[dependabot]

Bumps mongoose from 9.11.2 to 9.11.4.

Release notes

Sourced from mongoose's releases.

9.11.4 / 2026-10-23

• fix: avoid walking into inherited properties like toString when hydrating documents, setting dotted paths, and merging updates
• fix: only use own properties when looking up discriminators by key
• fix(schema): disallow setting special properties via virtual()
• fix(query): respect connection-level sanitizeFilter in queries
• fix(query): disallow special properties like __proto__ as paths in where() and mod()
• fix(deps): upgrade mquery -> 6.0.1 to avoid prototype pollution with query helpers like gt() and in()

9.11.3 / 2026-10-21

• fix(update): honor overwriteImmutable in upserts and nested timestamps #16614 #15781 #8619 AbdelrahmanHafez
• fix(model): stop Model.validate() crashing on missing nested objects #16600 NotAFlightRisk
• fix(connection): don't disable autoIndex/autoCreate for a primary ReadPreference instance #16592 NgoQuocViet2001
• docs: remove references to MongoDB versions older than 6.x #16593

Changelog

Sourced from mongoose's changelog.

9.11.4 / 2026-10-23

• fix: avoid walking into inherited properties like toString when hydrating documents, setting dotted paths, and merging updates
• fix: only use own properties when looking up discriminators by key
• fix(schema): disallow setting special properties via virtual()
• fix(query): respect connection-level sanitizeFilter in queries
• fix(query): disallow special properties like __proto__ as paths in where() and mod()
• fix(deps): upgrade mquery -> 6.0.1 to avoid prototype pollution with query helpers like gt() and in()

9.11.3 / 2026-10-21

• fix(update): honor overwriteImmutable in upserts and nested timestamps #16614 #15781 #8619 AbdelrahmanHafez
• fix(model): stop Model.validate() crashing on missing nested objects #16600 NotAFlightRisk
• fix(connection): don't disable autoIndex/autoCreate for a primary ReadPreference instance #16592 NgoQuocViet2001
• docs: remove references to MongoDB versions older than 6.x #16593

8.24.6 / 2026-10-20

• fix(array): compare dates by value in indexOf() so pull() removes them #16590 #16535 mrityunjay-pandey
• fix: preserve circular arrays when cloning with a seen map #16598 #16514 mrityunjay-pandey
• fix(cast): reject arrays when casting to Int32 or Double #16597 #16446 mrityunjay-pandey
• fix(query): avoid path collision when excluding subdocument with select: false child #16604 #16409 #12798 mrityunjay-pandey
• fix(query): pass schema through when casting a nested \ comparison #16605 #16496 mrityunjay-pandey

Commits

• 8d8b50f chore: release 9.11.4
• 1a95578 chore: bump mquery -> 6.0.1
• e339a2a Merge branch 'vkarpov15/20261022/master/security'
• 12058e0 Merge branch 'vkarpov15/20261016/master/security'
• b68f907 fix: only use own properties when looking up discriminators by key
• e681842 fix: skip inherited properties in setDottedPath - not user facing but still g...
• 2a195d1 fix: avoid setting values underneath inherited properties when constructing n...
• fc01d2f fix: avoid overriding built-in properties when copying conditions and avoid p...
• 74df776 fix: disallow setting special properties via virtual()
• 4bb6594 fix(query): respect connection-level sanitizeFilter in queries
• Additional commits viewable in compare view

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
codegamy	Ready	Preview	Oct 26, 2026 5:26pm UTC