Repository navigation
Releases: parse-community/parse-server
Releases · parse-community/parse-server
Release list
9.10.5-alpha.5
9.10.5-alpha.5 (2026-10-11)
Bug Fixes
- SMS MFA login code request saves other login request fields with master privileges (GHSA-9rh6-r4ph-367v) (#10781) (e2a1474)
8.6.104
8.6.104 (2026-10-11)
Bug Fixes
- SMS MFA login code request saves other login request fields with master privileges (GHSA-9rh6-r4ph-367v) (#10782) (7433e30)
9.10.5-alpha.4
9.10.5-alpha.4 (2026-10-10)
Bug Fixes
- LiveQuery subscriptions using a
$orquery can receive another user's events, including session tokens (GHSA-349r-988w-x3jp) (#10776) (a7821c6)
9.10.5-alpha.3
9.10.5-alpha.2
9.10.5-alpha.2 (2026-10-10)
Bug Fixes
- Custom auth adapters that extend the AuthAdapter class accept any authData (GHSA-rq3w-5c6f-p7wr) (#10773) (bee4082)
8.6.103
8.6.103 (2026-10-10)
Bug Fixes
- LiveQuery subscriptions using a
$orquery can receive another user's events, including session tokens (GHSA-349r-988w-x3jp) (#10777) (41a4a22)
8.6.102
8.6.102 (2026-10-10)
Bug Fixes
- Custom auth adapters that extend the AuthAdapter class accept any authData (GHSA-rq3w-5c6f-p7wr) (#10774) (c000850)
9.10.5-alpha.1
9.10.4
9.10.4 (2026-10-09)
Bug Fixes
- Batch and direct access requests fail for object IDs without alphanumeric characters or class names without letters (#10761) (c8d5ebb)
- GraphQL API fails when a class name or mutation alias collides with a built-in name (#10757) (866e82b)
- Object write with a reserved field name can make reads fail on MongoDB (GHSA-gwrq-q25v-g8mr) (#10763) (d90b841)
- Unauthenticated deletion of class schemas removes class-level permissions on MongoDB (GHSA-qmg9-m772-5rm7) (#10767) (2114fca)
9.10.4-alpha.4
9.10.4-alpha.4 (2026-10-08)
Bug Fixes
- Unauthenticated deletion of class schemas removes class-level permissions on MongoDB (GHSA-qmg9-m772-5rm7) (#10767) (2114fca)