Bump mongoose from 9.2.2 to 9.5.0 in /server

[dependabot]

Bumps mongoose from 9.2.2 to 9.5.0.

Release notes

Sourced from mongoose's releases.

9.5.0 / 2026-04-20

• feat(debug): add timestamp option to debug output #16216 rejunp
• feat(query): add cloneUpdate option to explicitly disable update cloning #16230 #16202
• feat(query): extend defaults query option to find() #16226 sderrow
• fix(query): avoid cloning update until absolutely necessary to better support updates with __proto__ #16230 #16202
• fix(query): avoid treating documents with a $set() method as objects with a $set property when casting updates #16230
• fix(queryHelpers): pass default options to discriminators #16227 #16226
• fix(document): handle including and excluding nested paths with optimistic concurrency #16177 #16054
• fix(model): throw ObjectParameterError in insertOne() if doc is not an object #16221 IshitaSingh0822
• fix(cast): preserve reason in CastError message after setModel() #16167 White-Devil2839
• perf(model): remove unnecessary clone in findOneAndUpdate() #16230
• perf: use kareem 3.3.0 mongoosejs/kareem#45 #16229
• chore: use TSTyche assertions #16222 mrazauskas

9.4.1 / 2026-04-03

• Revert "fix(setDefaultsOnInsert): run setters on default values during upsert" #16218 #16051

9.4.0 / 2026-04-03

• perf(document+model): avoid parallel save error instantiation, simplify resetting atomics, streamline validation and collection handling
• feat(document): add $getChanges() alias, deprecate getChanges() #15959 techcodie
• fix(schema): support toJSONSchema on unions #16179
• fix(schema): implement validation for Union schemas and subdocuments techcodie
• fix(connection): snapshot Date in heartbeat handler and flush queue on recovery #16183 andreialecu
• fix(model): use duck-typing with version check to validate the argument to useConnection() is actually a connection #16098
• fix(setDefaultsOnInsert): run setters on default values during upsert #16051 mahmoodhamdi
• fix(utils): properly compare Set objects in deepEqual KhanjarSingh
• fix(utils): wrap discriminator merge check in parentheses to fix precedence Necro-Rohan
• fix(schema): correct template literal in encryptionType error message Mridul012
• fix(schema): correct error when unsupported query operator with number #16062
• fix(types): make MergeType and UnpackedIntersection distributive over union types techcodie
• types: add id to HydratedDocument virtuals by default unless explicitly set #16178
• types(populate): use marker type to track populated vs depopulated type for perf
• types(populate): retain populated paths in toObject() and toJSON() unless depopulate: true set #16085
• types(query): make TypeScript error on $and with unrecognized query operator
• chore: use TSTyche assertions mrazauskas
• docs(connection): remove references to useUnifiedTopology and fix backtick
• docs: fix typo 'retreiving' -> 'retrieving' in SchemaType getter JSDoc yogesh968
• docs: fix typos around 'retrieve' in schemaType and tests ayushshukla1807
• docs: fix typos in code comments Goldyvaiiii

9.3.3 / 2026-03-25

• fix(schemaType): standardize to use MongooseError instead of plain Error #16172 VIPAX-JIT
• types: make MergeType distributive to better support populate on models where the hydrated doc type is a union #16101 #16161
• docs: upgrade http:// links to https:// in connections.md #16163 Puxhkar
• docs: fix typographical, grammatical errors & documentation clarity improvements #16175 yogesh968
• docs: clarify multi-mongos support documentation for sharded clusters

... (truncated)

Changelog

Sourced from mongoose's changelog.

9.5.0 / 2026-04-20

• feat(debug): add timestamp option to debug output #16216 rejunp
• feat(query): add cloneUpdate option to explicitly disable update cloning #16230 #16202
• feat(query): extend defaults query option to find() #16226 sderrow
• fix(query): avoid cloning update until absolutely necessary to better support updates with __proto__ #16230 #16202
• fix(query): avoid treating documents with a $set() method as objects with a $set property when casting updates #16230
• fix(queryHelpers): pass default options to discriminators #16227 #16226
• fix(document): handle including and excluding nested paths with optimistic concurrency #16177 #16054
• fix(model): throw ObjectParameterError in insertOne() if doc is not an object #16221 IshitaSingh0822
• fix(cast): preserve reason in CastError message after setModel() #16167 White-Devil2839
• perf(model): remove unnecessary clone in findOneAndUpdate() #16230
• perf: use kareem 3.3.0 mongoosejs/kareem#45 #16229
• chore: use TSTyche assertions #16222 mrazauskas

9.4.1 / 2026-04-03

• Revert "fix(setDefaultsOnInsert): run setters on default values during upsert" #16218 #16051

9.4.0 / 2026-04-03

• perf(document+model): avoid parallel save error instantiation, simplify resetting atomics, streamline validation and collection handling
• feat(document): add $getChanges() alias, deprecate getChanges() #15959 techcodie
• fix(schema): support toJSONSchema on unions #16179
• fix(schema): implement validation for Union schemas and subdocuments techcodie
• fix(connection): snapshot Date in heartbeat handler and flush queue on recovery #16183 andreialecu
• fix(model): use duck-typing with version check to validate the argument to useConnection() is actually a connection #16098
• fix(setDefaultsOnInsert): run setters on default values during upsert #16051 mahmoodhamdi
• fix(utils): properly compare Set objects in deepEqual KhanjarSingh
• fix(utils): wrap discriminator merge check in parentheses to fix precedence Necro-Rohan
• fix(schema): correct template literal in encryptionType error message Mridul012
• fix(schema): correct error when unsupported query operator with number #16062
• fix(types): make MergeType and UnpackedIntersection distributive over union types techcodie
• types: add id to HydratedDocument virtuals by default unless explicitly set #16178
• types(populate): use marker type to track populated vs depopulated type for perf
• types(populate): retain populated paths in toObject() and toJSON() unless depopulate: true set #16085
• types(query): make TypeScript error on $and with unrecognized query operator
• chore: use TSTyche assertions mrazauskas
• docs(connection): remove references to useUnifiedTopology and fix backtick
• docs: fix typo 'retreiving' -> 'retrieving' in SchemaType getter JSDoc yogesh968
• docs: fix typos around 'retrieve' in schemaType and tests ayushshukla1807
• docs: fix typos in code comments Goldyvaiiii

9.3.3 / 2026-03-25

• fix(schemaType): standardize to use MongooseError instead of plain Error #16172 VIPAX-JIT
• types: make MergeType distributive to better support populate on models where the hydrated doc type is a union #16101 #16161
• docs: upgrade http:// links to https:// in connections.md #16163 Puxhkar
• docs: fix typographical, grammatical errors & documentation clarity improvements #16175 yogesh968
• docs: clarify multi-mongos support documentation for sharded clusters

... (truncated)

Commits

• b949826 chore: release 9.5.0
• a35104a Merge pull request #16230 from Automattic/vkarpov15/gh-16202-2
• 841eea1 Merge branch 'vkarpov15/gh-16202-2' of github.com:Automattic/mongoose into vk...
• 1db8455 address code review comments
• e1d8e43 Apply suggestion from @​Copilot
• 279cbf8 feat(query): add cloneUpdate option that tells Mongoose explicitly to not clo...
• 2d5cf49 Merge branch 'master' into vkarpov15/gh-16202-2
• 5800081 Merge pull request #16229 from Automattic/vkarpov15/kareem-3.3
• 32675b3 further reduce min-release-age for kareem
• 6a24e3f chore: temp reduce min-release-age for kareem
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #106.