Regular Expression Denial of Service (ReDoS) of ms package < 2.0.0

[JasonBoy]

Due to an incomplete fix for previously reported vulnerability npm:ms:20151024, the new npm:ms:20170412 was reported.
Any chance to update? or update the ms package is a major change?

[clozanosanchez]

Mongoose should update ms to v2.0.0, but mquery (another mongoose dependency) is also affected by this problem (I think they are working on to release a new version soon).

[vkarpov15]

I pushed a fix which upgrades to the latest version of mquery, which in turn bumps its dependency on debug. Mongoose's exposure to this issue is minimal:

• Mongoose doesn't use debug directly, but mquery uses it to print some query debug info
• Mongoose uses ms directly for parsing arguments to schema-declared TTL indexes, and the overhead of building an index on production data is likely more than 0.3 seconds

Still, better safe than sorry. Gonna push a new release 👍