# Changelog

## Score

- CAI 43 → 44 (+0.4)
- Rubric changed (rubric-2026.09.11 → rubric-2026.09.18) — scores are not directly comparable.

## Lenses

- Code Health 93 → 93 (+0.0)
- Architecture 100 → 80 (-20.3)
- Maturity 60 → 60 (+0.0)
- Readiness 18 → 20 (+1.9)
- Security 75 → 79 (+3.2)
- Accessibility 53 → 53 (+0.0)
- Performance 100 (new)

## Resolved (71)

- Critical CVE: [CVE redacted] (frontend/package-lock.json)
- Critical vulnerability: [GHSA redacted] (frontend/package-lock.json)
- Dependency hygiene PARTLY measured — npm pinning read, dependency currency not (no pnpm-resolved versions to grade)
- High CVE: [CVE redacted] (frontend/package-lock.json)
- High CVE: [CVE redacted] (frontend/package-lock.json)
- High CVE: [CVE redacted] (frontend/package-lock.json)
- High CVE: [CVE redacted] (frontend/package-lock.json)
- High CVE: [CVE redacted] (frontend/package-lock.json)
- High CVE: [CVE redacted] (frontend/package-lock.json)
- High CVE: [CVE redacted] (frontend/package-lock.json)
- High CVE: [CVE redacted] (frontend/package-lock.json)
- High CVE: [CVE redacted] (frontend/package-lock.json)
- High CVE: [CVE redacted] (frontend/package-lock.json)
- High CVE: [CVE redacted] (frontend/package-lock.json)
- High CVE: [CVE redacted] (frontend/package-lock.json)
- High CVE: [CVE redacted] (frontend/package-lock.json)
- High CVE: [CVE redacted] (frontend/package-lock.json)
- High CVE: [CVE redacted] (frontend/package-lock.json)
- High CVE: [CVE redacted] (frontend/package-lock.json)
- High CVE: [CVE redacted] (frontend/package-lock.json)
- …and 51 more

## New (22)

- High CVE: [GHSA redacted] (frontend/package-lock.json)
- High CVE: [GHSA redacted] (frontend/package-lock.json)
- High CVE: [GHSA redacted] (frontend/package-lock.json)
- High vulnerability: [GHSA redacted] (frontend/package-lock.json)
- Medium CVE: [GHSA redacted] (frontend/package-lock.json)
- Medium CVE: [GHSA redacted] (frontend/package-lock.json)
- Medium vulnerability: RUSTSEC-2026-0285 (Cargo.lock)
- Outdated: anyhow
- Outdated: axum
- Outdated: chrono
- Outdated: config
- Outdated: futures
- Outdated: once_cell
- Outdated: openssl
- Outdated: serde
- Outdated: serde_json
- Outdated: thiserror
- Outdated: tokio
- Outdated: tokio-stream
- Outdated: tower
- …and 2 more