)]}'
{
  "commit": "e0e1f16b6bbed7b2069bbef6c30b8bae535880ff",
  "tree": "43562d3807eaa90706ca7eb0204cef18b0499a71",
  "parents": [
    "7107fa10b6958cd03823f591ab5549f2d0bf0e36"
  ],
  "author": {
    "name": "Piotr P. Karwasz",
    "email": "pkarwasz-github@apache.org",
    "time": "Tue Sep 01 22:33:48 2026 +0200"
  },
  "committer": {
    "name": "GitHub",
    "email": "noreply@github.com",
    "time": "Tue Sep 01 16:33:48 2026 -0400"
  },
  "message": "Split the Security and Threat Model pages (#83)\n\n* Leave only the model on the threat model page\n\nThe page opened with the stock Commons security boilerplate and closed with a\nvulnerability list and a deserialization pointer, all of which the Security\npage already carries. Repeated on a page whose whole job is the model, they\ndilute it for a reader and feed irrelevant context to an agent consuming it.\n\nDrop the three repeated sections and the \"Threat Model\" wrapper heading, and\npromote what is left one level: the nine sections become top-level, and the\nbold pseudo-headings inside \"Assumptions about the environment\" become real\nsubsections. \"Reserved Settings (must not be loosened)\" loses the\nparenthetical from its title, which would otherwise land in the anchor, and\ncarries it in the opening sentence instead.\n\nPoint the intra-page links at the anchors Doxia actually emits. They used\nGitHub slugs (#what-is-in-scope) where the rendered page has What_is_in_Scope,\nso all 23 were dead on the site. The subsections are addressable now, so the\nreferences that read \"see **Supported runtimes** under [Assumptions about the\nenvironment]\" become direct links.\n\nRetarget the \"Supported runtimes\" link that pointed at index.html, which has\nno such section, to the Javadoc overview section that does.\n\nAssisted-By: Claude Opus 5 (1M context) \u003cnoreply@anthropic.com\u003e\nClaude-Session: https://claude.ai/code/session_01XVaEa2R2sHtBgJh8Mhv841\n\n* Migrate the security page to Markdown\n\nEvery hand-written page on this site is Markdown; the security page was the\nlast hand-written xdoc, the other xdocs being commons-build-plugin output.\nDoxia derives heading ids the same way for both formats, so the section titles\ncarry the anchors over unchanged.\n\nAdd the supported release line while converting: it was stated only in the\nrepository\u0027s SECURITY.md and nowhere on the site.\n\nAssisted-By: Claude Opus 5 (1M context) \u003cnoreply@anthropic.com\u003e\nClaude-Session: https://claude.ai/code/session_01XVaEa2R2sHtBgJh8Mhv841\n\n* Fix the site links that never resolved\n\nThe Javadoc overview renders as apidocs/index.html, so its relative links to\nthe threat model and to the Maven coordinates resolved inside apidocs/ and\n404ed; they need to climb one level. The coordinates sentence also carried a\nleftover Markdown link after the working anchor.\n\nThe site descriptor still named the project Apache Commons Text, which the\nskin printed in every page title.\n\nAssisted-By: Claude Opus 5 (1M context) \u003cnoreply@anthropic.com\u003e\nClaude-Session: https://claude.ai/code/session_01XVaEa2R2sHtBgJh8Mhv841\n\n* Give every case on the threat model page its own heading\n\nThe bullets under \"What is out of scope\" and \"Settings you may modify\" were\nsubsections in disguise: several run seven to twelve lines with their own\nparagraphs and nested lists, held together only by list indentation, and\nnothing outside could link to one. Promote all fourteen to headings. The\nbullet with no bold lead-in becomes \"Non-conforming JAXP implementations\",\nmatching the disposition the triage table already names, and \"Android, on any\nAPI level\" loses its comma, which would otherwise land in the anchor.\n\nLift \"Reserved settings\" and \"Settings you may modify\" out of \"Assumptions\nabout the environment\" first, so their cases sit at the same level as the\nout-of-scope ones. Neither is an assumption about the environment: supported\nruntimes, honored JAXP contracts, XInclude resolution and system properties\nare, while those two state the contract with the caller. Doxia derives ids\nfrom heading text, so both keep the anchors they had.\n\nWith every case addressable, the last two-hop references collapse, and the\ntriage table points at the specific case a disposition maps to instead of at\nthe whole section.\n\nAssisted-By: Claude Opus 5 (1M context) \u003cnoreply@anthropic.com\u003e\nClaude-Session: https://claude.ai/code/session_01XVaEa2R2sHtBgJh8Mhv841",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "133d78c3daa0651dcc791df800aee9a7b5d5e1a6",
      "old_mode": 33188,
      "old_path": "src/main/javadoc/overview.html",
      "new_id": "18924f8bcab567ea39435b0dfd66103619c12524",
      "new_mode": 33188,
      "new_path": "src/main/javadoc/overview.html"
    },
    {
      "type": "add",
      "old_id": "0000000000000000000000000000000000000000",
      "old_mode": 0,
      "old_path": "/dev/null",
      "new_id": "b841501ad66a5acf8ae1262d3c608e5ec731fb86",
      "new_mode": 33188,
      "new_path": "src/site/markdown/security.md"
    },
    {
      "type": "modify",
      "old_id": "2d30ebcbea9fabcebdc2f95a7dc304dcf61d91c5",
      "old_mode": 33188,
      "old_path": "src/site/markdown/threat_model.md",
      "new_id": "01cf03af12edd82a0a62c659533edb75dfdefd03",
      "new_mode": 33188,
      "new_path": "src/site/markdown/threat_model.md"
    },
    {
      "type": "modify",
      "old_id": "d6ca7acec8faced94fb03a3301fe34fa2f61c66f",
      "old_mode": 33188,
      "old_path": "src/site/site.xml",
      "new_id": "7a294563f784b98a3908e5d2f576bf96f1d7bd29",
      "new_mode": 33188,
      "new_path": "src/site/site.xml"
    },
    {
      "type": "delete",
      "old_id": "123a31a047936bfcab41c8de60787fa80832aa44",
      "old_mode": 33188,
      "old_path": "src/site/xdoc/security.xml",
      "new_id": "0000000000000000000000000000000000000000",
      "new_mode": 0,
      "new_path": "/dev/null"
    }
  ]
}