Skip to content

Fix: junit licence finding via json-simple / vintage engine (Snyk) - v1.0.4 - #55

Merged
reeshika-h merged 13 commits into
mainfrom
fix/snyk-java-deps-and-credentials
Nov 3, 2026
Merged

Fix: junit licence finding via json-simple / vintage engine (Snyk) - v1.0.4#55
reeshika-h merged 13 commits into
mainfrom
fix/snyk-java-deps-and-credentials

Conversation

@reeshika-h

@reeshika-h reeshika-h commented Oct 26, 2026

Copy link
Copy Markdown
Contributor

Summary

Resolves DX-4814 (the junit finding that arrived via the test-scoped vintage engine and json-simple), v1.0.4.

  • Removed the unused junit-vintage-engine (test scope) and moved InstallationUnitTests to Jupiter's Assertions.
  • Excluded junit:junit from the json-simple dependency (it declares junit 4.10 as a compile dependency; it is not needed at runtime).

Verification

  • snyk test: 1 → 0.
  • Tests: 81/81 pass (same as baseline). The full suite was run before the final version/changelog edits, which do not touch code.

🤖 Generated with Claude Code

harshithad0703 and others added 10 commits November 4, 2025 15:38
@harshithad0703
Merge pull request #50 from contentstack/main
18f4b0a 
back merge
@reeshika-h
Add agent guide and skills documentation
595ac59
@reeshika-h
license updated
c80c252
@reeshika-h
Update dependencies in pom.xml: upgrade Retrofit, Gson, OkHttp, and K…
0484b1c 
…otlin versions; add okhttp-jvm dependency.
@reeshika-h
Merge pull request #51 from contentstack/DX-5384-cursor
f17cd8b 
Add agent guide and skills documentation
@harshithad0703
chore: align release workflows with new development-to-main process
18fd59a
@harshithad0703
Merge pull request #52 from contentstack/enh/dx-6968-new-release-process
5fe8794 
chore: align release workflows with new development-to-main process
@reeshika-h @claude
Merge development into back-merge/DX-20927
63520bf 
Brings back-merge branch up to date with development so main can be back-merged cleanly (DX-20927).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@cs-raj
Merge pull request #54 from contentstack/back-merge/DX-20927
1ceef44 
DX-20927 | Back-merge main into development
@reeshika-h @claude
Fix: exclude leaked junit from json-simple; drop vintage engine
8bcb745 
Remove unused junit-vintage-engine (test scope), exclude junit from json-simple; v1.0.4.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
@reeshika-h
reeshika-h requested a review from a team as a code owner October 26, 2026 10:56
@snyk-io

snyk-io Bot commented Oct 26, 2026 •
edited
Loading

Copy link
Copy Markdown

✅ Snyk checks have passed. No issues have been found so far.

Status Scan Engine Critical High Medium Low Total (0)
✅ Open Source Security 0 0 0 0 0 issues
✅ Licenses 0 0 0 0 0 issues
✅ Code Security 0 0 0 0 0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

@github-actions

github-actions Bot commented Oct 26, 2026

Copy link
Copy Markdown

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type Count (with fixes) Without fixes Threshold Result
🔴 Critical Severity 0 0 10 ✅ Passed
🟠 High Severity 0 0 25 ✅ Passed
🟡 Medium Severity 0 0 500 ✅ Passed
🔵 Low Severity 0 0 1000 ✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity Breaches (with fixes) Breaches (no fixes) SLA Threshold (with/no fixes) Status
🔴 Critical 0 0 15 / 30 days ✅ Passed
🟠 High 0 0 30 / 120 days ✅ Passed
🟡 Medium 0 0 90 / 365 days ✅ Passed
🔵 Low 0 0 180 / 365 days ✅ Passed

✅ BUILD PASSED - All security checks passed

@reeshika-h
reeshika-h changed the base branch from development to main November 2, 2026 05:56
@reeshika-h
reeshika-h requested a review from a team as a code owner November 2, 2026 05:56
@github-actions

github-actions Bot commented Nov 2, 2026

Copy link
Copy Markdown

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type Count (with fixes) Without fixes Threshold Result
🔴 Critical Severity 0 0 10 ✅ Passed
🟠 High Severity 0 0 25 ✅ Passed
🟡 Medium Severity 0 0 500 ✅ Passed
🔵 Low Severity 0 0 1000 ✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity Breaches (with fixes) Breaches (no fixes) SLA Threshold (with/no fixes) Status
🔴 Critical 0 0 15 / 30 days ✅ Passed
🟠 High 0 0 30 / 120 days ✅ Passed
🟡 Medium 0 0 90 / 365 days ✅ Passed
🔵 Low 0 0 180 / 365 days ✅ Passed

✅ BUILD PASSED - All security checks passed

@reeshika-h @claude
ci: grant contents write to the build job for dependency submission
c0f5a9b 
The "Update dependency graph" step submits a snapshot to the GitHub
dependency graph and fails with HTTP 403 "Resource not accessible by
integration" because the token is read-only. The submission action needs
contents: write, so declare it on the job.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
@github-actions

github-actions Bot commented Nov 2, 2026

Copy link
Copy Markdown

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type Count (with fixes) Without fixes Threshold Result
🔴 Critical Severity 0 0 10 ✅ Passed
🟠 High Severity 0 0 25 ✅ Passed
🟡 Medium Severity 0 0 500 ✅ Passed
🔵 Low Severity 0 0 1000 ✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity Breaches (with fixes) Breaches (no fixes) SLA Threshold (with/no fixes) Status
🔴 Critical 0 0 15 / 30 days ✅ Passed
🟠 High 0 0 30 / 120 days ✅ Passed
🟡 Medium 0 0 90 / 365 days ✅ Passed
🔵 Low 0 0 180 / 365 days ✅ Passed

✅ BUILD PASSED - All security checks passed

cs-raj
cs-raj previously approved these changes Nov 2, 2026
View reviewed changes
@reeshika-h @claude
ci: pass GitHub context to run steps via env vars to avoid script inj…
897dcc6 
…ection

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
@github-actions

github-actions Bot commented Nov 2, 2026

Copy link
Copy Markdown

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type Count (with fixes) Without fixes Threshold Result
🔴 Critical Severity 0 0 10 ✅ Passed
🟠 High Severity 0 0 25 ✅ Passed
🟡 Medium Severity 0 0 500 ✅ Passed
🔵 Low Severity 0 0 1000 ✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity Breaches (with fixes) Breaches (no fixes) SLA Threshold (with/no fixes) Status
🔴 Critical 0 0 15 / 30 days ✅ Passed
🟠 High 0 0 30 / 120 days ✅ Passed
🟡 Medium 0 0 90 / 365 days ✅ Passed
🔵 Low 0 0 180 / 365 days ✅ Passed

✅ BUILD PASSED - All security checks passed

@reeshika-h
reeshika-h merged commit 02c87b7 into main Nov 3, 2026
8 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@cs-raj cs-raj cs-raj approved these changes
@dhaval-jain-cstk dhaval-jain-cstk dhaval-jain-cstk approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@reeshika-h @cs-raj @dhaval-jain-cstk @harshithad0703