Address code review feedback: improve comments and fix typo

Co-authored-by: tvaron3 <70857381+tvaron3@users.noreply.github.com>

Author: Copilot

sdk/cosmos/azure-cosmos/CHANGELOG.md

@@ -12,7 +12,7 @@
 * **[SECURITY]** Fixed Remote Code Execution (RCE) vulnerability via unsafe Java deserialization in `CosmosClientMetadataCachesSnapshot`, `AsyncCache`, and `DocumentCollection`. Added `SafeObjectInputStream` with class allowlisting to prevent deserialization of unauthorized classes.
 
 #### Other Changes
-* Added `x-ms-hub-region-processing-only` header to allow hub-region stickiness when 404 `READ SESSION NOT AVAIALBLE` is hit for Single-Writer accounts. - [PR 47631](https://github.com/Azure/azure-sdk-for-java/pull/47631)
+* Added `x-ms-hub-region-processing-only` header to allow hub-region stickiness when 404 `READ SESSION NOT AVAILABLE` is hit for Single-Writer accounts. - [PR 47631](https://github.com/Azure/azure-sdk-for-java/pull/47631)
 
 ### 4.77.0 (2026-01-26)
 

sdk/cosmos/azure-cosmos/src/main/java/com/azure/cosmos/implementation/caches/AsyncCache.java

@@ -246,12 +246,16 @@ private void readObject(ObjectInputStream ois) throws ClassNotFoundException, IO
                 pairs.put(key, new AsyncLazy<>(value));
             }
 
-            // Security fix: Don't deserialize the IEqualityComparer as it could be a malicious object.
+            // Security fix: Don't deserialize the IEqualityComparer as it could be a malicious object
+            // (e.g., a crafted lambda that executes arbitrary code).
             // Instead, skip it and use the default equality comparer.
-            // This is safe because all existing serialized caches use the default comparer.
-            ois.readObject(); // Read and discard the serialized comparer
+            // This is safe because:
+            // 1. All existing production code uses the default equality comparer
+            // 2. The serialization format remains unchanged (we still write the comparer for backward compatibility)
+            // 3. Future format changes should increment the serialVersionUID to handle compatibility explicitly
+            ois.readObject(); // Read and discard the serialized comparer to maintain format compatibility
 
-            // Use the default equality comparer
+            // Use the default equality comparer (same as AsyncCache constructor)
             @SuppressWarnings("unchecked")
             IEqualityComparer<TValue> equalityComparer = (value1, value2) -> {
                 if (value1 == value2)