Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
# [5.3.0](parse-community/parse-server@5.2.8...5.3.0) (2022-10-29) ### Bug Fixes * afterSave trigger removes pointer in Parse object ([parse-community#7913](parse-community#7913)) ([47d796e](parse-community@47d796e)) * authentication adapter app ID validation may be circumvented; this fixes a vulnerability that affects configurations which allow users to authenticate using the Parse Server authentication adapter for *Facebook* or *Spotify* and where the server-side authentication adapter configuration `appIds` is set as a string (e.g. `abc`) instead of an array of strings (e.g. `["abc"]`) ([GHSA-r657-33vp-gp22](GHSA-r657-33vp-gp22)) [skip release] ([parse-community#8188](parse-community#8188)) ([1a2b1b9](parse-community@1a2b1b9)) * auto-release process may fail if optional back-merging task fails ([parse-community#8051](parse-community#8051)) ([cf925e7](parse-community@cf925e7)) * brute force guessing of user sensitive data via search patterns (GHSA-2m6g-crv8-p3c6) ([parse-community#8145](parse-community#8145)) [skip release] ([f0db4ca](parse-community@f0db4ca)) * certificate in Apple Game Center auth adapter not validated [skip release] ([parse-community#8055](parse-community#8055)) ([4c2aa63](parse-community@4c2aa63)) * custom database options are not passed to MongoDB GridFS ([parse-community#7911](parse-community#7911)) ([b1e5565](parse-community@b1e5565)) * depreciate allowClientClassCreation defaulting to true ([parse-community#7925](parse-community#7925)) ([38ed96a](parse-community@38ed96a)) * errors in GraphQL do not show the original error but a general `Unexpected Error` ([parse-community#8045](parse-community#8045)) ([0d81887](parse-community@0d81887)) * interrupted WebSocket connection not closed by LiveQuery server ([parse-community#8012](parse-community#8012)) ([2d5221e](parse-community@2d5221e)) * invalid file request not properly handled [skip release] ([parse-community#8061](parse-community#8061)) ([1a04a34](parse-community@1a04a34)) * live query role cache does not clear when a user is added to a role ([parse-community#8026](parse-community#8026)) ([199dfc1](parse-community@199dfc1)) * peer dependency mismatch for GraphQL dependencies ([parse-community#7934](parse-community#7934)) ([0a6faa8](parse-community@0a6faa8)) * protected fields exposed via LiveQuery (GHSA-crrq-vr9j-fxxh) [skip release] ([parse-community#8075](parse-community#8075)) ([636d16e](parse-community@636d16e)) * return correct response when revert is used in beforeSave ([parse-community#7839](parse-community#7839)) ([19900fc](parse-community@19900fc)) * security upgrade @parse/fs-files-adapter from 1.2.1 to 1.2.2 ([parse-community#7948](parse-community#7948)) ([3a70fda](parse-community@3a70fda)) * security upgrade moment from 2.29.1 to 2.29.2 ([parse-community#7931](parse-community#7931)) ([731c550](parse-community@731c550)) * security upgrade parse push adapter from 4.1.0 to 4.1.2 ([parse-community#7893](parse-community#7893)) ([93667b4](parse-community@93667b4)) * server crashes when receiving file download request with invalid byte range; this fixes a security vulnerability that allows an attacker to impact the availability of the server instance; the fix improves parsing of the range parameter to properly handle invalid range requests ([GHSA-h423-w6qv-2wj3](GHSA-h423-w6qv-2wj3)) [skip release] ([parse-community#8237](parse-community#8237)) ([4c1befa](parse-community@4c1befa)) * session object properties can be updated by foreign user; this fixes a security vulnerability in which a foreign user can write to the session object of another user if the session object ID is known; the fix prevents writing to foreign session objects ([GHSA-6w4q-23cf-j9jp](GHSA-6w4q-23cf-j9jp)) [skip release] ([parse-community#8181](parse-community#8181)) ([83cdc89](parse-community@83cdc89)) * websocket connection of LiveQuery interrupts frequently ([parse-community#8048](parse-community#8048)) ([03caae1](parse-community@03caae1)) ### Features * add MongoDB 5.1 compatibility ([parse-community#7682](parse-community#7682)) ([022a856](parse-community@022a856)) * add MongoDB 5.2 support ([parse-community#7894](parse-community#7894)) ([5bfa716](parse-community@5bfa716)) * add support for Node 17 and 18 ([parse-community#7896](parse-community#7896)) ([3e9f292](parse-community@3e9f292)) * align file trigger syntax with class trigger; use the new syntax `Parse.Cloud.beforeSave(Parse.File, (request) => {})`, the old syntax `Parse.Cloud.beforeSaveFile((request) => {})` has been deprecated ([parse-community#7966](parse-community#7966)) ([c6dcad8](parse-community@c6dcad8)) * replace GraphQL Apollo with GraphQL Yoga ([parse-community#7967](parse-community#7967)) ([1aa2204](parse-community@1aa2204)) * selectively enable / disable default authentication adapters ([parse-community#7953](parse-community#7953)) ([c1e808f](parse-community@c1e808f)) * upgrade mongodb from 4.4.1 to 4.5.0 ([parse-community#7991](parse-community#7991)) ([e692b5d](parse-community@e692b5d)) ### Performance Improvements * reduce database operations when using the constant parameter in Cloud Function validation ([parse-community#7892](parse-community#7892)) ([041197f](parse-community@041197f))
- Loading branch information
1 parent
2549540
commit 12e174b