[Snyk] Upgrade mongoose from 6.8.3 to 6.12.7 #94

debarghya-choudhury · 2024-03-23T15:26:45Z

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to upgrade mongoose from 6.8.3 to 6.12.7.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

The recommended version is 26 versions ahead of your current version.
The recommended version was released 22 days ago, on 2024-03-01.

The recommended version fixes:

Issue	PriorityScore (*)	Exploit Maturity
Regular Expression Denial of Service (ReDoS) SNYK-JS-FASTXMLPARSER-5668858	375/1000 Why? CVSS 7.5	No Known Exploit
Server-side Request Forgery (SSRF) SNYK-JS-IP-6240864	375/1000 Why? CVSS 7.5	Proof of Concept
Prototype Pollution SNYK-JS-MONGOOSE-5777721	375/1000 Why? CVSS 7.5	Proof of Concept
Prototype Pollution SNYK-JS-FASTXMLPARSER-3325616	375/1000 Why? CVSS 7.5	Proof of Concept
Information Exposure SNYK-JS-MONGODB-5871303	375/1000 Why? CVSS 7.5	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Release notes

Package name: mongoose

6.12.7 - 2024-03-01
chore: release 6.12.7
6.12.6 - 2024-01-22
6.12.5 - 2024-01-03
6.12.4 - 2023-12-27
6.12.3 - 2023-11-07
6.12.2 - 2023-10-25
6.12.1 - 2023-10-12
6.12.0 - 2023-08-24
6.11.6 - 2023-08-21
6.11.5 - 2023-08-01
6.11.4 - 2023-07-17
6.11.3 - 2023-07-11
6.11.2 - 2023-06-08
6.11.1 - 2023-05-08
6.11.0 - 2023-05-01
6.10.5 - 2023-04-06
6.10.4 - 2023-03-21
6.10.3 - 2023-03-13
6.10.2 - 2023-03-07
6.10.1 - 2023-03-03
6.10.0 - 2023-02-22
6.9.3 - 2023-02-22
6.9.2 - 2023-02-16
6.9.1 - 2023-02-06
6.9.0 - 2023-01-25
6.8.4 - 2023-01-17
6.8.3 - 2023-01-06

from mongoose GitHub release notes

Commit messages

Package name: mongoose

29f57c1 chore: release 6.12.7
d14d25b Merge pull request #14383 from Automattic/vkarpov15/gh-14113-2
92112dd Merge branch '6.x' into vkarpov15/gh-14113-2
222ad3b chore: pin tmp@0.2.1 re: chore: upgrade rimraf to fix transitive vulnerability raszi/node-tmp#293
b6cb439 Merge branch '6.x' into vkarpov15/gh-14113-2
0af28e0 Merge pull request #14376 from Automattic/vkarpov15/gh-14372
5096630 style: fix lint
867f7b7 test: fix #13335 tests
a9f6614 test: try fixing tests
635c795 perf(document+schema): small optimizations to make `init()` faster
d937726 Merge branch '6.x' into vkarpov15/gh-14372
ac9ea01 test: quick connection string fix
45f5c4c perf(model): make `insertMany()` `lean` option skip hydrating Mongoose docs
5dfb62f test: fix issues with cherry-picking #13376 to 6.x
352137b Merge pull request #14355 from 3150/introduce_resumeTokenChanged_into_6.x
34feac0 introduce resumeTokenChanged into 6.x
09181ef chore: release 6.12.6
af123cb Merge pull request #14277 from Automattic/vkarpov15/gh-14184
6b67f9b test: add test case for #14184
900e9fa fix(collection): correctly handle buffer timeouts with `find()`
4b6d208 Merge pull request #14254 from Automattic/vkarpov15/gh-14244
cc9ac77 Merge pull request #14265 from rohanricky/pathRelativeToParent_null_check
73bea51 null check
6bc42ce test: add missing issue to test title