Is AI recommending you? Ask Contentstack Canoe for free
CS-log-dark.svg

Product Changelog

Stay up-to-date with all the improvements, features, and changes introduced to the product, APIs, docs, and other resources.

rss_feedSubscribe to RSS Feed

Security Fix:

  • Pinned the transitive qs dependency to version 6.16.1 to fix a security vulnerability.

New Feature:

  • Added the opt-in Contentstack.Builder.setSerializeNulls(boolean) option. When you enable it, the SDK sends null values in request bodies to the API instead of dropping them, so you can clear a field's value (for example, a Number field on a localized entry). The option is off by default, so existing behavior does not change.

Security Fix:

  • Fixed security vulnerabilities in the SDK dependencies.

Security Fix:

  • Updated urllib3 to version 2.8.0, certifi to version 2026.10.19, and setuptools to version 84.1.0 to fix security vulnerabilities.
  • Removed unused development packages.

Security Fix:

  • Updated the qs dependency to version 6.16.2 and the follow-redirects dependency (through axios) to version 1.16.2 to fix security vulnerabilities.

Security Fix:

  • Updated the minimum urllib3 version to 2.8.0 to fix vulnerabilities related to improper certificate validation and allocation of resources without limits.

Security Fix:

  • Excluded the vulnerable transitive junit 4.10 dependency (CVE-2020-15250), which json-simple pulled in.
  • Removed the unused junit-vintage-engine test dependency.

Security Fix:

  • Updated the spring-web dependency from version 7.0.8 to 7.0.9 to fix Spring Framework security vulnerabilities.

Security Fix:

  • Updated the qs dependency to version 6.16.1 and the follow-redirects dependency (through axios) to version 1.16.2 to fix security vulnerabilities.

Security Fix:

  • Updated the spring-core, spring-beans, and spring-web dependencies from version 6.2.19 to 7.0.9 to fix Spring Framework security vulnerabilities.

Security Fix:

  • Updated the axios dependency to version 1.20.0 and the follow-redirects dependency to version 1.16.2 to fix security vulnerabilities.

Embedded entries and assets in the JSON Rich Text Editor (RTE) now resolve to their current metadata, so your rendered content no longer serves values captured when the entry was last saved. You can also retrieve nested embedded items in a single request.

With this release, you can:

  • Get current metadata automatically: Utils SDKs resolve asset and entry data from _embedded_items, so current metadata appears without stale or unpublished values leaking through, including for link-type references.
  • Resolve nested items in one call: pass include_embedded_items[]=RECURSIVE to resolve entry-to-entry-to-asset chains without a separate request per level.
  • Control the depth: use embedded_items_depth to limit how many levels are resolved, up to a maximum of 5.
Note
  • Existing behavior is unchanged. Omitting the parameter or using include_embedded_items[]=BASE returns the same response as before, so no migration is required.
  • Depth is capped at 5. Values above 5 are clamped to 5.
  • Higher depths increase payload size, so use the smallest depth you need.
  • RECURSIVE applies to GET requests only.

Check our documentation for more details, or contact support for more information.

Security Fix:

  • Updated the jsoup dependency to version 1.23.2 to resolve a resource allocation vulnerability (CVE-2026-75140).

Security Fix:

  • Updated the jsoup dependency to version 1.23.2 to resolve a resource allocation vulnerability (CVE-2026-75140).

Security Fix:

  • Updated the jsoup dependency to version 1.23.2 to resolve a resource allocation vulnerability (CVE-2026-75140).

New Features:

  • Added publish and unpublish support for taxonomies and terms.
  • Added localize and unlocalize support for taxonomies and terms.

Bug Fix:

  • Upgraded the json gem to 2.21.2 to fix a high-severity use-after-free vulnerability (CVE-2026-71847) in the streaming JSON parser.

Bug Fix:

  • Resolved a security vulnerability.

Bug Fix:

  • Upgraded org.jsoup:jsoup to 1.23.1 to fix a Cross-site Scripting (XSS) vulnerability.

Bug Fixes:

  • Fixed a crash when logging requests whose URLs contain percent-encoded characters, caused by the log message being passed to the system logger as a format string.
  • Fixed a runtime error when using the cacheThenNetwork cache policy with async/await. The policy now resolves once and falls back to cache-else-network.
  • Fixed a per-request networkElseCache cache policy being ignored in favor of the stack-level policy when a transport error occurred.
  • Fixed requests hanging indefinitely when a response returned neither data nor an error. These now fail with an invalid HTTP response error.

Bug Fix:

  • Resolved a security vulnerability.

Bug Fixes:

  • Upgraded @contentstack/core to ^1.5.1 to resolve MODULE_NOT_FOUND and "expression is too dynamic" build failures in bundlers such as Next.js Turbopack and webpack, caused by a dynamic require() call in the keep-alive agent setup. It now uses statically analyzable require('http') and require('https') calls.
  • Guarded keep-alive agent creation for native ESM environments, where require is undefined, to prevent a ReferenceError.
  • Added a package browser field mapping http/https so browser bundles resolve them cleanly.

Bug & Security Fixes:

  • Updated dependencies in datasync-asset-store-filesystem (v2.3.8) to resolve security vulnerabilities.

New Feature:

  • Added Taxonomy CDA support: fetch and query published taxonomies and terms with hierarchy traversal, localization, and fallback.

Bug & Security Fixes:

  • Updated vulnerable dependency versions in contentstack.management.aspnetcore.csproj and test project files to resolve security vulnerabilities.
  • Suppressed static-analysis alerts for hardcoded credentials in test files (integration and unit tests).

Bug & Security Fix:

  • Resolved security vulnerabilities.

Bug & Security Fixes:

  • Bumped @contentstack/core dependency to ^1.5.0, introducing the following stability improvements:
    • Added default retry logic for transient network-level errors (e.g., ECONNABORTED, ETIMEDOUT, ECONNRESET, EPIPE, EAI_AGAIN) when there is no HTTP response.
    • Implemented distinct classification for request timeouts instead of returning a generic UNKNOWN_ERROR.
    • Added default httpAgent and httpsAgent keep-alive connection agents in Node environments.

Bug & Security Fixes:

  • Bumped setuptools minimum version from >=80.0.0,<82.0.0 to >=83.0.0 to resolve a security vulnerability finding.

Bug & Security Fixes:

  • Upgraded setuptools to 83.0.0 to resolve an Improper Unicode Encoding Handling security issue.

Enhancements:

  • Updated the contentType(...).entry(...).variants(variantUidOrUids, branchName?) method to accept an optional branchName as the second argument, which sets the CMA branch header for that variant's scope. The first argument supports either a single variant UID string or an array of UIDs (comma-separated in the request path). Omitting the branch name preserves the previous behavior.
  • Added variants(uid).publish() and variants(uid).unpublish() methods, which call the entry publish and unpublish endpoints by nesting the variant payload under the entry.
  • Updated the publish() and unpublish() methods (for both entries and entry variants) to accept optional headers and parameters, which are merged directly into the underlying HTTP request.
  • Added unit and sanity API tests for entry variants with an explicit branch, as well as for the new variant publish and unpublish methods.

New Features:

  • Added branch support in entry variants.

Enhancements:

  • Updated the variants() method on Entry and Entries to support an optional branch name as the second argument. When provided, the branch is sent as a request header alongside x-cs-variant-uid.
  • Ensured existing variants(uid) and variants(uids) calls remain backward compatible.
  • Added unit and API tests to support variant and branch requests.

New Features:

  • Added branch support in entry variants.

Enhancements:

  • Added support for entry variants with optional branch scoping via the variants() method on Entry and Query.

Enhancements:

  • Added the variants(variant_uids, branch_name) method to Contentstack::Entry and Contentstack::Query to fetch entry variants with optional per-request branch scoping. These requests now send the x-cs-variant-uid header (as comma-separated UIDs) and respect either the stack-level or per-call branch settings.

Bug Fix:

  • Fixed an issue where the previously published 2.0.0 package did not include the EmbeddedObjectConverter. Bumped the package version to 2.0.1 and republished to ensure the published package matches the source code unambiguously.

Bug & Security Fix:

  • Bumped the @contentstack/utils dependency from ^1.4.1 to ^1.9.1.

New Features:

  • Added support for passing an optional branch parameter to the .Variant() method in both the Entry and Query classes to support Entry Variants branching.
  • Implemented an automatic fallback to the Stack's configured branch or "main" if the branch parameter is null or empty.
  • Added comprehensive unit and integration tests for the Entry and Query variant branch logic.

New Features:

  • Added optional branch support for entry variants in the Entry.variants() and ContentType.variants() methods.

New Features:

  • Added branch override support for Entry Variants. The Entry.Variant(uid?, branchUid?) method now accepts an optional branchUid to target a specific branch for variant calls (Find, Create, Update, Fetch, Delete) by overriding the branch request header. If null or empty, it falls back to the Stack's configured branch.
  • Added publish and unpublish support for Entry Variants via EntryVariant.Publish/PublishAsync and EntryVariant.Unpublish/UnpublishAsync. These methods match the PublishUnpublishDetails contract used by Entry.Publish/Unpublish and respect the branch override.

New Features:

  • Added publish and unpublish support for Entry Variants via the entry publish/unpublish endpoints, including documented payloads for entry.variants and optional entry.variant_rules on publish.
  • Added optional stack branch support via the branch request header for Entry Variants. Entry.variants() now accepts no arguments, a branch UID only, or (variant_uid, branch) (use variants(variant_uid, None) when targeting a variant without a branch).

New Feature:

  • Added branch support in entry variants.

New Feature:

  • Added branch support in entry variants.

New Feature:

  • Added support for Taxonomy Localization and Publishing.

Enhancement:

  • Removed the locale parameter from Taxonomy.fetch() and Term.fetch().

New Feature:

  • Added Taxonomy Publishing support to the Content Delivery SDK via stack.taxonomy().

Bug & Security Fix:

  • Removed the unused keyring dependency to resolve a license-policy issue on the transitive secretstorage package.

Bug & Security Fix:

  • Removed hardcoded password literals in unit tests to resolve CWE-798 (Use of Hardcoded Passwords) findings.

New Features:

  • Added Branch management with Create, Fetch, Delete (including Async variants), and Query operations via Stack.Branch(uid?).
  • Introduced multi-region endpoint resolution via Endpoint.GetContentstackEndpoint(region, service) supporting 7 regions (NA, EU, AU, Azure-NA, Azure-EU, GCP-NA, GCP-EU) and 18 service keys.
  • Wired OAuth auto token refresh into the request pipeline.
  • Added PreviewToken support for Create and Delete operations.
  • Added image format upload coverage for JPEG, AVIF, and multi-format assets.

Enhancements:

  • Upgraded the framework requirement to .NET 10 or later.
  • Removed the Newtonsoft.Json dependency; all JSON serialization now uses System.Text.Json.
  • Replaced client.SerializerSettings (JsonSerializerSettings) with client.SerializerOptions (JsonSerializerOptions).
  • Removed response.OpenJObjectResponse() in favor of response.OpenJsonObjectResponse() (JsonObject) or response.OpenTResponse<T>().
  • Updated JObjectParameterValue to accept System.Text.Json.Nodes.JsonNode instead of Newtonsoft.Json.Linq.JObject.
  • Replaced all [JsonProperty] attributes with [JsonPropertyName].

New Features:

  • Added support for the GCP_EU region.
  • Added the Endpoint class for dynamic region-to-URL resolution via CDN-backed regions.json, and ContentstackRegionMap to map the ContentstackRegion enum to registry region IDs.
  • Added ApiErrorBodyParser for consistent API error envelope parsing.
  • Added JsonNodeConversion and JsonObjectMerge utilities to replace Newtonsoft equivalents.
  • Added ContentstackJsonDefaults to provide shared JsonSerializerOptions across all custom converters.

Enhancements:

  • Upgraded the framework requirement to .NET 10 or later.
  • Removed the Newtonsoft.Json dependency; all JSON serialization now uses System.Text.Json (BCL).
  • Migrated SDK methods to use JsonObject instead of JObject. Entry.ToJson(), Query.Count(), AssetLibrary.Count(), ContentType.Fetch(), GlobalField.Fetch(), and GlobalFieldQuery.Find() now return JsonObject.
  • Updated AssetLibrary.Query() to accept JsonObject as its parameter.
  • Replaced SerializerSettings with SerializerOptions and updated model classes to use [JsonPropertyName] instead of [JsonProperty].
  • Updated Config.BaseUrl to resolve hosts from the regions registry, removing the hardcoded regionCode() and HostURL.
  • Replaced Console.WriteLine with Debug.WriteLine in ContentstackConvert to suppress parse warnings from the application stdout.
  • Updated the contentstack.utils dependency to v2.0.0 (final release).
  • Replaced refresh-region.cs with refresh-region.py to prevent MSBuild from compiling the script as source, and added build/contentstack.csharp.targets to auto-deliver the script to consumer projects on their first build.
  • Updated the .NET version in the SCA scan CI pipeline from 7.0.x to 10.0.x.
  • Added EndpointTest.cs and added Assets/regions.json to .gitignore.

New Features:

  • Introduced multi-region endpoint resolution via Endpoint.GetContentstackEndpoint(region, service), supporting 7 regions (NA, EU, AU, Azure-NA, Azure-EU, GCP-NA, GCP-EU) and 18 service keys.
  • Added a proxy method Utils.GetContentstackEndpoint(region, service) to access endpoint resolution directly from the Utils class without needing to import Contentstack.Utils.Endpoints.
  • Added the omitHttps flag to strip the https:// scheme from returned URLs, allowing for direct passing to SDK host configurations (e.g., new ContentstackOptions { Host = Endpoint.GetContentstackEndpoint("eu", "contentDelivery", omitHttps: true) }).
  • Added case-insensitive region alias support (e.g., "us", "NA", "AWS-NA", and "azure_na" all resolve correctly to the same region).
  • Implemented an auto-download and disk caching mechanism for the regions.json registry from the CDN on first use, requiring no setup. The SDK self-heals if the file is missing.
  • Bundled Scripts/refresh-region.py inside the NuGet package, which automatically places the script in your project's Scripts/ folder upon the first dotnet build. You can run this script anytime to pull the latest regions from the CDN.

Breaking Changes:

  • Upgraded the framework requirement to .NET 10 or later (previously netstandard2.0 / net6.0).
  • Removed the Newtonsoft.Json package reference and replaced it with System.Text.Json across the entire package. Consuming projects must add System.Text.Json or rely on the BCL on supported runtimes.
  • Updated GetVariantAliases() and GetVariantMetadataTags() methods to accept JsonObject / JsonArray instead of JObject / JArray.
  • Deprecated GetDataCsvariantsAttribute(JObject/JArray, string), which now maps to JsonObject / JsonArray overloads.
  • Updated Node.attrs values to use System.Text.Json.JsonElement instead of Newtonsoft.Json.Linq.JToken. (Note: Consuming code should update from node.attrs["src"].Value<string>() to node.attrs["src"].GetString()).
  • Updated model classes to use [JsonPropertyName] instead of [JsonProperty].