Merge pull request #199 from contentstack/backmerge/main-into-development-198

Back-merge main into development (1.11.3 Snyk fixes)

Author: reeshika-h

AGENTS.md

@@ -17,7 +17,7 @@
 | Build | `setuptools` / `setup.py`; package `contentstack_management` |
 | HTTP | `requests`, `requests-toolbelt`, `urllib3` |
 | Tests | `pytest` — `tests/integration` (live e2e / sanity, dynamic stack), `tests/unit`, `tests/mock`, `tests/api` (legacy, superseded by `tests/integration`) |
-| Lint / coverage | `pylint`, `coverage` (see `requirements-dev.txt`) |
+| Lint / coverage | `ruff`, `coverage` (see `requirements-dev.txt`) |
 | Secrets / hooks | Talisman, Snyk (see `README.md` development setup) |
 
 ## Source layout
@@ -44,7 +44,7 @@
 | Test (mock) | `pytest tests/mock/ -v` |
 | Test (legacy API, live) | `pytest tests/api/ -v` (needs `.env` — see `tests/cred.py`) |
 | Coverage (CI) | `coverage run -m pytest tests/unit/` |
-| Lint | `pylint contentstack_management/` |
+| Lint | `ruff check contentstack_management/` |
 
 > **CI note:** `.github/workflows/unit-test.yml` runs **only `tests/unit/`** (no credentials). The `tests/integration` sanity suite is run manually (or via a credential-gated job) because it provisions real stacks.
 
@@ -70,7 +70,7 @@ Do not commit secrets. `tests/integration/.env`, `docs/`, and the repo-root `cma
 
 | Skill | Path | What it covers |
 |-------|------|----------------|
-| **Development workflow** | [`skills/dev-workflow/SKILL.md`](skills/dev-workflow/SKILL.md) | Install, pytest suites, packaging version, pylint, hooks, PR baseline |
+| **Development workflow** | [`skills/dev-workflow/SKILL.md`](skills/dev-workflow/SKILL.md) | Install, pytest suites, packaging version, ruff, hooks, PR baseline |
 | **Contentstack Management (SDK)** | [`skills/contentstack-management/SKILL.md`](skills/contentstack-management/SKILL.md) | **`Client`**, **`Stack`**, **`_APIClient`**, CMA resources, OAuth, CMA docs |
 | **Python style & repo layout** | [`skills/python-style/SKILL.md`](skills/python-style/SKILL.md) | Package layout, naming, imports via **`_APIClient`**, secrets in logs |
 | **Testing** | [`skills/testing/SKILL.md`](skills/testing/SKILL.md) | pytest unit / API / mock, **`tests/cred.py`**, env hygiene |

CHANGELOG.md

@@ -9,6 +9,14 @@
 - Branch create: optional `branch.publish_config.environments` (environment names, not UIDs) clones only the listed environments. `[]` clones none; omitting `publish_config` clones all environments, as before. The list is sent unchanged; an unknown name returns the API's 422 response with its body unchanged and no branch is created.
 - Tests: unit tests for the branch create body with and without the environment list and for a mocked 422. Sanity integration tests for create with two names, `[]`, an unknown name and a mix (not run here).
 
+---
+## v1.11.3
+
+#### Date: 02 November 2026
+
+- Bumped `urllib3` minimum version from `>=2.7.0` to `>=2.8.0` in `requirements.txt` and `setup.py` to resolve Snyk findings: improper certificate validation, allocation of resources without limits or throttling, and an infinite loop (DX-27815, DX-27816, DX-27817).
+- Tests: replaced hardcoded passwords and secrets with environment-backed or runtime-generated values and removed `# deepcode ignore` suppression comments, resolving Snyk Code findings (DX-22180 to DX-22195). No change to the published package.
+
 ---
 ## v1.11.2
 

CODEOWNERS

@@ -1,4 +1,5 @@
 * @contentstack/developer-ecosystem-pr-reviewers
 .github/workflows/ @contentstack/security-admin
 **/.snyk @contentstack/security-admin
-**/CODEOWNERS @contentstack/security-admin
+**/CODEOWNERS @contentstack/security-admin
+**/.gitguardian.yaml @contentstack/security-admin

requirements-dev.txt

@@ -1,4 +1,4 @@
 # Development-only dependencies — not shipped in the production package.
-# Keep linting/tools (e.g. pylint) here so production scans can exclude them.
+# Keep linting/tools (e.g. ruff) here so production scans can exclude them.
 -r requirements.txt
-pylint>=2.0.0
+ruff>=0.11.5

requirements.txt

@@ -2,7 +2,7 @@ python-dotenv>=1.2.2
 # <82: pkg_resources (used by coverage-badge and similar tools) was removed in setuptools 82+
 setuptools>=83.0.0
 requests>=2.33.0,<3.0.0
-urllib3>=2.7.0,<3.0.0
+urllib3>=2.8.0,<3.0.0
 requests-toolbelt>=1.0.0,<2.0.0
 pyotp==2.9.0
 packaging>=24.0

setup.py

@@ -69,7 +69,7 @@ def get_author_email(package):
     install_requires=[
         "requests >= 2.5.4",
         "requests-toolbelt >= 0.3.1",
-        "urllib3 >= 2.7.0,<3.0.0",
+        "urllib3 >= 2.8.0,<3.0.0",
     ],
     extras_require={
         "dev": ["pytest>=7.0", "twine>=4.0.2", "packaging>=24.0", "dotenv>=0.0.5", "pylint>=2.0.0"],

skills/README.md

@@ -6,7 +6,7 @@ Source of truth for detailed guidance. Read **[`AGENTS.md`](../AGENTS.md)** firs
 
 | Skill folder | Use when |
 |--------------|----------|
-| **dev-workflow** | Install, **`pytest`** (unit / API / mock), **`__version__`**, pylint, Talisman/Snyk, before PR |
+| **dev-workflow** | Install, **`pytest`** (unit / API / mock), **`__version__`**, ruff, Talisman/Snyk, before PR |
 | **contentstack-management** | **`Client`**, **`Stack`**, **`_APIClient`**, domain modules, OAuth, CMA paths and payloads |
 | **python-style** | Editing **`contentstack_management/`** or **`setup.py`** / **`requirements.txt`**—layout, style, imports |
 | **testing** | Adding or changing tests under **`tests/`**, **`tests/cred.py`**, env for API runs |

skills/dev-workflow/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: dev-workflow
-description: Use for install, pytest suites, versioning, pylint, hooks, and PR baseline in contentstack-management-python.
+description: Use for install, pytest suites, versioning, ruff, hooks, and PR baseline in contentstack-management-python.
 ---
 
 # Development workflow – Contentstack Management Python
@@ -30,7 +30,7 @@ description: Use for install, pytest suites, versioning, pylint, hooks, and PR b
 
 ### Tooling
 
-- **pylint** is listed in **`requirements-dev.txt`**; follow existing style in touched files.
+- **ruff** is listed in **`requirements-dev.txt`** (lint with `ruff check contentstack_management/`); follow existing style in touched files.
 - **Husky / Talisman / Snyk** — see **README.md** for local hook setup.
 
 ### Pull requests

skills/python-style/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: python-style
-description: Use for package layout under contentstack_management/, setup.py, pylint-friendly style, and imports.
+description: Use for package layout under contentstack_management/, setup.py, lint-friendly style, and imports.
 ---
 
 # Python style and repo layout – Contentstack Management Python

tests/api/users/test_api.py

@@ -44,10 +44,8 @@ def test_active_user(self):
             "user": {
                 "first_name": "your_first_name",
                 "last_name": "your_last_name",
-                # deepcode ignore NoHardcodedPasswords: test fixture value, not a real secret
-                "password": "your_password",
-                # deepcode ignore NoHardcodedPasswords: test fixture value, not a real secret
-                "password_confirmation": "confirm_your_password"
+                "password": password,
+                "password_confirmation": password
             }
         }
         response = self.client.user().activate(activation_token, act_data)
@@ -80,10 +78,8 @@ def test_reset_password(self):
         act_data = {
             "user": {
                 "reset_password_token": "abcdefghijklmnop1234567890",
-                # deepcode ignore NoHardcodedPasswords: test fixture value, not a real secret
-                "password": "Simple@123",
-                # deepcode ignore NoHardcodedPasswords: test fixture value, not a real secret
-                "password_confirmation": "Simple@123"
+                "password": password,
+                "password_confirmation": password
             }
         }
         response = self.client.user().reset_password(act_data)