# Changelog

> **This is the PUBLIC form of this artifact. Findings are listed in full, but the details of SECURITY findings — which rule fired, in which file, on which line, and how to fix it — are deliberately withheld, and any secret-scanner results are excluded entirely. Where detail is absent here it was REMOVED FOR PUBLICATION; it is not missing from the analysis. The complete artifact is available from the repository owner.**

## Score

- CAI 41 → 68 (+27.1)
- Rubric changed (rubric-2026.08.15 → rubric-2026.09.15) — scores are not directly comparable.

## Lenses

- Code Health 100 → 93 (-6.6)
- Architecture 69 → 98 (+29.4)
- Maturity 64 → 73 (+9.3)
- Readiness 30 → 55 (+25.3)
- Security 32 → 81 (+49.7)

## Resolved (18)

- Dimension evaluation failed
- Duplicated block (9 lines × 2) (core/src/main/scalajvm/sttp/client4/internal/httpclient/MultiPartBodyPublisher.java)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- No artifact signing
- No automated tests
- No consequences/trade-offs section (e.g. loss of unsafeApply's exception-handling safety) (generated-docs/out/adr/0002-http-model-conventions.md)
- No exposed public API
- No tests found
- Rotate the exposed credentials — git history can't be un-committed
- Secret: etsy-access-token (core/src/main/scala/sttp/client4/testing/WebSocketBackendStub.scala)
- Secret: etsy-access-token (core/src/main/scalajvm/sttp/client4/DefaultSyncBackend.scala)
- Secret: etsy-access-token (core/src/main/scalajvm/sttp/client4/httpclient/HttpClientSyncBackend.scala)
- Secret: etsy-access-token (okhttp-backend/src/main/scala/sttp/client4/okhttp/OkHttpSyncBackend.scala)
- Test reliability not included
- The requirements file lists only the Sphinx themes (sphinx_rtd_theme==2.0.0, sphinx==7.3.7) and a few other packages; it does not show which sttp modules or backends are supported. (docs/requirements.txt)

## New (128)

- AbstractBackendStub.adjustResponseBody (cognitive 20) (core/src/main/scala/sttp/client4/testing/AbstractBackendStub.scala)
- AbstractBackendStub.adjustResponseBody (cyclomatic 29) (core/src/main/scala/sttp/client4/testing/AbstractBackendStub.scala)
- BodyFromAkka.webSocketAndFlow (cognitive 31) (akka-http-backend/src/main/scala/sttp/client4/akkahttp/BodyFromAkka.scala)
- BodyFromAkka.webSocketAndFlow (cyclomatic 16) (akka-http-backend/src/main/scala/sttp/client4/akkahttp/BodyFromAkka.scala)
- BodyFromPekko.webSocketAndFlow (cognitive 31) (pekko-http-backend/src/main/scala/sttp/client4/pekkohttp/BodyFromPekko.scala)
- BodyFromPekko.webSocketAndFlow (cyclomatic 16) (pekko-http-backend/src/main/scala/sttp/client4/pekkohttp/BodyFromPekko.scala)
- Boundary-crossing change coupling: AkkaHttpBackend.scala ↔ Http4sBackendBase.scala (akka-http-backend/src/main/scala/sttp/client4/akkahttp/AkkaHttpBackend.scala)
- Duplicated block (10 lines × 2) (akka-http-backend/src/main/scala/sttp/client4/akkahttp/AkkaHttpBackend.scala)
- Duplicated block (10 lines × 2) (akka-http-backend/src/main/scala/sttp/client4/akkahttp/AkkaHttpClient.scala)
- Duplicated block (10 lines × 2) (effects/cats/src/main/scalajvm/sttp/client4/httpclient/cats/CatsSimpleQueue.scala)
- Duplicated block (10 lines × 2) (effects/zio/src/main/scala/sttp/client4/impl/zio/ZioWebSockets.scala)
- Duplicated block (10 lines × 2) (http4s-backend/src/main/scala/sttp/client4/http4s/Http4sBackendBase.scala)
- Duplicated block (11 lines × 2) (http4s-backend/src/main/scala/sttp/client4/http4s/Http4sBackendBase.scala)
- Duplicated block (12 lines × 2) (akka-http-backend/src/main/scala/sttp/client4/akkahttp/AkkaHttpBackend.scala)
- Duplicated block (12 lines × 2) (akka-http-backend/src/main/scala/sttp/client4/akkahttp/ToAkka.scala)
- Duplicated block (12 lines × 2) (http4s-backend/src/main/scala/sttp/client4/http4s/Http4sBackendBase.scala)
- Duplicated block (12–13 lines × 2) (core/src/main/scalanative/sttp/client4/curl/AbstractCurlBackend.scala)
- Duplicated block (12–15 lines × 2) (effects/zio/src/main/scalajvm/sttp/client4/httpclient/zio/ZioBodyFromHttpClient.scala)
- Duplicated block (13 lines × 2) (effects/fs2-ce2/src/main/scala/sttp/client4/impl/fs2/Fs2WebSockets.scala)
- Duplicated block (13 lines × 2) (http4s-backend/src/main/scala/sttp/client4/http4s/Http4sBackendBase.scala)
- …and 108 more

## Changes since last survey

- 38 commits — 38 feature/other, 0 fixes

## By area

- (root) — 26 commits
- examples/src — 4 commits
- project/build.properties — 2 commits
- core/src — 1 commit
- docs/backends — 1 commit
- generated-docs/out — 1 commit
- http4s-backend/src — 1 commit
- observability/otel4s-metrics-backend — 1 commit
- project/plugins.sbt — 1 commit

## Notable commits

- change: Add missing resource variants that close a user-provided client (#2978)
- change: Add support for RFC 10008 (QUERY HTTP method) (#2948)
- change: Propagate cancellation for http4s backend (#2984)
- change: Release 4.0.27
- change: Update armeria to 1.41.0 (#2964)
- change: Update armeria to 1.41.1 (#2987)
- change: Update cats-effect, cats-effect-kernel, ... to 3.7.1 (#2980)
- change: Update fs2-core, fs2-reactive-streams to 3.14.0 (#2991)
- change: Update http4s-client, http4s-ember-client to 0.23.37 (#2994)
- change: Update jedis to 8.0.1 (#2983)
- change: Update jsoniter-scala-core, ... to 2.40.1 (#2961)
- change: Update jsoniter-scala-core, ... to 2.41.0 (#3005)
- change: Update logback-classic to 1.6.2 (#2973)
- change: Update logback-classic to 1.6.3 (#2974)
- change: Update mdoc, sbt-mdoc to 2.9.2 (#2990)
- change: Update model:core to 1.8.0 (#3000)
- change: Update model:core to 1.8.1 (#3002)
- change: Update model:core to 1.8.2 (#3007)
- change: Update okhttp-jvm to 5.5.0 (#2975)
- change: Update opentelemetry-api, ... to 1.65.0 (#2965)
- …and 18 more

## Architecture

- Containers 0 added · 0 removed · contexts 1 added · 0 removed · edges 0 added · 0 removed

## Added bounded contexts (1)

- repository