# Changelog

## Score

- CAI 63 → 66 (+2.9)
- Rubric changed (rubric-2026.09.9 → rubric-2026.09.17) — scores are not directly comparable.

## Lenses

- Code Health 78 → 77 (-0.3)
- Architecture 99 → 95 (-3.8)
- Maturity 66 → 68 (+2.1)
- Readiness 77 → 64 (-13.4)
- Security 56 → 68 (+12.0)
- Event Sourcing 100 → 100 (+0.0)
- Accessibility 63 → 63 (+0.0)
- Performance 100 (new)

## Resolved (60)

- Duplicated block (12 lines × 2) (mistralrs-quant/src/cutile/nvfp4_glu.rs)
- High CVE: [GHSA redacted] (mistralrs-cli/webui/package-lock.json)
- High CVE: [GHSA redacted] (Cargo.lock)
- High CVE: [GHSA redacted] (mistralrs-cli/webui/package-lock.json)
- Hotspot: mistralrs-cli/src/commands/doctor.rs (mistralrs-cli/src/commands/doctor.rs)
- Hotspot: mistralrs-cli/src/commands/quant/gguf_discovery.rs (mistralrs-cli/src/commands/quant/gguf_discovery.rs)
- Hotspot: mistralrs-cli/src/commands/quantize.rs (mistralrs-cli/src/commands/quantize.rs)
- Hotspot: mistralrs-cli/src/commands/tune.rs (mistralrs-cli/src/commands/tune.rs)
- Hotspot: mistralrs-cli/webui/src/lib/services/streaming.ts (mistralrs-cli/webui/src/lib/services/streaming.ts)
- Hotspot: mistralrs-core/src/attention/backends/cpu/mask.rs (mistralrs-core/src/attention/backends/cpu/mask.rs)
- Hotspot: mistralrs-core/src/cuda/speculative_rejection.rs (mistralrs-core/src/cuda/speculative_rejection.rs)
- Hotspot: mistralrs-core/src/diagnostics.rs (mistralrs-core/src/diagnostics.rs)
- Hotspot: mistralrs-core/src/engine/cuda_memory.rs (mistralrs-core/src/engine/cuda_memory.rs)
- Hotspot: mistralrs-core/src/layers.rs (mistralrs-core/src/layers.rs)
- Hotspot: mistralrs-core/src/models/hunyuan_v1_moe.rs (mistralrs-core/src/models/hunyuan_v1_moe.rs)
- Hotspot: mistralrs-core/src/moe/experts/backends.rs (mistralrs-core/src/moe/experts/backends.rs)
- Hotspot: mistralrs-core/src/moe/experts/config.rs (mistralrs-core/src/moe/experts/config.rs)
- Hotspot: mistralrs-core/src/pipeline/auto.rs (mistralrs-core/src/pipeline/auto.rs)
- Hotspot: mistralrs-core/src/pipeline/paths.rs (mistralrs-core/src/pipeline/paths.rs)
- Hotspot: mistralrs-core/src/reasoning_parsers/harmony.rs (mistralrs-core/src/reasoning_parsers/harmony.rs)
- …and 40 more

## New (195)

- Duplicated block (11 lines × 2) (scripts/production_soak.py)
- Duplicated block (12–13 lines × 3) (examples/server/anthropic_chat.py)
- Duplicated block (13 lines × 2) (examples/server/anthropic_agentic.py)
- Duplicated block (14 lines × 2) (scripts/production_soak.py)
- Duplicated block (14 lines × 2) (scripts/production_soak.py)
- Duplicated block (15 lines × 2) (scripts/production_soak.py)
- Duplicated block (15 lines × 2) (scripts/production_soak.py)
- Duplicated block (16 lines × 2) (scripts/production_soak.py)
- Duplicated block (16 lines × 2) (scripts/production_soak.py)
- Duplicated block (17 lines × 2) (scripts/production_soak.py)
- Duplicated block (18–21 lines × 3) (scripts/production_soak.py)
- Duplicated block (19 lines × 2) (examples/python/custom_search.py)
- Duplicated block (20 lines × 2) (scripts/production_soak.py)
- Duplicated block (21 lines × 2) (scripts/production_soak.py)
- Duplicated block (21 lines × 24) (examples/server/chat.py)
- Duplicated block (22–25 lines × 2) (scripts/production_soak.py)
- Duplicated block (23 lines × 2) (scripts/production_soak.py)
- Duplicated block (23 lines × 2) (scripts/production_soak.py)
- Duplicated block (25 lines × 3) (examples/python/shell_skills.py)
- Duplicated block (26 lines × 2) (scripts/production_soak.py)
- …and 175 more

## Changes since last survey

- 12 commits — 3 feature/other, 9 fixes

## By area

- (root) — 3 commits
- mistralrs-core/src — 3 commits
- mistralrs-quant/src — 2 commits
- docs/openapi.json — 1 commit
- mistralrs-audio/src — 1 commit
- mistralrs-cli/src — 1 commit
- mistralrs-server-core/src — 1 commit

## Notable commits

- fix: chore(deps): fix open Dependabot security alerts (#2444)
- fix: fix(core): only honor tool-call and reasoning delimiters emitted as special tokens (#2455)
- fix: fix(core): read the CUDA graph instantiate flag through the cudarc 0.19.10 newtype (#2454)
- fix: fix(quant): restore CUDA builds and inference after the candle bump (#2451)
- fix: fix(search): share the remote fetch guard with the web search and extraction tools (#2449)
- fix: fix(server): accept only a bare file name for calibration save_cimatrix (#2445)
- fix: fix(server): bound decoded GIF frames and audio samples (#2448)
- fix: fix(server): judge IPv6 transition addresses by their embedded IPv4 in the media guard (#2446)
- fix: fix(ui): validate chat ids before building chat file paths (#2447)
- change: chore(deps): bump candle to e65eb1de and cutile to 0.3.1 (#2450)
- change: chore(release): 0.9.4 finalization (#2452)
- change: chore: add SECURITY.md