chore(deps-dev): bump mongoose from 8.23.1 to 9.7.2

[dependabot]

Bumps mongoose from 8.23.1 to 9.7.2.

Release notes

Sourced from mongoose's releases.

9.7.2 / 2026-06-22

• fix(documentarray): reindex subdocs after array reordering and removal so subsequent nested changes save using the correct path #16282 AbdelrahmanHafez
• fix(document): avoid accessing special properties in Document.prototype.get()
• fix(schema): only return own properties in schematype lookups and disallow setting schema paths under special properties
• docs: update homepage sponsor layout

9.7.1 / 2026-06-17

• perf(document+model): improve save performance by avoiding unnecessary promise allocations and reducing path/default/dirty-state overhead #16331
• fix(schema): include ObjectId regex pattern in toJSONSchema() output #16335 #16334 AbdelrahmanHafez
• fix(populate): split populate into separate queries per document if the resulting $in filter has more than 50k elements to reduce risk of BSON size errors #16333 #5890
• docs: add assistant sidebar with MongoDB Knowledge integration #16311 #16283
• docs: update docs copy buttons, edit links, homepage alignment, and llms.txt generation #16326 #16327 #16329

9.7.0 / 2026-06-09

• feat: add Node.js TracingChannel support for APM instrumentation #16275 #16105 logaretm
• feat(model): add standard schema adapter for models #16308 #16280
• fix(cursor): avoid waiting on buffering to run aggregation middleware #16289 #16284
• fix(document): throw error if overwriting array selected with $slice #16313 #2432
• fix(schema): remove validateSync() union fallback #16310 #16291 AbdelrahmanHafez
• types: cast primitive types within unions when applying create casting #16320 #16316
• docs: add llms.txt #16312 #15687
• docs: rewrite documents docs #16298
• docs(model): clarify some details on model.validate() casting #16308 #16280
• docs(findOneAndUpdate): clarify update handling of undefined #16299
• docs(model): fix link to be absolute #16321 hasezoey

9.6.3 / 2026-05-27

• fix(clone): isolate cloned arrays from source documents #16281 AbdelrahmanHafez
• fix(update): preserve user-provided $setOnInsert.createdAt with overwriteImmutable: true #16278 #15781 AbdelrahmanHafez
• fix(schema): always pass raw string value to error validators, only trim to 30 chars for maxlength validator #16238 #16236 #15550 #15571
• types: add $percentile to TypeScript aggregation expression types #16290 #16288
• docs: update default pool sizes on createConnection() #16295 torbiak-samdesk
• docs: improve code block copy button behavior and sidebar scrolling #16294 DraXx-Van
• docs: remove broken link to deleted schema example #16297 kaseken

9.6.2 / 2026-05-08

• fix(document): correctly handle modified subpaths when parent path is unset after modifying #16271 #16252
• types: handle compiling with exactOptionalPropertyTypes #16277 #16273
• chore: align Node version docs and types #16270 AbdelrahmanHafez

9.6.1 / 2026-04-29

• types(objectid): fix _id getter helper on ObjectId #16251 noseworthy

9.6.0 / 2026-04-28

... (truncated)

Changelog

Sourced from mongoose's changelog.

9.7.2 / 2026-06-22

• fix(documentarray): reindex subdocs after array reordering and removal so subsequent nested changes save using the correct path #16282 AbdelrahmanHafez
• fix(document): avoid accessing special properties in Document.prototype.get()
• fix(schema): only return own properties in schematype lookups and disallow setting schema paths under special properties
• docs: update homepage sponsor layout

9.7.1 / 2026-06-17

• perf(document+model): improve save performance by avoiding unnecessary promise allocations and reducing path/default/dirty-state overhead #16331
• fix(schema): include ObjectId regex pattern in toJSONSchema() output #16335 #16334 AbdelrahmanHafez
• fix(populate): split populate into separate queries per document if the resulting $in filter has more than 50k elements to reduce risk of BSON size errors #16333 #5890
• docs: add assistant sidebar with MongoDB Knowledge integration #16311 #16283
• docs: update docs copy buttons, edit links, homepage alignment, and llms.txt generation #16326 #16327 #16329

9.7.0 / 2026-06-09

• feat: add Node.js TracingChannel support for APM instrumentation #16275 #16105 logaretm
• feat(model): add standard schema adapter for models #16308 #16280
• fix(cursor): avoid waiting on buffering to run aggregation middleware #16289 #16284
• fix(document): throw error if overwriting array selected with $slice #16313 #2432
• fix(schema): remove validateSync() union fallback #16310 #16291 AbdelrahmanHafez
• types: cast primitive types within unions when applying create casting #16320 #16316
• docs: add llms.txt #16312 #15687
• docs: rewrite documents docs #16298
• docs(model): clarify some details on model.validate() casting #16308 #16280
• docs(findOneAndUpdate): clarify update handling of undefined #16299
• docs(model): fix link to be absolute #16321 hasezoey

9.6.3 / 2026-05-27

• fix(clone): isolate cloned arrays from source documents #16281 AbdelrahmanHafez
• fix(update): preserve user-provided $setOnInsert.createdAt with overwriteImmutable: true #16278 #15781 AbdelrahmanHafez
• fix(schema): always pass raw string value to error validators, only trim to 30 chars for maxlength validator #16238 #16236 #15550 #15571
• types: add $percentile to TypeScript aggregation expression types #16290 #16288
• docs: update default pool sizes on createConnection() #16295 torbiak-samdesk
• docs: improve code block copy button behavior and sidebar scrolling #16294 DraXx-Van
• docs: remove broken link to deleted schema example #16297 kaseken

8.24.0 / 2026-05-14

• feat(aggregate): add pipelineForUnionWith() helper to allow reusing pipelines with $unionWith in TypeScript #16247 #16041 #16033
• fix(connection): handle calling watch() on disconnected connection #16246 #16034
• types: handle compiling with exactOptionalPropertyTypes #16286 #16273

9.6.2 / 2026-05-08

• fix(document): correctly handle modified subpaths when parent path is unset after modifying #16271 #16252
• types: handle compiling with exactOptionalPropertyTypes #16277 #16273
• chore: align Node version docs and types #16270 AbdelrahmanHafez

... (truncated)

Commits

• 87ade9b chore: release 9.7.2
• 4e12786 Merge branch 'vkarpov15/fix-security-20260609-master'
• b3dd12a docs: flex wrap for major sponsors
• d48fee3 fix(documentarray): reindex subdocs after reordering (#16282)
• 03bedea docs: add mongodb as sponsor on homepage
• 8fa2365 fix(document): additional defensive checks in Document.prototype.get()
• 35a3f33 fix(schema): only return own properties in schematype lookups
• d2a725f chore: fix eslint ignore to exclude old docs files
• 7fee4b5 chore: release 9.7.1
• 1e81fcc Merge pull request #16333 from Automattic/vkarpov15/gh-5890-2
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)