parse-community-parse-server

Adapters/Auth

fix: OAuth2 adapter app ID validation sends wrong token to introspection endpoint ([GHSA-69xg-f649-w5g2](https://github.com/parse-community/parse-server/security/advisories/GHSA-69xg-f649-w5g2 )) (#10187 )

2026-03-11 23:48:06 +00:00

cloud

feat: Asynchronous initialization of Parse Server (#8232 )

2022-12-21 15:30:13 +01:00

configs

fix: Server does not start via CLI when auth option is set (#8666 )

2023-07-04 13:16:55 +02:00

dependencies

Remove S3 File Adapter (#7324 )

2021-04-09 10:12:24 -05:00

support

refactor: Bump jasmine from 5.7.1 to 6.1.0 (#10338 )

2026-03-28 16:10:57 +00:00

.babelrc

feat: Add TypeScript support (#9550 )

2025-01-30 01:45:35 +01:00

AccountLockoutPolicy.spec.js

fix: Account lockout race condition allows bypassing threshold via concurrent requests (#10266 )

2026-03-21 03:04:42 +00:00

AdaptableController.spec.js

fix(prettier): Properly handle lint-stage files (#6970 )

2020-10-25 15:06:58 -05:00

AdapterLoader.spec.js

fix: Instance comparison with instanceof is not realm-safe (#10225 )

2026-03-16 21:30:09 +00:00

AggregateRouter.spec.js

feat: Remove deprecation DEPPS1: Native MongoDB syntax in aggregation pipeline (#8362 )

2023-01-05 15:53:43 +01:00

Analytics.spec.js

fix(prettier): Properly handle lint-stage files (#6970 )

2020-10-25 15:06:58 -05:00

AudienceRouter.spec.js

fix: Classes _GraphQLConfig and _Audience master key bypass via generic class routes ([GHSA-7xg7-rqf6-pw6c](https://github.com/parse-community/parse-server/security/advisories/GHSA-7xg7-rqf6-pw6c )) (#10151 )

2026-03-09 03:41:12 +00:00

Auth.spec.js

fix: Using Parse Server option extendSessionOnUse does not correctly clear memory and functions as a debounce instead of a throttle (#8683 )

2025-03-06 01:34:52 +01:00

AuthDataUniqueIndex.spec.js

fix: Concurrent signup with same authentication creates duplicate users (#10149 )

2026-03-09 02:05:27 +00:00

AuthenticationAdapters.spec.js

test: Stale MFA unlink bypass via skipped adapter validation (#10277 )

2026-03-22 02:46:34 +00:00

AuthenticationAdaptersV2.spec.js

fix: Validate authData provider values in challenge endpoint (#10224 )

2026-03-16 19:22:45 +00:00

batch.spec.js

fix: Nested batch sub-requests cause unclear error (#10371 )

2026-04-01 14:35:25 +01:00

buildConfigDefinitions.spec.js

feat: Add event information to verifyUserEmails, preventLoginWithUnverifiedEmail to identify invoking signup / login action and auth provider (#9963 )

2026-02-06 03:48:35 +00:00

CacheController.spec.js

fix(prettier): Properly handle lint-stage files (#6970 )

2020-10-25 15:06:58 -05:00

CLI.spec.js

test: CLI execution tests fail on Node 22 due to late stderr callback (#10376 )

2026-04-01 16:46:24 +01:00

Client.spec.js

fix(prettier): Properly handle lint-stage files (#6970 )

2020-10-25 15:06:58 -05:00

ClientSDK.spec.js

Use Prettier JS (#5017 )

2018-09-01 13:58:06 -04:00

CloudCode.spec.js

test: Plaintext password accessible in beforeSave trigger on _User class (#10380 )

2026-04-01 20:40:18 +01:00

CloudCode.Validator.spec.js

test: Add more test IDs (#9285 )

2024-08-16 21:21:56 +02:00

CloudCodeLogger.spec.js

test: Fix flaky tests (#10313 )

2026-03-25 19:20:55 +00:00

CloudCodeMultipart.spec.js

feat: Add support for invoking Cloud Function with multipart/form-data protocol (#10395 )

2026-04-04 17:46:51 +01:00

cryptoUtils.spec.js

fix(prettier): Properly handle lint-stage files (#6970 )

2020-10-25 15:06:58 -05:00

DatabaseController.spec.js

feat: Extend storage adapter interface to optionally return matchedCount and modifiedCount from DatabaseController.update with many: true (#10353 )

2026-03-30 01:09:10 +01:00

defaultGraphQLTypes.spec.js

fix(prettier): Properly handle lint-stage files (#6970 )

2020-10-25 15:06:58 -05:00

DefinedSchemas.spec.js

feat: Add option keepUnknownIndexes to retain indexes which are not specified in schema (#9857 )

2025-10-03 14:35:34 +02:00

Deprecator.spec.js

refactor: Unnecessary deprecation warning on enableProductPurchaseLegacyApi: false (#10293 )

2026-03-23 23:07:17 +00:00

EmailVerificationToken.spec.js

fix: User enumeration via email verification endpoint ([GHSA-w54v-hf9p-8856](https://github.com/parse-community/parse-server/security/advisories/GHSA-w54v-hf9p-8856 )) (#10172 )

2026-03-10 13:58:58 +00:00

EnableExpressErrorHandler.spec.js

fix: Parse Server doesn't shutdown gracefully (#9634 )

2025-03-27 21:38:51 +01:00

eslint.config.js

fix: Instance comparison with instanceof is not realm-safe (#10225 )

2026-03-16 21:30:09 +00:00

EventEmitterPubSub.spec.js

fix(prettier): Properly handle lint-stage files (#6970 )

2020-10-25 15:06:58 -05:00

features.spec.js

fix: Server internal error details leaking in error messages returned to clients (#9937 )

2025-11-23 13:51:42 +01:00

FileDownload.spec.js

feat: Add server option fileDownload to restrict file download (#10394 )

2026-04-03 19:41:42 +01:00

FilesController.spec.js

feat: Add support for asynchronous invocation of FilesAdapter.getFileLocation (#9271 )

2024-08-27 17:09:19 +02:00

FileUrlValidator.spec.js

feat: Add Parse.File.url validation with config fileUpload.allowedFileUrlDomains against SSRF attacks (#10044 )

2026-02-07 17:03:39 +00:00

graphQLObjectsQueries.js

fix(prettier): Properly handle lint-stage files (#6970 )

2020-10-25 15:06:58 -05:00

GraphQLQueryComplexity.spec.js

fix: GraphQL complexity validator exponential fragment traversal DoS ([GHSA-mfj6-6p54-m98c](https://github.com/parse-community/parse-server/security/advisories/GHSA-mfj6-6p54-m98c )) (#10344 )

2026-03-29 02:32:35 +01:00

GridFSBucketStorageAdapter.spec.js

fix: Instance comparison with instanceof is not realm-safe (#10225 )

2026-03-16 21:30:09 +00:00

helper.js

ci: Remove feature to retry flaky tests (#10314 )

2026-03-26 00:30:55 +00:00

HTTPRequest.spec.js

feat: Upgrade to express 5.0.1 (#9530 )

2025-03-03 22:11:42 +01:00

Idempotency.spec.js

refactor: Bump uuid from 11.1.0 to 13.0.0 (#10370 )

2026-03-31 17:57:06 +01:00

index.spec.js

fix: JWT audience validation bypass in Google, Apple, and Facebook authentication adapters ([GHSA-x6fw-778m-wr9v](https://github.com/parse-community/parse-server/security/advisories/GHSA-x6fw-778m-wr9v )) (#10113 )

2026-03-06 05:12:13 +00:00

InMemoryCache.spec.js

fix(prettier): Properly handle lint-stage files (#6970 )

2020-10-25 15:06:58 -05:00

InMemoryCacheAdapter.spec.js

fix(prettier): Properly handle lint-stage files (#6970 )

2020-10-25 15:06:58 -05:00

InstallationsRouter.spec.js

refactor: Bump jasmine from 5.7.1 to 6.1.0 (#10338 )

2026-03-28 16:10:57 +00:00

JobSchedule.spec.js

fix(prettier): Properly handle lint-stage files (#6970 )

2020-10-25 15:06:58 -05:00

LdapAuth.spec.js

fix: LDAP injection via unsanitized user input in DN and group filter construction ([GHSA-7m6r-fhh7-r47c](https://github.com/parse-community/parse-server/security/advisories/GHSA-7m6r-fhh7-r47c )) (#10154 )

2026-03-09 14:06:32 +00:00

Logger.spec.js

Allow single server instance in test suite (#7262 )

2021-03-13 09:05:22 -06:00

LoggerController.spec.js

[WIP] Enable test suite to be randomized (#7265 )

2021-03-15 02:04:09 -05:00

LogsRouter.spec.js

fix: Server internal error details leaking in error messages returned to clients (#9937 )

2025-11-23 13:51:42 +01:00

Middlewares.spec.js

fix: Maintenance key IP mismatch silently downgrades to regular auth instead of rejecting (#10391 )

2026-04-03 17:36:27 +01:00

MongoSchemaCollectionAdapter.spec.js

feat: Add default ACL (#8701 )

2025-03-24 15:15:27 +01:00

MongoStorageAdapter.spec.js

refactor: Bump uuid from 11.1.0 to 13.0.0 (#10370 )

2026-03-31 17:57:06 +01:00

MongoTransform.spec.js

fix: Instance comparison with instanceof is not realm-safe (#10225 )

2026-03-16 21:30:09 +00:00

NullCacheAdapter.spec.js

fix(prettier): Properly handle lint-stage files (#6970 )

2020-10-25 15:06:58 -05:00

OAuth1.spec.js

test: Disable OAuth 1 tests with Twitter API (#9161 )

2024-06-22 03:09:13 +02:00

PagesRouter.spec.js

test: Reject non-ASCII characters in PagesRouter locale parameter (#10281 )

2026-03-22 17:32:50 +00:00

Parse.Push.spec.js

ci: Fix test exclusion list in combination with other exclusions (#9277 )

2024-08-13 22:13:19 +02:00

ParseACL.spec.js

fix: Default ACL overwrites custom ACL on Parse.Object update (#10061 )

2026-02-14 01:56:42 +00:00

ParseAPI.spec.js

fix: Instance comparison with instanceof is not realm-safe (#10225 )

2026-03-16 21:30:09 +00:00

ParseCloudCodePublisher.spec.js

fix(prettier): Properly handle lint-stage files (#6970 )

2020-10-25 15:06:58 -05:00

ParseConfigKey.spec.js

feat: Add support for more MongoDB driver options (#9911 )

2025-11-07 21:41:59 +01:00

ParseFile.spec.js

fix: Stored cross-site scripting (XSS) via SVG file upload ([GHSA-hcj7-6gxh-24ww](https://github.com/parse-community/parse-server/security/advisories/GHSA-hcj7-6gxh-24ww )) (#10136 )

2026-03-08 02:04:59 +00:00

ParseGeoPoint.spec.js

ci: Fix test exclusion list in combination with other exclusions (#9277 )

2024-08-13 22:13:19 +02:00

ParseGlobalConfig.spec.js

fix: Server internal error details leaking in error messages returned to clients (#9937 )

2025-11-23 13:51:42 +01:00

ParseGraphQLClassNameTransformer.spec.js

fix(prettier): Properly handle lint-stage files (#6970 )

2020-10-25 15:06:58 -05:00

ParseGraphQLController.spec.js

test: Fix flaky tests (#10320 )

2026-03-26 02:20:57 +00:00

ParseGraphQLSchema.spec.js

ci: Fix test exclusion list in combination with other exclusions (#9277 )

2024-08-13 22:13:19 +02:00

ParseGraphQLServer.spec.js

refactor: Bump uuid from 11.1.0 to 13.0.0 (#10370 )

2026-03-31 17:57:06 +01:00

ParseHooks.spec.js

feat: Upgrade to express 5.0.1 (#9530 )

2025-03-03 22:11:42 +01:00

ParseInstallation.spec.js

fix: Server internal error details leaking in error messages returned to clients (#9937 )

2025-11-23 13:51:42 +01:00

ParseLiveQuery.spec.js

fix: Missing error messages in Parse errors (#10304 )

2026-03-24 18:56:25 +00:00

ParseLiveQueryRedis.spec.js

ci: Fix flaky tests (#8468 )

2023-03-10 23:54:05 +01:00

ParseLiveQueryServer.spec.js

fix: Bypass of class-level permissions in LiveQuery ([GHSA-7ch5-98q2-7289](https://github.com/parse-community/parse-server/security/advisories/GHSA-7ch5-98q2-7289 )) (#10133 )

2026-03-08 01:15:08 +00:00

ParseObject.spec.js

fix: Security upgrade to parse 7.0.1 (#9877 )

2025-10-15 18:39:37 +02:00

ParsePolygon.spec.js

refactor: Bump jasmine from 5.7.1 to 6.1.0 (#10338 )

2026-03-28 16:10:57 +00:00

ParsePubSub.spec.js

fix(prettier): Properly handle lint-stage files (#6970 )

2020-10-25 15:06:58 -05:00

ParseQuery.Aggregate.spec.js

refactor: Bump jasmine from 5.7.1 to 6.1.0 (#10338 )

2026-03-28 16:10:57 +00:00

ParseQuery.Comment.spec.js

fix: Security upgrade to parse 7.0.1 (#9877 )

2025-10-15 18:39:37 +02:00

ParseQuery.FullTextSearch.spec.js

fix: Parse Server doesn't shutdown gracefully (#9634 )

2025-03-27 21:38:51 +01:00

ParseQuery.hint.spec.js

refactor: Bump jasmine from 5.7.1 to 6.1.0 (#10338 )

2026-03-28 16:10:57 +00:00

ParseQuery.spec.js

fix: Input type validation for query operators and batch path (#10230 )

2026-03-17 15:17:57 +00:00

ParseRelation.spec.js

fix: Security upgrade to parse 7.0.1 (#9877 )

2025-10-15 18:39:37 +02:00

ParseRole.spec.js

fix: Error in afterSave trigger for Parse.Role due to name field (#9883 )

2025-10-22 14:12:51 +02:00

parsers.spec.js

feat: Add event information to verifyUserEmails, preventLoginWithUnverifiedEmail to identify invoking signup / login action and auth provider (#9963 )

2026-02-06 03:48:35 +00:00

ParseServer.spec.js

fix: MongoDB timeout errors unhandled and potentially revealing internal data (#10020 )

2026-01-25 00:15:01 +01:00

ParseServerRESTController.spec.js

fix: Parse Server doesn't shutdown gracefully (#9634 )

2025-03-27 21:38:51 +01:00

ParseSession.spec.js

fix: Session field guard bypass via falsy values for ACL and user fields (#10382 )

2026-04-01 21:25:30 +01:00

ParseUser.spec.js

fix: Duplicate session destruction can cause unhandled promise rejection (#10319 )

2026-03-26 01:41:45 +00:00

ParseWebSocket.spec.js

fix(prettier): Properly handle lint-stage files (#6970 )

2020-10-25 15:06:58 -05:00

ParseWebSocketServer.spec.js

fix: websocket connection of LiveQuery interrupts frequently (#8048 )

2022-06-17 13:20:48 +02:00

PasswordPolicy.spec.js

feat: Deprecation DEPPS11: Replace PublicAPIRouter with PagesRouter (#9974 )

2025-12-12 20:55:39 +01:00

PointerPermissions.spec.js

test: Add more test IDs (#9285 )

2024-08-16 21:21:56 +02:00

PostgresConfigParser.spec.js

refactor: Upgrade pg-promise to 11.3.0 and pg-monitor to 2.0.0 (#8453 )

2023-03-06 00:16:04 +01:00

PostgresInitOptions.spec.js

build: release

2022-03-18 15:17:12 +01:00

PostgresStorageAdapter.spec.js

fix: Incomplete JSON key escaping in PostgreSQL Increment on nested Object fields (#10261 )

2026-03-20 20:33:40 +00:00

PromiseRouter.spec.js

Use Prettier JS (#5017 )

2018-09-01 13:58:06 -04:00

ProtectedFields.spec.js

fix: Maintenance key blocked from querying protected fields (#10290 )

2026-03-23 03:50:45 +00:00

PurchaseValidation.spec.js

feat: Add enableProductPurchaseLegacyApi option to disable legacy IAP validation (#10228 )

2026-03-17 00:26:31 +00:00

PushController.spec.js

fix: Instance comparison with instanceof is not realm-safe (#10225 )

2026-03-16 21:30:09 +00:00

PushQueue.spec.js

fix(prettier): Properly handle lint-stage files (#6970 )

2020-10-25 15:06:58 -05:00

PushRouter.spec.js

fix(prettier): Properly handle lint-stage files (#6970 )

2020-10-25 15:06:58 -05:00

PushWorker.spec.js

ci: Fix test exclusion list in combination with other exclusions (#9277 )

2024-08-13 22:13:19 +02:00

QueryTools.spec.js

test: LiveQuery regex timeout and context isolation are not exploitable (#10226 )

2026-03-16 22:06:42 +00:00

RateLimit.spec.js

fix: Batch login sub-request rate limit uses IP-based keying (#10349 )

2026-03-29 16:08:36 +01:00

ReadPreferenceOption.spec.js

feat: Remove deprecation DEPPS1: Native MongoDB syntax in aggregation pipeline (#8362 )

2023-01-05 15:53:43 +01:00

RedisCacheAdapter.spec.js

fix: CacheAdapter does not connect when using a CacheAdapter with a JSON config (#8633 )

2024-03-15 17:46:06 +01:00

RedisPubSub.spec.js

refactor: Bump redis from 4.7.0 to 5.10.0 (#9994 )

2026-01-17 22:09:44 +01:00

RegexVulnerabilities.spec.js

fix: Validate token type in PagesRouter to prevent type confusion errors (#10212 )

2026-03-15 18:43:23 +00:00

RequestComplexity.spec.js

fix: Add configurable batch request sub-request limit via option requestComplexity.batchRequestLimit (#10265 )

2026-03-21 02:20:35 +00:00

rest.spec.js

test: Fix flaky tests (#10320 )

2026-03-26 02:20:57 +00:00

RestQuery.spec.js

fix: Postgres query on non-existent column throws internal server error (#10308 )

2026-03-25 00:07:06 +00:00

RevocableSessionsUpgrade.spec.js

refactor: Bump to jasmine 5.6.0 (#9453 )

2025-03-11 21:34:14 +01:00

RouteAllowList.spec.js

feat: Add route block with new server option routeAllowList (#10389 )

2026-04-03 16:08:18 +01:00

Schema.spec.js

fix: Server internal error details leaking in error messages returned to clients (#9937 )

2025-11-23 13:51:42 +01:00

SchemaPerformance.spec.js

fix: Parse Server doesn't shutdown gracefully (#9634 )

2025-03-27 21:38:51 +01:00

schemas.spec.js

feat: Log more debug info when failing to set duplicate value for field with unique values (#9919 )

2025-12-14 16:39:17 +01:00

SecurityCheck.spec.js

fix: Regular Expression Denial of Service (ReDoS) via $regex query in LiveQuery ([GHSA-mf3j-86qx-cq5j](https://github.com/parse-community/parse-server/security/advisories/GHSA-mf3j-86qx-cq5j )) (#10118 )

2026-03-07 02:14:37 +00:00

SecurityCheckGroups.spec.js

fix: Add configurable batch request sub-request limit via option requestComplexity.batchRequestLimit (#10265 )

2026-03-21 02:20:35 +00:00

SessionTokenCache.spec.js

refactor: Upgrade lru-cache from 7.12.0 to 9.1.1 (#8559 )

2023-05-25 23:59:42 +02:00

Subscription.spec.js

fix(prettier): Properly handle lint-stage files (#6970 )

2020-10-25 15:06:58 -05:00

Uniqueness.spec.js

ci: Fix test exclusion list in combination with other exclusions (#9277 )

2024-08-13 22:13:19 +02:00

UserController.spec.js

ci: Fix flaky sendVerificationEmail tests (#9692 )

2025-04-15 17:25:42 +01:00

UserPII.spec.js

refactor: Bump to jasmine 5.6.0 (#9453 )

2025-03-11 21:34:14 +01:00

Utils.spec.js

fix: Instance comparison with instanceof is not realm-safe (#10225 )

2026-03-16 21:30:09 +00:00

ValidationAndPasswordsReset.spec.js

fix: Email verification resend page leaks user existence (GHSA-h29g-q5c2-9h4f) (#10238 )

2026-03-19 02:09:59 +00:00

VerifyUserPassword.spec.js

feat: Add password validation via POST request for user with unverified email using master key and option ignoreEmailVerification (#8895 )

2024-01-17 17:43:04 +01:00

vulnerabilities.spec.js

fix: File upload Content-Type override via extension mismatch ([GHSA-vr5f-2r24-w5hc](https://github.com/parse-community/parse-server/security/advisories/GHSA-vr5f-2r24-w5hc )) (#10383 )

2026-04-02 02:19:26 +01:00

WinstonLoggerAdapter.spec.js

ci: Fix test exclusion list in combination with other exclusions (#9277 )

2024-08-13 22:13:19 +02:00