chore(deps): bump mongoose from 8.23.0 to 9.2.4 in /apps/api

[dependabot]

Bumps mongoose from 8.23.0 to 9.2.4.

Release notes

Sourced from mongoose's releases.

9.2.4 / 2026-03-03

• types(models): allow unknown keys in subdocs while retaining autocomplete suggestions #16048
• types(schema): fix issues related to defining timestamps and virtuals with methods and/or statics in schema options #16052 #16046
• docs: use lowercase primitive types in JSDoc and fix incorrect @returns declarations #16036 #16018
• docs(field-level-encryption): improve CSFLE docs with model registration guidance and schema definition example #16065 #16015

9.2.3 / 2026-02-26

• types(model): make bulkSave() correctly take array of THydratedDocumentType #16032

9.2.2 / 2026-02-23

• fix(document): make pathsToSave filter all update operators and preserve unsaved state #16027
• fix(setDefaultsOnInsert): check child filter paths before applying defaults, fix dot-notation handling, and prevent prototype pollution #16031 #16030
• fix(populate): make refPath work as a function, including map paths with $* #16035 #16028
• perf: optimize pathsToSave and indexed-path checks for subdocuments
• types: remove duplicate definition of UUIDToJSON type #16029
• docs(field-level-encryption): clarify crypt_shared library usage and move extraOptions under autoEncryption #16026 #16015
• test(types): introduce TSTyche for type testing #16024

9.2.1 / 2026-02-11

• types(query): allow assigning QueryFilter<DocType> to QueryFilter<any> #16020
• types: duplicate identifier 'UUIDToJSON' in mongoosejs 9.2.0 #16023
• types: preserve subdocument toObject() field types when using virtuals + versionKey options #16021 #15965 AbdelrahmanHafez
• docs(mongoose): add missing options to mongoose.set() docs #16019

9.2.0 / 2026-02-09

• feat: add option to skip middleware #15883 #8768 AbdelrahmanHafez
• feat(model): delay "Duplicate schema index" warning until createIndexes runs to include model name in the warning #15979
• feat(model): add strict option to Model.hydrate(...) #15940 #15977
• feat(document): add flattenUUIDs option to toObject() and toJSON() #15864 #15021 AbdelrahmanHafez
• fix(schema): treat undefined as not provided for strict, strictQuery and id options #16004 AbdelrahmanHafez
• types(inferrawdoctype): avoid adding _id to nested paths and handle _id: false in options + schema definition #15989
• types: fix toObject() type inference with timestamps + virtuals #15975 AbdelrahmanHafez
• types(models): remove dead MapReduce and GeoSearch types #15984
• test(types): remove tsd in favor of tsc + test utilities #15951 #15696

9.1.6 / 2026-02-04

• fix: handle other top-level query operators in sanitizeFilter
• fix(types): fix toObject() type inference with timestamps + virtuals #15975 #15965 AbdelrahmanHafez
• fix(populate): defer subpopulate until after match functions to avoid comparing populated subdocs #15981 mongodb-js/mongoose-autopopulate#112
• fix(DocumentArray): correctly clone subdocument when updating document array #15978 #15973
• fix(documentArray): fix change tracking for documentArrays in nested maps #15983 #15970 AbdelrahmanHafez
• docs: clarify that you need to explicitly create timeseries collection before inserting document #15990 #15986

9.1.5 / 2026-01-20

... (truncated)

Changelog

Sourced from mongoose's changelog.

9.2.4 / 2026-03-03

• types(models): allow unknown keys in subdocs while retaining autocomplete suggestions #16048
• types(schema): fix issues related to defining timestamps and virtuals with methods and/or statics in schema options #16052 #16046
• docs: use lowercase primitive types in JSDoc and fix incorrect @returns declarations #16036 #16018
• docs(field-level-encryption): improve CSFLE docs with model registration guidance and schema definition example #16065 #16015

9.2.3 / 2026-02-26

• types(model): make bulkSave() correctly take array of THydratedDocumentType #16032

9.2.2 / 2026-02-23

• fix(document): make pathsToSave filter all update operators and preserve unsaved state #16027
• fix(setDefaultsOnInsert): check child filter paths before applying defaults, fix dot-notation handling, and prevent prototype pollution #16031 #16030
• fix(populate): make refPath work as a function, including map paths with $* #16035 #16028
• perf: optimize pathsToSave and indexed-path checks for subdocuments
• types: remove duplicate definition of UUIDToJSON type #16029
• docs(field-level-encryption): clarify crypt_shared library usage and move extraOptions under autoEncryption #16026 #16015
• test(types): introduce TSTyche for type testing #16024

9.2.1 / 2026-02-11

• types(query): allow assigning QueryFilter to QueryFilter #16020
• types: duplicate identifier 'UUIDToJSON' in mongoosejs 9.2.0 #16023
• types: preserve subdocument toObject() field types when using virtuals + versionKey options #16021 #15965 AbdelrahmanHafez
• docs(mongoose): add missing options to mongoose.set() docs #16019

9.2.0 / 2026-02-09

• feat: add option to skip middleware #15883 #8768 AbdelrahmanHafez
• feat(model): delay "Duplicate schema index" warning until createIndexes runs to include model name in the warning #15979
• feat(model): add strict option to Model.hydrate(...) #15940 #15977
• feat(document): add flattenUUIDs option to toObject() and toJSON() #15864 #15021 AbdelrahmanHafez
• fix(schema): treat undefined as not provided for strict, strictQuery and id options #16004 AbdelrahmanHafez
• types(inferrawdoctype): avoid adding _id to nested paths and handle _id: false in options + schema definition #15989
• types: fix toObject() type inference with timestamps + virtuals #15975 AbdelrahmanHafez
• types(models): remove dead MapReduce and GeoSearch types #15984
• test(types): remove tsd in favor of tsc + test utilities #15951 #15696

Commits

• c8a93b6 chore: release 9.2.4
• c55dcb2 Merge pull request #16065 from Automattic/vkarpov15/gh-16015-2
• 2de9bbe Update docs/field-level-encryption.md
• 2217d98 Update docs/field-level-encryption.md
• f818d44 Update docs/field-level-encryption.md
• 78f55cc docs(field-level-encryption): add example of defining schema with csfle
• eb6f2a2 docs(field-level-encryption): improve notes about registering models before c...
• 7971d30 Merge pull request #16061 from Automattic/dependabot/npm_and_yarn/master/ajv-...
• 02b03fe Merge pull request #16063 from Automattic/vkarpov15/eslint-10
• 92a5b7b upgrade to eslint 10.x
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

Summary by cubic

Upgrade mongoose to 9.2.4 in apps/api to pick up fixes, type improvements, and new features. This is a major bump; please verify model and middleware behavior.

• Migration
  • Run tests and watch for changes to strict, strictQuery, and id handling when options are undefined.
  • Recheck schemas that combine timestamps/virtuals with methods/statics for clean compilation.
  • If you serialize UUIDs, verify outputs with the new flattenUUIDs option.
  • Ensure our Node.js and mongodb driver versions are supported by mongoose@9; reinstall and rebuild.

^{Written for commit 16c95ac. Summary will update on new commits.}

[dependabot]

Labels

The following labels could not be found: backend, dependencies. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
forge-os	Error		Mar 9, 2026 0:51am

[cubic-dev-ai]

No issues found across 1 file