From 64bf0e6ef3526a701ca4c5b058a6e91b59efb4e0 Mon Sep 17 00:00:00 2001 From: Jens Papenhagen Date: Sat, 11 Jul 2026 16:51:59 +0200 Subject: [PATCH 1/5] docs: update changelog for 2.0.1 --- CHANGELOG.md | 31 ++++++++++++++++++++++++++++++- 1 file changed, 30 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index d1c04b5..e2dd7a7 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,33 @@ This project adheres to Semantic Versioning and follows a Keep a Changelog-like ## [Unreleased] +## [2.0.1] - 2026-07-11 + +### Added + +- NullAway + Error Prone integration for compile-time null safety checks. +- SECURITY.md with vulnerability reporting policy. +- OWASP dependency check integration and CycloneDX SBOM generation. +- Checkstyle enforcement for test code. +- GitHub Actions workflow for dependency validation. + +### Changed + +- Upgraded Jackson dependencies to 3.2.1. +- Upgraded JUnit BOM to 6.1.1. +- Upgraded SpotBugs to 6.5.8, spotbugs-annotations to 4.10.2. +- Upgraded Gradle wrapper to 9.6.1. +- Stricter PMD rules and SpotBugs configured to fail on warnings in main source set. +- Null-safety improvements across the entire codebase. +- Fixed catastrophic backtracking in `StringValidator` for random/fuzzy input. + +### Security + +- Added dependency verification metadata for reproducible builds. +- Enforced SHA-256 checksum verification for Gradle wrapper. + +## [2.0.0] - 2026-02-24 + ### Added - Conformance test suite for TOON Specification 3.1. @@ -182,7 +209,9 @@ This project adheres to Semantic Versioning and follows a Keep a Changelog-like - Delimiter options (comma, tab, pipe) and optional length marker. - Comprehensive README with specification overview and examples. -[Unreleased]: https://github.com/toon-format/toon-java/compare/v1.0.9...HEAD +[Unreleased]: https://github.com/toon-format/toon-java/compare/v2.0.1...HEAD +[2.0.1]: https://github.com/toon-format/toon-java/compare/v2.0.0...v2.0.1 +[2.0.0]: https://github.com/toon-format/toon-java/compare/v1.0.9...v2.0.0 [1.0.9]: https://github.com/toon-format/toon-java/releases/tag/v1.0.9 [1.0.8]: https://github.com/toon-format/toon-java/releases/tag/v1.0.8 [1.0.7]: https://github.com/toon-format/toon-java/releases/tag/v1.0.7 From 3e7c326c85437d6c55b191fade8083293447aeec Mon Sep 17 00:00:00 2001 From: Jens Papenhagen Date: Sat, 11 Jul 2026 16:55:54 +0200 Subject: [PATCH 2/5] docs: update readme for 2.0.1 --- README.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index 4927529..93c1d03 100644 --- a/README.md +++ b/README.md @@ -21,7 +21,7 @@ JToon is available on Maven Central. Add it to your project using your preferred ```gradle dependencies { - implementation 'dev.toonformat:jtoon:2.0.0' + implementation 'dev.toonformat:jtoon:2.0.1' } ``` @@ -29,7 +29,7 @@ dependencies { ```kotlin dependencies { - implementation("dev.toonformat:jtoon:2.0.0") + implementation("dev.toonformat:jtoon:2.0.1") } ``` @@ -39,7 +39,7 @@ dependencies { dev.toonformat jtoon - 2.0.0 + 2.0.1 ``` From decf6baf317421b66f62648812a9b3f6c06123d6 Mon Sep 17 00:00:00 2001 From: Jens Papenhagen Date: Sat, 11 Jul 2026 17:06:33 +0200 Subject: [PATCH 3/5] update github workflows --- .github/workflows/build.yml | 3 +++ .github/workflows/release.yml | 2 +- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 5c60bd1..9f979f0 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -44,6 +44,9 @@ jobs: - name: Build with Gradle run: ./gradlew build + - name: Generate SBOM + run: ./gradlew cyclonedxBom + - name: Upload test results uses: actions/upload-artifact@v7.0.1 if: always() diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 629caf8..315d1f0 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -68,7 +68,7 @@ jobs: GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }} - name: Generate SBOM - run: ./gradlew cyclonedxBom + run: ./gradlew cyclonedxBom --write-verification-metadata sha256 - name: Update README version run: | From 778c8f40a79ebbe4ba653416a17bc1423dd715f9 Mon Sep 17 00:00:00 2001 From: Jens Papenhagen Date: Sat, 11 Jul 2026 17:06:44 +0200 Subject: [PATCH 4/5] update doc for problems on build --- CONTRIBUTING.md | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 65c636a..4b8ffb6 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -99,6 +99,22 @@ Common Gradle tasks you'll use: ./gradlew clean ``` +### Dependency Verification + +This project uses [Gradle Dependency Verification](https://docs.gradle.org/current/userguide/dependency_verification.html) to ensure build reproducibility. All dependency checksums are stored in `gradle/verification-metadata.xml`. + +When you **add or update dependencies**, you must regenerate the verification metadata before pushing: + +```bash +# Regenerate verification metadata (includes all configurations) +./gradlew build --write-verification-metadata sha256 + +# If you also use CycloneDX SBOM generation, update that too +./gradlew cyclonedxBom --write-verification-metadata sha256 +``` + +Commit the updated `gradle/verification-metadata.xml` with your dependency changes. The CI build will **fail** if checksums are missing. + ## SPEC Compliance All implementations must comply with the [TOON specification](https://github.com/toon-format/spec/blob/main/SPEC.md). From 4566a2a3d21ec655e96281281fb5ea792b6464fd Mon Sep 17 00:00:00 2001 From: Jens Papenhagen Date: Sat, 11 Jul 2026 17:06:57 +0200 Subject: [PATCH 5/5] update metadata xml --- gradle/verification-metadata.xml | 90 ++++++++++++++++++++++++++++++++ 1 file changed, 90 insertions(+) diff --git a/gradle/verification-metadata.xml b/gradle/verification-metadata.xml index 1460659..391025f 100644 --- a/gradle/verification-metadata.xml +++ b/gradle/verification-metadata.xml @@ -127,6 +127,9 @@ + + + @@ -211,6 +214,9 @@ + + + @@ -248,6 +254,9 @@ + + + @@ -256,6 +265,9 @@ + + + @@ -264,6 +276,9 @@ + + + @@ -518,6 +533,9 @@ + + + @@ -701,6 +719,9 @@ + + + @@ -1469,6 +1490,9 @@ + + + @@ -1482,6 +1506,9 @@ + + + @@ -1769,6 +1796,9 @@ + + + @@ -1795,6 +1825,9 @@ + + + @@ -1803,6 +1836,9 @@ + + + @@ -1811,6 +1847,9 @@ + + + @@ -1976,6 +2015,9 @@ + + + @@ -2144,6 +2186,9 @@ + + + @@ -2312,6 +2357,9 @@ + + + @@ -2320,6 +2368,9 @@ + + + @@ -2328,6 +2379,9 @@ + + + @@ -2336,6 +2390,9 @@ + + + @@ -2344,6 +2401,9 @@ + + + @@ -2352,6 +2412,9 @@ + + + @@ -2360,6 +2423,9 @@ + + + @@ -2399,6 +2465,9 @@ + + + @@ -2539,6 +2608,9 @@ + + + @@ -2547,6 +2619,9 @@ + + + @@ -2759,6 +2834,9 @@ + + + @@ -2770,6 +2848,9 @@ + + + @@ -2814,6 +2895,9 @@ + + + @@ -2830,6 +2914,9 @@ + + + @@ -2846,6 +2933,9 @@ + + +