# Changelog

> **This is the PUBLIC form of this artifact. Findings are listed in full, but the details of SECURITY findings — which rule fired, in which file, on which line, and how to fix it — are deliberately withheld, and any secret-scanner results are excluded entirely. Where detail is absent here it was REMOVED FOR PUBLICATION; it is not missing from the analysis. The complete artifact is available from the repository owner.**

## Score

- CAI 61 → 72 (+10.4)
- Rubric changed (rubric-2026.08.17 → rubric-2026.08.18) — scores are not directly comparable.

## Lenses

- Architecture 86 → 85 (-0.6)
- Maturity 63 → 67 (+3.7)
- Readiness 70 → 81 (+11.0)
- Security 49 → 71 (+22.5)

## Resolved (94)

- Change coupling: AstForCallExpressionsCreator.scala ↔ AstForVarDeclAndAssignsCreator.scala (joern-cli/frontends/javasrc2cpg/src/main/scala/io/joern/javasrc2cpg/astcreation/expressions/AstForCallExpressionsCreator.scala)
- Change coupling: AstForControlStructuresCreator.scala ↔ AstForExpressionsCreator.scala (joern-cli/frontends/rubysrc2cpg/src/main/scala/io/joern/rubysrc2cpg/astcreation/AstForControlStructuresCreator.scala)
- Change coupling: FullNameProvider.scala ↔ FunctionDeclNodePass.scala (joern-cli/frontends/c2cpg/src/main/scala/io/joern/c2cpg/astcreation/FullNameProvider.scala)
- Dependency hygiene not measured — no supported dependency manifest was read
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- …and 74 more

## New (15)

- Change coupling: AstForDeclarationsCreator.scala ↔ AstForPrimitivesCreator.scala (joern-cli/frontends/jssrc2cpg/src/main/scala/io/joern/jssrc2cpg/astcreation/AstForDeclarationsCreator.scala)
- Change coupling: AstForExprSyntaxCreator.scala ↔ AstForSyntaxCollectionCreator.scala (joern-cli/frontends/swiftsrc2cpg/src/main/scala/io/joern/swiftsrc2cpg/astcreation/AstForExprSyntaxCreator.scala)
- Change coupling: AstForExpressionsCreator.scala ↔ AstForPrimitivesCreator.scala (joern-cli/frontends/jssrc2cpg/src/main/scala/io/joern/jssrc2cpg/astcreation/AstForExpressionsCreator.scala)
- Dependency hygiene not measured — dependency manifest found but not parsed for hygiene
- High: security finding (details withheld)
- High: security finding (details withheld)
- Medium: security finding (details withheld)
- Medium: security finding (details withheld)
- Off-boarding risk: anonymized user #3
- Off-boarding risk: anonymized user #1
- Off-boarding risk: anonymized user #2
- Off-boarding risk: anonymized user #4
- PR-triggered workflow without a permissions block
- Scanner failed to run — not a clean result
- complexity unreadable for .java, .py, .scala — churn × complexity hotspots could not be measured

## Changes since last survey

- 34 commits — 30 feature/other, 4 fixes

## By area

- joern-cli/frontends — 26 commits
- .github/workflows — 5 commits
- (root) — 2 commits
- project/UrlRetry.scala — 1 commit

## Notable commits

- fix: [CI] Fix release workflow (#6144)
- fix: [CI] Fix release-github workflow (#6143)
- fix: [rust2cpg] fix `self` parameters' typeFullNames. (#6124)
- fix: [rust2cpg] fix fn's methodFullName to include generic type parameters. (#6148)
- change: [CI] Pin GitHub Actions to commit SHAs, add Dependabot (#6145)
- change: [CI] Remove ruby setup from Github release workflow (#6140)
- change: [CI] Switch to platform-specific Github releases (#6139)
- change: [CI] Update actions/upload-artifact and actions/download-artifact (#6141)
- change: [bazel] Move build to Scala 3.8.3 and JDK target version 17. (#6131)
- change: [c2cpg] Handle C++ while and for loop condition decls properly (#6122)
- change: [csharpsrc2cpg] emit a block for body-less property setters (#6133)
- change: [csharpsrc2cpg] handle expression-bodied properties (#6129)
- change: [rubysrc2cpg] Remove unused code. (#6118)
- change: [rust2cpg] add binding nodes. (#6113)
- change: [rust2cpg] add config files. (#6156)
- change: [rust2cpg] add constructor method to structs. (#6120)
- change: [rust2cpg] add ctor for tuple/unit structs. (#6138)
- change: [rust2cpg] add dynamicTypeHint to implicit cast adjustments. (#6154)
- change: [rust2cpg] add ref edge linker. (#6147)
- change: [rust2cpg] add virtual modifiers to trait-impl methods. (#6121)
- …and 14 more