# Changelog

> **This is the PUBLIC form of this artifact. Findings are listed in full, but the details of SECURITY findings — which rule fired, in which file, on which line, and how to fix it — are deliberately withheld, and any secret-scanner results are excluded entirely. Where detail is absent here it was REMOVED FOR PUBLICATION; it is not missing from the analysis. The complete artifact is available from the repository owner.**

## Score

- CAI 68 → 69 (+0.7)

## Lenses

- Code Health 69 → 69 (+0.0)
- Architecture 91 → 91 (-0.3)
- Maturity 70 → 73 (+2.8)
- Readiness 64 → 64 (+0.3)
- Security 71 → 73 (+1.8)
- Event Sourcing 100 → 100 (+0.0)
- Performance 78 → 78 (+0.0)

## Resolved (21)

- Ambiguous naming for untainting operations. 'PUntaint' likely extracts the value, while 'PUntaintNoFailure' suggests a variant that doesn't fail, but the signature 'PUntaintNoFailure(f)' implies it takes a function 'f', which is confusing. It is unclear if 'f' is the function to apply to the untainted value or if 'PUntaintNoFailure' is a misnamed method that actually applies a function safely.
- Critical CVE: [GHSA redacted] (package-lock.json)
- Deprecated: XUnit
- Hotspot: src/Fable.Cli/Pipeline.fs (src/Fable.Cli/Pipeline.fs)
- Hotspot: src/Fable.Transforms/Beam/Fable2Beam.Reflection.fs (src/Fable.Transforms/Beam/Fable2Beam.Reflection.fs)
- Hotspot: src/Fable.Transforms/Python/Fable2Python.Annotation.fs (src/Fable.Transforms/Python/Fable2Python.Annotation.fs)
- Hotspot: src/Fable.Transforms/QuotationEmitter.fs (src/Fable.Transforms/QuotationEmitter.fs)
- Hotspot: src/fable-library-py/src/array.rs (src/fable-library-py/src/array.rs)
- Hotspot: src/fable-library-py/src/native_array.rs (src/fable-library-py/src/native_array.rs)
- Hotspot: src/fable-library-rust/src/Map.fs (src/fable-library-rust/src/Map.fs)
- Off-boarding risk: anonymized user #1
- Off-boarding risk: anonymized user #2
- Off-boarding risk: anonymized user #3
- Off-boarding risk: anonymized user #4
- Outdated (npm): concurrently
- Outdated (npm): shell-quote
- Redundant null-handling creation methods. 'Create' returns MaybeNull, 'CreateNonNull' presumably throws or asserts, and 'CreateWithNullCheck' seems to overlap with 'Create' but adds a 'name' parameter for error messages. The distinction between 'Create' and 'CreateWithNullCheck' is unclear without implementation details, suggesting potential duplication of intent with slightly different error handling.
- Repeated repair: src/Fable.Transforms/FSharp2Fable.fs (src/Fable.Transforms/FSharp2Fable.fs)
- Repeated repair: src/fable-library-beam/fable_async.erl (src/fable-library-beam/fable_async.erl)
- Repeated repair: src/fable-library-py/src/ints.rs (src/fable-library-py/src/ints.rs)
- …and 1 more

## New (56)

- FileTooLong: fable-library-beam/Seq.fs (src/fable-library-beam/Seq.fs)
- FileTooLong: src/Main.fs (src/fable-standalone/src/Main.fs)
- High: security finding (details withheld)
- High: security finding (details withheld)
- Hotspot: src/Fable.Cli/Entry.fs (src/Fable.Cli/Entry.fs)
- Hotspot: src/Fable.Compiler/MSBuildCrackerResolver.fs (src/Fable.Compiler/MSBuildCrackerResolver.fs)
- Hotspot: src/Fable.Transforms/Php/Fable2Php.fs (src/Fable.Transforms/Php/Fable2Php.fs)
- Hotspot: src/fable-compiler-js/src/app.fs (src/fable-compiler-js/src/app.fs)
- Hotspot: src/fable-standalone/src/Main.fs (src/fable-standalone/src/Main.fs)
- Inconsistent naming for untainting operations. 'PUntaint' is a method on the instance, while 'PUntaintNoFailure' takes a function argument. The 'NoFailure' suffix is non-standard and unclear. It is not obvious if 'PUntaint' can fail or if 'PUntaintNoFailure' is a variant that handles errors differently.
- Inconsistent use of 'Try' prefix and return types. Some methods return 'Tainted' directly (implying they might throw or wrap), while others return 'Tainted' but are named 'Try...'. 'unmarshal' is a distinct operation but lacks the 'Try' prefix despite likely being fallible. The distinction between 'TryTypeMember' and 'TryTypeMemberNonNull' is unclear without documentation.
- Off-boarding risk: anonymized user #5
- Off-boarding risk: anonymized user #2
- Off-boarding risk: anonymized user #1
- Off-boarding risk: anonymized user #4
- Off-boarding risk: anonymized user #3
- Orphaned file (src/Fable.AST/Common.fs)
- Orphaned file (src/Fable.Transforms/Php/PhpPrinter.fs)
- Orphaned file (src/Fable.Transforms/Printer.fs)
- Orphaned file (src/fable-library-dart/Date.dart)
- …and 36 more

## Changes since last survey

- 84 commits — 48 feature/other, 36 fixes

## By area

- src/Fable.Transforms — 20 commits
- src/fable-standalone — 9 commits
- src/fable-library-ts — 8 commits
- src/fable-library-py — 7 commits
- src/Fable.Cli — 6 commits
- (root) — 5 commits
- src/fable-compiler-js — 5 commits
- src/Fable.Compiler — 4 commits
- .github/workflows — 3 commits
- src/fable-library-beam — 3 commits
- .config/dotnet-tools.json — 2 commits
- src/Fable.Core — 2 commits
- tests/Beam — 2 commits
- tests/Integration — 2 commits
- tests/Python — 2 commits
- .github/dependabot.yml — 1 commit
- src/Fable.Build — 1 commit
- tests/React — 1 commit
- tests/Rust — 1 commit

## Notable commits

- fix: fix(all): More union type tests (#5091)
- fix: fix(all): forward `--targetprofile` for precompile (#5085)
- fix: fix(all): kill --run process on SIGTERM everywhere (#5140)
- fix: fix(all): recompile dependents on signature change in watch (#5084)
- fix: fix(all): refresh unchanged outputs so up-to-date skip works (#5145)
- fix: fix(all): render warning code without repeating the tag (#5142)
- fix: fix(all): report compiler agent failures instead of hanging (#5144)
- fix: fix(all): serialize output directory deduplication (#5143)
- fix: fix(all): support implicit conversion to erased unions (#5058)
- fix: fix(beam): make lazy sequence wrappers process-portable (#5063)
- fix: fix(beam): normalize exception messages and string split separators (#5053)
- fix: fix(beam): preserve async cancellation and finalize resources once (#5057)
- fix: fix(js/ts): accept decimal integers up to 2^96
- fix: fix(js/ts): add missing Async and Task members, cancel timed-out StartChild, bind Async in task { } (#5097)
- fix: fix(js/ts): align decimal conversion, parsing and G format
- fix: fix(js/ts): avoid full array copy in Encoding.GetString (#5069)
- fix: fix(js/ts): hash decimals by value in collections
- fix: fix(js/ts): inline interface cases of TypeScriptTaggedUnion (#5146)
- fix: fix(js/ts): keep .NET decimal scale through arithmetic (#5126)
- fix: fix(js/ts): keep decimal zero scale without leading zeros
- …and 64 more

## Architecture

- Containers 0 added · 0 removed · contexts 0 added · 0 removed · edges 2 added · 2 removed

## Added dependency edges (2)

- bench-compiler → Fable.Standalone
- fable → Fable.Transforms (coupling)

## Removed dependency edges (was a dependency, now gone) (2)

- bench-compiler → Fable.Standalone (coupling)
- fable → Fable.Transforms