# Changelog

> **This is the PUBLIC form of this artifact. Findings are listed in full, but the details of SECURITY findings — which rule fired, in which file, on which line, and how to fix it — are deliberately withheld, and any secret-scanner results are excluded entirely. Where detail is absent here it was REMOVED FOR PUBLICATION; it is not missing from the analysis. The complete artifact is available from the repository owner.**

## Score

- CAI 27 → 33 (+5.4)
- Rubric changed (rubric-2026.08.17 → rubric-2026.08.18) — scores are not directly comparable.

## Lenses

- Code Health 25 → 25 (+0.0)
- Architecture 100 → 100 (-0.2)
- Maturity 50 → 60 (+9.6)
- Readiness 18 → 26 (+7.4)
- Security 47 → 67 (+19.6)
- Accessibility 32 → 36 (+3.3)

## Resolved (74)

- Coverage not included — suite not readable by the collector
- Dependency hygiene not measured — no supported dependency manifest was read
- Low IaC: DS-0005 (src/crypto/internal/boring/Dockerfile)
- Low IaC: DS-0005 (src/crypto/internal/boring/Dockerfile)
- Low IaC: DS-0026 (src/crypto/internal/boring/Dockerfile)
- Low IaC: DS-0026 (src/crypto/internal/fips140/nistec/fiat/Dockerfile)
- Medium IaC: DS-0013 (src/crypto/internal/boring/Dockerfile)
- Medium IaC: DS-0013 (src/crypto/internal/fips140/nistec/fiat/Dockerfile)
- Medium: security finding (details withheld)
- Medium: security finding (details withheld)
- Off-boarding risk: anonymized user #1
- Off-boarding risk: anonymized user #10
- Off-boarding risk: anonymized user #11
- Off-boarding risk: anonymized user #12
- Off-boarding risk: anonymized user #13
- Off-boarding risk: anonymized user #14
- Off-boarding risk: anonymized user #15
- Off-boarding risk: anonymized user #16
- Off-boarding risk: anonymized user #2
- Off-boarding risk: anonymized user #3
- …and 54 more

## New (30)

- Boundary-crossing change coupling: ssa.go ↔ cpuflags.go (src/cmd/compile/internal/ssagen/ssa.go)
- Boundary-crossing change coupling: table.go ↔ doc.go (src/internal/godebugs/table.go)
- Change coupling: arshal_default.go ↔ doc.go (src/encoding/json/v2/arshal_default.go)
- Change coupling: cpuflags.go ↔ proc.go (src/runtime/cpuflags.go)
- Change coupling: gen_simdGenericOps.go ↔ gen_simdTypes.go (src/simd/archsimd/_gen/simdgen/gen_simdGenericOps.go)
- Change coupling: gen_simdGenericOps.go ↔ gen_simdrules.go (src/simd/archsimd/_gen/simdgen/gen_simdGenericOps.go)
- Coverage read from a committed report
- Dependency hygiene not measured — dependency manifest found but not parsed for hygiene
- Medium CVE: GO-2025-3503 (misc/go.mod)
- Medium CVE: GO-2026-4599 (src/crypto/internal/fips140/nistec/_asm/go.mod)
- Medium vulnerability: GO-2026-5932 (src/go.mod)
- Off-boarding risk: anonymized user #8
- Off-boarding risk: anonymized user #16
- Off-boarding risk: anonymized user #10
- Off-boarding risk: anonymized user #18
- Off-boarding risk: anonymized user #4
- Off-boarding risk: anonymized user #2
- Off-boarding risk: anonymized user #1
- Off-boarding risk: anonymized user #9
- Off-boarding risk: anonymized user #17
- …and 10 more

## Changes since last survey

- 79 commits — 68 feature/other, 11 fixes

## By area

- src/cmd — 52 commits
- src/crypto — 7 commits
- src/runtime — 3 commits
- src/go — 2 commits
- src/internal — 2 commits
- src/net — 2 commits
- src/os — 2 commits
- src/database — 1 commit
- src/debug — 1 commit
- src/math — 1 commit
- src/reflect — 1 commit
- src/simd — 1 commit
- src/sync — 1 commit
- src/vendor — 1 commit
- test/codegen — 1 commit
- test/fixedbugs — 1 commit

## Notable commits

- fix: cmd/compile: fix mergelocals for arm32/s390x/riscv64
- fix: cmd/compile: fix mergelocals on mips/mips64
- fix: cmd/compile: fix prove to generate Const64 for 64bits slicemasks
- fix: cmd/compile: fix time traveling proofs in prove
- fix: cmd/vet: fix misspelled analyzer name in test
- fix: crypto/internal/fips140/aes/gcm: fix ctxt load/store for short tags
- fix: database/sql/driver: fix Rows.Next() comment
- fix: debug: fix comment error
- fix: internal/fuzz: fix race between context deadline and error suppression
- fix: runtime: fix uninitialized 7th argument in mach_vm_region_trampoline
- fix: test: add regression test for go.dev/issue/80520
- change: cmd/asm, cmd/internal/obj: add crypto algorithm suites for riscv64
- change: cmd/compile/internal/noder: add package documentation
- change: cmd/compile/internal/ssa/_gen: disallow op variable name
- change: cmd/compile/internal/ssa: avoid fuse removing edges with live phis
- change: cmd/compile/internal/ssa: in generate_test look in subdirectories
- change: cmd/compile/internal/ssa: lower bits.Mul64 to MULXQ on GOAMD64>=v3
- change: cmd/compile/internal/ssa: lower byte compare against 128 to TBNZ/TBZ on arm64
- change: cmd/compile/internal/ssa: move Register to ssabase package and BlockKind to block subpackage
- change: cmd/compile/internal/ssa: remove unused poset unsigned machinery
- …and 59 more