# Changelog

> **This is the PUBLIC form of this artifact. Findings are listed in full, but the details of SECURITY findings — which rule fired, in which file, on which line, and how to fix it — are deliberately withheld, and any secret-scanner results are excluded entirely. Where detail is absent here it was REMOVED FOR PUBLICATION; it is not missing from the analysis. The complete artifact is available from the repository owner.**

## Score

- CAI 55 → 57 (+2.2)
- Rubric changed (rubric-2026.08.18 → rubric-2026.08.19) — scores are not directly comparable.

## Lenses

- Code Health 53 → 53 (+0.0)
- Architecture 99 → 99 (+0.0)
- Maturity 72 → 71 (-0.5)
- Readiness 44 → 49 (+5.8)
- Security 74 → 70 (-4.2)

## Resolved (8)

- High CVE: [GHSA redacted] (go.mod)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- LLM evaluation failed
- Off-boarding risk: anonymized user #1

## New (16)

- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- Hotspot: d2cli/main.go (d2cli/main.go)
- Medium IaC: CKV_DOCKER_2 (ci/release/docker/Dockerfile)
- Medium IaC: CKV_DOCKER_3 (ci/release/linux/Dockerfile)
- Medium IaC: CKV_DOCKER_4 (ci/release/docker/Dockerfile)
- Medium IaC: CKV_DOCKER_7 (ci/release/docker/Dockerfile)
- No SBOM
- Off-boarding risk: anonymized user #1
- The library examples directory is referenced but only one example (1-d2lib) is shown with no links to the other two (d2oracle, lowlevel). (docs/examples/lib/README.md)
- Unpinned build actions

## Changes since last survey

- 37 commits — 24 feature/other, 13 fixes

## By area

- (repo) — 17 commits
- .github/workflows — 8 commits
- ci/release — 6 commits
- (root) — 3 commits
- ci/sub — 1 commit
- d2js/js — 1 commit
- e2etests-cli/main_test.go — 1 commit

## Notable commits

- fix: Fix package installation links
- fix: Merge pull request #2790 from d2lang/agent/fix-distribution-links
- fix: Merge pull request #2793 from d2lang/agent/fix-cjs-asset-path
- fix: Merge pull request #2794 from d2lang/agent/fix-npm-stage-policy
- fix: Merge pull request #2795 from d2lang/agent/fix-npm-stage-notify
- fix: Merge pull request #2796 from d2lang/agent/fix-wasm-opt-memory
- fix: Merge pull request #2799 from d2lang/agent/fix-playwright-continuity
- fix: Merge pull request #2800 from d2lang/agent/fix-playwright-cache-permissions
- fix: fix continuity browser cache ownership
- fix: fix d2js CJS asset paths
- fix: fix docker continuity playwright bootstrap
- fix: fix npm stage CI execution
- fix: fix npm stage action policy
- change: Merge pull request #2789 from d2lang/agent/d2lang-link-migration
- change: Merge pull request #2791 from d2lang/agent/update-transferred-dependencies
- change: Merge pull request #2792 from d2lang/agent/npm-trusted-publishing
- change: Merge pull request #2797 from d2lang/agent/remove-legacy-npm-nightly
- change: Merge pull request #2798 from d2lang/agent/docker-continuity-test
- change: Merge pull request #2801 from d2lang/agent/migrate-playwright-go-061
- change: Merge pull request #2802 from d2lang/agent/docker-production-workflow
- …and 17 more