Bump the npm_and_yarn group across 1 directory with 6 updates by dependabot[bot] · Pull Request #11 · Janarthan0329/ExplorExpress-_WebProject

dependabot · 2026-05-13T12:13:01Z

Bumps the npm_and_yarn group with 6 updates in the /tour/backend directory:

Package	From	To
mongoose	`8.9.5`	`8.22.1`
brace-expansion	`1.1.12`	`1.1.14`
minimatch	`3.1.2`	`3.1.5`
path-to-regexp	`0.1.12`	`0.1.13`
picomatch	`2.3.1`	`2.3.2`
qs	`6.14.1`	`6.14.2`

Updates mongoose from 8.9.5 to 8.22.1

Release notes

Sourced from mongoose's releases.

8.22.1 / 2025-02-04

fix: handle other top-level query operators in sanitizeFilter

fix(document): when cloning a doc with subdocs, make sure the subdocs parent is the cloned doc #15904 #15901

types(models): support Mongoose query casting in AnyBulkWriteOperation filter property #15910

types: add toBSON() to documents #15927

8.22.0 / 2026-01-27

feat(model): allow passing strict option to hydrate() #15944 #15940

8.21.1

fix(clone): fix parent doc for map subdocuments and array subdocuments #15958 AbdelrahmanHafez

fix(document): when cloning a doc with subdocs, make sure the subdocs parent is the cloned doc #15904 #15901

fix: respect currentTime schema option in bulkWrite updates #15976 sderrow

types(models): support Mongoose query casting in AnyBulkWriteOperation filter property #15910

types: add toBSON() to documents #15927

8.21.0 / 2025-12-29

feat(document): add support for getAtomics() to allow custom container types to utilize atomics #15817

feat(document+model): pass options to pre('deleteOne') and update+options to pre('updateOne') hooks #15908 #15870

fix: add support for typescript style enums #15914 #15913 mjfwebb

8.20.4 / 2025-12-18

fix(model): ensure $isDeleted is set after calling doc.deleteOne() successfully #15898

fix(document): use bitwise OR to accumulate version mode flags #15893 #15888 AbdelrahmanHafez

8.20.3 / 2025-12-15

perf: use Object.hasOwn instead of Object#hasOwnProperty #15875 AbdelrahmanHafez

fix: improve error when calling Document.prototype.init() with null/undefined #15812 Vegapunk-debug

types(schema): avoid treating paths with default: null as required #15889

types(schema): allow partial statics to schema.statics() #15780

8.20.2 / 2025-12-05

fix(model): bump version if necessary after successful bulkSave() #15809 #15800

fix(bulkWrite): pass overwriteImmutable option to castUpdate fixes #15789 #15782 #15781

types(schema): allow calling schema.static() with as TStatics #15794 #15780

8.20.1 / 2025-11-20

types: correct Model.schema type and fix unknown check for this param type in schema.methods #15750 #15693

docs: add detailed loadClass() TypeScript usage guide #15731 #12813 Necro-Rohan

docs: update version support documentation for Mongoose #15761 ManmathX

docs: add copy-to-clipboard feature for code blocks in docs #15759 vedansha07

8.20.0 / 2025-11-17

... (truncated)

Changelog

Sourced from mongoose's changelog.

8.22.1 / 2026-02-04

fix: handle other top-level query operators in sanitizeFilter

fix(document): when cloning a doc with subdocs, make sure the subdocs parent is the cloned doc #15904 #15901

types(models): support Mongoose query casting in AnyBulkWriteOperation filter property #15910

types: add toBSON() to documents #15927

7.8.9 / 2026-02-04

fix: handle other top-level query operators in sanitizeFilter

8.22.0 / 2026-01-27

feat(model): allow passing strict option to hydrate() #15944 #15940

8.21.1 / 2026-01-23

fix(clone): fix parent doc for map subdocuments and array subdocuments #15958 AbdelrahmanHafez

fix(document): when cloning a doc with subdocs, make sure the subdocs parent is the cloned doc #15904 #15901

fix: respect currentTime schema option in bulkWrite updates #15976 sderrow

types(models): support Mongoose query casting in AnyBulkWriteOperation filter property #15910

types: add toBSON() to documents #15927

9.1.5 / 2026-01-20

fix(map): validate map subdocument when loaded with init #15960 #15957 AbdelrahmanHafez

fix(discriminator): prevent indexes and callQueue duplication with shared nested schemas #15974 #15966 AbdelrahmanHafez

fix(subdocuments): do not pass parent path on init #15970 #15969 #15682 AbdelrahmanHafez

types(inferrawdoctype): correct handling for subdocs and doc arrays #15967 #13772

docs: improve grammar and clarity in TypeScript schema comments #15971 harshsinghpujari

9.1.4 / 2026-01-15

fix: attach sessions to docs retrieved by cursor #15953 #15949 mjfwalsh

fix(model): make hydrate() handle nested schema arrays #15964 #15956

fix(clone): fix parent doc for map subdocuments and array subdocuments #15958 #15954 AbdelrahmanHafez

fix: prevent crash when accessing nested paths on prototype #15962 #15961 som14062005

9.1.3 / 2026-01-09

fix(model): support timestamps option to insertMany() as both boolean and QueryTimestampsConfig #15941 #15938

fix(query): include preview of current and incoming update in error when merging normal update with pipeline #15939 #15928

types(model): apply basic type casting to paths underneath subdocuments #15948 #15947

types(utility): make WithLevel1NestedPaths correctly handle PopulatedDoc and other TypeScript unions with Document members #15942 #15923

docs(schema): expose "DocumentArrayElement" #15590 hasezoey

9.1.2 / 2026-01-05

fix(subdocs): pass options to pre-save hooks for subdocs #15921 #15920 AbdelrahmanHafez

perf(model): select only _id when checking document existence during save() #15919 AbdelrahmanHafez

... (truncated)

Commits

472e7c7 chore: release 8.22.1
1735149 Merge branch '7.x' into 8.x
5227801 chore: release 7.8.9
b804e34 fix: handle other top-level query operators in sanitizeFilter
8d9a81f chore: release 8.22.0
f752854 Merge pull request #15985 from Automattic/8.22
e7a57ed avoid hardcoding dbName
31adbb4 chore: release 8.21.1
62a5af7 test: bring test cases from #15958 into 8.x to ensure fixes are applied in 8.x
bc8cb23 implement review suggestions
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for mongoose since your current version.

Updates brace-expansion from 1.1.12 to 1.1.14

Commits

10c05fc 1.1.14
1afa1b2 Add opt-in { max } mitigation to v1 legacy line (#103)
2fbb6a2 Revert "Backport fix for GHSA-7h2j-956f-4vf2 to v1 (#101)" (#102)
0d7652e Backport fix for GHSA-7h2j-956f-4vf2 to v1 (#101)
6c353ca 1.1.13
7fd684f Backport fix for GHSA-f886-m6hf-6m8v (#95)
See full diff in compare view

Updates minimatch from 3.1.2 to 3.1.5

Commits

7bba978 3.1.5
bd25942 docs: add warning about ReDoS
1a9c27c fix partial matching of globstar patterns
1a2e084 3.1.4
ae24656 update lockfile
b100374 limit recursion for **, improve perf considerably
26ffeaa lockfile update
9eca892 lock node version to 14
00c323b 3.1.3
30486b2 update CI matrix and actions
Additional commits viewable in compare view

Updates path-to-regexp from 0.1.12 to 0.1.13

Release notes

Sourced from path-to-regexp's releases.

0.1.13

Important

Fix CVE-2026-4867 (GHSA-37ch-88jc-xwx2)

Full Changelog: pillarjs/path-to-regexp@v0.1.12...v.0.1.13

Changelog

Sourced from path-to-regexp's changelog.

0.1.13 / 2026-03-26

Fix CVE-2026-4867 (GHSA-37ch-88jc-xwx2)

0.1.7 / 2015-07-28

Fixed regression with escaped round brackets and matching groups.

0.1.6 / 2015-06-19

Replace index feature by outputting all parameters, unnamed and named.

0.1.5 / 2015-05-08

Add an index property for position in match result.

0.1.4 / 2015-03-05

Add license information

0.1.3 / 2014-07-06

Better array support

Improved support for trailing slash in non-ending mode

0.1.0 / 2014-03-06

add options.end

0.0.2 / 2013-02-10

Update to match current express

add .license property to component.json

Commits

9fd0c87 0.1.13 (#425)
7ccf02c fix: CVE-2026-4867
See full diff in compare view

Maintainer changes

This version was pushed to npm by ulisesgascon, a new releaser for path-to-regexp since your current version.

Updates picomatch from 2.3.1 to 2.3.2

Release notes

Sourced from picomatch's releases.

2.3.2

This is a security release fixing several security relevant issues.

What's Changed

fix: exception when glob pattern contains constructor by @Jason3S in micromatch/picomatch#144

Fix for CVE-2026-33671

Fix for CVE-2026-33672

Full Changelog: micromatch/picomatch@2.3.1...2.3.2

Changelog

Sourced from picomatch's changelog.

Release history

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog and this project adheres to Semantic Versioning.

Changelogs are for humans, not machines.

There should be an entry for every single version.

The same types of changes should be grouped.

Versions and sections should be linkable.

The latest version comes first.

The release date of each versions is displayed.

Mention whether you follow Semantic Versioning.

Changelog entries are classified using the following labels (from keep-a-changelog):

Added for new features.

Changed for changes in existing functionality.

Deprecated for soon-to-be removed features.

Removed for now removed features.

Fixed for any bug fixes.

Security in case of vulnerabilities.

4.0.0 (2024-02-07)

Fixes

Fix bad text values in parse #126, thanks to @connor4312

Changed

Remove process global to work outside of node #129, thanks to @styfle

Add sideEffects to package.json #128, thanks to @frandiox

Removed os, make compatible browser environment. See #124, thanks to @gwsbhqt

3.0.1

Fixes

... (truncated)

Commits

81cba8d Publish 2.3.2
fc1f6b6 Merge commit from fork
eec17ae Merge commit from fork
78f8ca4 Merge pull request #156 from micromatch/backport-144
3f4f10e Merge pull request #144 from Jason3S/jdent-object-properties
See full diff in compare view

Updates qs from 6.14.1 to 6.14.2

Changelog

Sourced from qs's changelog.

6.14.2

[Fix] parse: mark overflow objects for indexed notation exceeding arrayLimit (#546)

[Fix] arrayLimit means max count, not max index, in combine/merge/parseArrayValue

[Fix] parse: throw on arrayLimit exceeded with indexed notation when throwOnLimitExceeded is true (#529)

[Fix] parse: enforce arrayLimit on comma-parsed values

[Fix] parse: fix error message to reflect arrayLimit as max index; remove extraneous comments (#545)

[Robustness] avoid .push, use void

[readme] document that addQueryPrefix does not add ? to empty output (#418)

[readme] clarify parseArrays and arrayLimit documentation (#543)

[readme] replace runkit CI badge with shields.io check-runs badge

[meta] fix changelog typo (arrayLength → arrayLimit)

[actions] fix rebase workflow permissions

Commits

bdcf0c7 v6.14.2
294db90 [readme] document that addQueryPrefix does not add ? to empty output
5c308e5 [readme] clarify parseArrays and arrayLimit documentation
6addf8c [Fix] parse: mark overflow objects for indexed notation exceeding arrayLimit
cfc108f [Fix] arrayLimit means max count, not max index, in combine/merge/`pars...
febb644 [Fix] parse: throw on arrayLimit exceeded with indexed notation when `thr...
f6a7abf [Fix] parse: enforce arrayLimit on comma-parsed values
fbc5206 [Fix] parse: fix error message to reflect arrayLimit as max index; remove e...
1b9a8b4 [actions] fix rebase workflow permissions
2a35775 [meta] fix changelog typo (arrayLength → arrayLimit)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps the npm_and_yarn group with 6 updates in the /tour/backend directory: | Package | From | To | | --- | --- | --- | | [mongoose](https://github.com/Automattic/mongoose) | `8.9.5` | `8.22.1` | | [brace-expansion](https://github.com/juliangruber/brace-expansion) | `1.1.12` | `1.1.14` | | [minimatch](https://github.com/isaacs/minimatch) | `3.1.2` | `3.1.5` | | [path-to-regexp](https://github.com/pillarjs/path-to-regexp) | `0.1.12` | `0.1.13` | | [picomatch](https://github.com/micromatch/picomatch) | `2.3.1` | `2.3.2` | | [qs](https://github.com/ljharb/qs) | `6.14.1` | `6.14.2` | Updates `mongoose` from 8.9.5 to 8.22.1 - [Release notes](https://github.com/Automattic/mongoose/releases) - [Changelog](https://github.com/Automattic/mongoose/blob/master/CHANGELOG.md) - [Commits](Automattic/mongoose@8.9.5...8.22.1) Updates `brace-expansion` from 1.1.12 to 1.1.14 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v1.1.12...v1.1.14) Updates `minimatch` from 3.1.2 to 3.1.5 - [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md) - [Commits](isaacs/minimatch@v3.1.2...v3.1.5) Updates `path-to-regexp` from 0.1.12 to 0.1.13 - [Release notes](https://github.com/pillarjs/path-to-regexp/releases) - [Changelog](https://github.com/pillarjs/path-to-regexp/blob/v.0.1.13/History.md) - [Commits](pillarjs/path-to-regexp@v0.1.12...v.0.1.13) Updates `picomatch` from 2.3.1 to 2.3.2 - [Release notes](https://github.com/micromatch/picomatch/releases) - [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md) - [Commits](micromatch/picomatch@2.3.1...2.3.2) Updates `qs` from 6.14.1 to 6.14.2 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.14.1...v6.14.2) --- updated-dependencies: - dependency-name: mongoose dependency-version: 8.22.1 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 1.1.14 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: minimatch dependency-version: 3.1.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: path-to-regexp dependency-version: 0.1.13 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: picomatch dependency-version: 2.3.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: qs dependency-version: 6.14.2 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels May 13, 2026

Navigation Menu

Bump the npm_and_yarn group across 1 directory with 6 updates - #11

Bump the npm_and_yarn group across 1 directory with 6 updates#11
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/tour/backend/npm_and_yarn-c5445f59e9

dependabot Bot commented on behalf of github May 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github May 13, 2026

8.22.1 / 2025-02-04

8.22.0 / 2026-01-27

8.21.1

8.21.0 / 2025-12-29

8.20.4 / 2025-12-18

8.20.3 / 2025-12-15

8.20.2 / 2025-12-05

8.20.1 / 2025-11-20

8.22.1 / 2026-02-04

7.8.9 / 2026-02-04

8.22.0 / 2026-01-27

8.21.1 / 2026-01-23

9.1.5 / 2026-01-20

9.1.4 / 2026-01-15

9.1.3 / 2026-01-09

9.1.2 / 2026-01-05

0.1.13

Important

0.1.13 / 2026-03-26

0.1.7 / 2015-07-28

0.1.6 / 2015-06-19

0.1.5 / 2015-05-08

0.1.4 / 2015-03-05

0.1.3 / 2014-07-06

0.1.0 / 2014-03-06

0.0.2 / 2013-02-10

2.3.2

What's Changed

Release history

4.0.0 (2024-02-07)

Fixes

Changed

3.0.1

Fixes

6.14.2

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants