chore: update dependencies and changelog for v1.31.2 by cs-raj · Pull Request #577 · contentstack/contentstack-management-javascript

cs-raj · 2026-09-22T10:58:46Z

Summary

Dependency update release for v1.31.2, with the changelog entry added. Also fixes a pre-existing CI permissions failure that was blocking this and every other PR.

1. Dependency updates (`abb7104`)

Runtime

Package	From	To
`axios`	^1.18.1	^1.20.0
`qs`	^6.15.2	^6.16.0

Dev
@babel/eslint-parser, @slack/bolt, @types/lodash, jest, nock, ts-jest, webpack

Security impact

npm audit across the full dependency tree, before and after:

	Before (1.31.1)	After (1.31.2)
Total	17	10
Critical	3	3
High	6	1
Moderate	7	5
Low	1	1

Seven resolved, five of them high severity.

The qs advisory is the consumer-facing one — qs is a runtime dependency, so that fix reaches anyone installing the SDK. axios showed no advisory in either tree; that bump is maintenance.

The ten remaining are all dev-only (babel-traverse, mocha, nyc, istanbul-lib-processinfo, serialize-javascript, uuid, diff, mochawesome) and are not shipped to consumers. Clearing them means upgrading the test toolchain — larger than this PR should carry.

Changelog

## [v1.31.2](https://github.com/contentstack/contentstack-management-javascript/tree/v1.31.2) (2026-09-22)

- Resolved security vulnerabilities in dependencies

2. CI permissions fix (`47dd3d2`)

The Coverage report step was failing with:

Failed to create a new comment with: Resource not accessible by integration

unit-test.yml declared no permissions: block, so the job received the repository default. The job log for run 35718905177 records what the token actually held:

GITHUB_TOKEN Permissions
Contents: read
Metadata: read
Packages: read

All read, no write — so the POST to the issue-comments endpoint returned 403. Build, tests and dorny/test-reporter all succeeded; only the coverage comment failed.

Fix is three lines:

permissions:
  contents: read          # actions/checkout
  pull-requests: write    # coverage report comments on the PR

Notes:

Pre-existing, not caused by this PR. Every run since 2026-08-02 fails the same way, including on development and master. Last success was 2026-07-29.
contents: read is required because declaring a permissions block sets unlisted scopes to none, which would break actions/checkout.
checks: write is deliberately not granted — the dorny/test-reporter step is currently succeeding without it.
Mirrors back-merge-pr.yml and sca-scan.yml, which already declare these same two scopes.

Verification

npm run lint — clean
npm run test:unit — 686 passing
npm ci installs cleanly from the updated lockfile
unit-test.yml re-parsed with js-yaml after the edit

Follow-ups not included here

lucassabreu/comment-coverage-clover@main is pinned to a moving branch. Now that it has pull-requests: write, pinning to a SHA is worth a separate decision.
actions/checkout@v2 and actions/setup-node@v3 are several majors behind; the run log warns about Node 20 deprecation.

🤖 Generated with Claude Code

Bumps runtime dependencies axios (^1.18.1 -> ^1.20.0) and qs (^6.15.2 -> ^6.16.0), plus dev dependencies @babel/eslint-parser, @slack/bolt, @types/lodash, jest, nock, ts-jest and webpack. npm audit across the dependency tree before and after: before 17 vulnerabilities (3 critical, 6 high, 7 moderate, 1 low) after 10 vulnerabilities (3 critical, 1 high, 5 moderate, 1 low) Seven resolved, five of them high severity. The qs advisory is the consumer-facing one, since qs is a runtime dependency. The ten that remain are all dev-only (babel-traverse, mocha, nyc, istanbul, serialize-javascript, uuid, diff, mochawesome) and are not shipped. Verified with npm run lint (clean) and npm run test:unit (686 passing). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

snyk-io · 2026-09-22T10:58:59Z

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

github-actions · 2026-09-22T10:59:22Z

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Threshold	Result
🔴 Critical Severity	10	✅ Passed
🟠 High Severity	25	✅ Passed
🟡 Medium Severity	500	✅ Passed
🔵 Low Severity	1000	✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity	SLA Threshold (with/no fixes)	Status
🔴 Critical	15 / 30 days	✅ Passed
🟠 High	30 / 120 days	✅ Passed
🟡 Medium	90 / 365 days	✅ Passed
🔵 Low	180 / 365 days	✅ Passed

✅ BUILD PASSED - All security checks passed

Copilot

Copilot review overview

🟡 Changes recommended

The PR description conflicts with the diff (it states package.json was already 1.31.2, but this PR bumps it), and should be corrected for release accuracy.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 1

Open (1)

Correct version bump details in PR description · New

What changed in this PR

This PR prepares the v1.31.2 dependency-update release for @contentstack/management by bumping runtime/dev dependencies, updating the lockfile, and adding a matching changelog entry.

Changes:

Bump package version to 1.31.2 and update runtime deps (axios, qs) plus several dev deps.
Refresh package-lock.json to reflect the updated dependency graph.
Add the v1.31.2 entry to CHANGELOG.md.

File	Description
package.json	Updates SDK version to 1.31.2 and bumps runtime/dev dependency ranges.
package-lock.json	Regenerates lockfile to match updated dependency versions and transitive tree.
CHANGELOG.md	Adds the v1.31.2 release note entry.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

The Coverage report step (lucassabreu/comment-coverage-clover) creates a comment on the pull request, which is a write operation. unit-test.yml declared no permissions block, so the job received the repository default. The job log for run 35718905177 records what the token actually held: GITHUB_TOKEN Permissions Contents: read Metadata: read Packages: read All read, no write, so the POST to the issue-comments endpoint returned 403 "Resource not accessible by integration". Build, tests and the dorny/test-reporter step all succeeded; only the coverage comment failed. This affects every run since 2026-08-02, including on development and master. The last successful run was 2026-07-29. Declaring a permissions block sets unlisted scopes to none, so contents: read is included for actions/checkout. checks: write is deliberately not granted: the test-reporter step is currently succeeding without it. Mirrors back-merge-pr.yml and sca-scan.yml, which already declare the same two scopes. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

github-actions · 2026-09-23T08:18:29Z

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Threshold	Result
🔴 Critical Severity	10	✅ Passed
🟠 High Severity	25	✅ Passed
🟡 Medium Severity	500	✅ Passed
🔵 Low Severity	1000	✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity	SLA Threshold (with/no fixes)	Status
🔴 Critical	15 / 30 days	✅ Passed
🟠 High	30 / 120 days	✅ Passed
🟡 Medium	90 / 365 days	✅ Passed
🔵 Low	180 / 365 days	✅ Passed

✅ BUILD PASSED - All security checks passed

github-actions · 2026-09-23T08:19:30Z

Coverage report for commit: 4df953b
File: coverage/clover.xml

Cover ┌─────────────────────────┐ Freq.
   0% │ ░░░░░░░░░░░░░░░░░░░░░░░ │  0.0%
  10% │ ░░░░░░░░░░░░░░░░░░░░░░░ │  0.0%
  20% │ ░░░░░░░░░░░░░░░░░░░░░░░ │  0.0%
  30% │ ██░░░░░░░░░░░░░░░░░░░░░ │  2.1%
  40% │ ░░░░░░░░░░░░░░░░░░░░░░░ │  0.0%
  50% │ ░░░░░░░░░░░░░░░░░░░░░░░ │  0.0%
  60% │ ░░░░░░░░░░░░░░░░░░░░░░░ │  0.0%
  70% │ █████░░░░░░░░░░░░░░░░░░ │  6.4%
  80% │ ███████████████████████ │ 36.2%
  90% │ ██████████████████░░░░░ │ 27.7%
 100% │ ██████████████████░░░░░ │ 27.7%
      └─────────────────────────┘
 *Legend:* █ = Current Distribution

Summary - Lines: 82.77% | Methods: 95.77% | Branches: 65.89%

Files	Lines	Methods	Branches
lib
contentstack.js	100.00%	100.00%	100.00%
contentstackClient.js	83.02%	92.86%	69.49%
contentstackCollection.js	94.12%	100.00%	86.96%
entity.js	76.34%	100.00%	62.95%
lib/core
Util.js	77.68%	94.44%	61.65%
concurrency-queue.js	71.84%	72.22%	62.02%
contentstackError.js	100.00%	100.00%	100.00%
contentstackHTTPClient.js	83.05%	84.62%	75.00%
errorMessages.js	100.00%	100.00%	71.43%
moduleHeaderSupport.js	89.71%	100.00%	83.67%
oauthHandler.js	90.85%	100.00%	67.14%
pkceStorage.js	100.00%	100.00%	94.12%
lib/organization
index.js	72.73%	100.00%	48.68%
lib/organization/teams
index.js	89.47%	100.00%	61.11%
lib/organization/teams/stackRoleMappings
index.js	78.57%	100.00%	47.50%
lib/organization/teams/teamUsers
index.js	100.00%	100.00%	87.50%
lib/query
index.js	75.51%	100.00%	59.62%
lib/stack/asset/folders
index.js	100.00%	100.00%	94.74%
lib/stack/asset
index.js	86.75%	100.00%	72.63%
lib/stack/auditlog
index.js	92.31%	100.00%	70.59%
lib/stack/branch
compare.js	70.83%	100.00%	60.00%
index.js	91.49%	100.00%	68.89%
mergeQueue.js	85.71%	100.00%	63.16%
lib/stack/branchAlias
index.js	80.65%	100.00%	59.52%
lib/stack/contentType/entry
index.js	83.72%	100.00%	62.10%
lib/stack/contentType/entry/variants
index.js	82.14%	94.12%	55.26%
lib/stack/contentType
index.js	85.29%	100.00%	68.00%
lib/stack/deliveryToken
index.js	95.65%	80.00%	85.71%
lib/stack/deliveryToken/previewToken
index.js	25.00%	25.00%	6.67%
lib/stack/environment
index.js	100.00%	100.00%	95.00%
lib/stack/extension
index.js	94.12%	100.00%	81.40%
lib/stack/globalField
index.js	92.11%	100.00%	81.13%
lib/stack
index.js	81.31%	92.86%	68.27%
lib/stack/label
index.js	100.00%	100.00%	93.75%
lib/stack/locale
index.js	100.00%	100.00%	95.00%
lib/stack/managementToken
index.js	100.00%	100.00%	90.00%
lib/stack/release
index.js	80.70%	100.00%	59.02%
lib/stack/roles
index.js	100.00%	100.00%	94.44%
lib/stack/taxonomy
index.js	78.35%	100.00%	52.07%
lib/stack/taxonomy/terms
index.js	79.31%	100.00%	56.96%
lib/stack/variantGroup
index.js	82.50%	100.00%	58.14%
lib/stack/variantGroup/variants
index.js	78.57%	100.00%	52.94%
lib/stack/variants
index.js	77.50%	100.00%	51.06%
lib/stack/webhook
index.js	85.00%	100.00%	64.29%
lib/stack/workflow
index.js	84.21%	100.00%	66.67%
lib/stack/workflow/publishRules
index.js	100.00%	100.00%	95.00%
lib/user
index.js	91.43%	100.00%	73.08%

_{🤖 comment via lucassabreu/comment-coverage-clover}

Copilot

Copilot review overview

🟡 Changes recommended

Unresolved workflow permission and security findings must be addressed.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 3 · 1 · 1

Open (5)

PR-controlled build job receives pull-request write access · New
Unpinned third-party action receives write-scoped token · New
Missing checks: write permission breaks test reporter · New
Fork pull requests cannot use write-scoped comment token · New
Correct version bump details in PR description

github-actions · 2026-09-23T11:44:39Z

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Threshold	Result
🔴 Critical Severity	10	✅ Passed
🟠 High Severity	25	✅ Passed
🟡 Medium Severity	500	✅ Passed
🔵 Low Severity	1000	✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity	SLA Threshold (with/no fixes)	Status
🔴 Critical	15 / 30 days	✅ Passed
🟠 High	30 / 120 days	✅ Passed
🟡 Medium	90 / 365 days	✅ Passed
🔵 Low	180 / 365 days	✅ Passed

✅ BUILD PASSED - All security checks passed

Copilot

Copilot review overview

🔵 Needs a closer look

Dependency and workflow changes require final human review, and the PR description has a documentation mismatch.

Review effort: Lite
Findings: 1 · 1 · 1

Open (3)

PR-controlled build job receives pull-request write access
Fork pull requests cannot use write-scoped comment token
Update PR description to reflect pinned coverage action · New

Resolved since last review (3)

Missing checks: write permission breaks test reporter
Unpinned third-party action receives write-scoped token
Correct version bump details in PR description

amit-kanswal-cs

LGTM

Copilot AI lite review requested due to automatic review settings September 22, 2026 10:58

Copilot started reviewing on behalf of cs-raj September 22, 2026 10:59 View session

Copilot AI reviewed Sep 22, 2026

View reviewed changes

Comment thread package.json

aniket-shikhare-cstk previously approved these changes Sep 22, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings September 23, 2026 08:17

cs-raj dismissed aniket-shikhare-cstk’s stale review via 47dd3d2 September 23, 2026 08:17

Copilot started reviewing on behalf of cs-raj September 23, 2026 08:18 View session

Copilot AI reviewed Sep 23, 2026

View reviewed changes

Comment thread .github/workflows/unit-test.yml

Comment thread .github/workflows/unit-test.yml

Comment thread .github/workflows/unit-test.yml

Comment thread .github/workflows/unit-test.yml

Update unit-test.yml

4df953b

Copilot AI review requested due to automatic review settings September 23, 2026 11:43

Aravind-Kumar-cstk approved these changes Sep 23, 2026

View reviewed changes

Copilot started reviewing on behalf of cs-raj September 23, 2026 11:44 View session

Copilot AI reviewed Sep 23, 2026

View reviewed changes

Comment thread .github/workflows/unit-test.yml

netrajpatel approved these changes Sep 24, 2026

View reviewed changes

amit-kanswal-cs approved these changes Sep 24, 2026

View reviewed changes

cs-raj merged commit e498701 into development Sep 24, 2026
14 checks passed

cs-raj deleted the fix/snyk-22-09-26 branch September 24, 2026 06:10

Navigation Menu

chore: update dependencies and changelog for v1.31.2 - #577

chore: update dependencies and changelog for v1.31.2#577
cs-raj merged 3 commits into
developmentfrom
fix/snyk-22-09-26

cs-raj commented Sep 22, 2026 •

edited

Loading

Uh oh!

snyk-io Bot commented Sep 22, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Sep 22, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

github-actions Bot commented Sep 23, 2026

Uh oh!

github-actions Bot commented Sep 23, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Sep 23, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

amit-kanswal-cs left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

Conversation

cs-raj commented Sep 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

1. Dependency updates (abb7104)

Security impact

Changelog

2. CI permissions fix (47dd3d2)

Verification

Follow-ups not included here

Uh oh!

snyk-io Bot commented Sep 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Snyk checks have passed. No issues have been found so far.

Uh oh!

github-actions Bot commented Sep 22, 2026

🔒 Security Scan Results

⏱️ SLA Breach Summary

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

Uh oh!

github-actions Bot commented Sep 23, 2026

🔒 Security Scan Results

⏱️ SLA Breach Summary

Uh oh!

github-actions Bot commented Sep 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Sep 23, 2026

🔒 Security Scan Results

⏱️ SLA Breach Summary

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🔵 Needs a closer look

Uh oh!

Uh oh!

amit-kanswal-cs left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

cs-raj commented Sep 22, 2026 •

edited

Loading

1. Dependency updates (`abb7104`)

2. CI permissions fix (`47dd3d2`)

snyk-io Bot commented Sep 22, 2026 •

edited

Loading

github-actions Bot commented Sep 23, 2026 •

edited

Loading