After updating to version 2.0.0, the performance of validating an admittedly complex schema and large JSON file was significantly reduced and in some cases ran out of memory with 1.5GB allocated.

The schema and JSON file which reproduce the problem are in this zip file:

sbom-build.spdx.zip

In version 1.5.9 the json file validates successfully against the schema with no errors in approximately 60 seconds of processing in my development environment.

The code which implements the validation is here: https://github.com/spdx/tools-java/blob/77a41decbe94825424267827180ba738f8cb53cf/src/main/java/org/spdx/tools/Verify.java#L169

I did some light manual sampling to see where the problem might be and most of the time seems to be spent in the startsWith method processing annotation in the Schema.validate(...) method.

Here is a typical stack trace:

stack-trace.txt