Release/2.0.1

.github/workflows/build.yml

@@ -44,6 +44,9 @@ jobs:
       - name: Build with Gradle
         run: ./gradlew build
 
+      - name: Generate SBOM
+        run: ./gradlew cyclonedxBom
+
       - name: Upload test results
         uses: actions/upload-artifact@v7.0.1
         if: always()

.github/workflows/release.yml

@@ -68,7 +68,7 @@ jobs:
           GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
 
       - name: Generate SBOM
-        run: ./gradlew cyclonedxBom
+        run: ./gradlew cyclonedxBom --write-verification-metadata sha256
 
       - name: Update README version
         run: |

CHANGELOG.md

@@ -6,6 +6,33 @@ This project adheres to Semantic Versioning and follows a Keep a Changelog-like
 
 ## [Unreleased]
 
+## [2.0.1] - 2026-07-11
+
+### Added
+
+-   NullAway + Error Prone integration for compile-time null safety checks.
+-   SECURITY.md with vulnerability reporting policy.
+-   OWASP dependency check integration and CycloneDX SBOM generation.
+-   Checkstyle enforcement for test code.
+-   GitHub Actions workflow for dependency validation.
+
+### Changed
+
+-   Upgraded Jackson dependencies to 3.2.1.
+-   Upgraded JUnit BOM to 6.1.1.
+-   Upgraded SpotBugs to 6.5.8, spotbugs-annotations to 4.10.2.
+-   Upgraded Gradle wrapper to 9.6.1.
+-   Stricter PMD rules and SpotBugs configured to fail on warnings in main source set.
+-   Null-safety improvements across the entire codebase.
+-   Fixed catastrophic backtracking in `StringValidator` for random/fuzzy input.
+
+### Security
+
+-   Added dependency verification metadata for reproducible builds.
+-   Enforced SHA-256 checksum verification for Gradle wrapper.
+
+## [2.0.0] - 2026-02-24
+
 ### Added
 
 -   Conformance test suite for TOON Specification 3.1.
@@ -182,7 +209,9 @@ This project adheres to Semantic Versioning and follows a Keep a Changelog-like
 -   Delimiter options (comma, tab, pipe) and optional length marker.
 -   Comprehensive README with specification overview and examples.
 
-[Unreleased]: https://github.com/toon-format/toon-java/compare/v1.0.9...HEAD
+[Unreleased]: https://github.com/toon-format/toon-java/compare/v2.0.1...HEAD
+[2.0.1]: https://github.com/toon-format/toon-java/compare/v2.0.0...v2.0.1
+[2.0.0]: https://github.com/toon-format/toon-java/compare/v1.0.9...v2.0.0
 [1.0.9]: https://github.com/toon-format/toon-java/releases/tag/v1.0.9
 [1.0.8]: https://github.com/toon-format/toon-java/releases/tag/v1.0.8
 [1.0.7]: https://github.com/toon-format/toon-java/releases/tag/v1.0.7

CONTRIBUTING.md

@@ -99,6 +99,22 @@ Common Gradle tasks you'll use:
 ./gradlew clean
 ```
 
+### Dependency Verification
+
+This project uses [Gradle Dependency Verification](https://docs.gradle.org/current/userguide/dependency_verification.html) to ensure build reproducibility. All dependency checksums are stored in `gradle/verification-metadata.xml`.
+
+When you **add or update dependencies**, you must regenerate the verification metadata before pushing:
+
+```bash
+# Regenerate verification metadata (includes all configurations)
+./gradlew build --write-verification-metadata sha256
+
+# If you also use CycloneDX SBOM generation, update that too
+./gradlew cyclonedxBom --write-verification-metadata sha256
+```
+
+Commit the updated `gradle/verification-metadata.xml` with your dependency changes. The CI build will **fail** if checksums are missing.
+
 ## SPEC Compliance
 
 All implementations must comply with the [TOON specification](https://github.com/toon-format/spec/blob/main/SPEC.md).

README.md

@@ -21,15 +21,15 @@ JToon is available on Maven Central. Add it to your project using your preferred
 
 ```gradle
 dependencies {
-    implementation 'dev.toonformat:jtoon:2.0.0'
+    implementation 'dev.toonformat:jtoon:2.0.1'
 }
 ```
 
 **Gradle (Kotlin DSL):**
 
 ```kotlin
 dependencies {
-    implementation("dev.toonformat:jtoon:2.0.0")
+    implementation("dev.toonformat:jtoon:2.0.1")
 }
 ```
 
@@ -39,7 +39,7 @@ dependencies {
 <dependency>
     <groupId>dev.toonformat</groupId>
     <artifactId>jtoon</artifactId>
-    <version>2.0.0</version>
+    <version>2.0.1</version>
 </dependency>
 ```