Bump the npm_and_yarn group across 1 directory with 4 updates #1

dependabot · 2025-06-13T15:04:39Z

Bumps the npm_and_yarn group with 4 updates in the / directory: mongoose, nanoid, next and @babel/runtime.

Updates mongoose from 8.8.0 to 8.9.5

Release notes

8.9.5 / 2025-01-13

fix: disallow nested $where in populate match

fix(schema): handle bitwise operators on Int32 #15176 #15170

8.9.4 / 2025-01-09

fix(document): fix document not applying manual populate when using a function in schema.options.ref #15138 IchirokuXVI

fix(model): make Model.validate() static correctly cast document arrays #15169 #15164

fix(model): allow passing validateBeforeSave option to bulkSave() to skip validation #15161 #15156

fix(schema): allow multiple self-referencing discriminator schemas using Schema.prototype.discriminator #15142 #15120

types: avoid BufferToBinary<> wiping lean types when passed to generic functions #15160 #15158

docs: fix <code> in header ids #15159

docs: fix header in field-level-encryption.md #15137 damieng

8.9.3 / 2024-12-30

fix(schema): make duplicate index error a warning for now to prevent blocking upgrading #15135 #15112 #15109

fix(model): handle document array paths set to non-array values in Model.castObject() #15124 #15075

fix(document): avoid using childSchemas.path for compatibility with pre-Mongoose-8.8 schemas #15131 #15071

fix(model): avoid throwing unnecessary error if updateOne() returns null in save() #15126

perf(cursor): clear the stack every time if using populate with batchSize to avoid stack overflows with large docs #15136 #10449

types: make BufferToBinary avoid Document instances #15123 #15122

types(model+query): avoid stripping out virtuals when calling populate with paths generic #15132 #15111

types(schema): add missing removeIndex #15134

types: add cleanIndexes() to IndexManager interface #15127

docs: move search endpoint to netlify #15119

8.9.2 / 2024-12-19

fix(schema): avoid throwing duplicate index error if index spec keys have different order or index has a custom name #15112 #15109

fix(map): clean modified subpaths when overwriting values in map of subdocs #15114 #15108

fix(aggregate): pull session from transaction local storage for aggregation cursors #15094 IchirokuXVI

types: correctly handle union types in BufferToBinary and related helpers #15103 #15102 #15057

types: add UUID to RefType #15115 #15101

docs: remove link to Mongoose 5.x docs from dropdown #15116

docs(connection+document+model): remove remaining references to remove(), clarify that deleteOne() does not execute until then() or exec() #15113 #15107

8.9.1 / 2024-12-16

fix(connection): remove heartbeat check in load balanced mode #15089 #15042 #14812

fix(discriminator): gather childSchemas when creating discriminator to ensure $getAllSubdocs() can properly get all subdocs #15099 #15088 #15092

fix(model): handle discriminators in castObject() #15096 #15075

fix(schema): throw error if duplicate index definition using unique in schema path and subsequent .index() call #15093 #15056

fix: mark documents that are populated using hydratedPopulatedDocs option as populated in top-level doc #15080 #15048

fix(document+schema): improve error message for get() on invalid path #15098 #15071

docs: remove more callback doc references & some small other changes #15095

8.9.0 / 2024-12-13

... (truncated)

Changelog

Sourced from mongoose's changelog.

8.9.5 / 2025-01-13

fix: disallow nested $where in populate match CVE-2025-23061

fix(schema): handle bitwise operators on Int32 #15176 #15170

7.8.4 / 2025-01-13

fix: disallow nested $where in populate match CVE-2025-23061

6.13.6 / 2025-01-13

fix: disallow nested $where in populate match CVE-2025-23061

8.9.4 / 2025-01-09

fix(document): fix document not applying manual populate when using a function in schema.options.ref #15138 IchirokuXVI

fix(model): make Model.validate() static correctly cast document arrays #15169 #15164

fix(model): allow passing validateBeforeSave option to bulkSave() to skip validation #15161 #15156

fix(schema): allow multiple self-referencing discriminator schemas using Schema.prototype.discriminator #15142 #15120

types: avoid BufferToBinary<> wiping lean types when passed to generic functions #15160 #15158

docs: fix <code> in header ids #15159

docs: fix header in field-level-encryption.md #15137 damieng

8.9.3 / 2024-12-30

fix(schema): make duplicate index error a warning for now to prevent blocking upgrading #15135 #15112 #15109

fix(model): handle document array paths set to non-array values in Model.castObject() #15124 #15075

fix(document): avoid using childSchemas.path for compatibility with pre-Mongoose-8.8 schemas #15131 #15071

fix(model): avoid throwing unnecessary error if updateOne() returns null in save() #15126

perf(cursor): clear the stack every time if using populate with batchSize to avoid stack overflows with large docs #15136 #10449

types: make BufferToBinary avoid Document instances #15123 #15122

types(model+query): avoid stripping out virtuals when calling populate with paths generic #15132 #15111

types(schema): add missing removeIndex #15134

types: add cleanIndexes() to IndexManager interface #15127

docs: move search endpoint to netlify #15119

8.9.2 / 2024-12-19

fix(schema): avoid throwing duplicate index error if index spec keys have different order or index has a custom name #15112 #15109

fix(map): clean modified subpaths when overwriting values in map of subdocs #15114 #15108

fix(aggregate): pull session from transaction local storage for aggregation cursors #15094 IchirokuXVI

types: correctly handle union types in BufferToBinary and related helpers #15103 #15102 #15057

types: add UUID to RefType #15115 #15101

docs: remove link to Mongoose 5.x docs from dropdown #15116

docs(connection+document+model): remove remaining references to remove(), clarify that deleteOne() does not execute until then() or exec() #15113 #15107

8.9.1 / 2024-12-16

fix(connection): remove heartbeat check in load balanced mode #15089 #15042 #14812

fix(discriminator): gather childSchemas when creating discriminator to ensure $getAllSubdocs() can properly get all subdocs #15099 #15088 #15092

... (truncated)

Commits

5af0a10 chore: release 8.9.5
a42d8f5 Merge branch '7.x'
73e81ab chore: release 7.8.4
4fe9a90 Merge branch '6.x' into 7.x
e59e342 chore: release 6.13.6
64a9f97 fix: disallow nested $where in populate match
fa33717 Merge pull request #15176 from Automattic/vkarpov15/gh-15170
0728602 test: make test cast non-boolean value
0cad0d7 fix(schema): handle bitwise operators on Int32
39886fb docs: quick changelog formatting fix
Additional commits viewable in compare view

Updates nanoid from 5.0.8 to 5.0.9

Release notes

Sourced from nanoid's releases.

5.0.9

Fixed a way to break Nano ID by passing non-integer size (by @myndzi).

Changelog

Sourced from nanoid's changelog.

5.0.9

Fixed a way to break Nano ID by passing non-integer size (by @myndzi).

Commits

65a38ac Release 5.0.9 version
b00d120 Merge after 3.3.8 release
3044cd5 Release 3.3.8 version
cdc3edc Update size limit
4fe3495 Update size limit
d643045 Fix pool pollution, infinite loop (#510)
0daa00f Additional fixes and tests for #508 (#509)
313a14e Update dependencies
eb2db95 Fix size limit and linting
9da8f60 Fix pool pollution, infinite loop (#508)
Additional commits viewable in compare view

Updates next from 15.0.2 to 15.2.4

Release notes

Sourced from next's releases.

v15.1.8

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

fix: Merge link header from middleware with the ones from React (#73431)

fix(edge): run after() if request is cancelled mid-streaming (#76013)

gate segmentCache branch in base-server (#79505)

Credits

Huge thanks to @amannn, @lubieowoce, and @ztanner for helping!

Commits

804aa35 v15.2.4
ecb72ee Match subrequest handling for edge and node (#77474)
25f810b exclude images and static media from dev origin check (#77417)
d9bcb83 ensure /__next middleware URLs are included in the origin check (#77416)
cfeaa86 remove direct ip/port bypass in dev origin check (#77414)
f847302 switch development origin verification to be opt-in rather than opt-out (#77395)
535e26d v15.2.3
2fcae1d Update default allowed origins list (#77212)
adf5462 unify allowed origin detection handling (#77053)
5e59da1 Add dev warning for cross-origin and stabilize allowedDevOrigins (#77044)
Additional commits viewable in compare view

Updates @babel/runtime from 7.26.0 to 7.27.6

Release notes

Sourced from @babel/runtime's releases.

v7.27.6 (2025-06-05)

🐛 Bug Fix

babel-helpers, babel-plugin-transform-async-generator-functions, babel-plugin-transform-regenerator, babel-preset-env, babel-runtime-corejs3

#17366 fix: finally causes unexpected return value (@liuxingbaoyu)

babel-generator, babel-parser, babel-types

#17357 Ensure syntactic ordering when visiting array-type AST nodes (@JLHwung)

Committers: 3

Huáng Jùnliàng (@JLHwung)

Ingvar Stepanyan (@RReverser)

@liuxingbaoyu

v7.27.5 (2025-06-03)

Thanks @NullVoxPopuli for your first PR!

🐛 Bug Fix

babel-plugin-transform-regenerator

#17359 fix: Unexpected infinite loop with regenerator for try (@liuxingbaoyu)

Other

#17349 Map ESLint's sourceType: commonjs to script (@JLHwung)

💅 Polish

babel-parser

#17333 Improve using declaration errors (@JLHwung)

Committers: 4

Babel Bot (@babel-bot)

Huáng Jùnliàng (@JLHwung)

@NullVoxPopuli

@liuxingbaoyu

v7.27.4 (2025-05-30)

👓 Spec Compliance

babel-parser, babel-plugin-proposal-explicit-resource-management

#17323 Disallow using in bare case statement (@JLHwung)

💅 Polish

babel-parser

#17311 Improve parseExpression error messages (@JLHwung)

🔬 Output optimization

babel-helpers, babel-plugin-transform-async-generator-functions, babel-plugin-transform-async-to-generator, babel-plugin-transform-block-scoping, babel-plugin-transform-classes, babel-plugin-transform-destructuring, babel-plugin-transform-regenerator, babel-plugin-transform-runtime, babel-preset-env, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime

#17287 Reduce regenerator size more (@liuxingbaoyu)

babel-helpers, babel-plugin-transform-async-generator-functions, babel-plugin-transform-async-to-generator, babel-plugin-transform-block-scoping, babel-plugin-transform-classes, babel-plugin-transform-destructuring, babel-plugin-transform-regenerator, babel-plugin-transform-runtime, babel-preset-env, babel-runtime-corejs3

#17334 Use shorter method names for regenerator context (@nicolo-ribaudo)

#17268 Reduce regenerator helper size (@liuxingbaoyu)

babel-core, babel-helpers, babel-plugin-transform-async-generator-functions, babel-plugin-transform-async-to-generator, babel-plugin-transform-block-scoping, babel-plugin-transform-classes, babel-plugin-transform-destructuring, babel-plugin-transform-regenerator, babel-plugin-transform-runtime, babel-preset-env, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime, babel-standalone

... (truncated)

Changelog

Sourced from @babel/runtime's changelog.

v7.27.6 (2025-06-05)

🐛 Bug Fix

babel-helpers, babel-plugin-transform-async-generator-functions, babel-plugin-transform-regenerator, babel-preset-env, babel-runtime-corejs3

#17366 fix: finally causes unexpected return value (@liuxingbaoyu)

babel-generator, babel-parser, babel-types

#17357 Ensure syntactic ordering when visiting array-type AST nodes (@JLHwung)

v7.27.5 (2025-06-03)

🐛 Bug Fix

babel-plugin-transform-regenerator

#17359 fix: Unexpected infinite loop with regenerator for try (@liuxingbaoyu)

Other

#17349 Map ESLint's sourceType: commonjs to script (@JLHwung)

💅 Polish

babel-parser

#17333 Improve using declaration errors (@JLHwung)

v7.27.4 (2025-05-30)

👓 Spec Compliance

babel-parser, babel-plugin-proposal-explicit-resource-management

#17323 Disallow using in bare case statement (@JLHwung)

💅 Polish

babel-parser

#17311 Improve parseExpression error messages (@JLHwung)

🔬 Output optimization

babel-helpers, babel-plugin-transform-async-generator-functions, babel-plugin-transform-async-to-generator, babel-plugin-transform-block-scoping, babel-plugin-transform-classes, babel-plugin-transform-destructuring, babel-plugin-transform-regenerator, babel-plugin-transform-runtime, babel-preset-env, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime

#17287 Reduce regenerator size more (@liuxingbaoyu)

babel-helpers, babel-plugin-transform-async-generator-functions, babel-plugin-transform-async-to-generator, babel-plugin-transform-block-scoping, babel-plugin-transform-classes, babel-plugin-transform-destructuring, babel-plugin-transform-regenerator, babel-plugin-transform-runtime, babel-preset-env, babel-runtime-corejs3

#17334 Use shorter method names for regenerator context (@nicolo-ribaudo)

#17268 Reduce regenerator helper size (@liuxingbaoyu)

babel-core, babel-helpers, babel-plugin-transform-async-generator-functions, babel-plugin-transform-async-to-generator, babel-plugin-transform-block-scoping, babel-plugin-transform-classes, babel-plugin-transform-destructuring, babel-plugin-transform-regenerator, babel-plugin-transform-runtime, babel-preset-env, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime, babel-standalone

#17238 Split regeneratorRuntime into multiple helpers (@nicolo-ribaudo)

v7.27.3 (2025-05-27)

🐛 Bug Fix

babel-generator

#17324 Improve multiline comments handling in yield/await expression (@JLHwung)

babel-helpers, babel-plugin-transform-async-generator-functions, babel-plugin-transform-regenerator, babel-preset-env, babel-runtime-corejs3

#17328 Correctly set .displayName on GeneratorFunction (@nicolo-ribaudo)

babel-plugin-proposal-explicit-resource-management

#17319 fix: handle shadowed binding in for using of body (@JLHwung)

#17317 fix: support named evaluation for using declaration (@JLHwung)

babel-plugin-proposal-decorators, babel-types

#17321 fix(converter): Remove abstract modifiers in class declaration to expression conversion (@magic-akari)

babel-helper-module-transforms, babel-plugin-proposal-explicit-resource-management, babel-plugin-transform-modules-amd, babel-plugin-transform-modules-commonjs, babel-plugin-transform-modules-umd

#17257 Preserve class id when transforming using declarations with exported class (@JLHwung)

... (truncated)

Commits

baa4cb8 v7.27.6
7d06930 v7.27.4
5b9468d Reduce regenerator size more (#17287)
cb78b5b [babel 8] Do not replace global regeneratorRuntime references in regenerato...
a0690e3 Split regeneratorRuntime into multiple helpers (#17238)
da5e371 v7.27.3
eebd3a0 v7.27.1
296cdc5 Remove unused regenerator-runtime dep in @babel/runtime (#17263)
fdc0fb5 [Babel 8] Bump nodejs requirements to ^20.19.0 || >= 22.12.0 (#17204)
5c350ea v7.27.0
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps the npm_and_yarn group with 4 updates in the / directory: [mongoose](https://github.com/Automattic/mongoose), [nanoid](https://github.com/ai/nanoid), [next](https://github.com/vercel/next.js) and [@babel/runtime](https://github.com/babel/babel/tree/HEAD/packages/babel-runtime). Updates `mongoose` from 8.8.0 to 8.9.5 - [Release notes](https://github.com/Automattic/mongoose/releases) - [Changelog](https://github.com/Automattic/mongoose/blob/master/CHANGELOG.md) - [Commits](Automattic/mongoose@8.8.0...8.9.5) Updates `nanoid` from 5.0.8 to 5.0.9 - [Release notes](https://github.com/ai/nanoid/releases) - [Changelog](https://github.com/ai/nanoid/blob/main/CHANGELOG.md) - [Commits](ai/nanoid@5.0.8...5.0.9) Updates `next` from 15.0.2 to 15.2.4 - [Release notes](https://github.com/vercel/next.js/releases) - [Changelog](https://github.com/vercel/next.js/blob/canary/release.js) - [Commits](vercel/next.js@v15.0.2...v15.2.4) Updates `@babel/runtime` from 7.26.0 to 7.27.6 - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.27.6/packages/babel-runtime) --- updated-dependencies: - dependency-name: mongoose dependency-version: 8.9.5 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: nanoid dependency-version: 5.0.9 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: next dependency-version: 15.2.4 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@babel/runtime" dependency-version: 7.27.6 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <[email protected]>

vercel · 2025-06-13T15:04:41Z

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name	Status	Preview	Comments	Updated (UTC)
oofnote	❌ Failed (Inspect)			Jun 13, 2025 3:05pm

dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jun 13, 2025

vercel bot had a problem deploying to Preview June 13, 2025 15:05 Failure

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Bump the npm_and_yarn group across 1 directory with 4 updates #1

Bump the npm_and_yarn group across 1 directory with 4 updates #1

Uh oh!

dependabot bot commented on behalf of github Jun 13, 2025

Uh oh!

vercel bot commented Jun 13, 2025 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Bump the npm_and_yarn group across 1 directory with 4 updates #1

Are you sure you want to change the base?

Bump the npm_and_yarn group across 1 directory with 4 updates #1

Uh oh!

Conversation

dependabot bot commented on behalf of github Jun 13, 2025

8.9.5 / 2025-01-13

8.9.4 / 2025-01-09

8.9.3 / 2024-12-30

8.9.2 / 2024-12-19

8.9.1 / 2024-12-16

8.9.0 / 2024-12-13

8.9.5 / 2025-01-13

7.8.4 / 2025-01-13

6.13.6 / 2025-01-13

8.9.4 / 2025-01-09

8.9.3 / 2024-12-30

8.9.2 / 2024-12-19

8.9.1 / 2024-12-16

5.0.9

5.0.9

v15.1.8

Core Changes

Credits

v7.27.6 (2025-06-05)

🐛 Bug Fix

Committers: 3

v7.27.5 (2025-06-03)

🐛 Bug Fix

💅 Polish

Committers: 4

v7.27.4 (2025-05-30)

👓 Spec Compliance

💅 Polish

🔬 Output optimization

v7.27.6 (2025-06-05)

🐛 Bug Fix

v7.27.5 (2025-06-03)

🐛 Bug Fix

💅 Polish

v7.27.4 (2025-05-30)

👓 Spec Compliance

💅 Polish

🔬 Output optimization

v7.27.3 (2025-05-27)

🐛 Bug Fix

Uh oh!

vercel bot commented Jun 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

vercel bot commented Jun 13, 2025 •

edited

Loading