parse-server · Issues· 561 open

requestContextMiddleware DI missing on nested directAccess ops

Saving a _Role clears the entire cache, issuing FLUSHDB on the Redis cache adapter

RestWrite.js auth and validation branches survive boolean negation under mutation testing

Allow to run queries through LiveQueryClient

masterKeyIps never validates the CIDR mask

allowCustomObjectId accepts an operation as objectId and creates an unreachable user

Malformed ACL on signup answers 500, or a 400 that still persists the user

Relation query with a null operand throws an uncaught TypeError (500)

Verification and password reset emails are dispatched without a rejection handler, producing unhandled rejections

RedisCacheAdapter put, del and clear reject on a Redis outage, producing unhandled rejections

Documentation for directAccess states the default is false, but it has defaulted to true since Parse Server 6

Per-entry cache TTL is silently ignored by the in-memory cache adapter

LiveQuery role cache is not invalidated for all users affected by a role write or delete

/installations and /audiences reject a find sent as POST + _method=GET with "Invalid key name: 0"

Rate limit Redis keys are not scoped to the configured route