# Changelog

## Score

- CAI 68 → 69 (+1.9)
- Rubric changed (rubric-2026.09.8 → rubric-2026.09.16) — scores are not directly comparable.

## Lenses

- Code Health 80 → 81 (+0.4)
- Architecture 67 → 70 (+3.5)
- Maturity 62 → 66 (+3.6)
- Readiness 71 → 66 (-5.5)
- Security 78 → 81 (+3.3)
- Domain Modelling 100 → 100 (+0.0)
- Performance 100 (new)

## Resolved (65)

- Change coupling: blanket_hint_mostly_unused.rs ↔ unknown_lints.rs (src/diagnostics/rules/blanket_hint_mostly_unused.rs)
- Duplicated block (11 lines × 2) (src/sources/path.rs)
- Duplicated block (6 lines × 2) (src/context/mod.rs)
- Duplicated block (6 lines × 2) (src/context/mod.rs)
- Duplicated block (6 lines × 2) (src/util/credential/paseto.rs)
- FileTooLong: auth/mod.rs (src/util/auth/mod.rs)
- FunctionTooLong: cargo::context::save_credentials (src/context/mod.rs)
- FunctionTooLong: cargo::util::auth::credential_provider (src/util/auth/mod.rs)
- HackComment (src/workspace/parser/mod.rs)
- Hotspot: crates/cargo-test-macro/src/lib.rs (crates/cargo-test-macro/src/lib.rs)
- Hotspot: crates/cargo-test-support/src/registry.rs (crates/cargo-test-support/src/registry.rs)
- Hotspot: crates/cargo-util-schemas/src/manifest/mod.rs (crates/cargo-util-schemas/src/manifest/mod.rs)
- Hotspot: crates/cargo-util/src/process_builder.rs (crates/cargo-util/src/process_builder.rs)
- Hotspot: src/bin/cargo/commands/add.rs (src/bin/cargo/commands/add.rs)
- Hotspot: src/bin/cargo/commands/install.rs (src/bin/cargo/commands/install.rs)
- Hotspot: src/bin/cargo/commands/remove.rs (src/bin/cargo/commands/remove.rs)
- Hotspot: src/bin/cargo/commands/tree.rs (src/bin/cargo/commands/tree.rs)
- Hotspot: src/compiler/build_runner/compilation_files.rs (src/compiler/build_runner/compilation_files.rs)
- Hotspot: src/compiler/build_runner/mod.rs (src/compiler/build_runner/mod.rs)
- Hotspot: src/compiler/fingerprint/dep_info.rs (src/compiler/fingerprint/dep_info.rs)
- …and 45 more

## New (24)

- Boundary-crossing change coupling: lib.rs ↔ directory.rs (crates/resolver-tests/src/lib.rs)
- Change coupling clique: blanket_hint_mostly_unused.rs, im_a_teapot.rs, unknown_lints.rs (src/diagnostics/rules/blanket_hint_mostly_unused.rs)
- Dependency hygiene PARTLY measured — Cargo dependencies read, no committed lock to grade for currency
- Duplicated block (13 lines × 2) (src/sources/path.rs)
- FileTooLong: ops/cargo_clean.rs (src/ops/cargo_clean.rs)
- FunctionTooLong: cargo::bin::cargo::commands::install::exec (src/bin/cargo/commands/install.rs)
- Hotspot: src/compiler/unused_deps.rs (src/compiler/unused_deps.rs)
- Inconsistent naming and parameter structure for linking arguments. `rustc_link_arg` takes a single flag. `rustc_link_arg_bin` takes a bin name and a flag. However, `rustc_link_arg_bins`, `tests`, `examples`, and `benches` take only a flag, implying they apply to all targets of that kind. This inconsistency makes it unclear if `rustc_link_arg_bin` is meant to be the general case for a single target, while the others are bulk operations, or if the naming is just arbitrary.
- Inconsistent naming for project creation helpers. `project` creates in a default location, `project_in` takes a directory, and `project_in_home` takes a name (presumably relative to home). The naming doesn't clearly convey the relationship between the arguments and the resulting path structure.
- Inconsistent parameter order for symlink operations. `ProjectBuilder` methods take `dst` then `src`, while `Project.symlink` takes `src` then `dst`. This inconsistency increases the risk of errors when switching between building a project and manipulating an existing one.
- MethodTooLong: ArgMatchesExt.compile_options (src/util/command_prelude.rs)
- Off the main sequence: cargo-credential
- Off the main sequence: cargo-platform
- Off the main sequence: cargo-util
- Off the main sequence: cargo-util-schemas
- Off the main sequence: crates-io
- Off the main sequence: rustfix
- Off-boarding risk: anonymized user #1
- PackageRegistry::query (cyclomatic 16) (src/workspace/registry.rs)
- Projects may be oversized for their cohesion
- …and 4 more

## Changes since last survey

- 123 commits — 82 feature/other, 41 fixes

## By area

- tests/testsuite — 32 commits
- (repo) — 30 commits
- src/workspace — 13 commits
- doc/book — 11 commits
- src/ops — 7 commits
- src/compiler — 6 commits
- (root) — 4 commits
- crates/build-rs — 4 commits
- src/context — 4 commits
- src/diagnostics — 4 commits
- crates/cargo-util-schemas — 3 commits
- src/sources — 3 commits
- .github/workflows — 1 commit
- src/util — 1 commit

## Notable commits

- fix: fix(build-dep): Reject builtin dependencies in build-dependencies
- fix: fix(build-rs): make `unstable` compile  (#17489)
- fix: fix(build-rs): make unstable compile
- fix: fix(builtin-deps): Builtin dependencies manifest validation (#17499)
- fix: fix(builtin-deps): Reject `builtin = false`
- fix: fix(builtin-deps): Reject `builtin = true` in combination with other sources
- fix: fix(builtin-deps): Reject `builtin` when `workspace = true`
- fix: fix(builtin-deps): Reject version specifier on builtin deps
- fix: fix(builtin-deps): Require feature gate for patches in config
- fix: fix(builtin-deps): Require feature gate when patching with builtins
- fix: fix(builtin-deps): Require the `builtin-dependencies` feature
- fix: fix(builtin-deps): Require unstable feature for unused workspace dependency
- fix: fix(builtin-deps): Require unstable feature when replacing with builtin
- fix: fix(compilation): Preventing OUT_DIR env var from leaking into cargo run after build.rs run (#17503)
- fix: fix(compilation): Preventing OUT_DIR from leaking into cargo run
- fix: fix(diag): Don't report unused normal deps when static libs are skipped
- fix: fix(diag): Don't report unused normal deps when static libs are skipped  (#17515)
- fix: fix(git): For git cli, tell users what config we aren't forwarding on error
- fix: fix(git): For git cli, tell users what config we aren't forwarding on error (#17477)
- fix: fix(package): preserve feature metadata
- …and 103 more