[mtrezza]

Closes #942

Bumps parse-server from 9.10.0 to 9.10.7, which moves the transitive ip-address from 10.1.0 to 10.7.4.

parse-server@9.10.0 pins express-rate-limit to exactly 8.3.1, which pins ip-address to exactly 10.1.0, so ip-address can't move without bumping parse-server. parse-server@9.10.7 pins express-rate-limit 8.7.0 (parse-community/parse-server#10672), which declares ip-address ^10.2.0.

Security

Dependabot alerts resolved by this PR (no vulnerable copy left in the lock file):

Alert	Package	Severity	Advisory	Version
345	ip-address	medium	GHSA-v2v4-37r5-5v8g	10.1.0 → 10.7.4
413	fast-xml-parser	high	GHSA-8r6m-32jq-jx6q	5.10.0 → 5.11.2
339	follow-redirects	medium	GHSA-r4q5-vmmm-2653	1.15.11 → 1.16.0
368	protobufjs	medium	GHSA-f38q-mgvj-vph7	7.6.1 → 7.6.6
411	protobufjs	medium	GHSA-j3f2-48v5-ccww	7.6.1 → 7.6.6

Alerts that likely stay open because another copy of the package is still in the vulnerable range:

• ip-address alerts 425 (high, GHSA-mwp4-54f8-5fhr, <= 10.3.0), 442, 439, 418 and 417: the production copy moves to 10.7.4, but the copy bundled inside npm (node_modules/npm/node_modules/ip-address 10.2.0, a dev dependency via @semantic-release/npm) is still in range and can't be changed from this repository.
• ws alerts 362 and 397: only the nested copies under parse-server and @parse/push-adapter move to 8.21.3. The root ws 8.20.0 is held by the direct dependency parse 8.6.0, which this PR doesn't change. A follow-up bump of parse from 8.6.0 to 8.6.2 would resolve them.
• undici 7.x alerts (419–423, 440, 443, 446): the production copy under expo-server-sdk moves from 7.28.0 to 7.30.1, but the dev copy under @semantic-release/github stays at 7.28.0. refactor: Bump undici #941 covers it.
• uuid alert 356: the copy under firebase-admin moves from 11.1.0 to 11.1.1; other copies stay, e.g. 11.1.0 under @apollo/server.

After this merges, #933 (fast-xml-parser 5.10.0 → 5.10.1) is no longer needed. #941 (undici) is still needed for its dev copies.

Changes

parse-server 9.10.0 → 9.10.7

Seven patch releases with security and bug fixes (release notes). These entries touch features this example uses (the server options in config.ts, Cloud Code in cloud/, schema definitions, LiveQuery). None requires a change here:

• 9.10.2: Create and update class-level permissions are enforced before schema validation (fix: Create and update class-level permissions not enforced before schema validation parse-server#10739). TestObject grants both to *.
• 9.10.2: New option enableLiveQueryClassLevelPermissionRoles (default false) with deprecation DEPPS25, which changes the default to true in 10.0.0 (fix: LiveQuery evaluates class-level permissions against an incomplete caller identity parse-server#10675). config.ts doesn't set it, so Parse Server logs one more deprecation warning at startup.
• 9.10.1–9.10.5: LiveQuery hardening for protected fields, class-level permission identity and $or subscriptions (fix: LiveQuery discloses protected fields by resolving an incomplete subscriber identity (GHSA-9jpp-xhh6-75mf) parse-server#10654, fix: LiveQuery evaluates class-level permissions against an incomplete caller identity parse-server#10675, fix: LiveQuery ignores userField protectedFields groups and over-redacts fields the REST path returns parse-server#10690, fix: LiveQuery ignores Parse Server option protectedFieldsOwnerExempt parse-server#10737, fix: LiveQuery subscriptions using a $or query can receive another user's events, including session tokens (GHSA-349r-988w-x3jp) parse-server#10776). The LiveQuery classes Posts and Comments use none of these.
• 9.10.4: Writes without the master key reject field names that start with _ (GHSA-gwrq-q25v-g8mr, fix: Object write with a reserved field name can make reads fail on MongoDB (GHSA-gwrq-q25v-g8mr) parse-server#10763). The fields beforeSave and additionalData aren't affected.
• 9.10.5: The save response returns the stored value of a field that beforeSave reverts only to callers with read access (GHSA-9rvr-f5hc-9f2f, fix: Object update returns the stored value of a field reverted in beforeSave to a caller without read access (GHSA-9rvr-f5hc-9f2f) parse-server#10788). Object write keys are checked for prototype pollution and dot notation (fix: Object write with a dot notation key can skip afterSave triggers and LiveQuery events (GHSA-969q-274f-mc7w) parse-server#10786, fix: Object write with a crafted key can pollute a shared prototype and cause denial of service (GHSA-rx55-fw4j-pvpx) parse-server#10790).
• 9.10.6–9.10.7: Save responses filter field values by read access (fix: Object update returns stored field values to a caller without read access (GHSA-2rcp-jc67-vq74) parse-server#10798, fix: Object create returns field values to a caller without read access (GHSA-qq3r-ppqq-rh6m) parse-server#10813, fix: Save response reveals whether a field is stored to a caller without read access (GHSA-ch64-8phh-m7hc) parse-server#10829). Dot-notation key fixes (fix: Object update with a dot notation key below a pointer field can terminate the server process (GHSA-wc3c-6843-q7mv) parse-server#10802, fix: Object write with a null dot notation key can corrupt a field or make reads fail on MongoDB (GHSA-655c-2xf3-77x9) parse-server#10804, fix: Object write with a crafted dot notation key can pollute a shared prototype when the class has a trigger or LiveQuery (GHSA-95hp-82c6-25q5) parse-server#10810); the last applies to classes with a trigger, such as TestObject. The extra database read on save is removed again (perf: Remove additional database read when saving an object parse-server#10833).
• The order of RestWrite.execute() changed. checkInternalFields runs first, resolveFileUrls and validateDotNotationKeys run before beforeSave, and validateWritePermission runs after beforeSave and before validateSchema. The beforeSave rejection that the tests expect still fires first.

Entries in areas this example doesn't use (LDAP, GraphQL, sessions, installations, MFA, auth adapters, batch requests, relations, email, rate limiting), including:

• 9.10.3: Updating a user rejects an empty username or password (fix: User update accepts an empty username or password parse-server#10752).
• 9.10.4: PromiseRouter no longer validates the className and objectId route parameters, so batch and direct access requests work for object IDs without alphanumeric characters and class names without letters (fix: Batch and direct access requests fail for object IDs without alphanumeric characters or class names without letters parse-server#10761).
• 9.10.5: Malformed $or, $and, $nor and $options operators return a proper error instead of an internal server error (fix: Malformed query operators $or, $and, $nor, $options cause internal server error parse-server#10775).
• 9.10.1–9.10.2: Rate limit fixes (fix: Rate limit is bypassed by sending request header X-Forwarded-For: 127.0.0.1 when Parse Server option trustProxy is permissive parse-server#10664, fix: Rate limit with option requestPath set to GraphQL endpoint path has no effect parse-server#10738) don't apply because config.ts configures no rateLimit.

ip-address 10.1.0 → 10.7.4

Used by express-rate-limit, and by socks, an optional peer dependency of mongodb.

• 10.1.1–10.3.1: Security fixes for HTML-emitting Address6 methods (GHSA-v2v4-37r5-5v8g), IPv4-mapped and NAT64 classification (GHSA-22jq-vg5j-6vgg), CIDR suffixes suppressing special-use classification (GHSA-4xrf-jv44-h6hh), and Address4 leading-zero octets (GHSA-mwp4-54f8-5fhr).
• 10.4.0: Address6.fromByteArray is narrowed to Array<number> with validation (Validate the byte arrays Address6 is given beaugunderson/ip-address#217). socks 2.8.7 passes Array.from(Buffer), so it stays compatible. The package stays loadable on Node 12 (Keep the package loadable on node 12, and enforce it beaugunderson/ip-address#216).
• 10.5.0: fromURL fails gracefully for hosts that aren't IPv6 (Honor the fromURL graceful-failure contract for non-IPv6 hosts beaugunderson/ip-address#218).
• 10.5.1: Link-local fe80::/10 and NAT64 local-use classification (GHSA-rpw4-54j3-4h4q, GHSA-2vr4-cq9g-pvrc).
• 10.6.0: Adds isGlobal(); classifiers pinned to the IANA special-purpose registries (Add isGlobal() and pin the classifiers to the IANA special-purpose registries beaugunderson/ip-address#224).
• 10.7.0: Adds offset() and nextNetwork(), and accepts prefix-length ip6.arpa names (Add offset() and nextNetwork(), accept prefix-length ip6.arpa names, correct the IPv6 end-address docs beaugunderson/ip-address#225).
• 10.7.1: Lockfile bumps only (Bump js-yaml and brace-expansion in the lockfile beaugunderson/ip-address#226).
• 10.7.2–10.7.3: arpa parsing fixes (Accept an arpa suffix in any case and without the root dot in fromArpa beaugunderson/ip-address#227, Reject an in-addr.arpa name longer than 32 characters before splitting it beaugunderson/ip-address#228).
• 10.7.4: Finds an IPv6 zone by index, so a rejected zone costs one pass.
• isMapped4() and networkForm() are new in this range, which is why express-rate-limit 8.7.0 requires ^10.2.0.
• Versions are now published from GitHub Actions with an SLSA provenance attestation, which is Dependabot's "new releaser" notice. The new prepare script (git config core.hooksPath hooks || true) doesn't run when the package is installed from the registry.

express-rate-limit 8.3.1 → 8.7.0

Adds features (logger option, async store init, retryAfter option, debug logging, time constants that are already deprecated) and fixes. 8.5.1 moves off the vulnerable ip-address, and 8.6.2 detects IPv4-mapped IPv6 addresses by range. It isn't active here because config.ts configures no rateLimit.

ws 8.20.0 → 8.21.3 (copy nested under parse-server, used by the LiveQuery server)

ws 8.21 adds the server defaults maxBufferedChunks (262144) and maxFragments (16384), and closes peers that exceed either with code 1008. These apply to the LiveQuery WebSocket server; normal LiveQuery clients aren't affected. The permessage-deflate fix doesn't apply because the server's perMessageDeflate stays at its default false. The close() TypeError fix doesn't apply either, because Parse Server calls close() without arguments.

parse 8.6.0 → 8.6.2 (copy nested under parse-server)

Only ws bumps (parse-community/Parse-SDK-JS#3068, parse-community/Parse-SDK-JS#3119). The global Parse in Cloud Code and in the tests comes from this copy. The direct dependency parse stays at 8.6.0.

Lock file

Generated with npm install (npm 10.9.3). The changes stay within the parse-server dependency tree:

• Pinned dependencies of parse-server 9.10.7 that moved: express-rate-limit 8.3.1 → 8.7.0, @parse/push-adapter 8.4.0 → 8.5.5, graphql 16.13.2 → 16.14.2, @graphql-tools/utils 11.0.0 → 11.2.2, follow-redirects 1.15.11 → 1.16.0, lru-cache 11.2.7 → 11.5.2, and the nested parse 8.6.0 → 8.6.2 and ws 8.20.0 → 8.21.3.
• Transitive:
  • ip-address 10.1.0 → 10.7.4.
  • @parse/node-apn 8.0.0 → 8.1.0. Under @parse/push-adapter: parse 8.5.0 → 8.6.2, ws 8.19.0 → 8.21.3, new idb-keyval 6.3.0.
  • firebase-admin 13.7.0 → 13.9.0 with @firebase/* patch updates, uuid 11.1.0 → 11.1.1 under firebase-admin.
  • @google-cloud/storage 7.19.0 → 7.22.0, google-auth-library 10.6.2 → 10.9.1 with gaxios 7.1.4 → 7.3.1.
  • fast-xml-parser 5.10.0 → 5.11.2, fast-xml-builder 1.2.0 → 1.3.1, strnum 2.4.1 → 2.5.1, xml-naming 0.1.0 → 0.3.0, @nodable/entities 2.2.0 → 3.1.0 (major, inside the fast-xml-parser tree).
  • protobufjs 7.6.1 → 7.6.6, @grpc/grpc-js 1.14.4 → 1.14.6 with nested @grpc/proto-loader 0.8.0 → 0.8.1, two nested yargs 17.7.2 → 17.7.3, @opentelemetry/api 1.9.1 → 1.10.0.
  • is-unsafe 2.0.0 → 2.0.2, bn.js 4.12.3 → 4.12.5, semver 7.7.4 → 7.8.5 under jsonwebtoken, undici 7.28.0 → 7.30.1 under expo-server-sdk, new idb-keyval 6.3.0 under parse-server.
• Removed: @babel/runtime and @babel/runtime-corejs3 under @parse/push-adapter, and a duplicate xml-naming under fast-xml-parser.
• Metadata only: deprecated added to three uuid 9.0.1 copies, license fields on a few unchanged entries, and the root uuid 8.3.2 flagged dev instead of devOptional.
• Difference from the lock file in refactor: Bump ip-address and parse-server #942: this lock keeps the optional peer dependencies socks 2.8.7 and smart-buffer 4.2.0 unchanged from master. It also moves gcp-metadata 7.0.1, an optional peer dependency of mongodb, from parse-server/node_modules to the root (with nested gaxios 7.3.1 and node-fetch 3.3.2). The Dependabot lock pruned all three.

parse-server 9.10.7 has the same Node engine range as 9.10.0, and no updated package needs a newer Node version than that.

Breaking Changes

None

Code Changes Required

None. The upgrade is a drop-in replacement.

Release

release-automated.yml has been failing since 2026-07-20 (actions/setup-node@v2 cache responds with 400), so merging this fix: PR won't produce a release until that workflow is fixed.

Summary by CodeRabbit

• Updates
  • Updated the Parse Server dependency to version 9.10.7.
  • No user-facing feature changes are included in this update.

[parse-github-assistant]

🚀 Thanks for opening this pull request! We appreciate your effort in improving the project. Please let us know once your pull request is ready for review.

Tip

• Keep pull requests small. Large PRs will be rejected. Break complex features into smaller, incremental PRs.
• Use Test Driven Development. Write failing tests before implementing functionality. Ensure tests pass.
• Group code into logical blocks. Add a short comment before each block to explain its purpose.
• We offer conceptual guidance. Coding is up to you. PRs must be merge-ready for human review.
• Our review focuses on concept, not quality. PRs with code issues will be rejected. Use an AI agent.
• Human review time is precious. Avoid review ping-pong. Inspect and test your AI-generated code.

Note

Please respond to review comments from AI agents just like you would to comments from a human reviewer. Let the reviewer resolve their own comments, unless they have reviewed and accepted your commit, or agreed with your explanation for why the feedback was incorrect.

Caution

Pull requests must be written using an AI agent with human supervision. Pull requests written entirely by a human will likely be rejected, because of lower code quality, higher review effort and the higher risk of introducing bugs. Please note that AI review comments on this pull request alone do not satisfy this requirement. Our CI and AI review are safeguards, not development tools. If many issues are flagged, rethink your development approach. Invest more effort in planning and design rather than using review cycles to fix low-quality code.

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Essentials
• Run ID: d958cd96-d6ce-4ddb-ba97-9c3da5be79d3

Commits

Reviewing files that changed from the base of the PR and between bdbbfa1 and cff2057.

Files selected for processing: 2

• package-lock.json
• package.json

Included review availability: This review used your included allowance. Your plan provides up to 5 included reviews per hour; 3 remain after this review.

Walkthrough

The project upgrades parse-server from 9.10.0 to 9.10.7. The lockfile records updated Parse Server dependencies and refreshed resolutions for other packages.

Changes: Parse Server dependency upgrade

Layer / File(s)	Summary
Upgrade Parse Server and its dependency graph package.json, package-lock.json	parse-server changes from 9.10.0 to 9.10.7. The lockfile updates related packages, including Parse, the push adapter, and WebSocket.
Refresh other package resolutions package-lock.json	The lockfile updates other dependency versions and records peer resolutions, engine requirements, license metadata, and deprecation notices.

Priority: Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related issues

• parse-community/parse-server#10825: The upgrade to Parse Server 9.10.7 includes the save-response field filtering fix related to unreadable stored fields.

Merge Risk: Minimal · up to cff20

The dependency upgrade is ready to merge after normal checks; no actionable incompatibility was found.

Pre-merge checks: 5 · 1 · 1

Failed checks: 1 warning · 1 inconclusive

Check name	Status	Explanation	Resolution
Security Check		The PR introduces follow-redirects 1.16.0 in the production parse-server dependency path. GitHub advisories GHSA-q3jh-wrc6-jgq8 and GHSA-8r9p-f939-6h3c mark >=1.16.0 <1.16.1 as high severity. Th…	Use follow-redirects 1.16.1 or later in the production dependency tree. Bump to a Parse Server release that pins the fixed version, or add a verified npm override for parse-server's follow-redirects dependency. Regenerate `package-loc…
Linked Issues check		Issue [#942] requires ip-address 10.1.0 → 10.7.4 and parse-server 9.10.0 → 9.10.7 together. package.json and package-lock.json show the parse-server update, and the PR description states the…	Provide reviewable evidence of the ip-address 10.7.4 package contents, including its manifest and prepare script, and confirm that the registry install path does not execute that script.

Passed checks: 5 passed

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title begins with the required "fix:" prefix and the first letter after it is capitalized. It names two real changes in the changeset: the ip-address bump from 10.1.0 to 10.7.4 and the parse-serve…
Out of Scope Changes check		The PR changes package.json and refreshes package-lock.json. The lockfile updates are dependency-tree resolutions associated with the parse-server upgrade, including security-related transitive …
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Engage In Review Feedback		PASS. The supplied current-review result contains zero actionable findings, and no CodeRabbit review threads were returned. Therefore, no review feedback required engagement, implementation, or review…

Full details: Title check

Explanation

The title begins with the required "fix:" prefix and the first letter after it is capitalized. It names two real changes in the changeset: the ip-address bump from 10.1.0 to 10.7.4 and the parse-server bump from 9.10.0 to 9.10.7. The package.json and package-lock.json summaries confirm the parse-server bump. The lockfile diff is large, but the title covers its main purpose.

Full details: Out of Scope Changes check

Explanation

The PR changes package.json and refreshes package-lock.json. The lockfile updates are dependency-tree resolutions associated with the parse-server upgrade, including security-related transitive packages. No unrelated source, configuration, or workflow changes are shown.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (2 skipped: 2 unsupported.)

Full details: Engage In Review Feedback

Explanation

PASS. The supplied current-review result contains zero actionable findings, and no CodeRabbit review threads were returned. Therefore, no review feedback required engagement, implementation, or reviewer agreement.

Full details: Security Check

Explanation

The PR introduces follow-redirects 1.16.0 in the production parse-server dependency path. GitHub advisories GHSA-q3jh-wrc6-jgq8 and GHSA-8r9p-f939-6h3c mark >=1.16.0 <1.16.1 as high severity. The diff changes this package from 1.15.11 to 1.16.0, and a base-versus-head npm audit comparison reports these advisories only in HEAD.

Resolution

Use follow-redirects 1.16.1 or later in the production dependency tree. Bump to a Parse Server release that pins the fixed version, or add a verified npm override for parse-server's follow-redirects dependency. Regenerate package-lock.json and confirm both GHSA advisories are absent from npm audit.

Full details: Linked Issues check

Explanation

Issue [#942] requires ip-address 10.1.0 → 10.7.4 and parse-server 9.10.0 → 9.10.7 together. package.json and package-lock.json show the parse-server update, and the PR description states the production ip-address copy reaches 10.7.4. The updated parse-server version is consistent with including the requested server fixes. However, the available evidence does not establish that the ip-address package contents were reviewed before the update, as required by [#942].

Resolution

Provide reviewable evidence of the ip-address 10.7.4 package contents, including its manifest and prepare script, and confirm that the registry install path does not execute that script.

Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[mtrezza]

@coderabbitai full review

[coderabbitai]

✅ Action performed

Full review finished.

[parseplatformorg]

🎉 This change has been released in version 3.1.0