fix(deps): update dependency mongoose [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
mongoose (source)	5.13.9 -> 5.13.15
mongoose (source)	6.2.10 -> 6.4.6

GitHub Vulnerability Alerts

CVE-2022-24304

Description

Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment.

Affected versions of this package are vulnerable to Prototype Pollution. The Schema.path() function is vulnerable to prototype pollution when setting the schema object. This vulnerability allows modification of the Object prototype and could be manipulated into a Denial of Service (DoS) attack.

Proof of Concept

// poc.js
const mongoose = require('mongoose');
const schema = new mongoose.Schema();

malicious_payload = '__proto__.toString'

schema.path(malicious_payload, [String])

x = {}
console.log(x.toString()) // crashed (Denial of service (DoS) attack)

Impact

This vulnerability can be manipulated to exploit other types of attacks, such as Denial of service (DoS), Remote Code Execution, or Property Injection.

---

Release Notes

Automattic/mongoose (mongoose)

v5.13.15

Compare Source

====================

• fix: backport fix for CVE-2022-2564 #​12281 shubanker
• docs: fix broken link from findandmodify method deprecation #​11366 laissonsilveira

v5.13.14

Compare Source

====================

• fix(timestamps): avoid setting createdAt on documents that already exist but dont have createdAt #​11024
• docs(models): fix up nModified example for 5.x #​11055

v5.13.13

Compare Source

====================

• fix: upgrade to [email protected] #​10909 gaurav-sharma-gs
• fix: correctly emit end event in before close #​10916 iovanom
• fix(index.d.ts): improve ts types for query set #​10942 jneal-afs

v5.13.12

Compare Source

====================

• fix(cursor): use stream destroy method on close to prevent emitting duplicate 'close' #​10897 iovanom
• fix(index.d.ts): backport streamlining of FilterQuery and DocumentDefinition to avoid "excessively deep and possibly infinite" TS errors #​10617

v5.13.11

Compare Source

====================

• fix: upgrade mongodb -> 3.7.2 #​10871 winstonralph
• fix(connection): call setMaxListeners(0) on MongoClient to avoid event emitter memory leak warnings with useDb() #​10732

v5.13.10

Compare Source

====================

• fix(index.d.ts): allow using type: SchemaDefinitionProperty in schema definitions #​10674
• fix(index.d.ts): allow AnyObject as param to findOneAndReplace() #​10714

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.