parse-community-parse-server

Adapters/Auth

fix: OAuth2 adapter app ID validation sends wrong token to introspection endpoint ([GHSA-69xg-f649-w5g2](https://github.com/parse-community/parse-server/security/advisories/GHSA-69xg-f649-w5g2 )) (#10187 )

2026-03-11 23:48:06 +00:00

cloud

…

configs

fix: Server does not start via CLI when auth option is set (#8666 )

2023-07-04 13:16:55 +02:00

dependencies

…

support

refactor: Bump jasmine from 5.7.1 to 6.1.0 (#10338 )

2026-03-28 16:10:57 +00:00

.babelrc

feat: Add TypeScript support (#9550 )

2025-01-30 01:45:35 +01:00

AccountLockoutPolicy.spec.js

fix: Account lockout race condition allows bypassing threshold via concurrent requests (#10266 )

2026-03-21 03:04:42 +00:00

AdaptableController.spec.js

…

AdapterLoader.spec.js

fix: Instance comparison with instanceof is not realm-safe (#10225 )

2026-03-16 21:30:09 +00:00

AggregateRouter.spec.js

feat: Remove deprecation DEPPS1: Native MongoDB syntax in aggregation pipeline (#8362 )

2023-01-05 15:53:43 +01:00

Analytics.spec.js

…

AudienceRouter.spec.js

fix: Classes _GraphQLConfig and _Audience master key bypass via generic class routes ([GHSA-7xg7-rqf6-pw6c](https://github.com/parse-community/parse-server/security/advisories/GHSA-7xg7-rqf6-pw6c )) (#10151 )

2026-03-09 03:41:12 +00:00

Auth.spec.js

fix: Using Parse Server option extendSessionOnUse does not correctly clear memory and functions as a debounce instead of a throttle (#8683 )

2025-03-06 01:34:52 +01:00

AuthDataUniqueIndex.spec.js

fix: Concurrent signup with same authentication creates duplicate users (#10149 )

2026-03-09 02:05:27 +00:00

AuthenticationAdapters.spec.js

test: Stale MFA unlink bypass via skipped adapter validation (#10277 )

2026-03-22 02:46:34 +00:00

AuthenticationAdaptersV2.spec.js

fix: Validate authData provider values in challenge endpoint (#10224 )

2026-03-16 19:22:45 +00:00

batch.spec.js

fix: Add configurable batch request sub-request limit via option requestComplexity.batchRequestLimit (#10265 )

2026-03-21 02:20:35 +00:00

buildConfigDefinitions.spec.js

feat: Add event information to verifyUserEmails, preventLoginWithUnverifiedEmail to identify invoking signup / login action and auth provider (#9963 )

2026-02-06 03:48:35 +00:00

CacheController.spec.js

…

CLI.spec.js

refactor: Upgrade to commander 13.0.0 (#9574 )

2025-01-29 06:04:54 +01:00

Client.spec.js

…

ClientSDK.spec.js

…

CloudCode.spec.js

fix: Instance comparison with instanceof is not realm-safe (#10225 )

2026-03-16 21:30:09 +00:00

CloudCode.Validator.spec.js

test: Add more test IDs (#9285 )

2024-08-16 21:21:56 +02:00

CloudCodeLogger.spec.js

test: Fix flaky tests (#10313 )

2026-03-25 19:20:55 +00:00

cryptoUtils.spec.js

…

DatabaseController.spec.js

fix: Concurrent signup with same authentication creates duplicate users (#10149 )

2026-03-09 02:05:27 +00:00

defaultGraphQLTypes.spec.js

…

DefinedSchemas.spec.js

feat: Add option keepUnknownIndexes to retain indexes which are not specified in schema (#9857 )

2025-10-03 14:35:34 +02:00

Deprecator.spec.js

refactor: Unnecessary deprecation warning on enableProductPurchaseLegacyApi: false (#10293 )

2026-03-23 23:07:17 +00:00

EmailVerificationToken.spec.js

fix: User enumeration via email verification endpoint ([GHSA-w54v-hf9p-8856](https://github.com/parse-community/parse-server/security/advisories/GHSA-w54v-hf9p-8856 )) (#10172 )

2026-03-10 13:58:58 +00:00

EnableExpressErrorHandler.spec.js

fix: Parse Server doesn't shutdown gracefully (#9634 )

2025-03-27 21:38:51 +01:00

eslint.config.js

fix: Instance comparison with instanceof is not realm-safe (#10225 )

2026-03-16 21:30:09 +00:00

EventEmitterPubSub.spec.js

…

features.spec.js

fix: Server internal error details leaking in error messages returned to clients (#9937 )

2025-11-23 13:51:42 +01:00

FilesController.spec.js

feat: Add support for asynchronous invocation of FilesAdapter.getFileLocation (#9271 )

2024-08-27 17:09:19 +02:00

FileUrlValidator.spec.js

feat: Add Parse.File.url validation with config fileUpload.allowedFileUrlDomains against SSRF attacks (#10044 )

2026-02-07 17:03:39 +00:00

graphQLObjectsQueries.js

…

GraphQLQueryComplexity.spec.js

fix: GraphQL complexity validator exponential fragment traversal DoS ([GHSA-mfj6-6p54-m98c](https://github.com/parse-community/parse-server/security/advisories/GHSA-mfj6-6p54-m98c )) (#10344 )

2026-03-29 02:32:35 +01:00

GridFSBucketStorageAdapter.spec.js

fix: Instance comparison with instanceof is not realm-safe (#10225 )

2026-03-16 21:30:09 +00:00

helper.js

ci: Remove feature to retry flaky tests (#10314 )

2026-03-26 00:30:55 +00:00

HTTPRequest.spec.js

feat: Upgrade to express 5.0.1 (#9530 )

2025-03-03 22:11:42 +01:00

Idempotency.spec.js

ci: Fix test exclusion list in combination with other exclusions (#9277 )

2024-08-13 22:13:19 +02:00

index.spec.js

fix: JWT audience validation bypass in Google, Apple, and Facebook authentication adapters ([GHSA-x6fw-778m-wr9v](https://github.com/parse-community/parse-server/security/advisories/GHSA-x6fw-778m-wr9v )) (#10113 )

2026-03-06 05:12:13 +00:00

InMemoryCache.spec.js

…

InMemoryCacheAdapter.spec.js

…

InstallationsRouter.spec.js

refactor: Bump jasmine from 5.7.1 to 6.1.0 (#10338 )

2026-03-28 16:10:57 +00:00

JobSchedule.spec.js

…

LdapAuth.spec.js

fix: LDAP injection via unsanitized user input in DN and group filter construction ([GHSA-7m6r-fhh7-r47c](https://github.com/parse-community/parse-server/security/advisories/GHSA-7m6r-fhh7-r47c )) (#10154 )

2026-03-09 14:06:32 +00:00

Logger.spec.js

…

LoggerController.spec.js

…

LogsRouter.spec.js

fix: Server internal error details leaking in error messages returned to clients (#9937 )

2025-11-23 13:51:42 +01:00

Middlewares.spec.js

fix: Validate body field types in request middleware (#10209 )

2026-03-15 15:41:02 +00:00

MongoSchemaCollectionAdapter.spec.js

feat: Add default ACL (#8701 )

2025-03-24 15:15:27 +01:00

MongoStorageAdapter.spec.js

feat: Add support for partialFilterExpression in MongoDB storage adapter (#10346 )

2026-03-29 03:37:19 +01:00

MongoTransform.spec.js

fix: Instance comparison with instanceof is not realm-safe (#10225 )

2026-03-16 21:30:09 +00:00

NullCacheAdapter.spec.js

…

OAuth1.spec.js

test: Disable OAuth 1 tests with Twitter API (#9161 )

2024-06-22 03:09:13 +02:00

PagesRouter.spec.js

test: Reject non-ASCII characters in PagesRouter locale parameter (#10281 )

2026-03-22 17:32:50 +00:00

Parse.Push.spec.js

ci: Fix test exclusion list in combination with other exclusions (#9277 )

2024-08-13 22:13:19 +02:00

ParseACL.spec.js

fix: Default ACL overwrites custom ACL on Parse.Object update (#10061 )

2026-02-14 01:56:42 +00:00

ParseAPI.spec.js

fix: Instance comparison with instanceof is not realm-safe (#10225 )

2026-03-16 21:30:09 +00:00

ParseCloudCodePublisher.spec.js

…

ParseConfigKey.spec.js

feat: Add support for more MongoDB driver options (#9911 )

2025-11-07 21:41:59 +01:00

ParseFile.spec.js

fix: Stored cross-site scripting (XSS) via SVG file upload ([GHSA-hcj7-6gxh-24ww](https://github.com/parse-community/parse-server/security/advisories/GHSA-hcj7-6gxh-24ww )) (#10136 )

2026-03-08 02:04:59 +00:00

ParseGeoPoint.spec.js

ci: Fix test exclusion list in combination with other exclusions (#9277 )

2024-08-13 22:13:19 +02:00

ParseGlobalConfig.spec.js

fix: Server internal error details leaking in error messages returned to clients (#9937 )

2025-11-23 13:51:42 +01:00

ParseGraphQLClassNameTransformer.spec.js

…

ParseGraphQLController.spec.js

test: Fix flaky tests (#10320 )

2026-03-26 02:20:57 +00:00

ParseGraphQLSchema.spec.js

ci: Fix test exclusion list in combination with other exclusions (#9277 )

2024-08-13 22:13:19 +02:00

ParseGraphQLServer.spec.js

fix: GraphQL API endpoint ignores CORS origin restriction ([GHSA-q3p6-g7c4-829c](https://github.com/parse-community/parse-server/security/advisories/GHSA-q3p6-g7c4-829c )) (#10334 )

2026-03-27 15:03:33 +00:00

ParseHooks.spec.js

feat: Upgrade to express 5.0.1 (#9530 )

2025-03-03 22:11:42 +01:00

ParseInstallation.spec.js

fix: Server internal error details leaking in error messages returned to clients (#9937 )

2025-11-23 13:51:42 +01:00

ParseLiveQuery.spec.js

fix: Missing error messages in Parse errors (#10304 )

2026-03-24 18:56:25 +00:00

ParseLiveQueryRedis.spec.js

ci: Fix flaky tests (#8468 )

2023-03-10 23:54:05 +01:00

ParseLiveQueryServer.spec.js

fix: Bypass of class-level permissions in LiveQuery ([GHSA-7ch5-98q2-7289](https://github.com/parse-community/parse-server/security/advisories/GHSA-7ch5-98q2-7289 )) (#10133 )

2026-03-08 01:15:08 +00:00

ParseObject.spec.js

fix: Security upgrade to parse 7.0.1 (#9877 )

2025-10-15 18:39:37 +02:00

ParsePolygon.spec.js

refactor: Bump jasmine from 5.7.1 to 6.1.0 (#10338 )

2026-03-28 16:10:57 +00:00

ParsePubSub.spec.js

…

ParseQuery.Aggregate.spec.js

refactor: Bump jasmine from 5.7.1 to 6.1.0 (#10338 )

2026-03-28 16:10:57 +00:00

ParseQuery.Comment.spec.js

fix: Security upgrade to parse 7.0.1 (#9877 )

2025-10-15 18:39:37 +02:00

ParseQuery.FullTextSearch.spec.js

fix: Parse Server doesn't shutdown gracefully (#9634 )

2025-03-27 21:38:51 +01:00

ParseQuery.hint.spec.js

refactor: Bump jasmine from 5.7.1 to 6.1.0 (#10338 )

2026-03-28 16:10:57 +00:00

ParseQuery.spec.js

fix: Input type validation for query operators and batch path (#10230 )

2026-03-17 15:17:57 +00:00

ParseRelation.spec.js

fix: Security upgrade to parse 7.0.1 (#9877 )

2025-10-15 18:39:37 +02:00

ParseRole.spec.js

fix: Error in afterSave trigger for Parse.Role due to name field (#9883 )

2025-10-22 14:12:51 +02:00

parsers.spec.js

feat: Add event information to verifyUserEmails, preventLoginWithUnverifiedEmail to identify invoking signup / login action and auth provider (#9963 )

2026-02-06 03:48:35 +00:00

ParseServer.spec.js

fix: MongoDB timeout errors unhandled and potentially revealing internal data (#10020 )

2026-01-25 00:15:01 +01:00

ParseServerRESTController.spec.js

fix: Parse Server doesn't shutdown gracefully (#9634 )

2025-03-27 21:38:51 +01:00

ParseSession.spec.js

fix: Session field immutability bypass via falsy-value guard ([GHSA-f6j3-w9v3-cq22](https://github.com/parse-community/parse-server/security/advisories/GHSA-f6j3-w9v3-cq22 )) (#10347 )

2026-03-29 04:55:39 +01:00

ParseUser.spec.js

fix: Duplicate session destruction can cause unhandled promise rejection (#10319 )

2026-03-26 01:41:45 +00:00

ParseWebSocket.spec.js

…

ParseWebSocketServer.spec.js

…

PasswordPolicy.spec.js

feat: Deprecation DEPPS11: Replace PublicAPIRouter with PagesRouter (#9974 )

2025-12-12 20:55:39 +01:00

PointerPermissions.spec.js

test: Add more test IDs (#9285 )

2024-08-16 21:21:56 +02:00

PostgresConfigParser.spec.js

refactor: Upgrade pg-promise to 11.3.0 and pg-monitor to 2.0.0 (#8453 )

2023-03-06 00:16:04 +01:00

PostgresInitOptions.spec.js

…

PostgresStorageAdapter.spec.js

fix: Incomplete JSON key escaping in PostgreSQL Increment on nested Object fields (#10261 )

2026-03-20 20:33:40 +00:00

PromiseRouter.spec.js

…

ProtectedFields.spec.js

fix: Maintenance key blocked from querying protected fields (#10290 )

2026-03-23 03:50:45 +00:00

PurchaseValidation.spec.js

feat: Add enableProductPurchaseLegacyApi option to disable legacy IAP validation (#10228 )

2026-03-17 00:26:31 +00:00

PushController.spec.js

fix: Instance comparison with instanceof is not realm-safe (#10225 )

2026-03-16 21:30:09 +00:00

PushQueue.spec.js

…

PushRouter.spec.js

…

PushWorker.spec.js

ci: Fix test exclusion list in combination with other exclusions (#9277 )

2024-08-13 22:13:19 +02:00

QueryTools.spec.js

test: LiveQuery regex timeout and context isolation are not exploitable (#10226 )

2026-03-16 22:06:42 +00:00

RateLimit.spec.js

fix: Batch login sub-request rate limit uses IP-based keying (#10349 )

2026-03-29 16:08:36 +01:00

ReadPreferenceOption.spec.js

feat: Remove deprecation DEPPS1: Native MongoDB syntax in aggregation pipeline (#8362 )

2023-01-05 15:53:43 +01:00

RedisCacheAdapter.spec.js

fix: CacheAdapter does not connect when using a CacheAdapter with a JSON config (#8633 )

2024-03-15 17:46:06 +01:00

RedisPubSub.spec.js

refactor: Bump redis from 4.7.0 to 5.10.0 (#9994 )

2026-01-17 22:09:44 +01:00

RegexVulnerabilities.spec.js

fix: Validate token type in PagesRouter to prevent type confusion errors (#10212 )

2026-03-15 18:43:23 +00:00

RequestComplexity.spec.js

fix: Add configurable batch request sub-request limit via option requestComplexity.batchRequestLimit (#10265 )

2026-03-21 02:20:35 +00:00

rest.spec.js

test: Fix flaky tests (#10320 )

2026-03-26 02:20:57 +00:00

RestQuery.spec.js

fix: Postgres query on non-existent column throws internal server error (#10308 )

2026-03-25 00:07:06 +00:00

RevocableSessionsUpgrade.spec.js

refactor: Bump to jasmine 5.6.0 (#9453 )

2025-03-11 21:34:14 +01:00

Schema.spec.js

fix: Server internal error details leaking in error messages returned to clients (#9937 )

2025-11-23 13:51:42 +01:00

SchemaPerformance.spec.js

fix: Parse Server doesn't shutdown gracefully (#9634 )

2025-03-27 21:38:51 +01:00

schemas.spec.js

feat: Log more debug info when failing to set duplicate value for field with unique values (#9919 )

2025-12-14 16:39:17 +01:00

SecurityCheck.spec.js

fix: Regular Expression Denial of Service (ReDoS) via $regex query in LiveQuery ([GHSA-mf3j-86qx-cq5j](https://github.com/parse-community/parse-server/security/advisories/GHSA-mf3j-86qx-cq5j )) (#10118 )

2026-03-07 02:14:37 +00:00

SecurityCheckGroups.spec.js

fix: Add configurable batch request sub-request limit via option requestComplexity.batchRequestLimit (#10265 )

2026-03-21 02:20:35 +00:00

SessionTokenCache.spec.js

refactor: Upgrade lru-cache from 7.12.0 to 9.1.1 (#8559 )

2023-05-25 23:59:42 +02:00

Subscription.spec.js

…

Uniqueness.spec.js

ci: Fix test exclusion list in combination with other exclusions (#9277 )

2024-08-13 22:13:19 +02:00

UserController.spec.js

ci: Fix flaky sendVerificationEmail tests (#9692 )

2025-04-15 17:25:42 +01:00

UserPII.spec.js

refactor: Bump to jasmine 5.6.0 (#9453 )

2025-03-11 21:34:14 +01:00

Utils.spec.js

fix: Instance comparison with instanceof is not realm-safe (#10225 )

2026-03-16 21:30:09 +00:00

ValidationAndPasswordsReset.spec.js

fix: Email verification resend page leaks user existence (GHSA-h29g-q5c2-9h4f) (#10238 )

2026-03-19 02:09:59 +00:00

VerifyUserPassword.spec.js

feat: Add password validation via POST request for user with unverified email using master key and option ignoreEmailVerification (#8895 )

2024-01-17 17:43:04 +01:00

vulnerabilities.spec.js

fix: LiveQuery protected-field guard bypass via array-like logical operator value ([GHSA-mmg8-87c5-jrc2](https://github.com/parse-community/parse-server/security/advisories/GHSA-mmg8-87c5-jrc2 )) (#10350 )

2026-03-29 19:36:52 +01:00

WinstonLoggerAdapter.spec.js

ci: Fix test exclusion list in combination with other exclusions (#9277 )

2024-08-13 22:13:19 +02:00