Repository navigation

9.10.6

parseplatformorg released this 22 Oct 16:59

f31bc12

9.10.6 (2026-10-22)

Bug Fixes

Object create returns field values to a caller without read access (GHSA-qq3r-ppqq-rh6m) (#10813) (d95b14d)
Object update returns stored field values to a caller without read access (GHSA-2rcp-jc67-vq74) (#10798) (4f110a9)
Object update with a dot notation key below a pointer field can terminate the server process (GHSA-wc3c-6843-q7mv) (#10802) (946b670)
Object write with a crafted dot notation key can pollute a shared prototype when the class has a trigger or LiveQuery (GHSA-95hp-82c6-25q5) (#10810) (9e3da78)
Object write with a null dot notation key can corrupt a field or make reads fail on MongoDB (GHSA-655c-2xf3-77x9) (#10804) (b405b63)
Session upgrade endpoint creates an additional session from an already revocable session token (GHSA-2j2x-c587-q33g) (#10808) (5bcb56b)

Assets 2