fix: resolve 13 CVEs via npm dependency upgrades and parse-server 9.x config fixes#2223
Open
starmanlabsio wants to merge 2 commits into
Open
fix: resolve 13 CVEs via npm dependency upgrades and parse-server 9.x config fixes#2223starmanlabsio wants to merge 2 commits into
starmanlabsio wants to merge 2 commits into
Conversation
- Upgrade parse-server ^8.6.84 to ^9.10.0 - Upgrade react-router ^7.14.2 to ^8.3.0 (fixes 11 CVEs) - Upgrade nodemailer ^8.0.7 to ^9.0.3 - Upgrade sharp ^0.34.5 to ^0.35.3 - Add security overrides: follow-redirects, uuid, ws, brace-expansion, gaxios, express-rate-limit, lodash, undici - Server: 0 vulnerabilities, Client: 2 unfixable (quill, insane)
- Remove encodeParseObjectInCloudFunction (invalid option in v9, caused startup error) - Remove allowExpiredAuthDataToken (deprecated, already defaults to false) - Change logLevel from array ['error'] to string 'error' - Fix cloud function to return dynamic import Promise
|
@starmanlabsio is attempting to deploy a commit to the prafull 's projects Team on Vercel. A member of the Team first needs to authorize it. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR resolves 13 known CVEs (7 server-side, 6 client-side) and removes a parse-server startup error by upgrading vulnerable dependencies and fixing deprecated configuration.
Audit results:
NPM Package Upgrades and CVEs Resolved
Server (apps/OpenSignServer)
1. parse-server ^8.6.84 to ^9.10.0
parse-server 9.10.0 ships newer versions of @apollo/server (5.5.0), uuid (11.1.1), and fixes its internal dependency tree. Additional overrides pin follow-redirects, ws, brace-expansion, gaxios, express-rate-limit, and ip-address to patched versions.
2. nodemailer ^8.0.7 to ^9.0.3
3. sharp ^0.34.5 to ^0.35.3
4. ws >=8.21.0 to >=8.21.1
Client (apps/OpenSign)
5. react-router ^7.14.2 to ^8.3.0
The vulnerable range is 7.12.0 through 8.2.0. Version 8.3.0 is the first clean release. The codebase uses only basic APIs (BrowserRouter, Routes, Route, Outlet, useNavigate, useLocation, useParams, NavLink, Link, Navigate, matchPath) which are all fully compatible with v8.
Source Code Changes and Rationale
apps/OpenSignServer/index.js
Change 1: Remove
encodeParseObjectInCloudFunction: trueLine removed (was line 125)
This option was removed in parse-server 9.x. The server logged
error: Invalid key(s) found in Parse Server configuration: encodeParseObjectInCloudFunctionon every startup. Removing it eliminates the startup error. Cloud function serialization behavior is now controlled by parse-server's internal defaults.Change 2: Remove
allowExpiredAuthDataToken: falseLine removed (was line 122)
This option is deprecated in parse-server 9.x and scheduled for removal. The deprecation notice states: "Auth providers are always validated on login regardless of this setting." The previous value of
falsematches the default behavior, so removing it has no functional impact.Change 3: Change
logLevel: ['error']tologLevel: 'error'Line 109 (was line 111)
parse-server 9.x expects
logLevelto be a string, not an array. Valid values are:error,warn,info,debug,verbose,silly,silent. Passing an array was silently handled in v8 but is not the documented format for v9.Change 4: Fix cloud function to return the dynamic import Promise
Line 107 (was lines 107-109)
Before:
After:
The original code called
import()but did not return the Promise. This created a race condition where parse-server could start accepting requests before cloud functions were fully registered. Returning the Promise allows parse-server to properly await cloud function registration during startup.Unfixable Vulnerabilities (Accepted Risk)
These are transitive dependencies with no available fix. The quill XSS requires an attacker to control rich text input and have a user export it as HTML. The insane ReDoS requires crafting a malicious HTML string that exceeds ~50 characters to trigger regex backtracking.
Additional Notes
"18 || 20 || 22"to"20 || 22".fileUpload.allowedFileUrlDomains,requestComplexity.*,protectedFields*, etc. These are informational and do not affect current functionality. They will become breaking changes in a future parse-server release.Testing
npm auditverified: server shows 0 vulnerabilities, client shows 2 unfixableencodeParseObjectInCloudFunctioninvalid key error