chore(deps): bump mongoose from 9.6.3 to 9.7.2 in /Server

[dependabot]

Bumps mongoose from 9.6.3 to 9.7.2.

Release notes

Sourced from mongoose's releases.

9.7.2 / 2026-06-22

• fix(documentarray): reindex subdocs after array reordering and removal so subsequent nested changes save using the correct path #16282 AbdelrahmanHafez
• fix(document): avoid accessing special properties in Document.prototype.get()
• fix(schema): only return own properties in schematype lookups and disallow setting schema paths under special properties
• docs: update homepage sponsor layout

9.7.1 / 2026-06-17

• perf(document+model): improve save performance by avoiding unnecessary promise allocations and reducing path/default/dirty-state overhead #16331
• fix(schema): include ObjectId regex pattern in toJSONSchema() output #16335 #16334 AbdelrahmanHafez
• fix(populate): split populate into separate queries per document if the resulting $in filter has more than 50k elements to reduce risk of BSON size errors #16333 #5890
• docs: add assistant sidebar with MongoDB Knowledge integration #16311 #16283
• docs: update docs copy buttons, edit links, homepage alignment, and llms.txt generation #16326 #16327 #16329

9.7.0 / 2026-06-09

• feat: add Node.js TracingChannel support for APM instrumentation #16275 #16105 logaretm
• feat(model): add standard schema adapter for models #16308 #16280
• fix(cursor): avoid waiting on buffering to run aggregation middleware #16289 #16284
• fix(document): throw error if overwriting array selected with $slice #16313 #2432
• fix(schema): remove validateSync() union fallback #16310 #16291 AbdelrahmanHafez
• types: cast primitive types within unions when applying create casting #16320 #16316
• docs: add llms.txt #16312 #15687
• docs: rewrite documents docs #16298
• docs(model): clarify some details on model.validate() casting #16308 #16280
• docs(findOneAndUpdate): clarify update handling of undefined #16299
• docs(model): fix link to be absolute #16321 hasezoey

Changelog

Sourced from mongoose's changelog.

9.7.2 / 2026-06-22

• fix(documentarray): reindex subdocs after array reordering and removal so subsequent nested changes save using the correct path #16282 AbdelrahmanHafez
• fix(document): avoid accessing special properties in Document.prototype.get()
• fix(schema): only return own properties in schematype lookups and disallow setting schema paths under special properties
• docs: update homepage sponsor layout

9.7.1 / 2026-06-17

• perf(document+model): improve save performance by avoiding unnecessary promise allocations and reducing path/default/dirty-state overhead #16331
• fix(schema): include ObjectId regex pattern in toJSONSchema() output #16335 #16334 AbdelrahmanHafez
• fix(populate): split populate into separate queries per document if the resulting $in filter has more than 50k elements to reduce risk of BSON size errors #16333 #5890
• docs: add assistant sidebar with MongoDB Knowledge integration #16311 #16283
• docs: update docs copy buttons, edit links, homepage alignment, and llms.txt generation #16326 #16327 #16329

9.7.0 / 2026-06-09

• feat: add Node.js TracingChannel support for APM instrumentation #16275 #16105 logaretm
• feat(model): add standard schema adapter for models #16308 #16280
• fix(cursor): avoid waiting on buffering to run aggregation middleware #16289 #16284
• fix(document): throw error if overwriting array selected with $slice #16313 #2432
• fix(schema): remove validateSync() union fallback #16310 #16291 AbdelrahmanHafez
• types: cast primitive types within unions when applying create casting #16320 #16316
• docs: add llms.txt #16312 #15687
• docs: rewrite documents docs #16298
• docs(model): clarify some details on model.validate() casting #16308 #16280
• docs(findOneAndUpdate): clarify update handling of undefined #16299
• docs(model): fix link to be absolute #16321 hasezoey

Commits

• 87ade9b chore: release 9.7.2
• 4e12786 Merge branch 'vkarpov15/fix-security-20260609-master'
• b3dd12a docs: flex wrap for major sponsors
• d48fee3 fix(documentarray): reindex subdocs after reordering (#16282)
• 03bedea docs: add mongodb as sponsor on homepage
• 8fa2365 fix(document): additional defensive checks in Document.prototype.get()
• 35a3f33 fix(schema): only return own properties in schematype lookups
• d2a725f chore: fix eslint ignore to exclude old docs files
• 7fee4b5 chore: release 9.7.1
• 1e81fcc Merge pull request #16333 from Automattic/vkarpov15/gh-5890-2
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

---

Summary by cubic

Upgrade mongoose from 9.6.3 to 9.7.2 in Server to pick up performance improvements and important bug fixes.

• Dependencies

  • mongoose: 9.6.3 → 9.7.2
  • Highlights: faster saves; correct reindexing of subdocument arrays; safer document getters/schema; splits very large populate $in queries; adds Node.js TracingChannel support.

• Migration

  • No code changes expected. Run tests; if projecting arrays with $slice, note that overwriting those arrays now throws.

^{Written for commit 8270ccd. Summary will update on new commits.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
klar	Ready	Preview, Comment, Open in v0	Jul 28, 2026 7:22am