Repository navigation
Tags
Tags
chore(release): 6.0.0-alpha.10 [skip ci] # [6.0.0-alpha.10](parse-community/parse-server@6.0.0-alpha.9...6.0.0-alpha.10) (2022-11-19) ### Bug Fixes * Cloud Code trigger `beforeSave` does not work with `Parse.Role` ([parse-community#8320](parse-community#8320)) ([f29d972](parse-community@f29d972))
chore(release): 5.4.0 [skip ci] # [5.4.0](parse-community/parse-server@5.3.3...5.4.0) (2022-11-19) ### Bug Fixes * authentication adapter app ID validation may be circumvented; this fixes a vulnerability that affects configurations which allow users to authenticate using the Parse Server authentication adapter for *Facebook* or *Spotify* and where the server-side authentication adapter configuration `appIds` is set as a string (e.g. `abc`) instead of an array of strings (e.g. `["abc"]`) ([GHSA-r657-33vp-gp22](GHSA-r657-33vp-gp22)) [skip release] ([parse-community#8187](parse-community#8187)) ([8c8ec71](parse-community@8c8ec71)) * brute force guessing of user sensitive data via search patterns (GHSA-2m6g-crv8-p3c6) ([parse-community#8146](parse-community#8146)) [skip release] ([4c0c7c7](parse-community@4c0c7c7)) * certificate in Apple Game Center auth adapter not validated [skip release] ([parse-community#8058](parse-community#8058)) ([75af9a2](parse-community@75af9a2)) * graphQL query ignores condition `equalTo` with value `false` ([parse-community#8032](parse-community#8032)) ([7f5a15d](parse-community@7f5a15d)) * internal indices for classes `_Idempotency` and `_Role` are not protected in defined schema ([parse-community#8121](parse-community#8121)) ([c16f529](parse-community@c16f529)) * invalid file request not properly handled [skip release] ([parse-community#8062](parse-community#8062)) ([4c9e956](parse-community@4c9e956)) * liveQuery with `containedIn` not working when object field is an array ([parse-community#8128](parse-community#8128)) ([1d9605b](parse-community@1d9605b)) * protected fields exposed via LiveQuery (GHSA-crrq-vr9j-fxxh) [skip release] ([parse-community#8076](parse-community#8076)) ([9fd4516](parse-community@9fd4516)) * push notifications `badge` doesn't update with Installation beforeSave trigger ([parse-community#8162](parse-community#8162)) ([3c75c2b](parse-community@3c75c2b)) * query aggregation pipeline cannot handle value of type `Date` when `directAccess: true` ([parse-community#8167](parse-community#8167)) ([e424137](parse-community@e424137)) * relation constraints in compound queries `Parse.Query.or`, `Parse.Query.and` not working ([parse-community#8203](parse-community#8203)) ([28f0d26](parse-community@28f0d26)) * security upgrade undici from 5.6.0 to 5.8.0 ([parse-community#8108](parse-community#8108)) ([4aa016b](parse-community@4aa016b)) * server crashes when receiving file download request with invalid byte range; this fixes a security vulnerability that allows an attacker to impact the availability of the server instance; the fix improves parsing of the range parameter to properly handle invalid range requests ([GHSA-h423-w6qv-2wj3](GHSA-h423-w6qv-2wj3)) [skip release] ([parse-community#8238](parse-community#8238)) ([c03908f](parse-community@c03908f)) * session object properties can be updated by foreign user; this fixes a security vulnerability in which a foreign user can write to the session object of another user if the session object ID is known; the fix prevents writing to foreign session objects ([GHSA-6w4q-23cf-j9jp](GHSA-6w4q-23cf-j9jp)) [skip release] ([parse-community#8180](parse-community#8180)) ([37fed30](parse-community@37fed30)) * sorting by non-existing value throws `INVALID_SERVER_ERROR` on Postgres ([parse-community#8157](parse-community#8157)) ([3b775a1](parse-community@3b775a1)) * updating object includes unchanged keys in client response for certain key types ([parse-community#8159](parse-community#8159)) ([37af1d7](parse-community@37af1d7)) ### Features * add convenience access to Parse Server configuration in Cloud Code via `Parse.Server` ([parse-community#8244](parse-community#8244)) ([9f11115](parse-community@9f11115)) * add option to change the default value of the `Parse.Query.limit()` constraint ([parse-community#8152](parse-community#8152)) ([0388956](parse-community@0388956)) * add support for MongoDB 6 ([parse-community#8242](parse-community#8242)) ([aba0081](parse-community@aba0081)) * add support for Postgres 15 ([parse-community#8215](parse-community#8215)) ([2feb6c4](parse-community@2feb6c4)) * liveQuery support for unsorted distance queries ([parse-community#8221](parse-community#8221)) ([0f763da](parse-community@0f763da))
chore(release): 6.0.0-alpha.9 [skip ci] # [6.0.0-alpha.9](parse-community/parse-server@6.0.0-alpha.8...6.0.0-alpha.9) (2022-11-16) ### Features * Remove deprecation `DEPPS3`: Config option `enforcePrivateUsers` defaults to `true` ([parse-community#8283](parse-community#8283)) ([ed499e3](parse-community@ed499e3)) ### BREAKING CHANGES * The Parse Server option `enforcePrivateUsers` is set to `true` by default; in previous releases this option defaults to `false`; this change improves the default security configuration of Parse Server (parse-community#8283) ([ed499e3](ed499e3))
chore(release): 6.0.0-alpha.8 [skip ci] # [6.0.0-alpha.8](parse-community/parse-server@6.0.0-alpha.7...6.0.0-alpha.8) (2022-11-11) ### Features * Restrict use of `masterKey` to localhost by default ([parse-community#8281](parse-community#8281)) ([6c16021](parse-community@6c16021)) ### BREAKING CHANGES * This release restricts the use of `masterKey` to localhost by default; if you are using Parse Dashboard on a different server to connect to Parse Server you need to add the IP address of the server that hosts Parse Dashboard to this option (parse-community#8281) ([6c16021](6c16021))
chore(release): 6.0.0-alpha.7 [skip ci] # [6.0.0-alpha.7](parse-community/parse-server@6.0.0-alpha.6...6.0.0-alpha.7) (2022-11-11) ### Features * Upgrade Redis 3 to 4 ([parse-community#8293](parse-community#8293)) ([7d622f0](parse-community@7d622f0)) ### BREAKING CHANGES * This release upgrades to Redis 4; if you are using the Redis cache adapter with Parse Server then this is a breaking change as the Redis client options have changed; see the [Redis migration guide](https://github.com/redis/node-redis/blob/redis%404.0.0/docs/v3-to-v4.md) for more details (parse-community#8293) ([7d622f0](7d622f0))
chore(release): 6.0.0-alpha.6 [skip ci] # [6.0.0-alpha.6](parse-community/parse-server@6.0.0-alpha.5...6.0.0-alpha.6) (2022-11-10) ### Features * Remove support for MongoDB 4.0 ([parse-community#8292](parse-community#8292)) ([37245f6](parse-community@37245f6)) ### BREAKING CHANGES * This release removes support for MongoDB 4.0; the new minimum supported MongoDB version is 4.2. which also removes support for the deprecated MongoDB MMAPv1 storage engine ([37245f6](37245f6))
chore(release): 6.0.0-alpha.5 [skip ci] # [6.0.0-alpha.5](parse-community/parse-server@6.0.0-alpha.4...6.0.0-alpha.5) (2022-11-10) ### Bug Fixes * Throwing error in Cloud Code Triggers `afterLogin`, `afterLogout` crashes server ([parse-community#8280](parse-community#8280)) ([130d290](parse-community@130d290)) ### BREAKING CHANGES * Throwing an error in Cloud Code Triggers `afterLogin`, `afterLogout` returns a rejected promise; in previous releases it crashed the server if you did not handle the error on the Node.js process level; consider adapting your code if your app currently handles these errors on the Node.js process level with `process.on('unhandledRejection', ...)` ([130d290](130d290))
chore(release): 6.0.0-alpha.4 [skip ci] # [6.0.0-alpha.4](parse-community/parse-server@6.0.0-alpha.3...6.0.0-alpha.4) (2022-11-10) ### Features * Remove deprecation `DEPPS2`: Config option `directAccess` defaults to true ([parse-community#8284](parse-community#8284)) ([f535ee6](parse-community@f535ee6)) ### BREAKING CHANGES * Config option `directAccess` defaults to true; set this to `false` in environments where multiple Parse Server instances run behind a load balancer and Parse requests within the current Node.js environment should be routed via the load balancer and distributed as HTTP requests among all instances via the `serverURL`. ([f535ee6](f535ee6))
chore(release): 6.0.0-alpha.3 [skip ci] # [6.0.0-alpha.3](parse-community/parse-server@6.0.0-alpha.2...6.0.0-alpha.3) (2022-11-10) ### Features * Remove deprecation `DEPPS4`: Remove convenience method for http request `Parse.Cloud.httpRequest` ([parse-community#8287](parse-community#8287)) ([2d79c08](parse-community@2d79c08)) ### BREAKING CHANGES * The convenience method for HTTP requests `Parse.Cloud.httpRequest` is removed; use your preferred 3rd party library for making HTTP requests ([2d79c08](2d79c08))
chore(release): 6.0.0-alpha.2 [skip ci] # [6.0.0-alpha.2](parse-community/parse-server@6.0.0-alpha.1...6.0.0-alpha.2) (2022-11-10) ### Features * Improve authentication adapter interface to support multi-factor authentication (MFA), authentication challenges, and provide a more powerful interface for writing custom authentication adapters ([parse-community#8156](parse-community#8156)) ([5bbf9ca](parse-community@5bbf9ca))
PreviousNext