Skip to content

chore(deps): bump mongoose from 8.24.1 to 9.11.0 in /experimental/license-inventory - #1822

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/experimental/license-inventory/mongoose-9.11.0
Closed

chore(deps): bump mongoose from 8.24.1 to 9.11.0 in /experimental/license-inventory#1822
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/experimental/license-inventory/mongoose-9.11.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 13, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps mongoose from 8.24.1 to 9.11.0.

Release notes

Sourced from mongoose's releases.

9.11.0 / 2026-10-05

  • feat: use MongoDB Node.js driver 7.7.x #16550
  • feat(query): add Query.prototype.findAndCount() for composable paginated queries #16508 #16504 lokeshllkumar
  • fix: avoid double-calling validators on document arrays underneath nested paths #16484 #16291 #5411
  • types: pass TLeanResultType into query for type narrowing support with lean() #16523 #16519
  • docs(guide): use async/await instead of removed callbacks #16566 joi-agent
  • test: run TypeScript tests on typescript 5+7 with combinations of exactOptionalPropertyTypes, skipLibCheck, strict #16510 #16506

9.10.4 / 2026-10-02

  • fix: handle MongoDB server 9.x returning collation: { locale: 'simple' } on all indexes #16557
  • fix(populate): resolve dotted parent path when collecting deferred sub-populate children #16538 jfits
  • fix(array): compare dates by value in indexOf() so pull() removes them #16535 giaBaoJS
  • fix(map): register $set when Map#set() replaces an array #16540 #16539 luantaraschi
  • fix(query): cast case and then expressions in $expr $switch branches #16534 kwy404
  • docs(guide): fix read preference tag set example #16541 NotAFlightRisk

9.10.3 / 2026-09-29

  • fix(model): preserve unsaved documents after ordered bulkSave errors #16533 #16532 IbrahimHafez1
  • fix(model): don't mutate the caller's update object in bulkWrite updateMany #16526 fadiroot
  • fix(schema): run setters declared on the union path itself #16528 giaBaoJS
  • fix(collection): open collection if connection was already opened #16527 #16525 #16524
  • fix(query+model): replace {MODEL} in cast error messages from update and bulkWrite casting #16529 #16502 #16480

9.10.2 / 2026-09-22

9.10.1 / 2026-09-14

  • types: relax populate Model generics to allow typed virtuals to be passed to populate in TypeScript 7 with skipLibCheck #16503

9.10.0 / 2026-09-10

  • feat: upgrade mongodb driver -> 7.6.0
  • feat(model): add Model.findAndCount() wrapper for limit+skip based pagination with countDocuments #16460 #16454
  • feat(schema): add Schema.prototype.queryHelper() to make it easier to define query helpers in TypeScript #16464 #16410
  • feat: support middleware skip option for cursors and custom hooks #16350 #15883 #8768 AbdelrahmanHafez
  • fix: apply defaults to undefined array elements #16542 #9232
  • types: support for type narrowing when using projection in find and findOne #16500 #15545
  • types: make Schema.prototype.static() return type with new static #16464

9.9.5 / 2026-09-04

... (truncated)

Changelog

Sourced from mongoose's changelog.

9.11.0 / 2026-10-05

  • feat: use MongoDB Node.js driver 7.7.x #16550
  • feat(query): add Query.prototype.findAndCount() for composable paginated queries #16508 #16504 lokeshllkumar
  • fix: avoid double-calling validators on document arrays underneath nested paths #16484 #16291 #5411
  • types: pass TLeanResultType into query for type narrowing support with lean() #16523 #16519
  • docs(guide): use async/await instead of removed callbacks #16566 joi-agent
  • test: run TypeScript tests on typescript 5+7 with combinations of exactOptionalPropertyTypes, skipLibCheck, strict #16510 #16506

9.10.4 / 2026-10-02

  • fix: handle MongoDB server 9.x returning collation: { locale: 'simple' } on all indexes #16557
  • fix(populate): resolve dotted parent path when collecting deferred sub-populate children #16538 jfits
  • fix(array): compare dates by value in indexOf() so pull() removes them #16535 giaBaoJS
  • fix(map): register $set when Map#set() replaces an array #16540 #16539 luantaraschi
  • fix(query): cast case and then expressions in $expr $switch branches #16534 kwy404
  • docs(guide): fix read preference tag set example #16541 NotAFlightRisk

9.10.3 / 2026-09-29

  • fix(model): preserve unsaved documents after ordered bulkSave errors #16533 #16532 IbrahimHafez1
  • fix(model): don't mutate the caller's update object in bulkWrite updateMany #16526 fadiroot
  • fix(schema): run setters declared on the union path itself #16528 giaBaoJS
  • fix(collection): open collection if connection was already opened #16527 #16525 #16524
  • fix(query+model): replace {MODEL} in cast error messages from update and bulkWrite casting #16529 #16502 #16480

9.10.2 / 2026-09-22

9.10.1 / 2026-09-14

  • types: relax populate Model generics to allow typed virtuals to be passed to populate in TypeScript 7 with skipLibCheck #16503

9.10.0 / 2026-09-10

  • feat: upgrade mongodb driver -> 7.6.0
  • feat(model): add Model.findAndCount() wrapper for limit+skip based pagination with countDocuments #16460 #16454
  • feat(schema): add Schema.prototype.queryHelper() to make it easier to define query helpers in TypeScript #16464 #16410
  • feat: support middleware skip option for cursors and custom hooks #16350 #15883 #8768 AbdelrahmanHafez
  • fix: apply defaults to undefined array elements #16542 #9232
  • types: support for type narrowing when using projection in find and findOne #16500 #15545
  • types: make Schema.prototype.static() return type with new static #16464

9.9.5 / 2026-09-04

... (truncated)

Commits
  • 23a1216 chore: release 9.11.0
  • 9cdeb3f Merge pull request #16567 from Automattic/9.11
  • 4bd7183 fix lint
  • fcd1f5b Merge branch 'master' into 9.11
  • 602350a Correct for loop syntax in document.js
  • 3ed677b Merge pull request #16484 from Automattic/vkarpov15/paths-to-validate-fix
  • 5ae258f Merge pull request #16566 from joi-agent/joi-docs-guide-use-async-await-inste...
  • 1fc7890 docs(guide): use async/await instead of removed callbacks
  • 32efa1b chore: release 9.10.4
  • 1e86af9 Merge pull request #16557 from Automattic/vkarpov15/mongodb-9-fix
  • Additional commits viewable in compare view

@dependabot
dependabot Bot requested a review from a team as a code owner October 13, 2026 12:39
@dependabot dependabot Bot added automated dependencies Pull requests that update a dependency file labels Oct 13, 2026
@dependabot @github

dependabot Bot commented on behalf of github Oct 13, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: experimental. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@netlify

netlify Bot commented Oct 13, 2026 •
edited
Loading

Copy link
Copy Markdown

✅ Deploy Preview for endearing-brigadeiros-63f9d0 canceled.

Name Link
🔨 Latest commit 1faad1b
🔍 Latest deploy log https://app.netlify.com/projects/endearing-brigadeiros-63f9d0/deploys/6acf473085fbfd5b760eebb0

@github-actions

github-actions Bot commented Oct 13, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Scorecard details
PackageVersionScoreDetails
npm/@mongodb-js/saslprep 1.6.0 UnknownUnknown
npm/@standard-schema/spec 1.1.0 UnknownUnknown
npm/@types/whatwg-url 11.0.5 🟢 6.6
Details
CheckScoreReason
Code-Review🟢 9Found 29/30 approved changesets -- score normalized to 9
Packaging⚠️ -1packaging workflow not detected
Maintained🟢 1030 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 9license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
Fuzzing⚠️ 0project is not fuzzed
npm/@types/whatwg-url 13.0.0 🟢 6.6
Details
CheckScoreReason
Code-Review🟢 9Found 29/30 approved changesets -- score normalized to 9
Packaging⚠️ -1packaging workflow not detected
Maintained🟢 1030 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 9license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
Fuzzing⚠️ 0project is not fuzzed
npm/bson 6.10.4 🟢 6.3
Details
CheckScoreReason
Maintained🟢 1017 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 10all changesets reviewed
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy⚠️ 0security policy file not detected
License🟢 10license file detected
Pinned-Dependencies⚠️ 1dependency not pinned by hash detected -- score normalized to 1
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases🟢 85 out of the last 5 releases have a total of 5 signed artifacts.
Branch-Protection🟢 5branch protection is not maximal on development and all release branches
SAST🟢 10SAST tool is run on all commits
npm/bson 7.3.3 🟢 6.3
Details
CheckScoreReason
Maintained🟢 1017 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 10all changesets reviewed
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy⚠️ 0security policy file not detected
License🟢 10license file detected
Pinned-Dependencies⚠️ 1dependency not pinned by hash detected -- score normalized to 1
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases🟢 85 out of the last 5 releases have a total of 5 signed artifacts.
Branch-Protection🟢 5branch protection is not maximal on development and all release branches
SAST🟢 10SAST tool is run on all commits
npm/kareem 3.4.0 UnknownUnknown
npm/mongodb 6.20.0 🟢 6.1
Details
CheckScoreReason
Code-Review🟢 9Found 23/24 approved changesets -- score normalized to 9
Maintained🟢 1030 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy⚠️ 0security policy file not detected
License🟢 10license file detected
Branch-Protection🟢 5branch protection is not maximal on development and all release branches
Signed-Releases🟢 85 out of the last 5 releases have a total of 5 signed artifacts.
Binary-Artifacts🟢 10no binaries found in the repo
SAST🟢 9SAST tool detected but not run on all commits
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed
npm/mongodb 7.7.0 🟢 6.1
Details
CheckScoreReason
Code-Review🟢 9Found 23/24 approved changesets -- score normalized to 9
Maintained🟢 1030 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy⚠️ 0security policy file not detected
License🟢 10license file detected
Branch-Protection🟢 5branch protection is not maximal on development and all release branches
Signed-Releases🟢 85 out of the last 5 releases have a total of 5 signed artifacts.
Binary-Artifacts🟢 10no binaries found in the repo
SAST🟢 9SAST tool detected but not run on all commits
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed
npm/mongodb-connection-string-url 3.0.2 🟢 5.4
Details
CheckScoreReason
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Maintained🟢 34 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 3
Code-Review🟢 10all changesets reviewed
Binary-Artifacts🟢 10no binaries found in the repo
Packaging⚠️ -1packaging workflow not detected
Pinned-Dependencies🟢 3dependency not pinned by hash detected -- score normalized to 3
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy⚠️ 0security policy file not detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Branch-Protection🟢 5branch protection is not maximal on development and all release branches
Signed-Releases⚠️ -1no releases found
SAST🟢 9SAST tool is not run on all commits -- score normalized to 9
npm/mongodb-connection-string-url 7.0.2 🟢 5.4
Details
CheckScoreReason
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Maintained🟢 34 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 3
Code-Review🟢 10all changesets reviewed
Binary-Artifacts🟢 10no binaries found in the repo
Packaging⚠️ -1packaging workflow not detected
Pinned-Dependencies🟢 3dependency not pinned by hash detected -- score normalized to 3
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy⚠️ 0security policy file not detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Branch-Protection🟢 5branch protection is not maximal on development and all release branches
Signed-Releases⚠️ -1no releases found
SAST🟢 9SAST tool is not run on all commits -- score normalized to 9
npm/mongoose 9.11.0 🟢 6.8
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 9 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Code-Review🟢 6Found 10/15 approved changesets -- score normalized to 6
Security-Policy🟢 9security policy file detected
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies🟢 3dependency not pinned by hash detected -- score normalized to 3
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Fuzzing⚠️ 0project is not fuzzed
Packaging🟢 10packaging workflow detected
SAST🟢 9SAST tool detected but not run on all commits
npm/mquery 6.0.0 UnknownUnknown

Scanned Files

  • experimental/license-inventory/package-lock.json

@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/experimental/license-inventory/mongoose-9.11.0 branch 3 times, most recently from 13c0b88 to c8d615d Compare October 14, 2026 07:16
@dependabot
chore(deps): bump mongoose in /experimental/license-inventory
1faad1b 
Bumps [mongoose](https://github.com/Automattic/mongoose) from 8.24.1 to 9.11.0.
- [Release notes](https://github.com/Automattic/mongoose/releases)
- [Changelog](https://github.com/Automattic/mongoose/blob/master/CHANGELOG.md)
- [Commits](Automattic/mongoose@8.24.1...9.11.0)

---
updated-dependencies:
- dependency-name: mongoose
  dependency-version: 9.11.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/experimental/license-inventory/mongoose-9.11.0 branch from c8d615d to 1faad1b Compare October 14, 2026 09:11
@dependabot @github

dependabot Bot commented on behalf of github Oct 18, 2026

Copy link
Copy Markdown
Contributor Author

Superseded by #1841.

@dependabot dependabot Bot closed this Oct 18, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/experimental/license-inventory/mongoose-9.11.0 branch October 18, 2026 09:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

automated dependencies Pull requests that update a dependency file evergreen maintenance

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants