Fix: Spring pins and hardcoded test values (Snyk) - v2.8.3

.github/workflows/unit-testing.yml

@@ -9,6 +9,9 @@ on:
 jobs:
   coverage:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
 
     steps:
       - name: 🧾 Checkout repository

CHANGELOG.md

@@ -1,5 +1,11 @@
 # CHANGELOG
 
+## v2.8.3
+
+### Oct 26, 2026
+- Fix: Updated the `dependencyManagement` pins for `org.springframework:spring-core`, `spring-beans` and `spring-web` from 6.2.19 to 7.0.9 (the version `contentstack-utils` already targets) to resolve Snyk-reported Spring Framework vulnerabilities (resource allocation without limits, XSS, HTTP response splitting, sensitive cookie without Secure attribute). Build-time pins only; no API or dependency changes for consumers.
+- Tests: replaced hardcoded publisher user values with generated values
+
 ## v2.8.2
 
 ### Aug 26, 2026

pom.xml

@@ -5,7 +5,7 @@
     <modelVersion>4.0.0</modelVersion>
     <groupId>com.contentstack.sdk</groupId>
     <artifactId>java</artifactId>
-    <version>2.8.2</version>
+    <version>2.8.3</version>
     <packaging>jar</packaging>
     <name>contentstack-java</name>
     <description>Java SDK for Contentstack Content Delivery API</description>
@@ -230,17 +230,17 @@
             <dependency>
                 <groupId>org.springframework</groupId>
                 <artifactId>spring-core</artifactId>
-                <version>6.2.19</version>
+                <version>7.0.9</version>
             </dependency>
             <dependency>
                 <groupId>org.springframework</groupId>
                 <artifactId>spring-beans</artifactId>
-                <version>6.2.19</version>
+                <version>7.0.9</version>
             </dependency>
             <dependency>
                 <groupId>org.springframework</groupId>
                 <artifactId>spring-web</artifactId>
-                <version>6.2.19</version>
+                <version>7.0.9</version>
             </dependency>
             <!-- Fix CVE-2020-15250: junit pulled by json-simple -->
             <dependency>

src/test/java/com/contentstack/sdk/TestEntryModel.java

@@ -1,5 +1,6 @@
 package com.contentstack.sdk;
 
+import java.util.UUID;
 import org.json.JSONArray;
 import org.json.JSONObject;
 import org.junit.jupiter.api.Test;
@@ -254,8 +255,8 @@ void testConstructorWithPublishDetails() {
         JSONObject publishDetails = new JSONObject();
         publishDetails.put("environment", "production");
         publishDetails.put("time", "2024-01-01T00:00:00.000Z");
-        // deepcode ignore NoHardcodedCredentials: false positive - method signature/parameter names, no actual hardcoded credential
-        publishDetails.put("user", "test_publisher_uid");
+        String publisherUid = UUID.randomUUID().toString();
+        publishDetails.put("user", publisherUid);
 
         JSONObject json = new JSONObject();
         json.put("uid", "published_entry");
@@ -267,7 +268,7 @@ void testConstructorWithPublishDetails() {
         assertNotNull(model.publishDetails);
         assertEquals("production", model.environment);
         assertEquals("2024-01-01T00:00:00.000Z", model.time);
-        assertEquals("test_publisher_uid", model.user);
+        assertEquals(publisherUid, model.user);
 
         // Verify metadata is populated
         assertNotNull(model.metadata);
@@ -331,7 +332,6 @@ void testConstructorWithAllFields() throws Exception {
         JSONObject publishDetails = new JSONObject();
         publishDetails.put("environment", "staging");
         publishDetails.put("time", "2024-02-01T12:00:00.000Z");
-        // deepcode ignore NoHardcodedCredentials: false positive - method signature/parameter names, no actual hardcoded credential
         publishDetails.put("user", "admin");
 
         // Create images array
@@ -443,8 +443,7 @@ void testConstructorWithEntryKeyAndAllFields() throws Exception {
         JSONObject publishDetails = new JSONObject();
         publishDetails.put("environment", "development");
         publishDetails.put("time", "2024-03-01T15:00:00.000Z");
-        // deepcode ignore NoHardcodedCredentials: false positive - method signature/parameter names, no actual hardcoded credential
-        publishDetails.put("user", "dev_user");
+        publishDetails.put("user", UUID.randomUUID().toString());
 
         // Create images
         JSONArray imagesArray = new JSONArray();