fix: NumberOrBoolean config option (cluster) value not coerced from env/CLI#10531
Conversation
|
🚀 Thanks for opening this pull request! We appreciate your effort in improving the project. Please let us know once your pull request is ready for review. Tip
Note Please respond to review comments from AI agents just like you would to comments from a human reviewer. Let the reviewer resolve their own comments, unless they have reviewed and accepted your commit, or agreed with your explanation for why the feedback was incorrect. Caution Pull requests must be written using an AI agent with human supervision. Pull requests written entirely by a human will likely be rejected, because of lower code quality, higher review effort and the higher risk of introducing bugs. Please note that AI review comments on this pull request alone do not satisfy this requirement. Our CI and AI review are safeguards, not development tools. If many issues are flagged, rethink your development approach. Invest more effort in planning and design rather than using review cycles to fix low-quality code. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (4)
📝 WalkthroughWalkthroughThis PR fixes an incorrect parser reference for the NumberOrBoolean generic type. ChangesNumberOrBoolean parser fix
Estimated code review effort: 2 (Simple) | ~10 minutes Related issues: Suggested labels: bug, tests Suggested reviewers: mtrezza 🐰 🚥 Pre-merge checks | ✅ 6 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (6 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## alpha #10531 +/- ##
=======================================
Coverage 92.66% 92.66%
=======================================
Files 193 193
Lines 16981 16981
Branches 248 248
=======================================
Hits 15736 15736
Misses 1224 1224
Partials 21 21 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
|
@coderabbitai review |
✅ Action performedReview finished.
|
|
@coderabbitai full review |
✅ Action performedFull review finished. |
|
@coderabbitai full review |
✅ Action performedFull review finished. |
|
Re-running failed CI |
# [9.10.0-alpha.3](9.10.0-alpha.2...9.10.0-alpha.3) (2026-07-07) ### Bug Fixes * NumberOrBoolean config option (cluster) value not coerced from env/CLI ([#10531](#10531)) ([459786f](459786f))
|
🎉 This change has been released in version 9.10.0-alpha.3 |
# [9.10.0](9.9.0...9.10.0) (2026-07-13) ### Bug Fixes * Cloud Code beforeFind trigger context is not isolated from prototype pollution ([#10570](#10570)) ([bea001e](bea001e)) * Cloud Function multipart requests bypass the maxUploadSize limit ([#10498](#10498)) ([f12e1c3](f12e1c3)) * Denial of service via exponential-time processing of deeply nested query operators ([GHSA-cgxm-vr2f-6fj8](GHSA-cgxm-vr2f-6fj8)) ([#10511](#10511)) ([1103c7a](1103c7a)) * Endpoints `/login` and `/verifyPassword` disclose MFA secrets and protected fields when `_User` get is denied ([GHSA-75v4-m273-5j49](GHSA-75v4-m273-5j49)) ([#10492](#10492)) ([83e90ed](83e90ed)) * GeoPoint distance queries fail with an internal server error on MongoDB 8.3 and later ([#10572](#10572)) ([b706c22](b706c22)) * GraphQL "Did you mean" validation suggestions disclose schema to unauthenticated callers ([GHSA-8cph-rgr4-g5vj](GHSA-8cph-rgr4-g5vj)) ([#10467](#10467)) ([155123a](155123a)) * GraphQL error messages disclose pointer and relation target class names when public introspection is disabled ([GHSA-r2g6-4f6j-f6rf](GHSA-r2g6-4f6j-f6rf)) ([#10568](#10568)) ([cb9b542](cb9b542)) * GraphQL error messages disclose required input field names when public introspection is disabled ([GHSA-2fgh-8j2g-w354](GHSA-2fgh-8j2g-w354)) ([#10566](#10566)) ([d96c945](d96c945)), closes [GHSA-2f#8j2g-w354](https://github.com/GHSA-2f/issues/8j2g-w354) [/github.com/parse-community/parse-server/security/advisories/GHSA-2f#8j2g-w354](https://github.com//github.com/parse-community/parse-server/security/advisories/GHSA-2f/issues/8j2g-w354) * GraphQL variable-coercion suggestions disclose schema to unauthenticated callers ([GHSA-9g8f-h8f3-hjcm](GHSA-9g8f-h8f3-hjcm)) ([#10563](#10563)) ([2625489](2625489)) * LiveQuery discloses object data to a subscriber across an ACL read-access change ([GHSA-97pr-9hgg-3p8r](GHSA-97pr-9hgg-3p8r)) ([#10515](#10515)) ([e9c85df](e9c85df)) * LiveQuery subscriptions leak when a client reuses a subscribe requestId ([#10499](#10499)) ([3fad4fb](3fad4fb)) * Middleware route checks do not match routing-equivalent path variants (trailing slash, case) ([#10501](#10501)) ([f861210](f861210)) * NumberOrBoolean config option (cluster) value not coerced from env/CLI ([#10531](#10531)) ([459786f](459786f)) * Pre-authentication denial of service via client version header regex backtracking ([GHSA-38m6-82c8-4xfm](GHSA-38m6-82c8-4xfm)) ([#10463](#10463)) ([56c159e](56c159e)) * rateLimit on exact static routes is bypassed by appending a query string ([#10500](#10500)) ([880e8e6](880e8e6)) * Relation `$relatedTo` query bypasses `protectedFields` and owning-object ACL ([GHSA-wmwx-jr2p-4j4r](GHSA-wmwx-jr2p-4j4r)) ([#10493](#10493)) ([43658f1](43658f1)) * Server option routeAllowList is bypassable through batch sub-requests ([GHSA-p84r-h6rx-f2xr](GHSA-p84r-h6rx-f2xr)) ([#10482](#10482)) ([552c6dd](552c6dd)) * Stored XSS via malformed Content-Type bypassing file upload extension blocklist ([GHSA-r899-h629-j84r](GHSA-r899-h629-j84r)) ([#10521](#10521)) ([cce91e5](cce91e5)) * Stored XSS via non-standard file extension bypassing file upload extension blocklist ([GHSA-v8x7-r927-cc93](GHSA-v8x7-r927-cc93)) ([#10505](#10505)) ([be12a60](be12a60)) * Stored XSS via trailing-dot filename bypassing file upload extension blocklist ([GHSA-7wqv-xjf3-x35v](GHSA-7wqv-xjf3-x35v)) ([#10489](#10489)) ([66484ce](66484ce)) ### Features * Add option to disallow aggregation pipelines for the read-only master key ([#10517](#10517)) ([816078f](816078f))
|
🎉 This change has been released in version 9.10.0 |
* commit 'b5ca12fa5e2c951e0cd4ac45ec11e23430da323b': (48 commits) chore(release): 9.10.0 [skip ci] empty commit to trigger CI chore(release): 9.10.0-alpha.8 [skip ci] fix: GeoPoint distance queries fail with an internal server error on MongoDB 8.3 and later (parse-community#10572) chore(release): 9.10.0-alpha.7 [skip ci] fix: Cloud Code beforeFind trigger context is not isolated from prototype pollution (parse-community#10570) chore(release): 9.10.0-alpha.6 [skip ci] fix: GraphQL error messages disclose pointer and relation target class names when public introspection is disabled ([GHSA-r2g6-4f6j-f6rf](GHSA-r2g6-4f6j-f6rf)) (parse-community#10568) chore(release): 9.10.0-alpha.5 [skip ci] fix: GraphQL error messages disclose required input field names when public introspection is disabled ([GHSA-2fgh-8j2g-w354](GHSA-2fgh-8j2g-w354)) (parse-community#10566) chore(release): 9.10.0-alpha.4 [skip ci] fix: GraphQL variable-coercion suggestions disclose schema to unauthenticated callers ([GHSA-9g8f-h8f3-hjcm](GHSA-9g8f-h8f3-hjcm)) (parse-community#10563) chore(release): 9.10.0-alpha.3 [skip ci] fix: NumberOrBoolean config option (cluster) value not coerced from env/CLI (parse-community#10531) chore(release): 9.10.0-alpha.2 [skip ci] fix: Stored XSS via malformed Content-Type bypassing file upload extension blocklist ([GHSA-r899-h629-j84r](GHSA-r899-h629-j84r)) (parse-community#10521) test: Rate limit requestMethods is scoped to the configured HTTP methods (parse-community#10520) chore(release): 9.10.0-alpha.1 [skip ci] feat: Add option to disallow aggregation pipelines for the read-only master key (parse-community#10517) chore(release): 9.9.1-alpha.13 [skip ci] ... # Conflicts: # package.json
Closes #9643
Summary by CodeRabbit
clusteroption so numeric strings and boolean-like values are interpreted correctly.