9.10.1-alpha.3

9.10.1-alpha.3 (2026-07-16)

Bug Fixes

• Bump ws from 8.20.0 to 8.21.0 (#10576) (629426f)

9.10.1-alpha.2

9.10.1-alpha.2 (2026-07-14)

Bug Fixes

• Creating a session can delete another user's session (#10582) (0df8779)

9.10.1-alpha.1

9.10.1-alpha.1 (2026-07-13)

Bug Fixes

• Bump follow-redirects from 1.15.11 to 1.16.0 (#10577) (d577327)

9.10.0

9.10.0 (2026-07-13)

Bug Fixes

• Cloud Code beforeFind trigger context is not isolated from prototype pollution (#10570) (bea001e)
• Cloud Function multipart requests bypass the maxUploadSize limit (#10498) (f12e1c3)
• Denial of service via exponential-time processing of deeply nested query operators (GHSA-cgxm-vr2f-6fj8) (#10511) (1103c7a)
• Endpoints /login and /verifyPassword disclose MFA secrets and protected fields when _User get is denied (GHSA-75v4-m273-5j49) (#10492) (83e90ed)
• GeoPoint distance queries fail with an internal server error on MongoDB 8.3 and later (#10572) (b706c22)
• GraphQL "Did you mean" validation suggestions disclose schema to unauthenticated callers (GHSA-8cph-rgr4-g5vj) (#10467) (155123a)
• GraphQL error messages disclose pointer and relation target class names when public introspection is disabled (GHSA-r2g6-4f6j-f6rf) (#10568) (cb9b542)
• GraphQL error messages disclose required input field names when public introspection is disabled (GHSA-2fgh-8j2g-w354) (#10566) (d96c945), closes GHSA-2f#8j2g-w354 /github.com/parse-community/parse-server/security/advisories/GHSA-2f#8j2g-w354
• GraphQL variable-coercion suggestions disclose schema to unauthenticated callers (GHSA-9g8f-h8f3-hjcm) (#10563) (2625489)
• LiveQuery discloses object data to a subscriber across an ACL read-access change (GHSA-97pr-9hgg-3p8r) (#10515) (e9c85df)
• LiveQuery subscriptions leak when a client reuses a subscribe requestId (#10499) (3fad4fb)
• Middleware route checks do not match routing-equivalent path variants (trailing slash, case) (#10501) (f861210)
• NumberOrBoolean config option (cluster) value not coerced from env/CLI (#10531) (459786f)
• Pre-authentication denial of service via client version header regex backtracking (GHSA-38m6-82c8-4xfm) (#10463) (56c159e)
• rateLimit on exact static routes is bypassed by appending a query string (#10500) (880e8e6)
• Relation $relatedTo query bypasses protectedFields and owning-object ACL (GHSA-wmwx-jr2p-4j4r) (#10493) (43658f1)
• Server option routeAllowList is bypassable through batch sub-requests (GHSA-p84r-h6rx-f2xr) (#10482) (552c6dd)
• Stored XSS via malformed Content-Type bypassing file upload extension blocklist (GHSA-r899-h629-j84r) (#10521) (cce91e5)
• Stored XSS via non-standard file extension bypassing file upload extension blocklist (GHSA-v8x7-r927-cc93) (#10505) (be12a60)
• Stored XSS via trailing-dot filename bypassing file upload extension blocklist (GHSA-7wqv-xjf3-x35v) (#10489) (66484ce)

Features

• Add option to disallow aggregation pipelines for the read-only master key (#10517) (816078f)

9.10.0-alpha.8

9.10.0-alpha.8 (2026-07-13)

Bug Fixes

• GeoPoint distance queries fail with an internal server error on MongoDB 8.3 and later (#10572) (b706c22)

9.10.0-alpha.7

9.10.0-alpha.7 (2026-07-11)

Bug Fixes

• Cloud Code beforeFind trigger context is not isolated from prototype pollution (#10570) (bea001e)

9.10.0-alpha.6

9.10.0-alpha.6 (2026-07-10)

Bug Fixes

• GraphQL error messages disclose pointer and relation target class names when public introspection is disabled (GHSA-r2g6-4f6j-f6rf) (#10568) (cb9b542)

9.10.0-alpha.5

9.10.0-alpha.5 (2026-07-10)

Bug Fixes

• GraphQL error messages disclose required input field names when public introspection is disabled (GHSA-2fgh-8j2g-w354) (#10566) (d96c945), closes GHSA-2f#8j2g-w354 /github.com/parse-community/parse-server/security/advisories/GHSA-2f#8j2g-w354

8.6.87

8.6.87 (2026-07-10)

Bug Fixes

• GraphQL error messages disclose pointer and relation target class names when public introspection is disabled (GHSA-r2g6-4f6j-f6rf) (#10569) (bc863d7)

8.6.86

8.6.86 (2026-07-10)

Bug Fixes

• GraphQL error messages disclose required input field names when public introspection is disabled (GHSA-2fgh-8j2g-w354) (#10567) (6985a38), closes GHSA-2f#8j2g-w354 /github.com/parse-community/parse-server/security/advisories/GHSA-2f#8j2g-w354