# Changelog

## Score

- CAI 36 → 53 (+17.3)
- Rubric changed (rubric-2026.08.15 → rubric-2026.09.15) — scores are not directly comparable.

## Lenses

- Code Health 52 → 48 (-3.4)
- Architecture 97 → 100 (+2.9)
- Maturity 49 → 63 (+14.4)
- Readiness 15 → 46 (+30.8)
- Security 60 → 73 (+12.9)

## Resolved (85)

- Coverage not measured — test suite did not build
- Critical CVE: [GHSA redacted] (kotlin-js-store/yarn.lock)
- Critical CVE: [GHSA redacted] (kotlin-js-store/yarn.lock)
- Dimension evaluation failed
- Duplicated block (34 lines × 2) (coil-core/src/commonMain/kotlin/coil3/decode/DecodeUtils.kt)
- High CVE: [GHSA redacted] (kotlin-js-store/yarn.lock)
- High CVE: [GHSA redacted] (kotlin-js-store/yarn.lock)
- High CVE: [GHSA redacted] (kotlin-js-store/yarn.lock)
- High CVE: [GHSA redacted] (kotlin-js-store/yarn.lock)
- High CVE: [GHSA redacted] (kotlin-js-store/yarn.lock)
- High CVE: [GHSA redacted] (kotlin-js-store/yarn.lock)
- High CVE: [GHSA redacted] (kotlin-js-store/yarn.lock)
- High CVE: [GHSA redacted] (kotlin-js-store/yarn.lock)
- High CVE: [GHSA redacted] (kotlin-js-store/yarn.lock)
- High CVE: [GHSA redacted] (kotlin-js-store/yarn.lock)
- High CVE: [GHSA redacted] (kotlin-js-store/yarn.lock)
- High CVE: [GHSA redacted] (kotlin-js-store/yarn.lock)
- High CVE: [GHSA redacted] (kotlin-js-store/yarn.lock)
- High CVE: [GHSA redacted] (kotlin-js-store/yarn.lock)
- High CVE: [GHSA redacted] (kotlin-js-store/yarn.lock)
- …and 65 more

## New (88)

- AbstractContentPainterNode.modifyConstraints (cognitive 17) (coil-compose-core/src/commonMain/kotlin/coil3/compose/internal/ContentPainterModifier.kt)
- Change coupling: AsyncImage.kt ↔ SubcomposeAsyncImage.kt (coil-compose-core/src/commonMain/kotlin/coil3/compose/AsyncImage.kt)
- Change coupling: ScaleDrawable.kt ↔ CrossfadeDrawable.kt (coil-core/src/androidMain/kotlin/coil3/size/ScaleDrawable.kt)
- ClassTooLong: DiskLruCache (coil-core/src/commonMain/kotlin/coil3/disk/DiskLruCache.kt)
- Dependency hygiene PARTLY measured — Maven/Gradle declarations read, no dependency graph resolved
- DiskLruCache.completeEdit (cognitive 20) (coil-core/src/commonMain/kotlin/coil3/disk/DiskLruCache.kt)
- Documentation: no installation or build instructions (README.md)
- Documentation: no licence statement (README.md)
- Documentation: no usage examples (README.md)
- Documentation: written for insiders (docs/java_compatibility.md)
- Duplicated block (11 lines × 2) (coil-core/src/androidMain/kotlin/coil3/ColorImage.kt)
- Duplicated block (16 lines × 2) (coil-core/src/commonMain/kotlin/coil3/decode/DecodeUtils.kt)
- Duplicated block (17 lines × 2) (coil-network-ktor2/src/jvmCommonMain/kotlin/coil3/network/ktor2/internal/utils.jvmCommon.kt)
- Duplicated block (23 lines × 2) (coil-core/src/jsCommonMain/kotlin/coil3/decode/SkiaImageDecoder.jsCommon.kt)
- Duplicated block (33 lines × 2) (coil-core/src/androidMain/kotlin/coil3/decode/StaticImageDecoder.kt)
- Duplicated block (49 lines × 2) (coil-core/src/androidMain/kotlin/coil3/EventListener.kt)
- Duplicated block (56 lines × 2) (coil-network-ktor2/src/commonMain/kotlin/coil3/network/ktor2/KtorNetworkFetcher.kt)
- Duplicated block (61 lines × 2) (coil-network-ktor2/src/commonMain/kotlin/coil3/network/ktor2/internal/utils.kt)
- ErrorFunctionDetector.isInsideImageRequestBuilderLambda (cognitive 41) (coil-lint/src/main/kotlin/coil3/lint/ErrorFunctionDetector.kt)
- High CVE: [GHSA redacted] (kotlin-js-store/yarn.lock)
- …and 68 more

## Changes since last survey

- 63 commits — 59 feature/other, 4 fixes

## By area

- gradle/libs.versions.toml — 25 commits
- (root) — 20 commits
- coil-core/src — 9 commits
- gradle/wrapper — 2 commits
- (repo) — 1 commit
- .github/workflows — 1 commit
- buildSrc/src — 1 commit
- coil-bom/build.gradle.kts — 1 commit
- coil-network-core/src — 1 commit
- internal/test-js-es-modules — 1 commit
- samples/view — 1 commit

## Notable commits

- fix: Fix JS ES module test configuration (#3560)
- fix: Fix Skiko bridge for ES module consumers (#3558)
- fix: Fix android test source sets to androidHostTest and androidDeviceTest (#3597)
- fix: Fix deduplicated request cancellation handling (#3566)
- change: Adds support for loading images from blob URLs (object URLs) on web (JS/Wasm) targets (#3504)
- change: Avoid internal Skiko APIs on web (#3534)
- change: Enable suppressAgpWarnings. (#3535)
- change: Fix formatting.
- change: Group Compose Multiplatform and Skiko dependency updates (#3538)
- change: Merge pull request #3591 from coil-kt/release/3.6
- change: Migrate to AGP's new DSL. (#3567)
- change: Migrate to Bitmap.installPixelsFromArrayBuffer for decoding images on web. (#3536)
- change: Prepare 3.6.0.
- change: Prepare next development version.
- change: Prepare next development version.
- change: Prepare next development version.
- change: Prepare next development version.
- change: Prepare version 3.6.1.
- change: Prepare version 3.6.2.
- change: Prepare version 3.6.3.
- …and 43 more

## Architecture

- Containers 0 added · 0 removed · contexts 5 added · 0 removed · edges 4 added · 0 removed

## Added bounded contexts (5)

- coil-compose-core
- coil-core
- coil-gif
- coil-svg
- shared

## Added dependency edges (4)

- coil-compose-core → coil-core (coupling)
- coil-gif → coil-core
- coil-svg → coil-core
- shared → coil-core