parse-community-parse-server

Adapters

fix: GeoPoint distance queries fail with an internal server error on MongoDB 8.3 and later (#10572 )

2026-07-13 02:39:05 +02:00

cli

refactor: Add lint rules for no unused vars and unused import (#9940 )

2025-11-22 22:12:34 +01:00

cloud-code

feat: Add support for invoking Cloud Function with multipart/form-data protocol (#10395 )

2026-04-04 17:46:51 +01:00

Controllers

fix: Relation $relatedTo query bypasses protectedFields and owning-object ACL ([GHSA-wmwx-jr2p-4j4r](https://github.com/parse-community/parse-server/security/advisories/GHSA-wmwx-jr2p-4j4r )) (#10493 )

2026-06-04 01:52:43 +02:00

Deprecator

feat: Add option to disallow aggregation pipelines for the read-only master key (#10517 )

2026-06-20 01:11:51 +02:00

GraphQL

fix: GraphQL error messages disclose pointer and relation target class names when public introspection is disabled ([GHSA-r2g6-4f6j-f6rf](https://github.com/parse-community/parse-server/security/advisories/GHSA-r2g6-4f6j-f6rf )) (#10568 )

2026-07-11 00:28:29 +02:00

LiveQuery

fix: LiveQuery discloses object data to a subscriber across an ACL read-access change ([GHSA-97pr-9hgg-3p8r](https://github.com/parse-community/parse-server/security/advisories/GHSA-97pr-9hgg-3p8r )) (#10515 )

2026-06-19 02:13:55 +02:00

Options

fix: NumberOrBoolean config option (cluster) value not coerced from env/CLI (#10531 )

2026-07-07 15:37:06 +02:00

Push

fix: Schema poisoning via prototype pollution in deep copy ([GHSA-9ccr-fpp6-78qf](https://github.com/parse-community/parse-server/security/advisories/GHSA-9ccr-fpp6-78qf )) (#10200 )

2026-03-14 16:01:04 +01:00

Routers

fix: Stored XSS via malformed Content-Type bypassing file upload extension blocklist ([GHSA-r899-h629-j84r](https://github.com/parse-community/parse-server/security/advisories/GHSA-r899-h629-j84r )) (#10521 )

2026-06-25 11:09:12 +02:00

SchemaMigrations

feat: Add option keepUnknownIndexes to retain indexes which are not specified in schema (#9857 )

2025-10-03 14:35:34 +02:00

Security

fix: Add configurable batch request sub-request limit via option requestComplexity.batchRequestLimit (#10265 )

2026-03-21 02:20:35 +00:00

vendor

refactor: Upgrade to eslint 9.19.0 (#9580 )

2025-02-01 15:32:43 +01:00

AccountLockout.js

fix: Account lockout race condition allows bypassing threshold via concurrent requests (#10266 )

2026-03-21 03:04:42 +00:00

Auth.js

fix: Denial of service via unindexed database query for unconfigured auth providers ([GHSA-g4cf-xj29-wqqr](https://github.com/parse-community/parse-server/security/advisories/GHSA-g4cf-xj29-wqqr )) (#10270 )

2026-03-21 15:49:08 +00:00

AuthDataLock.js

fix: MFA SMS one-time password accepted twice under concurrent login ([GHSA-jpq4-7fmq-q5fj](https://github.com/parse-community/parse-server/security/advisories/GHSA-jpq4-7fmq-q5fj )) (#10448 )

2026-04-26 03:10:27 +01:00

batch.js

fix: Middleware route checks do not match routing-equivalent path variants (trailing slash, case) (#10501 )

2026-06-12 13:03:10 +02:00

cache.js

Use Prettier JS (#5017 )

2018-09-01 13:58:06 -04:00

Config.js

feat: Add installation deviceToken deduplication options (#10451 )

2026-04-30 23:11:39 +01:00

cryptoUtils.js

fix(prettier): Properly handle lint-stage files (#6970 )

2020-10-25 15:06:58 -05:00

defaults.js

fix: Concurrent signup with same authentication creates duplicate users (#10149 )

2026-03-09 02:05:27 +00:00

deprecated.js

fix(prettier): Properly handle lint-stage files (#6970 )

2020-10-25 15:06:58 -05:00

Error.js

fix: Malformed $regex query leaks database error details in API response ([GHSA-9cp7-3q5w-j92g](https://github.com/parse-community/parse-server/security/advisories/GHSA-9cp7-3q5w-j92g )) (#10101 )

2026-03-05 20:46:05 +00:00

FileUrlValidator.js

feat: Add Parse.File.url validation with config fileUpload.allowedFileUrlDomains against SSRF attacks (#10044 )

2026-02-07 17:03:39 +00:00

index.ts

feat: Add TypeScript definitions (#9693 )

2025-04-15 12:59:58 +01:00

InstallationDedup.js

feat: Add installation deviceToken deduplication options (#10451 )

2026-04-30 23:11:39 +01:00

KeyPromiseQueue.js

Add KeyPromiseQueue to Push and Job StatusHandlers (#7267 )

2021-03-15 18:51:46 -05:00

logger.ts

feat: Add TypeScript support (#9550 )

2025-01-30 01:45:35 +01:00

middlewares.js

fix: Middleware route checks do not match routing-equivalent path variants (trailing slash, case) (#10501 )

2026-06-12 13:03:10 +02:00

Page.js

Add page localization (#7128 )

2021-02-09 14:03:57 +01:00

ParseMessageQueue.js

fix(prettier): Properly handle lint-stage files (#6970 )

2020-10-25 15:06:58 -05:00

ParseServer.ts

feat: Add support for invoking Cloud Function with multipart/form-data protocol (#10395 )

2026-04-04 17:46:51 +01:00

ParseServerRESTController.js

fix: Context mutations leak across requests in ParseServerRESTController (#10291 )

2026-04-12 15:20:58 +01:00

password.js

fix: Login timing side-channel reveals user existence ([GHSA-mmpq-5hcv-hf2v](https://github.com/parse-community/parse-server/security/advisories/GHSA-mmpq-5hcv-hf2v )) (#10398 )

2026-04-05 17:48:57 +01:00

PromiseRouter.js

feat: Upgrade to express 5.0.1 (#9530 )

2025-03-03 22:11:42 +01:00

request.js

refactor: Add lint rules for no unused vars and unused import (#9940 )

2025-11-22 22:12:34 +01:00

requiredParameter.js

Use Prettier JS (#5017 )

2018-09-01 13:58:06 -04:00

rest.js

fix: Pre-authentication denial of service via client version header regex backtracking ([GHSA-38m6-82c8-4xfm](https://github.com/parse-community/parse-server/security/advisories/GHSA-38m6-82c8-4xfm )) (#10463 )

2026-05-17 15:11:10 +01:00

RestQuery.js

fix: Denial of service via exponential-time processing of deeply nested query operators ([GHSA-cgxm-vr2f-6fj8](https://github.com/parse-community/parse-server/security/advisories/GHSA-cgxm-vr2f-6fj8 )) (#10511 )

2026-06-17 16:21:23 +02:00

RestWrite.js

fix: Pre-authentication denial of service via client version header regex backtracking ([GHSA-38m6-82c8-4xfm](https://github.com/parse-community/parse-server/security/advisories/GHSA-38m6-82c8-4xfm )) (#10463 )

2026-05-17 15:11:10 +01:00

SharedRest.js

fix: Classes _GraphQLConfig and _Audience master key bypass via generic class routes ([GHSA-7xg7-rqf6-pw6c](https://github.com/parse-community/parse-server/security/advisories/GHSA-7xg7-rqf6-pw6c )) (#10151 )

2026-03-09 03:41:12 +00:00

StatusHandler.js

fix: Instance comparison with instanceof is not realm-safe (#10225 )

2026-03-16 21:30:09 +00:00

TestUtils.js

fix: Server internal error details leaking in error messages returned to clients (#9937 )

2025-11-23 13:51:42 +01:00

triggers.js

fix: Cloud Code beforeFind trigger context is not isolated from prototype pollution (#10570 )

2026-07-11 03:45:38 +02:00

Utils.js

fix: Stored XSS via trailing-dot filename bypassing file upload extension blocklist ([GHSA-7wqv-xjf3-x35v](https://github.com/parse-community/parse-server/security/advisories/GHSA-7wqv-xjf3-x35v )) (#10489 )

2026-06-01 23:36:26 +02:00