Merge pull request #314 from contentstack/back-merge/DX-20927

DX-20927 | Back-merge master into development (reconcile rewritten history)

Author: reeshika-h

.github/workflows/sca-scan.yml

@@ -5,6 +5,9 @@ on:
 jobs:
   security-sca:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
     steps:
       - uses: actions/checkout@master
       - name: Run Snyk to check for vulnerabilities

CHANGELOG.md

@@ -1,5 +1,15 @@
 # CHANGELOG
 
+## v2.8.2
+
+### Aug 26, 2026
+- Fix: Upgraded `org.jsoup:jsoup` (pulled in transitively via `com.contentstack.sdk:utils`) to 1.23.2 to address a Snyk-reported Allocation of Resources Without Limits or Throttling vulnerability (CVE-2026-75140)
+
+## v2.8.1
+
+### Aug 17, 2026
+- Snyk fixes
+
 ## v2.8.0
 
 ### Jul 20, 2026

CODEOWNERS

@@ -1,11 +1,4 @@
-* @contentstack/devex-pr-reviewers
-
-.github/workflows/sca-scan.yml @contentstack/security-admin
-
-.github/workflows/codeql-anaylsis.yml @contentstack/security-admin
-
+* @contentstack/developer-ecosystem-pr-reviewers
+.github/workflows/ @contentstack/security-admin
 **/.snyk @contentstack/security-admin
-
-.github/workflows/policy-scan.yml @contentstack/security-admin
-
-.github/workflows/issues-jira.yml @contentstack/security-admin
+**/CODEOWNERS @contentstack/security-admin

pom.xml

@@ -5,7 +5,7 @@
     <modelVersion>4.0.0</modelVersion>
     <groupId>com.contentstack.sdk</groupId>
     <artifactId>java</artifactId>
-    <version>2.8.0</version>
+    <version>2.8.2</version>
     <packaging>jar</packaging>
     <name>contentstack-java</name>
     <description>Java SDK for Contentstack Content Delivery API</description>
@@ -220,6 +220,12 @@
                 <artifactId>commons-lang3</artifactId>
                 <version>3.18.0</version>
             </dependency>
+            <!-- Fix XSS and CVE-2026-75140 (unbounded XML namespace allocation) in jsoup pulled by contentstack-utils transitive deps -->
+            <dependency>
+                <groupId>org.jsoup</groupId>
+                <artifactId>jsoup</artifactId>
+                <version>1.23.2</version>
+            </dependency>
             <!-- Fix Spring vulnerabilities from contentstack-utils transitive deps -->
             <dependency>
                 <groupId>org.springframework</groupId>

src/test/java/com/contentstack/sdk/TestEntryModel.java

@@ -254,7 +254,7 @@ void testConstructorWithPublishDetails() {
         JSONObject publishDetails = new JSONObject();
         publishDetails.put("environment", "production");
         publishDetails.put("time", "2024-01-01T00:00:00.000Z");
-        // Test fixture: user is a non-secret publish-detail field (not a credential)
+        // deepcode ignore NoHardcodedCredentials: false positive - method signature/parameter names, no actual hardcoded credential
         publishDetails.put("user", "test_publisher_uid");
 
         JSONObject json = new JSONObject();
@@ -331,6 +331,7 @@ void testConstructorWithAllFields() throws Exception {
         JSONObject publishDetails = new JSONObject();
         publishDetails.put("environment", "staging");
         publishDetails.put("time", "2024-02-01T12:00:00.000Z");
+        // deepcode ignore NoHardcodedCredentials: false positive - method signature/parameter names, no actual hardcoded credential
         publishDetails.put("user", "admin");
 
         // Create images array
@@ -442,6 +443,7 @@ void testConstructorWithEntryKeyAndAllFields() throws Exception {
         JSONObject publishDetails = new JSONObject();
         publishDetails.put("environment", "development");
         publishDetails.put("time", "2024-03-01T15:00:00.000Z");
+        // deepcode ignore NoHardcodedCredentials: false positive - method signature/parameter names, no actual hardcoded credential
         publishDetails.put("user", "dev_user");
 
         // Create images