gnu-lorien / yorick

A character database compatible with By Night Studio's Mind's Eye Theatre Books
https://patron.undergroundtheater.org
GNU Affero General Public License v3.0
3 stars 4 forks source link

Bump parse-server from 2.2.21 to 4.5.2 #207

Closed dependabot[bot] closed 3 years ago

dependabot[bot] commented 3 years ago

Bumps parse-server from 2.2.21 to 4.5.2.

Release notes

Sourced from parse-server's releases.

4.5.2

Full Changelog

  • SECURITY FIX: Fixes incorrect session property authProvider: password of anonymous users. When signing up an anonymous user, the session field createdWith indicates incorrectly that the session has been created using username and password with authProvider: password, instead of an anonymous sign-up with authProvider: anonymous. This fixes the issue by setting the correct authProvider: anonymous for future sign-ups of anonymous users. This fix does not fix incorrect authProvider: password for existing sessions of anonymous users. Consider this if your app logic depends on the authProvider field. (Corey Baker) GHSA-23r4-5mxp-c7g5

4.5.0

Full Changelog

BREAKING CHANGES:

  • FIX: Consistent casing for afterLiveQueryEvent. The afterLiveQueryEvent was introduced in 4.4.0 with inconsistent casing for the event names, which was fixed in 4.5.0. #7023. Thanks to dblythy.

  • FIX: Properly handle serverURL and publicServerUrl in Batch requests. #7049. Thanks to Zach Goldberg.
  • IMPROVE: Prevent invalid column names (className and length). #7053. Thanks to Diamond Lewis.
  • IMPROVE: GraphQL: Remove viewer from logout mutation. #7029. Thanks to Antoine Cormouls.
  • IMPROVE: GraphQL: Optimize on Relation. #7044. Thanks to Antoine Cormouls.
  • NEW: Include sessionToken in onLiveQueryEvent. #7043. Thanks to dblythy.
  • FIX: Definitions for accountLockout and passwordPolicy. #7040. Thanks to dblythy.
  • FIX: Fix typo in server definitions for emailVerifyTokenReuseIfValid. #7037. Thanks to dblythy.
  • SECURITY FIX: LDAP auth stores password in plain text. See GHSA-4w46-w44m-3jq3 for more details about the vulnerability and da905a3 for the fix. Thanks to Fabian Strachanski.
  • NEW: Reuse tokens if they haven't expired. #7017. Thanks to dblythy.
  • NEW: Add LDAPS-support to LDAP-Authcontroller. #7014. Thanks to Fabian Strachanski.
  • FIX: (beforeSave/afterSave): Return value instead of Parse.Op for nested fields. #7005. Thanks to Diamond Lewis.
  • FIX: (beforeSave): Skip Sanitizing Database results. #7003. Thanks to Diamond Lewis.
  • FIX: Fix includeAll for querying a Pointer and Pointer array. #7002. Thanks to Corey Baker.
  • FIX: Add encryptionKey to src/options/index.js. #6999. Thanks to dblythy.
  • IMPROVE: Update PostgresStorageAdapter.js. #6989. Thanks to Vitaly Tomilov.

4.4.0

Full Changelog

... (truncated)

Changelog

Sourced from parse-server's changelog.

4.5.2

Full Changelog

Security Fixes

  • SECURITY FIX: Fixes incorrect session property authProvider: password of anonymous users. When signing up an anonymous user, the session field createdWith indicates incorrectly that the session has been created using username and password with authProvider: password, instead of an anonymous sign-up with authProvider: anonymous. This fixes the issue by setting the correct authProvider: anonymous for future sign-ups of anonymous users. This fix does not fix incorrect authProvider: password for existing sessions of anonymous users. Consider this if your app logic depends on the authProvider field. (Corey Baker) GHSA-23r4-5mxp-c7g5

4.5.1

This version was published by mistake and was deprecated.

4.5.0

Full Changelog

Breaking Changes

  • FIX: Consistent casing for afterLiveQueryEvent. The afterLiveQueryEvent was introduced in 4.4.0 with inconsistent casing for the event names, which was fixed in 4.5.0. #7023. Thanks to dblythy.

Other Changes

  • FIX: Properly handle serverURL and publicServerUrl in Batch requests. #7049. Thanks to Zach Goldberg.
  • IMPROVE: Prevent invalid column names (className and length). #7053. Thanks to Diamond Lewis.
  • IMPROVE: GraphQL: Remove viewer from logout mutation. #7029. Thanks to Antoine Cormouls.
  • IMPROVE: GraphQL: Optimize on Relation. #7044. Thanks to Antoine Cormouls.
  • NEW: Include sessionToken in onLiveQueryEvent. #7043. Thanks to dblythy.
  • FIX: Definitions for accountLockout and passwordPolicy. #7040. Thanks to dblythy.
  • FIX: Fix typo in server definitions for emailVerifyTokenReuseIfValid. #7037. Thanks to dblythy.
  • SECURITY FIX: LDAP auth stores password in plain text. See GHSA-4w46-w44m-3jq3 for more details about the vulnerability and da905a3 for the fix. Thanks to Fabian Strachanski.
  • NEW: Reuse tokens if they haven't expired. #7017. Thanks to dblythy.
  • NEW: Add LDAPS-support to LDAP-Authcontroller. #7014. Thanks to Fabian Strachanski.
  • FIX: (beforeSave/afterSave): Return value instead of Parse.Op for nested fields. #7005. Thanks to Diamond Lewis.
  • FIX: (beforeSave): Skip Sanitizing Database results. #7003. Thanks to Diamond Lewis.
  • FIX: Fix includeAll for querying a Pointer and Pointer array. #7002. Thanks to Corey Baker.
  • FIX: Add encryptionKey to src/options/index.js. #6999. Thanks to dblythy.
  • IMPROVE: Update PostgresStorageAdapter.js. #6989. Thanks to Vitaly Tomilov.

4.4.0

Full Changelog

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by parseadmin, a new releaser for parse-server since your current version.


Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) - `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language - `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language - `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language - `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/gnu-lorien/yorick/network/alerts).
dependabot[bot] commented 3 years ago

Superseded by #208.