[dinwwwh]

Requested by dinwwwh · project thread

Docs only, no behavior change.

convertSecurity removes a security list left empty once mutualTLS schemes are dropped. The README limitation covered only the operation case (it falls back to the document's security). This extends it to the document case too: a document security that lists only mutual TLS alternatives is removed, so 3.0 requires no security.

It also rewords the convertSecurity comment, which said removing an emptied list avoids meaning "no security is needed". That only holds for an operation; at the document level a removed list and [] both mean no security. The existing test drops their names from security requirements, then emptied requirements and lists already covers both cases.

---

Generated by Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[pullfrog]

✅ No new issues found.

Reviewed changes

• README limitation reworded — the mutualTLS security-list bullet now covers both scopes: an operation falls back to the document's security, and a document list left with nothing means no security is required.
• convertSecurity comment reworded — distinguishes why an emptied requirement is removed (an empty requirement means optional security) from why an emptied list is removed (operation fallback).

Both claims match convertSecurity (packages/downgrader/src/v3.1-to-v3.0.ts:749) and are already pinned by the existing test packages/downgrader/tests/v3.1-to-v3.0.test.ts:260, which asserts the document list is removed and that each operation case (dropped list, kept {}, preserved []) behaves as described. uncheck passes on both changed files.

  ^{｜ View workflow run ｜ Using deepseek-v4.1-flash (free via Pullfrog for OSS) ｜ 𝕏}

[codspeed]

Merging this PR will not alter performance

✅ 21 untouched benchmarks

---

_{Comparing claude/project-thread-hhhrxt (5ea95bb) with main (ae7568d)}