fix(deps): update dependency mongoose to v8.8.3 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
mongoose (source)	8.7.0 -> 8.8.3

GitHub Vulnerability Alerts

CVE-2024-53900

Mongoose versions prior to 8.8.3, 7.8.3, and 6.13.5 are vulnerable to improper use of the $where operator. This vulnerability arises from the ability of the $where clause to execute arbitrary JavaScript code in MongoDB queries, potentially leading to code injection attacks and unauthorized access or manipulation of database data.

---

Release Notes

Automattic/mongoose (mongoose)

v8.8.3

Compare Source

==================

• fix: disallow using $where in match
• perf: cache results from getAllSubdocs() on saveOptions, only loop through known subdoc properties #​15055 #​15029
• fix(model+query): support overwriteDiscriminatorKey for bulkWrite updateOne and updateMany, allow inferring discriminator key from update #​15046 #​15040

v8.8.2

Compare Source

==================

• fix(model): handle array filters when casting bulkWrite #​15036 #​14978
• fix(model): make diffIndexes() avoid trying to drop default timeseries collection index #​15035 #​14984
• fix: save execution stack in query as string #​15039 durran
• types(cursor): correct asyncIterator and asyncDispose for TypeScript with lib: 'esnext' #​15038
• docs(migrating_to_8): add note about removing findByIdAndRemove #​15024 dragontaek-lee

v8.8.1

Compare Source

==================

• perf: make a few micro-optimizations to help speed up findOne() #​15022 #​14906
• fix: apply embedded discriminators to subdoc schemas before compiling top level model so middleware applies correctly #​15001 #​14961
• fix(query): add overwriteImmutable option to allow updating immutable properties without disabling strict mode #​15000 #​8619

v8.8.0

Compare Source

==================

• feat: upgrade mongodb -> ~6.10 #​14991 #​14877
• feat(query): add schemaLevelProjections option to query to disable schema-level select: false #​14986 #​11474
• feat: allow defining virtuals on arrays, not just array elements #​14955 #​2326
• feat(model): add applyTimestamps() function to apply all schema timestamps, including subdocuments, to a given POJO #​14943 #​14698
• feat(model): add hideIndexes option to syncIndexes() and cleanIndexes() #​14987 #​14868
• fix(query): make sanitizeFilter disable implicit $in #​14985 #​14657
• fix(model): avoid unhandled error if createIndex() throws a sync error #​14995
• fix(model): avoid throwing TypeError if bulkSave()'s bulkWrite() fails with a non-BulkWriteError #​14993
• types: added toJSON:flattenObjectIds effect #​14989
• types: add __v to lean() result type and ModifyResult #​14990 #​12959
• types: use globalThis instead of global for NativeDate #​14992 #​14988
• docs(change-streams): fix markdown syntax highlighting for script output example #​14994

v8.7.3

Compare Source

==================

• fix(cursor): close underlying query cursor when calling destroy() #​14982 #​14966
• types: add JSONSerialized helper that can convert HydratedDocument to JSON output type #​14981 #​14451
• types(model): convert InsertManyResult to interface and remove unnecessary insertedIds override #​14977
• types(connection): add missing sanitizeFilter option #​14975
• types: improve goto definition for inferred schema definitions #​14968 forivall
• docs(migration-guide-v7): correct link to the section "Id Setter" #​14973 rb-ntnx

v8.7.2

Compare Source

==================

• fix(document): recursively clear modified subpaths when setting deeply nested subdoc to null #​14963 #​14952
• fix(populate): handle array of ids with parent refPath #​14965
• types: make Buffers into mongodb.Binary in lean result type to match runtime behavior #​14967
• types: correct schema type inference when using nested typeKey like type: { type: String } #​14956 #​14950
• types: re-export DeleteResult and UpdateResult from MongoDB Node.js driver #​14947 #​14946
• docs(documents): add section on setting deeply nested properties, including warning about nullish coalescing assignment #​14972
• docs(model): add more info on acknowledged: false, specifically that Mongoose may return that if the update was empty #​14957

v8.7.1

Compare Source

==================

• fix: set flattenObjectIds to false when calling toObject() for internal purposes #​14938
• fix: add mongodb 8 to test matrix #​14937
• fix: handle buffers stored in MongoDB as EJSON representation with { $binary } #​14932
• docs: indicate that Mongoose 8.7 is required for full MongoDB 8 support #​14937

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.