chore: release — development → main

[harshitha07d]

Summary

Release PR merging development into main (27 commits).

Package version bumps

Package	Old	New
@contentstack/cli-apps	2.0.0	2.0.1
@contentstack/cli-asset-management	1.0.0	1.0.1
@contentstack/cli-audit	2.0.0	2.0.1
@contentstack/cli-cm-branches	2.0.0	2.0.1
@contentstack/cli-cm-clone	2.0.0	2.0.1
@contentstack/cli-cm-export	2.0.0	2.0.1
@contentstack/cli-cm-export-to-csv	2.0.0	2.0.1
@contentstack/cli-cm-import	2.0.0	2.0.1
@contentstack/cli-cm-import-setup	2.0.0	2.0.1
@contentstack/cli-cm-migrate-rte	2.0.0	2.0.1
@contentstack/cli-cm-regex-validate	2.0.0	2.0.1
@contentstack/cli-content-type	2.0.0	2.0.1
@contentstack/cli-migration	2.0.0	2.0.1
@contentstack/cli-query-export	2.0.0	2.0.1
@contentstack/cli-seed	2.0.0	2.0.1
@contentstack/cli-variants	2.0.0	2.0.1
@contentstack/cli-external-migrate	2.0.0	2.0.1

Bug fixes

• fix(bootstrap): surface precise branch-not-found error, stop spinner before printing error, reject on non-2xx tarball response, handle zlib errors, widen 404 message, guard non-2xx responses
• fix(tsgen): resolve the real GraphQL endpoint per region
• fix(bulk-operations): publish only to scoped targets
• fix(import): clarify global field reference-field warning message

Maintenance

• Snyk lockfile fixes
• pnpm-lock.yaml updates
• READMEs updated across all packages

🤖 Generated with Claude Code

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[github-actions]

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Count (with fixes)	Without fixes	Threshold	Result
🔴 Critical Severity	0	0	10	✅ Passed
🟠 High Severity	0	2	25	✅ Passed
🟡 Medium Severity	0	0	500	✅ Passed
🔵 Low Severity	0	0	1000	✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity	Breaches (with fixes)	Breaches (no fixes)	SLA Threshold (with/no fixes)	Status
🔴 Critical	0	0	15 / 30 days	✅ Passed
🟠 High	0	0	30 / 120 days	✅ Passed
🟡 Medium	0	0	90 / 365 days	✅ Passed
🔵 Low	0	0	180 / 365 days	✅ Passed

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:

• Critical without fixes: 0
• High without fixes: 2
• Medium without fixes: 0
• Low without fixes: 0

✅ BUILD PASSED - All security checks passed

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[github-actions]

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Count (with fixes)	Without fixes	Threshold	Result
🔴 Critical Severity	0	0	10	✅ Passed
🟠 High Severity	0	1	25	✅ Passed
🟡 Medium Severity	0	64	500	✅ Passed
🔵 Low Severity	0	0	1000	✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity	Breaches (with fixes)	Breaches (no fixes)	SLA Threshold (with/no fixes)	Status
🔴 Critical	0	0	15 / 30 days	✅ Passed
🟠 High	0	0	30 / 120 days	✅ Passed
🟡 Medium	0	0	90 / 365 days	✅ Passed
🔵 Low	0	0	180 / 365 days	✅ Passed

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:

• Critical without fixes: 0
• High without fixes: 1
• Medium without fixes: 64
• Low without fixes: 0

✅ BUILD PASSED - All security checks passed

[github-actions]

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Count (with fixes)	Without fixes	Threshold	Result
🔴 Critical Severity	0	0	10	✅ Passed
🟠 High Severity	0	1	25	✅ Passed
🟡 Medium Severity	0	64	500	✅ Passed
🔵 Low Severity	0	0	1000	✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity	Breaches (with fixes)	Breaches (no fixes)	SLA Threshold (with/no fixes)	Status
🔴 Critical	0	0	15 / 30 days	✅ Passed
🟠 High	0	0	30 / 120 days	✅ Passed
🟡 Medium	0	0	90 / 365 days	✅ Passed
🔵 Low	0	0	180 / 365 days	✅ Passed

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:

• Critical without fixes: 0
• High without fixes: 1
• Medium without fixes: 64
• Low without fixes: 0

✅ BUILD PASSED - All security checks passed

[Copilot]

🟡 Changes recommended

Unresolved critical and moderate findings remain across compatibility, asset publishing, bootstrap messaging, batching, and secret scanning.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Description: Release updates for CLI plugins, including scoped asset publishing, Global Field restoration, tsgen GraphQL error handling, dependency refreshes, and documentation updates.

Changes:

• Adds target-aware backup asset publishing and batching.
• Improves import, tsgen, and bootstrap error handling.
• Updates package versions, dependencies, tests, and generated documentation.

File summaries

File	Summary
pnpm-workspace.yaml	Updates dependency overrides.
packages/contentstack-variants/package.json	Release and dependency bump.
packages/contentstack-seed/README.md	Updates displayed version.
packages/contentstack-seed/package.json	Release and dependency bump.
packages/contentstack-query-export/package.json	Release and dependency bump.
packages/contentstack-migration/README.md	Updates displayed version.
packages/contentstack-migration/package.json	Release and dependency bump.
packages/contentstack-migrate-rte/README.md	Updates displayed version.
packages/contentstack-migrate-rte/package.json	Release and dependency bump.
packages/contentstack-import/src/utils/content-type-helper.ts	Clarifies deferred reference restoration.
packages/contentstack-import/src/import/modules/assets.ts	Updates post-scan publish guidance.
packages/contentstack-import/src/commands/cm/stacks/import.ts	Updates post-import publish guidance.
packages/contentstack-import/README.md	Updates displayed version.
packages/contentstack-import/package.json	Release and dependency bump.
packages/contentstack-import-setup/README.md	Updates displayed version.
packages/contentstack-import-setup/package.json	Release and dependency bump.
packages/contentstack-external-migrate/package.json	Dependency updates.
packages/contentstack-export/README.md	Updates displayed version.
packages/contentstack-export/package.json	Release and dependency bump.
packages/contentstack-export-to-csv/README.md	Updates displayed version.
packages/contentstack-export-to-csv/package.json	Release and dependency bump.
packages/contentstack-content-type/README.md	Updates displayed version.
packages/contentstack-content-type/package.json	Release and dependency bump.
packages/contentstack-clone/README.md	Regenerates command documentation. nit (3 votes): duplicate and invalid command usage remains.
packages/contentstack-clone/package.json	Release and dependency bump.
packages/contentstack-cli-tsgen/test/unit/helper.test.ts	Adds GraphQL host tests.
packages/contentstack-cli-tsgen/src/lib/helper.ts	Resolves region-specific GraphQL hosts.
packages/contentstack-cli-tsgen/src/commands/tsgen.ts	Uses resolved hosts and surfaces underlying errors.
packages/contentstack-cli-tsgen/package.json	Release and dependency bump.
packages/contentstack-cli-cm-regex-validate/README.md	Updates displayed version.
packages/contentstack-cli-cm-regex-validate/package.json	Release and dependency bump.
packages/contentstack-bulk-operations/test/unit/utils/revert-retry-handler.test.ts	Tests environment preservation.
packages/contentstack-bulk-operations/test/unit/utils/item-fetcher.test.ts	Tests requested publish locales.
packages/contentstack-bulk-operations/test/unit/utils/batch-helper.test.ts	Tests target-specific batching.
packages/contentstack-bulk-operations/test/unit/utils/backup-dir-asset-fetcher.test.ts	Tests backup asset target scanning.
packages/contentstack-bulk-operations/test/unit/services/bulk-operation-service.test.ts	Tests scoped environment payloads.
packages/contentstack-bulk-operations/src/utils/revert-retry-handler.ts	Preserves environments during revert and retry.
packages/contentstack-bulk-operations/src/utils/item-fetcher.ts	Separates locale hints from publish locales.
packages/contentstack-bulk-operations/src/utils/interactive.ts	Handles --backup-dir.
packages/contentstack-bulk-operations/src/utils/index.ts	Exports batching and scanning utilities.
packages/contentstack-bulk-operations/src/utils/data-dir-asset-fetcher.ts	Replaced by backup-directory scanning.
packages/contentstack-bulk-operations/src/utils/config-builder.ts	Builds backup-directory configuration.
packages/contentstack-bulk-operations/src/utils/batch-helper.ts	Implements target-aware batching. moderate (1 vote): per-key buckets can exceed the intended memory bound.
packages/contentstack-bulk-operations/src/utils/backup-dir-asset-fetcher.ts	Maps backup assets to publish targets. moderate (2 votes): unusable publish details can be counted as eligible.
packages/contentstack-bulk-operations/src/services/bulk-operation-service.ts	Prevents environment widening in bulk payloads.
packages/contentstack-bulk-operations/src/messages/index.ts	Adds backup-directory messaging.
packages/contentstack-bulk-operations/src/interfaces/index.ts	Adds backup-directory types.
packages/contentstack-bulk-operations/src/commands/cm/stacks/bulk-assets.ts	Implements scoped backup publishing. critical (2 votes): removes the --data-dir/-d interface without a compatibility alias. moderate (1 vote): dry-run performs scan-status API requests. moderate (1 vote): scan targets include assets without valid publish targets. moderate (1 vote): backup-dir is not rejected for CMS-only operations.
packages/contentstack-bulk-operations/src/base-bulk-command.ts	Skips untargeted items.
packages/contentstack-bulk-operations/README.md	Documents backup publishing.
packages/contentstack-bulk-operations/package.json	Release and dependency bump.
packages/contentstack-branches/README.md	Updates displayed version.
packages/contentstack-branches/package.json	Release and dependency bump.
packages/contentstack-bootstrap/test/github.test.js	Adds GitHub error tests.
packages/contentstack-bootstrap/src/bootstrap/index.ts	Converts GitHub 404s into user-facing errors. moderate (1 vote): custom branches are reported as cli-use.
packages/contentstack-bootstrap/src/bootstrap/github/client.ts	Handles HTTP statuses and stream errors.
packages/contentstack-bootstrap/README.md	Updates displayed version.
packages/contentstack-bootstrap/package.json	Release and dependency bump.
packages/contentstack-bootstrap/messages/index.json	Adds bootstrap error messages. moderate (2 votes): the error text hard-codes the cli-use branch.
packages/contentstack-audit/README.md	Updates displayed version.
packages/contentstack-audit/package.json	Release and dependency bump.
packages/contentstack-asset-management/package.json	Release and dependency bump.
packages/contentstack-apps-cli/README.md	Updates displayed version.
packages/contentstack-apps-cli/package.json	Release and dependency bump.
.talismanrc	Updates secret-scan allowlists. critical (1 vote): removing existing fixture exceptions may cause secret-scan failures.

Review details

Suppressed comments (5)

packages/contentstack-bootstrap/src/bootstrap/index.ts:79

• The 404 path always formats the message with the literal cli-use branch, even though the constructor accepts and uses appConfig.branch for custom branches. Users requesting a different branch will receive an incorrect remediation message; pass the resolved branch into the message or use the branch from this.repo.

      if (error instanceof GithubError && error.status === 404) {
        throw new Error(messageHandler.parse('CLI_BOOTSTRAP_APP_UNAVAILABLE', this.appConfig.source));
      }

packages/contentstack-bulk-operations/src/commands/cm/stacks/bulk-assets.ts:308

• The --dry-run help text promises that no API calls are made, but this return is reached only after fetchScanStatusByUIDs has already issued management API requests. Check dry-run mode before that request (and define how scan-gating is represented in the preview), or change the flag contract to explicitly allow read-only API calls.

    }

    if (dryRun) {
      log.info($t(messages.BACKUP_DIR_DRY_RUN));
      return;

packages/contentstack-bulk-operations/src/commands/cm/stacks/bulk-assets.ts:269

• targetUids is built from every UID in the import mapper, but that mapper also contains assets that pass 1 counted as skipped because they have no publish_details (and assets whose details yield no valid target). A backup containing only such assets can therefore report clean publishable assets, prompt the user, and fetch scan status before streamAndPublish enqueues nothing. Track or return only UIDs with a valid publish target and use that set for the scan-status/dashboard counts.

    this.bulkOperationConfig.environments = stats.environments;
    this.bulkOperationConfig.locales = stats.locales;

packages/contentstack-bulk-operations/src/commands/cm/stacks/bulk-assets.ts:95

• Because backup-dir is not included in the CMS-only flag list in src/utils/operation-flag-matrix.ts, --operation delete|move --backup-dir ... passes the operation matrix and then silently ignores the directory in the CS Assets path. Add this new flag to the CMS-only list (and cover the invalid combination) so it is rejected like --folder-uid.

    'backup-dir': flags.string({
      description: messages.BACKUP_DIR_FLAG_DESC,
      // Environments and locales are always derived per-asset from the backup.
      exclusive: ['source-env', 'folder-uid', 'environments', 'locales'],

packages/contentstack-bulk-operations/src/utils/batch-helper.ts:67

• This stores up to 50 items for every distinct (locale, environment-set) key until end(). A backup containing many different environment subsets can therefore retain most or all assets in memory, contradicting the previous one-batch memory bound and risking high memory use on large imports. Flush or otherwise bound buckets while preserving target-specific batching, and account for the resulting batch count.

  private readonly buckets = new Map<string, { locale: string; environments: string[]; items: PublishItem[] }>();
  private batchCount = 0;
  private skipped = 0;

  constructor(

• Files reviewed: 65/66 changed files
• Comments generated: 5
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Count (with fixes)	Without fixes	Threshold	Result
🔴 Critical Severity	0	0	10	✅ Passed
🟠 High Severity	0	1	25	✅ Passed
🟡 Medium Severity	0	64	500	✅ Passed
🔵 Low Severity	0	0	1000	✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity	Breaches (with fixes)	Breaches (no fixes)	SLA Threshold (with/no fixes)	Status
🔴 Critical	0	0	15 / 30 days	✅ Passed
🟠 High	0	0	30 / 120 days	✅ Passed
🟡 Medium	0	0	90 / 365 days	✅ Passed
🔵 Low	0	0	180 / 365 days	✅ Passed

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:

• Critical without fixes: 0
• High without fixes: 1
• Medium without fixes: 64
• Low without fixes: 0

✅ BUILD PASSED - All security checks passed

[Copilot]

Note

Copilot was unable to run its full agentic suite in this review.

Pull request overview

Copilot reviewed 67 out of 68 changed files in this pull request and generated 6 comments.

Suppressed comments (4)

packages/contentstack-import/src/utils/content-type-helper.ts:1

• The updated warning claims the reference “will be restored once it is imported,” but this is inside removeReferenceFields (and the prior message explicitly said the field is being removed). If the code still removes the reference field from the schema at this point, this message is misleading—either revert to wording that reflects removal, or adjust the implementation to actually defer/remediate references later.
  packages/contentstack-clone/README.md:1
• This README section appears to contain duplicated command entries and a malformed USAGE line (csdx cm:stack-clone cm:stacks:clone). Please regenerate the oclif docs (or manually remove duplicates) so the commands list has a single entry and the generated usage matches the actual invocation.
  packages/contentstack-clone/README.md:1
• This README section appears to contain duplicated command entries and a malformed USAGE line (csdx cm:stack-clone cm:stacks:clone). Please regenerate the oclif docs (or manually remove duplicates) so the commands list has a single entry and the generated usage matches the actual invocation.
  packages/contentstack-cli-tsgen/test/unit/helper.test.ts:1
• The test mock reaches into an internal module path (@contentstack/cli-utilities/lib/region-endpoints), which is brittle and can break on refactors/packaging changes. Since resolveCanonicalEndpoints is imported from @contentstack/cli-utilities in production code, prefer jest.requireActual("@contentstack/cli-utilities") and take resolveCanonicalEndpoints from there.

[Copilot]

🟡 Changes recommended

Unresolved findings remain in release automation, bootstrap messaging, import error handling, and bulk-operations behavior.

Get a fresh assessment by requesting another Copilot review.

Review details

Suppressed comments (7)

.github/workflows/release-production-plugins.yml:39

• The workflow loads release.json but never references steps.release_config.outputs (or any exported variables), so all publish steps run unconditionally and the per-plugin release switches have no effect. Gate each publish step with the loaded release configuration, or remove this configuration-loading step if this workflow is intentionally always-all.

      - name: Reading Configuration
        id: release_config
        uses: rgarcia-phi/json-to-variables@v1.1.0
        with:
          filename: .github/config/release.json

.talismanrc:5

• This hunk removes the existing Talisman ignore entries for unchanged audit fixtures and source files, even though those files still contain the fake api_key/secret_key fixture values that the ignores cover. The secret scan can now fail on these known test values; preserve the existing ignores or scrub the fixtures and update the checksums deliberately.

- filename: packages/contentstack-bulk-operations/src/utils/backup-dir-asset-fetcher.ts
  checksum: fbf1ef882bf4ea8f06a7a28b9248a07e01f5a5d2d4da98dbb9ee52bc16ce318a
- filename: packages/contentstack-bulk-operations/test/unit/utils/backup-dir-asset-fetcher.test.ts
  checksum: b905524c952aff0f089fa5347e0db18479b75a438cd9ae77e2dfe1cb203d7e59

packages/contentstack-bootstrap/messages/index.json:7

• This message hardcodes the default cli-use branch, but the bootstrap command accepts a custom branch. A 404 for a custom branch will therefore report the wrong branch and mislead the user; pass the actual selected branch or use wording that does not name cli-use.

  "CLI_BOOTSTRAP_APP_UNAVAILABLE": "Unable to download \"%s\": the repository or branch \"cli-use\" was not found. Ensure both exist on GitHub.",

packages/contentstack-bulk-operations/src/commands/cm/stacks/bulk-assets.ts:92

• Replacing the public --data-dir option with --backup-dir makes existing 2.0 automation fail with an unknown flag while this package is released as 2.1.0. Keep --data-dir as a deprecated alias, or treat this as a documented breaking major release and migrate the config API consistently.

    'backup-dir': flags.string({

packages/contentstack-bulk-operations/src/utils/backup-dir-asset-fetcher.ts:136

• Pass 1 counts any mapped asset with a non-empty publish_details array as eligible, but it does not return the eligible target UID set. The command later uses every mapper value for scan-status counts, so mapped assets with no publish details can be shown as clean and trigger confirmation even though pass 2 emits no batch. Return and use only eligible target UIDs.

      eligible++;

      // Same targets pass 2 batches on, so the counts stay exact.
      const targets = assetPublishTargets(asset, environmentsMap);

packages/contentstack-bulk-operations/src/utils/item-fetcher.ts:138

• This makes publish_details.locale the requested locale while item.locale remains the fallback resolution hint. The single/bulk operation loggers currently persist only item.locale (bulk stores requested locales only at the batch level), and revert/retry reconstruct target details from item.locale, so a fallback entry published to e.g. fr-fr will later be retried or reverted in en-us. Persist and use the requested locale in the operation logs.

          publish_details: validEnvironments.map((env) => ({
            environment: env,
            locale,
          })),

packages/contentstack-clone/README.md:45

• This adds a second complete generated section for the same clone command: the original section starts again at line 98, while this inserted section also has a duplicate index entry and an incorrect cm:stack-clone cm:stacks:clone usage line. Remove the duplicate block and regenerate the README from the manifest.

• Files reviewed: 67/68 changed files
• Comments generated: 5
• Review effort level: Lite