Skip to content

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Oct 17, 2022

Bumps parse-server from 4.5.0 to 5.2.8.

Release notes

Sourced from parse-server's releases.

5.2.8

5.2.8 (2022-10-14)

Bug Fixes

  • server crashes when receiving file download request with invalid byte range; this fixes a security vulnerability that allows an attacker to impact the availability of the server instance; the fix improves parsing of the range parameter to properly handle invalid range requests (GHSA-h423-w6qv-2wj3) (#8235) (066f296)

5.2.7

5.2.7 (2022-09-20)

Bug Fixes

  • authentication adapter app ID validation may be circumvented; this fixes a vulnerability that affects configurations which allow users to authenticate using the Parse Server authentication adapter for Facebook or Spotify and where the server-side authentication adapter configuration appIds is set as a string (e.g. abc) instead of an array of strings (e.g. ["abc"]) (GHSA-r657-33vp-gp22) (#8185) (ecf0814)

5.2.6

5.2.6 (2022-09-20)

Bug Fixes

  • session object properties can be updated by foreign user; this fixes a security vulnerability in which a foreign user can write to the session object of another user if the session object ID is known; the fix prevents writing to foreign session objects (GHSA-6w4q-23cf-j9jp) (#8182) (6d0b2f5)

5.2.5

5.2.5 (2022-09-02)

Bug Fixes

  • brute force guessing of user sensitive data via search patterns; this fixes a security vulnerability in which internal and protected fields may be used as query constraints to guess the value of these fields and obtain sensitive data (GHSA-2m6g-crv8-p3c6) (#8144) (e39d51b)

5.2.4

5.2.4 (2022-06-30)

Bug Fixes

5.2.3

5.2.3 (2022-06-17)

Bug Fixes

  • invalid file request not properly handled; this fixes a security vulnerability in which an invalid file request can crash the server (GHSA-xw6g-jjvf-wwf9) (#8060) (5be375d)

... (truncated)

Commits
  • 8011b2f chore(release): 5.2.8 [skip ci]
  • 066f296 fix: server crashes when receiving file download request with invalid byte ra...
  • e6dc487 chore(release): 5.2.7 [skip ci]
  • ecf0814 fix: authentication adapter app ID validation may be circumvented; this fixes...
  • 7aac70c chore(release): 5.2.6 [skip ci]
  • 6d0b2f5 fix: session object properties can be updated by foreign user; this fixes a s...
  • 83fd16c chore(release): 5.2.5 [skip ci]
  • e39d51b fix: brute force guessing of user sensitive data via search patterns; this fi...
  • e42be5c chore(release): 5.2.4 [skip ci]
  • 309f64c fix: protected fields exposed via LiveQuery; this removes protected fields fr...
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by parseadmin, a new releaser for parse-server since your current version.


Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [parse-server](https://github.com/parse-community/parse-server) from 4.5.0 to 5.2.8.
- [Release notes](https://github.com/parse-community/parse-server/releases)
- [Changelog](https://github.com/parse-community/parse-server/blob/alpha/CHANGELOG.md)
- [Commits](parse-community/parse-server@4.5.0...5.2.8)

---
updated-dependencies:
- dependency-name: parse-server
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added the dependencies Pull requests that update a dependency file label Oct 17, 2022
@nx-cloud
Copy link

nx-cloud bot commented Oct 17, 2022

☁️ Nx Cloud Report

We didn't find any information for the current pull request with the commit 412d65f.
You might need to set the 'NX_BRANCH' environment variable in your CI pipeline.

Check the Nx Cloud Github Integration documentation for more information.


Sent with 💌 from NxCloud.

@dependabot @github
Copy link
Contributor Author

dependabot bot commented on behalf of github Oct 31, 2022

Superseded by #394.

@dependabot dependabot bot closed this Oct 31, 2022
@dependabot dependabot bot deleted the dependabot/npm_and_yarn/parse-server-5.2.8 branch October 31, 2022 10:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants