# Changelog

> **This is the PUBLIC form of this artifact. Findings are listed in full, but the details of SECURITY findings — which rule fired, in which file, on which line, and how to fix it — are deliberately withheld, and any secret-scanner results are excluded entirely. Where detail is absent here it was REMOVED FOR PUBLICATION; it is not missing from the analysis. The complete artifact is available from the repository owner.**

## Score

- CAI 74 → 68 (-6.1)
- Rubric changed (rubric-2026.10.1 → rubric-2026.10.5) — scores are not directly comparable.

## Lenses

- Code Health 84 → 67 (-16.5)
- Architecture 98 → 98 (+0.0)
- Maturity 64 → 59 (-4.9)
- Readiness 79 → 79 (+0.0)
- Security 85 → 83 (-2.5)
- Performance 90 → 90 (+0.0)

## Resolved (10)

- Documentation: no contributor guidance (README.md)
- Documentation: no installation or build instructions (README.md)
- Documentation: no usage examples (README.md)
- Duplicate intent. Both methods take a key and an alive cache and return a server. The names suggest one might use the continuum directly and the other a lookup table, or one is public and one internal, but they are both exposed on the public `Ring` type. This forces users to guess which one to use.
- Inconsistent accessor pattern. One is a method call `tracer()` and the other is a property access `tracer`. In Ruby, this usually implies one is a getter method and the other might be a setter or a different accessor, but having both exposed on the same type for the same concept is confusing.
- Medium: security finding (details withheld)
- Medium: security finding (details withheld)
- Medium: security finding (details withheld)
- Off-boarding risk: anonymized user #1
- Redundant methods with unclear distinction. Both methods appear to retrieve a key with metadata. The suffix '_result' suggests a difference in return type (e.g., raw object vs. structured result), but without documentation, this is confusing. Similarly, 'get_multi' vs 'get_multi_with_metadata' vs 'get_multi_with_metadata_result' creates a 3-level naming hierarchy for what is likely just a variation in the response object structure.

## New (7)

- Duplicate intent. Two methods on the `Ring` class perform the same lookup operation (finding a server for a key) with identical signatures. This is a clear duplication.
- Further sole-owners (lower concentration)
- Hotspot: lib/dalli/protocol/response_processor.rb (lib/dalli/protocol/response_processor.rb)
- Off-boarding risk: anonymized user #1
- Redundant methods with unclear distinction. Both methods appear to retrieve a key with metadata. The difference between returning a raw result vs a structured result is not obvious from the signature alone, and having two parallel entry points for the same logical operation creates confusion.
- Redundant methods with unclear distinction. Similar to the single-key case, having both a block-based and a result-returning version for multi-get with metadata is inconsistent with the rest of the API (where `get_multi` returns a hash and `get` returns a value/result). It forces the user to choose between two similar APIs for the same data retrieval.
- ResponseProcessor.getk_response_from_buffer (cyclomatic 16) (lib/dalli/protocol/response_processor.rb)

## Changes since last survey

- 74 commits — 64 feature/other, 10 fixes

## By area

- lib/dalli — 26 commits
- (repo) — 22 commits
- (root) — 13 commits
- test/integration — 4 commits
- .devcontainer/Dockerfile — 2 commits
- .github/workflows — 2 commits
- .devcontainer/setup.sh — 1 commit
- .github/dependabot.yml — 1 commit
- docs/security-hardening-plan.md — 1 commit
- lib/rack — 1 commit
- test/protocol — 1 commit

## Notable commits

- fix: Merge pull request #1213 from petergoldstein/fix/raw-write-no-compress
- fix: Merge pull request #1214 from petergoldstein/fix/cas-and-flush
- fix: Merge pull request #1215 from petergoldstein/fix/tls-handshake-and-verification-warning
- fix: Merge pull request #1216 from petergoldstein/fix/server-config-and-read-limits
- fix: Merge pull request #1217 from petergoldstein/fix/options-and-rack-session-cleanups
- fix: Merge pull request #1218 from petergoldstein/fix/bad-value-keeps-quiet-writes
- fix: Merge pull request #1220 from petergoldstein/fix/rack-session-401-response
- fix: Merge pull request #1222 from jaideeppyne/fix/metadata-network-errors
- fix: Merge remote-tracking branch 'origin/main' into fix/options-and-rack-session-cleanups
- fix: fix: retry metadata bulk reads and surface terminal network errors
- change: Add PR number to #1222 changelog entry
- change: Add PR number to changelog entry
- change: Add PR number to changelog entry
- change: Add PR number to changelog entry
- change: Add changelog entries for #1213-#1218
- change: Add connect_timeout option
- change: Bound DNS resolution by socket_timeout when opening a TCP socket
- change: Bound decompression without relying on zlib yielding chunks
- change: Bump actions/upload-artifact from 7.0.1 to 7.0.2
- change: Call the cas block for a stored nil when cache_nils is on
- …and 54 more