Conversation
|
Hi there @mtrezza! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository. This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory |
There was a problem hiding this comment.
Copilot review overview
🟢 Approval recommended
The advisory now consistently represents versions before 8.6.40 as affected.
Review effort: Balanced
Findings: None
What changed in this PR
Corrects the Parse Server advisory so the existing affected-version events consistently cover versions before 8.6.40.
Changes:
- Removes the stale
< 8.0.0affected-version metadata. - Updates the advisory modification timestamp.
| File | Description |
|---|---|
| advisories/github-reviewed/2026/03/GHSA-p2x3-8689-cwpg/GHSA-p2x3-8689-cwpg.json | Corrects affected-version metadata for Parse Server 8.x. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Updates
Comments
The range of the 8.x entry should be < 8.6.40, not < 8.0.0. Now the whole 8.x branch from 8.0.0 to 8.6.39 is outside the range.
The 8.x fix parse-community/parse-server@21330d1 (#10190) is in tag 8.6.40 and not in tag 8.6.39. The 9.x fix is a separate commit (#10189) and is not part of the 8.x branch.