Skip to content

Latest commit

 

History

History
535 lines (386 loc) · 77 KB

CHANGELOG_beta.md

File metadata and controls

535 lines (386 loc) · 77 KB

7.4.0-beta.1 (2024-12-23)

Bug Fixes

  • Parse.Query.distinct fails due to invalid aggregate stage 'hint' (#9295) (5f66c6a)
  • Security upgrade cross-spawn from 7.0.3 to 7.0.6 (#9444) (3d034e0)
  • Security upgrade fast-xml-parser from 4.4.0 to 4.4.1 (#9262) (992d39d)
  • Security upgrade node from 20.14.0-alpine3.20 to 20.17.0-alpine3.20 (#9300) (15bb17d)

Features

7.3.0-beta.1 (2024-10-03)

Bug Fixes

  • Custom object ID allows to acquire role privileges (GHSA-8xq9-g7ch-35hg) (#9317) (13ee52f)
  • Parse Server databaseOptions nested keys incorrectly identified as invalid (#9213) (77206d8)
  • Parse Server installation fails due to post install script incorrectly parsing required min. Node version (#9216) (0fa82a5)
  • Parse Server option maxLogFiles doesn't recognize day duration literals such as 1d to mean 1 day (#9215) (0319cee)
  • Security upgrade path-to-regexp from 6.2.1 to 6.3.0 (#9314) (8b7fe69)

Features

  • Add atomic operations for Cloud Config parameters (#9219) (35cadf9)
  • Add Cloud Code triggers Parse.Cloud.beforeSave and Parse.Cloud.afterSave for Parse Config (#9232) (90a1e4a)
  • Add Node 22 support (#9187) (7778471)
  • Add support for asynchronous invocation of FilesAdapter.getFileLocation (#9271) (1a2da40)

7.2.0-beta.1 (2024-07-09)

Bug Fixes

  • Invalid push notification tokens are not cleaned up from database for FCM API v2 (#9173) (284da09)

Features

  • Add support for dot notation on array fields of Parse Object (#9115) (cf4c880)
  • Upgrade to @parse/push-adapter 6.4.0 (#9182) (ef1634b)
  • Upgrade to Parse JS SDK 5.3.0 (#9180) (dca187f)

7.1.0-beta.1 (2024-06-30)

Bug Fixes

  • Parse.Cloud.startJob and Parse.Push.send not returning status ID when setting Parse Server option directAccess: true (#8766) (5b0efb2)
  • Required option not handled correctly for special fields (File, GeoPoint, Polygon) on GraphQL API mutations (#8915) (907ad42)
  • Facebook Limited Login not working due to incorrect domain in JWT validation (#9122) (9d0bd2b)
  • Live query throws error when constraint notEqualTo is set to null (#8835) (11d3e48)
  • Parse Server option extendSessionOnUse not working for session lengths < 24 hours (#9113) (0a054e6)
  • Rate limiting can fail when using Parse Server option rateLimit.redisUrl with clusters (#8632) (c277739)
  • SQL injection when using Parse Server with PostgreSQL; fixes security vulnerability GHSA-c2hr-cqg6-8j6r (#9167) (2edf1e4)

Features

  • Add silent log level for Cloud Code (#8803) (5f81efb)
  • Add server security check status security.enableCheck to Features Router (#8679) (b07ec15)
  • Prevent Parse Server start in case of unknown option in server configuration (#8987) (8758e6a)
  • Upgrade to @parse/push-adapter 6.0.0 (#9066) (18bdbf8)
  • Upgrade to @parse/push-adapter 6.2.0 (#9127) (ca20496)
  • Upgrade to Parse JS SDK 5.2.0 (#9128) (665b8d5)

7.0.0-beta.1 (2024-03-19)

Bug Fixes

  • CacheAdapter does not connect when using a CacheAdapter with a JSON config (#8633) (720d24e)
  • Conditional email verification not working in some cases if verifyUserEmails, preventLoginWithUnverifiedEmail set to functions (#8838) (8e7a6b1)
  • Deny request if master key is not set in Parse Server option masterKeyIps regardless of ACL and CLP (#8957) (a7b5b38)
  • Docker image not published to Docker Hub on new release (#8905) (a2ac8d1)
  • Docker version releases by removing arm/v6 and arm/v7 support (#8976) (1f62dd0)
  • GraphQL file upload fails in case of use of pointer or relation (#8721) (1aba638)
  • Improve PostgreSQL injection detection; fixes security vulnerability GHSA-6927-3vr9-fxf2 which affects Parse Server deployments using a Postgres database (#8961) (cbefe77)
  • Incomplete user object in verifyEmail function if both username and email are changed (#8889) (1eb95ae)
  • Parse Server option emailVerifyTokenReuseIfValid: true generates new token on every email verification request (#8885) (0023ce4)
  • Parse Server option fileExtensions default value rejects file extensions that are less than 3 or more than 4 characters long (#8699) (2760381)
  • Server crashes on invalid Cloud Function or Cloud Job name; fixes security vulnerability GHSA-6hh7-46r2-vf29 (#9024) (9f6e342)
  • Server crashes when receiving an array of Parse.Pointer in the request body (#8784) (66e3603)
  • Username is undefined in email verification link on email change (#8887) (e315c13)

Features

  • Add installationId to arguments for verifyUserEmails, preventLoginWithUnverifiedEmail (#8836) (a22dbe1)
  • Add installationId, ip, resendRequest to arguments passed to verifyUserEmails on verification email request (#8873) (8adcbee)
  • Add Parse.User as function parameter to Parse Server options verifyUserEmails, preventLoginWithUnverifiedEmail on login (#8850) (972f630)
  • Add password validation via POST request for user with unverified email using master key and option ignoreEmailVerification (#8895) (633a9d2)
  • Add support for MongoDB 7 (#8761) (3de8494)
  • Add support for MongoDB query comment (#8928) (2170962)
  • Add support for Node 20, drop support for Node 14, 16 (#8907) (ced4872)
  • Add support for Postgres 16 (#8898) (99489b2)
  • Allow Parse.Session.current on expired session token instead of throwing error (#8722) (f9dde4a)
  • Deprecation DEPPS5: Config option allowClientClassCreation defaults to false (#8849) (29624e0)
  • Deprecation DEPPS6: Authentication adapters disabled by default (#8858) (0cf58eb)
  • Deprecation DEPPS7: Remove deprecated Cloud Code file trigger syntax (#8855) (4e6a375)
  • Deprecation DEPPS8: Parse Server option allowExpiredAuthDataToken defaults to false (#8860) (e29845f)
  • Deprecation DEPPS9: LiveQuery fields option is renamed to keys (#8852) (38983e8)
  • Node process exits with error code 1 on uncaught exception to allow custom uncaught exception handling (#8894) (70c280c)
  • Switch GraphQL server from Yoga v2 to Apollo v4 (#8959) (105ae7c)
  • Upgrade Parse Server Push Adapter to 5.0.2 (#8813) (6ef1986)
  • Upgrade to Parse JS SDK 5 (#9022) (ad4aa83)

Performance Improvements

  • Improved IP validation performance for masterKeyIPs, maintenanceKeyIPs (#8510) (b87daba)

BREAKING CHANGES

  • The Parse Server option allowClientClassCreation defaults to false. (29624e0)
  • A request using the master key will now be rejected as unauthorized if the IP from which the request originates is not set in the Parse Server option masterKeyIps, even if the request does not require the master key permission, for example for a public object in a public class class. (a7b5b38)
  • Node process now exits with code 1 on uncaught exceptions, enabling custom handlers that were blocked by Parse Server's default behavior of re-throwing errors. This change may lead to automatic process restarts by the environment, unlike before. (70c280c)
  • Authentication adapters are disabled by default; to use an authentication adapter it needs to be explicitly enabled in the Parse Server authentication adapter option auth.<provider>.enabled: true (0cf58eb)
  • Parse Server option allowExpiredAuthDataToken defaults to false; a 3rd party authentication token will be validated every time the user tries to log in and the login will fail if the token has expired; the effect of this change may differ for different authentication adapters, depending on the token lifetime and the token refresh logic of the adapter (e29845f)
  • LiveQuery fields option is renamed to keys (38983e8)
  • Cloud Code file trigger syntax has been aligned with object trigger syntax, for example Parse.Cloud.beforeDeleteFile' has been changed to Parse.Cloud.beforeDelete(Parse.File, (request) => {})' (4e6a375)
  • Removes support for Node 14 and 16 (ced4872)
  • Removes support for Postgres 11 and 12 (99489b2)
  • The Parse.User passed as argument if verifyUserEmails is set to a function is renamed from user to object for consistency with invocations of verifyUserEmails on signup or login; the user object is not a plain JavaScript object anymore but an instance of Parse.User (8adcbee)
  • Parse.Session.current() no longer throws an error if the session token is expired, but instead returns the session token with its expiration date to allow checking its validity (f9dde4a)
  • Parse.Query no longer supports the BSON type code; although this feature was never officially documented, its removal is announced as a breaking change to protect deployments where it might be in use. (3de8494)

6.5.0-beta.1 (2023-11-16)

Bug Fixes

  • Context not passed to Cloud Code Trigger beforeFind when using Parse.Query.include (#8765) (7d32d89)
  • Parse Server option fileUpload.fileExtensions fails to determine file extension if filename contains multiple dots (#8754) (3d6d50e)
  • Security bump @babel/traverse from 7.20.5 to 7.23.2 (#8777) (2d6b3d1)
  • Security upgrade graphql from 16.6.0 to 16.8.1 (#8758) (71dfd8a)

Features

  • Add $setOnInsert operator to Parse.Server.database.update (#8791) (f630a45)
  • Add compatibility for MongoDB Atlas Serverless and AWS Amazon DocumentDB with collation options enableCollationCaseComparison, transformEmailToLowercase, transformUsernameToLowercase (#8805) (09fbeeb)
  • Add context to Cloud Code Triggers beforeLogin and afterLogin (#8724) (a9c34ef)
  • Allow setting createdAt and updatedAt during Parse.Object creation with maintenance key (#8696) (77bbfb3)

6.4.0-beta.1 (2023-09-16)

Bug Fixes

  • Parse Server option fileUpload.fileExtensions does not work with an array of extensions (#8688) (6a4a00c)
  • Redis 4 does not reconnect after unhandled error (#8706) (2b3d4e5)
  • Remove config logging when launching Parse Server via CLI (#8710) (ae68f0c)
  • Server does not start via CLI when auth option is set (#8666) (4e2000b)

Features

  • Add conditional email verification via dynamic Parse Server options verifyUserEmails, sendUserEmailVerification that now accept functions (#8425) (44acd6d)
  • Add property Parse.Server.version to determine current version of Parse Server in Cloud Code (#8670) (a9d376b)
  • Add TOTP authentication adapter (#8457) (cc079a4)

Performance Improvements

  • Improve performance of recursive pointer iterations (#8741) (45a3ed0)

6.3.0-beta.1 (2023-06-10)

Bug Fixes

  • Cloud Code Trigger afterSave executes even if not set (#8520) (afd0515)
  • GridFS file storage doesn't work with certain enableSchemaHooks settings (#8467) (d4cda4b)
  • Inaccurate table total row count for PostgreSQL (#8511) (0823a02)
  • LiveQuery server is not shut down properly when handleShutdown is called (#8491) (967700b)
  • Rate limit feature is incompatible with Node 14 (#8578) (f911f2c)
  • Unnecessary log entries by extendSessionOnUse (#8562) (fd6a007)

Features

  • extendSessionOnUse to automatically renew Parse Sessions (#8505) (6f885d3)
  • Add new Parse Server option preventSignupWithUnverifiedEmail to prevent returning a user without session token on sign-up with unverified email address (#8451) (82da308)
  • Add option to change the log level of logs emitted by Cloud Functions (#8530) (2caea31)
  • Add support for $eq query constraint in LiveQuery (#8614) (656d673)
  • Add zones for rate limiting by ip, user, session, global (#8508) (03fba97)
  • Allow Parse.Object pointers in Cloud Code arguments (#8490) (28aeda3)

Reverts

  • fix: Inaccurate table total row count for PostgreSQL (6722110)

6.1.0-beta.2 (2023-05-01)

Bug Fixes

  • LiveQuery can return incorrectly formatted date (#8456) (4ce135a)
  • Nested date is incorrectly decoded as empty object {} when fetching a Parse Object (#8446) (22d2446)
  • Parameters missing in afterFind trigger of authentication adapters (#8458) (ce34747)
  • Rate limiting across multiple servers via Redis not working (#8469) (d9e347d)

Features

  • Add afterFind trigger to authentication adapters (#8444) (c793bb8)
  • Add rate limiting across multiple servers via Redis (#8394) (34833e4)
  • Allow multiple origins for header Access-Control-Allow-Origin (#8517) (4f15539)
  • Export AuthAdapter to make it available for extension with custom authentication adapters (#8443) (40c1961)

6.1.0-beta.1 (2023-03-02)

Bug Fixes

Features

  • Add option schemaCacheTtl for schema cache pulling as alternative to enableSchemaHooks (#8436) (b3b76de)
  • Add Parse Server option resetPasswordSuccessOnInvalidEmail to choose success or error response on password reset with invalid email (#7551) (e5d610e)
  • Deprecate LiveQuery fields option in favor of keys for semantic consistency (#8388) (a49e323)

6.0.0-beta.1 (2023-01-31)

Bug Fixes

  • ParseServer.verifyServerUrl may fail if server response headers are missing; remove unnecessary logging (#8391) (1c37a7c)
  • Cloud Code trigger beforeSave does not work with Parse.Role (#8320) (f29d972)
  • ES6 modules do not await the import of Cloud Code files (#8368) (a7bd180)
  • Nested objects are encoded incorrectly for MongoDB (#8209) (1412666)
  • Parse Server option masterKeyIps does not include localhost by default for IPv6 (#8322) (ab82635)
  • Rate limiter may reject requests that contain a session token (#8399) (c114dc8)
  • Remove Node 12 and Node 17 support (#8279) (2546cc8)
  • Schema without class level permissions may cause error (#8409) (aa2cd51)
  • The client IP address may be determined incorrectly in some cases; this fixes a security vulnerability in which the Parse Server option masterKeyIps may be circumvented, see GHSA-vm5r-c87r-pf6x (#8372) (892040d)
  • Throwing error in Cloud Code Triggers afterLogin, afterLogout crashes server (#8280) (130d290)

Features

  • Access the internal scope of Parse Server using the new maintenanceKey; the internal scope contains unofficial and undocumented fields (prefixed with underscore _) which are used internally by Parse Server; you may want to manipulate these fields for out-of-band changes such as data migration or correction tasks; changes within the internal scope of Parse Server may happen at any time without notice or changelog entry, it is therefore recommended to look at the source code of Parse Server to understand the effects of manipulating internal fields before using the key; it is discouraged to use the maintenanceKey for routine operations in a production environment; see access scopes (#8212) (f3bcc93)
  • Adapt verifyServerUrl for new asynchronous Parse Server start-up states (#8366) (ffa4974)
  • Add ParseQuery.watch to trigger LiveQuery only on update of specific fields (#8028) (fc92faa)
  • Add Node 19 support (#8363) (a4990dc)
  • Add option to change the log level of the logs emitted by triggers (#8328) (8f3b694)
  • Add request rate limiter based on IP address (#8174) (6c79f6a)
  • Asynchronous initialization of Parse Server (#8232) (99fcf45)
  • Improve authentication adapter interface to support multi-factor authentication (MFA), authentication challenges, and provide a more powerful interface for writing custom authentication adapters (#8156) (5bbf9ca)
  • Reduce Docker image size by improving stages (#8359) (40810b4)
  • Remove deprecation DEPPS1: Native MongoDB syntax in aggregation pipeline (#8362) (d0d30c4)
  • Remove deprecation DEPPS2: Config option directAccess defaults to true (#8284) (f535ee6)
  • Remove deprecation DEPPS3: Config option enforcePrivateUsers defaults to true (#8283) (ed499e3)
  • Remove deprecation DEPPS4: Remove convenience method for http request Parse.Cloud.httpRequest (#8287) (2d79c08)
  • Remove support for MongoDB 4.0 (#8292) (37245f6)
  • Restrict use of masterKey to localhost by default (#8281) (6c16021)
  • Upgrade Node Package Manager lock file package-lock.json to version 2 (#8285) (ee72467)
  • Upgrade Redis 3 to 4 (#8293) (7d622f0)
  • Upgrade Redis 3 to 4 for LiveQuery (#8333) (b2761fb)
  • Upgrade to Parse JavaScript SDK 4 (#8332) (9092874)
  • Write log entry when request with master key is rejected as outside of masterKeyIps (#8350) (e22b73d)

BREAKING CHANGES

  • The Docker image does not contain the git dependency anymore; if you have been using git as a transitive dependency it now needs to be explicitly installed in your Docker file, for example with RUN apk --no-cache add git (#8359) (40810b4)
  • Fields in the internal scope of Parse Server (prefixed with underscore _) are only returned using the new maintenanceKey; previously the masterKey allowed reading of internal fields; see access scopes for a comparison of the keys' access permissions (#8212) (f3bcc93)
  • The method ParseServer.verifyServerUrl now returns a promise instead of a callback. (ffa4974)
  • The MongoDB aggregation pipeline requires native MongoDB syntax instead of the custom Parse Server syntax; for example pipeline stage names require a leading dollar sign like $match and the MongoDB document ID is referenced using _id instead of objectId (#8362) (d0d30c4)
  • The mechanism to determine the client IP address has been rewritten; to correctly determine the IP address it is now required to set the Parse Server option trustProxy accordingly if Parse Server runs behind a proxy server, see the express framework's trust proxy setting (#8372) (892040d)
  • The Node Package Manager lock file package-lock.json is upgraded to version 2; while it is backwards with version 1 for the npm installer, consider this if you run any non-npm analysis tools that use the lock file (#8285) (ee72467)
  • This release introduces the asynchronous initialization of Parse Server to prevent mounting Parse Server before being ready to receive request; it changes how Parse Server is imported, initialized and started; it also removes the callback serverStartComplete; see the Parse Server 6 migration guide for more details (#8232) (99fcf45)
  • Nested objects are now properly stored in the database using JSON serialization; previously, due to a bug only top-level objects were serialized, but nested objects were saved as raw JSON; for example, a nested Date object was saved as a JSON object like { "__type": "Date", "iso": "2020-01-01T00:00:00.000Z" } instead of its serialized representation 2020-01-01T00:00:00.000Z (#8209) (1412666)
  • The Parse Server option enforcePrivateUsers is set to true by default; in previous releases this option defaults to false; this change improves the default security configuration of Parse Server (#8283) (ed499e3)
  • This release restricts the use of masterKey to localhost by default; if you are using Parse Dashboard on a different server to connect to Parse Server you need to add the IP address of the server that hosts Parse Dashboard to this option (#8281) (6c16021)
  • This release upgrades to Redis 4; if you are using the Redis cache adapter with Parse Server then this is a breaking change as the Redis client options have changed; see the Redis migration guide for more details (#8293) (7d622f0)
  • This release removes support for MongoDB 4.0; the new minimum supported MongoDB version is 4.2. which also removes support for the deprecated MongoDB MMAPv1 storage engine (37245f6)
  • Throwing an error in Cloud Code Triggers afterLogin, afterLogout returns a rejected promise; in previous releases it crashed the server if you did not handle the error on the Node.js process level; consider adapting your code if your app currently handles these errors on the Node.js process level with process.on('unhandledRejection', ...) (130d290)
  • Config option directAccess defaults to true; set this to false in environments where multiple Parse Server instances run behind a load balancer and Parse requests within the current Node.js environment should be routed via the load balancer and distributed as HTTP requests among all instances via the serverURL. (f535ee6)
  • The convenience method for HTTP requests Parse.Cloud.httpRequest is removed; use your preferred 3rd party library for making HTTP requests (2d79c08)
  • This release removes Node 12 and Node 17 support (2546cc8)

5.4.0-beta.1 (2022-10-29)

Bug Fixes

  • authentication adapter app ID validation may be circumvented; this fixes a vulnerability that affects configurations which allow users to authenticate using the Parse Server authentication adapter for Facebook or Spotify and where the server-side authentication adapter configuration appIds is set as a string (e.g. abc) instead of an array of strings (e.g. ["abc"]) (GHSA-r657-33vp-gp22) [skip release] (#8187) (8c8ec71)
  • brute force guessing of user sensitive data via search patterns (GHSA-2m6g-crv8-p3c6) (#8146) [skip release] (4c0c7c7)
  • certificate in Apple Game Center auth adapter not validated [skip release] (#8058) (75af9a2)
  • graphQL query ignores condition equalTo with value false (#8032) (7f5a15d)
  • internal indices for classes _Idempotency and _Role are not protected in defined schema (#8121) (c16f529)
  • invalid file request not properly handled [skip release] (#8062) (4c9e956)
  • liveQuery with containedIn not working when object field is an array (#8128) (1d9605b)
  • protected fields exposed via LiveQuery (GHSA-crrq-vr9j-fxxh) [skip release] (#8076) (9fd4516)
  • push notifications badge doesn't update with Installation beforeSave trigger (#8162) (3c75c2b)
  • query aggregation pipeline cannot handle value of type Date when directAccess: true (#8167) (e424137)
  • relation constraints in compound queries Parse.Query.or, Parse.Query.and not working (#8203) (28f0d26)
  • security upgrade undici from 5.6.0 to 5.8.0 (#8108) (4aa016b)
  • server crashes when receiving file download request with invalid byte range; this fixes a security vulnerability that allows an attacker to impact the availability of the server instance; the fix improves parsing of the range parameter to properly handle invalid range requests (GHSA-h423-w6qv-2wj3) [skip release] (#8238) (c03908f)
  • session object properties can be updated by foreign user; this fixes a security vulnerability in which a foreign user can write to the session object of another user if the session object ID is known; the fix prevents writing to foreign session objects (GHSA-6w4q-23cf-j9jp) [skip release] (#8180) (37fed30)
  • sorting by non-existing value throws INVALID_SERVER_ERROR on Postgres (#8157) (3b775a1)
  • updating object includes unchanged keys in client response for certain key types (#8159) (37af1d7)

Features

  • add convenience access to Parse Server configuration in Cloud Code via Parse.Server (#8244) (9f11115)
  • add option to change the default value of the Parse.Query.limit() constraint (#8152) (0388956)
  • add support for MongoDB 6 (#8242) (aba0081)
  • add support for Postgres 15 (#8215) (2feb6c4)
  • liveQuery support for unsorted distance queries (#8221) (0f763da)

5.3.0-beta.1 (2022-06-17)

Bug Fixes

  • afterSave trigger removes pointer in Parse object (#7913) (47d796e)
  • auto-release process may fail if optional back-merging task fails (#8051) (cf925e7)
  • custom database options are not passed to MongoDB GridFS (#7911) (b1e5565)
  • depreciate allowClientClassCreation defaulting to true (#7925) (38ed96a)
  • errors in GraphQL do not show the original error but a general Unexpected Error (#8045) (0d81887)
  • interrupted WebSocket connection not closed by LiveQuery server (#8012) (2d5221e)
  • live query role cache does not clear when a user is added to a role (#8026) (199dfc1)
  • peer dependency mismatch for GraphQL dependencies (#7934) (0a6faa8)
  • return correct response when revert is used in beforeSave (#7839) (19900fc)
  • security upgrade @parse/fs-files-adapter from 1.2.1 to 1.2.2 (#7948) (3a70fda)
  • security upgrade moment from 2.29.1 to 2.29.2 (#7931) (731c550)
  • security upgrade parse push adapter from 4.1.0 to 4.1.2 (#7893) (93667b4)
  • websocket connection of LiveQuery interrupts frequently (#8048) (03caae1)

Features

  • add MongoDB 5.1 compatibility (#7682) (022a856)
  • add MongoDB 5.2 support (#7894) (5bfa716)
  • add support for Node 17 and 18 (#7896) (3e9f292)
  • align file trigger syntax with class trigger; use the new syntax Parse.Cloud.beforeSave(Parse.File, (request) => {}), the old syntax Parse.Cloud.beforeSaveFile((request) => {}) has been deprecated (#7966) (c6dcad8)
  • replace GraphQL Apollo with GraphQL Yoga (#7967) (1aa2204)
  • selectively enable / disable default authentication adapters (#7953) (c1e808f)
  • upgrade mongodb from 4.4.1 to 4.5.0 (#7991) (e692b5d)

Performance Improvements

  • reduce database operations when using the constant parameter in Cloud Function validation (#7892) (041197f)

5.2.0-beta.2 (2022-03-24)

Bug Fixes

  • security bump minimist from 1.2.5 to 1.2.6 (#7884) (c5cf282)
  • sensitive keyword detection may produce false positives (#7881) (0d6f9e9)

5.2.0-beta.1 (2022-03-23)

Features

  • improved LiveQuery error logging with additional information (#7837) (443a509)

5.0.0-beta.10 (2022-03-15)

Bug Fixes

  • adding or modifying a nested property requires addField permissions (#7679) (6a6248b)
  • bump nanoid from 3.1.25 to 3.2.0 (#7781) (f5f63bf)
  • bump node-fetch from 2.6.1 to 3.1.1 (#7782) (9082351)
  • node engine compatibility did not include node 16 (#7739) (ea7c014)
  • node engine range has no upper limit to exclude incompatible node versions (#7692) (573558d)
  • package.json & package-lock.json to reduce vulnerabilities (#7823) (5ca2288)
  • schema cache not cleared in some cases (#7678) (5af6e5d)
  • security upgrade follow-redirects from 1.14.6 to 1.14.7 (#7769) (8f5a861)
  • security upgrade follow-redirects from 1.14.7 to 1.14.8 (#7801) (70088a9)
  • security vulnerability that allows remote code execution (GHSA-p6h4-93qp-jhcm) (#7844) (e569f40)
  • server crash using GraphQL due to missing @apollo/client peer dependency (#7787) (08089d6)
  • unable to use objectId size higher than 19 on GraphQL API (#7627) (ed86c80)
  • upgrade mime from 2.5.2 to 3.0.0 (#7725) (f5ef98b)
  • upgrade parse from 3.3.1 to 3.4.0 (#7723) (d4c1f47)
  • upgrade winston from 3.5.0 to 3.5.1 (#7820) (4af253d)

Features

Reverts

  • refactor: allow ES import for cloud string if package type is module (b64640c)
  • update node engine to 2.22.0 (#7827) (f235412)

BREAKING CHANGES

  • This requires Node.js version >=12.22.10. (5ace99d)
  • The MongoDB GridStore adapter has been removed. By default, Parse Server already uses GridFS, so if you do not manually use the GridStore adapter, you can ignore this change. (f88aa2a)
  • Removes official Node 15 support which has reached it end-of-life date. (45cc58c)

5.0.0-beta.9 (2022-03-12)

Features

BREAKING CHANGES

  • This requires Node.js version >=12.22.10. (23a3488)

5.0.0-beta.8 (2022-03-12)

Bug Fixes

  • security vulnerability that allows remote code execution (GHSA-p6h4-93qp-jhcm) (#7843) (971adb5)

5.0.0-beta.7 (2022-02-10)

Bug Fixes

  • security upgrade follow-redirects from 1.14.7 to 1.14.8 (#7802) (7029b27)

5.0.0-beta.6 (2022-01-13)

Bug Fixes

  • security upgrade follow-redirects from 1.14.2 to 1.14.7 (#7772) (4bd34b1)

5.0.0-beta.5 (2022-01-13)

Bug Fixes

5.0.0-beta.4 (2021-11-27)

Bug Fixes

  • unable to use objectId size higher than 19 on GraphQL API (#7722) (8ee0445)

5.0.0-beta.3 (2021-11-12)

Bug Fixes

  • node engine range has no upper limit to exclude incompatible node versions (#7693) (6a54dac)

5.0.0-beta.2 (2021-11-10)

Reverts

  • refactor: allow ES import for cloud string if package type is module (#7691) (200d4ba)

5.0.0-beta.1 (2021-11-01)

BREAKING CHANGES

  • Improved schema caching through database real-time hooks. Reduces DB queries, decreases Parse Query execution time and fixes a potential schema memory leak. If multiple Parse Server instances connect to the same DB (for example behind a load balancer), set the Parse Server Option databaseOptions.enableSchemaHooks: true to enable this feature and keep the schema in sync across all instances. Failing to do so will cause a schema change to not propagate to other instances and re-syncing will only happen when these instances restart. The options enableSingleSchemaCache and schemaCacheTTL have been removed. To use this feature with MongoDB, a replica set cluster with change stream support is required. (Diamond Lewis, SebC) #7214
  • Added file upload restriction. File upload is now only allowed for authenticated users by default for improved security. To allow file upload also for Anonymous Users or Public, set the fileUpload parameter in the Parse Server Options (dblythy, Manuel Trezza) #7071
  • Removed parse-server-simple-mailgun-adapter dependency; to continue using the adapter it has to be explicitly installed (Manuel Trezza) #7321
  • Remove support for MongoDB 3.6 which has reached its End-of-Life date and PostgreSQL 10 (Manuel Trezza) #7315
  • Remove support for Node 10 which has reached its End-of-Life date (Manuel Trezza) #7314
  • Remove S3 Files Adapter from Parse Server, instead install separately as @parse/s3-files-adapter (Manuel Trezza) #7324
  • Remove Session field restricted; the field was a code artifact from a feature that never existed in Open Source Parse Server; if you have been using this field for custom purposes, consider that for new Parse Server installations the field does not exist anymore in the schema, and for existing installations the field default value false will not be set anymore when creating a new session (Manuel Trezza) #7543
  • ci: add node engine version check (Manuel Trezza) #7574
  • To delete a field via the GraphQL API, the field value has to be set to null. Previously, setting a field value to null would save a null value in the database, which was not according to the GraphQL specs. To delete a file field use file: null, the previous way of using file: { file: null } has become obsolete. (626fad2)

Notable Changes

  • Alphabetical ordered GraphQL API, improved GraphQL Schema cache system and fix GraphQL input reassign issue (Moumouls) #7344
  • Added Parse Server Security Check to report weak security settings (Manuel Trezza, dblythy) #7247
  • EXPERIMENTAL: Added new page router with placeholder rendering and localization of custom and feature pages such as password reset and email verification (Manuel Trezza) #7128
  • EXPERIMENTAL: Added custom routes to easily customize flows for password reset, email verification or build entirely new flows (Manuel Trezza) #7231
  • Added Deprecation Policy to govern the introduction of breaking changes in a phased pattern that is more predictable for developers (Manuel Trezza) #7199
  • Add REST API endpoint /loginAs to create session of any user with master key; allows to impersonate another user. (GormanFletcher) #7406
  • Add official support for MongoDB 5.0 (Manuel Trezza) #7469
  • Added Parse Server Configuration enforcePrivateUsers, which will remove public access by default on new Parse.Users (dblythy) #7319
  • add support for Postgres 14 (#7644) (090350a)
  • add user-defined schema and migrations (#7418) (25d5c30)
  • setting a field to null does not delete it via GraphQL API (#7649) (626fad2)
  • combined and query with relational query condition returns incorrect results (#7593) (174886e)

Other Changes

  • Support native mongodb syntax in aggregation pipelines (Raschid JF Rafeally) #7339
  • Fix error when a not yet inserted job is updated (Antonio Davi Macedo Coelho de Castro) #7196
  • request.context for afterFind triggers (dblythy) #7078
  • Winston Logger interpolating stdout to console (dplewis) #7114
  • Added convenience method Parse.Cloud.sendEmail(...) to send email via email adapter in Cloud Code (dblythy) #7089
  • LiveQuery support for $and, $nor, $containedBy, $geoWithin, $geoIntersects queries (dplewis) #7113
  • Supporting patterns in LiveQuery server's config parameter classNames (Nes-si) #7131
  • Added requireAnyUserRoles and requireAllUserRoles for Parse Cloud validator (dblythy) #7097
  • Support Facebook Limited Login (miguel-s) #7219
  • Removed Stage name check on aggregate pipelines (BRETT71) #7237
  • Retry transactions on MongoDB when it fails due to transient error (Antonio Davi Macedo Coelho de Castro) #7187
  • Bump tests to use Mongo 4.4.4 (Antonio Davi Macedo Coelho de Castro) #7184
  • Added new account lockout policy option accountLockout.unlockOnPasswordReset to automatically unlock account on password reset (Manuel Trezza) #7146
  • Test Parse Server continuously against all recent MongoDB versions that have not reached their end-of-life support date, added MongoDB compatibility table to Parse Server docs (Manuel Trezza) #7161
  • Test Parse Server continuously against all recent Node.js versions that have not reached their end-of-life support date, added Node.js compatibility table to Parse Server docs (Manuel Trezza) 7161
  • Throw error on invalid Cloud Function validation configuration (dblythy) #7154
  • Allow Cloud Validator options to be async (dblythy) #7155
  • Optimize queries on classes with pointer permissions (Pedro Diaz) #7061
  • Test Parse Server continuously against all relevant Postgres versions (minor versions), added Postgres compatibility table to Parse Server docs (Corey Baker) #7176
  • Randomize test suite (Diamond Lewis) #7265
  • LDAP: Properly unbind client on group search error (Diamond Lewis) #7265
  • Improve data consistency in Push and Job Status update (Diamond Lewis) #7267
  • Excluding keys that have trailing edges.node when performing GraphQL resolver (Chris Bland) #7273
  • Added centralized feature deprecation with standardized warning logs (Manuel Trezza) #7303
  • Use Node.js 15.13.0 in CI (Olle Jonsson) #7312
  • Fix file upload issue for S3 compatible storage (Linode, DigitalOcean) by avoiding empty tags property when creating a file (Ali Oguzhan Yildiz) #7300
  • Add building Docker image as CI check (Manuel Trezza) #7332
  • Add NPM package-lock version check to CI (Manuel Trezza) #7333
  • Fix incorrect LiveQuery events triggered for multiple subscriptions on the same class with different events #7341
  • Fix select and excludeKey queries to properly accept JSON string arrays. Also allow nested fields in exclude (Corey Baker) #7242
  • Fix LiveQuery server crash when using $all query operator on a missing object key (Jason Posthuma) #7421
  • Added runtime deprecation warnings (Manuel Trezza) #7451
  • Add ability to pass context of an object via a header, X-Parse-Cloud-Context, for Cloud Code triggers. The header addition allows client SDK's to add context without injecting _context in the body of JSON objects (Corey Baker) #7437
  • Add CI check to add changelog entry (Manuel Trezza) #7512
  • Refactor: uniform issue templates across repos (Manuel Trezza) #7528
  • ci: bump ci environment (Manuel Trezza) #7539
  • CI now pushes docker images to Docker Hub (Corey Baker) #7548
  • Allow afterFind and afterLiveQueryEvent to set unsaved pointers and keys (dblythy) #7310
  • Allow setting descending sort to full text queries (dblythy) #7496
  • Allow cloud string for ES modules (Daniel Blyth) #7560
  • docs: Introduce deprecation ID for reference in comments and online search (Manuel Trezza) #7562
  • refactor: deprecate Parse.Cloud.httpRequest; it is recommended to use a HTTP library instead. (Daniel Blyth) #7595
  • refactor: Modernize HTTPRequest tests (brandongregoryscott) #7604
  • Allow liveQuery on Session class (Daniel Blyth) #7554