diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4290190..a685a05 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,8 +7,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.0.2] - 2026-05-14
+
 ### Fixed
-- Fixed EBA-DEC-002 false positives on integer-typed metrics that use the `pure` unit. `Fact.metric` stores the metric QName in Clark notation (`{namespace}localname`), but `_build_metric_type_map()` was keyed on prefix notation (`eba_met:qXYZ`) taken from the module, so every lookup missed and the validator fell back to unit-based inference, flagging every `pure`-unit integer fact as a percentage. Added a `Fact.metric_qname` property that exposes the prefix-normalised QName and updated the decimals rules (EBA-DEC-001/002/003) to use it. Integer classification is now fully taxonomy-driven — the unit-based fallback in `check_integer_decimals_xml` has been removed. No backward-incompatible changes: `Fact.metric` is unchanged.
+- Fixed EBA-DEC-002 false positives on integer-typed metrics that use the `pure` unit. `Fact.metric` stores the metric QName in Clark notation (`{namespace}localname`), but `_build_metric_type_map()` was keyed on prefix notation (`eba_met:qXYZ`) taken from the module, so every lookup missed and the validator fell back to unit-based inference, flagging every `pure`-unit integer fact (e.g. `qAZH`, `qCCG`, `qDGB`) as a percentage. Added a `Fact.metric_qname` property that exposes the prefix-normalised QName and updated the decimals rules (EBA-DEC-001/002/003) to use it. Integer classification is now fully taxonomy-driven — the unit-based fallback in `check_integer_decimals_xml` has been removed. No backward-incompatible changes: `Fact.metric` is unchanged (#111).
+
+### Security
+- Updated `urllib3` and widened the `sphinx` constraint (`^7.4.7` → `>=7.4.7,<8.2`) to pull in patched releases addressing reported vulnerabilities (#112).
 
 ## [2.0.1] - 2026-03-25
 
@@ -174,7 +179,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Added
 - Initial pre-release version
 
-[Unreleased]: https://github.com/Meaningful-Data/xbridge/compare/v2.0.1...HEAD
+[Unreleased]: https://github.com/Meaningful-Data/xbridge/compare/v2.0.2...HEAD
+[2.0.2]: https://github.com/Meaningful-Data/xbridge/compare/v2.0.1...v2.0.2
 [2.0.1]: https://github.com/Meaningful-Data/xbridge/compare/v2.0.0...v2.0.1
 [2.0.0]: https://github.com/Meaningful-Data/xbridge/compare/v1.5.2...v2.0.0
 [1.5.2]: https://github.com/Meaningful-Data/xbridge/compare/v1.5.1...v1.5.2
diff --git a/pyproject.toml b/pyproject.toml
index 6c50d0d..ec0064d 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "eba-xbridge"
-version = "2.0.1"
+version = "2.0.2"
 description = "XBRL-XML to XBRL-CSV converter for EBA Taxonomy (version 4.2)"
 license = 'Apache 2.0'
 readme = "README.rst"
diff --git a/src/xbridge/__init__.py b/src/xbridge/__init__.py
index d69d36d..b4a3f8f 100644
--- a/src/xbridge/__init__.py
+++ b/src/xbridge/__init__.py
@@ -2,4 +2,4 @@
 Init file for eba-xbridge library
 """
 
-__version__ = "2.0.1"
+__version__ = "2.0.2"
diff --git a/tests/test_eba_decimals.py b/tests/test_eba_decimals.py
index 0cafc65..1b00851 100644
--- a/tests/test_eba_decimals.py
+++ b/tests/test_eba_decimals.py
@@ -585,9 +585,7 @@ def test_missing_params_no_findings(self) -> None:
 
 # Pillar 3 CODIS module has examples of all four metric types, and the
 # fixture is small enough to load quickly.
-_PILLAR3_CODIS_SCHEMA = (
-    "http://www.eba.europa.eu/eu/fr/xbrl/crr/fws/pillar3/4.1/mod/codis.xsd"
-)
+_PILLAR3_CODIS_SCHEMA = "http://www.eba.europa.eu/eu/fr/xbrl/crr/fws/pillar3/4.1/mod/codis.xsd"
 
 # Metrics picked from src/xbridge/modules/codis_pillar3_4.1.json
 _CODIS_MONETARY_METRIC = "qHNJ"
@@ -611,12 +609,9 @@ def _xbrl_with_module(body: str, prefix: str = "eba_met") -> bytes:
         'xmlns:find="http://www.eurofiling.info/xbrl/ext/filing-indicators" '
         f'xmlns:{prefix}="http://www.eba.europa.eu/xbrl/crr/dict/met"'
     )
-    schema_ref = (
-        f'<link:schemaRef xlink:type="simple" xlink:href="{_PILLAR3_CODIS_SCHEMA}"/>'
-    )
+    schema_ref = f'<link:schemaRef xlink:type="simple" xlink:href="{_PILLAR3_CODIS_SCHEMA}"/>'
     return (
-        f'<?xml version="1.0" encoding="utf-8"?>'
-        f'<xbrli:xbrl {ns}>{schema_ref}{body}</xbrli:xbrl>'
+        f'<?xml version="1.0" encoding="utf-8"?><xbrli:xbrl {ns}>{schema_ref}{body}</xbrli:xbrl>'
     ).encode()
 
 
@@ -734,9 +729,7 @@ def _parse(self, xml_bytes: bytes):
 
     def test_metric_raw_is_clark_notation(self) -> None:
         """Backwards compatibility: ``Fact.metric`` stays in Clark notation."""
-        xml = _xbrl(
-            _unit("u1", "xbrli:pure") + _context() + _fact(metric="eba_met:mi1")
-        )
+        xml = _xbrl(_unit("u1", "xbrli:pure") + _context() + _fact(metric="eba_met:mi1"))
         facts = self._parse(xml)
         assert len(facts) == 1
         assert facts[0].metric is not None
@@ -745,17 +738,13 @@ def test_metric_raw_is_clark_notation(self) -> None:
 
     def test_metric_qname_is_prefix_form(self) -> None:
         """``Fact.metric_qname`` returns the EBA prefix form."""
-        xml = _xbrl(
-            _unit("u1", "xbrli:pure") + _context() + _fact(metric="eba_met:mi1")
-        )
+        xml = _xbrl(_unit("u1", "xbrli:pure") + _context() + _fact(metric="eba_met:mi1"))
         facts = self._parse(xml)
         assert facts[0].metric_qname == "eba_met:mi1"
 
     def test_metric_qname_cached(self) -> None:
         """Repeated access uses the cache, not re-parses the nsmap each time."""
-        xml = _xbrl(
-            _unit("u1", "xbrli:pure") + _context() + _fact(metric="eba_met:mi1")
-        )
+        xml = _xbrl(_unit("u1", "xbrli:pure") + _context() + _fact(metric="eba_met:mi1"))
         facts = self._parse(xml)
         first = facts[0].metric_qname
         second = facts[0].metric_qname