mtrezza · Nov 4, 2026 · Jul 13, 2026 · Jul 13, 2026 · Jul 13, 2026 · Jul 13, 2026
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
@@ -12,3 +12,16 @@ updates:
     commit-message:
       # Set commit message prefix
       prefix: "refactor"
+  - package-ecosystem: "docker"
+    # Location of Dockerfile
+    directory: "/"
+    # Check daily for updates
+    schedule:
+      interval: "daily"
+    ignore:
+      # Update the Node.js major version only with a Parse Dashboard major release
+      - dependency-name: "node"
+        update-types: ["version-update:semver-major"]
+    commit-message:
+      # Set commit message prefix; fix triggers a release that publishes the updated image
+      prefix: "fix"
diff --git a/.github/workflows/ci-automated-check-environment.yml b/.github/workflows/ci-automated-check-environment.yml
@@ -17,7 +17,7 @@ jobs:
       - name: Setup Node
         uses: actions/setup-node@v4
         with:
-          node-version: 20
+          node-version: 22
           cache: npm
       - name: Install dependencies
         run: npm ci

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -60,24 +60,18 @@ jobs:
         include:
           - name: Docker linux/amd64
             DOCKER_PLATFORM: linux/amd64
+            CACHE_SCOPE: docker-amd64
+            RUNNER_TYPE: ubuntu-latest
+          - name: Docker linux/arm64/v8
+            DOCKER_PLATFORM: linux/arm64/v8
+            CACHE_SCOPE: docker-arm64
             RUNNER_TYPE: ubuntu-latest
-          # - name: Docker linux/arm64/v8
-          #   DOCKER_PLATFORM: linux/arm64/v8
-          #   # Replace this with a native arm linux runner when available, presumably by EOY 2024, see:
-          #   # https://github.com/orgs/community/discussions/19197#discussioncomment-10550689
-          #   # The conditional setup of QEMU may need to be adapted to not run on native arm,
-          #   # which will speed up the build process for arm64/v8 since no emulation will be needed.
-          #   RUNNER_TYPE: ubuntu-latest
       fail-fast: false
     name: ${{ matrix.name }}
     timeout-minutes: 45
     runs-on: ${{ matrix.RUNNER_TYPE }}
     steps:
       - uses: actions/checkout@v4
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v2
-        # Only set up QEMU if not running on native arm
-        if: ${{ matrix.DOCKER_PLATFORM != 'linux/amd64' && matrix.RUNNER_TYPE == 'ubuntu-latest' }}
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v2
         with:
@@ -86,8 +80,8 @@ jobs:
         uses: docker/build-push-action@v3
         with:
           platforms: ${{ matrix.DOCKER_PLATFORM }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+          cache-from: type=gha,scope=${{ matrix.CACHE_SCOPE }}
+          cache-to: type=gha,mode=max,scope=${{ matrix.CACHE_SCOPE }}
   check-lock-file-version:
     name: NPM Lock File Version
     timeout-minutes: 5
@@ -105,12 +99,12 @@ jobs:
     strategy:
       matrix:
         include:
-          - name: Node 20
-            NODE_VERSION: 20.19.0
           - name: Node 22
-            NODE_VERSION: 22.12.0
+            NODE_VERSION: 22.13.0
           - name: Node 24
             NODE_VERSION: 24.1.0
+          - name: Node 26
+            NODE_VERSION: 26.13.0
       fail-fast: false
     name: ${{ matrix.name }}
     timeout-minutes: 15

diff --git a/.github/workflows/release-automated.yml b/.github/workflows/release-automated.yml
@@ -45,9 +45,6 @@ jobs:
         uses: actions/checkout@v2
         with:
           ref: ${{ needs.release.outputs.current_tag }}
-      - name: Set up QEMU
-        id: qemu
-        uses: docker/setup-qemu-action@v2
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v2
         with:

diff --git a/.github/workflows/release-manual-docker.yml b/.github/workflows/release-manual-docker.yml
@@ -27,9 +27,6 @@ jobs:
         uses: actions/checkout@v2
         with:
           ref: ${{ github.event.inputs.ref }}
-      - name: Set up QEMU
-        id: qemu
-        uses: docker/setup-qemu-action@v2
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v2
         with:

diff --git a/.gitignore b/.gitignore
@@ -21,3 +21,6 @@ test_logs
 # AI tools
 .claude
 .superpowers
+
+# Docs
+/docs/
diff --git a/Dockerfile b/Dockerfile
@@ -1,33 +1,51 @@
 ############################################################
 # Build stage
 ############################################################
-FROM node:20.19.0-alpine3.20 AS build
+# Runs on the platform of the build machine, also when building the image for
+# another platform, so that no code runs under emulation; Node.js running under
+# QEMU emulation can crash with an illegal instruction. Builders that don't set
+# BUILDPLATFORM, like the legacy Docker builder, run it on their own platform.
+FROM --platform=${BUILDPLATFORM:-linux} node:24.22.2-alpine AS build
 
 RUN apk --no-cache add git
 WORKDIR /src
 
 # Copy package.json first to benefit from layer caching
 COPY package*.json ./
 
-# Install without scripts otherwise webpack will fail
-RUN npm ci --omit=dev --ignore-scripts
+# Architecture of the image to build, set by BuildKit; builders that don't set
+# it build the image for their own platform
+ARG TARGETARCH
+
+# Install production dependencies for the image platform without scripts
+# otherwise webpack will fail
+RUN arch="${TARGETARCH:-$(uname -m)}" \
+ && case "$arch" in \
+      amd64|x86_64) cpu=x64 ;; \
+      arm64|aarch64) cpu=arm64 ;; \
+      arm|armv6l|armv7l) cpu=arm ;; \
+      ppc64le) cpu=ppc64 ;; \
+      s390x) cpu=s390x ;; \
+      *) echo "Unsupported target architecture: '$arch'" >&2; exit 1 ;; \
+    esac \
+ && npm ci --omit=dev --ignore-scripts --os=linux --cpu="$cpu" --libc=musl
 
 # Copy production node_modules aside for later
 RUN cp -R node_modules prod_node_modules
 
 # Copy src to have webpack config files ready for install
 COPY . /src
 
-# Install remaining dev dependencies
+# Install remaining dev dependencies; this also runs the prepare script, which
+# builds the bundles of the image
 RUN npm ci
 
-# Run all webpack build steps
-RUN npm run prepare && npm run build
-
 ############################################################
 # Release stage
 ############################################################
-FROM node:20.19.0-alpine3.20 AS release
+# Must not contain RUN instructions, because building the image for another
+# platform than the one of the build machine would then require emulation.
+FROM node:24.22.2-alpine AS release
 WORKDIR /src
 
 # Copy production node_modules

diff --git a/Parse-Dashboard/app.js b/Parse-Dashboard/app.js
@@ -87,13 +87,52 @@ module.exports = function(config, options) {
       cookieSessionStore: options.cookieSessionStore
     });
 
+    // Headers set by reverse proxies to describe the original client. Their
+    // presence means the request was relayed and did not originate on this host.
+    // The `x-forwarded-` prefix is matched as a whole because proxies vary in
+    // which of them they set, and any single one is enough to reveal a relay.
+    const forwardingHeaderPrefix = 'x-forwarded-';
+    const forwardingHeaders = ['x-real-ip', 'forwarded'];
+
     /**
-     * Checks whether a request is from localhost.
+     * Checks whether the connection was opened from this host.
+     *
+     * This describes the connection, not the client: a reverse proxy running on
+     * the same host also connects over loopback, so a true result does not mean
+     * the client is local. Use it only to decide whether the connection itself
+     * needs encrypting, never to grant access.
+     */
+    function isLoopbackPeer(req) {
+      // The whole of 127.0.0.0/8 is loopback, not just 127.0.0.1. The address is
+      // absent on a socket that has already been destroyed.
+      const address = req.socket.remoteAddress;
+      return typeof address === 'string' && (
+        address.startsWith('127.') ||
+        address.startsWith('::ffff:127.') ||
+        address === '::1'
+      );
+    }
+
+    /**
+     * Checks whether a request originated on this host.
+     *
+     * Stricter than `isLoopbackPeer`, because a same-host reverse proxy would
+     * otherwise make every request it relays look local. A request counts as
+     * local only when nothing indicates it was relayed.
      */
     function isLocalRequest(req) {
-      return req.connection.remoteAddress === '127.0.0.1' ||
-        req.connection.remoteAddress === '::ffff:127.0.0.1' ||
-        req.connection.remoteAddress === '::1';
+      // A configured proxy relays every request, so no request is local.
+      if (config.trustProxy) {
+        return false;
+      }
+      // Forwarding headers are never sent by a client on this host.
+      const isForwarded = Object.keys(req.headers).some(header =>
+        header.startsWith(forwardingHeaderPrefix) || forwardingHeaders.includes(header)
+      );
+      if (isForwarded) {
+        return false;
+      }
+      return isLoopbackPeer(req);
     }
 
     /**
@@ -102,11 +141,15 @@ module.exports = function(config, options) {
      * - Requires users to be configured for remote access (unless dev mode is enabled)
      */
     function enforceRemoteAccessRestrictions(req, res, next) {
-      if (!options.dev && !isLocalRequest(req)) {
-        if (!req.secure && !options.allowInsecureHTTP) {
+      if (!options.dev) {
+        // Keyed on the connection: a loopback connection cannot be observed off
+        // this host, so it needs no encryption of its own.
+        if (!isLoopbackPeer(req) && !req.secure && !options.allowInsecureHTTP) {
           return res.status(403).json({ error: 'Parse Dashboard can only be remotely accessed via HTTPS' });
         }
-        if (!users) {
+        // Keyed on the client: granting access requires knowing where the
+        // request came from, which a relayed request cannot establish.
+        if (!isLocalRequest(req) && !users) {
           return res.status(401).json({ error: 'Configure a user to access Parse Dashboard remotely' });
         }
       }
@@ -135,13 +178,13 @@ module.exports = function(config, options) {
         agent: config.agent,
       };
 
-      if (!options.dev && !isLocalRequest(req)) {
-        if (!req.secure && !options.allowInsecureHTTP) {
+      if (!options.dev) {
+        if (!isLoopbackPeer(req) && !req.secure && !options.allowInsecureHTTP) {
           //Disallow HTTP requests except on localhost, to prevent the master key from being transmitted in cleartext
           return res.send({ success: false, error: 'Parse Dashboard can only be remotely accessed via HTTPS' });
         }
 
-        if (!users) {
+        if (!isLocalRequest(req) && !users) {
           //Accessing the dashboard over the internet can only be done with username and password
           return res.send({ success: false, error: 'Configure a user to access Parse Dashboard remotely' });
         }

diff --git a/Parse-Dashboard/browser-control/BrowserControlAPI.js b/Parse-Dashboard/browser-control/BrowserControlAPI.js
@@ -195,7 +195,7 @@ function createBrowserControlAPI(getWebpackState) {
       await page.waitForSelector(selector, { timeout });
 
       // Clear existing text first
-      await page.click(selector, { clickCount: 3 });
+      await page.click(selector, { count: 3 });
       await page.keyboard.press('Backspace');
 
       // Type new text

diff --git a/Parse-Dashboard/browser-control/BrowserSessionManager.js b/Parse-Dashboard/browser-control/BrowserSessionManager.js
@@ -210,7 +210,7 @@ class BrowserSessionManager extends EventEmitter {
       }
 
       // Close browser
-      if (session.browser && session.browser.isConnected()) {
+      if (session.browser && session.browser.connected) {
         await session.browser.close();
       }
     } catch (error) {

diff --git a/Parse-Dashboard/browser-control/README.md b/Parse-Dashboard/browser-control/README.md
@@ -11,7 +11,7 @@ The Browser Control API is a development-time tool that allows AI agents to inte
 ### Prerequisites
 
 **Requirements:**
-- Node.js 20.19.0 or higher
+- A Node.js version that Parse Dashboard supports, see [Node.js](../../README.md#nodejs)
 
 **Note:** MongoDB is automatically started when you run `npm run browser-control` - no manual setup needed!
 
@@ -790,7 +790,7 @@ The Browser Control API uses a **two-layer security model** to prevent accidenta
 - `BROWSER_SLOW_MO=100` - Slow down browser operations by N milliseconds
 
 ### MongoDB Auto-Start (when browser-control is enabled)
-MongoDB is automatically started when browser-control mode is enabled using `mongodb-runner`.
+MongoDB is automatically started when browser-control mode is enabled using `@mongodb-js/mongodb-runner`.
 
 - `MONGO_PORT=27017` - MongoDB port (default: 27017)
 - `MONGO_VERSION=8.0.4` - MongoDB version (default: 8.0.4)

diff --git a/Parse-Dashboard/browser-control/setup.js b/Parse-Dashboard/browser-control/setup.js
@@ -160,7 +160,7 @@ function setupBrowserControl(app, config) {
   let webpackWatcher = null;
 
   // Auto-start MongoDB and Parse Server
-  const { MongoCluster } = require('mongodb-runner');
+  const { MongoCluster } = require('@mongodb-js/mongodb-runner');
   const mongoPort = parseInt(process.env.MONGO_PORT, 10) || 27017;
   const parseServerPort = parseInt(process.env.PARSE_SERVER_PORT, 10) || 1337;
   const parseServerURL = `http://localhost:${parseServerPort}/parse`;

diff --git a/Parse-Dashboard/server.js b/Parse-Dashboard/server.js
@@ -191,11 +191,18 @@ module.exports = (options) => {
   // Mount parseDashboard with authentication
   app.use(mountPath, parseDashboard(config.data, dashboardOptions));
 
+  // 0.0.0.0 (IPv4) and :: (IPv6) are bind-all addresses: they are not directly
+  // navigable and browsers do not treat them as a secure context, which breaks
+  // Web APIs the dashboard relies on (e.g. crypto.randomUUID used by the Parse
+  // SDK). Advertise localhost instead so the printed URL actually works.
+  const displayHost = address =>
+    address === '0.0.0.0' || address === '::' ? 'localhost' : address;
+
   let server;
   if(!configSSLKey || !configSSLCert){
     // Start the server.
     server = app.listen(port, host, function () {
-      console.log(`The dashboard is now available at http://${server.address().address}:${server.address().port}${mountPath}`);
+      console.log(`The dashboard is now available at http://${displayHost(server.address().address)}:${server.address().port}${mountPath}`);
 
       // Initialize browser control WebSocket if enabled
       if (browserControlSetup) {
@@ -211,7 +218,7 @@ module.exports = (options) => {
       key: privateKey,
       cert: certificate
     }, app).listen(port, host, function () {
-      console.log(`The dashboard is now available at https://${server.address().address}:${server.address().port}${mountPath}`);
+      console.log(`The dashboard is now available at https://${displayHost(server.address().address)}:${server.address().port}${mountPath}`);
 
       // Initialize browser control WebSocket if enabled
       if (browserControlSetup) {

diff --git a/README.md b/README.md
@@ -6,7 +6,7 @@
 [![Build Status](https://github.com/parse-community/parse-dashboard/workflows/ci/badge.svg?branch=release)](https://github.com/parse-community/parse-dashboard/actions?query=workflow%3Aci+branch%3Arelease)
 [![Snyk Badge](https://snyk.io/test/github/parse-community/parse-dashboard/badge.svg)](https://snyk.io/test/github/parse-community/parse-dashboard)
 
-[![Node Version](https://img.shields.io/badge/nodejs-20,_22,_24-green.svg?logo=node.js&style=flat)](https://nodejs.org/)
+[![Node Version](https://img.shields.io/badge/nodejs-22,_24,_26-green.svg?logo=node.js&style=flat)](https://nodejs.org/)
 [![auto-release](https://img.shields.io/badge/%F0%9F%9A%80-auto--release-9e34eb.svg)](https://github.com/parse-community/parse-dashboard/releases)
 
 [![npm latest version](https://img.shields.io/npm/v/parse-dashboard/latest.svg)](https://www.npmjs.com/package/parse-dashboard)
@@ -168,9 +168,9 @@ Parse Dashboard is continuously tested with the most recent releases of Node.js
 
 | Version    | Minimum version | End-of-Life | Compatible |
 |------------|----------------|-------------|------------|
-| Node.js 20 | 20.18.0        | April 2026  | ✅ Yes      |
-| Node.js 22 | 22.9.0         | April 2027  | ✅ Yes      |
-| Node.js 24 | 24.0.0         | April 2028  | ✅ Yes      |
+| Node.js 22 | 22.13.0        | April 2027  | ✅ Yes      |
+| Node.js 24 | 24.1.0         | April 2028  | ✅ Yes      |
+| Node.js 26 | 26.13.0        | April 2029  | ✅ Yes      |
 
 ## Configuring Parse Dashboard
 
@@ -986,6 +986,8 @@ You can provide a list of locales or languages you want to support for your dash
 
 The official docker image is published on [docker hub](https://hub.docker.com/r/parseplatform/parse-dashboard)
 
+With every Parse Dashboard major release, the Docker image is updated to the newest Node.js LTS version that the new major version supports, see [Compatibility](#nodejs). Between major releases, it only receives Node.js minor and patch updates, unless its Node.js version reaches its end-of-life.
+
 Run the image with your ``config.json`` mounted as a volume
 
 ```
-Original file line number
+Diff line change
@@ Expand Up / @@ -21,3 +21,6 @@ test_logs @@
     # AI tools
     .claude
     .superpowers
+    # Docs
+    /docs/