[drkjc]

Changes

• Bump the version to 1.0.1
• CHANGELOG.md: add the 1.0.1 entry

[Copilot]

🟢 Approval recommended

The version fields are consistent, the release notes match the release scope, and no blocking issues remain.

No open issues 🎉

What changed in this PR

Prepares the Composer Server SDK’s 1.0.1 release by synchronizing version metadata and adding release notes.

Changes:

• Updates the SDK version, package version, and lockfile version fields to 1.0.1.
• Adds a changelog entry documenting the README link and release SBOM naming corrections.

File	Description
src/​version.ts	Updates the SDK version constant to 1.0.1.
package.json	Sets the package version to 1.0.1.
package-lock.json	Synchronizes both root version fields with the package version.
CHANGELOG.md	Adds the dated 1.0.1 release notes.

_{Review effort: Balanced}

[Samy-O7]

Approving at 9f936bb. Checked:

• The diff only bumps the version to 1.0.1 (package.json, both root fields in package-lock.json, src/version.ts) and adds the 1.0.1 CHANGELOG section.
• With this merged into main, the publish workflow's release check passes for v1.0.1 (7 lines of release notes) and fails for a wrong tag, a commit that isn't on main, and main without this PR.
• Ran the build job's steps on the merged tree with npm 11.19.0: 145 tests pass, the runtime audit finds 0 vulnerabilities, and the SBOM's root is @spreedly/composer-sdk-server@1.0.1 with the right purl and no components (no runtime dependencies). It validates against the CycloneDX 1.5 schema.
• Compared the packed tarball with the published 1.0.0 (whose integrity matches the registry): the same 27 files, and only CHANGELOG.md, the README's two Client SDK links, package.json's version and the VERSION constant in dist change. Since v1.0.0, main has only changed publish.yml and the README, so "No changes to the SDK's code" holds.
• gitleaks 8.30.1 finds no leaks in the packed files.