Manuel fd6f6a6ea9 fix: OAuth2 adapter app ID validation sends wrong token to introspection endpoint ([GHSA-69xg-f649-w5g2](https://github.com/parse-community/parse-server/security/advisories/GHSA-69xg-f649-w5g2)) (#10188)

2026-03-11 23:47:44 +00:00

..

Adapters

fix: OAuth2 adapter app ID validation sends wrong token to introspection endpoint ([GHSA-69xg-f649-w5g2](https://github.com/parse-community/parse-server/security/advisories/GHSA-69xg-f649-w5g2)) (#10188)

2026-03-11 23:47:44 +00:00

cli

refactor: Add lint rules for no unused vars and unused import (#9940)

2025-11-22 22:12:34 +01:00

cloud-code

feat: Add beforePasswordResetRequest hook (#9906)

2025-11-19 14:57:28 +01:00

Controllers

SQL injection via query field name when using PostgreSQL ([GHSA-c442-97qw-j6c6](https://github.com/parse-community/parse-server/security/advisories/GHSA-c442-97qw-j6c6)) (#10179)

2026-03-11 14:22:31 +00:00

Deprecator

fix: Deprecation warning logged at server launch for nested Parse Server option even if option is explicitly set (#9934)

2025-11-17 19:43:32 +01:00

GraphQL

fix: Denial-of-service via unbounded query complexity in REST and GraphQL API ([GHSA-cmj3-wx7h-ffvg](https://github.com/parse-community/parse-server/security/advisories/GHSA-cmj3-wx7h-ffvg)) (#10131)

2026-03-07 23:33:27 +00:00

LiveQuery

fix: Protected fields bypass via LiveQuery subscription WHERE clause ([GHSA-j7mm-f4rv-6q6q](https://github.com/parse-community/parse-server/security/advisories/GHSA-j7mm-f4rv-6q6q)) (#10176)

2026-03-10 20:53:16 +00:00

Options

fix: User enumeration via email verification endpoint ([GHSA-w54v-hf9p-8856](https://github.com/parse-community/parse-server/security/advisories/GHSA-w54v-hf9p-8856)) (#10173)

2026-03-10 13:59:30 +00:00

Push

fix(prettier): Properly handle lint-stage files (#6970)

2020-10-25 15:06:58 -05:00

Routers

fix: User enumeration via email verification endpoint ([GHSA-w54v-hf9p-8856](https://github.com/parse-community/parse-server/security/advisories/GHSA-w54v-hf9p-8856)) (#10173)

2026-03-10 13:59:30 +00:00

SchemaMigrations

feat: Add option keepUnknownIndexes to retain indexes which are not specified in schema (#9857)

2025-10-03 14:35:34 +02:00

Security

fix: User enumeration via email verification endpoint ([GHSA-w54v-hf9p-8856](https://github.com/parse-community/parse-server/security/advisories/GHSA-w54v-hf9p-8856)) (#10173)

2026-03-10 13:59:30 +00:00

vendor

refactor: Upgrade to eslint 9.19.0 (#9580)

2025-02-01 15:32:43 +01:00

AccountLockout.js

refactor: replace hardcoded error codes with references (#7546)

2021-10-18 20:19:47 +02:00

Auth.js

fix: Account takeover via operator injection in authentication data identifier ([GHSA-5fw2-8jcv-xh87](https://github.com/parse-community/parse-server/security/advisories/GHSA-5fw2-8jcv-xh87)) (#10186)

2026-03-11 18:07:21 +00:00

batch.js

fix: Rate limit bypass via batch request endpoint ([GHSA-775h-3xrc-c228](https://github.com/parse-community/parse-server/security/advisories/GHSA-775h-3xrc-c228)) (#10148)

2026-03-08 20:30:42 +00:00

cache.js

Use Prettier JS (#5017)

2018-09-01 13:58:06 -04:00

ClientSDK.js

fix(prettier): Properly handle lint-stage files (#6970)

2020-10-25 15:06:58 -05:00

Config.js

fix: User enumeration via email verification endpoint ([GHSA-w54v-hf9p-8856](https://github.com/parse-community/parse-server/security/advisories/GHSA-w54v-hf9p-8856)) (#10173)

2026-03-10 13:59:30 +00:00

cryptoUtils.js

fix(prettier): Properly handle lint-stage files (#6970)

2020-10-25 15:06:58 -05:00

defaults.js

fix: Concurrent signup with same authentication creates duplicate users (#10150)

2026-03-09 02:05:49 +00:00

deprecated.js

fix(prettier): Properly handle lint-stage files (#6970)

2020-10-25 15:06:58 -05:00

Error.js

fix: Malformed $regex query leaks database error details in API response (GHSA-9cp7-3q5w-j92g) (#10102)

2026-03-05 20:45:39 +00:00

index.ts

feat: Add TypeScript definitions (#9693)

2025-04-15 12:59:58 +01:00

KeyPromiseQueue.js

Add KeyPromiseQueue to Push and Job StatusHandlers (#7267)

2021-03-15 18:51:46 -05:00

logger.ts

feat: Add TypeScript support (#9550)

2025-01-30 01:45:35 +01:00

middlewares.js

fix: Rate limit bypass via batch request endpoint ([GHSA-775h-3xrc-c228](https://github.com/parse-community/parse-server/security/advisories/GHSA-775h-3xrc-c228)) (#10148)

2026-03-08 20:30:42 +00:00

Page.js

Add page localization (#7128)

2021-02-09 14:03:57 +01:00

ParseMessageQueue.js

fix(prettier): Properly handle lint-stage files (#6970)

2020-10-25 15:06:58 -05:00

ParseServer.ts

fix: Regular Expression Denial of Service (ReDoS) via $regex query in LiveQuery ([GHSA-mf3j-86qx-cq5j](https://github.com/parse-community/parse-server/security/advisories/GHSA-mf3j-86qx-cq5j)) (#10120)

2026-03-07 02:14:34 +00:00

ParseServerRESTController.js

feat: Upgrade Parse JS SDK from 6.0.0 to 6.1.0 (#9686)

2025-04-02 00:09:53 +01:00

password.js

refactor: Add lint rules for no unused vars and unused import (#9940)

2025-11-22 22:12:34 +01:00

PromiseRouter.js

feat: Upgrade to express 5.0.1 (#9530)

2025-03-03 22:11:42 +01:00

request.js

refactor: Add lint rules for no unused vars and unused import (#9940)

2025-11-22 22:12:34 +01:00

requiredParameter.js

Use Prettier JS (#5017)

2018-09-01 13:58:06 -04:00

rest.js

feat: Add Parse Server option enableSanitizedErrorResponse to remove detailed error messages from responses sent to clients (#9944)

2025-11-28 19:48:35 +01:00

RestQuery.js

fix: Protected fields bypass via dot-notation in query and sort ([GHSA-r2m8-pxm9-9c4g](https://github.com/parse-community/parse-server/security/advisories/GHSA-r2m8-pxm9-9c4g)) (#10168)

2026-03-10 02:04:35 +00:00

RestWrite.js

fix: Concurrent signup with same authentication creates duplicate users (#10150)

2026-03-09 02:05:49 +00:00

SharedRest.js

fix: Classes _GraphQLConfig and _Audience master key bypass via generic class routes ([GHSA-7xg7-rqf6-pw6c](https://github.com/parse-community/parse-server/security/advisories/GHSA-7xg7-rqf6-pw6c)) (#10152)

2026-03-09 03:41:25 +00:00

StatusHandler.js

perf: Remove saving Parse Cloud Job request parameters in internal collection _JobStatus (#8343)

2025-05-14 21:24:56 +02:00

TestUtils.js

fix: Server internal error details leaking in error messages returned to clients (#9937)

2025-11-23 13:51:42 +01:00

triggers.js

fix: Denial of Service (DoS) and Cloud Function Dispatch Bypass via Prototype Chain Resolution ([GHSA-5j86-7r7m-p8h6](https://github.com/parse-community/parse-server/security/advisories/GHSA-5j86-7r7m-p8h6)) (#10124)

2026-03-07 17:38:28 +00:00

Utils.js

fix: Denylist requestKeywordDenylist keyword scan bypass through nested object placement ([GHSA-q342-9w2p-57fp](https://github.com/parse-community/parse-server/security/advisories/GHSA-q342-9w2p-57fp)) (#10122)

2026-03-07 16:40:49 +00:00