From d30c70f1121f37e2bc578ba20f61a4c0223e0c95 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 7 May 2026 05:21:43 +0000 Subject: [PATCH 1/2] Bump mongoose from 8.9.5 to 8.22.1 Bumps [mongoose](https://github.com/Automattic/mongoose) from 8.9.5 to 8.22.1. - [Release notes](https://github.com/Automattic/mongoose/releases) - [Changelog](https://github.com/Automattic/mongoose/blob/master/CHANGELOG.md) - [Commits](https://github.com/Automattic/mongoose/compare/8.9.5...8.22.1) --- updated-dependencies: - dependency-name: mongoose dependency-version: 8.22.1 dependency-type: direct:production ... Signed-off-by: dependabot[bot] --- package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package.json b/package.json index 364a0f4..45050da 100644 --- a/package.json +++ b/package.json @@ -34,7 +34,7 @@ "express": "4.21.2", "iotagent-node-lib": "https://github.com/telefonicaid/iotagent-node-lib.git#master", "logops": "2.1.2", - "mongoose": "8.9.5", + "mongoose": "8.22.1", "revalidator": "~0.3.1", "underscore": "~1.12.1" }, From f15ee4213cf727395fae63c9c009f3c8a300db70 Mon Sep 17 00:00:00 2001 From: Alvaro Vega Date: Mon, 11 May 2026 13:02:42 +0200 Subject: [PATCH 2/2] Update CHANGES_NEXT_RELEASE --- CHANGES_NEXT_RELEASE | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGES_NEXT_RELEASE b/CHANGES_NEXT_RELEASE index 8b13789..0663e70 100644 --- a/CHANGES_NEXT_RELEASE +++ b/CHANGES_NEXT_RELEASE @@ -1 +1 @@ - +- Upgrade mongoose from 8.9.5 to 8.22.1 due to CWE-74 CVE-2026-42334