[Snyk] Security upgrade mongoose from 7.0.3 to 7.3.4

[sidhantpanda]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • package.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	798/1000 Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 8.1	Prototype Pollution SNYK-JS-MONGOOSE-5777721	No	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: mongoose

The new version differs by 250 commits.

• 0cb0757 chore: release 7.3.4
• aef309e Merge branch '6.x'
• e9eb8ab chore: release 6.11.3
• 688da8f test: fix flakey tests, remove test for #9597 because it affects global state and fails intermittently on deno
• 4f264a8 test: fix tests re: #13317
• 9616af7 fix(schema): correctly handle uuids with populate()
• 305ce4f fix: avoid prototype pollution on init
• 90d84fd chore: release 7.3.3
• 82b9c3c style: fix lint
• 02699fa Merge branch 'vkarpov15/avoid-prototype-pollution'
• 2188458 Merge pull request #13577 from Automattic/vkarpov15/gh-13529
• e94ca23 Merge pull request #13589 from Automattic/vkarpov15/gh-13582
• 1a998e2 Merge pull request #13588 from Automattic/vkarpov15/gh-13575
• cc722a1 test: add coverage for constructor properties
• e29578d fix: avoid prototype pollution on init
• 422dff4 perf: avoid adding all doc array subpaths when 1 path is modified
• eb9a4f7 fix(document): clean up all array subdocument modified paths on save()
• 8b8f37b types: apply suggested alternative handling for TOverrides = any
• 79a4bda Merge branch 'master' into vkarpov15/gh-13529
• 22b1e25 fix(populate): correctly set `populatedModelSymbol` on documents populated using `Model.populate()`
• b336ed8 chore: release 7.3.2
• 7ad5eef Merge pull request #13579 from Automattic/vkarpov15/gh-13531
• c01cff6 Merge pull request #13581 from hasezoey/updateDev
• 7b3b027 chore(dev-deps): bump mkdirp from 2.1.3 to 3.0.1

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Prototype Pollution

[github-actions]

Based on the code patch you provided, it appears to be a package.json file that specifies dependencies for a Node.js application. The specific portion of the patch you highlighted is updating the version of the "mongoose" package from "7.0.3" to "7.3.4".

The code patch itself does not contain any bugs or risks. Updating the package version can potentially address issues or add new features introduced in the newer version.

Here are a couple of improvement suggestions:

1. Consider pinning dependency versions: It's generally recommended to specify exact versions for your dependencies instead of using loose ranges like "^4.1.0". This ensures that all developers working on the project use the same versions of the packages, avoiding unexpected behavior caused by incompatible changes in newer versions.

2. Regularly update dependencies: Keeping your dependencies up to date is essential for security and bug fixes. Regularly review and update your package.json file to include the latest stable versions of your dependencies.

Remember to thoroughly test your application after updating dependencies to ensure compatibility and functionality.