fix(snyk): resolve 385 vulnerabilities in contentstack/extensions

.github/workflows/codeql-analysis.yml

@@ -0,0 +1,68 @@
+# For most projects, this workflow file will not need changing; you simply need
+# to commit it to your repository.
+#
+# You may wish to alter this file to override the set of languages analyzed,
+# or to provide custom queries or build logic.
+#
+# ******** NOTE ********
+# We have attempted to detect the languages in your repository. Please check
+# the `language` matrix defined below to confirm you have the correct set of
+# supported CodeQL languages.
+#
+name: "CodeQL"
+
+on:
+  pull_request:
+    # The branches below must be a subset of the branches above
+    branches: '*'
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [ 'javascript' ]
+        # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby' ]
+        # Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v3
+
+    # Initializes the CodeQL tools for scanning.
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@v2
+      with:
+        languages: ${{ matrix.language }}
+        # If you wish to specify custom queries, you can do so here or in a config file.
+        # By default, queries listed here will override any specified in a config file.
+        # Prefix the list here with "+" to use these queries and those in the config file.
+
+        # Details on CodeQL's query packs refer to : https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
+        # queries: security-extended,security-and-quality
+
+
+    # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
+    # If this step fails, then you should remove it and run the build manually (see below)
+    - name: Autobuild
+      uses: github/codeql-action/autobuild@v2
+
+    # ℹ️ Command-line programs to run using the OS shell.
+    # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
+
+    #   If the Autobuild fails above, remove it and uncomment the following three lines. 
+    #   modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance.
+
+    # - run: |
+    #   echo "Run, Build Application using script"
+    #   ./location_of_script_within_repo/buildscript.sh
+
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@v2

.github/workflows/policy-scan.yml

@@ -0,0 +1,46 @@
+name: Checks the security policy and configurations
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+jobs:
+  security-policy:
+    if: github.event.repository.visibility == 'public'
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - uses: actions/checkout@master
+      - name: Checks for SECURITY.md policy file
+        run: |
+          if ! [[ -f "SECURITY.md" || -f ".github/SECURITY.md" ]]; then exit 1; fi
+  security-license:
+    if: github.event.repository.visibility == 'public'
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - uses: actions/checkout@master
+      - name: Checks for License file
+        run: |
+          expected_license_files=("LICENSE" "LICENSE.txt" "LICENSE.md" "License.txt")
+          license_file_found=false
+          current_year=$(date +"%Y")
+
+          for license_file in "${expected_license_files[@]}"; do
+              if  [ -f "$license_file" ]; then
+                 license_file_found=true
+                 # check the license file for the current year, if not exists, exit with error
+                  if  ! grep -q "$current_year" "$license_file"; then
+                      echo "License file $license_file does not contain the current year."
+                      exit 2
+                  fi
+                  break
+              fi        
+          done
+
+          if [ "$license_file_found" = false ]; then
+              echo "No license file found. Please add a license file to the repository."
+              exit 1
+          fi

.github/workflows/sca-scan.yml

@@ -0,0 +1,21 @@
+name: Source Composition Analysis Scan
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+jobs:
+  security-sca:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
+    steps:
+      - uses: actions/checkout@master
+      - name: Run Snyk to check for vulnerabilities
+        uses: snyk/actions/node@master
+        env:
+          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
+        with:
+          args: --all-projects --fail-on=all
+          json: true
+        continue-on-error: true
+      - uses: contentstack/sca-policy@main

.gitignore

@@ -1 +1,24 @@
-**/**/node_modules/*
+### react ###
+.DS_*
+*.log
+logs
+**/*.backup.*
+**/*.back.*
+
+node_modules
+bower_components
+
+*.sublime*
+
+psd
+thumb
+sketch
+
+### npm audit reports ###
+npm_audit_consolidated_report.txt
+npm_audit_report*.txt
+npm_audit*.txt
+
+### scripts ###
+npm_audit_all.sh
+npm_audit*.sh

.talismanrc

@@ -0,0 +1,5 @@
+fileignoreconfig:
+- filename: .github/workflows/secrets-scan.yml
+  ignore_detectors:
+    - filecontent
+version: "1.0"

CODEOWNERS

@@ -0,0 +1,11 @@
+* @contentstack/marketplace-solutions-pr-reviewers
+
+.github/workflows/sca-scan.yml @contentstack/security-admin
+
+.github/workflows/codeql-anaylsis.yml @contentstack/security-admin
+
+**/.snyk @contentstack/security-admin
+
+.github/workflows/policy-scan.yml @contentstack/security-admin
+
+.github/workflows/issues-jira.yml @contentstack/security-admin

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Contentstack
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -1,52 +1,101 @@
-***REMOVED***Contentstack Extensions 
+# Contentstack Extensions
 
-Contentstack provides Extensions that let you extend its UI. It provides two types of extensions: Custom Fields and Custom Widgets.
+Contentstack provides Extensions that let you extend its UI. It provides four types of extensions: Custom Fields, Custom Widgets, Dashboard Widgets and JSON RTE Plugin.
 
-The **Custom Fields** extension lets you create custom fields that you can use in your content types, such as a color picker, code editor, video selector, and more. The **Custom Widgets** extension lets you add widgets that help you analyze the content of an entry and recommend content ideas. Examples of custom widgets are SEO recommendations, sentiment analysis, and content translation in different languages.
+The **Custom Fields** extension lets you create custom fields that you can use in your content types, such as a color picker, code editor, video selector, and more.
 
-This is a repository of example extensions created using Contentstack’s [Extensions SDK](https://github.com/contentstack/ui-extensions-sdk).
+The **Custom Widgets** extension lets you add widgets that help you analyze the content of an entry and recommend content ideas. Examples of custom widgets are SEO recommendations, sentiment analysis, and content translation in different languages.
 
-##***REMOVED***Examples of custom fields created using Extensions
-Here are some examples/use cases of custom fields that can be created using Extensions. These examples come with readme files that explain how to install and get started with these fields.   
+The **Dashboard Widgets extension** allows you to add widgets to the dashboard of your stack. Using this extension, you can create useful widgets such as recently published content, to-do list, personal notes, stack summary, and more.
+
+The **JSON Rich Text Editor Plugins** lets you add/create custom plugins to extend the functionality of your JSON Rich Text Editor as per your needs. You can use the prebuilt JSON RTE plugins by modifying the code to suit your requirement. Some of the basic prebuilt plugins include Highlight, Info Panel, and Word Count. 
+
+
+This is a repository of example extensions created using Contentstack’s [App SDK](https://www.npmjs.com/package/@contentstack/app-sdk) for JSON RTE Plugins and for others [Extensions SDK](https://github.com/contentstack/ui-extensions-sdk).
+
+### Examples of custom fields created using Extensions
+
+Here are some examples/use cases of custom fields that can be created using Extensions. These examples come with readme files that explain how to install and get started with these fields.
 
 [Color Picker](./color-picker):  
 A native color picker polyfill that allows users to select color as input value and saves the color code in the backend.
 
-
 [Ace Editor](./ace-editor):  
 A code editor written in JavaScript, allowing you to edit HTML, PHP, JavaScript and other with ease.
 
 [JSON Editor](./json-editor):  
 A simple editor that lets you view, edit and format JSON code within the field of your content type
 
 [Key-value Field](./key-value-field):  
-This extension lets you add key-value pairs as input value of a field of your content type.   
+This extension lets you add key-value pairs as input value of a field of your content type.
 
 [Progress Bar](./progress-bar):  
 It lets you display a progress bar as input field. Users can set value by sliding the progress bar to the left or right.
 
-[Star Ratings](./ratings):   
-This extension lets you display five stars as an input field. Users can select one or more stars, and a corresponding value will be saved in Contentstack.  
+[Star Ratings](./ratings):  
+This extension lets you display five stars as an input field. Users can select one or more stars, and a corresponding value will be saved in Contentstack.
 
 [Marketo Forms](./marketo-forms):  
 This extension lets you fetch and display the list of your existing Marketo forms into the field of your content type.
 
 [Brightcove](./brightcove):  
 This extension lets you fetch and display your Brightcove videos into a field of your content type.
 
-[Shopify](./shopify):  
-This extension lets you load products of your Shopify store into the field of your content type.
-
-[Egnyte](./Egnyte):  
-This extension lets you fetch files of your Egnyte account and display them into a field of your content type.
-
 [Ooyala](./ooyala):  
 This extension lets you fetch and display your Ooyala videos into a field of your content type.
 
-[Text Intelligence](./text-intelligence): 
+[Optimizely](./optimizely):  
+This extension lets you serve personalized content by allowing you to select the audience for each entry.
+
+[Youtube](./youtube):
+This extension lets you fetch and display Youtube videos into a field of your content type.
+
+[External API Lookup](./external-api-lookup-template):
+This extension lets you fetch data from an external API and display the data as possible values for the field on an entry page in Contentstack.
+
+### Examples of custom widgets created using Extensions
+
+Here are some examples/use cases of custom widgets that can be created using Extensions. These examples come with readme files that explain how to install and get started with these widgets.
+
+[Text Intelligence](./text-intelligence):
 This extension (custom widget) uses MonekyLearn APIs to provide helpful recommendations such as content summarizer, keyword extractor, retail classifier, etc.
 
-###***REMOVED***Other Documentation
+[Google Analytics](./google-analytics):
+This widget uses the Google Analytics data to display the traffic analysis and statistics of your entry on the sidebar of the entry.
+
+[Optimizely Experiments](./optimizely-experiments):
+This extension lets you retrieve and display Optimizely Experiments and their details in your entry.
+
+[Developer Tools](./developer-tools):
+This widget extension provides developers with quick tools (API endpoint, JSON, etc.) to work with an entry or all entries of a content type and do a lot more.
+
+### Examples of dashboard widgets created using Extensions
+
+Here are some examples/use cases of dashboard widgets that can be created using Extensions. These examples come with readme files that explain how to install and get started with these widgets.
+
+[Google Analytics](./dashboard-widget-google-analytics):
+This dashboard widget uses the Google Analytics data to display the traffic analysis and statistics of your site on the stack dashboard.
+
+[Content Type Visualizer](./content-type-visualizer):
+Content Type Visualizer Dashboard Widget offers a graphical representation of all content types, along with their fields, in a particular stack.
+
+### Examples of JSON RTE Plugin created using Extensions
+
+Here are some examples/use cases of JSON RTE Plugin that can be created using Extensions. These examples come with readme files that explain how to install and get started with these plugins.
+
+[Highlight](./highlight)
+Allows you to highlight certain parts of your content, such as a whole line of text or a paragraph.
+
+
+[Info Panel](./info-panel)
+Allows you to place important content inside a colored panel to make it stand out.
+
+
+[Word Count](./word-count)
+Allows you to track the word count for your JSON Rich Text Editor content.
+
+### Other Documentation
+
 - [What are Extensions](https://www.contentstack.com/docs/guide/extensions)
 - [Extensions SDK](https://github.com/contentstack/ui-extensions-sdk)
--  [Extensions FAQs](https://www.contentstack.com/docs/faqs#extensions)
+- [Extensions FAQs](https://www.contentstack.com/docs/faqs#extensions)

SECURITY.md

@@ -0,0 +1,27 @@
+## Security
+
+Contentstack takes the security of our software products and services seriously, which includes all source code repositories managed through our GitHub organizations.
+
+If you believe you have found a security vulnerability in any Contentstack-owned repository, please report it to us as described below.
+
+## Reporting Security Issues
+
+**Please do not report security vulnerabilities through public GitHub issues.**
+
+Send email to [security@contentstack.com](mailto:security@contentstack.com).
+
+You should receive a response within 24 hours. If for some reason you do not, please follow up via email to ensure we received your original message.
+
+Please include the requested information listed below (as much as you can provide) to help us better understand the nature and scope of the possible issue:
+
+- Type of issue (e.g. buffer overflow, SQL injection, cross-site scripting, etc.)
+- Full paths of source file(s) related to the manifestation of the issue
+- The location of the affected source code (tag/branch/commit or direct URL)
+- Any special configuration required to reproduce the issue
+- Step-by-step instructions to reproduce the issue
+- Proof-of-concept or exploit code (if possible)
+- Impact of the issue, including how an attacker might exploit the issue
+
+This information will help us triage your report more quickly.
+
+[https://www.contentstack.com/trust/](https://www.contentstack.com/trust/)

ace-editor/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Contentstack
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.