# Changelog

## Score

- CAI 56 → 45 (-11.0)
- Rubric changed (rubric-2026.10.1 → rubric-2026.10.5) — scores are not directly comparable.

## Lenses

- Code Health 74 → 60 (-14.3)
- Architecture 89 → 91 (+1.4)
- Maturity 72 → 46 (-25.7)
- Readiness 37 → 40 (+2.6)
- Security 69 → 62 (-6.7)
- Accessibility 73 → 40 (-33.0)
- Performance 100 → 100 (+0.0)

## Resolved (7)

- Duplicated block (9 lines × 4) (material/overrides/hooks/shortcodes.py)
- Job-level write token spans steps that do not need it
- Leaked secret: signing-key (material/overrides/assets/javascripts/iconsearch_index.json)
- Low CVE: [GHSA redacted] (package-lock.json)
- Low CVE: [GHSA redacted] (package-lock.json)
- Low CVE: [GHSA redacted] (package-lock.json)
- Members sharing a duplicated core (4 members, 50+ identical tokens) (material/overrides/hooks/shortcodes.py)

## New (14)

- Critical CVE: [GHSA redacted] (package-lock.json)
- Duplicated block (10 lines × 2) (material/overrides/hooks/shortcodes.py)
- Duplicated block (10 lines × 2) (material/overrides/hooks/shortcodes.py)
- End-of-life runtime: Node.js 18 (package.json)
- High CVE: [GHSA redacted] (package-lock.json)
- Job-level write token spans steps that do not need it (.github/workflows/build.yml)
- Medium CVE: [GHSA redacted] (package-lock.json)
- Medium CVE: [GHSA redacted] (package-lock.json)
- Medium CVE: [GHSA redacted] (package-lock.json)
- Medium CVE: [GHSA redacted] (package-lock.json)
- Orphaned file (includes/debug/cairo-lookup-linux.py)
- Rotate the exposed credentials — git history can't be un-committed
- Secret: generic-api-key (docs/assets/javascripts/ginseng.js)
- Secret: generic-api-key (docs/assets/javascripts/ginseng.js)

## Changes since last survey

- 3 commits — 3 feature/other, 0 fixes

## By area

- docs/blog — 1 commit
- docs/insiders — 1 commit
- docs/tutorials — 1 commit

## Notable commits

- change: Retired Insiders section
- change: Updated Zensical transition blog posts
- change: Updated getting started and maintenance guidance