# Changelog

> **This is the PUBLIC form of this artifact. Findings are listed in full, but the details of SECURITY findings — which rule fired, in which file, on which line, and how to fix it — are deliberately withheld, and any secret-scanner results are excluded entirely. Where detail is absent here it was REMOVED FOR PUBLICATION; it is not missing from the analysis. The complete artifact is available from the repository owner.**

## Score

- CAI 44 → 42 (-2.2)

## Lenses

- Code Health 45 → 43 (-1.2)
- Architecture 90 → 89 (-1.4)
- Maturity 48 → 48 (-0.2)
- Readiness 39 → 38 (-0.9)
- Security 70 → 78 (+7.4)
- Accessibility 40 → 35 (-4.7)
- Performance 100 → 100 (+0.0)

## Resolved (9)

- High CVE: [GHSA redacted] (yarn.lock)
- High CVE: [GHSA redacted] (yarn.lock)
- Medium vulnerability: [GHSA redacted] (yarn.lock)
- No SBOM
- No artifact signing
- No build provenance
- Off-boarding risk: anonymized user #1
- Unpinned build actions
- Workflow token permissions not restricted

## New (11)

- High CVE: [GHSA redacted] (yarn.lock)
- Leaked secret: high-entropy-secret (site/src/config.js)
- Low CVE: [GHSA redacted] (yarn.lock)
- Low CVE: [GHSA redacted] (yarn.lock)
- Medium: security finding (details withheld)
- Medium: security finding (details withheld)
- Mock-dominated test: should not schedule timeout when ResizeObserver is active (tests/modules/body.test.js)
- Off-boarding risk: anonymized user #1
- Orphaned file (src/extensions/custom-view/bootstrap-table-custom-view.js)
- Workflow token permissions not restricted (.github/workflows/deploy.yml)
- Workflow token permissions not restricted (.github/workflows/test.yml)

## Changes since last survey

- 49 commits — 46 feature/other, 3 fixes

## By area

- (repo) — 24 commits
- (root) — 21 commits
- .github/workflows — 1 commit
- dist/locale — 1 commit
- site/src — 1 commit
- src/modules — 1 commit

## Notable commits

- fix: Fix #8484: fixed the columns dropdown displaying raw HTML markup when using escapeTitle
- fix: Merge pull request #8514 from vicuts/fix/locale-ro-ro
- fix: Merge pull request #8524 from wenzhixin/bug/8484
- change: Build 1.28.0
- change: Merge pull request #8522 from wenzhixin/dependabot/npm_and_yarn/vue-3.5.44
- change: Merge pull request #8523 from wenzhixin/dependabot/npm_and_yarn/rollup-4.64.6
- change: Merge pull request #8525 from wenzhixin/docs/7448
- change: Merge pull request #8526 from wenzhixin/dependabot/npm_and_yarn/cspell-10.4.0
- change: Merge pull request #8527 from wenzhixin/dependabot/npm_and_yarn/eslint-10.13.0
- change: Merge pull request #8528 from wenzhixin/dependabot/npm_and_yarn/rollup-4.64.7
- change: Merge pull request #8529 from wenzhixin/dependabot/npm_and_yarn/happy-dom-21.0.3
- change: Merge pull request #8530 from wenzhixin/dependabot/npm_and_yarn/cypress-16.2.0
- change: Merge pull request #8531 from wenzhixin/dependabot/npm_and_yarn/sass-1.105.2
- change: Merge pull request #8532 from wenzhixin/dependabot/npm_and_yarn/vitest-5.0.5
- change: Merge pull request #8533 from wenzhixin/dependabot/npm_and_yarn/rollup-4.64.9
- change: Merge pull request #8534 from wenzhixin/changelog/unreleased-1.28.0
- change: Merge pull request #8535 from wenzhixin/dependabot/npm_and_yarn/rollup-4.64.10
- change: Merge pull request #8536 from wenzhixin/dependabot/npm_and_yarn/core-js-3.51.0
- change: Merge pull request #8537 from wenzhixin/dependabot/npm_and_yarn/rollup-4.64.12
- change: Merge pull request #8538 from wenzhixin/dependabot/npm_and_yarn/happy-dom-21.0.4
- …and 29 more