diff --git a/api/package.json b/api/package.json
index 52f276ed..93d2752e 100644
--- a/api/package.json
+++ b/api/package.json
@@ -17,7 +17,7 @@
     "json2xml": "^0.1.3",
     "jsonwebtoken": "^8.1.0",
     "moment": "^2.20.1",
-    "mongoose": "^4.12.5",
+    "mongoose": "^4.13.21",
     "morgan": "^1.8.2",
     "xml2json": "^0.11.0"
   },
diff --git a/api/yarn.lock b/api/yarn.lock
index 698784fd..b5db3a41 100644
--- a/api/yarn.lock
+++ b/api/yarn.lock
@@ -2322,9 +2322,9 @@ mongodb@2.2.34:
     mongodb-core "2.1.18"
     readable-stream "2.2.7"
 
-mongoose@^4.12.5:
-  version "4.13.14"
-  resolved "http://registry.npm.taobao.org/mongoose/download/mongoose-4.13.14.tgz#0eb6d4fc6a15c9834994ab4102da614421d1dff0"
+mongoose@^4.13.21:
+  version "4.13.21"
+  resolved "https://registry.yarnpkg.com/mongoose/-/mongoose-4.13.21.tgz#83f4a8461b19aca1b2274feaaaf262b71b6f034d"
   dependencies:
     async "2.6.0"
     bson "~1.0.4"
@@ -2332,7 +2332,7 @@ mongoose@^4.12.5:
     kareem "1.5.0"
     lodash.get "4.4.2"
     mongodb "2.2.34"
-    mpath "0.3.0"
+    mpath "0.5.1"
     mpromise "0.5.5"
     mquery "2.3.3"
     ms "2.0.0"
@@ -2350,9 +2350,9 @@ morgan@^1.8.2:
     on-finished "~2.3.0"
     on-headers "~1.0.1"
 
-mpath@0.3.0:
-  version "0.3.0"
-  resolved "http://registry.npm.taobao.org/mpath/download/mpath-0.3.0.tgz#7a58f789e9b5fd3c94520634157960f26bd5ef44"
+mpath@0.5.1:
+  version "0.5.1"
+  resolved "https://registry.yarnpkg.com/mpath/-/mpath-0.5.1.tgz#17131501f1ff9e6e4fbc8ffa875aa7065b5775ab"
 
 mpromise@0.5.5:
   version "0.5.5"