Repository navigation
fix: Installation update is written to the installation named by the request's installation ID instead of the addressed object (GHSA-8j8q-73xx-w3m4) - #10792
Merged
Conversation
|
🚀 Thanks for opening this pull request! We appreciate your effort in improving the project. Please let us know once your pull request is ready for review. Tip
Note Please respond to review comments from AI agents just like you would to comments from a human reviewer. Let the reviewer resolve their own comments, unless they have reviewed and accepted your commit, or agreed with your explanation for why the feedback was incorrect. Caution Pull requests must be written using an AI agent with human supervision. Pull requests written entirely by a human will likely be rejected, because of lower code quality, higher review effort and the higher risk of introducing bugs. Please note that AI review comments on this pull request alone do not satisfy this requirement. Our CI and AI review are safeguards, not development tools. If many issues are flagged, rethink your development approach. Invest more effort in planning and design rather than using review cycles to fix low-quality code. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
📝 Walkthrough
Merge Risk: ⚪ Minimal · up to
|
| Check name | Status | Explanation | Resolution |
|---|---|---|---|
| Description check |  |
The pull request has no description. It does not provide the required Issue, Approach, or Tasks information from the repository template. | Add a pull request description that includes the Issue and Approach sections. Complete the applicable Tasks, including the regression tests and security check, and remove or mark inapplicable tasks. |
-
Check name Status Explanation Title check The title uses the required fix:prefix, starts the subject with an uppercase letter, and identifies the security issue addressed by the changes.Docstring Coverage No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 2… Linked Issues check Check skipped because no linked issues were found for this pull request. Out of Scope Changes check Check skipped because no linked issues were found for this pull request. Security Check PASS. The pull request changes only _Installationidentity resolution insrc/RestWrite.js.auth.installationIdis now used only whenthis.queryis absent, so create deduplication still resolve…Engage In Review Feedback No review feedback comments or actionable findings were supplied. Therefore, there was no feedback to ignore, resolve, implement, or discuss.
- Fix all pre-merge checks with AI
✨ Finishing Touches
-
🧪 Generate unit tests (beta)
-
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Comment @coderabbitai help to get the list of available commands.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## alpha #10792 +/- ##
==========================================
- Coverage 94.03% 94.02% -0.01%
==========================================
Files 193 193
Lines 17239 17239
Branches 259 259
==========================================
- Hits 16210 16209 -1
- Misses 1007 1008 +1
Partials 22 22 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
mtrezza
changed the title
parseplatformorg
pushed a commit
that referenced
this pull request
Oct 15, 2026
## [9.10.5-alpha.10](9.10.5-alpha.9...9.10.5-alpha.10) (2026-10-15) ### Bug Fixes * Installation update is written to the installation named by the request's installation ID instead of the addressed object ([GHSA-8j8q-73xx-w3m4](GHSA-8j8q-73xx-w3m4)) ([#10792](#10792)) ([256a253](256a253))
Contributor
|
🎉 This change has been released in version 9.10.5-alpha.10 |
parseplatformorg
pushed a commit
that referenced
this pull request
Oct 16, 2026
## [9.10.5](9.10.4...9.10.5) (2026-10-16) ### Bug Fixes * Custom auth adapters that extend the AuthAdapter class accept any authData ([GHSA-rq3w-5c6f-p7wr](GHSA-rq3w-5c6f-p7wr)) ([#10773](#10773)) ([bee4082](bee4082)) * Installation update is written to the installation named by the request's installation ID instead of the addressed object ([GHSA-8j8q-73xx-w3m4](GHSA-8j8q-73xx-w3m4)) ([#10792](#10792)) ([256a253](256a253)) * LiveQuery subscriptions using a `$or` query can receive another user's events, including session tokens ([GHSA-349r-988w-x3jp](GHSA-349r-988w-x3jp)) ([#10776](#10776)) ([a7821c6](a7821c6)) * Login with master key overwrites stored MFA settings of user ([#10771](#10771)) ([28bb53b](28bb53b)) * Malformed query operators `$or`, `$and`, `$nor`, `$options` cause internal server error ([#10775](#10775)) ([c56ccdf](c56ccdf)) * Object update returns the stored value of a field reverted in `beforeSave` to a caller without read access ([GHSA-9rvr-f5hc-9f2f](GHSA-9rvr-f5hc-9f2f)) ([#10788](#10788)) ([0b33504](0b33504)) * Object write with a crafted key can pollute a shared prototype and cause denial of service ([GHSA-rx55-fw4j-pvpx](GHSA-rx55-fw4j-pvpx)) ([#10790](#10790)) ([e895091](e895091)) * Object write with a dot notation key can skip `afterSave` triggers and LiveQuery events ([GHSA-969q-274f-mc7w](GHSA-969q-274f-mc7w)) ([#10786](#10786)) ([6dab17c](6dab17c)) * Option `requestKeywordDenylist` does not apply to query parameters `keys`, `include` and `excludeKeys` ([#10793](#10793)) ([e220f51](e220f51)) * Relation `$relatedTo` query using an operator instead of an object ID bypasses owning-object ACL ([GHSA-58m4-cqvw-4vgh](GHSA-58m4-cqvw-4vgh)) ([#10783](#10783)) ([36af858](36af858)) * SMS MFA login code request saves other login request fields with master privileges ([GHSA-9rh6-r4ph-367v](GHSA-9rh6-r4ph-367v)) ([#10781](#10781)) ([e2a1474](e2a1474))
Contributor
|
🎉 This change has been released in version 9.10.5 |
beiguancyc
added a commit
to beiguancyc/parse-server
that referenced
this pull request
Oct 21, 2026
* release: (158 commits) chore(release): 9.10.5 [skip ci] empty commit to trigger CI chore(release): 9.10.5-alpha.11 [skip ci] fix: Option `requestKeywordDenylist` does not apply to query parameters `keys`, `include` and `excludeKeys` (parse-community#10793) chore(release): 9.10.5-alpha.10 [skip ci] fix: Installation update is written to the installation named by the request's installation ID instead of the addressed object ([GHSA-8j8q-73xx-w3m4](GHSA-8j8q-73xx-w3m4)) (parse-community#10792) chore(release): 9.10.5-alpha.9 [skip ci] fix: Object write with a crafted key can pollute a shared prototype and cause denial of service ([GHSA-rx55-fw4j-pvpx](GHSA-rx55-fw4j-pvpx)) (parse-community#10790) chore(release): 9.10.5-alpha.8 [skip ci] fix: Object update returns the stored value of a field reverted in `beforeSave` to a caller without read access ([GHSA-9rvr-f5hc-9f2f](GHSA-9rvr-f5hc-9f2f)) (parse-community#10788) chore(release): 9.10.5-alpha.7 [skip ci] fix: Object write with a dot notation key can skip `afterSave` triggers and LiveQuery events ([GHSA-969q-274f-mc7w](GHSA-969q-274f-mc7w)) (parse-community#10786) chore(release): 9.10.5-alpha.6 [skip ci] fix: Relation `$relatedTo` query using an operator instead of an object ID bypasses owning-object ACL ([GHSA-58m4-cqvw-4vgh](GHSA-58m4-cqvw-4vgh)) (parse-community#10783) chore(release): 9.10.5-alpha.5 [skip ci] fix: SMS MFA login code request saves other login request fields with master privileges ([GHSA-9rh6-r4ph-367v](GHSA-9rh6-r4ph-367v)) (parse-community#10781) chore(release): 9.10.5-alpha.4 [skip ci] fix: LiveQuery subscriptions using a `$or` query can receive another user's events, including session tokens ([GHSA-349r-988w-x3jp](GHSA-349r-988w-x3jp)) (parse-community#10776) chore(release): 9.10.5-alpha.3 [skip ci] fix: Malformed query operators `$or`, `$and`, `$nor`, `$options` cause internal server error (parse-community#10775) ... # Conflicts: # package-lock.json # package.json
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Issue
Installation update is written to the installation named by the request's installation ID instead of the addressed object (GHSA-8j8q-73xx-w3m4)
Tasks