build: Release (#10452)

Author: mtrezza

DEPRECATIONS.md

@@ -27,6 +27,7 @@ The following is a list of deprecations, according to the [Deprecation Policy](h
 | DEPPS21 | Config option `protectedFieldsOwnerExempt` defaults to `false`                               |                                                                        | 9.6.0 (2026)                    | 10.0.0 (2027)                   | deprecated            | -     |
 | DEPPS22 | Config option `protectedFieldsTriggerExempt` defaults to `true`                              |                                                                        | 9.6.0 (2026)                    | 10.0.0 (2027)                   | deprecated            | -     |
 | DEPPS23 | Config option `protectedFieldsSaveResponseExempt` defaults to `false`                               |                                                                        | 9.7.0 (2026)                    | 10.0.0 (2027)                   | deprecated            | -     |
+| DEPPS24 | Config option `installation.duplicateDeviceTokenActionEnforceAuth` defaults to `true`         | [#10451](https://github.com/parse-community/parse-server/pull/10451)   | 9.9.0 (2026)                    | 10.0.0 (2027)                   | deprecated            | -     |
 
 [i_deprecation]: ## "The version and date of the deprecation."
 [i_change]: ## "The version and date of the planned change."

README.md

@@ -72,6 +72,7 @@ A big _thank you_ 🙏 to our [sponsors](#sponsors) and [backers](#backers) who
   - [Configuring File Adapters](#configuring-file-adapters)
     - [Restricting File URL Domains](#restricting-file-url-domains)
   - [Idempotency Enforcement](#idempotency-enforcement)
+  - [Installations](#installations)
   - [Localization](#localization)
     - [Pages](#pages)
       - [Localization with Directory Structure](#localization-with-directory-structure)
@@ -658,6 +659,49 @@ Assuming the script above is named, `parse_idempotency_delete_expired_records.sh
 2 * * * * /root/parse_idempotency_delete_expired_records.sh >/dev/null 2>&1
 ```
 
+## Installations
+
+Parse Server deduplicates `_Installation` records when a new install collides with an existing row's `deviceToken`. The `installation` option block configures the dedup behavior.
+
+### Options
+
+| Parameter | Optional | Type | Default | Environment Variable |
+|---|---|---|---|---|
+| `installation.duplicateDeviceTokenActionEnforceAuth` | yes | `Boolean` | `false` | `PARSE_SERVER_INSTALLATION_DUPLICATE_DEVICE_TOKEN_ACTION_ENFORCE_AUTH` |
+| `installation.duplicateDeviceTokenAction` | yes | `String` | `'delete'` | `PARSE_SERVER_INSTALLATION_DUPLICATE_DEVICE_TOKEN_ACTION` |
+| `installation.duplicateDeviceTokenMergePriority` | yes | `String` | `'deviceToken'` | `PARSE_SERVER_INSTALLATION_DUPLICATE_DEVICE_TOKEN_MERGE_PRIORITY` |
+
+#### `duplicateDeviceTokenActionEnforceAuth`
+
+When `true`, the dedup operation runs with the caller's auth context so ACL and CLP are honored. When `false`, the dedup runs as master and bypasses both. Master and maintenance keys always bypass regardless of this flag.
+
+#### `duplicateDeviceTokenAction`
+
+What Parse Server does to the conflicting `_Installation` row(s) when a new install's `deviceToken` collides with an existing row.
+
+- `'delete'`: destroys the conflicting row.
+- `'update'`: clears the now-conflicting ID field on the conflicting row, preserving custom fields, channels, and history.
+
+#### `duplicateDeviceTokenMergePriority`
+
+When an existing row holds the new `deviceToken` but has no `installationId` of its own, Parse Server merges the two rows. This option controls which side wins.
+
+- `'deviceToken'`: the deviceToken-only row survives; the request's installationId-matched row is the loser.
+- `'installationId'`: the request's installationId-matched row survives; the deviceToken-only orphan is the loser.
+
+### Configuration example
+
+```javascript
+const parseServer = new ParseServer({
+  ...otherOptions,
+  installation: {
+    duplicateDeviceTokenActionEnforceAuth: true,
+    duplicateDeviceTokenAction: 'update',
+    duplicateDeviceTokenMergePriority: 'installationId',
+  },
+});
+```
+
 ## Localization
 
 ### Pages

changelogs/CHANGELOG_alpha.md

@@ -1,3 +1,31 @@
+# [9.9.0-alpha.3](https://github.com/parse-community/parse-server/compare/9.9.0-alpha.2...9.9.0-alpha.3) (2026-04-30)
+
+
+### Features
+
+* Add installation deviceToken deduplication options ([#10451](https://github.com/parse-community/parse-server/issues/10451)) ([9fee1a0](https://github.com/parse-community/parse-server/commit/9fee1a07080ab8bda2a3d4798881bcc288e5b37a))
+
+# [9.9.0-alpha.2](https://github.com/parse-community/parse-server/compare/9.9.0-alpha.1...9.9.0-alpha.2) (2026-04-26)
+
+
+### Bug Fixes
+
+* MFA SMS one-time password accepted twice under concurrent login ([GHSA-jpq4-7fmq-q5fj](https://github.com/parse-community/parse-server/security/advisories/GHSA-jpq4-7fmq-q5fj)) ([#10448](https://github.com/parse-community/parse-server/issues/10448)) ([725be0d](https://github.com/parse-community/parse-server/commit/725be0d602baa619492606e7b3f6829082d93a4c))
+
+# [9.9.0-alpha.1](https://github.com/parse-community/parse-server/compare/9.8.1-alpha.1...9.9.0-alpha.1) (2026-04-17)
+
+
+### Features
+
+* Add `rawValues` and `rawFieldNames` options for aggregation queries ([#10438](https://github.com/parse-community/parse-server/issues/10438)) ([f26700e](https://github.com/parse-community/parse-server/commit/f26700e39d1980940467bee0d26ca3deb88e3924))
+
+## [9.8.1-alpha.1](https://github.com/parse-community/parse-server/compare/9.8.0...9.8.1-alpha.1) (2026-04-12)
+
+
+### Bug Fixes
+
+* Context mutations leak across requests in `ParseServerRESTController` ([#10291](https://github.com/parse-community/parse-server/issues/10291)) ([60a58ec](https://github.com/parse-community/parse-server/commit/60a58ec11a8bb67aaf217b1e7362b89d742b66da))
+
 # [9.8.0-alpha.13](https://github.com/parse-community/parse-server/compare/9.8.0-alpha.12...9.8.0-alpha.13) (2026-04-12)