Skip to content

Conversation

@renovate
Copy link

@renovate renovate bot commented Mar 17, 2023

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
mongoose (source) 5.13.136.11.3 age confidence

GitHub Vulnerability Alerts

CVE-2022-2564

Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Affected versions of this package are vulnerable to Prototype Pollution. The Schema.path() function is vulnerable to prototype pollution when setting the schema object. This vulnerability allows modification of the Object prototype and could be manipulated into a Denial of Service (DoS) attack.

CVE-2023-3696

Prototype Pollution in GitHub repository automattic/mongoose prior to 7.3.3, 6.11.3, and 5.13.20.


Release Notes

Automattic/mongoose (mongoose)

v6.11.3

Compare Source

===================

  • fix: avoid prototype pollution on init
  • fix(schema): correctly handle uuids with populate() #​13317 #​13595

v6.11.2

Compare Source

===================

v6.11.1

Compare Source

===================

  • fix(query): apply schema-level paths before calculating projection for findOneAndUpdate() #​13348 #​13340
  • fix: add SUPPRESS_JEST_WARNINGS environment variable to hide jest warnings #​13384 #​13373
  • types(model): allow overwriting expected param type for bulkWrite() #​13292 hasezoey

v6.11.0

Compare Source

===================

v6.10.5

Compare Source

===================

  • perf(document): avoid unnecessary loops, conditionals, string manipulation on Document.prototype.get() for 10x speedup on top-level properties #​12953
  • fix(model): execute valid write operations if calling bulkWrite() with ordered: false #​13218 #​13176
  • fix(array): pass-through all parameters #​13202 #​13201 hasezoey
  • fix: improve error message when sorting by empty string #​13249 #​10182
  • docs: add version support and check version docs #​13251 #​13193

v6.10.4

Compare Source

===================

  • fix(document): apply setters on resulting value when calling Document.prototype.$inc() #​13178 #​13158
  • fix(model): add results property to unordered insertMany() to make it easy to identify exactly which documents were inserted #​13163 #​12791
  • docs(guide+schematypes): add UUID to schematypes guide #​13184

v6.10.3

Compare Source

===================

v6.10.2

Compare Source

===================

  • fix(document): avoid setting array default if document array projected out by sibling projection #​13135 #​13043 #​13003
  • fix(documentarray): set correct document array path if making map of document arrays #​13133
  • fix: undo accidental change to engines in package.json #​13124 lorand-horvath
  • docs: quick improvement to Model.init() docs #​13054

v6.10.1

Compare Source

===================

v6.10.0

Compare Source

===================

v6.9.3

Compare Source

==================

v6.9.2

Compare Source

==================

v6.9.1

Compare Source

==================

  • fix(document): isModified should not be triggered when setting a nested boolean to the same value as previously #​12994 lpizzinidev
  • fix(document): save newly set defaults underneath single nested subdocuments #​13002 #​12905
  • fix(update): handle custom discriminator model name when casting update #​12947 wassil
  • fix(connection): handles unique autoincrement ID for connections #​12990 lpizzinidev
  • fix(types): fix type of options of Model.aggregate #​12933 ghost91-
  • fix(types): fix "near" aggregation operator input type #​12954 Jokero
  • fix(types): add missing Top operator to AccumulatorOperator type declaration #​12952 lpizzinidev
  • docs(transactions): added example for Connection.transaction() method #​12943 #​12934 lpizzinidev
  • docs(populate): fix out of date comment referencing onModel property #​13000
  • docs(transactions): fix typo in transactions.md #​12995 Parth86

v6.9.0

Compare Source

==================

v6.8.4

Compare Source

==================

v6.8.3

Compare Source

==================

  • perf: improve performance of assignRawDocsToIdStructure for faster populate on large docs #​12867 Uzlopak
  • fix(model): ensure consistent ordering of validation errors in insertMany() with ordered: false and rawResult: true #​12866
  • fix: avoid passing final callback to pre hook, because calling the callback can mess up hook execution #​12836
  • fix(types): avoid inferring timestamps if methods, virtuals, or statics set #​12871
  • fix(types): correctly infer string enums on const arrays #​12870 JavaScriptBach
  • fix(types): allow virtuals to be invoked in the definition of other virtuals #​12874 sffc
  • fix(types): add type def for Aggregate#model without arguments #​12864 hasezoey
  • docs(discriminators): add section about changing discriminator key #​12861
  • docs(typescript): explain that virtuals inferred from schema only show up on Model, not raw document type #​12860 #​12684

v6.8.2

Compare Source

==================

  • fix(schema): propagate strictQuery to implicitly created schemas for embedded discriminators #​12827 #​12796
  • fix(model): respect discriminators with Model.validate() #​12824 #​12621
  • fix(query): fix unexpected validation error when doing findOneAndReplace() with a nullish value #​12826 #​12821
  • fix(discriminator): apply built-in plugins to discriminator schema even if mergeHooks and mergePlugins are both false #​12833 #​12696
  • fix(types): add option "overwriteModels" as a schema option #​12817 #​12816 hasezoey
  • fix(types): add property "defaultOptions" #​12818 hasezoey
  • docs: make search bar respect documentation version, so you can search 5.x docs #​12548
  • docs(typescript): make note about recommending strict mode when using auto typed schemas #​12825 #​12420
  • docs: add section on sorting to query docs #​12588 IslandRhythms
  • test(query.test): add write-concern option #​12829 hasezoey

v6.8.1

Compare Source

==================

v6.8.0

Compare Source

==================

v6.7.5

Compare Source

==================

v6.7.4

Compare Source

==================

v6.7.3

Compare Source

==================

v6.7.2

Compare Source

==================

v6.7.1

Compare Source

==================

v6.7.0

Compare Source

==================

  • feat: upgrade to mongodb driver 4.11.0 #​12446
  • feat: add UUID Schema Type (BSON Buffer SubType 4) #​12268 #​3208 hasezoey
  • feat(aggregation): add $fill pipeline stage #​12545 raphael-papazikas
  • feat(types+schema): allow defining schema paths using mongoose.Types.* to work around TS type inference issues #​12352
  • feat(schema): add alias() method that makes it easier to define multiple aliases for a given path #​12368
  • feat(model): add mergeHooks option to Model.discriminator() to avoid duplicate hooks #​12542
  • feat(document): add $timestamps() method to set timestamps for save(), bulkSave(), and insertMany() #​12540

v6.6.7

Compare Source

==================

v6.6.6

Compare Source

==================

v6.6.5

Compare Source

==================

  • fix(document): set defaults on subdocuments underneath init-ed single nested subdocument #​12523 #​12515
  • fix: make Jest fake timers check more robust to other libs that overwrite time functions #​12527 #​12514
  • fix(types): indicate that Schema.prototype.discriminator() returns this #​12522 #​12457
  • fix(types): add "estimatedDocumentCount" and "countDocuments" as possible hooks #​12519 #​12516
  • docs(models): add section on MongoDB Views #​12526 #​5694
  • docs(subdocs): clarify that populated docs are not subdocs #​12521 #​12398
  • docs(change-streams): remove unnecessary obsolete comment about needing to use mongodb driver change streams #​12444

v6.6.4

Compare Source

==================

  • fix(model): avoid saving applied defaults if path is deselected #​12506 #​12414
  • fix(types): correct DocType for auto typed query helpers #​12342
  • fix(types): avoid "excessively deep" type instantiation error when using bulkWrite() with type that extends from document #​12277
  • fix(types): avoid relying on typeof this, which isn't supported in TypeScript < 4.4 #​12375
  • docs(schema): correct example for Schema.prototype.discriminator() #​12493
  • docs(typescript): clean up query helpers examples #​12342
  • chore: use mongodb-memory-server for testing #​12262 hasezoey

v6.6.3

Compare Source

==================

v6.6.2

Compare Source

==================

  • fix(model): avoid deleting shared schema methods in fix for #​12254 #​12423
  • fix(document): set $inc default value in case field has not been specified on the document #​12435 lpizzinidev
  • fix(query): handle select: false on map paths in query results #​12467 lpizzinidev
  • fix(types): add HydratedDocumentFromSchema to make it easier to pull inferred hydrated doc type #​12464 #​12319
  • fix(types): add sanitizeFilter to types #​12465 zrosenbauer
  • fix(types): infer number enum types from schema if using enum: [0, 1] as const #​12463 #​12242
  • docs(validation): add section on global schematype validation, clean up other issues #​12430
  • docs: add clarification about overwrite flag in model.js #​12447 Tzvika-m
  • docs: change to consistent "Example:" for jsdoc comments #​12432 hasezoey

v6.6.1

Compare Source

==================

  • fix: correctly apply defaults after subdoc init #​12328
  • fix(array): avoid using default _id when using pull() #​12294
  • fix: allow null values inside $expr objects #​12429 MartinDrost
  • fix(query): use correct Query constructor when cloning query #​12418
  • docs(website): remove setting "latest38x" which is not used anywhere #​12396 hasezoey

v6.6.0

Compare Source

==================

v6.5.5

Compare Source

==================

  • fix(setDefaultsOnInsert): avoid applying defaults on insert if nested property set #​12279
  • fix(model): make applyHooks() and applyMethods() handle case where custom method is set to Mongoose implementation #​12254
  • fix(types): add string "ascending" and "descending" index-directions #​10269
  • docs: upgrade dox to 1.0.0 #​12403 hasezoey
  • docs: update old mongodb nodejs driver documentation urls #​12387 hasezoey
  • docs: update JSDOC ... (spread) definition #​12388 hasezoey
  • refactor(model): allow optionally passing indexes to createIndexes and cleanIndexes #​12280 AbdelrahmanHafez

v6.5.4

Compare Source

==================

  • fix(document): allow calling $assertPopulated() with values to better support manual population #​12233
  • fix(connection+mongoose): better handling for calling model() with 1 argument #​12359
  • fix(model): allow defining discriminator virtuals and methods using schema options #​12326
  • fix(types): fix MongooseQueryMiddleware missing "findOneAndReplace" and "replaceOne" #​12330 #​12329 Jule- lpizzinidev
  • fix(types): fix replaceOne return type #​12351 lpizzinidev

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
Copy link
Author

renovate bot commented Mar 17, 2023

⚠ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: backend/package-lock.json
/usr/local/bin/docker: line 4: .: filename argument required
.: usage: . filename [arguments]
npm WARN ignoring workspace config at /tmp/worker/e95262/53a474/repos/github/hweeks/dcpm/backend/.npmrc 
npm WARN ignoring workspace config at /tmp/worker/e95262/53a474/repos/github/hweeks/dcpm/backend/.npmrc 
npm WARN ignoring workspace config at /tmp/worker/e95262/53a474/repos/github/hweeks/dcpm/backend/.npmrc 
npm ERR! code EUNSUPPORTEDPROTOCOL
npm ERR! Unsupported URL Type "workspace:": workspace:*

npm ERR! A complete log of this run can be found in: /tmp/worker/e95262/53a474/cache/others/npm/_logs/2023-07-18T21_36_47_829Z-debug-0.log

@renovate renovate bot changed the title fix(deps): update dependency mongoose to v5.13.15 [security] fix(deps): update dependency mongoose to v5.13.20 [security] Jul 18, 2023
@renovate renovate bot force-pushed the renovate/npm-mongoose-vulnerability branch from 5843ae3 to f3a3fec Compare July 18, 2023 21:37
@renovate renovate bot force-pushed the renovate/npm-mongoose-vulnerability branch from f3a3fec to 07ad1ad Compare August 6, 2024 09:20
@renovate renovate bot changed the title fix(deps): update dependency mongoose to v5.13.20 [security] fix(deps): update dependency mongoose to v6 [security] Aug 6, 2024
@renovate
Copy link
Author

renovate bot commented Aug 6, 2024

⚠️ Artifact update problem

Renovate failed to update artifacts related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: backend/package-lock.json
npm ERR! code EUNSUPPORTEDPROTOCOL
npm ERR! Unsupported URL Type "workspace:": workspace:*

npm ERR! A complete log of this run can be found in:
npm ERR!     /runner/cache/others/npm/_logs/2026-01-19T19_51_56_354Z-debug-0.log

File name: yarn.lock
➤ YN0000: ┌ Resolution step
➤ YN0002: │ @dcpm/frontend@workspace:frontend doesn't provide @types/node (p72969), requested by ts-node
➤ YN0060: │ @dcpm/frontend@workspace:frontend provides react (p5b86c) with version 17.0.2, which doesn't satisfy what @hot-loader/react-dom requests
➤ YN0060: │ @dcpm/frontend@workspace:frontend provides react (p57493) with version 17.0.2, which doesn't satisfy what react-markdown and some of its descendants request
➤ YN0060: │ @dcpm/frontend@workspace:frontend provides semantic-release (pbffd9) with version 15.14.0, which doesn't satisfy what hweeks-semantic-release-monorepo and some of its descendants request
➤ YN0002: │ @octokit/rest@npm:16.43.2 doesn't provide @octokit/core (p84523), requested by @octokit/plugin-request-log
➤ YN0060: │ semantic-release@npm:17.0.4 provides marked (p53cc6) with version 0.8.2, which doesn't satisfy what marked-terminal requests
➤ YN0000: │ Some peer dependencies are incorrectly met; run yarn explain peer-requirements <hash> for details, where <hash> is the six-letter p-prefixed code
➤ YN0000: └ Completed in 2s 287ms
➤ YN0000: ┌ Fetch step
➤ YN0013: │ 1895 packages were already cached, 89 had to be fetched
➤ YN0019: │ 6 packages appeared to be unused and were removed
➤ YN0000: └ Completed in 2s 443ms
➤ YN0000: ┌ Link step
➤ YN0001: │ TypeError: Failed to open the cache entry for fsevents@patch:fsevents@npm%3A2.3.2#~builtin<compat/fsevents>::version=2.3.2&hash=18f3a7: (0 , QO.isDate) is not a function
    at ihe (/tmp/containerbase/cache/.cache/node/corepack/v1/yarn/3.1.1/yarn.js:317:10860)
    at Jr.utimesImpl (/tmp/containerbase/cache/.cache/node/corepack/v1/yarn/3.1.1/yarn.js:317:28773)
    at Jr.utimesSync (/tmp/containerbase/cache/.cache/node/corepack/v1/yarn/3.1.1/yarn.js:317:28366)
    at Jr.mkdirpSync (/tmp/containerbase/cache/.cache/node/corepack/v1/yarn/3.1.1/yarn.js:312:13525)
    at Jr.mkdirSync (/tmp/containerbase/cache/.cache/node/corepack/v1/yarn/3.1.1/yarn.js:317:28953)
    at g (/tmp/containerbase/cache/.cache/node/corepack/v1/yarn/3.1.1/yarn.js:432:330)
    at Jr.baseFs (/tmp/containerbase/cache/.cache/node/corepack/v1/yarn/3.1.1/yarn.js:432:2835)
    at /tmp/containerbase/cache/.cache/node/corepack/v1/yarn/3.1.1/yarn.js:432:2907
    at Mv (/tmp/containerbase/cache/.cache/node/corepack/v1/yarn/3.1.1/yarn.js:382:4076)
    at oh.factory (/tmp/containerbase/cache/.cache/node/corepack/v1/yarn/3.1.1/yarn.js:432:2898)
➤ YN0000: └ Completed in 1s 199ms
➤ YN0000: Failed with errors in 6s 97ms

@renovate renovate bot force-pushed the renovate/npm-mongoose-vulnerability branch 2 times, most recently from 40e4b56 to 44095ea Compare August 13, 2025 15:16
@renovate renovate bot force-pushed the renovate/npm-mongoose-vulnerability branch from 44095ea to ab2dac3 Compare August 31, 2025 11:12
@renovate renovate bot force-pushed the renovate/npm-mongoose-vulnerability branch from ab2dac3 to 7079a44 Compare September 25, 2025 20:01
@renovate renovate bot force-pushed the renovate/npm-mongoose-vulnerability branch 2 times, most recently from bafb54e to 1a87442 Compare October 22, 2025 17:31
@renovate renovate bot force-pushed the renovate/npm-mongoose-vulnerability branch from 1a87442 to 9488910 Compare November 10, 2025 16:46
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant