chore(deps): bump mongoose from 8.24.0 to 8.24.7 in /backend by dependabot[bot] · Pull Request #2292 · hackforla/VRMS

dependabot · 2026-11-11T08:47:13Z

Bumps mongoose from 8.24.0 to 8.24.7.

Release notes

8.24.7 / 2026-10-23

fix: avoid walking into inherited properties like toString when hydrating documents, setting dotted paths, and merging updates

fix: only use own properties when looking up discriminators by key

fix(schema): disallow setting special properties via virtual()

fix(query): respect connection-level sanitizeFilter in queries

fix(query): disallow special properties like __proto__ as paths in where() and mod()

fix(deps): upgrade mquery -> 5.0.1 to avoid prototype pollution with query helpers like gt() and in()

8.24.6 / 2026-10-20

fix(array): compare dates by value in indexOf() so pull() removes them #16590 #16535 mrityunjay-pandey

fix: preserve circular arrays when cloning with a seen map #16598 #16514 mrityunjay-pandey

fix(cast): reject arrays when casting to Int32 or Double #16597 #16446 mrityunjay-pandey

fix(query): avoid path collision when excluding subdocument with select: false child #16604 #16409 #12798 mrityunjay-pandey

fix(query): pass schema through when casting a nested \ comparison #16605 #16496 mrityunjay-pandey

8.24.5 / 2026-10-04

fix: handle MongoDB server 9.x returning collation: { locale: 'simple' } on all indexes #16557

fix(documentarray): reindex subdocs after addToSet() skips a duplicate #16507 giaBaoJS

8.24.4 / 2026-08-21

fix(discriminator): prevent indexes and callQueue duplication with shared nested schemas #16467 #16466 #15966 (8.x backport) AbinMadathil-Celigo

8.24.3

fix(query): apply sanitizeFilter on countDocuments and cursor()

8.24.2 / 2026-07-27

fix(subdocument): don't minimize empty document array elements to null #16393 WaleedAshraf

types: correct Model.validate() return type to Promise #16340 #16340 chatman-media

8.24.1

fix(documentarray): reindex subdocs after array reordering and removal so subsequent nested changes save using the correct path #16282 AbdelrahmanHafez

fix(document): avoid accessing special properties in Document.prototype.get()

fix(schema): avoid returning inherited properties from schema path lookups, including paths underneath maps of subdocuments

fix(clone): isolate cloned arrays from source documents #16281 AbdelrahmanHafez

types: enable exactOptionalPropertyTypes in TypeScript tests #16287

Changelog

Sourced from mongoose's changelog.

8.24.7 / 2026-10-23

fix: avoid walking into inherited properties like toString when hydrating documents, setting dotted paths, and merging updates

fix: only use own properties when looking up discriminators by key

fix(schema): disallow setting special properties via virtual()

fix(query): respect connection-level sanitizeFilter in queries

fix(query): disallow special properties like __proto__ as paths in where() and mod()

fix(deps): upgrade mquery -> 4.0.4 to avoid prototype pollution with query helpers like gt() and in()

9.11.3 / 2026-10-21

fix(update): honor overwriteImmutable in upserts and nested timestamps #16614 #15781 #8619 AbdelrahmanHafez

fix(model): stop Model.validate() crashing on missing nested objects #16600 NotAFlightRisk

fix(connection): don't disable autoIndex/autoCreate for a primary ReadPreference instance #16592 NgoQuocViet2001

docs: remove references to MongoDB versions older than 6.x #16593

8.24.6 / 2026-10-20

fix(array): compare dates by value in indexOf() so pull() removes them #16590 #16535 mrityunjay-pandey

fix: preserve circular arrays when cloning with a seen map #16598 #16514 mrityunjay-pandey

fix(cast): reject arrays when casting to Int32 or Double #16597 #16446 mrityunjay-pandey

fix(query): avoid path collision when excluding subdocument with select: false child #16604 #16409 #12798 mrityunjay-pandey

fix(query): pass schema through when casting a nested \ comparison #16605 #16496 mrityunjay-pandey

9.11.2 / 2026-10-12

perf: avoid applying saveSubdocs and sharding plugins to subdocuments #16585

perf: upgrade to kareem@3.4.1 for mongoosejs/kareem#47 #16588

fix(model): cast array filter values in bulkWrite() #16574 #16573 OmBhandwaldar

fix(schema): allow function messages for number min/max and string minlength #16579 #16572 #8512 NotAFlightRisk

types: make MergeType more efficiently handle MergeType<A, {}> #16581 #16580

docs: fix broken API anchors and a malformed link #16583 SatvikMishra08

9.11.1 / 2026-10-07

fix(document): call recursive toObject() when setting a path to a nested object #16571

fix(update): keep casting array filters after a path not in the schema #16558 giaBaoJS

fix(document): apply flattenDecimals when toObject() takes the shallow fast path #16569 #16568 jeremyml

fix(query): cast operators under $not inside $elemMatch on primitive arrays #16542 #13880 breken-ai

fix(query): use embedded discriminator schema when filter selects the key with $eq or $in #16543 breken-ai

fix(documentarray): don't pass arrayPathIndex to subdocuments when initializing nested document arrays #16546 Mohamed-Elshesheny

fix(cursor): await driver cleanup when destroying query cursors #16562 #16560 IbrahimHafez1

fix(cursor): reject getDriverCursor after initialization errors #16563 #16561 IbrahimHafez1

types(schema): treat Int32 paths as number #16565 #16564 lazerg

types(models): align UpdateOneModel and UpdateManyModel update typing with UpdateQuery #16559 #16545 aipd506

9.11.0 / 2026-10-05

feat: use MongoDB Node.js driver 7.7.x #16550

feat(query): add Query.prototype.findAndCount() for composable paginated queries #16508 #16504 lokeshllkumar

... (truncated)

Commits

d0e609c chore: release 8.24.7
adca543 chore: upgrade mquery -> 5.0.1
cf237dd Merge branch 'vkarpov15/20261022/8.x/security' into 8.x
ad76a19 Merge branch 'vkarpov15/20261016/8.x/security' into 8.x
390453c fix: only use own properties when looking up discriminators by key
8e0dc48 fix: skip inherited properties in setDottedPath - not user facing but still g...
18b5513 fix: avoid setting values underneath inherited properties when constructing n...
27fcdff fix: avoid overriding built-in properties when copying conditions and avoid p...
318f7e0 fix: disallow setting special properties via virtual()
83eda6a fix(query): respect connection-level sanitizeFilter in queries
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [mongoose](https://github.com/Automattic/mongoose) from 8.24.0 to 8.24.7. - [Release notes](https://github.com/Automattic/mongoose/releases) - [Changelog](https://github.com/Automattic/mongoose/blob/master/CHANGELOG.md) - [Commits](Automattic/mongoose@8.24.0...8.24.7) --- updated-dependencies: - dependency-name: mongoose dependency-version: 8.24.7 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2026-11-11T08:47:43Z

Want to review this pull request? Take a look at this documentation for a step by step guide!

From your project repository, check out a new branch and test the changes.

git checkout -b hackforla-dependabot/npm_and_yarn/backend/mongoose-8.24.7 development
git pull https://github.com/hackforla/VRMS.git dependabot/npm_and_yarn/backend/mongoose-8.24.7

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 11, 2026

dependabot Bot mentioned this pull request Nov 11, 2026

chore(deps): bump mongoose from 8.24.0 to 8.24.1 in /backend #2193

Closed

Navigation Menu

Repository navigation

chore(deps): bump mongoose from 8.24.0 to 8.24.7 in /backend - #2292

chore(deps): bump mongoose from 8.24.0 to 8.24.7 in /backend#2292
dependabot[bot] wants to merge 1 commit into
developmentfrom
dependabot/npm_and_yarn/backend/mongoose-8.24.7

dependabot Bot commented on behalf of github Nov 11, 2026

Uh oh!

github-actions Bot commented Nov 11, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Nov 11, 2026

8.24.7 / 2026-10-23

8.24.6 / 2026-10-20

8.24.5 / 2026-10-04

8.24.4 / 2026-08-21

8.24.3

8.24.2 / 2026-07-27

8.24.1

8.24.7 / 2026-10-23

9.11.3 / 2026-10-21

8.24.6 / 2026-10-20

9.11.2 / 2026-10-12

9.11.1 / 2026-10-07

9.11.0 / 2026-10-05

Uh oh!

github-actions Bot commented Nov 11, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants