Public changelog exists
Why it matters
No changelog means users have no reliable way to know what changed between versions, whether a bug they hit is fixed, or whether upgrading is safe. A changelog that stops at v1.2.0 when the project is now on v2.1.0 is a signal that the project is poorly maintained — the same signal that drives dependency abandonment decisions. iso-25010:2011 analysability covers this: a project where change history is opaque requires source-level investigation to understand its evolution. Following Keep a Changelog format provides a predictable structure that users can parse quickly for the entries that matter to them.
Severity rationale
Medium because the absence of a changelog doesn't block initial use but degrades confidence in the project's maintenance posture and makes upgrade decisions opaque, compounding over time.
Remediation
Create CHANGELOG.md at the project root following Keep a Changelog format. The latest entry must match the version in package.json:
# Changelog
## [2.1.0] - 2026-03-15
### Added
- New `query()` method replacing `fetchData()`
- TypeScript type exports for all public types
### Fixed
- Connection timeout now throws instead of hanging indefinitely
## [2.0.0] - 2026-02-01
### Changed
- BREAKING: Renamed `fetchData()` to `query()`
- Minimum Node.js version bumped to 18
### Removed
- CommonJS import support dropped
A changelog without dates, version numbers, or change categorization fails this check. An outdated changelog (not updated for the current version) also fails.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Developer Documentation Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- iso-25010:2011 · maintainability.analysability
- soc2:2017 · CC8.1 — Change management
Taxons
History
- 2026-04-18·v1.0.0·Initial import from developer-documentation·automated
- 2026-07-06·v1.0.1·Add SOC 2 TSC mapping (CC8.1) from the verified compliance crosswalk register (docs/compliance/).·by soc2-mapping-enrichment-ship-2