release: v4.6.0 by karancs06 · Pull Request #678 · contentstack/live-preview-sdk

karancs06 · 2026-11-03T11:20:31Z

Live Preview SDK v4.6.0

Summary

More field types can now be edited straight from the Visual Builder canvas toolbar: Select, Tags, Taxonomy and Boolean. The editor is also told when the entries on the page change, and field labels load faster because the reference map request now names the hovered entry.

What's changed

Features

Select fields: edit them from the canvas toolbar.
Entry tags: edit an entry's tags from the canvas toolbar.
Taxonomy fields: an Edit button and the whole-field toolbar, with a short explanation on the Taxonomy add buttons.
Boolean fields: an Edit button on the canvas toolbar.
Page entries: the editor is notified when the entries on the page change.

Fixes

The reference map request now sends the hovered field's entry uid, content type and locale, so the editor can answer for that entry alone instead of looking up every entry on the page. Editors that ignore the payload behave as before.
dompurify bumped to patch a DOM XSS advisory.

Refactoring

Field toolbar: isEditedAsOneValue split into isMultipleSelect and isTaxonomyField.

Tests

Dropped Boolean toolbar tests that other toolbar tests already cover.

Chores

Version bump to 4.6.0; CHANGELOG regenerated via auto-changelog, plus the reference map fix added to the v4.6.0 section.
README CDN snippet pinned to @contentstack/live-preview-utils@4.6.0.
CODEOWNERS update from main.

Post-merge checklist

Merge the main sync into stage_v4 first (chore: sync main into stage_v4 for v4.6.0 #677), so this branch is up to date with main
Merge this PR (stage_v4 → main)
Create GitHub Release v4.6.0 from main (tag created via Release UI), which triggers the npm-publish workflow
Verify @contentstack/live-preview-utils@4.6.0 is published to npm
Verify CDN https://esm.sh/@contentstack/live-preview-utils@4.6.0 resolves

🤖 Generated with Claude Code

Bumps dompurify from 3.4.13/3.4.14 to 3.4.16 (direct dependency) in package.json and package-lock.json, resolving a Snyk-reported Cross-site Scripting (XSS) advisory in dompurify. Co-Authored-By: Claude <noreply@anthropic.com>

…662) * feat(VB-2354): notify the editor when the entries on the page change (#648) * feat: notify the editor when the entries on the page change Send entries-in-page-changed once the builder is ready and again from the body MutationObserver whenever the entry+locale set on the page changes, so the editor can react to late-rendered references without polling. Dedup the page scan by entry and locale. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * refactor: rename the push event to entries-in-current-page-changed Matches the noun of get-entries-in-current-page and the past-tense form the other push events use. Settled before release since the string is the wire contract on a pinned SDK. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix: notify entry changes when data-cslp is rewritten in place The page observer only watched childList, so a framework re-render that keeps the node and swaps its data-cslp (variant switch, re-keyed list) never pushed the new entry set. Watch that one attribute too. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix: keep get-entries-in-current-page deduped by entry uid The first cut keyed the page scan by entry+locale, which changed what existing callers of the request receive. An entry renders in one locale per page, so key by uid again and let the push send the same object. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix: report an empty entry set on the first page scan The initial signature was "", the same as an empty page, so a page with no data-cslp elements never sent the opening event. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * test: expect the entries-in-current-page-changed event on builder init The builder now reports an empty entry set on the first scan, so the init test sees one more post message. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com> * fix(visual-builder): recover when the editor misses the entries push The push had no rejection handler, so an editor without the listener left an unhandled rejection on every send and the set was never resent. The failed signature now resets so the next observer pass retries, and destroy() cancels the pending debounced pass. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>

fix(security): bump dompurify to patch DOM XSS advisory

* feat(select-edit): classify number-typed dropdowns as Select Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat(select-edit): show the Edit button for Select fields Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat(select-edit): hide add-value buttons on multiple Select fields Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(select-edit): send whole-field metadata when editing a multiple Select A value click on a multiple Select opened the modal at the value's index, so the saved value landed inside the array instead of replacing it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0195ab4j6aVrXMYw6Dm6Nndx --------- Co-authored-by: Claude <noreply@anthropic.com>

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PhGzeBieWdXYBvXLHnWDDf

…ct and isTaxonomyField

…olbar tests Note why Select skips canvas add buttons while Taxonomy keeps them, and that Taxonomy is always multiple. Drop a duplicate Edit button test, keep the Taxonomy test setup at the top of its block, and cover a Taxonomy inside a modular block keeping its parent index on Edit. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PhGzeCtGiaD8r2BWLkqEWx

…utton feat(field-toolbar): show the Edit button for Taxonomy fields on the canvas toolbar

* feat(visual-builder): add tags field type and Edit button Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WR1cdspQX3zgyjf5NZhSsa * feat(visual-builder): edit entry tags as one field from the toolbar Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WR1cdspQX3zgyjf5NZhSsa * fix(visual-builder): use the Venus tag icon for the tags field Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WR1cdtPR9Cyz2DQKRoMFCJ --------- Co-authored-by: Claude <noreply@anthropic.com>

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YU96SVM9VXkfjSbSeoFdZ4

…ady cover Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YU96SUpGdU5NuSX7N5UsA5

feat(field-toolbar): show the Edit button for Boolean fields

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

The field label asked the editor for the whole reference map on every hover, which the editor builds by looking up every entry on the page. The request now carries the hovered field's entry uid, content type and locale, so the editor can answer for that entry alone, at once for the page entry. Editors that do not read the payload behave as before. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

release: v4.6.0 (develop_v4 to stage_v4)

…ap-nonblocking fix(visual-builder): name the hovered entry in the reference map request

chore: sync stage_v4 into develop_v4 after v4.6.0

release: promote develop_v4 to stage_v4

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

snyk-io · 2026-11-03T11:20:43Z

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

github-actions · 2026-11-03T11:21:08Z

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Count (with fixes)	Threshold	Result
🔴 Critical Severity	2	10	✅ Passed
🟠 High Severity	2	25	✅ Passed
🟡 Medium Severity	1	500	✅ Passed
🔵 Low Severity	1	1000	✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity	SLA Threshold (with/no fixes)	Status
🔴 Critical	15 / 30 days	✅ Passed
🟠 High	30 / 120 days	✅ Passed
🟡 Medium	90 / 365 days	✅ Passed
🔵 Low	180 / 365 days	✅ Passed

✅ BUILD PASSED - All security checks passed

github-actions · 2026-11-03T11:30:14Z

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	68.72%	2597 / 3779
🔵	Statements	67.6%	2640 / 3905
🔵	Functions	66.28%	468 / 706
🔵	Branches	63.07%	1573 / 2494

File Coverage

File	Stmts	Branches	Functions	Lines	Uncovered Lines
Changed Files
src/visualBuilder/index.ts	61.22%	33.33%	44.44%	60.95%	105-111, 115-118, 123-132, 138-208, 259-272, 275, 286-307, 361-363, 367, 426-429
src/visualBuilder/components/FieldToolbar.tsx	70.76%	71.84%	57.14%	70.76%	67-94, 105-112, 181-182, 232-248, 312-319, 350-356, 366, 370, 423-427, 446
src/visualBuilder/components/fieldLabelWrapper.tsx	60.9%	62.62%	69.56%	61.68%	48-49, 64-65, 113-116, 150-160, 180-182, 260-269, 276-279, 314-317, 322-349, 402, 407-410, 416, 575
src/visualBuilder/components/icons/fields/index.ts	100%	100%	100%	100%
src/visualBuilder/generators/generateCustomCursor.ts	100%	80%	100%	100%
src/visualBuilder/utils/constants.ts	100%	100%	100%	100%
src/visualBuilder/utils/getEntryIdentifiersInCurrentPage.ts	100%	100%	100%	100%
src/visualBuilder/utils/getFieldType.ts	96%	97.14%	100%	100%	5
src/visualBuilder/utils/handleIndividualFields.ts	100%	85%	100%	100%

Generated in workflow #966 for commit 03b79fd by the Vitest Coverage Report Action

chore: sync main into stage_v4 for v4.6.0

github-actions · 2026-11-03T11:57:43Z

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Count (with fixes)	Threshold	Result
🔴 Critical Severity	2	10	✅ Passed
🟠 High Severity	2	25	✅ Passed
🟡 Medium Severity	1	500	✅ Passed
🔵 Low Severity	1	1000	✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity	SLA Threshold (with/no fixes)	Status
🔴 Critical	15 / 30 days	✅ Passed
🟠 High	30 / 120 days	✅ Passed
🟡 Medium	90 / 365 days	✅ Passed
🔵 Low	180 / 365 days	✅ Passed

✅ BUILD PASSED - All security checks passed

kirtesh-cstk

LGTM

hitesh-shetty-cstk

LGTM!!

claude and others added 25 commits October 3, 2026 03:40

fix(security): bump dompurify to patch DOM XSS advisory

eb53cc9

Bumps dompurify from 3.4.13/3.4.14 to 3.4.16 (direct dependency) in package.json and package-lock.json, resolving a Snyk-reported Cross-site Scripting (XSS) advisory in dompurify. Co-Authored-By: Claude <noreply@anthropic.com>

Merge branch 'develop_v4' into fix/dompurify-xss

01fd725

Merge pull request #660 from contentstack/fix/dompurify-xss

f3e2ffe

fix(security): bump dompurify to patch DOM XSS advisory

feat(field-toolbar): show the Edit button for Taxonomy fields

e5175f4

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PhGzeBieWdXYBvXLHnWDDf

feat(field-toolbar): give Taxonomy fields the whole-field toolbar

a84b2c2

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PhGzeBieWdXYBvXLHnWDDf

refactor(field-toolbar): split isEditedAsOneValue into isMultipleSele…

9b34a1d

…ct and isTaxonomyField

Merge pull request #669 from contentstack/agent/taxonomy-field-edit-b…

ab49ee5

…utton feat(field-toolbar): show the Edit button for Taxonomy fields on the canvas toolbar

feat(field-toolbar): show the Edit button for Boolean fields

60fbed8

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YU96SVM9VXkfjSbSeoFdZ4

test(field-toolbar): drop Boolean tests that other toolbar tests alre…

88b0ee2

…ady cover Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YU96SUpGdU5NuSX7N5UsA5

Merge pull request #671 from contentstack/agent/boolean-edit-button

28f24be

feat(field-toolbar): show the Edit button for Boolean fields

Merge branch 'develop_v4' into stage_v4 for v4.6.0 release

b04d5d7

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

4.6.0

da007ae

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

fix: update CDN version to 4.6.0 in README

b732cd8

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Merge pull request #674 from contentstack/release-v4.6.0

0a499cb

release: v4.6.0 (develop_v4 to stage_v4)

Merge pull request #672 from contentstack/fix/field-label-reference-m…

923344d

…ap-nonblocking fix(visual-builder): name the hovered entry in the reference map request

Merge branch 'develop_v4' into sync-stage-v4-develop-v4

f62c092

Merge pull request #676 from contentstack/sync-stage-v4-develop-v4

0cbd067

chore: sync stage_v4 into develop_v4 after v4.6.0

Merge pull request #675 from contentstack/develop_v4

074f0cc

release: promote develop_v4 to stage_v4

Merge branch 'main' into sync-main-into-stage-v4

ec94d24

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs(changelog): add the reference map fix to v4.6.0

16bb292

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

karancs06 requested a review from a team as a code owner November 3, 2026 11:20

Merge pull request #677 from contentstack/sync-main-into-stage-v4

03b79fd

chore: sync main into stage_v4 for v4.6.0

kirtesh-cstk approved these changes Nov 4, 2026

View reviewed changes

hitesh-shetty-cstk approved these changes Nov 4, 2026

View reviewed changes

sairaj-cs self-requested a review November 4, 2026 06:17

sairaj-cs approved these changes Nov 4, 2026

View reviewed changes

karancs06 merged commit 9183bcb into main Nov 4, 2026
10 checks passed

Navigation Menu

Repository navigation

release: v4.6.0 - #678

release: v4.6.0#678
karancs06 merged 26 commits into
mainfrom
stage_v4

karancs06 commented Nov 3, 2026

Uh oh!

snyk-io Bot commented Nov 3, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Nov 3, 2026

Uh oh!

github-actions Bot commented Nov 3, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Nov 3, 2026

Uh oh!

kirtesh-cstk left a comment

Uh oh!

hitesh-shetty-cstk left a comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

Conversation

karancs06 commented Nov 3, 2026

Live Preview SDK v4.6.0

Summary

What's changed

Features

Fixes

Refactoring

Tests

Chores

Post-merge checklist

Uh oh!

snyk-io Bot commented Nov 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Snyk checks have passed. No issues have been found so far.

Uh oh!

github-actions Bot commented Nov 3, 2026

🔒 Security Scan Results

⏱️ SLA Breach Summary

Uh oh!

github-actions Bot commented Nov 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Coverage Report

Uh oh!

github-actions Bot commented Nov 3, 2026

🔒 Security Scan Results

⏱️ SLA Breach Summary

Uh oh!

kirtesh-cstk left a comment

Choose a reason for hiding this comment

Uh oh!

hitesh-shetty-cstk left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

snyk-io Bot commented Nov 3, 2026 •

edited

Loading

github-actions Bot commented Nov 3, 2026 •

edited

Loading