fix: hardcoded test secrets and qs/follow-redirects vulnerabilities (Snyk) - v1.5.4

.talismanrc

@@ -1,4 +1,12 @@
 fileignoreconfig:
 - filename: package-lock.json
-  checksum: 3656a81955301405bf367fcfe25fde8084ccaf56c260c7bc0c9fd20fa6e80c1e
+  checksum: 7681285ab507610b8277057e61a7af6299c34fe1ad695ca9ea600fc91a9df8c2
+- filename: test/request.spec.ts
+  checksum: 64cac3bf1b76418bed42b769393c862fa34152d76ce022a210960691850ff16a
+- filename: test/utils/mocks.ts
+  checksum: db275eae5ff5fbdd2efc202c254f6f5094e3fca3639502a3ee4dff0819623627
+- filename: test/contentstack-error.spec.ts
+  checksum: 87f5f8e7856290098ee4085e8a5aa6ade3a933d89fb1030bf59ab8eac0e881d8
+- filename: test/utils/test-secrets.ts
+  checksum: 813223dfa867273f6f4b889530de5f6c608122d769d78d634c2ec9c060e11396
 version: ""

CHANGELOG.md

@@ -1,5 +1,9 @@
 ## Change log
 
+### Version: 1.5.4
+#### Date: October-26-2026
+ - Fix: Bump qs to 6.17.1, axios to ^1.21.0, tslib to ^2.9.1 and update follow-redirects to 1.16.2 (via axios) to resolve Snyk-reported vulnerabilities
+
 ### Version: 1.5.3
 #### Date: September-24-2026
  - Fix: Bump qs to 6.16.0 and axios to ^1.20.0 to resolve Snyk-reported vulnerabilities

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contentstack/core",
-  "version": "1.5.3",
+  "version": "1.5.4",
   "type": "commonjs",
   "main": "./dist/cjs/src/index.js",
   "types": "./dist/cjs/src/index.d.ts",
@@ -37,11 +37,11 @@
     "husky-check": "npx husky install && chmod +x .husky/pre-commit"
   },
   "dependencies": {
-    "axios": "^1.20.0",
+    "axios": "^1.21.0",
     "axios-mock-adapter": "^2.1.0",
     "lodash": "^4.18.1",
-    "qs": "6.16.0",
-    "tslib": "^2.8.1"
+    "qs": "6.17.1",
+    "tslib": "^2.9.1"
   },
   "files": [
     "dist/*",

test/contentstack-core.spec.ts

@@ -1,3 +1,4 @@
+import { TEST_ACCESS_TOKEN } from './utils/test-secrets';
 import { AxiosInstance } from '../src';
 import { httpClient } from '../src/lib/contentstack-core';
 import MockAdapter from 'axios-mock-adapter';
@@ -104,8 +105,7 @@ describe('contentstackCore', () => {
     it('should include apiKey in headers when provided', () => {
       const options = {
         apiKey: 'my-api-key',
-        // deepcode ignore HardcodedNonCryptoSecret: test fixture value, not a real secret
-        accessToken: 'my-access-token',
+        accessToken: TEST_ACCESS_TOKEN,
         insecure: true,
         defaultHostname: 'example.com',
         port: 443,
@@ -118,17 +118,15 @@ describe('contentstackCore', () => {
       expect(instance.defaults.headers).toEqual(
         expect.objectContaining({
           api_key: 'my-api-key',
-          // deepcode ignore HardcodedNonCryptoSecret: test fixture value, not a real secret
-          access_token: 'my-access-token',
+          access_token: TEST_ACCESS_TOKEN,
         })
       );
     });
 
     it('should include accessToken in headers when provided', () => {
       const options = {
         apiKey: 'my-api-key',
-        // deepcode ignore HardcodedNonCryptoSecret: test fixture value, not a real secret
-        accessToken: 'my-access-token',
+        accessToken: TEST_ACCESS_TOKEN,
         insecure: false,
         defaultHostname: 'example.com',
         port: 443,
@@ -141,8 +139,7 @@ describe('contentstackCore', () => {
       expect(instance.defaults.headers).toEqual(
         expect.objectContaining({
           api_key: 'my-api-key',
-          // deepcode ignore HardcodedNonCryptoSecret: test fixture value, not a real secret
-          access_token: 'my-access-token',
+          access_token: TEST_ACCESS_TOKEN,
         })
       );
     });

test/contentstack-error.spec.ts

@@ -1,5 +1,6 @@
 /* eslint-disable prettier/prettier */
 import { error } from '../src/lib/contentstack-error';
+import { TEST_PASSWORD } from './utils/test-secrets';
 import { mockErrorResponse, mockErrorResponseNoData, mockErrorResponseNoConfigNoResponse, mockErrorResponseWithoutErrorData } from './utils/mocks';
 
 describe('Contentstack Error', () => {
@@ -26,8 +27,7 @@ describe('Contentstack Error', () => {
         data: {
           name: 'John Doe',
           email: 'johndoe@example.com',
-          // deepcode ignore NoHardcodedPasswords: test fixture value, not a real secret
-          password: 'password123',
+          password: TEST_PASSWORD,
         },
         headers: {
           authtoken: '...token',
@@ -93,8 +93,7 @@ describe('Contentstack Error', () => {
         data: {
           name: "John Doe",
           email: "johndoe@example.com",
-          // deepcode ignore NoHardcodedPasswords: test fixture value, not a real secret
-          password: "password123",
+          password: TEST_PASSWORD,
         },
         headers: {
           authtoken: "...token",

test/request.spec.ts

@@ -181,8 +181,7 @@ describe('Request tests', () => {
 
     client.stackConfig = {
       // live_preview not defined
-      // deepcode ignore HardcodedNonCryptoSecret: test fixture value, not a real secret
-      apiKey: 'test-key',
+      apiKey: 'YOUR_API_KEY',
     };
 
     mock.onGet(url).reply(200, mockResponse);

test/utils/mocks.ts

@@ -1,15 +1,15 @@
 /* eslint-disable @cspell/spellchecker */
 /* eslint-disable prettier/prettier */
 
+import { TEST_PASSWORD } from './test-secrets';
 const mockErrorResponse = {
   config: {
     url: "https://example.com/api/v1/users",
     method: "POST",
     data: {
       name: "John Doe",
       email: "johndoe@example.com",
-      // deepcode ignore NoHardcodedPasswords: test fixture value, not a real secret
-      password: "password123",
+      password: TEST_PASSWORD,
     },
     headers: {
       authtoken: "dummy-auth-token",
@@ -37,8 +37,7 @@ const mockErrorResponseWithoutErrorData = {
     data: {
       name: "John Doe",
       email: "johndoe@example.com",
-      // deepcode ignore NoHardcodedPasswords: test fixture value, not a real secret
-      password: "password123",
+      password: TEST_PASSWORD,
     },
     headers: {
       authtoken: "dummy-auth-token",
@@ -72,8 +71,7 @@ const mockErrorResponseNoData = {
     data: {
       name: "John Doe",
       email: "johndoe@example.com",
-      // deepcode ignore NoHardcodedPasswords: test fixture value, not a real secret
-      password: "password123",
+      password: TEST_PASSWORD,
     },
     headers: {
       authtoken: "dummy-auth-token",

test/utils/test-secrets.ts

@@ -0,0 +1,8 @@
+import { randomBytes } from 'crypto';
+
+/**
+ * Per-run generated values for tests that need credential-shaped inputs but must not
+ * commit literal secrets. None of these are real credentials.
+ */
+export const TEST_PASSWORD = randomBytes(8).toString('hex');
+export const TEST_ACCESS_TOKEN = randomBytes(8).toString('hex');