parse-server

Parse Server for Node.js / Express

APACHE-2.0 License

Downloads
105.2K
Stars
20.6K
Committers
341
View Code on GitHub Visit Website View on X
Ecosystems: MongoDB, GraphQL, Node.js, PostgreSQL

Bot releases are hidden (Show)

parse-server - 5.0.0-alpha.2

Published by parseplatformorg almost 3 years ago

5.0.0-alpha.2 (2021-10-27)

Bug Fixes

  • setting a field to null does not delete it via GraphQL API (#7649) (626fad2)

BREAKING CHANGES

  • To delete a field via the GraphQL API, the field value has to be set to null. Previously, setting a field value to null would save a null value in the database, which was not according to the GraphQL specs. To delete a file field use file: null, the previous way of using file: { file: null } has become obsolete. (626fad2)
parse-server - 5.0.0-alpha.1

Published by mtrezza about 3 years ago

5.0.0-alpha.1 (2021-10-12)

Breaking Changes

  • Improved schema caching through database real-time hooks. Reduces DB queries, decreases Parse Query execution time and fixes a potential schema memory leak. If multiple Parse Server instances connect to the same DB (for example behind a load balancer), set the Parse Server Option databaseOptions.enableSchemaHooks: true to enable this feature and keep the schema in sync across all instances. Failing to do so will cause a schema change to not propagate to other instances and re-syncing will only happen when these instances restart. The options enableSingleSchemaCache and schemaCacheTTL have been removed. To use this feature with MongoDB, a replica set cluster with change stream support is required. (Diamond Lewis, SebC) #7214
  • Added file upload restriction. File upload is now only allowed for authenticated users by default for improved security. To allow file upload also for Anonymous Users or Public, set the fileUpload parameter in the Parse Server Options (dblythy, Manuel Trezza) #7071
  • Removed parse-server-simple-mailgun-adapter dependency; to continue using the adapter it has to be explicitly installed (Manuel Trezza) #7321
  • Remove support for MongoDB 3.6 which has reached its End-of-Life date and PostgreSQL 10 (Manuel Trezza) #7315
  • Remove support for Node 10 which has reached its End-of-Life date (Manuel Trezza) #7314
  • Remove S3 Files Adapter from Parse Server, instead install separately as @parse/s3-files-adapter (Manuel Trezza) #7324
  • Remove Session field restricted; the field was a code artifact from a feature that never existed in Open Source Parse Server; if you have been using this field for custom purposes, consider that for new Parse Server installations the field does not exist anymore in the schema, and for existing installations the field default value false will not be set anymore when creating a new session (Manuel Trezza) #7543

Notable Changes

  • Alphabetical ordered GraphQL API, improved GraphQL Schema cache system and fix GraphQL input reassign issue (Moumouls) #7344
  • Added Parse Server Security Check to report weak security settings (Manuel Trezza, dblythy) #7247
  • EXPERIMENTAL: Added new page router with placeholder rendering and localization of custom and feature pages such as password reset and email verification (Manuel Trezza) #7128
  • EXPERIMENTAL: Added custom routes to easily customize flows for password reset, email verification or build entirely new flows (Manuel Trezza) #7231
  • Added Deprecation Policy to govern the introduction of breaking changes in a phased pattern that is more predictable for developers (Manuel Trezza) #7199
  • Add REST API endpoint /loginAs to create session of any user with master key; allows to impersonate another user. (GormanFletcher) #7406
  • Add official support for MongoDB 5.0 (Manuel Trezza) #7469
  • Added Parse Server Configuration enforcePrivateUsers, which will remove public access by default on new Parse.Users (dblythy) #7319
  • ci: add node engine version check (Manuel Trezza) #7574

Other Changes

  • Support native mongodb syntax in aggregation pipelines (Raschid JF Rafeally) #7339
  • Fix error when a not yet inserted job is updated (Antonio Davi Macedo Coelho de Castro) #7196
  • request.context for afterFind triggers (dblythy) #7078
  • Winston Logger interpolating stdout to console (dplewis) #7114
  • Added convenience method Parse.Cloud.sendEmail(...) to send email via email adapter in Cloud Code (dblythy) #7089
  • LiveQuery support for $and, $nor, $containedBy, $geoWithin, $geoIntersects queries (dplewis) #7113
  • Supporting patterns in LiveQuery server's config parameter classNames (Nes-si) #7131
  • Added requireAnyUserRoles and requireAllUserRoles for Parse Cloud validator (dblythy) #7097
  • Support Facebook Limited Login (miguel-s) #7219
  • Removed Stage name check on aggregate pipelines (BRETT71) #7237
  • Retry transactions on MongoDB when it fails due to transient error (Antonio Davi Macedo Coelho de Castro) #7187
  • Bump tests to use Mongo 4.4.4 (Antonio Davi Macedo Coelho de Castro) #7184
  • Added new account lockout policy option accountLockout.unlockOnPasswordReset to automatically unlock account on password reset (Manuel Trezza) #7146
  • Test Parse Server continuously against all recent MongoDB versions that have not reached their end-of-life support date, added MongoDB compatibility table to Parse Server docs (Manuel Trezza) #7161
  • Test Parse Server continuously against all recent Node.js versions that have not reached their end-of-life support date, added Node.js compatibility table to Parse Server docs (Manuel Trezza) 7161
  • Throw error on invalid Cloud Function validation configuration (dblythy) #7154
  • Allow Cloud Validator options to be async (dblythy) #7155
  • Optimize queries on classes with pointer permissions (Pedro Diaz) #7061
  • Test Parse Server continuously against all relevant Postgres versions (minor versions), added Postgres compatibility table to Parse Server docs (Corey Baker) #7176
  • Randomize test suite (Diamond Lewis) #7265
  • LDAP: Properly unbind client on group search error (Diamond Lewis) #7265
  • Improve data consistency in Push and Job Status update (Diamond Lewis) #7267
  • Excluding keys that have trailing edges.node when performing GraphQL resolver (Chris Bland) #7273
  • Added centralized feature deprecation with standardized warning logs (Manuel Trezza) #7303
  • Use Node.js 15.13.0 in CI (Olle Jonsson) #7312
  • Fix file upload issue for S3 compatible storage (Linode, DigitalOcean) by avoiding empty tags property when creating a file (Ali Oguzhan Yildiz) #7300
  • Add building Docker image as CI check (Manuel Trezza) #7332
  • Add NPM package-lock version check to CI (Manuel Trezza) #7333
  • Fix incorrect LiveQuery events triggered for multiple subscriptions on the same class with different events #7341
  • Fix select and excludeKey queries to properly accept JSON string arrays. Also allow nested fields in exclude (Corey Baker) #7242
  • Fix LiveQuery server crash when using $all query operator on a missing object key (Jason Posthuma) #7421
  • Added runtime deprecation warnings (Manuel Trezza) #7451
  • Add ability to pass context of an object via a header, X-Parse-Cloud-Context, for Cloud Code triggers. The header addition allows client SDK's to add context without injecting _context in the body of JSON objects (Corey Baker) #7437
  • Add CI check to add changelog entry (Manuel Trezza) #7512
  • Refactor: uniform issue templates across repos (Manuel Trezza) #7528
  • ci: bump ci environment (Manuel Trezza) #7539
  • CI now pushes docker images to Docker Hub (Corey Baker) #7548
  • Allow afterFind and afterLiveQueryEvent to set unsaved pointers and keys (dblythy) #7310
  • Allow setting descending sort to full text queries (dblythy) #7496
  • Allow cloud string for ES modules (Daniel Blyth) #7560
  • docs: Introduce deprecation ID for reference in comments and online search (Manuel Trezza) #7562
  • refactor: deprecate Parse.Cloud.httpRequest; it is recommended to use a HTTP library instead. (Daniel Blyth) #7595
  • refactor: Modernize HTTPRequest tests (brandongregoryscott) #7604
  • Allow liveQuery on Session class (Daniel Blyth) #7554
parse-server - 4.10.4

Published by mtrezza about 3 years ago

Full Changelog

Security Fixes

  • Strip out sessionToken when LiveQuery is used on Parse.User (Daniel Blyth) GHSA-7pr3-p5fm-8r9x
parse-server - 4.10.3

Published by mtrezza about 3 years ago

Full Changelog

Security Fixes

parse-server - 4.10.2

Published by mtrezza about 3 years ago

Full Changelog

Fixes

  • Move graphql-tag from devDependencies to dependencies (Antonio Davi Macedo Coelho de Castro) #7183
parse-server - 4.10.1

Published by mtrezza about 3 years ago

Full Changelog

  • Updated to Parse JS SDK 3.3.0 and other security fixes (Manuel Trezza) #7508

⚠️ This includes a security fix of the Parse JS SDK where logIn will default to POST instead of GET method. This may require changes in your deployment before you upgrade to this release, see the Parse JS SDK 3.0.0 release notes.

parse-server - 4.10.0

Published by mtrezza about 3 years ago

Full Changelog

Versions >4.5.2 and <4.10.0 are skipped.

⚠️ A security incident caused a number of incorrect version tags to be pushed to the Parse Server repository. These version tags linked to a personal fork of a contributor who had write access to the repository. The code to which these tags linked has not been reviewed or approved by Parse Platform. Even though no releases were published with these incorrect versions, it was possible to define a Parse Server dependency that pointed to these version tags, for example if you defined this dependency:

"parse-server": "[email protected]:parse-community/parse-server.git#4.9.3"

We have since deleted the incorrect version tags, but they may still show up in your personal fork on GitHub or locally. We do not know when these tags have been pushed to the Parse Server repository, but we first became aware of this issue on July 21, 2021. We are not aware of any malicious code or concerns related to privacy, security or legality (e.g. proprietary code). However, it has been reported that some functionality does not work as expected and the introduction of security vulnerabilities cannot be ruled out.

You may be also affected if you used the Bitnami image for Parse Server. Bitnami picked up the incorrect version tag 4.9.3 and published a new Bitnami image for Parse Server.

If you are using any of the affected versions, we urgently recommend to upgrade to version 4.10.0.
GHSA-593v-wcqx-hq2w

parse-server - 4.5.2

Published by mtrezza about 3 years ago

Full Changelog

  • SECURITY FIX: Fixes incorrect session property authProvider: password of anonymous users. When signing up an anonymous user, the session field createdWith indicates incorrectly that the session has been created using username and password with authProvider: password, instead of an anonymous sign-up with authProvider: anonymous. This fixes the issue by setting the correct authProvider: anonymous for future sign-ups of anonymous users. This fix does not fix incorrect authProvider: password for existing sessions of anonymous users. Consider this if your app logic depends on the authProvider field. (Corey Baker) GHSA-23r4-5mxp-c7g5
parse-server - 4.5.0

Published by davimacedo almost 4 years ago

Full Changelog

BREAKING CHANGES:

  • FIX: Consistent casing for afterLiveQueryEvent. The afterLiveQueryEvent was introduced in 4.4.0 with inconsistent casing for the event names, which was fixed in 4.5.0. #7023. Thanks to dblythy.
  • FIX: Properly handle serverURL and publicServerUrl in Batch requests. #7049. Thanks to Zach Goldberg.
  • IMPROVE: Prevent invalid column names (className and length). #7053. Thanks to Diamond Lewis.
  • IMPROVE: GraphQL: Remove viewer from logout mutation. #7029. Thanks to Antoine Cormouls.
  • IMPROVE: GraphQL: Optimize on Relation. #7044. Thanks to Antoine Cormouls.
  • NEW: Include sessionToken in onLiveQueryEvent. #7043. Thanks to dblythy.
  • FIX: Definitions for accountLockout and passwordPolicy. #7040. Thanks to dblythy.
  • FIX: Fix typo in server definitions for emailVerifyTokenReuseIfValid. #7037. Thanks to dblythy.
  • SECURITY FIX: LDAP auth stores password in plain text. See GHSA-4w46-w44m-3jq3 for more details about the vulnerability and da905a3 for the fix. Thanks to Fabian Strachanski.
  • NEW: Reuse tokens if they haven't expired. #7017. Thanks to dblythy.
  • NEW: Add LDAPS-support to LDAP-Authcontroller. #7014. Thanks to Fabian Strachanski.
  • FIX: (beforeSave/afterSave): Return value instead of Parse.Op for nested fields. #7005. Thanks to Diamond Lewis.
  • FIX: (beforeSave): Skip Sanitizing Database results. #7003. Thanks to Diamond Lewis.
  • FIX: Fix includeAll for querying a Pointer and Pointer array. #7002. Thanks to Corey Baker.
  • FIX: Add encryptionKey to src/options/index.js. #6999. Thanks to dblythy.
  • IMPROVE: Update PostgresStorageAdapter.js. #6989. Thanks to Vitaly Tomilov.
parse-server - 4.4.0

Published by davimacedo almost 4 years ago

Full Changelog

parse-server - 4.3.0

Published by davimacedo over 4 years ago

Full Changelog

  • PERFORMANCE: Optimizing pointer CLP query decoration done by DatabaseController#addPointerPermissions #6747. Thanks to mess-lelouch.
  • SECURITY: Fix security breach on GraphQL viewer 78239ac, secuity advisory. Thanks to Antoine Cormouls.
  • FIX: Save context not present if direct access enabled #6764. Thanks to Omair Vaiyani.
  • NEW: Before Connect + Before Subscribe #6793. Thanks to dblythy.
  • FIX: Add version to playground to fix CDN #6804. Thanks to Antoine Cormouls.
  • NEW (EXPERIMENTAL): Idempotency enforcement for client requests. This deduplicates requests where the client intends to send one request to Parse Server but due to network issues the server receives the request multiple times. Caution, this is an experimental feature that may not be appropriate for production. #6748. Thanks to Manuel Trezza.
  • FIX: Add production Google Auth Adapter instead of using the development url #6734. Thanks to SebC..
  • IMPROVE: Run Prettier JS Again Without requiring () on arrow functions #6796. Thanks to Diamond Lewis.
  • IMPROVE: Run Prettier JS #6795. Thanks to Diamond Lewis.
  • IMPROVE: Replace bcrypt with @node-rs/bcrypt #6794. Thanks to LongYinan.
  • IMPROVE: Make clear description of anonymous user #6655. Thanks to Jerome De Leon.
  • IMPROVE: Simplify GraphQL merge system to avoid js ref bugs #6791. Thanks to Antoine Cormouls.
  • NEW: Pass context in beforeDelete, afterDelete, beforeFind and Parse.Cloud.run #6666. Thanks to yog27ray.
  • NEW: Allow passing custom gql schema function to ParseServer#start options #6762. Thanks to Luca.
  • NEW: Allow custom cors origin header #6772. Thanks to Kevin Yao.
  • FIX: Fix context for cascade-saving and saving existing object #6735. Thanks to Manuel.
  • NEW: Add file bucket encryption using fileKey #6765. Thanks to Corey Baker.
  • FIX: Removed gaze from dev dependencies and removed not working dev script #6745. Thanks to Vincent Semrau.
  • IMPROVE: Upgrade graphql-tools to v6 #6701. Thanks to Yaacov Rydzinski.
  • NEW: Support Metadata in GridFSAdapter #6660. Thanks to Diamond Lewis.
  • NEW: Allow to unset file from graphql #6651. Thanks to Antoine Cormouls.
  • NEW: Handle shutdown for RedisCacheAdapter #6658. Thanks to promisenxu.
  • FIX: Fix explain on user class #6650. Thanks to Manuel.
  • FIX: Fix read preference for aggregate #6585. Thanks to Manuel.
  • NEW: Add context to Parse.Object.save #6626. Thanks to Manuel.
  • NEW: Adding ssl config params to Postgres URI #6580. Thanks to Corey Baker.
  • FIX: Travis postgres update: removing unnecessary start of mongo-runner #6594. Thanks to Corey Baker.
  • FIX: ObjectId size for Pointer in Postgres #6619. Thanks to Corey Baker.
  • IMPROVE: Improve a test case #6629. Thanks to Gordon Sun.
  • NEW: Allow to resolve automatically Parse Type fields from Custom Schema #6562. Thanks to Antoine Cormouls.
  • FIX: Remove wrong console log in test #6627. Thanks to Gordon Sun.
  • IMPROVE: Graphql tools v5 #6611. Thanks to Yaacov Rydzinski.
  • FIX: Catch JSON.parse and return 403 properly #6589. Thanks to Gordon Sun.
  • PERFORMANCE: Allow covering relation queries with minimal index #6581. Thanks to Noah Silas.
  • FIX: Fix Postgres group aggregation #6522. Thanks to Siddharth Ramesh.
  • NEW: Allow set user mapped from JWT directly on request #6411. Thanks to Gordon Sun.
parse-server - 4.2.0

Published by acinader over 4 years ago

Full Changelog

parse-server - 4.1.0

Published by acinader over 4 years ago

Full Changelog

SECURITY RELEASE: see advisory for details

parse-server - 4.0.2

Published by acinader over 4 years ago

Full Changelog

BREAKING CHANGES:

  1. Remove Support for Mongo 3.2 & 3.4. The new minimum supported version is Mongo 3.6.
  2. Change username and email validation to be case insensitive. This change should be transparent in most use cases. The validation behavior should now behave 'as expected'. See #5634 for details.

Special Note on Upgrading to Parse Server 4.0.0 and above

In addition to the breaking changes noted above, #5634 introduces a two new case insensitive indexes on the User collection. Special care should be taken when upgrading to this version to ensure that:

  1. The new indexes can be successfully created (see issue #6465 for details on a potential issue for your installation).

  2. Care is taken ensure that there is adequate compute capacity to create the index in the background while still servicing requests.

parse-server - 4.0.1

Published by acinader over 4 years ago

BREAKING CHANGES:

  1. Remove Support for Mongo 3.2 & 3.4. The new minimum supported version is Mongo 3.6.
  2. Change username and email validation to be case insensitive. This change should be transparent in most use cases. The validation behavior should now behave 'as expected'. See #5634 for details.

Special Note on Upgrading to Parse Server 4.0.0 and above

In addition to the breaking changes noted above, #5634 introduces a two new case insensitive indexes on the User collection. Special care should be taken when upgrading to this version to ensure that:

  1. The new indexes can be successfully created (see issue #6465 for details on a potential issue for your installation).

  2. Care is taken ensure that there is adequate compute capacity to create the index in the background while still servicing requests.

  • FIX: correct 'new' travis config to properly deploy. See #6452. Thanks to Arthur Cinader.
  • FIX: Better message on not allowed to protect default fields. See #6439.Thanks to Old Grandpa
parse-server - 4.0.0

Published by acinader over 4 years ago

BREAKING CHANGES:

  1. Remove Support for Mongo 3.2 & 3.4. The new minimum supported version is Mongo 3.6.
  2. Change username and email validation to be case insensitive. This change should be transparent in most use cases. The validation behavior should now behave 'as expected'. See #5634 for details.

Special Note on Upgrading to Parse Server 4.0.0 and above

In addition to the breaking changes noted above, #5634 introduces a two new case insensitive indexes on the User collection. Special care should be taken when upgrading to this version to ensure that:

  1. The new indexes can be successfully created (see issue #6465 for details on a potential issue for your installation).

  2. Care is taken ensure that there is adequate compute capacity to create the index in the background while still servicing requests.

Full Changelog

parse-server - 3.10.0

Published by acinader almost 5 years ago

Full Changelog

parse-server - 3.9.0

Published by davimacedo about 5 years ago

parse-server - 3.8.0

Published by acinader about 5 years ago

See the change log for details.

parse-server - 3.7.2

Published by davimacedo about 5 years ago

  • FIX: Live Query was failing on release 3.7.1
Package Rankings
Top 0.55% on Npmjs.org
Badges
Extracted from project README
Build Status Build Status Build Status Snyk Badge Coverage auto-release Node Version MongoDB Version Postgres Version npm latest version npm beta version npm alpha version Backers on Open Collective Sponsors on Open Collective Forum Twitter Chat Bronze Sponsors
Related Projects
fastify-boilerplate

Fastify 5 application boilerplate based on clean architecture, domain-driven design, CQRS, functi...

09 Jun 2024 85
express-graphql-mongodb-boilerplate

A boilerplate for Node.js apps / GraphQL-API / Authentication from scratch - express, graphql - (...

10 Oct 2019 352
node-grpc-graphql-server

Generates GraphQL schemas from gRPC Protocol Buffers and creates the server or gRPC client.

19 Oct 2020 11
graphql-yoga

🧘 Rewrite of a fully-featured GraphQL Server with focus on easy setup, performance & great develo...

15 Nov 2017 8,105
graphpack

☄️ A minimalistic zero-config GraphQL server.

11 Jul 2018 1,988
hackathon-starter

A boilerplate for Node.js web applications

13 Nov 2013 34,679
apollo-server

🌍  Spec-compliant and production ready JavaScript GraphQL server that lets you develop in a schem...

21 Apr 2016 13,699
graphql-starter-kit

💥 Monorepo template (seed project) pre-configured with GraphQL API, PostgreSQL, React, and Joy UI.

30 Sep 2016 3,835
my-pets-api

GraphQL server based on NodeJs to give back-end support a web client based on React

22 Dec 2020 3
apollo-server

🌍  Spec-compliant and production ready JavaScript GraphQL server that lets you develop in a schem...

21 Apr 2016 13,699
apollo-server

🌍  Spec-compliant and production ready JavaScript GraphQL server that lets you develop in a schem...

21 Apr 2016 13,699