[AdrianCurtin]

Security patch

A security patch from an October 2026 review across the agent, MCP, Atlas Search, mongo-direct, transport, cache, webhook, LiveQuery, GraphQL, MFA, and cursor surfaces, with raised dependency floors and a release-workflow fix. CHANGELOG.md 5.8.4 has the full entry and the Behavior Notes.

Changes

Agent and MCP

• FIXED: semantic_search applies the agent's classes: allowlist, the CLP find check, and per-agent filters:, with filter fields resolved through declared properties (a declared server name such as PublicState addresses that column; an undeclared field raises).
• FIXED: MCP resource subscriptions apply the agent's tenant scope and per-agent filter; a loopback-bound MCP server validates the Host header (allowed_hosts:).
• FIXED: Agent $relatedTo requires a plain objectId and field-name key; operators inside __type values are refused. A blank master key counts as no master key.

Atlas Search, vector search, and mongo-direct

• FIXED: Parse Server internal columns are refused as search paths, globs, queryString fields (including escaped names), sort keys, highlights, autocomplete, and facet paths, for every caller, and in $setWindowFields, $densify, $fill, $bucket, $sortByCount, and top-level $search stages.
• FIXED: The protected-field check, CLP gate, and strip read one schema snapshot through the requesting app's client and fail closed when the schema cannot be resolved. This closes a fetch-fails-then-succeeds race and a multi-app case where a $group on a protected field returned its value.
• FIXED: $jsonSchema is denied; Parse::MongoDB.find is refused inside Parse.with_session; declared pointer server names map to their _p_ column.
• FIXED: Parse::RegexSecurity no longer compiles caller pattern text with Ruby's Regexp (Onigmo memory-safety fixes in Ruby 3.3.13, 3.4.12, and 4.0.9; GitLab-assigned CVE-2026-89078 and related).

Transport, caching, webhooks, LiveQuery

• FIXED: Absolute and protocol-relative request paths are refused before sending; PARSE_REQUIRE_HTTPS is parsed case-insensitively; URL credentials are redacted.
• CHANGED: A Marshal-serialized cache over an external backend is refused unless allow_marshal_cache: true.
• FIXED: Whitespace webhook signing secrets count as unset; webhook bodies are size-checked before reading.
• FIXED: LiveQuery _User / _Session events drop credentials; LiveQuery threads start without inherited identity and never gain the master key. Parse.without_ambient_identity documents and implements the identity lifetime contract.

GraphQL, MFA, cursors

• FIXED: Generated GraphQL types omit credential fields; field policy is explicit (exclude_fields:, protected_fields:), and the docs state that resolvers must enforce authorization.
• NEW: Parse::Cursor HMAC signing with a 32-byte minimum secret and expected_class:; trusted: for unsigned trusted persistence, which cannot bypass a configured secret.
• FIXED: mfa_required? requires a String username; Parse::MFA.verify takes after: for reuse protection.

Dependencies, CI, and release

• CHANGED: faraday 2.14.3 or later; rack 2.2.23 or later with every released vulnerable 3.0, 3.1, and 3.2 version excluded, keeping Rack 2.2 supported.
• CHANGED: Test stack on Parse Server 9.10.7 and Atlas Local 8.0.34; CI actions pinned to commit SHAs; ruby/setup-ruby 1.334.0 installs the patched Rubies for the 3.3, 3.4, and 4.0 legs (3.2 remains for legacy compatibility and is end of life); a dependency audit job runs on every push.
• FIXED: The release gate waits for Gem Tests on the release commit and fails if they do not finish.

Testing

• bundle exec rake test:unit passes on this commit.
• New live integration tests (security_584_integration_test.rb, security_584_atlas_integration_test.rb) pass against Parse Server 9.10.7 and Atlas Local 8.0.34 with no skips, covering cross-tenant denial alongside successful reads.
• The full integration suite on this exact commit is the release gate and is pending; results will be posted on this PR with skipped coverage listed separately.