feat: Upgrade Node Package Manager lock file `package-lock.json` to version 2 #8285

dblythy · 2022-11-03T10:37:09Z

New Pull Request Checklist

I am not disclosing a vulnerability.
I am creating this PR in reference to an issue.

Issue Description

Lockfile should be v2 with Node 16

Related issue: #8274
Closes: #8274

Approach

Generates lockfile

TODOs before merging

Add tests
A changelog entry is created automatically using the pull request title (do not manually add a changelog entry)

…-community#7839)

## [5.2.1-alpha.1](parse-community/parse-server@5.2.0...5.2.1-alpha.1) (2022-03-26) ### Bug Fixes * return correct response when revert is used in beforeSave ([parse-community#7839](parse-community#7839)) ([f63fb2b](parse-community@f63fb2b))

… Cloud Function validation (parse-community#7892)

## [5.2.1-alpha.2](parse-community/parse-server@5.2.1-alpha.1...5.2.1-alpha.2) (2022-03-26) ### Performance Improvements * reduce database operations when using the constant parameter in Cloud Function validation ([parse-community#7892](parse-community#7892)) ([48bd512](parse-community@48bd512))

# [5.3.0-alpha.1](parse-community/parse-server@5.2.1-alpha.2...5.3.0-alpha.1) (2022-03-27) ### Features * add MongoDB 5.1 compatibility ([parse-community#7682](parse-community#7682)) ([90155cf](parse-community@90155cf))

…ommunity#7893)

# [5.3.0-alpha.2](parse-community/parse-server@5.3.0-alpha.1...5.3.0-alpha.2) (2022-03-27) ### Bug Fixes * security upgrade parse push adapter from 4.1.0 to 4.1.2 ([parse-community#7893](parse-community#7893)) ([ef56e98](parse-community@ef56e98))

# [5.3.0-alpha.3](parse-community/parse-server@5.3.0-alpha.2...5.3.0-alpha.3) (2022-03-27) ### Features * add MongoDB 5.2 support ([parse-community#7894](parse-community#7894)) ([6b4b358](parse-community@6b4b358))

…alpha

parse-github-assistant · 2022-11-03T10:37:12Z

Thanks for opening this pull request!

🎉 We are excited about your hands-on contribution!

codecov · 2022-11-03T10:50:04Z

Codecov Report

Base: 94.25% // Head: 94.35% // Increases project coverage by +0.09% 🎉

Coverage data is based on head (ba32e3f) compared to base (99fcf45).
Patch has no changes to coverable lines.

❗ Current head ba32e3f differs from pull request most recent head c25a160. Consider uploading reports for the commit c25a160 to get more accurate results

Additional details and impacted files

@@            Coverage Diff             @@
##            alpha    #8285      +/-   ##
==========================================
+ Coverage   94.25%   94.35%   +0.09%     
==========================================
  Files         180      181       +1     
  Lines       14023    14271     +248     
==========================================
+ Hits        13218    13466     +248     
  Misses        805      805

Impacted Files	Coverage Δ
src/Options/Definitions.js	`100.00% <ø> (ø)`
src/index.js	`100.00% <0.00%> (ø)`
src/logger.js	`100.00% <0.00%> (ø)`
src/Push/PushQueue.js	`100.00% <0.00%> (ø)`
src/LiveQuery/Client.js	`100.00% <0.00%> (ø)`
src/requiredParameter.js	`100.00% <0.00%> (ø)`
src/cli/utils/commander.js	`100.00% <0.00%> (ø)`
src/LiveQuery/Subscription.js	`100.00% <0.00%> (ø)`
src/Routers/FeaturesRouter.js	`100.00% <0.00%> (ø)`
src/Routers/SecurityRouter.js	`100.00% <0.00%> (ø)`
... and 95 more

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

☔ View full report at Codecov.
📢 Do you have feedback about the report comment? Let us know in this issue.

.github/workflows/ci.yml

mtrezza · 2022-11-11T00:21:27Z

How is this getting along? Seems to be quite an effort looking at the number of commits

mtrezza · 2022-11-26T16:41:23Z

@dblythy Did this get stuck for some reason?

dblythy · 2022-11-26T17:54:18Z

The main problem is that lockfile v2 is much more strict with dependency mismatches, so there is some refactoring and updates that are required to ensure that npm install works. Are we still approaching this update even though we still support Node 14?

mtrezza · 2022-11-26T21:05:18Z

We could stay on v1 and exclude this from the initial Parse Server 6 release.

The only argument I see is that the majority of deployments are likely running or will soon run on Node >=16, since Node 14 LTS ends in April. The deployment process will be slower because of the one-time conversion of the lock file. It's also a resource waste. If we take 5.000 Parse Server installations per day (npm stats) and the one-time lock file conversion taking 30 seconds on avg., that would be 42 hours per day or 15,200 hours until Parse Server 7 release in 2024 of wasted compute time.

Lockfile v2 is backwards compatible with v1, but for anyone running custom scripts on the lockfile (like our CI does), this could be a breaking change. But it's a gray zone, we could also merge this anytime throughout the year.

I'll move this from "required" to "optional" in the tracking list.

…ity#8209) BREAKING CHANGE: Nested objects are now properly stored in the database using JSON serialization; previously, due to a bug only top-level objects were serialized, but nested objects were saved as raw JSON; for example, a nested `Date` object was saved as a JSON object like `{ "__type": "Date", "iso": "2020-01-01T00:00:00.000Z" }` instead of its serialized representation `2020-01-01T00:00:00.000Z` (parse-community#8209)

* Nested objects are encoded incorrectly for MongoDB ([parse-community#8209](parse-community#8209)) ([1412666](parse-community@1412666)) * Nested objects are now properly stored in the database using JSON serialization; previously, due to a bug only top-level objects were serialized, but nested objects were saved as raw JSON; for example, a nested `Date` object was saved as a JSON object like `{ "__type": "Date", "iso": "2020-01-01T00:00:00.000Z" }` instead of its serialized representation `2020-01-01T00:00:00.000Z` (parse-community#8209) ([1412666](1412666))

BREAKING CHANGE: This release introduces the asynchronous initialization of Parse Server to prevent mounting Parse Server before being ready to receive request; it changes how Parse Server is imported, initialized and started; it also removes the callback `serverStartComplete`; see the [Parse Server 6 migration guide](https://github.com/parse-community/parse-server/blob/alpha/6.0.0.md) for more details (parse-community#8232)

# [6.0.0-alpha.16](parse-community/parse-server@6.0.0-alpha.15...6.0.0-alpha.16) (2022-12-21) ### Features * Asynchronous initialization of Parse Server ([parse-community#8232](parse-community#8232)) ([99fcf45](parse-community@99fcf45)) ### BREAKING CHANGES * This release introduces the asynchronous initialization of Parse Server to prevent mounting Parse Server before being ready to receive request; it changes how Parse Server is imported, initialized and started; it also removes the callback `serverStartComplete`; see the [Parse Server 6 migration guide](https://github.com/parse-community/parse-server/blob/alpha/6.0.0.md) for more details (parse-community#8232) ([99fcf45](99fcf45))

mtrezza · 2022-12-22T11:01:22Z

Nice! It seems only deprecation warnings are left now, no more peer dependency warnings.

Rerunning CI

# [6.0.0-alpha.17](6.0.0-alpha.16...6.0.0-alpha.17) (2022-12-22) ### Features * Upgrade Node Package Manager lock file `package-lock.json` to version 2 ([#8285](#8285)) ([ee72467](ee72467)) ### BREAKING CHANGES * The Node Package Manager lock file `package-lock.json` is upgraded to version 2; while it is backwards with version 1 for the npm installer, consider this if you run any non-npm analysis tools that use the lock file (#8285) ([ee72467](ee72467))

parseplatformorg · 2022-12-22T12:28:04Z

🎉 This change has been released in version 6.0.0-alpha.17

Moumouls · 2022-12-22T21:51:12Z

So nice to be on V2, thanks @dblythy, @mtrezza !

# [6.0.0-beta.1](5.4.0...6.0.0-beta.1) (2023-01-31) ### Bug Fixes * `ParseServer.verifyServerUrl` may fail if server response headers are missing; remove unnecessary logging ([#8391](#8391)) ([1c37a7c](1c37a7c)) * Cloud Code trigger `beforeSave` does not work with `Parse.Role` ([#8320](#8320)) ([f29d972](f29d972)) * ES6 modules do not await the import of Cloud Code files ([#8368](#8368)) ([a7bd180](a7bd180)) * Nested objects are encoded incorrectly for MongoDB ([#8209](#8209)) ([1412666](1412666)) * Parse Server option `masterKeyIps` does not include localhost by default for IPv6 ([#8322](#8322)) ([ab82635](ab82635)) * Rate limiter may reject requests that contain a session token ([#8399](#8399)) ([c114dc8](c114dc8)) * Remove Node 12 and Node 17 support ([#8279](#8279)) ([2546cc8](2546cc8)) * Schema without class level permissions may cause error ([#8409](#8409)) ([aa2cd51](aa2cd51)) * The client IP address may be determined incorrectly in some cases; this fixes a security vulnerability in which the Parse Server option `masterKeyIps` may be circumvented, see [GHSA-vm5r-c87r-pf6x](GHSA-vm5r-c87r-pf6x) ([#8372](#8372)) ([892040d](892040d)) * Throwing error in Cloud Code Triggers `afterLogin`, `afterLogout` crashes server ([#8280](#8280)) ([130d290](130d290)) ### Features * Access the internal scope of Parse Server using the new `maintenanceKey`; the internal scope contains unofficial and undocumented fields (prefixed with underscore `_`) which are used internally by Parse Server; you may want to manipulate these fields for out-of-band changes such as data migration or correction tasks; changes within the internal scope of Parse Server may happen at any time without notice or changelog entry, it is therefore recommended to look at the source code of Parse Server to understand the effects of manipulating internal fields before using the key; it is discouraged to use the `maintenanceKey` for routine operations in a production environment; see [access scopes](https://github.com/parse-community/parse-server#access-scopes) ([#8212](#8212)) ([f3bcc93](f3bcc93)) * Adapt `verifyServerUrl` for new asynchronous Parse Server start-up states ([#8366](#8366)) ([ffa4974](ffa4974)) * Add `ParseQuery.watch` to trigger LiveQuery only on update of specific fields ([#8028](#8028)) ([fc92faa](fc92faa)) * Add Node 19 support ([#8363](#8363)) ([a4990dc](a4990dc)) * Add option to change the log level of the logs emitted by triggers ([#8328](#8328)) ([8f3b694](8f3b694)) * Add request rate limiter based on IP address ([#8174](#8174)) ([6c79f6a](6c79f6a)) * Asynchronous initialization of Parse Server ([#8232](#8232)) ([99fcf45](99fcf45)) * Improve authentication adapter interface to support multi-factor authentication (MFA), authentication challenges, and provide a more powerful interface for writing custom authentication adapters ([#8156](#8156)) ([5bbf9ca](5bbf9ca)) * Reduce Docker image size by improving stages ([#8359](#8359)) ([40810b4](40810b4)) * Remove deprecation `DEPPS1`: Native MongoDB syntax in aggregation pipeline ([#8362](#8362)) ([d0d30c4](d0d30c4)) * Remove deprecation `DEPPS2`: Config option `directAccess` defaults to true ([#8284](#8284)) ([f535ee6](f535ee6)) * Remove deprecation `DEPPS3`: Config option `enforcePrivateUsers` defaults to `true` ([#8283](#8283)) ([ed499e3](ed499e3)) * Remove deprecation `DEPPS4`: Remove convenience method for http request `Parse.Cloud.httpRequest` ([#8287](#8287)) ([2d79c08](2d79c08)) * Remove support for MongoDB 4.0 ([#8292](#8292)) ([37245f6](37245f6)) * Restrict use of `masterKey` to localhost by default ([#8281](#8281)) ([6c16021](6c16021)) * Upgrade Node Package Manager lock file `package-lock.json` to version 2 ([#8285](#8285)) ([ee72467](ee72467)) * Upgrade Redis 3 to 4 ([#8293](#8293)) ([7d622f0](7d622f0)) * Upgrade Redis 3 to 4 for LiveQuery ([#8333](#8333)) ([b2761fb](b2761fb)) * Upgrade to Parse JavaScript SDK 4 ([#8332](#8332)) ([9092874](9092874)) * Write log entry when request with master key is rejected as outside of `masterKeyIps` ([#8350](#8350)) ([e22b73d](e22b73d)) ### BREAKING CHANGES * The Docker image does not contain the git dependency anymore; if you have been using git as a transitive dependency it now needs to be explicitly installed in your Docker file, for example with `RUN apk --no-cache add git` (#8359) ([40810b4](40810b4)) * Fields in the internal scope of Parse Server (prefixed with underscore `_`) are only returned using the new `maintenanceKey`; previously the `masterKey` allowed reading of internal fields; see [access scopes](https://github.com/parse-community/parse-server#access-scopes) for a comparison of the keys' access permissions (#8212) ([f3bcc93](f3bcc93)) * The method `ParseServer.verifyServerUrl` now returns a promise instead of a callback. ([ffa4974](ffa4974)) * The MongoDB aggregation pipeline requires native MongoDB syntax instead of the custom Parse Server syntax; for example pipeline stage names require a leading dollar sign like `$match` and the MongoDB document ID is referenced using `_id` instead of `objectId` (#8362) ([d0d30c4](d0d30c4)) * The mechanism to determine the client IP address has been rewritten; to correctly determine the IP address it is now required to set the Parse Server option `trustProxy` accordingly if Parse Server runs behind a proxy server, see the express framework's [trust proxy](https://expressjs.com/en/guide/behind-proxies.html) setting (#8372) ([892040d](892040d)) * The Node Package Manager lock file `package-lock.json` is upgraded to version 2; while it is backwards with version 1 for the npm installer, consider this if you run any non-npm analysis tools that use the lock file (#8285) ([ee72467](ee72467)) * This release introduces the asynchronous initialization of Parse Server to prevent mounting Parse Server before being ready to receive request; it changes how Parse Server is imported, initialized and started; it also removes the callback `serverStartComplete`; see the [Parse Server 6 migration guide](https://github.com/parse-community/parse-server/blob/alpha/6.0.0.md) for more details (#8232) ([99fcf45](99fcf45)) * Nested objects are now properly stored in the database using JSON serialization; previously, due to a bug only top-level objects were serialized, but nested objects were saved as raw JSON; for example, a nested `Date` object was saved as a JSON object like `{ "__type": "Date", "iso": "2020-01-01T00:00:00.000Z" }` instead of its serialized representation `2020-01-01T00:00:00.000Z` (#8209) ([1412666](1412666)) * The Parse Server option `enforcePrivateUsers` is set to `true` by default; in previous releases this option defaults to `false`; this change improves the default security configuration of Parse Server (#8283) ([ed499e3](ed499e3)) * This release restricts the use of `masterKey` to localhost by default; if you are using Parse Dashboard on a different server to connect to Parse Server you need to add the IP address of the server that hosts Parse Dashboard to this option (#8281) ([6c16021](6c16021)) * This release upgrades to Redis 4; if you are using the Redis cache adapter with Parse Server then this is a breaking change as the Redis client options have changed; see the [Redis migration guide](https://github.com/redis/node-redis/blob/redis%404.0.0/docs/v3-to-v4.md) for more details (#8293) ([7d622f0](7d622f0)) * This release removes support for MongoDB 4.0; the new minimum supported MongoDB version is 4.2. which also removes support for the deprecated MongoDB MMAPv1 storage engine ([37245f6](37245f6)) * Throwing an error in Cloud Code Triggers `afterLogin`, `afterLogout` returns a rejected promise; in previous releases it crashed the server if you did not handle the error on the Node.js process level; consider adapting your code if your app currently handles these errors on the Node.js process level with `process.on('unhandledRejection', ...)` ([130d290](130d290)) * Config option `directAccess` defaults to true; set this to `false` in environments where multiple Parse Server instances run behind a load balancer and Parse requests within the current Node.js environment should be routed via the load balancer and distributed as HTTP requests among all instances via the `serverURL`. ([f535ee6](f535ee6)) * The convenience method for HTTP requests `Parse.Cloud.httpRequest` is removed; use your preferred 3rd party library for making HTTP requests ([2d79c08](2d79c08)) * This release removes Node 12 and Node 17 support ([2546cc8](2546cc8))

parseplatformorg · 2023-01-31T03:21:49Z

🎉 This change has been released in version 6.0.0-beta.1

# [6.0.0](5.4.0...6.0.0) (2023-01-31) ### Bug Fixes * `ParseServer.verifyServerUrl` may fail if server response headers are missing; remove unnecessary logging ([#8391](#8391)) ([1c37a7c](1c37a7c)) * Cloud Code trigger `beforeSave` does not work with `Parse.Role` ([#8320](#8320)) ([f29d972](f29d972)) * ES6 modules do not await the import of Cloud Code files ([#8368](#8368)) ([a7bd180](a7bd180)) * Nested objects are encoded incorrectly for MongoDB ([#8209](#8209)) ([1412666](1412666)) * Parse Server option `masterKeyIps` does not include localhost by default for IPv6 ([#8322](#8322)) ([ab82635](ab82635)) * Rate limiter may reject requests that contain a session token ([#8399](#8399)) ([c114dc8](c114dc8)) * Remove Node 12 and Node 17 support ([#8279](#8279)) ([2546cc8](2546cc8)) * Schema without class level permissions may cause error ([#8409](#8409)) ([aa2cd51](aa2cd51)) * The client IP address may be determined incorrectly in some cases; this fixes a security vulnerability in which the Parse Server option `masterKeyIps` may be circumvented, see [GHSA-vm5r-c87r-pf6x](GHSA-vm5r-c87r-pf6x) ([#8372](#8372)) ([892040d](892040d)) * Throwing error in Cloud Code Triggers `afterLogin`, `afterLogout` crashes server ([#8280](#8280)) ([130d290](130d290)) ### Features * Access the internal scope of Parse Server using the new `maintenanceKey`; the internal scope contains unofficial and undocumented fields (prefixed with underscore `_`) which are used internally by Parse Server; you may want to manipulate these fields for out-of-band changes such as data migration or correction tasks; changes within the internal scope of Parse Server may happen at any time without notice or changelog entry, it is therefore recommended to look at the source code of Parse Server to understand the effects of manipulating internal fields before using the key; it is discouraged to use the `maintenanceKey` for routine operations in a production environment; see [access scopes](https://github.com/parse-community/parse-server#access-scopes) ([#8212](#8212)) ([f3bcc93](f3bcc93)) * Adapt `verifyServerUrl` for new asynchronous Parse Server start-up states ([#8366](#8366)) ([ffa4974](ffa4974)) * Add `ParseQuery.watch` to trigger LiveQuery only on update of specific fields ([#8028](#8028)) ([fc92faa](fc92faa)) * Add Node 19 support ([#8363](#8363)) ([a4990dc](a4990dc)) * Add option to change the log level of the logs emitted by triggers ([#8328](#8328)) ([8f3b694](8f3b694)) * Add request rate limiter based on IP address ([#8174](#8174)) ([6c79f6a](6c79f6a)) * Asynchronous initialization of Parse Server ([#8232](#8232)) ([99fcf45](99fcf45)) * Improve authentication adapter interface to support multi-factor authentication (MFA), authentication challenges, and provide a more powerful interface for writing custom authentication adapters ([#8156](#8156)) ([5bbf9ca](5bbf9ca)) * Reduce Docker image size by improving stages ([#8359](#8359)) ([40810b4](40810b4)) * Remove deprecation `DEPPS1`: Native MongoDB syntax in aggregation pipeline ([#8362](#8362)) ([d0d30c4](d0d30c4)) * Remove deprecation `DEPPS2`: Config option `directAccess` defaults to true ([#8284](#8284)) ([f535ee6](f535ee6)) * Remove deprecation `DEPPS3`: Config option `enforcePrivateUsers` defaults to `true` ([#8283](#8283)) ([ed499e3](ed499e3)) * Remove deprecation `DEPPS4`: Remove convenience method for http request `Parse.Cloud.httpRequest` ([#8287](#8287)) ([2d79c08](2d79c08)) * Remove support for MongoDB 4.0 ([#8292](#8292)) ([37245f6](37245f6)) * Restrict use of `masterKey` to localhost by default ([#8281](#8281)) ([6c16021](6c16021)) * Upgrade Node Package Manager lock file `package-lock.json` to version 2 ([#8285](#8285)) ([ee72467](ee72467)) * Upgrade Redis 3 to 4 ([#8293](#8293)) ([7d622f0](7d622f0)) * Upgrade Redis 3 to 4 for LiveQuery ([#8333](#8333)) ([b2761fb](b2761fb)) * Upgrade to Parse JavaScript SDK 4 ([#8332](#8332)) ([9092874](9092874)) * Write log entry when request with master key is rejected as outside of `masterKeyIps` ([#8350](#8350)) ([e22b73d](e22b73d)) ### BREAKING CHANGES * The Docker image does not contain the git dependency anymore; if you have been using git as a transitive dependency it now needs to be explicitly installed in your Docker file, for example with `RUN apk --no-cache add git` (#8359) ([40810b4](40810b4)) * Fields in the internal scope of Parse Server (prefixed with underscore `_`) are only returned using the new `maintenanceKey`; previously the `masterKey` allowed reading of internal fields; see [access scopes](https://github.com/parse-community/parse-server#access-scopes) for a comparison of the keys' access permissions (#8212) ([f3bcc93](f3bcc93)) * The method `ParseServer.verifyServerUrl` now returns a promise instead of a callback. ([ffa4974](ffa4974)) * The MongoDB aggregation pipeline requires native MongoDB syntax instead of the custom Parse Server syntax; for example pipeline stage names require a leading dollar sign like `$match` and the MongoDB document ID is referenced using `_id` instead of `objectId` (#8362) ([d0d30c4](d0d30c4)) * The mechanism to determine the client IP address has been rewritten; to correctly determine the IP address it is now required to set the Parse Server option `trustProxy` accordingly if Parse Server runs behind a proxy server, see the express framework's [trust proxy](https://expressjs.com/en/guide/behind-proxies.html) setting (#8372) ([892040d](892040d)) * The Node Package Manager lock file `package-lock.json` is upgraded to version 2; while it is backwards with version 1 for the npm installer, consider this if you run any non-npm analysis tools that use the lock file (#8285) ([ee72467](ee72467)) * This release introduces the asynchronous initialization of Parse Server to prevent mounting Parse Server before being ready to receive request; it changes how Parse Server is imported, initialized and started; it also removes the callback `serverStartComplete`; see the [Parse Server 6 migration guide](https://github.com/parse-community/parse-server/blob/alpha/6.0.0.md) for more details (#8232) ([99fcf45](99fcf45)) * Nested objects are now properly stored in the database using JSON serialization; previously, due to a bug only top-level objects were serialized, but nested objects were saved as raw JSON; for example, a nested `Date` object was saved as a JSON object like `{ "__type": "Date", "iso": "2020-01-01T00:00:00.000Z" }` instead of its serialized representation `2020-01-01T00:00:00.000Z` (#8209) ([1412666](1412666)) * The Parse Server option `enforcePrivateUsers` is set to `true` by default; in previous releases this option defaults to `false`; this change improves the default security configuration of Parse Server (#8283) ([ed499e3](ed499e3)) * This release restricts the use of `masterKey` to localhost by default; if you are using Parse Dashboard on a different server to connect to Parse Server you need to add the IP address of the server that hosts Parse Dashboard to this option (#8281) ([6c16021](6c16021)) * This release upgrades to Redis 4; if you are using the Redis cache adapter with Parse Server then this is a breaking change as the Redis client options have changed; see the [Redis migration guide](https://github.com/redis/node-redis/blob/redis%404.0.0/docs/v3-to-v4.md) for more details (#8293) ([7d622f0](7d622f0)) * This release removes support for MongoDB 4.0; the new minimum supported MongoDB version is 4.2. which also removes support for the deprecated MongoDB MMAPv1 storage engine ([37245f6](37245f6)) * Throwing an error in Cloud Code Triggers `afterLogin`, `afterLogout` returns a rejected promise; in previous releases it crashed the server if you did not handle the error on the Node.js process level; consider adapting your code if your app currently handles these errors on the Node.js process level with `process.on('unhandledRejection', ...)` ([130d290](130d290)) * Config option `directAccess` defaults to true; set this to `false` in environments where multiple Parse Server instances run behind a load balancer and Parse requests within the current Node.js environment should be routed via the load balancer and distributed as HTTP requests among all instances via the `serverURL`. ([f535ee6](f535ee6)) * The convenience method for HTTP requests `Parse.Cloud.httpRequest` is removed; use your preferred 3rd party library for making HTTP requests ([2d79c08](2d79c08)) * This release removes Node 12 and Node 17 support ([2546cc8](2546cc8))

parseplatformorg · 2023-01-31T03:40:01Z

🎉 This change has been released in version 6.0.0

…ersion 2 (parse-community#8285) BREAKING CHANGE: The Node Package Manager lock file `package-lock.json` is upgraded to version 2; while it is backwards with version 1 for the npm installer, consider this if you run any non-npm analysis tools that use the lock file (parse-community#8285)

* Upgrade Node Package Manager lock file `package-lock.json` to version 2 ([parse-community#8285](parse-community#8285)) ([ee72467](parse-community@ee72467)) * The Node Package Manager lock file `package-lock.json` is upgraded to version 2; while it is backwards with version 1 for the npm installer, consider this if you run any non-npm analysis tools that use the lock file (parse-community#8285) ([ee72467](ee72467))

* `ParseServer.verifyServerUrl` may fail if server response headers are missing; remove unnecessary logging ([parse-community#8391](parse-community#8391)) ([1c37a7c](parse-community@1c37a7c)) * Cloud Code trigger `beforeSave` does not work with `Parse.Role` ([parse-community#8320](parse-community#8320)) ([f29d972](parse-community@f29d972)) * ES6 modules do not await the import of Cloud Code files ([parse-community#8368](parse-community#8368)) ([a7bd180](parse-community@a7bd180)) * Nested objects are encoded incorrectly for MongoDB ([parse-community#8209](parse-community#8209)) ([1412666](parse-community@1412666)) * Parse Server option `masterKeyIps` does not include localhost by default for IPv6 ([parse-community#8322](parse-community#8322)) ([ab82635](parse-community@ab82635)) * Rate limiter may reject requests that contain a session token ([parse-community#8399](parse-community#8399)) ([c114dc8](parse-community@c114dc8)) * Remove Node 12 and Node 17 support ([parse-community#8279](parse-community#8279)) ([2546cc8](parse-community@2546cc8)) * Schema without class level permissions may cause error ([parse-community#8409](parse-community#8409)) ([aa2cd51](parse-community@aa2cd51)) * The client IP address may be determined incorrectly in some cases; this fixes a security vulnerability in which the Parse Server option `masterKeyIps` may be circumvented, see [GHSA-vm5r-c87r-pf6x](GHSA-vm5r-c87r-pf6x) ([parse-community#8372](parse-community#8372)) ([892040d](parse-community@892040d)) * Throwing error in Cloud Code Triggers `afterLogin`, `afterLogout` crashes server ([parse-community#8280](parse-community#8280)) ([130d290](parse-community@130d290)) * Access the internal scope of Parse Server using the new `maintenanceKey`; the internal scope contains unofficial and undocumented fields (prefixed with underscore `_`) which are used internally by Parse Server; you may want to manipulate these fields for out-of-band changes such as data migration or correction tasks; changes within the internal scope of Parse Server may happen at any time without notice or changelog entry, it is therefore recommended to look at the source code of Parse Server to understand the effects of manipulating internal fields before using the key; it is discouraged to use the `maintenanceKey` for routine operations in a production environment; see [access scopes](https://github.com/parse-community/parse-server#access-scopes) ([parse-community#8212](parse-community#8212)) ([f3bcc93](parse-community@f3bcc93)) * Adapt `verifyServerUrl` for new asynchronous Parse Server start-up states ([parse-community#8366](parse-community#8366)) ([ffa4974](parse-community@ffa4974)) * Add `ParseQuery.watch` to trigger LiveQuery only on update of specific fields ([parse-community#8028](parse-community#8028)) ([fc92faa](parse-community@fc92faa)) * Add Node 19 support ([parse-community#8363](parse-community#8363)) ([a4990dc](parse-community@a4990dc)) * Add option to change the log level of the logs emitted by triggers ([parse-community#8328](parse-community#8328)) ([8f3b694](parse-community@8f3b694)) * Add request rate limiter based on IP address ([parse-community#8174](parse-community#8174)) ([6c79f6a](parse-community@6c79f6a)) * Asynchronous initialization of Parse Server ([parse-community#8232](parse-community#8232)) ([99fcf45](parse-community@99fcf45)) * Improve authentication adapter interface to support multi-factor authentication (MFA), authentication challenges, and provide a more powerful interface for writing custom authentication adapters ([parse-community#8156](parse-community#8156)) ([5bbf9ca](parse-community@5bbf9ca)) * Reduce Docker image size by improving stages ([parse-community#8359](parse-community#8359)) ([40810b4](parse-community@40810b4)) * Remove deprecation `DEPPS1`: Native MongoDB syntax in aggregation pipeline ([parse-community#8362](parse-community#8362)) ([d0d30c4](parse-community@d0d30c4)) * Remove deprecation `DEPPS2`: Config option `directAccess` defaults to true ([parse-community#8284](parse-community#8284)) ([f535ee6](parse-community@f535ee6)) * Remove deprecation `DEPPS3`: Config option `enforcePrivateUsers` defaults to `true` ([parse-community#8283](parse-community#8283)) ([ed499e3](parse-community@ed499e3)) * Remove deprecation `DEPPS4`: Remove convenience method for http request `Parse.Cloud.httpRequest` ([parse-community#8287](parse-community#8287)) ([2d79c08](parse-community@2d79c08)) * Remove support for MongoDB 4.0 ([parse-community#8292](parse-community#8292)) ([37245f6](parse-community@37245f6)) * Restrict use of `masterKey` to localhost by default ([parse-community#8281](parse-community#8281)) ([6c16021](parse-community@6c16021)) * Upgrade Node Package Manager lock file `package-lock.json` to version 2 ([parse-community#8285](parse-community#8285)) ([ee72467](parse-community@ee72467)) * Upgrade Redis 3 to 4 ([parse-community#8293](parse-community#8293)) ([7d622f0](parse-community@7d622f0)) * Upgrade Redis 3 to 4 for LiveQuery ([parse-community#8333](parse-community#8333)) ([b2761fb](parse-community@b2761fb)) * Upgrade to Parse JavaScript SDK 4 ([parse-community#8332](parse-community#8332)) ([9092874](parse-community@9092874)) * Write log entry when request with master key is rejected as outside of `masterKeyIps` ([parse-community#8350](parse-community#8350)) ([e22b73d](parse-community@e22b73d)) * The Docker image does not contain the git dependency anymore; if you have been using git as a transitive dependency it now needs to be explicitly installed in your Docker file, for example with `RUN apk --no-cache add git` (parse-community#8359) ([40810b4](40810b4)) * Fields in the internal scope of Parse Server (prefixed with underscore `_`) are only returned using the new `maintenanceKey`; previously the `masterKey` allowed reading of internal fields; see [access scopes](https://github.com/parse-community/parse-server#access-scopes) for a comparison of the keys' access permissions (parse-community#8212) ([f3bcc93](f3bcc93)) * The method `ParseServer.verifyServerUrl` now returns a promise instead of a callback. ([ffa4974](ffa4974)) * The MongoDB aggregation pipeline requires native MongoDB syntax instead of the custom Parse Server syntax; for example pipeline stage names require a leading dollar sign like `$match` and the MongoDB document ID is referenced using `_id` instead of `objectId` (parse-community#8362) ([d0d30c4](d0d30c4)) * The mechanism to determine the client IP address has been rewritten; to correctly determine the IP address it is now required to set the Parse Server option `trustProxy` accordingly if Parse Server runs behind a proxy server, see the express framework's [trust proxy](https://expressjs.com/en/guide/behind-proxies.html) setting (parse-community#8372) ([892040d](892040d)) * The Node Package Manager lock file `package-lock.json` is upgraded to version 2; while it is backwards with version 1 for the npm installer, consider this if you run any non-npm analysis tools that use the lock file (parse-community#8285) ([ee72467](ee72467)) * This release introduces the asynchronous initialization of Parse Server to prevent mounting Parse Server before being ready to receive request; it changes how Parse Server is imported, initialized and started; it also removes the callback `serverStartComplete`; see the [Parse Server 6 migration guide](https://github.com/parse-community/parse-server/blob/alpha/6.0.0.md) for more details (parse-community#8232) ([99fcf45](99fcf45)) * Nested objects are now properly stored in the database using JSON serialization; previously, due to a bug only top-level objects were serialized, but nested objects were saved as raw JSON; for example, a nested `Date` object was saved as a JSON object like `{ "__type": "Date", "iso": "2020-01-01T00:00:00.000Z" }` instead of its serialized representation `2020-01-01T00:00:00.000Z` (parse-community#8209) ([1412666](1412666)) * The Parse Server option `enforcePrivateUsers` is set to `true` by default; in previous releases this option defaults to `false`; this change improves the default security configuration of Parse Server (parse-community#8283) ([ed499e3](ed499e3)) * This release restricts the use of `masterKey` to localhost by default; if you are using Parse Dashboard on a different server to connect to Parse Server you need to add the IP address of the server that hosts Parse Dashboard to this option (parse-community#8281) ([6c16021](6c16021)) * This release upgrades to Redis 4; if you are using the Redis cache adapter with Parse Server then this is a breaking change as the Redis client options have changed; see the [Redis migration guide](https://github.com/redis/node-redis/blob/redis%404.0.0/docs/v3-to-v4.md) for more details (parse-community#8293) ([7d622f0](7d622f0)) * This release removes support for MongoDB 4.0; the new minimum supported MongoDB version is 4.2. which also removes support for the deprecated MongoDB MMAPv1 storage engine ([37245f6](37245f6)) * Throwing an error in Cloud Code Triggers `afterLogin`, `afterLogout` returns a rejected promise; in previous releases it crashed the server if you did not handle the error on the Node.js process level; consider adapting your code if your app currently handles these errors on the Node.js process level with `process.on('unhandledRejection', ...)` ([130d290](130d290)) * Config option `directAccess` defaults to true; set this to `false` in environments where multiple Parse Server instances run behind a load balancer and Parse requests within the current Node.js environment should be routed via the load balancer and distributed as HTTP requests among all instances via the `serverURL`. ([f535ee6](f535ee6)) * The convenience method for HTTP requests `Parse.Cloud.httpRequest` is removed; use your preferred 3rd party library for making HTTP requests ([2d79c08](2d79c08)) * This release removes Node 12 and Node 17 support ([2546cc8](2546cc8))

mtrezza and others added 19 commits March 25, 2022 19:47

ci: fix node engine check (parse-community#7891)

9ef1968

fix: return correct response when revert is used in beforeSave (parse…

f63fb2b

…-community#7839)

perf: reduce database operations when using the constant parameter in…

48bd512

… Cloud Function validation (parse-community#7892)

feat: add MongoDB 5.1 compatibility (parse-community#7682)

90155cf

chore(release): 5.3.0-alpha.1 [skip ci]

499cead

# [5.3.0-alpha.1](parse-community/parse-server@5.2.1-alpha.2...5.3.0-alpha.1) (2022-03-27) ### Features * add MongoDB 5.1 compatibility ([parse-community#7682](parse-community#7682)) ([90155cf](parse-community@90155cf))

fix: security upgrade parse push adapter from 4.1.0 to 4.1.2 (parse-c…

ef56e98

…ommunity#7893)

feat: add MongoDB 5.2 support (parse-community#7894)

6b4b358

chore(release): 5.3.0-alpha.3 [skip ci]

75eca2d

# [5.3.0-alpha.3](parse-community/parse-server@5.3.0-alpha.2...5.3.0-alpha.3) (2022-03-27) ### Features * add MongoDB 5.2 support ([parse-community#7894](parse-community#7894)) ([6b4b358](parse-community@6b4b358))

Merge remote-tracking branch 'upstream/alpha' into alpha

61ef23f

Merge remote-tracking branch 'upstream/alpha' into alpha

606ed96

Merge branch 'alpha' of https://github.com/dblythy/parse-server into …

1e89817

…alpha

Merge remote-tracking branch 'upstream/alpha' into alpha

9720e8e

Merge remote-tracking branch 'upstream/alpha' into alpha

7bc5c36

Merge remote-tracking branch 'upstream/alpha' into alpha

7b2ab38

Merge remote-tracking branch 'upstream/alpha' into alpha

3c8f5cc

Merge remote-tracking branch 'upstream/alpha' into alpha

5814437

mtrezza reviewed Nov 3, 2022

View reviewed changes

.github/workflows/ci.yml Show resolved Hide resolved

mtrezza changed the title ~~fix: Generate lockflie v2~~ ci: Upgrade to npm lockflie version 2 Nov 3, 2022

mtrezza changed the title ~~ci: Upgrade to npm lockflie version 2~~ ci: Upgrade to npm lockfile version 2 Nov 3, 2022

dblythy added 2 commits November 3, 2022 22:20

Merge remote-tracking branch 'upstream/alpha' into alpha

986c6c2

Merge remote-tracking branch 'upstream/alpha' into alpha

6a40dc4

dblythy and others added 5 commits December 22, 2022 19:42

Update package-lock.json

19b99b4

dblythy force-pushed the regenerate-lock branch from 7aa5d46 to 19b99b4 Compare December 22, 2022 08:42

dblythy added 4 commits December 22, 2022 19:44

Merge remote-tracking branch 'upstream/alpha' into regenerate-lock

d71e9c0

Update package-lock.json

48b7a75

Update Definitions.js

c413df6

Update package-lock.json

c25a160

dblythy requested a review from a team December 22, 2022 10:03

mtrezza approved these changes Dec 22, 2022

View reviewed changes

mtrezza changed the title ~~ci: Upgrade to npm lockfile version 2~~ feat: Upgrade to npm lockfile version 2 Dec 22, 2022

mtrezza changed the title ~~feat: Upgrade to npm lockfile version 2~~ feat: Upgrade Node Package Manager lock file package-lock.json to version 2 Dec 22, 2022

mtrezza merged commit ee72467 into parse-community:alpha Dec 22, 2022

parseplatformorg added the state:released-alpha Released as alpha version label Dec 22, 2022

parseplatformorg added the state:released-beta Released as beta version label Jan 31, 2023

parseplatformorg added the state:released Released as stable version label Jan 31, 2023

dplewis deleted the regenerate-lock branch February 4, 2023 02:22

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: Upgrade Node Package Manager lock file `package-lock.json` to version 2 #8285

feat: Upgrade Node Package Manager lock file `package-lock.json` to version 2 #8285

dblythy commented Nov 3, 2022

parse-github-assistant bot commented Nov 3, 2022 •

edited

Loading

codecov bot commented Nov 3, 2022 •

edited

Loading

mtrezza commented Nov 11, 2022

mtrezza commented Nov 26, 2022 •

edited

Loading

dblythy commented Nov 26, 2022 •

edited

Loading

mtrezza commented Nov 26, 2022 •

edited

Loading

mtrezza commented Dec 22, 2022 •

edited

Loading

parseplatformorg commented Dec 22, 2022

Moumouls commented Dec 22, 2022

parseplatformorg commented Jan 31, 2023

parseplatformorg commented Jan 31, 2023

feat: Upgrade Node Package Manager lock file package-lock.json to version 2 #8285

feat: Upgrade Node Package Manager lock file package-lock.json to version 2 #8285

Conversation

dblythy commented Nov 3, 2022

New Pull Request Checklist

Issue Description

Approach

TODOs before merging

parse-github-assistant bot commented Nov 3, 2022 • edited Loading

Thanks for opening this pull request!

codecov bot commented Nov 3, 2022 • edited Loading

Codecov Report

mtrezza commented Nov 11, 2022

mtrezza commented Nov 26, 2022 • edited Loading

dblythy commented Nov 26, 2022 • edited Loading

mtrezza commented Nov 26, 2022 • edited Loading

mtrezza commented Dec 22, 2022 • edited Loading

parseplatformorg commented Dec 22, 2022

Moumouls commented Dec 22, 2022

parseplatformorg commented Jan 31, 2023

parseplatformorg commented Jan 31, 2023

feat: Upgrade Node Package Manager lock file `package-lock.json` to version 2 #8285

feat: Upgrade Node Package Manager lock file `package-lock.json` to version 2 #8285

parse-github-assistant bot commented Nov 3, 2022 •

edited

Loading

codecov bot commented Nov 3, 2022 •

edited

Loading

mtrezza commented Nov 26, 2022 •

edited

Loading

dblythy commented Nov 26, 2022 •

edited

Loading

mtrezza commented Nov 26, 2022 •

edited

Loading

mtrezza commented Dec 22, 2022 •

edited

Loading