)]}'
{
  "commit": "36cff8d52f25ee2fa2ca083d4f0c245410af41ad",
  "tree": "5549fa5cf2db4cc370b6a75f05c9c996c110183a",
  "parents": [
    "c8accf8c85ee091c1473baf6d380fce9338e8b3f"
  ],
  "author": {
    "name": "David Ostrovsky",
    "email": "david@ostrovsky.org",
    "time": "Sat Oct 10 23:14:09 2026 +0200"
  },
  "committer": {
    "name": "David Ostrovsky",
    "email": "david@ostrovsky.org",
    "time": "Sat Oct 10 15:01:13 2026 -0700"
  },
  "message": "Use core SecureRandomUtil for the PKCE code_verifier\n\nCore added com.google.gerrit.util.crypto.SecureRandomUtil as the single\nsource of cryptographically strong randomness and migrated its callers\nto it. Migrate the plugin\u0027s only SecureRandom use, the PKCE\ncode_verifier in HttpOAuthClient, to it.\n\nSecureRandomUtil.newRandomString32() returns 32 bytes of entropy as\nunpadded base64url, which is identical to the previous SecureRandom\nplus base64url encoding and a valid RFC 7636 code_verifier, so there is\nno behaviour change.\n\nChange-Id: Id7909f834f793ee720e9dac26808699e3c1368ef\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "653a48704bbce30a9495c61ec3e393c48dd7956b",
      "old_mode": 33188,
      "old_path": "src/main/java/com/googlesource/gerrit/plugins/oauth/client/HttpOAuthClient.java",
      "new_id": "67ac817812e36724f7d79d21d09d6b552b149de3",
      "new_mode": 33188,
      "new_path": "src/main/java/com/googlesource/gerrit/plugins/oauth/client/HttpOAuthClient.java"
    }
  ]
}