🚨 [security] Update mongoose 6.8.2 → 8.9.5 (major)

[depfu]

---

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

---

Here is everything you need to know about this upgrade. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ mongoose (6.8.2 → 8.9.5) · Repo · Changelog

Security Advisories 🚨

🚨 Mongoose search injection vulnerability

Mongoose before 8.9.5 can improperly use a nested $where filter with a populate() match, leading to search injection. NOTE: this issue exists because of an incomplete fix for CVE-2024-53900.

🚨 Mongoose search injection vulnerability

Mongoose versions prior to 8.8.3, 7.8.3, and 6.13.5 are vulnerable to improper use of the $where operator. This vulnerability arises from the ability of the $where clause to execute arbitrary JavaScript code in MongoDB queries, potentially leading to code injection attacks and unauthorized access or manipulation of database data.

🚨 Mongoose search injection vulnerability

Mongoose versions prior to 8.8.3, 7.8.3, and 6.13.5 are vulnerable to improper use of the $where operator. This vulnerability arises from the ability of the $where clause to execute arbitrary JavaScript code in MongoDB queries, potentially leading to code injection attacks and unauthorized access or manipulation of database data.

🚨 Mongoose search injection vulnerability

Mongoose versions prior to 8.8.3, 7.8.3, and 6.13.5 are vulnerable to improper use of the $where operator. This vulnerability arises from the ability of the $where clause to execute arbitrary JavaScript code in MongoDB queries, potentially leading to code injection attacks and unauthorized access or manipulation of database data.

🚨 Mongoose Prototype Pollution vulnerability

Prototype Pollution in GitHub repository automattic/mongoose prior to 7.3.3, 6.11.3, and 5.13.20.

🚨 Mongoose Prototype Pollution vulnerability

Prototype Pollution in GitHub repository automattic/mongoose prior to 7.3.3, 6.11.3, and 5.13.20.

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by 10 commits:

• chore: release 8.9.5
• Merge branch '7.x'
• chore: release 7.8.4
• Merge branch '6.x' into 7.x
• chore: release 6.13.6
• fix: disallow nested $where in populate match
• Merge pull request #15176 from Automattic/vkarpov15/gh-15170
• test: make test cast non-boolean value
• fix(schema): handle bitwise operators on Int32
• docs: quick changelog formatting fix

↗️ @​types/webidl-conversions (indirect, 7.0.0 → 7.0.3) · Repo

Sorry, we couldn't find anything useful about this release.

↗️ @​types/whatwg-url (indirect, 8.2.2 → 11.0.5) · Repo

Sorry, we couldn't find anything useful about this release.

↗️ bson (indirect, 4.7.0 → 6.10.1) · Repo · Changelog

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ kareem (indirect, 2.5.0 → 2.6.3) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by 18 commits:

• chore: release 2.6.3
• chore: update npmignore to exclude a couple of extraneous files
• chore: release 2.6.2
• fix: publish all files by default
• chore: release 2.6.1
• chore: release 2.6.0
• Merge pull request #35 from hasezoey/updateUrl
• Merge pull request #37 from mongoosejs/vkarpov15/typescript
• improve typings for options
• add declare and fix other issues with typescript types
• add typescript types
• create SECURITY.md
• chore: release 2.5.1
• Merge pull request #36 from mongoosejs/vkarpov15/mongoose-12836
• avoid passing final callback to pre hook, because calling the callback can mess up hook execution
• docs(README): remove coverage status, because it is currently not submitted
• docs(README): update build ci badge to github-ci
• chore(package.json): update repository url for moved package

↗️ mongodb (indirect, 4.12.1 → 6.12.0) · Repo · Changelog

Security Advisories 🚨

🚨 MongoDB Driver may publish events containing authentication-related data

Some MongoDB Drivers may erroneously publish events containing authentication-related data to a command listener configured by an application. The published events may contain security-sensitive data when specific authentication-related commands are executed.

Without due care, an application may inadvertently expose this sensitive information, e.g., by writing it to a log file. This issue only arises if an application enables the command listener feature (this is not enabled by default).

This issue affects the MongoDB C Driver 1.0.0 prior to 1.17.7, MongoDB PHP Driver 1.0.0 prior to 1.9.2, MongoDB Swift Driver 1.0.0 prior to 1.1.1, MongoDB Node.js Driver 3.6 prior to 3.6.10, MongoDB Node.js Driver 4.0 prior to 4.17.0 and MongoDB Node.js Driver 5.0 prior to 5.8.0. This issue also affects users of the MongoDB C++ Driver dependent on the C driver 1.0.0 prior to 1.17.7 (C++ driver prior to 3.7.0).

🚨 MongoDB Driver may publish events containing authentication-related data

Some MongoDB Drivers may erroneously publish events containing authentication-related data to a command listener configured by an application. The published events may contain security-sensitive data when specific authentication-related commands are executed.

Without due care, an application may inadvertently expose this sensitive information, e.g., by writing it to a log file. This issue only arises if an application enables the command listener feature (this is not enabled by default).

This issue affects the MongoDB C Driver 1.0.0 prior to 1.17.7, MongoDB PHP Driver 1.0.0 prior to 1.9.2, MongoDB Swift Driver 1.0.0 prior to 1.1.1, MongoDB Node.js Driver 3.6 prior to 3.6.10, MongoDB Node.js Driver 4.0 prior to 4.17.0 and MongoDB Node.js Driver 5.0 prior to 5.8.0. This issue also affects users of the MongoDB C++ Driver dependent on the C driver 1.0.0 prior to 1.17.7 (C++ driver prior to 3.7.0).

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ mongodb-connection-string-url (indirect, 2.6.0 → 3.0.2) · Repo · Changelog

Release Notes

3.0.2

3.0.2 (2025-01-14)

The MongoDB Node.js team is pleased to announce version 3.0.2 of the mongodb-connection-string-url package!

Release Notes

This release updates the whatwg-url dependency to either be 13.x or 14.x as either works with this package. Ensuring you have 14 installed in your dependency tree should address the deprecation warning related to 'punycode'

• Changelog

We invite you to try the mongodb-connection-string-url library immediately, and report any issues to the NODE project.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 21 commits:

• chore(main): release 3.0.2 (#38)
• chore: add package-lock.json file (#56)
• chore(deps-dev): bump eslint-plugin-standard from 4.1.0 to 5.0.0 (#46)
• chore(deps-dev): bump mocha from 8.4.0 to 11.0.1 (#52)
• chore(deps): allow both of whatwg-url 13.x and 14.x (#54)
• ci(NODE-6562): add Node.js 22 to ci matrix (#45)
• chore(deps-dev): bump @types/chai from 4.3.20 to 5.0.1 (#43)
• chore(deps-dev): bump @types/node from 14.18.63 to 22.9.0 (#42)
• chore(deps-dev): bump eslint-plugin-promise from 4.3.1 to 7.1.0 (#40)
• chore(NODE-6514): remove dependencies not in module (#44)
• chore(NODE-6514): update dependabot config (#37)
• chore: add HISTORY.md
• chore: bootstrap releases for path (#35)
• Merge pull request #34 from mongodb-js/NODE-5389-automate-release
• fix: markdown
• chore(NODE-5389): add release automation
• 3.0.1
• ci(NODE-6036): upgrade gha and add dependabot (#33)
• 3.0.0
• feat!: bump supported Node.js version range (#32)
• fix: update whatwg-url version due to deprecation warning (#31)

↗️ mquery (indirect, 4.0.3 → 5.0.0) · Repo · Changelog

Release Notes

5.0.0 (from changelog)

• BREAKING CHANGE: drop callback support #137 hasezoey
• BREAKING CHANGE: remove custom promise library support #137 hasezoey
• BREAKING CHANGE: remove long deprecated update, remove functions #136 hasezoey
• BREAKING CHANGE: remove collection ducktyping: first param to mquery() is now always the query filter #138
• feat: support MongoDB Node driver 5 #137 hasezoey

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 53 commits:

• chore: release 5.0.0
• Merge pull request #138 from mongoosejs/vkarpov15/remove-ducktyping
• BREAKING CHANGE: remove support for `mquery(collection)`, first param is always filter
• fix couple of merge conflicts from #136
• Merge pull request #136 from hasezoey/removeOldQueryFn
• Merge branch 'master' into removeOldQueryFn
• Merge pull request #137 from hasezoey/updateMongoDriver
• feat: remove node 12 support
• chore(package.json): actually let mocha exit after finished
• docs(README): de-duplicate header names
• docs(README): various style fixes
• docs(README): update for async use
• test: update tests for async
• fix(mquery): rename cache "_distinct" to "_distinctDoc" to not conflict with the function
• fix(mquery): rename cache "_update" to "_updateDoc" to not conflict with the function
• fix(collection/node): add workarounds for removal of "remove" and "update"
• fix(mquery): actually use parameters to ".then"
• feat(collection/node): convert to promises
• feat(utils): remove function "tick"
• feat(mquery): remove "Query.Promise"
• feat(mquery): remove function "Query.prototype.thunk"
• feat(mquery): remove function "Query.prototype._wrapCallback"
• feat(mquery): change most functions to be builder / executer
• fix(mquery): update conditions for selecting if the input is a collection
• test: update test utils to use promises for setup
• deps: update mongodb to "5.x"
• test: remove "update" from "stream -> throws"
• feat: remove "snapshot"
• feat: remove "maxScan"
• feat: remove "update"
• feat: remove "remove"
• Merge pull request #135 from hasezoey/github
• Merge pull request #134 from hasezoey/modernize
• chore: change from "files"-property to ".npmignore"
• chore(travis.yml): remove file
• chore(github/workflows): add test workflow
• chore: add issue & pull request template
• style: apply updated eslint config
• chore(eslintrc): update file with modified version from mongoose
• chore(README): add link to empty link place
• chore(README): add proper code blocks for script executions
• chore(README): consistenize indent of lists
• chore(README): lower size of seperators
• chore(README): format TOC
• style(mquery): remove empty space between jsdoc comments
• style(mquery): add missing spaces for example code in JSDOC
• style(mquery): change "Note" headers to be consistent
• style(mquery): add missing ":" to headers
• style(mquery): change headers to have a space
• chore(.eslintignore): remove file
• chore(package.json): add "files" property
• chore(Makefile): remove unused file
• chore(gitignore): add yarn.lock

↗️ punycode (indirect, 2.1.1 → 2.3.1) · Repo

Commits

See the full diff on Github. The new version differs by 25 commits:

• Release v2.3.1
• Prepare v2.3.1 release
• Update `version`
• ci(deps): update GitHub Actions workflows to run on Node.js 20 (LTS) (#130)
• Update dependencies (#128)
• Fix broken reference
• Add README section for maintainers
• Release v2.3.0
• Rename package.json#name before publishing `punycode.js`
• Release v2.2.2
• Update repo URL
• Add jsDelivr hits badge (#69)
• Update mocha dependency (#103)
• Set up GitHub Actions
• Add test for #115
• Do not encode DEL (#115)
• Update browser support section in README (#118)
• Replace `let` with `const` where applicable (#93)
• Release v2.2.1
• Do not decode non-ASCII-alphanumerics in Punycode labels (#124)
• Release v2.2.0
• fix: upstream node.js changes (#121)
• fix: update jsdoc definitions (#120)
• Fix usage instructions in README (#113)
• Add LTS Node.js version to CI settings (#92)

↗️ sift (indirect, 16.0.1 → 17.1.3) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by 2 commits:

• 17.1.3
• fix #269

↗️ tr46 (indirect, 3.0.0 → 5.0.0) · Repo

Commits

See the full diff on Github. The new version differs by 17 commits:

• 5.0.0
• Update to follow the TR46 rev 31
• Update web platform tests
• Use logical assignment operators
• Move to Node's built-in test runner
• Update dependencies and move from yarn to npm
• Raise minimum Node.js version to v18
• Reflect the change from master to main
• v4.1.1
• Fix empty label handling
• Improve automation of regexp generation
• Remove installation instructions
• 4.1.0
• Update tables to Unicode 15
• 4.0.0
• Require punycode with trailing slash
• Update dependencies and minimum Node version

↗️ whatwg-url (indirect, 11.0.0 → 14.1.0) · Repo

Release Notes

14.1.0

Added URL.parse(), per whatwg/url@58acb06.

14.0.0

Breaking change: removed Node.js v16 support.

13.0.0

Breaking change: removed Node.js v14 support.

Added URL.canParse(), per whatwg/url@ae3c28b.

Added URLSearchParams's size getter, per whatwg/url@12b6f0c.

Added optional second value argument to URLSearchParams's has() and delete() methods, per whatwg/url@bfb9157.

Changed the serialization of the origin of blob: URLs whose inner URLs were not http: or https: to be "null", per whatwg/url@eee49fd.

12.0.1

Updated our tr46 dependency, which brings along several fixes related to international domain names. Such as:

• Empty domain name labels, as in https://xn--4-0bd15808a.../, no longer cause URL parsing to fail.
• Invalid punycode-encoded domain name labels, as in http://xn--ls8h=/, now correctly cause URL parsing to fail.
• Includes support for Unicode 15.0.0.

As part of this, we are now running against the newly-introduced test data derived from the Unicode Consortium-maintained IdnaTestV2.txt file, and passing them all.

12.0.0

Breaking change: removed Node.js v12 support.

Changed the characters allowed in domains vs. generic hosts, per whatwg/url@35e195a.

Changed the URL API's search and hash setters, as well as the URLSearchParams API, to always ensure the URL is serialize-parse roundtrippable, per whatwg/url@fdaa0e5.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 43 commits:

• 14.1.0
• Roll tests
• Match the spec's "find the IPv6 address compressed piece index"
• Implement URL.parse()
• Update dev dependencies
• Incorporate editorial updates
• Fix specification link for percentDecodeString()
• Remove DOMException dev dependency
• 14.0.0
• Use official GitHub Actions for live viewer deployment
• Update web platform tests
• Move from Jest to Node.js test runner and c8
• Update dependencies and dev dependencies
• Raise minimum Node.js version to v18
• Reflect the change from master to main
• 13.0.0
• Require Node v16+; update dev dependencies
• Change blob: URL origin serialization for inner non-http(s): URL
• Implement value argument for URLSearchParams has() and delete()
• Implement URL.canParse()
• Implement URLSearchParam's size
• Overhaul the test runner
• 12.0.1
• Update dev dependencies
• Upgrade tr46 dependency to fix IDNA issues
• 12.0.0
• Ensure the URL API roundtrips for opaque paths
• Live viewer: rename "URL" field to "input"
• Live viewer: add escape support
• Live viewer: remove another IE-ism
• Live viewer: update the UI and fragment on load
• Live viewer: don't generate new history entries
• Live viewer: stop using iframes
• Live viewer: switch to using modules
• Live viewer: stop using duplicate IDs
• Live viewer: display the origin too
• Update dev dependencies
• Update dependencies and require Node v14
• Update specification and test commit SHAs
• Split forbidden host/domain code-points
• Live viewer: fix empty string URL inputs in shared links
• Live viewer: switch from browserify to esbuild
• Simplify cannotHaveAUsernamePasswordPort

🆕 @​mongodb-js/saslprep (added, 1.1.9)

🗑️ @​aws-crypto/ie11-detection (removed)

🗑️ @​aws-crypto/sha256-browser (removed)

🗑️ @​aws-crypto/sha256-js (removed)

🗑️ @​aws-crypto/supports-web-crypto (removed)

🗑️ @​aws-crypto/util (removed)

🗑️ @​aws-sdk/abort-controller (removed)

🗑️ @​aws-sdk/client-cognito-identity (removed)

🗑️ @​aws-sdk/client-sso (removed)

🗑️ @​aws-sdk/client-sso-oidc (removed)

🗑️ @​aws-sdk/client-sts (removed)

🗑️ @​aws-sdk/config-resolver (removed)

🗑️ @​aws-sdk/credential-provider-cognito-identity (removed)

🗑️ @​aws-sdk/credential-provider-env (removed)

🗑️ @​aws-sdk/credential-provider-imds (removed)

🗑️ @​aws-sdk/credential-provider-ini (removed)

🗑️ @​aws-sdk/credential-provider-node (removed)

🗑️ @​aws-sdk/credential-provider-process (removed)

🗑️ @​aws-sdk/credential-provider-sso (removed)

🗑️ @​aws-sdk/credential-provider-web-identity (removed)

🗑️ @​aws-sdk/credential-providers (removed)

🗑️ @​aws-sdk/fetch-http-handler (removed)

🗑️ @​aws-sdk/hash-node (removed)

🗑️ @​aws-sdk/invalid-dependency (removed)

🗑️ @​aws-sdk/is-array-buffer (removed)

🗑️ @​aws-sdk/middleware-content-length (removed)

🗑️ @​aws-sdk/middleware-endpoint (removed)

🗑️ @​aws-sdk/middleware-host-header (removed)

🗑️ @​aws-sdk/middleware-logger (removed)

🗑️ @​aws-sdk/middleware-recursion-detection (removed)

🗑️ @​aws-sdk/middleware-retry (removed)

🗑️ @​aws-sdk/middleware-sdk-sts (removed)

🗑️ @​aws-sdk/middleware-serde (removed)

🗑️ @​aws-sdk/middleware-signing (removed)

🗑️ @​aws-sdk/middleware-stack (removed)

🗑️ @​aws-sdk/middleware-user-agent (removed)

🗑️ @​aws-sdk/node-config-provider (removed)

🗑️ @​aws-sdk/node-http-handler (removed)

🗑️ @​aws-sdk/property-provider (removed)

🗑️ @​aws-sdk/protocol-http (removed)

🗑️ @​aws-sdk/querystring-builder (removed)

🗑️ @​aws-sdk/querystring-parser (removed)

🗑️ @​aws-sdk/service-error-classification (removed)

🗑️ @​aws-sdk/shared-ini-file-loader (removed)

🗑️ @​aws-sdk/signature-v4 (removed)

🗑️ @​aws-sdk/smithy-client (removed)

🗑️ @​aws-sdk/token-providers (removed)

🗑️ @​aws-sdk/types (removed)

🗑️ @​aws-sdk/url-parser (removed)

🗑️ @​aws-sdk/util-base64 (removed)

🗑️ @​aws-sdk/util-body-length-browser (removed)

🗑️ @​aws-sdk/util-body-length-node (removed)

🗑️ @​aws-sdk/util-buffer-from (removed)

🗑️ @​aws-sdk/util-config-provider (removed)

🗑️ @​aws-sdk/util-defaults-mode-browser (removed)

🗑️ @​aws-sdk/util-defaults-mode-node (removed)

🗑️ @​aws-sdk/util-endpoints (removed)

🗑️ @​aws-sdk/util-hex-encoding (removed)

🗑️ @​aws-sdk/util-locate-window (removed)

🗑️ @​aws-sdk/util-middleware (removed)

🗑️ @​aws-sdk/util-retry (removed)

🗑️ @​aws-sdk/util-uri-escape (removed)

🗑️ @​aws-sdk/util-user-agent-browser (removed)

🗑️ @​aws-sdk/util-user-agent-node (removed)

🗑️ @​aws-sdk/util-utf8-browser (removed)

🗑️ @​aws-sdk/util-utf8-node (removed)

🗑️ @​types/node (removed)

🗑️ base64-js (removed)

🗑️ bowser (removed)

🗑️ buffer (removed)

🗑️ fast-xml-parser (removed)

🗑️ ieee754 (removed)

🗑️ ip (removed)

🗑️ saslprep (removed)

🗑️ smart-buffer (removed)

🗑️ socks (removed)

🗑️ strnum (removed)

🗑️ tslib (removed)

🗑️ uuid (removed)

---

👉 No CI detected

You don't seem to have any Continuous Integration service set up!

Without a service that will test the Depfu branches and pull requests, we can't inform you if incoming updates actually work with your app. We think that this degrades the service we're trying to provide down to a point where it is more or less meaningless.

This is fine if you just want to give Depfu a quick try. If you want to really let Depfu help you keep your app up-to-date, we recommend setting up a CI system:

* [Circle CI](https://circleci.com), [Semaphore ](https://semaphoreci.com) and [Github Actions](https://docs.github.com/actions) are all excellent options. * If you use something like Jenkins, make sure that you're using the Github integration correctly so that it reports status data back to Github. * If you have already set up a CI for this repository, you might need to check your configuration. Make sure it will run on all new branches. If you don’t want it to run on every branch, you can whitelist branches starting with `depfu/`.

---

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@​depfu rebase

Rebases against your default branch and redoes this update

@​depfu recreate

Recreates this PR, overwriting any edits that you've made to it

@​depfu merge

Merges this PR once your tests are passing and conflicts are resolved

@​depfu cancel merge

Cancels automatic merging of this PR

@​depfu close

Closes this PR and deletes the branch

@​depfu reopen

Restores the branch and reopens this PR (if it's closed)

@​depfu pause

Ignores all future updates for this dependency and closes this PR

@​depfu pause [minor|major]

Ignores all future minor/major updates for this dependency and closes this PR

@​depfu resume

Future versions of this dependency will create PRs again (leaves this PR as is)