Version 2.0.0

[dcruzb]

Prepares the first v2 release. Draft until the jsPDF fix lands — do not tag before that.

Remaining steps

1. The jsPDF fix merges into v2.
2. Update this branch from v2, then add the Version 2.0.0 commit: CHANGELOG.md header ## [2.0.0] — in progress becomes the release date. package.json and package-lock.json are already at 2.0.0.
3. Merge, then tag the merge commit as version/v2.0.0.
4. The publish job waits on the npm-publish environment for approval.

LATEST_MAJOR is 2, so this publishes under the latest dist-tag: npm i @cincoders/cinnamon installs v2 from then on. Projects already depending on ^1.x are unaffected, since that range never resolves to 2.x.

Before tagging, develop must reach main. v1's deploy.yml carries the matching LATEST_MAJOR: '2' (244d5f6), so its next fix publishes under v1-latest instead of taking latest back. Until that is on main, a 1.x tag would move latest back to v1.

Already in this branch

• LATEST_MAJOR set to 2.
• RoleSwitch is exported from the package root but had no CHANGELOG entry, so it would have been missing from the release notes.

Verified against current v2

• build:lib succeeds and every path in exports exists in dist (., ./server, ./icons, ./cinnamon.css).
• npm pack: 146 files, 164 KB, nothing outside dist/.
• Installed the tarball into an empty project with React 19: all three entry points import in Node, and a TypeScript consumer with skipLibCheck: true compiles.
• The release notes extracted from CHANGELOG.md come to about 20k characters, including the full migration guide, well under GitHub's 125k limit.

Worth knowing before tagging

The four new table dependencies never reach the published code. jspdf, jspdf-autotable, html-to-image and @tanstack/react-table are used only by stories — dist has no reference to any of them, and Table / tableExport are not exported. They are in dependencies, though, so every consumer installs them, jsPDF's critical advisories included. While Table stays unexported, moving them to devDependencies clears the consumer audit without needing jsPDF's major upgrade.

Text types break under React 19 with skipLibCheck: false. Text.d.ts uses the global JSX namespace, which @types/react 19 removed; v2 builds against 18.3. Consumers on the default skipLibCheck: true are unaffected. React.JSX.IntrinsicElements plus an explicit return type would fix it.

dist/auth/hasAccess.test.d.ts ships in the tarball. Harmless, but it is test output.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud