parse-community/parse-server 9.10.1

on GitHub

9.10.1 (2026-09-24)

Bug Fixes

• Parse.Query.explain runs afterFind trigger on query plan results (#10536) (64d58ff)
• Account takeover via empty password in LDAP auth adapter (GHSA-863r-39r9-vfcf) (#10642) (f261957)
• Bump @parse/push-adapter from 8.4.0 to 8.5.3 (#10676) (ae167c4)
• Bump body-parser from 2.2.2 to 2.3.0 (#10600) (77e955f)
• Bump express-rate-limit from 8.3.1 to 8.7.0 (#10672) (73d8600)
• Bump follow-redirects from 1.15.11 to 1.16.0 (#10577) (d577327)
• Bump parse from 8.6.0 to 8.6.2, @parse/push-adapter from 8.5.3 to 8.5.5 and ws from 8.21.0 to 8.21.3 (#10688) (11c8a40)
• Bump qs from 6.15.2 to 6.16.0 (#10651) (25263e7)
• Bump undici from 7.28.0 to 7.29.1 (#10674) (2f09a30)
• Bump ws from 8.20.0 to 8.21.0 (#10576) (629426f)
• Creating a session can delete another user's session (#10582) (0df8779)
• GraphQL argument and enum validation errors disclose target class names when public introspection is disabled (GHSA-6m77-f8xr-f723) (#10665) (fead3db)
• GraphQL schema is disclosed by replaying an automatic persisted query when public introspection is disabled (GHSA-gxxq-pghq-9vrc) (#10669) (8d22053)
• Install the latest Parse Server version in bootstrap.sh (#10556) (997ee15)
• LiveQuery discloses protected fields by resolving an incomplete subscriber identity (GHSA-9jpp-xhh6-75mf) (#10654) (66c507b)
• Per-entry cache TTL is ignored by the in-memory cache adapter (#10671) (1352c67)
• Rate limit is bypassed by sending request header X-Forwarded-For: 127.0.0.1 when Parse Server option trustProxy is permissive (#10664) (ebd425e)
• Relation count query bypasses protectedFields for identity-scoped groups (GHSA-rmhf-xv62-rm99) (#10667) (a32977f)
• Server crash from unhandled promise rejection when multiple Cloud Code validator fields fail (#10540) (90c2778)
• Unauthenticated deletion of installation records via operator injection in device token deduplication (GHSA-cc6h-c8m4-hgrx) (#10657) (ad00f82)
• Unverified auth provider identity accepted on password login for code-based auth adapters (GHSA-mr43-w6c2-mvjq) (#10662) (9b73e6f)