# Changelog

> **This is the PUBLIC form of this artifact. Findings are listed in full, but the details of SECURITY findings — which rule fired, in which file, on which line, and how to fix it — are deliberately withheld, and any secret-scanner results are excluded entirely. Where detail is absent here it was REMOVED FOR PUBLICATION; it is not missing from the analysis. The complete artifact is available from the repository owner.**

## Score

- CAI 51 → 57 (+5.9)
- Rubric changed (rubric-2026.08.17 → rubric-2026.08.18) — scores are not directly comparable.

## Lenses

- Architecture 100 → 100 (+0.0)
- Maturity 58 → 61 (+3.3)
- Readiness 64 → 64 (+0.0)
- Security 32 → 46 (+14.3)

## Resolved (171)

- Dependency hygiene not measured — no supported dependency manifest was read
- Duplicated block (10 lines × 2) (third_party/java/proguard/proguard6.2.2/src/proguard/Initializer.java)
- Duplicated block (10 lines × 2) (third_party/java/proguard/proguard6.2.2/src/proguard/Initializer.java)
- Duplicated block (10 lines × 2) (third_party/java/proguard/proguard6.2.2/src/proguard/backport/Backporter.java)
- Duplicated block (10 lines × 2) (third_party/java/proguard/proguard6.2.2/src/proguard/classfile/LibraryClass.java)
- Duplicated block (10 lines × 2) (third_party/java/proguard/proguard6.2.2/src/proguard/classfile/editor/ConstantPoolShrinker.java)
- Duplicated block (10 lines × 2) (third_party/java/proguard/proguard6.2.2/src/proguard/classfile/visitor/ConcreteClassDownTraveler.java)
- Duplicated block (10 lines × 2) (third_party/java/proguard/proguard6.2.2/src/proguard/optimize/evaluation/InstructionUsageMarker.java)
- Duplicated block (10 lines × 2) (third_party/java/proguard/proguard6.2.2/src/proguard/optimize/evaluation/VariableOptimizer.java)
- Duplicated block (10 lines × 2) (third_party/java/proguard/proguard6.2.2/src/proguard/optimize/info/ParameterEscapedMarker.java)
- Duplicated block (10 lines × 6) (third_party/java/proguard/proguard6.2.2/src/proguard/ConfigurationChecker.java)
- Duplicated block (11 lines × 2) (third_party/java/proguard/proguard6.2.2/src/proguard/ClassSpecificationVisitorFactory.java)
- Duplicated block (11 lines × 2) (third_party/java/proguard/proguard6.2.2/src/proguard/backport/LambdaExpression.java)
- Duplicated block (11 lines × 2) (third_party/java/proguard/proguard6.2.2/src/proguard/classfile/ProgramClass.java)
- Duplicated block (11 lines × 2) (third_party/java/proguard/proguard6.2.2/src/proguard/classfile/editor/CompactCodeAttributeComposer.java)
- Duplicated block (11 lines × 2) (third_party/java/proguard/proguard6.2.2/src/proguard/classfile/editor/CompactCodeAttributeComposer.java)
- Duplicated block (11 lines × 2) (third_party/java/proguard/proguard6.2.2/src/proguard/obfuscate/Obfuscator.java)
- Duplicated block (11 lines × 2) (third_party/java/proguard/proguard6.2.2/src/proguard/optimize/evaluation/EvaluationSimplifier.java)
- Duplicated block (11 lines × 2) (third_party/java/proguard/proguard6.2.2/src/proguard/optimize/evaluation/SimpleEnumDescriptorSimplifier.java)
- Duplicated block (11 lines × 2) (third_party/java/proguard/proguard6.2.2/src/proguard/optimize/peephole/MethodInliner.java)
- …and 151 more

## New (70)

- Dependency hygiene not measured — dependency manifest found but not parsed for hygiene
- Further orphaned files (smaller)
- High CVE: [GHSA redacted] (requirements.txt)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- Off-boarding risk: anonymized user #3
- Off-boarding risk: anonymized user #2
- Off-boarding risk: anonymized user #1
- Orphaned knowledge (third_party/java/proguard/proguard6.2.2/src/proguard/ClassSpecificationVisitorFactory.java)
- Orphaned knowledge (third_party/java/proguard/proguard6.2.2/src/proguard/ConfigurationParser.java)
- Orphaned knowledge (third_party/java/proguard/proguard6.2.2/src/proguard/ConfigurationWriter.java)
- Orphaned knowledge (third_party/java/proguard/proguard6.2.2/src/proguard/Initializer.java)
- Orphaned knowledge (third_party/java/proguard/proguard6.2.2/src/proguard/backport/AbstractAPIConverter.java)
- Orphaned knowledge (third_party/java/proguard/proguard6.2.2/src/proguard/backport/LambdaExpressionConverter.java)
- Orphaned knowledge (third_party/java/proguard/proguard6.2.2/src/proguard/backport/StreamSupportConverter.java)
- Orphaned knowledge (third_party/java/proguard/proguard6.2.2/src/proguard/classfile/ClassConstants.java)
- Orphaned knowledge (third_party/java/proguard/proguard6.2.2/src/proguard/classfile/attribute/visitor/DebugAttributeVisitor.java)
- Orphaned knowledge (third_party/java/proguard/proguard6.2.2/src/proguard/classfile/attribute/visitor/SingleTimeAttributeVisitor.java)
- Orphaned knowledge (third_party/java/proguard/proguard6.2.2/src/proguard/classfile/editor/AttributeAdder.java)
- …and 50 more

## Changes since last survey

- 118 commits — 100 feature/other, 18 fixes

## By area

- src/main — 71 commits
- src/test — 26 commits
- (root) — 7 commits
- src/tools — 6 commits
- .bazelci/build_bazel_binaries.yml — 1 commit
- .github/scripts — 1 commit
- .github/workflows — 1 commit
- docs/contribute — 1 commit
- docs/docs — 1 commit
- scripts/release — 1 commit
- third_party/protobuf.patch — 1 commit
- tools/jdk — 1 commit

## Notable commits

- fix: Fix /proc/<pid>/stat parsing to handle process names with spaces.
- fix: Fix HTTP-proxy Proxy-Authorization leak to HTTPS origins.
- fix: Fix `setup_javabase` on Windows
- fix: Fix action rewinding with a non-verifying AC (https://github.com/bazelbuild/bazel/pull/30266)
- fix: Fix chained-symlink escape handling in CompressedTarFunction.
- fix: Fix critical path gap when actions consume TreeFileArtifacts from fast template expansion actions.
- fix: Fix handling of symbolic/hard links when using `strip_components` (https://github.com/bazelbuild/bazel/pull/30044)
- fix: Fix incorrect TargetSummaryEvent when target-building actions are cached with Skymeld.
- fix: Fix macOS build breakage introduced by https://github.com/bazelbuild/bazel/commit/b0f8378f16614779db8f92827440b42b7ba96746.
- fix: Fix out-of-bounds heap access in singlejar extra field copying.
- fix: Fix post-analysis query (`cquery`/`aquery`) output truncation under `--keep_going`.
- fix: Fix race condition in worker death detection (https://github.com/bazelbuild/bazel/pull/30067)
- fix: Fix race condition when reading worker response from exiting process.
- fix: Fix read-only enforcement for hermetic sandbox mounts.
- fix: Fix release script for rolling releases
- fix: Fix scope leak in ParsedFlagsValue.applyTo() (https://github.com/bazelbuild/bazel/pull/29494)
- fix: Minor grammar and formatting fixes.
- fix: Quote TAB in Windows command-line escaper and fix narrowing.
- change: .
- change: Add --experimental_max_repeated_lost_inputs to make the action-rewinding lost-input limit configurable (https://github.com/bazelbuild/bazel/pull/30164)
- …and 98 more

## Architecture

- Unchanged — 0 containers · 2 contexts · 0 edges