# Changelog

> **This is the PUBLIC form of this artifact. Findings are listed in full, but the details of SECURITY findings — which rule fired, in which file, on which line, and how to fix it — are deliberately withheld, and any secret-scanner results are excluded entirely. Where detail is absent here it was REMOVED FOR PUBLICATION; it is not missing from the analysis. The complete artifact is available from the repository owner.**

## Score

- CAI 58 → 57 (-0.8)

## Lenses

- Code Health 46 → 46 (-0.9)
- Architecture 93 → 92 (-0.4)
- Maturity 71 → 67 (-4.5)
- Readiness 68 → 68 (-0.0)
- Security 64 → 64 (+0.2)
- Performance 71 → 71 (+0.0)

## Resolved (35)

- Critical CVE: [GHSA redacted] (pnpm-lock.yaml)
- Duplicated block (11 lines × 2) (crates/loro-internal/src/state/list_state.rs)
- Duplicated block (11–12 lines × 2) (crates/loro-internal/src/diff_calc.rs)
- Duplicated block (22 lines × 2) (crates/loro-internal/src/encoding/outdated_encode_reordered.rs)
- FixmeComment (crates/loro/tests/integration_test/undo_test.rs)
- FixmeComment (crates/loro/tests/integration_test/undo_test.rs)
- High CVE: [GHSA redacted] (crates/loro-wasm/pnpm-lock.yaml)
- High CVE: [GHSA redacted] (pnpm-lock.yaml)
- High CVE: [GHSA redacted] (pnpm-lock.yaml)
- High CVE: [GHSA redacted] (pnpm-lock.yaml)
- High CVE: [GHSA redacted] (crates/loro-wasm/pnpm-lock.yaml)
- High CVE: [GHSA redacted] (pnpm-lock.yaml)
- High: security finding (details withheld)
- InnerStore::track_value_cache (cognitive 17) (crates/loro-internal/src/state/container_store/inner_store.rs)
- LoroDoc.#applyOperation (cognitive 20) (loro-js/src/runtime/document.ts)
- LoroDoc.#indexHistoryOperations (cyclomatic 19) (loro-js/src/runtime/document.ts)
- LoroDoc.#withoutLiveChildInserts (cognitive 18) (loro-js/src/runtime/document.ts)
- LoroDoc.#withoutLiveChildInserts (cyclomatic 18) (loro-js/src/runtime/document.ts)
- LoroDoc::_apply_diff (cognitive 54) (crates/loro-internal/src/loro.rs)
- LoroDoc::_apply_diff (cyclomatic 26) (crates/loro-internal/src/loro.rs)
- …and 15 more

## New (81)

- ClassTooLong: LoroDoc (crates/loro/src/lib.rs)
- Critical CVE: [GHSA redacted] (loro-js/package.json)
- Duplicated block (8 lines × 2) (crates/loro-internal/src/state/value_decode.rs)
- FileTooLong: undo/movable_list.rs (crates/loro-internal/src/undo/movable_list.rs)
- FixmeComment (crates/loro/tests/integration_test/undo_test.rs)
- High CVE: [GHSA redacted] (pnpm-lock.yaml)
- High CVE: [GHSA redacted] (crates/loro-wasm/package.json)
- High CVE: [GHSA redacted] (loro-js/package.json)
- High CVE: [GHSA redacted] (pnpm-lock.yaml)
- High CVE: [GHSA redacted] (pnpm-lock.yaml)
- High CVE: [GHSA redacted] (crates/loro-wasm/package.json)
- Hotspot: crates/loro-internal/src/container/richtext/richtext_state.rs (crates/loro-internal/src/container/richtext/richtext_state.rs)
- Hotspot: crates/loro-internal/src/encoding/json_schema.rs (crates/loro-internal/src/encoding/json_schema.rs)
- Hotspot: crates/loro-internal/src/encoding/outdated_encode_reordered.rs (crates/loro-internal/src/encoding/outdated_encode_reordered.rs)
- Hotspot: crates/loro-internal/src/oplog/known_history.rs (crates/loro-internal/src/oplog/known_history.rs)
- Hotspot: crates/loro-internal/src/txn.rs (crates/loro-internal/src/txn.rs)
- ImportedValues::eq (cyclomatic 17) (crates/loro-internal/src/oplog/known_history.rs)
- LoroDoc.#installTreeMoves (cognitive 21) (loro-js/src/runtime/document.ts)
- LoroDoc.#undoMovableLists (cyclomatic 32) (loro-js/src/runtime/document.ts)
- LoroDoc::apply_diff_with_movable_undo (cognitive 67) (crates/loro-internal/src/loro.rs)
- …and 61 more

## Changes since last survey

- 23 commits — 9 feature/other, 14 fixes

## By area

- crates/loro-internal — 12 commits
- crates/loro-wasm — 4 commits
- crates/loro — 3 commits
- (repo) — 1 commit
- .github/workflows — 1 commit
- crates/delta — 1 commit
- loro-js/src — 1 commit

## Notable commits

- fix: fix(loro.js): skip cycle-closing concurrent tree moves (#1205)
- fix: fix(text): exclude trailing style anchors from slices (#1189)
- fix: fix(wasm): correct strict TypeScript declarations (#1201)
- fix: fix: keep binary import exact when JSON drops value bits
- fix: fix: keep parsed blocks out of doc-wide arenas and contain callback panics (#1197)
- fix: fix: pass release PR bodies through the environment (#1226)
- fix: fix: preserve MovableList undo identities and removal anchors (#1209)
- fix: fix: preserve text delta chunks and UTF-8 insertion order (#1230)
- fix: fix: preserve undo and redo history boundaries on no-ops (#1202)
- fix: fix: prevent stack overflow when reading and dropping deep snapshot values (#1204)
- fix: fix: reject negative cursor position counters (#1200)
- fix: fix: roll back failed undo and redo applications (#1210)
- fix: fix: traverse deep trees without overflowing the stack (#1206)
- fix: fix: use fast snapshots to bootstrap batch imports (#1208)
- change: Merge pull request #1221 from loro-dev/release-rust
- change: chore: bump version to 1.17.0
- change: chore: release rust crates v1.17.1 (#1224)
- change: chore: version packages (#1181)
- change: chore: version packages 1.17.1 (#1225)
- change: docs: clarify map child deletion undo identity (#1199)
- …and 3 more