# Changelog

> **This is the PUBLIC form of this artifact. Findings are listed in full, but the details of SECURITY findings — which rule fired, in which file, on which line, and how to fix it — are deliberately withheld, and any secret-scanner results are excluded entirely. Where detail is absent here it was REMOVED FOR PUBLICATION; it is not missing from the analysis. The complete artifact is available from the repository owner.**

## Score

- CAI 54 → 52 (-1.7)
- Rubric changed (rubric-2026.10.1 → rubric-2026.10.5) — scores are not directly comparable.

## Lenses

- Code Health 98 → 99 (+0.5)
- Maturity 45 → 46 (+1.0)
- Readiness 37 → 44 (+7.4)
- Security 100 → 61 (-38.6)

## Resolved (3)

- Documentation: no contributor guidance (README.md)
- High: security finding (details withheld)
- Workflow token permissions not restricted

## New (8)

- Documentation: no installation or build instructions (README.md)
- High: security finding (details withheld)
- High: security finding (details withheld)
- No SBOM
- No artifact signing
- No build provenance
- Orphaned file (project/Unix.scala)
- Unpinned build actions

## Changes since last survey

- 21 commits — 21 feature/other, 0 fixes

## By area

- (repo) — 11 commits
- (root) — 4 commits
- .github/workflows — 3 commits
- admin/build.sh — 2 commits
- .github/dependabot.yml — 1 commit

## Notable commits

- change: Build the distribution on GitHub Actions instead of Travis and AppVeyor
- change: Don't let Scala Steward propose Scala 3's scala-library
- change: Drop the unused S3 upload, name release assets explicitly
- change: Keep Dependabot away from the smoketest workflow's branch ref
- change: Keep the release secrets in per-branch environments
- change: Merge 2.12.x into 2.13.x
- change: Merge 2.12.x into 2.13.x
- change: Merge 2.12.x into 2.13.x
- change: Merge pull request #236 from lrytz/gha
- change: Merge pull request #237 from lrytz/default-version
- change: Merge pull request #238 from lrytz/merge-212
- change: Merge pull request #239 from lrytz/dist-gha-hardening
- change: Merge pull request #240 from lrytz/dist-merge-212
- change: Merge pull request #242 from lrytz/dist-dependabot-ignore
- change: Merge pull request #243 from lrytz/dist-merge-212-dependabot
- change: Merge remote-tracking branch 'upstream/2.12.x' into merge-212
- change: Package 2.12.21 by default
- change: Pass the scala/scala token only to the steps that use it
- change: Pin GitHub Actions to commit SHAs
- change: Reject version inputs with anything around the version
- …and 1 more