DX-20927 | Back-merge master into development (reconcile rewritten history) - #314
Open
reeshika-h wants to merge 319 commits into
Open
reeshika-h wants to merge 319 commits into
reeshika-h wants to merge 319 commits into
Conversation
Fix/dx 2373 skips single item
- Introduced SanityReport class to generate test summaries and send reports to Slack. - Updated logging in CSHttpConnection to use logger instead of printStackTrace. - Modified error handling in Entry class to check for empty error messages. - Updated dependency versions in pom.xml and added new dependencies. - Added test configuration properties to .gitignore. - Created send-report.sh script for running tests and sending reports.
…remove disabled test for asset URL update
…ests in TestLivePreview and TestStack
Fixed testcase assertions to be env agnostic
Update version to 2.1.1 and updated changelog
Development
back merge
Update branch restrictions in PR workflow and add Talisman configuration
DX | 19-05-2025 | Release
…nv for environment variables
Fix workflow
back merge
back merge
chore: back-merge master into development
fix: update version to 2.7.2 and add Snyk fixes to CHANGELOG
back merge
…anch headers Addresses Copilot review on PR #295: - Guard variants(String) and variants(String[]) against null input - Treat whitespace-only variant/branch as blank via trim().isEmpty() - Join multi-variant header with "," for consistency with other SDK headers Blank input intentionally skips (does not remove) the header: headers are a shared Stack-level map, so remove() would clear the header for sibling Entry/Query objects and the Stack-level default. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…-support Add variant and branch support in Entry and Query APIs
DX | 20-07-2026 | Release
…odel Snyk Code flagged publish_details "user" test-fixture fields as hardcoded credentials (CWE-798). These are non-secret string values used only to populate mock JSON payloads, so add deepcode ignore annotations instead of leaving unscoped comments.
jsoup 1.22.x is pulled in transitively via com.contentstack.sdk:utils and is flagged by Snyk for a Cross-site Scripting (XSS) issue, fixed in 1.23.1. Pin the version in dependencyManagement following the existing pattern used for other contentstack-utils transitive deps.
fix: suppress Snyk hardcoded-credential false positives in tests
fix: pin jsoup to 1.23.1 to resolve XSS vulnerability
…nerability jsoup is pulled in transitively via com.contentstack.sdk:utils and is flagged by Snyk (CVE-2026-75140) for unbounded memory growth in XmlTreeBuilder's namespace scope tracking. Fixed upstream in 1.23.2 via a rewritten NamespaceBindings scope tracker. Bump the dependencyManagement pin following the existing pattern used for other contentstack-utils transitive deps. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
fix: bump jsoup pin to 1.23.2 to resolve Snyk resource allocation vulnerability
The secret-removal history rewrite on master left development on the old, pre-rewrite commit SHAs. Every development-only commit is a content-identical copy of a master commit (same tree and message, only the GPG signature differs), so this merge records development as a parent while keeping master's tree unchanged. That gives the two branches a shared merge-base again. Refs DX-20927 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
Contributor
Author
|
|
🔒 Security Scan Results
⏱️ SLA Breach Summary
ℹ️ Vulnerabilities Without Available Fixes (Informational Only)The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:
✅ BUILD PASSED - All security checks passed |
aniket-shikhare-cstk
approved these changes
Sep 24, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
8 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The secret-removal history rewrite on
masterchanged its commit SHAs, whiledevelopmentstayed on the old pre-rewrite commits. The two branches' last shared commit is now from Oct 2024, and GitHub shows master 318 ahead / 307 behind.What this does
I checked every
development-only commit: each is a content-identical copy of a master commit (same tree and same message; only the GPG signature was dropped by the rewrite).developmenthas no unique changes.This branch is
master+ a merge ofdevelopmentusing theoursstrategy:developmentbecomes a parent again, so the branches share a merge-base and future back-merges/releases are normal.development, the diff is only master's new changes (jsoup fixes, version/changelog, CODEOWNERS, workflows).Note: after the next release, the ~307 old duplicate commits will show up in master's history. They contain no secrets (a gitleaks scan of the development-only range found nothing).
Jira: DX-20927
🤖 Generated with Claude Code