From 20ebe86b4cf24153b85c05d190257af5bd8f2ef1 Mon Sep 17 00:00:00 2001
From: reeshika-h <reeshika.hosmani@contentstack.com>
Date: Wed, 31 Dec 2025 14:44:10 +0530
Subject: [PATCH 1/3] Update pom.xml dependencies for security fixes and enable
 tests in the build process

---
 pom.xml                                       | 35 +++++++++++++++++++
 .../com/contentstack/sdk/TestEntryModel.java  |  1 +
 2 files changed, 36 insertions(+)

diff --git a/pom.xml b/pom.xml
index f3317c31..14bf2575 100644
--- a/pom.xml
+++ b/pom.xml
@@ -172,6 +172,13 @@
             <artifactId>json-simple</artifactId>
             <version>${json-simple-version}</version>
             <scope>compile</scope>
+            <!-- Exclude junit - it was incorrectly included as compile dep in json-simple -->
+            <exclusions>
+                <exclusion>
+                    <groupId>junit</groupId>
+                    <artifactId>junit</artifactId>
+                </exclusion>
+            </exclusions>
         </dependency>
 
         <dependency>
@@ -215,6 +222,34 @@
                 <artifactId>kotlin-stdlib</artifactId>
                 <version>2.1.0</version> 
             </dependency>
+            <!-- Fix CVE-2025-48924: Uncontrolled Recursion in commons-lang3 -->
+            <dependency>
+                <groupId>org.apache.commons</groupId>
+                <artifactId>commons-lang3</artifactId>
+                <version>3.18.0</version>
+            </dependency>
+            <!-- Fix Spring vulnerabilities from contentstack-utils transitive deps -->
+            <dependency>
+                <groupId>org.springframework</groupId>
+                <artifactId>spring-core</artifactId>
+                <version>6.2.11</version>
+            </dependency>
+            <dependency>
+                <groupId>org.springframework</groupId>
+                <artifactId>spring-beans</artifactId>
+                <version>6.2.11</version>
+            </dependency>
+            <dependency>
+                <groupId>org.springframework</groupId>
+                <artifactId>spring-web</artifactId>
+                <version>6.2.11</version>
+            </dependency>
+            <!-- Fix CVE-2020-15250: junit pulled by json-simple -->
+            <dependency>
+                <groupId>junit</groupId>
+                <artifactId>junit</artifactId>
+                <version>4.13.2</version>
+            </dependency>
         </dependencies>
     </dependencyManagement>
     <build>
diff --git a/src/test/java/com/contentstack/sdk/TestEntryModel.java b/src/test/java/com/contentstack/sdk/TestEntryModel.java
index 0da5c9fb..cbf9fbe2 100644
--- a/src/test/java/com/contentstack/sdk/TestEntryModel.java
+++ b/src/test/java/com/contentstack/sdk/TestEntryModel.java
@@ -254,6 +254,7 @@ void testConstructorWithPublishDetails() {
         JSONObject publishDetails = new JSONObject();
         publishDetails.put("environment", "production");
         publishDetails.put("time", "2024-01-01T00:00:00.000Z");
+        // file deepcode ignore NoHardcodedCredentials/test: <please specify a reason of ignoring this>
         publishDetails.put("user", "user123");
 
         JSONObject json = new JSONObject();

From 8a27208bf7e8c0fc9629dc1fc50333311caafd5e Mon Sep 17 00:00:00 2001
From: reeshika-h <reeshika.hosmani@contentstack.com>
Date: Wed, 31 Dec 2025 15:39:21 +0530
Subject: [PATCH 2/3] Update pom.xml to upgrade dependencies: rxjava to 3.1.11,
 retrofit to 3.0.0, jackson-databind to 2.19.2, and annotations to 26.0.2 for
 improved functionality and security.

---
 pom.xml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pom.xml b/pom.xml
index 14bf2575..0ed4c3ea 100644
--- a/pom.xml
+++ b/pom.xml
@@ -20,8 +20,8 @@
         <maven-source-plugin.version>3.3.1</maven-source-plugin.version>
         <maven-javadoc-plugin.version>3.4.1</maven-javadoc-plugin.version>
         <dotenv-source.version>3.0.0</dotenv-source.version>
-        <rxjava-source.version>3.1.10</rxjava-source.version>
-        <retrofit-source.version>2.11.0</retrofit-source.version>
+        <rxjava-source.version>3.1.11</rxjava-source.version>
+        <retrofit-source.version>3.0.0</retrofit-source.version>
         <loggin.version>5.1.0</loggin.version>
         <jococo-plugin.version>0.8.5</jococo-plugin.version>
         <lombok-source.version>1.18.36</lombok-source.version>
@@ -184,7 +184,7 @@
         <dependency>
             <groupId>com.fasterxml.jackson.core</groupId>
             <artifactId>jackson-databind</artifactId>
-            <version>2.18.2</version>
+            <version>2.19.2</version>
         </dependency>
         <dependency>
             <groupId>com.slack.api</groupId>
@@ -194,7 +194,7 @@
         <dependency>
             <groupId>org.jetbrains</groupId>
             <artifactId>annotations</artifactId>
-            <version>24.0.1</version>
+            <version>26.0.2</version>
         </dependency>
         <dependency>
             <groupId>com.squareup.okhttp3</groupId>

From 9191447c054cdd18fd66e8219f3bc48db6625f04 Mon Sep 17 00:00:00 2001
From: reeshika-h <reeshika.hosmani@contentstack.com>
Date: Wed, 31 Dec 2025 20:39:35 +0530
Subject: [PATCH 3/3] Update LICENSE year to 2026 for copyright compliance

---
 LICENSE | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/LICENSE b/LICENSE
index d78b6bc8..c2a603d8 100644
--- a/LICENSE
+++ b/LICENSE
@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2012 - 2025 Contentstack
+Copyright (c) 2012 - 2026 Contentstack
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal