# Changelog

> **This is the PUBLIC form of this artifact. Findings are listed in full, but the details of SECURITY findings — which rule fired, in which file, on which line, and how to fix it — are deliberately withheld, and any secret-scanner results are excluded entirely. Where detail is absent here it was REMOVED FOR PUBLICATION; it is not missing from the analysis. The complete artifact is available from the repository owner.**

## Score

- CAI 55 → 63 (+7.8)
- Rubric changed (rubric-2026.09.8 → rubric-2026.09.16) — scores are not directly comparable.

## Lenses

- Code Health 72 → 73 (+0.5)
- Architecture 64 → 70 (+5.2)
- Maturity 65 → 62 (-3.7)
- Readiness 65 → 63 (-2.1)
- Security 42 → 61 (+19.0)
- Performance 85 (new)

## Resolved (101)

- Documentation: no architecture or design documentation (docs/book/src/features.md)
- Documentation: no installation or build instructions (README.md)
- Documentation: no installation or build instructions (docs/book/src/installation.md)
- Documentation: no usage examples (README.md)
- Documentation: written for insiders (docs/book/src/security.md)
- Duplicated block (8 lines × 2) (crates/ide-completion/src/render/const_.rs)
- Duplicated block (9 lines × 2) (crates/ide-completion/src/completions/attribute.rs)
- High CVE: [CVE redacted] (editors/code/package-lock.json)
- High CVE: [CVE redacted] (editors/code/package-lock.json)
- High CVE: [CVE redacted] (editors/code/package-lock.json)
- High CVE: [GHSA redacted] (editors/code/package-lock.json)
- High CVE: [GHSA redacted] (editors/code/package-lock.json)
- High CVE: [GHSA redacted] (editors/code/package-lock.json)
- High CVE: [GHSA redacted] (editors/code/package-lock.json)
- High CVE: [GHSA redacted] (editors/code/package-lock.json)
- Hotspot: crates/hir-def/src/attrs/docs.rs (crates/hir-def/src/attrs/docs.rs)
- Hotspot: crates/hir-def/src/expr_store/pretty.rs (crates/hir-def/src/expr_store/pretty.rs)
- Hotspot: crates/hir-def/src/find_path.rs (crates/hir-def/src/find_path.rs)
- Hotspot: crates/hir-def/src/hir.rs (crates/hir-def/src/hir.rs)
- Hotspot: crates/hir-def/src/item_scope.rs (crates/hir-def/src/item_scope.rs)
- …and 81 more

## New (59)

- Duplicate read operation across different types. `SourceDatabase` is the primary database trait, but `Files` exposes an identical `file_text` method. This suggests `Files` is either a redundant wrapper or a legacy alias, creating confusion about which type to use for reading file content.
- Duplicate read operation. `Files.file_source_root` duplicates `SourceDatabase.file_source_root` with inconsistent signature.
- Duplicate read operation. `Files.source_root` duplicates `SourceDatabase.source_root` with inconsistent signature (explicit db parameter in `Files`).
- Duplicate write operation with inconsistent signatures. `SourceDatabase` has `set_file_text` as a direct method, while `Files` has `set_file_text` that takes the database as an explicit argument. This inconsistency in how the database context is passed (implicit receiver vs explicit parameter) is confusing.
- Duplicate write operation. `Files.set_file_source_root_with_durability` duplicates `SourceDatabase.set_file_source_root_with_durability` with inconsistent signature.
- Duplicate write operation. `Files.set_source_root_with_durability` duplicates `SourceDatabase.set_source_root_with_durability` with inconsistent signature.
- Duplicated block (14 lines × 2) (crates/ide-completion/src/render/const_.rs)
- Duplicated block (5 lines × 2) (crates/parser/src/grammar/expressions/atom.rs)
- Function::hir_fmt (cognitive 16) (crates/hir/src/display.rs)
- High CVE: [GHSA redacted] (editors/code/package-lock.json)
- High CVE: [GHSA redacted] (editors/code/package-lock.json)
- High CVE: [GHSA redacted] (editors/code/package-lock.json)
- High CVE: [GHSA redacted] (editors/code/package-lock.json)
- High CVE: [GHSA redacted] (editors/code/package-lock.json)
- High: security finding (details withheld)
- Hotspot: crates/ide-completion/src/completions/attribute/cfg.rs (crates/ide-completion/src/completions/attribute/cfg.rs)
- Members sharing a duplicated core (4 members, 50+ identical tokens) (crates/hir-ty/src/diagnostics/expr.rs)
- Members sharing a duplicated core (4 members, 50+ identical tokens) (crates/ide/src/hover/render.rs)
- Members sharing a duplicated core (4 members, 50+ identical tokens) (crates/rust-analyzer/src/cli/analysis_stats.rs)
- No ADRs found
- …and 39 more

## Changes since last survey

- 115 commits — 81 feature/other, 34 fixes

## By area

- (repo) — 72 commits
- crates/ide-completion — 10 commits
- crates/hir-ty — 8 commits
- crates/hir — 4 commits
- crates/ide — 3 commits
- crates/ide-assists — 3 commits
- editors/code — 3 commits
- (root) — 2 commits
- crates/rust-analyzer — 2 commits
- .github/workflows — 1 commit
- crates/hir-def — 1 commit
- crates/ide-diagnostics — 1 commit
- crates/parser — 1 commit
- crates/test-utils — 1 commit
- crates/vfs — 1 commit
- crates/vfs-notify — 1 commit
- xtask/src — 1 commit

## Notable commits

- fix: Auto merge of #162573 - erickt:fix-fuchsia-tests, r=jieyouxu
- fix: Merge pull request #23352 from anatawa12/fix-panic-with-is-impl-with-types-from-builtin-derive-impl
- fix: Merge pull request #23359 from 0xull/fix-23327-macro-item-cache
- fix: Merge pull request #23361 from Wilfred/fix/remove-eslint-define-config
- fix: Merge pull request #23368 from edragain2nd/fix/early_return_binary_op_error
- fix: Merge pull request #23375 from scovich/lsp-macos-hang-fix
- fix: Merge pull request #23409 from Wilfred/fix/async-closure-hrtb
- fix: Merge pull request #23410 from sainad2222/fix/semantic-tokens-delta-cache
- fix: Merge pull request #23421 from 0xull/fix-23131
- fix: Rollup merge of #161903 - nnethercote:fix-target_config-cycle, r=nikic
- fix: Rollup merge of #162610 - malezjaa:fix-tailcall-indirect-return, r=folkertdev
- fix: Rollup merge of #162703 - malezjaa:regression-test-valtree-leaf-const, r=jieyouxu
- fix: Rollup merge of #162895 - chenyukang:yukang-fix-148207-generated-derive-suggestion, r=petrochenkov
- fix: fix: Include working directory when discover command fails
- fix: fix: Panic in async closures with HRTB
- fix: fix: Panic when trait solver re-enters itself
- fix: fix: add type_match relevance for type-alias
- fix: fix: avoid recursion when casting enum variant discriminants
- fix: fix: cache macro-expanded roots when climbing ancestors
- fix: fix: coersion safe fn to unsafe fn
- …and 95 more