From d205fda9002cb53c73c5999baed2c8cb072fd67a Mon Sep 17 00:00:00 2001 From: Aravind Kumar Date: Tue, 6 Oct 2026 17:45:28 +0530 Subject: [PATCH 1/4] Updated codeowners --- CODEOWNERS | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/CODEOWNERS b/CODEOWNERS index ac7dad02..d9f2fb34 100644 --- a/CODEOWNERS +++ b/CODEOWNERS @@ -1,4 +1,5 @@ * @contentstack/developer-ecosystem-pr-reviewers .github/workflows/ @contentstack/security-admin **/.snyk @contentstack/security-admin -**/CODEOWNERS @contentstack/security-admin \ No newline at end of file +**/CODEOWNERS @contentstack/security-admin +**/.gitguardian.yaml @contentstack/security-admin \ No newline at end of file From eaef38a822e08a2238d95a5190595d4c00b21698 Mon Sep 17 00:00:00 2001 From: reeshika-h Date: Mon, 26 Oct 2026 16:25:33 +0530 Subject: [PATCH 2/4] Fix: bump Spring pins to 7.0.9; use generated test values Build-time Spring pins 6.2.19 -> 7.0.9; replace hardcoded publisher values in tests with generated UUIDs; v2.8.3. Co-Authored-By: Claude Sonnet 5.5 --- CHANGELOG.md | 6 ++++++ pom.xml | 8 ++++---- .../java/com/contentstack/sdk/TestEntryModel.java | 11 +++++------ 3 files changed, 15 insertions(+), 10 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 0ce5d156..00e52681 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,11 @@ # CHANGELOG +## v2.8.3 + +### Oct 26, 2026 +- Fix: Updated the `dependencyManagement` pins for `org.springframework:spring-core`, `spring-beans` and `spring-web` from 6.2.19 to 7.0.9 (the version `contentstack-utils` already targets) to resolve Snyk-reported Spring Framework vulnerabilities (resource allocation without limits, XSS, HTTP response splitting, sensitive cookie without Secure attribute). Build-time pins only; no API or dependency changes for consumers. +- Tests: replaced hardcoded publisher user values with generated values + ## v2.8.2 ### Aug 26, 2026 diff --git a/pom.xml b/pom.xml index 31d375e1..23432445 100644 --- a/pom.xml +++ b/pom.xml @@ -5,7 +5,7 @@ 4.0.0 com.contentstack.sdk java - 2.8.2 + 2.8.3 jar contentstack-java Java SDK for Contentstack Content Delivery API @@ -230,17 +230,17 @@ org.springframework spring-core - 6.2.19 + 7.0.9 org.springframework spring-beans - 6.2.19 + 7.0.9 org.springframework spring-web - 6.2.19 + 7.0.9 diff --git a/src/test/java/com/contentstack/sdk/TestEntryModel.java b/src/test/java/com/contentstack/sdk/TestEntryModel.java index cc1447da..0c95989e 100644 --- a/src/test/java/com/contentstack/sdk/TestEntryModel.java +++ b/src/test/java/com/contentstack/sdk/TestEntryModel.java @@ -1,5 +1,6 @@ package com.contentstack.sdk; +import java.util.UUID; import org.json.JSONArray; import org.json.JSONObject; import org.junit.jupiter.api.Test; @@ -254,8 +255,8 @@ void testConstructorWithPublishDetails() { JSONObject publishDetails = new JSONObject(); publishDetails.put("environment", "production"); publishDetails.put("time", "2024-01-01T00:00:00.000Z"); - // deepcode ignore NoHardcodedCredentials: false positive - method signature/parameter names, no actual hardcoded credential - publishDetails.put("user", "test_publisher_uid"); + String publisherUid = UUID.randomUUID().toString(); + publishDetails.put("user", publisherUid); JSONObject json = new JSONObject(); json.put("uid", "published_entry"); @@ -267,7 +268,7 @@ void testConstructorWithPublishDetails() { assertNotNull(model.publishDetails); assertEquals("production", model.environment); assertEquals("2024-01-01T00:00:00.000Z", model.time); - assertEquals("test_publisher_uid", model.user); + assertEquals(publisherUid, model.user); // Verify metadata is populated assertNotNull(model.metadata); @@ -331,7 +332,6 @@ void testConstructorWithAllFields() throws Exception { JSONObject publishDetails = new JSONObject(); publishDetails.put("environment", "staging"); publishDetails.put("time", "2024-02-01T12:00:00.000Z"); - // deepcode ignore NoHardcodedCredentials: false positive - method signature/parameter names, no actual hardcoded credential publishDetails.put("user", "admin"); // Create images array @@ -443,8 +443,7 @@ void testConstructorWithEntryKeyAndAllFields() throws Exception { JSONObject publishDetails = new JSONObject(); publishDetails.put("environment", "development"); publishDetails.put("time", "2024-03-01T15:00:00.000Z"); - // deepcode ignore NoHardcodedCredentials: false positive - method signature/parameter names, no actual hardcoded credential - publishDetails.put("user", "dev_user"); + publishDetails.put("user", UUID.randomUUID().toString()); // Create images JSONArray imagesArray = new JSONArray(); From bd5684acdcb90181d6074cc32675a859cd1d6e92 Mon Sep 17 00:00:00 2001 From: reeshika-h Date: Mon, 2 Nov 2026 12:00:33 +0530 Subject: [PATCH 3/4] ci: grant pull-requests and checks write to the coverage job The job posts a coverage comment on the PR and the step fails with "Resource not accessible by integration" because the token is read-only. Declare the permissions the job needs, as the js-core and typescript coverage workflows already do. Co-Authored-By: Claude Sonnet 5.5 --- .github/workflows/unit-testing.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/unit-testing.yml b/.github/workflows/unit-testing.yml index 8c1cd6f5..087e6e3d 100644 --- a/.github/workflows/unit-testing.yml +++ b/.github/workflows/unit-testing.yml @@ -9,6 +9,10 @@ on: jobs: coverage: runs-on: ubuntu-latest + permissions: + contents: read + checks: write + pull-requests: write steps: - name: 🧾 Checkout repository From f26c630645cb1cf6399f9d771c4d77ec4cf2a3b3 Mon Sep 17 00:00:00 2001 From: reeshika-h Date: Mon, 2 Nov 2026 16:03:30 +0530 Subject: [PATCH 4/4] ci: drop unneeded checks: write permission from coverage job Co-Authored-By: Claude Sonnet 5.5 --- .github/workflows/unit-testing.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/.github/workflows/unit-testing.yml b/.github/workflows/unit-testing.yml index 087e6e3d..a7792293 100644 --- a/.github/workflows/unit-testing.yml +++ b/.github/workflows/unit-testing.yml @@ -11,7 +11,6 @@ jobs: runs-on: ubuntu-latest permissions: contents: read - checks: write pull-requests: write steps: