Merge master into development (back-merge of 1.15.0 Snyk fixes)

Resolved conflicts in changelog.md (kept v1.16.0; v1.15.0 takes master's
release date and Tests line) and pom.xml (kept version 1.16.0).

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Author: reeshika-h

.github/CODEOWNERS

@@ -1,4 +1,5 @@
 * @contentstack/developer-ecosystem-pr-reviewers
 .github/workflows/ @contentstack/security-admin
 **/.snyk @contentstack/security-admin
-**/CODEOWNERS @contentstack/security-admin
+**/CODEOWNERS @contentstack/security-admin
+**/.gitguardian.yaml @contentstack/security-admin

changelog.md

@@ -8,9 +8,10 @@
 
 ## v1.15.0
 
-### Oct 21, 2026
+### Nov 02, 2026
 
 - Feat: Added the opt-in `Contentstack.Builder.setSerializeNulls(boolean)` option. When enabled, `null` values in request bodies are sent to the API instead of being dropped, so a field's value (for example a Number field on a localized entry) can be cleared. Off by default; existing behavior is unchanged.
+- Tests: Replaced hardcoded usernames and API keys in `LoginDetailTest` and `TestClient` with generated values to resolve Snyk Code findings (DX-22133, DX-22134). No change to the published artifact.
 
 ## v1.14.1
 

src/test/java/com/contentstack/cms/TestClient.java

@@ -1,5 +1,6 @@
 package com.contentstack.cms;
 
+import java.util.UUID;
 import com.contentstack.cms.core.Util;
 import com.contentstack.cms.stack.Stack;
 import io.github.cdimascio.dotenv.Dotenv;
@@ -17,8 +18,8 @@ public class TestClient {
     public final static String USER_ID = (env.get("userId") != null) ? env.get("userId") : "c11e668e0295477f";
     public final static String OWNERSHIP = (env.get("ownershipToken") != null) ? env.get("ownershipToken")
             : "ownershipTokenId";
-    // file deepcode ignore NonCryptoHardcodedSecret/test: <please specify a reason of ignoring this>
-    public final static String API_KEY = (env.get("apiKey") != null) ? env.get("apiKey") : "apiKey99999999";
+    public final static String API_KEY = (env.get("apiKey") != null) ? env.get("apiKey")
+            : "blt" + UUID.randomUUID().toString().replace("-", "").substring(0, 16);
     public final static String MANAGEMENT_TOKEN = (env.get("managementToken") != null) ? env.get("managementToken")
             : "managementToken99999999";
 

src/test/java/com/contentstack/cms/models/LoginDetailTest.java

@@ -1,5 +1,6 @@
 package com.contentstack.cms.models;
 
+import java.util.UUID;
 import com.contentstack.cms.core.AuthInterceptor;
 import okhttp3.Interceptor;
 import okhttp3.internal.http.RealInterceptorChain;
@@ -102,9 +103,9 @@ void getterSetterUserModelLastName() {
     @Test
     void getterSetterUserModelUsername() {
         UserModel userModel = new UserModel();
-        // deepcode ignore NoHardcodedCredentials/test: <please specify a reason of ignoring this>
-        userModel.setUsername("***REMOVED***");
-        Assertions.assertEquals("***REMOVED***",
+        String username = UUID.randomUUID().toString();
+        userModel.setUsername(username);
+        Assertions.assertEquals(username,
                 userModel.getUsername());
     }