Skip to content

DX | 02-11-2026 | Release - #78

Merged
reeshika-h merged 15 commits into
masterfrom
development
Nov 2, 2026
Merged

DX | 02-11-2026 | Release#78
reeshika-h merged 15 commits into
masterfrom
development

Conversation

@cs-raj

@cs-raj cs-raj commented Nov 2, 2026

Copy link
Copy Markdown
Contributor

Summary

Release PR: promotes development to master. The main change is DX-27614 — release.yml publishes to npm with OIDC trusted publishing (no NPM_TOKEN). It has to be on master, where releases are cut from.

What's included

  • OIDC trusted publishing in release.yml (chore(release): publish to npm with trusted publishing #73): runs on release: published, id-token: write, Node 24 and latest npm
  • Release workflow checks that the release tag matches package.json
  • github-release.yml dropped; the tarball is attached in release.yml
  • Dependency fixes: qs vulnerabilities resolved via lock file refresh, 1 dependency bumped for Snyk
  • Version bump 1.1.4 → 1.1.5

Notes

  • Merging does not publish. Publishing starts when the GitHub release for v1.1.5 is published.
  • The npm trusted-publisher config is tracked in CLOUD-19945 / CLOUD-20184.

🤖 Generated with Claude Code

harshithad0703 and others added 13 commits May 20, 2026 15:10
@harshithad0703
Merge pull request #60 from contentstack/master
4065b31 
chore: back-merge master into development
@harshithad0703
Merge pull request #62 from contentstack/master
dac3671 
chore: back-merge master into development
@OMpawar-21
Merge pull request #67 from contentstack/master
e45be36 
chore: back-merge master into development
@cs-raj @claude
chore(release): publish to npm with trusted publishing
07a7fa6 
Publish on release:published so the npm trusted publisher keyed on release.yml
can be used, drop NODE_AUTH_TOKEN in favour of id-token: write (OIDC), run on
Node 24 with npm@latest (trusted publishing needs npm >= 11.5.1), check out the
release tag without persisted credentials, keep the explicit build-ts step.
GitHub pre-releases go to the beta dist-tag.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
@cs-raj @claude
chore(release): verify the release tag matches package.json
6d6d478 
Refuse to publish when the release tag is not "v" + the package.json version,
so a tag cut on the wrong commit cannot publish an older version under a
newer tag. The tag reaches the check through an env variable, never through
a shell line.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@cs-raj @claude
chore(release): drop github-release.yml, attach the tarball in releas…
c4322c4 
…e.yml

github-release.yml created the GitHub release with GITHUB_TOKEN on every
version bump pushed to master. Events raised by that token do not start other
workflows, so with publishing on release: published a bot-created release
would never run release.yml and npm would silently miss the version.
Releases are created by a person instead (as since v1.1.3), and release.yml
now attaches the npm pack tarball after a successful publish.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@cs-raj @claude
fix: resolve qs vulnerabilities via lock file refresh
c847a78 
Regenerated package-lock.json (clean npm install); no package.json change.

qs 6.15.3 -> 6.16.0 (via body-parser)
Fixes SNYK-JS-QS-19432017 and SNYK-JS-QS-19432019
Snyk: 2 medium findings -> 0

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
@cs-raj
chore: back-merge master into development
9d895a8
@cs-raj
Merge pull request #76 from contentstack/chore/back-merge-master-to-d…
553e841 
…evelopment

chore: back-merge master into development
@cs-raj
Merge remote-tracking branch 'origin/development' into feat/DX-27614
e860b70
@cs-raj @claude
fix: bump 1 dep to resolve Snyk vulnerabilities
03afb7c 
Lock file regenerated (fixed 2 on its own).
Direct upgrades: body-parser ^2.3.0 -> ^2.4.0 (library floor raise;
installs body-parser 2.4.0 and qs 6.16.1)
Overrides: none
.talismanrc: package-lock.json checksum entry replaced by a
filecontent/base64content ignore so lock regens stop tripping Talisman.
Vuln count: snyk 2 -> 0, npm audit 1 -> 0. Build verified passing.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@cs-raj @claude
chore(release): bump version to 1.1.5
b2db42c 
The check-version-bump workflow requires package.json to be above the
latest tag once a PR changes it; this PR's Snyk lock fix does.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@cs-raj
Merge pull request #73 from contentstack/feat/DX-27614
cf5b93f 
chore(release): publish to npm with trusted publishing
@cs-raj
cs-raj requested review from a team as code owners November 2, 2026 05:46
@snyk-io

snyk-io Bot commented Nov 2, 2026 •
edited
Loading

Copy link
Copy Markdown

✅ Snyk checks have passed. No issues have been found so far.

Status Scan Engine Critical High Medium Low Total (0)
✅ Open Source Security 0 0 0 0 0 issues
✅ Licenses 0 0 0 0 0 issues
✅ Code Security 0 0 0 0 0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

@github-actions

github-actions Bot commented Nov 2, 2026

Copy link
Copy Markdown

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type Count (with fixes) Without fixes Threshold Result
🔴 Critical Severity 0 0 10 ✅ Passed
🟠 High Severity 0 0 25 ✅ Passed
🟡 Medium Severity 0 1 500 ✅ Passed
🔵 Low Severity 0 0 1000 ✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity Breaches (with fixes) Breaches (no fixes) SLA Threshold (with/no fixes) Status
🔴 Critical 0 0 15 / 30 days ✅ Passed
🟠 High 0 0 30 / 120 days ✅ Passed
🟡 Medium 0 0 90 / 365 days ✅ Passed
🔵 Low 0 0 180 / 365 days ✅ Passed

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:

  • Critical without fixes: 0
  • High without fixes: 0
  • Medium without fixes: 1
  • Low without fixes: 0

✅ BUILD PASSED - All security checks passed

cs-raj and others added 2 commits November 2, 2026 12:34
@cs-raj @claude
chore: bump dependencies
42f1f6c 
Raise the minimum versions of direct dependencies and refresh package-lock.json.

dependencies:
- debug ^4.3.5 -> ^4.4.3

devDependencies:
- @types/basic-auth ^1.1.2 -> ^1.1.8
- @types/node ^10.12.2 -> ^10.17.60
- jest ^29.0.3 -> ^29.7.0
- rimraf ^2.6.2 -> ^2.7.1
- supertest ^3.3.0 -> ^3.4.2
- typescript ^4.2.0 -> ^4.9.5

package.json version stays at 1.1.5.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
@reeshika-h
Merge pull request #79 from contentstack/chore/bump-dependencies
e434486 
chore: bump dependencies
@github-actions

github-actions Bot commented Nov 2, 2026

Copy link
Copy Markdown

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type Count (with fixes) Without fixes Threshold Result
🔴 Critical Severity 0 0 10 ✅ Passed
🟠 High Severity 0 0 25 ✅ Passed
🟡 Medium Severity 0 0 500 ✅ Passed
🔵 Low Severity 0 0 1000 ✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity Breaches (with fixes) Breaches (no fixes) SLA Threshold (with/no fixes) Status
🔴 Critical 0 0 15 / 30 days ✅ Passed
🟠 High 0 0 30 / 120 days ✅ Passed
🟡 Medium 0 0 90 / 365 days ✅ Passed
🔵 Low 0 0 180 / 365 days ✅ Passed

✅ BUILD PASSED - All security checks passed

@reeshika-h
reeshika-h merged commit c35dc5e into master Nov 2, 2026
10 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Aravind-Kumar-cstk Aravind-Kumar-cstk Aravind-Kumar-cstk approved these changes
@reeshika-h reeshika-h reeshika-h approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@cs-raj @Aravind-Kumar-cstk @reeshika-h @harshithad0703 @OMpawar-21