release: v4.6.0 (develop_v4 to stage_v4) by hitesh-shetty-cstk · Pull Request #674 · contentstack/live-preview-sdk

hitesh-shetty-cstk · 2026-10-29T13:19:16Z

Live Preview SDK v4.6.0

Summary

The Visual Builder canvas toolbar now shows an Edit button for Select, Taxonomy, Boolean and entry tags fields, and the SDK tells the editor when the entries on the page change.

This PR merges develop_v4 into stage_v4 and adds the release commits. stage_v4 only accepts changes through a PR, so this branch replaces the local merge and push.

What's changed

Features

Select fields: edit Select fields from the canvas toolbar. (feat(visual-builder): edit Select fields from the canvas toolbar #668)
Taxonomy fields: Taxonomy fields get the whole-field toolbar with an Edit button, and the add buttons explain what they do. (feat(field-toolbar): show the Edit button for Taxonomy fields on the canvas toolbar #669)
Entry tags: edit entry tags from the canvas toolbar. (feat(visual-builder): edit entry tags from the canvas toolbar #670)
Boolean fields: show the Edit button for Boolean fields. (feat(field-toolbar): show the Edit button for Boolean fields #671)
Entries on the page: notify the editor when the entries rendered on the page change. (feat(visual-builder): notify the editor when the entries on the page change #662)

Fixes

Bump dompurify to patch a DOM XSS advisory. (fix(security): bump dompurify to patch DOM XSS advisory #660)

Refactoring

Split isEditedAsOneValue into isMultipleSelect and isTaxonomyField.

Tests

Toolbar tests for the new field types. Removed Boolean tests that other toolbar tests already cover.

Chores

Version bump to 4.6.0. CHANGELOG regenerated with auto-changelog.
README CDN snippet pinned to @contentstack/live-preview-utils@4.6.0.

Commits on this branch

Merge branch 'develop_v4' into stage_v4 for v4.6.0 release (no conflicts)
4.6.0: package.json, package-lock.json, CHANGELOG.md
fix: update CDN version to 4.6.0 in README

No tag was pushed. The GitHub Release creates v4.6.0.

Release checklist

Merge this PR into stage_v4 with a merge commit
Open and merge the stage_v4 to main PR
Create GitHub Release v4.6.0 from main (the Release UI creates the tag and runs the npm-publish workflow)
Check that @contentstack/live-preview-utils@4.6.0 is on npm
Check that https://esm.sh/@contentstack/live-preview-utils@4.6.0 resolves
Sync main back into develop_v4

🤖 Generated with Claude Code

release: v4.5.3

Bumps dompurify from 3.4.13/3.4.14 to 3.4.16 (direct dependency) in package.json and package-lock.json, resolving a Snyk-reported Cross-site Scripting (XSS) advisory in dompurify. Co-Authored-By: Claude <noreply@anthropic.com>

…662) * feat(VB-2354): notify the editor when the entries on the page change (#648) * feat: notify the editor when the entries on the page change Send entries-in-page-changed once the builder is ready and again from the body MutationObserver whenever the entry+locale set on the page changes, so the editor can react to late-rendered references without polling. Dedup the page scan by entry and locale. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * refactor: rename the push event to entries-in-current-page-changed Matches the noun of get-entries-in-current-page and the past-tense form the other push events use. Settled before release since the string is the wire contract on a pinned SDK. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix: notify entry changes when data-cslp is rewritten in place The page observer only watched childList, so a framework re-render that keeps the node and swaps its data-cslp (variant switch, re-keyed list) never pushed the new entry set. Watch that one attribute too. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix: keep get-entries-in-current-page deduped by entry uid The first cut keyed the page scan by entry+locale, which changed what existing callers of the request receive. An entry renders in one locale per page, so key by uid again and let the push send the same object. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix: report an empty entry set on the first page scan The initial signature was "", the same as an empty page, so a page with no data-cslp elements never sent the opening event. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * test: expect the entries-in-current-page-changed event on builder init The builder now reports an empty entry set on the first scan, so the init test sees one more post message. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com> * fix(visual-builder): recover when the editor misses the entries push The push had no rejection handler, so an editor without the listener left an unhandled rejection on every send and the set was never resent. The failed signature now resets so the next observer pass retries, and destroy() cancels the pending debounced pass. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>

fix(security): bump dompurify to patch DOM XSS advisory

* feat(select-edit): classify number-typed dropdowns as Select Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat(select-edit): show the Edit button for Select fields Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat(select-edit): hide add-value buttons on multiple Select fields Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(select-edit): send whole-field metadata when editing a multiple Select A value click on a multiple Select opened the modal at the value's index, so the saved value landed inside the array instead of replacing it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0195ab4j6aVrXMYw6Dm6Nndx --------- Co-authored-by: Claude <noreply@anthropic.com>

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PhGzeBieWdXYBvXLHnWDDf

…ct and isTaxonomyField

…olbar tests Note why Select skips canvas add buttons while Taxonomy keeps them, and that Taxonomy is always multiple. Drop a duplicate Edit button test, keep the Taxonomy test setup at the top of its block, and cover a Taxonomy inside a modular block keeping its parent index on Edit. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PhGzeCtGiaD8r2BWLkqEWx

…utton feat(field-toolbar): show the Edit button for Taxonomy fields on the canvas toolbar

* feat(visual-builder): add tags field type and Edit button Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WR1cdspQX3zgyjf5NZhSsa * feat(visual-builder): edit entry tags as one field from the toolbar Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WR1cdspQX3zgyjf5NZhSsa * fix(visual-builder): use the Venus tag icon for the tags field Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WR1cdtPR9Cyz2DQKRoMFCJ --------- Co-authored-by: Claude <noreply@anthropic.com>

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YU96SVM9VXkfjSbSeoFdZ4

…ady cover Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YU96SUpGdU5NuSX7N5UsA5

feat(field-toolbar): show the Edit button for Boolean fields

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

snyk-io · 2026-10-29T13:19:34Z

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

github-actions · 2026-10-29T13:19:56Z

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Count (with fixes)	Threshold	Result
🔴 Critical Severity	2	10	✅ Passed
🟠 High Severity	2	25	✅ Passed
🟡 Medium Severity	1	500	✅ Passed
🔵 Low Severity	1	1000	✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity	SLA Threshold (with/no fixes)	Status
🔴 Critical	15 / 30 days	✅ Passed
🟠 High	30 / 120 days	✅ Passed
🟡 Medium	90 / 365 days	✅ Passed
🔵 Low	180 / 365 days	✅ Passed

✅ BUILD PASSED - All security checks passed

github-actions · 2026-10-29T13:26:14Z

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	68.72%	2597 / 3779
🔵	Statements	67.6%	2640 / 3905
🔵	Functions	66.28%	468 / 706
🔵	Branches	63.07%	1573 / 2494

File Coverage

File	Stmts	Branches	Functions	Lines	Uncovered Lines
Changed Files
src/visualBuilder/index.ts	61.22%	33.33%	44.44%	60.95%	105-111, 115-118, 123-132, 138-208, 259-272, 275, 286-307, 361-363, 367, 426-429
src/visualBuilder/components/FieldToolbar.tsx	70.76%	71.84%	57.14%	70.76%	67-94, 105-112, 181-182, 232-248, 312-319, 350-356, 366, 370, 423-427, 446
src/visualBuilder/components/icons/fields/index.ts	100%	100%	100%	100%
src/visualBuilder/generators/generateCustomCursor.ts	100%	80%	100%	100%
src/visualBuilder/utils/constants.ts	100%	100%	100%	100%
src/visualBuilder/utils/getEntryIdentifiersInCurrentPage.ts	100%	100%	100%	100%
src/visualBuilder/utils/getFieldType.ts	96%	97.14%	100%	100%	5
src/visualBuilder/utils/handleIndividualFields.ts	100%	85%	100%	100%

Generated in workflow #957 for commit b732cd8 by the Vitest Coverage Report Action

sairaj-cs

LGTM

karancs06 and others added 18 commits September 29, 2026 14:43

Merge pull request #659 from contentstack/stage_v4

03a99ca

release: v4.5.3

fix(security): bump dompurify to patch DOM XSS advisory

eb53cc9

Bumps dompurify from 3.4.13/3.4.14 to 3.4.16 (direct dependency) in package.json and package-lock.json, resolving a Snyk-reported Cross-site Scripting (XSS) advisory in dompurify. Co-Authored-By: Claude <noreply@anthropic.com>

Merge branch 'develop_v4' into fix/dompurify-xss

01fd725

Merge pull request #660 from contentstack/fix/dompurify-xss

f3e2ffe

fix(security): bump dompurify to patch DOM XSS advisory

feat(field-toolbar): show the Edit button for Taxonomy fields

e5175f4

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PhGzeBieWdXYBvXLHnWDDf

feat(field-toolbar): give Taxonomy fields the whole-field toolbar

a84b2c2

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PhGzeBieWdXYBvXLHnWDDf

refactor(field-toolbar): split isEditedAsOneValue into isMultipleSele…

9b34a1d

…ct and isTaxonomyField

Merge pull request #669 from contentstack/agent/taxonomy-field-edit-b…

ab49ee5

…utton feat(field-toolbar): show the Edit button for Taxonomy fields on the canvas toolbar

feat(field-toolbar): show the Edit button for Boolean fields

60fbed8

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YU96SVM9VXkfjSbSeoFdZ4

test(field-toolbar): drop Boolean tests that other toolbar tests alre…

88b0ee2

…ady cover Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YU96SUpGdU5NuSX7N5UsA5

Merge pull request #671 from contentstack/agent/boolean-edit-button

28f24be

feat(field-toolbar): show the Edit button for Boolean fields

Merge branch 'develop_v4' into stage_v4 for v4.6.0 release

b04d5d7

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

4.6.0

da007ae

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

fix: update CDN version to 4.6.0 in README

b732cd8

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

hitesh-shetty-cstk requested a review from a team as a code owner October 29, 2026 13:19

sairaj-cs approved these changes Oct 30, 2026

View reviewed changes

karancs06 merged commit 0a499cb into stage_v4 Oct 30, 2026
10 checks passed

karancs06 deleted the release-v4.6.0 branch October 30, 2026 05:36

Navigation Menu

Repository navigation

release: v4.6.0 (develop_v4 to stage_v4) - #674

release: v4.6.0 (develop_v4 to stage_v4)#674
karancs06 merged 18 commits into
stage_v4from
release-v4.6.0

hitesh-shetty-cstk commented Oct 29, 2026

Uh oh!

snyk-io Bot commented Oct 29, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 29, 2026

Uh oh!

github-actions Bot commented Oct 29, 2026

Uh oh!

sairaj-cs left a comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

Conversation

hitesh-shetty-cstk commented Oct 29, 2026

Live Preview SDK v4.6.0

Summary

What's changed

Features

Fixes

Refactoring

Tests

Chores

Commits on this branch

Release checklist

Uh oh!

snyk-io Bot commented Oct 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Snyk checks have passed. No issues have been found so far.

Uh oh!

github-actions Bot commented Oct 29, 2026

🔒 Security Scan Results

⏱️ SLA Breach Summary

Uh oh!

github-actions Bot commented Oct 29, 2026

Coverage Report

Uh oh!

sairaj-cs left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

snyk-io Bot commented Oct 29, 2026 •

edited

Loading