enh: replace @timbenniks/contentstack-endpoints with @contentstack/utils

[harshitha-cstk]

Summary

• Replaces @timbenniks/contentstack-endpoints (third-party) with getContentstackEndpoint from @contentstack/utils (official Contentstack package) for region-to-endpoint resolution
• Removes @timbenniks/contentstack-endpoints as a direct dependency from package.json
• Cleans up the null-guard pattern and simplifies region handling in lib/contentstack.ts
• Adds comprehensive region and endpoint documentation to the README
• Updates .env.example with all valid region options

What changed and why

lib/contentstack.ts

This repo uses a getStack() factory function that creates a new stack instance per request for SSR isolation. The endpoint resolution logic inside that function was updated.

Before:

import { getContentstackEndpoints, getRegionForString } from "@timbenniks/contentstack-endpoints";

export function getStack() {
  const region = getRegionForString(process.env.NEXT_PUBLIC_CONTENTSTACK_REGION as string);
  const endpoints = getContentstackEndpoints(region, true);

  return Stack({
    region: region ? region : process.env.NEXT_PUBLIC_CONTENTSTACK_REGION as any,
    host: process.env.NEXT_PUBLIC_CONTENTSTACK_CONTENT_DELIVERY || endpoints && endpoints.contentDelivery,
    // ...
  });
}

After:

import { getContentstackEndpoint, type ContentstackEndpoints } from "@contentstack/utils";

export function getStack() {
  const endpoints = getContentstackEndpoint(process.env.NEXT_PUBLIC_CONTENTSTACK_REGION || 'us', '', true) as ContentstackEndpoints;

  return Stack({
    region: process.env.NEXT_PUBLIC_CONTENTSTACK_REGION as any,
    host: process.env.NEXT_PUBLIC_CONTENTSTACK_CONTENT_DELIVERY || endpoints.contentDelivery as string,
    // ...
  });
}

Key improvements:

• Two-step region resolution collapses into one call — getContentstackEndpoint handles all alias normalisation internally (NA, na, US, us all resolve correctly)
• The && null-guard is removed — getContentstackEndpoint throws on an invalid region at startup (fail-fast) instead of silently returning undefined and causing a downstream SDK error
• The region ? region : ... ternary is removed — host: in the SDK config takes precedence over region at runtime, so passing the raw env var string is equivalent

package.json

Removed @timbenniks/contentstack-endpoints as a direct dependency. @contentstack/utils was already part of the Contentstack ecosystem and is the officially supported package.

README.md

Added a Regions and endpoint configuration section covering:

Area	What's documented
Region values	Full table of all 7 supported regions with accepted values
Endpoint keys	All 9 endpoint keys with their NA values
Custom environments	Override env vars for dedicated/private cloud instances

.env.example

Updated the region line with all valid region options as an inline comment:

NEXT_PUBLIC_CONTENTSTACK_REGION=EU # Options: NA, EU, AU, AZURE-NA, AZURE-EU, GCP-NA, GCP-EU

Files changed

File	Change
lib/contentstack.ts	Swap endpoint resolution package, simplify region and guard logic
package.json	Remove @timbenniks/contentstack-endpoints direct dependency
package-lock.json	Updated after npm install
README.md	Add regions and endpoint configuration section
.env.example	Add valid region options comment

No breaking changes

• All env var names are unchanged (NEXT_PUBLIC_CONTENTSTACK_REGION, NEXT_PUBLIC_CONTENTSTACK_CONTENT_DELIVERY, etc.)
• Runtime behaviour is identical for all currently supported regions
• The getStack() factory pattern and per-request isolation are unchanged
• All server components and API routes are untouched

[github-actions]

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Count (with fixes)	Without fixes	Threshold	Result
🔴 Critical Severity	1	0	10	✅ Passed
🟠 High Severity	4	0	25	✅ Passed
🟡 Medium Severity	4	12	500	✅ Passed
🔵 Low Severity	0	0	1000	✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity	Breaches (with fixes)	Breaches (no fixes)	SLA Threshold (with/no fixes)	Status
🔴 Critical	0	0	15 / 30 days	✅ Passed
🟠 High	0	0	30 / 120 days	✅ Passed
🟡 Medium	0	0	90 / 365 days	✅ Passed
🔵 Low	0	0	180 / 365 days	✅ Passed

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:

• Critical without fixes: 0
• High without fixes: 0
• Medium without fixes: 12
• Low without fixes: 0

✅ BUILD PASSED - All security checks passed

[github-actions]

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Count (with fixes)	Without fixes	Threshold	Result
🔴 Critical Severity	1	0	10	✅ Passed
🟠 High Severity	4	0	25	✅ Passed
🟡 Medium Severity	4	12	500	✅ Passed
🔵 Low Severity	0	0	1000	✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity	Breaches (with fixes)	Breaches (no fixes)	SLA Threshold (with/no fixes)	Status
🔴 Critical	0	0	15 / 30 days	✅ Passed
🟠 High	0	0	30 / 120 days	✅ Passed
🟡 Medium	0	0	90 / 365 days	✅ Passed
🔵 Low	0	0	180 / 365 days	✅ Passed

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:

• Critical without fixes: 0
• High without fixes: 0
• Medium without fixes: 12
• Low without fixes: 0

✅ BUILD PASSED - All security checks passed

[github-actions]

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Count (with fixes)	Without fixes	Threshold	Result
🔴 Critical Severity	0	0	10	✅ Passed
🟠 High Severity	0	0	25	✅ Passed
🟡 Medium Severity	0	21	500	✅ Passed
🔵 Low Severity	0	0	1000	✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity	Breaches (with fixes)	Breaches (no fixes)	SLA Threshold (with/no fixes)	Status
🔴 Critical	0	0	15 / 30 days	✅ Passed
🟠 High	0	0	30 / 120 days	✅ Passed
🟡 Medium	0	0	90 / 365 days	✅ Passed
🔵 Low	0	0	180 / 365 days	✅ Passed

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:

• Critical without fixes: 0
• High without fixes: 0
• Medium without fixes: 21
• Low without fixes: 0

✅ BUILD PASSED - All security checks passed

[github-actions]

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Count (with fixes)	Without fixes	Threshold	Result
🔴 Critical Severity	0	0	10	✅ Passed
🟠 High Severity	0	0	25	✅ Passed
🟡 Medium Severity	0	21	500	✅ Passed
🔵 Low Severity	0	0	1000	✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity	Breaches (with fixes)	Breaches (no fixes)	SLA Threshold (with/no fixes)	Status
🔴 Critical	0	0	15 / 30 days	✅ Passed
🟠 High	0	0	30 / 120 days	✅ Passed
🟡 Medium	0	0	90 / 365 days	✅ Passed
🔵 Low	0	0	180 / 365 days	✅ Passed

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:

• Critical without fixes: 0
• High without fixes: 0
• Medium without fixes: 21
• Low without fixes: 0

✅ BUILD PASSED - All security checks passed

[github-actions]

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Count (with fixes)	Without fixes	Threshold	Result
🔴 Critical Severity	0	0	10	✅ Passed
🟠 High Severity	0	0	25	✅ Passed
🟡 Medium Severity	0	21	500	✅ Passed
🔵 Low Severity	0	0	1000	✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity	Breaches (with fixes)	Breaches (no fixes)	SLA Threshold (with/no fixes)	Status
🔴 Critical	0	0	15 / 30 days	✅ Passed
🟠 High	0	0	30 / 120 days	✅ Passed
🟡 Medium	0	0	90 / 365 days	✅ Passed
🔵 Low	0	0	180 / 365 days	✅ Passed

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:

• Critical without fixes: 0
• High without fixes: 0
• Medium without fixes: 21
• Low without fixes: 0

✅ BUILD PASSED - All security checks passed