Conversation
## [9.5.2-alpha.1](9.5.1...9.5.2-alpha.1) (2026-03-07) ### Bug Fixes * NoSQL injection via token type in password reset and email verification endpoints ([GHSA-vgjh-hmwf-c588](GHSA-vgjh-hmwf-c588)) ([#10128](#10128)) ([b2f2317](b2f2317))
## [9.5.2-alpha.2](9.5.2-alpha.1...9.5.2-alpha.2) (2026-03-07) ### Bug Fixes * Denial-of-service via unbounded query complexity in REST and GraphQL API ([GHSA-cmj3-wx7h-ffvg](GHSA-cmj3-wx7h-ffvg)) ([#10130](#10130)) ([0ae9c25](0ae9c25))
## [9.5.2-alpha.3](9.5.2-alpha.2...9.5.2-alpha.3) (2026-03-08) ### Bug Fixes * Bypass of class-level permissions in LiveQuery ([GHSA-7ch5-98q2-7289](GHSA-7ch5-98q2-7289)) ([#10133](#10133)) ([98188d9](98188d9))
## [9.5.2-alpha.4](9.5.2-alpha.3...9.5.2-alpha.4) (2026-03-08) ### Bug Fixes * Stored cross-site scripting (XSS) via SVG file upload ([GHSA-hcj7-6gxh-24ww](GHSA-hcj7-6gxh-24ww)) ([#10136](#10136)) ([93b784d](93b784d))
## [9.5.2-alpha.5](9.5.2-alpha.4...9.5.2-alpha.5) (2026-03-08) ### Bug Fixes * Missing audience validation in Keycloak authentication adapter ([GHSA-48mh-j4p5-7j9v](GHSA-48mh-j4p5-7j9v)) ([#10137](#10137)) ([78ef1a1](78ef1a1))
## [9.5.2-alpha.6](9.5.2-alpha.5...9.5.2-alpha.6) (2026-03-08) ### Bug Fixes * Protected fields bypass via logical query operators ([GHSA-72hp-qff8-4pvv](GHSA-72hp-qff8-4pvv)) ([#10140](#10140)) ([be1d65d](be1d65d))
## [9.5.2-alpha.7](9.5.2-alpha.6...9.5.2-alpha.7) (2026-03-08) ### Bug Fixes * Parse Server role escalation and CLP bypass via direct `_Join table write ([GHSA-5f92-jrq3-28rc](GHSA-5f92-jrq3-28rc)) ([#10141](#10141)) ([22faa08](22faa08))
…rKey` query parameter ([GHSA-6r2j-cxgf-495f](GHSA-6r2j-cxgf-495f)) (#10143)
## [9.5.2-alpha.8](9.5.2-alpha.7...9.5.2-alpha.8) (2026-03-08) ### Bug Fixes * Parse Server session token exfiltration via `redirectClassNameForKey` query parameter ([GHSA-6r2j-cxgf-495f](GHSA-6r2j-cxgf-495f)) ([#10143](#10143)) ([70b7b07](70b7b07))
## [9.5.2-alpha.9](9.5.2-alpha.8...9.5.2-alpha.9) (2026-03-08) ### Bug Fixes * Parse Server OAuth2 authentication adapter account takeover via identity spoofing ([GHSA-fr88-w35c-r596](GHSA-fr88-w35c-r596)) ([#10145](#10145)) ([9cfd06e](9cfd06e))
## [9.5.2-alpha.10](9.5.2-alpha.9...9.5.2-alpha.10) (2026-03-08) ### Bug Fixes * Rate limit bypass via batch request endpoint ([GHSA-775h-3xrc-c228](GHSA-775h-3xrc-c228)) ([#10147](#10147)) ([2766f4f](2766f4f))
## [9.5.2-alpha.11](9.5.2-alpha.10...9.5.2-alpha.11) (2026-03-09) ### Bug Fixes * Concurrent signup with same authentication creates duplicate users ([#10149](#10149)) ([853bfe1](853bfe1))
…eneric class routes ([GHSA-7xg7-rqf6-pw6c](GHSA-7xg7-rqf6-pw6c)) (#10151)
## [9.5.2-alpha.12](9.5.2-alpha.11...9.5.2-alpha.12) (2026-03-09) ### Bug Fixes * Classes `_GraphQLConfig` and `_Audience` master key bypass via generic class routes ([GHSA-7xg7-rqf6-pw6c](GHSA-7xg7-rqf6-pw6c)) ([#10151](#10151)) ([1de4e43](1de4e43))
## [9.5.2-alpha.13](9.5.2-alpha.12...9.5.2-alpha.13) (2026-03-09) ### Bug Fixes * LDAP injection via unsanitized user input in DN and group filter construction ([GHSA-7m6r-fhh7-r47c](GHSA-7m6r-fhh7-r47c)) ([#10154](#10154)) ([5bbca7b](5bbca7b))
## [9.5.2-alpha.14](9.5.2-alpha.13...9.5.2-alpha.14) (2026-03-09) ### Bug Fixes * LiveQuery `regexTimeout` default value not applied ([#10156](#10156)) ([416cfbc](416cfbc))
…esponse headers for files via `Parse.Cloud.afterFind(Parse.File)` (#10158)
# [9.6.0-alpha.48](9.6.0-alpha.47...9.6.0-alpha.48) (2026-03-21) ### Bug Fixes * Session update endpoint allows overwriting server-generated session fields ([GHSA-jc39-686j-wp6q](GHSA-jc39-686j-wp6q)) ([#10263](#10263)) ([ea68fc0](ea68fc0))
…uestComplexity.batchRequestLimit` (#10265)
# [9.6.0-alpha.49](9.6.0-alpha.48...9.6.0-alpha.49) (2026-03-21) ### Bug Fixes * Add configurable batch request sub-request limit via option `requestComplexity.batchRequestLimit` ([#10265](#10265)) ([164ed0d](164ed0d))
…ncurrent requests (#10266)
# [9.6.0-alpha.50](9.6.0-alpha.49...9.6.0-alpha.50) (2026-03-21) ### Bug Fixes * Account lockout race condition allows bypassing threshold via concurrent requests ([#10266](#10266)) ([ff70fee](ff70fee))
# [9.6.0-alpha.51](9.6.0-alpha.50...9.6.0-alpha.51) (2026-03-21) ### Bug Fixes * Create CLP not enforced before user field validation on signup ([#10268](#10268)) ([a0530c2](a0530c2))
# [9.6.0-alpha.52](9.6.0-alpha.51...9.6.0-alpha.52) (2026-03-21) ### Bug Fixes * Denial of service via unindexed database query for unconfigured auth providers ([GHSA-g4cf-xj29-wqqr](GHSA-g4cf-xj29-wqqr)) ([#10270](#10270)) ([fbac847](fbac847))
# [9.6.0-alpha.53](9.6.0-alpha.52...9.6.0-alpha.53) (2026-03-21) ### Bug Fixes * SQL injection via aggregate and distinct field names in PostgreSQL adapter ([GHSA-p2w6-rmh7-w8q3](GHSA-p2w6-rmh7-w8q3)) ([#10272](#10272)) ([bdddab5](bdddab5))
# [9.6.0-alpha.54](9.6.0-alpha.53...9.6.0-alpha.54) (2026-03-22) ### Bug Fixes * MFA recovery code single-use bypass via concurrent requests ([GHSA-2299-ghjr-6vjp](GHSA-2299-ghjr-6vjp)) ([#10275](#10275)) ([5e70094](5e70094))
# [9.6.0-alpha.55](9.6.0-alpha.54...9.6.0-alpha.55) (2026-03-22) ### Bug Fixes * Auth data exposed via /users/me endpoint ([GHSA-37mj-c2wf-cx96](GHSA-37mj-c2wf-cx96)) ([#10278](#10278)) ([875cf10](875cf10))
…s owner exemption for `protectedFields` (#10280)
# [9.6.0-alpha.56](9.6.0-alpha.55...9.6.0-alpha.56) (2026-03-22) ### Features * Add `protectedFieldsOwnerExempt` option to control `_User` class owner exemption for `protectedFields` ([#10280](#10280)) ([d5213f8](d5213f8))
|
🚀 Thanks for opening this pull request! We appreciate your effort in improving the project. Please let us know once your pull request is ready for review. Tip
Note Please respond to review comments from AI agents just like you would to comments from a human reviewer. Let the reviewer resolve their own comments, unless they have reviewed and accepted your commit, or agreed with your explanation for why the feedback was incorrect. Caution Pull requests must be written using an AI agent with human supervision. Pull requests written entirely by a human will likely be rejected, because of lower code quality, higher review effort and the higher risk of introducing bugs. Please note that AI review comments on this pull request alone do not satisfy this requirement. |
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment Tip CodeRabbit can suggest fixes for GitHub Check annotations.Configure the |
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## release #10283 +/- ##
===========================================
- Coverage 92.70% 92.13% -0.58%
===========================================
Files 191 192 +1
Lines 15939 16482 +543
Branches 180 226 +46
===========================================
+ Hits 14776 15185 +409
- Misses 1151 1273 +122
- Partials 12 24 +12 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
|
🎉 This change has been released in version 9.6.0 |
Release
This pull request was created automatically according to the release cycle.
Warning
Only use
Merge Committo merge this pull request. Do not useRebase and MergeorSquash and Merge.