deps: bump mongoose from 9.7.4 to 9.12.1 by dependabot[bot] · Pull Request #187 · khanhkit/AgentProxy

dependabot · 2026-11-10T20:49:05Z

Bumps mongoose from 9.7.4 to 9.12.1.

Release notes

9.12.1 / 2026-11-09

perf(update): avoid quadratic ancestor lookup in update validators and validate nested array subdocs once #16586 https://github.com/Re-cool

perf: keep lib/ source within Latin-1 #16681 orgads

perf(map): avoid quadratic concat() when creating a MongooseMap from an object #16677 ptweezy

fix(array): keep earlier pushed values when push() is called again with $each #16619 #16618 maxymlyskov

fix(model+query): handle inherited read preference and read concern on cloned queries #16668 #16632

fix(timestamps): set timestamps on subdocs pushed via array filters #16615 #8809 vaidehi-snk

fix(model): validate paths under a nested path passed to Model.validate() #16653 NotAFlightRisk

fix(update): skip array-level validators for $pull with $in #16666 AnkitKumar61

fix(cursor): finish destruction after terminal initialization #16612 IbrahimHafez1

9.12.0 / 2026-11-04

feat: upgrade to mongodb driver 7.8 #16772 #16667

perf: improve for document arrays: cache paths with defaults and schemas with select paths; avoid unnecessary $isModified() lookup #16595

fix: make recompileSchema recompute derived caches and delay _preCompile() until an actual model is compiled (not subdocs or doc arrays) #16595

fix(array): compare UUIDs by value in indexOf() so pull() and addToSet() work #16606 luantaraschi

docs(query): remove unused use$geoWithin docs and property #16589 #16583

9.11.4 / 2026-10-23

fix: avoid walking into inherited properties like toString when hydrating documents, setting dotted paths, and merging updates

fix: only use own properties when looking up discriminators by key

fix(schema): disallow setting special properties via virtual()

fix(query): respect connection-level sanitizeFilter in queries

fix(query): disallow special properties like __proto__ as paths in where() and mod()

fix(deps): upgrade mquery -> 6.0.1 to avoid prototype pollution with query helpers like gt() and in()

9.11.3 / 2026-10-21

fix(update): honor overwriteImmutable in upserts and nested timestamps #16614 #15781 #8619 AbdelrahmanHafez

fix(model): stop Model.validate() crashing on missing nested objects #16600 NotAFlightRisk

fix(connection): don't disable autoIndex/autoCreate for a primary ReadPreference instance #16592 NgoQuocViet2001

docs: remove references to MongoDB versions older than 6.x #16593

9.11.2 / 2026-10-12

perf: avoid applying saveSubdocs and sharding plugins to subdocuments #16585

perf: upgrade to kareem@3.4.1 for mongoosejs/kareem#47 #16588

fix(model): cast array filter values in bulkWrite() #16574 #16573 OmBhandwaldar

fix(schema): allow function messages for number min/max and string minlength #16579 #16572 #8512 NotAFlightRisk

types: make MergeType more efficiently handle MergeType<A, {}> #16581 #16580

docs: fix broken API anchors and a malformed link #16583 SatvikMishra08

9.11.1 / 2026-10-07

fix(document): call recursive toObject() when setting a path to a nested object #16571

fix(update): keep casting array filters after a path not in the schema #16558 giaBaoJS

fix(document): apply flattenDecimals when toObject() takes the shallow fast path #16569 #16568 jeremyml

... (truncated)

Changelog

Sourced from mongoose's changelog.

9.12.1 / 2026-11-09

perf(update): avoid quadratic ancestor lookup in update validators and validate nested array subdocs once #16586 https://github.com/Re-cool

perf: keep lib/ source within Latin-1 #16681 orgads

perf(map): avoid quadratic concat() when creating a MongooseMap from an object #16677 ptweezy

fix(array): keep earlier pushed values when push() is called again with $each #16619 #16618 maxymlyskov

fix(model+query): handle inherited read preference and read concern on cloned queries #16668 #16632

fix(timestamps): set timestamps on subdocs pushed via array filters #16615 #8809 vaidehi-snk

fix(model): validate paths under a nested path passed to Model.validate() #16653 NotAFlightRisk

fix(update): skip array-level validators for $pull with $in #16666 AnkitKumar61

fix(cursor): finish destruction after terminal initialization #16612 IbrahimHafez1

9.12.0 / 2026-11-04

feat: upgrade to mongodb driver 7.8 #16772 #16667

perf: improve for document arrays: cache paths with defaults and schemas with select paths; avoid unnecessary $isModified() lookup #16595

fix: make recompileSchema recompute derived caches and delay _preCompile() until an actual model is compiled (not subdocs or doc arrays) #16595

fix(array): compare UUIDs by value in indexOf() so pull() and addToSet() work #16606 luantaraschi

docs(query): remove unused use$geoWithin docs and property #16589 #16583

9.11.5 / 2026-11-03

fix(query): pass explain verbosity to the driver cursor in find() #16635 jasontd92

fix(map): support ObjectId keys in MongooseMap#has() NgoQuocViet2001

fix(schema): clear enumValues when enum validator is removed with enum(false) #16631 Enesuygurs

fix: respect disabled updatedAt in pipeline updates #16642 #16641 ItsM0rty

fix: make schema clone() copy $timestamps #16651 #16650 Oleksii-Pavliuk

fix(model): preserve WriteError instances in insertMany() writeErrors #16608 #16607 Majny

fix: bump sift -> 17.1.4 rishabhnehra

docs(production): add production indexes guide #16627

docs(ask-ai): send session cookie and continue stored conversations #16652 nlarew

8.24.8 / 2026-11-02

fix(schema): remove map paths cleanly, including maps under nested paths (backport to 8.x) #16625 #16461 #16457 mrityunjay-pandey

fix(schema): keep the map value schematype a single object when cloning (backport to 8.x) #16624 #16473 mrityunjay-pandey

fix(map): support ObjectId keys in MongooseMap#has() (backport to 8.x #16634 mrityunjay-pandey

fix(hydration): use the doc model for looking up a ref (backport to 8.x) #16623 #16453 mrityunjay-pandey

fix(document): replace {MODEL} in custom cast error messages from document validation (backport to 8.x) #16622 #16480 mrityunjay-pandey

fix(schema): run setters declared on the union path itself (backport to 8.x) #16621 #16528 mrityunjay-pandey

9.11.4 / 2026-10-23

fix: avoid walking into inherited properties like toString when hydrating documents, setting dotted paths, and merging updates

fix: only use own properties when looking up discriminators by key

fix(schema): disallow setting special properties via virtual()

fix(query): respect connection-level sanitizeFilter in queries

fix(query): disallow special properties like __proto__ as paths in where() and mod()

fix(deps): upgrade mquery -> 6.0.1 to avoid prototype pollution with query helpers like gt() and in()

... (truncated)

Commits

6f90b9b chore: release 9.12.1
b9fbdbd Merge pull request #16619 from maxymlyskov/fix/keep-earlier-pushed-values-on-...
07da07e Merge pull request #16668 from Automattic/vkarpov15/gh-16632
fe9a124 fix: fix tests; schema-level read pref and read concern should not propagate ...
ba63298 Merge branch 'master' into vkarpov15/gh-16632
3d6f961 perf(cleanPositionalOperators): consolidate 2 replace() into 1 and skip if no...
ccbbb54 Refactor read options handling in setInheritedReadOptions
df8026d Merge pull request #16615 from vaidehi-snk/fix/gh-8809-deep-subdoc-push-times...
9fa83bb test: flatten tests from #16612
48267f0 Merge pull request #16612 from IbrahimHafez1/codex/cursor-destroy-initialization
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [mongoose](https://github.com/Automattic/mongoose) from 9.7.4 to 9.12.1. - [Release notes](https://github.com/Automattic/mongoose/releases) - [Changelog](https://github.com/Automattic/mongoose/blob/master/CHANGELOG.md) - [Commits](Automattic/mongoose@9.7.4...9.12.1) --- updated-dependencies: - dependency-name: mongoose dependency-version: 9.12.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2026-11-10T20:50:01Z

✅ OpenCodeReview: Review skipped: no items were selected.

github-actions · 2026-11-10T21:21:04Z

CI Coverage Report

Coverage job: success
PR test policy: success

Coverage artifact was not available for this run.

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 10, 2026

Navigation Menu

Repository navigation

deps: bump mongoose from 9.7.4 to 9.12.1 - #187

deps: bump mongoose from 9.7.4 to 9.12.1#187
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/mongoose-9.12.1

dependabot Bot commented on behalf of github Nov 10, 2026

Uh oh!

github-actions Bot commented Nov 10, 2026

Uh oh!

github-actions Bot commented Nov 10, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Nov 10, 2026

9.12.1 / 2026-11-09

9.12.0 / 2026-11-04

9.11.4 / 2026-10-23

9.11.3 / 2026-10-21

9.11.2 / 2026-10-12

9.11.1 / 2026-10-07

9.12.1 / 2026-11-09

9.12.0 / 2026-11-04

9.11.5 / 2026-11-03

8.24.8 / 2026-11-02

9.11.4 / 2026-10-23

Uh oh!

github-actions Bot commented Nov 10, 2026

Uh oh!

github-actions Bot commented Nov 10, 2026

CI Coverage Report

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants