Merge branch 'development' into version5

Author: nadeem-cs

CHANGELOG.md

@@ -3,6 +3,10 @@
 Breaking: Cache persistence is now a separate plugin. When using a cache policy other than `IGNORE_CACHE`, you must pass `cacheOptions.persistenceStore`. Install `@contentstack/persistence-plugin` and use `new PersistenceStore({ ... })` as the store. The SDK no longer bundles persistence code or accepts `storeType` in `cacheOptions`.
 Enhancement: SDK defines only the `PersistenceStore` interface (getItem/setItem); full implementation lives in the plugin for a lighter core package.
 
+### Version: 4.11.1
+#### Date: Feb-09-2026
+Fix: Fix security issues
+
 ### Version: 4.11.0
 #### Date: Jan-19-2026
 Enhancement: Integrated getContentstackEndpoint method of Utils SDK for endpoint selection

package-lock.json

@@ -47,8 +47,8 @@
     "prerelease": "npm run test:all && npm run validate:all"
   },
   "dependencies": {
-    "@contentstack/core": "^1.3.6",
-    "@contentstack/utils": "^1.6.3",
+    "@contentstack/core": "^1.3.9",
+    "@contentstack/utils": "^1.7.0",
     "axios": "^1.13.1",
     "humps": "^2.0.1"
   },

package.json

@@ -146,9 +146,10 @@ describe('Locale Fallback Chain Tests', () => {
           locale: result.locale
         });
       } catch (error: any) {
-        if (error.status === 422) {
-          console.log('⚠️ API returned 422 for non-existent locale (expected behavior)');
-          expect(error.status).toBe(422);
+        // API can return 422, 400, or 141 for invalid/non-existent locale
+        if (error.status === 422 || error.status === 400 || error.status === 141) {
+          console.log(`⚠️ API returned ${error.status} for non-existent locale (expected behavior)`);
+          expect([422, 400, 141]).toContain(error.status);
         } else {
           throw error;
         }
@@ -346,9 +347,10 @@ describe('Locale Fallback Chain Tests', () => {
           hasContent: !!result.title
         });
       } catch (error: any) {
-        if (error.status === 422) {
-          console.log('⚠️ API rejected invalid locale format (expected)');
-          expect(error.status).toBe(422);
+        // API can return 422, 400, or 141 for invalid locale format
+        if (error.status === 422 || error.status === 400 || error.status === 141) {
+          console.log(`⚠️ API rejected invalid locale format with status ${error.status} (expected)`);
+          expect([422, 400, 141]).toContain(error.status);
         } else {
           throw error;
         }