update vulnerable library mongoose