This repository has been archived by the owner on Jun 9, 2023. It is now read-only.
fix(deps): update dependency mongoose to v5.13.15 [security] #319
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
5.12.7
->5.13.15
GitHub Vulnerability Alerts
CVE-2022-2564
Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment.\n\nAffected versions of this package are vulnerable to Prototype Pollution. The
Schema.path()
function is vulnerable to prototype pollution when setting the schema object. This vulnerability allows modification of the Object prototype and could be manipulated into a Denial of Service (DoS) attack.automattic/mongoose vulnerable to Prototype pollution via Schema.path
CVE-2022-2564 / GHSA-f825-f98c-gj3g
More information
Details
Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment.\n\nAffected versions of this package are vulnerable to Prototype Pollution. The
Schema.path()
function is vulnerable to prototype pollution when setting the schema object. This vulnerability allows modification of the Object prototype and could be manipulated into a Denial of Service (DoS) attack.Severity
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
References
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Release Notes
Automattic/mongoose
v5.13.15
Compare Source
====================
v5.13.14
Compare Source
====================
v5.13.13
Compare Source
====================
v5.13.12
Compare Source
====================
v5.13.11
Compare Source
====================
useDb()
#10732v5.13.10
Compare Source
====================
v5.13.9
Compare Source
===================
extends Document
andany
#10647v5.13.8
Compare Source
===================
v5.13.7
Compare Source
===================
Schema#index()
types #10562 JaredReisingerpush()
#10546v5.13.6
Compare Source
===================
next()
to avoid stack overflow with large batch size #10449v5.13.5
Compare Source
===================
depopulate()
with no args depopulates all #10501 gfranczv5.13.4
Compare Source
===================
$setOnInsert
#10460doc
an object with correct keys #10475v5.13.3
Compare Source
===================
$addToSet
and with positional operator #10447discriminator()
with non-document #10452 #10421 DouglasGabrv5.13.2
Compare Source
===================
v5.13.1
Compare Source
====================
v5.13.0
Compare Source
===================
bulkSave()
function that saves multiple docs in 1bulkWrite()
#9727 #9673 AbdelrahmanHafezpathsToSkip
to apply intoObject()
andtoJSON()
#10120diffIndexes()
function that calculates what indexessyncIndexes()
will create/drop without actually executing any changes #10362 IslandRhythmsendSession()
#10306v5.12.15
Compare Source
====================
Schema
for cases when we can't infer from Model #10358Query#cast()
#10388 lkhodiscriminatorKey
schema option #10386 #10376 IslandRhythmsv5.12.14
Compare Source
====================
Model.populate()
#10335ValidationError
as a possible type forValidationError#errors
#10320 IslandRhythmsModel.exists()
#10336 Aminoizv5.12.13
Compare Source
====================
$getAllSubdocs()
#10275findOneAndUpdate()
#10232 #10231 cnwangjiev5.12.12
Compare Source
====================
returnOriginal
withfindOneAndUpdate()
#10298 #10297 #10292 #10285 IslandRhythmsmap()
result an array if used over an array #10288 quantumsheepv5.12.11
Compare Source
====================
v5.12.10
Compare Source
====================
defaults
option on result documents from query options #7287 IslandRhythmspathsToValidate
tovalidate()
andvalidateSync()
#10258loadClass()
on classes that havecollection
as a static property #10257 #10254 IslandRhythmsvirtualsOnly
parameter toloadClass()
function signature IslandRhythmsv5.12.9
Compare Source
===================
options
as first parameter #10216v5.12.8
Compare Source
===================
toJSON()
function to ensurename
property always ends up inJSON.stringify()
output #10166 IslandRhythmsallowDiskUse
option #10177insertMany()
#10144extends Document
#10144UpdateWithAggregationPipeline
for cases whenUpdateQuery
is used as a function param #10186useFindAndModify
anduseCreateIndex
deprecation warnings #10155Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate. View repository job log here.