[mtrezza]

Security

This addresses the two open Dependabot alerts for ws:

• alert 397: GHSA-96hv-2xvq-fx4p / CVE-2026-48779 (high), memory exhaustion DoS from tiny fragments and data chunks. Vulnerable >= 8.0.0, < 8.21.0, first patched version 8.21.0.
• alert 362: GHSA-58qx-3vcg-4xpx / CVE-2026-45736 (medium), uninitialized memory disclosure. Vulnerable >= 8.0.0, < 8.20.1, first patched version 8.20.1.

The only vulnerable copy was ws 8.20.0 at the lock root, pinned exactly by the direct dependency parse 8.6.0. parse 8.6.2 pins ws 8.21.3, which is outside both vulnerable ranges. After this change the lock contains a single ws copy, 8.21.3.

Runtime Impact

• The example never imports parse itself. The global Parse used in cloud code and in the tests is the one that parse-server 9.10.7 exposes (require('parse/node'), then global.Parse = Parse).
• parse-server 9.10.7 and @parse/push-adapter 8.5.5 both depend on parse 8.6.2. Because the root copy was 8.6.0, each of them used its own nested copy (parse 8.6.2 with ws 8.21.3). The vulnerable root copy (parse 8.6.0 with ws 8.20.0) was therefore never loaded at runtime.
• With the root at 8.6.2, npm deduplicates those nested copies (parse 8.6.2, ws 8.21.3, idb-keyval 6.3.0) into the root. parse-server and the push adapter load the same versions as before, now from one shared copy. The push adapter uses parse/node only for Parse.Error.
• The ws limits introduced in 8.21.0 (maxBufferedChunks, maxFragments) and the other ws changes listed below are already in effect through parse-server's nested ws 8.21.3 copy, so the LiveQuery server behaves as before.

Changes

parse 8.6.0 → 8.6.2:

• 8.6.1: Bump ws from 8.20.0 to 8.21.0 (fix: Bump ws from 8.20.0 to 8.21.0 Parse-SDK-JS#3068).
• 8.6.2: Bump ws from 8.21.0 to 8.21.3 (fix: Bump ws from 8.21.0 to 8.21.3 Parse-SDK-JS#3119).
• Not in the release notes: 8.6.1 also ships idb-keyval 6.3.0 instead of 6.2.2 (refactor: Bump idb-keyval from 6.2.2 to 6.3.0 Parse-SDK-JS#3082). The SDK calls idb-keyval only when window.indexedDB exists, so never in Node.js. idb-keyval 6.3.0 contains browser-only fixes and adds the ./compat and ./umd subpath exports. The SDK's browser and weapp builds differ only in transpiled output from newer build tooling. The SDK sources, the type definitions and the Node.js build are unchanged apart from the version string.

ws 8.20.0 → 8.21.3:

• 8.20.1: Fixed an uninitialized memory disclosure in websocket.close() when a TypedArray is passed as reason (GHSA-58qx-3vcg-4xpx). close() now throws a TypeError if reason is neither a string nor a Uint8Array.
• 8.21.0: Added the maxBufferedChunks and maxFragments options, and fixed a remote memory exhaustion DoS from a high volume of tiny fragments and data chunks (GHSA-96hv-2xvq-fx4p).
• 8.21.1: Empty fragments now count toward the limit, and the defaults are lowered to 262144 (maxBufferedChunks) and 16384 (maxFragments).
• 8.21.2: Test fix only.
• 8.21.3: The server now rejects permessage-deflate offers whose client_max_window_bits is smaller than its configured clientMaxWindowBits.

Breaking Changes

None

Code Changes Required

None. The upgrade is a drop-in replacement. Only package.json and package-lock.json change, and the lock diff is limited to the parse, ws and idb-keyval entries.

Summary by CodeRabbit

• Chores
  • Updated the app’s Parse package from version 8.6.0 to 8.6.2. Supporting package versions were also updated, and redundant lockfile entries were removed. No user-facing feature changes are included in this release.

[parse-github-assistant]

🚀 Thanks for opening this pull request! We appreciate your effort in improving the project. Please let us know once your pull request is ready for review.

Tip

• Keep pull requests small. Large PRs will be rejected. Break complex features into smaller, incremental PRs.
• Use Test Driven Development. Write failing tests before implementing functionality. Ensure tests pass.
• Group code into logical blocks. Add a short comment before each block to explain its purpose.
• We offer conceptual guidance. Coding is up to you. PRs must be merge-ready for human review.
• Our review focuses on concept, not quality. PRs with code issues will be rejected. Use an AI agent.
• Human review time is precious. Avoid review ping-pong. Inspect and test your AI-generated code.

Note

Please respond to review comments from AI agents just like you would to comments from a human reviewer. Let the reviewer resolve their own comments, unless they have reviewed and accepted your commit, or agreed with your explanation for why the feedback was incorrect.

Caution

Pull requests must be written using an AI agent with human supervision. Pull requests written entirely by a human will likely be rejected, because of lower code quality, higher review effort and the higher risk of introducing bugs. Please note that AI review comments on this pull request alone do not satisfy this requirement. Our CI and AI review are safeguards, not development tools. If many issues are flagged, rethink your development approach. Invest more effort in planning and design rather than using review cycles to fix low-quality code.

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Essentials
• Run ID: 9dcf8a11-3f9d-4eba-8950-418545d0c108

Commits

Reviewing files that changed from the base of the PR and between 2597083 and 682fcaf.

Files selected for processing: 2

• package-lock.json
• package.json

Included review availability: This review used your included allowance. Your plan provides up to 5 included reviews per hour; 3 remain after this review.

Walkthrough

The root parse dependency is updated from 8.6.0 to 8.6.2. The lockfile updates the resolved parse, idb-keyval, and ws package records and removes redundant nested records.

Changes: Parse dependency update

Layer / File(s)	Summary
Update Parse and resolved dependencies package.json, package-lock.json	The manifest and lockfile update parse to 8.6.2. The lockfile updates idb-keyval to 6.3.0 and ws to 8.21.3, removes redundant nested records, and adds a nested semver record under the parse-server legacy dependency record.

Priority: Normal

Estimated code review effort: 2 (Simple) | ~8 minutes

Possibly related PRs

• parse-community/parse-server-example#946: This PR updates parse-server and records nested parse and ws resolutions. The current PR updates the root parse dependency and removes the remaining duplicate resolutions.

Suggested reviewers: semantic-release-bot

Merge Risk: Minimal · up to 682fc

The dependency update is internally consistent and ready to merge.

Pre-merge checks: 6

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title begins with the required prefix "fix:" and the first letter after the prefix is capitalized ("Bump"). It accurately describes the main change: the root parse dependency is bumped from 8.6.0 …
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Security Check		PASS. The pull request changes only package.json and package-lock.json. It upgrades parse from 8.6.0 to 8.6.2 and changes every locked ws entry from 8.20.0 to 8.21.3, with no remaining vulnera…
Engage In Review Feedback		PASS: The supplied review data reports zero actionable findings and no posted CodeRabbit review threads. Therefore, no feedback comment required engagement, implementation, or reviewer retraction.

Full details: Title check

Explanation

The title begins with the required prefix "fix:" and the first letter after the prefix is capitalized ("Bump"). It accurately describes the main change: the root parse dependency is bumped from 8.6.0 to 8.6.2 in package.json and package-lock.json, which also resolves the ws copy to 8.21.3 and addresses the two reported ws Dependabot alerts.

Full details: Security Check

Explanation

PASS. The pull request changes only package.json and package-lock.json. It upgrades parse from 8.6.0 to 8.6.2 and changes every locked ws entry from 8.20.0 to 8.21.3, with no remaining vulnerable ws copy. No application code, scripts, or security-sensitive logic was added or modified.

Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[parseplatformorg]

🎉 This change has been released in version 3.1.4