chore(deps): bump mongoose from 8.22.1 to 8.24.1 in /TallerNode

[dependabot]

Bumps mongoose from 8.22.1 to 8.24.1.

Release notes

Sourced from mongoose's releases.

8.24.1

• fix(documentarray): reindex subdocs after array reordering and removal so subsequent nested changes save using the correct path #16282 AbdelrahmanHafez
• fix(document): avoid accessing special properties in Document.prototype.get()
• fix(schema): avoid returning inherited properties from schema path lookups, including paths underneath maps of subdocuments
• fix(clone): isolate cloned arrays from source documents #16281 AbdelrahmanHafez
• types: enable exactOptionalPropertyTypes in TypeScript tests #16287

8.24.0 / 2026-05-14

• feat(aggregate): add pipelineForUnionWith() helper to allow reusing pipelines with $unionWith in TypeScript #16247 #16041 #16033
• fix(connection): handle calling watch() on disconnected connection #16246 #16034
• types: handle compiling with exactOptionalPropertyTypes #16286 #16273

8.23.1 / 2026-04-23

• fix(model): support sort option in Model.bulkWrite() updateOne and replaceOne operations #16091 #16079
• fix(setDefaultsOnInsert): check child filter paths before applying defaults (backport #16031 to 8.x) #16219 marklai1998
• fix(schema): always pass raw string value to error validators, only trim to 30 chars for maxlength validator #16238 #16236 #15550 #15571

8.23.0 / 2026-02-09

• feat(document): add flattenUUIDs option to toObject() and toJSON() (backport #15021 to 8.x)

Changelog

Sourced from mongoose's changelog.

8.24.1 / 2026-06-22

• fix(documentarray): reindex subdocs after array reordering and removal so subsequent nested changes save using the correct path #16282 AbdelrahmanHafez
• fix(document): avoid accessing special properties in Document.prototype.get()
• fix(schema): avoid returning inherited properties from schema path lookups, including paths underneath maps of subdocuments
• fix(clone): isolate cloned arrays from source documents #16281 AbdelrahmanHafez
• types: enable exactOptionalPropertyTypes in TypeScript tests #16287

9.7.2 / 2026-06-22

• fix(documentarray): reindex subdocs after array reordering and removal so subsequent nested changes save using the correct path #16282 AbdelrahmanHafez
• fix(document): avoid accessing special properties in Document.prototype.get()
• fix(schema): only return own properties in schematype lookups and disallow setting schema paths under special properties
• docs: update homepage sponsor layout

9.7.1 / 2026-06-17

• perf(document+model): improve save performance by avoiding unnecessary promise allocations and reducing path/default/dirty-state overhead #16331
• fix(schema): include ObjectId regex pattern in toJSONSchema() output #16335 #16334 AbdelrahmanHafez
• fix(populate): split populate into separate queries per document if the resulting $in filter has more than 50k elements to reduce risk of BSON size errors #16333 #5890
• docs: add assistant sidebar with MongoDB Knowledge integration #16311 #16283
• docs: update docs copy buttons, edit links, homepage alignment, and llms.txt generation #16326 #16327 #16329

9.7.0 / 2026-06-09

• feat: add Node.js TracingChannel support for APM instrumentation #16275 #16105 logaretm
• feat(model): add standard schema adapter for models #16308 #16280
• fix(cursor): avoid waiting on buffering to run aggregation middleware #16289 #16284
• fix(document): throw error if overwriting array selected with $slice #16313 #2432
• fix(schema): remove validateSync() union fallback #16310 #16291 AbdelrahmanHafez
• types: cast primitive types within unions when applying create casting #16320 #16316
• docs: add llms.txt #16312 #15687
• docs: rewrite documents docs #16298
• docs(model): clarify some details on model.validate() casting #16308 #16280
• docs(findOneAndUpdate): clarify update handling of undefined #16299
• docs(model): fix link to be absolute #16321 hasezoey

9.6.3 / 2026-05-27

• fix(clone): isolate cloned arrays from source documents #16281 AbdelrahmanHafez
• fix(update): preserve user-provided $setOnInsert.createdAt with overwriteImmutable: true #16278 #15781 AbdelrahmanHafez
• fix(schema): always pass raw string value to error validators, only trim to 30 chars for maxlength validator #16238 #16236 #15550 #15571
• types: add $percentile to TypeScript aggregation expression types #16290 #16288
• docs: update default pool sizes on createConnection() #16295 torbiak-samdesk
• docs: improve code block copy button behavior and sidebar scrolling #16294 DraXx-Van
• docs: remove broken link to deleted schema example #16297 kaseken

8.24.0 / 2026-05-14

• feat(aggregate): add pipelineForUnionWith() helper to allow reusing pipelines with $unionWith in TypeScript #16247 #16041 #16033

... (truncated)

Commits

• d5dd19e chore: release 8.24.1
• 0c346a4 fix(documentarray): reindex subdocs after reordering (#16282)
• 550b803 fix(document): additional defensive checks in Document.prototype.get()
• 953d085 fix(schema): only return own properties in schematype lookups
• 1e1679f types: use exactOptionalPropertyTypes in tests (#16287)
• 051b095 fix(clone): isolate cloned arrays from source documents (#16281)
• 89ca7f2 chore: release 8.24.0
• 6922aa4 Merge pull request #16286 from Automattic/vkarpov15/gh-16273-8x
• 4295eff types: handle compiling with exactOptionalPropertyTypes
• f712fdb Merge pull request #16246 from Automattic/vkarpov15/gh-16034
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​mongoose@​8.22.1 ⏵ 8.24.1	-12	+2

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm mongoose is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: TallerNode/package-lock.json → npm/mongoose@8.24.1 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/mongoose@8.24.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report