release: v4.5.2

[kirtesh-cstk]

Live Preview SDK v4.5.2

Summary

Republishes the package with its dist/ folder. Version 4.5.1 went to npm containing only package.json, README.md and LICENSE, so importing it failed at build time for every consumer. This release carries the packaging fix and the build output.

What's changed

Fixes

• Build runs before the package is packed. A prepack script now builds on every publish path, including a local npm publish or npm pack. Previously nothing built before publish, so an absent dist/ produced a tarball with no JavaScript in it. A failing build now fails the publish instead of shipping an empty package.
• Prereleases publish under the alpha dist-tag. The alpha publish job had lost its --tag alpha, so a prerelease would have moved the latest tag and been served to consumers installing without a version.

Chores

• Third-party vitest-coverage-report-action pinned to a commit sha rather than a mutable version tag.
• Version bump to 4.5.2; CHANGELOG regenerated via auto-changelog.
• README CDN snippet pinned to @contentstack/live-preview-utils@4.5.2.

Notes for reviewers

This branch is cut from main rather than stage_v4. The packaging fix was merged directly to main as a hotfix, and stage_v4 is an ancestor of main with nothing main lacks, so the usual stage_v4 → main release PR would have been empty and would not have contained the fix. stage_v4 and develop_v4 pick both up on their next sync.

Verified with a clean npm ci followed by npm pack --dry-run: 1931 files and 7.8 MB with the fix, against 3 files and 12.3 kB without, the latter reproducing the published 4.5.1 exactly. The build was also confirmed on node 24, which no release has used before.

Post-merge checklist

• Merge this PR (release-v4.5.2 → main)
• Create GitHub Release v4.5.2 from main (tag created via the Release UI) — triggers the npm-publish workflow
• Confirm the release title is exactly v4.5.2; a title ending in -alpha routes to the prerelease job
• Verify npm view @contentstack/live-preview-utils@4.5.2 dist.fileCount returns roughly 1931, not 3
• Verify the CDN resolves: https://esm.sh/@contentstack/live-preview-utils@4.5.2
• Deprecate 4.5.1 on npm, pointing at 4.5.2

---

🤖 Generated with Claude Code

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[github-actions]

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Count (with fixes)	Without fixes	Threshold	Result
🔴 Critical Severity	0	0	10	✅ Passed
🟠 High Severity	0	0	25	✅ Passed
🟡 Medium Severity	0	0	500	✅ Passed
🔵 Low Severity	0	0	1000	✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity	Breaches (with fixes)	Breaches (no fixes)	SLA Threshold (with/no fixes)	Status
🔴 Critical	0	0	15 / 30 days	✅ Passed
🟠 High	0	0	30 / 120 days	✅ Passed
🟡 Medium	0	0	90 / 365 days	✅ Passed
🔵 Low	0	0	180 / 365 days	✅ Passed

✅ BUILD PASSED - All security checks passed

[Copilot]

🟢 Approval recommended

No unresolved review issues were identified.

Pull request overview

Republishes the Live Preview SDK as v4.5.2 with corrected packaging and release metadata.

Changes:

• Bumps package and lockfile versions to 4.5.2.
• Updates the README CDN reference.
• Documents the release in the changelog.

File summaries

File	Description
README.md	Pins the CDN example to 4.5.2.
package.json	Updates the package version.
package-lock.json	Synchronizes lockfile metadata.
CHANGELOG.md	Documents the v4.5.2 release.

Review details

• Files reviewed: 3/4 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[karancs06]

LGTM!!

[hitesh-shetty-cstk]

Release path at risk: this is the cut that republishes the package every Live Preview and Visual Builder consumer installs. 4.5.1 went to npm with no dist/, so an app upgrading to it failed at build time on an import that could not resolve.

Automated review

What this changes: Bumps the package and lockfile to 4.5.2, regenerates the changelog, and moves the README CDN snippet to 4.5.2. No source changes. The packaging fix this release exists to carry landed on main ahead of this branch, so it does not show up in the diff.

Business impact: Publishing. I checked the branch head rather than taking the description on trust. package.json at this SHA carries "prepack": "npm run build" with files set to ["dist"], and .github/workflows/npm-publish.yml carries npm publish --tag alpha in the prerelease job. The fix is on the branch, so the 4.5.2 tarball should contain dist/. Were it absent, consumers on 4.5.2 would hit the same build failure as 4.5.1, and the README would be sending them to a CDN URL that cannot resolve.

Security: nothing beyond what the scanners cover. One observation on the publish workflow, outside this diff and not counted as a finding here: both jobs run npm install -g npm@latest in a job holding id-token: write for provenance, which puts unpinned third-party code in the path that signs and publishes the package. This same release pins vitest-coverage-report-action to a commit sha for that reason, so the publish path is worth the same treatment.

Flow

flowchart TD
    A[Merge release-v4.5.2 into main] --> B[Create GitHub Release v4.5.2]
    B --> C{release.name ends with -alpha}
    C -->|no| D[publish job]
    C -->|yes| E[publish-alpha job]
    D --> F[npm ci]
    E --> F
    F --> G[npm publish fires prepack]:::changed
    G --> H[tsup build writes dist/]:::changed
    H --> I[npm publish --provenance]
    I --> J[dist-tag latest at 4.5.2]
    I --> K[dist-tag alpha]
    classDef changed fill:#fff3cd,stroke:#d39e00

Loading

Findings: 0 blocker, 1 should fix, 2 nit. Both nits are inline on CHANGELOG.md. The should-fix sits below because the file it concerns is not part of this diff.

Should fix (follow-up, not a change to this PR) — .github/workflows/npm-publish.yml routes on endsWith(github.event.release.name, '-alpha'). A release named v4.6.0-alpha.1, the usual semver prerelease spelling, does not end in -alpha, so it routes to the publish job and goes out without --tag alpha. That moves latest onto a prerelease, which is the failure this release set out to remove. A release created with no name at all looks the same to that condition. Reading github.event.release.prerelease, or testing the tag for a prerelease suffix, would close it. The post-merge checklist covers 4.5.2 by asking for an exact title, so the exposure is the next prerelease rather than this release.

Reviewer candidates:

• @csAyushDubey authored 7 of the last 30 commits on package.json, the most of anyone once the author is excluded.
• @karancs06 authored 2 of the last 30 commits on package.json, and is the most recent of the contributors tied at that count.

@Deepak-Kharah owns most of the history on .github/workflows/npm-publish.yml, 3 of its last 6 commits. Since the release path is what this PR exercises, worth walking them through the publish behaviour before the release is created. No review requested from them.

Not covered: I did not run the build, npm pack, or the test suite, so the 1931 file count in the description is unverified here. I also did not confirm that stage_v4 is an ancestor of main with nothing main lacks. The published tarball after the release is created is the real check, and the checklist already has it.

Automated review by Claude Code. A human review is still required.

---

Generated by Claude Code

[github-actions]

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	67.43%	2530 / 3752
🔵	Statements	66.28%	2570 / 3877
🔵	Functions	64.71%	453 / 700
🔵	Branches	61.98%	1531 / 2470

File Coverage

No changed files found.

Generated in workflow #911 for commit 514013d by the Vitest Coverage Report Action