Fix: cleartext HTTP in test and axios/follow-redirects vulnerabilities (Snyk) - v1.5.5 by reeshika-h · Pull Request #157 · contentstack/contentstack-marketplace-sdk

reeshika-h · 2026-10-26T10:57:51Z

Summary

Resolves DX-9929 (cleartext HTTP in a localhost test) plus the unticketed axios / follow-redirects vulnerabilities (v1.5.5).

test/unit/concurrency-Queue-test.js now serves over https using a throwaway self-signed certificate generated per run with openssl (no new dependency), trusted only while that file's tests run.
axios floor ^1.17.0 → ^1.20.0 and follow-redirects → 1.16.2 (same major / patch level). Version 1.5.4 → 1.5.5 with a changelog entry.

Verification

snyk test: 15 → 0. snyk code test: the ticketed cleartext finding is cleared. 3 SSRF findings remain in lib/core/concurrency-queue.js; they are false positives (a retry re-sends the caller's original request, and the header only sets the wait time) and are not part of this change.
Unit tests: 194 passing.

🤖 Generated with Claude Code

chore: back-merge main into development

Brings back-merge branch up to date with development so main can be back-merged cleanly (DX-20927). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

DX-20927 | Back-merge main into development

Publish on release:published from release.yml so the npm trusted publisher can be keyed on the filename, drop NODE_AUTH_TOKEN in favour of id-token: write (OIDC), run on Node 24 with npm@latest (trusted publishing needs npm >= 11.5.1), check out the release tag without persisted credentials. GitHub pre-releases go to the beta dist-tag. The GitHub Packages job gains the packages: write permission it was missing and keeps publishing with the job's own token. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

Refuse to publish when the release tag is not "v" + the package.json version, so a tag cut on the wrong commit cannot publish an older version under a newer tag. The GitHub Packages job now uses the same beta/latest dist-tag rule as the npm job, so a GitHub pre-release never becomes latest on either registry. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Snyk (snyk test --all-projects): 13 issues (8 high, 5 medium, all axios 1.18.1) -> 0. Regenerated package-lock.json (axios 1.18.1 -> 1.20.0). Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

…velopment chore: back-merge main into development

Lock file regenerated (fixed 3 on its own: body-parser high, markdown-it high, fast-uri moderate; all dev-only). Direct upgrades: none (no patch or minor bump clears a finding) Overrides: none (remaining transitive fixes are cross-major) Vuln count: snyk 0 → 0, npm audit 13 → 10. Build verified passing. .talismanrc: package-lock.json checksum replaced by a filecontent/base64content ignore so lock regens stop tripping talisman. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

The check-version-bump workflow requires package.json to be above the latest tag once a PR changes it; this PR's Snyk lock fix does. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

The Coverage report step posts a PR comment, which the default read-only GITHUB_TOKEN refuses ("Resource not accessible by integration"), so Build & Test failed although every test passed. Grant pull-requests: write on the job and keep contents: read for the checkout. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Throwaway self-signed https test server; axios ^1.20.0, follow-redirects 1.16.2; v1.5.5. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

snyk-io · 2026-10-26T10:58:03Z

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

github-actions · 2026-10-26T10:58:40Z

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Threshold	Result
🔴 Critical Severity	10	✅ Passed
🟠 High Severity	25	✅ Passed
🟡 Medium Severity	500	✅ Passed
🔵 Low Severity	1000	✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity	SLA Threshold (with/no fixes)	Status
🔴 Critical	15 / 30 days	✅ Passed
🟠 High	30 / 120 days	✅ Passed
🟡 Medium	90 / 365 days	✅ Passed
🔵 Low	180 / 365 days	✅ Passed

✅ BUILD PASSED - All security checks passed

chore(release): publish to npm with trusted publishing

The job posts a coverage comment on the PR and the step fails with "Resource not accessible by integration" because the token is read-only. Declare the permissions the job needs, as the js-core and typescript coverage workflows already do. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

github-actions · 2026-11-02T06:31:28Z

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Threshold	Result
🔴 Critical Severity	10	✅ Passed
🟠 High Severity	25	✅ Passed
🟡 Medium Severity	500	✅ Passed
🔵 Low Severity	1000	✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity	SLA Threshold (with/no fixes)	Status
🔴 Critical	15 / 30 days	✅ Passed
🟠 High	30 / 120 days	✅ Passed
🟡 Medium	90 / 365 days	✅ Passed
🔵 Low	180 / 365 days	✅ Passed

✅ BUILD PASSED - All security checks passed

github-actions · 2026-11-02T06:32:26Z

Coverage report for commit: 42cb6ee
File: coverage/clover.xml

Cover ┌─────────────────────────┐ Freq.
   0% │ ░░░░░░░░░░░░░░░░░░░░░░░ │  0.0%
  10% │ ░░░░░░░░░░░░░░░░░░░░░░░ │  0.0%
  20% │ ░░░░░░░░░░░░░░░░░░░░░░░ │  0.0%
  30% │ ░░░░░░░░░░░░░░░░░░░░░░░ │  0.0%
  40% │ ░░░░░░░░░░░░░░░░░░░░░░░ │  0.0%
  50% │ ░░░░░░░░░░░░░░░░░░░░░░░ │  0.0%
  60% │ ░░░░░░░░░░░░░░░░░░░░░░░ │  0.0%
  70% │ ███░░░░░░░░░░░░░░░░░░░░ │  5.3%
  80% │ ███████████████████████ │ 47.4%
  90% │ ████████░░░░░░░░░░░░░░░ │ 15.8%
 100% │ ████████████████░░░░░░░ │ 31.6%
      └─────────────────────────┘
 *Legend:* █ = Current Distribution

Summary - Lines: 85.93% | Methods: 96.08% | Branches: 67.22%

Files	Lines	Methods	Branches
lib
contentstack.js	100.00%	100.00%	100.00%
contentstackClient.js	100.00%	100.00%	85.29%
contentstackCollection.js	86.67%	100.00%	90.00%
entity.js	75.31%	100.00%	53.45%
lib/core
Util.js	96.36%	100.00%	83.64%
concurrency-queue.js	90.40%	90.91%	83.74%
contentstackError.js	100.00%	100.00%	100.00%
contentstackHTTPClient.js	100.00%	100.00%	94.59%
messageHandler.js	66.67%	57.14%	60.00%
region.js	100.00%	100.00%	75.00%
lib/marketplace/app/hosting
deployment.js	80.88%	100.00%	63.16%
index.js	80.00%	100.00%	58.23%
lib/marketplace/app
index.js	80.46%	90.00%	53.26%
lib/marketplace/app/oauth
index.js	83.33%	100.00%	52.63%
lib/marketplace/apprequest
index.js	82.86%	100.00%	58.54%
lib/marketplace/authorization
index.js	83.33%	100.00%	65.12%
lib/marketplace
index.js	90.48%	100.00%	82.76%
lib/marketplace/installation
index.js	81.82%	100.00%	56.52%
lib/marketplace/installation/webhooks
index.js	81.58%	100.00%	53.19%

_{🤖 comment via lucassabreu/comment-coverage-clover}

Lock file regenerated (fixed 13 snyk and 7 npm audit findings on its own). Direct upgrades: axios ^1.17.0 -> ^1.20.0, mocha ^11.7.1 -> ^11.8.0, mochawesome ^7.1.3 -> ^7.1.4 Overrides: none Vuln count: snyk 13 -> 0, npm audit 53 -> 46. Build verified passing. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

…ngelog The previous commit brings in the dependency refresh from #153 (package-lock.json, mocha, mochawesome) alongside the axios and follow-redirects fixes already in this PR. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

github-actions · 2026-11-02T06:55:48Z

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Threshold	Result
🔴 Critical Severity	10	✅ Passed
🟠 High Severity	25	✅ Passed
🟡 Medium Severity	500	✅ Passed
🔵 Low Severity	1000	✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity	SLA Threshold (with/no fixes)	Status
🔴 Critical	15 / 30 days	✅ Passed
🟠 High	30 / 120 days	✅ Passed
🟡 Medium	90 / 365 days	✅ Passed
🔵 Low	180 / 365 days	✅ Passed

✅ BUILD PASSED - All security checks passed

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

github-actions · 2026-11-02T10:35:49Z

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Threshold	Result
🔴 Critical Severity	10	✅ Passed
🟠 High Severity	25	✅ Passed
🟡 Medium Severity	500	✅ Passed
🔵 Low Severity	1000	✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity	SLA Threshold (with/no fixes)	Status
🔴 Critical	15 / 30 days	✅ Passed
🟠 High	30 / 120 days	✅ Passed
🟡 Medium	90 / 365 days	✅ Passed
🔵 Low	180 / 365 days	✅ Passed

✅ BUILD PASSED - All security checks passed

…package-lock.json - merge the 1.5.5 release changes from development (trusted-publishing release workflow, release.yml, .talismanrc, changelog, version 1.5.5) - resolve .github/workflows/unit-test.yml (same pull-requests: write permission on both sides) and CHANGELOG.md (single v1.5.5 entry combining both) - delete package-lock.json and node_modules, then clean npm install to regenerate the lock file - npm ci --dry-run passes; unit tests and build pass; snyk test reports 0 vulnerabilities Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

github-actions · 2026-11-02T11:31:28Z

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Threshold	Result
🔴 Critical Severity	10	✅ Passed
🟠 High Severity	25	✅ Passed
🟡 Medium Severity	500	✅ Passed
🔵 Low Severity	1000	✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity	SLA Threshold (with/no fixes)	Status
🔴 Critical	15 / 30 days	✅ Passed
🟠 High	30 / 120 days	✅ Passed
🟡 Medium	90 / 365 days	✅ Passed
🔵 Low	180 / 365 days	✅ Passed

✅ BUILD PASSED - All security checks passed

Combine the two `fs` imports into one so `npm run lint` passes (import/no-duplicates). Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

github-actions · 2026-11-02T11:33:47Z

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Threshold	Result
🔴 Critical Severity	10	✅ Passed
🟠 High Severity	25	✅ Passed
🟡 Medium Severity	500	✅ Passed
🔵 Low Severity	1000	✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity	SLA Threshold (with/no fixes)	Status
🔴 Critical	15 / 30 days	✅ Passed
🟠 High	30 / 120 days	✅ Passed
🟡 Medium	90 / 365 days	✅ Passed
🔵 Low	180 / 365 days	✅ Passed

✅ BUILD PASSED - All security checks passed

cs-raj and others added 15 commits May 4, 2026 16:38

Merge pull request #144 from contentstack/main

e8e4b7b

chore: back-merge main into development

Merge pull request #146 from contentstack/main

83fa3f2

chore: back-merge main into development

Merge pull request #147 from contentstack/main

141073d

chore: back-merge main into development

Merge development into back-merge/DX-20927

f50ba1a

Brings back-merge branch up to date with development so main can be back-merged cleanly (DX-20927). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Merge pull request #150 from contentstack/back-merge/DX-20927

12d7b3e

DX-20927 | Back-merge main into development

fix: bump axios to ^1.20.0 to clear Snyk findings

4fd07c2

Snyk (snyk test --all-projects): 13 issues (8 high, 5 medium, all axios 1.18.1) -> 0. Regenerated package-lock.json (axios 1.18.1 -> 1.20.0). Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

chore: back-merge main into development

74408db

Merge pull request #156 from contentstack/chore/back-merge-main-to-de…

2f3550a

…velopment chore: back-merge main into development

Merge remote-tracking branch 'origin/development' into feat/DX-27614

457ed01

chore(release): bump version to 1.5.5

7dd49f2

The check-version-bump workflow requires package.json to be above the latest tag once a PR changes it; this PR's Snyk lock fix does. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Fix: use https in concurrency queue test; bump axios

d85faca

Throwaway self-signed https test server; axios ^1.20.0, follow-redirects 1.16.2; v1.5.5. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

reeshika-h requested a review from a team as a code owner October 26, 2026 10:57

Merge pull request #152 from contentstack/feat/DX-27614

1503e2d

chore(release): publish to npm with trusted publishing

reeshika-h changed the base branch from development to main November 2, 2026 05:56

reeshika-h requested a review from a team as a code owner November 2, 2026 06:30

cs-raj previously approved these changes Nov 2, 2026

View reviewed changes

cs-raj and others added 2 commits November 2, 2026 12:24

reeshika-h dismissed cs-raj’s stale review via 5d5e773 November 2, 2026 06:55

reeshika-h mentioned this pull request Nov 2, 2026

fix: bump axios to ^1.20.0 to resolve 13 Snyk findings #153

Closed

cs-raj previously approved these changes Nov 2, 2026

View reviewed changes

ci: drop checks: write permission from build-test job

beb380d

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

reeshika-h dismissed cs-raj’s stale review via beb380d November 2, 2026 10:35

fix: merge duplicate fs imports in concurrency queue test

42cb6ee

Combine the two `fs` imports into one so `npm run lint` passes (import/no-duplicates). Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

cs-raj approved these changes Nov 2, 2026

View reviewed changes

dhaval-jain-cstk approved these changes Nov 2, 2026

View reviewed changes

reeshika-h merged commit 0f9479d into main Nov 3, 2026
9 checks passed

reeshika-h deleted the fix/snyk-cleartext-http branch November 3, 2026 06:55

Navigation Menu

Repository navigation

Fix: cleartext HTTP in test and axios/follow-redirects vulnerabilities (Snyk) - v1.5.5 - #157

Fix: cleartext HTTP in test and axios/follow-redirects vulnerabilities (Snyk) - v1.5.5#157
reeshika-h merged 22 commits into
mainfrom
fix/snyk-cleartext-http

reeshika-h commented Oct 26, 2026

Uh oh!

snyk-io Bot commented Oct 26, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 26, 2026

Uh oh!

github-actions Bot commented Nov 2, 2026

Uh oh!

github-actions Bot commented Nov 2, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Nov 2, 2026

Uh oh!

github-actions Bot commented Nov 2, 2026

Uh oh!

github-actions Bot commented Nov 2, 2026

Uh oh!

github-actions Bot commented Nov 2, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

reeshika-h commented Oct 26, 2026

Summary

Verification

Uh oh!

snyk-io Bot commented Oct 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Snyk checks have passed. No issues have been found so far.

Uh oh!

github-actions Bot commented Oct 26, 2026

🔒 Security Scan Results

⏱️ SLA Breach Summary

Uh oh!

github-actions Bot commented Nov 2, 2026

🔒 Security Scan Results

⏱️ SLA Breach Summary

Uh oh!

github-actions Bot commented Nov 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Nov 2, 2026

🔒 Security Scan Results

⏱️ SLA Breach Summary

Uh oh!

github-actions Bot commented Nov 2, 2026

🔒 Security Scan Results

⏱️ SLA Breach Summary

Uh oh!

github-actions Bot commented Nov 2, 2026

🔒 Security Scan Results

⏱️ SLA Breach Summary

Uh oh!

github-actions Bot commented Nov 2, 2026

🔒 Security Scan Results

⏱️ SLA Breach Summary

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

snyk-io Bot commented Oct 26, 2026 •

edited

Loading

github-actions Bot commented Nov 2, 2026 •

edited

Loading