# Changelog

> **This is the PUBLIC form of this artifact. Findings are listed in full, but the details of SECURITY findings — which rule fired, in which file, on which line, and how to fix it — are deliberately withheld, and any secret-scanner results are excluded entirely. Where detail is absent here it was REMOVED FOR PUBLICATION; it is not missing from the analysis. The complete artifact is available from the repository owner.**

## Score

- CAI 34 → 30 (-3.9)
- Rubric changed (rubric-2026.10.1 → rubric-2026.10.5) — scores are not directly comparable.

## Lenses

- Code Health 36 → 32 (-4.8)
- Architecture 89 → 89 (+0.1)
- Maturity 59 → 54 (-4.9)
- Readiness 23 → 19 (-4.1)
- Security 63 → 63 (+0.0)
- Accessibility 32 → 28 (-3.8)
- Performance 100 → 100 (+0.0)

## Resolved (21)

- Change coupling: opnsense_widget_manager.js ↔ Cpu.js (src/opnsense/www/js/opnsense_widget_manager.js)
- ClassTooLong: WidgetManager (src/opnsense/www/js/opnsense_widget_manager.js)
- Documentation: no installation or build instructions (README.md)
- Duplicated block (10 lines × 2) (src/opnsense/mvc/app/controllers/OPNsense/Trust/Api/CaController.php)
- Duplicated block (6 lines × 2) (src/opnsense/scripts/captiveportal/cp-background-process.py)
- Duplicated block (9 lines × 2) (src/opnsense/mvc/app/models/OPNsense/Firewall/FieldTypes/FilterRuleField.php)
- FileTooLong: js/opnsense_widget_manager.js (src/opnsense/www/js/opnsense_widget_manager.js)
- FilterController.moveRuleBeforeAction (cognitive 18) (src/opnsense/mvc/app/controllers/OPNsense/Firewall/Api/FilterController.php)
- Hotspot: src/opnsense/mvc/app/controllers/OPNsense/Trust/Api/CrlController.php (src/opnsense/mvc/app/controllers/OPNsense/Trust/Api/CrlController.php)
- MethodTooLong: WidgetManager._renderHeader (src/opnsense/www/js/opnsense_widget_manager.js)
- Off-boarding risk: anonymized user #1
- Off-boarding risk: anonymized user #2
- Off-boarding risk: anonymized user #3
- Off-boarding risk: anonymized user #4
- ServiceController.reconfigureAction (cognitive 18) (src/opnsense/mvc/app/controllers/OPNsense/Monit/Api/ServiceController.php)
- StatusController.getAction (cognitive 19) (src/opnsense/mvc/app/controllers/OPNsense/Monit/Api/StatusController.php)
- UIBootgrid._registerEvents (cognitive 50) (src/opnsense/www/js/opnsense_bootgrid.js)
- UIBootgrid._registerEvents (cyclomatic 33) (src/opnsense/www/js/opnsense_bootgrid.js)
- _renderOptionsForm (cognitive 33) (src/opnsense/www/js/opnsense_widget_manager.js)
- _renderOptionsForm (cyclomatic 26) (src/opnsense/www/js/opnsense_widget_manager.js)
- …and 1 more

## New (27)

- Duplicated block (5 lines × 2) (src/opnsense/scripts/captiveportal/cp-background-process.py)
- Duplicated block (8 lines × 2) (src/opnsense/scripts/captiveportal/cp-background-process.py)
- FileTooLong: js/opnsense_widgets.js (src/opnsense/www/js/opnsense_widgets.js)
- FilterBaseController.moveRuleBeforeBase (cyclomatic 22) (src/opnsense/mvc/app/controllers/OPNsense/Firewall/Api/FilterBaseController.php)
- Hotspot: src/opnsense/mvc/app/controllers/OPNsense/Firewall/Api/FilterController.php (src/opnsense/mvc/app/controllers/OPNsense/Firewall/Api/FilterController.php)
- Hotspot: src/opnsense/mvc/app/controllers/OPNsense/Trust/Api/CaController.php (src/opnsense/mvc/app/controllers/OPNsense/Trust/Api/CaController.php)
- Hotspot: src/opnsense/mvc/app/controllers/OPNsense/Trust/Api/CertController.php (src/opnsense/mvc/app/controllers/OPNsense/Trust/Api/CertController.php)
- Hotspot: src/opnsense/scripts/captiveportal/cp-background-process.py (src/opnsense/scripts/captiveportal/cp-background-process.py)
- Hotspot: src/opnsense/www/js/widgets/BaseWidget.js (src/opnsense/www/js/widgets/BaseWidget.js)
- IPsecIkev1Status.collectStatus (cognitive 22) (src/opnsense/mvc/app/library/OPNsense/System/Status/IPsecIkev1Status.php)
- Leaked secret: hardcoded-credential (src/opnsense/mvc/app/library/OPNsense/Firewall/ForwardRule.php)
- Medium: security finding (details withheld)
- NetworkInterfaceContainerField.toLegacy (cyclomatic 17) (src/opnsense/mvc/app/models/OPNsense/Interfaces/FieldTypes/NetworkInterfaceField.php)
- Off-boarding risk: anonymized user #2
- Off-boarding risk: anonymized user #1
- Off-boarding risk: anonymized user #3
- Off-boarding risk: anonymized user #4
- Orphaned file (src/opnsense/mvc/app/models/OPNsense/Monit/Migrations/M1_0_7.php)
- TooManyMethods: WidgetManager (src/opnsense/www/js/opnsense_widgets.js)
- TunnelController.searchPhase1Action (cyclomatic 17) (src/opnsense/mvc/app/controllers/OPNsense/IPsec/Api/TunnelController.php)
- …and 7 more

## Changes since last survey

- 136 commits — 115 feature/other, 21 fixes

## By area

- src/opnsense — 107 commits
- src/etc — 23 commits
- src/www — 2 commits
- (root) — 1 commit
- contrib/IXR — 1 commit
- src/man — 1 commit
- src/sbin — 1 commit

## Notable commits

- fix: Firewall: Aliases - fix performance regression introduced in https://github.com/opnsense/core/pull/8368
- fix: Firewall: NAT: Destination NAT - fix destination for no-rdr rules, related to https://github.com/opnsense/core/pull/10945
- fix: Revert "interfaces: fallback here to prevent php warnings"
- fix: Revert "interfaces: the PPP uptime option no longer exists"
- fix: Revert "mvc: UidField: allow reuse of UID 0 for system scope users"
- fix: System: Gateways - fix protocol selection for dynamic interfaces without ipprotocol set and make sure policy based routing rules can use these for both protocols. closes https://github.com/opnsense/core/issues/10978
- fix: System: Gateways - previous fix for https://github.com/opnsense/core/issues/10978 didn't work for groups, inspecting the code again does seem to prefer https://github.com/opnsense/core/pull/10982 anyway.
- fix: System: Routes: Configuration - concurrency fix and small cleanups for https://github.com/opnsense/core/issues/10569
- fix: configd: fix simulate_mode, instantly return from configdStream() before trying to use a socket. required for https://github.com/opnsense/ui_devtools
- fix: contrib: multiple deprecation fixes
- fix: firewall: Revert parts of b45e2cd as most users would predict a cloned rule to appear adjecent to the original rule (#11007)
- fix: interfaces: fix default for non-pluggable devices
- fix: interfaces: fix index into $todo for proper flag check
- fix: interfaces: fix previous
- fix: lockout: type safety fix.
- fix: mvc: also fix overrides of reconfigureForceRestart() regarding return type
- fix: mvc:model - revert part of https://github.com/opnsense/core/commit/54aa99b2d0fda5ea836724f17963d04ba7e6a061 as later commits remove the need for it
- fix: snapshots: notes: small fix
- fix: system: fix scope change validation
- fix: trust: fix handling of untrust dir, closes https://github.com/opnsense/core/issues/11062
- …and 116 more

## Architecture

- 0 containers · 1 bounded contexts · 0 dependency edges (baseline)