Skip to content

Commit 5d33068

Browse files
arnaud-moncelarnaud-moncel
authored
fix(datasource mongoose): bump mongoose to 8.21 to fix vulnerability (#1422)
fix #1421
1 parent 4b66b9a commit 5d33068

5 files changed

Lines changed: 39 additions & 39 deletions

File tree

‎packages/_example/package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@
2424
"fastify4": "npm:fastify@^4.29.0",
2525
"koa": "^3.0.1",
2626
"mariadb": "^3.0.2",
27-
"mongoose": "8.8.4",
27+
"mongoose": "8.21.0",
2828
"mysql2": "^3.0.1",
2929
"pg": "^8.8.0",
3030
"reflect-metadata": "^0.1.13",

‎packages/datasource-mongo/package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@
1515
"@forestadmin/datasource-mongoose": "1.12.5",
1616
"@forestadmin/datasource-toolkit": "1.50.1",
1717
"json-stringify-pretty-compact": "^3.0.0",
18-
"mongoose": "8.8.4",
18+
"mongoose": "8.21.0",
1919
"tunnel-ssh": "^5.2.0"
2020
},
2121
"files": [

‎packages/datasource-mongoose/package.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -20,10 +20,10 @@
2020
"luxon": "^3.2.1"
2121
},
2222
"devDependencies": {
23-
"mongoose": "8.8.4"
23+
"mongoose": "8.21.0"
2424
},
2525
"peerDependencies": {
26-
"mongoose": "6.x || 7.x || >=8.0.0 <=8.8.x"
26+
"mongoose": "6.x || 7.x || 8.x"
2727
},
2828
"scripts": {
2929
"build": "tsc",

‎packages/datasource-mongoose/src/collection.ts‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -205,8 +205,8 @@ export default class MongooseCollection extends BaseCollection {
205205
if (this.stack.length < 2) {
206206
// We are updating a real document, we can delegate the work to mongoose directly.
207207
await (ids.length > 1
208-
? this.model.updateMany({ _id: ids }, patch, { rawResult: true })
209-
: this.model.updateOne({ _id: ids }, patch, { rawResult: true }));
208+
? this.model.updateMany({ _id: ids }, patch)
209+
: this.model.updateOne({ _id: ids }, patch));
210210
} else if (patch.parentId && ids.some(id => !id.startsWith(patch.parentId))) {
211211
// When we update subdocuments, we need to make sure that the new parent is the same as the
212212
// old one: reparenting is not supported.
@@ -238,8 +238,8 @@ export default class MongooseCollection extends BaseCollection {
238238
if (!Object.keys(subdocPatch).length) return null;
239239

240240
return ids.length > 1
241-
? this.model.updateMany({ _id: rootIds }, subdocPatch, { rawResult: true })
242-
: this.model.updateOne({ _id: rootIds }, subdocPatch, { rawResult: true });
241+
? this.model.updateMany({ _id: rootIds }, subdocPatch)
242+
: this.model.updateOne({ _id: rootIds }, subdocPatch);
243243
});
244244

245245
await Promise.all(promises);

‎yarn.lock‎

Lines changed: 31 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -2697,7 +2697,7 @@
26972697
dependencies:
26982698
sparse-bitfield "^3.0.3"
26992699

2700-
"@mongodb-js/saslprep@^1.1.5":
2700+
"@mongodb-js/saslprep@^1.3.0":
27012701
version "1.4.4"
27022702
resolved "https://registry.yarnpkg.com/@mongodb-js/saslprep/-/saslprep-1.4.4.tgz#34a946ff6ae142e8f2259b87f2935f8284ba874d"
27032703
integrity sha512-p7X/ytJDIdwUfFL/CLOhKgdfJe1Fa8uw9seJYvdOmnP9JBWGWHW69HkOixXS6Wy9yvGf1MbhcS6lVmrhy4jm2g==
@@ -6348,7 +6348,7 @@ bson@^4.7.2:
63486348
dependencies:
63496349
buffer "^5.6.0"
63506350

6351-
bson@^6.7.0:
6351+
bson@^6.10.4:
63526352
version "6.10.4"
63536353
resolved "https://registry.yarnpkg.com/bson/-/bson-6.10.4.tgz#d530733bb5bb16fb25c162e01a3344fab332fd2b"
63546354
integrity sha512-WIsKqkSC0ABoBJuT1LEX+2HEvNmNKKgnTAyd0fL8qzK4SH2i9NXg+t08YtdZp/V9IZ33cxe3iV4yM0qg8lMQng==
@@ -13277,13 +13277,13 @@ mongodb-connection-string-url@^2.6.0:
1327713277
"@types/whatwg-url" "^8.2.1"
1327813278
whatwg-url "^11.0.0"
1327913279

13280-
mongodb-connection-string-url@^3.0.0:
13281-
version "3.0.1"
13282-
resolved "https://registry.yarnpkg.com/mongodb-connection-string-url/-/mongodb-connection-string-url-3.0.1.tgz#c13e6ac284ae401752ebafdb8cd7f16c6723b141"
13283-
integrity sha512-XqMGwRX0Lgn05TDB4PyG2h2kKO/FfWJyCzYQbIhXUxz7ETt0I/FqHjUeqj37irJ+Dl1ZtU82uYyj14u2XsZKfg==
13280+
mongodb-connection-string-url@^3.0.2:
13281+
version "3.0.2"
13282+
resolved "https://registry.yarnpkg.com/mongodb-connection-string-url/-/mongodb-connection-string-url-3.0.2.tgz#e223089dfa0a5fa9bf505f8aedcbc67b077b33e7"
13283+
integrity sha512-rMO7CGo/9BFwyZABcKAWL8UJwH/Kc2x0g72uhDWzG48URRax5TCIcJ7Rc3RZqffZzO/Gwff/jyKwCU9TN8gehA==
1328413284
dependencies:
1328513285
"@types/whatwg-url" "^11.0.2"
13286-
whatwg-url "^13.0.0"
13286+
whatwg-url "^14.1.0 || ^13.0.0"
1328713287

1328813288
mongodb@4.17.2:
1328913289
version "4.17.2"
@@ -13297,23 +13297,23 @@ mongodb@4.17.2:
1329713297
"@aws-sdk/credential-providers" "^3.186.0"
1329813298
"@mongodb-js/saslprep" "^1.1.0"
1329913299

13300-
mongodb@~6.10.0:
13301-
version "6.10.0"
13302-
resolved "https://registry.yarnpkg.com/mongodb/-/mongodb-6.10.0.tgz#20a9f1cf3c6829e75fc39e6d8c1c19f164209c2e"
13303-
integrity sha512-gP9vduuYWb9ZkDM546M+MP2qKVk5ZG2wPF63OvSRuUbqCR+11ZCAE1mOfllhlAG0wcoJY5yDL/rV3OmYEwXIzg==
13300+
mongodb@~6.20.0:
13301+
version "6.20.0"
13302+
resolved "https://registry.yarnpkg.com/mongodb/-/mongodb-6.20.0.tgz#5212dcf512719385287aa4574265352eefb01d8e"
13303+
integrity sha512-Tl6MEIU3K4Rq3TSHd+sZQqRBoGlFsOgNrH5ltAcFBV62Re3Fd+FcaVf8uSEQFOJ51SDowDVttBTONMfoYWrWlQ==
1330413304
dependencies:
13305-
"@mongodb-js/saslprep" "^1.1.5"
13306-
bson "^6.7.0"
13307-
mongodb-connection-string-url "^3.0.0"
13305+
"@mongodb-js/saslprep" "^1.3.0"
13306+
bson "^6.10.4"
13307+
mongodb-connection-string-url "^3.0.2"
1330813308

13309-
mongoose@8.8.4:
13310-
version "8.8.4"
13311-
resolved "https://registry.yarnpkg.com/mongoose/-/mongoose-8.8.4.tgz#11e3991a7fd03596a79bc9f9b2fe8f3e75b7a30d"
13312-
integrity sha512-yJbn695qCsqDO+xyPII29x2R7flzXhxCDv09mMZPSGllf0sm4jKw3E9s9uvQ9hjO6bL2xjU8KKowYqcY9eSTMQ==
13309+
mongoose@8.21.0:
13310+
version "8.21.0"
13311+
resolved "https://registry.yarnpkg.com/mongoose/-/mongoose-8.21.0.tgz#e4b940a6b22c2fc176916667766f34656e352906"
13312+
integrity sha512-dW2U01gN8EVQT5KAO5AkzjbqWc8A/CsEq15jOzq/M9ISpy8jw3iq7W9ZP135h9zykFOMt3AMxq4+anvt2YNJgw==
1331313313
dependencies:
13314-
bson "^6.7.0"
13314+
bson "^6.10.4"
1331513315
kareem "2.6.3"
13316-
mongodb "~6.10.0"
13316+
mongodb "~6.20.0"
1331713317
mpath "0.9.0"
1331813318
mquery "5.0.0"
1331913319
ms "2.1.3"
@@ -15408,7 +15408,7 @@ punycode.js@^2.3.1:
1540815408
resolved "https://registry.yarnpkg.com/punycode.js/-/punycode.js-2.3.1.tgz#6b53e56ad75588234e79f4affa90972c7dd8cdb7"
1540915409
integrity sha512-uxFIHU0YlHYhDQtV4R9J6a52SLx28BCjT+4ieh7IGbgwVJWO+km431c4yRlREUAsAmt/uMjQUyQHNEPf0M39CA==
1541015410

15411-
punycode@2.x.x, punycode@^2.1.0, punycode@^2.1.1, punycode@^2.3.0:
15411+
punycode@2.x.x, punycode@^2.1.0, punycode@^2.1.1, punycode@^2.3.1:
1541215412
version "2.3.1"
1541315413
resolved "https://registry.yarnpkg.com/punycode/-/punycode-2.3.1.tgz#027422e2faec0b25e1549c3e1bd8309b9133b6e5"
1541415414
integrity sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg==
@@ -17455,12 +17455,12 @@ tr46@^3.0.0:
1745517455
dependencies:
1745617456
punycode "^2.1.1"
1745717457

17458-
tr46@^4.1.1:
17459-
version "4.1.1"
17460-
resolved "https://registry.yarnpkg.com/tr46/-/tr46-4.1.1.tgz#281a758dcc82aeb4fe38c7dfe4d11a395aac8469"
17461-
integrity sha512-2lv/66T7e5yNyhAAC4NaKe5nVavzuGJQVVtRYLyQ2OI8tsJ61PMLlelehb0wi2Hx6+hT/OJUWZcw8MjlSRnxvw==
17458+
tr46@^5.1.0:
17459+
version "5.1.1"
17460+
resolved "https://registry.yarnpkg.com/tr46/-/tr46-5.1.1.tgz#96ae867cddb8fdb64a49cc3059a8d428bcf238ca"
17461+
integrity sha512-hdF5ZgjTqgAntKkklYw0R03MG2x/bSzTtkxmIRw/sTNV8YXsCJ1tfLAX23lhxhHJlEf3CRCOCGGWw3vI3GaSPw==
1746217462
dependencies:
17463-
punycode "^2.3.0"
17463+
punycode "^2.3.1"
1746417464

1746517465
tr46@~0.0.3:
1746617466
version "0.0.3"
@@ -18326,12 +18326,12 @@ whatwg-url@^11.0.0:
1832618326
tr46 "^3.0.0"
1832718327
webidl-conversions "^7.0.0"
1832818328

18329-
whatwg-url@^13.0.0:
18330-
version "13.0.0"
18331-
resolved "https://registry.yarnpkg.com/whatwg-url/-/whatwg-url-13.0.0.tgz#b7b536aca48306394a34e44bda8e99f332410f8f"
18332-
integrity sha512-9WWbymnqj57+XEuqADHrCJ2eSXzn8WXIW/YSGaZtb2WKAInQ6CHfaUUcTyyver0p8BDg5StLQq8h1vtZuwmOig==
18329+
"whatwg-url@^14.1.0 || ^13.0.0":
18330+
version "14.2.0"
18331+
resolved "https://registry.yarnpkg.com/whatwg-url/-/whatwg-url-14.2.0.tgz#4ee02d5d725155dae004f6ae95c73e7ef5d95663"
18332+
integrity sha512-De72GdQZzNTUBBChsXueQUnPKDkg/5A5zp7pFDuQAj5UFoENpiACU0wlCvzpAGnTkj++ihpKwKyYewn/XNUbKw==
1833318333
dependencies:
18334-
tr46 "^4.1.1"
18334+
tr46 "^5.1.0"
1833518335
webidl-conversions "^7.0.0"
1833618336

1833718337
whatwg-url@^5.0.0:

0 commit comments

Comments
 (0)