Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix(deps): update dependency mongoose to v8 [security] #8127

Open
wants to merge 1 commit into
base: develop
Choose a base branch
from
Open

fix(deps): update dependency mongoose to v8 [security] #8127

wants to merge 1 commit into from

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Dec 3, 2024

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
mongoose (source) ^6.11.3 -> ^8.0.0 age adoption passing confidence

Mongoose search injection vulnerability

CVE-2024-53900 / GHSA-m7xq-9374-9rvx

More information

Details

Mongoose before 8.8.3 can improperly use $where in match.

Severity

  • CVSS Score: Unknown
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Release Notes

Automattic/mongoose (mongoose)

v8.8.3

Compare Source

==================

  • fix: disallow using $where in match
  • perf: cache results from getAllSubdocs() on saveOptions, only loop through known subdoc properties #​15055 #​15029
  • fix(model+query): support overwriteDiscriminatorKey for bulkWrite updateOne and updateMany, allow inferring discriminator key from update #​15046 #​15040

v8.8.2

Compare Source

==================

  • fix(model): handle array filters when casting bulkWrite #​15036 #​14978
  • fix(model): make diffIndexes() avoid trying to drop default timeseries collection index #​15035 #​14984
  • fix: save execution stack in query as string #​15039 durran
  • types(cursor): correct asyncIterator and asyncDispose for TypeScript with lib: 'esnext' #​15038
  • docs(migrating_to_8): add note about removing findByIdAndRemove #​15024 dragontaek-lee

v8.8.1

Compare Source

==================

  • perf: make a few micro-optimizations to help speed up findOne() #​15022 #​14906
  • fix: apply embedded discriminators to subdoc schemas before compiling top level model so middleware applies correctly #​15001 #​14961
  • fix(query): add overwriteImmutable option to allow updating immutable properties without disabling strict mode #​15000 #​8619

v8.8.0

Compare Source

==================

  • feat: upgrade mongodb -> ~6.10 #​14991 #​14877
  • feat(query): add schemaLevelProjections option to query to disable schema-level select: false #​14986 #​11474
  • feat: allow defining virtuals on arrays, not just array elements #​14955 #​2326
  • feat(model): add applyTimestamps() function to apply all schema timestamps, including subdocuments, to a given POJO #​14943 #​14698
  • feat(model): add hideIndexes option to syncIndexes() and cleanIndexes() #​14987 #​14868
  • fix(query): make sanitizeFilter disable implicit $in #​14985 #​14657
  • fix(model): avoid unhandled error if createIndex() throws a sync error #​14995
  • fix(model): avoid throwing TypeError if bulkSave()'s bulkWrite() fails with a non-BulkWriteError #​14993
  • types: added toJSON:flattenObjectIds effect #​14989
  • types: add __v to lean() result type and ModifyResult #​14990 #​12959
  • types: use globalThis instead of global for NativeDate #​14992 #​14988
  • docs(change-streams): fix markdown syntax highlighting for script output example #​14994

v8.7.3

Compare Source

==================

  • fix(cursor): close underlying query cursor when calling destroy() #​14982 #​14966
  • types: add JSONSerialized helper that can convert HydratedDocument to JSON output type #​14981 #​14451
  • types(model): convert InsertManyResult to interface and remove unnecessary insertedIds override #​14977
  • types(connection): add missing sanitizeFilter option #​14975
  • types: improve goto definition for inferred schema definitions #​14968 forivall
  • docs(migration-guide-v7): correct link to the section "Id Setter" #​14973 rb-ntnx

v8.7.2

Compare Source

==================

  • fix(document): recursively clear modified subpaths when setting deeply nested subdoc to null #​14963 #​14952
  • fix(populate): handle array of ids with parent refPath #​14965
  • types: make Buffers into mongodb.Binary in lean result type to match runtime behavior #​14967
  • types: correct schema type inference when using nested typeKey like type: { type: String } #​14956 #​14950
  • types: re-export DeleteResult and UpdateResult from MongoDB Node.js driver #​14947 #​14946
  • docs(documents): add section on setting deeply nested properties, including warning about nullish coalescing assignment #​14972
  • docs(model): add more info on acknowledged: false, specifically that Mongoose may return that if the update was empty #​14957

v8.7.1

Compare Source

==================

  • fix: set flattenObjectIds to false when calling toObject() for internal purposes #​14938
  • fix: add mongodb 8 to test matrix #​14937
  • fix: handle buffers stored in MongoDB as EJSON representation with { $binary } #​14932
  • docs: indicate that Mongoose 8.7 is required for full MongoDB 8 support #​14937

v8.7.0

Compare Source

==================

  • feat(model): add Model.applyVirtuals() to apply virtuals to a POJO #​14905 #​14818
  • feat: upgrade mongodb -> 6.9.0 #​14914
  • feat(query): cast $rename to string #​14887 #​3027
  • feat(SchemaType): add getEmbeddedSchemaType() method to SchemaTypes #​14880 #​8389
  • fix(model): throw MongooseBulkSaveIncompleteError if bulkSave() didn't completely succeed #​14884 #​14763
  • fix(connection): avoid returning readyState = connected if connection state is stale #​14812 #​14727
  • fix: depopulate if push() or addToSet() with an ObjectId on a populated array #​14883 #​1635
  • types: make __v a number, only set __v on top-level documents #​14892

v8.6.4

Compare Source

==================

  • fix(document): avoid massive perf degradation when saving new doc with 10 level deep subdocs #​14910 #​14897
  • fix(model): skip applying static hooks by default if static name conflicts with aggregate middleware #​14904 dragontaek-lee
  • fix(model): filter applying static hooks by default if static name conflicts with mongoose middleware #​14908 dragontaek-lee

v8.6.3

Compare Source

==================

v8.6.2

Compare Source

==================

v8.6.1

Compare Source

==================

  • fix(document): avoid unnecessary clone() in applyGetters() that was preventing getters from running on 3-level deep subdocuments #​14844 #​14840 #​14835
  • fix(model): throw error if bulkSave() did not insert or update any documents #​14837 #​14763
  • fix(cursor): throw error in ChangeStream constructor if changeStreamThunk() throws a sync error #​14846
  • types(query): add $expr to RootQuerySelector #​14845
  • docs: update populate.md to fix missing match: { } #​14847 makhoulshbeeb

v8.6.0

Compare Source

==================

  • feat: upgrade mongodb -> 6.8.0, handle throwing error on closed cursor in Mongoose with MongooseError instead of MongoCursorExhaustedError #​14813
  • feat(model+query): support options parameter for distinct() #​14772 #​8006
  • feat(QueryCursor): add getDriverCursor() function that returns the raw driver cursor #​14745
  • types: change query selector to disallow unknown top-level keys by default #​14764 alex-statsig
  • types: make toObject() and toJSON() not generic by default to avoid type widening #​14819 #​12883
  • types: avoid automatically inferring lean result type when assigning to explicitly typed variable #​14734

v8.5.5

Compare Source

==================

  • fix(populate): fix a couple of other places where Mongoose gets the document's _id with getters #​14833 #​14827 #​14759
  • fix(discriminator): shallow clone Schema.prototype.obj before merging schemas to avoid modifying original obj #​14821
  • types: fix schema type based on timestamps schema options value #​14829 #​14825 ark23CIS

v8.5.4

Compare Source

==================

  • fix: add empty string check for collection name passed #​14806 Shubham2552
  • docs(model): add 'throw' as valid strict value for bulkWrite() and add some more clarification on throwOnValidationError #​14809

v8.5.3

Compare Source

==================

v8.5.2

Compare Source

==================

v8.5.1

Compare Source

==================

  • perf(model): performance improvements for insertMany() #​14724
  • fix(model): avoid leaving subdoc defaults on top-level doc when setting subdocument to same value #​14728 #​14722
  • fix(model): handle transactionAsyncLocalStorage option with insertMany() #​14743
  • types: make _id required on Document type #​14735 #​14660
  • types: fix ChangeStream.close to return a Promise like the driver #​14740 orgads

v8.5.0

Compare Source

==================

  • perf: memoize toJSON / toObject default options #​14672
  • feat(document): add $createModifiedPathsSnapshot(), $restoreModifiedPathsSnapshot(), $clearModifiedPaths() #​14699 #​14268
  • feat(query): make sanitizeProjection prevent projecting in paths deselected in the schema #​14691
  • feat: allow setting array default value to null #​14717 #​6691
  • feat(mongoose): allow drivers to set global plugins #​14682
  • feat(connection): bubble up monitorCommands events to Mongoose connection if monitorCommands option set #​14681 #​14611
  • fix(document): ensure post('deleteOne') hooks are called when calling save() after subdoc.deleteOne() #​14732 #​9885
  • fix(query): remove count() and findOneAndRemove() from query chaining #​14692 #​14689
  • fix: remove default connection if setting createInitialConnection to false after Mongoose instance created #​14679 #​8302
  • types(models+query): infer return type from schema for 1-level deep nested paths #​14632
  • types(connection): make transaction() return type match the executor function #​14661 #​14656
  • docs: fix docs links in index.md mirasayon

v8.4.5

Compare Source

==================

v8.4.4

Compare Source

==================

  • perf: avoid unnecesary get() call and use faster approach for converting to string #​14673 #​14394
  • fix(projection): handle projections on arrays in Model.hydrate() projection option #​14686 #​14680
  • fix(document): avoid passing validateModifiedOnly to subdocs so subdocs get fully validating if they're directly modified #​14685 #​14677
  • fix: handle casting primitive array with $elemMatch in bulkWrite() #​14687 #​14678
  • fix(query): cast $pull using embedded discriminator schema when discriminator key is set in filter #​14676 #​14675
  • types(connection): fix return type of withSession() #​14690 tt-public
  • types: add $documents pipeline stage and fix $unionWith type #​14666 nick-statsig
  • docs(findoneandupdate): improve example that shows findOneAndUpdate() returning doc before updates were applied #​14671 #​14670

v8.4.3

Compare Source

==================

  • fix: remove 0x flamegraph files from release

v8.4.2

Compare Source

==================

  • perf: more toObject() perf improvements #​14623 #​14606 #​14394
  • fix(model): check the value of overwriteModels in options when calling discriminator() #​14646 uditha-g
  • fix: avoid throwing TypeError when deleting an null entry on a populated Map #​14654 futurliberta
  • fix(connection): fix up some inconsistencies in operation-end event and add to docs #​14659 #​14648
  • types: avoid inferring Boolean, Buffer, ObjectId as Date in schema definitions under certain circumstances #​14667 #​14630
  • docs: add note about parallelism in transations #​14647 fiws

v8.4.1

Compare Source

==================

v8.4.0

Compare Source

==================

  • feat: upgrade mongodb -> 6.6.2 #​14584
  • feat: add transactionAsyncLocalStorage option to opt in to automatically setting session on all transactions #​14583 #​13889
  • feat: handle initially null driver when instantiating Mongoose for Rollup support #​14577 #​12335
  • feat(mongoose): export omitUndefined() helper #​14582 #​14569
  • feat: add Model.listSearchIndexes() #​14519 #​14450
  • feat(connection): add listDatabases() function #​14506 #​9048
  • feat(schema): add schema-level readConcern option to apply default readConcern for all queries #​14579 #​14511
  • fix(error): remove model property from CastError to avoid printing all model properties to console #​14568 #​14529
  • fix(model): make bulkWrite() and insertMany() throw if throwOnValidationError set and all ops invalid #​14587 #​14572
  • fix(document): ensure transform function passed to toObject() options applies to subdocs #​14600 #​14589
  • types: add inferRawDocType helper #​13900 #​13772
  • types(document): make document _id type default to unknown instead of any #​14541

v8.3.5

Compare Source

==================

  • fix(query): shallow clone $or, $and if merging onto empty query filter #​14580 #​14567
  • types(model+query): pass TInstanceMethods to QueryWithHelpers so populated docs have methods #​14581 #​14574
  • docs(typescript): clarify that setting THydratedDocumentType on schemas is necessary for correct method context #​14575 #​14573

v8.3.4

Compare Source

==================

  • perf(document): avoid cloning options using spread operator for perf reasons #​14565 #​14394
  • fix(query): apply translateAliases before casting to avoid strictMode error when using aliases #​14562 #​14521
  • fix(model): consistent top-level timestamps option for bulkWrite operations
    #​14546 #​14536
  • docs(connections): improve description of connection creation patterns #​14564 #​14528

v8.3.3

Compare Source

==================

  • perf(document): add fast path for applying non-nested virtuals to JSON #​14543
  • fix: make hydrate() recursively hydrate virtual populate docs if hydratedPopulatedDocs is set #​14533 #​14503
  • fix: improve timestamps option handling in bulkWrite #​14546 #​14536 sderrow
  • fix(model): make recompileSchema() overwrite existing document array discriminators #​14527
  • types(schema): correctly infer Array<Schema.Types.*> #​14534 #​14367
  • types(query+populate): apply populate overrides to doc toObject() result #​14525 #​14441
  • types: add null to select override return type for findOne #​14545 sderrow

v8.3.2

Compare Source

==================

v8.3.1

Compare Source

==================

  • fix(document): make update minimization unset property rather than setting to null #​14504 #​14445
  • fix(model): make Model.recompileSchema() also re-apply discriminators #​14500 #​14444
  • fix(schema): deduplicate idGetter so creating multiple models with same schema doesn't result in multiple id getters #​14492
  • fix: update kareem -> 2.6.3 for index.d.ts #​14508 #​14497
  • fix(mongoose): make setDriver() update mongoose.model() connections and collections #​14505
  • types(validation): support function for validator message property, and add support for accessing validator reason #​14499 #​14496
  • docs: remove typo #​14501 epmartini

v8.3.0

Compare Source

==================

v8.2.4

Compare Source

==================

v8.2.3

Compare Source

==================

v8.2.2

Compare Source

==================

v8.2.1

Compare Source

==================

v8.2.0

Compare Source

==================

v8.1.3

Compare Source

==================

  • fix: avoid corrupting $set-ed arrays when transaction error occurs #​14346 #​14340
  • fix(populate): handle ref() functions that return a model instance #​14343 #​14249
  • fix: insert version key when using insertMany even if toObject.versionKey set to false #​14344
  • fix(cursor): make aggregation cursor support transform option to match query cursor #​14348 #​14331
  • docs(document): clarify that transform function option applies to subdocs #​13757

v8.1.2

Compare Source

==================

  • fix: include virtuals in document array toString() output if toObject.virtuals set #​14335 #​14315
  • fix(document): handle setting nested path to spread doc with extra properties #​14287 #​14269
  • fix(populate): call setter on virtual populated path with populated doc instead of undefined #​14314
  • fix(QueryCursor): remove callback parameter of AggregationCursor and QueryCursor #​14299 DevooKim
  • types: add typescript support for arbitrary fields for the options parameter of Model functions which are of type MongooseQueryOptions #​14342 #​14341 FaizBShah
  • types(model): correct return type for findOneAndUpdate with includeResultMetadata and lean set #​14336 #​14303
  • types(connection): add type definition for createCollections() #​14295 #​14279
  • docs(timestamps): clarify that replaceOne() and findOneAndReplace() overwrite timestamps #​14337 #​14309

v8.1.1

Compare Source

==================

  • fix(model): throw readable error when calling Model() with a string instead of model() #​14288 #​14281
  • fix(document): handle setting nested path to spread doc with extra properties #​14287 #​14269
  • types(query): add back context and setDefaultsOnInsert as Mongoose-specific query options #​14284 #​14282
  • types(query): add missing runValidators back to MongooseQueryOptions #​14278 #​14275

v8.1.0

Compare Source

==================

Configuration

📅 Schedule: Branch creation - "" in timezone Europe/London, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Never, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot added the Security label Dec 3, 2024
@github-actions GitHub Actions
Copy link

github-actions bot commented Dec 3, 2024

Oops! Looks like you forgot to update the changelog. When updating CHANGELOG.md, please consider the following:

  • Changelog is read by country implementors who might not always be familiar with all technical details of OpenCRVS. Keep language high-level, user friendly and avoid technical references to internals.
  • Answer "What's new?", "Why was the change made?" and "Why should I care?" for each change.
  • If it's a breaking change, include a migration guide answering "What do I need to do to upgrade?".

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
Security
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
0 participants