Shipped · Databases

What parse-community/parse-server shipped

The public repository of Parseplatform · github.com/parse-community/parse-server

Written by FoxPlug from the repository's own releases; not affiliated with Parseplatform. Paste your own repository in the box below and FoxPlug writes the same weekly update for your product. This page is an automatic summary of the releases, pull requests and commits in github.com/parse-community/parse-server; Parseplatform did not write it and does not use or endorse FoxPlug. Every line links to the change it describes.

Get a weekly update like this for your product, free

Or Use it as a GitHub Action

Follow parse-server's weekly shipped digest

Week of October 5, 2026

What shipped

Why it matters

This week brought a large batch of security fixes across release branches 8.6.x and 9.10.5-alpha, covering query operators, LiveQuery, SMS MFA, custom auth adapters, class schema deletion and reserved field names. If you run Parse Server in production, upgrading takes you onto versions where those access-control bypasses and internal server errors are closed. Two non-security fixes also landed: batch and direct access for unusual object IDs and class names, and GraphQL name collisions.

Changelog entry

Example posts FoxPlug drafted from these changes. Not written or posted by the project.

Post for X

Security-heavy week for Parse Server. Relation $relatedTo ACL bypass, LiveQuery $or cross-user events, SMS MFA master-privilege writes and auth adapter authData validation are all fixed in 8.6.x and 9.10.5-alpha. Malformed $or/$and/$nor/$options queries no longer 500. Please upgr

Post for LinkedIn

This week's Parse Server releases are mostly security fixes. Relation $relatedTo queries using an operator instead of an object ID could bypass owning-object ACL. LiveQuery subscriptions using a $or query could receive another user's events, including session tokens. SMS MFA login code requests saved other login request fields with master privileges. Custom auth adapters extending AuthAdapter accepted any authData. Unauthenticated deletion of class schemas removed class-level permissions on MongoDB, and object writes with a reserved field name could make reads fail. Login with the master key no longer overwrites stored MFA settings, and malformed $or, $and, $nor and $options operators no longer cause an internal server error. Fixes are available on the 8.6.x and 9.10.5-alpha lines.

Week of September 28, 2026

What shipped

Why it matters

This week addressed multiple security vulnerabilities across permission enforcement, session handling, and batch operations. Class-level permissions fixes and authorization checks improve data protection. Several test infrastructure improvements reduce flakiness and deployment issues.

Changelog entry

Example posts FoxPlug drafted from these changes. Not written or posted by the project.

Post for X

Parse Server releases this week include security fixes for user update authorization, session creation permissions, class-level permission enforcement, and transactional batch request handling. Update recommended.

Post for LinkedIn

Parse Server shipped multiple security fixes this week addressing authorization and permission enforcement issues. Updates include fixes for user update checks running against target accounts before authorization, session creation bypassing class-level permissions, and transactional batch requests affecting other clients. These changes strengthen access control and data protection across the server.

Week of September 21, 2026

What shipped

Why it matters

Version 9.10.1 addresses multiple security vulnerabilities in GraphQL introspection, field-level access control, and authentication. LiveQuery fixes ensure permission evaluation matches REST API behavior. Critical dependency updates resolve production vulnerabilities.

Changelog entry

Example posts FoxPlug drafted from these changes. Not written or posted by the project.

Post for X

Parse Server 9.10.1 released: fixes for query explain triggers, LDAP auth, GraphQL introspection disclosures, LiveQuery permissions, and critical dependency updates.

Post for LinkedIn

Parse Server 9.10.1 is now available. This release includes fixes for security vulnerabilities in GraphQL introspection and field access control, resolves LiveQuery permission evaluation inconsistencies with the REST API, addresses an LDAP authentication account takeover issue, and updates critical production dependencies including protobufjs.

More from parse-community/parse-server on GitHub

Merged pull requests

Weeks with too little public activity are left out rather than filled in. Last updated 2026-10-13.

Is this your repo? Ask us to remove this page.