mongoose
9.11.4 · 23 Oct 2026MIT5.8M / weekRepositoryHomepagenpmAtom feed
Upgrading mongoose from 6.1.7 to 6.1.8
1 release in betweenevery note read
Security
7 advisories still affect 6.1.8
- Mongoose: Prototype pollution in mongoose update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter)moderate · GHSA-664h-wqgq-64gw
- Mongoose Prototype Pollution vulnerabilitycritical · GHSA-9m93-w8w6-76hh
- automattic/mongoose vulnerable to Prototype pollution via Schema.pathhigh · GHSA-f825-f98c-gj3g
Upgrading to 6.13.10 clears them.
Release by release
- new
Remove sliced in favor of Array.prototype.slice() #11238 Uzlopak
- new
Improve setDottedPath #11264 Uzlopak
- fixed
connection: Stop leaking sessions in .transaction() #11259 #11256 Uzlopak
- fixed
document: Handle edge case where NestJS sets String.type = String, mixing up schema definitions #11199
- fixed
Remove obsolete code after upgrading to bson4 #11265 Uzlopak
- fixed
Remove util.isArray in favor of Array.isArray #11234 Uzlopak
- fixed
index.d.ts: Avoid UnpackedIntersection making
findOne().populate()result non-nullable #11041
- new
6 internal lines (docs, tests, tooling) left out.