diff --git a/.talismanrc b/.talismanrc index 0ae5699..3ca200d 100644 --- a/.talismanrc +++ b/.talismanrc @@ -1,4 +1,12 @@ fileignoreconfig: - filename: package-lock.json - checksum: 3656a81955301405bf367fcfe25fde8084ccaf56c260c7bc0c9fd20fa6e80c1e + checksum: 7681285ab507610b8277057e61a7af6299c34fe1ad695ca9ea600fc91a9df8c2 +- filename: test/request.spec.ts + checksum: 64cac3bf1b76418bed42b769393c862fa34152d76ce022a210960691850ff16a +- filename: test/utils/mocks.ts + checksum: db275eae5ff5fbdd2efc202c254f6f5094e3fca3639502a3ee4dff0819623627 +- filename: test/contentstack-error.spec.ts + checksum: 87f5f8e7856290098ee4085e8a5aa6ade3a933d89fb1030bf59ab8eac0e881d8 +- filename: test/utils/test-secrets.ts + checksum: 813223dfa867273f6f4b889530de5f6c608122d769d78d634c2ec9c060e11396 version: "" \ No newline at end of file diff --git a/CHANGELOG.md b/CHANGELOG.md index 6ef4e5e..661c9f2 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,9 @@ ## Change log +### Version: 1.5.4 +#### Date: October-26-2026 + - Fix: Bump qs to 6.17.1, axios to ^1.21.0, tslib to ^2.9.1 and update follow-redirects to 1.16.2 (via axios) to resolve Snyk-reported vulnerabilities + ### Version: 1.5.3 #### Date: September-24-2026 - Fix: Bump qs to 6.16.0 and axios to ^1.20.0 to resolve Snyk-reported vulnerabilities diff --git a/package-lock.json b/package-lock.json index 3ec7919..ba6a1f1 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,19 +1,19 @@ { "name": "@contentstack/core", - "version": "1.5.3", + "version": "1.5.4", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "@contentstack/core", - "version": "1.5.3", + "version": "1.5.4", "license": "MIT", "dependencies": { - "axios": "^1.20.0", + "axios": "^1.21.0", "axios-mock-adapter": "^2.1.0", "lodash": "^4.18.1", - "qs": "6.16.0", - "tslib": "^2.8.1" + "qs": "6.17.1", + "tslib": "^2.9.1" }, "devDependencies": { "@commitlint/cli": "^17.8.1", @@ -3584,9 +3584,9 @@ } }, "node_modules/axios": { - "version": "1.20.0", - "resolved": "https://registry.npmjs.org/axios/-/axios-1.20.0.tgz", - "integrity": "sha512-r8aOh8j9cGKpgQAqpzrUHnSIc6a59Y3Xf/cv8sy1DrHCkZHzQGEuoq1tARk6qSyDdtQGSDgpb9kFlruzPvrgwg==", + "version": "1.21.0", + "resolved": "https://registry.npmjs.org/axios/-/axios-1.21.0.tgz", + "integrity": "sha512-YCzXMB53Q9PZBsh7yN7wtapit4WepwcHS2fP8QhGsBxSz5YtgYobV7GGlWlAJi+RxfU77GQTQi2DSLUma42EYA==", "license": "MIT", "dependencies": { "follow-redirects": "^1.16.0", @@ -6446,9 +6446,9 @@ "license": "ISC" }, "node_modules/follow-redirects": { - "version": "1.16.0", - "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.16.0.tgz", - "integrity": "sha512-y5rN/uOsadFT/JfYwhxRS5R7Qce+g3zG97+JrtFZlC9klX/W5hD7iiLzScI4nZqUS7DNUdhPgw4xI8W2LuXlUw==", + "version": "1.16.2", + "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.16.2.tgz", + "integrity": "sha512-/kVP2U8z596Ia0gwFrwyIeo74ta5aVmSeU1FfAUMAmcEP5EP7zydmag3SLiN64NaRKef3lxsq7i/g7ltJQDGow==", "funding": [ { "type": "individual", @@ -10569,9 +10569,9 @@ } }, "node_modules/qs": { - "version": "6.16.0", - "resolved": "https://registry.npmjs.org/qs/-/qs-6.16.0.tgz", - "integrity": "sha512-h6fhOIaRrID2CbEY2fqs+7t+UXZo+MLAnU5gRIq85uFtdiUPCdsApMlHhXogKVM4HM2DVbIjGNTTYH2OcmP1vA==", + "version": "6.17.1", + "resolved": "https://registry.npmjs.org/qs/-/qs-6.17.1.tgz", + "integrity": "sha512-jd3COkaKVgGUW+ZHyEHCG9bH7RoaaiWuMgzsIBjUMVjLAaWGWpoUAVwljVvBHxRu/2qEHnadLGZrkutYUBPQJA==", "license": "BSD-3-Clause", "dependencies": { "es-define-property": "^1.0.1", @@ -12168,9 +12168,9 @@ } }, "node_modules/tslib": { - "version": "2.8.1", - "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz", - "integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==", + "version": "2.9.1", + "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.9.1.tgz", + "integrity": "sha512-a4Ux9VKuIMHsOS7ENbEq6hK2ZGYIT27Rtl0E4eD9KqwxhKiQeMZE/9xb3IdYwWaSOyIBQLExhQgXDTYoiCxnWA==", "license": "0BSD" }, "node_modules/tsutils": { diff --git a/package.json b/package.json index 8ca4fb8..def61b2 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "@contentstack/core", - "version": "1.5.3", + "version": "1.5.4", "type": "commonjs", "main": "./dist/cjs/src/index.js", "types": "./dist/cjs/src/index.d.ts", @@ -37,11 +37,11 @@ "husky-check": "npx husky install && chmod +x .husky/pre-commit" }, "dependencies": { - "axios": "^1.20.0", + "axios": "^1.21.0", "axios-mock-adapter": "^2.1.0", "lodash": "^4.18.1", - "qs": "6.16.0", - "tslib": "^2.8.1" + "qs": "6.17.1", + "tslib": "^2.9.1" }, "files": [ "dist/*", diff --git a/test/contentstack-core.spec.ts b/test/contentstack-core.spec.ts index 3b710e2..13445d3 100644 --- a/test/contentstack-core.spec.ts +++ b/test/contentstack-core.spec.ts @@ -1,3 +1,4 @@ +import { TEST_ACCESS_TOKEN } from './utils/test-secrets'; import { AxiosInstance } from '../src'; import { httpClient } from '../src/lib/contentstack-core'; import MockAdapter from 'axios-mock-adapter'; @@ -104,8 +105,7 @@ describe('contentstackCore', () => { it('should include apiKey in headers when provided', () => { const options = { apiKey: 'my-api-key', - // deepcode ignore HardcodedNonCryptoSecret: test fixture value, not a real secret - accessToken: 'my-access-token', + accessToken: TEST_ACCESS_TOKEN, insecure: true, defaultHostname: 'example.com', port: 443, @@ -118,8 +118,7 @@ describe('contentstackCore', () => { expect(instance.defaults.headers).toEqual( expect.objectContaining({ api_key: 'my-api-key', - // deepcode ignore HardcodedNonCryptoSecret: test fixture value, not a real secret - access_token: 'my-access-token', + access_token: TEST_ACCESS_TOKEN, }) ); }); @@ -127,8 +126,7 @@ describe('contentstackCore', () => { it('should include accessToken in headers when provided', () => { const options = { apiKey: 'my-api-key', - // deepcode ignore HardcodedNonCryptoSecret: test fixture value, not a real secret - accessToken: 'my-access-token', + accessToken: TEST_ACCESS_TOKEN, insecure: false, defaultHostname: 'example.com', port: 443, @@ -141,8 +139,7 @@ describe('contentstackCore', () => { expect(instance.defaults.headers).toEqual( expect.objectContaining({ api_key: 'my-api-key', - // deepcode ignore HardcodedNonCryptoSecret: test fixture value, not a real secret - access_token: 'my-access-token', + access_token: TEST_ACCESS_TOKEN, }) ); }); diff --git a/test/contentstack-error.spec.ts b/test/contentstack-error.spec.ts index 07030d7..df98ed2 100644 --- a/test/contentstack-error.spec.ts +++ b/test/contentstack-error.spec.ts @@ -1,5 +1,6 @@ /* eslint-disable prettier/prettier */ import { error } from '../src/lib/contentstack-error'; +import { TEST_PASSWORD } from './utils/test-secrets'; import { mockErrorResponse, mockErrorResponseNoData, mockErrorResponseNoConfigNoResponse, mockErrorResponseWithoutErrorData } from './utils/mocks'; describe('Contentstack Error', () => { @@ -26,8 +27,7 @@ describe('Contentstack Error', () => { data: { name: 'John Doe', email: 'johndoe@example.com', - // deepcode ignore NoHardcodedPasswords: test fixture value, not a real secret - password: 'password123', + password: TEST_PASSWORD, }, headers: { authtoken: '...token', @@ -93,8 +93,7 @@ describe('Contentstack Error', () => { data: { name: "John Doe", email: "johndoe@example.com", - // deepcode ignore NoHardcodedPasswords: test fixture value, not a real secret - password: "password123", + password: TEST_PASSWORD, }, headers: { authtoken: "...token", diff --git a/test/request.spec.ts b/test/request.spec.ts index a8d106d..373fa6d 100644 --- a/test/request.spec.ts +++ b/test/request.spec.ts @@ -181,8 +181,7 @@ describe('Request tests', () => { client.stackConfig = { // live_preview not defined - // deepcode ignore HardcodedNonCryptoSecret: test fixture value, not a real secret - apiKey: 'test-key', + apiKey: 'YOUR_API_KEY', }; mock.onGet(url).reply(200, mockResponse); diff --git a/test/utils/mocks.ts b/test/utils/mocks.ts index 9f6b3f9..35264dd 100644 --- a/test/utils/mocks.ts +++ b/test/utils/mocks.ts @@ -1,6 +1,7 @@ /* eslint-disable @cspell/spellchecker */ /* eslint-disable prettier/prettier */ +import { TEST_PASSWORD } from './test-secrets'; const mockErrorResponse = { config: { url: "https://example.com/api/v1/users", @@ -8,8 +9,7 @@ const mockErrorResponse = { data: { name: "John Doe", email: "johndoe@example.com", - // deepcode ignore NoHardcodedPasswords: test fixture value, not a real secret - password: "password123", + password: TEST_PASSWORD, }, headers: { authtoken: "dummy-auth-token", @@ -37,8 +37,7 @@ const mockErrorResponseWithoutErrorData = { data: { name: "John Doe", email: "johndoe@example.com", - // deepcode ignore NoHardcodedPasswords: test fixture value, not a real secret - password: "password123", + password: TEST_PASSWORD, }, headers: { authtoken: "dummy-auth-token", @@ -72,8 +71,7 @@ const mockErrorResponseNoData = { data: { name: "John Doe", email: "johndoe@example.com", - // deepcode ignore NoHardcodedPasswords: test fixture value, not a real secret - password: "password123", + password: TEST_PASSWORD, }, headers: { authtoken: "dummy-auth-token", diff --git a/test/utils/test-secrets.ts b/test/utils/test-secrets.ts new file mode 100644 index 0000000..1f3dd4d --- /dev/null +++ b/test/utils/test-secrets.ts @@ -0,0 +1,8 @@ +import { randomBytes } from 'crypto'; + +/** + * Per-run generated values for tests that need credential-shaped inputs but must not + * commit literal secrets. None of these are real credentials. + */ +export const TEST_PASSWORD = randomBytes(8).toString('hex'); +export const TEST_ACCESS_TOKEN = randomBytes(8).toString('hex');