v0.14 - Hedge (September 2026)

The CNA pages get an interval — and the year totals stop being measured by adding up their months.

Forecasts

• Every scored CNA publishes an 80% range. The per-CNA backtest already computed the residuals a band needs and threw them away. They are kept now, and the CNA hero leads with the range in the same form the overview page does. A CNA without one keeps the model-and-MASE line rather than implying a precision nobody measured.
• The band's shape is shared; its width is not. A rolling-origin backtest can only score its newest origin one month out, the next two months out, and so on, so horizon h holds at most max_origins - h + 1 residuals however long the series is. A CNA therefore has almost nothing to fit at exactly the horizons the next-year column is built from. So how the band widens with horizon is pooled across CNAs, where the data for it exists and where CNAs genuinely resemble each other, and only its overall width is the CNA's own — measured dispersion varies about fivefold between them. Held out across 139 CNAs, that covers 80.0% at the 80% level and 93.1% at the 95% level, and holds those rates from h=1 to h=16. Fitting each CNA on its own residuals gives 73.0% and 83.2%; one pooled band for everyone gives 83.9% and drifts to 88% by h=16.
• A year is measured as a year. The year band used to be the sum of its monthly bands, which assumes the model is wrong in the same direction every month of the year. It is not: monthly residual spread runs about 3.4x the spread of the same model's error on a 16-month total, where 4.0x would mean the months cancel completely. The months very nearly cancel, so summing overstated the range badly — it put the median CNA's 80% interval at 25x, and oracle's 2027 range at 937 to 835,920. Both pipelines now score a published total as a total, so the figure the front page leads with is measured the way it is presented.

Corrected

• The interval stopped widening before the forecast stopped. The backtest ran to twelve months against a sixteen-month forecast, and the band code silently reuses its longest fitted horizon beyond that range — so September to December of next year were all drawn with the h=12 band, flat, across a third of the range the dashboard leads with. The horizon now follows what is published, and a month past it carries no band rather than an extrapolated one.
• Runaway CNA forecasts. TR-CERT was published forecasting 1,018,180 CVEs for December 2027 against 809 in its entire history — a model compounding a trend in log space, carrying a respectable MASE of 1.79 because selection scored the first months of the path while the divergence happened out at the end where nothing was measured. A forecast that exceeds eight times the CNA's trailing two-year peak now falls back to the naive baseline and says so. The threshold comes from the series: across 6,858 CNA-months, real growth over that peak passes 5.0x once in a thousand, and 8x three times in all.
• A crash waiting on the first CNA band. Horizon lookup assumed the fitted horizons were contiguous. They need not be — a residual is only recorded where both the actual and the forecast are positive, so a series with sporadic zero months loses whole horizons, and 127 of 140 CNAs have at least one zero month. The aggregate series never does, which is why it had not fired.
• Asset versions are stamped by CI. The ?v= on every stylesheet and script was maintained by hand in eleven places across four files, where getting it wrong serves new markup with a cached script. It is stamped from the last commit that touched an asset — not from the head commit, which advances on every daily data update and would discard every visitor's cache once a day.

Known gap

• A CNA's band arrives when its turn does. Scoring is far too slow to run for every CNA daily, so a dozen are re-scored per run and the population cycles through over about a fortnight. A CNA that has not been scored since this release has no band yet, and shows the model and its MASE until it is.

v0.13 - Ockham (September 2026)

The front end, rebuilt — the dashboard says what it can defend and drops what it could not.

Forecasts

• The interval leads. The headline is the 80% range, not a point estimate. A single figure twelve to sixteen months out claims a precision the models do not have, and the interval is the output whose coverage is actually measured — 80.7% empirical against a nominal 80%.
• The comparison with last year is a range too, quoted as a multiple, because a single growth figure against a range forecast puts the false precision straight back.
• Modelled figures round to the nearest thousand; counts do not. Published totals are observed, so they stay exact, and the rounding becomes the signal for which numbers are estimated.
• The chart leads with the ensemble — the line, the band and the headline now all describe the same thing — and closes on a labelled interval bracket rather than a single value.

Rebuilt

• Tailwind's play CDN is gone. It warns in the console that it is not for production, and because its dark: variant is unusable from the CDN, dark mode had been hand-patched with roughly 470 lines of !important overrides — 41% of the old stylesheet, written twice. app.css replaces it with tokens, and contains no !important at all.
• All four pages share one design system and one page shell, instead of duplicating the header, footer, analytics snippet and theme script in each file.
• Numeric columns are right-aligned with tabular figures, and colour is reserved for judgements rather than spent on the direction of an error.

Corrected

• Forecast history table alignment. Five column headers, six cells — every value after the forecast column rendered one column left of its heading, the same defect the rankings table carried before v0.12.
• CNA sort indicators. Arrows were written into a span while aria-sort was never set, so the visible state and the accessible one were separate facts and only one existed.
• Charts follow the theme. Colours were read once when a chart was built, so switching theme by any route other than the toggle left one theme's gridlines on the other's background.
• Mobile navigation. The old nav overflowed its own header band and pushed the document to 510px at a 375px viewport; no page scrolls sideways now.
• The evolution chart no longer dramatises small revisions. Its y-axis was fitted to the data, so a change of a few tenths of a percent filled the panel and read as a collapse.

Known gap

• CNA forecasts have no interval. The per-CNA pipeline emits a point forecast and a validation MASE; the residuals that would build a band are computed on every run and discarded, and the backtest is configured with just enough origins to sit on the minimum the interval code requires. Those pages name the model and its MASE instead of implying a precision that has not been measured.

v0.12 - Delphi (September 2026)

Calibration & Correction — the forecast now reflects the data, the accuracy figures describe the published forecast, and the uncertainty is visible.

Corrected

• Growth floor removed. It compared a partial-year forecast remainder against a full prior year and inflated it to clear an annual growth bar, collapsing all twelve models into a five-CVE band. Bias is now handled by log-space modelling instead.
• Constraint config wired up. The whole config document was being passed to a class that read flat keys, so every configured value was silently ignored.
• Forecast tracker fixed. A schema key mismatch raised KeyError on every run behind a bare except; roughly nine months of daily forecast vintages were lost.
• Rankings table alignment. Seven column headers, six cells — every value after MAPE rendered one column left of its heading.
• Year selector restored (the buttons the code looked for did not exist), and the year-end projection no longer renders as part of the actuals line.
• Forecast anchored on the live count. The projection continues from the total published as of now — the month in progress is a nowcast of what is already out plus the model's expectation for the working days that remain — rather than restarting from the last complete month, where it branched below the actuals and was overtaken within days.

Measurement

• Rolling-origin backtesting across 24 origins replaces a single-origin score.
• MASE is the ranking metric, with naive baselines ranked alongside every model.
• One forecast path. Backtest and production run identical code, so the accuracy figures describe the forecast actually published.

Methodology

• Log-space modelling with mild trend damping (φ = 0.98).
• Business-day normalisation — months carry 20–23 business days.
• Conformal prediction intervals with published empirical coverage.
• Curated ensemble — a trimmed mean over models that clear the baseline.
• One forecast path for both halves of the site. CNA forecasts now run through the same engine as the CVE forecast, rather than fitting models raw.
• Data vintage logging, to measure how much counts get revised after publication.
• Output validation in CI now checks what actually broke before: year totals that do not reconcile, projections leaking into the actuals series, models collapsing onto one number, and intervals that fail to contain their own forecast.
• CNA page rebuilt. Years were hard-coded, so by September 2026 the settled 2025 total was labelled a forecast. The "2026 Forecasted" figure summed only forecast months — a four-month total shown as a year. Per-CNA model choice now uses rolling-origin MASE against a naive baseline, and a CNA whose best model cannot beat that baseline gets the baseline, rather than reporting a 160%-error model as its best.
• Model choice is cached. Scoring every CNA by backtest on every run measured at over an hour, so selection is cached and a capped batch refreshed per run — oldest first, with new CNAs and materially grown series jumping the queue. Forecasting still runs for every CNA daily; only the scoring is amortised, holding the job to roughly five minutes.

v0.11 - Galway (March 2026)

Comprehensive Spring Cleaning - Code quality, web overhaul, CI/CD hardening, and accessibility

Code Quality

• Shared Model Utilities: Extracted duplicated parameter-fixing logic from CVE/CNA adapters into core/model_utils.py
• Constraint Integration: Completed the forecast constraint pipeline — growth floors, trend adjustments, and YTD floors now actively applied
• Date Handling: Standardized on dateutil.parser.isoparse across the codebase, replacing manual timezone hacks
• Logging: Added RotatingFileHandler with 10MB limit and 3 backups, request timeouts on external HTTP calls
• Ruff: Full codebase formatted and linted with ruff — enforced via CI

Web Dashboard

• Dark Mode: System preference detection with manual toggle, persisted in localStorage
• Accessibility (WCAG AA): ARIA labels on all interactive elements, keyboard navigation, focus indicators, skip-to-content links
• SEO: Meta descriptions, Open Graph tags, Twitter Cards, canonical URLs on all pages
• Shared CSS: Extracted duplicated styles from 3 HTML files into styles.css with CSS custom properties for theming
• Tailwind v3: Upgraded from Tailwind CSS 2.2.19 to v3 CDN play version
• JavaScript: Deferred script loading, chart update pattern (no more destroy/recreate), named constants

CI/CD & Testing

• Test Workflow: Automated pytest on pull requests and pushes to main
• Lint Workflow: Ruff format and lint checks on pull requests
• Dependabot: Weekly dependency updates for pip packages and GitHub Actions
• Data Validation: JSON schema validation of forecast data before deployment
• Unit Tests: 20 tests covering model utilities and forecast constraints
• Extracted Scripts: Moved inline Python from workflows to code/scripts/

Repository Cleanup

• Removed 60+ files: Empty scripts, old tuner logs/backups, unused web files, obsolete v.10 documentation
• Updated documentation: Architecture, deployment, development, and API reference guides refreshed for v0.11
• pyproject.toml: Centralized ruff and pytest configuration

v0.10 - Phoenix (October 2025)

Complete Architectural Rebirth - Production-ready unified pipeline with historical validation and accuracy tracking

Major Features

• Unified Pipeline: Single command (run_production_forecast.py) for CVE + CNA forecasting
• Historical Backtest: Real-world validation on 2025 data (Jan-Sep) with actual vs. predicted comparisons
• Forecast Tracking: ForecastTracker accumulates prediction snapshots for long-term accuracy analysis
• Model Rankings: Real-time leaderboard based on backtest MASE, compared against a naive benchmark
• Forecast vs Published Table: Month-by-month comparison with error percentages and performance ratings

Architecture Improvements

• Modular Design: BaseForecaster, ValidationMixin, CVEForecaster, CNAForecaster adapters
• Clean Separation: Data loading, training, forecasting, and validation in separate modules
• Extensible Framework: Easy to add new models, data sources, or validation strategies
• Production-Ready: Robust error handling, comprehensive logging, and monitoring

Automated Workflows

• Daily Forecast: Midnight UTC execution with automatic deployment to GitHub Pages
• Monthly Tuning: 1st of each month hyperparameter optimization with config updates
• Zero Downtime: Continuous deployment with automatic rollback on failure
• Artifact Storage: 90-day retention of tuning results and execution logs

Documentation

• Architecture Guide: System design, components, and data flow
• API Reference: Classes, methods, and configuration options
• Deployment Guide: GitHub Actions, hosting, and CI/CD
• Development Guide: Contributing, testing, and best practices
• Tuning Guide: Hyperparameter optimization workflows

v0.09 - Edinburgh (October 2025)

🔄 Year Rollover Automation & Enhanced Forecasting - Complete 2026 readiness with zero manual intervention

Year Rollover Automation

• Fully dynamic YoY growth calculations that automatically compare current year vs previous year
• Automatic chart axis updates - date ranges adapt seamlessly across year boundaries
• Smart forecast end year detection with automatic rollover when config becomes outdated
• Dynamic chart descriptions and labels that update based on current year
• Backend time series processing fully dynamic with current_datetime.year throughout

Enhanced Dashboard Features

• Improved "Projected Full Year Growth" card with explicit year comparisons (e.g., "2025 vs 2024")
• Detailed growth metrics showing actual numbers: "45,000 vs 39,970 (Full Year)"
• Chart x-axis automatically spans from Jan of current year to Jan of next year
• All summary statistics and cumulative timelines update dynamically

Code Quality & Maintenance

• Comprehensive year rollover audit identifying all hardcoded year references
• Main forecast page 100% automatic - zero manual intervention needed for 2026
• CNA forecast page requires minimal annual label updates (5 minute task)
• Annual maintenance checklist added to README for December 31, 2025
• Consolidated documentation for better repository organization

v.08 - Opening Drive (September 2025)

🚀 Launch of Individual CNA Forecasts - Revolutionary organization-specific vulnerability prediction system

CNA Forecasts Platform Launch

• Dedicated forecasting pipeline for 166+ CVE Numbering Authorities (CNAs)
• Organization-specific vulnerability disclosure predictions with interactive visualizations
• Advanced model ensemble including LightGBM, XGBoost, Prophet, and ExponentialSmoothing
• Intelligent model selection based on validation performance for each CNA's unique patterns
• Comprehensive sortable table interface with real-time forecast data and historical trends
• Dynamic chart generation with organization-specific timelines and cumulative projections

Technical Architecture

• CPU-optimized forecasting pipeline designed for production scalability
• Automated model validation with MAPE scoring and fallback mechanisms
• JSON-based data architecture supporting real-time updates and historical analysis
• Responsive web interface with Chart.js integration for interactive data exploration
• Configurable forecast horizons and model hyperparameters via JSON configuration
• Enterprise-grade error handling and logging for reliable automated execution

Data & Analytics

• Historical CVE data analysis spanning multiple years per organization
• Statistical model performance tracking with validation metrics
• Forecast confidence intervals and uncertainty quantification
• Cross-organizational trend analysis and comparative insights

v.07 - Security Summer Camp Prep (August 2025)

Fixed critical month transition bug in cumulative total calculations, ensuring accurate data representation across month boundaries

Bug Fix Details

• Replaced hard-coded month references with dynamic month detection
• Ensured cumulative totals properly build upon the previous month's values
• Fixed inconsistencies in cumulative statistics when crossing month boundaries
• Implemented future-proof solution that works reliably for all calendar transitions
• Added comprehensive logging to track cumulative total calculations

v.06 - Karlův mos (July 2025)

Revolutionary self-improving forecasting system with intelligent hyperparameter optimization

Intelligent Optimization

• Comprehensive hyperparameter tuner for 19+ models
• Self-improving workflow that learns from previous runs
• Adaptive grid/random search selection
• Intelligent timeout management and progress tracking

Automated Infrastructure

• Daily GitHub Actions integration with tuner
• Automatic configuration backup and management
• End-to-end validation pipeline
• Complete self-optimization workflow

• Support for 25+ models across Statistical, Tree-Based, and Deep Learning categories
• Enterprise-grade modular architecture with 7 focused modules
• Enhanced model stability with comprehensive error handling
• Dynamic forecasting with automatic period adaptation

v.05 - Adolfo Suárez Madrid-Baraja

• Fixed a critical bug that prevented the cumulative graph from rendering due to an incorrect data structure in data.json.
• Restored frontend compatibility by correcting the data generation logic, ensuring all charts now load correctly.

v.04 ORD MAD

• Enhanced model stability with improved error handling.
• Added input validation and scaling for better numerical stability.
• Optimized for CPU-only environments.
• Implemented dynamic forecast period calculation.
• Improved model selection based on MAPE scores.