Repository navigation
fix: Bump @parse/node-apn from 8.1.0 to 8.1.1 - #639
Conversation
|
🚀 Thanks for opening this pull request! We appreciate your effort in improving the project. Please let us know once your pull request is ready for review. Tip
Note Please respond to review comments from AI agents just like you would to comments from a human reviewer. Let the reviewer resolve their own comments, unless they have reviewed and accepted your commit, or agreed with your explanation for why the feedback was incorrect. Caution Pull requests must be written using an AI agent with human supervision. Pull requests written entirely by a human will likely be rejected, because of lower code quality, higher review effort and the higher risk of introducing bugs. Please note that AI review comments on this pull request alone do not satisfy this requirement. Our CI and AI review are safeguards, not development tools. If many issues are flagged, rethink your development approach. Invest more effort in planning and design rather than using review cycles to fix low-quality code. |
|
No actionable comments were generated in the recent review.
 |
| Layer / File(s) | Summary |
|---|---|
Update APN dependency versions package.json, package-lock.json |
@parse/node-apn is updated to 8.1.1. The lockfile updates node-forge to 1.4.2 and refreshes the related registry URLs, integrity hashes, and dependency references. |
Priority:
Estimated code review effort: 1 (Trivial) | ~5 minutes
Merge Risk: 
7a191
-
The dependency update is internally consistent and presents no supported merge-blocking risk.
Pre-merge checks: 
-
Check name Status Explanation Title check The title begins with the required fix:prefix and clearly describes the dependency update. The first word after the prefix is capitalized.Linked Issues check Check skipped because no linked issues were found for this pull request. Out of Scope Changes check Check skipped because no linked issues were found for this pull request. Security Check The pull request changes only dependency metadata. It upgrades @parse/node-apnfrom 8.1.0 to 8.1.1 and the single hoistednode-forgeentry from 1.4.0 to 1.4.2. No application code, scripts, permis…Engage In Review Feedback PASS: The current review produced zero actionable findings, and no CodeRabbit review threads were returned. No review feedback required engagement, implementation, or discussion. Description check The description is detailed and clearly explains the security issue, dependency changes, compatibility checks, impact, and lack of breaking changes. It does not use the template's explicit Issue, Appr… Full details: Security Check
-
Explanation
The pull request changes only dependency metadata. It upgrades
@parse/node-apnfrom 8.1.0 to 8.1.1 and the single hoistednode-forgeentry from 1.4.0 to 1.4.2. No application code, scripts, permissions, or runtime security patterns changed. The lockfile uses registry URLs and integrity hashes for both updated packages.
Full details: Description check
-
Explanation
The description is detailed and clearly explains the security issue, dependency changes, compatibility checks, impact, and lack of breaking changes. It does not use the template's explicit Issue, Approach, and Tasks headings, and it does not state the task checklist status, but the required information is substantially covered.
-
Finishing Touches
-
🧪 Generate unit tests (beta)
-
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Comment @coderabbitai help to get the list of available commands.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #639 +/- ##
=======================================
Coverage 99.18% 99.18%
=======================================
Files 11 11
Lines 1841 1841
=======================================
Hits 1826 1826
Misses 15 15 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
## [8.5.10](8.5.9...8.5.10) (2026-10-28) ### Bug Fixes * Bump @parse/node-apn from 8.1.0 to 8.1.1 ([#639](#639)) ([9ca05f9](9ca05f9))
|
🎉 This change has been released in version 8.5.10 |
Security
<= 1.4.0, no patched version listed. node-forge 1.4.0 is a single hoisted lock entry (node_modules/node-forge) shared by@parse/node-apn8.1.0 (exact pin) andfirebase-admin13.9.0 (^1.4.0).@parse/node-apn8.1.1 pins node-forge 1.4.2, which is outside the vulnerable range, andfirebase-admindedupes onto the same copy, so the alert resolves.@parse/node-apnuses node-forge only to parse certificate-based credentials (cert,key,pfx); token-based (.p8) authentication doesn't use it.firebase-admincalls onlyforge.pki.privateKeyFromPem(), to validate the service account'sprivate_keyincert().Changes
@parse/node-apn8.1.1node-forge 1.4.2
pem.decode()converts non-string input such as aBufferto a string again, as before 1.4.1. node-apn passes Buffers whencertandkeyare file paths or Buffers; 1.4.1 alone threwTypeError: str.charAt is not a functionthere.node-forge 1.4.1 (security release, 17 advisories)
Reached through credential parsing (node-apn's PEM, PKCS#12 and encrypted key parsing;
firebase-admin's PEM private key parsing):-----.asn1.fromDer()appliesmaxDepthinside BIT STRINGs and decodes only one level of them.2.999) is encoded and decoded in base 128 (Fix encoding/decoding of multi-byte first OID subidentifier digitalbazaar/forge#1148). This changesasn1.derToOid(), which the credential parsers use to read OIDs (certificate extensions and names, PKCS#12 bag types, encryption algorithms). OIDs from2.40upward used to decode wrongly (2.40as3.0,2.999as3.16.55) and now decode correctly. This has no effect here: every OID with a first subidentifier below 120 (all of0.x,1.xand2.0to2.39) decodes exactly as before. That includes the OIDs both callers check, whose first subidentifier is 42: Apple's push certificate extensions1.2.840.113635.100.6.3.1and.2, rsaEncryption, pkcs8ShroudedKeyBag and certBag.Not reached, because neither caller verifies signatures or certificate chains, encodes OIDs, or uses forge's TLS, AES-GCM, HTTP client or RSA key generation:
basicConstraintsbypass via deprecated extension OIDs in certificate chain verification (GHSA-5x38-2vff-x55p).pathLenConstraintbypass in certificate chain verification (GHSA-h46v-rmh6-fq4f), AES-GCM authentication bypass with an invalid tag length (GHSA-5cwg-6vw7-rj6p), and prototype pollution viaSet-Cookieinforge.http(GHSA-6wvx-3r32-xmcg).asn1.oidToDer(), the encoding side, which neither caller reaches.BigInteger.modInverse()with negative inputs (GHSA-h6cr-wjv9-3cpp).Compatibility check
firebase-admin's call was compared the same way:forge.pki.privateKeyFromPem()on a string, with itsFailed to parse private key: …error wrapping, under node-forge 1.4.0 and 1.4.2. The inputs were keys generated with OpenSSL 3.6 and the key inspec/support/fakeServiceAccount.json.fakeServiceAccount.jsonkey, each in 16 formatting variants (CRLF, CR, trailing spaces, leading Bag Attributes text, trailing text, leading blank lines, indentation with spaces or tabs, single-line and re-wrapped bodies, two keys, a certificate before the key, literal\nescapes)-----now reportsInvalid PEM formatted message.instead of a wrong PEM type error. Both versions reject itParent API
src/APNS.jsusesnew apn.Provider(), the provider'ssend()andnew apn.Notification(). node-apn's library code is identical in 8.1.0 and 8.1.1.src/FCM.jsreaches node-forge only throughcert()fromfirebase-admin/app, covered above. push-adapter doesn't match on any credential error message.Lock file
@parse/node-apn8.1.0 → 8.1.1node-forge1.4.0 → 1.4.2, still a single copyNo other entries change.
Breaking Changes
None
Code Changes Required
None. Only
package.jsonandpackage-lock.jsonchange.Summary by CodeRabbit