Skip to content

refactor: Bump parse-server from 9.8.0 to 9.9.0 #559

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
mtrezza wants to merge 1 commit into from
Closed

refactor: Bump parse-server from 9.8.0 to 9.9.0 #559

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
117 changes: 56 additions & 61 deletions package-lock.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,7 +39,7 @@
"jasmine-spec-reporter": "7.0.0",
"mongodb-runner": "6.7.3",
"nyc": "18.0.0",
"parse-server": "9.8.0",
"parse-server": "9.9.0",

@coderabbitai coderabbitai Bot Jul 13, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Check latest parse-server version on npm
curl -s https://registry.npmjs.org/parse-server | jq -r '.dist-tags.latest'

# Check GitHub security advisories for parse-server
gh api graphql -f query='
{
  securityVulnerabilities(first: 20, ecosystem: NPM, package: "parse-server") {
    nodes {
      advisory {
        summary
        severity
        ghsaId
        publishedAt
      }
      vulnerableVersionRange
      firstPatchedVersion {
        identifier
      }
    }
  }
}'

Repository: parse-community/parse-server-s3-adapter

Length of output: 6415

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== package.json parse-server context =="
nl -ba package.json | sed -n '1,120p' | rg -n '"parse-server"|devDependencies|dependencies|scripts' -n -C 2

echo
echo "== package-lock parse-server root entry =="
nl -ba package-lock.json | sed -n '1,80p' | rg -n '"parse-server"|devDependencies' -n -C 2

echo
echo "== npm registry latest + 9.9.x versions =="
python3 - <<'PY'
import json, urllib.request
url = "https://registry.npmjs.org/parse-server"
with urllib.request.urlopen(url, timeout=30) as r:
    data = json.load(r)
print("latest:", data["dist-tags"]["latest"])
vers = sorted(v for v in data["versions"].keys() if v.startswith("9.9."))
print("9.9.* versions:", ", ".join(vers[-20:]))
PY

echo
echo "== GitHub advisories relevant to parse-server 9.9.0 =="
gh api graphql -f query='
{
  securityVulnerabilities(first: 50, ecosystem: NPM, package: "parse-server") {
    nodes {
      advisory {
        summary
        severity
        ghsaId
      }
      vulnerableVersionRange
      firstPatchedVersion {
        identifier
      }
    }
  }
}' | jq -r '
  .data.securityVulnerabilities.nodes[]
  | select(.vulnerableVersionRange | test(">= 9\\.0\\.0"))
  | [.advisory.severity, .advisory.ghsaId, .advisory.summary, .vulnerableVersionRange, (.firstPatchedVersion.identifier // "")]
  | `@tsv`'

Repository: parse-community/parse-server-s3-adapter

Length of output: 253

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== package.json parse-server context =="
awk 'NR>=1 && NR<=120 { printf "%6d  %s\n", NR, $0 }' package.json \
  | grep -n -C 2 -E '"parse-server"|devDependencies|dependencies|scripts' || true

echo
echo "== package-lock parse-server root entry =="
awk 'NR>=1 && NR<=90 { printf "%6d  %s\n", NR, $0 }' package-lock.json \
  | grep -n -C 2 -E '"parse-server"|devDependencies' || true

echo
echo "== npm registry latest + 9.9.x versions =="
python3 - <<'PY'
import json, urllib.request
url = "https://registry.npmjs.org/parse-server"
with urllib.request.urlopen(url, timeout=30) as r:
    data = json.load(r)
print("latest:", data["dist-tags"]["latest"])
vers = sorted(v for v in data["versions"].keys() if v.startswith("9.9."))
print("9.9.* versions:", ", ".join(vers[-30:]))
PY

echo
echo "== GitHub advisories relevant to parse-server 9.9.0 =="
gh api graphql -f query='
{
  securityVulnerabilities(first: 50, ecosystem: NPM, package: "parse-server") {
    nodes {
      advisory {
        summary
        severity
        ghsaId
      }
      vulnerableVersionRange
      firstPatchedVersion {
        identifier
      }
    }
  }
}' | jq -r '
  .data.securityVulnerabilities.nodes[]
  | select(.vulnerableVersionRange | test(">= 9\\.0\\.0"))
  | [.advisory.severity, .advisory.ghsaId, .advisory.summary, .vulnerableVersionRange, (.firstPatchedVersion.identifier // "")]
  | `@tsv`'

Repository: parse-community/parse-server-s3-adapter

Length of output: 4269

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== npm registry latest and recent 9.9.x versions =="
curl -ks https://registry.npmjs.org/parse-server \
  | python3 - <<'PY'
import json, sys
data = json.load(sys.stdin)
print("latest:", data["dist-tags"]["latest"])
vers = sorted(v for v in data["versions"] if v.startswith("9.9."))
print("9.9.* versions:", ", ".join(vers[-30:]))
PY

echo
echo "== advisories that include 9.9.0 =="
gh api graphql -f query='
{
  securityVulnerabilities(first: 100, ecosystem: NPM, package: "parse-server") {
    nodes {
      advisory { ghsaId summary severity }
      vulnerableVersionRange
      firstPatchedVersion { identifier }
    }
  }
}' | jq -r '
  .data.securityVulnerabilities.nodes[]
  | select(.vulnerableVersionRange | test("(^|, )>= 9\\.0\\.0|9\\.9\\.0|< 9\\.9\\.1"))
  | [.advisory.severity, .advisory.ghsaId, .advisory.summary, .vulnerableVersionRange, (.firstPatchedVersion.identifier // "")]
  | `@tsv`'

Repository: parse-community/parse-server-s3-adapter

Length of output: 950

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== registry response probe =="
tmp=$(mktemp)
code=$(curl -k -sS -D /tmp/headers.txt -o "$tmp" -w '%{http_code}' https://registry.npmjs.org/parse-server || true)
echo "http_code=$code"
echo "-- headers --"
sed -n '1,20p' /tmp/headers.txt || true
echo "-- body head --"
head -c 500 "$tmp" | sed -n '1,5p' || true
echo
echo "body bytes:"
wc -c "$tmp" || true

echo
echo "== parse-server advisories from GraphQL =="
gh api graphql -f query='
{
  securityVulnerabilities(first: 100, ecosystem: NPM, package: "parse-server") {
    nodes {
      advisory { ghsaId summary severity }
      vulnerableVersionRange
      firstPatchedVersion { identifier }
    }
  }
}' | jq -r '
  .data.securityVulnerabilities.nodes[]
  | [.advisory.severity, .advisory.ghsaId, .advisory.summary, .vulnerableVersionRange, (.firstPatchedVersion.identifier // "")]
  | `@tsv`' | sed -n '1,30p'

Repository: parse-community/parse-server-s3-adapter

Length of output: 5615

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== npm registry latest =="
curl -ks https://registry.npmjs.org/parse-server | jq -r '.["dist-tags"].latest'

echo
echo "== recent 9.9.x versions =="
curl -ks https://registry.npmjs.org/parse-server \
  | jq -r '.versions | keys[]' \
  | awk -F. '$1==9 && $2==9 {print}' \
  | sort -V \
  | tail -n 20

Repository: parse-community/parse-server-s3-adapter

Length of output: 473

Upgrade parse-server to 9.10.0
9.9.0 is still below the current npm release and falls into multiple advisory ranges, including high-severity DoS issues. Bump the devDependency and regenerate the lockfile so both entries move off the vulnerable line.

📍 Affects 2 files
  • package.json#L42-L42 (this comment)
  • package-lock.json#L32-L32
  • package-lock.json#L13048-L13050
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@package.json` at line 42, Upgrade the parse-server devDependency from 9.9.0
to 9.10.0 in package.json, then regenerate package-lock.json so its root
dependency entry and resolved package entry both reference 9.10.0.

"rewire": "9.0.1",
"semantic-release": "25.0.3",
"semver": "7.7.4"
Expand Down
Loading