9.1.1 (2025-12-16)

Bug Fixes

• Server-Side Request Forgery (SSRF) in Instagram auth adapterGHSA-3f5f-xgrj-97pf (#9988) (fbcc938)

9.1.1-alpha.1 (2025-12-16)

Bug Fixes

• Server-Side Request Forgery (SSRF) in Instagram auth adapterGHSA-3f5f-xgrj-97pf (#9988) (fbcc938)

8.6.2 (2025-12-16)

Bug Fixes

• Server-Side Request Forgery (SSRF) in Instagram auth adapterGHSA-3f5f-xgrj-97pf (#9989) (155c6ad)

9.1.0 (2025-12-14)

Bug Fixes

• Cross-Site Scripting (XSS) via HTML pages for password reset and email verificationGHSA-jhgf-2h8h-ggxv (#9985) (3074eb7)

Features

• Add optionlogLevels.signupUsernameTaken to change log level of username already exists sign-up rejection (#9962) (f18f307)
• Add support for custom HTTP status code and headers to Cloud Function response with Express-style syntax (#9980) (8eeab8d)
• Log more debug info when failing to set duplicate value for field with unique values (#9919) (a23b192)

9.1.0-alpha.4 (2025-12-14)

Features

• Log more debug info when failing to set duplicate value for field with unique values (#9919) (a23b192)

9.1.0-alpha.3 (2025-12-14)

Bug Fixes

• Cross-Site Scripting (XSS) via HTML pages for password reset and email verificationGHSA-jhgf-2h8h-ggxv (#9985) (3074eb7)

9.1.0-alpha.2 (2025-12-14)

Features

• Add support for custom HTTP status code and headers to Cloud Function response with Express-style syntax (#9980) (8eeab8d)

9.1.0-alpha.1 (2025-12-14)

Features

• Add optionlogLevels.signupUsernameTaken to change log level of username already exists sign-up rejection (#9962) (f18f307)

9.0.0 (2025-12-14)

Bug Fixes

• Upgrade to GraphQL Apollo Server 5 and restrict GraphQL introspection (#9888) (87c7f07)

Features

• Deprecation DEPPS10: EncodeParse.Object in Cloud Function and remove optionencodeParseObjectInCloudFunction (#9973) (a2d3dbe)
• Deprecation DEPPS11: ReplacePublicAPIRouter withPagesRouter (#9974) (8f877d4)
• Deprecation DEPPS113: Config optionenableInsecureAuthAdapters defaults tofalse (#9982) (22d4622)
• Deprecation DEPPS12: Database optionallowPublicExplain defaults tofalse (#9975) (c1c7e69)
• Increase required minimum MongoDB version to7.0.16 (#9971) (7bb548b)
• Increase required minimum Node version to20.19.0 (#9970) (633964d)
• Increase required minimum version to Postgres16, PostGIS3.5 (#9972) (7483add)
• Update route patterns to use path-to-regexp v8 syntax (#9942) (fa8723b)
• Upgrade to @parse/push-adapter 8.1.0 (#9938) (d5e76b0)
• Upgrade to parse 8.0.0 (#9976) (f9970d4)

BREAKING CHANGES

• This release changes the config optionenableInsecureAuthAdapters default tofalse (Deprecation DEPPS13). (22d4622)
• This release changes the MongoDB database optionallowPublicExplain default tofalse (Deprecation DEPPS12). (c1c7e69)
• This release replacesPublicAPIRouter withPagesRouter (Deprecation DEPPS11). (8f877d4)
• This release encodesParse.Object in Cloud Function and removes optionencodeParseObjectInCloudFunction (Deprecation DEPPS10). (a2d3dbe)
• This releases increases the required minimum version to Postgres16, PostGIS3.5. (7483add)
• Route pattern syntax across cloud routes and rate-limiting now use the new path-to-regexp v8 syntax; see themigration guide for more details. (fa8723b)
• This releases increases the required minimum MongoDB version to7.0.16. (7bb548b)
• Upgrade to Apollo Server 5 and GraphQL express 5 integration; GraphQL introspection now requires usingmasterKey or settinggraphQLPublicIntrospection: true. (87c7f07)
• This releases increases the required minimum Node version to20.19.0. (633964d)

9.0.0-alpha.11 (2025-12-14)

Features

• Deprecation DEPPS113: Config optionenableInsecureAuthAdapters defaults tofalse (#9982) (22d4622)

BREAKING CHANGES

• This release changes the config optionenableInsecureAuthAdapters default tofalse (Deprecation DEPPS13). (22d4622)