# Changelog

## Score

- CAI 67 → 63 (-4.0)
- Rubric changed (rubric-2026.10.1 → rubric-2026.10.5) — scores are not directly comparable.

## Lenses

- Code Health 98 → 75 (-23.5)
- Architecture 69 → 69 (+0.0)
- Maturity 59 → 54 (-4.6)
- Readiness 67 → 67 (+0.0)
- Security 97 → 97 (+0.0)

## Resolved (6)

- Hotspot: lib/down/chunked_io.rb (lib/down/chunked_io.rb)
- Inconsistent access pattern for metadata properties. Httpx exposes `charset` and `content_type` as properties, while Http, NetHttp, and Wget expose them as methods. This forces users to check the type of the `DownloadedFile` instance to know whether to call a method or access a property.
- Inconsistent method signatures for opening a stream. Http and Httpx are consistent, but NetHttp lacks the `rewindable` parameter, and Wget includes `args` and `options` which are absent in others. This breaks the Liskov Substitution Principle for the `open` operation.
- Inconsistent method signatures for the same logical operation (downloading a file) across different backend implementations. Http and Httpx share a signature, but NetHttp has a drastically simplified signature (only url), and Wget has a different argument order and structure (args/options separated). This forces callers to implement complex conditional logic or adapters to use different backends interchangeably.
- While the method name is consistent, the return type behavior is likely inconsistent due to the underlying HTTP client differences (e.g., NetHttp might not parse Content-Disposition as reliably as Httpx). More critically, the `content_type` and `charset` accessors are inconsistent: Http/NetHttp/Wget use methods `content_type()` and `charset()`, while Httpx uses properties `content_type` and `charset`. This mixes method and property access patterns for the same data.
- Workflow token permissions not restricted

## New (6)

- Inconsistent accessor style for the charset property. Http and Wget use a method call (charset()), while Httpx uses a property access (charset).
- Inconsistent accessor style for the content_type property. Http, NetHttp, and Wget use a method call (content_type()), while Httpx uses a property access (content_type). This breaks consistency in how users retrieve the same information.
- Inconsistent method signatures for the 'open' operation across backend implementations. Similar to download(), NetHttp.open() takes only a URL, while Http/Httpx take (url, rewindable), and Wget takes (url, args, rewindable, options). This inconsistency makes it difficult to swap backends transparently.
- Inconsistent method signatures for the primary download operation across different backend implementations. While Down.download() and Down.Backend.download() provide a unified interface, the specific backend classes (Http, Httpx, NetHttp, Wget) expose vastly different signatures. NetHttp.download() only takes a URL, whereas Http/Httpx/Wget require numerous positional arguments for size limits, progress callbacks, and file handling. This forces users to know the specific backend's signature or rely on the top-level Down module, breaking polymorphism.
- Inconsistent property vs method access for metadata. Httpx exposes url, headers, charset, and content_type as properties, while Http and Wget expose url and headers as properties but content_type() and charset() as methods. This creates a confusing API where the same type of data is accessed differently depending on the backend.
- Workflow token permissions not restricted (.github/workflows/ci.yml)

## Changes since last survey

- 3 commits — 3 feature/other, 0 fixes

## By area

- (root) — 2 commits
- test/support — 1 commit

## Notable commits

- change: Avoid warnings on requiring `cgi` on Ruby 4.0+
- change: Bump to 5.6.1
- change: Ignore warnings from http-cookie