[Snyk] Upgrade mongoose from 5.7.5 to 5.13.22 by koolsashi2k6 · Pull Request #1 · CodeScanTest/secDevLabs

koolsashi2k6 · 2024-02-28T15:28:34Z

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to upgrade mongoose from 5.7.5 to 5.13.22.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

The recommended version is 131 versions ahead of your current version.
The recommended version was released 2 months ago, on 2024-01-02.

The recommended version fixes:

Issue	PriorityScore (*)	Exploit Maturity
Internal Property Tampering SNYK-JS-BSON-561052	165/1000 Why? Confidentiality impact: High, Integrity impact: High, Availability impact: High, Scope: Unchanged, Exploit Maturity: Unproven, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: High, Attack Vector: Network, EPSS: 0.00349, Social Trends: No, Days since published: 1435, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: High, Provider Urgency: High, Package Popularity Score: 99, Impact: 9.79, Likelihood: 1.68, Score Version: V5	No Known Exploit
Internal Property Tampering SNYK-JS-BSON-6056525	165/1000 Why? Confidentiality impact: High, Integrity impact: High, Availability impact: High, Scope: Unchanged, Exploit Maturity: Unproven, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: High, Attack Vector: Network, EPSS: 0.00349, Social Trends: No, Days since published: 1435, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: High, Provider Urgency: High, Package Popularity Score: 99, Impact: 9.79, Likelihood: 1.68, Score Version: V5	No Known Exploit
Prototype Pollution SNYK-JS-MONGOOSE-2961688	165/1000 Why? Confidentiality impact: High, Integrity impact: High, Availability impact: High, Scope: Unchanged, Exploit Maturity: Unproven, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: High, Attack Vector: Network, EPSS: 0.00349, Social Trends: No, Days since published: 1435, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: High, Provider Urgency: High, Package Popularity Score: 99, Impact: 9.79, Likelihood: 1.68, Score Version: V5	Proof of Concept
Prototype Pollution SNYK-JS-MONGOOSE-5777721	165/1000 Why? Confidentiality impact: High, Integrity impact: High, Availability impact: High, Scope: Unchanged, Exploit Maturity: Unproven, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: High, Attack Vector: Network, EPSS: 0.00349, Social Trends: No, Days since published: 1435, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: High, Provider Urgency: High, Package Popularity Score: 99, Impact: 9.79, Likelihood: 1.68, Score Version: V5	Proof of Concept
Prototype Pollution SNYK-JS-MQUERY-1050858	165/1000 Why? Confidentiality impact: High, Integrity impact: High, Availability impact: High, Scope: Unchanged, Exploit Maturity: Unproven, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: High, Attack Vector: Network, EPSS: 0.00349, Social Trends: No, Days since published: 1435, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: High, Provider Urgency: High, Package Popularity Score: 99, Impact: 9.79, Likelihood: 1.68, Score Version: V5	Proof of Concept
Prototype Pollution SNYK-JS-MQUERY-1089718	165/1000 Why? Confidentiality impact: High, Integrity impact: High, Availability impact: High, Scope: Unchanged, Exploit Maturity: Unproven, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: High, Attack Vector: Network, EPSS: 0.00349, Social Trends: No, Days since published: 1435, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: High, Provider Urgency: High, Package Popularity Score: 99, Impact: 9.79, Likelihood: 1.68, Score Version: V5	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-SEMVER-3247795	165/1000 Why? Confidentiality impact: High, Integrity impact: High, Availability impact: High, Scope: Unchanged, Exploit Maturity: Unproven, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: High, Attack Vector: Network, EPSS: 0.00349, Social Trends: No, Days since published: 1435, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: High, Provider Urgency: High, Package Popularity Score: 99, Impact: 9.79, Likelihood: 1.68, Score Version: V5	Proof of Concept
Prototype Pollution SNYK-JS-MONGOOSE-1086688	165/1000 Why? Confidentiality impact: High, Integrity impact: High, Availability impact: High, Scope: Unchanged, Exploit Maturity: Unproven, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: High, Attack Vector: Network, EPSS: 0.00349, Social Trends: No, Days since published: 1435, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: High, Provider Urgency: High, Package Popularity Score: 99, Impact: 9.79, Likelihood: 1.68, Score Version: V5	Proof of Concept
Prototype Pollution SNYK-JS-MPATH-1577289	165/1000 Why? Confidentiality impact: High, Integrity impact: High, Availability impact: High, Scope: Unchanged, Exploit Maturity: Unproven, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: High, Attack Vector: Network, EPSS: 0.00349, Social Trends: No, Days since published: 1435, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: High, Provider Urgency: High, Package Popularity Score: 99, Impact: 9.79, Likelihood: 1.68, Score Version: V5	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Release notes

Package name: mongoose

5.13.22 - 2024-01-02
5.13.21 - 2023-10-19
5.13.20 - 2023-07-12
5.13.19 - 2023-06-22
5.13.18 - 2023-06-22
5.13.17 - 2023-04-04
5.13.16 - 2023-02-20
5.13.15 - 2022-08-22
5.13.14 - 2021-12-27
5.13.13 - 2021-11-02
5.13.12 - 2021-10-19
5.13.11 - 2021-10-12
5.13.10 - 2021-10-05
5.13.9 - 2021-09-06
5.13.8 - 2021-08-23
5.13.7 - 2021-08-11
5.13.6 - 2021-08-09
5.13.5 - 2021-07-30
5.13.4 - 2021-07-28
5.13.3 - 2021-07-16
5.13.2 - 2021-07-03
5.13.1 - 2021-07-02
5.13.0 - 2021-06-28
5.12.15 - 2021-06-25
5.12.14 - 2021-06-15
5.12.13 - 2021-06-04
5.12.12 - 2021-05-28
5.12.11 - 2021-05-24
5.12.10 - 2021-05-18
5.12.9 - 2021-05-13
5.12.8 - 2021-05-10
5.12.7 - 2021-04-29
5.12.6 - 2021-04-27
5.12.5 - 2021-04-19
5.12.4 - 2021-04-15
5.12.3 - 2021-03-31
5.12.2 - 2021-03-22
5.12.1 - 2021-03-18
5.12.0 - 2021-03-11
5.11.20 - 2021-03-11
5.11.19 - 2021-03-05
5.11.18 - 2021-02-23
5.11.17 - 2021-02-17
5.11.16 - 2021-02-12
5.11.15 - 2021-02-03
5.11.14 - 2021-01-28
5.11.13 - 2021-01-20
5.11.12 - 2021-01-14
5.11.11 - 2021-01-08
5.11.10 - 2021-01-04
5.11.9 - 2020-12-28
5.11.8 - 2020-12-14
5.11.7 - 2020-12-10
5.11.6 - 2020-12-09
5.11.5 - 2020-12-07
5.11.4 - 2020-12-04
5.11.3 - 2020-12-03
5.11.2 - 2020-12-02
5.11.1 - 2020-12-01
5.11.0 - 2020-11-30
5.10.19 - 2020-11-30
5.10.18 - 2020-11-29
5.10.17 - 2020-11-27
5.10.16 - 2020-11-25
5.10.15 - 2020-11-16
5.10.14 - 2020-11-12
5.10.13 - 2020-11-06
5.10.12 - 2020-11-04
5.10.11 - 2020-10-26
5.10.10 - 2020-10-23
5.10.9 - 2020-10-09
5.10.8 - 2020-10-05
5.10.7 - 2020-09-24
5.10.6 - 2020-09-18
5.10.5 - 2020-09-11
5.10.4 - 2020-09-09
5.10.3 - 2020-09-03
5.10.2 - 2020-08-28
5.10.1 - 2020-08-26
5.10.0 - 2020-08-14
5.9.29 - 2020-08-13
5.9.28 - 2020-08-07
5.9.27 - 2020-07-31
5.9.26 - 2020-07-27
5.9.25 - 2020-07-17
5.9.24 - 2020-07-13
5.9.23 - 2020-07-10
5.9.22 - 2020-07-06
5.9.21 - 2020-07-01
5.9.20 - 2020-06-22
5.9.19 - 2020-06-15
5.9.18 - 2020-06-05
5.9.17 - 2020-06-02
5.9.16 - 2020-05-25
5.9.15 - 2020-05-18
5.9.14 - 2020-05-13
5.9.13 - 2020-05-08
5.9.12 - 2020-05-04
5.9.11 - 2020-04-30
5.9.10 - 2020-04-20
5.9.9 - 2020-04-13
5.9.7 - 2020-03-30
5.9.6 - 2020-03-23
5.9.5 - 2020-03-16
5.9.4 - 2020-03-09
5.9.3 - 2020-03-02
5.9.2 - 2020-02-21
5.9.1 - 2020-02-14
5.9.0 - 2020-02-13
5.8.13 - 2020-02-13
5.8.12 - 2020-02-12
5.8.11 - 2020-01-31
5.8.10 - 2020-01-27
5.8.9 - 2020-01-17
5.8.7 - 2020-01-10
5.8.6 - 2020-01-08
5.8.5 - 2020-01-06
5.8.4 - 2020-01-02
5.8.3 - 2019-12-23
5.8.2 - 2019-12-20
5.8.1 - 2019-12-12
5.8.0 - 2019-12-09
5.7.14 - 2019-12-06
5.7.13 - 2019-11-29
5.7.12 - 2019-11-19
5.7.11 - 2019-11-14
5.7.10 - 2019-11-11
5.7.9 - 2019-11-08
5.7.8 - 2019-11-05
5.7.7 - 2019-10-24
5.7.6 - 2019-10-21
5.7.5 - 2019-10-14

from mongoose GitHub release notes

Commit messages

Package name: mongoose

2642bb5 chore: release 5.13.22
e894fe8 types: add `skipValidation`, `strict`, `timestamps` as options for bulkWrite()
c5fa9b4 fix: also allow setting nested field to undefined re: #14205
66e5c1b fix: fix some merge issues with #14226 re: #14205
a96164e fix(document): allow setting nested path to `null`
7ff7e33 perf(schema): remove unnecessary lookahead in numeric subpath check
09c55b3 pin another version for node 4 build
a1c9fb1 chore: fix typo
7bd07d9 try pinning @ types/babylon dep to fix build issues
21639c8 chore: release 5.13.21
78257e2 Merge pull request #13670 from Automattic/IslandRhythms/backport-pull-12954
443092a add back `uniqueDocs`
e7ff415 fix: lint
deedb88 backport GeoNear to 5.x
11bb2c4 Merge pull request #13655 from Automattic/IslandRhythms/backport-npm
702b4a0 Update .npmignore
0f3997a chore: release 5.13.20
f1efabf fix: avoid prototype pollution on init
98e0762 chore: release 5.13.19
7e36d21 chore: release 5.13.18
6759c60 undo accidental changes and actually pin @ types/json-schema
4ed4a89 chore: pin version of @ types/json-schema because of install issues on node v4 and v6
9a9536d Merge pull request #13535 from lorand-horvath/patch-12
26424d5 5.x - bump mongodb driver to 3.7.4

Compare

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs

Snyk has created this PR to upgrade mongoose from 5.7.5 to 5.13.22. See this package in npm: https://www.npmjs.com/package/mongoose See this project in Snyk: https://app.snyk.io/org/hootsuite-poc/project/752da106-da31-43bf-9fb4-d9573f494fde?utm_source=github&utm_medium=referral&page=upgrade-pr

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[Snyk] Upgrade mongoose from 5.7.5 to 5.13.22#1

[Snyk] Upgrade mongoose from 5.7.5 to 5.13.22#1
koolsashi2k6 wants to merge 1 commit into
masterfrom
snyk-upgrade-db606573f788b5ae7d9a336688f5fa75

koolsashi2k6 commented Feb 28, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

koolsashi2k6 commented Feb 28, 2024

Snyk has created this PR to upgrade mongoose from 5.7.5 to 5.13.22.

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants