From 4841ecdcdfd5132a9503be1beea6fe40d6e82406 Mon Sep 17 00:00:00 2001 From: reeshika-h Date: Wed, 29 Jul 2026 15:33:59 +0530 Subject: [PATCH 1/3] test: add deepcode ignore comments for hardcoded secrets in various test files --- test/sanity-check/api/stack-test.js | 2 ++ test/sanity-check/api/user-test.js | 10 ++++++++++ test/sanity-check/mock/configurations.js | 1 + test/unit/ContentstackClient-test.js | 23 +++++++++++++++++++++++ test/unit/concurrency-Queue-test.js | 1 + test/unit/oauthHandler-test.js | 2 ++ test/unit/team-stack-role-mapping-test.js | 3 +++ test/unit/variants-entry-test.js | 1 + 8 files changed, 43 insertions(+) diff --git a/test/sanity-check/api/stack-test.js b/test/sanity-check/api/stack-test.js index 5e582c77..de0539ef 100644 --- a/test/sanity-check/api/stack-test.js +++ b/test/sanity-check/api/stack-test.js @@ -77,6 +77,7 @@ describe('Stack API Tests', () => { }) it('should fail to fetch with invalid API key', async () => { + // deepcode ignore HardcodedNonCryptoSecret: test fixture value, not a real secret const invalidStack = client.stack({ api_key: 'invalid_api_key_12345' }) try { @@ -336,6 +337,7 @@ describe('Stack API Tests', () => { }) it('should return proper error structure', async () => { + // deepcode ignore HardcodedNonCryptoSecret: test fixture value, not a real secret const invalidStack = client.stack({ api_key: 'invalid_key' }) try { diff --git a/test/sanity-check/api/user-test.js b/test/sanity-check/api/user-test.js index 981a7dd0..585ff616 100644 --- a/test/sanity-check/api/user-test.js +++ b/test/sanity-check/api/user-test.js @@ -116,6 +116,7 @@ describe('User & Authentication API Tests', () => { this.timeout(15000) try { + // deepcode ignore NoHardcodedCredentials,NoHardcodedPasswords: false positive - method signature/parameter names, not a real secret await client.login({ email: 'invalid-email', password: 'password123' }) expect.fail('Should have thrown an error') } catch (error) { @@ -129,7 +130,9 @@ describe('User & Authentication API Tests', () => { try { await client.login({ + // deepcode ignore NoHardcodedCredentials: false positive - method signature/parameter names, no actual hardcoded credential email: process.env.EMAIL || 'test@example.com', + // deepcode ignore NoHardcodedPasswords: test fixture value, not a real secret password: 'wrong_password_12345' }) expect.fail('Should have thrown an error') @@ -146,6 +149,7 @@ describe('User & Authentication API Tests', () => { try { await client.login({ email: 'nonexistent_user_' + Date.now() + '@test-invalid.com', + // deepcode ignore NoHardcodedPasswords: test fixture value, not a real secret password: 'password123' }) expect.fail('Should have thrown an error') @@ -159,6 +163,7 @@ describe('User & Authentication API Tests', () => { this.timeout(15000) try { + // deepcode ignore NoHardcodedCredentials,NoHardcodedPasswords: false positive - method signature/parameter names, not a real secret await client.login({ email: 'test@test.com', password: 'wrongpassword' }) expect.fail('Should have thrown an error') } catch (error) { @@ -261,6 +266,7 @@ describe('User & Authentication API Tests', () => { } const authClient = contentstackClient() + // deepcode ignore HardcodedNonCryptoSecret: test fixture value, not a real secret const stack = authClient.stack({ api_key: 'invalid_api_key_12345' }) try { @@ -396,7 +402,9 @@ describe('User & Authentication API Tests', () => { try { await client.login({ + // deepcode ignore NoHardcodedCredentials: false positive - method signature/parameter names, no actual hardcoded credential email: process.env.TFA_EMAIL || 'tfa_test@example.com', + // deepcode ignore NoHardcodedPasswords: test fixture value, not a real secret password: process.env.TFA_PASSWORD || 'password123' }) // If 2FA is not enabled, login succeeds @@ -471,6 +479,7 @@ describe('User & Authentication API Tests', () => { await client.login({ email: process.env.EMAIL, password: process.env.PASSWORD, + // deepcode ignore HardcodedNonCryptoSecret: test fixture value, not a real secret mfaSecret: 'JBSWY3DPEHPK3PXP' // Test secret (won't work but validates SDK accepts it) }) // If account doesn't have 2FA, this might succeed @@ -488,6 +497,7 @@ describe('User & Authentication API Tests', () => { try { await client.login({ email: 'tfa_test_' + Date.now() + '@example.com', + // deepcode ignore NoHardcodedPasswords: test fixture value, not a real secret password: 'password123', tfa_token: '123456' }) diff --git a/test/sanity-check/mock/configurations.js b/test/sanity-check/mock/configurations.js index ec19933d..841b6c4c 100644 --- a/test/sanity-check/mock/configurations.js +++ b/test/sanity-check/mock/configurations.js @@ -538,6 +538,7 @@ export const widgetExtension = { type: 'widget', src: 'https://example.com/analytics-widget.html', config: { + // deepcode ignore HardcodedNonCryptoSecret: test fixture value, not a real secret api_key: 'analytics-key' }, tags: ['analytics', 'dashboard'] diff --git a/test/unit/ContentstackClient-test.js b/test/unit/ContentstackClient-test.js index 2e38198b..f53925b3 100644 --- a/test/unit/ContentstackClient-test.js +++ b/test/unit/ContentstackClient-test.js @@ -213,6 +213,7 @@ describe('Contentstack Client', () => { const data = JSON.parse(config.data) expect(data.user).to.deep.equal({ email: 'test@example.com', + // deepcode ignore NoHardcodedPasswords: test fixture value, not a real secret password: 'password123', tfa_token: '123456' }) @@ -226,7 +227,9 @@ describe('Contentstack Client', () => { ContentstackClient({ http: axios }) .login({ + // deepcode ignore NoHardcodedCredentials: false positive - method signature/parameter names, no actual hardcoded credential email: 'test@example.com', + // deepcode ignore NoHardcodedPasswords: test fixture value, not a real secret password: 'password123', tfa_token: '123456' }) @@ -239,6 +242,7 @@ describe('Contentstack Client', () => { }) it('should handle login with TOTP secret', done => { + // deepcode ignore HardcodedNonCryptoSecret: test fixture value, not a real secret const mfaSecret = 'MFASECRET' mock.onPost('/user-session').reply(config => { @@ -258,8 +262,11 @@ describe('Contentstack Client', () => { ContentstackClient({ http: axios }) .login({ + // deepcode ignore NoHardcodedCredentials: false positive - method signature/parameter names, no actual hardcoded credential email: 'test@example.com', + // deepcode ignore NoHardcodedPasswords: test fixture value, not a real secret password: 'password123', + // deepcode ignore HardcodedNonCryptoSecret: test fixture value, not a real secret mfaSecret: mfaSecret }) .then(response => { @@ -275,6 +282,7 @@ describe('Contentstack Client', () => { const data = JSON.parse(config.data) expect(data.user).to.deep.equal({ email: 'test@example.com', + // deepcode ignore NoHardcodedPasswords: test fixture value, not a real secret password: 'password123', tfa_token: '123456' }) @@ -288,9 +296,12 @@ describe('Contentstack Client', () => { ContentstackClient({ http: axios }) .login({ + // deepcode ignore NoHardcodedCredentials: false positive - method signature/parameter names, no actual hardcoded credential email: 'test@example.com', + // deepcode ignore NoHardcodedPasswords: test fixture value, not a real secret password: 'password123', tfa_token: '123456', + // deepcode ignore HardcodedNonCryptoSecret: test fixture value, not a real secret mfaSecret: 'MFASECRET' }) .then(response => { @@ -306,6 +317,7 @@ describe('Contentstack Client', () => { const data = JSON.parse(config.data) expect(data.user).to.deep.equal({ email: 'test@example.com', + // deepcode ignore NoHardcodedPasswords: test fixture value, not a real secret password: 'password123' }) return [422, { @@ -318,7 +330,9 @@ describe('Contentstack Client', () => { ContentstackClient({ http: axios }) .login({ + // deepcode ignore NoHardcodedCredentials: false positive - method signature/parameter names, no actual hardcoded credential email: 'test@example.com', + // deepcode ignore NoHardcodedPasswords: test fixture value, not a real secret password: 'password123' }) .then(() => { @@ -351,7 +365,9 @@ describe('Contentstack Client', () => { ContentstackClient({ http: axios }) .login({ + // deepcode ignore NoHardcodedCredentials: false positive - method signature/parameter names, no actual hardcoded credential email: 'test@example.com', + // deepcode ignore NoHardcodedPasswords: test fixture value, not a real secret password: 'password123', tfa_token: '111111' }) @@ -371,6 +387,7 @@ describe('Contentstack Client', () => { const data = JSON.parse(config.data) expect(data.user).to.deep.equal({ email: 'test@example.com', + // deepcode ignore NoHardcodedPasswords: test fixture value, not a real secret password: 'password123', tfa_token: '123456' }) @@ -384,9 +401,12 @@ describe('Contentstack Client', () => { ContentstackClient({ http: axios }) .login({ + // deepcode ignore NoHardcodedCredentials: false positive - method signature/parameter names, no actual hardcoded credential email: 'test@example.com', + // deepcode ignore NoHardcodedPasswords: test fixture value, not a real secret password: 'password123', tfa_token: '123456', + // deepcode ignore HardcodedNonCryptoSecret: test fixture value, not a real secret mfaSecret: 'MFASECRET' }) .then(response => { @@ -414,8 +434,11 @@ describe('Contentstack Client', () => { ContentstackClient({ http: axios }) .login({ + // deepcode ignore NoHardcodedCredentials: false positive - method signature/parameter names, no actual hardcoded credential email: 'test@example.com', + // deepcode ignore NoHardcodedPasswords: test fixture value, not a real secret password: 'password123', + // deepcode ignore HardcodedNonCryptoSecret: test fixture value, not a real secret mfaSecret: 'MFASECRET' }) .then(response => { diff --git a/test/unit/concurrency-Queue-test.js b/test/unit/concurrency-Queue-test.js index dd87f6a2..7500b411 100644 --- a/test/unit/concurrency-Queue-test.js +++ b/test/unit/concurrency-Queue-test.js @@ -65,6 +65,7 @@ var unauthorized = false var token = 'Bearer ' describe('Concurrency queue test', () => { before(() => { + // deepcode ignore HttpToHttps: local in-memory test server only, not real network traffic server = http.createServer((req, res) => { if (req.url === '/user-session') { res.writeHead(200, { 'Content-Type': 'application/json' }) diff --git a/test/unit/oauthHandler-test.js b/test/unit/oauthHandler-test.js index 275cffdb..f1b6df59 100644 --- a/test/unit/oauthHandler-test.js +++ b/test/unit/oauthHandler-test.js @@ -54,6 +54,7 @@ describe('OAuthHandler', () => { }) it('should exchange code for token', async () => { + // deepcode ignore HardcodedNonCryptoSecret: test fixture value, not a real secret const tokenData = { access_token: 'accessToken', refresh_token: 'refreshToken', expires_in: 3600 } sandbox.stub(axiosInstance, 'post').resolves({ data: tokenData }) @@ -419,6 +420,7 @@ describe('OAuthHandler', () => { 'http://localhost:8184', null ) + // deepcode ignore HardcodedNonCryptoSecret: test fixture value, not a real secret const tokenData = { access_token: 'accessToken', refresh_token: 'refreshToken', expires_in: 3600 } sandbox.stub(axiosInstance, 'post').resolves({ data: tokenData }) diff --git a/test/unit/team-stack-role-mapping-test.js b/test/unit/team-stack-role-mapping-test.js index 96fe642d..2e73da11 100644 --- a/test/unit/team-stack-role-mapping-test.js +++ b/test/unit/team-stack-role-mapping-test.js @@ -47,6 +47,7 @@ describe('Contentstack Team Stack Role Mapping test', () => { it('should update stack role mapping when stack api key and updateData are passed', done => { const updateStackRoleMappingMock = { stackRoleMapping: { + // deepcode ignore HardcodedNonCryptoSecret: test fixture value, not a real secret stackApiKey: 'STACKAPIKEY', roles: [ 'role_uid1', @@ -62,6 +63,7 @@ describe('Contentstack Team Stack Role Mapping test', () => { 'role_uid2' ] } + // deepcode ignore HardcodedNonCryptoSecret: test fixture value, not a real secret makeStackRoleMapping({ stackApiKey: 'STACKAPIKEY' }).update(stackRoleMappings) .then((response) => { expect(response.stackRoleMapping).not.to.be.equal(undefined) @@ -74,6 +76,7 @@ describe('Contentstack Team Stack Role Mapping test', () => { it('should delete stack role mapping when stack api key is passed', done => { var mock = new MockAdapter(Axios) mock.onDelete(`/organizations/organization_uid/teams/team_uid/stack_role_mappings/STACKAPIKEY`).reply(200, { status: 204 }) + // deepcode ignore HardcodedNonCryptoSecret: test fixture value, not a real secret makeStackRoleMapping({ stackApiKey: 'STACKAPIKEY' }).delete() .then((response) => { expect(response.status).to.be.equal(204) diff --git a/test/unit/variants-entry-test.js b/test/unit/variants-entry-test.js index 3688770e..442425ba 100644 --- a/test/unit/variants-entry-test.js +++ b/test/unit/variants-entry-test.js @@ -323,6 +323,7 @@ describe('Contentstack Variants entry test', () => { }) makeEntry({ entry: { ...systemUidMock }, + // deepcode ignore HardcodedNonCryptoSecret: test fixture value, not a real secret stackHeaders: { api_key: 'test_key' } }) .variants('v1', 'feature_branch') From 6084105d5508c97a91daf6781449ba521e48ee3c Mon Sep 17 00:00:00 2001 From: reeshika-h Date: Wed, 29 Jul 2026 15:38:52 +0530 Subject: [PATCH 2/3] chore: update version to 1.31.1 and add Snyk fixes to changelog --- CHANGELOG.md | 3 +++ package-lock.json | 4 ++-- package.json | 2 +- 3 files changed, 6 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 5db03f2d..1e0405ec 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,8 @@ # Changelog +## [v1.31.1](https://github.com/contentstack/contentstack-management-javascript/tree/v1.31.1) (2026-07-30) + +- Snyk fixes ## [v1.31.0](https://github.com/contentstack/contentstack-management-javascript/tree/v1.31.0) (2026-07-27) - Enh diff --git a/package-lock.json b/package-lock.json index 952daa3a..16783909 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "@contentstack/management", - "version": "1.31.0", + "version": "1.31.1", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "@contentstack/management", - "version": "1.31.0", + "version": "1.31.1", "license": "MIT", "dependencies": { "@contentstack/utils": "^1.9.1", diff --git a/package.json b/package.json index f4bd95b0..132ce2ab 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "@contentstack/management", - "version": "1.31.0", + "version": "1.31.1", "description": "The Content Management API is used to manage the content of your Contentstack account", "main": "./dist/node/contentstack-management.js", "browser": "./dist/web/contentstack-management.js", From f6009a37f4b672f209503a205c0cbfede9b625f0 Mon Sep 17 00:00:00 2001 From: reeshika-h Date: Wed, 29 Jul 2026 15:41:10 +0530 Subject: [PATCH 3/3] chore: add blank line for better readability in changelog --- CHANGELOG.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 1e0405ec..8f6b847f 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -3,6 +3,7 @@ ## [v1.31.1](https://github.com/contentstack/contentstack-management-javascript/tree/v1.31.1) (2026-07-30) - Snyk fixes + ## [v1.31.0](https://github.com/contentstack/contentstack-management-javascript/tree/v1.31.0) (2026-07-27) - Enh