fix: Bump undici from 7.28.0 to 7.29.1

[mtrezza]

Issue

undici is vulnerable in the production dependency tree, and no existing PR covers it.

@parse/push-adapter -> expo-server-sdk@6.1.0 -> undici, resolved in the lockfile to 7.28.0 with dev: false. That version carries five open Dependabot alerts on alpha:

Advisory	Severity	Affected	Patched
GHSA-4cwx-7wf7-3272	High	>= 7.0.0, < 7.29.0	7.29.0
GHSA-m8rv-5g2x-5cg5	Medium	>= 7.0.0, < 7.29.0	7.29.0
GHSA-jr45-8vmc-qm54	Medium	>= 7.0.0, < 7.29.0	7.29.0
GHSA-v3r7-h72x-cjcm	Medium	>= 7.0.0, < 7.29.0	7.29.0
GHSA-8xcm-r25x-g524	Medium	>= 7.0.0, < 7.29.0	7.29.0

#10646 does not fix this. It bumps a different undici copy — the 6.x one under @actions/http-client, which is dev: true. The vulnerable production copy is a separate lockfile entry at node_modules/expo-server-sdk/node_modules/undici.

Closes #10646

Approach

Refresh the undici resolutions in package-lock.json (npm update undici). Lockfile only; package.json is untouched, since undici is not a direct dependency.

PROD  node_modules/expo-server-sdk/node_modules/undici          7.28.0 -> 7.29.1
dev   node_modules/@semantic-release/github/node_modules/undici 7.28.0 -> 7.29.1
dev   node_modules/undici                                       6.27.0 -> 6.28.1

The third line is exactly what #10646 does, so this supersedes it and additionally clears the three dev-scope < 6.28.0 advisories it was opened for.

Why not bump expo-server-sdk or @parse/push-adapter instead

Neither route fixes this:

• expo-server-sdk@6.1.0 declares undici: "^7.2.0", and so does the latest expo-server-sdk@7.2.0. The range already admits 7.29.1; only the lockfile resolution was stale, so bumping the SDK changes nothing here.
• @parse/push-adapter@8.5.3 (latest, vs 8.4.0 pinned here) still pins expo-server-sdk: "6.1.0" exactly — identical to 8.4.0. So a push-adapter bump does not move undici either. That upgrade is worth doing on its own merits and is proposed separately; it is deliberately not coupled to this security fix.

Worth a follow-up upstream: @parse/push-adapter pinning expo-server-sdk to an exact version is what froze this subtree. A caret range would let consumers pick up transitive fixes without waiting on a push-adapter release.

Breaking Changes

None. Both bumps stay within their existing semver ranges (^7.2.0 and ^6.23.0), and undici is not used directly by Parse Server.

Code Changes Required

None.

Notes

• The lockfile diff is 21 insertions / 18 deletions with no packages added or removed; only these three entries change version.
• 7.29.0 and 7.29.1 are both security releases; since alpha is on 7.28.0, the fixes from both apply.

Tasks

• Add security check — resolves the open production undici alerts

Summary by CodeRabbit

• Chores
  • Updated dependency lockfile entries to newer undici patch versions.
  • Refreshed associated package download URLs and integrity metadata.
  • Added license metadata for select package entries.

[parse-github-assistant]

🚀 Thanks for opening this pull request! We appreciate your effort in improving the project. Please let us know once your pull request is ready for review.

Tip

• Keep pull requests small. Large PRs will be rejected. Break complex features into smaller, incremental PRs.
• Use Test Driven Development. Write failing tests before implementing functionality. Ensure tests pass.
• Group code into logical blocks. Add a short comment before each block to explain its purpose.
• We offer conceptual guidance. Coding is up to you. PRs must be merge-ready for human review.
• Our review focuses on concept, not quality. PRs with code issues will be rejected. Use an AI agent.
• Human review time is precious. Avoid review ping-pong. Inspect and test your AI-generated code.

Note

Please respond to review comments from AI agents just like you would to comments from a human reviewer. Let the reviewer resolve their own comments, unless they have reviewed and accepted your commit, or agreed with your explanation for why the feedback was incorrect.

Caution

Pull requests must be written using an AI agent with human supervision. Pull requests written entirely by a human will likely be rejected, because of lower code quality, higher review effort and the higher risk of introducing bugs. Please note that AI review comments on this pull request alone do not satisfy this requirement. Our CI and AI review are safeguards, not development tools. If many issues are flagged, rethink your development approach. Invest more effort in planning and design rather than using review cycles to fix low-quality code.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Essentials

Run ID: d2171d49-94bc-430c-9e2f-190a731fad9b

📥 Commits

Reviewing files that changed from the base of the PR and between 948cf36 and f862ff9.

📒 Files selected for processing (1)

• package-lock.json

Included review availability: Your plan provides up to 10 included reviews per hour; 5 remain after this review.

---

📝 Walkthrough

Walkthrough

The lockfile updates nested and top-level undici entries from 7.28.0 to 7.29.1 and from 6.27.0 to 6.28.1. It also refreshes URLs and integrity hashes.

Changes

Undici dependency lockfile update

Layer / File(s)	Summary
Update undici versions and integrity data package-lock.json	Nested and top-level references use the updated undici versions. Resolved URLs and integrity hashes are refreshed. Three package entries also include MIT license metadata.

Priority: ⬆️ High

Estimated code review effort: 1 (Trivial) | ~5 minutes

Severity of issue fixed: High

Merge Risk: ⚪ Minimal · up to f862f

The dependency refresh is limited to lockfile resolutions and is ready to merge.

🚥 Pre-merge checks | ✅ 6 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Out of Scope Changes check	⚠️ Warning	The PR also updates the production undici resolution under expo-server-sdk from 7.28.0 to 7.29.1. Issue [#10646] covers only the development update from 6.27.0 to 6.28.1. The production se…	Remove the production 7.28.0 to 7.29.1 lockfile update, or link an issue that explicitly requires this production dependency update.

✅ Passed checks (6 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title begins with the required fix: prefix, uses a capitalized first word after the prefix, and accurately describes the undici version update.
Description check	✅ Passed	The description includes the required Issue, Approach, and Tasks sections. It explains the security purpose, affected dependency paths, version changes, scope, and security check. The standard introdu…
Linked Issues check	✅ Passed	Issue [#10646] requires undici 6.27.0 to 6.28.1. The PR summary reports this development resolution update in package-lock.json, including the lockfile metadata. The issue has no separate code…
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Security Check	✅ Passed	PASS. The pull request changes only package-lock.json; it introduces no executable code or new security-sensitive pattern. The production node_modules/expo-server-sdk/node_modules/undici record ch…
Engage In Review Feedback	✅ Passed	The supplied current-review result reports zero actionable findings. Therefore, this pull request has no current review feedback that requires engagement, implementation, or reviewer retraction.

Full details: Out of Scope Changes check

Explanation

The PR also updates the production undici resolution under expo-server-sdk from 7.28.0 to 7.29.1. Issue [#10646] covers only the development update from 6.27.0 to 6.28.1. The production security update has no directly linked issue in the supplied scope.

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

---

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.83%. Comparing base (ae167c4) to head (f862ff9).
⚠️ Report is 1 commits behind head on alpha.

Additional details and impacted files

@@            Coverage Diff             @@
##            alpha   #10674      +/-   ##
==========================================
+ Coverage   93.43%   93.83%   +0.40%     
==========================================
  Files         192      192              
  Lines       16882    16882              
  Branches      252      252              
==========================================
+ Hits        15773    15842      +69     
+ Misses       1083     1018      -65     
+ Partials       26       22       -4     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[parseplatformorg]

🎉 This change has been released in version 9.10.1-alpha.18

[parseplatformorg]

🎉 This change has been released in version 9.10.1