# Changelog

## Score

- CAI 67 → 68 (+1.1)
- Rubric changed (rubric-2026.09.11 → rubric-2026.09.18) — scores are not directly comparable.

## Lenses

- Code Health 87 → 87 (+0.0)
- Architecture 100 → 99 (-1.4)
- Maturity 70 → 70 (+0.2)
- Readiness 83 → 61 (-21.5)
- Security 53 → 64 (+11.1)
- Domain Modelling 100 → 100 (+0.0)
- Performance 100 (new)

## Resolved (6)

- Dependency hygiene PARTLY measured — npm pinning read, dependency currency not (no pnpm-resolved versions to grade)
- Documentation: no project overview (README.md)
- High CVE: [GHSA redacted] (scripts/ogp/package-lock.json)
- High vulnerability: [GHSA redacted] (scripts/ogp/package-lock.json)
- Hotspot: src/syntax/mod.rs (src/syntax/mod.rs)
- Medium CVE: [CVE redacted] (scripts/ogp/package-lock.json)

## New (4)

- Dependency hygiene PARTLY measured — Cargo dependencies read, dependency currency not (crates.io unreachable)
- High vulnerability: [GHSA redacted] (scripts/ogp/package-lock.json)
- Inconsistent naming convention for commit retrieval operations. The API mixes imperative verbs ('get', 'next', 'random') with inconsistent suffixes ('_commit' vs implicit return). Specifically, 'get_commit' implies fetching a specific item, while 'next_*' and 'random_*' imply iteration or selection from a set. The distinction between 'commit' and 'range_commit' is clear, but the verb choice is inconsistent.
- Inconsistent return types for similar 'lookup' or 'processing' operations. 'Highlighter.highlight' returns a single 'HighlightSpan' (likely a mistake, as highlighting usually produces multiple spans), whereas language lookup methods return 'LanguageSupport'. If 'highlight' is meant to return a collection, it should be consistent with other collection-returning APIs. If it returns a single span, the name 'highlight' is misleading as it suggests a process, not a lookup.

## Changes since last survey

- 6 commits — 6 feature/other, 0 fixes

## By area

- (repo) — 3 commits
- (root) — 3 commits

## Notable commits

- change: Merge pull request #241 from unhappychoice/dependabot/cargo/toml-1.1.6spec-1.1.0
- change: Merge pull request #242 from unhappychoice/dependabot/cargo/toml_edit-0.25.15spec-1.1.0
- change: Merge pull request #243 from unhappychoice/dependabot/cargo/rand-0.10.3
- change: chore(deps): bump rand from 0.10.2 to 0.10.3
- change: chore(deps): bump toml from 1.1.5+spec-1.1.0 to 1.1.6+spec-1.1.0
- change: chore(deps): bump toml_edit