v2.0.0

2.0.0 - 2026-10-17

Breaking changes

• Require full JDK 21, retain JDK 21/25 support, and emit Java 21 bytecode.
• Require Maven 3.9.16, add Maven 3.10.0, and test Gradle 8.14.6/9.8.1.
• Consolidate Jackson implementations on 3.2.3 and adopt JToon 3.0.0 TOON semantics.
• Upgrade Cognitive Java to 1.0.0, NullAway to 0.14.2, and SpotBugs to 4.10.5;
  preserve quality thresholds and public JSON/JUnit/CLI contracts.
• Refresh build/publishing plugins, use setup-java 6, and verify emitted archive
  bytecode, Maven runtime metadata, dependency inventory, and license contents.

Changed

• Automate signed release tags and publication after a reviewed version-change
  PR merges, with protected-source validation and required CI on the merge commit.
• Reuse the imported GPG home for Gradle publication signing and verify the
  resulting signatures during publishing preflight.
• Refresh compatible dependencies, including Woodstox and stax2-api, and run the
  complete Gradle verification lifecycle across the supported compatibility matrix.

v1.0.1

1.0.1 - 2026-09-19

Fixed

• Added deterministic CycloneDX UUID serial numbers required by GitHub SBOM attestations while keeping
  release SBOMs reproducible.
• Superseded the partial v1.0.0 publication, whose registry artifacts remain immutable but whose GitHub release
  stayed in draft after its serial-number-free SBOMs were rejected during attestation.

v1.0.0 — partial publication (superseded by v1.0.1)

Warning

Historical partial publication — superseded by v1.0.1.

The v1.0.0 artifacts published to Maven Central and the Gradle Plugin Portal are final and immutable. GitHub asset publication stopped before the CLI JAR, checksum manifests, detached signatures, SBOMs, and attestations were uploaded and finalized. Use v1.0.1 for downloads and complete supply-chain metadata.

Registry records: Maven Central · Gradle Plugin Portal

---

1.0.0 - 2026-09-11

Added

• Defined the v1 compatibility contract for CLI options, plugin configuration,
  exit codes, and JSON, TOON, and JUnit output schemas, together with a
  0.6.4-to-1.0.0 migration guide and maintainer release runbook.
• Declared and added continuous testing for Java 17, 21, and 25, Maven 3.9.x,
  and Gradle 8.14.x and 9.7.x support while retaining Java 17-compatible
  bytecode.
• Added deterministic CycloneDX 1.6 component SBOMs, signed GitHub release
  assets, SHA-256 and SHA-512 manifests, and GitHub build-provenance and SBOM
  attestations.

Changed

• Adopted TOON Specification 4.1 output semantics as a hard break. Empty arrays
  now use the canonical methods: [] representation; no legacy output mode is
  retained.
• Hardened signed-tag, protected-source, version-alignment, environment-approval,
  and immutable GitHub Actions controls for normal and isolated-hotfix releases.
• Made Maven and Gradle release archives reproducible and gated publication on
  registry, asset, signature, checksum, SBOM, and attestation verification.

Fixed

• Packaged the project license and uniquely named third-party licenses and
  notices in all applicable artifacts, with automated archive-content checks.
• Removed JDK 25 build warnings, corrected deprecated Jackson configuration,
  and preserved Maven builds from Windows paths containing spaces.

Dependencies

• Updated JToon from 1.0.9 to 2.0.2, including its Jackson 3 runtime from
  3.0.4 to 3.2.1.
• Updated cognitive-java from 0.6.0 to 0.7.1, Maven Compiler Plugin from
  3.15.0 to 3.16.0, Maven JAR Plugin from 3.5.0 to 3.5.1, and SpotBugs
  Maven Plugin from 4.9.8.3 to 4.10.4.1.

v0.6.4

0.6.4 - 2026-09-06

Dependencies

• Updated Jackson from 2.22.1 to 2.22.2, NullAway from 0.13.7 to
  0.13.8, and Maven Surefire from 3.5.6 to 3.6.0.

Changed

• Aligned offline CI test-cache priming with the configured JUnit and Surefire
  versions, including the Surefire provider's transitive dependencies.

v0.6.3

0.6.3 - 2026-08-29

Fixed

• Serialized Gradle report-state access within each JVM before acquiring the
  cross-process file lock, preventing parallel subproject checks from failing
  with OverlappingFileLockException.

Dependencies

• Updated JUnit from 6.1.1 to 6.1.3, JSpecify from 1.0.0 to 1.0.1, and
  Jackson from 2.22.0 to 2.22.1.

v0.6.2

0.6.2 - 2026-08-09

Changed

• Reduced the default CRAP threshold from 8.0 to 6.0 while keeping the
  recommended 4.0 to 8.0 range unchanged. Configure 8.0 explicitly when
  retaining the previous default behavior is required.
• Enriched JUnit XML output with method metric summaries in testcase names and
  detailed CRAP, coverage, and source context in diagnostic output.
• Hardened CLI parsing, changed-file ordering, source-root and module
  resolution, JaCoCo coverage parsing, and cross-platform path handling.
• Hardened Maven and Gradle report defaults, report-path ownership, alias
  handling, and configuration-cache state management.
• Tightened CI and release plumbing with pinned workflow actions, safer JDK 25
  quality-gate activation, blank-credential publication skips, and masked
  Central upload authorization.

Dependencies

• Updated the cognitive-java, JaCoCo, JUnit, Jackson, Error Prone, NullAway,
  Surefire, Central publishing, and Gradle wrapper versions used by the build
  and release workflow.

v0.6.1

0.6.1 - 2026-06-01

Fixed

• Stopped lambda-body decision nodes from inflating the enclosing source method's complexity and ignored javac synthetic lambda coverage methods during attribution.
• Treated ambiguous same-line overload coverage collisions as unavailable instead of assigning coverage to the wrong source method.

Changed

• Documented the current anonymous-class scope explicitly: anonymous-class methods are not reported as first-class rows and their body complexity is not folded into the enclosing method.
• Expanded CI with granular NullAway and SpotBugs gates across modules, plus release-preflight cache priming for SpotBugs.

Dependencies

• Updated compatible Java test and analysis tooling while keeping the JUnit version aligned with current CI compatibility.

v0.6.0

0.6.0 - 2026-05-24

Added

• Added configurable source exclusions across the CLI, Maven plugin, and Gradle plugin, including path globs, class-name regexes, annotation names, and conservative generated-code defaults.
• Added source-root overrides across the CLI and build-tool integrations, plus richer report-path, JUnit sidecar, and machine-readable primary-report controls.
• Added broader self-hosting quality coverage for JDK 21 and 25, Windows path-sensitive validation, and release-quality checks for shaded CLI packaging and publication preflight.

Changed

• Hardened Java parsing and JaCoCo attribution around constructors, malformed counter values, source-position edge cases, deterministic metric ordering, and package-comment handling.
• Expanded CLI and plugin documentation to cover report outputs, source roots, exclusion configuration, threshold guidance, exit-code behavior, and current published coordinates.
• Tightened CI and release automation so Javadoc failures, publication preflight, cross-platform wrapper behavior, and sibling quality gates fail early before publication.

Fixed

• Fixed Gradle and Maven module-path handling, Windows process cleanup and wrapper execution fallbacks, symlink and case-sensitive path handling, and Git-status timeout reporting.
• Fixed GitLab-visible JUnit metadata and report path collision handling for both primary output and sidecar generation.

Dependencies

• Updated stable Maven plugins, GitHub Actions, and supporting build dependencies used by the Java release and verification workflow.

v0.5.0

0.5.0 - 2026-05-10

Added

• Added configurable CRAP thresholds across the CLI, Maven plugin, and Gradle plugin, and exposed the active threshold in primary reports.
• Added AI-agent-friendly primary report controls across the CLI, Maven plugin, and Gradle plugin: agent, failuresOnly, omitRedundancy, report-output path controls, and the none primary report format.
• Added dedicated Maven and Gradle report controls for primary output, JUnit sidecars, and consumer-configurable report paths.
• Added the dedicated cognitive-java Gate CI job and documented the matching local self-hosting gate workflow.

Changed

• CRAP scoring now uses the worse available JaCoCo instruction or branch coverage and records the selected coverage kind per method.
• Simplified machine-readable report schemas to a top-level status and threshold plus method entries, and redefined agent mode as a composite shortcut that can still be overridden explicitly.
• Switched JSON and JUnit XML report marshaling to Jackson and improved the text report table formatting.
• Resolved Maven report paths against the execution root, clarified Maven Central versus Plugin Portal consumption guidance, and documented self-hosting gate ownership more precisely.

Fixed

• Hardened Gradle report state tracking and cleanup for stale sidecars, aliased paths, case-collision paths, symlinked targets, concurrent task state, and failed report replacement scenarios.
• Kept Gradle module and JaCoCo report mappings configuration-cache-friendly while validating report-path collisions and internal-task file misuse earlier.

Dependencies

• Updated Java build and publishing dependencies, including JUnit 6.0.3, Jackson 2.21.3, Error Prone 2.49.0, NullAway 0.13.4, Maven plugin tooling, and the Sonatype Central publishing plugin 0.10.0.

v0.4.1

0.4.1 - 2026-04-08

Changed

• Resolved Gradle plugin module and JaCoCo report mappings during configuration so crap-java-check no longer performs execution-time build-marker discovery.
• Added root-plus-subproject Gradle coverage tests and an explicit configuration-cache reuse test before advertising support in the published plugin metadata.