# Changelog

## Score

- CAI 67 → 58 (-9.5)
- Rubric changed (rubric-2026.10.1 → rubric-2026.10.5) — scores are not directly comparable.

## Lenses

- Code Health 98 → 53 (-45.5)
- Architecture 77 → 76 (-0.3)
- Maturity 57 → 51 (-5.8)
- Readiness 75 → 71 (-4.1)
- Security 74 → 74 (+0.0)
- Performance 80 → 80 (+0.0)

## Resolved (9)

- Off-boarding risk: anonymized user #1
- Outdated: io.netty:netty-buffer
- Outdated: io.netty:netty-codec-http
- Outdated: io.netty:netty-codec-socks
- Outdated: io.netty:netty-handler
- Outdated: io.netty:netty-handler-proxy
- Outdated: org.asynchttpclient:async-http-client
- PR-triggered workflow without a permissions block
- Release-publishing job runs with an unscoped token

## New (26)

- Hotspot: play-ahc-ws-standalone/src/main/scala/play/api/libs/ws/ahc/StandaloneAhcWSRequest.scala (play-ahc-ws-standalone/src/main/scala/play/api/libs/ws/ahc/StandaloneAhcWSRequest.scala)
- Hotspot: play-ahc-ws-standalone/src/main/scala/play/api/libs/ws/ahc/Streamed.scala (play-ahc-ws-standalone/src/main/scala/play/api/libs/ws/ahc/Streamed.scala)
- Off-boarding risk: anonymized user #1
- Orphaned file (bench/src/main/scala/play/api/libs/ws/ahc/StandaloneAhcWSRequestBenchMapsBench.scala)
- Orphaned file (play-ahc-ws-standalone/src/main/java/play/libs/oauth/OAuth.java)
- Orphaned file (play-ahc-ws-standalone/src/main/java/play/libs/ws/ahc/AhcCurlRequestLogger.java)
- Orphaned file (play-ahc-ws-standalone/src/main/java/play/libs/ws/ahc/StandaloneAhcWSClient.java)
- Orphaned file (play-ahc-ws-standalone/src/main/java/play/libs/ws/ahc/StandaloneAhcWSResponse.java)
- Orphaned file (play-ahc-ws-standalone/src/main/java/play/libs/ws/ahc/StreamedResponse.java)
- Orphaned file (play-ahc-ws-standalone/src/main/scala/play/api/libs/ws/ahc/FormUrlEncodedParser.scala)
- Orphaned file (play-ahc-ws-standalone/src/main/scala/play/api/libs/ws/ahc/cache/AhcHttpCache.scala)
- Orphaned file (play-ahc-ws-standalone/src/main/scala/play/api/libs/ws/ahc/cache/AsyncCachingHandler.scala)
- Orphaned file (play-ahc-ws-standalone/src/main/scala/play/api/libs/ws/ahc/cache/BackgroundAsyncHandler.scala)
- Orphaned file (play-ahc-ws-standalone/src/main/scala/play/api/libs/ws/ahc/cache/CacheAsyncConnection.scala)
- Orphaned file (play-ws-standalone-xml/src/main/java/play/libs/ws/XML.java)
- Orphaned file (play-ws-standalone/src/main/java/play/libs/ws/DefaultBodyWritables.java)
- Orphaned file (play-ws-standalone/src/main/java/play/libs/ws/StandaloneWSResponse.java)
- Orphaned file (play-ws-standalone/src/main/scala/play/api/libs/ws/DefaultBodyWritables.scala)
- Orphaned file (play-ws-standalone/src/main/scala/play/api/libs/ws/StandaloneWSResponse.scala)
- Orphaned file (play-ws-standalone/src/main/scala/play/api/libs/ws/WS.scala)
- …and 6 more

## Changes since last survey

- 27 commits — 27 feature/other, 0 fixes

## By area

- play-ahc-ws-standalone/src — 9 commits
- integration-tests/src — 6 commits
- (repo) — 5 commits
- (root) — 4 commits
- project/Dependencies.scala — 2 commits
- project/build.properties — 1 commit

## Notable commits

- change: Apply the configured TLS protocols and cipher suites
- change: Assert HTTP/2 backpressure in the sibling streaming test
- change: Document per-read decompression buffering
- change: Document the AHC 3 migration
- change: Document the AHC 3.0.14 HTTPS-proxy ALPN limitation
- change: Document the AHC 3.0.14 raw-Cookie limitation with a cookie store
- change: Expose AHC 3 client controls without breaking existing config callers
- change: Expose opt-in redirect refusals
- change: Guard compressed streaming against an extra stale-resume read
- change: Keep HTTP/2 off while Play WS cannot negotiate it over HTTPS
- change: Merge pull request #1481 from mkurz/feature/ahc-3-clean-upgrade
- change: Merge pull request #1482 from mkurz/play-json-3.1.0-M10+108-69160600-SNAPSHOT
- change: Merge pull request #1483 from mkurz/feature/https-alpn
- change: Merge pull request #1484 from scala-steward/update/netty-buffer-4.2.19.Final
- change: Merge pull request #1488 from scala-steward/update/sbt-2.1.0-RC1
- change: Negotiate HTTP/2 over HTTPS through ALPN
- change: Present client certificates on the loose TLS path
- change: Preserve OAuth 1 signing and Digest authentication
- change: Preserve request construction and cache behavior
- change: Re-check off-loop resumes on the event loop
- …and 7 more

## Architecture

- 0 containers · 1 bounded contexts · 0 dependency edges (baseline)