# Changelog

## Baseline

- First survey — no prior run to compare against. CAI 55.

## Lenses

- Code Health 78
- Architecture 52
- Maturity 70
- Readiness 71
- Security 67
- Domain Modelling 100
- Accessibility 47

## Changes since last survey

- 300 commits — 203 feature/other, 97 fixes

## By area

- web/src — 155 commits
- server/router — 54 commits
- (root) — 30 commits
- .github/workflows — 7 commits
- proto/gen — 7 commits
- internal/ai — 4 commits
- store/db — 4 commits
- store/seed — 4 commits
- store/test — 4 commits
- internal/filter — 3 commits
- web/package.json — 3 commits
- web/tests — 3 commits
- .github/ISSUE_TEMPLATE — 2 commits
- docs/plans — 2 commits
- internal/httpgetter — 2 commits
- internal/scheduler — 2 commits
- cmd/memos — 1 commit
- docs/identity-provider-bootstrap.md — 1 commit
- docs/issues — 1 commit
- internal/base — 1 commit

## Notable commits

- fix: chore: fix coderabbit logo for light and dark theme  (#5954)
- fix: chore: fix linter
- fix: fix(api): align resource IDs with AIP conventions
- fix: fix(api): appease image size lint
- fix: fix(api): make credentials write-only and restrict sensitive settings to admins
- fix: fix(api): reduce memory pressure in backend paths
- fix: fix(api): restrict user email exposure to self and admins (#5784)
- fix: fix(api): show clean RPC error messages
- fix: fix(api): switch user resource names to usernames (#5779)
- fix: fix(api): tolerate missing related users in memo conversions (#5809)
- fix: fix(api): update UID compatibility
- fix: fix(attachments): link media to source memos
- fix: fix(auth): enforce private instance access boundaries
- fix: fix(auth): harden authorization and username validation (#5890)
- fix: fix(auth): provision SSO users atomically (#6114)
- fix: fix(auth): stabilize SSO option loading
- fix: fix(auth): support OAuth client auth auto-detection
- fix: fix(ci): stamp canary image with semantic version
- fix: fix(cors): open API to any origin for token auth, keep cookies same-origin
- fix: fix(editor): align CodeMirror markdown event handling
- …and 280 more