[Snyk] Security upgrade mongoose from 5.10.15 to 5.13.3
Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.
Changes included in this Merge Request
- Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
- package.json
- package-lock.json
Vulnerabilities that will be fixed
With an upgrade:
Severity | Priority Score (*) | Issue | Breaking Change | Exploit Maturity |
---|---|---|---|---|
496/1000 Why? Recently disclosed, Has a fix available, CVSS 4.2 |
Information Exposure SNYK-JS-MONGODB-5871303 |
No | No Known Exploit |
(*) Note that the real score may have changed since the PR was raised.
Commit messages
Package name: mongoose
The new version differs by 250 commits.- 3924628 chore: release 5.13.3
- 88a32fe Merge pull request #10442 from semirturgay/gh-broken-defaults
- 66fd25f fix(timestamps): apply timestamps when creating new subdocs with `$addToSet` and with positional operator
- c6a646c test(timestamps): repro #10447
- 169f9e1 fix(schema): allow calling `Schema#loadClass()` with class that has a static getter with no setter
- acd262c test(schema): repro #10436
- 16b6a37 fix(model): avoid throwing error when `bulkSave()` called on a document with no changes
- c1ce3c9 test(model): repro #9673
- ad8ca76 fix(index.d.ts): allow passing ResultType generic to `Schema#path()`
- 34d2796 fix(index.d.ts): add `discriminator()` for single nested subdocs to type definitions
- ed1bffb Merge pull request #10452 from DouglasGabr/master
- 5edb25d fix(index.d.ts): consistently use NativeDate instead of Date for Date validators and timestamps functions
- 982a389 fix(types): remove discriminator type requirement
- a22c908 fix(model): fixing model defaults for embedded objects
- 6250841 chore: update opencollective sponsors
- c01685a Merge pull request #10440 from AbdelrahmanHafez/patch-10
- ac545ef test(model): cover applying object defaults
- ca34cfa bump native driver to 3.6.10
- e1fcf29 chore: update opencollective sponsors
- c03cacb chore: release 5.13.2
- 4482592 style: fix lint
- 1159631 chore: allow @ types/node 14.x
- 726ce8b fix: hardcode @ types/node version for now to avoid breaking changes from DefinitelyTyped/DefinitelyTyped#53669
- d250ddc fix(index.d.ts): allow using `type: Date` with Date paths in SchemaDefinitionType
Check the changes in this Merge Request to ensure they won't cause issues with your project.
Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.
For more information: 🧐 View latest project report
Learn how to fix vulnerabilities with free interactive lessons: