Astn · Sep 28, 2026 · Sep 28, 2026 · Sep 28, 2026
diff --git a/.github/scripts/api_surface/ApiSurface.csproj b/.github/scripts/api_surface/ApiSurface.csproj
@@ -4,7 +4,7 @@
     <TargetFramework>net10.0</TargetFramework>
     <Nullable>disable</Nullable>
     <ImplicitUsings>enable</ImplicitUsings>
-    <JsonRpcVersion Condition="'$(JsonRpcVersion)' == ''">2.0.0</JsonRpcVersion>
+    <JsonRpcVersion Condition="'$(JsonRpcVersion)' == ''">2.0.1</JsonRpcVersion>
     <NoWarn>$(NoWarn);CS0618;JSONRPC0001;JSONRPC0002;JSONRPC0003</NoWarn>
   </PropertyGroup>
   <ItemGroup>

diff --git a/.github/scripts/check_package_links.py b/.github/scripts/check_package_links.py
@@ -8,7 +8,7 @@
 Handler.UnRegisterFunction and Config.SetBeforeProcessHandler as the published assembly carries it, formats each
 UrlFormat with its DiagnosticId, requests the page and asserts the anchor id is in the HTML.
 
-Usage: python3 .github/scripts/check_package_links.py 2.0.0 [--keep]   (exit 1 on any failure)
+Usage: python3 .github/scripts/check_package_links.py 2.0.1 [--keep]   (exit 1 on any failure)
 
 The check runs against nuget.org, so it is a release step (after the publish workflow has run and the flat
 container lists the version, which lags the push by a few minutes), not a pull-request gate.

diff --git a/AustinHarris.JsonRpc.AspNetCore/AustinHarris.JsonRpc.AspNetCore.csproj b/AustinHarris.JsonRpc.AspNetCore/AustinHarris.JsonRpc.AspNetCore.csproj
@@ -5,8 +5,8 @@
         <Authors>Austin Harris</Authors>
         <Product>Json-Rpc.Net ASP.NET Core host</Product>
         <Description>ASP.NET Core hosting for AustinHarris.JsonRpc. Adds HTTP endpoints and raw Kestrel connections over TCP, Unix sockets and named pipes, with dependency injection.</Description>
-        <VersionPrefix>2.0.0</VersionPrefix>
-        <PackageReleaseNotes>2.0.0, released with the core package. What is new: https://astn.github.io/JSON-RPC.NET/changelog.html. Upgrading from 1.x: https://astn.github.io/JSON-RPC.NET/upgrading.html</PackageReleaseNotes>
+        <VersionPrefix>2.0.1</VersionPrefix>
+        <PackageReleaseNotes>2.0.1, released with the core package. What is new: https://astn.github.io/JSON-RPC.NET/changelog.html. Upgrading from 1.x: https://astn.github.io/JSON-RPC.NET/upgrading.html</PackageReleaseNotes>
         <Copyright>Austin Harris</Copyright>
         <PackageProjectUrl>https://astn.github.io/JSON-RPC.NET/aspnetcore.html</PackageProjectUrl>
         <RepositoryUrl>https://github.com/Astn/JSON-RPC.NET</RepositoryUrl>

diff --git a/AustinHarris.JsonRpc.Newtonsoft/AustinHarris.JsonRpc.Newtonsoft.csproj b/AustinHarris.JsonRpc.Newtonsoft/AustinHarris.JsonRpc.Newtonsoft.csproj
@@ -5,8 +5,8 @@
         <Authors>Austin Harris</Authors>
         <Product>Json-Rpc.Net Json.NET serializer</Product>
         <Description>Json.NET serializer for AustinHarris.JsonRpc. Uses JsonSerializerSettings for converters, contract resolvers and lenient JSON input.</Description>
-        <VersionPrefix>2.0.0</VersionPrefix>
-        <PackageReleaseNotes>2.0.0, released with the core package. What is new: https://astn.github.io/JSON-RPC.NET/changelog.html. Upgrading from 1.x: https://astn.github.io/JSON-RPC.NET/upgrading.html</PackageReleaseNotes>
+        <VersionPrefix>2.0.1</VersionPrefix>
+        <PackageReleaseNotes>2.0.1, released with the core package. What is new: https://astn.github.io/JSON-RPC.NET/changelog.html. Upgrading from 1.x: https://astn.github.io/JSON-RPC.NET/upgrading.html</PackageReleaseNotes>
         <Copyright>Austin Harris</Copyright>
         <PackageProjectUrl>https://astn.github.io/JSON-RPC.NET/newtonsoft.html</PackageProjectUrl>
         <RepositoryUrl>https://github.com/Astn/JSON-RPC.NET</RepositoryUrl>

diff --git a/AustinHarris.JsonRpc.SystemTextJson/AustinHarris.JsonRpc.SystemTextJson.csproj b/AustinHarris.JsonRpc.SystemTextJson/AustinHarris.JsonRpc.SystemTextJson.csproj
@@ -5,8 +5,8 @@
         <Authors>Austin Harris</Authors>
         <Product>Json-Rpc.Net System.Text.Json serializer</Product>
         <Description>System.Text.Json serializer for AustinHarris.JsonRpc. Reads UTF-8 parameters and writes results directly to the response buffer, configured with JsonSerializerOptions.</Description>
-        <VersionPrefix>2.0.0</VersionPrefix>
-        <PackageReleaseNotes>2.0.0, released with the core package. What is new: https://astn.github.io/JSON-RPC.NET/changelog.html. Upgrading from 1.x: https://astn.github.io/JSON-RPC.NET/upgrading.html</PackageReleaseNotes>
+        <VersionPrefix>2.0.1</VersionPrefix>
+        <PackageReleaseNotes>2.0.1, released with the core package. What is new: https://astn.github.io/JSON-RPC.NET/changelog.html. Upgrading from 1.x: https://astn.github.io/JSON-RPC.NET/upgrading.html</PackageReleaseNotes>
         <Copyright>Austin Harris</Copyright>
         <PackageProjectUrl>https://astn.github.io/JSON-RPC.NET/systemtextjson.html</PackageProjectUrl>
         <RepositoryUrl>https://github.com/Astn/JSON-RPC.NET</RepositoryUrl>

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -8,6 +8,12 @@ the package pages on NuGet link here.
 Versions follow [Semantic Versioning](https://semver.org/) for the public API and the documented wire
 behaviour: a breaking change to either means a new major version.
 
+## 2.0.1 (2026-09-28)
+
+### Fixed
+
+- The built-in serializer's tokenizer is a port of [jsmn](https://github.com/zserge/jsmn) (MIT, copyright Serge A. Zaitsev), whose copyright and permission notice was missing from the tree and the package. `THIRD-PARTY-NOTICES.txt` at the repository root now carries it, ships in the `AustinHarris.JsonRpc` package, and `JsmnTokenizer.cs` opens with the notice; the READMEs and the reference name the origin.
+
 ## 2.0.0 (2026-09-28)
 
 ### Added

diff --git a/Json-Rpc/AustinHarris.JsonRpc.csproj b/Json-Rpc/AustinHarris.JsonRpc.csproj
@@ -5,15 +5,15 @@
         <Authors>Austin Harris</Authors>
         <Product>Json-Rpc.Net Core</Product>
         <Description>High-throughput JSON-RPC 2.0 server library for .NET Standard 2.0 through .NET 10: UTF-8 bytes in and out, no JSON library dependency, with Json.NET, System.Text.Json and ASP.NET Core hosting as companion packages.</Description>
-        <VersionPrefix>2.0.0</VersionPrefix>
+        <VersionPrefix>2.0.1</VersionPrefix>
         <Copyright>Austin Harris</Copyright>
         <PackageProjectUrl>https://astn.github.io/JSON-RPC.NET/</PackageProjectUrl>
         <RepositoryUrl>https://github.com/Astn/JSON-RPC.NET</RepositoryUrl>
         <RepositoryType>git</RepositoryType>
         <PackageLicenseExpression>MIT</PackageLicenseExpression>
         <PackageReadmeFile>README.md</PackageReadmeFile>
         <PackageTags>json-rpc;jsonrpc;json;rpc;server;netstandard;netstandard2.0;netstandard2.1;net8.0;net10.0;kestrel;pipelines;system.text.json;json.net;fast</PackageTags>
-        <PackageReleaseNotes>2.0.0: the request pipeline is built around UTF-8 bytes (ReadOnlySequence, ReadOnlyMemory or ReadOnlySpan in, IBufferWriter out), the JSON serializer is pluggable with the built-in serializer as the default and Json.NET and System.Text.Json as packages, and Task and ValueTask methods are supported again through ProcessAsync with cooperative cancellation. Document and batch limits are on by default (JsonRpcLimits), reserved method names are refused at registration, unknown named parameters are rejected, an error handler receives the exception the method threw, and the four assemblies are strong-named with one key that stays fixed from here on. Six times the throughput of 1.2.3 through the 1.x string API and twenty-four times through the byte entry points, measured on a 32-core Hugging Face Jobs host (see the README). InProcessClient is removed; three legacy members are obsolete at warning level with diagnostic ids JSONRPC0001 to JSONRPC0003. What is new: https://astn.github.io/JSON-RPC.NET/changelog.html. Upgrading from 1.x: https://astn.github.io/JSON-RPC.NET/upgrading.html</PackageReleaseNotes>
+        <PackageReleaseNotes>2.0.1: adds the jsmn copyright and permission notice (THIRD-PARTY-NOTICES.txt) to the package; no code change. 2.0.0: the request pipeline is built around UTF-8 bytes (ReadOnlySequence, ReadOnlyMemory or ReadOnlySpan in, IBufferWriter out), the JSON serializer is pluggable with the built-in serializer as the default and Json.NET and System.Text.Json as packages, and Task and ValueTask methods are supported again through ProcessAsync with cooperative cancellation. Document and batch limits are on by default (JsonRpcLimits), reserved method names are refused at registration, unknown named parameters are rejected, an error handler receives the exception the method threw, and the four assemblies are strong-named with one key that stays fixed from here on. Six times the throughput of 1.2.3 through the 1.x string API and twenty-four times through the byte entry points, measured on a 32-core Hugging Face Jobs host (see the README). InProcessClient is removed; three legacy members are obsolete at warning level with diagnostic ids JSONRPC0001 to JSONRPC0003. What is new: https://astn.github.io/JSON-RPC.NET/changelog.html. Upgrading from 1.x: https://astn.github.io/JSON-RPC.NET/upgrading.html</PackageReleaseNotes>
         <TargetFrameworks>netstandard2.0;netstandard2.1;net8.0;net10.0</TargetFrameworks>
         <LangVersion>latest</LangVersion>
         <GenerateDocumentationFile>true</GenerateDocumentationFile>
@@ -36,6 +36,7 @@
 
     <ItemGroup>
         <None Include="README.md" Pack="true" PackagePath="\" />
+        <None Include="..\THIRD-PARTY-NOTICES.txt" Pack="true" PackagePath="\" />
         <None Include="..\icon.png" Pack="true" PackagePath="\" />
         <InternalsVisibleTo Include="AustinHarris.JsonRpcTestN" Key="$(JsonRpcPublicKey)" />
         <InternalsVisibleTo Include="AustinHarris.JsonRpc.Micro" Key="$(JsonRpcPublicKey)" />

diff --git a/Json-Rpc/Jsmn/JsmnTokenizer.cs b/Json-Rpc/Jsmn/JsmnTokenizer.cs
@@ -1,3 +1,25 @@
+// Derived from jsmn (https://github.com/zserge/jsmn), a C JSON tokenizer.
+// Copyright (c) 2010 Serge A. Zaitsev
+//
+// Permission is hereby granted, free of charge, to any person obtaining a copy
+// of this software and associated documentation files (the "Software"), to deal
+// in the Software without restriction, including without limitation the rights
+// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+// copies of the Software, and to permit persons to whom the Software is
+// furnished to do so, subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in
+// all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+// THE SOFTWARE.
+// The full notice is in THIRD-PARTY-NOTICES.txt at the repository root and in the package.
+
 using System;
 using System.Buffers;
 

diff --git a/Json-Rpc/README.md b/Json-Rpc/README.md
@@ -8,6 +8,7 @@ You supply the transport.
 The core has no JSON library dependency.
 Its built-in serializer works on its own; companion packages add Json.NET,
 `System.Text.Json` or ASP.NET Core hosting.
+The built-in tokenizer is a port of [jsmn](https://github.com/zserge/jsmn) by Serge A. Zaitsev (MIT); the notice ships in the package as `THIRD-PARTY-NOTICES.txt`.
 
 Targets `netstandard2.0`, `netstandard2.1`, `net8.0` and `net10.0`.
 This is a server library, with no client proxies or server-to-client calls.
@@ -30,7 +31,7 @@ The `#:sdk` and `#:package` directives select the web SDK and package.
 
 ```csharp
 #:sdk Microsoft.NET.Sdk.Web
-#:package AustinHarris.JsonRpc.AspNetCore@2.0.0
+#:package AustinHarris.JsonRpc.AspNetCore@2.0.1
 
 using AustinHarris.JsonRpc;
 using AustinHarris.JsonRpc.AspNetCore;
@@ -192,3 +193,4 @@ Most service methods can stay as they are. Review these changes before switching
 - [Upgrading from 1.x](https://astn.github.io/JSON-RPC.NET/upgrading.html)
 - [Source repository](https://github.com/Astn/JSON-RPC.NET)
 - [MIT license](https://github.com/Astn/JSON-RPC.NET/blob/master/LICENSE)
+- [Third-party notices](https://github.com/Astn/JSON-RPC.NET/blob/master/THIRD-PARTY-NOTICES.txt)
diff --git a/README.md b/README.md
@@ -33,7 +33,7 @@ Here is a server you can put in one file. Save it as `server.cs`; the `#:` direc
 
 ```csharp
 #:sdk Microsoft.NET.Sdk.Web
-#:package AustinHarris.JsonRpc.AspNetCore@2.0.0
+#:package AustinHarris.JsonRpc.AspNetCore@2.0.1
 
 using AustinHarris.JsonRpc;
 using AustinHarris.JsonRpc.AspNetCore;
@@ -414,4 +414,4 @@ The tables and charts are generated from [benchmarks/charts/benchmarks.json](ben
 
 ## License
 
-MIT. See [LICENSE](LICENSE).
+MIT. See [LICENSE](LICENSE). The built-in serializer's tokenizer is a C# port of [jsmn](https://github.com/zserge/jsmn), copyright Serge A. Zaitsev, under the MIT license; its notice is in [THIRD-PARTY-NOTICES.txt](THIRD-PARTY-NOTICES.txt), which also ships in the `AustinHarris.JsonRpc` package.
diff --git a/THIRD-PARTY-NOTICES.txt b/THIRD-PARTY-NOTICES.txt
@@ -0,0 +1,36 @@
+Third-party notices for JSON-RPC.NET
+
+JSON-RPC.NET is licensed under the MIT license (see LICENSE). The AustinHarris.JsonRpc
+package and the source tree include code derived from the following project, which is
+distributed under its own license and copyright notice reproduced below.
+
+------------------------------------------------------------------------------
+jsmn
+------------------------------------------------------------------------------
+
+Json-Rpc/Jsmn/JsmnTokenizer.cs is a C# port of the jsmn JSON tokenizer by Serge A.
+Zaitsev (ported from https://github.com/zserge/jsmn at commit 25647e6, 2021-10-14),
+adapted to ReadOnlySpan<byte> with grammar validation added. It is used by the built-in
+serializer (AustinHarris.JsonRpc.Jsmn.JsmnSerializer) and ships in every build of the
+AustinHarris.JsonRpc assembly.
+
+jsmn (https://github.com/zserge/jsmn)
+Copyright (c) 2010 Serge A. Zaitsev
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.