build(deps): bump mongoose from 8.24.7 to 9.11.4 by dependabot[bot] · Pull Request #215 · LibreChat-AI/admin-panel

dependabot · 2026-11-01T09:10:28Z

Bumps mongoose from 8.24.7 to 9.11.4.

Release notes

9.11.4 / 2026-10-23

fix: avoid walking into inherited properties like toString when hydrating documents, setting dotted paths, and merging updates

fix: only use own properties when looking up discriminators by key

fix(schema): disallow setting special properties via virtual()

fix(query): respect connection-level sanitizeFilter in queries

fix(query): disallow special properties like __proto__ as paths in where() and mod()

fix(deps): upgrade mquery -> 6.0.1 to avoid prototype pollution with query helpers like gt() and in()

9.11.3 / 2026-10-21

fix(update): honor overwriteImmutable in upserts and nested timestamps #16614 #15781 #8619 AbdelrahmanHafez

fix(model): stop Model.validate() crashing on missing nested objects #16600 NotAFlightRisk

fix(connection): don't disable autoIndex/autoCreate for a primary ReadPreference instance #16592 NgoQuocViet2001

docs: remove references to MongoDB versions older than 6.x #16593

9.11.2 / 2026-10-12

perf: avoid applying saveSubdocs and sharding plugins to subdocuments #16585

perf: upgrade to kareem@3.4.1 for mongoosejs/kareem#47 #16588

fix(model): cast array filter values in bulkWrite() #16574 #16573 OmBhandwaldar

fix(schema): allow function messages for number min/max and string minlength #16579 #16572 #8512 NotAFlightRisk

types: make MergeType more efficiently handle MergeType<A, {}> #16581 #16580

docs: fix broken API anchors and a malformed link #16583 SatvikMishra08

9.11.1 / 2026-10-07

fix(document): call recursive toObject() when setting a path to a nested object #16571

fix(update): keep casting array filters after a path not in the schema #16558 giaBaoJS

fix(document): apply flattenDecimals when toObject() takes the shallow fast path #16569 #16568 jeremyml

fix(query): cast operators under $not inside $elemMatch on primitive arrays #16542 #13880 breken-ai

fix(query): use embedded discriminator schema when filter selects the key with $eq or $in #16543 breken-ai

fix(documentarray): don't pass arrayPathIndex to subdocuments when initializing nested document arrays #16546 Mohamed-Elshesheny

fix(cursor): await driver cleanup when destroying query cursors #16562 #16560 IbrahimHafez1

fix(cursor): reject getDriverCursor after initialization errors #16563 #16561 IbrahimHafez1

types(schema): treat Int32 paths as number #16565 #16564 lazerg

types(models): align UpdateOneModel and UpdateManyModel update typing with UpdateQuery #16559 #16545 aipd506

9.11.0 / 2026-10-05

feat: use MongoDB Node.js driver 7.7.x #16550

feat(query): add Query.prototype.findAndCount() for composable paginated queries #16508 #16504 lokeshllkumar

fix: avoid double-calling validators on document arrays underneath nested paths #16484 #16291 #5411

types: pass TLeanResultType into query for type narrowing support with lean() #16523 #16519

docs(guide): use async/await instead of removed callbacks #16566 joi-agent

test: run TypeScript tests on typescript 5+7 with combinations of exactOptionalPropertyTypes, skipLibCheck, strict #16510 #16506

9.10.4 / 2026-10-02

fix: handle MongoDB server 9.x returning collation: { locale: 'simple' } on all indexes #16557

... (truncated)

Changelog

Sourced from mongoose's changelog.

9.11.4 / 2026-10-23

fix: avoid walking into inherited properties like toString when hydrating documents, setting dotted paths, and merging updates

fix: only use own properties when looking up discriminators by key

fix(schema): disallow setting special properties via virtual()

fix(query): respect connection-level sanitizeFilter in queries

fix(query): disallow special properties like __proto__ as paths in where() and mod()

fix(deps): upgrade mquery -> 6.0.1 to avoid prototype pollution with query helpers like gt() and in()

9.11.3 / 2026-10-21

fix(update): honor overwriteImmutable in upserts and nested timestamps #16614 #15781 #8619 AbdelrahmanHafez

fix(model): stop Model.validate() crashing on missing nested objects #16600 NotAFlightRisk

fix(connection): don't disable autoIndex/autoCreate for a primary ReadPreference instance #16592 NgoQuocViet2001

docs: remove references to MongoDB versions older than 6.x #16593

8.24.6 / 2026-10-20

fix(array): compare dates by value in indexOf() so pull() removes them #16590 #16535 mrityunjay-pandey

fix: preserve circular arrays when cloning with a seen map #16598 #16514 mrityunjay-pandey

fix(cast): reject arrays when casting to Int32 or Double #16597 #16446 mrityunjay-pandey

fix(query): avoid path collision when excluding subdocument with select: false child #16604 #16409 #12798 mrityunjay-pandey

fix(query): pass schema through when casting a nested \ comparison #16605 #16496 mrityunjay-pandey

9.11.2 / 2026-10-12

perf: avoid applying saveSubdocs and sharding plugins to subdocuments #16585

perf: upgrade to kareem@3.4.1 for mongoosejs/kareem#47 #16588

fix(model): cast array filter values in bulkWrite() #16574 #16573 OmBhandwaldar

fix(schema): allow function messages for number min/max and string minlength #16579 #16572 #8512 NotAFlightRisk

types: make MergeType more efficiently handle MergeType<A, {}> #16581 #16580

docs: fix broken API anchors and a malformed link #16583 SatvikMishra08

9.11.1 / 2026-10-07

fix(document): call recursive toObject() when setting a path to a nested object #16571

fix(update): keep casting array filters after a path not in the schema #16558 giaBaoJS

fix(document): apply flattenDecimals when toObject() takes the shallow fast path #16569 #16568 jeremyml

fix(query): cast operators under $not inside $elemMatch on primitive arrays #16542 #13880 breken-ai

fix(query): use embedded discriminator schema when filter selects the key with $eq or $in #16543 breken-ai

fix(documentarray): don't pass arrayPathIndex to subdocuments when initializing nested document arrays #16546 Mohamed-Elshesheny

fix(cursor): await driver cleanup when destroying query cursors #16562 #16560 IbrahimHafez1

fix(cursor): reject getDriverCursor after initialization errors #16563 #16561 IbrahimHafez1

types(schema): treat Int32 paths as number #16565 #16564 lazerg

types(models): align UpdateOneModel and UpdateManyModel update typing with UpdateQuery #16559 #16545 aipd506

9.11.0 / 2026-10-05

feat: use MongoDB Node.js driver 7.7.x #16550

feat(query): add Query.prototype.findAndCount() for composable paginated queries #16508 #16504 lokeshllkumar

... (truncated)

Commits

8d8b50f chore: release 9.11.4
1a95578 chore: bump mquery -> 6.0.1
e339a2a Merge branch 'vkarpov15/20261022/master/security'
12058e0 Merge branch 'vkarpov15/20261016/master/security'
b68f907 fix: only use own properties when looking up discriminators by key
e681842 fix: skip inherited properties in setDottedPath - not user facing but still g...
2a195d1 fix: avoid setting values underneath inherited properties when constructing n...
fc01d2f fix: avoid overriding built-in properties when copying conditions and avoid p...
74df776 fix: disallow setting special properties via virtual()
4bb6594 fix(query): respect connection-level sanitizeFilter in queries
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [mongoose](https://github.com/Automattic/mongoose) from 8.24.7 to 9.11.4. - [Release notes](https://github.com/Automattic/mongoose/releases) - [Changelog](https://github.com/Automattic/mongoose/blob/master/CHANGELOG.md) - [Commits](Automattic/mongoose@8.24.7...9.11.4) --- updated-dependencies: - dependency-name: mongoose dependency-version: 9.11.4 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 1, 2026

Navigation Menu

Repository navigation

build(deps): bump mongoose from 8.24.7 to 9.11.4 - #215

build(deps): bump mongoose from 8.24.7 to 9.11.4#215
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bun/mongoose-9.11.4

dependabot Bot commented on behalf of github Nov 1, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Nov 1, 2026

9.11.4 / 2026-10-23

9.11.3 / 2026-10-21

9.11.2 / 2026-10-12

9.11.1 / 2026-10-07

9.11.0 / 2026-10-05

9.10.4 / 2026-10-02

9.11.4 / 2026-10-23

9.11.3 / 2026-10-21

8.24.6 / 2026-10-20

9.11.2 / 2026-10-12

9.11.1 / 2026-10-07

9.11.0 / 2026-10-05

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants