[cookesan]

Adds parse-server file upload advisory references to GHSA-vr5f-2r24-w5hc.

Audit refresh, July 8, 2026:

• Confirmed the live PR is open, ready for review, merge-clean, and the visible advisory check is green.
• Rechecked the merge-base diff: exactly one advisory JSON file changes (advisories/github-reviewed/2026/04/GHSA-vr5f-2r24-w5hc/GHSA-vr5f-2r24-w5hc.json), JSON parses, git diff --check passes, and the exact-head worktree is clean.
• Revalidated the added public references in the diff; all resolve through their source site or registry.

[cookesan]

Rechecked this reference-only PR while keeping the open Advisory Database queue current.

Adds direct commit and release references for GHSA-vr5f-2r24-w5hc in both Parse Server release lines. The advisory already references NVD, upstream PR #10383, upstream PR #10384, and package source; this PR links each merged fix to its fixed release and keeps the references grouped by release line.

Current audit, July 8, 2026:

• GHSA-vr5f-2r24-w5hc is live and not withdrawn.
• CVE-2026-35200 resolves in NVD with Analyzed status.
• PR [GHSA-fm4g-76c9-7w69] Http4s: DigestAuth nonce map grows unbounded #10383 merged to alpha as commit dd7cc41a952b9ec6fa655a5655f106cca27d65c7; release 9.7.1-alpha.4 is published, marked prerelease, and not marked draft.
• PR [GHSA-m358-vx46-jcm4] Add summary #10384 merged to release-8.x.x as commit 0de3e9f4bd477b0f0866f519974f513060876c04; release 8.6.73 is published and not marked draft or prerelease.
• npm parse-server 9.7.1-alpha.4 and 8.6.73 both resolve with package tarball and integrity metadata.
• Local JSON validation and whitespace checks pass, and the diff only changes this advisory.

No advisory data fields are changed.