@depup/mongoose 9.4.1-depup.0 → 9.8.0-depup.0

package/lib/document.js

@@ -562,27 +562,26 @@ function $applyDefaultsToNested(val, path, doc) {
 Document.prototype.$__buildDoc = function(obj, fields, skipId, exclude, hasIncludedChildren) {
   const doc = {};
 
-  const paths = Object.keys(this.$__schema.paths).
-    // Don't build up any paths that are underneath a map, we don't know
-    // what the keys will be
-    filter(p => !p.includes('$*'));
+  const paths = Object.keys(this.$__schema.paths);
   const plen = paths.length;
   let ii = 0;
 
   for (; ii < plen; ++ii) {
     const p = paths[ii];
 
-    if (p === '_id') {
-      if (skipId) {
-        continue;
-      }
-      if (obj && '_id' in obj) {
-        continue;
-      }
+    // Don't build up any paths that are underneath a map, we don't know
+    // what the keys will be
+    if (p.includes('$*')) {
+      continue;
     }
 
     const path = this.$__schema.paths[p].splitPath();
     const len = path.length;
+    // This loop only creates intermediate objects for nested paths: it never
+    // sets any leaf values, so single-segment paths are no-ops.
+    if (len === 1) {
+      continue;
+    }
     const last = len - 1;
     let curPath = '';
     let doc_ = doc;
@@ -757,6 +756,7 @@ function init(self, obj, doc, opts, prefix) {
   let i;
   const strict = self.$__.strictMode;
   const docSchema = self.$__schema;
+  const strictRead = docSchema.options.strictRead;
 
   for (let index = 0; index < len; ++index) {
     i = keys[index];
@@ -774,6 +774,14 @@ function init(self, obj, doc, opts, prefix) {
     }
 
     const value = obj[i];
+    if (!schemaType && strictRead && docSchema.pathType(path) === 'adhocOrUndefined') {
+      if (strictRead === 'throw') {
+        throw new StrictModeError(path, 'Field `' + path + '` is not in schema and strictRead is set to throw.');
+      } else if (strictRead === true) {
+        continue;
+      }
+    }
+
     if (!schemaType && utils.isPOJO(value)) {
       // assume nested object
       if (!doc[i]) {
@@ -786,6 +794,13 @@ function init(self, obj, doc, opts, prefix) {
       }
       init(self, value, doc[i], opts, path + '.');
     } else if (!schemaType) {
+      // Handle strictRead: filter unknown fields during document hydration from DB
+      if (strictRead === 'throw') {
+        throw new StrictModeError(path, 'Field `' + path + '` is not in schema and strictRead is set to throw.');
+      } else if (strictRead === true) {
+        // Skip this field - do not store in _doc
+        continue;
+      }
       doc[i] = value;
       if (!strict && !prefix) {
         self[i] = value;
@@ -1133,7 +1148,11 @@ Document.prototype.$set = function $set(path, val, type, options) {
       return this;
     }
 
-    options = Object.assign({}, options, { _skipMinimizeTopLevel: false });
+    // Only need to clone if we're overwriting `_skipMinimizeTopLevel`, recursive
+    // calls treat a missing `_skipMinimizeTopLevel` as `false`
+    if (_skipMinimizeTopLevel) {
+      options = Object.assign({}, options, { _skipMinimizeTopLevel: false });
+    }
 
     for (let i = 0; i < len; ++i) {
       key = keys[i];
@@ -1220,15 +1239,9 @@ Document.prototype.$set = function $set(path, val, type, options) {
   val = handleSpreadDoc(val, true);
 
   // if this doc is being constructed we should not trigger getters
-  const priorVal = (() => {
-    if (this.$__.priorDoc != null) {
-      return this.$__.priorDoc.$__getValue(path);
-    }
-    if (constructing) {
-      return void 0;
-    }
-    return this.$__getValue(path);
-  })();
+  const priorVal = this.$__.priorDoc != null ?
+    this.$__.priorDoc.$__getValue(path) :
+    (constructing ? void 0 : this.$__getValue(path));
 
   if (pathType === 'nested' && val) {
     if (typeof val === 'object' && val != null) {
@@ -1410,13 +1423,10 @@ Document.prototype.$set = function $set(path, val, type, options) {
   try {
     // If the user is trying to set a ref path to a document with
     // the correct model name, treat it as populated
-    const refMatches = (() => {
+    const refMatches = !(val instanceof Document) ? false : (() => {
       if (schema.options == null) {
         return false;
       }
-      if (!(val instanceof Document)) {
-        return false;
-      }
       const model = val.constructor;
 
       // Check ref
@@ -1954,7 +1964,9 @@ Document.prototype.get = function(path, type, options) {
 
   // Fast path if we know we're just accessing top-level path on the document:
   // just get the schema path, avoid `$__path()` because that does string manipulation
-  let schema = noDottedPath ? this.$__schema.paths[path] : this.$__path(path);
+  let schema = noDottedPath ?
+    Object.hasOwn(this.$__schema.paths, path) ? this.$__schema.paths[path] : undefined :
+    this.$__path(path);
   if (schema == null) {
     schema = this.$__schema.virtualpath(path);
 
@@ -1964,7 +1976,7 @@ Document.prototype.get = function(path, type, options) {
   }
 
   if (noDottedPath) {
-    let obj = this._doc[path];
+    let obj = Object.hasOwn(this._doc, path) ? this._doc[path] : undefined;
     if (adhoc) {
       obj = adhoc.cast(obj);
     }
@@ -1991,6 +2003,10 @@ Document.prototype.get = function(path, type, options) {
   }
 
   for (let i = 0, l = pieces.length; i < l; i++) {
+    if (specialProperties.has(pieces[i])) {
+      return undefined;
+    }
+
     if (obj?._doc) {
       obj = obj._doc;
     }
@@ -2012,7 +2028,7 @@ Document.prototype.get = function(path, type, options) {
 
   if (schema != null && options.getters !== false) {
     obj = schema.applyGetters(obj, this);
-  } else if (this.$__schema.nested[path] && options.virtuals) {
+  } else if (Object.hasOwn(this.$__schema.nested, path) && options.virtuals) {
     // Might need to apply virtuals if this is a nested path
     return applyVirtuals(this, clone(obj) || {}, { path: path });
   }
@@ -2870,7 +2886,8 @@ Document.prototype.validate = async function validate(pathsToValidate, options)
 
     await this._execDocumentPostHooks('validate', options, error);
   } finally {
-    delete this.$__.validateModifiedOnly;
+    // Assign rather than `delete` to avoid putting `$__` in dictionary mode
+    this.$__.validateModifiedOnly = undefined;
     this.$op = null;
     this.$__.validating = null;
   }
@@ -2913,7 +2930,7 @@ function _completeValidate(doc) {
     }
   }
 
-  doc.$__.cachedRequired = {};
+  doc.$__.cachedRequired = null;
   doc.$emit('validate', doc);
   doc.constructor.emit('validate', doc);
 
@@ -3204,7 +3221,7 @@ function _pushNestedArrayPaths(val, paths, path) {
  * ignore
  */
 
-Document.prototype._execDocumentPreHooks = async function _execDocumentPreHooks(opName, options, argsForHooks) {
+Document.prototype._execDocumentPreHooks = function _execDocumentPreHooks(opName, options, argsForHooks) {
   const filter = buildMiddlewareFilter(options, 'pre');
   return this.$__middleware.execPre(opName, this, argsForHooks || [], { filter });
 };
@@ -3213,7 +3230,7 @@ Document.prototype._execDocumentPreHooks = async function _execDocumentPreHooks(
  * ignore
  */
 
-Document.prototype._execDocumentPostHooks = async function _execDocumentPostHooks(opName, options, error) {
+Document.prototype._execDocumentPostHooks = function _execDocumentPostHooks(opName, options, error) {
   const filter = buildMiddlewareFilter(options, 'post');
   return this.$__middleware.execPost(opName, this, [this], { error, filter });
 };
@@ -3264,6 +3281,9 @@ function _handlePathsToSkip(paths, pathsToSkip) {
 /**
  * Executes registered validation rules (skipping asynchronous validators) for this document.
  *
+ * **Deprecated.** Use [`validate()`](https://mongoosejs.com/docs/api/document.html#Document.prototype.validate()) instead.
+ * `validateSync()` does not run validation middleware and will be removed in Mongoose 10.
+ *
  * #### Note:
  *
  * This method is useful if you need synchronous validation.
@@ -3281,14 +3301,21 @@ function _handlePathsToSkip(paths, pathsToSkip) {
  * @param {object} [options] options for validation
  * @param {boolean} [options.validateModifiedOnly=false] If `true`, Mongoose will only validate modified paths, as opposed to modified paths and `required` paths.
  * @param {Array|string} [options.pathsToSkip] list of paths to skip. If set, Mongoose will validate every modified path that is not in this list.
- * @param {boolean|object} [options.middleware=true] set to `false` to skip all user-defined middleware
- * @param {boolean} [options.middleware.pre=true] set to `false` to skip only pre hooks
- * @param {boolean} [options.middleware.post=true] set to `false` to skip only post hooks
  * @return {ValidationError|undefined} ValidationError if there are errors during validation, or undefined if there is no error.
+ * @deprecated Use `validate()` instead. `validateSync()` does not run middleware and will be removed in Mongoose 10.
  * @api public
  */
 
-Document.prototype.validateSync = function(pathsToValidate, options) {
+Document.prototype.validateSync = function() {
+  utils.warn('Mongoose: `Document.prototype.validateSync()` is deprecated and will be removed in Mongoose 10. Use `Document.prototype.validate()` instead.');
+  return this.$__validateSync.apply(this, arguments);
+};
+
+/*!
+ * ignore
+ */
+
+Document.prototype.$__validateSync = function(pathsToValidate, options) {
   const _this = this;
 
   if (arguments.length === 1 && typeof arguments[0] === 'object' && !Array.isArray(arguments[0])) {
@@ -3556,6 +3583,10 @@ function _checkImmutableSubpaths(subdoc, schematype, priorVal) {
  * @param {number} [options.wtimeout] sets a [timeout for the write concern](https://www.mongodb.com/docs/manual/reference/write-concern/#wtimeout). Overrides the [schema-level `writeConcern` option](https://mongoosejs.com/docs/guide.html#writeConcern).
  * @param {boolean} [options.checkKeys=true] the MongoDB driver prevents you from saving keys that start with '$' or contain '.' by default. Set this option to `false` to skip that check. See [restrictions on field names](https://www.mongodb.com/docs/manual/reference/limits/#Restrictions-on-Field-Names)
  * @param {boolean} [options.timestamps=true] if `false` and [timestamps](https://mongoosejs.com/docs/guide.html#timestamps) are enabled, skip timestamps for this `save()`.
+ * @param {Array} [options.pathsToSave] An array of paths that tell mongoose to only validate and save the paths in `pathsToSave`.
+ * @param {boolean|object} [options.middleware=true] set to `false` to skip all user-defined middleware
+ * @param {boolean} [options.middleware.pre=true] set to `false` to skip only pre hooks
+ * @param {boolean} [options.middleware.post=true] set to `false` to skip only post hooks
  * @method save
  * @memberOf Document
  * @instance
@@ -3620,7 +3651,11 @@ Document.prototype.$__reset = function reset() {
   // Clear atomics on dirty paths. Walk the modified and default paths
   // directly instead of calling $__dirty(), which builds intermediate
   // arrays, a Map, and does parent-path deduplication we don't need here.
-  this.$__resetAtomics();
+  // Skip entirely if the doc only has primitive values, because only arrays
+  // and maps have atomics.
+  if (!onlyPrimitiveValues) {
+    this.$__resetAtomics();
+  }
 
   this.$__.backup = {};
   this.$__.backup.activePaths = {
@@ -3750,15 +3785,17 @@ Document.prototype.$__dirty = function() {
     }
 
     let top = null;
+    let foundParent = false;
 
     const array = parentPaths(item.path);
     for (let i = 0; i < array.length - 1; i++) {
       if (allPaths.has(array[i])) {
         top = allPaths.get(array[i]);
+        foundParent = true;
         break;
       }
     }
-    if (top == null) {
+    if (!foundParent) {
       minimal.push(item);
     } else if (top != null &&
         top[arrayAtomicsSymbol] != null &&
@@ -4701,6 +4738,9 @@ Document.prototype.equals = function(doc) {
  * @param {boolean} [options.getters=false] if true, Mongoose will call any getters defined on the `localField`. By default, Mongoose gets the raw value of `localField`. For example, you would need to set this option to `true` if you wanted to [add a `lowercase` getter to your `localField`](https://mongoosejs.com/docs/schematypes.html#schematype-options).
  * @param {boolean} [options.clone=false] When you do `BlogPost.find().populate('author')`, blog posts with the same author will share 1 copy of an `author` doc. Enable this option to make Mongoose clone populated docs before assigning them.
  * @param {object|Function} [options.match=null] Add an additional filter to the populate query. Can be a filter object containing [MongoDB query syntax](https://www.mongodb.com/docs/manual/tutorial/query-documents/), or a function that returns a filter object.
+ * @param {boolean} [options.skipInvalidIds=false] By default, Mongoose throws a cast error if `localField` and `foreignField` schemas don't line up. If you enable this option, Mongoose will instead filter out any `localField` properties that cannot be casted to `foreignField`'s schema type.
+ * @param {number} [options.perDocumentLimit=null] For legacy reasons, `limit` with `populate()` may give incorrect results when populating multiple parent documents because it executes a single query for all parents. If you set `perDocumentLimit`, Mongoose will execute a separate query per parent document to ensure correct per-document `limit`.
+ * @param {boolean} [options.strictPopulate=true] Set to false to allow populating paths that aren't defined in the given model's schema.
  * @param {Function} [options.transform=null] Function that Mongoose will call on every populated document that allows you to transform the populated document.
  * @param {object} [options.options=null] Additional options like `limit` and `lean`.
  * @param {boolean} [options.forceRepopulate=true] Set to `false` to prevent Mongoose from repopulating paths that are already populated
@@ -5112,20 +5152,26 @@ Document.prototype.$__delta = function $__delta(pathsToSave, pathsToSaveSet) {
   const optimisticConcurrency = this.$__schema.options.optimisticConcurrency;
   if (optimisticConcurrency) {
     if (Array.isArray(optimisticConcurrency)) {
-      const optCon = new Set(optimisticConcurrency);
-      const modPaths = this.modifiedPaths();
+      if (!this.$__schema.options._optimisticConcurrencySet) {
+        this.$__schema.options._optimisticConcurrencySet = new Set(optimisticConcurrency);
+      }
+      const optimisticConcurrencySet = this.$__schema.options._optimisticConcurrencySet;
+      const modPaths = this.directModifiedPaths();
       const hasRelevantModPaths = pathsToSave == null ?
-        modPaths.find(path => optCon.has(path)) :
-        modPaths.find(path => optCon.has(path) && isInPathsToSave(path, pathsToSaveSet, pathsToSave));
+        modPaths.find(path => _pathOverlapsSet(path, optimisticConcurrencySet)) :
+        modPaths.find(path => _pathOverlapsSet(path, optimisticConcurrencySet) && isInPathsToSave(path, pathsToSaveSet, pathsToSave));
       if (hasRelevantModPaths) {
         this.$__.version = dirty.length ? VERSION_ALL : VERSION_WHERE;
       }
     } else if (Array.isArray(optimisticConcurrency?.exclude)) {
-      const excluded = new Set(optimisticConcurrency.exclude);
-      const modPaths = this.modifiedPaths();
+      if (!this.$__schema.options._optimisticConcurrencyExcludeSet) {
+        this.$__schema.options._optimisticConcurrencyExcludeSet = new Set(optimisticConcurrency.exclude);
+      }
+      const optimisticConcurrencyExcludeSet = this.$__schema.options._optimisticConcurrencyExcludeSet;
+      const modPaths = this.directModifiedPaths();
       const hasRelevantModPaths = pathsToSave == null ?
-        modPaths.find(path => !excluded.has(path)) :
-        modPaths.find(path => !excluded.has(path) && isInPathsToSave(path, pathsToSaveSet, pathsToSave));
+        modPaths.find(path => !_pathOrAncestorInSet(path, optimisticConcurrencyExcludeSet)) :
+        modPaths.find(path => !_pathOrAncestorInSet(path, optimisticConcurrencyExcludeSet) && isInPathsToSave(path, pathsToSaveSet, pathsToSave));
       if (hasRelevantModPaths) {
         this.$__.version = dirty.length ? VERSION_ALL : VERSION_WHERE;
       }
@@ -5258,6 +5304,12 @@ function checkDivergentArray(doc, path, array) {
     // If any array was selected using an $elemMatch projection, we deny the update.
     // NOTE: MongoDB only supports projected $elemMatch on top level array.
     const top = path.split('.')[0];
+    if (doc.$__.selected[top] && doc.$__.selected[top].$slice != null && utils.isMongooseArray(array)) {
+      const atomics = array[arrayAtomicsSymbol];
+      if (atomics.$set) {
+        return top;
+      }
+    }
     if (doc.$__.selected[top + '.$']) {
       return top;
     }
@@ -5633,24 +5685,47 @@ Document.prototype._applyVersionIncrement = function _applyVersionIncrement() {
 };
 
 /*!
- * Increment this document's version if necessary.
+ * Module exports.
  */
 
-Document.prototype._applyVersionIncrement = function _applyVersionIncrement() {
-  if (!this.$__.version) return;
-  const doIncrement = VERSION_INC === (VERSION_INC & this.$__.version);
-
-  this.$__.version = undefined;
-  if (doIncrement) {
-    const key = this.$__schema.options.versionKey;
-    const version = this.$__getValue(key) || 0;
-    this.$__setValue(key, version + 1); // increment version if was successful
+/*!
+ * Check if `path` or any of its ancestor paths exist in `pathSet`.
+ * For example:
+ *   _pathOrAncestorInSet('profile.firstName', Set(['profile'])) === true
+ *   _pathOrAncestorInSet('profile', Set(['profile.firstName'])) === false
+ */
+function _pathOrAncestorInSet(path, pathSet) {
+  if (pathSet.has(path)) {
+    return true;
   }
-};
+  let idx = path.indexOf('.');
+  while (idx !== -1) {
+    if (pathSet.has(path.substring(0, idx))) {
+      return true;
+    }
+    idx = path.indexOf('.', idx + 1);
+  }
+  return false;
+}
 
 /*!
- * Module exports.
+ * Check if `path`, any of its ancestor paths, or any of its descendant paths
+ * exist in `pathSet`.
+ * For example:
+ *   _pathOverlapsSet('profile.firstName', Set(['profile'])) === true
+ *   _pathOverlapsSet('profile', Set(['profile.firstName'])) === true
  */
+function _pathOverlapsSet(path, pathSet) {
+  if (_pathOrAncestorInSet(path, pathSet)) {
+    return true;
+  }
+  for (const p of pathSet) {
+    if (p.length > path.length + 1 && p[path.length] === '.' && p.slice(0, path.length) === path) {
+      return true;
+    }
+  }
+  return false;
+}
 
 Document.VERSION_WHERE = VERSION_WHERE;
 Document.VERSION_INC = VERSION_INC;

package/lib/drivers/node-mongodb-native/collection.js

@@ -172,7 +172,8 @@ function iter(i) {
       } else {
         const color = debug.color == null ? true : debug.color;
         const shell = debug.shell == null ? false : debug.shell;
-        this.$print(_this.name, i, args, color, shell);
+        const timestamp = debug.timestamp == null ? false : debug.timestamp;
+        this.$print(_this.name, i, args, color, shell, timestamp);
       }
     }
 
@@ -256,7 +257,12 @@ for (const key of Object.getOwnPropertyNames(Collection.prototype)) {
  * @method $print
  */
 
-NativeCollection.prototype.$print = function(name, i, args, color, shell) {
+NativeCollection.prototype.$print = function(name, i, args, color, shell, timestamp) {
+  let prefix = '';
+  if (timestamp) {
+    const ts = new Date().toISOString();
+    prefix = color ? `\x1B[0;90m[${ts}]\x1B[0m ` : `[${ts}] `;
+  }
   const moduleName = color ? '\x1B[0;36mMongoose:\x1B[0m ' : 'Mongoose: ';
   const functionCall = [name, i].join('.');
   const _args = [];
@@ -267,14 +273,14 @@ NativeCollection.prototype.$print = function(name, i, args, color, shell) {
   }
   const params = '(' + _args.join(', ') + ')';
 
-  console.info(moduleName + functionCall + params);
+  console.info(prefix + moduleName + functionCall + params);
 };
 
 /**
  * Debug print helper
  *
  * @api public
- * @method $print
+ * @method $printToStream
  */
 
 NativeCollection.prototype.$printToStream = function(name, i, args, stream) {

package/lib/error/cast.js

@@ -42,6 +42,7 @@ class CastError extends MongooseError {
       message: this.message
     };
   }
+
   /*!
    * ignore
    */
@@ -76,7 +77,7 @@ class CastError extends MongooseError {
    */
   setModel(model) {
     this.message = formatMessage(model, this.kind, this.value, this.path,
-      this.messageFormat, this.valueType);
+      this.messageFormat, this.valueType, this.reason);
   }
 }
 
@@ -122,10 +123,11 @@ function getMessageFormat(schemaType) {
 function formatMessage(model, kind, value, path, messageFormat, valueType, reason) {
   if (typeof messageFormat === 'string') {
     const stringValue = getStringValue(value);
-    let ret = messageFormat.
-      replace('{KIND}', kind).
-      replace('{VALUE}', stringValue).
-      replace('{PATH}', path);
+    let ret = messageFormat
+      .replace('{KIND}', kind)
+      .replace('{VALUE}', stringValue)
+      .replace('{PATH}', path);
+
     if (model != null) {
       ret = ret.replace('{MODEL}', model.modelName);
     }
@@ -136,17 +138,24 @@ function formatMessage(model, kind, value, path, messageFormat, valueType, reaso
   } else {
     const stringValue = getStringValue(value);
     const valueTypeMsg = valueType ? ' (type ' + valueType + ')' : '';
+
     let ret = 'Cast to ' + kind + ' failed for value ' +
       stringValue + valueTypeMsg + ' at path "' + path + '"';
+
     if (model != null) {
       ret += ' for model "' + model.modelName + '"';
     }
-    if (reason != null &&
-        typeof reason.constructor === 'function' &&
-        reason.constructor.name !== 'AssertionError' &&
-        reason.constructor.name !== 'Error') {
+
+    if (
+      reason != null &&
+      typeof reason.constructor === 'function' &&
+      reason.constructor.name !== 'AssertionError' &&
+      reason.constructor.name !== 'Error' &&
+      reason.constructor.name !== 'BSONError'
+    ) {
       ret += ' because of "' + reason.constructor.name + '"';
     }
+
     return ret;
   }
 }

package/lib/error/divergentArray.js

@@ -17,7 +17,7 @@ class DivergentArrayError extends MongooseError {
 
   constructor(paths) {
     const msg = 'For your own good, using `document.save()` to update an array '
-            + 'which was selected using an $elemMatch projection OR '
+            + 'which was selected using an $elemMatch or $slice projection OR '
             + 'populated using skip, limit, query conditions, or exclusion of '
             + 'the _id field when the operation results in a $pop or $set of '
             + 'the entire array is not supported. The following '

package/lib/error/messages.js

@@ -30,6 +30,7 @@ msg.DocumentNotFoundError = null;
 msg.general = {};
 msg.general.default = 'Validator failed for path `{PATH}` with value `{VALUE}`';
 msg.general.required = 'Path `{PATH}` is required.';
+msg.general.allowNull = 'Path `{PATH}` does not allow null values.';
 
 msg.Number = {};
 msg.Number.min = 'Path `{PATH}` ({VALUE}) is less than minimum allowed value ({MIN}).';

package/lib/helpers/clone.js

@@ -202,10 +202,15 @@ function cloneArray(arr, options) {
 
   let ret = null;
   if (options?.retainDocuments) {
+    // Use the cloned parent doc (options.parentDoc) when available so the new
+    // array is wired up to the clone, not the source. Falling back to the
+    // source's parent preserves the previous behavior for callers that don't
+    // pass parentDoc.
+    const newParent = options.parentDoc ?? (arr.isMongooseArray ? arr.$parent() : undefined);
     if (arr.isMongooseDocumentArray) {
-      ret = new (arr.$schemaType().schema.base.Types.DocumentArray)([], arr.$path(), arr.$parent(), arr.$schemaType());
+      ret = new (arr.$schemaType().schema.base.Types.DocumentArray)([], arr.$path(), newParent, arr.$schemaType());
     } else if (arr.isMongooseArray) {
-      ret = new (arr.$parent().schema.base.Types.Array)([], arr.$path(), arr.$parent(), arr.$schemaType());
+      ret = new (arr.$parent().schema.base.Types.Array)([], arr.$path(), newParent, arr.$schemaType());
     } else {
       ret = new Array(len);
     }
@@ -218,9 +223,21 @@ function cloneArray(arr, options) {
     // Create new options object to avoid mutating the shared options.
     // Subdocs need parentArray to point to their own cloned array.
     options = { ...options, parentArray: ret };
-  }
-  for (i = 0; i < len; ++i) {
-    ret[i] = clone(arr[i], options, true);
+    // Skip change-tracking while populating the freshly cloned array: every
+    // index assignment would otherwise call markModified on the cloned parent
+    // doc and (before this guard) on the source parent doc.
+    for (i = 0; i < len; ++i) {
+      const doc = clone(arr[i], options, true);
+      // Document arrays can contain null entries, so only restamp actual subdocs.
+      if (typeof doc?.$setIndex === 'function') {
+        doc.$setIndex(i);
+      }
+      ret.set(i, doc, true);
+    }
+  } else {
+    for (i = 0; i < len; ++i) {
+      ret[i] = clone(arr[i], options, true);
+    }
   }
 
   return ret;

package/lib/helpers/document/applyDefaults.js

@@ -17,6 +17,11 @@ module.exports = function applyDefaults(doc, fields, exclude, hasIncludedChildre
     }
 
     const type = doc.$__schema.paths[p];
+    // `getDefault()` returns undefined when `defaultValue` is undefined, in which
+    // case this loop never modifies the doc, so skip traversing the path entirely.
+    if (type.defaultValue === undefined) {
+      continue;
+    }
     const path = type.splitPath();
     const len = path.length;
     if (path[len - 1] === '$*') {

package/lib/helpers/populate/createPopulateQueryFilter.js

@@ -25,7 +25,15 @@ module.exports = function createPopulateQueryFilter(ids, _match, _foreignField,
     for (let i = 0; i < _parentPaths.length - 1; ++i) {
       const cur = _parentPaths[i];
       if (match[cur] != null && match[cur].$elemMatch != null) {
-        match[cur].$elemMatch[foreignField.slice(cur.length + 1)] = trusted({ $in: ids });
+        // Copy rather than mutate so the user's `match` stays unchanged and split populate
+        // queries (gh-5890) each get their own `$in` rather than sharing one object
+        match[cur] = {
+          ...match[cur],
+          $elemMatch: {
+            ...match[cur].$elemMatch,
+            [foreignField.slice(cur.length + 1)]: trusted({ $in: ids })
+          }
+        };
         delete match[foreignField];
         break;
       }

package/lib/helpers/populate/getModelsMapForPopulate.js

@@ -649,11 +649,7 @@ function addModelNamesToMap(model, map, available, modelNames, options, data, re
       ids = matchIdsToRefPaths(ret, modelNamesForRefPath, modelName);
     }
 
-    const perDocumentLimit = options.perDocumentLimit == null ?
-      get(options, 'options.perDocumentLimit', null) :
-      options.perDocumentLimit;
-
-    if (!available[modelName] || perDocumentLimit != null) {
+    if (!available[modelName]) {
       const currentOptions = {
         model: Model
       };
@@ -682,6 +678,7 @@ function addModelNamesToMap(model, map, available, modelNames, options, data, re
         isVirtual: data.isVirtual,
         virtual: data.virtual,
         count: data.count,
+        isRefPath: !!data.isRefPath,
         [populateModelSymbol]: Model
       };
       map.push(available[modelName]);
@@ -692,6 +689,7 @@ function addModelNamesToMap(model, map, available, modelNames, options, data, re
       available[modelName].ids.push(ids);
       available[modelName].allIds.push(ret);
       available[modelName].unpopulatedValues.push(unpopulatedValue);
+      available[modelName].isRefPath = available[modelName].isRefPath || !!data.isRefPath;
       if (data.hasMatchFunction) {
         available[modelName].match.push(data.match);
       }
@@ -873,7 +871,11 @@ function _findRefPathForDiscriminators(doc, modelSchema, data, options, normaliz
 }
 
 /**
- * Throw an error if there are any $where keys
+ * Throw an error if there are any $where keys to defend against [CVE-2024-53900](https://nvd.nist.gov/vuln/detail/CVE-2024-53900)
+ *
+ * Note that this is ONLY for $where because sift executes $where in Node.js memory.
+ * Other forms of MongoDB server-side execution, like $expr, are NOT filtered out.
+ * This function is not meant to protect against server-side execution in MongoDB.
  */
 
 function throwOn$where(match) {