[cs-raj]

Release: development → main

Promotes everything merged to development since the last release (#375). No package version bumps are included.

What's included

#	Change	PR / commits
1	Snyk Code: hardcoded secrets in test fixtures. Dummy values in unit-test fixtures replaced with the approved placeholders from the team's "Standard Approved Dummy Secrets" doc. 184 findings (166 secret, 18 password) → 0. Test files only, no source changes.	#382
2	Snyk dependency fixes (lockfile). pnpm-lock.yaml refreshed; adm-zip now resolves to 0.6.1 only (0.5.18 removed), clearing the adm-zip advisories on 0.5.18.	fa3d78fdc, c87d324cd, b3b07d38f, 708a61d60
3	Release workflow: npm trusted publishing (OIDC). Replaces the NPM_TOKEN-based release-production-plugins.yml with a single release.yml that runs on release: published (Node 24).	#379

1. Placeholder mapping (test files)

Property	Placeholder
apiKey / api_key / stackAPIKey / mockApiKey	API_KEY (STACK_API_KEY where two values must stay distinct)
access_token	ACCESS_TOKEN
auth_token / accessToken	TOKEN
encryptionKey	KEY
password	PASSWORD

48 test files across 13 packages (variants, query-export, asset-management, bootstrap, bulk-operations, clone, content-type, export-to-csv, export, import-setup, import, migrate-rte, seed). Assertions and inputs coupled to the old values were updated with them.

⚠️ Release behavior change

With the new release.yml, merging to main no longer publishes to npm by itself. Publishing now happens when a GitHub release is published. Since no package versions change here, no publish is needed for this merge.

Testing

• Each package's test suite was run before and after the fixture change with identical results (e.g. import 1740, bulk-operations 857, export 513, asset-management 278, seed 121, content-type 78).
• snyk test --code --all-project: only the Medium Path Traversal remains (see below).
• snyk test --all-projects (dependencies): clean except the one advisory below.
• CI green on the merged PRs.

Known / not in this release

• Path Traversal (Medium) in packages/contentstack-asset-management/src/query-export/cs-assets-query-exporter.ts:300: tracked separately, intentionally not changed here.
• adm-zip@0.6.1 advisory SNYK-JS-ADMZIP-21707815 (DX-31190) is still open; no fixed version is available yet.
• .talismanrc carries one new checksum entry for .github/workflows/release.yml (from chore(release): publish to npm with trusted publishing #379).

Jira

• Secret findings: DX-21306 – DX-21489 (184 tickets, in Review)
• adm-zip dependency findings: DX-21491, DX-21492, DX-27782 – DX-27785, DX-30501, DX-10488
• Parent: DX-10317

🤖 Generated with Claude Code

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[github-actions]

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Count (with fixes)	Without fixes	Threshold	Result
🔴 Critical Severity	0	0	10	✅ Passed
🟠 High Severity	0	152	25	✅ Passed
🟡 Medium Severity	0	63	500	✅ Passed
🔵 Low Severity	0	0	1000	✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity	Breaches (with fixes)	Breaches (no fixes)	SLA Threshold (with/no fixes)	Status
🔴 Critical	0	0	15 / 30 days	✅ Passed
🟠 High	0	0	30 / 120 days	✅ Passed
🟡 Medium	0	0	90 / 365 days	✅ Passed
🔵 Low	0	0	180 / 365 days	✅ Passed

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:

• Critical without fixes: 0
• High without fixes: 152
• Medium without fixes: 63
• Low without fixes: 0

✅ BUILD PASSED - All security checks passed