# Changelog

> **This is the PUBLIC form of this artifact. Findings are listed in full, but the details of SECURITY findings — which rule fired, in which file, on which line, and how to fix it — are deliberately withheld, and any secret-scanner results are excluded entirely. Where detail is absent here it was REMOVED FOR PUBLICATION; it is not missing from the analysis. The complete artifact is available from the repository owner.**

## Score

- CAI 45 → 44 (-1.6)
- Rubric changed (rubric-2026.08.18 → rubric-2026.08.19) — scores are not directly comparable.

## Lenses

- Code Health 83 → 83 (-0.0)
- Architecture 92 → 93 (+0.3)
- Maturity 75 → 79 (+4.3)
- Readiness 29 → 30 (+0.8)
- Security 58 → 47 (-11.3)
- Accessibility 45 → 45 (-0.0)

## Resolved (18)

- Change coupling: History.tsx ↔ Results.tsx (language-tour/src/components/execution/History.tsx)
- Change coupling: PopcornProvider.tsx ↔ vite.config.ts (language-tour/src/context/popcorn/PopcornProvider.tsx)
- Change coupling: beam.ts ↔ popcorn.ts (otp/js/src/beam.ts)
- Dimension evaluation failed
- Duplicated block (11 lines × 3) (examples/local-lv-burrito/lib/burrito_web/live/ordering_form_component.ex)
- Duplicated block (11 lines × 7) (examples/local-lv-burrito/lib/burrito_web/telemetry.ex)
- Duplicated block (15 lines × 7) (examples/local-lv-checkout/lib/local_lv_checkout_web/components/core_components.ex)
- Duplicated block (19 lines × 2) (examples/local-lv-burrito/local/lib/burrito_live.ex)
- Duplicated block (5 lines × 2) (popcorn/elixir/lib/popcorn/core_erlang_utils.ex)
- Duplicated block (6 lines × 7) (examples/local-lv-checkout/lib/local_lv_checkout_web/components/core_components.ex)
- Duplicated block (8 lines × 2) (examples/local-lv-burrito/lib/burrito_web/live/sync_table_live.ex)
- Duplicated block (8 lines × 2) (otp/utils/popcorn_server.ex)
- Further sole-owners (lower concentration)
- High: security finding (details withheld)
- Hotspot: otp/js/src/errors.ts (otp/js/src/errors.ts)
- Off-boarding risk: anonymized user #1
- Off-boarding risk: anonymized user #2
- The README is a Popdoc installation guide and does not mention how to run the Popcorn server locally or serve docs from a web server. (popdoc/README.md)

## New (75)

- Change coupling: Results.tsx ↔ PopcornProvider.tsx (language-tour/src/components/execution/Results.tsx)
- Critical CVE: [GHSA redacted] (landing-page/package-lock.json)
- Critical CVE: [GHSA redacted] (landing-page/package-lock.json)
- Critical CVE: [GHSA redacted] (pnpm-lock.yaml)
- Duplicated block (10 lines × 3) (examples/local-lv-burrito/lib/burrito_web/live/ordering_form_component.ex)
- Duplicated block (10 lines × 7) (examples/local-lv-burrito/lib/burrito_web/telemetry.ex)
- Duplicated block (13 lines × 7) (examples/local-lv-checkout/lib/local_lv_checkout_web/components/core_components.ex)
- Duplicated block (17 lines × 2) (examples/local-lv-burrito/local/lib/burrito_live.ex)
- Duplicated block (5 lines × 7) (examples/local-lv-checkout/lib/local_lv_checkout_web/components/core_components.ex)
- Duplicated block (7 lines × 2) (examples/local-lv-burrito/lib/burrito_web/live/sync_table_live.ex)
- Duplicated block (8 lines × 2) (popcorn/utils/popcorn_server.ex)
- Duplicated block (9 lines × 6) (examples/local-lv-burrito/lib/burrito_web/telemetry.ex)
- High CVE: [GHSA redacted] (landing-page/package-lock.json)
- High CVE: [GHSA redacted] (local-live-view/mix.lock)
- High CVE: [GHSA redacted] (landing-page/package-lock.json)
- High CVE: [GHSA redacted] (pnpm-lock.yaml)
- High CVE: [GHSA redacted] (local-live-view/mix.lock)
- High CVE: [GHSA redacted] (landing-page/package-lock.json)
- High CVE: [GHSA redacted] (pnpm-lock.yaml)
- High CVE: [GHSA redacted] (pnpm-lock.yaml)
- …and 55 more

## Changes since last survey

- 15 commits — 14 feature/other, 1 fixes

## By area

- popcorn/js — 4 commits
- otp/js — 3 commits
- .github/actions — 1 commit
- examples/game-of-life-otp — 1 commit
- local-live-view/lib — 1 commit
- otp/elixir — 1 commit
- otp/patches — 1 commit
- popcorn-2/elixir — 1 commit
- scripts/build-beam.sh — 1 commit
- scripts/stdlib.sh — 1 commit

## Notable commits

- fix: scripts: fix tarball creation (#728)
- change: [LLV] Figure out how to assign IDs to LLVs (#702)
- change: ci: use release build for e2e (#729)
- change: otp: add a Req adapter backed by browser fetch (#722)
- change: otp: avoid nested BEAM compression (#714)
- change: otp: disable distribution start (#719)
- change: otp: honor MIX_ENV when packing apps (#727)
- change: otp: increase pool size (#715)
- change: otp: intercept spawning OS processes (#720)
- change: otp: migrate examples (#733)
- change: otp: move into popcorn/ (#724)
- change: otp: restore closure minification (#731)
- change: otp: wait for app boot (#732)
- change: popcorn: move to popcorn-2 (#723)
- change: scripts: remove closure minification (#730)