search

WebJamApps / SellStuffApi

Making lots of money baby!
MIT License
0 stars 1 forks source link

[Snyk] Upgrade mongoose from 6.7.5 to 6.8.3 #14

Closed snyk-bot closed 1 year ago

snyk-bot commented 1 year ago

Snyk has created this PR to upgrade mongoose from 6.7.5 to 6.8.3.

:information_source: Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

The recommended version fixes:

Severity Issue PriorityScore (*) Exploit Maturity
Regular Expression Denial of Service (ReDoS)
SNYK-JS-COOKIEJAR-3149984		 372/1000
Why? Proof of Concept exploit, CVSS 5.3		 Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Release notes
Package name: mongoose
  • 6.8.3 - 2023-01-06

    6.8.3 / 2023-01-06

    • perf: improve performance of assignRawDocsToIdStructure for faster populate on large docs #12867 Uzlopak
    • fix(model): ensure consistent ordering of validation errors in insertMany() with ordered: false and rawResult: true #12866
    • fix: avoid passing final callback to pre hook, because calling the callback can mess up hook execution #12836
    • fix(types): avoid inferring timestamps if methods, virtuals, or statics set #12871
    • fix(types): correctly infer string enums on const arrays #12870 JavaScriptBach
    • fix(types): allow virtuals to be invoked in the definition of other virtuals #12874 sffc
    • fix(types): add type def for Aggregate#model without arguments #12864 hasezoey
    • docs(discriminators): add section about changing discriminator key #12861
    • docs(typescript): explain that virtuals inferred from schema only show up on Model, not raw document type #12860 #12684
  • 6.8.2 - 2022-12-28

    6.8.2 / 2022-12-28

    • fix(schema): propagate strictQuery to implicitly created schemas for embedded discriminators #12827 #12796
    • fix(model): respect discriminators with Model.validate() #12824 #12621
    • fix(query): fix unexpected validation error when doing findOneAndReplace() with a nullish value #12826 #12821
    • fix(discriminator): apply built-in plugins to discriminator schema even if mergeHooks and mergePlugins are both false #12833 #12696
    • fix(types): add option "overwriteModels" as a schema option #12817 #12816 hasezoey
    • fix(types): add property "defaultOptions" #12818 hasezoey
    • docs: make search bar respect documentation version, so you can search 5.x docs #12548
    • docs(typescript): make note about recommending strict mode when using auto typed schemas #12825 #12420
    • docs: add section on sorting to query docs #12588 IslandRhythms
    • test(query.test): add write-concern option #12829 hasezoey
  • 6.8.1 - 2022-12-19

    6.8.1 / 2022-12-19

    • fix(query): avoid throwing circular dependency error if same object is used in multiple properties #12774 orgads
    • fix(map): return value from super.delete() #12777 danbrud
    • fix(populate): handle virtual populate underneath document array with justOne=true and sort set where 1 element has only 1 result #12815 #12730
    • fix(update): handle embedded discriminators when casting array filters #12802 #12565
    • fix(populate): avoid calling transform if there's no populate results and using lean #12804 #12739
    • fix(model): prevent index creation on syncIndexes if not necessary #12785 #12250 lpizzinidev
    • fix(types): correctly infer this when using pre('updateOne') with { document: true, query: false } #12778
    • fix(types): make InferSchemaType: consider { required: boolean } required if it isn't explicitly false #12784 JavaScriptBach
    • docs: replace many occurrences of "localhost" with "127.0.0.1" #12811 #12741 hasezoey SadiqOnGithub
    • docs(mongoose): Added missing options to set #12810 lpizzinidev
    • docs: add info on $locals parameters to getters/setters tutorial #12814 #12550 IslandRhythms
    • docs: make Document.prototype.$clone() public #12803
    • docs(query): updated explanation for slice #12776 #12474 lpizzinidev
    • docs(middleware): fix broken links #12787 lpizzinidev
    • docs(queries): fixed broken links #12790 lpizzinidev
  • 6.8.0 - 2022-12-05
    Read more
  • 6.7.5 - 2022-11-30
    Read more
from mongoose GitHub release notes
Commit messages
Package name: mongoose
  • 783a5de chore: release 6.8.3
  • 0ccc498 Merge pull request #12881 from Automattic/vkarpov15/kareem-2.5.1
  • efeaa33 fix: upgrade kareem -> 2.5.1, Fix #12836
  • b9f2127 Merge pull request #12860 from Automattic/vkarpov15/gh-12684
  • 426cc8c Merge pull request #12861 from Automattic/vkarpov15/gh-6087
  • b7816cd Merge pull request #12866 from Automattic/vkarpov15/gh-12791
  • fe9bc23 Merge pull request #12870 from JavaScriptBach/const-array
  • a2af383 Merge pull request #12871 from Automattic/vkarpov15/gh-12807
  • fadb450 Merge pull request #12874 from sffc/patch-1
  • 6043907 Merge pull request #12867 from Automattic/perf-assignRawDocsToIdStructure
  • 5be82c3 Allow virtuals to be invoked in the definition of other virtuals
  • e9b5eed Merge pull request #12864 from dmshvetsov/dmshvetsov/fix-type-def-aggregation-model-fn
  • 0ed84bc fix(types): avoid inferring timestamps if `methods`, `virtuals`, or `statics` set
  • 5faf524 add type tests for Aggregate.prototype.model
  • 6f243a9 lint
  • 17ee131 add test
  • baea9f5 Correctly infer string enums on const arrays
  • c07fef4 improve performance of assignRawDocsToIdStructure
  • 9303f7d fix: correct writeError index when insertMany() with ordered: false, rawResult: true with mixed validation error and write error re: #12791
  • a1f7f0a style: quick fix
  • a90f97c fix(model): ensure consistent ordering of validation errors in `insertMany()` with `ordered: false` and `rawResult: true`
  • 456793e add type def for Aggreaget#model without arguments
  • d10ad8c Merge pull request #12862 from Automattic/revert-12858-dependabot/npm_and_yarn/master/axios-1.2.2
  • 52c0fe7 Revert "chore(deps-dev): bump axios from 1.1.3 to 1.2.2 (#12858)"
Compare

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs