parse-community-parse-server

Adapters/Auth

fix: OAuth2 adapter app ID validation sends wrong token to introspection endpoint ([GHSA-69xg-f649-w5g2](https://github.com/parse-community/parse-server/security/advisories/GHSA-69xg-f649-w5g2 )) (#10187 )

2026-03-11 23:48:06 +00:00

cloud

feat: Asynchronous initialization of Parse Server (#8232 )

2022-12-21 15:30:13 +01:00

configs

fix: Server does not start via CLI when auth option is set (#8666 )

2023-07-04 13:16:55 +02:00

dependencies

Remove S3 File Adapter (#7324 )

2021-04-09 10:12:24 -05:00

support

refactor: Add a few lint rules to test files in /spec (#9815 )

2025-07-04 20:24:08 +02:00

.babelrc

feat: Add TypeScript support (#9550 )

2025-01-30 01:45:35 +01:00

AccountLockoutPolicy.spec.js

fix: Account lockout race condition allows bypassing threshold via concurrent requests (#10266 )

2026-03-21 03:04:42 +00:00

AdaptableController.spec.js

fix(prettier): Properly handle lint-stage files (#6970 )

2020-10-25 15:06:58 -05:00

AdapterLoader.spec.js

fix: Instance comparison with instanceof is not realm-safe (#10225 )

2026-03-16 21:30:09 +00:00

AggregateRouter.spec.js

feat: Remove deprecation DEPPS1: Native MongoDB syntax in aggregation pipeline (#8362 )

2023-01-05 15:53:43 +01:00

Analytics.spec.js

fix(prettier): Properly handle lint-stage files (#6970 )

2020-10-25 15:06:58 -05:00

AudienceRouter.spec.js

fix: Classes _GraphQLConfig and _Audience master key bypass via generic class routes ([GHSA-7xg7-rqf6-pw6c](https://github.com/parse-community/parse-server/security/advisories/GHSA-7xg7-rqf6-pw6c )) (#10151 )

2026-03-09 03:41:12 +00:00

Auth.spec.js

fix: Using Parse Server option extendSessionOnUse does not correctly clear memory and functions as a debounce instead of a throttle (#8683 )

2025-03-06 01:34:52 +01:00

AuthDataUniqueIndex.spec.js

fix: Concurrent signup with same authentication creates duplicate users (#10149 )

2026-03-09 02:05:27 +00:00

AuthenticationAdapters.spec.js

test: Stale MFA unlink bypass via skipped adapter validation (#10277 )

2026-03-22 02:46:34 +00:00

AuthenticationAdaptersV2.spec.js

fix: Validate authData provider values in challenge endpoint (#10224 )

2026-03-16 19:22:45 +00:00

batch.spec.js

fix: Add configurable batch request sub-request limit via option requestComplexity.batchRequestLimit (#10265 )

2026-03-21 02:20:35 +00:00

buildConfigDefinitions.spec.js

feat: Add event information to verifyUserEmails, preventLoginWithUnverifiedEmail to identify invoking signup / login action and auth provider (#9963 )

2026-02-06 03:48:35 +00:00

CacheController.spec.js

fix(prettier): Properly handle lint-stage files (#6970 )

2020-10-25 15:06:58 -05:00

CLI.spec.js

refactor: Upgrade to commander 13.0.0 (#9574 )

2025-01-29 06:04:54 +01:00

Client.spec.js

fix(prettier): Properly handle lint-stage files (#6970 )

2020-10-25 15:06:58 -05:00

ClientSDK.spec.js

Use Prettier JS (#5017 )

2018-09-01 13:58:06 -04:00

CloudCode.spec.js

fix: Instance comparison with instanceof is not realm-safe (#10225 )

2026-03-16 21:30:09 +00:00

CloudCode.Validator.spec.js

test: Add more test IDs (#9285 )

2024-08-16 21:21:56 +02:00

CloudCodeLogger.spec.js

fix: Error in afterSave trigger for Parse.Role due to name field (#9883 )

2025-10-22 14:12:51 +02:00

cryptoUtils.spec.js

fix(prettier): Properly handle lint-stage files (#6970 )

2020-10-25 15:06:58 -05:00

DatabaseController.spec.js

fix: Concurrent signup with same authentication creates duplicate users (#10149 )

2026-03-09 02:05:27 +00:00

defaultGraphQLTypes.spec.js

fix(prettier): Properly handle lint-stage files (#6970 )

2020-10-25 15:06:58 -05:00

DefinedSchemas.spec.js

feat: Add option keepUnknownIndexes to retain indexes which are not specified in schema (#9857 )

2025-10-03 14:35:34 +02:00

Deprecator.spec.js

feat: Add enableProductPurchaseLegacyApi option to disable legacy IAP validation (#10228 )

2026-03-17 00:26:31 +00:00

EmailVerificationToken.spec.js

fix: User enumeration via email verification endpoint ([GHSA-w54v-hf9p-8856](https://github.com/parse-community/parse-server/security/advisories/GHSA-w54v-hf9p-8856 )) (#10172 )

2026-03-10 13:58:58 +00:00

EnableExpressErrorHandler.spec.js

fix: Parse Server doesn't shutdown gracefully (#9634 )

2025-03-27 21:38:51 +01:00

eslint.config.js

fix: Instance comparison with instanceof is not realm-safe (#10225 )

2026-03-16 21:30:09 +00:00

EventEmitterPubSub.spec.js

fix(prettier): Properly handle lint-stage files (#6970 )

2020-10-25 15:06:58 -05:00

features.spec.js

fix: Server internal error details leaking in error messages returned to clients (#9937 )

2025-11-23 13:51:42 +01:00

FilesController.spec.js

feat: Add support for asynchronous invocation of FilesAdapter.getFileLocation (#9271 )

2024-08-27 17:09:19 +02:00

FileUrlValidator.spec.js

feat: Add Parse.File.url validation with config fileUpload.allowedFileUrlDomains against SSRF attacks (#10044 )

2026-02-07 17:03:39 +00:00

graphQLObjectsQueries.js

fix(prettier): Properly handle lint-stage files (#6970 )

2020-10-25 15:06:58 -05:00

GraphQLQueryComplexity.spec.js

test: Request complexity controls correctly enforce subquery depth limits (GHSA-rqxg-pcc9-f79w) (#10215 )

2026-03-15 23:50:53 +00:00

GridFSBucketStorageAdapter.spec.js

fix: Instance comparison with instanceof is not realm-safe (#10225 )

2026-03-16 21:30:09 +00:00

helper.js

fix: Instance comparison with instanceof is not realm-safe (#10225 )

2026-03-16 21:30:09 +00:00

HTTPRequest.spec.js

feat: Upgrade to express 5.0.1 (#9530 )

2025-03-03 22:11:42 +01:00

Idempotency.spec.js

ci: Fix test exclusion list in combination with other exclusions (#9277 )

2024-08-13 22:13:19 +02:00

index.spec.js

fix: JWT audience validation bypass in Google, Apple, and Facebook authentication adapters ([GHSA-x6fw-778m-wr9v](https://github.com/parse-community/parse-server/security/advisories/GHSA-x6fw-778m-wr9v )) (#10113 )

2026-03-06 05:12:13 +00:00

InMemoryCache.spec.js

fix(prettier): Properly handle lint-stage files (#6970 )

2020-10-25 15:06:58 -05:00

InMemoryCacheAdapter.spec.js

fix(prettier): Properly handle lint-stage files (#6970 )

2020-10-25 15:06:58 -05:00

InstallationsRouter.spec.js

fix(prettier): Properly handle lint-stage files (#6970 )

2020-10-25 15:06:58 -05:00

JobSchedule.spec.js

fix(prettier): Properly handle lint-stage files (#6970 )

2020-10-25 15:06:58 -05:00

LdapAuth.spec.js

fix: LDAP injection via unsanitized user input in DN and group filter construction ([GHSA-7m6r-fhh7-r47c](https://github.com/parse-community/parse-server/security/advisories/GHSA-7m6r-fhh7-r47c )) (#10154 )

2026-03-09 14:06:32 +00:00

Logger.spec.js

Allow single server instance in test suite (#7262 )

2021-03-13 09:05:22 -06:00

LoggerController.spec.js

[WIP] Enable test suite to be randomized (#7265 )

2021-03-15 02:04:09 -05:00

LogsRouter.spec.js

fix: Server internal error details leaking in error messages returned to clients (#9937 )

2025-11-23 13:51:42 +01:00

Middlewares.spec.js

fix: Validate body field types in request middleware (#10209 )

2026-03-15 15:41:02 +00:00

MongoSchemaCollectionAdapter.spec.js

feat: Add default ACL (#8701 )

2025-03-24 15:15:27 +01:00

MongoStorageAdapter.spec.js

fix: Instance comparison with instanceof is not realm-safe (#10225 )

2026-03-16 21:30:09 +00:00

MongoTransform.spec.js

fix: Instance comparison with instanceof is not realm-safe (#10225 )

2026-03-16 21:30:09 +00:00

NullCacheAdapter.spec.js

fix(prettier): Properly handle lint-stage files (#6970 )

2020-10-25 15:06:58 -05:00

OAuth1.spec.js

test: Disable OAuth 1 tests with Twitter API (#9161 )

2024-06-22 03:09:13 +02:00

PagesRouter.spec.js

test: Reject non-ASCII characters in PagesRouter locale parameter (#10281 )

2026-03-22 17:32:50 +00:00

Parse.Push.spec.js

ci: Fix test exclusion list in combination with other exclusions (#9277 )

2024-08-13 22:13:19 +02:00

ParseACL.spec.js

fix: Default ACL overwrites custom ACL on Parse.Object update (#10061 )

2026-02-14 01:56:42 +00:00

ParseAPI.spec.js

fix: Instance comparison with instanceof is not realm-safe (#10225 )

2026-03-16 21:30:09 +00:00

ParseCloudCodePublisher.spec.js

fix(prettier): Properly handle lint-stage files (#6970 )

2020-10-25 15:06:58 -05:00

ParseConfigKey.spec.js

feat: Add support for more MongoDB driver options (#9911 )

2025-11-07 21:41:59 +01:00

ParseFile.spec.js

fix: Stored cross-site scripting (XSS) via SVG file upload ([GHSA-hcj7-6gxh-24ww](https://github.com/parse-community/parse-server/security/advisories/GHSA-hcj7-6gxh-24ww )) (#10136 )

2026-03-08 02:04:59 +00:00

ParseGeoPoint.spec.js

ci: Fix test exclusion list in combination with other exclusions (#9277 )

2024-08-13 22:13:19 +02:00

ParseGlobalConfig.spec.js

fix: Server internal error details leaking in error messages returned to clients (#9937 )

2025-11-23 13:51:42 +01:00

ParseGraphQLClassNameTransformer.spec.js

fix(prettier): Properly handle lint-stage files (#6970 )

2020-10-25 15:06:58 -05:00

ParseGraphQLController.spec.js

Improve single schema cache (#7214 )

2021-03-16 16:05:36 -05:00

ParseGraphQLSchema.spec.js

ci: Fix test exclusion list in combination with other exclusions (#9277 )

2024-08-13 22:13:19 +02:00

ParseGraphQLServer.spec.js

fix: Instance comparison with instanceof is not realm-safe (#10225 )

2026-03-16 21:30:09 +00:00

ParseHooks.spec.js

feat: Upgrade to express 5.0.1 (#9530 )

2025-03-03 22:11:42 +01:00

ParseInstallation.spec.js

fix: Server internal error details leaking in error messages returned to clients (#9937 )

2025-11-23 13:51:42 +01:00

ParseLiveQuery.spec.js

fix: LiveQuery subscription with invalid regular expression crashes server ([GHSA-827p-g5x5-h86c](https://github.com/parse-community/parse-server/security/advisories/GHSA-827p-g5x5-h86c )) (#10197 )

2026-03-14 14:23:27 +01:00

ParseLiveQueryRedis.spec.js

ci: Fix flaky tests (#8468 )

2023-03-10 23:54:05 +01:00

ParseLiveQueryServer.spec.js

fix: Bypass of class-level permissions in LiveQuery ([GHSA-7ch5-98q2-7289](https://github.com/parse-community/parse-server/security/advisories/GHSA-7ch5-98q2-7289 )) (#10133 )

2026-03-08 01:15:08 +00:00

ParseObject.spec.js

fix: Security upgrade to parse 7.0.1 (#9877 )

2025-10-15 18:39:37 +02:00

ParsePolygon.spec.js

ci: Fix test exclusion list in combination with other exclusions (#9277 )

2024-08-13 22:13:19 +02:00

ParsePubSub.spec.js

fix(prettier): Properly handle lint-stage files (#6970 )

2020-10-25 15:06:58 -05:00

ParseQuery.Aggregate.spec.js

fix: Server internal error details leaking in error messages returned to clients (#9937 )

2025-11-23 13:51:42 +01:00

ParseQuery.Comment.spec.js

fix: Security upgrade to parse 7.0.1 (#9877 )

2025-10-15 18:39:37 +02:00

ParseQuery.FullTextSearch.spec.js

fix: Parse Server doesn't shutdown gracefully (#9634 )

2025-03-27 21:38:51 +01:00

ParseQuery.hint.spec.js

feat: Increase required minimum MongoDB version to 7.0.16 (#9971 )

2025-12-12 18:51:39 +01:00

ParseQuery.spec.js

fix: Input type validation for query operators and batch path (#10230 )

2026-03-17 15:17:57 +00:00

ParseRelation.spec.js

fix: Security upgrade to parse 7.0.1 (#9877 )

2025-10-15 18:39:37 +02:00

ParseRole.spec.js

fix: Error in afterSave trigger for Parse.Role due to name field (#9883 )

2025-10-22 14:12:51 +02:00

parsers.spec.js

feat: Add event information to verifyUserEmails, preventLoginWithUnverifiedEmail to identify invoking signup / login action and auth provider (#9963 )

2026-02-06 03:48:35 +00:00

ParseServer.spec.js

fix: MongoDB timeout errors unhandled and potentially revealing internal data (#10020 )

2026-01-25 00:15:01 +01:00

ParseServerRESTController.spec.js

fix: Parse Server doesn't shutdown gracefully (#9634 )

2025-03-27 21:38:51 +01:00

ParseSession.spec.js

fix: Session update endpoint allows overwriting server-generated session fields ([GHSA-jc39-686j-wp6q](https://github.com/parse-community/parse-server/security/advisories/GHSA-jc39-686j-wp6q )) (#10263 )

2026-03-21 01:37:35 +00:00

ParseUser.spec.js

fix: Instance comparison with instanceof is not realm-safe (#10225 )

2026-03-16 21:30:09 +00:00

ParseWebSocket.spec.js

fix(prettier): Properly handle lint-stage files (#6970 )

2020-10-25 15:06:58 -05:00

ParseWebSocketServer.spec.js

fix: websocket connection of LiveQuery interrupts frequently (#8048 )

2022-06-17 13:20:48 +02:00

PasswordPolicy.spec.js

feat: Deprecation DEPPS11: Replace PublicAPIRouter with PagesRouter (#9974 )

2025-12-12 20:55:39 +01:00

PointerPermissions.spec.js

test: Add more test IDs (#9285 )

2024-08-16 21:21:56 +02:00

PostgresConfigParser.spec.js

refactor: Upgrade pg-promise to 11.3.0 and pg-monitor to 2.0.0 (#8453 )

2023-03-06 00:16:04 +01:00

PostgresInitOptions.spec.js

build: release

2022-03-18 15:17:12 +01:00

PostgresStorageAdapter.spec.js

fix: Incomplete JSON key escaping in PostgreSQL Increment on nested Object fields (#10261 )

2026-03-20 20:33:40 +00:00

PromiseRouter.spec.js

Use Prettier JS (#5017 )

2018-09-01 13:58:06 -04:00

ProtectedFields.spec.js

fix: User cannot retrieve own email with protectedFieldsOwnerExempt: false despite email not in protectedFields (#10284 )

2026-03-22 20:27:29 +00:00

PurchaseValidation.spec.js

feat: Add enableProductPurchaseLegacyApi option to disable legacy IAP validation (#10228 )

2026-03-17 00:26:31 +00:00

PushController.spec.js

fix: Instance comparison with instanceof is not realm-safe (#10225 )

2026-03-16 21:30:09 +00:00

PushQueue.spec.js

fix(prettier): Properly handle lint-stage files (#6970 )

2020-10-25 15:06:58 -05:00

PushRouter.spec.js

fix(prettier): Properly handle lint-stage files (#6970 )

2020-10-25 15:06:58 -05:00

PushWorker.spec.js

ci: Fix test exclusion list in combination with other exclusions (#9277 )

2024-08-13 22:13:19 +02:00

QueryTools.spec.js

test: LiveQuery regex timeout and context isolation are not exploitable (#10226 )

2026-03-16 22:06:42 +00:00

RateLimit.spec.js

fix: Normalize HTTP method case in allowMethodOverride middleware (#10262 )

2026-03-20 21:22:14 +00:00

ReadPreferenceOption.spec.js

feat: Remove deprecation DEPPS1: Native MongoDB syntax in aggregation pipeline (#8362 )

2023-01-05 15:53:43 +01:00

RedisCacheAdapter.spec.js

fix: CacheAdapter does not connect when using a CacheAdapter with a JSON config (#8633 )

2024-03-15 17:46:06 +01:00

RedisPubSub.spec.js

refactor: Bump redis from 4.7.0 to 5.10.0 (#9994 )

2026-01-17 22:09:44 +01:00

RegexVulnerabilities.spec.js

fix: Validate token type in PagesRouter to prevent type confusion errors (#10212 )

2026-03-15 18:43:23 +00:00

RequestComplexity.spec.js

fix: Add configurable batch request sub-request limit via option requestComplexity.batchRequestLimit (#10265 )

2026-03-21 02:20:35 +00:00

rest.spec.js

fix: Instance comparison with instanceof is not realm-safe (#10225 )

2026-03-16 21:30:09 +00:00

RestQuery.spec.js

fix: Parse Server session token exfiltration via redirectClassNameForKey query parameter ([GHSA-6r2j-cxgf-495f](https://github.com/parse-community/parse-server/security/advisories/GHSA-6r2j-cxgf-495f )) (#10143 )

2026-03-08 17:22:36 +00:00

RevocableSessionsUpgrade.spec.js

refactor: Bump to jasmine 5.6.0 (#9453 )

2025-03-11 21:34:14 +01:00

Schema.spec.js

fix: Server internal error details leaking in error messages returned to clients (#9937 )

2025-11-23 13:51:42 +01:00

SchemaPerformance.spec.js

fix: Parse Server doesn't shutdown gracefully (#9634 )

2025-03-27 21:38:51 +01:00

schemas.spec.js

feat: Log more debug info when failing to set duplicate value for field with unique values (#9919 )

2025-12-14 16:39:17 +01:00

SecurityCheck.spec.js

fix: Regular Expression Denial of Service (ReDoS) via $regex query in LiveQuery ([GHSA-mf3j-86qx-cq5j](https://github.com/parse-community/parse-server/security/advisories/GHSA-mf3j-86qx-cq5j )) (#10118 )

2026-03-07 02:14:37 +00:00

SecurityCheckGroups.spec.js

fix: Add configurable batch request sub-request limit via option requestComplexity.batchRequestLimit (#10265 )

2026-03-21 02:20:35 +00:00

SessionTokenCache.spec.js

refactor: Upgrade lru-cache from 7.12.0 to 9.1.1 (#8559 )

2023-05-25 23:59:42 +02:00

Subscription.spec.js

fix(prettier): Properly handle lint-stage files (#6970 )

2020-10-25 15:06:58 -05:00

Uniqueness.spec.js

ci: Fix test exclusion list in combination with other exclusions (#9277 )

2024-08-13 22:13:19 +02:00

UserController.spec.js

ci: Fix flaky sendVerificationEmail tests (#9692 )

2025-04-15 17:25:42 +01:00

UserPII.spec.js

refactor: Bump to jasmine 5.6.0 (#9453 )

2025-03-11 21:34:14 +01:00

Utils.spec.js

fix: Instance comparison with instanceof is not realm-safe (#10225 )

2026-03-16 21:30:09 +00:00

ValidationAndPasswordsReset.spec.js

fix: Email verification resend page leaks user existence (GHSA-h29g-q5c2-9h4f) (#10238 )

2026-03-19 02:09:59 +00:00

VerifyUserPassword.spec.js

feat: Add password validation via POST request for user with unverified email using master key and option ignoreEmailVerification (#8895 )

2024-01-17 17:43:04 +01:00

vulnerabilities.spec.js

fix: Auth data exposed via /users/me endpoint ([GHSA-37mj-c2wf-cx96](https://github.com/parse-community/parse-server/security/advisories/GHSA-37mj-c2wf-cx96 )) (#10278 )

2026-03-22 03:57:50 +00:00

WinstonLoggerAdapter.spec.js

ci: Fix test exclusion list in combination with other exclusions (#9277 )

2024-08-13 22:13:19 +02:00