Skip to content

chore: sync main to staging + Snyk dep fixes (2.4.2) - #199

Merged
Aravind-Kumar-cstk merged 13 commits into
stagingfrom
chore/sync-main-to-staging-20261104
Nov 4, 2026
Merged

chore: sync main to staging + Snyk dep fixes (2.4.2)#199
Aravind-Kumar-cstk merged 13 commits into
stagingfrom
chore/sync-main-to-staging-20261104

Conversation

@rahul-contentstack

@rahul-contentstack rahul-contentstack commented Nov 4, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Summary

Sync staging with the latest main, and include the Snyk dependency fixes from fix/snyk-patch-deps-20261029 (#191).

Changes from main

  • .github/CODEOWNERS: updated code owners
  • .github/workflows/sca-scan.yml: SCA scan workflow update
  • .github/workflows/issues-jira.yml: removed

Changes from fix/snyk-patch-deps-20261029 (#191)

  • Bump 2 dependencies to resolve Snyk vulnerabilities
  • Bump other dependencies to their latest in-range versions
  • Version bump to 2.4.2 (package.json, package-lock.json)

Merging this PR also merges #191's commits, so #191 does not need a separate merge.

Testing

  • npm test: 18 suites, 249 tests passed on the merged branch

🤖 Generated with Claude Code

rahul-contentstack and others added 11 commits June 18, 2026 17:38
@rahul-contentstack
fix: field not found issue for custom field and field modifier
fc0bc0c
@rahul-contentstack
Release 2.4.1
153a54c
@rahul-contentstack
updated package-lock
fede200
@Aravind-Kumar-cstk
issues-jira.yml
57c97b8
@Aravind-Kumar-cstk
Delete issues-jira.yml
bbf7533
@Aravind-Kumar-cstk
sca-scan.yml
ab951ba
@Aravind-Kumar-cstk
Updated codeowners
e655592
@Aravind-Kumar-cstk
Updated codeowners
c41dd6f
@Aravind-Kumar-cstk
Updated codeowners
39944af
@pradyumna-garg-contentstack @claude
fix: bump 2 deps to resolve Snyk vulnerabilities
015874f 
Lock file regenerated (fixed 25 on its own).
Direct upgrades: axios ^1.7.9 -> ^1.21.0 (dependencies), @babel/core ^7.2.2 -> ^7.29.7 (devDependencies)
Added devDependency: @types/node ^25.6.0 (keeps the TypeScript 4.7 build working; dev-only)
Overrides: none
Vuln count: snyk 25 -> 0, npm audit 31 -> 9. Build verified passing.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@cs-raj @claude
chore: bump deps to latest in-range versions and release 2.4.2
50c69bf 
Raise direct dependencies to their latest compatible versions and regenerate
package-lock.json. Keep typedoc at ^0.22.18 and pin typescript to ~4.7.4:
typedoc 0.28 needs TypeScript 5 and typedoc-plugin-rename-defaults only
supports typedoc <=0.25.

Build and tests (18 suites, 249 tests) pass.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@rahul-contentstack
rahul-contentstack requested a review from a team as a code owner November 4, 2026 07:15
@snyk-io

snyk-io Bot commented Nov 4, 2026 •
edited
Loading

Copy link
Copy Markdown

✅ Snyk checks have passed. No issues have been found so far.

Status Scan Engine Critical High Medium Low Total (0)
✅ Open Source Security 0 0 0 0 0 issues
✅ Licenses 0 0 0 0 0 issues
✅ Code Security 0 0 0 0 0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

@github-actions

github-actions Bot commented Nov 4, 2026

Copy link
Copy Markdown

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type Count (with fixes) Without fixes Threshold Result
🔴 Critical Severity 0 0 10 ✅ Passed
🟠 High Severity 6 2 25 ✅ Passed
🟡 Medium Severity 15 2 500 ✅ Passed
🔵 Low Severity 0 0 1000 ✅ Passed

⏱️ SLA Breach Summary

⚠️ Warning: The following vulnerabilities have exceeded their SLA thresholds (days since publication).

Severity Breaches (with fixes) Breaches (no fixes) SLA Threshold (with/no fixes) Status
🔴 Critical 0 0 15 / 30 days ✅ Passed
🟠 High 6 0 30 / 120 days ❌ Failed
🟡 Medium 10 0 90 / 365 days ❌ Failed
🔵 Low 0 0 180 / 365 days ✅ Passed

🟠 High Severity - SLA Breached Issues (with fixes)

Showing 6 issue(s) that have exceeded the 30-day SLA threshold:

  1. Improper Validation of Specified Quantity in Input

    • ID: SNYK-JS-AXIOS-20245046
    • Package: axios@1.16.0
    • Published: 35 days ago (SLA: 30 days)
    • CVSS Score: 8.2
    • CVE: CVE-2026-101901

  2. Prototype Pollution

    • ID: SNYK-JS-AXIOS-20245066
    • Package: axios@1.16.0
    • Published: 35 days ago (SLA: 30 days)
    • CVSS Score: 8.3
    • CVE: CVE-2026-101909

  3. Allocation of Resources Without Limits or Throttling

    • ID: SNYK-JS-AXIOS-20245062
    • Package: axios@1.16.0
    • Published: 35 days ago (SLA: 30 days)
    • CVSS Score: 8.2
    • CVE: CVE-2026-101906

  4. Improper Validation of Specified Quantity in Input

    • ID: SNYK-JS-AXIOS-20245044
    • Package: axios@1.16.0
    • Published: 35 days ago (SLA: 30 days)
    • CVSS Score: 8.2
    • CVE: CVE-2026-101901

  5. Unintended Proxy or Intermediary ('Confused Deputy')

    • ID: SNYK-JS-AXIOS-20245048
    • Package: axios@1.16.0
    • Published: 35 days ago (SLA: 30 days)
    • CVSS Score: 7.6
    • CVE: CVE-2026-101905

  6. Server-side Request Forgery (SSRF)

    • ID: SNYK-JS-AXIOS-20245060
    • Package: axios@1.16.0
    • Published: 35 days ago (SLA: 30 days)
    • CVSS Score: 7
    • CVE: CVE-2026-101898

🟡 Medium Severity - SLA Breached Issues (with fixes)

Showing 10 issue(s) that have exceeded the 90-day SLA threshold:

  1. Allocation of Resources Without Limits or Throttling

    • ID: SNYK-JS-AXIOS-18060165
    • Package: axios@1.16.0
    • Published: 105 days ago (SLA: 90 days)
    • CVSS Score: 6.3
    • CVE: CVE-2026-67312

  2. Allocation of Resources Without Limits or Throttling

    • ID: SNYK-JS-AXIOS-18060804
    • Package: axios@1.16.0
    • Published: 105 days ago (SLA: 90 days)
    • CVSS Score: 6.3
    • CVE: CVE-2026-67318

  3. Prototype Pollution

    • ID: SNYK-JS-AXIOS-18065351
    • Package: axios@1.16.0
    • Published: 105 days ago (SLA: 90 days)
    • CVSS Score: 6.9
    • CVE: CVE-2026-67320

  4. Permissive List of Allowed Inputs

    • ID: SNYK-JS-AXIOS-18065357
    • Package: axios@1.16.0
    • Published: 105 days ago (SLA: 90 days)
    • CVSS Score: 6.9
    • CVE: CVE-2026-67315

  5. Uncontrolled Recursion

    • ID: SNYK-JS-AXIOS-18060167
    • Package: axios@1.16.0
    • Published: 105 days ago (SLA: 90 days)
    • CVSS Score: 6.3
    • CVE: CVE-2026-67313

  6. Prototype Pollution

    • ID: SNYK-JS-AXIOS-18060659
    • Package: axios@1.16.0
    • Published: 105 days ago (SLA: 90 days)
    • CVSS Score: 6.3
    • CVE: CVE-2026-67314

  7. Prototype Pollution

    • ID: SNYK-JS-AXIOS-18065355
    • Package: axios@1.16.0
    • Published: 105 days ago (SLA: 90 days)
    • CVSS Score: 6.3
    • CVE: CVE-2026-67316

  8. Uncontrolled Recursion

    • ID: SNYK-JS-AXIOS-18060730
    • Package: axios@1.16.0
    • Published: 105 days ago (SLA: 90 days)
    • CVSS Score: 6.9
    • CVE: CVE-2026-67321

  9. Prototype Pollution

    • ID: SNYK-JS-AXIOS-18065349
    • Package: axios@1.16.0
    • Published: 105 days ago (SLA: 90 days)
    • CVSS Score: 6.3
    • CVE: CVE-2026-67319

  10. Allocation of Resources Without Limits or Throttling

  • ID: SNYK-JS-AXIOS-18065353
  • Package: axios@1.16.0
  • Published: 105 days ago (SLA: 90 days)
  • CVSS Score: 6.3
  • CVE: CVE-2026-67317

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:

  • Critical without fixes: 0
  • High without fixes: 2
  • Medium without fixes: 2
  • Low without fixes: 0

❌ BUILD FAILED - Security checks failed

Please review and fix the security vulnerabilities before merging.

@github-actions

github-actions Bot commented Nov 4, 2026

Copy link
Copy Markdown

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type Count (with fixes) Without fixes Threshold Result
🔴 Critical Severity 0 0 10 ✅ Passed
🟠 High Severity 6 2 25 ✅ Passed
🟡 Medium Severity 15 2 500 ✅ Passed
🔵 Low Severity 0 0 1000 ✅ Passed

⏱️ SLA Breach Summary

⚠️ Warning: The following vulnerabilities have exceeded their SLA thresholds (days since publication).

Severity Breaches (with fixes) Breaches (no fixes) SLA Threshold (with/no fixes) Status
🔴 Critical 0 0 15 / 30 days ✅ Passed
🟠 High 6 0 30 / 120 days ❌ Failed
🟡 Medium 10 0 90 / 365 days ❌ Failed
🔵 Low 0 0 180 / 365 days ✅ Passed

🟠 High Severity - SLA Breached Issues (with fixes)

Showing 6 issue(s) that have exceeded the 30-day SLA threshold:

  1. Allocation of Resources Without Limits or Throttling

    • ID: SNYK-JS-AXIOS-20245062
    • Package: axios@1.16.0
    • Published: 35 days ago (SLA: 30 days)
    • CVSS Score: 8.2
    • CVE: CVE-2026-101906

  2. Prototype Pollution

    • ID: SNYK-JS-AXIOS-20245066
    • Package: axios@1.16.0
    • Published: 35 days ago (SLA: 30 days)
    • CVSS Score: 8.3
    • CVE: CVE-2026-101909

  3. Server-side Request Forgery (SSRF)

    • ID: SNYK-JS-AXIOS-20245060
    • Package: axios@1.16.0
    • Published: 35 days ago (SLA: 30 days)
    • CVSS Score: 7
    • CVE: CVE-2026-101898

  4. Improper Validation of Specified Quantity in Input

    • ID: SNYK-JS-AXIOS-20245044
    • Package: axios@1.16.0
    • Published: 35 days ago (SLA: 30 days)
    • CVSS Score: 8.2
    • CVE: CVE-2026-101901

  5. Improper Validation of Specified Quantity in Input

    • ID: SNYK-JS-AXIOS-20245046
    • Package: axios@1.16.0
    • Published: 35 days ago (SLA: 30 days)
    • CVSS Score: 8.2
    • CVE: CVE-2026-101901

  6. Unintended Proxy or Intermediary ('Confused Deputy')

    • ID: SNYK-JS-AXIOS-20245048
    • Package: axios@1.16.0
    • Published: 35 days ago (SLA: 30 days)
    • CVSS Score: 7.6
    • CVE: CVE-2026-101905

🟡 Medium Severity - SLA Breached Issues (with fixes)

Showing 10 issue(s) that have exceeded the 90-day SLA threshold:

  1. Uncontrolled Recursion

    • ID: SNYK-JS-AXIOS-18060167
    • Package: axios@1.16.0
    • Published: 105 days ago (SLA: 90 days)
    • CVSS Score: 6.3
    • CVE: CVE-2026-67313

  2. Prototype Pollution

    • ID: SNYK-JS-AXIOS-18065355
    • Package: axios@1.16.0
    • Published: 105 days ago (SLA: 90 days)
    • CVSS Score: 6.3
    • CVE: CVE-2026-67316

  3. Prototype Pollution

    • ID: SNYK-JS-AXIOS-18065349
    • Package: axios@1.16.0
    • Published: 105 days ago (SLA: 90 days)
    • CVSS Score: 6.3
    • CVE: CVE-2026-67319

  4. Prototype Pollution

    • ID: SNYK-JS-AXIOS-18065351
    • Package: axios@1.16.0
    • Published: 105 days ago (SLA: 90 days)
    • CVSS Score: 6.9
    • CVE: CVE-2026-67320

  5. Permissive List of Allowed Inputs

    • ID: SNYK-JS-AXIOS-18065357
    • Package: axios@1.16.0
    • Published: 105 days ago (SLA: 90 days)
    • CVSS Score: 6.9
    • CVE: CVE-2026-67315

  6. Allocation of Resources Without Limits or Throttling

    • ID: SNYK-JS-AXIOS-18060165
    • Package: axios@1.16.0
    • Published: 105 days ago (SLA: 90 days)
    • CVSS Score: 6.3
    • CVE: CVE-2026-67312

  7. Allocation of Resources Without Limits or Throttling

    • ID: SNYK-JS-AXIOS-18065353
    • Package: axios@1.16.0
    • Published: 105 days ago (SLA: 90 days)
    • CVSS Score: 6.3
    • CVE: CVE-2026-67317

  8. Prototype Pollution

    • ID: SNYK-JS-AXIOS-18060659
    • Package: axios@1.16.0
    • Published: 105 days ago (SLA: 90 days)
    • CVSS Score: 6.3
    • CVE: CVE-2026-67314

  9. Uncontrolled Recursion

    • ID: SNYK-JS-AXIOS-18060730
    • Package: axios@1.16.0
    • Published: 105 days ago (SLA: 90 days)
    • CVSS Score: 6.9
    • CVE: CVE-2026-67321

  10. Allocation of Resources Without Limits or Throttling

  • ID: SNYK-JS-AXIOS-18060804
  • Package: axios@1.16.0
  • Published: 105 days ago (SLA: 90 days)
  • CVSS Score: 6.3
  • CVE: CVE-2026-67318

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:

  • Critical without fixes: 0
  • High without fixes: 2
  • Medium without fixes: 2
  • Low without fixes: 0

❌ BUILD FAILED - Security checks failed

Please review and fix the security vulnerabilities before merging.

@rahul-contentstack @claude
Merge branch 'fix/snyk-patch-deps-20261029' into chore/sync-main-to-s…
2efe4b6 
…taging-20261104

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@rahul-contentstack rahul-contentstack changed the title chore: sync main to staging chore: sync main to staging + Snyk dep fixes (2.4.2) Nov 4, 2026
@github-actions

github-actions Bot commented Nov 4, 2026

Copy link
Copy Markdown

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type Count (with fixes) Without fixes Threshold Result
🔴 Critical Severity 0 0 10 ✅ Passed
🟠 High Severity 0 0 25 ✅ Passed
🟡 Medium Severity 0 0 500 ✅ Passed
🔵 Low Severity 0 0 1000 ✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity Breaches (with fixes) Breaches (no fixes) SLA Threshold (with/no fixes) Status
🔴 Critical 0 0 15 / 30 days ✅ Passed
🟠 High 0 0 30 / 120 days ✅ Passed
🟡 Medium 0 0 90 / 365 days ✅ Passed
🔵 Low 0 0 180 / 365 days ✅ Passed

✅ BUILD PASSED - All security checks passed

@Aravind-Kumar-cstk
Aravind-Kumar-cstk merged commit a42d7a7 into staging Nov 4, 2026
8 checks passed
@Aravind-Kumar-cstk
Aravind-Kumar-cstk deleted the chore/sync-main-to-staging-20261104 branch November 4, 2026 07:32
This was referenced Nov 4, 2026
Closed
Closed
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Aravind-Kumar-cstk Aravind-Kumar-cstk Aravind-Kumar-cstk left review comments

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@rahul-contentstack @Aravind-Kumar-cstk @pradyumna-garg-contentstack @cs-raj