docs: add v2.0.0 changelog for breaking changes

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: sionsmith

CHANGELOG.md

@@ -5,6 +5,24 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.0.0] - 2026-02-24
+
+### Added
+- `workos_organization_role` resource - Manage organization authorization roles
+- `workos_organization_role` data source - Look up organization roles by slug or ID
+
+### Removed
+- **BREAKING:** `workos_connection` resource - WorkOS API does not support creating/updating connections via API; use the Dashboard instead. The read-only data source is still available.
+- **BREAKING:** `workos_directory` resource - WorkOS API does not support creating/updating directories via API; use the Dashboard instead. The read-only data source is still available.
+- **BREAKING:** `workos_webhook` resource - WorkOS has no public webhook management API; use the Dashboard instead.
+- **BREAKING:** `allow_profiles_outside_organization` attribute on `workos_organization` resource and data source - WorkOS API no longer accepts this parameter.
+
+### Fixed
+- `workos_user` resource: `email_verified` is now always sent on updates, preventing drift when email changes reset verification status
+- `workos_organization_membership` resource: `role_slug` is preserved from plan/state when the API omits it from responses
+- `workos_user` data source tests: replaced hardcoded placeholder IDs with dynamically created resources
+- `workos_organization_role` resource: slug is now prefixed with `org-` per WorkOS API requirement
+
 ## [1.0.0] - 2026-02-01
 
 ### Added
@@ -19,25 +37,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - `workos_organization` - Manage WorkOS organizations
   - Full CRUD operations
   - Domain management
-  - `allow_profiles_outside_organization` setting
-  - Import support
-
-- `workos_connection` - Manage SSO connections
-  - Support for SAML, OAuth, and OIDC connection types
-  - Okta, Azure AD, Google, and generic providers
-  - Connection state management
-  - Import support
-
-- `workos_directory` - Manage Directory Sync directories
-  - Support for Okta SCIM, Azure SCIM, and generic SCIM
-  - Bearer token and endpoint configuration
-  - Directory state management
-  - Import support
-
-- `workos_webhook` - Manage webhook endpoints
-  - URL and secret configuration
-  - Event type subscription (35+ event types)
-  - Enable/disable toggle
   - Import support
 
 - `workos_user` - Manage AuthKit users
@@ -53,8 +52,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 #### Data Sources
 - `workos_organization` - Look up organizations by ID or domain
-- `workos_connection` - Look up SSO connections by ID or organization/type
-- `workos_directory` - Look up directories by ID or organization
+- `workos_connection` - Look up SSO connections by ID or organization/type (read-only)
+- `workos_directory` - Look up directories by ID or organization (read-only)
 - `workos_directory_user` - Look up directory-synced users by ID or email
 - `workos_directory_group` - Look up directory-synced groups by ID or name
 - `workos_user` - Look up AuthKit users by ID or email
@@ -66,26 +65,4 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Security
 - API keys marked as sensitive and never logged
-- Webhook secrets marked as sensitive
 - User passwords marked as sensitive (write-only)
-- Bearer tokens marked as sensitive
-
-## [Unreleased]
-
-### Added
-- N/A
-
-### Changed
-- N/A
-
-### Deprecated
-- N/A
-
-### Removed
-- N/A
-
-### Fixed
-- N/A
-
-### Security
-- N/A