# Changelog

## Score

- CAI 43 → 49 (+6.3)
- Rubric changed (rubric-2026.09.11 → rubric-2026.09.18) — scores are not directly comparable.

## Lenses

- Code Health 94 → 95 (+0.8)
- Architecture 88 → 92 (+3.5)
- Maturity 62 → 62 (+0.0)
- Readiness 52 → 54 (+2.3)
- Security 39 → 73 (+33.6)
- Accessibility 32 → 32 (+0.0)

## Resolved (116)

- Critical CVE: [GHSA redacted] (pnpm-lock.yaml)
- Critical CVE: [GHSA redacted] (pnpm-lock.yaml)
- Critical CVE: [GHSA redacted] (pnpm-lock.yaml)
- Critical CVE: [GHSA redacted] (pnpm-lock.yaml)
- Critical CVE: [GHSA redacted] (pnpm-lock.yaml)
- Critical CVE: [GHSA redacted] (pnpm-lock.yaml)
- Critical CVE: [GHSA redacted] (pnpm-lock.yaml)
- Critical vulnerability: [GHSA redacted] (pnpm-lock.yaml)
- Documentation: no installation or build instructions (README.md)
- High CVE: [GHSA redacted] (pnpm-lock.yaml)
- High CVE: [GHSA redacted] (pnpm-lock.yaml)
- High CVE: [GHSA redacted] (pnpm-lock.yaml)
- High CVE: [GHSA redacted] (pnpm-lock.yaml)
- High CVE: [GHSA redacted] (pnpm-lock.yaml)
- High CVE: [GHSA redacted] (pnpm-lock.yaml)
- High CVE: [GHSA redacted] (pnpm-lock.yaml)
- High CVE: [GHSA redacted] (pnpm-lock.yaml)
- High CVE: [GHSA redacted] (pnpm-lock.yaml)
- High CVE: [GHSA redacted] (pnpm-lock.yaml)
- High CVE: [GHSA redacted] (pnpm-lock.yaml)
- …and 96 more

## New (12)

- Critical CVE: [GHSA redacted] (pnpm-lock.yaml)
- Documentation: no architecture or design documentation (packages/icons-sprite/README.md)
- Documentation: no architecture or design documentation (packages/icons-svelte-runes/README.md)
- High CVE: [GHSA redacted] (pnpm-lock.yaml)
- High CVE: [GHSA redacted] (pnpm-lock.yaml)
- High CVE: [GHSA redacted] (pnpm-lock.yaml)
- High CVE: [GHSA redacted] (pnpm-lock.yaml)
- Low CVE: [GHSA redacted] (pnpm-lock.yaml)
- Medium CVE: [GHSA redacted] (pnpm-lock.yaml)
- Medium CVE: [GHSA redacted] (pnpm-lock.yaml)
- Medium vulnerability: [GHSA redacted] (pnpm-lock.yaml)
- No ADRs found

## Changes since last survey

- 25 commits — 19 feature/other, 6 fixes

## By area

- icons/outline — 11 commits
- (root) — 8 commits
- .github/ISSUE_TEMPLATE — 1 commit
- icons/filled — 1 commit
- packages/icons-preact — 1 commit
- packages/icons-solidjs — 1 commit
- packages/icons-webfont — 1 commit
- test/test-react-rsc — 1 commit

## Notable commits

- fix: Fix `square-dashed` icon drawn as a solid square (#1614)
- fix: Fix filled `home` webfont glyph having zero width in Chrome (#1616)
- fix: Run tests in CI, fix ReactSVG type rot, add type and RSC guards (#1579)
- fix: Update dependencies to fix Dependabot alerts (#1612)
- fix: fix(solidjs): preserve JSX source export for Vite SSR (#1590)
- fix: fix: correct invalid unicode codepoint for align-right-2 icon (#1583)
- change: Add `airpods-l`, `airpods-r`, `folder-stats`, `folder-user`, `map-pinned`, `reduce-motion`, `reference-image` and `secret-phrases` icons (#1609)
- change: Add `cash-coin`, `edit-bulk` and `sticker-smile` icons (#1607)
- change: Add `duplicate`, `folder-ai`, `folder-sparkle`, `git-branch-*`, `git-merge-queue`, `git-pull-request-*`, `message-*-ai`, `message-*-sparkle`, `model-ai`, `pencil-ai` and `stack-*` icons (#1613)
- change: Add `gpu` and `gpu-2` icons (#1606)
- change: Add `orbit`, `orbit-vertical` and `orbits` icons (#1605)
- change: Add `voice` and `voice-2` icons (#1610)
- change: Add security policy (#1611)
- change: Bump @angular/common from 21.2.5 to 21.2.20 (#1596)
- change: Bump @angular/compiler from 21.2.5 to 21.2.20 (#1594)
- change: Bump @angular/core from 21.2.5 to 21.2.20 (#1595)
- change: Bump adm-zip from 0.5.16 to 0.6.1 (#1604)
- change: Bump astro from 7.0.9 to 7.2.8 (#1593)
- change: Bump svgo from 4.0.0 to 4.1.0 (#1592)
- change: Bump vitest from 4.0.16 to 4.1.11 (#1603)
- …and 5 more