mongoose
9.11.4 · 23 Oct 2026MIT5.8M / weekRepositoryHomepagenpmAtom feed
Upgrading mongoose from 6.2.7 to 6.2.8
1 release in betweenevery note read
- 0
- changes to make
- 0
- advisories fixed
- 0
- new
- 5
- fixes
Security
7 advisories still affect 6.2.8
- Mongoose: Prototype pollution in mongoose update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter)moderate · GHSA-664h-wqgq-64gw
- Mongoose Prototype Pollution vulnerabilitycritical · GHSA-9m93-w8w6-76hh
- automattic/mongoose vulnerable to Prototype pollution via Schema.pathhigh · GHSA-f825-f98c-gj3g
Upgrading to 6.13.10 clears them.
Release by release
- fixed
document: Handle casting array of spread docs #11522
- fixed
document: Avoid setting nested properties on top-level document when initing with strict: false #11526
- fixed
document: Correctly handle deeply nested subdocuments when getting paths to validate #11501
- fixed
types: Avoid making TInstanceMethods any by default leading to
this = anyin middleware #11435 - fixed
types: Allow defining array default if using Types.Array<> in document interface #11391
- fixed
2 internal lines (docs, tests, tooling) left out.