Merge branch 'alpha' into fix-fields

Author: mtrezza

.github/workflows/ci.yml

@@ -1,11 +1,11 @@
 name: ci
 on:
   push:
-    branches: [ release, alpha, beta ]
+    branches: [ release*, alpha, beta ]
   pull_request:
-    branches: [ release, alpha, beta ]
+    branches: [ release*, alpha, beta ]
 env:
-  NODE_VERSION: 18.12.1
+  NODE_VERSION: 19.3.0
   PARSE_SERVER_TEST_TIMEOUT: 20000
 jobs:
   check-code-analysis:
@@ -145,24 +145,24 @@ jobs:
           - name: MongoDB 4.2, ReplicaSet
             MONGODB_VERSION: 4.2.19
             MONGODB_TOPOLOGY: replicaset
-            NODE_VERSION: 18.12.1
+            NODE_VERSION: 19.3.0
           - name: MongoDB 4.4, ReplicaSet
             MONGODB_VERSION: 4.4.13
             MONGODB_TOPOLOGY: replicaset
-            NODE_VERSION: 18.12.1
+            NODE_VERSION: 19.3.0
           - name: MongoDB 5, ReplicaSet
             MONGODB_VERSION: 5.3.2
             MONGODB_TOPOLOGY: replicaset
-            NODE_VERSION: 18.12.1
+            NODE_VERSION: 19.3.0
           - name: MongoDB 6, ReplicaSet
             MONGODB_VERSION: 6.0.2
             MONGODB_TOPOLOGY: replicaset
-            NODE_VERSION: 18.12.1
+            NODE_VERSION: 19.3.0
           - name: Redis Cache
             PARSE_SERVER_TEST_CACHE: redis
             MONGODB_VERSION: 4.4.13
             MONGODB_TOPOLOGY: standalone
-            NODE_VERSION: 18.12.1
+            NODE_VERSION: 19.3.0
           - name: Node 14
             MONGODB_VERSION: 4.4.13
             MONGODB_TOPOLOGY: standalone
@@ -171,6 +171,10 @@ jobs:
             MONGODB_VERSION: 4.4.13
             MONGODB_TOPOLOGY: standalone
             NODE_VERSION: 16.18.1
+          - name: Node 18
+            MONGODB_VERSION: 4.4.13
+            MONGODB_TOPOLOGY: standalone
+            NODE_VERSION: 18.12.1
       fail-fast: false
     name: ${{ matrix.name }}
     timeout-minutes: 15
@@ -214,28 +218,28 @@ jobs:
         include:
           - name: PostgreSQL 11, PostGIS 3.0
             POSTGRES_IMAGE: postgis/postgis:11-3.0
-            NODE_VERSION: 18.12.1
+            NODE_VERSION: 19.3.0
           - name: PostgreSQL 11, PostGIS 3.1
             POSTGRES_IMAGE: postgis/postgis:11-3.1
-            NODE_VERSION: 18.12.1
+            NODE_VERSION: 19.3.0
           - name: PostgreSQL 11, PostGIS 3.2
             POSTGRES_IMAGE: postgis/postgis:11-3.2
-            NODE_VERSION: 18.12.1
+            NODE_VERSION: 19.3.0
           - name: PostgreSQL 11, PostGIS 3.3
             POSTGRES_IMAGE: postgis/postgis:11-3.3
-            NODE_VERSION: 18.12.1
+            NODE_VERSION: 19.3.0
           - name: PostgreSQL 12, PostGIS 3.3
             POSTGRES_IMAGE: postgis/postgis:12-3.3
-            NODE_VERSION: 18.12.1
+            NODE_VERSION: 19.3.0
           - name: PostgreSQL 13, PostGIS 3.3
             POSTGRES_IMAGE: postgis/postgis:13-3.3
-            NODE_VERSION: 18.12.1
+            NODE_VERSION: 19.3.0
           - name: PostgreSQL 14, PostGIS 3.3
             POSTGRES_IMAGE: postgis/postgis:14-3.3
-            NODE_VERSION: 18.12.1
+            NODE_VERSION: 19.3.0
           - name: PostgreSQL 15, PostGIS 3.3
             POSTGRES_IMAGE: postgis/postgis:15-3.3
-            NODE_VERSION: 18.12.1
+            NODE_VERSION: 19.3.0
       fail-fast: false
     name: ${{ matrix.name }}
     timeout-minutes: 15

DEPRECATIONS.md

@@ -4,7 +4,7 @@ The following is a list of deprecations, according to the [Deprecation Policy](h
 
 | ID     | Change                                          | Issue                                                                | Deprecation [ℹ️][i_deprecation] | Planned Removal [ℹ️][i_removal] | Status [ℹ️][i_status] | Notes |
 |--------|-------------------------------------------------|----------------------------------------------------------------------|---------------------------------|---------------------------------|-----------------------|-------|
-| DEPPS1 | Native MongoDB syntax in aggregation pipeline   | [#7338](https://github.com/parse-community/parse-server/issues/7338) | 5.0.0 (2022)                    | 6.0.0 (2023)                    | deprecated            | -     |
+| DEPPS1 | Native MongoDB syntax in aggregation pipeline   | [#7338](https://github.com/parse-community/parse-server/issues/7338) | 5.0.0 (2022)                    | 6.0.0 (2023)                    | removed            | -     |
 | DEPPS2 | Config option `directAccess` defaults to `true` | [#6636](https://github.com/parse-community/parse-server/pull/6636)   | 5.0.0 (2022)                    | 6.0.0 (2023)                    | removed            | -     |
 | DEPPS3 | Config option `enforcePrivateUsers` defaults to `true` | [#7319](https://github.com/parse-community/parse-server/pull/7319)   | 5.0.0 (2022)                    | 6.0.0 (2023)                    | removed            | -     |
 | DEPPS4 | Remove convenience method for http request `Parse.Cloud.httpRequest` | [#7589](https://github.com/parse-community/parse-server/pull/7589)   | 5.0.0 (2022)                    | 6.0.0 (2023)                    | removed            | -     |

README.md

@@ -132,7 +132,8 @@ Parse Server is continuously tested with the most recent releases of Node.js to
 |------------|----------------|-------------|------------|
 | Node.js 14 | 14.19.1        | April 2023  | ✅ Yes      |
 | Node.js 16 | 16.14.2        | April 2024  | ✅ Yes      |
-| Node.js 18 | 18.1.0         | April 2025  | ✅ Yes      |
+| Node.js 18 | 18.12.1         | April 2025  | ✅ Yes      |
+| Node.js 19 | 19.3.0         | June 2023  | ✅ Yes      |
 
 #### MongoDB
 

changelogs/CHANGELOG_alpha.md

@@ -1,3 +1,41 @@
+# [6.0.0-alpha.21](https://github.com/parse-community/parse-server/compare/6.0.0-alpha.20...6.0.0-alpha.21) (2023-01-06)
+
+
+### Features
+
+* Add request rate limiter based on IP address ([#8174](https://github.com/parse-community/parse-server/issues/8174)) ([6c79f6a](https://github.com/parse-community/parse-server/commit/6c79f6a69e25e47846e3b0685d6bdfd6b91086b1))
+
+# [6.0.0-alpha.20](https://github.com/parse-community/parse-server/compare/6.0.0-alpha.19...6.0.0-alpha.20) (2023-01-06)
+
+
+### Features
+
+* Add Node 19 support ([#8363](https://github.com/parse-community/parse-server/issues/8363)) ([a4990dc](https://github.com/parse-community/parse-server/commit/a4990dcd29abcb4442f3c424aff482a0a116160f))
+
+# [6.0.0-alpha.19](https://github.com/parse-community/parse-server/compare/6.0.0-alpha.18...6.0.0-alpha.19) (2023-01-05)
+
+
+### Features
+
+* Remove deprecation `DEPPS1`: Native MongoDB syntax in aggregation pipeline ([#8362](https://github.com/parse-community/parse-server/issues/8362)) ([d0d30c4](https://github.com/parse-community/parse-server/commit/d0d30c4f1394f563724644a8fc81734be538a2c0))
+
+
+### BREAKING CHANGES
+
+* The MongoDB aggregation pipeline requires native MongoDB syntax instead of the custom Parse Server syntax; for example pipeline stage names require a leading dollar sign like `$match` and the MongoDB document ID is referenced using `_id` instead of `objectId` (#8362) ([d0d30c4](d0d30c4))
+
+# [6.0.0-alpha.18](https://github.com/parse-community/parse-server/compare/6.0.0-alpha.17...6.0.0-alpha.18) (2023-01-05)
+
+
+### Bug Fixes
+
+* The client IP address may be determined incorrectly in some cases; this fixes a security vulnerability in which the Parse Server option `masterKeyIps` may be circumvented, see [GHSA-vm5r-c87r-pf6x](https://github.com/parse-community/parse-server/security/advisories/GHSA-vm5r-c87r-pf6x) ([#8372](https://github.com/parse-community/parse-server/issues/8372)) ([892040d](https://github.com/parse-community/parse-server/commit/892040dc2f82a3e2abe2824e4b553521b6f894de))
+
+
+### BREAKING CHANGES
+
+* The mechanism to determine the client IP address has been rewritten; to correctly determine the IP address it is now required to set the Parse Server option `trustProxy` accordingly if Parse Server runs behind a proxy server, see the express framework's [trust proxy](https://expressjs.com/en/guide/behind-proxies.html) setting (#8372) ([892040d](892040d))
+
 # [6.0.0-alpha.17](https://github.com/parse-community/parse-server/compare/6.0.0-alpha.16...6.0.0-alpha.17) (2022-12-22)
 
 

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "parse-server",
-  "version": "6.0.0-alpha.17",
+  "version": "6.0.0-alpha.21",
   "description": "An express module providing a Parse-compatible API server",
   "main": "lib/index.js",
   "repository": {
@@ -32,6 +32,7 @@
     "cors": "2.8.5",
     "deepcopy": "2.1.0",
     "express": "4.18.2",
+    "express-rate-limit": "6.6.0",
     "follow-redirects": "1.15.2",
     "graphql": "16.6.0",
     "graphql-list-fields": "2.0.2",
@@ -48,6 +49,7 @@
     "mongodb": "4.10.0",
     "mustache": "4.2.0",
     "parse": "3.4.2",
+    "path-to-regexp": "0.1.7",
     "pg-monitor": "1.5.0",
     "pg-promise": "10.12.1",
     "pluralize": "8.0.0",
@@ -97,8 +99,8 @@
     "mock-mail-adapter": "file:spec/dependencies/mock-mail-adapter",
     "mongodb-runner": "4.8.1",
     "mongodb-version-list": "1.0.0",
-    "node-fetch": "3.2.10",
     "node-abort-controller": "3.0.1",
+    "node-fetch": "3.2.10",
     "nyc": "15.1.0",
     "prettier": "2.0.5",
     "semantic-release": "17.4.6",

package.json

@@ -44,6 +44,7 @@ const nestedOptionEnvPrefix = {
   SecurityOptions: 'PARSE_SERVER_SECURITY_',
   SchemaOptions: 'PARSE_SERVER_SCHEMA_',
   LogLevels: 'PARSE_SERVER_LOG_LEVELS_',
+  RateLimitOptions: 'PARSE_SERVER_RATE_LIMIT_',
 };
 
 function last(array) {
@@ -111,7 +112,9 @@ function processProperty(property, iface) {
   }
   let defaultValue;
   if (defaultLine) {
-    defaultValue = defaultLine.split(' ')[1];
+    const defaultArray = defaultLine.split(' ');
+    defaultArray.shift();
+    defaultValue = defaultArray.join(' ');
   }
   let type = property.value.type;
   let isRequired = true;