Tutorial: Changelog — August 2026

Newest entry on top.

2026-08-02 — security (2.60.3) — remediate the OpenSSF Scorecard (6.7 → projected ~7.4)

Closed the compliance audit's headline finding (ship-contract Scorecard below the 7.0 floor) by clearing the dominant lever — the Vulnerabilities check (was 0). Fixed everything fixable: root + targets/web npm audit fix (→ 0 vulns each), and targets/mobile pinned postcss ^8.5.25

• brace-expansion ^2.0.2 via overrides. Documented + filtered the genuine-no-fix advisories via osv-scanner.toml next to each manifest (the mechanism Scorecard's Vulnerabilities check honors): 17 unmaintained Tauri-v2-Linux gtk3-rs/glib/proc-macro/unic Rust crates (confirmed no-fix by cargo audit) in targets/web-shell/, and 1 build-time-only Expo uuid advisory in targets/mobile/. Verified with the real tool — osv-scanner v2.4.0 reports "No issues found" — so the check moves 0 → 10, lifting the score to ~7.4. npm test green (375 + 430 + 122). PATCH 2.60.2 → 2.60.3. The public api.securityscorecards.dev number refreshes on OSSF's weekly rescan. Report: ../fairyfox-reports/2026-08-02-scorecard-remediation.md.

2026-08-02 — docs/notes — fairyfox: first full standards compliance audit

Ran the first full compliance audit (the gap seeded in the 2026-08-02 adoption). Walked every adopted standard's ## Verify and recorded a dated per-standard result in ../reference/adoption-manifest.md: 25/30 applicable standards implemented (34 rows − 4 N-A; 5 non-implemented), the rest honest dated gaps. Headline finding: the ship-contract's OpenSSF Scorecard is 6.7, below the 7.0 floor — verified against the live api.securityscorecards.dev (not the badge). The dominant lever is Vulnerabilities = 0 (27 known, mostly RUSTSEC advisories in the Tauri/Rust desktop deps); several other checks (Code-Review, Contributors, Branch-Protection) are structurally low for a solo 0-approval repo. Also partial: supply-chain (releases signed but no provenance), docs-site (chrome 2.2.1 → 2.3.0, browser-gated), docker (no Dockerfile yet), mandate-ledger (no ledger triggered). Fixed in-pass: pruned 5 stale Dependabot branches → the remote carries only main/dev (repo-hygiene clean). Also flags a date-accuracy correction: earlier artifacts in this effort were mis-dated 2026-07-25 (hub-commit date); the real date is 2026-08-02. Report: ../fairyfox-reports/2026-08-02-compliance-audit.md. No VERSION bump (notes/docs only).