# Changelog

> **This is the PUBLIC form of this artifact. Findings are listed in full, but the details of SECURITY findings — which rule fired, in which file, on which line, and how to fix it — are deliberately withheld, and any secret-scanner results are excluded entirely. Where detail is absent here it was REMOVED FOR PUBLICATION; it is not missing from the analysis. The complete artifact is available from the repository owner.**

## Score

- CAI 42 → 62 (+19.8)
- Rubric changed (rubric-2026.08.15 → rubric-2026.09.15) — scores are not directly comparable.

## Lenses

- Code Health 97 → 94 (-2.6)
- Architecture 94 → 100 (+5.7)
- Maturity 50 → 57 (+7.5)
- Readiness 34 → 56 (+21.0)
- Security 31 → 64 (+33.0)

## Resolved (38)

- Coverage not measured — test suite did not build
- Dimension evaluation failed
- Duplicated block (11 lines × 2) (balloon-compose/src/main/kotlin/com/skydoves/balloon/compose/BalloonModifier.kt)
- Duplicated block (14 lines × 2) (app/src/main/kotlin/com/skydoves/balloondemo/ComposeActivity.kt)
- Duplicated block (22 lines × 2) (app/src/main/kotlin/com/skydoves/balloondemo/ComposeActivity.kt)
- Duplicated block (31 lines × 2) (app/src/main/kotlin/com/skydoves/balloondemo/ComposeActivity.kt)
- Duplicated block (8 lines × 2) (balloon/src/main/kotlin/com/skydoves/balloon/Balloon.kt)
- Duplicated block (9 lines × 2) (balloon/src/main/kotlin/com/skydoves/balloon/overlay/BalloonAnchorOverlayView.kt)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- …and 18 more

## New (45)

- Ambiguous intent: `show` and `update` have identical signatures and likely similar behavior (showing the balloon at a specific alignment). It is unclear if `update` implies modifying an already visible balloon versus `show` which might imply a fresh display or state transition.
- BalloonKt.BalloonContent (cognitive 25) (balloon/src/commonMain/kotlin/com/skydoves/balloon/Balloon.kt)
- BalloonKt.BalloonContent (cyclomatic 28) (balloon/src/commonMain/kotlin/com/skydoves/balloon/Balloon.kt)
- BalloonPopupKt.BalloonPopupLayer (cognitive 16) (balloon/src/commonMain/kotlin/com/skydoves/balloon/BalloonPopup.kt)
- BalloonPopupPositionProvider.calculatePosition (cognitive 60) (balloon/src/commonMain/kotlin/com/skydoves/balloon/BalloonPopup.kt)
- BalloonPopupPositionProvider.calculatePosition (cyclomatic 36) (balloon/src/commonMain/kotlin/com/skydoves/balloon/BalloonPopup.kt)
- BalloonPopupPositionProvider.resolveArrowCenter (cyclomatic 16) (balloon/src/commonMain/kotlin/com/skydoves/balloon/BalloonPopup.kt)
- BalloonShapeBuilderKt.buildBalloonPath (cyclomatic 18) (balloon/src/commonMain/kotlin/com/skydoves/balloon/BalloonShapeBuilder.kt)
- Dependency hygiene PARTLY measured — Maven/Gradle declarations read, no dependency graph resolved
- Documentation: no project overview (README.md)
- Duplicate intent: Both methods configure the visual border/stroke of the balloon. 'Stroke' and 'Border' are semantically equivalent in this context, leading to confusion about which to use.
- Duplicated block (13 lines × 2) (samples-shared/src/commonMain/kotlin/com/skydoves/balloon/sample/BalloonDemoScreen.kt)
- Duplicated block (5 lines × 3) (balloon/src/commonMain/kotlin/com/skydoves/balloon/BalloonShapeBuilder.kt)
- FileTooLong: balloon/Balloon.kt (balloon/src/commonMain/kotlin/com/skydoves/balloon/Balloon.kt)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- …and 25 more

## Changes since last survey

- 47 commits — 41 feature/other, 6 fixes

## By area

- gradle/libs.versions.toml — 10 commits
- (root) — 7 commits
- balloon/src — 7 commits
- (repo) — 4 commits
- .github/workflows — 4 commits
- androidApp/src — 2 commits
- balloon-compose-multiplatform/src — 2 commits
- balloon/api — 2 commits
- docs/legacy-view — 2 commits
- gradle/wrapper — 2 commits
- samples-shared/src — 2 commits
- art/thumbnail.png — 1 commit
- docs/migration.md — 1 commit
- iosApp/iosApp.xcodeproj — 1 commit

## Notable commits

- fix: Fix animation and dismissal regressions found auditing 2.0.0 against 1.7.6
- fix: Fix hit testing, the overlay padding ring and shared placement state
- fix: Fix the RTL first-frame arrow edge and correct docs flagged in review
- fix: Merge pull request #1016 from skydoves/fix/revert-cmp-1.12.0
- fix: Merge pull request #1017 from skydoves/fix/verify-legacy-issues
- fix: Revert Compose Multiplatform to 1.10.3
- change: Add TikTok to the Who's using list (#1026)
- change: Add a Labs screen that drives every builder setter live
- change: Add a golden screenshot suite for the rendering surface
- change: Add a liquid glass tooltip demo built on Cloudy (#1020)
- change: Add a pixel-parity harness to the demo apps
- change: Add repository art: CodeRabbit logo and a multiplatform preview (#1018)
- change: Add unit and UI tests for the multiplatform balloon
- change: Bring the GitHub Actions up to date
- change: Cover the derive round trip
- change: Document the golden screenshot workflow
- change: Drop --scan from the CI build
- change: Drop --scan from the release build too
- change: Generate a baseline profile for 2.0.0
- change: Make the Renovate AGP freeze actually match
- …and 27 more

## Architecture

- Containers 0 added · 0 removed · contexts 3 added · 0 removed · edges 2 added · 0 removed

## Added bounded contexts (3)

- androidApp
- balloon
- samples-shared

## Added dependency edges (2)

- androidApp → balloon
- samples-shared → balloon