Fix: junit licence finding via json-simple / vintage engine (Snyk) - v1.0.4

.cursor/rules/README.md

@@ -0,0 +1,5 @@
+# Cursor (optional)
+
+*Cursor* users: start at *[AGENTS.md](../../AGENTS.md)*. All conventions live in **skills/*/SKILL.md**.
+
+This folder only points contributors to *AGENTS.md* so editor-specific config does not duplicate the canonical docs.

.github/workflows/back-merge-pr.yml

@@ -0,0 +1,59 @@
+name: Back-merge main to development
+
+on:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  open-back-merge-pr:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Open back-merge PR if needed
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+        run: |
+          set -euo pipefail
+          BASE_BRANCH="development"
+          SOURCE_BRANCH="main"
+
+          git fetch origin "$BASE_BRANCH" "$SOURCE_BRANCH"
+
+          SOURCE_SHA=$(git rev-parse "origin/$SOURCE_BRANCH")
+          BASE_SHA=$(git rev-parse "origin/$BASE_BRANCH")
+
+          if [ "$SOURCE_SHA" = "$BASE_SHA" ]; then
+            echo "$SOURCE_BRANCH and $BASE_BRANCH are at the same commit; nothing to back-merge."
+            exit 0
+          fi
+
+          EXISTING=$(gh pr list --repo "$REPO" \
+            --base "$BASE_BRANCH" \
+            --head "$SOURCE_BRANCH" \
+            --state open \
+            --json number \
+            --jq 'length')
+
+          if [ "$EXISTING" -gt 0 ]; then
+            echo "An open PR from $SOURCE_BRANCH to $BASE_BRANCH already exists; skipping."
+            exit 0
+          fi
+
+          gh pr create --repo "$REPO" \
+            --base "$BASE_BRANCH" \
+            --head "$SOURCE_BRANCH" \
+            --title "chore: back-merge main into development" \
+            --body "Automated back-merge after changes landed on \`main\`. Review and merge to keep \`development\` in sync."
+
+          echo "Created back-merge PR $SOURCE_BRANCH -> $BASE_BRANCH."

.github/workflows/check-version-bump.yml

@@ -0,0 +1,110 @@
+name: Check Version Bump
+
+on:
+  pull_request:
+
+jobs:
+  version-bump:
+    name: Version & Changelog bump
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Detect changed files and version bump
+        id: detect
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: |
+          set -euo pipefail
+          FILES=$(git diff --name-only "$BASE_SHA" "$HEAD_SHA")
+
+          VERSION_FILES_CHANGED=false
+          echo "$FILES" | grep -qx 'pom.xml' && VERSION_FILES_CHANGED=true
+          echo "$FILES" | grep -qE '^changelog\.md$|^CHANGELOG\.md$|^CHANGELOG\.MD$' && VERSION_FILES_CHANGED=true
+          echo "version_files_changed=$VERSION_FILES_CHANGED" >> "$GITHUB_OUTPUT"
+
+          CODE_CHANGED=false
+          echo "$FILES" | grep -qE '^src/|^pom.xml' && CODE_CHANGED=true
+          echo "code_changed=$CODE_CHANGED" >> "$GITHUB_OUTPUT"
+
+      - name: Skip when only test/docs/.github changed
+        if: steps.detect.outputs.code_changed != 'true'
+        run: |
+          echo "No release-affecting files changed (e.g. only test/docs/.github). Skipping version-bump check."
+          exit 0
+
+      - name: Fail when version bump was missed
+        if: steps.detect.outputs.code_changed == 'true' && steps.detect.outputs.version_files_changed != 'true'
+        run: |
+          echo "::error::This PR has code changes but no version bump. Please bump the version in pom.xml and add an entry in changelog.md."
+          exit 1
+
+      - name: Set up Java
+        if: steps.detect.outputs.code_changed == 'true' && steps.detect.outputs.version_files_changed == 'true'
+        uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: '11'
+
+      - name: Check version bump
+        if: steps.detect.outputs.code_changed == 'true' && steps.detect.outputs.version_files_changed == 'true'
+        run: |
+          set -euo pipefail
+
+          POM_VERSION=$(python3 - <<'PYV'
+import xml.etree.ElementTree as ET
+root = ET.parse("pom.xml").getroot()
+ns = {"m":"http://maven.apache.org/POM/4.0.0"}
+ver = root.find("m:version", ns)
+if ver is None:
+    parent = root.find("m:parent", ns)
+    ver = parent.find("m:version", ns) if parent is not None else None
+print((ver.text if ver is not None else "").strip())
+PYV
+)
+
+          POM_VERSION="${POM_VERSION#v}"
+          POM_VERSION="${POM_VERSION%%-*}"
+          if [ -z "$POM_VERSION" ]; then
+            echo "::error::Could not read version from pom.xml"
+            exit 1
+          fi
+
+          git fetch --tags --force 2>/dev/null || true
+          LATEST_TAG=$(git describe --tags --abbrev=0 2>/dev/null || true)
+          if [ -z "$LATEST_TAG" ]; then
+            echo "No existing tags found. Skipping version-bump check (first release)."
+            exit 0
+          fi
+
+          LATEST_VERSION="${LATEST_TAG#v}"
+          LATEST_VERSION="${LATEST_VERSION%%-*}"
+          if [ "$(printf '%s\n' "$LATEST_VERSION" "$POM_VERSION" | sort -V | tail -1)" != "$POM_VERSION" ]; then
+            echo "::error::Version bump required: pom.xml version ($POM_VERSION) is not greater than latest tag ($LATEST_TAG). Please bump the version in pom.xml."
+            exit 1
+          fi
+          if [ "$POM_VERSION" = "$LATEST_VERSION" ]; then
+            echo "::error::Version bump required: pom.xml version ($POM_VERSION) equals latest tag ($LATEST_TAG). Please bump the version in pom.xml."
+            exit 1
+          fi
+
+          CHANGELOG_FILE="changelog.md"
+          if [ ! -f "$CHANGELOG_FILE" ] && [ -f "CHANGELOG.md" ]; then
+            CHANGELOG_FILE="CHANGELOG.md"
+          fi
+
+          CHANGELOG_VERSION=$(sed -nE 's/^####[[:space:]]+v?([0-9]+\.[0-9]+\.[0-9]+).*/\1/p' "$CHANGELOG_FILE" | head -1)
+          if [ -z "$CHANGELOG_VERSION" ]; then
+            echo "::error::Could not find a version entry in $CHANGELOG_FILE (expected line like '#### v1.0.0')."
+            exit 1
+          fi
+          if [ "$CHANGELOG_VERSION" != "$POM_VERSION" ]; then
+            echo "::error::CHANGELOG version mismatch: $CHANGELOG_FILE top version ($CHANGELOG_VERSION) does not match pom.xml version ($POM_VERSION). Please add or update the changelog entry for $POM_VERSION."
+            exit 1
+          fi
+
+          echo "Version bump check passed: pom.xml and $CHANGELOG_FILE are at $POM_VERSION (latest tag: $LATEST_TAG)."

.github/workflows/maven.yml

@@ -18,6 +18,8 @@ jobs:
   build:
 
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
 
     steps:
     - uses: actions/checkout@v3

AGENTS.md

@@ -0,0 +1,48 @@
+# Contentstack Marketplace Java SDK – Agent guide
+
+*Universal entry point* for contributors and AI agents. Detailed conventions live in **skills/*/SKILL.md**.
+
+## What this repo is
+
+| Field | Detail |
+| --- | --- |
+| *Name:* | [contentstack/contentstack-marketplace-java](https://github.com/contentstack/contentstack-marketplace-java) |
+| *Purpose:* | Java SDK for the Contentstack Marketplace API: apps, authorizations, installations, and related resources (Retrofit-based HTTP client). |
+| *Out of scope (if any):* | Not a general Contentstack Delivery or Management SDK; Marketplace API only. No Kotlin-first API surface (Kotlin stdlib is a transitive dependency). |
+
+## Tech stack (at a glance)
+
+| Area | Details |
+| --- | --- |
+| Language | Java 8 (compiler `source`/`target` in `pom.xml`; CI uses JDK 11). Lombok for generated code. |
+| Build | Maven — `pom.xml`; artifact `com.contentstack.sdk:marketplace`. |
+| Tests | JUnit 5 (and Vintage for legacy tests) — `src/test/java/**`. |
+| Lint / coverage | Compiler warnings (`-Xlint` in `maven-compiler-plugin`); JaCoCo (`target/site/jacoco/index.html` after tests). Optional JetBrains Qodana JVM — `qodana.yaml`. |
+| Other | HTTP: Retrofit 2, OkHttp, Gson. `README.md` for end-user install and usage. |
+
+## Commands (quick reference)
+
+| Command Type | Command |
+| --- | --- |
+| Build | `mvn -B package --file pom.xml` |
+| Test | `mvn test` |
+| Lint | No separate CLI lint target; use compiler warnings during `mvn compile` / `mvn package`, JaCoCo report after `mvn test`, or Qodana locally/CI per `qodana.yaml`. |
+
+CI: GitHub Actions — `.github/workflows/maven.yml` (`mvn -B package --file pom.xml` on push/PR to `main`).
+
+## Where the documentation lives: skills
+
+| Skill | Path | What it covers |
+| --- | --- | --- |
+| Dev workflow | [skills/dev-workflow/SKILL.md](skills/dev-workflow/SKILL.md) | Branches, CI, build/test, release notes |
+| Marketplace SDK API | [skills/contentstack-marketplace-sdk/SKILL.md](skills/contentstack-marketplace-sdk/SKILL.md) | Public API, `Marketplace` builder, domains (apps, auths, installations) |
+| Java layout & conventions | [skills/java/SKILL.md](skills/java/SKILL.md) | Package layout, Java/Lombok usage in this repo |
+| Testing | [skills/testing/SKILL.md](skills/testing/SKILL.md) | Test layout, `TestClient`, env / credentials |
+| Code review | [skills/code-review/SKILL.md](skills/code-review/SKILL.md) | PR checklist for this SDK |
+| Framework & HTTP | [skills/framework-and-http/SKILL.md](skills/framework-and-http/SKILL.md) | Retrofit `Client`, Gson, base URLs, extension points |
+
+An index with "when to use" hints is in [skills/README.md](skills/README.md).
+
+## Using Cursor (optional)
+
+If you use *Cursor*, [.cursor/rules/README.md](.cursor/rules/README.md) only points to *AGENTS.md*—same docs as everyone else.

LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2012 - 2025 Contentstack
+Copyright (c) 2012 - 2026 Contentstack
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

changelog.md

@@ -2,6 +2,10 @@
 
 A brief description of what changes project contains
 
+#### v1.0.4
+
+- Fixed snyk issue: excluded the vulnerable transitive `junit:junit` 4.10 (CVE-2020-15250) that `json-simple` declares as a compile dependency, and removed the unused `junit-vintage-engine` test dependency (tests migrated to JUnit Jupiter assertions)
+
 #### v1.0.3
 
 - Fixed snyk issues

pom.xml

@@ -5,7 +5,7 @@
     <modelVersion>4.0.0</modelVersion>
     <groupId>com.contentstack.sdk</groupId>
     <artifactId>marketplace</artifactId>
-    <version>1.0.3</version>
+    <version>1.0.4</version>
     <name>Contentstack Marketplace Java SDK</name>
     <description>Contentstack Java Management SDK for Content Management API</description>
     <url>https://github.com/contentstack/contentstack-management-java/</url>
@@ -20,16 +20,15 @@
         <maven-javadoc-plugin.version>3.4.1</maven-javadoc-plugin.version>
         <dotenv-source.version>5.2.2</dotenv-source.version>
         <rxjava-source.version>3.1.6</rxjava-source.version>
-        <retrofit-source.version>2.10.0</retrofit-source.version>
-        <converter-gson-version>2.10.0</converter-gson-version>
-        <okhttp.version>4.12.0</okhttp.version>
-        <okio.version>3.4.0</okio.version>
+        <retrofit-source.version>3.0.0</retrofit-source.version>
+        <converter-gson-version>3.0.0</converter-gson-version>
+        <okhttp.version>5.1.0</okhttp.version>
+        <okio.version>3.9.1</okio.version>
         <logging.version>4.10.0</logging.version>
         <jococo-plugin.version>0.8.7</jococo-plugin.version>
         <lombok-source.version>1.18.36</lombok-source.version>
         <junit-jupiter.version>5.8.0</junit-jupiter.version>
         <junit-jupiter-engine.version>5.8.0-M1</junit-jupiter-engine.version>
-        <junit-vintage-engine.version>5.8.0</junit-vintage-engine.version>
         <gson.version>2.10.1</gson.version>
         <maven-site-plugin.version>4.0.0-M9</maven-site-plugin.version>
         <maven-gpg-plugin.version>3.1.0</maven-gpg-plugin.version>
@@ -125,6 +124,12 @@
             <artifactId>okhttp</artifactId>
             <version>${okhttp.version}</version>
         </dependency>
+        <!-- OkHttp 5+: the okhttp artifact is a stub on Maven; JVM classes ship in okhttp-jvm -->
+        <dependency>
+            <groupId>com.squareup.okhttp3</groupId>
+            <artifactId>okhttp-jvm</artifactId>
+            <version>${okhttp.version}</version>
+        </dependency>
         <dependency>
             <groupId>com.squareup.okio</groupId>
             <artifactId>okio</artifactId>
@@ -154,22 +159,23 @@
             <version>${junit-jupiter.version}</version>
             <scope>test</scope>
         </dependency>
-        <dependency>
-            <groupId>org.junit.vintage</groupId>
-            <artifactId>junit-vintage-engine</artifactId>
-            <version>${junit-vintage-engine.version}</version>
-            <scope>test</scope>
-        </dependency>
         <dependency>
             <groupId>com.googlecode.json-simple</groupId>
             <artifactId>json-simple</artifactId>
             <version>1.1.1</version>
             <scope>compile</scope>
+            <exclusions>
+                <!-- json-simple declares junit 4.10 as a compile dependency (CVE-2020-15250); it is not needed at runtime -->
+                <exclusion>
+                    <groupId>junit</groupId>
+                    <artifactId>junit</artifactId>
+                </exclusion>
+            </exclusions>
         </dependency>
        <dependency>
             <groupId>org.jetbrains.kotlin</groupId>
             <artifactId>kotlin-stdlib</artifactId>
-            <version>2.1.0</version>
+            <version>2.2.0</version>
         </dependency>
     </dependencies>
 
@@ -225,6 +231,7 @@
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-javadoc-plugin</artifactId>
+                <version>${maven-javadoc-plugin.version}</version>
                 <configuration>
                     <source>8</source>
                 </configuration>

skills/README.md

@@ -0,0 +1,16 @@
+# Skills – Contentstack Marketplace Java SDK
+
+Source of truth for detailed guidance. Read [AGENTS.md](../AGENTS.md) first, then open the skill that matches your task.
+
+## When to use which skill
+
+| Skill folder | Use when |
+| --- | --- |
+| [dev-workflow](dev-workflow/) | Branching, CI, local build/test commands, releases |
+| [contentstack-marketplace-sdk](contentstack-marketplace-sdk/) | `Marketplace` API surface, apps/auths/installations, versioning |
+| [java](java/) | Package structure, Java 8/Lombok patterns in this codebase |
+| [testing](testing/) | Writing or running tests, fixtures, `.env` / secrets |
+| [code-review](code-review/) | Reviewing or preparing PRs for this repository |
+| [framework-and-http](framework-and-http/) | Retrofit, OkHttp, Gson, `Client` and HTTP boundaries |
+
+Each folder contains `SKILL.md` with YAML frontmatter (`name`, `description`).

skills/code-review/SKILL.md

@@ -0,0 +1,42 @@
+---
+name: code-review
+description: Use when reviewing pull requests or preparing changes for review in this SDK repository.
+---
+
+# Code review – Contentstack Marketplace Java SDK
+
+## When to use
+
+- Reviewing a PR for correctness, API safety, and consistency
+- Self-review before requesting reviewers
+
+## Instructions
+
+### Blocker
+
+- Breaking changes to public **`Marketplace`** or domain types without version/changelog strategy and maintainer agreement.
+- Committed secrets, real org tokens, or `.env` files with live credentials.
+- New HTTP clients that bypass **`com.contentstack.sdk.Client`** without rationale (duplicated base URLs, converters).
+
+### Major
+
+- Missing or misleading Javadoc on new public methods/classes.
+- Tests absent for non-trivial new behavior (happy path at minimum).
+- Null/empty handling inconsistent with existing `Builder` and service patterns.
+- Compiler warnings introduced without justification.
+
+### Minor
+
+- Naming or package placement inconsistent with `com.contentstack.sdk.marketplace` structure.
+- Typos in user-facing Javadoc or `README.md` when behavior changes.
+
+### Quick checklist
+
+- [ ] `mvn -B package` succeeds locally.
+- [ ] Public API changes reflected in `README.md` or Javadoc where users look first.
+- [ ] Tests updated; integration tests respect env-based credentials ([../testing/SKILL.md](../testing/SKILL.md)).
+
+## References
+
+- [../contentstack-marketplace-sdk/SKILL.md](../contentstack-marketplace-sdk/SKILL.md)
+- [../testing/SKILL.md](../testing/SKILL.md)