Skip to content

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Dec 3, 2024

This PR contains the following updates:

Package Change Age Confidence
mongoose (source) 5.13.20 -> 6.13.6 age confidence

GitHub Vulnerability Alerts

CVE-2024-53900

Mongoose versions prior to 8.8.3, 7.8.3, and 6.13.5 are vulnerable to improper use of the $where operator. This vulnerability arises from the ability of the $where clause to execute arbitrary JavaScript code in MongoDB queries, potentially leading to code injection attacks and unauthorized access or manipulation of database data.

CVE-2025-23061

Mongoose versions prior to 8.9.5, 7.8.4, and 6.13.6 are vulnerable to improper use of the $where operator. This vulnerability arises from the ability of the $where clause to execute arbitrary JavaScript code in MongoDB queries, potentially leading to code injection attacks and unauthorized access or manipulation of database data.

NOTE: this issue exists because of an incomplete fix for CVE-2024-53900.


Release Notes

Automattic/mongoose (mongoose)

v6.13.6

Compare Source

===================

v6.13.5

Compare Source

===================

  • fix: disallow using $where in match

v6.13.4

Compare Source

===================

v6.13.3

Compare Source

===================

  • docs(migrating_to_6): document that Lodash _.isEmpty() with ObjectId() as a parameter returns true in Mongoose 6 #​11152

v6.13.2

Compare Source

===================

  • fix(document): make set() respect merge option on deeply nested objects #​14870 #​14878

v6.13.1

Compare Source

===================

v6.13.0

Compare Source

===================

  • feat(model): add throwOnValidationError option for opting into getting MongooseBulkWriteError if all valid operations succeed in bulkWrite() and insertMany() #​14599 #​14587 #​14572 #​13410

v6.12.9

Compare Source

===================

v6.12.8

Compare Source

===================

  • fix(document): handle virtuals that are stored as objects but getter returns string with toJSON #​14468 #​14446
  • fix(schematype): consistently set wasPopulated to object with value property rather than boolean #​14418
  • docs(model): add extra note about lean option for insertMany() skipping casting #​14415 #​14376

v6.12.7

Compare Source

===================

v6.12.6

Compare Source

===================

  • fix(collection): correctly handle buffer timeouts with find() #​14277
  • fix(document): allow calling push() with different $position arguments #​14254

v6.12.5

Compare Source

===================

  • perf(schema): remove unnecessary lookahead in numeric subpath check
  • fix(document): allow setting nested path to null #​14226
  • fix(document): avoid flattening dotted paths in mixed path underneath nested path #​14198 #​14178
  • fix: add ignoreAtomics option to isModified() for better backwards compatibility with Mongoose 5 #​14213

v6.12.4

Compare Source

===================

  • fix: upgrade mongodb driver -> 4.17.2
  • fix(document): avoid treating nested projection as inclusive when applying defaults #​14173 #​14115
  • fix: account for null values when assigning isNew property #​14172 #​13883

v6.12.3

Compare Source

===================

  • fix(ChangeStream): correctly handle hydrate option when using change stream as stream instead of iterator #​14052
  • fix(schema): fix dangling reference to virtual in tree after removeVirtual() #​14019 #​13085
  • fix(document): avoid unmarking modified on nested path if no initial value stored and already modified #​14053 #​14024
  • fix(document): consistently avoid marking subpaths of nested paths as modified #​14053 #​14022

v6.12.2

Compare Source

===================

v6.12.1

Compare Source

===================

v6.12.0

Compare Source

===================

  • feat: use mongodb driver v4.17.1
  • fix(model): make Model.bulkWrite() with empty array and ordered false not throw an error #​13664
  • fix(document): correctly handle inclusive/exclusive projections when applying subdocument defaults #​13763 #​13720

v6.11.6

Compare Source

===================

v6.11.5

Compare Source

===================

  • fix(schema): make Schema.prototype.clone() avoid creating different copies of subdocuments and single nested paths underneath single nested paths #​13671 #​13626
  • fix: custom debug function not processing all args #​13418

v6.11.4

Compare Source

===================

  • perf: speed up mapOfSubdocs benchmark by 4x by avoiding unnecessary O(n^2) loop in getPathsToValidate() #​13614

v6.11.3

Compare Source

===================

  • fix: avoid prototype pollution on init
  • fix(schema): correctly handle uuids with populate() #​13317 #​13595

v6.11.2

Compare Source

===================

v6.11.1

Compare Source

===================

  • fix(query): apply schema-level paths before calculating projection for findOneAndUpdate() #​13348 #​13340
  • fix: add SUPPRESS_JEST_WARNINGS environment variable to hide jest warnings #​13384 #​13373
  • types(model): allow overwriting expected param type for bulkWrite() #​13292 hasezoey

v6.11.0

Compare Source

===================

v6.10.5

Compare Source

===================

  • perf(document): avoid unnecessary loops, conditionals, string manipulation on Document.prototype.get() for 10x speedup on top-level properties #​12953
  • fix(model): execute valid write operations if calling bulkWrite() with ordered: false #​13218 #​13176
  • fix(array): pass-through all parameters #​13202 #​13201 hasezoey
  • fix: improve error message when sorting by empty string #​13249 #​10182
  • docs: add version support and check version docs #​13251 #​13193

v6.10.4

Compare Source

===================

  • fix(document): apply setters on resulting value when calling Document.prototype.$inc() #​13178 #​13158
  • fix(model): add results property to unordered insertMany() to make it easy to identify exactly which documents were inserted #​13163 #​12791
  • docs(guide+schematypes): add UUID to schematypes guide #​13184

v6.10.3

Compare Source

===================

v6.10.2

Compare Source

===================

  • fix(document): avoid setting array default if document array projected out by sibling projection #​13135 #​13043 #​13003
  • fix(documentarray): set correct document array path if making map of document arrays #​13133
  • fix: undo accidental change to engines in package.json #​13124 lorand-horvath
  • docs: quick improvement to Model.init() docs #​13054

v6.10.1

Compare Source

===================

v6.10.0

Compare Source

===================

v6.9.3

Compare Source

==================

v6.9.2

Compare Source

==================

v6.9.1

Compare Source

==================

  • fix(document): isModified should not be triggered when setting a nested boolean to the same value as previously #​12994 lpizzinidev
  • fix(document): save newly set defaults underneath single nested subdocuments #​13002 #​12905
  • fix(update): handle custom discriminator model name when casting update #​12947 wassil
  • fix(connection): handles unique autoincrement ID for connections #​12990 lpizzinidev
  • fix(types): fix type of options of Model.aggregate #​12933 ghost91-
  • fix(types): fix "near" aggregation operator input type #​12954 Jokero
  • fix(types): add missing Top operator to AccumulatorOperator type declaration #​12952 lpizzinidev
  • docs(transactions): added example for Connection.transaction() method #​12943 #​12934 lpizzinidev
  • docs(populate): fix out of date comment referencing onModel property #​13000
  • docs(transactions): fix typo in transactions.md #​12995 Parth86

v6.9.0

Compare Source

==================

v6.8.4

Compare Source

==================

v6.8.3

Compare Source

==================

  • perf: improve performance of assignRawDocsToIdStructure for faster populate on large docs #​12867 Uzlopak
  • fix(model): ensure consistent ordering of validation errors in insertMany() with ordered: false and rawResult: true #​12866
  • fix: avoid passing final callback to pre hook, because calling the callback can mess up hook execution #​12836
  • fix(types): avoid inferring timestamps if methods, virtuals, or statics set #​12871
  • fix(types): correctly infer string enums on const arrays #​12870 JavaScriptBach
  • fix(types): allow virtuals to be invoked in the definition of other virtuals #​12874 sffc
  • fix(types): add type def for Aggregate#model without arguments #​12864 hasezoey
  • docs(discriminators): add section about changing discriminator key #​12861
  • docs(typescript): explain that virtuals inferred from schema only show up on Model, not raw document type #​12860 #​12684

v6.8.2

Compare Source

==================

  • fix(schema): propagate strictQuery to implicitly created schemas for embedded discriminators #​12827 #​12796
  • fix(model): respect discriminators with Model.validate() #​12824 #​12621
  • fix(query): fix unexpected validation error when doing findOneAndReplace() with a nullish value #​12826 #​12821
  • fix(discriminator): apply built-in plugins to discriminator schema even if mergeHooks and mergePlugins are both false #​12833 #​12696
  • fix(types): add option "overwriteModels" as a schema option #​12817 #​12816 hasezoey
  • fix(types): add property "defaultOptions" #​12818 hasezoey
  • docs: make search bar respect documentation version, so you can search 5.x docs #​12548
  • docs(typescript): make note about recommending strict mode when using auto typed schemas #​12825 #​12420
  • docs: add section on sorting to query docs #​12588 IslandRhythms
  • test(query.test): add write-concern option #​12829 hasezoey

v6.8.1

Compare Source

==================

v6.8.0

Compare Source

==================

v6.7.5

Compare Source

==================

v6.7.4

Compare Source

==================

v6.7.3

Compare Source

==================

v6.7.2

Compare Source

==================

v6.7.1

Compare Source

==================

v6.7.0

Compare Source

==================

  • feat: upgrade to mongodb driver 4.11.0 #​12446
  • feat: add UUID Schema Type (BSON Buffer SubType 4) #​12268 #​3208 hasezoey
  • feat(aggregation): add $fill pipeline stage #​12545 raphael-papazikas
  • feat(types+schema): allow defining schema paths using mongoose.Types.* to work around TS type inference issues #​12352
  • feat(schema): add alias() method that makes it easier to define multiple aliases for a given path #​12368
  • feat(model): add mergeHooks option to Model.discriminator() to avoid duplicate hooks #​12542
  • feat(document): add $timestamps() method to set timestamps for save(), bulkSave(), and insertMany() #​12540

v6.6.7

Compare Source

==================

v6.6.6

Compare Source

==================

  • fix(update): handle runValidators when using $set on a doc array in discriminator schema #​12571 #​12518
  • fix(document): allow creating document with document array and top-level key named schema #​12569 #​12480
  • fix(cast): make schema-level strictQuery override schema-level strict for query filters #​12570 #​12508
  • fix(aggregate): avoid adding extra $match stage if user manually set discriminator key to correct value in first pipeline stage #​12568 #​12478
  • fix: Throws error when updating a key name that match the discriminator key name on nested object #​12534 #​12517 lpizzinidev
  • fix(types): add limit to $filter expression [#​12553](https://redirect.gi

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot added dependencies Pull requests that update a dependency file security labels Dec 3, 2024
@renovate renovate bot assigned timoa Dec 3, 2024
@renovate renovate bot changed the title fix(deps): update dependency mongoose to v8 [security] fix(deps): update dependency mongoose to v8 [security] - autoclosed Dec 4, 2024
@renovate renovate bot closed this Dec 4, 2024
@renovate renovate bot deleted the fix/deps/npm-mongoose-vulnerability branch December 4, 2024 17:46
@renovate renovate bot changed the title fix(deps): update dependency mongoose to v8 [security] - autoclosed fix(deps): update dependency mongoose to v8 [security] Dec 4, 2024
@renovate renovate bot reopened this Dec 4, 2024
@renovate renovate bot force-pushed the fix/deps/npm-mongoose-vulnerability branch from 0b1df70 to 8d870e8 Compare December 4, 2024 20:23
@renovate renovate bot changed the title fix(deps): update dependency mongoose to v8 [security] fix(deps): update dependency mongoose to v6 [security] Dec 4, 2024
Copy link

@github-actions github-actions bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Scan Summary

Tool Critical High Medium Low Status
Dependency Scan (universal) 0 1 2 0
Shell Script Analysis 0 0 0 0
Security Audit for Infrastructure 0 1 0 0

Recommendation

Looks good ✔️

@renovate renovate bot force-pushed the fix/deps/npm-mongoose-vulnerability branch from 8d870e8 to 49d3c32 Compare December 4, 2024 23:14
@renovate renovate bot force-pushed the fix/deps/npm-mongoose-vulnerability branch from 49d3c32 to 56cc659 Compare January 16, 2025 18:37
@renovate renovate bot changed the title fix(deps): update dependency mongoose to v6 [security] fix(deps): update dependency mongoose to v8 [security] Jan 16, 2025
@renovate renovate bot force-pushed the fix/deps/npm-mongoose-vulnerability branch from 56cc659 to dd25089 Compare January 17, 2025 18:18
@renovate renovate bot changed the title fix(deps): update dependency mongoose to v8 [security] fix(deps): update dependency mongoose to v6 [security] Jan 17, 2025
@renovate renovate bot force-pushed the fix/deps/npm-mongoose-vulnerability branch from dd25089 to 20afd4c Compare January 17, 2025 22:06
@renovate renovate bot force-pushed the fix/deps/npm-mongoose-vulnerability branch 2 times, most recently from 28d6d33 to 7e80d28 Compare August 13, 2025 15:36
@renovate renovate bot force-pushed the fix/deps/npm-mongoose-vulnerability branch from 7e80d28 to 72f92aa Compare August 31, 2025 10:34
@renovate renovate bot force-pushed the fix/deps/npm-mongoose-vulnerability branch from 72f92aa to c266702 Compare September 25, 2025 15:00
@renovate renovate bot force-pushed the fix/deps/npm-mongoose-vulnerability branch from c266702 to a7caeb8 Compare October 21, 2025 15:45
@renovate renovate bot force-pushed the fix/deps/npm-mongoose-vulnerability branch from a7caeb8 to a615899 Compare November 11, 2025 01:16
@renovate renovate bot changed the title fix(deps): update dependency mongoose to v6 [security] fix(deps): update dependency mongoose to v6 [security] - autoclosed Nov 12, 2025
@renovate renovate bot closed this Nov 12, 2025
@renovate renovate bot changed the title fix(deps): update dependency mongoose to v6 [security] - autoclosed fix(deps): update dependency mongoose to v6 [security] Nov 13, 2025
@renovate renovate bot reopened this Nov 13, 2025
@renovate renovate bot force-pushed the fix/deps/npm-mongoose-vulnerability branch 2 times, most recently from a615899 to 3e5214a Compare November 13, 2025 21:40
| datasource | package  | from    | to     |
| ---------- | -------- | ------- | ------ |
| npm        | mongoose | 5.13.20 | 6.13.6 |
@renovate renovate bot force-pushed the fix/deps/npm-mongoose-vulnerability branch from 3e5214a to e0c3f02 Compare November 18, 2025 10:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file security

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants