Skip to content

[Snyk] Security upgrade mongoose from 5.10.15 to 5.13.3

Bernhard Wittmann requested to merge snyk-fix-9e48d62f4870de07cfb42f7c977d42c4 into main

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this Merge Request

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • package.json
    • package-lock.json

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
medium severity 496/1000
Why? Recently disclosed, Has a fix available, CVSS 4.2		 Information Exposure
SNYK-JS-MONGODB-5871303 		No No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: mongoose The new version differs by 250 commits.
  • 3924628 chore: release 5.13.3
  • 88a32fe Merge pull request #10442 from semirturgay/gh-broken-defaults
  • 66fd25f fix(timestamps): apply timestamps when creating new subdocs with `$addToSet` and with positional operator
  • c6a646c test(timestamps): repro #10447
  • 169f9e1 fix(schema): allow calling `Schema#loadClass()` with class that has a static getter with no setter
  • acd262c test(schema): repro #10436
  • 16b6a37 fix(model): avoid throwing error when `bulkSave()` called on a document with no changes
  • c1ce3c9 test(model): repro #9673
  • ad8ca76 fix(index.d.ts): allow passing ResultType generic to `Schema#path()`
  • 34d2796 fix(index.d.ts): add `discriminator()` for single nested subdocs to type definitions
  • ed1bffb Merge pull request #10452 from DouglasGabr/master
  • 5edb25d fix(index.d.ts): consistently use NativeDate instead of Date for Date validators and timestamps functions
  • 982a389 fix(types): remove discriminator type requirement
  • a22c908 fix(model): fixing model defaults for embedded objects
  • 6250841 chore: update opencollective sponsors
  • c01685a Merge pull request #10440 from AbdelrahmanHafez/patch-10
  • ac545ef test(model): cover applying object defaults
  • ca34cfa bump native driver to 3.6.10
  • e1fcf29 chore: update opencollective sponsors
  • c03cacb chore: release 5.13.2
  • 4482592 style: fix lint
  • 1159631 chore: allow @ types/node 14.x
  • 726ce8b fix: hardcode @ types/node version for now to avoid breaking changes from DefinitelyTyped/DefinitelyTyped#53669
  • d250ddc fix(index.d.ts): allow using `type: Date` with Date paths in SchemaDefinitionType

See the full diff

Check the changes in this Merge Request to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information: 🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.

Merge request reports