9.10.1 (2026-09-24)
Bug Fixes
Parse.Query.explainruns afterFind trigger on query plan results (#10536) (64d58ff)- Account takeover via empty password in LDAP auth adapter (GHSA-863r-39r9-vfcf) (#10642) (f261957)
- Bump @parse/push-adapter from 8.4.0 to 8.5.3 (#10676) (ae167c4)
- Bump body-parser from 2.2.2 to 2.3.0 (#10600) (77e955f)
- Bump express-rate-limit from 8.3.1 to 8.7.0 (#10672) (73d8600)
- Bump follow-redirects from 1.15.11 to 1.16.0 (#10577) (d577327)
- Bump parse from 8.6.0 to 8.6.2, @parse/push-adapter from 8.5.3 to 8.5.5 and ws from 8.21.0 to 8.21.3 (#10688) (11c8a40)
- Bump qs from 6.15.2 to 6.16.0 (#10651) (25263e7)
- Bump undici from 7.28.0 to 7.29.1 (#10674) (2f09a30)
- Bump ws from 8.20.0 to 8.21.0 (#10576) (629426f)
- Creating a session can delete another user's session (#10582) (0df8779)
- GraphQL argument and enum validation errors disclose target class names when public introspection is disabled (GHSA-6m77-f8xr-f723) (#10665) (fead3db)
- GraphQL schema is disclosed by replaying an automatic persisted query when public introspection is disabled (GHSA-gxxq-pghq-9vrc) (#10669) (8d22053)
- Install the latest Parse Server version in bootstrap.sh (#10556) (997ee15)
- LiveQuery discloses protected fields by resolving an incomplete subscriber identity (GHSA-9jpp-xhh6-75mf) (#10654) (66c507b)
- Per-entry cache TTL is ignored by the in-memory cache adapter (#10671) (1352c67)
- Rate limit is bypassed by sending request header
X-Forwarded-For: 127.0.0.1when Parse Server optiontrustProxyis permissive (#10664) (ebd425e) - Relation count query bypasses protectedFields for identity-scoped groups (GHSA-rmhf-xv62-rm99) (#10667) (a32977f)
- Server crash from unhandled promise rejection when multiple Cloud Code validator fields fail (#10540) (90c2778)
- Unauthenticated deletion of installation records via operator injection in device token deduplication (GHSA-cc6h-c8m4-hgrx) (#10657) (ad00f82)
- Unverified auth provider identity accepted on password login for code-based auth adapters (GHSA-mr43-w6c2-mvjq) (#10662) (9b73e6f)