Shipped · Databases

What parse-community/parse-server shipped

The public repository of Parseplatform · github.com/parse-community/parse-server

Written by FoxPlug from public releases; not affiliated with Parseplatform. An automatic summary of the public release, pull request and commit data of github.com/parse-community/parse-server. Parseplatform did not write it and does not use or endorse FoxPlug. Every line links to the public change it describes.

Get a weekly update like this for your product, free

Or Use it as a GitHub Action

Follow parse-server's weekly shipped digest

Week of September 21, 2026

What shipped

Version 9.10.1 released with fixes for query explain triggers, LDAP auth account takeover, and dependency updates. Release
Fixed server crash caused by file pointers without URLs in object writes (GHSA-gpr6-gr9g-pfw6). Pull request #10695
Fixed LiveQuery evaluating class-level permissions against incomplete caller identity, causing incorrect access denials. Pull request #10675
Fixed LiveQuery ignoring userField protectedFields groups, causing over-redaction of fields that REST queries return. Pull request #10690
Fixed in-memory cache adapter ignoring per-entry TTL configuration. Pull request #10671
Fixed graphQLPublicIntrospection option having no effect on GraphQL introspection queries. Pull request #10696
Fixed GraphQL schema disclosure via automatic persisted query replay when public introspection is disabled (GHSA-gxxq-pghq-9vrc). Pull request #10670
Fixed relation count queries bypassing protectedFields for identity-scoped groups (GHSA-rmhf-xv62-rm99). Pull request #10668
Fixed GraphQL validation errors disclosing target class names when public introspection is disabled (GHSA-6m77-f8xr-f723). Pull request #10666
Updated @parse/push-adapter to 8.5.3, resolving critical protobufjs vulnerabilities. Pull request #10676

Why it matters

Version 9.10.1 addresses multiple security vulnerabilities in GraphQL introspection, field-level access control, and authentication. LiveQuery fixes ensure permission evaluation matches REST API behavior. Critical dependency updates resolve production vulnerabilities.

Changelog entry

Bug Fixes: Parse.Query.explain runs afterFind trigger on query plan results; Account takeover via empty password in LDAP auth adapter (GHSA-863r-39r9-vfcf); Dependency updates for @parse/push-adapter, body-parser, and others Release
Bug Fixes: Server crash via file pointer without URL in an object write (GHSA-gpr6-gr9g-pfw6) Pull request #10695
Bug Fixes: LiveQuery evaluates class-level permissions against an incomplete caller identity Pull request #10675
Bug Fixes: LiveQuery ignores userField protectedFields groups and over-redacts fields the REST path returns Pull request #10690
Bug Fixes: Per-entry cache TTL is ignored by the in-memory cache adapter Pull request #10671
Bug Fixes: Parse Server option graphQLPublicIntrospection has no effect Pull request #10696
Bug Fixes: GraphQL schema is disclosed by replaying an automatic persisted query when public introspection is disabled (GHSA-gxxq-pghq-9vrc) Pull request #10670
Bug Fixes: Relation count query bypasses protectedFields for identity-scoped groups (GHSA-rmhf-xv62-rm99) Pull request #10668
Bug Fixes: GraphQL argument and enum validation errors disclose target class names when public introspection is disabled (GHSA-6m77-f8xr-f723) Pull request #10666

Example posts FoxPlug drafted from these changes. Not written or posted by the project.

Post for X

[16] Parse Server 9.10.1 released: fixes for query explain triggers, LDAP auth, GraphQL introspection disclosures, LiveQuery permissions, and critical dependency updates.

Post for LinkedIn

Parse Server 9.10.1 is now available. This release includes fixes for security vulnerabilities in GraphQL introspection and field access control, resolves LiveQuery permission evaluation inconsistencies with the REST API, addresses an LDAP authentication account takeover issue, and updates critical production dependencies including protobufjs.