[Snyk] Security upgrade mongoose from 4.2.4 to 6.13.10

[nirw-snyk]

Snyk has created this PR to fix 1 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

• package.json
• package-lock.json

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Prototype Pollution SNYK-JS-MONGOOSE-18319533	738

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Prototype Pollution

[nirw-snyk]

This is a major upgrade spanning two major versions (v4 → v6) and introduces a large number of significant breaking changes. A direct upgrade without code modifications will cause application failures. A thorough review and refactoring are required.

Breaking Changes: Mongoose v4 → v5

This first major step introduces fundamental changes to connection logic and query behavior.

• Environment Requirements: Mongoose 5 requires Node.js v4.0.0+ and MongoDB v3.0.0+. [3]
• Connection Management: The mongoose.connect() method has been overhauled. The useMongoClient option is removed and its behavior is now default. [3] Connection calls now require a standard MongoDB connection string and reliably return a promise. [2, 11]
• Middleware Execution: Query middleware (like pre('find')) must now be attached to a schema before the model is created with mongoose.model(). [3]
• Stricter Type Casting: Boolean casting is much stricter. For example, a string like 'not a boolean' will no longer be coerced to true. [3]
• API Changes: The $pushAll operator has been removed in favor of using $push with $each. [2]

Breaking Changes: Mongoose v5 → v6

This second major step builds on v5, modernizes the driver, and changes default behaviors.

• Connection Options: The useNewUrlParser and useUnifiedTopology options are removed and are now the default, non-configurable behavior. [7]
• strictQuery Default: The strictQuery option is now true by default. This means Mongoose will strip out any fields in a query filter that are not defined in the schema, which can silently alter query results. [1]
• omitUndefined Removed: The omitUndefined option is removed. Mongoose 6 will always strip undefined values from updates. [1]
• API Removals & Changes:
  • Model.exists() now returns a lean document instead of a boolean. [1]
  • execPopulate() has been removed. Use Promise.all() with multiple populate() calls instead. [1]
  • Arrays are now ES6 Proxies, which improves change tracking but may affect edge cases. markModified() is often no longer necessary for array element assignments. [7]

Sources:

• Mongoose 4.x to 5.x Migration Guide [3]
• Mongoose 5.x to 6.x Migration Guide [1]

Recommendation: This upgrade is high-risk and requires significant developer effort. It is critical to follow both migration guides, paying special attention to connection logic, the new strictQuery default, and middleware registration. Extensive testing is mandatory before deployment.

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.