chore(deps): bump mongoose from 8.24.1 to 9.11.2 in /experimental/license-inventory by dependabot[bot] · Pull Request #1841 · finos/git-proxy

dependabot · 2026-10-18T09:33:51Z

Bumps mongoose from 8.24.1 to 9.11.2.

Release notes

9.11.2 / 2026-10-12

perf: avoid applying saveSubdocs and sharding plugins to subdocuments #16585

perf: upgrade to kareem@3.4.1 for mongoosejs/kareem#47 #16588

fix(model): cast array filter values in bulkWrite() #16574 #16573 OmBhandwaldar

fix(schema): allow function messages for number min/max and string minlength #16579 #16572 #8512 NotAFlightRisk

types: make MergeType more efficiently handle MergeType<A, {}> #16581 #16580

docs: fix broken API anchors and a malformed link #16583 SatvikMishra08

9.11.1 / 2026-10-07

fix(document): call recursive toObject() when setting a path to a nested object #16571

fix(update): keep casting array filters after a path not in the schema #16558 giaBaoJS

fix(document): apply flattenDecimals when toObject() takes the shallow fast path #16569 #16568 jeremyml

fix(query): cast operators under $not inside $elemMatch on primitive arrays #16542 #13880 breken-ai

fix(query): use embedded discriminator schema when filter selects the key with $eq or $in #16543 breken-ai

fix(documentarray): don't pass arrayPathIndex to subdocuments when initializing nested document arrays #16546 Mohamed-Elshesheny

fix(cursor): await driver cleanup when destroying query cursors #16562 #16560 IbrahimHafez1

fix(cursor): reject getDriverCursor after initialization errors #16563 #16561 IbrahimHafez1

types(schema): treat Int32 paths as number #16565 #16564 lazerg

types(models): align UpdateOneModel and UpdateManyModel update typing with UpdateQuery #16559 #16545 aipd506

9.11.0 / 2026-10-05

feat: use MongoDB Node.js driver 7.7.x #16550

feat(query): add Query.prototype.findAndCount() for composable paginated queries #16508 #16504 lokeshllkumar

fix: avoid double-calling validators on document arrays underneath nested paths #16484 #16291 #5411

types: pass TLeanResultType into query for type narrowing support with lean() #16523 #16519

docs(guide): use async/await instead of removed callbacks #16566 joi-agent

test: run TypeScript tests on typescript 5+7 with combinations of exactOptionalPropertyTypes, skipLibCheck, strict #16510 #16506

9.10.4 / 2026-10-02

fix: handle MongoDB server 9.x returning collation: { locale: 'simple' } on all indexes #16557

fix(populate): resolve dotted parent path when collecting deferred sub-populate children #16538 jfits

fix(array): compare dates by value in indexOf() so pull() removes them #16535 giaBaoJS

fix(map): register $set when Map#set() replaces an array #16540 #16539 luantaraschi

fix(query): cast case and then expressions in $expr $switch branches #16534 kwy404

docs(guide): fix read preference tag set example #16541 NotAFlightRisk

9.10.3 / 2026-09-29

fix(model): preserve unsaved documents after ordered bulkSave errors #16533 #16532 IbrahimHafez1

fix(model): don't mutate the caller's update object in bulkWrite updateMany #16526 fadiroot

fix(schema): run setters declared on the union path itself #16528 giaBaoJS

fix(collection): open collection if connection was already opened #16527 #16525 #16524

fix(query+model): replace {MODEL} in cast error messages from update and bulkWrite casting #16529 #16502 #16480

9.10.2 / 2026-09-22

... (truncated)

Changelog

Sourced from mongoose's changelog.

9.11.2 / 2026-10-12

perf: avoid applying saveSubdocs and sharding plugins to subdocuments #16585

perf: upgrade to kareem@3.4.1 for mongoosejs/kareem#47 #16588

fix(model): cast array filter values in bulkWrite() #16574 #16573 OmBhandwaldar

fix(schema): allow function messages for number min/max and string minlength #16579 #16572 #8512 NotAFlightRisk

types: make MergeType more efficiently handle MergeType<A, {}> #16581 #16580

docs: fix broken API anchors and a malformed link #16583 SatvikMishra08

9.11.1 / 2026-10-07

fix(document): call recursive toObject() when setting a path to a nested object #16571

fix(update): keep casting array filters after a path not in the schema #16558 giaBaoJS

fix(document): apply flattenDecimals when toObject() takes the shallow fast path #16569 #16568 jeremyml

fix(query): cast operators under $not inside $elemMatch on primitive arrays #16542 #13880 breken-ai

fix(query): use embedded discriminator schema when filter selects the key with $eq or $in #16543 breken-ai

fix(documentarray): don't pass arrayPathIndex to subdocuments when initializing nested document arrays #16546 Mohamed-Elshesheny

fix(cursor): await driver cleanup when destroying query cursors #16562 #16560 IbrahimHafez1

fix(cursor): reject getDriverCursor after initialization errors #16563 #16561 IbrahimHafez1

types(schema): treat Int32 paths as number #16565 #16564 lazerg

types(models): align UpdateOneModel and UpdateManyModel update typing with UpdateQuery #16559 #16545 aipd506

9.11.0 / 2026-10-05

feat: use MongoDB Node.js driver 7.7.x #16550

feat(query): add Query.prototype.findAndCount() for composable paginated queries #16508 #16504 lokeshllkumar

fix: avoid double-calling validators on document arrays underneath nested paths #16484 #16291 #5411

types: pass TLeanResultType into query for type narrowing support with lean() #16523 #16519

docs(guide): use async/await instead of removed callbacks #16566 joi-agent

test: run TypeScript tests on typescript 5+7 with combinations of exactOptionalPropertyTypes, skipLibCheck, strict #16510 #16506

8.24.5 / 2026-10-04

fix: handle MongoDB server 9.x returning collation: { locale: 'simple' } on all indexes #16557

fix(documentarray): reindex subdocs after addToSet() skips a duplicate #16507 giaBaoJS

9.10.4 / 2026-10-02

fix: handle MongoDB server 9.x returning collation: { locale: 'simple' } on all indexes #16557

fix(populate): resolve dotted parent path when collecting deferred sub-populate children #16538 jfits

fix(array): compare dates by value in indexOf() so pull() removes them #16535 giaBaoJS

fix(map): register $set when Map#set() replaces an array #16540 #16539 luantaraschi

fix(query): cast case and then expressions in $expr $switch branches #16534 kwy404

docs(guide): fix read preference tag set example #16541 NotAFlightRisk

9.10.3 / 2026-09-29

fix(model): preserve unsaved documents after ordered bulkSave errors #16533 #16532 IbrahimHafez1

fix(model): don't mutate the caller's update object in bulkWrite updateMany #16526 fadiroot

fix(schema): run setters declared on the union path itself #16528 giaBaoJS

... (truncated)

Commits

a477fca chore: release 9.11.2
8111c11 Merge pull request #16574 from OmBhandwaldar/fix/bulkwrite-cast-array-filters
7944871 Merge pull request #16585 from Automattic/vkarpov15/perf-fixup
6b69ea4 Merge pull request #16579 from Automattic/vkarpov15/gh-16572
d8ceee6 fix: address a couple of claude comments
d2ea541 Merge pull request #16581 from Automattic/vkarpov15/query-typescript-perf-master
57b26b9 Merge pull request #16583 from SatvikMishra08/docs/fix-broken-api-anchors
98331b8 Merge pull request #16588 from Automattic/vkarpov15/20261012/upgrade-kareem
d69c1a1 fix: handle skipping built-in plugins for subdocuments at the middleware defi...
d30768b chore: remove min-release-age temporarily for kareem 3.4.1
Additional commits viewable in compare view

dependabot · 2026-10-18T09:33:55Z

Labels

The following labels could not be found: experimental. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

netlify · 2026-10-18T09:33:57Z

✅ Deploy Preview for endearing-brigadeiros-63f9d0 canceled.

Name	Link
🔨 Latest commit	`41acb38`
🔍 Latest deploy log	https://app.netlify.com/projects/endearing-brigadeiros-63f9d0/deploys/6ae0405c4105762839fb56fd

github-actions · 2026-10-18T09:37:26Z

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Scorecard details

Package

Version

Score

Details

npm/@mongodb-js/saslprep

1.6.1

Unknown

npm/@standard-schema/spec

1.1.0

Unknown

npm/@types/whatwg-url

11.0.5

🟢 6.6

Details

Check	Score	Reason
Code-Review	🟢 9	Found 28/30 approved changesets -- score normalized to 9
Packaging	⚠️ -1	packaging workflow not detected
Maintained	🟢 10	30 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Security-Policy	🟢 10	security policy file detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
License	🟢 9	license file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ -1	no releases found
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 8	dependency not pinned by hash detected -- score normalized to 8
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0
Fuzzing	⚠️ 0	project is not fuzzed

npm/@types/whatwg-url

13.0.0

🟢 6.6

Details

Check	Score	Reason
Code-Review	🟢 9	Found 28/30 approved changesets -- score normalized to 9
Packaging	⚠️ -1	packaging workflow not detected
Maintained	🟢 10	30 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Security-Policy	🟢 10	security policy file detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
License	🟢 9	license file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ -1	no releases found
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 8	dependency not pinned by hash detected -- score normalized to 8
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0
Fuzzing	⚠️ 0	project is not fuzzed

npm/bson

6.10.4

🟢 6.3

Details

Check	Score	Reason
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Maintained	🟢 10	17 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Code-Review	🟢 10	all changesets reviewed
Binary-Artifacts	🟢 10	no binaries found in the repo
Packaging	⚠️ -1	packaging workflow not detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Security-Policy	⚠️ 0	security policy file not detected
Pinned-Dependencies	⚠️ 1	dependency not pinned by hash detected -- score normalized to 1
Fuzzing	⚠️ 0	project is not fuzzed
License	🟢 10	license file detected
Signed-Releases	🟢 8	5 out of the last 5 releases have a total of 5 signed artifacts.
Branch-Protection	🟢 5	branch protection is not maximal on development and all release branches
SAST	🟢 10	SAST tool is run on all commits

npm/bson

7.3.3

🟢 6.3

Details

Check	Score	Reason
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Maintained	🟢 10	17 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Code-Review	🟢 10	all changesets reviewed
Binary-Artifacts	🟢 10	no binaries found in the repo
Packaging	⚠️ -1	packaging workflow not detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Security-Policy	⚠️ 0	security policy file not detected
Pinned-Dependencies	⚠️ 1	dependency not pinned by hash detected -- score normalized to 1
Fuzzing	⚠️ 0	project is not fuzzed
License	🟢 10	license file detected
Signed-Releases	🟢 8	5 out of the last 5 releases have a total of 5 signed artifacts.
Branch-Protection	🟢 5	branch protection is not maximal on development and all release branches
SAST	🟢 10	SAST tool is run on all commits

npm/is-stream

2.0.1

🟢 3.6

Details

Check	Score	Reason
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Packaging	⚠️ -1	packaging workflow not detected
Maintained	⚠️ 0	1 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Binary-Artifacts	🟢 10	no binaries found in the repo
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Security-Policy	🟢 9	security policy file detected
Code-Review	⚠️ 2	Found 8/30 approved changesets -- score normalized to 2
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Fuzzing	⚠️ 0	project is not fuzzed
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ 0	branch protection not enabled on development/release branches
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/kareem

3.4.1

Unknown

npm/mongodb

6.20.0

🟢 6.1

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Code-Review	🟢 9	Found 23/24 approved changesets -- score normalized to 9
Packaging	⚠️ -1	packaging workflow not detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Security-Policy	⚠️ 0	security policy file not detected
License	🟢 10	license file detected
Branch-Protection	🟢 5	branch protection is not maximal on development and all release branches
Signed-Releases	🟢 8	5 out of the last 5 releases have a total of 5 signed artifacts.
Binary-Artifacts	🟢 10	no binaries found in the repo
SAST	🟢 9	SAST tool detected but not run on all commits
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Fuzzing	⚠️ 0	project is not fuzzed

npm/mongodb

7.7.0

🟢 6.1

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Code-Review	🟢 9	Found 23/24 approved changesets -- score normalized to 9
Packaging	⚠️ -1	packaging workflow not detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Security-Policy	⚠️ 0	security policy file not detected
License	🟢 10	license file detected
Branch-Protection	🟢 5	branch protection is not maximal on development and all release branches
Signed-Releases	🟢 8	5 out of the last 5 releases have a total of 5 signed artifacts.
Binary-Artifacts	🟢 10	no binaries found in the repo
SAST	🟢 9	SAST tool detected but not run on all commits
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Fuzzing	⚠️ 0	project is not fuzzed

npm/mongodb-connection-string-url

3.0.2

🟢 5.4

Details

Check	Score	Reason
Code-Review	🟢 10	all changesets reviewed
Maintained	🟢 3	4 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 3
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Packaging	⚠️ -1	packaging workflow not detected
Pinned-Dependencies	🟢 3	dependency not pinned by hash detected -- score normalized to 3
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Security-Policy	⚠️ 0	security policy file not detected
Fuzzing	⚠️ 0	project is not fuzzed
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	🟢 5	branch protection is not maximal on development and all release branches
SAST	🟢 9	SAST tool is not run on all commits -- score normalized to 9

npm/mongodb-connection-string-url

7.0.2

🟢 5.4

Details

Check	Score	Reason
Code-Review	🟢 10	all changesets reviewed
Maintained	🟢 3	4 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 3
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Packaging	⚠️ -1	packaging workflow not detected
Pinned-Dependencies	🟢 3	dependency not pinned by hash detected -- score normalized to 3
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Security-Policy	⚠️ 0	security policy file not detected
Fuzzing	⚠️ 0	project is not fuzzed
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	🟢 5	branch protection is not maximal on development and all release branches
SAST	🟢 9	SAST tool is not run on all commits -- score normalized to 9

npm/mongoose

9.11.2

🟢 6.9

Details

Check	Score	Reason
Security-Policy	🟢 9	security policy file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Maintained	🟢 10	30 commit(s) and 8 issue activity found in the last 90 days -- score normalized to 10
Code-Review	🟢 6	Found 11/16 approved changesets -- score normalized to 6
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 3	dependency not pinned by hash detected -- score normalized to 3
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Fuzzing	⚠️ 0	project is not fuzzed
Packaging	🟢 10	packaging workflow detected
SAST	🟢 10	SAST tool is run on all commits

npm/mquery

6.0.0

Unknown

Scanned Files

experimental/license-inventory/package-lock.json

Bumps [mongoose](https://github.com/Automattic/mongoose) from 8.24.1 to 9.11.2. - [Release notes](https://github.com/Automattic/mongoose/releases) - [Changelog](https://github.com/Automattic/mongoose/blob/master/CHANGELOG.md) - [Commits](Automattic/mongoose@8.24.1...9.11.2) --- updated-dependencies: - dependency-name: mongoose dependency-version: 9.11.1 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot requested a review from a team as a code owner October 18, 2026 09:33

dependabot Bot added automated dependencies Pull requests that update a dependency file labels Oct 18, 2026

dependabot Bot mentioned this pull request Oct 18, 2026

chore(deps): bump mongoose from 8.24.1 to 9.11.0 in /experimental/license-inventory #1822

Closed

github-actions Bot added the evergreen label Oct 18, 2026

github-actions Bot added the maintenance label Oct 18, 2026

dependabot Bot changed the title ~~chore(deps): bump mongoose from 8.24.1 to 9.11.1 in /experimental/license-inventory~~ chore(deps): bump mongoose from 8.24.1 to 9.11.2 in /experimental/license-inventory Oct 27, 2026

dependabot Bot force-pushed the dependabot/npm_and_yarn/experimental/license-inventory/mongoose-9.11.1 branch from 0c488aa to 643e42f Compare October 27, 2026 05:39

dependabot Bot force-pushed the dependabot/npm_and_yarn/experimental/license-inventory/mongoose-9.11.1 branch from 643e42f to 41acb38 Compare October 27, 2026 06:10

jescalada closed this Oct 28, 2026

Navigation Menu

Repository navigation

chore(deps): bump mongoose from 8.24.1 to 9.11.2 in /experimental/license-inventory - #1841

chore(deps): bump mongoose from 8.24.1 to 9.11.2 in /experimental/license-inventory#1841
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/experimental/license-inventory/mongoose-9.11.1

dependabot Bot commented on behalf of github Oct 18, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Oct 18, 2026

Uh oh!

netlify Bot commented Oct 18, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 18, 2026 •

edited

Loading

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Oct 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

9.11.2 / 2026-10-12

9.11.1 / 2026-10-07

9.11.0 / 2026-10-05

9.10.4 / 2026-10-02

9.10.3 / 2026-09-29

9.10.2 / 2026-09-22

9.11.2 / 2026-10-12

9.11.1 / 2026-10-07

9.11.0 / 2026-10-05

8.24.5 / 2026-10-04

9.10.4 / 2026-10-02

9.10.3 / 2026-09-29

Uh oh!

dependabot Bot commented on behalf of github Oct 18, 2026

Labels

Uh oh!

netlify Bot commented Oct 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for endearing-brigadeiros-63f9d0 canceled.

Uh oh!

github-actions Bot commented Oct 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Dependency Review

OpenSSF Scorecard

Scanned Files

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot Bot commented on behalf of github Oct 18, 2026 •

edited

Loading

netlify Bot commented Oct 18, 2026 •

edited

Loading

github-actions Bot commented Oct 18, 2026 •

edited

Loading