# Changelog

> **This is the PUBLIC form of this artifact. Findings are listed in full, but the details of SECURITY findings — which rule fired, in which file, on which line, and how to fix it — are deliberately withheld, and any secret-scanner results are excluded entirely. Where detail is absent here it was REMOVED FOR PUBLICATION; it is not missing from the analysis. The complete artifact is available from the repository owner.**

## Score

- CAI 70 → 71 (+1.2)

## Lenses

- Code Health 97 → 97 (+0.0)
- Architecture 92 → 91 (-0.7)
- Maturity 52 → 53 (+0.8)
- Readiness 80 → 84 (+3.8)
- Security 93 → 92 (-0.7)
- Performance 85 → 85 (+0.0)

## Resolved (12)

- Dormant codebase
- Duplicate intent: Two methods with nearly identical names and signatures perform the same axis permutation operation. The suffix difference ('d' vs no 'd') is inconsistent with Rust naming conventions which typically prefer one canonical verb form.
- Duplicate intent: Two methods with nearly identical names and signatures perform the same axis reversal operation. Same inconsistency pattern as above.
- Duplicated block (9 lines × 2) (src/iterators/mod.rs)
- Inconsistent naming for ownership conversion: `ArrayBase` (owned) has `to_owned` and `into_owned`. `ArrayRef` (borrowed) has `to_owned`. While `to_owned` is standard for `Borrow`, `ArrayBase` having both `to_owned` (clone) and `into_owned` (move) is fine, but the presence of `try_into_owned_nocopy` on `Data` and `ArrayBase` adds complexity. More critically, `ArrayBase` has `into_shared` and `to_shared`, while `DataOwned` has `into_shared`. This is mostly consistent, but `to_owned` on `ArrayBase` implies cloning, whereas `into_owned` implies moving. Ensure users don't confuse `to_owned` (clone) with `into_owned` (move) on the same type.
- Most significant orphaned file (src/arrayformat.rs)
- Most significant orphaned file (src/impl_ops.rs)
- Most significant orphaned file (src/slice.rs)
- Off-boarding risk: anonymized user #1
- Outdated: matrixmultiply
- Redundant exposure: `into_owned` is exposed on both the concrete `ArrayBase` type and the `Data` trait. While trait methods are often implemented on the type, exposing the same signature on the type itself when it's primarily a trait method can be confusing regarding ownership transfer semantics and method resolution priority.
- Workflow token permissions not restricted

## New (17)

- Further orphaned files (smaller)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- Medium CVE: RUSTSEC-2026-0381 (Cargo.lock)
- Medium CVE: RUSTSEC-2026-0382 (Cargo.lock)
- Off-boarding risk: anonymized user #1
- Orphaned file (src/array_approx.rs)
- Orphaned file (src/dimension/ops.rs)
- Orphaned file (src/geomspace.rs)
- Orphaned file (src/impl_views/indexing.rs)
- Orphaned file (src/impl_views/splitting.rs)
- Orphaned file (src/logspace.rs)
- Orphaned knowledge (src/slice.rs)
- Outdated: rand
- Workflow token permissions not restricted (.github/workflows/ci.yaml)
- Workflow token permissions not restricted (.github/workflows/latest-deps.yaml)

## Changes since last survey

- 9 commits — 6 feature/other, 3 fixes

## By area

- (root) — 3 commits
- src/dimension — 2 commits
- .github/workflows — 1 commit
- src/doc — 1 commit
- src/numeric — 1 commit
- src/tri.rs — 1 commit

## Notable commits

- fix: fix: allow zero strides on empty arrays (#1611)
- fix: fix: inverted is_all_nan / is_any_nan / is_all_infinite / is_any_infinite (#1614)
- fix: fix: prevent stack overflow in F-order triu/tril (#1616)
- change: Enable AVX-512 in matrixmultiply (#1605)
- change: ci: run latest-deps check daily and add stable clippy (#1623)
- change: docs: add column_stack to ndarray-for-numpy-users guide (#1618)
- change: feat: add `Dimension::from_slice` (#1608)
- change: feat: update to rand 0.10 and rand_distr 0.6
- change: fix(ci): address new lints and float constant deprecations (#1620)