fix(deps): update dependency mongoose to v8.9.5 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
mongoose (source)	8.4.1 -> 8.9.5

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

GitHub Vulnerability Alerts

CVE-2024-53900

Mongoose versions prior to 8.8.3, 7.8.3, and 6.13.5 are vulnerable to improper use of the $where operator. This vulnerability arises from the ability of the $where clause to execute arbitrary JavaScript code in MongoDB queries, potentially leading to code injection attacks and unauthorized access or manipulation of database data.

CVE-2025-23061

Mongoose versions prior to 8.9.5, 7.8.4, and 6.13.6 are vulnerable to improper use of the $where operator. This vulnerability arises from the ability of the $where clause to execute arbitrary JavaScript code in MongoDB queries, potentially leading to code injection attacks and unauthorized access or manipulation of database data.

NOTE: this issue exists because of an incomplete fix for CVE-2024-53900.

---

Release Notes

Automattic/mongoose (mongoose)

v8.9.5

Compare Source

==================

• fix: disallow nested $where in populate match CVE-2025-23061
• fix(schema): handle bitwise operators on Int32 #​15176 #​15170

v8.9.4

Compare Source

==================

• fix(document): fix document not applying manual populate when using a function in schema.options.ref #​15138 IchirokuXVI
• fix(model): make Model.validate() static correctly cast document arrays #​15169 #​15164
• fix(model): allow passing validateBeforeSave option to bulkSave() to skip validation #​15161 #​15156
• fix(schema): allow multiple self-referencing discriminator schemas using Schema.prototype.discriminator #​15142 #​15120
• types: avoid BufferToBinary<> wiping lean types when passed to generic functions #​15160 #​15158
• docs: fix <code> in header ids #​15159
• docs: fix header in field-level-encryption.md #​15137 damieng

v8.9.3

Compare Source

==================

• fix(schema): make duplicate index error a warning for now to prevent blocking upgrading #​15135 #​15112 #​15109
• fix(model): handle document array paths set to non-array values in Model.castObject() #​15124 #​15075
• fix(document): avoid using childSchemas.path for compatibility with pre-Mongoose-8.8 schemas #​15131 #​15071
• fix(model): avoid throwing unnecessary error if updateOne() returns null in save() #​15126
• perf(cursor): clear the stack every time if using populate with batchSize to avoid stack overflows with large docs #​15136 #​10449
• types: make BufferToBinary avoid Document instances #​15123 #​15122
• types(model+query): avoid stripping out virtuals when calling populate with paths generic #​15132 #​15111
• types(schema): add missing removeIndex #​15134
• types: add cleanIndexes() to IndexManager interface #​15127
• docs: move search endpoint to netlify #​15119

v8.9.2

Compare Source

==================

• fix(schema): avoid throwing duplicate index error if index spec keys have different order or index has a custom name #​15112 #​15109
• fix(map): clean modified subpaths when overwriting values in map of subdocs #​15114 #​15108
• fix(aggregate): pull session from transaction local storage for aggregation cursors #​15094 IchirokuXVI
• types: correctly handle union types in BufferToBinary and related helpers #​15103 #​15102 #​15057
• types: add UUID to RefType #​15115 #​15101
• docs: remove link to Mongoose 5.x docs from dropdown #​15116
• docs(connection+document+model): remove remaining references to remove(), clarify that deleteOne() does not execute until then() or exec() #​15113 #​15107

v8.9.1

Compare Source

==================

• fix(connection): remove heartbeat check in load balanced mode #​15089 #​15042 #​14812
• fix(discriminator): gather childSchemas when creating discriminator to ensure $getAllSubdocs() can properly get all subdocs #​15099 #​15088 #​15092
• fix(model): handle discriminators in castObject() #​15096 #​15075
• fix(schema): throw error if duplicate index definition using unique in schema path and subsequent .index() call #​15093 #​15056
• fix: mark documents that are populated using hydratedPopulatedDocs option as populated in top-level doc #​15080 #​15048
• fix(document+schema): improve error message for get() on invalid path #​15098 #​15071
• docs: remove more callback doc references & some small other changes #​15095

v8.9.0

Compare Source

==================

• feat: upgrade mongodb -> 6.12
• feat: add int32 schematype #​15054 aditi-khare-mongoDB
• feat: add double schematype #​15061 aditi-khare-mongoDB
• feat: allow specifying error message override for duplicate key errors unique: true #​15059 #​12844
• feat(connection): add support for Connection.prototype.bulkWrite() with MongoDB server 8.0 #​15058 #​15028
• feat: add forceRepopulate option for populate() to allow avoiding repopulating already populated docs #​15044 #​14979
• fix(connection): remove heartbeat check in load balanced mode #​15089 #​15042
• fix(query): clone PopulateOptions when setting _localModel to avoid state leaking between subpopulate instances #​15082 #​15026
• types: add splice() to DocumentArray to allow adding partial objects with splice() #​15085 #​15041
• types(aggregate): add $firstN, $lastN, $bottom, $bottomN, $minN and $maxN operators #​15087 mlomnicki
• docs: Remove merge conflict markers #​15090 sponrad

v8.8.4

Compare Source

==================

• fix: cast using overwritten embedded discriminator key when set #​15076 #​15051
• fix: avoid throwing error if saveOptions undefined when invalidating subdoc cache #​15062

v8.8.3

Compare Source

==================

• fix: disallow using $where in match
• perf: cache results from getAllSubdocs() on saveOptions, only loop through known subdoc properties #​15055 #​15029
• fix(model+query): support overwriteDiscriminatorKey for bulkWrite updateOne and updateMany, allow inferring discriminator key from update #​15046 #​15040

v8.8.2

Compare Source

==================

• fix(model): handle array filters when casting bulkWrite #​15036 #​14978
• fix(model): make diffIndexes() avoid trying to drop default timeseries collection index #​15035 #​14984
• fix: save execution stack in query as string #​15039 durran
• types(cursor): correct asyncIterator and asyncDispose for TypeScript with lib: 'esnext' #​15038
• docs(migrating_to_8): add note about removing findByIdAndRemove #​15024 dragontaek-lee

v8.8.1

Compare Source

==================

• perf: make a few micro-optimizations to help speed up findOne() #​15022 #​14906
• fix: apply embedded discriminators to subdoc schemas before compiling top level model so middleware applies correctly #​15001 #​14961
• fix(query): add overwriteImmutable option to allow updating immutable properties without disabling strict mode #​15000 #​8619

v8.8.0

Compare Source

==================

• feat: upgrade mongodb -> ~6.10 #​14991 #​14877
• feat(query): add schemaLevelProjections option to query to disable schema-level select: false #​14986 #​11474
• feat: allow defining virtuals on arrays, not just array elements #​14955 #​2326
• feat(model): add applyTimestamps() function to apply all schema timestamps, including subdocuments, to a given POJO #​14943 #​14698
• feat(model): add hideIndexes option to syncIndexes() and cleanIndexes() #​14987 #​14868
• fix(query): make sanitizeFilter disable implicit $in #​14985 #​14657
• fix(model): avoid unhandled error if createIndex() throws a sync error #​14995
• fix(model): avoid throwing TypeError if bulkSave()'s bulkWrite() fails with a non-BulkWriteError #​14993
• types: added toJSON:flattenObjectIds effect #​14989
• types: add __v to lean() result type and ModifyResult #​14990 #​12959
• types: use globalThis instead of global for NativeDate #​14992 #​14988
• docs(change-streams): fix markdown syntax highlighting for script output example #​14994

v8.7.3

Compare Source

==================

• fix(cursor): close underlying query cursor when calling destroy() #​14982 #​14966
• types: add JSONSerialized helper that can convert HydratedDocument to JSON output type #​14981 #​14451
• types(model): convert InsertManyResult to interface and remove unnecessary insertedIds override #​14977
• types(connection): add missing sanitizeFilter option #​14975
• types: improve goto definition for inferred schema definitions #​14968 forivall
• docs(migration-guide-v7): correct link to the section "Id Setter" #​14973 rb-ntnx

v8.7.2

Compare Source

==================

• fix(document): recursively clear modified subpaths when setting deeply nested subdoc to null #​14963 #​14952
• fix(populate): handle array of ids with parent refPath #​14965
• types: make Buffers into mongodb.Binary in lean result type to match runtime behavior #​14967
• types: correct schema type inference when using nested typeKey like type: { type: String } #​14956 #​14950
• types: re-export DeleteResult and UpdateResult from MongoDB Node.js driver #​14947 #​14946
• docs(documents): add section on setting deeply nested properties, including warning about nullish coalescing assignment #​14972
• docs(model): add more info on acknowledged: false, specifically that Mongoose may return that if the update was empty #​14957

v8.7.1

Compare Source

==================

• fix: set flattenObjectIds to false when calling toObject() for internal purposes #​14938
• fix: add mongodb 8 to test matrix #​14937
• fix: handle buffers stored in MongoDB as EJSON representation with { $binary } #​14932
• docs: indicate that Mongoose 8.7 is required for full MongoDB 8 support #​14937

v8.7.0

Compare Source

==================

• feat(model): add Model.applyVirtuals() to apply virtuals to a POJO #​14905 #​14818
• feat: upgrade mongodb -> 6.9.0 #​14914
• feat(query): cast $rename to string #​14887 #​3027
• feat(SchemaType): add getEmbeddedSchemaType() method to SchemaTypes #​14880 #​8389
• fix(model): throw MongooseBulkSaveIncompleteError if bulkSave() didn't completely succeed #​14884 #​14763
• fix(connection): avoid returning readyState = connected if connection state is stale #​14812 #​14727
• fix: depopulate if push() or addToSet() with an ObjectId on a populated array #​14883 #​1635
• types: make __v a number, only set __v on top-level documents #​14892

v8.6.4

Compare Source

==================

• fix(document): avoid massive perf degradation when saving new doc with 10 level deep subdocs #​14910 #​14897
• fix(model): skip applying static hooks by default if static name conflicts with aggregate middleware #​14904 dragontaek-lee
• fix(model): filter applying static hooks by default if static name conflicts with mongoose middleware #​14908 dragontaek-lee

v8.6.3

Compare Source

==================

• fix: make getters convert uuid to string when calling toObject() and toJSON() #​14890 #​14869
• fix: fix missing Aggregate re-exports for ESM #​14886 wongsean
• types(document): add generic param to depopulate() to allow updating properties #​14891 #​14876

v8.6.2

Compare Source

==================

• fix: make set merge deeply nested objects #​14870 #​14861 ianHeydoc
• types: allow arbitrary keys in query filters again (revert #​14764) #​14874 #​14863 #​14862 #​14842
• types: make SchemaType static setters property accessible in TypeScript #​14881 #​14879
• type(inferrawdoctype): infer Date types as JS dates rather than Mongoose SchemaType Date #​14882 #​14839

v8.6.1

Compare Source

==================

• fix(document): avoid unnecessary clone() in applyGetters() that was preventing getters from running on 3-level deep subdocuments #​14844 #​14840 #​14835
• fix(model): throw error if bulkSave() did not insert or update any documents #​14837 #​14763
• fix(cursor): throw error in ChangeStream constructor if changeStreamThunk() throws a sync error #​14846
• types(query): add $expr to RootQuerySelector #​14845
• docs: update populate.md to fix missing match: { } #​14847 makhoulshbeeb

v8.6.0

Compare Source

==================

• feat: upgrade mongodb -> 6.8.0, handle throwing error on closed cursor in Mongoose with MongooseError instead of MongoCursorExhaustedError #​14813
• feat(model+query): support options parameter for distinct() #​14772 #​8006
• feat(QueryCursor): add getDriverCursor() function that returns the raw driver cursor #​14745
• types: change query selector to disallow unknown top-level keys by default #​14764 alex-statsig
• types: make toObject() and toJSON() not generic by default to avoid type widening #​14819 #​12883
• types: avoid automatically inferring lean result type when assigning to explicitly typed variable #​14734

v8.5.5

Compare Source

==================

• fix(populate): fix a couple of other places where Mongoose gets the document's _id with getters #​14833 #​14827 #​14759
• fix(discriminator): shallow clone Schema.prototype.obj before merging schemas to avoid modifying original obj #​14821
• types: fix schema type based on timestamps schema options value #​14829 #​14825 ark23CIS

v8.5.4

Compare Source

==================

• fix: add empty string check for collection name passed #​14806 Shubham2552
• docs(model): add 'throw' as valid strict value for bulkWrite() and add some more clarification on throwOnValidationError #​14809

v8.5.3

Compare Source

==================

• fix(document): call required functions on subdocuments underneath nested paths with correct context #​14801 #​14788
• fix(populate): avoid throwing error when no result and lean() set #​14799 #​14794 #​14759 MohOraby
• fix(document): apply virtuals to subdocuments if parent schema has virtuals: true for backwards compatibility #​14774 #​14771 #​14623 #​14394
• types: make HydratedSingleSubdocument and HydratedArraySubdocument merge types instead of using & #​14800 #​14793
• types: support schema type inference based on schema options timestamps as well #​14773 #​13215 ark23CIS
• types(cursor): indicate that cursor.next() can return null #​14798 #​14787
• types: allow mongoose.connection.db to be undefined #​14797 #​14789
• docs: add schema type widening advice #​14790 JstnMcBrd

v8.5.2

Compare Source

==================

• perf(clone): avoid further unnecessary checks if cloning a primitive value #​14762 #​14394
• fix: allow setting document array default to null #​14769 #​14717 #​6691
• fix(model): support session: null option for save() to opt out of automatic session option with transactionAsyncLocalStorage #​14744 #​14736
• fix(model+document): avoid depopulating manually populated doc as getter value #​14760 #​14759
• fix: correct shardkey access in buildBulkWriteOps #​14753 #​14752 adf0nt3s
• fix(query): handle casting $switch in $expr #​14755 #​14751
• types: allow calling SchemaType.cast() without parent and init parameters #​14756 #​14748 #​9076
• docs: fix a wrong example in v6 migration guide #​14758 abdelrahman-elkady

v8.5.1

Compare Source

==================

• perf(model): performance improvements for insertMany() #​14724
• fix(model): avoid leaving subdoc defaults on top-level doc when setting subdocument to same value #​14728 #​14722
• fix(model): handle transactionAsyncLocalStorage option with insertMany() #​14743
• types: make _id required on Document type #​14735 #​14660
• types: fix ChangeStream.close to return a Promise like the driver #​14740 orgads

v8.5.0

Compare Source

==================

• perf: memoize toJSON / toObject default options #​14672
• feat(document): add $createModifiedPathsSnapshot(), $restoreModifiedPathsSnapshot(), $clearModifiedPaths() #​14699 #​14268
• feat(query): make sanitizeProjection prevent projecting in paths deselected in the schema #​14691
• feat: allow setting array default value to null #​14717 #​6691
• feat(mongoose): allow drivers to set global plugins #​14682
• feat(connection): bubble up monitorCommands events to Mongoose connection if monitorCommands option set #​14681 #​14611
• fix(document): ensure post('deleteOne') hooks are called when calling save() after subdoc.deleteOne() #​14732 #​9885
• fix(query): remove count() and findOneAndRemove() from query chaining #​14692 #​14689
• fix: remove default connection if setting createInitialConnection to false after Mongoose instance created #​14679 #​8302
• types(models+query): infer return type from schema for 1-level deep nested paths #​14632
• types(connection): make transaction() return type match the executor function #​14661 #​14656
• docs: fix docs links in index.md mirasayon

v8.4.5

Compare Source

==================

• types: correct this for validate.validator schematype option #​14720 #​14696
• docs(model): note that insertMany() with lean skips applying defaults #​14723 #​14698

v8.4.4

Compare Source

==================

• perf: avoid unnecesary get() call and use faster approach for converting to string #​14673 #​14394
• fix(projection): handle projections on arrays in Model.hydrate() projection option #​14686 #​14680
• fix(document): avoid passing validateModifiedOnly to subdocs so subdocs get fully validating if they're directly modified #​14685 #​14677
• fix: handle casting primitive array with $elemMatch in bulkWrite() #​14687 #​14678
• fix(query): cast $pull using embedded discriminator schema when discriminator key is set in filter #​14676 #​14675
• types(connection): fix return type of withSession() #​14690 tt-public
• types: add $documents pipeline stage and fix $unionWith type #​14666 nick-statsig
• docs(findoneandupdate): improve example that shows findOneAndUpdate() returning doc before updates were applied #​14671 #​14670

v8.4.3

Compare Source

==================

• fix: remove 0x flamegraph files from release

v8.4.2

Compare Source

==================

• perf: more toObject() perf improvements #​14623 #​14606 #​14394
• fix(model): check the value of overwriteModels in options when calling discriminator() #​14646 uditha-g
• fix: avoid throwing TypeError when deleting an null entry on a populated Map #​14654 futurliberta
• fix(connection): fix up some inconsistencies in operation-end event and add to docs #​14659 #​14648
• types: avoid inferring Boolean, Buffer, ObjectId as Date in schema definitions under certain circumstances #​14667 #​14630
• docs: add note about parallelism in transations #​14647 fiws

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[socket-security]

Updated dependencies detected. Learn more about Socket for GitHub ↗︎

Package	New capabilities	Transitives	Size	Publisher
npm/mongoose@8.9.5 🔁 npm/mongoose@8.4.1	Transitive: eval, filesystem, shell	+91	16.9 MB	aaron, rauchg, tjholowaychuk, ...1 more

View full report↗︎

The merge-base changed after approval.

[renovate]

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update (8.9.5). You will get a PR once a newer version is released. To ignore this dependency forever, add it to the ignoreDeps array of your Renovate config.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.