chore(release): 8.6.82 [skip ci]

## [8.6.82](https://github.com/parse-community/parse-server/compare/8.6.81...8.6.82) (2026-06-17) ### Bug Fixes * Denial of service via exponential-time processing of deeply nested query operators ([GHSA-cgxm-vr2f-6fj8](https://github.com/parse-community/parse-server/security/advisories/GHSA-cgxm-vr2f-6fj8)) ([#10512](https://github.com/parse-community/parse-server/issues/10512)) ([0f5d2ad](https://github.com/parse-community/parse-server/commit/0f5d2ad77b422dc904458254548be87397fc6e9b))
fix: Denial of service via exponential-time processing of deeply nested query operators ([GHSA-cgxm-vr2f-6fj8](https://github.com/parse-community/parse-server/security/advisories/GHSA-cgxm-vr2f-6fj8 )) (#10512 )
2026-08-09 13:03:18 +00:00 · 2026-06-17 14:23:01 +00:00 · 2026-06-17 16:21:38 +02:00 · 2026-06-16 00:44:09 +00:00 · 2026-06-16 02:42:57 +02:00 · 2026-06-03 23:54:50 +00:00
66 changed files with 7231 additions and 2348 deletions
@@ -16,6 +16,7 @@ The following is a list of deprecations, according to the [Deprecation Policy](h
 | DEPPS10 | Encode `Parse.Object` in Cloud Function and remove option `encodeParseObjectInCloudFunction` | [#8634](https://github.com/parse-community/parse-server/issues/8634) | 6.2.0 (2023)                    | 9.0.0 (2026)                    | deprecated            | -     |
 | DEPPS11 | Replace `PublicAPIRouter` with `PagesRouter`                                                 | [#7625](https://github.com/parse-community/parse-server/issues/7625) | 8.0.0 (2025)                    | 9.0.0 (2026)                    | deprecated            | -     |
 | DEPPS12 | Database option `allowPublicExplain` will default to `true`                                  | [#7519](https://github.com/parse-community/parse-server/issues/7519) | 8.5.0 (2025)                    | 9.0.0 (2026)                    | deprecated            | -     |
+| DEPPS20 | Remove config option `allowExpiredAuthDataToken`                                             |                                                                      | 8.6.0 (2026)                    | 9.0.0 (2026)                    | deprecated            | -     |

 [i_deprecation]: ## "The version and date of the deprecation."
 [i_removal]: ## "The version and date of the planned removal."
@@ -557,6 +557,40 @@ async function benchmarkObjectCreateNestedDenylist(name) {
  });
 }

+/**
+ * Benchmark: $relatedTo relation query (public, non-master)
+ *
+ * Measures a public `$relatedTo` query, which now performs an owning-object
+ * read-access check before reading the relation join table (GHSA-wmwx-jr2p-4j4r).
+ * This captures the cost of that added authorization read on the relation path.
+ */
+async function benchmarkRelatedToQuery(name) {
+  const Child = Parse.Object.extend('BenchmarkRelChild');
+  const children = [];
+  for (let i = 0; i < 50; i++) {
+    children.push(new Child({ value: i }));
+  }
+  await Parse.Object.saveAll(children, { useMasterKey: true });
+
+  // Publicly readable owning object, so the authorized relation path runs fully.
+  const Parent = Parse.Object.extend('BenchmarkRelParent');
+  const parent = new Parent({ name: 'benchmark-parent' });
+  const acl = new Parse.ACL();
+  acl.setPublicReadAccess(true);
+  parent.setACL(acl);
+  parent.relation('members').add(children);
+  await parent.save(null, { useMasterKey: true });
+
+  return measureOperation({
+    name,
+    iterations: 1_000,
+    operation: async () => {
+      // Non-master query exercises the owning-object read-access check.
+      await parent.relation('members').query().find();
+    },
+  });
+}
+
 /**
 * Run all benchmarks
 */
@@ -582,6 +616,7 @@ async function runBenchmarks() {
      { name: 'Object.saveAll (batch save)', fn: benchmarkBatchSave },
      { name: 'Query.get (by objectId)', fn: benchmarkObjectRead },
      { name: 'Query.find (simple query)', fn: benchmarkSimpleQuery },
+      { name: 'Query.find ($relatedTo relation)', fn: benchmarkRelatedToQuery },
      { name: 'User.signUp', fn: benchmarkUserSignup },
      { name: 'User.login', fn: benchmarkUserLogin },
      { name: 'Query.include (parallel pointers)', fn: benchmarkQueryWithIncludeParallel },
@@ -1,3 +1,276 @@
+## [8.6.82](https://github.com/parse-community/parse-server/compare/8.6.81...8.6.82) (2026-06-17)
+
+
+### Bug Fixes
+
+* Denial of service via exponential-time processing of deeply nested query operators ([GHSA-cgxm-vr2f-6fj8](https://github.com/parse-community/parse-server/security/advisories/GHSA-cgxm-vr2f-6fj8)) ([#10512](https://github.com/parse-community/parse-server/issues/10512)) ([0f5d2ad](https://github.com/parse-community/parse-server/commit/0f5d2ad77b422dc904458254548be87397fc6e9b))
+
+## [8.6.81](https://github.com/parse-community/parse-server/compare/8.6.80...8.6.81) (2026-06-16)
+
+
+### Bug Fixes
+
+* Stored XSS via non-standard file extension bypassing file upload extension blocklist ([GHSA-v8x7-r927-cc93](https://github.com/parse-community/parse-server/security/advisories/GHSA-v8x7-r927-cc93)) ([#10506](https://github.com/parse-community/parse-server/issues/10506)) ([97c6a78](https://github.com/parse-community/parse-server/commit/97c6a78d19f976ec756c1295f08a8fccab90799a))
+
+## [8.6.80](https://github.com/parse-community/parse-server/compare/8.6.79...8.6.80) (2026-06-03)
+
+
+### Bug Fixes
+
+* Relation `$relatedTo` query bypasses `protectedFields` and owning-object ACL ([GHSA-wmwx-jr2p-4j4r](https://github.com/parse-community/parse-server/security/advisories/GHSA-wmwx-jr2p-4j4r)) ([#10494](https://github.com/parse-community/parse-server/issues/10494)) ([efef11b](https://github.com/parse-community/parse-server/commit/efef11bc2dac50b994607adca66e2901075ab640))
+
+## [8.6.79](https://github.com/parse-community/parse-server/compare/8.6.78...8.6.79) (2026-06-01)
+
+
+### Bug Fixes
+
+* Stored XSS via trailing-dot filename bypassing file upload extension blocklist ([GHSA-7wqv-xjf3-x35v](https://github.com/parse-community/parse-server/security/advisories/GHSA-7wqv-xjf3-x35v)) ([#10490](https://github.com/parse-community/parse-server/issues/10490)) ([9e99279](https://github.com/parse-community/parse-server/commit/9e992797ebd47df8143d4530fce4cc46fefb6532))
+
+## [8.6.78](https://github.com/parse-community/parse-server/compare/8.6.77...8.6.78) (2026-05-18)
+
+
+### Bug Fixes
+
+* GraphQL "Did you mean" validation suggestions disclose schema to unauthenticated callers ([GHSA-8cph-rgr4-g5vj](https://github.com/parse-community/parse-server/security/advisories/GHSA-8cph-rgr4-g5vj)) ([#10468](https://github.com/parse-community/parse-server/issues/10468)) ([a0ddb85](https://github.com/parse-community/parse-server/commit/a0ddb850e1060908f7aac3755861fb4a3d364127))
+
+## [8.6.77](https://github.com/parse-community/parse-server/compare/8.6.76...8.6.77) (2026-05-17)
+
+
+### Bug Fixes
+
+* Pre-authentication denial of service via client version header regex backtracking ([GHSA-38m6-82c8-4xfm](https://github.com/parse-community/parse-server/security/advisories/GHSA-38m6-82c8-4xfm)) ([#10464](https://github.com/parse-community/parse-server/issues/10464)) ([8523425](https://github.com/parse-community/parse-server/commit/8523425525a16bbff13fa9718ca356a7e48caa0d))
+
+## [8.6.76](https://github.com/parse-community/parse-server/compare/8.6.75...8.6.76) (2026-04-26)
+
+
+### Bug Fixes
+
+* MFA SMS one-time password accepted twice under concurrent login ([GHSA-jpq4-7fmq-q5fj](https://github.com/parse-community/parse-server/security/advisories/GHSA-jpq4-7fmq-q5fj)) ([#10449](https://github.com/parse-community/parse-server/issues/10449)) ([8681c60](https://github.com/parse-community/parse-server/commit/8681c600c5fe2924c9d6ae805482bbb2896d2958))
+
+## [8.6.75](https://github.com/parse-community/parse-server/compare/8.6.74...8.6.75) (2026-04-06)
+
+
+### Bug Fixes
+
+* Endpoint `/sessions/me` bypasses `_Session` `protectedFields` ([GHSA-g4v2-qx3q-4p64](https://github.com/parse-community/parse-server/security/advisories/GHSA-g4v2-qx3q-4p64)) ([#10407](https://github.com/parse-community/parse-server/issues/10407)) ([6ecc642](https://github.com/parse-community/parse-server/commit/6ecc6422c8624ba89a0fa71090d2c5f45d07d8de))
+
+## [8.6.74](https://github.com/parse-community/parse-server/compare/8.6.73...8.6.74) (2026-04-05)
+
+
+### Bug Fixes
+
+* Login timing side-channel reveals user existence ([GHSA-mmpq-5hcv-hf2v](https://github.com/parse-community/parse-server/security/advisories/GHSA-mmpq-5hcv-hf2v)) ([#10399](https://github.com/parse-community/parse-server/issues/10399)) ([1be6c97](https://github.com/parse-community/parse-server/commit/1be6c97494ab31cb93107c501d619c4f8b7d8e56))
+
+## [8.6.73](https://github.com/parse-community/parse-server/compare/8.6.72...8.6.73) (2026-04-02)
+
+
+### Bug Fixes
+
+* File upload Content-Type override via extension mismatch ([GHSA-vr5f-2r24-w5hc](https://github.com/parse-community/parse-server/security/advisories/GHSA-vr5f-2r24-w5hc)) ([#10384](https://github.com/parse-community/parse-server/issues/10384)) ([0de3e9f](https://github.com/parse-community/parse-server/commit/0de3e9f4bd477b0f0866f519974f513060876c04))
+
+## [8.6.72](https://github.com/parse-community/parse-server/compare/8.6.71...8.6.72) (2026-03-31)
+
+
+### Bug Fixes
+
+* Security upgrade @apollo/server from 4.12.1 to 4.13.0 ([#10082](https://github.com/parse-community/parse-server/issues/10082)) ([18a1560](https://github.com/parse-community/parse-server/commit/18a1560d480d5bdcacbc24dbb7e45c02d7f93613))
+
+## [8.6.71](https://github.com/parse-community/parse-server/compare/8.6.70...8.6.71) (2026-03-30)
+
+
+### Bug Fixes
+
+* Streaming file download bypasses afterFind file trigger authorization ([GHSA-hpm8-9qx6-jvwv](https://github.com/parse-community/parse-server/security/advisories/GHSA-hpm8-9qx6-jvwv)) ([#10362](https://github.com/parse-community/parse-server/issues/10362)) ([053109b](https://github.com/parse-community/parse-server/commit/053109b3ee71815bc39ed84116c108ff9edbf337))
+
+## [8.6.70](https://github.com/parse-community/parse-server/compare/8.6.69...8.6.70) (2026-03-29)
+
+
+### Bug Fixes
+
+* LiveQuery protected-field guard bypass via array-like logical operator value ([GHSA-mmg8-87c5-jrc2](https://github.com/parse-community/parse-server/security/advisories/GHSA-mmg8-87c5-jrc2)) ([#10351](https://github.com/parse-community/parse-server/issues/10351)) ([ffad0ec](https://github.com/parse-community/parse-server/commit/ffad0ec6b971ee0dd9545e1bf1fb34ddebf275c2))
+
+## [8.6.69](https://github.com/parse-community/parse-server/compare/8.6.68...8.6.69) (2026-03-29)
+
+
+### Bug Fixes
+
+* Session field immutability bypass via falsy-value guard ([GHSA-f6j3-w9v3-cq22](https://github.com/parse-community/parse-server/security/advisories/GHSA-f6j3-w9v3-cq22)) ([#10348](https://github.com/parse-community/parse-server/issues/10348)) ([ebccd7f](https://github.com/parse-community/parse-server/commit/ebccd7fe2708007e62f705ee1c820a6766178777))
+
+## [8.6.68](https://github.com/parse-community/parse-server/compare/8.6.67...8.6.68) (2026-03-29)
+
+
+### Bug Fixes
+
+* GraphQL complexity validator exponential fragment traversal DoS ([GHSA-mfj6-6p54-m98c](https://github.com/parse-community/parse-server/security/advisories/GHSA-mfj6-6p54-m98c)) ([#10345](https://github.com/parse-community/parse-server/issues/10345)) ([ea15412](https://github.com/parse-community/parse-server/commit/ea15412795f34594cc8a674fe858d445675e0295))
+
+## [8.6.67](https://github.com/parse-community/parse-server/compare/8.6.66...8.6.67) (2026-03-28)
+
+
+### Bug Fixes
+
+* Cloud function validator bypass via prototype chain traversal ([GHSA-vpj2-qq7w-5qq6](https://github.com/parse-community/parse-server/security/advisories/GHSA-vpj2-qq7w-5qq6)) ([#10343](https://github.com/parse-community/parse-server/issues/10343)) ([4fc48cf](https://github.com/parse-community/parse-server/commit/4fc48cf28f22eea200d74d883505f485234a48d7))
+
+## [8.6.66](https://github.com/parse-community/parse-server/compare/8.6.65...8.6.66) (2026-03-27)
+
+
+### Bug Fixes
+
+* GraphQL API endpoint ignores CORS origin restriction ([GHSA-q3p6-g7c4-829c](https://github.com/parse-community/parse-server/security/advisories/GHSA-q3p6-g7c4-829c)) ([#10335](https://github.com/parse-community/parse-server/issues/10335)) ([0347641](https://github.com/parse-community/parse-server/commit/0347641507891d0013ec57f7c10f012064f41263))
+
+## [8.6.65](https://github.com/parse-community/parse-server/compare/8.6.64...8.6.65) (2026-03-27)
+
+
+### Bug Fixes
+
+* LiveQuery protected field leak via shared mutable state across concurrent subscribers ([GHSA-m983-v2ff-wq65](https://github.com/parse-community/parse-server/security/advisories/GHSA-m983-v2ff-wq65)) ([#10331](https://github.com/parse-community/parse-server/issues/10331)) ([5834e29](https://github.com/parse-community/parse-server/commit/5834e29234593addaa0251a85f572ad4f376320b))
+
+## [8.6.64](https://github.com/parse-community/parse-server/compare/8.6.63...8.6.64) (2026-03-26)
+
+
+### Bug Fixes
+
+* MFA single-use token bypass via concurrent authData login requests ([GHSA-w73w-g5xw-rwhf](https://github.com/parse-community/parse-server/security/advisories/GHSA-w73w-g5xw-rwhf)) ([#10327](https://github.com/parse-community/parse-server/issues/10327)) ([661f160](https://github.com/parse-community/parse-server/commit/661f160edac8daac0486bc94413cf9652876ab92))
+
+## [8.6.63](https://github.com/parse-community/parse-server/compare/8.6.62...8.6.63) (2026-03-26)
+
+
+### Bug Fixes
+
+* Auth data exposed via verify password endpoint ([GHSA-wp76-gg32-8258](https://github.com/parse-community/parse-server/security/advisories/GHSA-wp76-gg32-8258)) ([#10324](https://github.com/parse-community/parse-server/issues/10324)) ([a1d4e7b](https://github.com/parse-community/parse-server/commit/a1d4e7b12a12f16d3870dbee582a36765858e94c))
+
+## [8.6.62](https://github.com/parse-community/parse-server/compare/8.6.61...8.6.62) (2026-03-22)
+
+
+### Bug Fixes
+
+* Reject invalid locale format in PagesRouter ([#10282](https://github.com/parse-community/parse-server/issues/10282)) ([e047da9](https://github.com/parse-community/parse-server/commit/e047da961a4e911c3e110fc5534207a2d9b5ea35))
+
+## [8.6.61](https://github.com/parse-community/parse-server/compare/8.6.60...8.6.61) (2026-03-22)
+
+
+### Bug Fixes
+
+* Auth data exposed via /users/me endpoint ([GHSA-37mj-c2wf-cx96](https://github.com/parse-community/parse-server/security/advisories/GHSA-37mj-c2wf-cx96)) ([#10279](https://github.com/parse-community/parse-server/issues/10279)) ([5b8998e](https://github.com/parse-community/parse-server/commit/5b8998e6866bcf75be7b5bb625e27d23bfaf912c))
+
+## [8.6.60](https://github.com/parse-community/parse-server/compare/8.6.59...8.6.60) (2026-03-22)
+
+
+### Bug Fixes
+
+* MFA recovery code single-use bypass via concurrent requests ([GHSA-2299-ghjr-6vjp](https://github.com/parse-community/parse-server/security/advisories/GHSA-2299-ghjr-6vjp)) ([#10276](https://github.com/parse-community/parse-server/issues/10276)) ([fc3da35](https://github.com/parse-community/parse-server/commit/fc3da35a81d5083b453e8967cabcc880f1a3bd0c))
+
+## [8.6.59](https://github.com/parse-community/parse-server/compare/8.6.58...8.6.59) (2026-03-21)
+
+
+### Bug Fixes
+
+* SQL injection via aggregate and distinct field names in PostgreSQL adapter ([GHSA-p2w6-rmh7-w8q3](https://github.com/parse-community/parse-server/security/advisories/GHSA-p2w6-rmh7-w8q3)) ([#10273](https://github.com/parse-community/parse-server/issues/10273)) ([03249f9](https://github.com/parse-community/parse-server/commit/03249f9bf5b8783c8b848f84dab791ff0b761b8c))
+
+## [8.6.58](https://github.com/parse-community/parse-server/compare/8.6.57...8.6.58) (2026-03-21)
+
+
+### Bug Fixes
+
+* Denial of service via unindexed database query for unconfigured auth providers ([GHSA-g4cf-xj29-wqqr](https://github.com/parse-community/parse-server/security/advisories/GHSA-g4cf-xj29-wqqr)) ([#10271](https://github.com/parse-community/parse-server/issues/10271)) ([40eb442](https://github.com/parse-community/parse-server/commit/40eb442e02672986730007d0a1edb22c1c4bd357))
+
+## [8.6.57](https://github.com/parse-community/parse-server/compare/8.6.56...8.6.57) (2026-03-21)
+
+
+### Bug Fixes
+
+* Session update endpoint allows overwriting server-generated session fields ([GHSA-jc39-686j-wp6q](https://github.com/parse-community/parse-server/security/advisories/GHSA-jc39-686j-wp6q)) ([#10264](https://github.com/parse-community/parse-server/issues/10264)) ([26b628c](https://github.com/parse-community/parse-server/commit/26b628c8fb3cc79ea955374769eebcff6f8a8a73))
+
+## [8.6.56](https://github.com/parse-community/parse-server/compare/8.6.55...8.6.56) (2026-03-20)
+
+
+### Bug Fixes
+
+* LiveQuery subscription query depth bypass ([GHSA-6qh5-m6g3-xhq6](https://github.com/parse-community/parse-server/security/advisories/GHSA-6qh5-m6g3-xhq6)) ([#10260](https://github.com/parse-community/parse-server/issues/10260)) ([060d270](https://github.com/parse-community/parse-server/commit/060d27053fb0fadf613c25aabab7fe0c82b7a899))
+
+## [8.6.55](https://github.com/parse-community/parse-server/compare/8.6.54...8.6.55) (2026-03-20)
+
+
+### Bug Fixes
+
+* Query condition depth bypass via pre-validation transform pipeline ([GHSA-9fjp-q3c4-6w3j](https://github.com/parse-community/parse-server/security/advisories/GHSA-9fjp-q3c4-6w3j)) ([#10258](https://github.com/parse-community/parse-server/issues/10258)) ([2581b54](https://github.com/parse-community/parse-server/commit/2581b5426047ce9cbcd3d9c0e8379e9c30e23ab5))
+
+## [8.6.54](https://github.com/parse-community/parse-server/compare/8.6.53...8.6.54) (2026-03-20)
+
+
+### Bug Fixes
+
+* Protected field change detection oracle via LiveQuery watch parameter ([GHSA-qpc3-fg4j-8hgm](https://github.com/parse-community/parse-server/security/advisories/GHSA-qpc3-fg4j-8hgm)) ([#10254](https://github.com/parse-community/parse-server/issues/10254)) ([c62eaca](https://github.com/parse-community/parse-server/commit/c62eacaf38de86913f09240583448360b1cc8e67))
+
+## [8.6.53](https://github.com/parse-community/parse-server/compare/8.6.52...8.6.53) (2026-03-20)
+
+
+### Bug Fixes
+
+* LiveQuery bypasses CLP pointer permission enforcement ([GHSA-fph2-r4qg-9576](https://github.com/parse-community/parse-server/security/advisories/GHSA-fph2-r4qg-9576)) ([#10252](https://github.com/parse-community/parse-server/issues/10252)) ([976dad1](https://github.com/parse-community/parse-server/commit/976dad109f3fe3fbd0a3a35ef62e7a5d35eb0bee))
+
+## [8.6.52](https://github.com/parse-community/parse-server/compare/8.6.51...8.6.52) (2026-03-19)
+
+
+### Bug Fixes
+
+* Auth provider validation bypass on login via partial authData ([GHSA-pfj7-wv7c-22pr](https://github.com/parse-community/parse-server/security/advisories/GHSA-pfj7-wv7c-22pr)) ([#10247](https://github.com/parse-community/parse-server/issues/10247)) ([8d7df56](https://github.com/parse-community/parse-server/commit/8d7df5639c4a35768fe8b78b4580b30e8a74721c))
+
+## [8.6.51](https://github.com/parse-community/parse-server/compare/8.6.50...8.6.51) (2026-03-19)
+
+
+### Bug Fixes
+
+* Email verification resend page leaks user existence (GHSA-h29g-q5c2-9h4f) ([#10243](https://github.com/parse-community/parse-server/issues/10243)) ([967aa57](https://github.com/parse-community/parse-server/commit/967aa57732202009b2389ce9ecb3130d53d657e5))
+
+## [8.6.50](https://github.com/parse-community/parse-server/compare/8.6.49...8.6.50) (2026-03-17)
+
+
+### Bug Fixes
+
+* Protected fields leak via LiveQuery afterEvent trigger ([GHSA-5hmj-jcgp-6hff](https://github.com/parse-community/parse-server/security/advisories/GHSA-5hmj-jcgp-6hff)) ([#10233](https://github.com/parse-community/parse-server/issues/10233)) ([743324e](https://github.com/parse-community/parse-server/commit/743324e71fa2a6693bea78c4589cf2211b210eb6))
+
+## [8.6.49](https://github.com/parse-community/parse-server/compare/8.6.48...8.6.49) (2026-03-16)
+
+
+### Bug Fixes
+
+* Empty authData bypasses credential requirement on signup ([GHSA-wjqw-r9x4-j59v](https://github.com/parse-community/parse-server/security/advisories/GHSA-wjqw-r9x4-j59v)) ([#10220](https://github.com/parse-community/parse-server/issues/10220)) ([b62336b](https://github.com/parse-community/parse-server/commit/b62336be06d06e3e9fbf3365354363e381603f58))
+
+## [8.6.48](https://github.com/parse-community/parse-server/compare/8.6.47...8.6.48) (2026-03-16)
+
+
+### Bug Fixes
+
+* Password reset token single-use bypass via concurrent requests ([GHSA-r3xq-68wh-gwvh](https://github.com/parse-community/parse-server/security/advisories/GHSA-r3xq-68wh-gwvh)) ([#10217](https://github.com/parse-community/parse-server/issues/10217)) ([83b4de0](https://github.com/parse-community/parse-server/commit/83b4de0b7ce722fac0ecbb5fe815e3da8fb6b8a0))
+
+## [8.6.47](https://github.com/parse-community/parse-server/compare/8.6.46...8.6.47) (2026-03-15)
+
+
+### Bug Fixes
+
+* Cloud function dispatch crashes server via prototype chain traversal ([GHSA-4263-jgmp-7pf4](https://github.com/parse-community/parse-server/security/advisories/GHSA-4263-jgmp-7pf4)) ([#10211](https://github.com/parse-community/parse-server/issues/10211)) ([8d8c760](https://github.com/parse-community/parse-server/commit/8d8c7604790f931531ac31bd88c98eb3d995b9c5))
+
+## [8.6.46](https://github.com/parse-community/parse-server/compare/8.6.45...8.6.46) (2026-03-15)
+
+
+### Bug Fixes
+
+* Revert accidental breaking default values for query complexity limits ([#10206](https://github.com/parse-community/parse-server/issues/10206)) ([a3a57c1](https://github.com/parse-community/parse-server/commit/a3a57c15077d0c9c902fd444de986915b942ab2f))
+
+## [8.6.45](https://github.com/parse-community/parse-server/compare/8.6.44...8.6.45) (2026-03-15)
+
+
+### Bug Fixes
+
+* Server crash via deeply nested query condition operators ([GHSA-9xp9-j92r-p88v](https://github.com/parse-community/parse-server/security/advisories/GHSA-9xp9-j92r-p88v)) ([#10203](https://github.com/parse-community/parse-server/issues/10203)) ([433fa8f](https://github.com/parse-community/parse-server/commit/433fa8fb19f813966871da8be874e1197a29b10b))
+
+## [8.6.44](https://github.com/parse-community/parse-server/compare/8.6.43...8.6.44) (2026-03-14)
+
+
+### Bug Fixes
+
+* Schema poisoning via prototype pollution in deep copy ([GHSA-9ccr-fpp6-78qf](https://github.com/parse-community/parse-server/security/advisories/GHSA-9ccr-fpp6-78qf)) ([#10201](https://github.com/parse-community/parse-server/issues/10201)) ([6aec8ea](https://github.com/parse-community/parse-server/commit/6aec8ea9e17375930e55406d0c62a429505924cc))
+
 ## [8.6.43](https://github.com/parse-community/parse-server/compare/8.6.42...8.6.43) (2026-03-14)


@@ -1,16 +1,16 @@
 {
  "name": "parse-server",
-  "version": "8.6.43",
+  "version": "8.6.82",
  "lockfileVersion": 2,
  "requires": true,
  "packages": {
    "": {
      "name": "parse-server",
-      "version": "8.6.43",
+      "version": "8.6.82",
      "hasInstallScript": true,
      "license": "Apache-2.0",
      "dependencies": {
-        "@apollo/server": "4.12.1",
+        "@apollo/server": "4.13.0",
        "@graphql-tools/merge": "9.0.24",
        "@graphql-tools/schema": "10.0.23",
        "@graphql-tools/utils": "10.8.6",
@@ -19,7 +19,6 @@
        "bcryptjs": "3.0.2",
        "commander": "13.1.0",
        "cors": "2.8.5",
-        "deepcopy": "2.1.0",
        "express": "5.2.1",
        "express-rate-limit": "7.5.1",
        "follow-redirects": "1.15.9",
@@ -236,9 +235,10 @@
      }
    },
    "node_modules/@apollo/server": {
-      "version": "4.12.1",
-      "resolved": "https://registry.npmjs.org/@apollo/server/-/server-4.12.1.tgz",
-      "integrity": "sha512-jceK1LK6l074in4mWu8XkwzDjvxdSzkmk8M7YpVLOGjQ6PmlaChcGRJ9BUwB46r22MxdPCXdC/6U5Vi8gzYbvQ==",
+      "version": "4.13.0",
+      "resolved": "https://registry.npmjs.org/@apollo/server/-/server-4.13.0.tgz",
+      "integrity": "sha512-t4GzaRiYIcPwYy40db6QjZzgvTr9ztDKBddykUXmBb2SVjswMKXbkaJ5nPeHqmT3awr9PAaZdCZdZhRj55I/8A==",
+      "deprecated": "Apollo Server v4 is end-of-life since January 26, 2026. As long as you are already using a non-EOL version of Node.js, upgrading to v5 should take only a few minutes. See https://www.apollographql.com/docs/apollo-server/previous-versions for details.",
      "license": "MIT",
      "dependencies": {
        "@apollo/cache-control-types": "^1.0.3",
@@ -256,6 +256,7 @@
        "@types/express-serve-static-core": "^4.17.30",
        "@types/node-fetch": "^2.6.1",
        "async-retry": "^1.2.1",
+        "content-type": "^1.0.5",
        "cors": "^2.8.5",
        "express": "^4.21.1",
        "loglevel": "^1.6.8",
@@ -9541,14 +9542,6 @@
      "integrity": "sha512-oIPzksmTg4/MriiaYGO+okXDT7ztn/w3Eptv/+gSIdMdKsJo0u4CfYNFJPy+4SKMuCqGw2wxnA+URMg3t8a/bQ==",
      "dev": true
    },
-    "node_modules/deepcopy": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/deepcopy/-/deepcopy-2.1.0.tgz",
-      "integrity": "sha512-8cZeTb1ZKC3bdSCP6XOM1IsTczIO73fdqtwa2B0N15eAz7gmyhQo+mc5gnFuulsgN3vIQYmTgbmQVKalH1dKvQ==",
-      "dependencies": {
-        "type-detect": "^4.0.8"
-      }
-    },
    "node_modules/default-require-extensions": {
      "version": "3.0.1",
      "resolved": "https://registry.npmjs.org/default-require-extensions/-/default-require-extensions-3.0.1.tgz",
@@ -11703,88 +11696,6 @@
        "webidl-conversions": "^3.0.0"
      }
    },
-    "node_modules/gcp-metadata": {
-      "version": "5.3.0",
-      "resolved": "https://registry.npmjs.org/gcp-metadata/-/gcp-metadata-5.3.0.tgz",
-      "integrity": "sha512-FNTkdNEnBdlqF2oatizolQqNANMrcqJt6AAYt99B3y1aLLC8Hc5IOBb+ZnnzllodEEf6xMBp6wRcBbc16fa65w==",
-      "license": "Apache-2.0",
-      "optional": true,
-      "peer": true,
-      "dependencies": {
-        "gaxios": "^5.0.0",
-        "json-bigint": "^1.0.0"
-      },
-      "engines": {
-        "node": ">=12"
-      }
-    },
-    "node_modules/gcp-metadata/node_modules/gaxios": {
-      "version": "5.1.3",
-      "resolved": "https://registry.npmjs.org/gaxios/-/gaxios-5.1.3.tgz",
-      "integrity": "sha512-95hVgBRgEIRQQQHIbnxBXeHbW4TqFk4ZDJW7wmVtvYar72FdhRIo1UGOLS2eRAKCPEdPBWu+M7+A33D9CdX9rA==",
-      "license": "Apache-2.0",
-      "optional": true,
-      "peer": true,
-      "dependencies": {
-        "extend": "^3.0.2",
-        "https-proxy-agent": "^5.0.0",
-        "is-stream": "^2.0.0",
-        "node-fetch": "^2.6.9"
-      },
-      "engines": {
-        "node": ">=12"
-      }
-    },
-    "node_modules/gcp-metadata/node_modules/node-fetch": {
-      "version": "2.7.0",
-      "resolved": "https://registry.npmjs.org/node-fetch/-/node-fetch-2.7.0.tgz",
-      "integrity": "sha512-c4FRfUm/dbcWZ7U+1Wq0AwCyFL+3nt2bEw05wfxSz+DWpWsitgmSgYmy2dQdWyKC1694ELPqMs/YzUSNozLt8A==",
-      "license": "MIT",
-      "optional": true,
-      "peer": true,
-      "dependencies": {
-        "whatwg-url": "^5.0.0"
-      },
-      "engines": {
-        "node": "4.x || >=6.0.0"
-      },
-      "peerDependencies": {
-        "encoding": "^0.1.0"
-      },
-      "peerDependenciesMeta": {
-        "encoding": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/gcp-metadata/node_modules/tr46": {
-      "version": "0.0.3",
-      "resolved": "https://registry.npmjs.org/tr46/-/tr46-0.0.3.tgz",
-      "integrity": "sha512-N3WMsuqV66lT30CrXNbEjx4GEwlow3v6rr4mCcv6prnfwhS01rkgyFdjPNBYd9br7LpXV1+Emh01fHnq2Gdgrw==",
-      "license": "MIT",
-      "optional": true,
-      "peer": true
-    },
-    "node_modules/gcp-metadata/node_modules/webidl-conversions": {
-      "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/webidl-conversions/-/webidl-conversions-3.0.1.tgz",
-      "integrity": "sha512-2JAn3z8AR6rjK8Sm8orRC0h/bcl/DqL7tRPdGZ4I1CjdF+EaMLmYxBHyXuKL849eucPFhvBoxMsflfOb8kxaeQ==",
-      "license": "BSD-2-Clause",
-      "optional": true,
-      "peer": true
-    },
-    "node_modules/gcp-metadata/node_modules/whatwg-url": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/whatwg-url/-/whatwg-url-5.0.0.tgz",
-      "integrity": "sha512-saE57nupxk6v3HY35+jzBwYa0rKSy0XR8JSxZPwgLr7ys0IBzhGviA1/TUGJLmSVqs8pb9AnvICXEuOHLprYTw==",
-      "license": "MIT",
-      "optional": true,
-      "peer": true,
-      "dependencies": {
-        "tr46": "~0.0.3",
-        "webidl-conversions": "^3.0.0"
-      }
-    },
    "node_modules/generic-pool": {
      "version": "3.9.0",
      "resolved": "https://registry.npmjs.org/generic-pool/-/generic-pool-3.9.0.tgz",
@@ -12859,13 +12770,6 @@
        "url": "https://github.com/sponsors/sindresorhus"
      }
    },
-    "node_modules/ip": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/ip/-/ip-2.0.1.tgz",
-      "integrity": "sha512-lJUL9imLTNi1ZfXT+DU6rBBdbiKGBuay9B6xGSPVjUeQwaH1RIGqef8RZkUtHioLmSNpPR5M4HVKJGm1j8FWVQ==",
-      "optional": true,
-      "peer": true
-    },
    "node_modules/ipaddr.js": {
      "version": "1.9.1",
      "resolved": "https://registry.npmjs.org/ipaddr.js/-/ipaddr.js-1.9.1.tgz",
@@ -21089,32 +20993,6 @@
        "url": "https://github.com/sponsors/sindresorhus"
      }
    },
-    "node_modules/smart-buffer": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/smart-buffer/-/smart-buffer-4.2.0.tgz",
-      "integrity": "sha512-94hK0Hh8rPqQl2xXc3HsaBoOXKV20MToPkcXvwbISWLEs+64sBq5kFgn2kJDHb1Pry9yrP0dxrCI9RRci7RXKg==",
-      "optional": true,
-      "peer": true,
-      "engines": {
-        "node": ">= 6.0.0",
-        "npm": ">= 3.0.0"
-      }
-    },
-    "node_modules/socks": {
-      "version": "2.7.1",
-      "resolved": "https://registry.npmjs.org/socks/-/socks-2.7.1.tgz",
-      "integrity": "sha512-7maUZy1N7uo6+WVEX6psASxtNlKaNVMlGQKkG/63nEDdLOWNbiUMoLK7X4uYoLhQstau72mLgfEWcXcwsaHbYQ==",
-      "optional": true,
-      "peer": true,
-      "dependencies": {
-        "ip": "^2.0.0",
-        "smart-buffer": "^4.2.0"
-      },
-      "engines": {
-        "node": ">= 10.13.0",
-        "npm": ">= 3.0.0"
-      }
-    },
    "node_modules/source-map": {
      "version": "0.6.1",
      "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.6.1.tgz",
@@ -22164,14 +22042,6 @@
        "node": ">= 0.8.0"
      }
    },
-    "node_modules/type-detect": {
-      "version": "4.0.8",
-      "resolved": "https://registry.npmjs.org/type-detect/-/type-detect-4.0.8.tgz",
-      "integrity": "sha512-0fr/mIH1dlO+x7TlcMy+bIDqKPsw/70tVyeHW787goQjhmqaZe10uwLujubK9q9Lg6Fiho1KUKDYz0Z7k7g5/g==",
-      "engines": {
-        "node": ">=4"
-      }
-    },
    "node_modules/type-fest": {
      "version": "4.21.0",
      "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-4.21.0.tgz",
@@ -23285,9 +23155,9 @@
      }
    },
    "@apollo/server": {
-      "version": "4.12.1",
-      "resolved": "https://registry.npmjs.org/@apollo/server/-/server-4.12.1.tgz",
-      "integrity": "sha512-jceK1LK6l074in4mWu8XkwzDjvxdSzkmk8M7YpVLOGjQ6PmlaChcGRJ9BUwB46r22MxdPCXdC/6U5Vi8gzYbvQ==",
+      "version": "4.13.0",
+      "resolved": "https://registry.npmjs.org/@apollo/server/-/server-4.13.0.tgz",
+      "integrity": "sha512-t4GzaRiYIcPwYy40db6QjZzgvTr9ztDKBddykUXmBb2SVjswMKXbkaJ5nPeHqmT3awr9PAaZdCZdZhRj55I/8A==",
      "requires": {
        "@apollo/cache-control-types": "^1.0.3",
        "@apollo/server-gateway-interface": "^1.1.1",
@@ -23304,6 +23174,7 @@
        "@types/express-serve-static-core": "^4.17.30",
        "@types/node-fetch": "^2.6.1",
        "async-retry": "^1.2.1",
+        "content-type": "^1.0.5",
        "cors": "^2.8.5",
        "express": "^4.21.1",
        "loglevel": "^1.6.8",
@@ -29757,14 +29628,6 @@
      "integrity": "sha512-oIPzksmTg4/MriiaYGO+okXDT7ztn/w3Eptv/+gSIdMdKsJo0u4CfYNFJPy+4SKMuCqGw2wxnA+URMg3t8a/bQ==",
      "dev": true
    },
-    "deepcopy": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/deepcopy/-/deepcopy-2.1.0.tgz",
-      "integrity": "sha512-8cZeTb1ZKC3bdSCP6XOM1IsTczIO73fdqtwa2B0N15eAz7gmyhQo+mc5gnFuulsgN3vIQYmTgbmQVKalH1dKvQ==",
-      "requires": {
-        "type-detect": "^4.0.8"
-      }
-    },
    "default-require-extensions": {
      "version": "3.0.1",
      "resolved": "https://registry.npmjs.org/default-require-extensions/-/default-require-extensions-3.0.1.tgz",
@@ -31257,67 +31120,6 @@
        }
      }
    },
-    "gcp-metadata": {
-      "version": "5.3.0",
-      "resolved": "https://registry.npmjs.org/gcp-metadata/-/gcp-metadata-5.3.0.tgz",
-      "integrity": "sha512-FNTkdNEnBdlqF2oatizolQqNANMrcqJt6AAYt99B3y1aLLC8Hc5IOBb+ZnnzllodEEf6xMBp6wRcBbc16fa65w==",
-      "optional": true,
-      "peer": true,
-      "requires": {
-        "gaxios": "^5.0.0",
-        "json-bigint": "^1.0.0"
-      },
-      "dependencies": {
-        "gaxios": {
-          "version": "5.1.3",
-          "resolved": "https://registry.npmjs.org/gaxios/-/gaxios-5.1.3.tgz",
-          "integrity": "sha512-95hVgBRgEIRQQQHIbnxBXeHbW4TqFk4ZDJW7wmVtvYar72FdhRIo1UGOLS2eRAKCPEdPBWu+M7+A33D9CdX9rA==",
-          "optional": true,
-          "peer": true,
-          "requires": {
-            "extend": "^3.0.2",
-            "https-proxy-agent": "^5.0.0",
-            "is-stream": "^2.0.0",
-            "node-fetch": "^2.6.9"
-          }
-        },
-        "node-fetch": {
-          "version": "2.7.0",
-          "resolved": "https://registry.npmjs.org/node-fetch/-/node-fetch-2.7.0.tgz",
-          "integrity": "sha512-c4FRfUm/dbcWZ7U+1Wq0AwCyFL+3nt2bEw05wfxSz+DWpWsitgmSgYmy2dQdWyKC1694ELPqMs/YzUSNozLt8A==",
-          "optional": true,
-          "peer": true,
-          "requires": {
-            "whatwg-url": "^5.0.0"
-          }
-        },
-        "tr46": {
-          "version": "0.0.3",
-          "resolved": "https://registry.npmjs.org/tr46/-/tr46-0.0.3.tgz",
-          "integrity": "sha512-N3WMsuqV66lT30CrXNbEjx4GEwlow3v6rr4mCcv6prnfwhS01rkgyFdjPNBYd9br7LpXV1+Emh01fHnq2Gdgrw==",
-          "optional": true,
-          "peer": true
-        },
-        "webidl-conversions": {
-          "version": "3.0.1",
-          "resolved": "https://registry.npmjs.org/webidl-conversions/-/webidl-conversions-3.0.1.tgz",
-          "integrity": "sha512-2JAn3z8AR6rjK8Sm8orRC0h/bcl/DqL7tRPdGZ4I1CjdF+EaMLmYxBHyXuKL849eucPFhvBoxMsflfOb8kxaeQ==",
-          "optional": true,
-          "peer": true
-        },
-        "whatwg-url": {
-          "version": "5.0.0",
-          "resolved": "https://registry.npmjs.org/whatwg-url/-/whatwg-url-5.0.0.tgz",
-          "integrity": "sha512-saE57nupxk6v3HY35+jzBwYa0rKSy0XR8JSxZPwgLr7ys0IBzhGviA1/TUGJLmSVqs8pb9AnvICXEuOHLprYTw==",
-          "optional": true,
-          "peer": true,
-          "requires": {
-            "tr46": "~0.0.3",
-            "webidl-conversions": "^3.0.0"
-          }
-        }
-      }
-    },
    "generic-pool": {
      "version": "3.9.0",
      "resolved": "https://registry.npmjs.org/generic-pool/-/generic-pool-3.9.0.tgz",
@@ -32078,13 +31880,6 @@
        "p-is-promise": "^3.0.0"
      }
    },
-    "ip": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/ip/-/ip-2.0.1.tgz",
-      "integrity": "sha512-lJUL9imLTNi1ZfXT+DU6rBBdbiKGBuay9B6xGSPVjUeQwaH1RIGqef8RZkUtHioLmSNpPR5M4HVKJGm1j8FWVQ==",
-      "optional": true,
-      "peer": true
-    },
    "ipaddr.js": {
      "version": "1.9.1",
      "resolved": "https://registry.npmjs.org/ipaddr.js/-/ipaddr.js-1.9.1.tgz",
@@ -37805,24 +37600,6 @@
        }
      }
    },
-    "smart-buffer": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/smart-buffer/-/smart-buffer-4.2.0.tgz",
-      "integrity": "sha512-94hK0Hh8rPqQl2xXc3HsaBoOXKV20MToPkcXvwbISWLEs+64sBq5kFgn2kJDHb1Pry9yrP0dxrCI9RRci7RXKg==",
-      "optional": true,
-      "peer": true
-    },
-    "socks": {
-      "version": "2.7.1",
-      "resolved": "https://registry.npmjs.org/socks/-/socks-2.7.1.tgz",
-      "integrity": "sha512-7maUZy1N7uo6+WVEX6psASxtNlKaNVMlGQKkG/63nEDdLOWNbiUMoLK7X4uYoLhQstau72mLgfEWcXcwsaHbYQ==",
-      "optional": true,
-      "peer": true,
-      "requires": {
-        "ip": "^2.0.0",
-        "smart-buffer": "^4.2.0"
-      }
-    },
    "source-map": {
      "version": "0.6.1",
      "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.6.1.tgz",
@@ -38597,11 +38374,6 @@
        "prelude-ls": "^1.2.1"
      }
    },
-    "type-detect": {
-      "version": "4.0.8",
-      "resolved": "https://registry.npmjs.org/type-detect/-/type-detect-4.0.8.tgz",
-      "integrity": "sha512-0fr/mIH1dlO+x7TlcMy+bIDqKPsw/70tVyeHW787goQjhmqaZe10uwLujubK9q9Lg6Fiho1KUKDYz0Z7k7g5/g=="
-    },
    "type-fest": {
      "version": "4.21.0",
      "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-4.21.0.tgz",
@@ -1,6 +1,6 @@
 {
  "name": "parse-server",
-  "version": "8.6.43",
+  "version": "8.6.82",
  "description": "An express module providing a Parse-compatible API server",
  "main": "lib/index.js",
  "repository": {
@@ -20,7 +20,7 @@
  ],
  "license": "Apache-2.0",
  "dependencies": {
-    "@apollo/server": "4.12.1",
+    "@apollo/server": "4.13.0",
    "@graphql-tools/merge": "9.0.24",
    "@graphql-tools/schema": "10.0.23",
    "@graphql-tools/utils": "10.8.6",
@@ -29,7 +29,6 @@
    "bcryptjs": "3.0.2",
    "commander": "13.1.0",
    "cors": "2.8.5",
-    "deepcopy": "2.1.0",
    "express": "5.2.1",
    "express-rate-limit": "7.5.1",
    "follow-redirects": "1.15.9",
@@ -1,49 +0,0 @@
-const ClientSDK = require('../lib/ClientSDK');
-
-describe('ClientSDK', () => {
-  it('should properly parse the SDK versions', () => {
-    const clientSDKFromVersion = ClientSDK.fromString;
-    expect(clientSDKFromVersion('i1.1.1')).toEqual({
-      sdk: 'i',
-      version: '1.1.1',
-    });
-    expect(clientSDKFromVersion('i1')).toEqual({
-      sdk: 'i',
-      version: '1',
-    });
-    expect(clientSDKFromVersion('apple-tv1.13.0')).toEqual({
-      sdk: 'apple-tv',
-      version: '1.13.0',
-    });
-    expect(clientSDKFromVersion('js1.9.0')).toEqual({
-      sdk: 'js',
-      version: '1.9.0',
-    });
-  });
-
-  it('should properly sastisfy', () => {
-    expect(
-      ClientSDK.compatible({
-        js: '>=1.9.0',
-      })('js1.9.0')
-    ).toBe(true);
-
-    expect(
-      ClientSDK.compatible({
-        js: '>=1.9.0',
-      })('js2.0.0')
-    ).toBe(true);
-
-    expect(
-      ClientSDK.compatible({
-        js: '>=1.9.0',
-      })('js1.8.0')
-    ).toBe(false);
-
-    expect(
-      ClientSDK.compatible({
-        js: '>=1.9.0',
-      })(undefined)
-    ).toBe(true);
-  });
-});
@@ -178,4 +178,32 @@ describe('graphql query complexity', () => {
      expect(result.errors).toBeUndefined();
    });
  });
+
+  describe('fragment fan-out', () => {
+    it('should reject query with exponential fragment fan-out efficiently', async () => {
+      await setupGraphQL({
+        requestComplexity: { graphQLFields: 100 },
+      });
+      // Binary fan-out: each fragment spreads the next one twice.
+      // Without fix: 2^(levels-1) field visits = 2^25 ≈ 33M (hangs event loop).
+      // With fix (memoization): O(levels) traversal, same field count, instant rejection.
+      const levels = 26;
+      let query = 'query Q { ...F0 }\n';
+      for (let i = 0; i < levels; i++) {
+        if (i === levels - 1) {
+          query += `fragment F${i} on Query { __typename }\n`;
+        } else {
+          query += `fragment F${i} on Query { ...F${i + 1} ...F${i + 1} }\n`;
+        }
+      }
+      const start = Date.now();
+      const result = await graphqlRequest(query);
+      const elapsed = Date.now() - start;
+      // Must complete in under 5 seconds (without fix it would take seconds or hang)
+      expect(elapsed).toBeLessThan(5000);
+      // Field count is 2^(levels-1) = 16777216, which exceeds the limit of 100
+      expect(result.errors).toBeDefined();
+      expect(result.errors[0].message).toMatch(/Number of GraphQL fields .* exceeds maximum allowed/);
+    });
+  });
 });
@@ -112,7 +112,6 @@ describe('middlewares', () => {
  });

  const BodyParams = {
-    clientVersion: '_ClientVersion',
    installationId: '_InstallationId',
    sessionToken: '_SessionToken',
    masterKey: '_MasterKey',
@@ -852,6 +852,69 @@ describe('Pages Router', () => {
          followRedirects: false,
        });
        expect(formResponse.status).toEqual(303);
+        // With emailVerifySuccessOnInvalidEmail: true (default), the resend
+        // page always redirects to the success page to prevent user enumeration
+        expect(formResponse.text).toContain(
+          `/${locale}/${pages.emailVerificationSendSuccess.defaultFile}`
+        );
+      });
+
+      it('localizes end-to-end for verify email: invalid verification link - link send fail with emailVerifySuccessOnInvalidEmail disabled', async () => {
+        config.emailVerifySuccessOnInvalidEmail = false;
+        await reconfigureServer(config);
+        const sendVerificationEmail = spyOn(
+          config.emailAdapter,
+          'sendVerificationEmail'
+        ).and.callThrough();
+        const user = new Parse.User();
+        user.setUsername('exampleUsername');
+        user.setPassword('examplePassword');
+        user.set('email', 'mail@example.com');
+        await user.signUp();
+        await jasmine.timeout();
+
+        const link = sendVerificationEmail.calls.all()[0].args[0].link;
+        const linkWithLocale = new URL(link);
+        linkWithLocale.searchParams.append(pageParams.locale, exampleLocale);
+        linkWithLocale.searchParams.set(pageParams.token, 'invalidToken');
+
+        const linkResponse = await request({
+          url: linkWithLocale.toString(),
+          followRedirects: false,
+        });
+        expect(linkResponse.status).toBe(200);
+
+        const appId = linkResponse.headers['x-parse-page-param-appid'];
+        const locale = linkResponse.headers['x-parse-page-param-locale'];
+        const publicServerUrl = linkResponse.headers['x-parse-page-param-publicserverurl'];
+        await jasmine.timeout();
+
+        const invalidVerificationPagePath = pageResponse.calls.all()[0].args[0];
+        expect(appId).toBeDefined();
+        expect(locale).toBe(exampleLocale);
+        expect(publicServerUrl).toBeDefined();
+        expect(invalidVerificationPagePath).toMatch(
+          new RegExp(`\/${exampleLocale}\/${pages.emailVerificationLinkInvalid.defaultFile}`)
+        );
+
+        spyOn(UserController.prototype, 'resendVerificationEmail').and.callFake(() =>
+          Promise.reject('failed to resend verification email')
+        );
+
+        const formUrl = `${publicServerUrl}/apps/${appId}/resend_verification_email`;
+        const formResponse = await request({
+          url: formUrl,
+          method: 'POST',
+          body: {
+            locale,
+            username: 'exampleUsername',
+          },
+          headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+          followRedirects: false,
+        });
+        expect(formResponse.status).toEqual(303);
+        // With emailVerifySuccessOnInvalidEmail: false, the resend page
+        // redirects to the fail page
        expect(formResponse.text).toContain(
          `/${locale}/${pages.emailVerificationSendFail.defaultFile}`
        );
@@ -1002,6 +1065,81 @@ describe('Pages Router', () => {
          await fs.rm(baseDir, { recursive: true, force: true });
        }
      });
+
+      it('does not leak email verification status via resend page when emailVerifySuccessOnInvalidEmail is true', async () => {
+        const emailAdapter = {
+          sendVerificationEmail: () => {},
+          sendPasswordResetEmail: () => {},
+          sendMail: () => {},
+        };
+        await reconfigureServer({
+          ...config,
+          verifyUserEmails: true,
+          emailVerifySuccessOnInvalidEmail: true,
+          emailAdapter,
+        });
+
+        // Create a user with unverified email
+        const user = new Parse.User();
+        user.setUsername('realuser');
+        user.setPassword('password123');
+        user.setEmail('real@example.com');
+        await user.signUp();
+
+        const formUrl = `${config.publicServerURL}/apps/${config.appId}/resend_verification_email`;
+
+        // Resend for existing unverified user
+        const existingResponse = await request({
+          method: 'POST',
+          url: formUrl,
+          headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+          body: 'username=realuser',
+          followRedirects: false,
+        }).catch(e => e);
+
+        // Resend for non-existing user
+        const nonExistingResponse = await request({
+          method: 'POST',
+          url: formUrl,
+          headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+          body: 'username=fakeuser',
+          followRedirects: false,
+        }).catch(e => e);
+
+        // Both should redirect to the same page (success) to prevent enumeration
+        expect(existingResponse.status).toBe(303);
+        expect(nonExistingResponse.status).toBe(303);
+        expect(existingResponse.headers.location).toContain('email_verification_send_success');
+        expect(nonExistingResponse.headers.location).toContain('email_verification_send_success');
+      });
+
+      it('does leak email verification status via resend page when emailVerifySuccessOnInvalidEmail is false', async () => {
+        const emailAdapter = {
+          sendVerificationEmail: () => {},
+          sendPasswordResetEmail: () => {},
+          sendMail: () => {},
+        };
+        await reconfigureServer({
+          ...config,
+          verifyUserEmails: true,
+          emailVerifySuccessOnInvalidEmail: false,
+          emailAdapter,
+        });
+
+        const formUrl = `${config.publicServerURL}/apps/${config.appId}/resend_verification_email`;
+
+        // Resend for non-existing user should redirect to fail page
+        const nonExistingResponse = await request({
+          method: 'POST',
+          url: formUrl,
+          headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+          body: 'username=fakeuser',
+          followRedirects: false,
+        }).catch(e => e);
+
+        expect(nonExistingResponse.status).toBe(303);
+        expect(nonExistingResponse.headers.location).toContain('email_verification_send_fail');
+      });
    });

    describe('custom route', () => {
@@ -1258,15 +1396,31 @@ describe('Pages Router', () => {
      expect(response.text).toContain('&lt;img');
    });

-    it('should escape XSS in locale parameter', async () => {
+    it('should reject XSS payload in locale parameter', async () => {
      const xssLocale = '"><svg/onload=alert(1)>';
      const response = await request({
        url: `http://localhost:8378/1/apps/choose_password?locale=${encodeURIComponent(xssLocale)}&appId=test`,
      });

      expect(response.status).toBe(200);
+      // Invalid locale is rejected by format validation, so the XSS
+      // payload never reaches the page content
      expect(response.text).not.toContain('<svg/onload=alert(1)>');
-      expect(response.text).toContain('&quot;&gt;&lt;svg');
+      expect(response.text).not.toContain('&quot;&gt;&lt;svg');
+    });
+
+    it('should reject non-ASCII characters in locale parameter', async () => {
+      // Non-ASCII characters like ğ (U+011F) would cause ERR_INVALID_CHAR
+      // when set as HTTP header value if not rejected by locale validation
+      const nonAsciiLocale = 'ğ';
+      const response = await request({
+        url: `http://localhost:8378/1/apps/choose_password?locale=${encodeURIComponent(nonAsciiLocale)}&appId=test`,
+      });
+
+      expect(response.status).toBe(200);
+      // Non-ASCII locale is rejected by format validation;
+      // no ERR_INVALID_CHAR error occurs
+      expect(response.headers['x-parse-page-param-locale']).toBeUndefined();
    });

    it('should handle legitimate usernames with quotes correctly', async () => {
@@ -1490,6 +1490,96 @@ describe('Parse.File testing', () => {
      );
    });

+    it('default should block non-standard extension variants preserving a dangerous content type', async () => {
+      await reconfigureServer({
+        fileUpload: {
+          enableForPublic: true,
+        },
+      });
+      const svgContent = Buffer.from(
+        '<svg xmlns="http://www.w3.org/2000/svg"><script>alert(1)</script></svg>'
+      ).toString('base64');
+      const filenames = [
+        'malicious.svg~',
+        'malicious.svg.tmp',
+        'malicious.svg.bak',
+        'malicious.svg.backup',
+        'malicious.xhtml.bak',
+        'malicious.xml.tmp',
+      ];
+      for (const filename of filenames) {
+        await expectAsync(
+          request({
+            method: 'POST',
+            url: `http://localhost:8378/1/files/${filename}`,
+            body: JSON.stringify({
+              _ApplicationId: 'test',
+              _JavaScriptKey: 'test',
+              _ContentType: 'image/svg+xml',
+              base64: svgContent,
+            }),
+          }).catch(e => {
+            throw new Error(e.data.error);
+          })
+        ).toBeRejectedWith(
+          new Parse.Error(
+            Parse.Error.FILE_SAVE_ERROR,
+            `File upload of extension svg+xml is disabled.`
+          )
+        );
+      }
+    });
+
+    it('default should block non-standard extension variants preserving a text/html content type', async () => {
+      await reconfigureServer({
+        fileUpload: {
+          enableForPublic: true,
+        },
+      });
+      const htmlContent = Buffer.from('<html><script>alert(1)</script></html>').toString('base64');
+      const filenames = ['malicious.html.old', 'malicious.htm~', 'malicious.html.bak'];
+      for (const filename of filenames) {
+        await expectAsync(
+          request({
+            method: 'POST',
+            url: `http://localhost:8378/1/files/${filename}`,
+            body: JSON.stringify({
+              _ApplicationId: 'test',
+              _JavaScriptKey: 'test',
+              _ContentType: 'text/html',
+              base64: htmlContent,
+            }),
+          }).catch(e => {
+            throw new Error(e.data.error);
+          })
+        ).toBeRejectedWith(
+          new Parse.Error(Parse.Error.FILE_SAVE_ERROR, `File upload of extension html is disabled.`)
+        );
+      }
+    });
+
+    it('default should allow a non-standard extension with a safe content type', async () => {
+      await reconfigureServer({
+        fileUpload: {
+          enableForPublic: true,
+        },
+      });
+      await expectAsync(
+        request({
+          method: 'POST',
+          url: 'http://localhost:8378/1/files/archive.bak',
+          body: JSON.stringify({
+            _ApplicationId: 'test',
+            _JavaScriptKey: 'test',
+            _ContentType: 'image/png',
+            base64: 'ParseA==',
+          }),
+        }).catch(e => {
+          throw new Error(e.data.error);
+        })
+      ).toBeResolved();
+    });
+
    it('works with a period in the file name', async () => {
      await reconfigureServer({
        fileUpload: {
@@ -503,7 +503,7 @@ describe('ParseGraphQLServer', () => {
        }
      });

-      it('should be cors enabled and scope the response within the source origin', async () => {
+      it('should be cors enabled', async () => {
        let checked = false;
        const apolloClient = new ApolloClient({
          link: new ApolloLink((operation, forward) => {
@@ -512,7 +512,7 @@ describe('ParseGraphQLServer', () => {
              const {
                response: { headers },
              } = context;
-              expect(headers.get('access-control-allow-origin')).toEqual('http://example.com');
+              expect(headers.get('access-control-allow-origin')).toEqual('*');
              checked = true;
              return response;
            });
@@ -715,6 +715,115 @@ describe('ParseGraphQLServer', () => {
            })
          expect(introspection.data).toBeDefined();
        });
+
+        it('should strip "Did you mean" field suggestions from validation errors without master or maintenance key', async () => {
+          try {
+            await apolloClient.query({
+              query: gql`
+                query Typo {
+                  healt
+                }
+              `,
+            });
+            fail('should have thrown a validation error');
+          } catch (e) {
+            const message = e.networkError.result.errors[0].message;
+            expect(message).toContain('Cannot query field "healt"');
+            expect(message).not.toMatch(/Did you mean/);
+            expect(message).not.toContain('health');
+          }
+        });
+
+        it('should strip "Did you mean" argument suggestions from validation errors without master or maintenance key', async () => {
+          try {
+            await apolloClient.query({
+              query: gql`
+                query UnknownArg {
+                  users(wher: {}) {
+                    edges {
+                      node {
+                        id
+                      }
+                    }
+                  }
+                }
+              `,
+            });
+            fail('should have thrown a validation error');
+          } catch (e) {
+            const message = e.networkError.result.errors[0].message;
+            expect(message).toContain('Unknown argument "wher"');
+            expect(message).not.toMatch(/Did you mean/);
+            expect(message).not.toContain('"where"');
+          }
+        });
+
+        it('should keep "Did you mean" suggestions with master key', async () => {
+          try {
+            await apolloClient.query({
+              query: gql`
+                query Typo {
+                  healt
+                }
+              `,
+              context: {
+                headers: {
+                  'X-Parse-Master-Key': 'test',
+                },
+              },
+            });
+            fail('should have thrown a validation error');
+          } catch (e) {
+            const message = e.networkError.result.errors[0].message;
+            expect(message).toContain('Cannot query field "healt"');
+            expect(message).toMatch(/Did you mean/);
+            expect(message).toContain('health');
+          }
+        });
+
+        it('should keep "Did you mean" suggestions with maintenance key', async () => {
+          try {
+            await apolloClient.query({
+              query: gql`
+                query Typo {
+                  healt
+                }
+              `,
+              context: {
+                headers: {
+                  'X-Parse-Maintenance-Key': 'test2',
+                },
+              },
+            });
+            fail('should have thrown a validation error');
+          } catch (e) {
+            const message = e.networkError.result.errors[0].message;
+            expect(message).toContain('Cannot query field "healt"');
+            expect(message).toMatch(/Did you mean/);
+            expect(message).toContain('health');
+          }
+        });
+
+        it('should keep "Did you mean" suggestions when public introspection is enabled', async () => {
+          const parseServer = await reconfigureServer();
+          await createGQLFromParseServer(parseServer, { graphQLPublicIntrospection: true });
+
+          try {
+            await apolloClient.query({
+              query: gql`
+                query Typo {
+                  healt
+                }
+              `,
+            });
+            fail('should have thrown a validation error');
+          } catch (e) {
+            const message = e.networkError.result.errors[0].message;
+            expect(message).toContain('Cannot query field "healt"');
+            expect(message).toMatch(/Did you mean/);
+            expect(message).toContain('health');
+          }
+        });
      });


@@ -318,6 +318,76 @@ describe('ParseLiveQueryServer', function () {
    expect(Client.pushError).toHaveBeenCalled();
  });

+  it('rejects field-wrapped deeply nested operators exceeding the query depth limit', async () => {
+    await reconfigureServer({ requestComplexity: { queryDepth: 3 } });
+    const parseLiveQueryServer = new ParseLiveQueryServer({});
+    const clientId = 1;
+    addMockClient(parseLiveQueryServer, clientId);
+    const parseWebSocket = { clientId };
+    // A deep $or hidden inside a field-level $elemMatch must still be counted by the
+    // LiveQuery query depth guard (parity with the REST validateQueryDepth fix).
+    let nested = { name: 'x' };
+    for (let i = 0; i < 4; i++) {
+      nested = { $or: [nested] };
+    }
+    const request = {
+      query: { className: 'test', where: { tags: { $elemMatch: nested } }, keys: ['x'] },
+      requestId: 2,
+      sessionToken: 'sessionToken',
+    };
+    await parseLiveQueryServer._handleSubscribe(parseWebSocket, request);
+
+    const Client = require('../lib/LiveQuery/Client').Client;
+    expect(Client.pushError).toHaveBeenCalledWith(
+      jasmine.anything(),
+      Parse.Error.INVALID_QUERY,
+      jasmine.stringMatching(/Query condition nesting depth exceeds maximum allowed depth of 3/),
+      false,
+      2
+    );
+    expect(parseLiveQueryServer.subscriptions.size).toBe(0);
+  });
+
+  it('rejects a non-array value for a logical operator on subscribe', async () => {
+    await reconfigureServer({ requestComplexity: { queryDepth: 3 } });
+    const parseLiveQueryServer = new ParseLiveQueryServer({});
+    const clientId = 1;
+    addMockClient(parseLiveQueryServer, clientId);
+    const parseWebSocket = { clientId };
+    const request = {
+      query: { className: 'test', where: { $or: 'not-an-array' }, keys: ['x'] },
+      requestId: 3,
+      sessionToken: 'sessionToken',
+    };
+    await parseLiveQueryServer._handleSubscribe(parseWebSocket, request);
+
+    const Client = require('../lib/LiveQuery/Client').Client;
+    expect(Client.pushError).toHaveBeenCalledWith(
+      jasmine.anything(),
+      Parse.Error.INVALID_QUERY,
+      jasmine.stringMatching(/\$or must be an array/),
+      false,
+      3
+    );
+    expect(parseLiveQueryServer.subscriptions.size).toBe(0);
+  });
+
+  it('allows null values nested in the query within the depth limit', async () => {
+    await reconfigureServer({ requestComplexity: { queryDepth: 3 } });
+    const parseLiveQueryServer = new ParseLiveQueryServer({});
+    const clientId = 1;
+    addMockClient(parseLiveQueryServer, clientId);
+    const parseWebSocket = { clientId };
+    const request = {
+      query: { className: 'test', where: { $or: [{ name: null }] }, keys: ['x'] },
+      requestId: 4,
+      sessionToken: 'sessionToken',
+    };
+    await parseLiveQueryServer._handleSubscribe(parseWebSocket, request);
+
+    expect(parseLiveQueryServer.subscriptions.size).toBe(1);
+  });
+
  it('can handle subscribe command with new query', async () => {
    const parseLiveQueryServer = new ParseLiveQueryServer({});
    // Add mock client
@@ -256,4 +256,293 @@ describe('Parse.Session', () => {
    expect(newSession.createdWith.action).toBe('create');
    expect(newSession.createdWith.authProvider).toBeUndefined();
  });
+
+  it('should reject expiresAt when updating a session via PUT', async () => {
+    const user = await Parse.User.signUp('sessionupdateuser1', 'password');
+    const sessionToken = user.getSessionToken();
+
+    // Get the session objectId
+    const sessionRes = await request({
+      method: 'GET',
+      url: 'http://localhost:8378/1/sessions/me',
+      headers: {
+        'X-Parse-Application-Id': 'test',
+        'X-Parse-REST-API-Key': 'rest',
+        'X-Parse-Session-Token': sessionToken,
+      },
+    });
+    const sessionId = sessionRes.data.objectId;
+    const originalExpiresAt = sessionRes.data.expiresAt;
+
+    // Attempt to overwrite expiresAt via PUT
+    const updateRes = await request({
+      method: 'PUT',
+      url: `http://localhost:8378/1/sessions/${sessionId}`,
+      headers: {
+        'X-Parse-Application-Id': 'test',
+        'X-Parse-REST-API-Key': 'rest',
+        'X-Parse-Session-Token': sessionToken,
+        'Content-Type': 'application/json',
+      },
+      body: {
+        expiresAt: { __type: 'Date', iso: '2099-12-31T23:59:59.000Z' },
+      },
+    }).catch(e => e);
+
+    expect(updateRes.data.code).toBe(Parse.Error.INVALID_KEY_NAME);
+
+    // Verify expiresAt was not changed
+    const verifyRes = await request({
+      method: 'GET',
+      url: 'http://localhost:8378/1/sessions/me',
+      headers: {
+        'X-Parse-Application-Id': 'test',
+        'X-Parse-REST-API-Key': 'rest',
+        'X-Parse-Session-Token': sessionToken,
+      },
+    });
+    expect(verifyRes.data.expiresAt).toEqual(originalExpiresAt);
+  });
+
+  it('should reject createdWith when updating a session via PUT', async () => {
+    const user = await Parse.User.signUp('sessionupdateuser2', 'password');
+    const sessionToken = user.getSessionToken();
+
+    // Get the session objectId
+    const sessionRes = await request({
+      method: 'GET',
+      url: 'http://localhost:8378/1/sessions/me',
+      headers: {
+        'X-Parse-Application-Id': 'test',
+        'X-Parse-REST-API-Key': 'rest',
+        'X-Parse-Session-Token': sessionToken,
+      },
+    });
+    const sessionId = sessionRes.data.objectId;
+    const originalCreatedWith = sessionRes.data.createdWith;
+
+    // Attempt to overwrite createdWith via PUT
+    const updateRes = await request({
+      method: 'PUT',
+      url: `http://localhost:8378/1/sessions/${sessionId}`,
+      headers: {
+        'X-Parse-Application-Id': 'test',
+        'X-Parse-REST-API-Key': 'rest',
+        'X-Parse-Session-Token': sessionToken,
+        'Content-Type': 'application/json',
+      },
+      body: {
+        createdWith: { action: 'attacker', authProvider: 'evil' },
+      },
+    }).catch(e => e);
+
+    expect(updateRes.data.code).toBe(Parse.Error.INVALID_KEY_NAME);
+
+    // Verify createdWith was not changed
+    const verifyRes = await request({
+      method: 'GET',
+      url: 'http://localhost:8378/1/sessions/me',
+      headers: {
+        'X-Parse-Application-Id': 'test',
+        'X-Parse-REST-API-Key': 'rest',
+        'X-Parse-Session-Token': sessionToken,
+      },
+    });
+    expect(verifyRes.data.createdWith).toEqual(originalCreatedWith);
+  });
+
+  it('should allow master key to update expiresAt on a session', async () => {
+    const user = await Parse.User.signUp('sessionupdateuser3', 'password');
+    const sessionToken = user.getSessionToken();
+
+    // Get the session objectId
+    const sessionRes = await request({
+      method: 'GET',
+      url: 'http://localhost:8378/1/sessions/me',
+      headers: {
+        'X-Parse-Application-Id': 'test',
+        'X-Parse-REST-API-Key': 'rest',
+        'X-Parse-Session-Token': sessionToken,
+      },
+    });
+    const sessionId = sessionRes.data.objectId;
+    const farFuture = '2099-12-31T23:59:59.000Z';
+
+    // Master key should be able to update expiresAt
+    await request({
+      method: 'PUT',
+      url: `http://localhost:8378/1/sessions/${sessionId}`,
+      headers: {
+        'X-Parse-Application-Id': 'test',
+        'X-Parse-Master-Key': 'test',
+        'Content-Type': 'application/json',
+      },
+      body: {
+        expiresAt: { __type: 'Date', iso: farFuture },
+      },
+    });
+
+    // Verify expiresAt was changed
+    const verifyRes = await request({
+      method: 'GET',
+      url: `http://localhost:8378/1/sessions/${sessionId}`,
+      headers: {
+        'X-Parse-Application-Id': 'test',
+        'X-Parse-Master-Key': 'test',
+      },
+    });
+    expect(verifyRes.data.expiresAt.iso).toBe(farFuture);
+  });
+
+  it('should reject null expiresAt when updating a session via PUT', async () => {
+    const user = await Parse.User.signUp('sessionupdatenull1', 'password');
+    const sessionToken = user.getSessionToken();
+
+    const sessionRes = await request({
+      method: 'GET',
+      url: 'http://localhost:8378/1/sessions/me',
+      headers: {
+        'X-Parse-Application-Id': 'test',
+        'X-Parse-REST-API-Key': 'rest',
+        'X-Parse-Session-Token': sessionToken,
+      },
+    });
+    const sessionId = sessionRes.data.objectId;
+    const originalExpiresAt = sessionRes.data.expiresAt;
+
+    const updateRes = await request({
+      method: 'PUT',
+      url: `http://localhost:8378/1/sessions/${sessionId}`,
+      headers: {
+        'X-Parse-Application-Id': 'test',
+        'X-Parse-REST-API-Key': 'rest',
+        'X-Parse-Session-Token': sessionToken,
+        'Content-Type': 'application/json',
+      },
+      body: {
+        expiresAt: null,
+      },
+    }).catch(e => e);
+
+    expect(updateRes.data.code).toBe(Parse.Error.INVALID_KEY_NAME);
+
+    const verifyRes = await request({
+      method: 'GET',
+      url: 'http://localhost:8378/1/sessions/me',
+      headers: {
+        'X-Parse-Application-Id': 'test',
+        'X-Parse-REST-API-Key': 'rest',
+        'X-Parse-Session-Token': sessionToken,
+      },
+    });
+    expect(verifyRes.data.expiresAt).toEqual(originalExpiresAt);
+  });
+
+  it('should reject null createdWith when updating a session via PUT', async () => {
+    const user = await Parse.User.signUp('sessionupdatenull2', 'password');
+    const sessionToken = user.getSessionToken();
+
+    const sessionRes = await request({
+      method: 'GET',
+      url: 'http://localhost:8378/1/sessions/me',
+      headers: {
+        'X-Parse-Application-Id': 'test',
+        'X-Parse-REST-API-Key': 'rest',
+        'X-Parse-Session-Token': sessionToken,
+      },
+    });
+    const sessionId = sessionRes.data.objectId;
+    const originalCreatedWith = sessionRes.data.createdWith;
+
+    const updateRes = await request({
+      method: 'PUT',
+      url: `http://localhost:8378/1/sessions/${sessionId}`,
+      headers: {
+        'X-Parse-Application-Id': 'test',
+        'X-Parse-REST-API-Key': 'rest',
+        'X-Parse-Session-Token': sessionToken,
+        'Content-Type': 'application/json',
+      },
+      body: {
+        createdWith: null,
+      },
+    }).catch(e => e);
+
+    expect(updateRes.data.code).toBe(Parse.Error.INVALID_KEY_NAME);
+
+    const verifyRes = await request({
+      method: 'GET',
+      url: 'http://localhost:8378/1/sessions/me',
+      headers: {
+        'X-Parse-Application-Id': 'test',
+        'X-Parse-REST-API-Key': 'rest',
+        'X-Parse-Session-Token': sessionToken,
+      },
+    });
+    expect(verifyRes.data.createdWith).toEqual(originalCreatedWith);
+  });
+
+  it('should reject null installationId when updating a session via PUT', async () => {
+    const user = await Parse.User.signUp('sessionupdatenull3', 'password');
+    const sessionToken = user.getSessionToken();
+
+    const sessionRes = await request({
+      method: 'GET',
+      url: 'http://localhost:8378/1/sessions/me',
+      headers: {
+        'X-Parse-Application-Id': 'test',
+        'X-Parse-REST-API-Key': 'rest',
+        'X-Parse-Session-Token': sessionToken,
+      },
+    });
+    const sessionId = sessionRes.data.objectId;
+
+    const updateRes = await request({
+      method: 'PUT',
+      url: `http://localhost:8378/1/sessions/${sessionId}`,
+      headers: {
+        'X-Parse-Application-Id': 'test',
+        'X-Parse-REST-API-Key': 'rest',
+        'X-Parse-Session-Token': sessionToken,
+        'Content-Type': 'application/json',
+      },
+      body: {
+        installationId: null,
+      },
+    }).catch(e => e);
+
+    expect(updateRes.data.code).toBe(Parse.Error.INVALID_KEY_NAME);
+  });
+
+  it('should reject null sessionToken when updating a session via PUT', async () => {
+    const user = await Parse.User.signUp('sessionupdatenull4', 'password');
+    const sessionToken = user.getSessionToken();
+
+    const sessionRes = await request({
+      method: 'GET',
+      url: 'http://localhost:8378/1/sessions/me',
+      headers: {
+        'X-Parse-Application-Id': 'test',
+        'X-Parse-REST-API-Key': 'rest',
+        'X-Parse-Session-Token': sessionToken,
+      },
+    });
+    const sessionId = sessionRes.data.objectId;
+
+    const updateRes = await request({
+      method: 'PUT',
+      url: `http://localhost:8378/1/sessions/${sessionId}`,
+      headers: {
+        'X-Parse-Application-Id': 'test',
+        'X-Parse-REST-API-Key': 'rest',
+        'X-Parse-Session-Token': sessionToken,
+        'Content-Type': 'application/json',
+      },
+      body: {
+        sessionToken: null,
+      },
+    }).catch(e => e);
+
+    expect(updateRes.data.code).toBe(Parse.Error.INVALID_KEY_NAME);
+  });
 });
@@ -81,6 +81,29 @@ describe('Parse.User testing', () => {
    }
  });

+  it('normalizes login response time for non-existent and existing users', async () => {
+    const passwordCrypto = require('../lib/password');
+    const compareSpy = spyOn(passwordCrypto, 'compare').and.callThrough();
+    await Parse.User.signUp('existinguser', 'password123');
+    compareSpy.calls.reset();
+
+    // Login with non-existent user — should use dummy hash
+    await expectAsync(
+      Parse.User.logIn('nonexistentuser', 'wrongpassword')
+    ).toBeRejected();
+    expect(compareSpy).toHaveBeenCalledTimes(1);
+    expect(compareSpy).toHaveBeenCalledWith('wrongpassword', passwordCrypto.dummyHash);
+    compareSpy.calls.reset();
+
+    // Login with existing user but wrong password — should use real hash
+    await expectAsync(
+      Parse.User.logIn('existinguser', 'wrongpassword')
+    ).toBeRejected();
+    expect(compareSpy).toHaveBeenCalledTimes(1);
+    expect(compareSpy.calls.mostRecent().args[0]).toBe('wrongpassword');
+    expect(compareSpy.calls.mostRecent().args[1]).not.toBe(passwordCrypto.dummyHash);
+  });
+
  it('user login with context', async () => {
    let hit = 0;
    const context = { foo: 'bar' };
@@ -37,6 +37,30 @@ describe('request complexity', () => {
    return where;
  }

+  function buildNestedOrQuery(depth) {
+    let where = { username: 'test' };
+    for (let i = 0; i < depth; i++) {
+      where = { $or: [where, { username: 'test' }] };
+    }
+    return where;
+  }
+
+  function buildNestedAndQuery(depth) {
+    let where = { username: 'test' };
+    for (let i = 0; i < depth; i++) {
+      where = { $and: [where, { username: 'test' }] };
+    }
+    return where;
+  }
+
+  function buildNestedNorQuery(depth) {
+    let where = { username: 'test' };
+    for (let i = 0; i < depth; i++) {
+      where = { $nor: [where, { username: 'test' }] };
+    }
+    return where;
+  }
+
  describe('config validation', () => {
    it('should accept valid requestComplexity config', async () => {
      await expectAsync(
@@ -45,6 +69,7 @@ describe('request complexity', () => {
            includeDepth: 10,
            includeCount: 100,
            subqueryDepth: 5,
+            queryDepth: 10,
            graphQLDepth: 15,
            graphQLFields: 300,
          },
@@ -59,6 +84,7 @@ describe('request complexity', () => {
            includeDepth: -1,
            includeCount: -1,
            subqueryDepth: -1,
+            queryDepth: -1,
            graphQLDepth: -1,
            graphQLFields: -1,
          },
@@ -110,21 +136,23 @@ describe('request complexity', () => {
      });
      const config = Config.get('test');
      expect(config.requestComplexity.includeDepth).toBe(3);
-      expect(config.requestComplexity.includeCount).toBe(50);
-      expect(config.requestComplexity.subqueryDepth).toBe(5);
-      expect(config.requestComplexity.graphQLDepth).toBe(50);
-      expect(config.requestComplexity.graphQLFields).toBe(200);
+      expect(config.requestComplexity.includeCount).toBe(-1);
+      expect(config.requestComplexity.subqueryDepth).toBe(-1);
+      expect(config.requestComplexity.queryDepth).toBe(-1);
+      expect(config.requestComplexity.graphQLDepth).toBe(-1);
+      expect(config.requestComplexity.graphQLFields).toBe(-1);
    });

    it('should apply full defaults when not configured', async () => {
      await reconfigureServer({});
      const config = Config.get('test');
      expect(config.requestComplexity).toEqual({
-        includeDepth: 5,
-        includeCount: 50,
-        subqueryDepth: 5,
-        graphQLDepth: 50,
-        graphQLFields: 200,
+        includeDepth: -1,
+        includeCount: -1,
+        subqueryDepth: -1,
+        queryDepth: -1,
+        graphQLDepth: -1,
+        graphQLFields: -1,
      });
    });
  });
@@ -216,6 +244,195 @@ describe('request complexity', () => {
    });
  });

+  describe('query depth', () => {
+    let config;
+
+    beforeEach(async () => {
+      await reconfigureServer({
+        requestComplexity: { queryDepth: 3 },
+      });
+      config = Config.get('test');
+    });
+
+    it('should allow $or within depth limit', async () => {
+      const where = buildNestedOrQuery(3);
+      await expectAsync(
+        rest.find(config, auth.nobody(config), '_User', where)
+      ).toBeResolved();
+    });
+
+    it('should reject $or exceeding depth limit', async () => {
+      const where = buildNestedOrQuery(4);
+      await expectAsync(
+        rest.find(config, auth.nobody(config), '_User', where)
+      ).toBeRejectedWith(
+        jasmine.objectContaining({
+          message: jasmine.stringMatching(/Query condition nesting depth exceeds maximum allowed depth of 3/),
+        })
+      );
+    });
+
+    it('should reject $and exceeding depth limit', async () => {
+      const where = buildNestedAndQuery(4);
+      await expectAsync(
+        rest.find(config, auth.nobody(config), '_User', where)
+      ).toBeRejectedWith(
+        jasmine.objectContaining({
+          message: jasmine.stringMatching(/Query condition nesting depth exceeds maximum allowed depth of 3/),
+        })
+      );
+    });
+
+    it('should reject $nor exceeding depth limit', async () => {
+      const where = buildNestedNorQuery(4);
+      await expectAsync(
+        rest.find(config, auth.nobody(config), '_User', where)
+      ).toBeRejectedWith(
+        jasmine.objectContaining({
+          message: jasmine.stringMatching(/Query condition nesting depth exceeds maximum allowed depth of 3/),
+        })
+      );
+    });
+
+    it('should reject mixed nested operators exceeding depth limit', async () => {
+      // $or > $and > $nor > $or = depth 4
+      const where = {
+        $or: [
+          {
+            $and: [
+              {
+                $nor: [
+                  { $or: [{ username: 'a' }, { username: 'b' }] },
+                ],
+              },
+            ],
+          },
+        ],
+      };
+      await expectAsync(
+        rest.find(config, auth.nobody(config), '_User', where)
+      ).toBeRejectedWith(
+        jasmine.objectContaining({
+          message: jasmine.stringMatching(/Query condition nesting depth exceeds maximum allowed depth of 3/),
+        })
+      );
+    });
+
+    it('should allow with master key even when exceeding limit', async () => {
+      const where = buildNestedOrQuery(4);
+      await expectAsync(
+        rest.find(config, auth.master(config), '_User', where)
+      ).toBeResolved();
+    });
+
+    it('should allow with maintenance key even when exceeding limit', async () => {
+      const where = buildNestedOrQuery(4);
+      await expectAsync(
+        rest.find(config, auth.maintenance(config), '_User', where)
+      ).toBeResolved();
+    });
+
+    it('should allow unlimited when queryDepth is -1', async () => {
+      await reconfigureServer({
+        requestComplexity: { queryDepth: -1 },
+      });
+      config = Config.get('test');
+      const where = buildNestedOrQuery(15);
+      await expectAsync(
+        rest.find(config, auth.nobody(config), '_User', where)
+      ).toBeResolved();
+    });
+  });
+
+  describe('query depth bypass via field-wrapped operators', () => {
+    let config;
+
+    function buildDeepOr(depth) {
+      let where = { username: 'test' };
+      for (let i = 0; i < depth; i++) {
+        where = { $or: [where] };
+      }
+      return where;
+    }
+
+    beforeEach(async () => {
+      await reconfigureServer({
+        requestComplexity: { queryDepth: 3 },
+      });
+      config = Config.get('test');
+    });
+
+    it('should reject a deeply nested $or wrapped in $elemMatch exceeding depth limit', async () => {
+      const where = { username: { $elemMatch: buildDeepOr(4) } };
+      await expectAsync(
+        rest.find(config, auth.nobody(config), '_User', where)
+      ).toBeRejectedWith(
+        jasmine.objectContaining({
+          message: jasmine.stringMatching(/Query condition nesting depth exceeds maximum allowed depth of 3/),
+        })
+      );
+    });
+
+    it('should reject a deeply nested $or wrapped in $not exceeding depth limit', async () => {
+      const where = { username: { $not: buildDeepOr(4) } };
+      await expectAsync(
+        rest.find(config, auth.nobody(config), '_User', where)
+      ).toBeRejectedWith(
+        jasmine.objectContaining({
+          message: jasmine.stringMatching(/Query condition nesting depth exceeds maximum allowed depth of 3/),
+        })
+      );
+    });
+
+    it('should reject a deeply nested $or wrapped under a plain field name exceeding depth limit', async () => {
+      const where = { metadata: buildDeepOr(4) };
+      await expectAsync(
+        rest.find(config, auth.nobody(config), '_User', where)
+      ).toBeRejectedWith(
+        jasmine.objectContaining({
+          message: jasmine.stringMatching(/Query condition nesting depth exceeds maximum allowed depth of 3/),
+        })
+      );
+    });
+
+    it('should allow field-wrapped logical operators within depth limit', async () => {
+      const where = {
+        username: {
+          $inQuery: {
+            className: '_User',
+            where: { $or: [{ username: 'a' }, { username: 'b' }] },
+          },
+        },
+      };
+      await expectAsync(
+        rest.find(config, auth.nobody(config), '_User', where)
+      ).toBeResolved();
+    });
+
+    it('should not count field-level operators that do not nest logical operators toward depth', async () => {
+      const where = { username: { $in: ['a', 'b'] } };
+      await expectAsync(
+        rest.find(config, auth.nobody(config), '_User', where)
+      ).toBeResolved();
+    });
+
+    it('should not exponentially process field-wrapped deeply nested operators when queryDepth is disabled', async () => {
+      // With queryDepth disabled, the depth guard does not run; the walk over the
+      // nested $or arrays must still be linear (not O(2^n)) so a single small request
+      // cannot hang the event loop.
+      await reconfigureServer({
+        requestComplexity: { queryDepth: -1 },
+      });
+      config = Config.get('test');
+      const where = { username: { $elemMatch: buildDeepOr(26) } };
+      const start = Date.now();
+      await expectAsync(
+        rest.find(config, auth.nobody(config), '_User', where)
+      ).toBeRejected();
+      expect(Date.now() - start).toBeLessThan(5000);
+    }, 60000);
+  });
+
  describe('include limits', () => {
    let config;

@@ -34,6 +34,14 @@ describe('Security Check Groups', () => {
      config.allowClientClassCreation = false;
      config.enableInsecureAuthAdapters = false;
      config.graphQLPublicIntrospection = false;
+      config.requestComplexity = {
+        includeDepth: 5,
+        includeCount: 50,
+        subqueryDepth: 5,
+        queryDepth: 10,
+        graphQLDepth: 50,
+        graphQLFields: 200,
+      };
      await reconfigureServer(config);

      const group = new CheckGroupServerConfig();
@@ -57,6 +65,7 @@ describe('Security Check Groups', () => {
        includeDepth: -1,
        includeCount: -1,
        subqueryDepth: -1,
+        queryDepth: -1,
        graphQLDepth: -1,
        graphQLFields: -1,
      };
@@ -212,4 +212,25 @@ describe('Utils', () => {
      expect(error.message).toBe('Detailed error message');
    });
  });
+
+  describe('getFileExtension', () => {
+    const cases = [
+      ['file.txt', 'txt'],
+      ['file.tar.gz', 'gz'],
+      ['.hidden', 'hidden'],
+      ['file.', ''],
+      ['file..', ''],
+      ['file', ''],
+      ['', ''],
+      [null, ''],
+      [undefined, ''],
+      ['poc.svg.', ''],
+      ['archive.tar.gz.', ''],
+    ];
+    for (const [input, expected] of cases) {
+      it(`returns ${JSON.stringify(expected)} for ${JSON.stringify(input)}`, () => {
+        expect(Utils.getFileExtension(input)).toBe(expected);
+      });
+    }
+  });
 });
@@ -747,7 +747,7 @@ describe('Custom Pages, Email Verification, Password Reset', () => {
    });
  });

-  it('redirects you to link send fail page if you try to resend a link for a nonexistant user', done => {
+  it('redirects you to link send success page if you try to resend a link for a nonexistent user', done => {
    reconfigureServer({
      appName: 'emailing app',
      verifyUserEmails: true,
@@ -757,6 +757,37 @@ describe('Custom Pages, Email Verification, Password Reset', () => {
        sendMail: () => {},
      },
      publicServerURL: 'http://localhost:8378/1',
+    }).then(() => {
+      request({
+        url: 'http://localhost:8378/1/apps/test/resend_verification_email',
+        method: 'POST',
+        followRedirects: false,
+        body: {
+          username: 'sadfasga',
+        },
+      }).then(response => {
+        expect(response.status).toEqual(302);
+        // With emailVerifySuccessOnInvalidEmail: true (default), the resend
+        // page redirects to success to prevent user enumeration
+        expect(response.text).toEqual(
+          'Found. Redirecting to http://localhost:8378/1/apps/link_send_success.html'
+        );
+        done();
+      });
+    });
+  });
+
+  it('redirects you to link send fail page if you try to resend a link for a nonexistent user with emailVerifySuccessOnInvalidEmail disabled', done => {
+    reconfigureServer({
+      appName: 'emailing app',
+      verifyUserEmails: true,
+      emailVerifySuccessOnInvalidEmail: false,
+      emailAdapter: {
+        sendVerificationEmail: () => Promise.resolve(),
+        sendPasswordResetEmail: () => Promise.resolve(),
+        sendMail: () => {},
+      },
+      publicServerURL: 'http://localhost:8378/1',
    }).then(() => {
      request({
        url: 'http://localhost:8378/1/apps/test/resend_verification_email',
@@ -304,11 +304,11 @@ function transformQueryKeyValue(className, key, value, schema, count = false) {
      return { key: 'times_used', value: value };
    default: {
      // Other auth data
-      const authDataMatch = key.match(/^authData\.([a-zA-Z0-9_]+)\.id$/);
+      const authDataMatch = key.match(/^authData\.([a-zA-Z0-9_]+)(\.(.+))?$/);
      if (authDataMatch && className === '_User') {
        const provider = authDataMatch[1];
-        // Special-case auth data.
-        return { key: `_auth_data_${provider}.id`, value };
+        const subField = authDataMatch[3];
+        return { key: `_auth_data_${provider}${subField ? `.${subField}` : ''}`, value };
      }
    }
  }
@@ -233,6 +233,12 @@ const transformDotField = fieldName => {
  return name;
 };

+const validateAggregateFieldName = name => {
+  if (typeof name !== 'string' || !name.match(/^[a-zA-Z][a-zA-Z0-9_]*$/)) {
+    throw new Parse.Error(Parse.Error.INVALID_KEY_NAME, `Invalid field name: ${name}`);
+  }
+};
+
 const transformAggregateField = fieldName => {
  if (typeof fieldName !== 'string') {
    return fieldName;
@@ -243,7 +249,12 @@ const transformAggregateField = fieldName => {
  if (fieldName === '$_updated_at') {
    return 'updatedAt';
  }
-  return fieldName.substring(1);
+  if (!fieldName.startsWith('$')) {
+    throw new Parse.Error(Parse.Error.INVALID_KEY_NAME, `Invalid field name: ${fieldName}`);
+  }
+  const name = fieldName.substring(1);
+  validateAggregateFieldName(name);
+  return name;
 };

 const validateKeys = object => {
@@ -328,6 +339,14 @@ const buildWhereClause = ({ schema, query, index, caseInsensitive }): WhereClaus
          patterns.push(`$${index}:raw = $${index + 1}::text`);
          values.push(name, fieldValue);
          index += 2;
+        } else if (
+          typeof fieldValue === 'object' &&
+          !Object.keys(fieldValue).some(key => key.startsWith('$'))
+        ) {
+          name = transformDotFieldToComponents(fieldName).join('->');
+          patterns.push(`($${index}:raw)::jsonb = $${index + 1}::jsonb`);
+          values.push(name, JSON.stringify(fieldValue));
+          index += 2;
        }
      }
    } else if (fieldValue === null || fieldValue === undefined) {
@@ -2157,12 +2176,18 @@ export class PostgresStorageAdapter implements StorageAdapter {

  async distinct(className: string, schema: SchemaType, query: QueryType, fieldName: string) {
    debug('distinct');
+    const fieldSegments = fieldName.split('.');
+    for (const segment of fieldSegments) {
+      if (!segment.match(/^[a-zA-Z][a-zA-Z0-9_]*$/)) {
+        throw new Parse.Error(Parse.Error.INVALID_KEY_NAME, `Invalid field name: ${fieldName}`);
+      }
+    }
    let field = fieldName;
    let column = fieldName;
    const isNested = fieldName.indexOf('.') >= 0;
    if (isNested) {
      field = transformDotFieldToComponents(fieldName).join('->');
-      column = fieldName.split('.')[0];
+      column = fieldSegments[0];
    }
    const isArrayField =
      schema.fields && schema.fields[fieldName] && schema.fields[fieldName].type === 'Array';
@@ -424,7 +424,13 @@ const findUsersWithAuthData = async (config, authData, beforeFind) => {
    providers.map(async provider => {
      const providerAuthData = authData[provider];

-      const adapter = config.authDataManager.getValidatorForProvider(provider)?.adapter;
+      const validatorConfig = config.authDataManager.getValidatorForProvider(provider);
+      // Skip database query for unconfigured providers to avoid unindexed collection scans;
+      // the provider will be rejected later in handleAuthDataValidation with UNSUPPORTED_SERVICE
+      if (!validatorConfig?.validator) {
+        return null;
+      }
+      const adapter = validatorConfig.adapter;
      if (beforeFind && typeof adapter?.beforeFind === 'function') {
        await adapter.beforeFind(providerAuthData);
      }
@@ -0,0 +1,47 @@
+// Apply optimistic locking for authData provider field changes. For each lockable
+// top-level field in the original authData whose value differs from the incoming
+// value, add an equality constraint for the original value to the update WHERE
+// clause. Concurrent requests racing the same single-use token will only allow the
+// first update to match; subsequent updates miss and surface as OBJECT_NOT_FOUND.
+//
+// Only fields whose values round-trip cleanly through both storage adapters are
+// locked: primitives (string, number, boolean) and arrays. Date values and nested
+// objects are skipped because their JSON representation differs between the
+// MongoDB and Postgres adapters, and because Parse Server's query-key validator
+// rejects deeper paths containing characters like `+` (e.g. phone-number keys).
+// Locking the consumed single-use credential (the MFA token string or the
+// recovery-code array) is sufficient — its removal invalidates the WHERE clause
+// for concurrent writers.
+export function applyAuthDataOptimisticLock(query, originalAuthData, newAuthData) {
+  if (!originalAuthData) {
+    return;
+  }
+  for (const provider of Object.keys(newAuthData)) {
+    const original = originalAuthData[provider];
+    if (!original || typeof original !== 'object') {
+      continue;
+    }
+    for (const [field, value] of Object.entries(original)) {
+      if (!isLockableAuthDataValue(value)) {
+        continue;
+      }
+      if (JSON.stringify(value) !== JSON.stringify(newAuthData[provider]?.[field])) {
+        query[`authData.${provider}.${field}`] = value;
+      }
+    }
+  }
+}
+
+function isLockableAuthDataValue(value) {
+  if (value === null || value === undefined) {
+    return false;
+  }
+  const t = typeof value;
+  if (t === 'string' || t === 'number' || t === 'boolean') {
+    return true;
+  }
+  if (Array.isArray(value)) {
+    return true;
+  }
+  return false;
+}
@@ -1,40 +0,0 @@
-var semver = require('semver');
-
-function compatible(compatibleSDK) {
-  return function (clientSDK) {
-    if (typeof clientSDK === 'string') {
-      clientSDK = fromString(clientSDK);
-    }
-    // REST API, or custom SDK
-    if (!clientSDK) {
-      return true;
-    }
-    const clientVersion = clientSDK.version;
-    const compatiblityVersion = compatibleSDK[clientSDK.sdk];
-    return semver.satisfies(clientVersion, compatiblityVersion);
-  };
-}
-
-function supportsForwardDelete(clientSDK) {
-  return compatible({
-    js: '>=1.9.0',
-  })(clientSDK);
-}
-
-function fromString(version) {
-  const versionRE = /([-a-zA-Z]+)([0-9\.]+)/;
-  const match = version.toLowerCase().match(versionRE);
-  if (match && match.length === 3) {
-    return {
-      sdk: match[1],
-      version: match[2],
-    };
-  }
-  return undefined;
-}
-
-module.exports = {
-  compatible,
-  supportsForwardDelete,
-  fromString,
-};
@@ -8,8 +8,6 @@ import { Parse } from 'parse/node';
 import _ from 'lodash';
 // @flow-disable-next
 import intersect from 'intersect';
-// @flow-disable-next
-import deepcopy from 'deepcopy';
 import logger from '../logger';
 import Utils from '../Utils';
 import * as SchemaController from './SchemaController';
@@ -75,18 +73,27 @@ const validateQuery = (
  query: any,
  isMaster: boolean,
  isMaintenance: boolean,
-  update: boolean
+  update: boolean,
+  options: ?ParseServerOptions,
+  _depth: number = 0
 ): void => {
  if (isMaintenance) {
    isMaster = true;
  }
+  const rc = options?.requestComplexity;
+  if (!isMaster && rc && rc.queryDepth !== -1 && _depth > rc.queryDepth) {
+    throw new Parse.Error(
+      Parse.Error.INVALID_QUERY,
+      `Query condition nesting depth exceeds maximum allowed depth of ${rc.queryDepth}`
+    );
+  }
  if (query.ACL) {
    throw new Parse.Error(Parse.Error.INVALID_QUERY, 'Cannot query on ACL.');
  }

  if (query.$or) {
    if (query.$or instanceof Array) {
-      query.$or.forEach(value => validateQuery(value, isMaster, isMaintenance, update));
+      query.$or.forEach(value => validateQuery(value, isMaster, isMaintenance, update, options, _depth + 1));
    } else {
      throw new Parse.Error(Parse.Error.INVALID_QUERY, 'Bad $or format - use an array value.');
    }
@@ -94,7 +101,7 @@ const validateQuery = (

  if (query.$and) {
    if (query.$and instanceof Array) {
-      query.$and.forEach(value => validateQuery(value, isMaster, isMaintenance, update));
+      query.$and.forEach(value => validateQuery(value, isMaster, isMaintenance, update, options, _depth + 1));
    } else {
      throw new Parse.Error(Parse.Error.INVALID_QUERY, 'Bad $and format - use an array value.');
    }
@@ -102,7 +109,7 @@ const validateQuery = (

  if (query.$nor) {
    if (query.$nor instanceof Array && query.$nor.length > 0) {
-      query.$nor.forEach(value => validateQuery(value, isMaster, isMaintenance, update));
+      query.$nor.forEach(value => validateQuery(value, isMaster, isMaintenance, update, options, _depth + 1));
    } else {
      throw new Parse.Error(
        Parse.Error.INVALID_QUERY,
@@ -505,7 +512,7 @@ class DatabaseController {
    const originalQuery = query;
    const originalUpdate = update;
    // Make a copy of the object, so we don't mutate the incoming data.
-    update = deepcopy(update);
+    update = structuredClone(update);
    var relationUpdates = [];
    var isMaster = acl === undefined;
    var aclGroup = acl || [];
@@ -547,7 +554,7 @@ class DatabaseController {
          if (acl) {
            query = addWriteACL(query, acl);
          }
-          validateQuery(query, isMaster, false, true);
+          validateQuery(query, isMaster, false, true, this.options);
          return schemaController
            .getOneSchema(className, true)
            .catch(error => {
@@ -795,7 +802,7 @@ class DatabaseController {
        if (acl) {
          query = addWriteACL(query, acl);
        }
-        validateQuery(query, isMaster, false, false);
+        validateQuery(query, isMaster, false, false, this.options);
        return schemaController
          .getOneSchema(className)
          .catch(error => {
@@ -1067,38 +1074,169 @@ class DatabaseController {

  // Modifies query so that it no longer has $relatedTo
  // Returns a promise that resolves when query is mutated
-  reduceRelationKeys(className: string, query: any, queryOptions: any): ?Promise<void> {
+  reduceRelationKeys(
+    className: string,
+    query: any,
+    queryOptions: any,
+    auth: any = {},
+    aclGroup: any[] = [],
+    isMaster: boolean = false,
+    schemaController: ?SchemaController.SchemaController
+  ): ?Promise<void> {
    if (query['$or']) {
      return Promise.all(
        query['$or'].map(aQuery => {
-          return this.reduceRelationKeys(className, aQuery, queryOptions);
+          return this.reduceRelationKeys(
+            className,
+            aQuery,
+            queryOptions,
+            auth,
+            aclGroup,
+            isMaster,
+            schemaController
+          );
        })
      );
    }
    if (query['$and']) {
      return Promise.all(
        query['$and'].map(aQuery => {
-          return this.reduceRelationKeys(className, aQuery, queryOptions);
+          return this.reduceRelationKeys(
+            className,
+            aQuery,
+            queryOptions,
+            auth,
+            aclGroup,
+            isMaster,
+            schemaController
+          );
+        })
+      );
+    }
+    if (Array.isArray(query['$nor'])) {
+      // Guard with Array.isArray (unlike the legacy $or/$and checks above) so a
+      // malformed non-array $nor still falls through to validateQuery and yields
+      // the existing INVALID_QUERY error instead of throwing here.
+      return Promise.all(
+        query['$nor'].map(aQuery => {
+          return this.reduceRelationKeys(
+            className,
+            aQuery,
+            queryOptions,
+            auth,
+            aclGroup,
+            isMaster,
+            schemaController
+          );
        })
      );
    }
    var relatedTo = query['$relatedTo'];
    if (relatedTo) {
-      return this.relatedIds(
-        relatedTo.object.className,
-        relatedTo.key,
-        relatedTo.object.objectId,
-        queryOptions
-      )
-        .then(ids => {
+      return this.authorizeRelatedToQuery(relatedTo, auth, aclGroup, isMaster, schemaController)
+        .then(canReadOwningObject => {
          delete query['$relatedTo'];
-          this.addInObjectIdsIds(ids, query);
-          return this.reduceRelationKeys(className, query, queryOptions);
+          if (!canReadOwningObject) {
+            // The caller is not allowed to read the owning object, so the
+            // relation must not disclose any linked objects (and must not act
+            // as a membership oracle for a known related id).
+            this.addInObjectIdsIds([], query);
+            return this.reduceRelationKeys(
+              className,
+              query,
+              queryOptions,
+              auth,
+              aclGroup,
+              isMaster,
+              schemaController
+            );
+          }
+          return this.relatedIds(
+            relatedTo.object.className,
+            relatedTo.key,
+            relatedTo.object.objectId,
+            queryOptions
+          ).then(ids => {
+            this.addInObjectIdsIds(ids, query);
+            return this.reduceRelationKeys(
+              className,
+              query,
+              queryOptions,
+              auth,
+              aclGroup,
+              isMaster,
+              schemaController
+            );
+          });
        })
        .then(() => {});
    }
  }

+  // Authorizes a `$relatedTo` relation query against the owning object before
+  // its join table is read by `relatedIds`. Without this check, `$relatedTo`
+  // bypasses both `protectedFields` and the owning object's ACL/CLP, because
+  // the downstream protected-field and ACL filters only apply to the queried
+  // (target) class, never to the owning class referenced by `$relatedTo`.
+  //
+  // - Throws `OPERATION_FORBIDDEN` if the relation key is a protected field on
+  //   the owning class for the caller's auth context (mirrors the protected
+  //   WHERE-field denial in `RestQuery.denyProtectedFields`).
+  // - Resolves to `true` if the caller may read the owning object (so the join
+  //   table read may proceed), or `false` otherwise (so the relation yields no
+  //   results and cannot be used as a membership oracle).
+  //
+  // Master and maintenance requests bypass both checks by design.
+  authorizeRelatedToQuery(
+    relatedTo: any,
+    auth: any = {},
+    aclGroup: any[] = [],
+    isMaster: boolean = false,
+    schemaController: ?SchemaController.SchemaController
+  ): Promise<boolean> {
+    if (isMaster) {
+      return Promise.resolve(true);
+    }
+    const owningClassName = relatedTo && relatedTo.object && relatedTo.object.className;
+    const owningId = relatedTo && relatedTo.object && relatedTo.object.objectId;
+    const relationKey = relatedTo && relatedTo.key;
+    return this.loadSchemaIfNeeded(schemaController).then(loadedSchema => {
+      // 1. The relation key must not be a protected field on the owning class.
+      const protectedFields =
+        this.addProtectedFields(loadedSchema, owningClassName, {}, aclGroup, auth) || [];
+      const rootField = typeof relationKey === 'string' ? relationKey.split('.')[0] : relationKey;
+      if (protectedFields.includes(relationKey) || protectedFields.includes(rootField)) {
+        throw createSanitizedError(
+          Parse.Error.OPERATION_FORBIDDEN,
+          `This user is not allowed to query ${relationKey} on class ${owningClassName}`,
+          this.options
+        );
+      }
+      // 2. The caller must be able to read the owning object itself. A read with
+      //    the caller's auth context applies the owning class CLP, the object
+      //    ACL and pointer permissions. Any "not authorized" or "not found"
+      //    outcome maps to "cannot read", so the relation returns no results.
+      return this.find(
+        owningClassName,
+        { objectId: owningId },
+        { acl: aclGroup, limit: 1, keys: ['objectId'], op: 'get' },
+        auth,
+        loadedSchema
+      )
+        .then(results => Array.isArray(results) && results.length > 0)
+        .catch(error => {
+          if (
+            error instanceof Parse.Error &&
+            (error.code === Parse.Error.OPERATION_FORBIDDEN ||
+              error.code === Parse.Error.OBJECT_NOT_FOUND)
+          ) {
+            return false;
+          }
+          throw error;
+        });
+    });
+  }
+
  addInObjectIdsIds(ids: ?Array<string> = null, query: any) {
    const idsFromString: ?Array<string> =
      typeof query.objectId === 'string' ? [query.objectId] : null;
@@ -1262,7 +1400,17 @@ class DatabaseController {
            ? Promise.resolve()
            : schemaController.validatePermission(className, aclGroup, op)
          )
-            .then(() => this.reduceRelationKeys(className, query, queryOptions))
+            .then(() =>
+              this.reduceRelationKeys(
+                className,
+                query,
+                queryOptions,
+                auth,
+                aclGroup,
+                isMaster,
+                schemaController
+              )
+            )
            .then(() => this.reduceInRelation(className, query, schemaController))
            .then(() => {
              let protectedFields;
@@ -1300,7 +1448,7 @@ class DatabaseController {
                  query = addReadACL(query, aclGroup);
                }
              }
-              validateQuery(query, isMaster, isMaintenance, false);
+              validateQuery(query, isMaster, isMaintenance, false, this.options);
              if (count) {
                if (!classExists) {
                  return 0;
@@ -2,8 +2,8 @@
 import { randomHexString } from '../cryptoUtils';
 import AdaptableController from './AdaptableController';
 import { validateFilename, FilesAdapter } from '../Adapters/Files/FilesAdapter';
-import path from 'path';
 const Parse = require('parse').Parse;
+const Utils = require('../Utils');

 const legacyFilesRegex = new RegExp(
  '^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}-.*'
@@ -15,14 +15,15 @@ export class FilesController extends AdaptableController {
  }

  async createFile(config, filename, data, contentType, options) {
-    const extname = path.extname(filename);
-
+    const extname = Utils.getFileExtension(filename);
    const hasExtension = extname.length > 0;
    const mime = (await import('mime')).default
    if (!hasExtension && contentType && mime.getExtension(contentType)) {
-      filename = filename + '.' + mime.getExtension(contentType);
-    } else if (hasExtension && !contentType) {
-      contentType = mime.getType(filename);
+      // Avoid producing a doubled dot when the filename already ends in one
+      const separator = filename.endsWith('.') ? '' : '.';
+      filename = filename + separator + mime.getExtension(contentType);
+    } else if (hasExtension) {
+      contentType = mime.getType(filename) || contentType;
    }

    if (!this.options.preserveFileName) {
@@ -21,8 +21,6 @@ import SchemaCache from '../Adapters/Cache/SchemaCache';
 import DatabaseController from './DatabaseController';
 import Config from '../Config';
 import { createSanitizedError } from '../Error';
-// @flow-disable-next
-import deepcopy from 'deepcopy';
 import type {
  Schema,
  SchemaFields,
@@ -573,7 +571,7 @@ class SchemaData {
          if (!this.__data[schema.className]) {
            const data = {};
            data.fields = injectDefaultSchema(schema).fields;
-            data.classLevelPermissions = deepcopy(schema.classLevelPermissions);
+            data.classLevelPermissions = structuredClone(schema.classLevelPermissions);
            data.indexes = schema.indexes;

            const classProtectedFields = this.__protectedFields[schema.className];
@@ -301,7 +301,15 @@ export class UserController extends AdaptableController {
  async updatePassword(token, password) {
    try {
      const rawUser = await this.checkResetTokenValidity(token);
-      const user = await updateUserPassword(rawUser, password, this.config);
+      let user;
+      try {
+        user = await updateUserPassword(rawUser, password, this.config);
+      } catch (error) {
+        if (error && error.code === Parse.Error.OBJECT_NOT_FOUND) {
+          throw 'Failed to reset password: username / email / token is invalid';
+        }
+        throw error;
+      }

      const accountLockoutPolicy = new AccountLockout(user, this.config);
      return await accountLockoutPolicy.unlockAccount();
@@ -353,7 +361,7 @@ function updateUserPassword(user, password, config) {
      config,
      Auth.master(config),
      '_User',
-      { objectId: user.objectId },
+      { objectId: user.objectId, _perishable_token: user._perishable_token },
      {
        password: password,
      }
@@ -19,4 +19,9 @@ module.exports = [
  { optionKey: 'encodeParseObjectInCloudFunction', changeNewDefault: 'true' },
  { optionKey: 'enableInsecureAuthAdapters', changeNewDefault: 'false' },
  { optionKey: 'databaseOptions.allowPublicExplain', changeNewDefault: 'false' },
+  {
+    optionKey: 'allowExpiredAuthDataToken',
+    changeNewKey: '',
+    solution: "Auth providers are always validated on login regardless of this setting. Set 'allowExpiredAuthDataToken' to 'false' or remove the option to accept the future removal.",
+  },
 ];
@@ -1,11 +1,10 @@
-import corsMiddleware from 'cors';
 import graphqlUploadExpress from 'graphql-upload/graphqlUploadExpress.js';
 import { ApolloServer } from '@apollo/server';
 import { expressMiddleware } from '@apollo/server/express4';
 import { ApolloServerPluginCacheControlDisabled } from '@apollo/server/plugin/disabled';
 import express from 'express';
 import { GraphQLError } from 'graphql';
-import { handleParseErrors, handleParseHeaders, handleParseSession } from '../middlewares';
+import { allowCrossDomain, handleParseErrors, handleParseHeaders, handleParseSession } from '../middlewares';
 import requiredParameter from '../requiredParameter';
 import { createComplexityValidationPlugin } from './helpers/queryComplexity';
 import defaultLogger from '../logger';
@@ -51,6 +50,33 @@ const IntrospectionControlPlugin = (publicIntrospection) => ({

 });

+// graphql-js validation rules (FieldsOnCorrectTypeRule, KnownArgumentNamesRule,
+// KnownTypeNamesRule, ...) embed "Did you mean ...?" hints sourced from the live
+// schema in their error messages. Those messages are returned to the caller
+// before didResolveOperation runs, so they sidestep IntrospectionControlPlugin
+// and disclose schema identifiers the introspection guard is meant to hide.
+// Strip the hint suffix for callers that are not allowed to introspect.
+const SchemaSuggestionsControlPlugin = (publicIntrospection) => ({
+  requestDidStart: async (requestContext) => ({
+    validationDidStart: async () => {
+      if (publicIntrospection) {
+        return;
+      }
+      const isMasterOrMaintenance =
+        requestContext.contextValue.auth?.isMaster ||
+        requestContext.contextValue.auth?.isMaintenance;
+      if (isMasterOrMaintenance) {
+        return;
+      }
+      return async (validationErrors) => {
+        validationErrors?.forEach(error => {
+          error.message = error.message.replace(/ ?Did you mean(.+?)\?$/, '');
+        });
+      };
+    },
+  }),
+});
+
 class ParseGraphQLServer {
  parseGraphQLController: ParseGraphQLController;

@@ -76,8 +102,7 @@ class ParseGraphQLServer {
    try {
      return {
        schema: await this.parseGraphQLSchema.load(),
-        context: async ({ req, res }) => {
-          res.set('access-control-allow-origin', req.get('origin') || '*');
+        context: async ({ req }) => {
          return {
            info: req.info,
            config: req.config,
@@ -113,7 +138,7 @@ class ParseGraphQLServer {
            requestHeaders: ['X-Parse-Application-Id'],
          },
          introspection: this.config.graphQLPublicIntrospection,
-          plugins: [ApolloServerPluginCacheControlDisabled(), IntrospectionControlPlugin(this.config.graphQLPublicIntrospection), createComplexityValidationPlugin(() => this.parseServer.config.requestComplexity)],
+          plugins: [ApolloServerPluginCacheControlDisabled(), IntrospectionControlPlugin(this.config.graphQLPublicIntrospection), SchemaSuggestionsControlPlugin(this.config.graphQLPublicIntrospection), createComplexityValidationPlugin(() => this.parseServer.config.requestComplexity)],
          schema,
        });
        await apollo.start();
@@ -162,7 +187,7 @@ class ParseGraphQLServer {
    if (!app || !app.use) {
      requiredParameter('You must provide an Express.js app instance!');
    }
-    app.use(this.config.graphQLPath, corsMiddleware());
+    app.use(this.config.graphQLPath, allowCrossDomain(this.parseServer.config.appId));
    app.use(this.config.graphQLPath, handleParseHeaders);
    app.use(this.config.graphQLPath, handleParseSession);
    this.applyRequestContextMiddleware(app, this.parseServer.config);
@@ -5,8 +5,7 @@ const createObject = async (className, fields, config, auth, info) => {
    fields = {};
  }

-  return (await rest.create(config, auth, className, fields, info.clientSDK, info.context))
-    .response;
+  return (await rest.create(config, auth, className, fields, info.context)).response;
 };

 const updateObject = async (className, objectId, fields, config, auth, info) => {
@@ -14,9 +13,7 @@ const updateObject = async (className, objectId, fields, config, auth, info) =>
    fields = {};
  }

-  return (
-    await rest.update(config, auth, className, { objectId }, fields, info.clientSDK, info.context)
-  ).response;
+  return (await rest.update(config, auth, className, { objectId }, fields, info.context)).response;
 };

 const deleteObject = async (className, objectId, config, auth, info) => {
@@ -69,7 +69,6 @@ const getObject = async (
    className,
    objectId,
    options,
-    info.clientSDK,
    info.context
  );

@@ -131,9 +130,8 @@ const findObjects = async (
    if (Object.keys(where).length > 0 && subqueryReadPreference) {
      preCountOptions.subqueryReadPreference = subqueryReadPreference;
    }
-    preCount = (
-      await rest.find(config, auth, className, where, preCountOptions, info.clientSDK, info.context)
-    ).count;
+    preCount = (await rest.find(config, auth, className, where, preCountOptions, info.context))
+      .count;
    if ((skip || 0) + limit < preCount) {
      skip = preCount - limit;
    }
@@ -199,7 +197,6 @@ const findObjects = async (
      className,
      where,
      options,
-      info.clientSDK,
      info.context
    );
    results = findResult.results;
@@ -1,14 +1,22 @@
 import { GraphQLError } from 'graphql';
 import logger from '../../logger';

-function calculateQueryComplexity(operation, fragments) {
+function calculateQueryComplexity(operation, fragments, limits = {}) {
  let maxDepth = 0;
  let totalFields = 0;
+  const fragmentCache = new Map();
+  const { maxDepth: allowedMaxDepth, maxFields: allowedMaxFields } = limits;

  function visitSelectionSet(selectionSet, depth, visitedFragments) {
    if (!selectionSet) {
      return;
    }
+    if (
+      (allowedMaxFields !== undefined && allowedMaxFields !== -1 && totalFields > allowedMaxFields) ||
+      (allowedMaxDepth !== undefined && allowedMaxDepth !== -1 && maxDepth > allowedMaxDepth)
+    ) {
+      return;
+    }
    for (const selection of selectionSet.selections) {
      if (selection.kind === 'Field') {
        totalFields++;
@@ -23,14 +31,36 @@ function calculateQueryComplexity(operation, fragments) {
        visitSelectionSet(selection.selectionSet, depth, visitedFragments);
      } else if (selection.kind === 'FragmentSpread') {
        const name = selection.name.value;
+        if (fragmentCache.has(name)) {
+          const cached = fragmentCache.get(name);
+          totalFields += cached.fields;
+          const adjustedDepth = depth + cached.maxDepthDelta;
+          if (adjustedDepth > maxDepth) {
+            maxDepth = adjustedDepth;
+          }
+          continue;
+        }
        if (visitedFragments.has(name)) {
          continue;
        }
        const fragment = fragments[name];
        if (fragment) {
-          const branchVisited = new Set(visitedFragments);
-          branchVisited.add(name);
-          visitSelectionSet(fragment.selectionSet, depth, branchVisited);
+          if (
+            (allowedMaxFields !== undefined && allowedMaxFields !== -1 && totalFields > allowedMaxFields) ||
+            (allowedMaxDepth !== undefined && allowedMaxDepth !== -1 && maxDepth > allowedMaxDepth)
+          ) {
+            continue;
+          }
+          visitedFragments.add(name);
+          const savedFields = totalFields;
+          const savedMaxDepth = maxDepth;
+          maxDepth = depth;
+          visitSelectionSet(fragment.selectionSet, depth, visitedFragments);
+          const fieldsContribution = totalFields - savedFields;
+          const maxDepthDelta = maxDepth - depth;
+          fragmentCache.set(name, { fields: fieldsContribution, maxDepthDelta });
+          maxDepth = Math.max(savedMaxDepth, maxDepth);
+          visitedFragments.delete(name);
        }
      }
    }
@@ -69,7 +99,8 @@ function createComplexityValidationPlugin(getConfig) {

        const { depth, fields } = calculateQueryComplexity(
          requestContext.operation,
-          fragments
+          fragments,
+          { maxDepth: graphQLDepth, maxFields: graphQLFields }
        );

        if (graphQLDepth !== -1 && depth > graphQLDepth) {
@@ -1,6 +1,7 @@
 import { GraphQLNonNull, GraphQLEnumType } from 'graphql';
-import deepcopy from 'deepcopy';
+
 import { mutationWithClientMutationId } from 'graphql-relay';
+import { cloneArgs } from '../parseGraphQLUtils';
 import { FunctionsRouter } from '../../Routers/FunctionsRouter';
 import * as defaultGraphQLTypes from './defaultGraphQLTypes';

@@ -44,7 +45,7 @@ const load = parseGraphQLSchema => {
      },
      mutateAndGetPayload: async (args, context) => {
        try {
-          const { functionName, params } = deepcopy(args);
+          const { functionName, params } = cloneArgs(args);
          const { config, auth, info } = context;

          return {
@@ -1,9 +1,9 @@
 import { GraphQLNonNull } from 'graphql';
 import { fromGlobalId, mutationWithClientMutationId } from 'graphql-relay';
 import getFieldNames from 'graphql-list-fields';
-import deepcopy from 'deepcopy';
+
 import * as defaultGraphQLTypes from './defaultGraphQLTypes';
-import { extractKeysAndInclude, getParseClassMutationConfig } from '../parseGraphQLUtils';
+import { extractKeysAndInclude, getParseClassMutationConfig, cloneArgs } from '../parseGraphQLUtils';
 import * as objectsMutations from '../helpers/objectsMutations';
 import * as objectsQueries from '../helpers/objectsQueries';
 import { ParseGraphQLClassConfig } from '../../Controllers/ParseGraphQLController';
@@ -75,7 +75,7 @@ const load = function (parseGraphQLSchema, parseClass, parseClassConfig: ?ParseG
      },
      mutateAndGetPayload: async (args, context, mutationInfo) => {
        try {
-          let { fields } = deepcopy(args);
+          let { fields } = cloneArgs(args);
          if (!fields) { fields = {}; }
          const { config, auth, info } = context;

@@ -178,7 +178,7 @@ const load = function (parseGraphQLSchema, parseClass, parseClassConfig: ?ParseG
      },
      mutateAndGetPayload: async (args, context, mutationInfo) => {
        try {
-          let { id, fields } = deepcopy(args);
+          let { id, fields } = cloneArgs(args);
          if (!fields) { fields = {}; }
          const { config, auth, info } = context;

@@ -284,7 +284,7 @@ const load = function (parseGraphQLSchema, parseClass, parseClassConfig: ?ParseG
      },
      mutateAndGetPayload: async (args, context, mutationInfo) => {
        try {
-          let { id } = deepcopy(args);
+          let { id } = cloneArgs(args);
          const { config, auth, info } = context;

          const globalIdObject = fromGlobalId(id);
@@ -1,13 +1,13 @@
 import { GraphQLNonNull } from 'graphql';
 import { fromGlobalId } from 'graphql-relay';
 import getFieldNames from 'graphql-list-fields';
-import deepcopy from 'deepcopy';
+
 import pluralize from 'pluralize';
 import * as defaultGraphQLTypes from './defaultGraphQLTypes';
 import * as objectsQueries from '../helpers/objectsQueries';
 import { ParseGraphQLClassConfig } from '../../Controllers/ParseGraphQLController';
 import { transformClassNameToGraphQL } from '../transformers/className';
-import { extractKeysAndInclude } from '../parseGraphQLUtils';
+import { extractKeysAndInclude, cloneArgs } from '../parseGraphQLUtils';

 const getParseClassQueryConfig = function (parseClassConfig: ?ParseGraphQLClassConfig) {
  return (parseClassConfig && parseClassConfig.query) || {};
@@ -75,7 +75,7 @@ const load = function (parseGraphQLSchema, parseClass, parseClassConfig: ?ParseG
          return await getQuery(
            parseClass,
            _source,
-            deepcopy(args),
+            cloneArgs(args),
            context,
            queryInfo,
            parseGraphQLSchema.parseClasses
@@ -99,7 +99,7 @@ const load = function (parseGraphQLSchema, parseClass, parseClassConfig: ?ParseG
      async resolve(_source, args, context, queryInfo) {
        try {
          // Deep copy args to avoid internal re assign issue
-          const { where, order, skip, first, after, last, before, options } = deepcopy(args);
+          const { where, order, skip, first, after, last, before, options } = cloneArgs(args);
          const { readPreference, includeReadPreference, subqueryReadPreference } = options || {};
          const { config, auth, info } = context;
          const selectedFields = getFieldNames(queryInfo);
@@ -1,10 +1,10 @@
 import Parse from 'parse/node';
 import { GraphQLNonNull } from 'graphql';
-import deepcopy from 'deepcopy';
+
 import { mutationWithClientMutationId } from 'graphql-relay';
 import * as schemaTypes from './schemaTypes';
 import { transformToParse, transformToGraphQL } from '../transformers/schemaFields';
-import { enforceMasterKeyAccess } from '../parseGraphQLUtils';
+import { enforceMasterKeyAccess, cloneArgs } from '../parseGraphQLUtils';
 import { getClass } from './schemaQueries';
 import { createSanitizedError } from '../../Error';

@@ -28,7 +28,7 @@ const load = parseGraphQLSchema => {
    },
    mutateAndGetPayload: async (args, context) => {
      try {
-        const { name, schemaFields } = deepcopy(args);
+        const { name, schemaFields } = cloneArgs(args);
        const { config, auth } = context;

        enforceMasterKeyAccess(auth, config);
@@ -78,7 +78,7 @@ const load = parseGraphQLSchema => {
    },
    mutateAndGetPayload: async (args, context) => {
      try {
-        const { name, schemaFields } = deepcopy(args);
+        const { name, schemaFields } = cloneArgs(args);
        const { config, auth } = context;

        enforceMasterKeyAccess(auth, config);
@@ -130,7 +130,7 @@ const load = parseGraphQLSchema => {
    },
    mutateAndGetPayload: async (args, context) => {
      try {
-        const { name } = deepcopy(args);
+        const { name } = cloneArgs(args);
        const { config, auth } = context;

        enforceMasterKeyAccess(auth, config);
@@ -1,9 +1,9 @@
 import Parse from 'parse/node';
-import deepcopy from 'deepcopy';
+
 import { GraphQLNonNull, GraphQLList } from 'graphql';
 import { transformToGraphQL } from '../transformers/schemaFields';
 import * as schemaTypes from './schemaTypes';
-import { enforceMasterKeyAccess } from '../parseGraphQLUtils';
+import { enforceMasterKeyAccess, cloneArgs } from '../parseGraphQLUtils';

 const getClass = async (name, schema) => {
  try {
@@ -28,7 +28,7 @@ const load = parseGraphQLSchema => {
      type: new GraphQLNonNull(schemaTypes.CLASS),
      resolve: async (_source, args, context) => {
        try {
-          const { name } = deepcopy(args);
+          const { name } = cloneArgs(args);
          const { config, auth } = context;

          enforceMasterKeyAccess(auth, config);
@@ -1,6 +1,7 @@
 import { GraphQLNonNull, GraphQLString, GraphQLBoolean, GraphQLInputObjectType } from 'graphql';
 import { mutationWithClientMutationId } from 'graphql-relay';
-import deepcopy from 'deepcopy';
+
+import { cloneArgs } from '../parseGraphQLUtils';
 import UsersRouter from '../../Routers/UsersRouter';
 import * as objectsMutations from '../helpers/objectsMutations';
 import { OBJECT } from './defaultGraphQLTypes';
@@ -32,7 +33,7 @@ const load = parseGraphQLSchema => {
    },
    mutateAndGetPayload: async (args, context, mutationInfo) => {
      try {
-        const { fields } = deepcopy(args);
+        const { fields } = cloneArgs(args);
        const { config, auth, info } = context;

        const parseFields = await transformTypes('create', fields, {
@@ -109,7 +110,7 @@ const load = parseGraphQLSchema => {
    },
    mutateAndGetPayload: async (args, context, mutationInfo) => {
      try {
-        const { fields, authData } = deepcopy(args);
+        const { fields, authData } = cloneArgs(args);
        const { config, auth, info } = context;

        const parseFields = await transformTypes('create', fields, {
@@ -173,7 +174,7 @@ const load = parseGraphQLSchema => {
    },
    mutateAndGetPayload: async (args, context, mutationInfo) => {
      try {
-        const { username, password, authData } = deepcopy(args);
+        const { username, password, authData } = cloneArgs(args);
        const { config, auth, info } = context;

        const { sessionToken, objectId, authDataResponse } = (
@@ -59,7 +59,6 @@ const getUserFromSessionToken = async (context, queryInfo, keysPrefix, userId) =
    // Get the user it self from auth object
    { objectId: context.auth.user.id },
    options,
-    info.clientVersion,
    info.context
  );
  if (!response.results || response.results.length == 0) {
@@ -55,3 +55,11 @@ export const extractKeysAndInclude = selectedFields => {
 export const getParseClassMutationConfig = function (parseClassConfig) {
  return (parseClassConfig && parseClassConfig.mutation) || {};
 };
+
+export function cloneArgs(args) {
+  try {
+    return structuredClone(args);
+  } catch {
+    return JSON.parse(JSON.stringify(args));
+  }
+}
@@ -25,7 +25,7 @@ import { LRUCache as LRU } from 'lru-cache';
 import UserRouter from '../Routers/UsersRouter';
 import DatabaseController from '../Controllers/DatabaseController';
 import { isDeepStrictEqual } from 'util';
-import deepcopy from 'deepcopy';
+

 class ParseLiveQueryServer {
  server: any;
@@ -206,18 +206,23 @@ class ParseLiveQueryServer {
          continue;
        }
        requestIds.forEach(async requestId => {
+          // Deep-clone shared object so each concurrent callback works on its own copy
+          let localDeletedParseObject = JSON.parse(JSON.stringify(deletedParseObject));
          const acl = message.currentParseObject.getACL();
          // Check CLP
          const op = this._getCLPOperation(subscription.query);
          let res: any = {};
          try {
-            await this._matchesCLP(
+            const matchesCLP = await this._matchesCLP(
              classLevelPermissions,
              message.currentParseObject,
              client,
              requestId,
              op
            );
+            if (matchesCLP === false) {
+              return null;
+            }
            const isMatched = await this._matchesACL(acl, client, requestId);
            if (!isMatched) {
              return null;
@@ -225,7 +230,7 @@ class ParseLiveQueryServer {
            res = {
              event: 'delete',
              sessionToken: client.sessionToken,
-              object: deletedParseObject,
+              object: localDeletedParseObject,
              clients: this.clients.size,
              subscriptions: this.subscriptions.size,
              useMasterKey: client.hasMasterKey,
@@ -247,8 +252,9 @@ class ParseLiveQueryServer {
              return;
            }
            if (res.object && typeof res.object.toJSON === 'function') {
-              deletedParseObject = toJSONwithObjects(res.object, res.object.className || className);
+              localDeletedParseObject = toJSONwithObjects(res.object, res.object.className || className);
            }
+            res.object = localDeletedParseObject;
            await this._filterSensitiveData(
              classLevelPermissions,
              res,
@@ -257,7 +263,7 @@ class ParseLiveQueryServer {
              op,
              subscription.query
            );
-            client.pushDelete(requestId, deletedParseObject);
+            client.pushDelete(requestId, res.object);
          } catch (e) {
            const error = resolveError(e);
            Client.pushError(client.parseWebSocket, error.code, error.message, false, requestId);
@@ -313,6 +319,13 @@ class ParseLiveQueryServer {
          continue;
        }
        requestIds.forEach(async requestId => {
+          // Deep-clone shared objects so each concurrent callback works on its own copy.
+          // Without cloning, _filterSensitiveData's in-place field deletion and afterEvent
+          // trigger modifications corrupt the shared state across concurrent subscribers.
+          let localCurrentParseObject = JSON.parse(JSON.stringify(currentParseObject));
+          let localOriginalParseObject = originalParseObject
+            ? JSON.parse(JSON.stringify(originalParseObject))
+            : null;
          // Set orignal ParseObject ACL checking promise, if the object does not match
          // subscription, we do not need to check ACL
          let originalACLCheckingPromise;
@@ -337,21 +350,24 @@ class ParseLiveQueryServer {
          }
          try {
            const op = this._getCLPOperation(subscription.query);
-            await this._matchesCLP(
+            const matchesCLP = await this._matchesCLP(
              classLevelPermissions,
              message.currentParseObject,
              client,
              requestId,
              op
            );
+            if (matchesCLP === false) {
+              return;
+            }
            const [isOriginalMatched, isCurrentMatched] = await Promise.all([
              originalACLCheckingPromise,
              currentACLCheckingPromise,
            ]);
            logger.verbose(
              'Original %j | Current %j | Match: %s, %s, %s, %s | Query: %s',
-              originalParseObject,
-              currentParseObject,
+              localOriginalParseObject,
+              localCurrentParseObject,
              isOriginalSubscriptionMatched,
              isCurrentSubscriptionMatched,
              isOriginalMatched,
@@ -365,7 +381,7 @@ class ParseLiveQueryServer {
            } else if (isOriginalMatched && !isCurrentMatched) {
              type = 'leave';
            } else if (!isOriginalMatched && isCurrentMatched) {
-              if (originalParseObject) {
+              if (localOriginalParseObject) {
                type = 'enter';
              } else {
                type = 'create';
@@ -380,8 +396,8 @@ class ParseLiveQueryServer {
            res = {
              event: type,
              sessionToken: client.sessionToken,
-              object: currentParseObject,
-              original: originalParseObject,
+              object: localCurrentParseObject,
+              original: localOriginalParseObject,
              clients: this.clients.size,
              subscriptions: this.subscriptions.size,
              useMasterKey: client.hasMasterKey,
@@ -406,14 +422,16 @@ class ParseLiveQueryServer {
              return;
            }
            if (res.object && typeof res.object.toJSON === 'function') {
-              currentParseObject = toJSONwithObjects(res.object, res.object.className || className);
+              localCurrentParseObject = toJSONwithObjects(res.object, res.object.className || className);
            }
            if (res.original && typeof res.original.toJSON === 'function') {
-              originalParseObject = toJSONwithObjects(
+              localOriginalParseObject = toJSONwithObjects(
                res.original,
                res.original.className || className
              );
            }
+            res.object = localCurrentParseObject;
+            res.original = localOriginalParseObject;
            await this._filterSensitiveData(
              classLevelPermissions,
              res,
@@ -424,7 +442,7 @@ class ParseLiveQueryServer {
            );
            const functionName = 'push' + res.event.charAt(0).toUpperCase() + res.event.slice(1);
            if (client[functionName]) {
-              client[functionName](requestId, currentParseObject, originalParseObject);
+              client[functionName](requestId, res.object, res.original ?? null);
            }
          } catch (e) {
            const error = resolveError(e);
@@ -537,6 +555,16 @@ class ParseLiveQueryServer {
    if (typeof where !== 'object' || where === null) {
      return;
    }
+    for (const op of ['$or', '$and', '$nor']) {
+      if (where[op] !== undefined && !Array.isArray(where[op])) {
+        throw new Parse.Error(Parse.Error.INVALID_QUERY, `${op} must be an array`);
+      }
+      if (Array.isArray(where[op])) {
+        where[op].forEach((subQuery: any) => {
+          this._validateQueryConstraints(subQuery);
+        });
+      }
+    }
    for (const key of Object.keys(where)) {
      const constraint = where[key];
      if (typeof constraint === 'object' && constraint !== null) {
@@ -564,18 +592,6 @@ class ParseLiveQueryServer {
            );
          }
        }
-        for (const op of ['$or', '$and', '$nor']) {
-          if (Array.isArray(constraint[op])) {
-            constraint[op].forEach((subQuery: any) => {
-              this._validateQueryConstraints(subQuery);
-            });
-          }
-        }
-        if (Array.isArray(where[key])) {
-          where[key].forEach((subQuery: any) => {
-            this._validateQueryConstraints(subQuery);
-          });
-        }
      }
    }
  }
@@ -585,7 +601,7 @@ class ParseLiveQueryServer {
    if (!parseObject) {
      return false;
    }
-    return matchesQuery(deepcopy(parseObject), subscription.query);
+    return matchesQuery(structuredClone(parseObject), subscription.query);
  }

  async _clearCachedRoles(userId: string) {
@@ -653,8 +669,10 @@ class ParseLiveQueryServer {
  ): Promise<any> {
    const subscriptionInfo = client.getSubscriptionInfo(requestId);
    const aclGroup = ['*'];
+    let userId;
    if (typeof subscriptionInfo !== 'undefined') {
-      const { userId } = await this.getAuthForSessionToken(subscriptionInfo.sessionToken);
+      const result = await this.getAuthForSessionToken(subscriptionInfo.sessionToken);
+      userId = result.userId;
      if (userId) {
        aclGroup.push(userId);
      }
@@ -665,6 +683,66 @@ class ParseLiveQueryServer {
      aclGroup,
      op
    );
+    // Enforce pointer permissions that validatePermission defers.
+    // Returns false to silently skip the event (like ACL), rather than
+    // throwing which would push errors to the client and log noise.
+    if (!client.hasMasterKey && classLevelPermissions) {
+      const permissionField =
+        ['get', 'find', 'count'].indexOf(op) > -1 ? 'readUserFields' : 'writeUserFields';
+      const pointerFields = [];
+      if (classLevelPermissions[op]?.pointerFields) {
+        pointerFields.push(...classLevelPermissions[op].pointerFields);
+      }
+      if (Array.isArray(classLevelPermissions[permissionField])) {
+        for (const field of classLevelPermissions[permissionField]) {
+          if (!pointerFields.includes(field)) {
+            pointerFields.push(field);
+          }
+        }
+      }
+      if (pointerFields.length > 0) {
+        // If public or user-specific permission already grants access, skip pointer check
+        if (
+          !SchemaController.testPermissions(classLevelPermissions, aclGroup, op)
+        ) {
+          if (!userId) {
+            return false;
+          }
+          // Check if any pointer field points to the current user
+          const hasAccess = pointerFields.some(field => {
+            const value =
+              typeof object.get === 'function' ? object.get(field) : object[field];
+            if (!value) {
+              return false;
+            }
+            // Handle Parse.Object pointer (has .id)
+            if (value.id) {
+              return value.id === userId;
+            }
+            // Handle raw pointer JSON (has .objectId)
+            if (value.objectId) {
+              return value.objectId === userId;
+            }
+            // Handle array of pointers
+            if (Array.isArray(value)) {
+              return value.some(item => {
+                if (item.id) {
+                  return item.id === userId;
+                }
+                if (item.objectId) {
+                  return item.objectId === userId;
+                }
+                return false;
+              });
+            }
+            return false;
+          });
+          if (!hasAccess) {
+            return false;
+          }
+        }
+      }
+    }
  }

  async _filterSensitiveData(
@@ -690,7 +768,9 @@ class ParseLiveQueryServer {
        return;
      }
      let protectedFields = classLevelPermissions?.protectedFields || [];
-      if (!client.hasMasterKey && !Array.isArray(protectedFields)) {
+      if (client.hasMasterKey) {
+        protectedFields = [];
+      } else if (!Array.isArray(protectedFields)) {
        protectedFields = getDatabaseController(this.config).addProtectedFields(
          classLevelPermissions,
          res.object.className,
@@ -949,8 +1029,45 @@ class ParseLiveQueryServer {
          return;
        }
      }
-      // Check CLP for subscribe operation
+      // Validate query condition depth
      const appConfig = Config.get(this.config.appId);
+      if (!client.hasMasterKey) {
+        const rc = appConfig.requestComplexity;
+        if (rc && rc.queryDepth !== -1) {
+          const maxDepth = rc.queryDepth;
+          const checkDepth = (node: any, depth: number) => {
+            if (depth > maxDepth) {
+              throw new Parse.Error(
+                Parse.Error.INVALID_QUERY,
+                `Query condition nesting depth exceeds maximum allowed depth of ${maxDepth}`
+              );
+            }
+            if (node === null || typeof node !== 'object') {
+              return;
+            }
+            if (Array.isArray(node)) {
+              for (const item of node) {
+                checkDepth(item, depth);
+              }
+              return;
+            }
+            // Descend into every value so that logical operators ($or/$and/$nor)
+            // nested under field-level operators (e.g. $elemMatch, $not) or plain
+            // field names are still counted. Only logical operators increase the
+            // depth, which preserves the documented meaning of `queryDepth`.
+            for (const key of Object.keys(node)) {
+              const isLogical = key === '$or' || key === '$and' || key === '$nor';
+              if (isLogical && !Array.isArray(node[key])) {
+                throw new Parse.Error(Parse.Error.INVALID_QUERY, `${key} must be an array`);
+              }
+              checkDepth(node[key], isLogical ? depth + 1 : depth);
+            }
+          };
+          checkDepth(request.query.where, 0);
+        }
+      }
+
+      // Check CLP for subscribe operation
      const schemaController = await appConfig.database.loadSchema();
      const classLevelPermissions = schemaController.getClassLevelPermissions(className);
      const op = this._getCLPOperation(request.query);
@@ -976,7 +1093,7 @@ class ParseLiveQueryServer {
        op
      );

-      // Check protected fields in WHERE clause
+      // Check protected fields in WHERE clause and WATCH parameter
      if (!client.hasMasterKey) {
        const auth = request.user ? { user: request.user, userRoles: [] } : {};
        const protectedFields =
@@ -1002,6 +1119,9 @@ class ParseLiveQueryServer {
              }
            }
            for (const op of ['$or', '$and', '$nor']) {
+              if (where[op] !== undefined && !Array.isArray(where[op])) {
+                throw new Parse.Error(Parse.Error.INVALID_QUERY, `${op} must be an array`);
+              }
              if (Array.isArray(where[op])) {
                where[op].forEach((subQuery: any) => checkWhere(subQuery));
              }
@@ -1009,6 +1129,17 @@ class ParseLiveQueryServer {
          };
          checkWhere(request.query.where);
        }
+        if (protectedFields.length > 0 && Array.isArray(request.query.watch)) {
+          for (const watchField of request.query.watch) {
+            const rootField = watchField.split('.')[0];
+            if (protectedFields.includes(watchField) || protectedFields.includes(rootField)) {
+              throw new Parse.Error(
+                Parse.Error.OPERATION_FORBIDDEN,
+                'Permission denied'
+              );
+            }
+          }
+        }
      }

      // Validate regex patterns in the subscription query
@@ -206,6 +206,9 @@ function matchesKeyConstraints(object, key, constraints) {
  }
  var i;
  if (key === '$or') {
+    if (!Array.isArray(constraints)) {
+      return false;
+    }
    for (i = 0; i < constraints.length; i++) {
      if (matchesQuery(object, constraints[i])) {
        return true;
@@ -214,6 +217,9 @@ function matchesKeyConstraints(object, key, constraints) {
    return false;
  }
  if (key === '$and') {
+    if (!Array.isArray(constraints)) {
+      return false;
+    }
    for (i = 0; i < constraints.length; i++) {
      if (!matchesQuery(object, constraints[i])) {
        return false;
@@ -222,6 +228,9 @@ function matchesKeyConstraints(object, key, constraints) {
    return true;
  }
  if (key === '$nor') {
+    if (!Array.isArray(constraints)) {
+      return false;
+    }
    for (i = 0; i < constraints.length; i++) {
      if (matchesQuery(object, constraints[i])) {
        return false;
@@ -78,7 +78,7 @@ module.exports.ParseServerOptions = {
  allowExpiredAuthDataToken: {
    env: 'PARSE_SERVER_ALLOW_EXPIRED_AUTH_DATA_TOKEN',
    help:
-      'Allow a user to log in even if the 3rd party authentication token that was used to sign in to their account has expired. If this is set to `false`, then the token will be validated every time the user signs in to their account. This refers to the token that is stored in the `_User.authData` field. Defaults to `false`.',
+      'Deprecated. This option will be removed in a future version. Auth providers are always validated on login. On update, if this is set to `true`, auth providers are only re-validated when the auth data has changed. If this is set to `false`, auth providers are re-validated on every update. Defaults to `false`.',
    action: parsers.booleanParser,
    default: false,
  },
@@ -720,37 +720,44 @@ module.exports.RateLimitOptions = {
 module.exports.RequestComplexityOptions = {
  graphQLDepth: {
    env: 'PARSE_SERVER_REQUEST_COMPLEXITY_GRAPHQL_DEPTH',
-    help: 'Maximum depth of GraphQL field selections. Set to `-1` to disable. Default is `50`.',
+    help: 'Maximum depth of GraphQL field selections. Set to `-1` to disable. Default is `-1`.',
    action: parsers.numberParser('graphQLDepth'),
-    default: 50,
+    default: -1,
  },
  graphQLFields: {
    env: 'PARSE_SERVER_REQUEST_COMPLEXITY_GRAPHQL_FIELDS',
    help:
-      'Maximum number of field selections in a GraphQL query. Set to `-1` to disable. Default is `200`.',
+      'Maximum number of field selections in a GraphQL query. Set to `-1` to disable. Default is `-1`.',
    action: parsers.numberParser('graphQLFields'),
-    default: 200,
+    default: -1,
  },
  includeCount: {
    env: 'PARSE_SERVER_REQUEST_COMPLEXITY_INCLUDE_COUNT',
    help:
-      'Maximum number of include paths in a single query. Set to `-1` to disable. Default is `50`.',
+      'Maximum number of include paths in a single query. Set to `-1` to disable. Default is `-1`.',
    action: parsers.numberParser('includeCount'),
-    default: 50,
+    default: -1,
  },
  includeDepth: {
    env: 'PARSE_SERVER_REQUEST_COMPLEXITY_INCLUDE_DEPTH',
    help:
-      'Maximum depth of include pointer chains (e.g. `a.b.c` = depth 3). Set to `-1` to disable. Default is `5`.',
+      'Maximum depth of include pointer chains (e.g. `a.b.c` = depth 3). Set to `-1` to disable. Default is `-1`.',
    action: parsers.numberParser('includeDepth'),
-    default: 5,
+    default: -1,
+  },
+  queryDepth: {
+    env: 'PARSE_SERVER_REQUEST_COMPLEXITY_QUERY_DEPTH',
+    help:
+      'Maximum nesting depth of `$or`, `$and`, `$nor` query operators. Set to `-1` to disable. Default is `-1`.',
+    action: parsers.numberParser('queryDepth'),
+    default: -1,
  },
  subqueryDepth: {
    env: 'PARSE_SERVER_REQUEST_COMPLEXITY_SUBQUERY_DEPTH',
    help:
-      'Maximum nesting depth of `$inQuery`, `$notInQuery`, `$select`, `$dontSelect` subqueries. Set to `-1` to disable. Default is `5`.',
+      'Maximum nesting depth of `$inQuery`, `$notInQuery`, `$select`, `$dontSelect` subqueries. Set to `-1` to disable. Default is `-1`.',
    action: parsers.numberParser('subqueryDepth'),
-    default: 5,
+    default: -1,
  },
 };
 module.exports.SecurityOptions = {
@@ -15,7 +15,7 @@
 * @property {AccountLockoutOptions} accountLockout The account lockout policy for failed login attempts.
 * @property {Boolean} allowClientClassCreation Enable (or disable) client class creation, defaults to false
 * @property {Boolean} allowCustomObjectId Enable (or disable) custom objectId
- * @property {Boolean} allowExpiredAuthDataToken Allow a user to log in even if the 3rd party authentication token that was used to sign in to their account has expired. If this is set to `false`, then the token will be validated every time the user signs in to their account. This refers to the token that is stored in the `_User.authData` field. Defaults to `false`.
+ * @property {Boolean} allowExpiredAuthDataToken Deprecated. This option will be removed in a future version. Auth providers are always validated on login. On update, if this is set to `true`, auth providers are only re-validated when the auth data has changed. If this is set to `false`, auth providers are re-validated on every update. Defaults to `false`.
 * @property {String[]} allowHeaders Add headers to Access-Control-Allow-Headers
 * @property {String|String[]} allowOrigin Sets origins for Access-Control-Allow-Origin. This can be a string for a single origin or an array of strings for multiple origins.
 * @property {Adapter<AnalyticsAdapter>} analyticsAdapter Adapter module for the analytics
@@ -130,11 +130,12 @@

 /**
 * @interface RequestComplexityOptions
- * @property {Number} graphQLDepth Maximum depth of GraphQL field selections. Set to `-1` to disable. Default is `50`.
- * @property {Number} graphQLFields Maximum number of field selections in a GraphQL query. Set to `-1` to disable. Default is `200`.
- * @property {Number} includeCount Maximum number of include paths in a single query. Set to `-1` to disable. Default is `50`.
- * @property {Number} includeDepth Maximum depth of include pointer chains (e.g. `a.b.c` = depth 3). Set to `-1` to disable. Default is `5`.
- * @property {Number} subqueryDepth Maximum nesting depth of `$inQuery`, `$notInQuery`, `$select`, `$dontSelect` subqueries. Set to `-1` to disable. Default is `5`.
+ * @property {Number} graphQLDepth Maximum depth of GraphQL field selections. Set to `-1` to disable. Default is `-1`.
+ * @property {Number} graphQLFields Maximum number of field selections in a GraphQL query. Set to `-1` to disable. Default is `-1`.
+ * @property {Number} includeCount Maximum number of include paths in a single query. Set to `-1` to disable. Default is `-1`.
+ * @property {Number} includeDepth Maximum depth of include pointer chains (e.g. `a.b.c` = depth 3). Set to `-1` to disable. Default is `-1`.
+ * @property {Number} queryDepth Maximum nesting depth of `$or`, `$and`, `$nor` query operators. Set to `-1` to disable. Default is `-1`.
+ * @property {Number} subqueryDepth Maximum nesting depth of `$inQuery`, `$notInQuery`, `$select`, `$dontSelect` subqueries. Set to `-1` to disable. Default is `-1`.
 */

 /**
@@ -347,7 +347,7 @@ export interface ParseServerOptions {
  /* Set to true if new users should be created without public read and write access.
  :DEFAULT: true */
  enforcePrivateUsers: ?boolean;
-  /* Allow a user to log in even if the 3rd party authentication token that was used to sign in to their account has expired. If this is set to `false`, then the token will be validated every time the user signs in to their account. This refers to the token that is stored in the `_User.authData` field. Defaults to `false`.
+  /* Deprecated. This option will be removed in a future version. Auth providers are always validated on login. On update, if this is set to `true`, auth providers are only re-validated when the auth data has changed. If this is set to `false`, auth providers are re-validated on every update. Defaults to `false`.
  :DEFAULT: false */
  allowExpiredAuthDataToken: ?boolean;
  /* An array of keys and values that are prohibited in database read and write requests to prevent potential security vulnerabilities. It is possible to specify only a key (`{"key":"..."}`), only a value (`{"value":"..."}`) or a key-value pair (`{"key":"...","value":"..."}`). The specification can use the following types: `boolean`, `numeric` or `string`, where `string` will be interpreted as a regex notation. Request data is deep-scanned for matching definitions to detect also any nested occurrences. Defaults are patterns that are likely to be used in malicious requests. Setting this option will override the default patterns.
@@ -397,22 +397,25 @@ export interface RateLimitOptions {
 }

 export interface RequestComplexityOptions {
-  /* Maximum depth of include pointer chains (e.g. `a.b.c` = depth 3). Set to `-1` to disable. Default is `5`.
-  :DEFAULT: 5 */
+  /* Maximum depth of include pointer chains (e.g. `a.b.c` = depth 3). Set to `-1` to disable. Default is `-1`.
+  :DEFAULT: -1 */
  includeDepth: ?number;
-  /* Maximum number of include paths in a single query. Set to `-1` to disable. Default is `50`.
-  :DEFAULT: 50 */
+  /* Maximum number of include paths in a single query. Set to `-1` to disable. Default is `-1`.
+  :DEFAULT: -1 */
  includeCount: ?number;
-  /* Maximum nesting depth of `$inQuery`, `$notInQuery`, `$select`, `$dontSelect` subqueries. Set to `-1` to disable. Default is `5`.
-  :DEFAULT: 5 */
+  /* Maximum nesting depth of `$inQuery`, `$notInQuery`, `$select`, `$dontSelect` subqueries. Set to `-1` to disable. Default is `-1`.
+  :DEFAULT: -1 */
  subqueryDepth: ?number;
-  /* Maximum depth of GraphQL field selections. Set to `-1` to disable. Default is `50`.
+  /* Maximum nesting depth of `$or`, `$and`, `$nor` query operators. Set to `-1` to disable. Default is `-1`.
+  :DEFAULT: -1 */
+  queryDepth: ?number;
+  /* Maximum depth of GraphQL field selections. Set to `-1` to disable. Default is `-1`.
  :ENV: PARSE_SERVER_REQUEST_COMPLEXITY_GRAPHQL_DEPTH
-  :DEFAULT: 50 */
+  :DEFAULT: -1 */
  graphQLDepth: ?number;
-  /* Maximum number of field selections in a GraphQL query. Set to `-1` to disable. Default is `200`.
+  /* Maximum number of field selections in a GraphQL query. Set to `-1` to disable. Default is `-1`.
  :ENV: PARSE_SERVER_REQUEST_COMPLEXITY_GRAPHQL_FIELDS
-  :DEFAULT: 200 */
+  :DEFAULT: -1 */
  graphQLFields: ?number;
 }

@@ -1,6 +1,4 @@
 // @flow
-// @flow-disable-next
-import deepcopy from 'deepcopy';
 import AdaptableController from '../Controllers/AdaptableController';
 import { master } from '../Auth';
 import Config from '../Config';
@@ -91,7 +89,7 @@ export class PushWorker {

    // Map the on the badges count and return the send result
    const promises = Object.keys(badgeInstallationsMap).map(badge => {
-      const payload = deepcopy(body);
+      const payload = structuredClone(body);
      payload.data.badge = parseInt(badge);
      const installations = badgeInstallationsMap[badge];
      return this.sendToAdapter(payload, installations, pushStatus, config, UTCOffset);
@@ -1,5 +1,5 @@
 import Parse from 'parse/node';
-import deepcopy from 'deepcopy';
+

 export function isPushIncrementing(body) {
  if (!body.data || !body.data.badge) {
@@ -45,7 +45,7 @@ export function transformPushBodyForLocale(body, locale) {
  if (!data) {
    return body;
  }
-  body = deepcopy(body);
+  body = structuredClone(body);
  localizableKeys.forEach(key => {
    const localeValue = body.data[`${key}-${locale}`];
    if (localeValue) {
@@ -128,7 +128,7 @@ export function validatePushType(where = {}, validPushTypes = []) {
 }

 export function applyDeviceTokenExists(where) {
-  where = deepcopy(where);
+  where = structuredClone(where);
  if (!Object.prototype.hasOwnProperty.call(where, 'deviceToken')) {
    where['deviceToken'] = { $exists: true };
  }
@@ -31,7 +31,6 @@ const { createSanitizedError } = require('./Error');
 * @param options.className {string} The name of the class to query
 * @param options.restWhere {object} The where object for the query
 * @param options.restOptions {object} The options object for the query
- * @param options.clientSDK {string} The client SDK that is performing the query
 * @param options.runAfterFind {boolean} Whether to run the afterFind trigger
 * @param options.runBeforeFind {boolean} Whether to run the beforeFind trigger
 * @param options.context {object} The context object for the query
@@ -44,7 +43,6 @@ async function RestQuery({
  className,
  restWhere = {},
  restOptions = {},
-  clientSDK,
  runAfterFind = true,
  runBeforeFind = true,
  context,
@@ -73,7 +71,6 @@ async function RestQuery({
    className,
    result.restWhere || restWhere,
    result.restOptions || restOptions,
-    clientSDK,
    runAfterFind,
    context,
    isGet
@@ -93,7 +90,6 @@ RestQuery.Method = Object.freeze({
 * @param className
 * @param restWhere
 * @param restOptions
- * @param clientSDK
 * @param runAfterFind
 * @param context
 */
@@ -103,7 +99,6 @@ function _UnsafeRestQuery(
  className,
  restWhere = {},
  restOptions = {},
-  clientSDK,
  runAfterFind = true,
  context,
  isGet
@@ -113,7 +108,6 @@ function _UnsafeRestQuery(
  this.className = className;
  this.restWhere = restWhere;
  this.restOptions = restOptions;
-  this.clientSDK = clientSDK;
  this.runAfterFind = runAfterFind;
  this.response = null;
  this.findOptions = {};
@@ -281,6 +275,9 @@ function _UnsafeRestQuery(
 // TODO: consolidate the replaceX functions
 _UnsafeRestQuery.prototype.execute = function (executeOptions) {
  return Promise.resolve()
+    .then(() => {
+      return this.validateQueryDepth();
+    })
    .then(() => {
      return this.buildRestWhere();
    })
@@ -317,7 +314,7 @@ _UnsafeRestQuery.prototype.execute = function (executeOptions) {
 };

 _UnsafeRestQuery.prototype.each = function (callback) {
-  const { config, auth, className, restWhere, restOptions, clientSDK } = this;
+  const { config, auth, className, restWhere, restOptions } = this;
  // if the limit is set, use it
  restOptions.limit = restOptions.limit || 100;
  restOptions.order = 'objectId';
@@ -336,7 +333,6 @@ _UnsafeRestQuery.prototype.each = function (callback) {
        className,
        restWhere,
        restOptions,
-        clientSDK,
        this.runAfterFind,
        this.context
      );
@@ -352,6 +348,43 @@ _UnsafeRestQuery.prototype.each = function (callback) {
  );
 };

+_UnsafeRestQuery.prototype.validateQueryDepth = function () {
+  if (this.auth.isMaster || this.auth.isMaintenance) {
+    return;
+  }
+  const rc = this.config.requestComplexity;
+  if (!rc || rc.queryDepth === -1) {
+    return;
+  }
+  const maxDepth = rc.queryDepth;
+  const checkDepth = (node, depth) => {
+    if (depth > maxDepth) {
+      throw new Parse.Error(
+        Parse.Error.INVALID_QUERY,
+        `Query condition nesting depth exceeds maximum allowed depth of ${maxDepth}`
+      );
+    }
+    if (node === null || typeof node !== 'object') {
+      return;
+    }
+    if (Array.isArray(node)) {
+      for (const item of node) {
+        checkDepth(item, depth);
+      }
+      return;
+    }
+    // Descend into every value so that logical operators ($or/$and/$nor) nested
+    // under field-level operators (e.g. $elemMatch, $not) or plain field names are
+    // still counted. Only logical operators increase the depth, which preserves the
+    // documented meaning of `queryDepth`.
+    for (const key of Object.keys(node)) {
+      const isLogical = key === '$or' || key === '$and' || key === '$nor';
+      checkDepth(node[key], isLogical ? depth + 1 : depth);
+    }
+  };
+  checkDepth(this.restWhere, 0);
+};
+
 _UnsafeRestQuery.prototype.buildRestWhere = function () {
  return Promise.resolve()
    .then(() => {
@@ -871,6 +904,13 @@ _UnsafeRestQuery.prototype.denyProtectedFields = async function () {
      }
    }
    for (const op of ['$or', '$and', '$nor']) {
+      if (where[op] !== undefined && !Array.isArray(where[op])) {
+        throw createSanitizedError(
+          Parse.Error.INVALID_QUERY,
+          `${op} must be an array`,
+          this.config
+        );
+      }
      if (Array.isArray(where[op])) {
        where[op].forEach(subQuery => checkWhere(subQuery));
      }
@@ -1278,6 +1318,10 @@ function findObjectWithKey(root, key) {
        return answer;
      }
    }
+    // Arrays are fully traversed above; returning here avoids re-walking the same
+    // elements through the `for (subkey in root)` loop below, which would make this
+    // function O(2^n) for nested arrays (e.g. deeply nested $or/$and/$nor).
+    return;
  }
  if (root && root[key]) {
    return root;
@@ -3,7 +3,7 @@
 // This could be either a "create" or an "update".

 var SchemaController = require('./Controllers/SchemaController');
-var deepcopy = require('deepcopy');
+

 const Auth = require('./Auth');
 const Utils = require('./Utils');
@@ -11,11 +11,11 @@ var cryptoUtils = require('./cryptoUtils');
 var passwordCrypto = require('./password');
 var Parse = require('parse/node');
 var triggers = require('./triggers');
-var ClientSDK = require('./ClientSDK');
 const util = require('util');
 import RestQuery from './RestQuery';
 import _ from 'lodash';
 import logger from './logger';
+import { applyAuthDataOptimisticLock } from './AuthDataLock';
 import { requiredColumns } from './Controllers/SchemaController';
 import { createSanitizedError } from './Error';

@@ -28,7 +28,7 @@ import { createSanitizedError } from './Error';
 // RestWrite will handle objectId, createdAt, and updatedAt for
 // everything. It also knows to use triggers and special modifications
 // for the _User class.
-function RestWrite(config, auth, className, query, data, originalData, clientSDK, context, action) {
+function RestWrite(config, auth, className, query, data, originalData, context, action) {
  if (auth.isReadOnly) {
    throw createSanitizedError(
      Parse.Error.OPERATION_FORBIDDEN,
@@ -39,7 +39,6 @@ function RestWrite(config, auth, className, query, data, originalData, clientSDK
  this.config = config;
  this.auth = auth;
  this.className = className;
-  this.clientSDK = clientSDK;
  this.storage = {};
  this.runOptions = {};
  this.context = context || {};
@@ -75,8 +74,8 @@ function RestWrite(config, auth, className, query, data, originalData, clientSDK

  // Processing this operation may mutate our data, so we operate on a
  // copy
-  this.query = deepcopy(query);
-  this.data = deepcopy(data);
+  this.query = structuredClone(query);
+  this.data = structuredClone(data);
  // We never change originalData, so we do not need a deep copy
  this.originalData = originalData;

@@ -377,10 +376,10 @@ RestWrite.prototype.setRequiredFieldsIfNeeded = function () {
        JSON.stringify(schema.classLevelPermissions.ACL) !==
          JSON.stringify({ '*': { read: true, write: true } })
      ) {
-        const acl = deepcopy(schema.classLevelPermissions.ACL);
+        const acl = structuredClone(schema.classLevelPermissions.ACL);
        if (acl.currentUser) {
          if (this.auth.user?.id) {
-            acl[this.auth.user?.id] = deepcopy(acl.currentUser);
+            acl[this.auth.user?.id] = structuredClone(acl.currentUser);
          }
          delete acl.currentUser;
        }
@@ -453,8 +452,14 @@ RestWrite.prototype.validateAuthData = function () {
  const authData = this.data.authData;
  const hasUsernameAndPassword =
    typeof this.data.username === 'string' && typeof this.data.password === 'string';
+  const hasAuthData =
+    authData &&
+    Object.keys(authData).some(provider => {
+      const providerData = authData[provider];
+      return providerData && typeof providerData === 'object' && Object.keys(providerData).length;
+    });

-  if (!this.query && !authData) {
+  if (!this.query && !hasAuthData) {
    if (typeof this.data.username !== 'string' || _.isEmpty(this.data.username)) {
      throw new Parse.Error(Parse.Error.USERNAME_MISSING, 'bad or missing username');
    }
@@ -463,13 +468,10 @@ RestWrite.prototype.validateAuthData = function () {
    }
  }

-  if (
-    (authData && !Object.keys(authData).length) ||
-    !Object.prototype.hasOwnProperty.call(this.data, 'authData')
-  ) {
+  if (!Object.prototype.hasOwnProperty.call(this.data, 'authData')) {
    // Nothing to validate here
    return;
-  } else if (Object.prototype.hasOwnProperty.call(this.data, 'authData') && !this.data.authData) {
+  } else if (!this.data.authData) {
    // Handle saving authData to null
    throw new Parse.Error(
      Parse.Error.UNSUPPORTED_SERVICE,
@@ -478,14 +480,16 @@ RestWrite.prototype.validateAuthData = function () {
  }

  var providers = Object.keys(authData);
-  if (providers.length > 0) {
-    const canHandleAuthData = providers.some(provider => {
-      const providerAuthData = authData[provider] || {};
-      return !!Object.keys(providerAuthData).length;
-    });
-    if (canHandleAuthData || hasUsernameAndPassword || this.auth.isMaster || this.getUserId()) {
-      return this.handleAuthData(authData);
-    }
+  if (!providers.length) {
+    // Empty authData object, nothing to validate
+    return;
+  }
+  const canHandleAuthData = providers.some(provider => {
+    const providerAuthData = authData[provider] || {};
+    return !!Object.keys(providerAuthData).length;
+  });
+  if (canHandleAuthData || hasUsernameAndPassword || this.auth.isMaster || this.getUserId()) {
+    return this.handleAuthData(authData);
  }
  throw new Parse.Error(
    Parse.Error.UNSUPPORTED_SERVICE,
@@ -609,7 +613,7 @@ RestWrite.prototype.handleAuthData = async function (authData) {
        // Run beforeLogin hook before storing any updates
        // to authData on the db; changes to userResult
        // will be ignored.
-        await this.runBeforeLoginTrigger(deepcopy(userResult));
+        await this.runBeforeLoginTrigger(structuredClone(userResult));

        // If we are in login operation via authData
        // we need to be sure that the user has provided
@@ -627,9 +631,10 @@ RestWrite.prototype.handleAuthData = async function (authData) {
        return;
      }

-      // Force to validate all provided authData on login
-      // on update only validate mutated ones
-      if (hasMutatedAuthData || !this.config.allowExpiredAuthDataToken) {
+      // Always validate all provided authData on login to prevent authentication
+      // bypass via partial authData (e.g. sending only the provider ID without
+      // an access token); on update only validate mutated ones
+      if (isLogin || hasMutatedAuthData || !this.config.allowExpiredAuthDataToken) {
        const res = await Auth.handleAuthDataValidation(
          isLogin ? authData : mutatedAuthData,
          this,
@@ -639,6 +644,15 @@ RestWrite.prototype.handleAuthData = async function (authData) {
        this.authDataResponse = res.authDataResponse;
      }

+      // Capture original authData before mutating userResult via the response reference
+      const originalAuthData = userResult?.authData
+        ? Object.fromEntries(
+          Object.entries(userResult.authData).map(([k, v]) =>
+            [k, v && typeof v === 'object' ? { ...v } : v]
+          )
+        )
+        : undefined;
+
      // IF we are in login we'll skip the database operation / beforeSave / afterSave etc...
      // we need to set it up there.
      // We are supposed to have a response only on LOGIN with authData, so we skip those
@@ -654,18 +668,32 @@ RestWrite.prototype.handleAuthData = async function (authData) {
        // uses the `doNotSave` option. Just update the authData part
        // Then we're good for the user, early exit of sorts
        if (Object.keys(this.data.authData).length) {
+          const query = { objectId: this.data.objectId };
+          // Optimistic locking: include each changed original field in the WHERE clause
+          // for providers whose data is being updated. This prevents concurrent requests
+          // from both succeeding when consuming single-use tokens (e.g. MFA recovery codes
+          // as arrays, or MFA SMS OTP tokens as strings).
+          applyAuthDataOptimisticLock(query, originalAuthData, this.data.authData);
          try {
            await this.config.database.update(
              this.className,
-              { objectId: this.data.objectId },
+              query,
              { authData: this.data.authData },
              {}
            );
          } catch (error) {
+            if (error.code === Parse.Error.OBJECT_NOT_FOUND) {
+              throw new Parse.Error(Parse.Error.SCRIPT_FAILED, 'Invalid auth data');
+            }
            this._throwIfAuthDataDuplicate(error);
            throw error;
          }
        }
+      } else if (this.query && this.data.authData && Object.keys(this.data.authData).length) {
+        // UPDATE path (e.g. PUT /users/:id during linked-provider re-auth): apply
+        // the same optimistic lock to the subsequent runDatabaseOperation update so
+        // concurrent single-use token consumers cannot both succeed.
+        applyAuthDataOptimisticLock(this.query, originalAuthData, this.data.authData);
      }
    }
  }
@@ -1137,9 +1165,13 @@ RestWrite.prototype.handleSession = function () {
  if (this.query) {
    if (this.data.user && !this.auth.isMaster && this.data.user.objectId != this.auth.user.id) {
      throw new Parse.Error(Parse.Error.INVALID_KEY_NAME);
-    } else if (this.data.installationId) {
+    } else if ('installationId' in this.data) {
      throw new Parse.Error(Parse.Error.INVALID_KEY_NAME);
-    } else if (this.data.sessionToken) {
+    } else if ('sessionToken' in this.data) {
+      throw new Parse.Error(Parse.Error.INVALID_KEY_NAME);
+    } else if ('expiresAt' in this.data && !this.auth.isMaster && !this.auth.isMaintenance) {
+      throw new Parse.Error(Parse.Error.INVALID_KEY_NAME);
+    } else if ('createdWith' in this.data && !this.auth.isMaster && !this.auth.isMaintenance) {
      throw new Parse.Error(Parse.Error.INVALID_KEY_NAME);
    }
    if (!this.auth.isMaster) {
@@ -1754,7 +1786,7 @@ RestWrite.prototype.sanitizedData = function () {
      delete data[key];
    }
    return data;
-  }, deepcopy(this.data));
+  }, structuredClone(this.data));
  return Parse._decode(undefined, data);
 };

@@ -1804,7 +1836,7 @@ RestWrite.prototype.buildParseObjects = function () {
      delete data[key];
    }
    return data;
-  }, deepcopy(this.data));
+  }, structuredClone(this.data));

  const sanitized = this.sanitizedData();
  for (const attribute of readOnlyAttributes) {
@@ -1863,7 +1895,6 @@ RestWrite.prototype._updateResponseWithData = function (response, data) {
  if (_.isEmpty(this.storage.fieldsChangedByTrigger)) {
    return response;
  }
-  const clientSupportsDelete = ClientSDK.supportsForwardDelete(this.clientSDK);
  this.storage.fieldsChangedByTrigger.forEach(fieldName => {
    const dataValue = data[fieldName];

@@ -1871,10 +1902,9 @@ RestWrite.prototype._updateResponseWithData = function (response, data) {
      response[fieldName] = dataValue;
    }

-    // Strips operations from responses
    if (response[fieldName] && response[fieldName].__op) {
      delete response[fieldName];
-      if (clientSupportsDelete && dataValue.__op == 'Delete') {
+      if (dataValue.__op == 'Delete') {
        response[fieldName] = dataValue;
      }
    }
@@ -38,7 +38,6 @@ export class AggregateRouter extends ClassesRouter {
        this.className(req),
        body.where,
        options,
-        req.info.clientSDK,
        req.info.context
      );
      for (const result of response.results) {
@@ -48,6 +47,9 @@ export class AggregateRouter extends ClassesRouter {
      }
      return { response };
    } catch (e) {
+      if (e instanceof Parse.Error) {
+        throw e;
+      }
      throw new Parse.Error(Parse.Error.INVALID_QUERY, e.message);
    }
  }
@@ -18,7 +18,6 @@ export class AudiencesRouter extends ClassesRouter {
        '_Audience',
        body.where,
        options,
-        req.info.clientSDK,
        req.info.context
      )
      .then(response => {
@@ -39,7 +39,6 @@ export class ClassesRouter extends PromiseRouter {
        this.className(req),
        body.where,
        options,
-        req.info.clientSDK,
        req.info.context
      )
      .then(response => {
@@ -84,7 +83,6 @@ export class ClassesRouter extends PromiseRouter {
        this.className(req),
        req.params.objectId,
        options,
-        req.info.clientSDK,
        req.info.context
      )
      .then(response => {
@@ -119,7 +117,6 @@ export class ClassesRouter extends PromiseRouter {
      req.auth,
      this.className(req),
      req.body || {},
-      req.info.clientSDK,
      req.info.context
    );
  }
@@ -132,7 +129,6 @@ export class ClassesRouter extends PromiseRouter {
      this.className(req),
      where,
      req.body || {},
-      req.info.clientSDK,
      req.info.context
    );
  }
@@ -5,6 +5,7 @@ import Config from '../Config';
 import logger from '../logger';
 const triggers = require('../triggers');
 const Utils = require('../Utils');
+const auth = require('../Auth');
 import { createSanitizedHttpError } from '../Error';

 export class FilesRouter {
@@ -40,6 +41,22 @@ export class FilesRouter {
    return router;
  }

+  static async _resolveAuth(req, config) {
+    const sessionToken = req.get('X-Parse-Session-Token');
+    if (!sessionToken) {
+      return null;
+    }
+    try {
+      return await auth.getAuthForSessionToken({
+        config,
+        sessionToken,
+        installationId: req.get('X-Parse-Installation-Id'),
+      });
+    } catch {
+      return null;
+    }
+  }
+
  async getHandler(req, res) {
    const config = Config.get(req.params.appId);
    if (!config) {
@@ -54,11 +71,12 @@ export class FilesRouter {
      const mime = (await import('mime')).default;
      let contentType = mime.getType(filename);
      let file = new Parse.File(filename, { base64: '' }, contentType);
+      const fileAuth = await FilesRouter._resolveAuth(req, config);
      const triggerResult = await triggers.maybeRunFileTrigger(
        triggers.Types.beforeFind,
        { file },
        config,
-        req.auth
+        fileAuth
      );
      if (triggerResult?.file?._name) {
        filename = triggerResult?.file?._name;
@@ -66,6 +84,15 @@ export class FilesRouter {
      }

      if (isFileStreamable(req, filesController)) {
+        const afterFind = await triggers.maybeRunFileTrigger(
+          triggers.Types.afterFind,
+          { file, forceDownload: false },
+          config,
+          fileAuth
+        );
+        if (afterFind?.forceDownload) {
+          res.set('Content-Disposition', `attachment;filename=${afterFind.file?._name || filename}`);
+        }
        filesController.handleFileStream(config, filename, req, res, contentType).catch(() => {
          res.status(404);
          res.set('Content-Type', 'text/plain');
@@ -87,7 +114,7 @@ export class FilesRouter {
        triggers.Types.afterFind,
        { file, forceDownload: false },
        config,
-        req.auth
+        fileAuth
      );

      if (afterFind?.file) {
@@ -159,6 +186,7 @@ export class FilesRouter {

    const fileExtensions = config.fileUpload?.fileExtensions;
    if (!isMaster && fileExtensions) {
+      const mime = (await import('mime')).default;
      const isValidExtension = extension => {
        return fileExtensions.some(ext => {
          if (ext === '*') {
@@ -170,22 +198,44 @@ export class FilesRouter {
          }
        });
      };
-      let extension = contentType;
-      if (filename && filename.includes('.')) {
-        extension = filename.substring(filename.lastIndexOf('.') + 1);
-      } else if (contentType && contentType.includes('/')) {
-        extension = contentType.split('/')[1];
-      }
-      // Strip MIME parameters (e.g. ";charset=utf-8") and whitespace
-      extension = extension?.split(';')[0]?.replace(/\s+/g, '');
-
-      if (extension && !isValidExtension(extension)) {
+      const rejectExtension = ext => {
        next(
          new Parse.Error(
            Parse.Error.FILE_SAVE_ERROR,
-            `File upload of extension ${extension} is disabled.`
+            `File upload of extension ${ext} is disabled.`
          )
        );
+      };
+
+      // Parse the filename extension token, stripping MIME parameters and whitespace.
+      let extension = Utils.getFileExtension(filename);
+      extension = extension?.split(';')[0]?.replace(/\s+/g, '');
+
+      // Derive the Content-Type subtype as a fallback identifier, e.g.
+      // "image/svg+xml" -> "svg+xml", "image/svg+xml;charset=utf-8" -> "svg+xml".
+      let contentTypeExtension;
+      if (contentType && contentType.includes('/')) {
+        contentTypeExtension = contentType.split('/')[1]?.split(';')[0]?.replace(/\s+/g, '');
+      } else if (contentType) {
+        // Malformed Content-Type without a slash: use the raw value so the
+        // existing rejection path still fires.
+        contentTypeExtension = contentType.split(';')[0]?.replace(/\s+/g, '');
+      }
+
+      // The blocklist must be evaluated against the type the file is actually
+      // served as. `FilesController.createFile` derives the stored Content-Type
+      // from the filename extension only when `mime` recognizes it; otherwise it
+      // preserves the client-supplied Content-Type. So the Content-Type subtype
+      // must also be validated whenever the filename has no usable extension OR
+      // an extension that `mime` does not recognize (e.g. "file.svg~"), which
+      // would otherwise slip past the exact-match blocklist.
+      const isExtensionRecognized = extension && mime.getType(filename);
+      if (extension && !isValidExtension(extension)) {
+        rejectExtension(extension);
+        return;
+      }
+      if (!isExtensionRecognized && contentTypeExtension && !isValidExtension(contentTypeExtension)) {
+        rejectExtension(contentTypeExtension);
        return;
      }
    }
@@ -326,11 +376,12 @@ export class FilesRouter {
      const { filesController } = config;
      let { filename } = req.params;
      const file = new Parse.File(filename, { base64: '' });
+      const fileAuth = await FilesRouter._resolveAuth(req, config);
      const triggerResult = await triggers.maybeRunFileTrigger(
        triggers.Types.beforeFind,
        { file },
        config,
-        req.auth
+        fileAuth
      );
      if (triggerResult?.file?._name) {
        filename = triggerResult.file._name;
@@ -346,7 +397,7 @@ export class FilesRouter {
        triggers.Types.afterFind,
        { file },
        config,
-        req.auth
+        fileAuth
      );
      res.status(200);
      res.json(data);
@@ -51,7 +51,6 @@ function getFileForProductIdentifier(productIdentifier, req) {
      '_Product',
      { productIdentifier: productIdentifier },
      undefined,
-      req.info.clientSDK,
      req.info.context
    )
    .then(function (result) {
@@ -19,7 +19,6 @@ export class InstallationsRouter extends ClassesRouter {
        '_Installation',
        body.where,
        options,
-        req.info.clientSDK,
        req.info.context
      )
      .then(response => {
@@ -120,12 +120,16 @@ export class PagesRouter extends PromiseRouter {
    }

    const userController = config.userController;
+    const suppressError = config.emailVerifySuccessOnInvalidEmail ?? true;

    return userController.resendVerificationEmail(username, req, token).then(
      () => {
        return this.goToPage(req, pages.emailVerificationSendSuccess);
      },
      () => {
+        if (suppressError) {
+          return this.goToPage(req, pages.emailVerificationSendSuccess);
+        }
        return this.goToPage(req, pages.emailVerificationSendFail);
      }
    );
@@ -551,6 +555,16 @@ export class PagesRouter extends PromiseRouter {
      (req.body || {})[pageParams.locale] ||
      (req.params || {})[pageParams.locale] ||
      (req.headers || {})[pageParamHeaderPrefix + pageParams.locale];
+
+    // Validate locale format to prevent path traversal and invalid
+    // HTTP header characters; only allow standard locale patterns
+    // like "en", "en-US", "de-AT", "zh-Hans-CN"
+    if (locale !== undefined && typeof locale !== 'string') {
+      return undefined;
+    }
+    if (typeof locale === 'string' && !/^[a-zA-Z]{2,3}(-[a-zA-Z0-9]{2,8})*$/.test(locale)) {
+      return undefined;
+    }
    return locale;
  }

@@ -71,6 +71,7 @@ export class PublicAPIRouter extends PromiseRouter {
    }

    const userController = config.userController;
+    const suppressError = config.emailVerifySuccessOnInvalidEmail ?? true;

    return userController.resendVerificationEmail(username, req, token).then(
      () => {
@@ -80,6 +81,12 @@ export class PublicAPIRouter extends PromiseRouter {
        });
      },
      () => {
+        if (suppressError) {
+          return Promise.resolve({
+            status: 302,
+            location: `${config.linkSendSuccessURL}`,
+          });
+        }
        return Promise.resolve({
          status: 302,
          location: `${config.linkSendFailURL}`,
@@ -9,29 +9,51 @@ export class SessionsRouter extends ClassesRouter {
    return '_Session';
  }

-  handleMe(req) {
-    // TODO: Verify correct behavior
+  async handleMe(req) {
    if (!req.info || !req.info.sessionToken) {
      throw new Parse.Error(Parse.Error.INVALID_SESSION_TOKEN, 'Session token required.');
    }
-    return rest
-      .find(
-        req.config,
-        Auth.master(req.config),
-        '_Session',
-        { sessionToken: req.info.sessionToken },
-        undefined,
-        req.info.clientSDK,
-        req.info.context
-      )
-      .then(response => {
-        if (!response.results || response.results.length == 0) {
-          throw new Parse.Error(Parse.Error.INVALID_SESSION_TOKEN, 'Session token not found.');
-        }
-        return {
-          response: response.results[0],
-        };
-      });
+    const sessionToken = req.info.sessionToken;
+    // Query with master key to validate the session token and get the session objectId
+    const sessionResponse = await rest.find(
+      req.config,
+      Auth.master(req.config),
+      '_Session',
+      { sessionToken },
+      {},
+      req.info.context
+    );
+    if (
+      !sessionResponse.results ||
+      sessionResponse.results.length == 0 ||
+      !sessionResponse.results[0].user
+    ) {
+      throw new Parse.Error(Parse.Error.INVALID_SESSION_TOKEN, 'Session token not found.');
+    }
+    const sessionObjectId = sessionResponse.results[0].objectId;
+    const userId = sessionResponse.results[0].user.objectId;
+    // Re-fetch the session with the caller's auth context so that
+    // protectedFields and CLP apply correctly
+    const userAuth = new Auth.Auth({
+      config: req.config,
+      isMaster: false,
+      user: Parse.Object.fromJSON({ className: '_User', objectId: userId }),
+      installationId: req.info.installationId,
+    });
+    const response = await rest.get(
+      req.config,
+      userAuth,
+      '_Session',
+      sessionObjectId,
+      {},
+      req.info.context
+    );
+    if (!response.results || response.results.length == 0) {
+      throw new Parse.Error(Parse.Error.INVALID_SESSION_TOKEN, 'Session token not found.');
+    }
+    return {
+      response: response.results[0],
+    };
  }

  handleUpdateToRevocableSession(req) {
@@ -18,6 +18,7 @@ import { promiseEnsureIdempotency } from '../middlewares';
 import RestWrite from '../RestWrite';
 import { logger } from '../logger';
 import { createSanitizedError } from '../Error';
+import { applyAuthDataOptimisticLock } from '../AuthDataLock';

 export class UsersRouter extends ClassesRouter {
  className() {
@@ -108,7 +109,13 @@ export class UsersRouter extends ClassesRouter {
        .find('_User', query, {}, Auth.maintenance(req.config))
        .then(results => {
          if (!results.length) {
-            throw new Parse.Error(Parse.Error.OBJECT_NOT_FOUND, 'Invalid username/password.');
+            // Perform a dummy bcrypt compare to normalize response timing,
+            // preventing user enumeration via timing side-channel
+            return passwordCrypto
+              .compare(password, passwordCrypto.dummyHash)
+              .then(() => {
+                throw new Parse.Error(Parse.Error.OBJECT_NOT_FOUND, 'Invalid username/password.');
+              });
          }

          if (results.length > 1) {
@@ -121,6 +128,11 @@ export class UsersRouter extends ClassesRouter {
            user = results[0];
          }

+          if (typeof user.password !== 'string' || user.password.length === 0) {
+            // Passwordless account (e.g. OAuth-only): run dummy compare for
+            // timing normalization, discard result, always reject
+            return passwordCrypto.compare(password, passwordCrypto.dummyHash).then(() => false);
+          }
          return passwordCrypto.compare(password, user.password);
        })
        .then(correct => {
@@ -170,34 +182,48 @@ export class UsersRouter extends ClassesRouter {
    });
  }

-  handleMe(req) {
+  async handleMe(req) {
    if (!req.info || !req.info.sessionToken) {
      throw createSanitizedError(Parse.Error.INVALID_SESSION_TOKEN, 'Invalid session token', req.config);
    }
    const sessionToken = req.info.sessionToken;
-    return rest
-      .find(
-        req.config,
-        Auth.master(req.config),
-        '_Session',
-        { sessionToken },
-        { include: 'user' },
-        req.info.clientSDK,
-        req.info.context
-      )
-      .then(response => {
-        if (!response.results || response.results.length == 0 || !response.results[0].user) {
-          throw createSanitizedError(Parse.Error.INVALID_SESSION_TOKEN, 'Invalid session token', req.config);
-        } else {
-          const user = response.results[0].user;
-          // Send token back on the login, because SDKs expect that.
-          user.sessionToken = sessionToken;
-
-          // Remove hidden properties.
-          UsersRouter.removeHiddenProperties(user);
-          return { response: user };
-        }
-      });
+    // Query the session with master key to validate the session token,
+    // but do NOT include 'user' to avoid leaking user data via master context
+    const sessionResponse = await rest.find(
+      req.config,
+      Auth.master(req.config),
+      '_Session',
+      { sessionToken },
+      {},
+      req.info.context
+    );
+    if (
+      !sessionResponse.results ||
+      sessionResponse.results.length == 0 ||
+      !sessionResponse.results[0].user
+    ) {
+      throw createSanitizedError(Parse.Error.INVALID_SESSION_TOKEN, 'Invalid session token', req.config);
+    }
+    const userId = sessionResponse.results[0].user.objectId;
+    // Re-fetch the user with the caller's auth context so that
+    // protectedFields, CLP, and auth adapter afterFind apply correctly
+    const userResponse = await rest.get(
+      req.config,
+      req.auth,
+      '_User',
+      userId,
+      {},
+      req.info.context
+    );
+    if (!userResponse.results || userResponse.results.length == 0) {
+      throw createSanitizedError(Parse.Error.INVALID_SESSION_TOKEN, 'Invalid session token', req.config);
+    }
+    const user = userResponse.results[0];
+    // Send token back on the login, because SDKs expect that.
+    user.sessionToken = sessionToken;
+    // Remove hidden properties.
+    UsersRouter.removeHiddenProperties(user);
+    return { response: user };
  }

  async handleLogIn(req) {
@@ -223,7 +249,6 @@ export class UsersRouter extends ClassesRouter {
          { objectId: user.objectId },
          req.body || {},
          user,
-          req.info.clientSDK,
          req.info.context
        ),
        user
@@ -280,12 +305,19 @@ export class UsersRouter extends ClassesRouter {

    // If we have some new validated authData update directly
    if (validatedAuthData && Object.keys(validatedAuthData).length) {
-      await req.config.database.update(
-        '_User',
-        { objectId: user.objectId },
-        { authData: validatedAuthData },
-        {}
-      );
+      const query = { objectId: user.objectId };
+      // Prevent concurrent requests from both succeeding when consuming single-use
+      // tokens (e.g. MFA recovery codes or SMS OTP tokens) by extending the update
+      // WHERE clause with the original values of changed primitive/array fields.
+      applyAuthDataOptimisticLock(query, user.authData, validatedAuthData);
+      try {
+        await req.config.database.update('_User', query, { authData: validatedAuthData }, {});
+      } catch (error) {
+        if (error.code === Parse.Error.OBJECT_NOT_FOUND) {
+          throw new Parse.Error(Parse.Error.SCRIPT_FAILED, 'Invalid auth data');
+        }
+        throw error;
+      }
    }

    const { sessionData, createSession } = RestWrite.createSession(req.config, {
@@ -383,10 +415,10 @@ export class UsersRouter extends ClassesRouter {

  handleVerifyPassword(req) {
    return this._authenticateUserFromRequest(req)
-      .then(user => {
+      .then(async user => {
        // Remove hidden properties.
        UsersRouter.removeHiddenProperties(user);
-
+        await req.config.authDataManager.runAfterFind(req, user.authData);
        return { response: user };
      })
      .catch(error => {
@@ -403,7 +435,6 @@ export class UsersRouter extends ClassesRouter {
        '_Session',
        { sessionToken: req.info.sessionToken },
        undefined,
-        req.info.clientSDK,
        req.info.context
      );
      if (records.results && records.results.length) {
@@ -116,7 +116,7 @@ class CheckGroupServerConfig extends CheckGroup {
          if (!rc) {
            throw 1;
          }
-          const values = [rc.includeDepth, rc.includeCount, rc.subqueryDepth, rc.graphQLDepth, rc.graphQLFields];
+          const values = [rc.includeDepth, rc.includeCount, rc.subqueryDepth, rc.queryDepth, rc.graphQLDepth, rc.graphQLFields];
          if (values.some(v => v === -1)) {
            throw 1;
          }
@@ -478,6 +478,23 @@ class Utils {
    }
    return current;
  }
+
+  /**
+   * Returns the file extension as the substring after the last dot in the
+   * filename. A trailing dot or a filename without a dot yields an empty
+   * string. Callers apply any further normalization (whitespace, MIME
+   * parameters, etc.) for their use case — this is a pure parser, not a
+   * policy.
+   *
+   * @param {string} filename
+   * @returns {string} the extension, or `''` if none
+   */
+  static getFileExtension(filename) {
+    if (!filename || !filename.includes('.')) {
+      return '';
+    }
+    return filename.substring(filename.lastIndexOf('.') + 1);
+  }
 }

 module.exports = Utils;
@@ -2,7 +2,6 @@ import AppCache from './cache';
 import Parse from 'parse/node';
 import auth from './Auth';
 import Config from './Config';
-import ClientSDK from './ClientSDK';
 import defaultLogger from './logger';
 import rest from './rest';
 import MongoStorageAdapter from './Adapters/Storage/Mongo/MongoStorageAdapter';
@@ -94,7 +93,6 @@ export async function handleParseHeaders(req, res, next) {
    javascriptKey: req.get('X-Parse-Javascript-Key'),
    dotNetKey: req.get('X-Parse-Windows-Key'),
    restAPIKey: req.get('X-Parse-REST-API-Key'),
-    clientVersion: req.get('X-Parse-Client-Version'),
    context: context,
  };

@@ -149,10 +147,7 @@ export async function handleParseHeaders(req, res, next) {
      delete req.body._JavaScriptKey;
      // TODO: test that the REST API formats generated by the other
      // SDKs are handled ok
-      if (req.body._ClientVersion) {
-        info.clientVersion = req.body._ClientVersion;
-        delete req.body._ClientVersion;
-      }
+      delete req.body._ClientVersion;
      if (req.body._InstallationId) {
        info.installationId = req.body._InstallationId;
        delete req.body._InstallationId;
@@ -193,10 +188,6 @@ export async function handleParseHeaders(req, res, next) {
    info.sessionToken = info.sessionToken.toString();
  }

-  if (info.clientVersion) {
-    info.clientSDK = ClientSDK.fromString(info.clientVersion);
-  }
-
  if (fileViaJSON && req.body) {
    req.fileData = req.body.fileData;
    // We need to repopulate req.body with a buffer
@@ -27,7 +27,13 @@ function compare(password, hashedPassword) {
  return bcrypt.compare(password, hashedPassword);
 }

+// Pre-computed bcrypt hash (cost factor 10) used for timing normalization.
+// The actual value is irrelevant; it ensures bcrypt.compare() runs with
+// realistic cost even when no real password hash is available.
+const dummyHash = '$2b$10$Wd1gvrMYPnQv5pHBbXCwCehxXmJSEzRqNON0ev98L6JJP5296S35i';
+
 module.exports = {
  hash: hash,
  compare: compare,
+  dummyHash: dummyHash,
 };
@@ -30,7 +30,6 @@ async function runFindTriggers(
  className,
  restWhere,
  restOptions,
-  clientSDK,
  context,
  options = {}
 ) {
@@ -89,7 +88,6 @@ async function runFindTriggers(
          className,
          restWhere: refilterWhere,
          restOptions,
-          clientSDK,
          context,
          runBeforeFind: false,
          runAfterFind: false,
@@ -125,7 +123,6 @@ async function runFindTriggers(
    className,
    restWhere,
    restOptions,
-    clientSDK,
    context,
    runBeforeFind: false,
  });
@@ -134,7 +131,7 @@ async function runFindTriggers(
 }

 // Returns a promise for an object with optional keys 'results' and 'count'.
-const find = async (config, auth, className, restWhere, restOptions, clientSDK, context) => {
+const find = async (config, auth, className, restWhere, restOptions, context) => {
  enforceRoleSecurity('find', className, auth, config);
  return runFindTriggers(
    config,
@@ -142,14 +139,13 @@ const find = async (config, auth, className, restWhere, restOptions, clientSDK,
    className,
    restWhere,
    restOptions,
-    clientSDK,
    context,
    { isGet: false }
  );
 };

 // get is just like find but only queries an objectId.
-const get = async (config, auth, className, objectId, restOptions, clientSDK, context) => {
+const get = async (config, auth, className, objectId, restOptions, context) => {
  enforceRoleSecurity('get', className, auth, config);
  return runFindTriggers(
    config,
@@ -157,7 +153,6 @@ const get = async (config, auth, className, objectId, restOptions, clientSDK, co
    className,
    { objectId },
    restOptions,
-    clientSDK,
    context,
    { isGet: true }
  );
@@ -263,16 +258,16 @@ function del(config, auth, className, objectId, context) {
 }

 // Returns a promise for a {response, status, location} object.
-function create(config, auth, className, restObject, clientSDK, context) {
+function create(config, auth, className, restObject, context) {
  enforceRoleSecurity('create', className, auth, config);
-  var write = new RestWrite(config, auth, className, null, restObject, null, clientSDK, context);
+  var write = new RestWrite(config, auth, className, null, restObject, null, context);
  return write.execute();
 }

 // Returns a promise that contains the fields of the update that the
 // REST API is supposed to return.
 // Usually, this is just updatedAt.
-function update(config, auth, className, restWhere, restObject, clientSDK, context) {
+function update(config, auth, className, restWhere, restObject, context) {
  enforceRoleSecurity('update', className, auth, config);

  return Promise.resolve()
@@ -309,7 +304,6 @@ function update(config, auth, className, restWhere, restObject, clientSDK, conte
        restWhere,
        restObject,
        originalRestObject,
-        clientSDK,
        context,
        'update'
      ).execute();
@@ -109,8 +109,11 @@ function getStore(category, name, applicationId) {
  _triggerStore[applicationId] = _triggerStore[applicationId] || baseStore();
  let store = _triggerStore[applicationId][category];
  for (const component of path) {
+    if (!Object.prototype.hasOwnProperty.call(store, component)) {
+      return createStore();
+    }
    store = store[component];
-    if (!store) {
+    if (!store || Object.getPrototypeOf(store) !== null) {
      return createStore();
    }
  }
@@ -137,6 +140,9 @@ function remove(category, name, applicationId) {
 function get(category, name, applicationId) {
  const lastComponent = name.split('.').splice(-1);
  const store = getStore(category, name, applicationId);
+  if (!Object.prototype.hasOwnProperty.call(store, lastComponent)) {
+    return undefined;
+  }
  return store[lastComponent];
 }