fix: Object write with a dot notation key can skip afterSave triggers and LiveQuery events (GHSA-969q-274f-mc7w)

[mtrezza]

Issue

Object write with a dot notation key can skip afterSave triggers and LiveQuery events (GHSA-969q-274f-mc7w)

Tasks

• Add tests

[parse-github-assistant]

🚀 Thanks for opening this pull request! We appreciate your effort in improving the project. Please let us know once your pull request is ready for review.

Tip

• Keep pull requests small. Large PRs will be rejected. Break complex features into smaller, incremental PRs.
• Use Test Driven Development. Write failing tests before implementing functionality. Ensure tests pass.
• Group code into logical blocks. Add a short comment before each block to explain its purpose.
• We offer conceptual guidance. Coding is up to you. PRs must be merge-ready for human review.
• Our review focuses on concept, not quality. PRs with code issues will be rejected. Use an AI agent.
• Human review time is precious. Avoid review ping-pong. Inspect and test your AI-generated code.

Note

Please respond to review comments from AI agents just like you would to comments from a human reviewer. Let the reviewer resolve their own comments, unless they have reviewed and accepted your commit, or agreed with your explanation for why the feedback was incorrect.

Caution

Pull requests must be written using an AI agent with human supervision. Pull requests written entirely by a human will likely be rejected, because of lower code quality, higher review effort and the higher risk of introducing bugs. Please note that AI review comments on this pull request alone do not satisfy this requirement. Our CI and AI review are safeguards, not development tools. If many issues are flagged, rethink your development approach. Invest more effort in planning and design rather than using review cycles to fix low-quality code.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Essentials
• Run ID: f8665581-a367-4683-b490-7308f89fdbcc

📥 Commits

Reviewing files that changed from the base of the PR and between 3b6f4dd and aafbbc2.

📒 Files selected for processing: 2

• spec/CloudCode.spec.js
• src/RestWrite.js

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

📝 Walkthrough

RestWrite now preserves reverted dot-notation values in responses while keeping trigger data separate. New Cloud Code tests cover nested values, null assignments, operations, parent changes, REST and SDK responses, persistence, ACLs, pointers, and LiveQuery updates.

Changes: Dot-notation revert handling

Layer / File(s)	Summary
Response restoration and final-object handling src/RestWrite.js	RestWrite applies null dot-notation values with ignored validation, tracks reverted paths, separates response data from trigger data, and restores nested response values after final-object processing.
Regression coverage for triggers and responses spec/CloudCode.spec.js	Tests cover reverted nested and null values, parent changes, operations, ACLs, pointers, missing or null parents, persistence, REST and SDK responses, returned objects, and LiveQuery updates.

Priority: ⬇️ Low

Estimated code review effort: 4 (Complex) | ~45 minutes

Merge Risk: ⚪ Minimal · up to aafbb

This security fix changes how update responses handle dot-notation values that a beforeSave trigger reverts. Broad regression tests cover the change, and no concrete defect was found. It looks ready to merge once the normal CI database test runs pass.

Caution

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

• Ignore

Failed checks: 1 error

Check name	Status	Explanation	Resolution
Description check		No pull request description was provided. The required Issue, Approach, and Tasks sections are missing, along with the relevant task status and implementation details.	Add a pull request description that follows the repository template. Describe the related issue, explain the implementation approach, and mark the applicable Tasks as complete or not applicable.

Passed checks: 6 passed

Check name	Status	Explanation
Title check		The title uses the required fix: prefix, and the security advisory identifier is capitalized. It accurately identifies the security fix covered by the changes.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 2…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Security Check		No new security vulnerability is evident in the reviewed diff. The changes stay within beforeSave/afterSave response reconstruction and dot-notation handling. Database permission validation remains in…
Engage In Review Feedback		No review feedback comments were supplied. The posted-review section reports no CodeRabbit threads, and the current review produced zero actionable findings. Therefore, there is no feedback that the c…

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[mtrezza]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

Pre-merge checks failed. Please resolve the failing checks before merging.

[codecov]

Codecov Report

❌ Patch coverage is 96.51163% with 3 lines in your changes missing coverage. Please review.
✅ Project coverage is 92.70%. Comparing base (12af4d6) to head (aafbbc2).
⚠️ Report is 1 commits behind head on release-8.x.x.

Files with missing lines	Patch %	Lines
src/RestWrite.js	96.51%	3 Missing ⚠️

Additional details and impacted files

@@                Coverage Diff                @@
##           release-8.x.x   #10787      +/-   ##
=================================================
+ Coverage          92.68%   92.70%   +0.01%     
=================================================
  Files                192      192              
  Lines              16342    16418      +76     
  Branches             238      238              
=================================================
+ Hits               15147    15220      +73     
- Misses              1174     1177       +3     
  Partials              21       21              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[parseplatformorg]

🎉 This change has been released in version 8.6.106