snyk fix

CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## [v1.31.1](https://github.com/contentstack/contentstack-management-javascript/tree/v1.31.1) (2026-07-30)
+
+- Snyk fixes
+
 ## [v1.31.0](https://github.com/contentstack/contentstack-management-javascript/tree/v1.31.0) (2026-07-27)
 
 - Enh

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contentstack/management",
-  "version": "1.31.0",
+  "version": "1.31.1",
   "description": "The Content Management API is used to manage the content of your Contentstack account",
   "main": "./dist/node/contentstack-management.js",
   "browser": "./dist/web/contentstack-management.js",

test/sanity-check/api/stack-test.js

@@ -77,6 +77,7 @@ describe('Stack API Tests', () => {
     })
 
     it('should fail to fetch with invalid API key', async () => {
+      // deepcode ignore HardcodedNonCryptoSecret: test fixture value, not a real secret
       const invalidStack = client.stack({ api_key: 'invalid_api_key_12345' })
 
       try {
@@ -336,6 +337,7 @@ describe('Stack API Tests', () => {
     })
 
     it('should return proper error structure', async () => {
+      // deepcode ignore HardcodedNonCryptoSecret: test fixture value, not a real secret
       const invalidStack = client.stack({ api_key: 'invalid_key' })
 
       try {

test/sanity-check/api/user-test.js

@@ -116,6 +116,7 @@ describe('User & Authentication API Tests', () => {
       this.timeout(15000)
 
       try {
+        // deepcode ignore NoHardcodedCredentials,NoHardcodedPasswords: false positive - method signature/parameter names, not a real secret
         await client.login({ email: 'invalid-email', password: 'password123' })
         expect.fail('Should have thrown an error')
       } catch (error) {
@@ -129,7 +130,9 @@ describe('User & Authentication API Tests', () => {
 
       try {
         await client.login({
+          // deepcode ignore NoHardcodedCredentials: false positive - method signature/parameter names, no actual hardcoded credential
           email: process.env.EMAIL || 'test@example.com',
+          // deepcode ignore NoHardcodedPasswords: test fixture value, not a real secret
           password: 'wrong_password_12345'
         })
         expect.fail('Should have thrown an error')
@@ -146,6 +149,7 @@ describe('User & Authentication API Tests', () => {
       try {
         await client.login({
           email: 'nonexistent_user_' + Date.now() + '@test-invalid.com',
+          // deepcode ignore NoHardcodedPasswords: test fixture value, not a real secret
           password: 'password123'
         })
         expect.fail('Should have thrown an error')
@@ -159,6 +163,7 @@ describe('User & Authentication API Tests', () => {
       this.timeout(15000)
 
       try {
+        // deepcode ignore NoHardcodedCredentials,NoHardcodedPasswords: false positive - method signature/parameter names, not a real secret
         await client.login({ email: 'test@test.com', password: 'wrongpassword' })
         expect.fail('Should have thrown an error')
       } catch (error) {
@@ -261,6 +266,7 @@ describe('User & Authentication API Tests', () => {
       }
 
       const authClient = contentstackClient()
+      // deepcode ignore HardcodedNonCryptoSecret: test fixture value, not a real secret
       const stack = authClient.stack({ api_key: 'invalid_api_key_12345' })
 
       try {
@@ -396,7 +402,9 @@ describe('User & Authentication API Tests', () => {
 
       try {
         await client.login({
+          // deepcode ignore NoHardcodedCredentials: false positive - method signature/parameter names, no actual hardcoded credential
           email: process.env.TFA_EMAIL || 'tfa_test@example.com',
+          // deepcode ignore NoHardcodedPasswords: test fixture value, not a real secret
           password: process.env.TFA_PASSWORD || 'password123'
         })
         // If 2FA is not enabled, login succeeds
@@ -471,6 +479,7 @@ describe('User & Authentication API Tests', () => {
           await client.login({
             email: process.env.EMAIL,
             password: process.env.PASSWORD,
+            // deepcode ignore HardcodedNonCryptoSecret: test fixture value, not a real secret
             mfaSecret: 'JBSWY3DPEHPK3PXP' // Test secret (won't work but validates SDK accepts it)
           })
           // If account doesn't have 2FA, this might succeed
@@ -488,6 +497,7 @@ describe('User & Authentication API Tests', () => {
       try {
         await client.login({
           email: 'tfa_test_' + Date.now() + '@example.com',
+          // deepcode ignore NoHardcodedPasswords: test fixture value, not a real secret
           password: 'password123',
           tfa_token: '123456'
         })

test/sanity-check/mock/configurations.js

@@ -538,6 +538,7 @@ export const widgetExtension = {
     type: 'widget',
     src: 'https://example.com/analytics-widget.html',
     config: {
+      // deepcode ignore HardcodedNonCryptoSecret: test fixture value, not a real secret
       api_key: 'analytics-key'
     },
     tags: ['analytics', 'dashboard']

test/unit/ContentstackClient-test.js

@@ -213,6 +213,7 @@ describe('Contentstack Client', () => {
         const data = JSON.parse(config.data)
         expect(data.user).to.deep.equal({
           email: 'test@example.com',
+          // deepcode ignore NoHardcodedPasswords: test fixture value, not a real secret
           password: 'password123',
           tfa_token: '123456'
         })
@@ -226,7 +227,9 @@ describe('Contentstack Client', () => {
 
       ContentstackClient({ http: axios })
         .login({
+          // deepcode ignore NoHardcodedCredentials: false positive - method signature/parameter names, no actual hardcoded credential
           email: 'test@example.com',
+          // deepcode ignore NoHardcodedPasswords: test fixture value, not a real secret
           password: 'password123',
           tfa_token: '123456'
         })
@@ -239,6 +242,7 @@ describe('Contentstack Client', () => {
     })
 
     it('should handle login with TOTP secret', done => {
+      // deepcode ignore HardcodedNonCryptoSecret: test fixture value, not a real secret
       const mfaSecret = 'MFASECRET'
 
       mock.onPost('/user-session').reply(config => {
@@ -258,8 +262,11 @@ describe('Contentstack Client', () => {
 
       ContentstackClient({ http: axios })
         .login({
+          // deepcode ignore NoHardcodedCredentials: false positive - method signature/parameter names, no actual hardcoded credential
           email: 'test@example.com',
+          // deepcode ignore NoHardcodedPasswords: test fixture value, not a real secret
           password: 'password123',
+          // deepcode ignore HardcodedNonCryptoSecret: test fixture value, not a real secret
           mfaSecret: mfaSecret
         })
         .then(response => {
@@ -275,6 +282,7 @@ describe('Contentstack Client', () => {
         const data = JSON.parse(config.data)
         expect(data.user).to.deep.equal({
           email: 'test@example.com',
+          // deepcode ignore NoHardcodedPasswords: test fixture value, not a real secret
           password: 'password123',
           tfa_token: '123456'
         })
@@ -288,9 +296,12 @@ describe('Contentstack Client', () => {
 
       ContentstackClient({ http: axios })
         .login({
+          // deepcode ignore NoHardcodedCredentials: false positive - method signature/parameter names, no actual hardcoded credential
           email: 'test@example.com',
+          // deepcode ignore NoHardcodedPasswords: test fixture value, not a real secret
           password: 'password123',
           tfa_token: '123456',
+          // deepcode ignore HardcodedNonCryptoSecret: test fixture value, not a real secret
           mfaSecret: 'MFASECRET'
         })
         .then(response => {
@@ -306,6 +317,7 @@ describe('Contentstack Client', () => {
         const data = JSON.parse(config.data)
         expect(data.user).to.deep.equal({
           email: 'test@example.com',
+          // deepcode ignore NoHardcodedPasswords: test fixture value, not a real secret
           password: 'password123'
         })
         return [422, {
@@ -318,7 +330,9 @@ describe('Contentstack Client', () => {
 
       ContentstackClient({ http: axios })
         .login({
+          // deepcode ignore NoHardcodedCredentials: false positive - method signature/parameter names, no actual hardcoded credential
           email: 'test@example.com',
+          // deepcode ignore NoHardcodedPasswords: test fixture value, not a real secret
           password: 'password123'
         })
         .then(() => {
@@ -351,7 +365,9 @@ describe('Contentstack Client', () => {
 
       ContentstackClient({ http: axios })
         .login({
+          // deepcode ignore NoHardcodedCredentials: false positive - method signature/parameter names, no actual hardcoded credential
           email: 'test@example.com',
+          // deepcode ignore NoHardcodedPasswords: test fixture value, not a real secret
           password: 'password123',
           tfa_token: '111111'
         })
@@ -371,6 +387,7 @@ describe('Contentstack Client', () => {
         const data = JSON.parse(config.data)
         expect(data.user).to.deep.equal({
           email: 'test@example.com',
+          // deepcode ignore NoHardcodedPasswords: test fixture value, not a real secret
           password: 'password123',
           tfa_token: '123456'
         })
@@ -384,9 +401,12 @@ describe('Contentstack Client', () => {
 
       ContentstackClient({ http: axios })
         .login({
+          // deepcode ignore NoHardcodedCredentials: false positive - method signature/parameter names, no actual hardcoded credential
           email: 'test@example.com',
+          // deepcode ignore NoHardcodedPasswords: test fixture value, not a real secret
           password: 'password123',
           tfa_token: '123456',
+          // deepcode ignore HardcodedNonCryptoSecret: test fixture value, not a real secret
           mfaSecret: 'MFASECRET'
         })
         .then(response => {
@@ -414,8 +434,11 @@ describe('Contentstack Client', () => {
 
       ContentstackClient({ http: axios })
         .login({
+          // deepcode ignore NoHardcodedCredentials: false positive - method signature/parameter names, no actual hardcoded credential
           email: 'test@example.com',
+          // deepcode ignore NoHardcodedPasswords: test fixture value, not a real secret
           password: 'password123',
+          // deepcode ignore HardcodedNonCryptoSecret: test fixture value, not a real secret
           mfaSecret: 'MFASECRET'
         })
         .then(response => {

test/unit/concurrency-Queue-test.js

@@ -65,6 +65,7 @@ var unauthorized = false
 var token = 'Bearer <token_value_new>'
 describe('Concurrency queue test', () => {
   before(() => {
+    // deepcode ignore HttpToHttps: local in-memory test server only, not real network traffic
     server = http.createServer((req, res) => {
       if (req.url === '/user-session') {
         res.writeHead(200, { 'Content-Type': 'application/json' })

test/unit/oauthHandler-test.js

@@ -54,6 +54,7 @@ describe('OAuthHandler', () => {
   })
 
   it('should exchange code for token', async () => {
+    // deepcode ignore HardcodedNonCryptoSecret: test fixture value, not a real secret
     const tokenData = { access_token: 'accessToken', refresh_token: 'refreshToken', expires_in: 3600 }
     sandbox.stub(axiosInstance, 'post').resolves({ data: tokenData })
 
@@ -419,6 +420,7 @@ describe('OAuthHandler', () => {
         'http://localhost:8184',
         null
       )
+      // deepcode ignore HardcodedNonCryptoSecret: test fixture value, not a real secret
       const tokenData = { access_token: 'accessToken', refresh_token: 'refreshToken', expires_in: 3600 }
       sandbox.stub(axiosInstance, 'post').resolves({ data: tokenData })
 

test/unit/team-stack-role-mapping-test.js

@@ -47,6 +47,7 @@ describe('Contentstack Team Stack Role Mapping test', () => {
   it('should update stack role mapping when stack api key and updateData are passed', done => {
     const updateStackRoleMappingMock = {
       stackRoleMapping: {
+        // deepcode ignore HardcodedNonCryptoSecret: test fixture value, not a real secret
         stackApiKey: 'STACKAPIKEY',
         roles: [
           'role_uid1',
@@ -62,6 +63,7 @@ describe('Contentstack Team Stack Role Mapping test', () => {
         'role_uid2'
       ]
     }
+    // deepcode ignore HardcodedNonCryptoSecret: test fixture value, not a real secret
     makeStackRoleMapping({ stackApiKey: 'STACKAPIKEY' }).update(stackRoleMappings)
       .then((response) => {
         expect(response.stackRoleMapping).not.to.be.equal(undefined)
@@ -74,6 +76,7 @@ describe('Contentstack Team Stack Role Mapping test', () => {
   it('should delete stack role mapping when stack api key is passed', done => {
     var mock = new MockAdapter(Axios)
     mock.onDelete(`/organizations/organization_uid/teams/team_uid/stack_role_mappings/STACKAPIKEY`).reply(200, { status: 204 })
+    // deepcode ignore HardcodedNonCryptoSecret: test fixture value, not a real secret
     makeStackRoleMapping({ stackApiKey: 'STACKAPIKEY' }).delete()
       .then((response) => {
         expect(response.status).to.be.equal(204)

test/unit/variants-entry-test.js

@@ -323,6 +323,7 @@ describe('Contentstack Variants entry test', () => {
       })
     makeEntry({
       entry: { ...systemUidMock },
+      // deepcode ignore HardcodedNonCryptoSecret: test fixture value, not a real secret
       stackHeaders: { api_key: 'test_key' }
     })
       .variants('v1', 'feature_branch')