Bump io.github.gradle-nexus.publish-plugin from 1.1.0 to 2.0.0

[dependabot]

Bumps io.github.gradle-nexus.publish-plugin from 1.1.0 to 2.0.0.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[Matt (matt-evervault)]

Review summary

Usage in this repo: io.github.gradle-nexus.publish-plugin is applied only in the root build.gradle, configured via the nexusPublishing { repositories { sonatype { ... } } } block, and used exclusively by .github/workflows/release.yml to run ./gradlew publishToSonatype closeAndReleaseSonatypeStagingRepository after a tagged release.

Changelog (1.1.0 → 2.0.0):

• Minimum required Gradle version raised to 6.2+ — no impact, this repo uses Gradle 8.7.
• The per-repository tasks this repo relies on (publishToSonatype, closeAndReleaseSonatypeStagingRepository) are unchanged in 2.0.0. What was renamed is the unrelated singular aggregate task closeAndReleaseStagingRepository → closeAndReleaseStagingRepositories, which this repo doesn't use.
• nexusUrl/snapshotRepositoryUrl/username/password config keys are unchanged.
• No security concerns — it's a build-time-only plugin for publishing to Sonatype, not shipped to SDK consumers.

Found and fixed a real build break: this repo has Gradle dependency locking active on the buildscript classpath, and buildscript-gradle.lockfile still pinned 1.1.0. As opened, this PR would fail every Gradle invocation (including CI) at configuration time with a dependency-locking constraint violation, since the lockfile strictly enforced the old version. I reproduced this locally, then pushed a follow-up commit regenerating the lockfile (gradle help --write-locks) — a 2-line diff bumping the two locked coordinates to 2.0.0, nothing else.

After that fix, gradle tasks configures cleanly and lists publishToSonatype/closeAndReleaseSonatypeStagingRepository with identical names/descriptions to before. I also ran the test suite; there are 15 pre-existing failures (NoClassDefFoundError around sun.misc.Unsafe, BouncyCastle vs. newer JDK) but I confirmed these are present identically on master without this change, so they're unrelated to this bump.

Verdict: safe to merge, now that the lockfile fix is included.

---

Generated by Claude Code