fix: Bump express-rate-limit from 8.3.1 to 8.7.0

[mtrezza]

Issue

express-rate-limit is pinned at 8.3.1, which pins ip-address to exactly 10.1.0. That version of ip-address is in the production dependency tree and is subject to two open Dependabot alerts on alpha:

Advisory	Severity	Affected	Patched
GHSA-mwp4-54f8-5fhr	High	<= 10.3.0	10.3.1
GHSA-v2v4-37r5-5v8g	Medium	<= 10.1.0	10.1.1

GHSA-mwp4-54f8-5fhr is the material one: Address4 decodes leading-zero octets as decimal while OS resolvers decode them as octal, which allows SSRF and trust-boundary bypass. ip-address is reachable in production through express-rate-limit's IP key generator.

Because express-rate-limit@8.3.1 pins "ip-address": "10.1.0" exactly, the advisory cannot be resolved by a transitive bump — the ancestor has to move.

Supersedes and closes #10621 (which targets express-rate-limit 8.6.2 / ip-address 10.5.0) and #10661 (which targets 8.7.0 but is now DIRTY against alpha).

Closes #10621
Closes #10661

Approach

Bump express-rate-limit from 8.3.1 to 8.7.0 (latest). express-rate-limit@8.7.0 declares "ip-address": "^10.2.0", so a fresh install resolves the production copy to 10.7.2, which carries no advisories. Manifest and lockfile only; no source changes.

Upstream changes, 8.3.1 -> 8.7.0

No breaking changes — every release in the range is additive or a fix.

• 8.3.2 — fixed skipFailedRequests for requests closed very early.
• 8.4.0 — mistagged; functionally identical to 8.3.2.
• 8.4.1 — added custom logger option; the default preserves the previous console.warn / console.error behaviour.
• 8.5.0 — store init functions may now be async; rejections are caught and logged.
• 8.5.1 — bumped ip-address in response to GHSA-v2v4-37r5-5v8g.
• 8.5.2 — reduced string templating in ipKeyGenerator.
• 8.6.0 — fixed the used count going negative when skipSuccessfulRequests / skipFailedRequests are set and the window resets mid-request; added DAY/HOUR/MINUTE/SECOND constants; added opt-in debug logging; validations now run once each rather than only on the first request.
• 8.6.1 — deprecated the time constants added in 8.6.0.
• 8.6.2 — ipKeyGenerator detects IPv4-mapped IPv6 addresses by range instead of by formatting.
• 8.7.0 — added the retryAfter option.

Parse Server constructs its limiter in src/middlewares.js and passes windowMs, max, message, handler, skip, keyGenerator and store. None of those options changed semantics in this range, and no new option is required.

Breaking Changes

None.

Code Changes Required

None — the upgrade is a drop-in replacement.

Notes for reviewers

1. Lockfile is version-only. No packages are added or removed (0 additions, 0 removals of node_modules/* entries); only versions and integrity hashes change. This branch is cut from current alpha, so it does not carry the unrelated gcp-metadata pruning that appeared in refactor: Bump express-rate-limit from 8.3.1 to 8.7.0 #10661's lockfile — that pruning already landed via refactor: Bump browserslist from 4.28.1 to 4.29.0 #10652.

2. debug is not a new production dependency. express-rate-limit@8.6.0+ declares debug: ^4.4.3, but debug@4.4.3 was already in the production tree on alpha, so the installed tree gains nothing.

3. Debug logging is opt-in and worth knowing about. The logging added in 8.6.0 runs through the express-rate-limit namespace and is inert unless DEBUG=express-rate-limit is set. If it is enabled, dist/index.cjs logs debug("computed key %o", key) — and for the session rate limit zone Parse Server's keyGenerator returns request.info.sessionToken, so the raw session token would be written to stderr. This is not a regression introduced by this PR (no logging occurs by default), but operators should avoid enabling that namespace in production.

4. Residual ip-address copies are dev-only. After the upgrade the only production copy is 10.7.2; the remaining 10.1.0 and 9.0.5 copies are vendored inside npm's own bundled tree under semantic-release.

5. Validation lifecycle changed, but the exposure surface did not. In 8.3.1, dist/index.cjs:939 called config.validations.disable() at the end of the first request, switching off every validation at once. 8.7.0 removes that and instead self-disables each check inside the wrapper (enabled[name] = false) after its own first run — upstream: "Validations are now run once each instead of only during the first request".

   The practical difference is limited to checks that did not happen to run during the first request: under 8.3.1 those were silenced forever, whereas under 8.7.0 each still gets its one run whenever it is first reached.

   For the checks Parse Server can actually reach this is a no-op. positiveHits, singleCount and limit are invoked unconditionally on every request (rate-limit.ts, immediately after the store increment), so they already ran on request Why?? #1 under 8.3.1 before disable() was reached. singleCount is the one that would matter, because its ERR_ERL_DOUBLE_COUNT message embeds the raw key verbatim and is surfaced through logger.error (default console.error, no DEBUG required) — and for the session/user zones Parse Server's key is a session token. But that was equally reachable on 8.3.1; if anything 8.3.1's window was marginally wider, since it had no per-check self-disable and concurrent early requests could each invoke it. Either way it can only fire on the first request(s) of a process, and none of the 62 specs in spec/RateLimit.spec.js trigger it.

   The remaining per-request checks (ip, trustProxy, xForwardedForHeader, forwardedHeader) live inside the default keyGenerator, which Parse Server replaces, so they never run in either version.

6. Store init errors are now caught instead of propagating. 8.3.1 called config.store.init(options) bare, so a synchronous throw propagated out of rateLimit() and therefore out of addRateLimit. 8.7.0 wraps it in try/catch and logs (upstream 8.5.0). Parse Server's Redis-backed rate limit store already handles its own connection errors, so this makes setup more resilient — but a genuinely broken store now fails quietly rather than loudly.

Tasks

• Add security check — resolves the open ip-address alerts (GHSA-mwp4-54f8-5fhr, GHSA-v2v4-37r5-5v8g)

[parse-github-assistant]

🚀 Thanks for opening this pull request! We appreciate your effort in improving the project. Please let us know once your pull request is ready for review.

Tip

• Keep pull requests small. Large PRs will be rejected. Break complex features into smaller, incremental PRs.
• Use Test Driven Development. Write failing tests before implementing functionality. Ensure tests pass.
• Group code into logical blocks. Add a short comment before each block to explain its purpose.
• We offer conceptual guidance. Coding is up to you. PRs must be merge-ready for human review.
• Our review focuses on concept, not quality. PRs with code issues will be rejected. Use an AI agent.
• Human review time is precious. Avoid review ping-pong. Inspect and test your AI-generated code.

Note

Please respond to review comments from AI agents just like you would to comments from a human reviewer. Let the reviewer resolve their own comments, unless they have reviewed and accepted your commit, or agreed with your explanation for why the feedback was incorrect.

Caution

Pull requests must be written using an AI agent with human supervision. Pull requests written entirely by a human will likely be rejected, because of lower code quality, higher review effort and the higher risk of introducing bugs. Please note that AI review comments on this pull request alone do not satisfy this requirement. Our CI and AI review are safeguards, not development tools. If many issues are flagged, rethink your development approach. Invest more effort in planning and design rather than using review cycles to fix low-quality code.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Essentials

Run ID: 99d9e1f5-5a9d-413d-b1f4-cc307be0dac3

📥 Commits

Reviewing files that changed from the base of the PR and between d02642a and b9f930e.

📒 Files selected for processing (1)

• package-lock.json

Included review availability: Your plan provides up to 10 included reviews per hour; 7 remain after this review.

---

📝 Walkthrough

Walkthrough

This pull request updates express-rate-limit from 8.3.1 to 8.7.0 in package.json and package-lock.json. The lockfile also updates ip-address to 10.7.2 and records debug as a dependency of express-rate-limit.

Changes

Dependency bump

Layer / File(s)	Summary
Declared dependency version package.json, package-lock.json	The declared express-rate-limit version changes from 8.3.1 to 8.7.0.
Resolved lockfile entries package-lock.json	The lockfile updates the express-rate-limit entries, records dependencies on debug and ip-address, and updates ip-address from 10.1.0 to 10.7.2.

Priority: ⬆️ High

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to b9f93

The dependency versions are aligned across the manifest and lockfile, with no identified merge-blocking issue. Proceed after normal checks.

---

Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 warning, 1 inconclusive)

Check name	Status	Explanation	Resolution
Security Check	⚠️ Warning	The upgrade fixes the production ip-address version, but it also adds a conditional credential leak. The changed lockfile upgrades express-rate-limit from 8.3.1 to 8.7.0 and adds debug. The 8.7.…	Use an express-rate-limit version or a patched dependency that does not log raw limiter keys. Redact or hash the key before debug output, and retain the patched production ip-address version. Also ensure production configuration cannot …
Engage In Review Feedback	❓ Inconclusive	The supplied review metadata reports zero actionable findings in the current review. It also states that this does not establish whether earlier review comments are absent or resolved. The reviewed di…	Provide the pull request's review-discussion history, including the status of earlier comments and evidence that each was discussed and then addressed in a commit or retracted by the reviewer. Reassess the check with that information.

✅ Passed checks (5 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	[#10621, #10661] package.json upgrades express-rate-limit from 8.3.1 to 8.7.0. package-lock.json resolves its ip-address dependency to 10.7.2, which exceeds the requested versions and keeps th…
Out of Scope Changes check	✅ Passed	The whole-PR diff changes only package.json and package-lock.json. The manifest and lockfile changes implement the linked dependency update. I found no unrelated changes in the whole-PR diff.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Title check	✅ Passed	The title uses the required fix: prefix and clearly describes the dependency upgrade.
Description check	✅ Passed	The description includes the Issue, Approach, and Tasks sections. It explains the security reason for the upgrade, the dependency changes, and the security check. The omitted Pull Request boilerplate …

Full details: Security Check

Explanation

The upgrade fixes the production ip-address version, but it also adds a conditional credential leak. The changed lockfile upgrades express-rate-limit from 8.3.1 to 8.7.0 and adds debug. The 8.7.0 implementation logs debug("computed key %o", key) in the express-rate-limit namespace. Parse Server’s session-zone key generator returns request.info.sessionToken, and Parse Server uses that token for session authentication. When DEBUG=express-rate-limit is enabled, the raw session token is written to the debug output and may be retained in logs. The leak is not active by default, but the PR introduces this sensitive-data logging path. The updated production ip-address is 10.7.2; the remaining 10.1.0 copies in the lockfile are bundled dev dependencies.

Resolution

Use an express-rate-limit version or a patched dependency that does not log raw limiter keys. Redact or hash the key before debug output, and retain the patched production ip-address version. Also ensure production configuration cannot enable the express-rate-limit debug namespace, and verify that session tokens do not appear in limiter logs.

Full details: Engage In Review Feedback

Explanation

The supplied review metadata reports zero actionable findings in the current review. It also states that this does not establish whether earlier review comments are absent or resolved. The reviewed diff changes only package.json and package-lock.json, and the repository provides no record of discussion or resolution states for prior comments. Therefore, the available evidence cannot show whether the user engaged with all review feedback.

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

---

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.83%. Comparing base (7cac84a) to head (b9f930e).

Additional details and impacted files

@@            Coverage Diff             @@
##            alpha   #10672      +/-   ##
==========================================
+ Coverage   93.82%   93.83%   +0.01%     
==========================================
  Files         192      192              
  Lines       16875    16875              
  Branches      252      252              
==========================================
+ Hits        15833    15835       +2     
+ Misses       1020     1018       -2     
  Partials       22       22              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[parseplatformorg]

🎉 This change has been released in version 9.10.1-alpha.15

[parseplatformorg]

🎉 This change has been released in version 9.10.1