parse-community-parse-server

Adapters/Auth

fix: OAuth2 adapter app ID validation sends wrong token to introspection endpoint ([GHSA-69xg-f649-w5g2](https://github.com/parse-community/parse-server/security/advisories/GHSA-69xg-f649-w5g2 )) (#10188 )

2026-03-11 23:47:44 +00:00

cloud

feat: Asynchronous initialization of Parse Server (#8232 )

2022-12-21 15:30:13 +01:00

configs

fix: Server does not start via CLI when auth option is set (#8666 )

2023-07-04 13:16:55 +02:00

dependencies

Remove S3 File Adapter (#7324 )

2021-04-09 10:12:24 -05:00

support

refactor: Add a few lint rules to test files in /spec (#9815 )

2025-07-04 20:24:08 +02:00

.babelrc

feat: Add TypeScript support (#9550 )

2025-01-30 01:45:35 +01:00

AccountLockoutPolicy.spec.js

fix: Remove username from email verification and password reset process (#8488 )

2025-03-02 02:32:43 +01:00

AdaptableController.spec.js

fix(prettier): Properly handle lint-stage files (#6970 )

2020-10-25 15:06:58 -05:00

AdapterLoader.spec.js

feat: Upgrade to @parse/push-adapter 6.4.0 (#9182 )

2024-07-08 22:23:57 +02:00

AggregateRouter.spec.js

feat: Remove deprecation DEPPS1: Native MongoDB syntax in aggregation pipeline (#8362 )

2023-01-05 15:53:43 +01:00

Analytics.spec.js

fix(prettier): Properly handle lint-stage files (#6970 )

2020-10-25 15:06:58 -05:00

AudienceRouter.spec.js

fix: Classes _GraphQLConfig and _Audience master key bypass via generic class routes ([GHSA-7xg7-rqf6-pw6c](https://github.com/parse-community/parse-server/security/advisories/GHSA-7xg7-rqf6-pw6c )) (#10152 )

2026-03-09 03:41:25 +00:00

Auth.spec.js

fix: Using Parse Server option extendSessionOnUse does not correctly clear memory and functions as a debounce instead of a throttle (#8683 )

2025-03-06 01:34:52 +01:00

AuthDataUniqueIndex.spec.js

fix: Concurrent signup with same authentication creates duplicate users (#10150 )

2026-03-09 02:05:49 +00:00

AuthenticationAdapters.spec.js

fix: MFA recovery codes not consumed after use ([GHSA-4hf6-3x24-c9m8](https://github.com/parse-community/parse-server/security/advisories/GHSA-4hf6-3x24-c9m8 )) (#10171 )

2026-03-10 04:22:30 +00:00

AuthenticationAdaptersV2.spec.js

fix: Authentication provider credentials are usable across Parse Server apps; fixes security vulnerability [GHSA-837q-jhwx-cmpv](https://github.com/parse-community/parse-server/security/advisories/GHSA-837q-jhwx-cmpv ) (#9667 )

2025-03-21 10:49:09 +01:00

batch.spec.js

fix: Parse Server doesn't shutdown gracefully (#9634 )

2025-03-27 21:38:51 +01:00

buildConfigDefinitions.spec.js

chore: Add objectParser for ObjectTypeAnnotation in Parse Server options (#9912 )

2025-12-03 16:10:29 +01:00

CacheController.spec.js

fix(prettier): Properly handle lint-stage files (#6970 )

2020-10-25 15:06:58 -05:00

CLI.spec.js

refactor: Upgrade to commander 13.0.0 (#9574 )

2025-01-29 06:04:54 +01:00

Client.spec.js

fix(prettier): Properly handle lint-stage files (#6970 )

2020-10-25 15:06:58 -05:00

CloudCode.spec.js

fix: File metadata endpoint bypasses beforeFind / afterFind trigger authorization ([GHSA-hwx8-q9cg-mqmc](https://github.com/parse-community/parse-server/security/advisories/GHSA-hwx8-q9cg-mqmc )) (#10107 )

2026-03-06 01:05:25 +00:00

CloudCode.Validator.spec.js

test: Add more test IDs (#9285 )

2024-08-16 21:21:56 +02:00

CloudCodeLogger.spec.js

fix: Error in afterSave trigger for Parse.Role due to name field (#9883 )

2025-10-22 14:12:51 +02:00

cryptoUtils.spec.js

fix(prettier): Properly handle lint-stage files (#6970 )

2020-10-25 15:06:58 -05:00

DatabaseController.spec.js

fix: Concurrent signup with same authentication creates duplicate users (#10150 )

2026-03-09 02:05:49 +00:00

defaultGraphQLTypes.spec.js

fix(prettier): Properly handle lint-stage files (#6970 )

2020-10-25 15:06:58 -05:00

DefinedSchemas.spec.js

feat: Add option keepUnknownIndexes to retain indexes which are not specified in schema (#9857 )

2025-10-03 14:35:34 +02:00

Deprecator.spec.js

fix: Deprecation warning logged at server launch for nested Parse Server option even if option is explicitly set (#9934 )

2025-11-17 19:43:32 +01:00

EmailVerificationToken.spec.js

fix: User enumeration via email verification endpoint ([GHSA-w54v-hf9p-8856](https://github.com/parse-community/parse-server/security/advisories/GHSA-w54v-hf9p-8856 )) (#10173 )

2026-03-10 13:59:30 +00:00

EnableExpressErrorHandler.spec.js

fix: Parse Server doesn't shutdown gracefully (#9634 )

2025-03-27 21:38:51 +01:00

eslint.config.js

fix: Indexes _email_verify_token for email verification and _perishable_token password reset are not created automatically (#9893 )

2025-11-01 13:52:23 +01:00

EventEmitterPubSub.spec.js

fix(prettier): Properly handle lint-stage files (#6970 )

2020-10-25 15:06:58 -05:00

features.spec.js

fix: Server internal error details leaking in error messages returned to clients (#9937 )

2025-11-23 13:51:42 +01:00

FilesController.spec.js

feat: Add support for asynchronous invocation of FilesAdapter.getFileLocation (#9271 )

2024-08-27 17:09:19 +02:00

graphQLObjectsQueries.js

fix(prettier): Properly handle lint-stage files (#6970 )

2020-10-25 15:06:58 -05:00

GraphQLQueryComplexity.spec.js

fix: GraphQL complexity validator exponential fragment traversal DoS ([GHSA-mfj6-6p54-m98c](https://github.com/parse-community/parse-server/security/advisories/GHSA-mfj6-6p54-m98c )) (#10345 )

2026-03-29 02:32:53 +01:00

GridFSBucketStorageAdapter.spec.js

fix: GridFSBucketAdapter throws when using some Parse Server specific options in MongoDB database options (#9915 )

2025-11-08 18:41:45 +01:00

helper.js

fix: Parse Server role escalation and CLP bypass via direct `_Join table write ([GHSA-5f92-jrq3-28rc](https://github.com/parse-community/parse-server/security/advisories/GHSA-5f92-jrq3-28rc )) (#10142 )

2026-03-08 16:26:52 +00:00

HTTPRequest.spec.js

feat: Upgrade to express 5.0.1 (#9530 )

2025-03-03 22:11:42 +01:00

Idempotency.spec.js

ci: Fix test exclusion list in combination with other exclusions (#9277 )

2024-08-13 22:13:19 +02:00

index.spec.js

fix: JWT audience validation bypass in Google, Apple, and Facebook authentication adapters ([GHSA-x6fw-778m-wr9v](https://github.com/parse-community/parse-server/security/advisories/GHSA-x6fw-778m-wr9v )) (#10114 )

2026-03-06 05:12:09 +00:00

InMemoryCache.spec.js

fix(prettier): Properly handle lint-stage files (#6970 )

2020-10-25 15:06:58 -05:00

InMemoryCacheAdapter.spec.js

fix(prettier): Properly handle lint-stage files (#6970 )

2020-10-25 15:06:58 -05:00

InstallationsRouter.spec.js

fix(prettier): Properly handle lint-stage files (#6970 )

2020-10-25 15:06:58 -05:00

JobSchedule.spec.js

fix(prettier): Properly handle lint-stage files (#6970 )

2020-10-25 15:06:58 -05:00

LdapAuth.spec.js

fix: LDAP injection via unsanitized user input in DN and group filter construction ([GHSA-7m6r-fhh7-r47c](https://github.com/parse-community/parse-server/security/advisories/GHSA-7m6r-fhh7-r47c )) (#10153 )

2026-03-09 14:04:08 +00:00

Logger.spec.js

Allow single server instance in test suite (#7262 )

2021-03-13 09:05:22 -06:00

LoggerController.spec.js

[WIP] Enable test suite to be randomized (#7265 )

2021-03-15 02:04:09 -05:00

LogsRouter.spec.js

fix: Server internal error details leaking in error messages returned to clients (#9937 )

2025-11-23 13:51:42 +01:00

Middlewares.spec.js

fix: Pre-authentication denial of service via client version header regex backtracking ([GHSA-38m6-82c8-4xfm](https://github.com/parse-community/parse-server/security/advisories/GHSA-38m6-82c8-4xfm )) (#10464 )

2026-05-17 15:11:27 +01:00

MongoSchemaCollectionAdapter.spec.js

feat: Add default ACL (#8701 )

2025-03-24 15:15:27 +01:00

MongoStorageAdapter.spec.js

feat: Add MongoDB client event logging via database option logClientEvents (#9914 )

2025-11-08 15:48:29 +01:00

MongoTransform.spec.js

fix: NoSQL injection via token type in password reset and email verification endpoints ([GHSA-vgjh-hmwf-c588](https://github.com/parse-community/parse-server/security/advisories/GHSA-vgjh-hmwf-c588 )) (#10129 )

2026-03-07 19:16:26 +00:00

NullCacheAdapter.spec.js

fix(prettier): Properly handle lint-stage files (#6970 )

2020-10-25 15:06:58 -05:00

OAuth1.spec.js

test: Disable OAuth 1 tests with Twitter API (#9161 )

2024-06-22 03:09:13 +02:00

PagesRouter.spec.js

fix: Reject invalid locale format in PagesRouter (#10282 )

2026-03-22 17:33:10 +00:00

Parse.Push.spec.js

ci: Fix test exclusion list in combination with other exclusions (#9277 )

2024-08-13 22:13:19 +02:00

ParseACL.spec.js

feat: Add default ACL (#8701 )

2025-03-24 15:15:27 +01:00

ParseAPI.spec.js

fix: Server internal error details leaking in error messages returned to clients (#9937 )

2025-11-23 13:51:42 +01:00

ParseCloudCodePublisher.spec.js

fix(prettier): Properly handle lint-stage files (#6970 )

2020-10-25 15:06:58 -05:00

ParseConfigKey.spec.js

feat: Add support for more MongoDB driver options (#9911 )

2025-11-07 21:41:59 +01:00

ParseFile.spec.js

fix: Stored XSS via malformed Content-Type bypassing file upload extension blocklist ([GHSA-r899-h629-j84r](https://github.com/parse-community/parse-server/security/advisories/GHSA-r899-h629-j84r )) (#10523 )

2026-06-25 11:09:37 +02:00

ParseGeoPoint.spec.js

ci: Fix test exclusion list in combination with other exclusions (#9277 )

2024-08-13 22:13:19 +02:00

ParseGlobalConfig.spec.js

fix: Server internal error details leaking in error messages returned to clients (#9937 )

2025-11-23 13:51:42 +01:00

ParseGraphQLClassNameTransformer.spec.js

fix(prettier): Properly handle lint-stage files (#6970 )

2020-10-25 15:06:58 -05:00

ParseGraphQLController.spec.js

Improve single schema cache (#7214 )

2021-03-16 16:05:36 -05:00

ParseGraphQLSchema.spec.js

ci: Fix test exclusion list in combination with other exclusions (#9277 )

2024-08-13 22:13:19 +02:00

ParseGraphQLServer.spec.js

fix: GraphQL error messages disclose pointer and relation target class names when public introspection is disabled ([GHSA-r2g6-4f6j-f6rf](https://github.com/parse-community/parse-server/security/advisories/GHSA-r2g6-4f6j-f6rf )) (#10569 )

2026-07-11 00:28:50 +02:00

ParseHooks.spec.js

feat: Upgrade to express 5.0.1 (#9530 )

2025-03-03 22:11:42 +01:00

ParseInstallation.spec.js

fix: Server internal error details leaking in error messages returned to clients (#9937 )

2025-11-23 13:51:42 +01:00

ParseLiveQuery.spec.js

fix: LiveQuery discloses object data to a subscriber across an ACL read-access change ([GHSA-97pr-9hgg-3p8r](https://github.com/parse-community/parse-server/security/advisories/GHSA-97pr-9hgg-3p8r )) (#10516 )

2026-06-19 02:14:17 +02:00

ParseLiveQueryRedis.spec.js

ci: Fix flaky tests (#8468 )

2023-03-10 23:54:05 +01:00

ParseLiveQueryServer.spec.js

fix: Denial of service via exponential-time processing of deeply nested query operators ([GHSA-cgxm-vr2f-6fj8](https://github.com/parse-community/parse-server/security/advisories/GHSA-cgxm-vr2f-6fj8 )) (#10512 )

2026-06-17 16:21:38 +02:00

ParseObject.spec.js

fix: Security upgrade to parse 7.0.1 (#9877 )

2025-10-15 18:39:37 +02:00

ParsePolygon.spec.js

ci: Fix test exclusion list in combination with other exclusions (#9277 )

2024-08-13 22:13:19 +02:00

ParsePubSub.spec.js

fix(prettier): Properly handle lint-stage files (#6970 )

2020-10-25 15:06:58 -05:00

ParseQuery.Aggregate.spec.js

fix: Server internal error details leaking in error messages returned to clients (#9937 )

2025-11-23 13:51:42 +01:00

ParseQuery.Comment.spec.js

fix: Security upgrade to parse 7.0.1 (#9877 )

2025-10-15 18:39:37 +02:00

ParseQuery.FullTextSearch.spec.js

fix: Parse Server doesn't shutdown gracefully (#9634 )

2025-03-27 21:38:51 +01:00

ParseQuery.hint.spec.js

feat: Increase required minimum MongoDB versions to 6.0.19, 7.0.16, 8.0.4 (#9531 )

2025-01-12 01:44:10 +01:00

ParseQuery.spec.js

test: Add tests for Parse.Query.includeAll for circular and self-referencing pointers (#9936 )

2025-11-23 13:16:22 +01:00

ParseRelation.spec.js

fix: Security upgrade to parse 7.0.1 (#9877 )

2025-10-15 18:39:37 +02:00

ParseRole.spec.js

fix: Error in afterSave trigger for Parse.Role due to name field (#9883 )

2025-10-22 14:12:51 +02:00

parsers.spec.js

fix: Parse Server option maxLogFiles doesn't recognize day duration literals such as 1d to mean 1 day (#9215 )

2024-07-18 15:41:59 +02:00

ParseServer.spec.js

fix: Parse Server doesn't shutdown gracefully (#9634 )

2025-03-27 21:38:51 +01:00

ParseServerRESTController.spec.js

fix: Parse Server doesn't shutdown gracefully (#9634 )

2025-03-27 21:38:51 +01:00

ParseSession.spec.js

fix: Session field immutability bypass via falsy-value guard ([GHSA-f6j3-w9v3-cq22](https://github.com/parse-community/parse-server/security/advisories/GHSA-f6j3-w9v3-cq22 )) (#10348 )

2026-03-29 04:56:09 +01:00

ParseUser.spec.js

fix: Login timing side-channel reveals user existence ([GHSA-mmpq-5hcv-hf2v](https://github.com/parse-community/parse-server/security/advisories/GHSA-mmpq-5hcv-hf2v )) (#10399 )

2026-04-05 17:58:38 +01:00

ParseWebSocket.spec.js

fix(prettier): Properly handle lint-stage files (#6970 )

2020-10-25 15:06:58 -05:00

ParseWebSocketServer.spec.js

fix: websocket connection of LiveQuery interrupts frequently (#8048 )

2022-06-17 13:20:48 +02:00

PasswordPolicy.spec.js

fix: Remove username from email verification and password reset process (#8488 )

2025-03-02 02:32:43 +01:00

PointerPermissions.spec.js

test: Add more test IDs (#9285 )

2024-08-16 21:21:56 +02:00

PostgresConfigParser.spec.js

refactor: Upgrade pg-promise to 11.3.0 and pg-monitor to 2.0.0 (#8453 )

2023-03-06 00:16:04 +01:00

PostgresInitOptions.spec.js

build: release

2022-03-18 15:17:12 +01:00

PostgresStorageAdapter.spec.js

ci: Find duplicate and slow tests (#9188 )

2024-07-16 10:34:10 +02:00

PromiseRouter.spec.js

Use Prettier JS (#5017 )

2018-09-01 13:58:06 -04:00

ProtectedFields.spec.js

fix: Protected fields bypass via logical query operators ([GHSA-72hp-qff8-4pvv](https://github.com/parse-community/parse-server/security/advisories/GHSA-72hp-qff8-4pvv )) (#10139 )

2026-03-08 15:25:37 +00:00

PublicAPI.spec.js

refactor: Bump to jasmine 5.6.0 (#9453 )

2025-03-11 21:34:14 +01:00

PurchaseValidation.spec.js

fix: Stored XSS via malformed Content-Type bypassing file upload extension blocklist ([GHSA-r899-h629-j84r](https://github.com/parse-community/parse-server/security/advisories/GHSA-r899-h629-j84r )) (#10523 )

2026-06-25 11:09:37 +02:00

PushController.spec.js

fix: Classes _GraphQLConfig and _Audience master key bypass via generic class routes ([GHSA-7xg7-rqf6-pw6c](https://github.com/parse-community/parse-server/security/advisories/GHSA-7xg7-rqf6-pw6c )) (#10152 )

2026-03-09 03:41:25 +00:00

PushQueue.spec.js

fix(prettier): Properly handle lint-stage files (#6970 )

2020-10-25 15:06:58 -05:00

PushRouter.spec.js

fix(prettier): Properly handle lint-stage files (#6970 )

2020-10-25 15:06:58 -05:00

PushWorker.spec.js

ci: Fix test exclusion list in combination with other exclusions (#9277 )

2024-08-13 22:13:19 +02:00

QueryTools.spec.js

fix: LiveQuery subscription with invalid regular expression crashes server ([GHSA-827p-g5x5-h86c](https://github.com/parse-community/parse-server/security/advisories/GHSA-827p-g5x5-h86c )) (#10199 )

2026-03-14 14:21:52 +01:00

RateLimit.spec.js

fix: Rate limit bypass via batch request endpoint ([GHSA-775h-3xrc-c228](https://github.com/parse-community/parse-server/security/advisories/GHSA-775h-3xrc-c228 )) (#10148 )

2026-03-08 20:30:42 +00:00

ReadPreferenceOption.spec.js

feat: Remove deprecation DEPPS1: Native MongoDB syntax in aggregation pipeline (#8362 )

2023-01-05 15:53:43 +01:00

RedisCacheAdapter.spec.js

fix: CacheAdapter does not connect when using a CacheAdapter with a JSON config (#8633 )

2024-03-15 17:46:06 +01:00

RedisPubSub.spec.js

fix: LiveQueryServer crashes using cacheAdapter on disconnect from Redis 4 server (#9616 )

2025-02-24 02:48:10 +01:00

RegexVulnerabilities.spec.js

fix: Account takeover via operator injection in authentication data identifier ([GHSA-5fw2-8jcv-xh87](https://github.com/parse-community/parse-server/security/advisories/GHSA-5fw2-8jcv-xh87 )) (#10186 )

2026-03-11 18:07:21 +00:00

RequestComplexity.spec.js

fix: Denial of service via exponential-time processing of deeply nested query operators ([GHSA-cgxm-vr2f-6fj8](https://github.com/parse-community/parse-server/security/advisories/GHSA-cgxm-vr2f-6fj8 )) (#10512 )

2026-06-17 16:21:38 +02:00

rest.spec.js

fix: Classes _GraphQLConfig and _Audience master key bypass via generic class routes ([GHSA-7xg7-rqf6-pw6c](https://github.com/parse-community/parse-server/security/advisories/GHSA-7xg7-rqf6-pw6c )) (#10152 )

2026-03-09 03:41:25 +00:00

RestQuery.spec.js

fix: Parse Server session token exfiltration via redirectClassNameForKey query parameter ([GHSA-6r2j-cxgf-495f](https://github.com/parse-community/parse-server/security/advisories/GHSA-6r2j-cxgf-495f )) (#10144 )

2026-03-08 17:23:47 +00:00

RevocableSessionsUpgrade.spec.js

refactor: Bump to jasmine 5.6.0 (#9453 )

2025-03-11 21:34:14 +01:00

Schema.spec.js

fix: Server internal error details leaking in error messages returned to clients (#9937 )

2025-11-23 13:51:42 +01:00

SchemaPerformance.spec.js

fix: Parse Server doesn't shutdown gracefully (#9634 )

2025-03-27 21:38:51 +01:00

schemas.spec.js

fix: Server internal error details leaking in error messages returned to clients (#9937 )

2025-11-23 13:51:42 +01:00

SecurityCheck.spec.js

fix: Regular Expression Denial of Service (ReDoS) via $regex query in LiveQuery ([GHSA-mf3j-86qx-cq5j](https://github.com/parse-community/parse-server/security/advisories/GHSA-mf3j-86qx-cq5j )) (#10120 )

2026-03-07 02:14:34 +00:00

SecurityCheckGroups.spec.js

fix: Revert accidental breaking default values for query complexity limits (#10206 )

2026-03-15 03:34:04 +00:00

SessionTokenCache.spec.js

refactor: Upgrade lru-cache from 7.12.0 to 9.1.1 (#8559 )

2023-05-25 23:59:42 +02:00

Subscription.spec.js

fix(prettier): Properly handle lint-stage files (#6970 )

2020-10-25 15:06:58 -05:00

Uniqueness.spec.js

ci: Fix test exclusion list in combination with other exclusions (#9277 )

2024-08-13 22:13:19 +02:00

UserController.spec.js

ci: Fix flaky sendVerificationEmail tests (#9692 )

2025-04-15 17:25:42 +01:00

UserPII.spec.js

refactor: Bump to jasmine 5.6.0 (#9453 )

2025-03-11 21:34:14 +01:00

Utils.spec.js

fix: Stored XSS via trailing-dot filename bypassing file upload extension blocklist ([GHSA-7wqv-xjf3-x35v](https://github.com/parse-community/parse-server/security/advisories/GHSA-7wqv-xjf3-x35v )) (#10490 )

2026-06-01 23:36:40 +02:00

ValidationAndPasswordsReset.spec.js

fix: Email verification resend page leaks user existence (GHSA-h29g-q5c2-9h4f) (#10243 )

2026-03-19 02:09:14 +00:00

VerifyUserPassword.spec.js

feat: Add password validation via POST request for user with unverified email using master key and option ignoreEmailVerification (#8895 )

2024-01-17 17:43:04 +01:00

vulnerabilities.spec.js

fix: Relation $relatedTo query bypasses protectedFields and owning-object ACL ([GHSA-wmwx-jr2p-4j4r](https://github.com/parse-community/parse-server/security/advisories/GHSA-wmwx-jr2p-4j4r )) (#10494 )

2026-06-04 01:53:37 +02:00

WinstonLoggerAdapter.spec.js

ci: Fix test exclusion list in combination with other exclusions (#9277 )

2024-08-13 22:13:19 +02:00