Fix: Spring pins and hardcoded test values (Snyk) - v2.8.3 by reeshika-h · Pull Request #315 · contentstack/contentstack-java

reeshika-h · 2026-10-26T10:55:42Z

Summary

Resolves DX-10363 to DX-10367 (Spring Framework vulnerabilities) and DX-22028, DX-22029 (hardcoded credentials in tests), v2.8.3.

dependencyManagement pins for spring-core, spring-beans, spring-web 6.2.19 → 7.0.9 (the version contentstack-utils already targets). These are build-time pins and do not propagate to consumers.
TestEntryModel: the two hardcoded publisher values are generated UUIDs (the assert uses the same variable); removed the deepcode ignore comments.

Verification

snyk test: 5 → 0; snyk code test: 2 → 0.
Tests: 1382/1382 pass (same as baseline).

🤖 Generated with Claude Code

…tion

…xecution

…revent crashes

Fix/dx 2373 skips single item

- Introduced SanityReport class to generate test summaries and send reports to Slack. - Updated logging in CSHttpConnection to use logger instead of printStackTrace. - Modified error handling in Entry class to check for empty error messages. - Updated dependency versions in pom.xml and added new dependencies. - Added test configuration properties to .gitignore. - Created send-report.sh script for running tests and sending reports.

…remove disabled test for asset URL update

…ests in TestLivePreview and TestStack

Fixed testcase assertions to be env agnostic

Update version to 2.1.1 and updated changelog

Development

back merge

Update branch restrictions in PR workflow and add Talisman configuration

DX | 19-05-2025 | Release

…nv for environment variables

fix: update version to 2.7.2 and add Snyk fixes to CHANGELOG

back merge

…anch headers Addresses Copilot review on PR #295: - Guard variants(String) and variants(String[]) against null input - Treat whitespace-only variant/branch as blank via trim().isEmpty() - Join multi-variant header with "," for consistency with other SDK headers Blank input intentionally skips (does not remove) the header: headers are a shared Stack-level map, so remove() would clear the header for sibling Entry/Query objects and the Stack-level default. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…-support Add variant and branch support in Entry and Query APIs

DX | 20-07-2026 | Release

chore: back-merge master into development

The secret-removal history rewrite on master left development on the old, pre-rewrite commit SHAs. Every development-only commit is a content-identical copy of a master commit (same tree and message, only the GPG signature differs), so this merge records development as a parent while keeping master's tree unchanged. That gives the two branches a shared merge-base again. Refs DX-20927 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

DX-20927 | Back-merge master into development (reconcile rewritten history)

Build-time Spring pins 6.2.19 -> 7.0.9; replace hardcoded publisher values in tests with generated UUIDs; v2.8.3. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

snyk-io · 2026-10-26T10:55:56Z

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

github-actions · 2026-10-26T10:56:42Z

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Threshold	Result
🔴 Critical Severity	10	✅ Passed
🟠 High Severity	25	✅ Passed
🟡 Medium Severity	500	✅ Passed
🔵 Low Severity	1000	✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity	SLA Threshold (with/no fixes)	Status
🔴 Critical	15 / 30 days	✅ Passed
🟠 High	30 / 120 days	✅ Passed
🟡 Medium	90 / 365 days	✅ Passed
🔵 Low	180 / 365 days	✅ Passed

✅ BUILD PASSED - All security checks passed

The base branch was changed.

github-actions · 2026-11-02T05:59:03Z

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Threshold	Result
🔴 Critical Severity	10	✅ Passed
🟠 High Severity	25	✅ Passed
🟡 Medium Severity	500	✅ Passed
🔵 Low Severity	1000	✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity	SLA Threshold (with/no fixes)	Status
🔴 Critical	15 / 30 days	✅ Passed
🟠 High	30 / 120 days	✅ Passed
🟡 Medium	90 / 365 days	✅ Passed
🔵 Low	180 / 365 days	✅ Passed

✅ BUILD PASSED - All security checks passed

The job posts a coverage comment on the PR and the step fails with "Resource not accessible by integration" because the token is read-only. Declare the permissions the job needs, as the js-core and typescript coverage workflows already do. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

github-actions · 2026-11-02T06:31:38Z

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Threshold	Result
🔴 Critical Severity	10	✅ Passed
🟠 High Severity	25	✅ Passed
🟡 Medium Severity	500	✅ Passed
🔵 Low Severity	1000	✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity	SLA Threshold (with/no fixes)	Status
🔴 Critical	15 / 30 days	✅ Passed
🟠 High	30 / 120 days	✅ Passed
🟡 Medium	90 / 365 days	✅ Passed
🔵 Low	180 / 365 days	✅ Passed

✅ BUILD PASSED - All security checks passed

github-actions · 2026-11-02T06:32:00Z

Coverage Summary

📘 Instruction Coverage: 93%
🌿 Branch Coverage: 80%

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

github-actions · 2026-11-02T10:34:29Z

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Threshold	Result
🔴 Critical Severity	10	✅ Passed
🟠 High Severity	25	✅ Passed
🟡 Medium Severity	500	✅ Passed
🔵 Low Severity	1000	✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity	SLA Threshold (with/no fixes)	Status
🔴 Critical	15 / 30 days	✅ Passed
🟠 High	30 / 120 days	✅ Passed
🟡 Medium	90 / 365 days	✅ Passed
🔵 Low	180 / 365 days	✅ Passed

✅ BUILD PASSED - All security checks passed

Aravind-Kumar-cstk and others added 30 commits April 16, 2025 10:37

Delete jira.yml

2851b44

Delete sast-scan.yml

bd10379

codeql-analysis.yml

46eaff1

Updated codeowners

12441f2

Refactor assertions in tests to use assertNotNull for improved valida…

236a058

…tion

Uncomment skipTests configuration in maven-surefire-plugin for test e…

4ff32c9

…xecution

policy-scan.yml

4d3e0cb

Merge branch 'master' into fix/dx-2373-skips-single-item

cb5ce37

Fix item processing in SyncStack to handle JSONObject correctly and p…

8beaa58

…revent crashes

Add test for handling single JSONObject under "items" in SyncStack

9d39ac5

Merge pull request #185 from contentstack/fix/dx-2373-skips-single-item

c62265f

Fix/dx 2373 skips single item

Enhance tests by adding assertions for entry parameters and headers; …

10f0bd2

…remove disabled test for asset URL update

Add SLF4J dependency and update JavaDoc links; comment out disabled t…

6567ff4

…ests in TestLivePreview and TestStack

Update assertions in tests to reflect expected header and entry counts

1435a5d

policy-scan.yml

3459364

issues-jira.yml

ff6447d

secrets-scan.yml

dc9e4be

Updated codeowners

244226b

talismanrc file updated

361b81f

Remove header size assertions from entry and query tests

9448814

Merge pull request #184 from contentstack/fix/DX-2420-pipeline-friendly

82e75af

Fixed testcase assertions to be env agnostic

Update version to 2.1.1 and updated changelog

527f953

Merge pull request #187 from contentstack/version-bump

7eb50ed

Update version to 2.1.1 and updated changelog

Merge pull request #186 from contentstack/development

0299754

Development

Merge pull request #189 from contentstack/master

11199c8

back merge

Update branch restrictions in PR workflow and add Talisman configuration

02a355d

Merge pull request #190 from contentstack/fix/talismanrc-update

5d12b4a

Update branch restrictions in PR workflow and add Talisman configuration

Merge pull request #188 from contentstack/staging

97b6a8e

DX | 19-05-2025 | Release

Add java-dotenv dependency and refactor Credentials class to use dote…

c362498

…nv for environment variables

reeshika-h and others added 11 commits July 3, 2026 14:52

Merge pull request #304 from contentstack/fix/snyk-issues

84a87ac

fix: update version to 2.7.2 and add Snyk fixes to CHANGELOG

Merge pull request #308 from contentstack/master

7038404

back merge

Merge branch 'development' into feat/DX-7325-variant-branch-support

e1c6b73

version bump

0aa9acf

Merge pull request #295 from contentstack/feat/DX-7325-variant-branch…

dbfac4c

…-support Add variant and branch support in Entry and Query APIs

Merge pull request #309 from contentstack/development

18185b6

DX | 20-07-2026 | Release

Merge pull request #310 from contentstack/master

2ff8049

chore: back-merge master into development

Merge pull request #314 from contentstack/back-merge/DX-20927

864741f

DX-20927 | Back-merge master into development (reconcile rewritten history)

Fix: bump Spring pins to 7.0.9; use generated test values

eaef38a

Build-time Spring pins 6.2.19 -> 7.0.9; replace hardcoded publisher values in tests with generated UUIDs; v2.8.3. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

reeshika-h requested a review from a team as a code owner October 26, 2026 10:55

cs-raj previously approved these changes Oct 30, 2026

View reviewed changes

reeshika-h changed the base branch from development to master November 2, 2026 05:57

Merge branch 'master' into fix/snyk-java-deps-and-credentials

6f2e447

reeshika-h requested a review from a team as a code owner November 2, 2026 06:30

cs-raj previously approved these changes Nov 2, 2026

View reviewed changes

ci: drop unneeded checks: write permission from coverage job

f26c630

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

reeshika-h dismissed cs-raj’s stale review via f26c630 November 2, 2026 10:33

dhaval-jain-cstk approved these changes Nov 2, 2026

View reviewed changes

cs-raj approved these changes Nov 2, 2026

View reviewed changes

reeshika-h merged commit cebaeb4 into master Nov 2, 2026
11 checks passed

Navigation Menu

Repository navigation

Fix: Spring pins and hardcoded test values (Snyk) - v2.8.3 - #315

Fix: Spring pins and hardcoded test values (Snyk) - v2.8.3#315
reeshika-h merged 313 commits into
masterfrom
fix/snyk-java-deps-and-credentials

reeshika-h commented Oct 26, 2026

Uh oh!

snyk-io Bot commented Oct 26, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 26, 2026

Uh oh!

github-actions Bot commented Nov 2, 2026

Uh oh!

github-actions Bot commented Nov 2, 2026

Uh oh!

github-actions Bot commented Nov 2, 2026

Uh oh!

github-actions Bot commented Nov 2, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

9 participants

Conversation

reeshika-h commented Oct 26, 2026

Summary

Verification

Uh oh!

snyk-io Bot commented Oct 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Snyk checks have passed. No issues have been found so far.

Uh oh!

github-actions Bot commented Oct 26, 2026

🔒 Security Scan Results

⏱️ SLA Breach Summary

Uh oh!

github-actions Bot commented Nov 2, 2026

🔒 Security Scan Results

⏱️ SLA Breach Summary

Uh oh!

github-actions Bot commented Nov 2, 2026

🔒 Security Scan Results

⏱️ SLA Breach Summary

Uh oh!

github-actions Bot commented Nov 2, 2026

Uh oh!

github-actions Bot commented Nov 2, 2026

🔒 Security Scan Results

⏱️ SLA Breach Summary

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

9 participants

snyk-io Bot commented Oct 26, 2026 •

edited

Loading