# Changelog

> **This is the PUBLIC form of this artifact. Findings are listed in full, but the details of SECURITY findings — which rule fired, in which file, on which line, and how to fix it — are deliberately withheld, and any secret-scanner results are excluded entirely. Where detail is absent here it was REMOVED FOR PUBLICATION; it is not missing from the analysis. The complete artifact is available from the repository owner.**

## Score

- CAI 54 → 49 (-4.9)
- Rubric changed (rubric-2026.10.1 → rubric-2026.10.5) — scores are not directly comparable.

## Lenses

- Code Health 69 → 51 (-17.7)
- Architecture 84 → 84 (+0.0)
- Maturity 48 → 41 (-6.1)
- Readiness 46 → 46 (+0.0)
- Security 84 → 89 (+5.0)

## Resolved (8)

- Documentation: no usage examples (README.md)
- Hotspot: LazyProxy/PhpDumper/LazyServiceDumper.php (LazyProxy/PhpDumper/LazyServiceDumper.php)
- Medium: security finding (details withheld)
- Medium: security finding (details withheld)
- Medium: security finding (details withheld)
- Medium: security finding (details withheld)
- Medium: security finding (details withheld)
- Off-boarding risk: anonymized user #1

## New (12)

- Container.reset (cognitive 18) (Container.php)
- Hotspot: Compiler/AnalyzeServiceReferencesPass.php (Compiler/AnalyzeServiceReferencesPass.php)
- Hotspot: Compiler/AutowirePass.php (Compiler/AutowirePass.php)
- Hotspot: Compiler/ServiceLocatorTagPass.php (Compiler/ServiceLocatorTagPass.php)
- Hotspot: Compiler/ValidateEnvPlaceholdersPass.php (Compiler/ValidateEnvPlaceholdersPass.php)
- No assertions: testProcessDoesNotResolvePercentSpansWithWhitespace (Tests/Compiler/CheckTypeDeclarationsPassTest.php)
- Off-boarding risk: anonymized user #1
- Orphaned file (Loader/Configurator/EnvConfigurator.php)
- RegisterAsCallableAttributesPass.process (cognitive 40) (Compiler/RegisterAsCallableAttributesPass.php)
- RegisterAsCallableAttributesPass.process (cyclomatic 18) (Compiler/RegisterAsCallableAttributesPass.php)
- ResolveClassPass.process (cognitive 17) (Compiler/ResolveClassPass.php)
- ServicesResetter.resetInstance (cognitive 24) (ServicesResetter.php)

## Changes since last survey

- 59 commits — 50 feature/other, 9 fixes

## By area

- (repo) — 29 commits
- (root) — 13 commits
- Compiler/AutowirePass.php — 5 commits
- Compiler/MergeExtensionConfigurationPass.php — 2 commits
- Loader/schema — 2 commits
- Tests/Compiler — 2 commits
- Compiler/CheckTypeDeclarationsPass.php — 1 commit
- Compiler/ServiceLocatorTagPass.php — 1 commit
- Kernel/AbstractKernel.php — 1 commit
- Kernel/KernelTrait.php — 1 commit
- Tests/Fixtures — 1 commit
- Tests/Loader — 1 commit

## Notable commits

- fix: [DependencyInjection] Fix `#[AutowireServiceClosure]` ignoring `#[Target]`
- fix: [DependencyInjection] Fix autowiring intersection types with aliases of aliases
- fix: [DependencyInjection] Fix dumping strings like "50% of 100%"
- fix: [DependencyInjection] Fix env vars reported as never used when overriding an extension service
- fix: [DependencyInjection] Fix ignoring env var processors after resolving env vars before compilation
- fix: [DependencyInjection] Fix injecting a lazy proxy for a nullable argument whose service is missing
- fix: [DependencyInjection] Fix the proxy tags of a lazy argument typed as a nullable intersection
- fix: bug #66894 [DependencyInjection] Fix ignoring env var processors after resolving env vars before compilation (nicolas-grekas)
- fix: bug #67117 [DependencyInjection] Fix `#[AutowireServiceClosure]` ignoring `#[Target]` (nicolas-grekas)
- change: Merge branch '6.4' into 7.4
- change: Merge branch '6.4' into 7.4
- change: Merge branch '6.4' into 7.4
- change: Merge branch '6.4' into 7.4
- change: Merge branch '6.4' into 7.4
- change: Merge branch '6.4' into 7.4
- change: Merge branch '7.4' into 8.1
- change: Merge branch '7.4' into 8.1
- change: Merge branch '7.4' into 8.1
- change: Merge branch '7.4' into 8.1
- change: Merge branch '7.4' into 8.1
- …and 39 more