[Rick Brighenti (rbrighenti)]

Finalizes the root CHANGELOG.md for the 2.0.0 release (2026-10-20). Docs only — no code, version.json, or pipeline changes.

Changes

• ## [2.0.0] - Unreleased → ## [2.0.0] - 2026-10-20.
• Reviewed all commits on main since v1.0.0 and added missing user-facing entries:
  • Breaking: OTel message format change ([nodejs]Update message format to align with OTel spec #256) — gen_ai.input/output.messages are now plain JSON arrays; version removed from InputMessages/OutputMessages; A365_MESSAGE_SCHEMA_VERSION replaced by DEFAULT_FINISH_REASON; default finish_reason: "stop". Breaking heading now also lists the OpenAI/LangChain extension packages that already had entries there.
  • Added: ApplyGuardrailScope + guardrail contracts ([nodejs]Add ApplyGuardrailScope for security guardrail tracing #254); responseModel, cache token fields, AgentDetails.agentType (Add model observation telemetry attributes #321); TokenResolver / ObservabilityTokenResolver type exports (Use S2S-only OBS export and app-only hosting token resolvers #290); five new agentic-user lifecycle notification handlers (Add NodeJS SDK support for new lifecycle event typeses #222).
  • Fixed: gateway mcpServers envelope unwrap (fix: unwrap mcpServers envelope from tooling gateway response #255); productContext channel-link fallback (fix: add product context fallback for subchannel #251); tooling axios declared dependency (Use S2S-only OBS export and app-only hosting token resolvers #290). Existing Fixed entries regrouped by package.
  • Security: @modelcontextprotocol/sdk ^1.26.0 (ci: fix failing "Node.js SDK (18)" integration tests #241); fast-uri / ws overrides (Fix fast-uri cve issues #259, Reproduce PR #285 dependency security updates #288).
  • Fix getCallerBaggagePairs: resolve userId across all channels #250 and its revert Revert: Fix getCallerBaggagePairs userId fallback #253 cancel out, so they're not listed.
• Moved the orphaned 1.0.0 ### Deprecated section above the section separator so it belongs to 1.0.0.
• Fixed 0.1.0 date 2025-01-03 → 2025-11-17 (the v0.1.0 tag date; the repo's first commit is 2025-10-26).

Notes / not changed

• 1.0.0 stays 2026-04-30 (the v1.0.0 tag date). npm shows it was published 2026-05-01T04:50Z, so this is a timezone difference, not an error.
• 0.2.0 has no git tag. I left it as is.
• There are no per-package CHANGELOG files under packages/.
• Stale release docs (not changed here): HOW_TO_RELEASE.md describes manual npm publish, but releases now go through the internal OneBranch/ESRP pipelines. It should be updated separately.

[Copilot]

🟡 Changes recommended

The revised 0.1.0 release date does not match the verified tag timestamp.

1 open issue

• Correct v0.1.0 release date to 2025-11-18 · New

What changed in this PR

Finalizes the SDK’s root changelog for the 2.0.0 release without changing runtime code or release pipelines.

Changes:

• Dates 2.0.0 and documents breaking changes, additions, fixes, and security updates.
• Groups fixes by package.
• Repositions the 1.0.0 deprecation entry and revises the historical 0.1.0 date.

File	Description
CHANGELOG.md	Finalizes 2.0.0 release notes and adjusts historical entries.

_{Review effort: Balanced}