update mongoose dependency

We're already running 3.8.12 in production, this change reflects this.