# Changelog

## Score

- CAI 53 → 55 (+1.8)
- Rubric changed (rubric-2026.10.1 → rubric-2026.10.5) — scores are not directly comparable.

## Lenses

- Code Health 76 → 54 (-22.6)
- Architecture 86 → 86 (+0.0)
- Maturity 40 → 51 (+10.5)
- Readiness 58 → 59 (+0.6)
- Security 67 → 65 (-2.0)

## Resolved (2)

- Off-boarding risk: anonymized user #1
- Workflow holding a long-lived secret is unscoped

## New (26)

- High secret: WD-SECRET-0005 (deploy.sh)
- Leaked secret: hardcoded-credential (deploy.sh)
- Medium CVE: [GHSA redacted] (build.sbt)
- Off-boarding risk: anonymized user #1
- Orphaned file (legacy/dev/merge_pr.py)
- Orphaned file (legacy/tutorial/SparkSnowflakeTutorial.scala)
- Orphaned file (src/it/3.5/scala/org/apache/spark/sql/snowflake/SFTestData.scala)
- Orphaned file (src/it/4.x/scala/net/snowflake/spark/snowflake/NativeSparkVariantNullHandlingITSuite.scala)
- Orphaned file (src/it/4.x/scala/org/apache/spark/sql/snowflake/SFTestData.scala)
- Orphaned file (src/main/scala/net/snowflake/spark/snowflake/CloudCredentialsUtils.scala)
- Orphaned file (src/main/scala/net/snowflake/spark/snowflake/Conversions.scala)
- Orphaned file (src/main/scala/net/snowflake/spark/snowflake/SnowflakeConnectorUtils.scala)
- Orphaned file (src/main/scala/net/snowflake/spark/snowflake/SnowflakeWriter.scala)
- Orphaned file (src/main/scala/net/snowflake/spark/snowflake/SparkConnectorContext.scala)
- Orphaned file (src/main/scala/net/snowflake/spark/snowflake/io/SFInternalStage.scala)
- Orphaned file (src/main/scala/net/snowflake/spark/snowflake/io/SFRecordReader.scala)
- Orphaned file (src/main/scala/net/snowflake/spark/snowflake/io/SnowflakeRDD.scala)
- Orphaned file (src/main/scala/net/snowflake/spark/snowflake/io/StageReader.scala)
- Rotate the exposed credentials — git history can't be un-committed
- Workflow holding a long-lived secret is unscoped (.github/workflows/IntegrationTest_2.12.yml)
- …and 6 more

## Changes since last survey

- 3 commits — 3 feature/other, 0 fixes

## By area

- src/main — 3 commits

## Notable commits

- change: Add per-catalog snowflake-database override for FallbackCatalog (#674)
- change: Default FallbackCatalog fallback database to the catalog's warehouse (#676)
- change: Handle quoted column names consistently in filter pushdown (#677)

## Architecture

- 0 containers · 1 bounded contexts · 0 dependency edges (baseline)