fix: move pylint to dev deps to resolve Snyk GPL-2.0 flag (DX-8256) by OMpawar-21 · Pull Request #182 · contentstack/contentstack-management-python

OMpawar-21 · 2026-08-10T08:27:35Z

Summary

Moved pylint>=2.0.0 from requirements.txt to requirements-dev.txt — it is a static analysis tool used only in development and CI, not distributed in the production package.
Created requirements-dev.txt (includes -r requirements.txt + pylint) so dev/CI installs remain unchanged.
Bumped version to 1.11.2 with changelog entry.

Why

Snyk flagged pylint (GPL-2.0) as a high-severity license violation in the production dependency scan (DX-8256). Because pylint is never shipped as part of the SDK binary or runtime image, it carries no copyleft obligation — it just needs to live outside the production requirements file so Snyk's scan scope excludes it.

Test plan

pip install -r requirements.txt — no pylint installed
pip install -r requirements-dev.txt — pylint installed, all existing deps present
CI lint job passes (update any workflow that references requirements.txt for linting to use requirements-dev.txt)
Snyk production scan no longer flags GPL-2.0 on pylint

🤖 Generated with Claude Code

pylint is a static analysis tool not shipped in the production package. Moving it to requirements-dev.txt removes the GPL-2.0 copyleft concern from Snyk production dependency scans (DX-8256). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

snyk-io · 2026-08-10T08:27:52Z

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

github-actions · 2026-08-10T08:28:21Z

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Without fixes	Threshold	Result
🔴 Critical Severity	0	10	✅ Passed
🟠 High Severity	0	25	✅ Passed
🟡 Medium Severity	2	500	✅ Passed
🔵 Low Severity	0	1000	✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity	SLA Threshold (with/no fixes)	Status
🔴 Critical	15 / 30 days	✅ Passed
🟠 High	30 / 120 days	✅ Passed
🟡 Medium	90 / 365 days	✅ Passed
🔵 Low	180 / 365 days	✅ Passed

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:

Critical without fixes: 0
High without fixes: 0
Medium without fixes: 2
Low without fixes: 0

✅ BUILD PASSED - All security checks passed

OMpawar-21 · 2026-08-10T09:08:08Z

Closing — fix needs to be applied to contentstack-python (delivery SDK) instead.

github-actions · 2026-08-10T09:15:58Z

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Without fixes	Threshold	Result
🔴 Critical Severity	0	10	✅ Passed
🟠 High Severity	0	25	✅ Passed
🟡 Medium Severity	2	500	✅ Passed
🔵 Low Severity	0	1000	✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity	SLA Threshold (with/no fixes)	Status
🔴 Critical	15 / 30 days	✅ Passed
🟠 High	30 / 120 days	✅ Passed
🟡 Medium	90 / 365 days	✅ Passed
🔵 Low	180 / 365 days	✅ Passed

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:

Critical without fixes: 0
High without fixes: 0
Medium without fixes: 2
Low without fixes: 0

✅ BUILD PASSED - All security checks passed

github-actions · 2026-08-10T09:46:01Z

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Without fixes	Threshold	Result
🔴 Critical Severity	0	10	✅ Passed
🟠 High Severity	0	25	✅ Passed
🟡 Medium Severity	2	500	✅ Passed
🔵 Low Severity	0	1000	✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity	SLA Threshold (with/no fixes)	Status
🔴 Critical	15 / 30 days	✅ Passed
🟠 High	30 / 120 days	✅ Passed
🟡 Medium	90 / 365 days	✅ Passed
🔵 Low	180 / 365 days	✅ Passed

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:

Critical without fixes: 0
High without fixes: 0
Medium without fixes: 2
Low without fixes: 0

✅ BUILD PASSED - All security checks passed

Copilot

Pull request overview

Moves pylint out of the shared dependency list and into a dev-only requirements file to avoid license findings in production-focused dependency scans, while also bumping the SDK version and changelog to reflect the change.

Changes:

Removed pylint from requirements.txt and introduced requirements-dev.txt to hold dev-only tooling.
Bumped contentstack_management version to 1.11.2.
Added a v1.11.2 changelog entry describing the dependency move.

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated 2 comments.

File	Description
requirements.txt	Removes `pylint` from the shared requirements list.
requirements-dev.txt	Adds a dev-only requirements file that includes `requirements.txt` and installs `pylint`.
contentstack_management/init.py	Updates `__version__` to `1.11.2`.
CHANGELOG.md	Adds release notes for `v1.11.2`.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

github-actions · 2026-08-11T03:14:19Z

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Without fixes	Threshold	Result
🔴 Critical Severity	0	10	✅ Passed
🟠 High Severity	0	25	✅ Passed
🟡 Medium Severity	2	500	✅ Passed
🔵 Low Severity	0	1000	✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity	SLA Threshold (with/no fixes)	Status
🔴 Critical	15 / 30 days	✅ Passed
🟠 High	30 / 120 days	✅ Passed
🟡 Medium	90 / 365 days	✅ Passed
🔵 Low	180 / 365 days	✅ Passed

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:

Critical without fixes: 0
High without fixes: 0
Medium without fixes: 2
Low without fixes: 0

✅ BUILD PASSED - All security checks passed

Addresses Copilot review comment — AGENTS.md and skills/dev-workflow/SKILL.md still referenced requirements.txt for pylint after it was moved to requirements-dev.txt. Also added pylint to the setup.py dev extra so `pip install -e ".[dev]"` installs it. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

github-actions · 2026-08-11T03:21:39Z

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Without fixes	Threshold	Result
🔴 Critical Severity	0	10	✅ Passed
🟠 High Severity	0	25	✅ Passed
🟡 Medium Severity	2	500	✅ Passed
🔵 Low Severity	0	1000	✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity	SLA Threshold (with/no fixes)	Status
🔴 Critical	15 / 30 days	✅ Passed
🟠 High	30 / 120 days	✅ Passed
🟡 Medium	90 / 365 days	✅ Passed
🔵 Low	180 / 365 days	✅ Passed

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:

Critical without fixes: 0
High without fixes: 0
Medium without fixes: 2
Low without fixes: 0

✅ BUILD PASSED - All security checks passed

Copilot

Pull request overview

Copilot reviewed 6 out of 7 changed files in this pull request and generated no new comments.

Suppressed comments (2)

skills/dev-workflow/SKILL.md:22

The install command is now redundant/misleading: pip install -e ".[dev]" already installs pylint (via extras_require["dev"]), so the follow-up pip install -r requirements-dev.txt doesn’t add anything and can confuse contributors.

1. **Install** — `pip install -e ".[dev]"` then `pip install -r requirements-dev.txt` for linting tools.

CHANGELOG.md:9

The changelog entry says pylint “is not distributed as part of the production package”, but it is still declared in the package metadata as an optional dev extra. It’s more accurate to state that pylint is not a runtime dependency (only installed for dev/CI).

- Moved `pylint` from `requirements.txt` to `requirements-dev.txt` to resolve Snyk GPL-2.0 license flag (DX-8256). `pylint` is a static analysis tool used only during development and CI; it is not distributed as part of the production package.

OMpawar-21and others added 2 commits August 10, 2026 13:46

chore: bump version to 1.11.2
eaea543
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

OMpawar-21 requested a review from a team as a code owner August 10, 2026 08:27

OMpawar-21 closed this Aug 10, 2026

OMpawar-21 deleted the fix/snyk-pylint-gpl-dx8256 branch August 10, 2026 09:08

OMpawar-21 restored the fix/snyk-pylint-gpl-dx8256 branch August 10, 2026 09:15

OMpawar-21 reopened this Aug 10, 2026

Merge branch 'main' into fix/snyk-pylint-gpl-dx8256
93eff64

cs-raj previously approved these changes Aug 10, 2026
View reviewed changes

OMpawar-21 requested a lite review from Copilot August 11, 2026 03:07

Copilotstarted reviewing on behalf of OMpawar-21 August 11, 2026 03:08 View session

CopilotAI reviewed Aug 11, 2026
View reviewed changes

Comment threadrequirements-dev.txt
Comment threadrequirements-dev.txt Outdated

Potential fix for pull request finding
81d6307
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

OMpawar-21 dismissed cs-raj’s stale review via 81d6307August 11, 2026 03:13

OMpawar-21 requested a lite review from Copilot August 11, 2026 03:22

Copilotstarted reviewing on behalf of OMpawar-21 August 11, 2026 03:22 View session

CopilotAI reviewed Aug 11, 2026
View reviewed changes

cs-raj approved these changes Aug 11, 2026
View reviewed changes

netrajpatel approved these changes Aug 11, 2026
View reviewed changes

OMpawar-21 merged commit 3a58ab1 into mainAug 11, 2026
9 checks passed

OMpawar-21 deleted the fix/snyk-pylint-gpl-dx8256 branch August 11, 2026 06:24

Navigation Menu

Uh oh!

fix: move pylint to dev deps to resolve Snyk GPL-2.0 flag (DX-8256) - #182

fix: move pylint to dev deps to resolve Snyk GPL-2.0 flag (DX-8256)#182
OMpawar-21 merged 5 commits into
mainfrom
fix/snyk-pylint-gpl-dx8256

OMpawar-21 commented Aug 10, 2026•
edited by cs-raj
Loading

Uh oh!

snyk-ioBot commented Aug 10, 2026•
edited
Loading

Uh oh!

github-actionsBot commented Aug 10, 2026

Uh oh!

OMpawar-21 commented Aug 10, 2026

Uh oh!

github-actionsBot commented Aug 10, 2026

Uh oh!

github-actionsBot commented Aug 10, 2026

Uh oh!

CopilotAI left a comment

Uh oh!

Uh oh!

Uh oh!

github-actionsBot commented Aug 11, 2026

Uh oh!

github-actionsBot commented Aug 11, 2026

Uh oh!

CopilotAI left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

OMpawar-21 commented Aug 10, 2026• edited by cs-raj Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Why

Test plan

Uh oh!

snyk-ioBot commented Aug 10, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Snyk checks have passed. No issues have been found so far.

Uh oh!

github-actionsBot commented Aug 10, 2026

🔒 Security Scan Results

⏱️ SLA Breach Summary

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

Uh oh!

OMpawar-21 commented Aug 10, 2026

Uh oh!

github-actionsBot commented Aug 10, 2026

🔒 Security Scan Results

⏱️ SLA Breach Summary

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

Uh oh!

github-actionsBot commented Aug 10, 2026

🔒 Security Scan Results

⏱️ SLA Breach Summary

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

Uh oh!

CopilotAI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

github-actionsBot commented Aug 11, 2026

🔒 Security Scan Results

⏱️ SLA Breach Summary

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

Uh oh!

github-actionsBot commented Aug 11, 2026

🔒 Security Scan Results

⏱️ SLA Breach Summary

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

Uh oh!

CopilotAI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

OMpawar-21 commented Aug 10, 2026•
edited by cs-raj
Loading

snyk-ioBot commented Aug 10, 2026•
edited
Loading