From 52f25234cdcec298c9ac9bfe00c909526133e7c3 Mon Sep 17 00:00:00 2001
From: Andrew Rumble <andrew.rumble@overleaf.com>
Date: Mon, 24 Aug 2026 13:43:45 +0100
Subject: [PATCH] Merge pull request #36462 from overleaf/lg-security-mongoose

[Security upgrade] bump mongoose to 8.24.1 in web

GitOrigin-RevId: 89373303435aec06c2e1efde1dd54f1d70c4dfe1
---
 .yarnrc.yml               |  5 ++++-
 package.json              |  1 -
 services/web/package.json |  2 +-
 yarn.lock                 | 10 +++++-----
 4 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/.yarnrc.yml b/.yarnrc.yml
index 2f5ba65084..2b009fb694 100644
--- a/.yarnrc.yml
+++ b/.yarnrc.yml
@@ -76,9 +76,12 @@ packageExtensions:
   "inversify@*":
     dependencies:
       reflect-metadata: "*"
+  # Must match services/web's pinned mongoose version exactly (not a range):
+  # sinon-mongoose checks `instanceof mongoose.Model` against its own resolved
+  # copy, so any version drift from web's copy breaks that check silently.
   "sinon-mongoose@*":
     dependencies:
-      mongoose: "*"
+      mongoose: "8.24.3"
   "react-linkify@*":
     peerDependencies:
       react: "*"
diff --git a/package.json b/package.json
index 2de6b4f73e..c9f4d13d07 100644
--- a/package.json
+++ b/package.json
@@ -80,7 +80,6 @@
     "send": "patch:send@npm%3A0.19.0#~/.yarn/patches/send-npm-0.19.0.patch",
     "serve-static": "1.16.2",
     "recurly": "4.12.0",
-    "mongoose": "8.22.1",
     "pg": "8.7.1",
     "pg-query-stream": "4.7.1",
     "@aws-sdk/client-s3": "3.994.0",
diff --git a/services/web/package.json b/services/web/package.json
index 49261a3ba5..4be06e333d 100644
--- a/services/web/package.json
+++ b/services/web/package.json
@@ -158,7 +158,7 @@
     "moment": "^2.29.4",
     "mongodb": "6.12.0",
     "mongodb-legacy": "6.1.3",
-    "mongoose": "8.22.1",
+    "mongoose": "8.24.3",
     "multer": "2.2.0",
     "nocache": "^2.1.0",
     "node-fetch": "^2.7.0",
diff --git a/yarn.lock b/yarn.lock
index e4471e6274..6d81b2346e 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -8174,7 +8174,7 @@ __metadata:
     moment: "npm:^2.29.4"
     mongodb: "npm:6.12.0"
     mongodb-legacy: "npm:6.1.3"
-    mongoose: "npm:8.22.1"
+    mongoose: "npm:8.24.3"
     multer: "npm:2.2.0"
     nocache: "npm:^2.1.0"
     nock: "npm:^13.5.6"
@@ -24975,9 +24975,9 @@ __metadata:
   languageName: node
   linkType: hard
 
-"mongoose@npm:8.22.1":
-  version: 8.22.1
-  resolution: "mongoose@npm:8.22.1"
+"mongoose@npm:8.24.3, mongoose@npm:^8.9.5":
+  version: 8.24.3
+  resolution: "mongoose@npm:8.24.3"
   dependencies:
     bson: "npm:^6.10.4"
     kareem: "npm:2.6.3"
@@ -24986,7 +24986,7 @@ __metadata:
     mquery: "npm:5.0.0"
     ms: "npm:2.1.3"
     sift: "npm:17.1.3"
-  checksum: 10c0/fd8ca6cc3dd2bec78cc1b2e446b93f8bfd583fa9bb12f32abf57849a4a44286d59972c53b3e45bb3ef46504b39982a783c38e2329bb32a25a221a705a167504f
+  checksum: 10c0/e07908efe90477e0dcde14783b6aa1308504c88b4b6adc561808b2907c8c31dd6a68b3cb16ce54f9c95ea4f4480caa4e0120cc2d721e156e5c5091ff64d07b92
   languageName: node
   linkType: hard