Changes reported in operations but only securityScheme changed

I am using

    testImplementation("org.openapitools.openapidiff:openapi-diff-core:2.1.6") {
        exclude(group = "io.swagger.core.v3", module = "swagger-core")
        exclude(group = "io.swagger.core.v3", module = "swagger-models")
        exclude(group = "io.swagger.core.v3", module = "swagger-annotations")
    }

Given the two API docs to compare where the only change is in authorizationUrl ('' vs. 'some_value') and tokenUrl ('' vs. 'some_value').

components:
  securitySchemes:
    OAuth2:
      bearerFormat: JWT
      flows:
        authorizationCode:
          authorizationUrl: ''
          tokenUrl: ''
      in: header
      scheme: bearer
      type: oauth2
info:
  title: Company API
  version: V0
openapi: 3.1.0
paths:
  /users:
    post:
      operationId: createUser
      responses:
        "201":
          description: Created
      security:
      - OAuth2: []
servers:
- description: Default Server URL
  url: /api/

components:
  securitySchemes:
    OAuth2:
      bearerFormat: JWT
      flows:
        authorizationCode:
          authorizationUrl: 'some_value'
          tokenUrl: 'some_value'
      in: header
      scheme: bearer
      type: oauth2
info:
  title: Company API
  version: V0
openapi: 3.1.0
paths:
  /users:
    post:
      operationId: createUser
      responses:
        "201":
          description: Created
      security:
      - OAuth2: []
servers:
- description: Default Server URL
  url: /api/

The resulting error message is misleading as the issue is not directly related to any concrete endpoint. This took me quite a while to narrow this down to this difference.

So it would be nice to have a more suitable error message.

org.opentest4j.AssertionFailedError: [### Company API (v V0)
---

#### What's Changed
---

##### `POST` /users


#### Result
---

API changes broke backward compatibility

] 

まず、示されている2つの OpenAPI 3.1 ドキュメントと openapi-diff-core 2.1.6 依存関係を使って報告を再現します。OAuth2 securityScheme の authorizationUrl と tokenUrl への変更が POST /users にどのように割り当てられるかを追跡し、次に報告された変更箇所を更新して、結果のメッセージが security-scheme の変更を特定していることを確認します。