# Changelog

> **This is the PUBLIC form of this artifact. Findings are listed in full, but the details of SECURITY findings — which rule fired, in which file, on which line, and how to fix it — are deliberately withheld, and any secret-scanner results are excluded entirely. Where detail is absent here it was REMOVED FOR PUBLICATION; it is not missing from the analysis. The complete artifact is available from the repository owner.**

## Score

- CAI 53 → 42 (-10.6)
- Rubric changed (rubric-2026.08.18 → rubric-2026.08.15) — scores are not directly comparable.

## Lenses

- Code Health 97 → 99 (+2.0)
- Architecture 98 → 96 (-1.9)
- Maturity 55 → 54 (-1.0)
- Readiness 47 → 28 (-19.1)
- Security 43 → 35 (-8.6)

## Resolved (11)

- ApacheNoticeResourceTransformer.modifyOutputStream (cognitive 16) (src/main/kotlin/com/github/jengelman/gradle/plugins/shadow/transformers/ApacheNoticeResourceTransformer.kt)
- ApacheNoticeResourceTransformer.transform (cognitive 35) (src/main/kotlin/com/github/jengelman/gradle/plugins/shadow/transformers/ApacheNoticeResourceTransformer.kt)
- ApacheNoticeResourceTransformer.transform (cyclomatic 17) (src/main/kotlin/com/github/jengelman/gradle/plugins/shadow/transformers/ApacheNoticeResourceTransformer.kt)
- Change coupling: DontIncludeResourceTransformer.kt ↔ IncludeResourceTransformer.kt (src/main/kotlin/com/github/jengelman/gradle/plugins/shadow/transformers/DontIncludeResourceTransformer.kt)
- Change coupling: ManifestAppenderTransformer.kt ↔ ManifestResourceTransformer.kt (src/main/kotlin/com/github/jengelman/gradle/plugins/shadow/transformers/ManifestAppenderTransformer.kt)
- Coverage not included — suite not readable by the collector
- Dependency hygiene not measured — dependency manifest found but not parsed for hygiene
- Hotspot: src/main/kotlin/com/github/jengelman/gradle/plugins/shadow/transformers/ApacheNoticeResourceTransformer.kt (src/main/kotlin/com/github/jengelman/gradle/plugins/shadow/transformers/ApacheNoticeResourceTransformer.kt)
- LLM evaluation failed
- Off-boarding risk: anonymized user #1
- PR-triggered workflow without a permissions block

## New (5)

- Coverage not measured — test suite did not build
- Dimension evaluation failed
- High: security finding (details withheld)
- No artifact signing
- No tests found

## Changes since last survey

- 16 commits — 15 feature/other, 1 fixes

## By area

- src/main — 4 commits
- src/functionalTest — 3 commits
- docs/kotlin-plugins — 2 commits
- gradle/wrapper — 2 commits
- (root) — 1 commit
- .github/workflows — 1 commit
- docs/configuration — 1 commit
- src/documentTest — 1 commit
- src/test — 1 commit

## Notable commits

- fix: Fix flaky test execution in AppendableMavenRepository (#2151)
- change: Deprecate DontIncludeResourceTransformer and IncludeResourceTransformer (#2143)
- change: Improves diagnostics for document-test code snippets (#2154)
- change: Migrate transformer functional tests back to unit tests (#2138)
- change: Prefer latest lib versions in docs (#2155)
- change: Refactor string appending to use appendLine in ApacheNoticeResourceTransformer (#2149)
- change: Rely on R8 embedded rules handling (#2132)
- change: Remove Serializable from DependencyFilter (#2144)
- change: Remove outdated comment
- change: Replace trimIndent with trimMargin in tests (#2148)
- change: Run documentTest with commonGradleArgs (#2152)
- change: Run testRetry for functionalTest only (#2153)
- change: Unify block indents (#2150)
- change: Update CI build to include non-interactive flag (#2146)
- change: Update Gradle to v9.7.0 (#2156)
- change: Update Gradle to v9.7.0-rc-3 (#2147)