[mtrezza]

Pull Request

• Report security issues confidentially.
• Any contribution is under this license.

Issue

The production dependency parse 8.6.1 pins ws exactly at 8.21.0, which is affected by:

• GHSA-73jw-fp74-p77x / CVE-2026-62389 (high): ws memory exhaustion from incomplete fragmented messages. An attacker sends a text frame without FIN, followed by continuation frames that never complete the message. The fragment count stays just under the default maxFragments limit, so the guard never fires, while each small fragment is kept as a separate Buffer. Affects ws before 8.21.1, patched in 8.21.1. It was reported in Default maxFragments still allows memory-exhaustion DoS (incomplete GHSA-96hv-2xvq-fx4p fix) websockets/ws#2331 as an incomplete fix of GHSA-96hv-2xvq-fx4p, which fix: Bump parse from 8.6.0 to 8.6.1 #611 addressed by upgrading to ws 8.21.0.

The advisory is still marked as unreviewed in the GitHub Advisory Database, so Dependabot does not raise an alert for it.

Because parse pins ws exactly, ws cannot be updated on its own. parse 8.6.2 is the first release that depends on a patched ws version (8.21.3).

Approach

Bumps the parse production dependency from 8.6.1 to 8.6.2, pinned to an exact version. Manifest and lock file only — no code changes. This follows the same approach as #611.

The lock file changes are limited to parse and its own dependencies:

• parse 8.6.1 → 8.6.2
• ws 8.21.0 → 8.21.3 (the only ws instance in the dependency tree)

Changes

• 8.6.2: Bump ws from 8.21.0 to 8.21.3 (fix: Bump ws from 8.21.0 to 8.21.3 Parse-SDK-JS#3119). This includes:
  • ws 8.21.1: Fixes the advisory above. Empty fragments now count toward the maxFragments limit (fix: count empty continuation frames toward the maxFragments limit websockets/ws#2329). The default maxBufferedChunks is lowered from 1048576 to 262144, and the default maxFragments from 131072 to 16384. Connections that exceed these limits are still closed with code 1008.
  • ws 8.21.2: Test-only fix, with no library changes.
  • ws 8.21.3: A ws server now rejects permessage-deflate offers whose client_max_window_bits is smaller than its configured clientMaxWindowBits. This only affects ws servers.
• 8.6.2: No SDK source changes. The remaining commits are release and CI commits. The published Node build (lib/node, which parse/node resolves to) matches 8.6.1 except for the version string.

Breaking Changes

None. parse 8.6.2 declares the same engines.node as 8.6.1 (>=20.19.0 <21 || >=22.13.0 <23 || >=24.1.0 <25), and ws 8.21.3 requires Node >=10.0.0, so the upgrade adds no new Node version constraint. engines.node in this repository is unchanged.

Code Changes Required

None — the upgrade is a drop-in replacement. This adapter imports parse/node only for Parse.Error: the constructor, the PUSH_MISCONFIGURED and OTHER_CAUSE codes, and instanceof checks. That API is unchanged, and the existing APNS, APNSNative, FCM and ParsePushAdapter specs cover it. The adapter does not use LiveQuery, so it loads ws but never opens a WebSocket connection with it. The full test suite passes locally with parse 8.6.2 (163 of 163 specs).

Tasks

No tasks apply (manifest and lock file only dependency update; existing tests cover the used API).

Summary by CodeRabbit

• Chores
  • Updated supporting software components to newer patch versions. These updates do not change the app’s features or behavior, and no user-facing changes are included in this release.

[parse-github-assistant]

🚀 Thanks for opening this pull request! We appreciate your effort in improving the project. Please let us know once your pull request is ready for review.

Tip

• Keep pull requests small. Large PRs will be rejected. Break complex features into smaller, incremental PRs.
• Use Test Driven Development. Write failing tests before implementing functionality. Ensure tests pass.
• Group code into logical blocks. Add a short comment before each block to explain its purpose.
• We offer conceptual guidance. Coding is up to you. PRs must be merge-ready for human review.
• Our review focuses on concept, not quality. PRs with code issues will be rejected. Use an AI agent.
• Human review time is precious. Avoid review ping-pong. Inspect and test your AI-generated code.

Note

Please respond to review comments from AI agents just like you would to comments from a human reviewer. Let the reviewer resolve their own comments, unless they have reviewed and accepted your commit, or agreed with your explanation for why the feedback was incorrect.

Caution

Pull requests must be written using an AI agent with human supervision. Pull requests written entirely by a human will likely be rejected, because of lower code quality, higher review effort and the higher risk of introducing bugs. Please note that AI review comments on this pull request alone do not satisfy this requirement. Our CI and AI review are safeguards, not development tools. If many issues are flagged, rethink your development approach. Invest more effort in planning and design rather than using review cycles to fix low-quality code.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Essentials

Run ID: 30b765a4-9663-4aee-b45e-4abbd77d27e8

📥 Commits

Reviewing files that changed from the base of the PR and between f101381 and b355416.

📒 Files selected for processing (2)

• package-lock.json
• package.json

Included review availability: 0 reviews are currently available. Your included PR review attempts over the past 7 days set your current allowance at 3 reviews per hour.

---

📝 Walkthrough

Walkthrough

The project updates its declared parse dependency from 8.6.1 to 8.6.2. The lockfile records parse at 8.6.2 and ws at 8.21.3.

Changes

Dependency version update

Layer / File(s)	Summary
Update dependency versions package.json, package-lock.json	package.json declares parse at 8.6.2. The lockfile updates the parse package records and resolves ws at 8.21.3.

Estimated code review effort: 2 (Simple) | ~8 minutes

Merge Risk: ⚪ Minimal · up to b3554

This update changes dependency versions without an identified application behavior issue. No actionable merge-blocking risk is evident.

🚥 Pre-merge checks | ✅ 7

✅ Passed checks (7 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title begins with the allowed prefix fix: and clearly describes the dependency update. The first word after the prefix is capitalized.
Description check	✅ Passed	The description includes the required Pull Request, Issue, Approach, and Tasks sections. It explains the security issue, the dependency changes, compatibility impact, testing status, and why no tasks …
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Security Check	✅ Passed	PASS: The reviewed range changes only package.json and package-lock.json. It replaces exact parse 8.6.1 with 8.6.2 and its pinned ws dependency 8.21.0 with 8.21.3. The lockfile assertions pass, an…
Engage In Review Feedback	✅ Passed	The current review produced zero actionable findings. Therefore, no review feedback required engagement, implementation, or reviewer retraction for this check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

---

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 99.18%. Comparing base (1188c1e) to head (b355416).
⚠️ Report is 1 commits behind head on master.

Additional details and impacted files

@@           Coverage Diff           @@
##           master     #612   +/-   ##
=======================================
  Coverage   99.18%   99.18%           
=======================================
  Files          11       11           
  Lines        1841     1841           
=======================================
  Hits         1826     1826           
  Misses         15       15           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[parseplatformorg]

🎉 This change has been released in version 8.5.5