# Changelog

## Score

- CAI 63 → 53 (-10.7)
- Rubric changed (rubric-2026.10.1 → rubric-2026.10.5) — scores are not directly comparable.

## Lenses

- Code Health 78 → 64 (-14.0)
- Architecture 66 → 71 (+5.3)
- Maturity 57 → 34 (-22.1)
- Readiness 68 → 72 (+3.8)
- Security 76 → 76 (+0.0)
- Performance 76 → 76 (+0.0)

## Resolved (3)

- Off-boarding risk: anonymized user #1
- PR-triggered workflow without a permissions block
- Release-publishing job runs with an unscoped token

## New (11)

- Duplicated block (10 lines × 2) (play-json/shared/src/main/scala-2.13+/play/api/libs/json/ImmutableLinkedHashMap.scala)
- Off-boarding risk: anonymized user #1
- Orphaned file (benchmarks/src/main/scala/play/api/libs/json/HashCodeCollider.scala)
- Orphaned file (play-json-joda/src/main/scala/play/api/libs/json/JodaReads.scala)
- Orphaned file (play-json/js-native/src/main/scala/StaticBindingNonJvm.scala)
- Orphaned file (play-json/native/src/main/scala/StaticBinding.scala)
- Orphaned file (play-json/shared/src/main/scala-2/play/api/libs/json/JsMacros.scala)
- Orphaned file (play-json/shared/src/main/scala/play/api/libs/json/JsValue.scala)
- PR-triggered workflow without a permissions block (.github/workflows/build-test.yml)
- Release-publishing job runs with an unscoped token (.github/workflows/release-drafter.yml)
- Workflow token permissions not restricted (.github/workflows/publish.yml)

## Changes since last survey

- 8 commits — 6 feature/other, 2 fixes

## By area

- (repo) — 3 commits
- (root) — 1 commit
- benchmarks/src — 1 commit
- play-json/jvm — 1 commit
- play-json/shared — 1 commit
- project/build.properties — 1 commit

## Notable commits

- fix: Fix the OWritesBench compilation on Scala 2
- fix: Merge pull request #1485 from linyiru/fix/owrites-bench-compile
- change: Measure two instances in the + footprint test
- change: Merge pull request #1479 from linyiru/perf/immutable-lhm-copy
- change: Merge pull request #1491 from scala-steward/update/patches
- change: Separate the shallowCopy steps with blank lines
- change: jackson-core 2.22.4 (was 2.22.3)
- change: sbt 2.1.0-RC1 (was 2.1.0-M3) (#1489)

## Architecture

- 0 containers · 1 bounded contexts · 0 dependency edges (baseline)