build(deps): bump mongoose from 9.6.3 to 9.7.2

[dependabot]

Bumps mongoose from 9.6.3 to 9.7.2.

Release notes

Sourced from mongoose's releases.

9.7.2 / 2026-06-22

• fix(documentarray): reindex subdocs after array reordering and removal so subsequent nested changes save using the correct path #16282 AbdelrahmanHafez
• fix(document): avoid accessing special properties in Document.prototype.get()
• fix(schema): only return own properties in schematype lookups and disallow setting schema paths under special properties
• docs: update homepage sponsor layout

9.7.1 / 2026-06-17

• perf(document+model): improve save performance by avoiding unnecessary promise allocations and reducing path/default/dirty-state overhead #16331
• fix(schema): include ObjectId regex pattern in toJSONSchema() output #16335 #16334 AbdelrahmanHafez
• fix(populate): split populate into separate queries per document if the resulting $in filter has more than 50k elements to reduce risk of BSON size errors #16333 #5890
• docs: add assistant sidebar with MongoDB Knowledge integration #16311 #16283
• docs: update docs copy buttons, edit links, homepage alignment, and llms.txt generation #16326 #16327 #16329

9.7.0 / 2026-06-09

• feat: add Node.js TracingChannel support for APM instrumentation #16275 #16105 logaretm
• feat(model): add standard schema adapter for models #16308 #16280
• fix(cursor): avoid waiting on buffering to run aggregation middleware #16289 #16284
• fix(document): throw error if overwriting array selected with $slice #16313 #2432
• fix(schema): remove validateSync() union fallback #16310 #16291 AbdelrahmanHafez
• types: cast primitive types within unions when applying create casting #16320 #16316
• docs: add llms.txt #16312 #15687
• docs: rewrite documents docs #16298
• docs(model): clarify some details on model.validate() casting #16308 #16280
• docs(findOneAndUpdate): clarify update handling of undefined #16299
• docs(model): fix link to be absolute #16321 hasezoey

Changelog

Sourced from mongoose's changelog.

9.7.2 / 2026-06-22

• fix(documentarray): reindex subdocs after array reordering and removal so subsequent nested changes save using the correct path #16282 AbdelrahmanHafez
• fix(document): avoid accessing special properties in Document.prototype.get()
• fix(schema): only return own properties in schematype lookups and disallow setting schema paths under special properties
• docs: update homepage sponsor layout

9.7.1 / 2026-06-17

• perf(document+model): improve save performance by avoiding unnecessary promise allocations and reducing path/default/dirty-state overhead #16331
• fix(schema): include ObjectId regex pattern in toJSONSchema() output #16335 #16334 AbdelrahmanHafez
• fix(populate): split populate into separate queries per document if the resulting $in filter has more than 50k elements to reduce risk of BSON size errors #16333 #5890
• docs: add assistant sidebar with MongoDB Knowledge integration #16311 #16283
• docs: update docs copy buttons, edit links, homepage alignment, and llms.txt generation #16326 #16327 #16329

9.7.0 / 2026-06-09

• feat: add Node.js TracingChannel support for APM instrumentation #16275 #16105 logaretm
• feat(model): add standard schema adapter for models #16308 #16280
• fix(cursor): avoid waiting on buffering to run aggregation middleware #16289 #16284
• fix(document): throw error if overwriting array selected with $slice #16313 #2432
• fix(schema): remove validateSync() union fallback #16310 #16291 AbdelrahmanHafez
• types: cast primitive types within unions when applying create casting #16320 #16316
• docs: add llms.txt #16312 #15687
• docs: rewrite documents docs #16298
• docs(model): clarify some details on model.validate() casting #16308 #16280
• docs(findOneAndUpdate): clarify update handling of undefined #16299
• docs(model): fix link to be absolute #16321 hasezoey

Commits

• 87ade9b chore: release 9.7.2
• 4e12786 Merge branch 'vkarpov15/fix-security-20260609-master'
• b3dd12a docs: flex wrap for major sponsors
• d48fee3 fix(documentarray): reindex subdocs after reordering (#16282)
• 03bedea docs: add mongodb as sponsor on homepage
• 8fa2365 fix(document): additional defensive checks in Document.prototype.get()
• 35a3f33 fix(schema): only return own properties in schematype lookups
• d2a725f chore: fix eslint ignore to exclude old docs files
• 7fee4b5 chore: release 9.7.1
• 1e81fcc Merge pull request #16333 from Automattic/vkarpov15/gh-5890-2
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
pro-react-admin	Ready	Preview, Comment	Jul 25, 2026 9:30pm
pro-react-admin-projecta	Ready	Preview, Comment	Jul 25, 2026 9:30pm
pro-react-admin-projectb	Canceled		Jul 25, 2026 9:30pm
pro-react-admin-shell	Ready	Preview, Comment	Jul 25, 2026 9:30pm

[what-the-diff]

PR摘要

• 升级了mongoose的版本
  从9.6.3版本升级到9.7.2版本。
• 升级了@mongodb-js/saslprep的版本
  从1.4.11版本升级到1.4.13版本。
• 升级了bson的版本
  从7.2.0版本升级到7.3.1版本。
• 升级了mongodb-connection-string-url的版本
  从7.0.1版本升级到7.0.2版本。
• 升级了react-is的版本
  从19.2.7版本升级了19.2.8版本。
• 为几个conventional-changelog预设添加了弃用通知
  推荐使用其他的替代包。
• 改进了锁定文件中更新包的完整性散列
  对于更新的包，改进了其在锁文件中的完整性哈希值。

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud