refactor: Bump express-rate-limit from 8.3.1 to 8.7.0

[Moumouls]

Pull Request

• Report security issues confidentially.
• Any contribution is under this license.

Issue

This PR replaces the original Dependabot pull request #10621, which is stale (it stopped at 8.6.2 and automatic rebases have been disabled). Dependabot branches live in the upstream repository and cannot be modified directly, so the update is re-created here from a fork against current alpha.

Approach

Bumps the express-rate-limit dependency from 8.3.1 to 8.7.0.

Parse Server uses express-rate-limit in src/middlewares.js to enforce the rateLimit option (and Cloud Code validators) with a custom keyGenerator (global / session / user / IP via request.config.ip) and an optional Redis store. This is a version-only bump: no Parse Server source, public API, or option schema changes.

Upstream changes included in this bump (8.3.2 through 8.7.0):

• 8.7.0 — added a retryAfter option to override the Retry-After header. Unused by Parse Server.
• 8.6.2 — ipKeyGenerator now detects IPv4-mapped IPv6 addresses by range rather than formatting. Parse Server's custom keyGenerator does not call ipKeyGenerator; it keys on app id, session token, user id, or request.config.ip.
• 8.6.1 — deprecated millisecond-based time constants (DAY, HOUR, MINUTE, SECOND). Parse Server does not use these constants.
• 8.6.0 — fixed a negative used count when skipSuccessfulRequests / skipFailedRequests overlap a window reset; added debug logging and time constants; validations now run once each instead of only on the first request. Parse Server does not use the skip-success/fail options.
• 8.5.2 — reduced string templating in ipKeyGenerator.
• 8.5.1 — updated the ip-address transitive dependency for GHSA-v2v4-37r5-5v8g.
• 8.5.0 — store init may now be async. Compatible with the existing Redis store wiring.
• 8.4.1 — custom logger support. Unused; default logging is unchanged.
• 8.3.2 — fixed skipping failed requests for connections closed very early.

The lockfile also resolves the ip-address transitive dependency from 10.1.0 to 10.7.0 (required by express-rate-limit@8.7.0) and records npm's lockfile metadata refresh.

No breaking changes are documented between 8.3.1 and 8.7.0.

Tasks

• Reviewed the upstream changelog for breaking changes between 8.3.1 and 8.7.0; none apply to this bump.
• Ran spec/RateLimit.spec.js (52 passed, 1 pending Redis-cache spec that is skipped unless PARSE_SERVER_TEST_CACHE=redis).

No new tests and no documentation changes are required: this is a version-only bump and contains no changes to Parse Server source code, behaviour or public API.

Summary by CodeRabbit

• Chores
  • Updated the express-rate-limit dependency to version 8.7.0.
  • Updated related networking and rate-limiting packages.
  • Removed unused Google Cloud metadata packages.
  • Refreshed dependency metadata and peer dependency declarations.

[parse-github-assistant]

🚀 Thanks for opening this pull request! We appreciate your effort in improving the project. Please let us know once your pull request is ready for review.

Tip

• Keep pull requests small. Large PRs will be rejected. Break complex features into smaller, incremental PRs.
• Use Test Driven Development. Write failing tests before implementing functionality. Ensure tests pass.
• Group code into logical blocks. Add a short comment before each block to explain its purpose.
• We offer conceptual guidance. Coding is up to you. PRs must be merge-ready for human review.
• Our review focuses on concept, not quality. PRs with code issues will be rejected. Use an AI agent.
• Human review time is precious. Avoid review ping-pong. Inspect and test your AI-generated code.

Note

Please respond to review comments from AI agents just like you would to comments from a human reviewer. Let the reviewer resolve their own comments, unless they have reviewed and accepted your commit, or agreed with your explanation for why the feedback was incorrect.

Caution

Pull requests must be written using an AI agent with human supervision. Pull requests written entirely by a human will likely be rejected, because of lower code quality, higher review effort and the higher risk of introducing bugs. Please note that AI review comments on this pull request alone do not satisfy this requirement. Our CI and AI review are safeguards, not development tools. If many issues are flagged, rethink your development approach. Invest more effort in planning and design rather than using review cycles to fix low-quality code.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 120231b8-1f38-4015-aee5-7494eac10889

📥 Commits

Reviewing files that changed from the base of the PR and between 09009e5 and c8d6959.

📒 Files selected for processing (2)

• package-lock.json
• package.json

Included review availability: Your plan provides up to 10 included reviews per hour; 9 remain after this review.

---

📝 Walkthrough

Walkthrough

The pull request updates express-rate-limit from 8.3.1 to 8.7.0. It updates ip-address, adds debug, removes gcp-metadata dependencies, and regenerates peer metadata in package-lock.json.

Changes

Dependency refresh

Layer / File(s)	Summary
express-rate-limit upgrade package.json, package-lock.json	express-rate-limit is updated to 8.7.0. The lockfile adds debug and updates ip-address to 10.7.0.
Lockfile metadata regeneration package-lock.json	Peer metadata is regenerated across resolved packages. gcp-metadata and its nested dependencies are removed.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Suggested reviewers: mtrezza

Merge Risk: ⚪ Minimal · up to c8d69

The dependency refresh has no identified merge-blocking behavior or installation risk.

🚥 Pre-merge checks | ✅ 7

✅ Passed checks (7 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title begins with the permitted prefix refactor: and clearly describes the dependency version bump.
Description check	✅ Passed	The description includes the required Pull Request, Issue, Approach, and Tasks sections. It explains the dependency update, scope, compatibility, upstream changes, and test results. Non-applicable che…
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Security Check	✅ Passed	PASS. The PR changes only package manifests and the lockfile. It upgrades express-rate-limit from 8.3.1 to 8.7.0 and ip-address from 10.1.0 to 10.7.0. The npm advisory scan reports the base `expre…
Engage In Review Feedback	✅ Passed	No actionable review feedback is present to ignore or resolve. The authoritative range contains one commit and changes only package.json and package-lock.json. GitHub PR #10661 reports zero reviews an…

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.80%. Comparing base (09009e5) to head (c8d6959).

Additional details and impacted files

@@            Coverage Diff             @@
##            alpha   #10661      +/-   ##
==========================================
- Coverage   93.82%   93.80%   -0.02%     
==========================================
  Files         192      192              
  Lines       16863    16863              
  Branches      252      252              
==========================================
- Hits        15821    15819       -2     
- Misses       1020     1022       +2     
  Partials       22       22              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.