V1-legacy - #333
Merged
Merged
Conversation
feat: add asset scanning support in import
…Each Assets loaded from --data-dir backup may not have a publish_details field if they were never published. The optional chain only guarded `asset`, not `publish_details`, causing a TypeError in displayAssetsDetails().
…sets.js setConfig() assigned to `config` at module scope but the variable was never declared, causing a ReferenceError on any cm:assets:publish run that goes through the data-dir flow.
…portCommand for asset publishing
…nd update related logic
fix: Update flags in AssetsPublishCommand and add user reminder in ImportCommand for asset publishing
publish() flattened each asset's publish_details into independent environments[] and locales[] arrays, so the CMA republished the cartesian product. For a ragged publish state (different locales on different environments) this over-published to env-locale pairs that never existed on the source stack. Add buildPublishGroups: group publish_details by environment, coalesce environments with an identical locale set, and emit one publish call per group so each call is a single rectangle the CMA reproduces exactly. A rectangular asset still collapses to one call (unchanged behavior). The DX-1656 invalid-environment guard is preserved (envs absent from the destination are still skipped). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Bumps [adm-zip](https://github.com/cthackers/adm-zip) from 0.5.18 to 0.6.0. - [Release notes](https://github.com/cthackers/adm-zip/releases) - [Changelog](https://github.com/cthackers/adm-zip/blob/master/history.md) - [Commits](cthackers/adm-zip@v0.5.18...v0.6.0) --- updated-dependencies: - dependency-name: adm-zip dependency-version: 0.6.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
back merge
git-diff@2.0.7 is unmaintained (last published 2018) and pulls in chalk@2, diff@3, loglevel, shelljs and shelljs.exec. Snyk flagged the only vulnerable path in the monorepo through that tree: Missing Release of Resource after Effective Lifetime [Medium] SNYK-JS-INFLIGHT-6095116 git-diff@2.0.7 > shelljs@0.8.5 > glob@7.2.3 > inflight@1.0.6 Snyk reports no direct upgrade or patch, since git-diff is abandoned. Replace it with diff@^9 (jsdiff): zero runtime dependencies, bundled TypeScript types, dual CJS/ESM. It also removes the dependency on a `git` binary and the temp-file/subprocess round trip git-diff used to shell out through shelljs. buildDiffString now calls createTwoFilesPatch, which emits the `---` and `+++` file headers itself, so the hand-rolled header concatenation is gone. Output was verified equivalent: both patch strings were run through Diff2html.parse and compared on file names, added/deleted line counts, hunk headers and every line type plus content - identical. Identical inputs are also handled better. git-diff returned undefined when both sides matched, which interpolated the literal string "undefined" into the patch; createTwoFilesPatch returns a well-formed patch with no hunks. Drop @types/git-diff, since diff ships its own types. Tests: the existing spec mocked diff2html, so the generated patch was never asserted. Add two cases covering the string handed to Diff2html.parse - one for headers, hunk and changed lines, one for the identical-input case. Both were mutation-checked against a corrupted buildDiffString. Suite: 78 passed, 16 suites, tsc clean, Snyk reports no vulnerable paths across the monorepo. Bump the pinned pnpm-lock.yaml checksum in .talismanrc, which the lockfile change invalidates. The finding is the usual sha512 integrity hashes, not a secret. Note: this commit also carries a pre-existing, uncommitted version bump to 1.5.4 that was already present in package.json. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
added audit check and fix for assets in pending or quarantined state
…ith-jsdiff fix(content-type): replace git-diff with jsdiff to clear Snyk issue
feat: v1 asset scanning support in bulk publish and import
netrajpatel
previously approved these changes
Aug 5, 2026
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates the SCA GitHub Actions workflow for the v1-legacy branch by explicitly setting GITHUB_TOKEN permissions for the security-sca job.
Changes:
- Adds an explicit
permissionsblock to thesecurity-scaworkflow job (includingpull-requests: write). - Keeps the existing Snyk scan and
contentstack/sca-policyaction execution flow.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
…ull-guard fix(bulk-publish): add null guard on asset.publish_details before forEach
…-zip-0.6.0 chore(deps): bump adm-zip from 0.5.18 to 0.6.0
bumped versions
…o updated-lock-file
…ns into updated-lock-file
updated lock file
Development
🔒 Security Scan Results
⏱️ SLA Breach Summary
✅ BUILD PASSED - All security checks passed |
cs-raj
approved these changes
Aug 6, 2026
Madhuri-cs
approved these changes
Aug 6, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.