build(deps): bump mongoose from 9.6.1 to 9.7.3 in /server

[dependabot]

Bumps mongoose from 9.6.1 to 9.7.3.

Release notes

Sourced from mongoose's releases.

9.7.3 / 2026-06-26

• types(model): correct Model.validate() return type to Promise #16340 #16338
• types: use @​standard-schema/spec for StandardSchema types rather than inlining #16341 #16339

9.7.2 / 2026-06-22

• fix(documentarray): reindex subdocs after array reordering and removal so subsequent nested changes save using the correct path #16282 AbdelrahmanHafez
• fix(document): avoid accessing special properties in Document.prototype.get()
• fix(schema): only return own properties in schematype lookups and disallow setting schema paths under special properties
• docs: update homepage sponsor layout

9.7.1 / 2026-06-17

• perf(document+model): improve save performance by avoiding unnecessary promise allocations and reducing path/default/dirty-state overhead #16331
• fix(schema): include ObjectId regex pattern in toJSONSchema() output #16335 #16334 AbdelrahmanHafez
• fix(populate): split populate into separate queries per document if the resulting $in filter has more than 50k elements to reduce risk of BSON size errors #16333 #5890
• docs: add assistant sidebar with MongoDB Knowledge integration #16311 #16283
• docs: update docs copy buttons, edit links, homepage alignment, and llms.txt generation #16326 #16327 #16329

9.7.0 / 2026-06-09

• feat: add Node.js TracingChannel support for APM instrumentation #16275 #16105 logaretm
• feat(model): add standard schema adapter for models #16308 #16280
• fix(cursor): avoid waiting on buffering to run aggregation middleware #16289 #16284
• fix(document): throw error if overwriting array selected with $slice #16313 #2432
• fix(schema): remove validateSync() union fallback #16310 #16291 AbdelrahmanHafez
• types: cast primitive types within unions when applying create casting #16320 #16316
• docs: add llms.txt #16312 #15687
• docs: rewrite documents docs #16298
• docs(model): clarify some details on model.validate() casting #16308 #16280
• docs(findOneAndUpdate): clarify update handling of undefined #16299
• docs(model): fix link to be absolute #16321 hasezoey

9.6.3 / 2026-05-27

• fix(clone): isolate cloned arrays from source documents #16281 AbdelrahmanHafez
• fix(update): preserve user-provided $setOnInsert.createdAt with overwriteImmutable: true #16278 #15781 AbdelrahmanHafez
• fix(schema): always pass raw string value to error validators, only trim to 30 chars for maxlength validator #16238 #16236 #15550 #15571
• types: add $percentile to TypeScript aggregation expression types #16290 #16288
• docs: update default pool sizes on createConnection() #16295 torbiak-samdesk
• docs: improve code block copy button behavior and sidebar scrolling #16294 DraXx-Van
• docs: remove broken link to deleted schema example #16297 kaseken

9.6.2 / 2026-05-08

• fix(document): correctly handle modified subpaths when parent path is unset after modifying #16271 #16252
• types: handle compiling with exactOptionalPropertyTypes #16277 #16273
• chore: align Node version docs and types #16270 AbdelrahmanHafez

Changelog

Sourced from mongoose's changelog.

9.7.3 / 2026-06-26

• types(model): correct Model.validate() return type to Promise #16340 #16338
• types: use @​standard-schema/spec for StandardSchema types rather than inlining #16341 #16339

9.7.2 / 2026-06-22

• fix(documentarray): reindex subdocs after array reordering and removal so subsequent nested changes save using the correct path #16282 AbdelrahmanHafez
• fix(document): avoid accessing special properties in Document.prototype.get()
• fix(schema): only return own properties in schematype lookups and disallow setting schema paths under special properties
• docs: update homepage sponsor layout

9.7.1 / 2026-06-17

• perf(document+model): improve save performance by avoiding unnecessary promise allocations and reducing path/default/dirty-state overhead #16331
• fix(schema): include ObjectId regex pattern in toJSONSchema() output #16335 #16334 AbdelrahmanHafez
• fix(populate): split populate into separate queries per document if the resulting $in filter has more than 50k elements to reduce risk of BSON size errors #16333 #5890
• docs: add assistant sidebar with MongoDB Knowledge integration #16311 #16283
• docs: update docs copy buttons, edit links, homepage alignment, and llms.txt generation #16326 #16327 #16329

9.7.0 / 2026-06-09

• feat: add Node.js TracingChannel support for APM instrumentation #16275 #16105 logaretm
• feat(model): add standard schema adapter for models #16308 #16280
• fix(cursor): avoid waiting on buffering to run aggregation middleware #16289 #16284
• fix(document): throw error if overwriting array selected with $slice #16313 #2432
• fix(schema): remove validateSync() union fallback #16310 #16291 AbdelrahmanHafez
• types: cast primitive types within unions when applying create casting #16320 #16316
• docs: add llms.txt #16312 #15687
• docs: rewrite documents docs #16298
• docs(model): clarify some details on model.validate() casting #16308 #16280
• docs(findOneAndUpdate): clarify update handling of undefined #16299
• docs(model): fix link to be absolute #16321 hasezoey

9.6.3 / 2026-05-27

• fix(clone): isolate cloned arrays from source documents #16281 AbdelrahmanHafez
• fix(update): preserve user-provided $setOnInsert.createdAt with overwriteImmutable: true #16278 #15781 AbdelrahmanHafez
• fix(schema): always pass raw string value to error validators, only trim to 30 chars for maxlength validator #16238 #16236 #15550 #15571
• types: add $percentile to TypeScript aggregation expression types #16290 #16288
• docs: update default pool sizes on createConnection() #16295 torbiak-samdesk
• docs: improve code block copy button behavior and sidebar scrolling #16294 DraXx-Van
• docs: remove broken link to deleted schema example #16297 kaseken

8.24.0 / 2026-05-14

• feat(aggregate): add pipelineForUnionWith() helper to allow reusing pipelines with $unionWith in TypeScript #16247 #16041 #16033
• fix(connection): handle calling watch() on disconnected connection #16246 #16034
• types: handle compiling with exactOptionalPropertyTypes #16286 #16273

... (truncated)

Commits

• df72bff chore: release 9.7.3
• 97f0f36 Merge pull request #16341 from Automattic/vkarpov15/gh-16339
• aa58b76 types: use @​standard-schema/spec for StandardSchema types rather than inlining
• 0734de7 fix(types): correct Model.validate() return type to Promise<TRawDocType> (#16...
• 87ade9b chore: release 9.7.2
• 4e12786 Merge branch 'vkarpov15/fix-security-20260609-master'
• b3dd12a docs: flex wrap for major sponsors
• d48fee3 fix(documentarray): reindex subdocs after reordering (#16282)
• 3e0e079 fix(types): correct Model.validate() return type to Promise<TRawDocType>
• 03bedea docs: add mongodb as sponsor on homepage
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
sde-verse	Error		Jul 1, 2026 12:09am