GHSA-q6wc-xx4m-92fj: PowerSync: Some sync filters ignored on 1.20.0 using `config.edition: 3`

March 7, 2026

In version 1.20.0, when using new sync streams with config.edition: 3, certain subquery filters were ignored when determining which data to sync to users.

Depending on the sync stream configuration, this could result in authenticated users syncing data that should have been restricted.

Only queries that gate synchronization using subqueries without partitioning the result set are affected.

Not affected:

Sync rules (bucket_definitions)
Sync streams using config.edition: 2
No data is exposed without authenticating

References

github.com/advisories/GHSA-q6wc-xx4m-92fj
github.com/powersync-ja/powersync-service
github.com/powersync-ja/powersync-service/security/advisories/GHSA-q6wc-xx4m-92fj

Code Behaviors & Features

Detect and mitigate GHSA-q6wc-xx4m-92fj with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →