P
8.6.121
8.6.121 (2026-11-04) Bug Fixes Object update with a dot notation key can terminate the server process when the class has a beforeSave trigger (GHSA-2rxj-6v32-2v6j) (#10865) (7b02d0e)
P
9.11.1-alpha.1
9.11.1-alpha.1 (2026-11-04) Bug Fixes Object update with a dot notation key can terminate the server process when the class has a beforeSave trigger (GHSA-2rxj-6v32-2v6j) (#10864) (c06821e)
P
9.11.0
9.11.0 (2026-11-03) Bug Fixes Dot notation operation on a missing field reveals whether the field is stored to a caller without read access (GHSA-4m87-fqwv-2m8v) (#10842) (d88efed) Installation update rejects a changed device type or installation ID before checking the caller's write permission (#10847) (3373ee2) LiveQuery subscriptions can receive installations and objects of other internal class…
P
9.11.0-alpha.2
9.11.0-alpha.2 (2026-11-03) Bug Fixes Schema migration deletes internal indexes created on server start (#10861) (d067fca)
P
8.6.120
8.6.120 (2026-11-03) Bug Fixes Security upgrade Docker image from Node.js 20 to 22 (#10852) (546307c)
P
9.11.0-alpha.1
9.11.0-alpha.1 (2026-11-03) Features Add support for Node.js 26 (#10860) (53f85c4)
P
9.10.8-alpha.4
9.10.8-alpha.4 (2026-11-02) Bug Fixes Security upgrade Docker image from Node.js 20 to 24 (#10851) (3bc3ba5)
P
8.6.119
8.6.119 (2026-10-30) Bug Fixes LiveQuery subscriptions can receive installations and objects of other internal classes without the master key (GHSA-q2gf-q36j-h978) (#10849) (81e88ea)
P
9.10.8-alpha.3
9.10.8-alpha.3 (2026-10-30) Bug Fixes LiveQuery subscriptions can receive installations and objects of other internal classes without the master key (GHSA-q2gf-q36j-h978) (#10848) (3a1595b)
P
9.10.8-alpha.2
9.10.8-alpha.2 (2026-10-30) Bug Fixes Installation update rejects a changed device type or installation ID before checking the caller's write permission (#10847) (3373ee2)
P
8.6.118
8.6.118 (2026-10-29) Bug Fixes Dot notation operation on a missing field reveals whether the field is stored to a caller without read access (GHSA-4m87-fqwv-2m8v) (#10843) (3515f98)
P
9.10.8-alpha.1
9.10.8-alpha.1 (2026-10-29) Bug Fixes Dot notation operation on a missing field reveals whether the field is stored to a caller without read access (GHSA-4m87-fqwv-2m8v) (#10842) (d88efed)
P
9.10.7
9.10.7 (2026-10-24) Bug Fixes Pre-authentication denial of service via email address format regex backtracking (GHSA-9492-427f-466x) (#10821) (fbd370a) Save response read access check logs errors twice or as warnings (#10831) (fc6e60b) Save response reveals whether a field is stored to a caller without read access (GHSA-ch64-8phh-m7hc) (#10829) (ae08ab6) Performance Improvements Remove additional…
P
8.6.117
8.6.117 (2026-10-24) Performance Improvements Remove additional database read when saving an object (#10834) (dfb0ff4)
P
9.10.7-alpha.4
9.10.7-alpha.4 (2026-10-24) Performance Improvements Remove additional database read when saving an object (#10833) (bec1c70)
P
9.10.7-alpha.3
9.10.7-alpha.3 (2026-10-23) Bug Fixes Save response read access check logs errors twice or as warnings (#10831) (fc6e60b)
P
8.6.116
8.6.116 (2026-10-23) Bug Fixes Save response reveals whether a field is stored to a caller without read access (GHSA-ch64-8phh-m7hc) (#10830) (cefeb78)
P
9.10.7-alpha.2
9.10.7-alpha.2 (2026-10-23) Bug Fixes Save response reveals whether a field is stored to a caller without read access (GHSA-ch64-8phh-m7hc) (#10829) (ae08ab6)
P
9.10.7-alpha.1
9.10.7-alpha.1 (2026-10-22) Bug Fixes Pre-authentication denial of service via email address format regex backtracking (GHSA-9492-427f-466x) (#10821) (fbd370a)
P
8.6.115
8.6.115 (2026-10-22) Bug Fixes Pre-authentication denial of service via email address format regex backtracking (GHSA-9492-427f-466x) (#10822) (4a5941d)
P
9.10.6
9.10.6 (2026-10-22) Bug Fixes Object create returns field values to a caller without read access (GHSA-qq3r-ppqq-rh6m) (#10813) (d95b14d) Object update returns stored field values to a caller without read access (GHSA-2rcp-jc67-vq74) (#10798) (4f110a9) Object update with a dot notation key below a pointer field can terminate the server process (GHSA-wc3c-6843-q7mv) (#10802) (946b670) Object write…
P
9.10.6-alpha.6
9.10.6-alpha.6 (2026-10-21) Bug Fixes Object create returns field values to a caller without read access (GHSA-qq3r-ppqq-rh6m) (#10813) (d95b14d)
P
8.6.114
8.6.114 (2026-10-21) Bug Fixes Object create returns field values to a caller without read access (GHSA-qq3r-ppqq-rh6m) (#10814) (45e3d76)
P
8.6.113
8.6.113 (2026-10-20) Bug Fixes Object write with a crafted dot notation key can pollute a shared prototype when the class has a trigger or LiveQuery (GHSA-95hp-82c6-25q5) (#10811) (3963bd5)
P
9.10.6-alpha.5
9.10.6-alpha.5 (2026-10-20) Bug Fixes Object write with a crafted dot notation key can pollute a shared prototype when the class has a trigger or LiveQuery (GHSA-95hp-82c6-25q5) (#10810) (9e3da78)
P
8.6.112
8.6.112 (2026-10-20) Bug Fixes Session upgrade endpoint creates an additional session from an already revocable session token (GHSA-2j2x-c587-q33g) (#10809) (f687eaa)
P
9.10.6-alpha.4
9.10.6-alpha.4 (2026-10-20) Bug Fixes Session upgrade endpoint creates an additional session from an already revocable session token (GHSA-2j2x-c587-q33g) (#10808) (5bcb56b)
P
8.6.111
8.6.111 (2026-10-19) Bug Fixes Object write with a null dot notation key can corrupt a field or make reads fail on MongoDB (GHSA-655c-2xf3-77x9) (#10805) (dbef6a8)
P
9.10.6-alpha.3
9.10.6-alpha.3 (2026-10-19) Bug Fixes Object write with a null dot notation key can corrupt a field or make reads fail on MongoDB (GHSA-655c-2xf3-77x9) (#10804) (b405b63)
P
8.6.110
8.6.110 (2026-10-19) Bug Fixes Object update with a dot notation key below a pointer field can terminate the server process (GHSA-wc3c-6843-q7mv) (#10803) (9318856)