Merge pull request #36462 from overleaf/lg-security-mongoose

[Security upgrade] bump mongoose to 8.24.1 in web

GitOrigin-RevId: 89373303435aec06c2e1efde1dd54f1d70c4dfe1

.yarnrc.yml

@@ -76,9 +76,12 @@ packageExtensions:
   "inversify@*":
     dependencies:
       reflect-metadata: "*"
+  # Must match services/web's pinned mongoose version exactly (not a range):
+  # sinon-mongoose checks `instanceof mongoose.Model` against its own resolved
+  # copy, so any version drift from web's copy breaks that check silently.
   "sinon-mongoose@*":
     dependencies:
-      mongoose: "*"
+      mongoose: "8.24.3"
   "react-linkify@*":
     peerDependencies:
       react: "*"

package.json

@@ -80,7 +80,6 @@
     "send": "patch:send@npm%3A0.19.0#~/.yarn/patches/send-npm-0.19.0.patch",
     "serve-static": "1.16.2",
     "recurly": "4.12.0",
-    "mongoose": "8.22.1",
     "pg": "8.7.1",
     "pg-query-stream": "4.7.1",
     "@aws-sdk/client-s3": "3.994.0",

services/web/package.json

@@ -158,7 +158,7 @@
     "moment": "^2.29.4",
     "mongodb": "6.12.0",
     "mongodb-legacy": "6.1.3",
-    "mongoose": "8.22.1",
+    "mongoose": "8.24.3",
     "multer": "2.2.0",
     "nocache": "^2.1.0",
     "node-fetch": "^2.7.0",

yarn.lock

@@ -8174,7 +8174,7 @@ __metadata:
     moment: "npm:^2.29.4"
     mongodb: "npm:6.12.0"
     mongodb-legacy: "npm:6.1.3"
-    mongoose: "npm:8.22.1"
+    mongoose: "npm:8.24.3"
     multer: "npm:2.2.0"
     nocache: "npm:^2.1.0"
     nock: "npm:^13.5.6"
@@ -24975,9 +24975,9 @@ __metadata:
   languageName: node
   linkType: hard
 
-"mongoose@npm:8.22.1":
-  version: 8.22.1
-  resolution: "mongoose@npm:8.22.1"
+"mongoose@npm:8.24.3, mongoose@npm:^8.9.5":
+  version: 8.24.3
+  resolution: "mongoose@npm:8.24.3"
   dependencies:
     bson: "npm:^6.10.4"
     kareem: "npm:2.6.3"
@@ -24986,7 +24986,7 @@ __metadata:
     mquery: "npm:5.0.0"
     ms: "npm:2.1.3"
     sift: "npm:17.1.3"
-  checksum: 10c0/fd8ca6cc3dd2bec78cc1b2e446b93f8bfd583fa9bb12f32abf57849a4a44286d59972c53b3e45bb3ef46504b39982a783c38e2329bb32a25a221a705a167504f
+  checksum: 10c0/e07908efe90477e0dcde14783b6aa1308504c88b4b6adc561808b2907c8c31dd6a68b3cb16ce54f9c95ea4f4480caa4e0120cc2d721e156e5c5091ff64d07b92
   languageName: node
   linkType: hard