Merge branch 'alpha' into invocation-verify-user-emails

Author: mtrezza

.github/workflows/ci-performance.yml

@@ -1,6 +1,6 @@
 name: ci-performance
 on:
-  pull_request_target:
+  pull_request:
     branches:
       - alpha
       - beta
@@ -17,8 +17,6 @@ env:
 
 permissions:
   contents: read
-  pull-requests: write
-  issues: write
 
 jobs:
   performance-check:
@@ -172,23 +170,6 @@ jobs:
           echo "baseline.json size: $(wc -c < baseline.json) bytes"
           echo "pr.json size: $(wc -c < pr.json) bytes"
 
-      - name: Store benchmark result (PR)
-        uses: benchmark-action/github-action-benchmark@v1
-        if: github.event_name == 'pull_request' && hashFiles('pr.json') != ''
-        continue-on-error: true
-        with:
-          name: Parse Server Performance
-          tool: 'customSmallerIsBetter'
-          output-file-path: pr.json
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          auto-push: false
-          save-data-file: false
-          alert-threshold: '110%'
-          comment-on-alert: true
-          fail-on-alert: false
-          alert-comment-cc-users: '@parse-community/maintainers'
-          summary-always: true
-
       - name: Compare benchmark results
         id: compare
         run: |
@@ -278,43 +259,6 @@ jobs:
           path: comparison.md
           retention-days: 30
 
-      - name: Prepare comment body
-        if: github.event_name == 'pull_request'
-        run: |
-          echo "## Performance Impact Report" > comment.md
-          echo "" >> comment.md
-          if [ -f comparison.md ]; then
-            cat comparison.md >> comment.md
-          else
-            echo "⚠️ Could not generate performance comparison." >> comment.md
-          fi
-          echo "" >> comment.md
-          echo "<details>" >> comment.md
-          echo "<summary>📊 View detailed results</summary>" >> comment.md
-          echo "" >> comment.md
-          echo "### Baseline Results" >> comment.md
-          echo "\`\`\`json" >> comment.md
-          cat baseline.json >> comment.md
-          echo "\`\`\`" >> comment.md
-          echo "" >> comment.md
-          echo "### PR Results" >> comment.md
-          echo "\`\`\`json" >> comment.md
-          cat pr.json >> comment.md
-          echo "\`\`\`" >> comment.md
-          echo "" >> comment.md
-          echo "</details>" >> comment.md
-          echo "" >> comment.md
-          echo "> **Note:** Thresholds: ⚠️ >25%, ❌ >50%." >> comment.md
-
-      - name: Comment PR with results
-        if: github.event_name == 'pull_request'
-        uses: thollander/actions-comment-pull-request@v2
-        continue-on-error: true
-        with:
-          filePath: comment.md
-          comment_tag: performance-benchmark
-          mode: recreate
-
       - name: Generate job summary
         if: always()
         run: |

.github/workflows/ci.yml

@@ -153,10 +153,6 @@ jobs:
     strategy:
       matrix:
         include:
-          - name: MongoDB 6, ReplicaSet
-            MONGODB_VERSION: 6.0.19
-            MONGODB_TOPOLOGY: replset
-            NODE_VERSION: 24.11.0
           - name: MongoDB 7, ReplicaSet
             MONGODB_VERSION: 7.0.16
             MONGODB_TOPOLOGY: replset
@@ -173,11 +169,7 @@ jobs:
           - name: Node 20
             MONGODB_VERSION: 8.0.4
             MONGODB_TOPOLOGY: standalone
-            NODE_VERSION: 20.18.0
-          - name: Node 18
-            MONGODB_VERSION: 8.0.4
-            MONGODB_TOPOLOGY: standalone
-            NODE_VERSION: 18.20.4
+            NODE_VERSION: 20.19.0
           - name: Node 22
             MONGODB_VERSION: 8.0.4
             MONGODB_TOPOLOGY: standalone
@@ -227,15 +219,6 @@ jobs:
     strategy:
       matrix:
         include:
-          - name: PostgreSQL 15, PostGIS 3.3
-            POSTGRES_IMAGE: postgis/postgis:15-3.3
-            NODE_VERSION: 24.11.0
-          - name: PostgreSQL 15, PostGIS 3.4
-            POSTGRES_IMAGE: postgis/postgis:15-3.4
-            NODE_VERSION: 24.11.0
-          - name: PostgreSQL 15, PostGIS 3.5
-            POSTGRES_IMAGE: postgis/postgis:15-3.5
-            NODE_VERSION: 24.11.0
           - name: PostgreSQL 16, PostGIS 3.5
             POSTGRES_IMAGE: postgis/postgis:16-3.5
             NODE_VERSION: 24.11.0

.releaserc.js

@@ -34,7 +34,8 @@ async function config() {
   console.log(`Running on branch: ${branch}`);
 
   // Set changelog file
-  const changelogFile = `./changelogs/CHANGELOG_${branch}.md`;
+  const changelogFileSuffix = branch.match(/release-\d+\.x\.x/) ? 'release' : branch;
+  const changelogFile = `./changelogs/CHANGELOG_${changelogFileSuffix}.md`;
   // eslint-disable-next-line no-console
   console.log(`Changelog file output to: ${changelogFile}`);
 
@@ -46,9 +47,8 @@ async function config() {
       'release',
       { name: 'alpha', prerelease: true },
       // { name: 'beta', prerelease: true },
-      'next-major',
       // Long-Term-Support branch
-      'release-8.x.x',
+      { name: 'release-9.x.x', range: '9.x.x', channel: '9.x.x' },
     ],
     dryRun: false,
     debug: true,

9.0.0.md

@@ -0,0 +1,56 @@
+# Parse Server 9 Migration Guide <!-- omit in toc -->
+
+This document only highlights specific changes that require a longer explanation. For a full list of changes in Parse Server 9 please refer to the [changelog](https://github.com/parse-community/parse-server/blob/alpha/CHANGELOG.md).
+
+---
+- [Route Path Syntax and Rate Limiting](#route-path-syntax-and-rate-limiting)
+---
+
+## Route Path Syntax and Rate Limiting
+Parse Server 9 standardizes the route pattern syntax across cloud routes and rate-limiting to use the new **path-to-regexp v8** style. This update introduces validation and a clear deprecation error for the old wildcard route syntax.
+
+### Key Changes
+- **Standardization**: All route paths now use the path-to-regexp v8 syntax, which provides better consistency and security.
+- **Validation**: Added validation to ensure route paths conform to the new syntax.
+- **Deprecation**: Old wildcard route syntax is deprecated and will trigger a clear error message.
+
+### Migration Steps
+
+#### Path Syntax Examples
+
+Update your rate limit configurations to use the new path-to-regexp v8 syntax:
+
+| Old Syntax (deprecated) | New Syntax (v8) |
+|------------------------|-----------------|
+| `/functions/*` | `/functions/*path` |
+| `/classes/*` | `/classes/*path` |
+| `/*` | `/*path` |
+| `*` | `*path` |
+
+**Before:**
+```javascript
+rateLimit: {
+  requestPath: '/functions/*',
+  requestTimeWindow: 10000,
+  requestCount: 100
+}
+```
+
+**After:**
+```javascript
+rateLimit: {
+  requestPath: '/functions/*path',
+  requestTimeWindow: 10000,
+  requestCount: 100
+}
+```
+
+- Review your custom cloud routes and ensure they use the new path-to-regexp v8 syntax.
+- Update any rate-limiting configurations to use the new route path format.
+- Test your application to ensure all routes work as expected with the new syntax.
+
+> [!Note]
+> Consult the [path-to-regexp v8 docs](https://github.com/pillarjs/path-to-regexp) and the [Express 5 migration guide](https://expressjs.com/en/guide/migrating-5.html#path-syntax) for more details on the new path syntax.
+
+### Related Pull Request
+- [#9942](https://github.com/parse-community/parse-server/pull/9942)

DEPRECATIONS.md

@@ -1,22 +1,23 @@
 # Deprecation Plan <!-- omit in toc -->
 
-The following is a list of deprecations, according to the [Deprecation Policy](https://github.com/parse-community/parse-server/blob/master/CONTRIBUTING.md#deprecation-policy). After a feature becomes deprecated, and giving developers time to adapt to the change, the deprecated feature will eventually be removed, leading to a breaking change. Developer feedback during the deprecation period may postpone or even revoke the introduction of the breaking change.
+The following is a list of deprecations, according to the [Deprecation Policy](https://github.com/parse-community/parse-server/blob/master/CONTRIBUTING.md#deprecation-policy). After a feature becomes deprecated, and giving developers time to adapt to the change, the deprecated feature will eventually be changed, leading to a breaking change. Developer feedback during the deprecation period may postpone or even revoke the introduction of the breaking change.
 
-| ID      | Change                                                                                       | Issue                                                                | Deprecation [ℹ️][i_deprecation] | Planned Removal [ℹ️][i_removal] | Status [ℹ️][i_status] | Notes |
+| ID      | Change                                                                                       | Issue                                                                | Deprecation [ℹ️][i_deprecation] | Planned Change [ℹ️][i_change] | Status [ℹ️][i_status] | Notes |
 |---------|----------------------------------------------------------------------------------------------|----------------------------------------------------------------------|---------------------------------|---------------------------------|-----------------------|-------|
-| DEPPS1  | Native MongoDB syntax in aggregation pipeline                                                | [#7338](https://github.com/parse-community/parse-server/issues/7338) | 5.0.0 (2022)                    | 6.0.0 (2023)                    | removed               | -     |
-| DEPPS2  | Config option `directAccess` defaults to `true`                                              | [#6636](https://github.com/parse-community/parse-server/pull/6636)   | 5.0.0 (2022)                    | 6.0.0 (2023)                    | removed               | -     |
-| DEPPS3  | Config option `enforcePrivateUsers` defaults to `true`                                       | [#7319](https://github.com/parse-community/parse-server/pull/7319)   | 5.0.0 (2022)                    | 6.0.0 (2023)                    | removed               | -     |
-| DEPPS4  | Remove convenience method for http request `Parse.Cloud.httpRequest`                         | [#7589](https://github.com/parse-community/parse-server/pull/7589)   | 5.0.0 (2022)                    | 6.0.0 (2023)                    | removed               | -     |
-| DEPPS5  | Config option `allowClientClassCreation` defaults to `false`                                 | [#7925](https://github.com/parse-community/parse-server/pull/7925)   | 5.3.0 (2022)                    | 7.0.0 (2024)                    | removed               | -     |
-| DEPPS6  | Auth providers disabled by default                                                           | [#7953](https://github.com/parse-community/parse-server/pull/7953)   | 5.3.0 (2022)                    | 7.0.0 (2024)                    | removed               | -     |
-| DEPPS7  | Remove file trigger syntax `Parse.Cloud.beforeSaveFile((request) => {})`                     | [#7966](https://github.com/parse-community/parse-server/pull/7966)   | 5.3.0 (2022)                    | 7.0.0 (2024)                    | removed               | -     |
-| DEPPS8  | Login with expired 3rd party authentication token defaults to `false`                        | [#7079](https://github.com/parse-community/parse-server/pull/7079)   | 5.3.0 (2022)                    | 7.0.0 (2024)                    | removed               | -     |
-| DEPPS9  | Rename LiveQuery `fields` option to `keys`                                                   | [#8389](https://github.com/parse-community/parse-server/issues/8389) | 6.0.0 (2023)                    | 7.0.0 (2024)                    | removed               | -     |
-| DEPPS10 | Encode `Parse.Object` in Cloud Function and remove option `encodeParseObjectInCloudFunction` | [#8634](https://github.com/parse-community/parse-server/issues/8634) | 6.2.0 (2023)                    | 9.0.0 (2026)                    | deprecated            | -     |
-| DEPPS11 | Replace `PublicAPIRouter` with `PagesRouter`                                                 | [#7625](https://github.com/parse-community/parse-server/issues/7625) | 8.0.0 (2025)                    | 9.0.0 (2026)                    | deprecated            | -     |
-| DEPPS12 | Database option `allowPublicExplain` will default to `true`                                  | [#7519](https://github.com/parse-community/parse-server/issues/7519) | 8.5.0 (2025)                    | 9.0.0 (2026)                    | deprecated            | -     |
+| DEPPS1  | Native MongoDB syntax in aggregation pipeline                                                | [#7338](https://github.com/parse-community/parse-server/issues/7338) | 5.0.0 (2022)                    | 6.0.0 (2023)                    | changed               | -     |
+| DEPPS2  | Config option `directAccess` defaults to `true`                                              | [#6636](https://github.com/parse-community/parse-server/pull/6636)   | 5.0.0 (2022)                    | 6.0.0 (2023)                    | changed               | -     |
+| DEPPS3  | Config option `enforcePrivateUsers` defaults to `true`                                       | [#7319](https://github.com/parse-community/parse-server/pull/7319)   | 5.0.0 (2022)                    | 6.0.0 (2023)                    | changed               | -     |
+| DEPPS4  | Remove convenience method for http request `Parse.Cloud.httpRequest`                         | [#7589](https://github.com/parse-community/parse-server/pull/7589)   | 5.0.0 (2022)                    | 6.0.0 (2023)                    | changed               | -     |
+| DEPPS5  | Config option `allowClientClassCreation` defaults to `false`                                 | [#7925](https://github.com/parse-community/parse-server/pull/7925)   | 5.3.0 (2022)                    | 7.0.0 (2024)                    | changed               | -     |
+| DEPPS6  | Auth providers disabled by default                                                           | [#7953](https://github.com/parse-community/parse-server/pull/7953)   | 5.3.0 (2022)                    | 7.0.0 (2024)                    | changed               | -     |
+| DEPPS7  | Remove file trigger syntax `Parse.Cloud.beforeSaveFile((request) => {})`                     | [#7966](https://github.com/parse-community/parse-server/pull/7966)   | 5.3.0 (2022)                    | 7.0.0 (2024)                    | changed               | -     |
+| DEPPS8  | Login with expired 3rd party authentication token defaults to `false`                        | [#7079](https://github.com/parse-community/parse-server/pull/7079)   | 5.3.0 (2022)                    | 7.0.0 (2024)                    | changed               | -     |
+| DEPPS9  | Rename LiveQuery `fields` option to `keys`                                                   | [#8389](https://github.com/parse-community/parse-server/issues/8389) | 6.0.0 (2023)                    | 7.0.0 (2024)                    | changed               | -     |
+| DEPPS10 | Encode `Parse.Object` in Cloud Function and remove option `encodeParseObjectInCloudFunction` | [#8634](https://github.com/parse-community/parse-server/issues/8634) | 6.2.0 (2023)                    | 9.0.0 (2026)                    | changed               | -     |
+| DEPPS11 | Replace `PublicAPIRouter` with `PagesRouter`                                                 | [#7625](https://github.com/parse-community/parse-server/issues/7625) | 8.0.0 (2025)                    | 9.0.0 (2026)                    | changed               | -     |
+| DEPPS12 | Database option `allowPublicExplain` defaults to `false`                                     | [#7519](https://github.com/parse-community/parse-server/issues/7519) | 8.5.0 (2025)                    | 9.0.0 (2026)                    | changed               | -     |
+| DEPPS13 | Config option `enableInsecureAuthAdapters` defaults to `false`                               | [#9667](https://github.com/parse-community/parse-server/pull/9667)   | 8.0.0 (2025)                    | 9.0.0 (2026)                    | changed               | -     |
 
 [i_deprecation]: ## "The version and date of the deprecation."
-[i_removal]: ## "The version and date of the planned removal."
-[i_status]: ## "The current status of the deprecation: deprecated (the feature is deprecated and still available), removed (the deprecated feature has been removed and is unavailable), retracted (the deprecation has been retracted and the feature will not be removed."
+[i_change]: ## "The version and date of the planned change."
+[i_status]: ## "The current status of the deprecation: deprecated (the feature is deprecated but still available), changed (the deprecated feature has been changed), retracted (the deprecation has been retracted and the feature will not be changed."

Dockerfile

@@ -40,7 +40,7 @@ COPY --from=build /tmp/lib lib
 
 COPY package*.json ./
 COPY bin bin
-COPY public_html public_html
+COPY public public
 COPY views views
 RUN mkdir -p logs && chown -R node: logs