# Changelog

> **This is the PUBLIC form of this artifact. Findings are listed in full, but the details of SECURITY findings — which rule fired, in which file, on which line, and how to fix it — are deliberately withheld, and any secret-scanner results are excluded entirely. Where detail is absent here it was REMOVED FOR PUBLICATION; it is not missing from the analysis. The complete artifact is available from the repository owner.**

## Score

- CAI 47 → 36 (-10.9)
- Rubric changed (rubric-2026.08.18 → rubric-2026.08.15) — scores are not directly comparable.

## Lenses

- Code Health 40 → 41 (+0.7)
- Maturity 72 → 59 (-12.7)
- Readiness 47 → 21 (-25.2)
- Security 65 → 64 (-1.0)

## Resolved (25)

- Change coupling: api-key-auth.jsx ↔ basic-auth.jsx (src/core/components/auth/api-key-auth.jsx)
- Change coupling: array-model.jsx ↔ object-model.jsx (src/core/plugins/json-schema-5/components/array-model.jsx)
- Change coupling: array-model.jsx ↔ primitive-model.jsx (src/core/plugins/json-schema-5/components/array-model.jsx)
- Change coupling: index.js ↔ index.js (src/core/plugins/oas3/components/index.js)
- Coverage not included — suite not readable by the collector
- Dependency hygiene not measured — dependency manifest found but not parsed for hygiene
- High CVE: [GHSA redacted] (package-lock.json)
- High: security finding (details withheld)
- High: security finding (details withheld)
- LLM evaluation failed
- Off-boarding risk: anonymized user #1
- addPropertyToResult (cognitive 29) (src/core/plugins/json-schema-2020-12-samples/fn/main.js)
- addPropertyToResult (cyclomatic 18) (src/core/plugins/json-schema-2020-12-samples/fn/main.js)
- authorize (cognitive 21) (src/core/oauth2-authorize.js)
- curlify (cognitive 42) (src/core/plugins/request-snippets/fn.js)
- curlify (cyclomatic 22) (src/core/plugins/request-snippets/fn.js)
- knowledge concentrated in recent work — freshness signal contradicted by repo activity
- mergeJsonSchema (cognitive 42) (src/core/plugins/json-schema-5-samples/fn/index.js)
- run (cognitive 21) (dev-helpers/oauth2-redirect.js)
- sampleFromSchemaGeneric (cognitive 206) (src/core/plugins/json-schema-2020-12-samples/fn/main.js)
- …and 5 more

## New (46)

- Change coupling: JSONSchema.jsx ↔ hoc.jsx (src/core/plugins/json-schema-2020-12/components/JSONSchema/JSONSchema.jsx)
- Change coupling: JSONSchema.jsx ↔ index.js (src/core/plugins/json-schema-2020-12/components/JSONSchema/JSONSchema.jsx)
- Change coupling: JSONSchema.jsx ↔ models.jsx (src/core/plugins/json-schema-2020-12/components/JSONSchema/JSONSchema.jsx)
- Change coupling: actions.js ↔ selectors.js (src/core/plugins/layout/actions.js)
- Change coupling: fn.js ↔ hoc.jsx (src/core/plugins/json-schema-2020-12/fn.js)
- Change coupling: hoc.jsx ↔ index.js (src/core/plugins/json-schema-2020-12/hoc.jsx)
- Change coupling: hoc.jsx ↔ models.jsx (src/core/plugins/json-schema-2020-12/hoc.jsx)
- Change coupling: index.js ↔ models.jsx (src/core/plugins/json-schema-2020-12/index.js)
- Change coupling: reducers.js ↔ selectors.js (src/core/plugins/layout/reducers.js)
- Change coupling: selectors.js ↔ wrap-selectors.js (src/core/plugins/oas3/spec-extensions/selectors.js)
- Dimension evaluation failed
- FileTooLong: core/system.js (src/core/system.js)
- FileTooLong: core/utils.js (test/unit/core/utils.js)
- FileTooLong: fn/index.js (src/core/plugins/json-schema-5-samples/fn/index.js)
- FileTooLong: json-schema-2020-12-samples/fn.js (test/unit/core/plugins/json-schema-2020-12-samples/fn.js)
- FileTooLong: json-schema-2020-12/fn.js (src/core/plugins/json-schema-2020-12/fn.js)
- FileTooLong: spec/actions.js (src/core/plugins/spec/actions.js)
- FileTooLong: spec/selectors.js (src/core/plugins/spec/selectors.js)
- FileTooLong: spec/selectors.js (test/unit/core/plugins/spec/selectors.js)
- FileTooLong: utils/index.js (src/core/utils/index.js)
- …and 26 more

## Changes since last survey

- 8 commits — 7 feature/other, 1 fixes

## By area

- (root) — 6 commits
- .github/workflows — 2 commits

## Notable commits

- fix: fix(deps): bump swagger-client to v3.37.8 (#10980)
- change: chore(ci): pin 3rd party github actions (#10989)
- change: chore(deps): bump ip-address from 10.2.0 to 10.4.0 (#10981)
- change: chore(deps): bump undici, @release-it/conventional-changelog and release-it (#10982)
- change: chore(deps): configure allowed install-time lifecycle scripts (#10988)
- change: chore(deps-dev): bump fast-uri from 3.1.4 to 3.1.5 (#10983)
- change: chore(release): cut the 5.32.12 release
- change: chore: rename dafault branch from master to main (#10985)