[mtrezza]

Issue

Object update with a dot notation key can terminate the server process when the class has a beforeSave trigger (GHSA-2rxj-6v32-2v6j)

Tasks

• Add tests

[parse-github-assistant]

🚀 Thanks for opening this pull request! We appreciate your effort in improving the project. Please let us know once your pull request is ready for review.

Tip

• Keep pull requests small. Large PRs will be rejected. Break complex features into smaller, incremental PRs.
• Use Test Driven Development. Write failing tests before implementing functionality. Ensure tests pass.
• Group code into logical blocks. Add a short comment before each block to explain its purpose.
• We offer conceptual guidance. Coding is up to you. PRs must be merge-ready for human review.
• Our review focuses on concept, not quality. PRs with code issues will be rejected. Use an AI agent.
• Human review time is precious. Avoid review ping-pong. Inspect and test your AI-generated code.

Note

Please respond to review comments from AI agents just like you would to comments from a human reviewer. Let the reviewer resolve their own comments, unless they have reviewed and accepted your commit, or agreed with your explanation for why the feedback was incorrect.

Caution

Pull requests must be written using an AI agent with human supervision. Pull requests written entirely by a human will likely be rejected, because of lower code quality, higher review effort and the higher risk of introducing bugs. Please note that AI review comments on this pull request alone do not satisfy this requirement. Our CI and AI review are safeguards, not development tools. If many issues are flagged, rethink your development approach. Invest more effort in planning and design rather than using review cycles to fix low-quality code.

[coderabbitai]

No actionable comments were generated in the recent review.

Walkthrough

The change catches serialization failures in trigger handling and adds regression tests for dot-notation writes beneath SDK instances, unserializable trigger results, and accepted writes beneath plain Object fields.

Changes: Trigger error handling

Layer / File(s)	Summary
Serialization and rejection handling src/triggers.js, spec/vulnerabilities.spec.js	beforeSave serialization failures now reject with INCORRECT_TYPE, and trigger promise chains catch rejections. Tests cover writes beneath typed SDK fields, unserializable trigger results, and accepted dot-notation writes beneath plain Object fields.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• parse-community/parse-server#10548: Both changes update trigger promise chains to handle failures that could otherwise leave requests unsettled.

Merge Risk: Minimal · up to 072be

Before-save serialization failures receive a type error, and trigger-chain rejections are caught. No material merge-blocking risk was identified.

🔕 Pre-merge checks override requested

An override was requested. Check the override result before merging.

Requested by @mtrezza via checkbox on 2026-11-04T12:51:09.584Z.

Failed checks: 2 errors

Check name	Status	Explanation	Resolution
Title check	[IGNORED]	The title "fix: GHSA-2rxj-6v32-2v6j" uses the required "fix:" prefix, but the first letter after the prefix is not capitalized ("GHSA" is a security advisory ID, not a capitalized sentence start). The…	Rewrite the title so it starts with an allowed prefix and a capitalized first word after the colon, for example "fix: Reject dot-notation writes to SDK instance methods in beforeSave triggers". Keep the advisory ID in the description or the…
Description check	[IGNORED]	The description is empty. The author provided only a placeholder note saying no description was added. None of the template sections (Issue, Approach, Tasks) are filled in. The template also requires …	Add a description that follows the repository template. Include: (1) the Issue section linking GHSA-2rxj-6v32-2v6j or the related advisory; (2) the Approach section explaining that serialization errors in beforeSave, afterFind, and afterSav…

Passed checks: 5 passed

Check name	Status	Explanation
Docstring Coverage		Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Security Check		No security vulnerability is introduced by the changed code. In src/triggers.js, beforeSave serialization is now guarded and returns Parse.Error.INCORRECT_TYPE instead of allowing an exception t…
Engage In Review Feedback		The current review produced zero actionable findings, and no review threads were returned. No review feedback required engagement, implementation, or reviewer retraction.

Full details: Docstring Coverage

Explanation

Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 1 functions across 1 files. (1 skipped: 1 too large.)

Full details: Security Check

Explanation

No security vulnerability is introduced by the changed code. In src/triggers.js, beforeSave serialization is now guarded and returns Parse.Error.INCORRECT_TYPE instead of allowing an exception to leave the request unresolved. The added terminal promise catches settle failures from success and error handlers for save and find triggers. The regression tests cover typed SDK values, user timestamps, unserializable trigger results, server availability, and accepted plain-object dot notation. The diff contains no new authentication bypass, injection, prototype-pollution, or unsafe evaluation pattern.

Full details: Title check

Explanation

The title "fix: GHSA-2rxj-6v32-2v6j" uses the required "fix:" prefix, but the first letter after the prefix is not capitalized ("GHSA" is a security advisory ID, not a capitalized sentence start). The title also names only the advisory ID and does not describe the change. The changeset adds regression tests and a serialization error catch for dot-notation writes under beforeSave triggers, so the title is related to the change but gives no description of it.

Resolution

Rewrite the title so it starts with an allowed prefix and a capitalized first word after the colon, for example "fix: Reject dot-notation writes to SDK instance methods in beforeSave triggers". Keep the advisory ID in the description or the Issue section if needed.

Full details: Description check

Explanation

The description is empty. The author provided only a placeholder note saying no description was added. None of the template sections (Issue, Approach, Tasks) are filled in. The template also requires the license and security reporting notice, which are absent.

Resolution

Add a description that follows the repository template. Include: (1) the Issue section linking GHSA-2rxj-6v32-2v6j or the related advisory; (2) the Approach section explaining that serialization errors in beforeSave, afterFind, and afterSave trigger objects are now caught and returned as INCORRECT_TYPE or SCRIPT_FAILED; (3) the Tasks checklist with completed items marked, such as Add tests, and the security check item checked if the security checks were run.

Finishing Touches

Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Warning

Some tools did not complete. Review the errors below.

ast-grep (0.51.1)

spec/vulnerabilities.spec.js

ast-grep timed out on this file

Biome (2.5.15)

src/triggers.js

File contains syntax errors that prevent linting: Line 230: Type annotations are a TypeScript only feature. Convert your file to a TypeScript file or remove the syntax.; Line 230: Type annotations are a TypeScript only feature. Convert your file to a TypeScript file or remove the syntax.; Line 230: Type annotations are a TypeScript only feature. Convert your file to a TypeScript file or remove the syntax.; Line 230: return types can only be used in TypeScript files

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Essentials
• Run ID: aafb9d20-dfcf-4305-ac98-1ba74a70f81e

Commits

Reviewing files that changed from the base of the PR and between 84a36be and 072bef6.

Files selected for processing: 2

• spec/vulnerabilities.spec.js
• src/triggers.js

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.20%. Comparing base (d067fca) to head (072bef6).
⚠️ Report is 4 commits behind head on alpha.

Additional details and impacted files

@@           Coverage Diff           @@
##            alpha   #10864   +/-   ##
=======================================
  Coverage   94.20%   94.20%           
=======================================
  Files         193      193           
  Lines       17401    17403    +2     
  Branches      246      246           
=======================================
+ Hits        16392    16394    +2     
  Misses        988      988           
  Partials       21       21           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[coderabbitai]

Pre-merge checks failed. Please resolve the failing checks before merging.

[parseplatformorg]

🎉 This change has been released in version 9.11.1-alpha.1