New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update dependency mongoose to v8.8.3 [SECURITY] #297

Open

renovate wants to merge 1 commit into main from renovate/npm-mongoose-vulnerability

Contributor

renovate bot commented Dec 3, 2024 •

edited

Loading

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
mongoose (source)	`8.5.3` -> `8.8.3`

GitHub Vulnerability Alerts

CVE-2024-53900

Mongoose versions prior to 8.8.3, 7.8.3, and 6.13.5 are vulnerable to improper use of the $where operator. This vulnerability arises from the ability of the $where clause to execute arbitrary JavaScript code in MongoDB queries, potentially leading to code injection attacks and unauthorized access or manipulation of database data.

Release Notes

Automattic/mongoose (mongoose)

`v8.8.3`

==================

fix: disallow using $where in match
perf: cache results from getAllSubdocs() on saveOptions, only loop through known subdoc properties #15055 #15029
fix(model+query): support overwriteDiscriminatorKey for bulkWrite updateOne and updateMany, allow inferring discriminator key from update #15046 #15040

`v8.8.2`

==================

fix(model): handle array filters when casting bulkWrite #15036 #14978
fix(model): make diffIndexes() avoid trying to drop default timeseries collection index #15035 #14984
fix: save execution stack in query as string #15039 durran
types(cursor): correct asyncIterator and asyncDispose for TypeScript with lib: 'esnext' #15038
docs(migrating_to_8): add note about removing findByIdAndRemove #15024 dragontaek-lee

`v8.8.1`

==================

perf: make a few micro-optimizations to help speed up findOne() #15022 #14906
fix: apply embedded discriminators to subdoc schemas before compiling top level model so middleware applies correctly #15001 #14961
fix(query): add overwriteImmutable option to allow updating immutable properties without disabling strict mode #15000 #8619

`v8.8.0`

==================

feat: upgrade mongodb -> ~6.10 #14991 #14877
feat(query): add schemaLevelProjections option to query to disable schema-level select: false #14986 #11474
feat: allow defining virtuals on arrays, not just array elements #14955 #2326
feat(model): add applyTimestamps() function to apply all schema timestamps, including subdocuments, to a given POJO #14943 #14698
feat(model): add hideIndexes option to syncIndexes() and cleanIndexes() #14987 #14868
fix(query): make sanitizeFilter disable implicit $in #14985 #14657
fix(model): avoid unhandled error if createIndex() throws a sync error #14995
fix(model): avoid throwing TypeError if bulkSave()'s bulkWrite() fails with a non-BulkWriteError #14993
types: added toJSON:flattenObjectIds effect #14989
types: add __v to lean() result type and ModifyResult #14990 #12959
types: use globalThis instead of global for NativeDate #14992 #14988
docs(change-streams): fix markdown syntax highlighting for script output example #14994

`v8.7.3`

==================

fix(cursor): close underlying query cursor when calling destroy() #14982 #14966
types: add JSONSerialized helper that can convert HydratedDocument to JSON output type #14981 #14451
types(model): convert InsertManyResult to interface and remove unnecessary insertedIds override #14977
types(connection): add missing sanitizeFilter option #14975
types: improve goto definition for inferred schema definitions #14968 forivall
docs(migration-guide-v7): correct link to the section "Id Setter" #14973 rb-ntnx

`v8.7.2`

==================

fix(document): recursively clear modified subpaths when setting deeply nested subdoc to null #14963 #14952
fix(populate): handle array of ids with parent refPath #14965
types: make Buffers into mongodb.Binary in lean result type to match runtime behavior #14967
types: correct schema type inference when using nested typeKey like type: { type: String } #14956 #14950
types: re-export DeleteResult and UpdateResult from MongoDB Node.js driver #14947 #14946
docs(documents): add section on setting deeply nested properties, including warning about nullish coalescing assignment #14972
docs(model): add more info on acknowledged: false, specifically that Mongoose may return that if the update was empty #14957

`v8.7.1`

==================

fix: set flattenObjectIds to false when calling toObject() for internal purposes #14938
fix: add mongodb 8 to test matrix #14937
fix: handle buffers stored in MongoDB as EJSON representation with { $binary } #14932
docs: indicate that Mongoose 8.7 is required for full MongoDB 8 support #14937

`v8.7.0`

==================

feat(model): add Model.applyVirtuals() to apply virtuals to a POJO #14905 #14818
feat: upgrade mongodb -> 6.9.0 #14914
feat(query): cast $rename to string #14887 #3027
feat(SchemaType): add getEmbeddedSchemaType() method to SchemaTypes #14880 #8389
fix(model): throw MongooseBulkSaveIncompleteError if bulkSave() didn't completely succeed #14884 #14763
fix(connection): avoid returning readyState = connected if connection state is stale #14812 #14727
fix: depopulate if push() or addToSet() with an ObjectId on a populated array #14883 #1635
types: make __v a number, only set __v on top-level documents #14892

`v8.6.4`

==================

fix(document): avoid massive perf degradation when saving new doc with 10 level deep subdocs #14910 #14897
fix(model): skip applying static hooks by default if static name conflicts with aggregate middleware #14904 dragontaek-lee
fix(model): filter applying static hooks by default if static name conflicts with mongoose middleware #14908 dragontaek-lee

`v8.6.3`

==================

fix: make getters convert uuid to string when calling toObject() and toJSON() #14890 #14869
fix: fix missing Aggregate re-exports for ESM #14886 wongsean
types(document): add generic param to depopulate() to allow updating properties #14891 #14876

`v8.6.2`

==================

fix: make set merge deeply nested objects #14870 #14861 ianHeydoc
types: allow arbitrary keys in query filters again (revert #14764) #14874 #14863 #14862 #14842
types: make SchemaType static setters property accessible in TypeScript #14881 #14879
type(inferrawdoctype): infer Date types as JS dates rather than Mongoose SchemaType Date #14882 #14839

`v8.6.1`

==================

fix(document): avoid unnecessary clone() in applyGetters() that was preventing getters from running on 3-level deep subdocuments #14844 #14840 #14835
fix(model): throw error if bulkSave() did not insert or update any documents #14837 #14763
fix(cursor): throw error in ChangeStream constructor if changeStreamThunk() throws a sync error #14846
types(query): add $expr to RootQuerySelector #14845
docs: update populate.md to fix missing match: { } #14847 makhoulshbeeb

`v8.6.0`

==================

feat: upgrade mongodb -> 6.8.0, handle throwing error on closed cursor in Mongoose with MongooseError instead of MongoCursorExhaustedError #14813
feat(model+query): support options parameter for distinct() #14772 #8006
feat(QueryCursor): add getDriverCursor() function that returns the raw driver cursor #14745
types: change query selector to disallow unknown top-level keys by default #14764 alex-statsig
types: make toObject() and toJSON() not generic by default to avoid type widening #14819 #12883
types: avoid automatically inferring lean result type when assigning to explicitly typed variable #14734

`v8.5.5`

==================

fix(populate): fix a couple of other places where Mongoose gets the document's _id with getters #14833 #14827 #14759
fix(discriminator): shallow clone Schema.prototype.obj before merging schemas to avoid modifying original obj #14821
types: fix schema type based on timestamps schema options value #14829 #14825 ark23CIS

`v8.5.4`

==================

fix: add empty string check for collection name passed #14806 Shubham2552
docs(model): add 'throw' as valid strict value for bulkWrite() and add some more clarification on throwOnValidationError #14809

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.


          Update dependency mongoose to v8.8.3 [SECURITY]

52cfc13

sonarqubecloud bot commented Dec 3, 2024

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet