From c89c47e979632e4d9b5a326ebcf1e33d9edaaa37 Mon Sep 17 00:00:00 2001 From: Valeri Karpov Date: Mon, 20 Jan 2025 09:25:09 -0500 Subject: [PATCH 1/5] chore: release 6.13.7 --- CHANGELOG.md | 10 +++++++--- package.json | 2 +- 2 files changed, 8 insertions(+), 4 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 003a0a0f0dd..5b4fdcb8db7 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,6 +1,10 @@ +6.13.7 / 2025-01-20 +=================== + * chore: re-release to force npm audit to pick up 6.x fix for CVE-2025-23061 + 6.13.6 / 2025-01-13 =================== - * fix: disallow nested $where in populate match + * fix: disallow nested $where in populate match CVE-2025-23061 6.13.5 / 2024-11-26 =================== @@ -204,7 +208,7 @@ * fix(document): isModified should not be triggered when setting a nested boolean to the same value as previously #12994 [lpizzinidev](https://github.com/lpizzinidev) * fix(document): save newly set defaults underneath single nested subdocuments #13002 #12905 * fix(update): handle custom discriminator model name when casting update #12947 [wassil](https://github.com/wassil) - * fix(connection): handles unique autoincrement ID for connections #12990 [lpizzinidev](https://github.com/lpizzinidev) + * fix(connection): handles unique autoincrement ID for connections #12990 [lpizzinidev](https://github.com/lpizzinidev) * fix(types): fix type of options of Model.aggregate #12933 [ghost91-](https://github.com/ghost91-) * fix(types): fix "near" aggregation operator input type #12954 [Jokero](https://github.com/Jokero) * fix(types): add missing Top operator to AccumulatorOperator type declaration #12952 [lpizzinidev](https://github.com/lpizzinidev) @@ -233,7 +237,7 @@ * docs(typescript): add notes about virtual context to Mongoose 6 migration and TypeScript virtuals docs #12912 #12806 * docs(schematypes): removed dead link and fixed formatting #12897 #12885 [lpizzinidev](https://github.com/lpizzinidev) * docs: fix link to lean api #12910 [manniL](https://github.com/manniL) - * docs: list all possible strings for schema.pre in one place #12868 + * docs: list all possible strings for schema.pre in one place #12868 * docs: add list of known incompatible npm packages #12892 [IslandRhythms](https://github.com/IslandRhythms) 6.8.3 / 2023-01-06 diff --git a/package.json b/package.json index c871d8c3676..4ca8c81e0cc 100644 --- a/package.json +++ b/package.json @@ -1,7 +1,7 @@ { "name": "mongoose", "description": "Mongoose MongoDB ODM", - "version": "6.13.6", + "version": "6.13.7", "author": "Guillermo Rauch ", "keywords": [ "mongodb", From c1ee8cce2c94c74d41cf1a2a7e911044c33f82e9 Mon Sep 17 00:00:00 2001 From: Valeri Karpov Date: Mon, 20 Jan 2025 09:38:15 -0500 Subject: [PATCH 2/5] test: attempt to fix libcrypto test failure for RS tests --- .github/workflows/test.yml | 24 +++++++++++++----------- 1 file changed, 13 insertions(+), 11 deletions(-) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index c9b01207ac1..d74d4e1121f 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -2,18 +2,18 @@ name: Test on: pull_request: paths: - - '.github/workflows/test.yml' - - 'package.json' - - 'index.js' - - 'lib/**' - - 'test/**.js' + - ".github/workflows/test.yml" + - "package.json" + - "index.js" + - "lib/**" + - "test/**.js" push: paths: - - '.github/workflows/test.yml' - - 'package.json' - - 'index.js' - - 'lib/**' - - 'test/**.js' + - ".github/workflows/test.yml" + - "package.json" + - "index.js" + - "lib/**" + - "test/**.js" permissions: contents: read @@ -62,6 +62,8 @@ jobs: key: ${{ matrix.os }}-${{ matrix.mongodb }} - run: npm install + - name: Install libcrypto + run: sudo apt-get update && sudo apt-get install -y libssl1.1 - name: NPM Test without Coverage run: npm test if: matrix.coverage != true @@ -74,7 +76,7 @@ jobs: with: name: coverage path: coverage - + test-deno: runs-on: ubuntu-20.04 name: Deno tests From 7d1f69abd9832e54f75d38705852461966cf6ba2 Mon Sep 17 00:00:00 2001 From: Valeri Karpov Date: Mon, 20 Jan 2025 09:42:37 -0500 Subject: [PATCH 3/5] chore: correct location for libssl install --- .github/workflows/test.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index d74d4e1121f..68f170f6253 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -62,8 +62,6 @@ jobs: key: ${{ matrix.os }}-${{ matrix.mongodb }} - run: npm install - - name: Install libcrypto - run: sudo apt-get update && sudo apt-get install -y libssl1.1 - name: NPM Test without Coverage run: npm test if: matrix.coverage != true @@ -115,6 +113,8 @@ jobs: uses: actions/setup-node@64ed1c7eab4cce3362f8c340dee64e5eaeef8f7c # v3.6.0 with: node-version: 16 + - name: Install libcrypto + run: sudo apt-get update && sudo apt-get install -y libssl1.1 - run: npm install - name: Test run: npm run test-rs From eeee55f64b79125490fbedf6fd8d659a7bebfe00 Mon Sep 17 00:00:00 2001 From: Valeri Karpov Date: Mon, 20 Jan 2025 09:49:16 -0500 Subject: [PATCH 4/5] chore: pin ubuntu 20 for RS tests re: typegoose/mongodb-memory-server#732 --- .github/workflows/test.yml | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 68f170f6253..f33174b7c95 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -105,7 +105,7 @@ jobs: test-replica-sets: needs: - test - runs-on: ubuntu-latest + runs-on: ubuntu-20.04 name: Replica Set tests steps: - uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0 @@ -113,8 +113,6 @@ jobs: uses: actions/setup-node@64ed1c7eab4cce3362f8c340dee64e5eaeef8f7c # v3.6.0 with: node-version: 16 - - name: Install libcrypto - run: sudo apt-get update && sudo apt-get install -y libssl1.1 - run: npm install - name: Test run: npm run test-rs From e9b72f6727ff67301ebd826cf833be039655ef0e Mon Sep 17 00:00:00 2001 From: Valeri Karpov Date: Mon, 20 Jan 2025 10:05:31 -0500 Subject: [PATCH 5/5] chore: ignore notes file --- .npmignore | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.npmignore b/.npmignore index efbbf2be524..82bea64d171 100644 --- a/.npmignore +++ b/.npmignore @@ -43,3 +43,5 @@ webpack.base.config.js .nyc-output *.tgz + +valnotes.md