CHANGELOG with entries per version
Why it matters
Consumers upgrading from v1.x to v2.x need to know what broke and what migrated. Without a CHANGELOG.md, they must diff the entire package history, read all commit messages, or trial-upgrade hoping nothing explodes. ISO 25010 modifiability requires that the system's evolution be trackable. A changelog is also a trust signal: maintained packages have changelogs; abandoned packages don't. For packages consumed in regulated or enterprise environments, documented version history is often a procurement requirement.
Severity rationale
High because consumers cannot safely assess upgrade risk without documented version history, leading to either blocked upgrades (security debt) or blind upgrades (breakage risk).
Remediation
Create CHANGELOG.md in the project root following the Keep a Changelog format, with one entry per released version.
# Changelog
## [2.3.1] - 2026-03-15
### Fixed
- Fixed retry logic that caused duplicate requests on timeout
## [2.3.0] - 2026-03-01
### Added
- New `retryConfig` option for customizing retry behavior
### Changed
- Default timeout increased from 5s to 10s
The most recent entry must match the current version in package.json. For teams using conventional commits, conventional-changelog or release-it can generate this automatically on each release. Keep a changelog even if you use GitHub Releases — not all consumers browse GitHub.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the SDK / Package Quality Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- iso-25010:2011 · maintainability.modifiability — Modifiability — changelog communicates breaking-change risk to upgrading consumers
Taxons
History
- 2026-04-18·v1.0.0·Initial import from sdk-package-quality·automated