# Changelog

> **This is the PUBLIC form of this artifact. Findings are listed in full, but the details of SECURITY findings — which rule fired, in which file, on which line, and how to fix it — are deliberately withheld, and any secret-scanner results are excluded entirely. Where detail is absent here it was REMOVED FOR PUBLICATION; it is not missing from the analysis. The complete artifact is available from the repository owner.**

## Score

- CAI 41 → 71 (+29.6)
- Rubric changed (rubric-2026.08.15 → rubric-2026.09.15) — scores are not directly comparable.

## Lenses

- Code Health 100 → 82 (-17.8)
- Architecture 94 (new)
- Maturity 58 → 68 (+10.2)
- Readiness 28 → 71 (+42.8)
- Security 38 → 69 (+30.2)

## Resolved (61)

- Coverage not measured — test suite did not build
- Dimension evaluation failed
- High IaC: KSV-0118 (kubernetes/test-node-base.yaml)
- High IaC: KSV-0118 (kubernetes/test-node-base.yaml)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- …and 41 more

## New (1119)

- AbstractProps.checkCreatorClosingOver (cognitive 16) (actor/src/main/scala/org/apache/pekko/actor/AbstractProps.scala)
- ActorCell.systemInvoke (cyclomatic 22) (actor/src/main/scala/org/apache/pekko/actor/ActorCell.scala)
- ActorPath.findInvalidPathElementCharPosition (cognitive 22) (actor/src/main/scala/org/apache/pekko/actor/ActorPath.scala)
- ActorPath.findInvalidPathElementCharPosition (cyclomatic 16) (actor/src/main/scala/org/apache/pekko/actor/ActorPath.scala)
- ActorRefBackpressureSinkStage.createLogic (cognitive 17) (stream/src/main/scala/org/apache/pekko/stream/impl/ActorRefBackpressureSinkStage.scala)
- ActorRefSource.createLogicAndMaterializedValue (cognitive 41) (stream/src/main/scala/org/apache/pekko/stream/impl/ActorRefSource.scala)
- ActorRefSource.createLogicAndMaterializedValue (cyclomatic 26) (stream/src/main/scala/org/apache/pekko/stream/impl/ActorRefSource.scala)
- ActorSelection.deliverSelection (cognitive 44) (actor/src/main/scala/org/apache/pekko/actor/ActorSelection.scala)
- ActorSelection.deliverSelection (cyclomatic 16) (actor/src/main/scala/org/apache/pekko/actor/ActorSelection.scala)
- ActorSystemImpl.printTree (cognitive 21) (actor/src/main/scala/org/apache/pekko/actor/ActorSystem.scala)
- AdapterClusterImpl.subscriptionsBehavior (cyclomatic 16) (cluster-typed/src/main/scala/org/apache/pekko/cluster/typed/internal/AdaptedClusterImpl.scala)
- AddressFromURIString.unapply (cognitive 17) (actor/src/main/scala/org/apache/pekko/actor/Address.scala)
- AggregateWithBoundary.createLogic (cognitive 38) (stream/src/main/scala/org/apache/pekko/stream/impl/fusing/AggregateWithBoundary.scala)
- AggregateWithBoundary.createLogic (cyclomatic 31) (stream/src/main/scala/org/apache/pekko/stream/impl/fusing/AggregateWithBoundary.scala)
- ArteryAeronUdpTransport.startAeron (cognitive 16) (remote/src/main/scala/org/apache/pekko/remote/artery/aeron/ArteryAeronUdpTransport.scala)
- ArteryTransport.attachControlMessageObserver (cognitive 29) (remote/src/main/scala/org/apache/pekko/remote/artery/ArteryTransport.scala)
- Association.attachOutboundStreamRestart (cognitive 34) (remote/src/main/scala/org/apache/pekko/remote/artery/Association.scala)
- Association.attachOutboundStreamRestart (cyclomatic 24) (remote/src/main/scala/org/apache/pekko/remote/artery/Association.scala)
- Association.quarantine (cognitive 22) (remote/src/main/scala/org/apache/pekko/remote/artery/Association.scala)
- Association.send (cognitive 50) (remote/src/main/scala/org/apache/pekko/remote/artery/Association.scala)
- …and 1099 more

## Changes since last survey

- 102 commits — 79 feature/other, 23 fixes

## By area

- project/Dependencies.scala — 27 commits
- remote/src — 13 commits
- actor/src — 11 commits
- .github/workflows — 8 commits
- actor-tests/src — 8 commits
- docs/src — 8 commits
- project/plugins.sbt — 4 commits
- serialization-jackson/src — 4 commits
- (root) — 3 commits
- cluster/src — 3 commits
- persistence-typed/src — 2 commits
- persistence/src — 2 commits
- project/build.properties — 2 commits
- (repo) — 1 commit
- actor-testkit-typed/src — 1 commit
- bench-jmh/src — 1 commit
- coordination/src — 1 commit
- slf4j/src — 1 commit
- stream-tests/src — 1 commit
- stream/src — 1 commit

## Notable commits

- fix: Fix image paths in substream docs (#3470)
- fix: fix: bound Jackson payload decompression size (#3491)
- fix: fix: bound compression-pointer hops in DNS name parsing (#3490)
- fix: fix: bound inbound Artery TCP frame length at framing (#3492)
- fix: fix: bound nesting depth when deserializing enclosed payloads (#3500)
- fix: fix: bound the number of entries in a compression table advertisement (#3510)
- fix: fix: bound the size a compressed payload may expand to (#3502)
- fix: fix: bounds check the lookup table indexes in gossip (#3508)
- fix: fix: check the remote deployment allow list before deserializing constructor args (#3493)
- fix: fix: close IO resources left open on abrupt or failing paths (#3532)
- fix: fix: default the Jackson max-decompressed-size to unlimited (#3515)
- fix: fix: don't dereference a null superclass in the protobuf allow list check (#3509)
- fix: fix: don't resolve HOCON includes in config that arrived in a message (#3505)
- fix: fix: don't resolve a wire-supplied manifest class the serializer will not use (#3495)
- fix: fix: handle post-Java 8 constant pool entries in LineNumbers (#3465)
- fix: fix: log the classic hostname verification warning at warning level (#3479)
- fix: fix: make AbstractPersistentActorWithTimers and AbstractFSMWithStash subclassable from Java on Scala 3 (#3475)
- fix: fix: match actor selection wildcards without backtracking (#3506)
- fix: fix: preserve StageActor demand across fused streams (#3461)
- fix: fix: reject messages whose parallel repeated fields disagree in length (#3507)
- …and 82 more