# Changelog

> **This is the PUBLIC form of this artifact. Findings are listed in full, but the details of SECURITY findings — which rule fired, in which file, on which line, and how to fix it — are deliberately withheld, and any secret-scanner results are excluded entirely. Where detail is absent here it was REMOVED FOR PUBLICATION; it is not missing from the analysis. The complete artifact is available from the repository owner.**

## Score

- CAI 55 → 58 (+2.3)
- Rubric changed (rubric-2026.08.17 → rubric-2026.08.18) — scores are not directly comparable.

## Lenses

- Code Health 99 → 98 (-1.0)
- Architecture 100 → 99 (-1.5)
- Maturity 49 → 51 (+1.5)
- Readiness 55 → 62 (+7.3)
- Security 45 → 47 (+2.2)
- Domain Modelling 100 → 100 (+0.0)

## Resolved (6)

- Dependency hygiene not measured — no supported dependency manifest was read
- High: security finding (details withheld)
- LLM evaluation failed
- Off-boarding risk: anonymized user #1
- Orphaned knowledge (grpc/src/main/scala/org/apache/pekko/projection/grpc/consumer/ConsumerFilter.scala)
- Orphaned knowledge (grpc/src/main/scala/org/apache/pekko/projection/grpc/internal/ConsumerFilterStore.scala)

## New (8)

- Boundary-crossing change coupling: CassandraProjection.scala ↔ SlickProjection.scala (cassandra/src/main/scala/org/apache/pekko/projection/cassandra/javadsl/CassandraProjection.scala)
- Boundary-crossing change coupling: CassandraProjection.scala ↔ SlickProjection.scala (cassandra/src/main/scala/org/apache/pekko/projection/cassandra/scaladsl/CassandraProjection.scala)
- Dependency hygiene not measured — dependency manifest found but not parsed for hygiene
- FileTooLong: internal/R2dbcOffsetStore.scala (r2dbc/src/main/scala/org/apache/pekko/projection/r2dbc/internal/R2dbcOffsetStore.scala)
- FileTooLong: internal/R2dbcProjectionImpl.scala (r2dbc/src/main/scala/org/apache/pekko/projection/r2dbc/internal/R2dbcProjectionImpl.scala)
- Off-boarding risk: anonymized user #1
- PR-triggered workflow without a permissions block
- The TestKit section describes both assert-function and probe-style testing but does not explain how to run the tests locally or what test runner is used. (docs/src/main/paradox/testing.md)

## Changes since last survey

- 10 commits — 10 feature/other, 0 fixes

## By area

- project/Dependencies.scala — 3 commits
- cassandra-test/src — 2 commits
- (root) — 1 commit
- .github/workflows — 1 commit
- docs/src — 1 commit
- grpc/src — 1 commit
- project/plugins.sbt — 1 commit

## Notable commits

- change: Bump sbt/setup-sbt from 1.5.2 to 1.5.4 (#589)
- change: Update logback-classic to 1.6.0 (#585)
- change: Update logback-classic to 1.6.1 (#590)
- change: Update r2dbc-mysql to 1.4.3 (#584)
- change: Update sbt-source-dist to 0.2.0 (#591)
- change: Update scalafmt-core to 3.11.5 (#592)
- change: cassandra integration test issues (#593)
- change: copy over doc change from akka (#586)
- change: copy over proto docs (#587)
- change: increase cassandra test timeout (#588)