[Snyk] Upgrade mongoose from 5.11.16 to 5.12.8

[snyk-bot]

Snyk has created this PR to upgrade mongoose from 5.11.16 to 5.12.8.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

• The recommended version is 13 versions ahead of your current version.
• The recommended version was released 21 days ago, on 2021-05-10.

The recommended version fixes:

Severity	Issue	PriorityScore (*)	Exploit Maturity
	Prototype Pollution SNYK-JS-MQUERY-1089718	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Proof of Concept
	Prototype Pollution SNYK-JS-MONGOOSE-1086688	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Release notes

Package name: mongoose

• 5.12.8 - 2021-05-10
  

  chore: release 5.12.8

• 5.12.7 - 2021-04-29
  

  chore: release 5.12.7

• 5.12.6 - 2021-04-27
  

  chore: release 5.12.6

• 5.12.5 - 2021-04-19
  

  chore: release 5.12.5

• 5.12.4 - 2021-04-15
  

  chore: release 5.12.4

• 5.12.3 - 2021-03-31
  

  chore: release 5.12.3

• 5.12.2 - 2021-03-22
• 5.12.1 - 2021-03-18
• 5.12.0 - 2021-03-11
• 5.11.20 - 2021-03-11
• 5.11.19 - 2021-03-05
• 5.11.18 - 2021-02-23
• 5.11.17 - 2021-02-17
• 5.11.16 - 2021-02-12

from mongoose GitHub release notes

Commit messages

Package name: mongoose

• a116b62 chore: release 5.12.8
• 7bedeb7 docs(typescript): add query helpers tutorial
• 9726a81 docs(typescript): add a typescript intro tutorial and statics tutorial
• d65070e fix(query): add `allowDiskUse()` method to improve setting MongoDB 4.4's new `allowDiskUse` option
• 2f0d4ef Merge pull request #10228 from Automattic/gh-10144
• 2cdf8e3 Merge branch 'master' into gh-10144
• 909cc87 docs(deprecations): add note that you can safely ignore `useFindAndModify` and `useCreateIndex` deprecation warnings
• 97145d5 fix(populate): allow populating paths under mixed schematypes where some documents have non-object properties
• cb3fdc4 test(populate): repro #10191
• c4ba0e9 fix(index.d.ts): separate `UpdateQuery` from `UpdateWithAggregationPipeline` for cases when `UpdateQuery` is used as a function param
• 2793843 Merge branch 'master' into gh-9603
• 10dfa8a fix(populate): handle populating immutable array paths
• 5ec0526 test(populate): repro #10159
• d7fd9f2 Merge pull request #10213 from michaln-q/patch-typescript-definitions
• d018326 Merge pull request #10201 from AbdelrahmanHafez/patch-10
• 7cc0426 Merge pull request #10210 from Automattic/gh-10166
• df4b340 fix: (index.d.ts) don't require error value in pre/post hooks
• 7c39d34 true fix
• 7b361fe Update errors.validation.test.js
• 3c2ae2f fix
• 302f18f change model name to fix possible errors
• 6f269d8 final check
• c2a00f1 check
• 0459e8b Update cast.js

Compare

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs

[github-actions]

Stale pull request message