# Changelog

## Score

- CAI 60 → 59 (-1.2)
- Rubric changed (rubric-2026.10.1 → rubric-2026.10.5) — scores are not directly comparable.

## Lenses

- Code Health 84 → 65 (-19.2)
- Architecture 81 → 81 (-0.0)
- Maturity 71 → 67 (-3.7)
- Readiness 52 → 52 (+0.0)
- Security 66 → 66 (-0.1)
- Domain Modelling 100 → 100 (+0.0)
- Accessibility 60 → 60 (+0.0)

## Resolved (3)

- Documentation: contradicts the code (docs/changelog-archive/CHANGELOG-1.x.md)
- Medium IaC: WD-COMPOSE-0002 (docker-compose.yml)
- Workflow token permissions not restricted

## New (7)

- Medium IaC: WD-COMPOSE-0002 (docker-compose.yml)
- Medium IaC: WD-COMPOSE-0002 (docker-compose.yml)
- Workflow token permissions not restricted (.github/workflows/ci-docker-image-build.yml)
- Workflow token permissions not restricted (.github/workflows/ci.yml)
- Workflow token permissions not restricted (.github/workflows/publish-docker-image.yml)
- Workflow token permissions not restricted (.github/workflows/publish-openapi-spec.yml)
- Workflow token permissions not restricted (.github/workflows/publish-release.yml)

## Changes since last survey

- 13 commits — 11 feature/other, 2 fixes

## By area

- (root) — 8 commits
- docs/swagger — 2 commits
- (repo) — 1 commit
- module/CLI — 1 commit
- module/Core — 1 commit

## Notable commits

- fix: Fix API docs for mercure version
- fix: Fix coding styles
- change: Add both mercure 0 and mercure 1 to dev containers
- change: Add mercure auth cookie
- change: Add support for Mercure 1.0
- change: Define trusted issuer for mercure
- change: Merge pull request #2672 from acelaya-forks/mercure-1-support
- change: Remove no-longer-needed mercure cookie_name directive
- change: Rollback addition of mercure auth cookie
- change: Update API docs with mercure authCookieName
- change: Update LICENSE
- change: Update installer
- change: Update to latest shlink-common