chore(deps-dev): bump mongoose from 9.6.2 to 9.8.1 in /evals

[dependabot]

Bumps mongoose from 9.6.2 to 9.8.1.

Release notes

Sourced from mongoose's releases.

9.8.1 / 2026-07-27

• perf(document): avoid rebuilding modified paths during required path validation #16379 xianjianlf2
• perf(document): avoid clearing the required paths cache on every document instantiation #16404 #16377
• fix(query): reject update modifiers without paths #16387 AbdelrahmanHafez
• perf: cache toString() results in array.unique to avoid redundant allocations #16390 vivek180905
• types: respect the _id option when inferring StandardSchema types #16402
• types(model): keep Model.schema typed when TSchema is omitted samuelmbabhazi
• docs(guide): clarify strictQuery handling of filter paths not in the schema #16397 MuhammadFarhantahir

9.8.0 / 2026-07-20

• feat(schema): add strictRead option to filter or throw on unknown fields during document hydration #16345 #4279 GourabSingha
• feat: upgrade MongoDB Node.js driver to 7.5 #16391
• fix(subdocument): don't minimize empty document array elements to null #16393 #15336 #7322 WaleedAshraf
• fix(model): correctly handle version keys when bulkSave() inserts new documents #16386 #15800 AbdelrahmanHafez
• fix(cast): correctly cast object-shaped geo query values #16380 #16376 rajkumar0932
• fix(schema): avoid mutating shared setters when casting array query values #16372 #16364 yakubka
• fix(document): correctly handle excluded parent paths with optimistic concurrency #16367 #16054 AbdelrahmanHafez
• types(model): add pathsToSave to SaveOptions #16375 AbdelrahmanHafez
• types(model): support extra fields in hydrate() with strict: false #16374 #15940 AbdelrahmanHafez
• docs(populate): document missing options and perDocumentLimit for populate() #16371 Wnayar
• docs: expand sample() example to show sampling from a filtered subset #16369 Wnayar
• docs: fix typos, grammar, and documentation links #16389 LakshyaTyagi15

9.7.4 / 2026-07-06

• types(create): fix handling of nested objects typed as interfaces #16363 #16362
• types: correct this parameter handling for methods with versionKey #16344 #16046
• docs: add FAQ entry for querySrv ECONNREFUSED errors on Windows with mongodb+srv:// connections #16342 ajay naik

9.7.3 / 2026-06-26

• types(model): correct Model.validate() return type to Promise #16340 #16338
• types: use @​standard-schema/spec for StandardSchema types rather than inlining #16341 #16339

9.7.2 / 2026-06-22

• fix(documentarray): reindex subdocs after array reordering and removal so subsequent nested changes save using the correct path #16282 AbdelrahmanHafez
• fix(document): avoid accessing special properties in Document.prototype.get()
• fix(schema): only return own properties in schematype lookups and disallow setting schema paths under special properties
• docs: update homepage sponsor layout

9.7.1 / 2026-06-17

• perf(document+model): improve save performance by avoiding unnecessary promise allocations and reducing path/default/dirty-state overhead #16331
• fix(schema): include ObjectId regex pattern in toJSONSchema() output #16335 #16334 AbdelrahmanHafez
• fix(populate): split populate into separate queries per document if the resulting $in filter has more than 50k elements to reduce risk of BSON size errors #16333 #5890
• docs: add assistant sidebar with MongoDB Knowledge integration #16311 #16283
• docs: update docs copy buttons, edit links, homepage alignment, and llms.txt generation #16326 #16327 #16329

... (truncated)

Changelog

Sourced from mongoose's changelog.

9.8.1 / 2026-07-27

• perf(document): avoid rebuilding modified paths during required path validation #16379 xianjianlf2
• perf(document): avoid clearing the required paths cache on every document instantiation #16404 #16377
• fix(query): reject update modifiers without paths #16387 AbdelrahmanHafez
• perf: cache toString() results in array.unique to avoid redundant allocations #16390 vivek180905
• types: respect the _id option when inferring StandardSchema types #16402
• types(model): keep Model.schema typed when TSchema is omitted samuelmbabhazi
• docs(guide): clarify strictQuery handling of filter paths not in the schema #16397 MuhammadFarhantahir

9.8.0 / 2026-07-20

• feat(schema): add strictRead option to filter or throw on unknown fields during document hydration #16345 #4279 GourabSingha
• feat: upgrade MongoDB Node.js driver to 7.5 #16391
• fix(subdocument): don't minimize empty document array elements to null #16393 #15336 #7322 WaleedAshraf
• fix(model): correctly handle version keys when bulkSave() inserts new documents #16386 #15800 AbdelrahmanHafez
• fix(cast): correctly cast object-shaped geo query values #16380 #16376 rajkumar0932
• fix(schema): avoid mutating shared setters when casting array query values #16372 #16364 yakubka
• fix(document): correctly handle excluded parent paths with optimistic concurrency #16367 #16054 AbdelrahmanHafez
• types(model): add pathsToSave to SaveOptions #16375 AbdelrahmanHafez
• types(model): support extra fields in hydrate() with strict: false #16374 #15940 AbdelrahmanHafez
• docs(populate): document missing options and perDocumentLimit for populate() #16371 Wnayar
• docs: expand sample() example to show sampling from a filtered subset #16369 Wnayar
• docs: fix typos, grammar, and documentation links #16389 LakshyaTyagi15

9.7.4 / 2026-07-06

• types(create): fix handling of nested objects typed as interfaces #16363 #16362
• types: correct this parameter handling for methods with versionKey #16344 #16046
• docs: add FAQ entry for querySrv ECONNREFUSED errors on Windows with mongodb+srv:// connections #16342 ajay naik

9.7.3 / 2026-06-26

• types(model): correct Model.validate() return type to Promise #16340 #16338
• types: use @​standard-schema/spec for StandardSchema types rather than inlining #16341 #16339

8.24.1 / 2026-06-22

• fix(documentarray): reindex subdocs after array reordering and removal so subsequent nested changes save using the correct path #16282 AbdelrahmanHafez
• fix(document): avoid accessing special properties in Document.prototype.get()
• fix(schema): avoid returning inherited properties from schema path lookups, including paths underneath maps of subdocuments
• fix(clone): isolate cloned arrays from source documents #16281 AbdelrahmanHafez
• types: enable exactOptionalPropertyTypes in TypeScript tests #16287

9.7.2 / 2026-06-22

• fix(documentarray): reindex subdocs after array reordering and removal so subsequent nested changes save using the correct path #16282 AbdelrahmanHafez
• fix(document): avoid accessing special properties in Document.prototype.get()
• fix(schema): only return own properties in schematype lookups and disallow setting schema paths under special properties
• docs: update homepage sponsor layout

... (truncated)

Commits

• ac79c2e chore: release 9.8.1
• 4efed2c Merge pull request #16406 from samuelmbabhazi/fix/modelSchema
• b915bd7 Merge pull request #16404 from Automattic/vkarpov15/gh-16377
• 14b750e Merge pull request #16403 from Automattic/vkarpov15/gh-16402
• 41e559d Merge pull request #16387 from AbdelrahmanHafez/fix/reject-pathless-update-mo...
• 1415de4 types(model): keep Model.schema typed when TSchema is omitted
• c0a75c2 Merge pull request #16390 from vivek180905/perf/cache-tostring-in-array-unique
• 7bdee0d perf(document): avoid clearing required paths cache on every document instant...
• 9947b06 test: expand test case to handle just _id: false
• a843b42 types: respect _id option when inferring StandardSchema type
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

---

Note

Low Risk
Optional dev transitive dependency for eval tooling; no production code paths, though mongoose 9.8 query/validation tweaks could affect promptfoo only if Mongo-backed features are enabled.

Overview
Updates evals/package-lock.json only (no package.json or app source changes). Mongoose moves 9.6.2 → 9.8.1 as an optional transitive dependency of promptfoo (e.g. natural’s optional Mongo support), pulling MongoDB driver ~7.2 → ~7.5, @standard-schema/spec, and minor bson / saslprep bumps.

The lockfile also reshuffles peer-related installs: top-level @anthropic-ai/sdk 0.115.0 (adds standardwebhooks), promptfoo keeps a nested @anthropic-ai/sdk 0.92.0, and many Express/MCP packages lose the "dev": true flag in the lock metadata without changing direct eval dependencies.

^{Reviewed by Cursor Bugbot for commit 1063764. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

Skill eval results

Skill	Before	After	Δ
agentcontrol/configs-create	100/100 (4/4)	0/100 (0/4)	-100
agentcontrol/configs-update	80/100 (4/5)	0/100 (0/5)	-80
agentcontrol/configs-variations	80/100 (4/5)	0/100 (0/5)	-80
agentcontrol/tools	75/100 (3/4)	0/100 (0/4)	-75
feature-flags/flag-and-release-change	-	0/100 (0/4)	new
feature-flags/flag-release	-	0/100 (0/5)	new
feature-flags/launchdarkly-flag-command	-	0/100 (0/3)	new
feature-flags/launchdarkly-flag-create	100/100 (3/3)	0/100 (0/4)	-100
feature-flags/should-flag-change	-	0/100 (0/10)	new

Only suites whose source actually changed since their last recorded score were re-run. Soft-failing while we stabilise the baseline.