Product Changelog

New Feature:

• Added support for choosing which environments a new branch clones. The branch create request body now accepts an optional publish_config.environments list of environment names. An empty list clones no environments, and omitting publish_config clones all of them. If a name does not match an environment, the API returns a 422 error and does not create the branch.

New Features:

• Added support for choosing which environments a new branch clones. The branch create request body now accepts an optional publish_config.environments list of environment names. An empty list clones no environments, and omitting publish_config clones all of them. If a name does not match an environment, the API returns a 422 error and does not create the branch.
• Added the IBranchPublishConfig type for the publish_config object.

Security Fix:

• Pinned the transitive qs dependency to version 6.16.1 to fix a security vulnerability.

New Feature:

• Added the opt-in Contentstack.Builder.setSerializeNulls(boolean) option. When you enable it, the SDK sends null values in request bodies to the API instead of dropping them, so you can clear a field's value (for example, a Number field on a localized entry). The option is off by default, so existing behavior does not change.

Security Fix:

• Fixed security vulnerabilities in the SDK dependencies.

Security Fix:

• Updated urllib3 to version 2.8.0, certifi to version 2026.10.19, and setuptools to version 84.1.0 to fix security vulnerabilities.
• Removed unused development packages.

Security Fix:

• Updated the qs dependency to version 6.16.2 and the follow-redirects dependency (through axios) to version 1.16.2 to fix security vulnerabilities.

Security Fix:

• Updated the minimum urllib3 version to 2.8.0 to fix vulnerabilities related to improper certificate validation and allocation of resources without limits.

Security Fix:

• Excluded the vulnerable transitive junit 4.10 dependency (CVE-2020-15250), which json-simple pulled in.
• Removed the unused junit-vintage-engine test dependency.

Security Fix:

• Updated the spring-web dependency from version 7.0.8 to 7.0.9 to fix Spring Framework security vulnerabilities.

Security Fix:

• Updated the qs dependency to version 6.16.1 and the follow-redirects dependency (through axios) to version 1.16.2 to fix security vulnerabilities.

Security Fix:

• Updated the spring-core, spring-beans, and spring-web dependencies from version 6.2.19 to 7.0.9 to fix Spring Framework security vulnerabilities.

Security Fix:

• Updated the axios dependency to version 1.20.0 and the follow-redirects dependency to version 1.16.2 to fix security vulnerabilities.

Embedded entries and assets in the JSON Rich Text Editor (RTE) now resolve to their current metadata, so your rendered content no longer serves values captured when the entry was last saved. You can also retrieve nested embedded items in a single request.

With this release, you can:

• Get current metadata automatically: Utils SDKs resolve asset and entry data from _embedded_items, so current metadata appears without stale or unpublished values leaking through, including for link-type references.
• Resolve nested items in one call: pass include_embedded_items[]=RECURSIVE to resolve entry-to-entry-to-asset chains without a separate request per level.
• Control the depth: use embedded_items_depth to limit how many levels are resolved, up to a maximum of 5.

Security Fix:

• Updated the jsoup dependency to version 1.23.2 to resolve a resource allocation vulnerability (CVE-2026-75140).

Security Fix:

• Updated the jsoup dependency to version 1.23.2 to resolve a resource allocation vulnerability (CVE-2026-75140).

Security Fix:

• Updated the jsoup dependency to version 1.23.2 to resolve a resource allocation vulnerability (CVE-2026-75140).

New Features:

• Added publish and unpublish support for taxonomies and terms.
• Added localize and unlocalize support for taxonomies and terms.

Bug Fix:

• Upgraded the json gem to 2.21.2 to fix a high-severity use-after-free vulnerability (CVE-2026-71847) in the streaming JSON parser.

Bug Fix:

• Resolved a security vulnerability.

Bug Fix:

• Upgraded org.jsoup:jsoup to 1.23.1 to fix a Cross-site Scripting (XSS) vulnerability.

Bug Fixes:

• Fixed a crash when logging requests whose URLs contain percent-encoded characters, caused by the log message being passed to the system logger as a format string.
• Fixed a runtime error when using the cacheThenNetwork cache policy with async/await. The policy now resolves once and falls back to cache-else-network.
• Fixed a per-request networkElseCache cache policy being ignored in favor of the stack-level policy when a transport error occurred.
• Fixed requests hanging indefinitely when a response returned neither data nor an error. These now fail with an invalid HTTP response error.

Bug Fix:

• Resolved a security vulnerability.

Bug Fixes:

• Upgraded @contentstack/core to ^1.5.1 to resolve MODULE_NOT_FOUND and "expression is too dynamic" build failures in bundlers such as Next.js Turbopack and webpack, caused by a dynamic require() call in the keep-alive agent setup. It now uses statically analyzable require('http') and require('https') calls.
• Guarded keep-alive agent creation for native ESM environments, where require is undefined, to prevent a ReferenceError.
• Added a package browser field mapping http/https so browser bundles resolve them cleanly.

Bug & Security Fixes:

• Updated dependencies in datasync-asset-store-filesystem (v2.3.8) to resolve security vulnerabilities.

New Feature:

• Added Taxonomy CDA support: fetch and query published taxonomies and terms with hierarchy traversal, localization, and fallback.

Bug & Security Fixes:

• Updated vulnerable dependency versions in contentstack.management.aspnetcore.csproj and test project files to resolve security vulnerabilities.
• Suppressed static-analysis alerts for hardcoded credentials in test files (integration and unit tests).

Bug & Security Fix:

• Resolved security vulnerabilities.

Bug & Security Fixes:

• Bumped @contentstack/core dependency to ^1.5.0, introducing the following stability improvements:
  • Added default retry logic for transient network-level errors (e.g., ECONNABORTED, ETIMEDOUT, ECONNRESET, EPIPE, EAI_AGAIN) when there is no HTTP response.
  • Implemented distinct classification for request timeouts instead of returning a generic UNKNOWN_ERROR.
  • Added default httpAgent and httpsAgent keep-alive connection agents in Node environments.

Bug & Security Fixes:

• Bumped setuptools minimum version from >=80.0.0,<82.0.0 to >=83.0.0 to resolve a security vulnerability finding.

Bug & Security Fixes:

• Upgraded setuptools to 83.0.0 to resolve an Improper Unicode Encoding Handling security issue.

Bug & Security Fixes:

• Upgraded black to >=26.3.1 to fix a high-severity Directory Traversal vulnerability.
• Upgraded pip to >=26.1.2 to fix Arbitrary File Upload, Arbitrary Code Injection, and Directory Traversal vulnerabilities.
• Upgraded setuptools to >=83.0.0 to fix an Improper Unicode Encoding Handling vulnerability.

Enhancements:

• Updated the contentType(...).entry(...).variants(variantUidOrUids, branchName?) method to accept an optional branchName as the second argument, which sets the CMA branch header for that variant's scope. The first argument supports either a single variant UID string or an array of UIDs (comma-separated in the request path). Omitting the branch name preserves the previous behavior.
• Added variants(uid).publish() and variants(uid).unpublish() methods, which call the entry publish and unpublish endpoints by nesting the variant payload under the entry.
• Updated the publish() and unpublish() methods (for both entries and entry variants) to accept optional headers and parameters, which are merged directly into the underlying HTTP request.
• Added unit and sanity API tests for entry variants with an explicit branch, as well as for the new variant publish and unpublish methods.

New Features:

• Added branch support in entry variants.

Enhancements:

• Updated the variants() method on Entry and Entries to support an optional branch name as the second argument. When provided, the branch is sent as a request header alongside x-cs-variant-uid.
• Ensured existing variants(uid) and variants(uids) calls remain backward compatible.
• Added unit and API tests to support variant and branch requests.

New Features:

• Added branch support in entry variants.

Enhancements:

• Added support for entry variants with optional branch scoping via the variants() method on Entry and Query.

Enhancements:

• Added the variants(variant_uids, branch_name) method to Contentstack::Entry and Contentstack::Query to fetch entry variants with optional per-request branch scoping. These requests now send the x-cs-variant-uid header (as comma-separated UIDs) and respect either the stack-level or per-call branch settings.

Bug Fix:

• Fixed an issue where the previously published 2.0.0 package did not include the EmbeddedObjectConverter. Bumped the package version to 2.0.1 and republished to ensure the published package matches the source code unambiguously.

Bug & Security Fix:

• Bumped the @contentstack/utils dependency from ^1.4.1 to ^1.9.1.

New Features:

• Added support for passing an optional branch parameter to the .Variant() method in both the Entry and Query classes to support Entry Variants branching.
• Implemented an automatic fallback to the Stack's configured branch or "main" if the branch parameter is null or empty.
• Added comprehensive unit and integration tests for the Entry and Query variant branch logic.

New Features:

• Added optional branch support for entry variants in the Entry.variants() and ContentType.variants() methods.

New Features:

• Added branch override support for Entry Variants. The Entry.Variant(uid?, branchUid?) method now accepts an optional branchUid to target a specific branch for variant calls (Find, Create, Update, Fetch, Delete) by overriding the branch request header. If null or empty, it falls back to the Stack's configured branch.
• Added publish and unpublish support for Entry Variants via EntryVariant.Publish/PublishAsync and EntryVariant.Unpublish/UnpublishAsync. These methods match the PublishUnpublishDetails contract used by Entry.Publish/Unpublish and respect the branch override.

New Features:

• Added publish and unpublish support for Entry Variants via the entry publish/unpublish endpoints, including documented payloads for entry.variants and optional entry.variant_rules on publish.
• Added optional stack branch support via the branch request header for Entry Variants. Entry.variants() now accepts no arguments, a branch UID only, or (variant_uid, branch) (use variants(variant_uid, None) when targeting a variant without a branch).

New Feature:

• Added branch support in entry variants.

New Feature:

• Added branch support in entry variants.

New Feature:

• Added support for Taxonomy Localization and Publishing.

Enhancement:

• Removed the locale parameter from Taxonomy.fetch() and Term.fetch().

New Feature:

• Added Taxonomy Publishing support to the Content Delivery SDK via stack.taxonomy().

Bug & Security Fix:

• Removed the unused keyring dependency to resolve a license-policy issue on the transitive secretstorage package.

Bug & Security Fix:

• Removed hardcoded password literals in unit tests to resolve CWE-798 (Use of Hardcoded Passwords) findings.