{"$schema":"https://json.schemastore.org/sarif-2.1.0.json","version":"2.1.0","runs":[{"tool":{"driver":{"name":"codehealth","informationUri":"https://codehealth.canine.dev","rules":[{"id":"D13","name":"Secret Scanning","shortDescription":{"text":"Secret Scanning"},"helpUri":"https://codehealth.canine.dev/dimensions/D13","relationships":[{"target":{"id":"CWE-798","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},"kinds":["relevant"]},{"target":{"id":"CWE-259","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},"kinds":["relevant"]}],"properties":{"cwe":["CWE-798","CWE-259"]}},{"id":"D16","name":"Bus Factor","shortDescription":{"text":"Bus Factor"},"helpUri":"https://codehealth.canine.dev/dimensions/D16"},{"id":"D19","name":"Documentation Quality","shortDescription":{"text":"Documentation Quality"},"helpUri":"https://codehealth.canine.dev/dimensions/D19"},{"id":"D21","name":"Naming Consistency","shortDescription":{"text":"Naming Consistency"},"helpUri":"https://codehealth.canine.dev/dimensions/D21"},{"id":"D28","name":"Secrets (history)","shortDescription":{"text":"Secrets (history)"},"helpUri":"https://codehealth.canine.dev/dimensions/D28","relationships":[{"target":{"id":"CWE-798","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},"kinds":["relevant"]},{"target":{"id":"CWE-259","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},"kinds":["relevant"]}],"properties":{"cwe":["CWE-798","CWE-259"]}},{"id":"D29","name":"Static Analysis (SAST)","shortDescription":{"text":"Static Analysis (SAST)"},"helpUri":"https://codehealth.canine.dev/dimensions/D29","relationships":[{"target":{"id":"CWE-79","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},"kinds":["relevant"]},{"target":{"id":"CWE-89","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},"kinds":["relevant"]},{"target":{"id":"CWE-78","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},"kinds":["relevant"]},{"target":{"id":"CWE-94","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},"kinds":["relevant"]},{"target":{"id":"CWE-77","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},"kinds":["relevant"]}],"properties":{"cwe":["CWE-79","CWE-89","CWE-78","CWE-94","CWE-77"]}},{"id":"D34","name":"Knowledge Freshness","shortDescription":{"text":"Knowledge Freshness"},"helpUri":"https://codehealth.canine.dev/dimensions/D34"},{"id":"D35","name":"Change Coupling","shortDescription":{"text":"Change Coupling"},"helpUri":"https://codehealth.canine.dev/dimensions/D35"}]}},"results":[{"ruleId":"D16","level":"note","message":{"text":"Off-boarding risk: anonymized user #1: If anonymized user #1 becomes unavailable, 14 significant file(s) lose their only recent owner: lib/java/com/google/android/material/navigation/NavigationBarMenuView.java, lib/java/com/google/android/material/listitem/ListItemLayout.java, lib/java/com/google/android/material/card/MaterialCardView.java, lib/java/com/google/android/material/listitem/ListItemRevealLayout.java, catalog/java/io/material/catalog/listitem/SwipeableListDemoFragment.java, catalog/java/io/material/catalog/listitem/MultiSectionListDemoFragment.java, catalog/java/io/material/catalog/listitem/ListsMainDemoFragment.java, catalog/java/io/material/catalog/listitem/SegmentedListDemoFragment.java (\u002B6 more). Pair on, review, or document these before any departure."},"locations":[],"partialFingerprints":{"codehealthFindingId/v1":"a9ad13ed7b3c77a69c478322a88fa120c3218d470d6f56b4b01a8f70e0ec7d9c"}},{"ruleId":"D16","level":"note","message":{"text":"Off-boarding risk: anonymized user #2: If anonymized user #2 becomes unavailable, 14 significant file(s) lose their only recent owner: lib/java/com/google/android/material/datepicker/MaterialCalendar.java, lib/java/com/google/android/material/textfield/IndicatorViewController.java, lib/java/com/google/android/material/timepicker/ClockFaceView.java, lib/java/com/google/android/material/datepicker/MonthAdapter.java, lib/java/com/google/android/material/textfield/StartCompoundLayout.java, lib/java/com/google/android/material/color/utilities/TemperatureCache.java, catalog/java/io/material/catalog/card/CardListDemoFragment.java, lib/java/com/google/android/material/textfield/ClearTextEndIconDelegate.java (\u002B6 more). Pair on, review, or document these before any departure."},"locations":[],"partialFingerprints":{"codehealthFindingId/v1":"b47ec27510466953fa325045fe75f06961c22ac2d4b7c622846e2bf5e95ad575"}},{"ruleId":"D16","level":"note","message":{"text":"Off-boarding risk: anonymized user #3: If anonymized user #3 becomes unavailable, 4 significant file(s) lose their only recent owner: lib/java/com/google/android/material/focus/FocusRingDrawable.java, catalog/java/io/material/catalog/topappbar/TopAppBarPreferencesCardItemsFragment.java, catalog/java/io/material/catalog/allcomponents/AllComponentsDemoFragment.java, catalog/java/io/material/catalog/topappbar/TopAppBarPreferencesFragment.java. Pair on, review, or document these before any departure."},"locations":[],"partialFingerprints":{"codehealthFindingId/v1":"edd2c31c16136f1733086cf34c118e69521e14f90e3ec56de90ab25a59248084"}},{"ruleId":"D16","level":"note","message":{"text":"Off-boarding risk: anonymized user #4: If anonymized user #4 becomes unavailable, 4 significant file(s) lose their only recent owner: lib/java/com/google/android/material/progressindicator/CircularDrawingDelegate.java, lib/java/com/google/android/material/progressindicator/DrawingDelegate.java, catalog/java/io/material/catalog/navigationrail/NavigationRailFragment.java, catalog/java/io/material/catalog/divider/DividerFragment.java. Pair on, review, or document these before any departure."},"locations":[],"partialFingerprints":{"codehealthFindingId/v1":"d62f85e7c0f773e9c45daf1a69822d7c692f57dc7b12bf8c7a5024df20d14b90"}},{"ruleId":"D16","level":"note","message":{"text":"Further sole-owners (lower concentration): 2 other contributor(s) are each the sole owner of a small amount of code below the off-boarding threshold \u2014 folded into the bus-factor score and metrics (38 single-owned of 444 analysed files in total, counted over production source files of roughly 100 lines or more, excluding tests, vendored, generated and example/demo trees, largest first). They are anonymized user #5 (1 file(s)), anonymized user #6 (1 file(s)) \u2014 spread or document their files in the same way, at lower priority than the named off-boarding risks above."},"locations":[],"partialFingerprints":{"codehealthFindingId/v1":"6eac528f2429e724e1a97ed868f79eefbcf1888dab4af9a9e673429369bb5b2f"}},{"ruleId":"D19","level":"note","message":{"text":"The Tooltip component is referenced but marked as yet to be completed with a tracking issue link, leaving readers unsure whether it exists or has been deferred.: Verify that the Tooltip component is present and update its status in the doc (e.g. \u0027in progress\u0027) so readers can confirm it is real."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"docs/components/Tooltip.md"},"region":{"startLine":1}}}],"partialFingerprints":{"codehealthFindingId/v1":"448e6a4d8b0dd7bd209f466b6a5b428e570f9a335fb7a65dae6100404d58f761"}},{"ruleId":"D29","level":"warning","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"f5d123690550d43d4cfb7df680f70c0ec4b561400af6f4fe8986f87830f8e7ad"},"taxa":[{"id":"CWE-926","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}}]},{"ruleId":"D29","level":"warning","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"79049a418972da547b8154fd4703a2d5499dd8b878c6d773e5b6522a9188e454"},"taxa":[{"id":"CWE-926","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}}]},{"ruleId":"D29","level":"warning","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"d4c35be7902fbc067612e99abab09be9814057af0d10ac22d3f3669bec660b5f"},"taxa":[{"id":"CWE-926","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}}]},{"ruleId":"D29","level":"warning","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"b400a5624c38a5b62ab99c4b362c48f40ac79440952a457a98cc694d8e8bf217"},"taxa":[{"id":"CWE-926","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}}]},{"ruleId":"D29","level":"warning","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"11ce34efeaa0c101f38250d1184512ff567db899bdfd1b7d631d9f7b4e8f4a1b"},"taxa":[{"id":"CWE-926","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}}]},{"ruleId":"D29","level":"warning","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"ce03fab5cfcfdbb478aade9a2d11dc1a07ed4ac067472cb2132b1ffe3e49cf1f"},"taxa":[{"id":"CWE-926","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}}]},{"ruleId":"D29","level":"warning","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"5e0f39f8294b25f9900d77b3059424e2a0c97d0422708c94522add827b80e8f6"},"taxa":[{"id":"CWE-926","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}}]},{"ruleId":"D29","level":"warning","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"47c61d70ed72617f6aa8c68de98e281dcfb9d6609730b6727aef649a7ab6e603"},"taxa":[{"id":"CWE-926","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}}]},{"ruleId":"D29","level":"warning","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"e439d5165179d937948daaa844cd336c795e1c835cb1355d3a178cf43c26721a"},"taxa":[{"id":"CWE-926","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}}]},{"ruleId":"D29","level":"warning","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"b0549f0e197b303ef4f8d4cbc5001393eabb04d437b96e5fa169f14916be15e6"},"taxa":[{"id":"CWE-926","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}}]},{"ruleId":"D29","level":"warning","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"0c34dfdd3af675b7c0df8b8b1da18886d737b6f4edc95623b6eb1ed423078893"},"taxa":[{"id":"CWE-926","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}}]},{"ruleId":"D29","level":"warning","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"d8d683c99b1286dac49a75713d627089ba3475c9f2f541fa0e41329dfb57bc24"},"taxa":[{"id":"CWE-926","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}}]},{"ruleId":"D29","level":"warning","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"4342a00780a9f910b19d0afef7028dd1db32d0bdd8b6d2ca5a70955a7f84211d"},"taxa":[{"id":"CWE-926","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}}]},{"ruleId":"D29","level":"warning","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"8387ccc289a507015c0a9355e15417c5f0e5268d2a7b46d666d19fe4b6116d60"},"taxa":[{"id":"CWE-926","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}}]},{"ruleId":"D29","level":"warning","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"39aa987f8622a12bd27bce61339f1a28feeea2e45529ab06b7d3c26a71e43c06"},"taxa":[{"id":"CWE-926","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}}]},{"ruleId":"D29","level":"warning","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"462aea07a182f485fba6f58fb46c6d29568822788421c39e04f712d5d9823755"},"taxa":[{"id":"CWE-926","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}}]},{"ruleId":"D29","level":"warning","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"ff8afdc848f00799b1af669a4c5efef5528aed1c0db8d460ada5cd65c32af392"},"taxa":[{"id":"CWE-926","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}}]},{"ruleId":"D29","level":"warning","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"a1754574f0bb7133dc68fcbe19954e69d45702e8dae4fe76d685cb1ace003c6d"},"taxa":[{"id":"CWE-926","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}}]},{"ruleId":"D29","level":"warning","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"a46da8b1db099384a1bec39507bf728665d3148880b2167965ba2a2d201b936e"},"taxa":[{"id":"CWE-926","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}}]},{"ruleId":"D29","level":"warning","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"857d0cece5923473209ac43d567a614cba3f90cb0be343a44284e13e8e99b777"},"taxa":[{"id":"CWE-926","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}}]},{"ruleId":"D29","level":"warning","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"d29222194aa5231f94d3abfd6a278a8e6fb8c34e49854a53f4d4debe468a5903"},"taxa":[{"id":"CWE-926","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}}]},{"ruleId":"D34","level":"error","message":{"text":"Orphaned knowledge: No living knowledge remains for this large file \u2014 its last meaningful change has decayed away; if it breaks, no one currently understands it. Schedule a read-through / add characterisation tests before it bites."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/java/com/google/android/material/checkbox/MaterialCheckBox.java"},"region":{"startLine":1}}}],"partialFingerprints":{"codehealthFindingId/v1":"0a2fe77c3b8b937f78b56c628f463261e6df279fc366caa057dbec9da5eb6c1f"}},{"ruleId":"D34","level":"error","message":{"text":"Orphaned knowledge: No living knowledge remains for this large file \u2014 its last meaningful change has decayed away; if it breaks, no one currently understands it. Schedule a read-through / add characterisation tests before it bites."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/java/com/google/android/material/transformation/FabTransformationBehavior.java"},"region":{"startLine":1}}}],"partialFingerprints":{"codehealthFindingId/v1":"067f1da0f2ef6f6d4680fcf2b95f3f1f21cccbbf37d7759510f72b03abfbfecc"}},{"ruleId":"D34","level":"error","message":{"text":"Orphaned knowledge: No living knowledge remains for this large file \u2014 its last meaningful change has decayed away; if it breaks, no one currently understands it. Schedule a read-through / add characterisation tests before it bites."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/java/com/google/android/material/shape/ShapePath.java"},"region":{"startLine":1}}}],"partialFingerprints":{"codehealthFindingId/v1":"7453b0c4976ca06eecdc6430beac22c8ca331ce305449776d59e95877a9ed8e7"}},{"ruleId":"D34","level":"error","message":{"text":"Orphaned knowledge: No living knowledge remains for this large file \u2014 its last meaningful change has decayed away; if it breaks, no one currently understands it. Schedule a read-through / add characterisation tests before it bites."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/java/com/google/android/material/chip/ChipGroup.java"},"region":{"startLine":1}}}],"partialFingerprints":{"codehealthFindingId/v1":"56f93b73b36f343956ed505395a989e364abd1fa54b8789940d3b21ec9a8830d"}},{"ruleId":"D34","level":"error","message":{"text":"Orphaned knowledge: No living knowledge remains for this large file \u2014 its last meaningful change has decayed away; if it breaks, no one currently understands it. Schedule a read-through / add characterisation tests before it bites."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/java/com/google/android/material/imageview/ShapeableImageView.java"},"region":{"startLine":1}}}],"partialFingerprints":{"codehealthFindingId/v1":"bc795d998cae7ac14af4995cbc175499a77861fab6c106fe082c94d634659356"}},{"ruleId":"D34","level":"note","message":{"text":"Further orphaned files (smaller): 180 smaller file(s) also have no living knowledge \u2014 folded into the freshness score and metrics rather than listed individually (185 orphaned of 481 analysed files in total, counted over production source files of roughly 100 lines or more, excluding tests, vendored, generated and example/demo trees, largest first)."},"locations":[],"partialFingerprints":{"codehealthFindingId/v1":"ce861fd78f6935114d3a342cb90ad25870f984e1042954fcbbe27c0e23be3658"}},{"ruleId":"D35","level":"warning","message":{"text":"Change coupling: RangeDateSelector.java \u2194 SingleDateSelector.java: \u0060lib/java/com/google/android/material/datepicker/RangeDateSelector.java\u0060 and \u0060lib/java/com/google/android/material/datepicker/SingleDateSelector.java\u0060 change together 81% of the time (17 of the 21 commits that touched whichever of the two files changed less often, counting a file under its earlier names as well). They sit in the same directory, and in this ecosystem sibling files there normally share one namespace/package \u2014 so a direct reference between them needs no import and this pass cannot see whether one exists. Read the pair before acting: if one file only DECLARES what the other consumes (a constants/types file beside its user), the co-change is definitional and the question is whether the split earns its keep; if they duplicate structure, extract the common part into a shared function or type they both call; if neither holds, the coupling is hidden and worth breaking."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/java/com/google/android/material/datepicker/RangeDateSelector.java"},"region":{"startLine":1}}}],"partialFingerprints":{"codehealthFindingId/v1":"4ba2012b7474bc8fceb4762ab4879fa677452fe61aafadbcff20ce6de5cd1b6b"}},{"ruleId":"D35","level":"warning","message":{"text":"Change coupling: CornerTreatment.java \u2194 MaterialShapeDrawable.java: \u0060lib/java/com/google/android/material/shape/CornerTreatment.java\u0060 and \u0060lib/java/com/google/android/material/shape/MaterialShapeDrawable.java\u0060 change together 62% of the time (8 of the 13 commits that touched whichever of the two files changed less often, counting a file under its earlier names as well). They sit in the same directory, and in this ecosystem sibling files there normally share one namespace/package \u2014 so a direct reference between them needs no import and this pass cannot see whether one exists. Read the pair before acting: if one file only DECLARES what the other consumes (a constants/types file beside its user), the co-change is definitional and the question is whether the split earns its keep; if they duplicate structure, extract the common part into a shared function or type they both call; if neither holds, the coupling is hidden and worth breaking."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/java/com/google/android/material/shape/CornerTreatment.java"},"region":{"startLine":1}}}],"partialFingerprints":{"codehealthFindingId/v1":"0a83ae39f7c7e62c0d53fb5580b33fe9f8b773b37385909349c01b65869a2fe0"}},{"ruleId":"D35","level":"warning","message":{"text":"Change coupling: MaterialShapeDrawable.java \u2194 RoundedCornerTreatment.java: \u0060lib/java/com/google/android/material/shape/MaterialShapeDrawable.java\u0060 and \u0060lib/java/com/google/android/material/shape/RoundedCornerTreatment.java\u0060 change together 50% of the time (5 of the 10 commits that touched whichever of the two files changed less often, counting a file under its earlier names as well). They sit in the same directory, and in this ecosystem sibling files there normally share one namespace/package \u2014 so a direct reference between them needs no import and this pass cannot see whether one exists. Read the pair before acting: if one file only DECLARES what the other consumes (a constants/types file beside its user), the co-change is definitional and the question is whether the split earns its keep; if they duplicate structure, extract the common part into a shared function or type they both call; if neither holds, the coupling is hidden and worth breaking."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/java/com/google/android/material/shape/MaterialShapeDrawable.java"},"region":{"startLine":1}}}],"partialFingerprints":{"codehealthFindingId/v1":"662c834726a608fba1652c9574f3852be35409302e4d5e6efdb66b0dc52b09d4"}},{"ruleId":"D35","level":"warning","message":{"text":"Change coupling: CutCornerTreatment.java \u2194 MaterialShapeDrawable.java: \u0060lib/java/com/google/android/material/shape/CutCornerTreatment.java\u0060 and \u0060lib/java/com/google/android/material/shape/MaterialShapeDrawable.java\u0060 change together 50% of the time (5 of the 10 commits that touched whichever of the two files changed less often, counting a file under its earlier names as well). They sit in the same directory, and in this ecosystem sibling files there normally share one namespace/package \u2014 so a direct reference between them needs no import and this pass cannot see whether one exists. Read the pair before acting: if one file only DECLARES what the other consumes (a constants/types file beside its user), the co-change is definitional and the question is whether the split earns its keep; if they duplicate structure, extract the common part into a shared function or type they both call; if neither holds, the coupling is hidden and worth breaking."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"lib/java/com/google/android/material/shape/CutCornerTreatment.java"},"region":{"startLine":1}}}],"partialFingerprints":{"codehealthFindingId/v1":"1466af39d799139c19d0adcfb12a9df92b8a7512ce0017df79cf31a69c1b0a26"}}],"taxonomies":[{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d","organization":"MITRE","informationUri":"https://cwe.mitre.org/","isComprehensive":false,"shortDescription":{"text":"The MITRE Common Weakness Enumeration (CWE)."},"taxa":[{"id":"CWE-259","guid":"ae9ad959-fbb6-9d5e-892d-3dca66da0b69","name":"Use of Hard-coded Password","shortDescription":{"text":"Use of Hard-coded Password"},"helpUri":"https://cwe.mitre.org/data/definitions/259.html"},{"id":"CWE-77","guid":"332c8ade-6612-9f56-a06b-d8d90b1a8750","name":"Command Injection","shortDescription":{"text":"Command Injection"},"helpUri":"https://cwe.mitre.org/data/definitions/77.html"},{"id":"CWE-78","guid":"2e31ceaf-c7ae-2e5e-9661-cfb1362789cf","name":"OS Command Injection","shortDescription":{"text":"OS Command Injection"},"helpUri":"https://cwe.mitre.org/data/definitions/78.html"},{"id":"CWE-79","guid":"fd45580b-e8c4-fc5e-8c2f-aa8fab0b4dbf","name":"Cross-site Scripting (XSS)","shortDescription":{"text":"Cross-site Scripting (XSS)"},"helpUri":"https://cwe.mitre.org/data/definitions/79.html"},{"id":"CWE-798","guid":"5e8f057d-fee3-995a-a0cb-9fc5b0d174d1","name":"Use of Hard-coded Credentials","shortDescription":{"text":"Use of Hard-coded Credentials"},"helpUri":"https://cwe.mitre.org/data/definitions/798.html"},{"id":"CWE-89","guid":"6d08fdad-37eb-c150-bbf0-d7d946863407","name":"SQL Injection","shortDescription":{"text":"SQL Injection"},"helpUri":"https://cwe.mitre.org/data/definitions/89.html"},{"id":"CWE-926","guid":"0d9b5579-5549-555a-8a97-f9cc14f3ad4a","name":"CWE-926","shortDescription":{"text":"CWE-926"},"helpUri":"https://cwe.mitre.org/data/definitions/926.html"},{"id":"CWE-94","guid":"75e7f50c-6c2f-dd52-bf40-bf6c52b861fd","name":"Code Injection","shortDescription":{"text":"Code Injection"},"helpUri":"https://cwe.mitre.org/data/definitions/94.html"}]}],"properties":{"codehealthPublication":{"public":true,"notice":"This is the PUBLIC form of this artifact. Findings are listed in full, but the details of SECURITY findings \u2014 which rule fired, in which file, on which line, and how to fix it \u2014 are deliberately withheld, and any secret-scanner results are excluded entirely. Where detail is absent here it was REMOVED FOR PUBLICATION; it is not missing from the analysis. The complete artifact is available from the repository owner.","securityFindingsRedacted":21,"secretScannerRunsExcluded":0}},"redactionTokens":["A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."]}]}