# Changelog

> **This is the PUBLIC form of this artifact. Findings are listed in full, but the details of SECURITY findings — which rule fired, in which file, on which line, and how to fix it — are deliberately withheld, and any secret-scanner results are excluded entirely. Where detail is absent here it was REMOVED FOR PUBLICATION; it is not missing from the analysis. The complete artifact is available from the repository owner.**

## Score

- CAI 61 → 53 (-7.2)
- Rubric changed (rubric-2026.10.1 → rubric-2026.10.5) — scores are not directly comparable.

## Lenses

- Code Health 86 → 85 (-0.7)
- Architecture 67 → 98 (+30.7)
- Maturity 65 → 41 (-24.3)
- Readiness 80 → 80 (+0.0)
- Security 72 → 73 (+0.5)
- Accessibility 51 → 47 (-3.7)
- Performance 100 → 100 (+0.0)

## Resolved (18)

- Duplicated block (7 lines × 2) (src/solidlsp/language_servers/erlang_language_server.py)
- Duplicated block (8 lines × 2) (src/solidlsp/language_servers/angular_language_server.py)
- Duplicated block (8 lines × 31) (src/solidlsp/language_servers/ansible_language_server.py)
- Duplicated block (8 lines × 4) (src/solidlsp/language_servers/erlang_language_server.py)
- Duplicated block (9 lines × 3) (src/solidlsp/language_servers/nextflow_language_server.py)
- High CVE: [GHSA redacted] (uv.lock)
- Inconsistent lookup method naming. `get_tool` takes a class, while `get_tool_by_name` takes a string. The naming convention `get_X` vs `get_X_by_Y` is inconsistent. If `get_tool` is the primary lookup, it should likely be `get_tool_by_class` or `get_tool_by_type` to match the explicit nature of `get_tool_by_name`, or `get_tool_by_name` should be `get_tool_by_name` (which it is) but `get_tool` is ambiguous. Better yet, use `get_tool` for the most common case and `get_tool_by_name` for the string case, but the lack of 'by_class' in the first one is inconsistent with the explicit 'by_name' in the second.
- Inconsistent method signatures for the same operation across implementations. `CodeEditor` and `LanguageServerCodeEditor` have a simple signature, while `JetBrainsCodeEditor` adds `rename_in_comments` and `rename_in_text_occurrences` parameters. This breaks the Liskov Substitution Principle if `CodeEditor` is treated as an interface, as callers cannot rely on the base signature.
- Inconsistent naming for listing available items. `PromptFactoryBase` uses `get_prompt_names`, while `MultiLangPromptCollection` splits this into `get_prompt_template_names` and `get_prompt_list_names`. The former is ambiguous (does it include lists?), while the latter is explicit but verbose. If `PromptFactoryBase` only handles templates, it should be `get_prompt_template_names` for consistency with the collection.
- Inconsistent naming pattern for safe vs. raising accessors. While common, the library also uses `get_language_server_manager` (returns None) and `get_language_server_manager_or_raise` (raises). This is consistent internally, but `get_active_project` vs `get_active_project_or_raise` is a specific pair. However, looking at `get_tool` vs `get_tool_by_name`, there is a broader inconsistency in how lookups are named.
- Low cohesion: DependencyProvider (LCOM4 4) (src/solidlsp/language_servers/kotlin_language_server.py)
- Medium CVE: PYSEC-2026-2132 (uv.lock)
- Medium: security finding (details withheld)
- Naming inconsistency for retrieving raw template content. `PromptTemplate` uses `get_template_string` (instance method), while `PromptFactoryBase` uses `get_prompt_template_string` (factory method). The prefix 'prompt_' in the factory method is redundant given the class context, and the verb 'get' vs implicit retrieval differs slightly in style.
- Off-boarding risk: anonymized user #1
- Project.gather_source_files (cognitive 24) (src/serena/project.py)
- Repeated repair: src/serena/memories/memory_manager.py (src/serena/memories/memory_manager.py)
- SolidLanguageServer._load_raw_document_symbols_cache (cognitive 18) (src/solidlsp/ls.py)

## New (46)

- AngularLanguageServer._find_representative_source_file (cognitive 25) (src/solidlsp/language_servers/angular_language_server.py)
- AngularLanguageServer._find_representative_source_file (cyclomatic 16) (src/solidlsp/language_servers/angular_language_server.py)
- Duplicated block (10 lines × 2) (src/solidlsp/language_servers/csharp_language_server.py)
- Duplicated block (10–11 lines × 2) (src/solidlsp/language_servers/emmylua_ls.py)
- Duplicated block (13 lines × 2) (src/solidlsp/language_servers/vue_language_server.py)
- Duplicated block (13–14 lines × 2) (src/solidlsp/language_servers/csharp_language_server.py)
- Duplicated block (14 lines × 2) (src/solidlsp/language_servers/angular_language_server.py)
- Duplicated block (14–16 lines × 2) (src/solidlsp/language_servers/csharp_language_server.py)
- Duplicated block (15 lines × 3) (src/solidlsp/language_servers/ada_language_server.py)
- Duplicated block (15–18 lines × 2) (src/solidlsp/language_servers/csharp_language_server.py)
- Duplicated block (16–18 lines × 2) (src/solidlsp/language_servers/csharp_language_server.py)
- Duplicated block (21–28 lines × 2) (src/solidlsp/language_servers/csharp_language_server.py)
- Duplicated block (31–33 lines × 2) (src/solidlsp/language_servers/csharp_language_server.py)
- Duplicated block (5 lines × 2) (src/solidlsp/language_servers/csharp_language_server.py)
- Duplicated block (64–70 lines × 2) (src/solidlsp/language_servers/csharp_language_server.py)
- Duplicated block (8 lines × 32) (src/solidlsp/language_servers/ansible_language_server.py)
- Duplicated block (8 lines × 4) (src/solidlsp/language_servers/ada_language_server.py)
- Duplicated block (8 lines × 5) (src/solidlsp/language_servers/emmylua_ls.py)
- Duplicated block (8–9 lines × 2) (src/solidlsp/language_servers/devsense_php_language_server.py)
- Duplicated block (9 lines × 15) (src/solidlsp/language_servers/crystal_language_server.py)
- …and 26 more

## Changes since last survey

- 134 commits — 86 feature/other, 48 fixes

## By area

- (root) — 42 commits
- src/serena — 36 commits
- src/solidlsp — 16 commits
- (repo) — 15 commits
- test/serena — 6 commits
- test/solidlsp — 6 commits
- docs/01-about — 3 commits
- docs/02-usage — 3 commits
- test/conftest.py — 2 commits
- .serena/memories — 1 commit
- news/20261013.html — 1 commit
- news/20261019.html — 1 commit
- scripts/bump_version.py — 1 commit
- test/resources — 1 commit

## Notable commits

- fix: Add regression test for Project file gathering/ignore rules
- fix: Add string repr for ProjectFile, fix further regression in CLI project index
- fix: Bump Expert to v0.1.10 and drop the fixed-bug xfails in the Elixir suites (#2098)
- fix: Fix Kotlin LS not being downloadable/usable
- fix: Fix MCP registry manifest: pass Serena's arguments to the package, not the runtime (#2161)
- fix: Fix Project.scan_directory
- fix: Fix Vue companion discovery to respect project ignore patterns (#2125)
- fix: Fix dashboard log updates during HTTP MCP server execution
- fix: Fix document structure
- fix: Fix project indexing (refactoring error)
- fix: Fix symlink handling in request_full_symbol_tree (#2163)
- fix: Fix: Avoid file/package symbols leaking into the high-level document symbol cache as a result of `request_full_symbol_tree` linking document root symbols to file symbols by modifying the cached symbols in place; shallow copies are now made before linking.
- fix: Fix: Re-establish compatibility with the Claude Desktop client in chat mode
- fix: Fix: Update model used by Anthropic token estimator
- fix: Merge pull request #2033 from RizgarOzan/fix/csharp-discovery-ignored-paths
- fix: Merge pull request #2083 from anxkhn/fix/tiktoken-literal-usage-counting
- fix: Merge pull request #2132 from oraios/fix-2126-cache-issue
- fix: Merge pull request #2150 from Andiii208/fix/symlink-escape-path-confinement
- fix: Merge pull request #2155 from dafyy321-pixel/fix/stale-replacement-occurrence-ids
- fix: Merge pull request #2157 from oraios/fix-kotlin-ls
- …and 114 more

## Architecture

- 0 containers · 1 bounded contexts · 0 dependency edges (baseline)