diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 5c60bd1..9f979f0 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -44,6 +44,9 @@ jobs:
- name: Build with Gradle
run: ./gradlew build
+ - name: Generate SBOM
+ run: ./gradlew cyclonedxBom
+
- name: Upload test results
uses: actions/upload-artifact@v7.0.1
if: always()
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 629caf8..315d1f0 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -68,7 +68,7 @@ jobs:
GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
- name: Generate SBOM
- run: ./gradlew cyclonedxBom
+ run: ./gradlew cyclonedxBom --write-verification-metadata sha256
- name: Update README version
run: |
diff --git a/CHANGELOG.md b/CHANGELOG.md
index d1c04b5..e2dd7a7 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,33 @@ This project adheres to Semantic Versioning and follows a Keep a Changelog-like
## [Unreleased]
+## [2.0.1] - 2026-07-11
+
+### Added
+
+- NullAway + Error Prone integration for compile-time null safety checks.
+- SECURITY.md with vulnerability reporting policy.
+- OWASP dependency check integration and CycloneDX SBOM generation.
+- Checkstyle enforcement for test code.
+- GitHub Actions workflow for dependency validation.
+
+### Changed
+
+- Upgraded Jackson dependencies to 3.2.1.
+- Upgraded JUnit BOM to 6.1.1.
+- Upgraded SpotBugs to 6.5.8, spotbugs-annotations to 4.10.2.
+- Upgraded Gradle wrapper to 9.6.1.
+- Stricter PMD rules and SpotBugs configured to fail on warnings in main source set.
+- Null-safety improvements across the entire codebase.
+- Fixed catastrophic backtracking in `StringValidator` for random/fuzzy input.
+
+### Security
+
+- Added dependency verification metadata for reproducible builds.
+- Enforced SHA-256 checksum verification for Gradle wrapper.
+
+## [2.0.0] - 2026-02-24
+
### Added
- Conformance test suite for TOON Specification 3.1.
@@ -182,7 +209,9 @@ This project adheres to Semantic Versioning and follows a Keep a Changelog-like
- Delimiter options (comma, tab, pipe) and optional length marker.
- Comprehensive README with specification overview and examples.
-[Unreleased]: https://github.com/toon-format/toon-java/compare/v1.0.9...HEAD
+[Unreleased]: https://github.com/toon-format/toon-java/compare/v2.0.1...HEAD
+[2.0.1]: https://github.com/toon-format/toon-java/compare/v2.0.0...v2.0.1
+[2.0.0]: https://github.com/toon-format/toon-java/compare/v1.0.9...v2.0.0
[1.0.9]: https://github.com/toon-format/toon-java/releases/tag/v1.0.9
[1.0.8]: https://github.com/toon-format/toon-java/releases/tag/v1.0.8
[1.0.7]: https://github.com/toon-format/toon-java/releases/tag/v1.0.7
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 65c636a..4b8ffb6 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -99,6 +99,22 @@ Common Gradle tasks you'll use:
./gradlew clean
```
+### Dependency Verification
+
+This project uses [Gradle Dependency Verification](https://docs.gradle.org/current/userguide/dependency_verification.html) to ensure build reproducibility. All dependency checksums are stored in `gradle/verification-metadata.xml`.
+
+When you **add or update dependencies**, you must regenerate the verification metadata before pushing:
+
+```bash
+# Regenerate verification metadata (includes all configurations)
+./gradlew build --write-verification-metadata sha256
+
+# If you also use CycloneDX SBOM generation, update that too
+./gradlew cyclonedxBom --write-verification-metadata sha256
+```
+
+Commit the updated `gradle/verification-metadata.xml` with your dependency changes. The CI build will **fail** if checksums are missing.
+
## SPEC Compliance
All implementations must comply with the [TOON specification](https://github.com/toon-format/spec/blob/main/SPEC.md).
diff --git a/README.md b/README.md
index 4927529..93c1d03 100644
--- a/README.md
+++ b/README.md
@@ -21,7 +21,7 @@ JToon is available on Maven Central. Add it to your project using your preferred
```gradle
dependencies {
- implementation 'dev.toonformat:jtoon:2.0.0'
+ implementation 'dev.toonformat:jtoon:2.0.1'
}
```
@@ -29,7 +29,7 @@ dependencies {
```kotlin
dependencies {
- implementation("dev.toonformat:jtoon:2.0.0")
+ implementation("dev.toonformat:jtoon:2.0.1")
}
```
@@ -39,7 +39,7 @@ dependencies {
dev.toonformat
jtoon
- 2.0.0
+ 2.0.1
```
diff --git a/gradle/verification-metadata.xml b/gradle/verification-metadata.xml
index 1460659..391025f 100644
--- a/gradle/verification-metadata.xml
+++ b/gradle/verification-metadata.xml
@@ -127,6 +127,9 @@
+
+
+
@@ -211,6 +214,9 @@
+
+
+
@@ -248,6 +254,9 @@
+
+
+
@@ -256,6 +265,9 @@
+
+
+
@@ -264,6 +276,9 @@
+
+
+
@@ -518,6 +533,9 @@
+
+
+
@@ -701,6 +719,9 @@
+
+
+
@@ -1469,6 +1490,9 @@
+
+
+
@@ -1482,6 +1506,9 @@
+
+
+
@@ -1769,6 +1796,9 @@
+
+
+
@@ -1795,6 +1825,9 @@
+
+
+
@@ -1803,6 +1836,9 @@
+
+
+
@@ -1811,6 +1847,9 @@
+
+
+
@@ -1976,6 +2015,9 @@
+
+
+
@@ -2144,6 +2186,9 @@
+
+
+
@@ -2312,6 +2357,9 @@
+
+
+
@@ -2320,6 +2368,9 @@
+
+
+
@@ -2328,6 +2379,9 @@
+
+
+
@@ -2336,6 +2390,9 @@
+
+
+
@@ -2344,6 +2401,9 @@
+
+
+
@@ -2352,6 +2412,9 @@
+
+
+
@@ -2360,6 +2423,9 @@
+
+
+
@@ -2399,6 +2465,9 @@
+
+
+
@@ -2539,6 +2608,9 @@
+
+
+
@@ -2547,6 +2619,9 @@
+
+
+
@@ -2759,6 +2834,9 @@
+
+
+
@@ -2770,6 +2848,9 @@
+
+
+
@@ -2814,6 +2895,9 @@
+
+
+
@@ -2830,6 +2914,9 @@
+
+
+
@@ -2846,6 +2933,9 @@
+
+
+