# Changelog

## Score

- CAI 63 → 59 (-4.0)
- Rubric changed (rubric-2026.10.1 → rubric-2026.10.5) — scores are not directly comparable.

## Lenses

- Code Health 100 → 76 (-24.3)
- Architecture 100 → 100 (+0.0)
- Maturity 69 → 65 (-3.6)
- Readiness 44 → 48 (+4.1)
- Security 88 → 66 (-21.4)

## Resolved (1)

- Workflow token permissions not restricted

## New (5)

- Ambiguous or overlapping configuration keys. `jsMappings` (in `ScalaJSWeb.autoImport`) and `scalaJSPipeline` (in `WebScalaJS.autoImport`) likely refer to the same underlying concept of mapping source files to output artifacts. The split across two different `autoImport` objects (which are likely companion objects to the two plugin objects) creates confusion about which key to use.
- Duplicate method exposing project settings. Both objects provide a `projectSettings` method returning `Seq[Setting[_]]`, which is the standard SBT pattern for plugin settings. Having two separate objects doing this implies redundant or conflicting configuration sources.
- Duplicate plugin definition objects with identical intent and signatures. Both `ScalaJSWeb` and `WebScalaJS` expose a `requires` method/property returning `Plugins`, suggesting they are two different names for the same SBT plugin or provide the same configuration surface.
- Workflow token permissions not restricted (.github/workflows/ci.yml)
- Workflow token permissions not restricted (.github/workflows/release.yml)