DX | 29-09-2026 | Release by cs-raj · Pull Request #151 · contentstack/contentstack-marketplace-sdk

cs-raj · 2026-09-29T07:00:47Z

No description provided.

chore: back-merge main into development

Brings back-merge branch up to date with development so main can be back-merged cleanly (DX-20927). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

DX-20927 | Back-merge main into development

Copilot

Copilot wasn't able to review any files in this pull request. Check if the Files changed in this pull request are included in default exclusions.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

snyk-io · 2026-09-29T07:01:03Z

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

github-actions · 2026-09-29T07:01:29Z

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Threshold	Result
🔴 Critical Severity	10	✅ Passed
🟠 High Severity	25	✅ Passed
🟡 Medium Severity	500	✅ Passed
🔵 Low Severity	1000	✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity	SLA Threshold (with/no fixes)	Status
🔴 Critical	15 / 30 days	✅ Passed
🟠 High	30 / 120 days	✅ Passed
🟡 Medium	90 / 365 days	✅ Passed
🔵 Low	180 / 365 days	✅ Passed

✅ BUILD PASSED - All security checks passed

Publish on release:published from release.yml so the npm trusted publisher can be keyed on the filename, drop NODE_AUTH_TOKEN in favour of id-token: write (OIDC), run on Node 24 with npm@latest (trusted publishing needs npm >= 11.5.1), check out the release tag without persisted credentials. GitHub pre-releases go to the beta dist-tag. The GitHub Packages job gains the packages: write permission it was missing and keeps publishing with the job's own token. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

Refuse to publish when the release tag is not "v" + the package.json version, so a tag cut on the wrong commit cannot publish an older version under a newer tag. The GitHub Packages job now uses the same beta/latest dist-tag rule as the npm job, so a GitHub pre-release never becomes latest on either registry. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Snyk (snyk test --all-projects): 13 issues (8 high, 5 medium, all axios 1.18.1) -> 0. Regenerated package-lock.json (axios 1.18.1 -> 1.20.0). Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

…velopment chore: back-merge main into development

github-actions · 2026-10-22T11:22:11Z

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Count (with fixes)	Without fixes	Threshold	Result
🔴 Critical Severity	0	0	10	✅ Passed
🟠 High Severity	8	1	25	✅ Passed
🟡 Medium Severity	5	1	500	✅ Passed
🔵 Low Severity	0	0	1000	✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity	SLA Threshold (with/no fixes)	Status
🔴 Critical	15 / 30 days	✅ Passed
🟠 High	30 / 120 days	✅ Passed
🟡 Medium	90 / 365 days	✅ Passed
🔵 Low	180 / 365 days	✅ Passed

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:

Critical without fixes: 0
High without fixes: 1
Medium without fixes: 1
Low without fixes: 0

✅ BUILD PASSED - All security checks passed

Lock file regenerated (fixed 3 on its own: body-parser high, markdown-it high, fast-uri moderate; all dev-only). Direct upgrades: none (no patch or minor bump clears a finding) Overrides: none (remaining transitive fixes are cross-major) Vuln count: snyk 0 → 0, npm audit 13 → 10. Build verified passing. .talismanrc: package-lock.json checksum replaced by a filecontent/base64content ignore so lock regens stop tripping talisman. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

The check-version-bump workflow requires package.json to be above the latest tag once a PR changes it; this PR's Snyk lock fix does. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

The Coverage report step posts a PR comment, which the default read-only GITHUB_TOKEN refuses ("Resource not accessible by integration"), so Build & Test failed although every test passed. Grant pull-requests: write on the job and keep contents: read for the checkout. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

chore(release): publish to npm with trusted publishing

github-actions · 2026-10-29T09:06:46Z

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Without fixes	Threshold	Result
🔴 Critical Severity	0	10	✅ Passed
🟠 High Severity	1	25	✅ Passed
🟡 Medium Severity	0	500	✅ Passed
🔵 Low Severity	0	1000	✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity	SLA Threshold (with/no fixes)	Status
🔴 Critical	15 / 30 days	✅ Passed
🟠 High	30 / 120 days	✅ Passed
🟡 Medium	90 / 365 days	✅ Passed
🔵 Low	180 / 365 days	✅ Passed

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:

Critical without fixes: 0
High without fixes: 1
Medium without fixes: 0
Low without fixes: 0

✅ BUILD PASSED - All security checks passed

github-actions · 2026-10-29T09:07:45Z

Coverage report for commit: 1503e2d
File: coverage/clover.xml

Cover ┌─────────────────────────┐ Freq.
   0% │ ░░░░░░░░░░░░░░░░░░░░░░░ │  0.0%
  10% │ ░░░░░░░░░░░░░░░░░░░░░░░ │  0.0%
  20% │ ░░░░░░░░░░░░░░░░░░░░░░░ │  0.0%
  30% │ ░░░░░░░░░░░░░░░░░░░░░░░ │  0.0%
  40% │ ░░░░░░░░░░░░░░░░░░░░░░░ │  0.0%
  50% │ ░░░░░░░░░░░░░░░░░░░░░░░ │  0.0%
  60% │ ░░░░░░░░░░░░░░░░░░░░░░░ │  0.0%
  70% │ ███░░░░░░░░░░░░░░░░░░░░ │  5.3%
  80% │ ███████████████████████ │ 47.4%
  90% │ ████████░░░░░░░░░░░░░░░ │ 15.8%
 100% │ ████████████████░░░░░░░ │ 31.6%
      └─────────────────────────┘
 *Legend:* █ = Current Distribution

Summary - Lines: 85.93% | Methods: 96.08% | Branches: 67.22%

Files	Lines	Methods	Branches
lib
contentstack.js	100.00%	100.00%	100.00%
contentstackClient.js	100.00%	100.00%	85.29%
contentstackCollection.js	86.67%	100.00%	90.00%
entity.js	75.31%	100.00%	53.45%
lib/core
Util.js	96.36%	100.00%	83.64%
concurrency-queue.js	90.40%	90.91%	83.74%
contentstackError.js	100.00%	100.00%	100.00%
contentstackHTTPClient.js	100.00%	100.00%	94.59%
messageHandler.js	66.67%	57.14%	60.00%
region.js	100.00%	100.00%	75.00%
lib/marketplace/app/hosting
deployment.js	80.88%	100.00%	63.16%
index.js	80.00%	100.00%	58.23%
lib/marketplace/app
index.js	80.46%	90.00%	53.26%
lib/marketplace/app/oauth
index.js	83.33%	100.00%	52.63%
lib/marketplace/apprequest
index.js	82.86%	100.00%	58.54%
lib/marketplace/authorization
index.js	83.33%	100.00%	65.12%
lib/marketplace
index.js	90.48%	100.00%	82.76%
lib/marketplace/installation
index.js	81.82%	100.00%	56.52%
lib/marketplace/installation/webhooks
index.js	81.58%	100.00%	53.19%

_{🤖 comment via lucassabreu/comment-coverage-clover}

cs-raj and others added 5 commits May 4, 2026 16:38

Merge pull request #144 from contentstack/main

e8e4b7b

chore: back-merge main into development

Merge pull request #146 from contentstack/main

83fa3f2

chore: back-merge main into development

Merge pull request #147 from contentstack/main

141073d

chore: back-merge main into development

Merge development into back-merge/DX-20927

f50ba1a

Brings back-merge branch up to date with development so main can be back-merged cleanly (DX-20927). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Merge pull request #150 from contentstack/back-merge/DX-20927

12d7b3e

DX-20927 | Back-merge main into development

Copilot AI balanced review requested due to automatic review settings September 29, 2026 07:00

Copilot AI reviewed Sep 29, 2026

View reviewed changes

cs-raj and others added 5 commits October 1, 2026 12:45

fix: bump axios to ^1.20.0 to clear Snyk findings

4fd07c2

Snyk (snyk test --all-projects): 13 issues (8 high, 5 medium, all axios 1.18.1) -> 0. Regenerated package-lock.json (axios 1.18.1 -> 1.20.0). Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

chore: back-merge main into development

74408db

Merge pull request #156 from contentstack/chore/back-merge-main-to-de…

2f3550a

…velopment chore: back-merge main into development

cs-raj and others added 5 commits October 24, 2026 19:37

Merge remote-tracking branch 'origin/development' into feat/DX-27614

457ed01

chore(release): bump version to 1.5.5

7dd49f2

The check-version-bump workflow requires package.json to be above the latest tag once a PR changes it; this PR's Snyk lock fix does. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Merge pull request #152 from contentstack/feat/DX-27614

1503e2d

chore(release): publish to npm with trusted publishing

cs-raj requested review from a team as code owners October 29, 2026 09:06

reeshika-h closed this pull request by merging all changes into main in 0f9479d Nov 3, 2026

Navigation Menu

Repository navigation

DX | 29-09-2026 | Release - #151

DX | 29-09-2026 | Release#151
15 commits merged into
mainfrom
development

cs-raj commented Sep 29, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

snyk-io Bot commented Sep 29, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Sep 29, 2026

Uh oh!

github-actions Bot commented Oct 22, 2026

Uh oh!

github-actions Bot commented Oct 29, 2026

Uh oh!

github-actions Bot commented Oct 29, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

cs-raj commented Sep 29, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

snyk-io Bot commented Sep 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Snyk checks have passed. No issues have been found so far.

Uh oh!

github-actions Bot commented Sep 29, 2026

🔒 Security Scan Results

⏱️ SLA Breach Summary

Uh oh!

github-actions Bot commented Oct 22, 2026

🔒 Security Scan Results

⏱️ SLA Breach Summary

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

Uh oh!

github-actions Bot commented Oct 29, 2026

🔒 Security Scan Results

⏱️ SLA Breach Summary

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

Uh oh!

github-actions Bot commented Oct 29, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

snyk-io Bot commented Sep 29, 2026 •

edited

Loading