[Snyk] Upgrade mongoose from 8.6.3 to 8.18.2

[nerdy-tech-com-gitub]

Snyk has created this PR to upgrade mongoose from 8.6.3 to 8.18.2.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

• The recommended version is 48 versions ahead of your current version.

• The recommended version was released 25 days ago.

Issues fixed by the recommended upgrade:

	Issue	Score	Exploit Maturity
	Regular Expression Denial of Service (ReDoS) SNYK-JS-CROSSSPAWN-8303230	57	Proof of Concept
	Improper Neutralization of Special Elements in Data Query Logic SNYK-JS-MONGOOSE-8446504	57	No Known Exploit
	Improper Neutralization of Special Elements in Data Query Logic SNYK-JS-MONGOOSE-8623536	57	Proof of Concept
	Regular Expression Denial of Service (ReDoS) SNYK-JS-BRACEEXPANSION-9789073	57	Proof of Concept

Release notes

Package name: mongoose

• 8.18.2 - 2025-09-22
  

  8.18.2 / 2025-09-22

  • fix(document): prevent $clone() from converting mongoose arrays into vanilla arrays #15633 #15625
  • fix(connection): use correct collection name for model when using useConnection() #15637
  • fix(connection): propagate changes to _lastHeartbeatAt to useDb() child connections #15640 #15635
  • types: fix schema property type definition in SchemaType #15631
• 8.18.1 - 2025-09-08
  

  8.18.1 / 2025-09-08

  • types: correct type inference for maps of maps #15602
  • types(model): copy base model statics onto discriminator model #15623 #15600
  • types: fix types for a string of enums #15605 ruiaraujo
  • types(SchemaOptions): disallow versionKey: true, which fails at runtime #15606
  • docs(typescript): add example explaining how to use query helper overrides for handling lean() #15622 #15601
  • docs(transactions): add note about nested transactions #15624
• 8.18.0 - 2025-08-22
  

  8.18.0 / 2025-08-22

  • feat(schema): support for union types #15574 #10894
  • fix: trim long strings in minLength and maxLength error messages and display the string length #15571 #15550
  • types(connection+collection): make BaseCollection and BaseConnection usable as values #15575 #15548
  • types: remove logic that omits timestamps when virtuals, methods, etc. options set #15577 #12807
• 8.17.2 - 2025-08-18
  

  8.17.2 / 2025-08-18

  • fix: avoid Model.validate() hanging when all paths fail casting #15580 #15579 piotracalski
  • types(document): better support for flattenObjectIds and versionKey options for toObject() and toJSON() #15582 #15578
  • docs: fix docs jsdoc tags and add UUID to be listed #15585
  • docs(document): fix code sample that errors with "Cannot set properties of undefined" #15589
• 8.17.1 - 2025-08-07
  

  8.17.1 / 2025-08-07

  • fix(query): propagate read preference and read concern to populate if read() called after populate() #15567 #15553
  • fix(model): call correct function in autoSearchIndex #15569 #15565
  • fix(model): allow setting statics option on discriminator schema #15568 #15556
  • fix(model): remove unnecessary conversion of undefined -> null in findById #15566 #15551
  • types: allow passing in projections without as const #15564 #15557
  • types: support maxLength and minLength in SchemaTypeOptions #15570 #4720
• 8.17.0 - 2025-07-30
  

  8.17.0 / 2025-07-30

  • feat: upgrade mongodb -> 6.18.0 #15552
  • feat(mongoose): export base Connection and Collection classes #15548
  • feat: make Schema.prototype.$conditionalHandlers public #15497
  • types: automatically infer discriminator type #15547 #15535
  • types: make versionKey: false disable __v from hydrated document #15524 #15511
  • types: indicate support for mongodb abort #15549 GalacticHypernova
  • types: add options property to schemas #15524
  • types(schematype): make defaultOptions static and add schemaOptions to DocumentArray #15529 #15524
• 8.16.5 - 2025-07-25
  

  8.16.5 / 2025-07-25

  • fix(map): avoid throwing required error if saving map of primitives with required: true #15542
  • types(model): export MongooseBulkWriteResult type #15546
  • types(connection): add base to connection type #15544
• 8.16.4 - 2025-07-16
• 8.16.3 - 2025-07-10
• 8.16.2 - 2025-07-07
• 8.16.1 - 2025-06-26
• 8.16.0 - 2025-06-16
• 8.15.2 - 2025-06-12
• 8.15.1 - 2025-05-26
• 8.15.0 - 2025-05-16
• 8.14.3 - 2025-05-13
• 8.14.2 - 2025-05-08
• 8.14.1 - 2025-04-29
• 8.14.0 - 2025-04-25
• 8.13.3 - 2025-04-24
• 8.13.2 - 2025-04-03
• 8.13.1 - 2025-03-28
• 8.13.0 - 2025-03-24
• 8.12.2 - 2025-03-21
• 8.12.1 - 2025-03-04
• 8.12.0 - 2025-03-03
• 8.11.0 - 2025-02-26
• 8.10.2 - 2025-02-25
• 8.10.1 - 2025-02-14
• 8.10.0 - 2025-02-05
• 8.9.7 - 2025-02-04
• 8.9.6 - 2025-01-31
• 8.9.5 - 2025-01-13
• 8.9.4 - 2025-01-09
• 8.9.3 - 2024-12-30
• 8.9.2 - 2024-12-19
• 8.9.1 - 2024-12-16
• 8.9.0 - 2024-12-13
• 8.8.4 - 2024-12-05
• 8.8.3 - 2024-11-26
• 8.8.2 - 2024-11-18
• 8.8.1 - 2024-11-08
• 8.8.0 - 2024-10-31
• 8.7.3 - 2024-10-25
• 8.7.2 - 2024-10-17
• 8.7.1 - 2024-10-09
• 8.7.0 - 2024-09-27
• 8.6.4 - 2024-09-26
• 8.6.3 - 2024-09-17

from mongoose GitHub release notes

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• This PR was automatically created by Snyk using the credentials of a real user.
• Max score is 1000. Note that the real score may have changed since the PR was raised.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

• 🧐 View latest project report
• 📜 Customise PR templates
• 🛠 Adjust upgrade PR settings
• 🔕 Ignore this dependency or unsubscribe from future upgrade PRs