LoginSign Up
← Back to all sparks
P

Parse Server

INFRA · APIS
Velocity5.0

Open-source backend platform for mobile and web apps

parseplatform.org ↗

One commit per release, and most of them are closing security holes in the Cloud Code and query paths.

backend-as-a-servicecloud-codeprototype-pollutiongraphqldependency-bumpsautomated-releases
◆Current state
Parse Server's feed is a stream of alpha prereleases — 9.10.0-alpha.6 through 9.10.1-alpha.6 in under three weeks — each containing exactly one bug fix, published automatically per merged commit. The security-relevant ones dominate: session creation that could delete another user's session, a beforeFind trigger context not isolated from prototype pollution, and GraphQL error messages disclosing pointer and relation target class names even with public introspection disabled, that last one carrying a published advisory identifier.
◆Where it's heading
The work is concentrated on trust boundaries in the parts of Parse Server that run user-supplied code or expose schema shape — Cloud Code triggers, validators, GraphQL introspection, session handling. Interleaved with it is ordinary supply-chain upkeep, with ws and follow-redirects bumped in their own releases. A MongoDB 8.3 compatibility fix for GeoPoint distance queries suggests the driver and database ends are being chased as well. Nothing in this window adds capability; it is all correctness and containment ahead of a stable cut.
◆Prediction
The alpha numbering restarting at 9.10.1-alpha.1 indicates 9.10.0 was released, so expect the 9.10.1 alphas to continue accumulating single-fix releases until the patch is cut — with more Cloud Code trigger isolation fixes the likeliest content.

◆Recent moves

  1. 6d ago

    Query.explain no longer runs afterFind on query plans

    A single-commit alpha stopping the afterFind trigger from firing on query plan results returned by explain. Small, but part of the same theme as the rest of the window — triggers running where they shouldn't.

    View source ↗
  2. 7d ago

    Fixes server crash when multiple validator fields fail

    Closes an unhandled promise rejection that crashed the server when more than one Cloud Code validator field failed at once. An availability bug reachable from ordinary invalid input, fixed in its own one-line release.

    View source ↗
  3. 8d ago

    bootstrap.sh installs the latest Parse Server version

    A build-script fix with no runtime effect, published as its own release by the per-commit automation. Illustrates how much of this feed's cadence is mechanical rather than substantive.

    View source ↗
  4. 15d ago

    Bumps ws to 8.21.0

    A dependency bump on the WebSocket library, released on its own. Routine supply-chain upkeep between the security fixes that make up the rest of the window.

    View source ↗
  5. 17d ago

    Fixes session creation deleting another user's session

    The sharpest fix in this window: creating a session could delete a session belonging to a different user, a cross-account effect in the authentication path rather than a crash or a display bug. It sits alongside the prototype pollution and GraphQL disclosure fixes as part of the same pass over trust boundaries.

    View source ↗
  6. 18d ago

    Bumps follow-redirects to 1.16.0

    A dependency bump opening the 9.10.1 alpha line. No behavior change beyond what the upstream library carries.

    View source ↗