Fixed Security Issues and Workflows by cs-raj · Pull Request #2744 · contentstack/cli

cs-raj · 2026-10-30T05:26:11Z

Release: `development` → `main`

Promotes everything merged to development since the last release. No package version bumps are included.

What's included

#	Change	PR / commits
1	Snyk Code: hardcoded secrets in test fixtures. Dummy values in unit-test fixtures replaced with the approved placeholders from the team's "Standard Approved Dummy Secrets" doc. 15 findings → 5; all 10 test-file findings cleared. Test files only, no source changes.	#2743
2	Snyk dependency fixes (lockfile). `pnpm-lock.yaml` refreshed.	`7fcae91a5`, `b477256bc`
3	Release workflow: npm trusted publishing (OIDC). Replaces the three `release-production-*.yml` workflows and `.github/config/release.json` with a single `release.yml` that runs on `release: published` (Node 24). Follow-ups: publish each cli package in its own step, in the original fixed order.	#2741, `31eec6c22`, `aaa9cd28d`

1. Placeholder mapping (test files)

Property	Placeholder
apiKey	`API_KEY` / `STACK_API_KEY` (kept distinct in `tokens-remove.test.ts`)
access_token	`ACCESS_TOKEN`
password	`PASSWORD`
MFA test secrets (must be valid base32, ≥16 chars)	`SECRETSECRETSECRET` / `TOKENTOKENTOKENTOKEN`

Files: contentstack-auth (tokens-remove.test.ts, mfa-handler.test.ts) and contentstack-utilities (auth-handler.test.ts, logger.test.ts).

⚠️ Release behavior change

With the new release.yml, merging to main no longer publishes to npm by itself. Publishing now happens when a GitHub release is published. Since no package versions change here, no publish is needed for this merge.

Testing

@contentstack/cli-utilities: 199 passing. @contentstack/cli-auth: 41 passing, 4 pending.
snyk test --code --all-project: the 10 test-file findings are gone.
CI green on fix: replace hardcoded secret literals in test fixtures with approved placeholders #2743 (test, lint, SCA, license, policy, CodeQL, GitGuardian).

Known / not in this release

5 Snyk Code findings remain, all in packages/contentstack-utilities/src/, intentionally untouched (changing them needs a design decision, not a placeholder):

encrypter.ts:14 and :27: default encryption key and scrypt salt. Changing either would break decryption of data existing users already have stored.
helpers.ts:119 and :121: error-message label map (api_key: 'Stack API key'); a false positive.
auth-handler.ts:147: http.createServer for the local OAuth callback on localhost; plain HTTP is intentional.

.talismanrc carries the checksum update for the new release.yml (from #2741).

Jira

Fixed (in Review): DX-21248 – DX-21257
Remaining source findings (To Do): DX-21243 – DX-21247
Parent: DX-10317

🤖 Generated with Claude Code

Back merge

Replace the three release-production workflows and release.json with one release.yml that runs on release:published, so the npm trusted publisher can be keyed on the filename. Drop NPM_TOKEN in favour of id-token: write (OIDC), run on Node 24 with npm@latest (trusted publishing needs npm >= 11.5.1), install with a frozen lockfile and check out the release tag without persisted credentials. Each package publishes in dependency order and is skipped when its version is already on npm, so one release publishes only what was bumped. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

cli-config and cli-auth do not depend on each other, so pnpm --sort was free to publish auth before config. List the five packages explicitly in the order the old release workflows used: utilities, command, config, auth, then core. A failed publish still stops the step before the next package. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Give each of the five packages its own publish step, as the old release workflows did, so a failed publish names the package in the Actions run and stops the job before the next one. The order is unchanged: utilities, command, config, auth, core. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Lock file regenerated (fixed 2 on its own: follow-redirects 1.16.0 -> 1.16.2). Direct upgrades: none Overrides: none added (the fast-uri 4.2.3, uuid 14.0.3 and js-yaml 5.5.0 pins are already on this branch) Vuln count vs main: snyk 41 -> 11, npm audit 7 -> 3. Build verified passing. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

chore(release): publish to npm with trusted publishing

… placeholders Replace Snyk-flagged dummy values in unit-test fixtures with the approved placeholders: apiKey -> API_KEY / STACK_API_KEY, access_token -> ACCESS_TOKEN, password -> PASSWORD, MFA test secrets -> SECRET / TOKEN. Coupled assertions updated. Test-only change, plus refreshed pnpm-lock.yaml. No source changes. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

mfa-handler requires >=16 char base32 secrets; the placeholder values were too short and failed CI. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

…-fixtures fix: replace hardcoded secret literals in test fixtures with approved placeholders

snyk-io · 2026-10-30T05:26:23Z

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

github-actions · 2026-10-30T05:26:55Z

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Count (with fixes)	Without fixes	Threshold	Result
🔴 Critical Severity	0	0	10	✅ Passed
🟠 High Severity	0	90	25	✅ Passed
🟡 Medium Severity	1	79	500	✅ Passed
🔵 Low Severity	0	0	1000	✅ Passed

⏱️ SLA Breach Summary

⚠️ Warning: The following vulnerabilities have exceeded their SLA thresholds (days since publication).

Severity	Breaches (no fixes)	SLA Threshold (with/no fixes)	Status
🔴 Critical	0	15 / 30 days	✅ Passed
🟠 High	0	30 / 120 days	✅ Passed
🟡 Medium	1	90 / 365 days	⚠️ Warning
🔵 Low	0	180 / 365 days	✅ Passed

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:

Critical without fixes: 0
High without fixes: 90
Medium without fixes: 79
Low without fixes: 0

⚠️ BUILD PASSED WITH WARNINGS - SLA breaches detected for issues without available fixes

Consider reviewing these vulnerabilities when fixes become available.

cs-raj and others added 10 commits October 22, 2026 16:50

Merge pull request #2738 from contentstack/main

8ae4b0f

Back merge

lock file

b477256

Merge pull request #2741 from contentstack/feat/DX-27614

b13410a

chore(release): publish to npm with trusted publishing

fix: use valid-length base32 secrets in mfa-handler test

b71499d

mfa-handler requires >=16 char base32 secrets; the placeholder values were too short and failed CI. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Merge pull request #2743 from contentstack/fix/hardcoded-secrets-test…

0d2f7ad

…-fixtures fix: replace hardcoded secret literals in test fixtures with approved placeholders

cs-raj requested review from a team as code owners October 30, 2026 05:26

sankartn approved these changes Oct 30, 2026

View reviewed changes

reeshika-h approved these changes Oct 30, 2026

View reviewed changes

dhaval-jain-cstk approved these changes Oct 30, 2026

View reviewed changes

cs-raj changed the title ~~DX | 30-10-2026 | Release~~ Fixed Security Issues and Workflows Oct 30, 2026

cs-raj merged commit 7aa7841 into main Nov 1, 2026
11 checks passed

Navigation Menu

Repository navigation

Fixed Security Issues and Workflows - #2744

Fixed Security Issues and Workflows#2744
cs-raj merged 10 commits into
mainfrom
development

cs-raj commented Oct 30, 2026

Uh oh!

snyk-io Bot commented Oct 30, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 30, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

cs-raj commented Oct 30, 2026

Release: development → main

What's included

1. Placeholder mapping (test files)

⚠️ Release behavior change

Testing

Known / not in this release

Jira

Uh oh!

snyk-io Bot commented Oct 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Snyk checks have passed. No issues have been found so far.

Uh oh!

github-actions Bot commented Oct 30, 2026

🔒 Security Scan Results

⏱️ SLA Breach Summary

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Release: `development` → `main`

snyk-io Bot commented Oct 30, 2026 •

edited

Loading