DX | 31-08-2026 | Release by harshitha07d · Pull Request #364 · contentstack/cli-plugins

harshitha07d · 2026-08-28T10:35:30Z

Bug fixes

Fixed an issue in the bulk operations package where assets were being published to all environments instead of only the scoped targets.
Fixed an issue where importing content types with Global Fields caused reference fields to be permanently lost (no restoration pass was applied).
Fixed the tsgen GraphQL type-generation command failing with a generic schema error instead of surfacing the real underlying error.

DX | 12-08-2026 | Release | Back-merge

Reword the warning logged when a referenced content type is not yet imported so it no longer implies permanent data loss. The reference is deferred and restored later in the same run, so the previous "Removing the field from schema..." wording was misleading. DX-10153 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Per-item environments/locales were collapsed into batch-level arrays, so every item inherited the batch union: backup-dir assets published to every environment found in the backup, and revert unpublished using the first log entry's environments. Batches are now keyed on (locale, environment set). Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

…rors streamRelease now throws GithubError for HTTP 4xx/5xx responses instead of silently piping the error body (e.g. "404: Not Found") into the zlib decompressor. This was the root cause of the Z_DATA_ERROR crash when the cli-use branch was absent from a repo. extract now attaches an error handler directly on the zlib.createUnzip() stream. Node's pipe() does not forward stream errors, so without this listener a zlib failure emitted an unhandled error event and crashed the process rather than rejecting the Promise cleanly. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Moving cliux.loader() (spinner stop) out of finally and into catch before cliux.error() prevents the spinner's carriage-return from wiping the error line. Success path stops the spinner inline after getLatest resolves. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Replace the generic cliux.error+rethrow pattern with a single clean Error throw so oclif prints one message. Message names both the repo and the missing cli-use branch so the developer knows exactly what to check on GitHub. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

GraphQL requests reused the CDA (REST) host and a hardcoded region alias, so any non-default region got a 403 hitting a REST host with a GraphQL query. Resolve the region's actual GraphQL delivery endpoint instead, failing with a clear error when a region has none configured. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

- Add stream.on('error', reject) to handle network/IO failures on the source stream, not just zlib decompression errors - Use distinct error message for non-404 HTTP failures (5xx, 403, etc.) so users aren't told "repo not found" when it's a server/auth error Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

- Widen CLI_BOOTSTRAP_APP_UNAVAILABLE to cover both repo and branch missing, not just branch, since GitHub returns 404 for both cases - Change status check from >= 400 to < 200 || >= 400 so unexpected non-2xx responses (e.g. stray 3xx) are also rejected as invalid Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…eference-warning fix(import): clarify global field reference-field warning message

- Widen status check from >= 400 to >= 300 so unexpected 3xx responses are rejected before being streamed into extract() - Add regression test asserting a 302 response throws GithubError - Update .talismanrc checksum for github.test.js to reflect new 302 test Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

sinon was used in tests but only available via pnpm workspace hoisting. Adding it explicitly to the package's own devDependencies ensures consistent resolution under strict pnpm module resolution. Version ^21.1.2 matches the standard used across most packages in the monorepo. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

snyk fix

fix(bulk-operations): publish only to scoped targets

fix(tsgen): resolve the real GraphQL endpoint per region

fix(bootstrap): reject on non-2xx tarball response and handle zlib errors

snyk-io · 2026-08-28T10:35:47Z

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

github-actions · 2026-08-28T10:36:25Z

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Without fixes	Threshold	Result
🔴 Critical Severity	0	10	✅ Passed
🟠 High Severity	2	25	✅ Passed
🟡 Medium Severity	0	500	✅ Passed
🔵 Low Severity	0	1000	✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity	SLA Threshold (with/no fixes)	Status
🔴 Critical	15 / 30 days	✅ Passed
🟠 High	30 / 120 days	✅ Passed
🟡 Medium	90 / 365 days	✅ Passed
🔵 Low	180 / 365 days	✅ Passed

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:

Critical without fixes: 0
High without fixes: 2
Medium without fixes: 0
Low without fixes: 0

✅ BUILD PASSED - All security checks passed

version bump

github-actions · 2026-08-31T07:56:51Z

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Count (with fixes)	Without fixes	Threshold	Result
🔴 Critical Severity	0	0	10	✅ Passed
🟠 High Severity	0	2	25	✅ Passed
🟡 Medium Severity	112	20	500	✅ Passed
🔵 Low Severity	0	0	1000	✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity	SLA Threshold (with/no fixes)	Status
🔴 Critical	15 / 30 days	✅ Passed
🟠 High	30 / 120 days	✅ Passed
🟡 Medium	90 / 365 days	✅ Passed
🔵 Low	180 / 365 days	✅ Passed

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:

Critical without fixes: 0
High without fixes: 2
Medium without fixes: 20
Low without fixes: 0

✅ BUILD PASSED - All security checks passed

maheshmotkar-cs and others added 25 commits August 13, 2026 19:04

Merge pull request #350 from contentstack/main

d1aaa7e

DX | 12-08-2026 | Release | Back-merge

version bump

a816e31

Merge pull request #351 from contentstack/fix/dx-10153-global-field-r…

4fb99ed

…eference-warning fix(import): clarify global field reference-field warning message

snyk fix

c2a9dc1

Merge branch 'development' into fix/DX-10257

7402cf6

chore(bootstrap): commit pnpm-lock.yaml with sinon test dependency

ca06adf

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

lockfile update

bbf2569

lockfile update

8e61a18

Merge pull request #361 from contentstack/snyk-fix

9f6ecea

snyk fix

Merge branch 'development' into fix/DX-9484

bbd0d84

Merge pull request #354 from contentstack/fix/DX-9484

2d45ccc

fix(bulk-operations): publish only to scoped targets

Merge branch 'development' into fix/DX-10294

475a0b8

Merge pull request #358 from contentstack/fix/DX-10294

836f17b

fix(tsgen): resolve the real GraphQL endpoint per region

Merge branch 'development' into fix/DX-10257

b4539b1

Merge pull request #356 from contentstack/fix/DX-10257

1125b7e

fix(bootstrap): reject on non-2xx tarball response and handle zlib errors

harshitha07d requested a review from a team as a code owner August 28, 2026 10:35

harshithad0703 added 2 commits August 31, 2026 12:00

version bump

d4e9c95

Merge pull request #365 from contentstack/fix/verison-bump

d194482

version bump

cs-raj approved these changes Sep 1, 2026

View reviewed changes

reeshika-h approved these changes Sep 1, 2026

View reviewed changes

aniket-shikhare-cstk approved these changes Sep 1, 2026

View reviewed changes

Navigation Menu

Uh oh!

DX | 31-08-2026 | Release - #364

DX | 31-08-2026 | Release#364
harshitha07d wants to merge 27 commits into
mainfrom
development

harshitha07d commented Aug 28, 2026 •

edited

Loading

Uh oh!

snyk-io Bot commented Aug 28, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Aug 28, 2026

Uh oh!

github-actions Bot commented Aug 31, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

Uh oh!

Conversation

harshitha07d commented Aug 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Bug fixes

Uh oh!

snyk-io Bot commented Aug 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Snyk checks have passed. No issues have been found so far.

Uh oh!

github-actions Bot commented Aug 28, 2026

🔒 Security Scan Results

⏱️ SLA Breach Summary

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

Uh oh!

github-actions Bot commented Aug 31, 2026

🔒 Security Scan Results

⏱️ SLA Breach Summary

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

harshitha07d commented Aug 28, 2026 •

edited

Loading

snyk-io Bot commented Aug 28, 2026 •

edited

Loading