (crates/liteparse/src/figure_cluster.rs)
- liteparse::figure_cluster::detect_figure_rects (cyclomatic 20) (crates/liteparse/src/figure_cluster.rs)

## New (44)

- Critical CVE: [GHSA redacted] (ocr/indraocr/uv.lock)
- Critical vulnerability: [GHSA redacted] (ocr/indraocr/uv.lock)
- Duplicated block (11–15 lines × 2) (crates/liteparse/src/markdown_layout/tables.rs)
- FunctionTooLong: liteparse::markdown_layout::tables::union_header_from_above (crates/liteparse/src/markdown_layout/tables.rs)
- High CVE: [GHSA redacted] (ocr/indraocr/uv.lock)
- High CVE: [GHSA redacted] (ocr/indraocr/uv.lock)
- High IaC: DS-0002 (ocr/indraocr/Dockerfile)
- High: security finding (details withheld)
- Low IaC: DS-0026 (ocr/indraocr/Dockerfile)
- Medium CVE: RUSTSEC-2026-0381 (Cargo.lock)
- Medium CVE: RUSTSEC-2026-0382 (Cargo.lock)
- Medium CVE: RUSTSEC-2026-0383 (Cargo.lock)
- Medium IaC: WD-DOCKER-0003 (ocr/indraocr/Dockerfile)
- Medium advisory (unsound): RUSTSEC-2026-0386 (Cargo.lock)
- Medium advisory (unsound): RUSTSEC-2026-0395 (Cargo.lock)
- Medium advisory (unsound): RUSTSEC-2026-0396 (Cargo.lock)
- Medium advisory (unsound): RUSTSEC-2026-0397 (Cargo.lock)
- Medium advisory (unsound): RUSTSEC-2026-0399 (Cargo.lock)
- Medium advisory (unsound): RUSTSEC-2026-0400 (Cargo.lock)
- Medium advisory (unsound): RUSTSEC-2026-0401 (Cargo.lock)
- …and 24 more

## Changes since last survey

- 21 commits — 7 feature/other, 14 fixes

## By area

- (repo) — 10 commits
- crates/liteparse — 6 commits
- (root) — 3 commits
- ocr/indraocr — 1 commit
- packages/node — 1 commit

## Notable commits

- fix: Merge pull request #490 from moah0911/fix/487-borderless-two-level-header
- fix: Merge pull request #506 from cestercian/fix/split-backward-jump-after-short-run
- fix: Merge pull request #507 from hebbia/hebbia/table-fixes
- fix: Merge pull request #509 from mkh09353/fix/markdown-dropped-text
- fix: Merge pull request #514 from OsamaAnsar/fix/node-cli-batch-parse-and-version
- fix: Merge pull request #517 from run-llama/logan/render-forms-fix
- fix: Merge pull request #518 from run-llama/fix/ruled-table-note-row
- fix: Merge remote-tracking branch 'origin/main' into fix/markdown-dropped-text
- fix: fix(markdown): don't demote a heading over a pending paragraph
- fix: fix(markdown): hand back trimmed cells only from accepted rows; escape interstitials
- fix: fix(markdown): keep the text of every line a borderless table run consumes
- fix: fix(node): batch-parse output collisions, unsupported extensions, --version
- fix: fix: improve rendering for forms nesting
- fix: refactor: trim comments and redundant checks in two-level header fix
- change: Don't end ruled tables at a lone mid-table note row
- change: Merge pull request #508 from gun29may/feat/indraocr-server
- change: Merge pull request #515 from run-llama/dependabot/cargo/lopdf-0.42.0
- change: bump pdfium version
- change: chore(deps): bump lopdf from 0.38.0 to 0.42.0
- change: feat(ocr): add Indra OCR server (ocr/indraocr)
- …and 1 more

## Architecture

- Unchanged — 0 containers · 2 contexts · 0 edges