CERBERUS/LibreChat
1
0
Fork 0
mirror of https://github.com/danny-avila/LibreChat.git synced 2026-08-04 14:57:42 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 6

🍃 chore: Bump Mongoose to 8.24.1 to Patch Prototype Pollution (#14461)

Browse source 
Closes GHSA-664h-wqgq-64gw (CVSS 6.5, CWE-1321), a prototype pollution
in update casting via a __proto__-prefixed dotted path. Affected range
is >=8.0.0 <8.24.1, so 8.23.1 was flagged by npm audit.
This commit is contained in:
Danny Avila 2026-07-27 12:40:14 -04:00 • committed by GitHub
parent a53936d273
commit 531fecc82b
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
4 changed files with 9 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

2
packages/api/package.json
View file

@ -155,7 +155,7 @@
"mathjs": "^15.2.0",
"memorystore": "^1.6.7",
"mongodb": "^6.14.2",
"mongoose": "^8.23.1",
"mongoose": "^8.24.1",
"nanoid": "^3.3.7",
"node-fetch": "2.7.0",
"pdfjs-dist": "^5.4.624",