mongoose 8.7.1 → 8.7.3

package/lib/cursor/aggregationCursor.js

@@ -196,6 +196,37 @@ AggregationCursor.prototype.close = async function close() {
   this.emit('close');
 };
 
+/**
+ * Marks this cursor as destroyed. Will stop streaming and subsequent calls to
+ * `next()` will error.
+ *
+ * @return {this}
+ * @api private
+ * @method _destroy
+ */
+
+AggregationCursor.prototype._destroy = function _destroy(_err, callback) {
+  let waitForCursor = null;
+  if (!this.cursor) {
+    waitForCursor = new Promise((resolve) => {
+      this.once('cursor', resolve);
+    });
+  } else {
+    waitForCursor = Promise.resolve();
+  }
+
+  waitForCursor
+    .then(() => this.cursor.close())
+    .then(() => {
+      this._closed = true;
+      callback();
+    })
+    .catch(error => {
+      callback(error);
+    });
+  return this;
+};
+
 /**
  * Get the next document from this cursor. Will return `null` when there are
  * no documents left.

package/lib/cursor/queryCursor.js

@@ -238,6 +238,39 @@ QueryCursor.prototype.close = async function close() {
   }
 };
 
+/**
+ * Marks this cursor as destroyed. Will stop streaming and subsequent calls to
+ * `next()` will error.
+ *
+ * @return {this}
+ * @api private
+ * @method _destroy
+ */
+
+QueryCursor.prototype._destroy = function _destroy(_err, callback) {
+  let waitForCursor = null;
+  if (!this.cursor) {
+    waitForCursor = new Promise((resolve) => {
+      this.once('cursor', resolve);
+    });
+  } else {
+    waitForCursor = Promise.resolve();
+  }
+
+  waitForCursor
+    .then(() => {
+      this.cursor.close();
+    })
+    .then(() => {
+      this._closed = true;
+      callback();
+    })
+    .catch(error => {
+      callback(error);
+    });
+  return this;
+};
+
 /**
  * Rewind this cursor to its uninitialized state. Any options that are present on the cursor will
  * remain in effect. Iterating this cursor will cause new queries to be sent to the server, even

package/lib/helpers/document/cleanModifiedSubpaths.js

@@ -25,11 +25,21 @@ module.exports = function cleanModifiedSubpaths(doc, path, options) {
       ++deleted;
 
       if (doc.$isSubdocument) {
-        const owner = doc.ownerDocument();
-        const fullPath = doc.$__fullPath(modifiedPath);
-        owner.$__.activePaths.clearPath(fullPath);
+        cleanParent(doc, modifiedPath);
       }
     }
   }
   return deleted;
 };
+
+function cleanParent(doc, path, seen = new Set()) {
+  if (seen.has(doc)) {
+    throw new Error('Infinite subdocument loop: subdoc with _id ' + doc._id + ' is a parent of itself');
+  }
+  const parent = doc.$parent();
+  const newPath = doc.$__pathRelativeToParent(void 0, false) + '.' + path;
+  parent.$__.activePaths.clearPath(newPath);
+  if (parent.$isSubdocument) {
+    cleanParent(parent, newPath, seen);
+  }
+}

package/lib/helpers/populate/getModelsMapForPopulate.js

@@ -478,9 +478,10 @@ function addModelNamesToMap(model, map, available, modelNames, options, data, re
     return;
   }
 
-  let k = modelNames.length;
+  const flatModelNames = utils.array.flatten(modelNames);
+  let k = flatModelNames.length;
   while (k--) {
-    let modelName = modelNames[k];
+    let modelName = flatModelNames[k];
     if (modelName == null) {
       continue;
     }
@@ -503,11 +504,10 @@ function addModelNamesToMap(model, map, available, modelNames, options, data, re
     }
 
     let ids = ret;
-    const flat = Array.isArray(ret) ? utils.array.flatten(ret) : [];
 
     const modelNamesForRefPath = data.modelNamesInOrder ? data.modelNamesInOrder : modelNames;
-    if (data.isRefPath && Array.isArray(ret) && flat.length === modelNamesForRefPath.length) {
-      ids = flat.filter((val, i) => modelNamesForRefPath[i] === modelName);
+    if (data.isRefPath && Array.isArray(ret) && ret.length === modelNamesForRefPath.length) {
+      ids = matchIdsToRefPaths(ret, modelNamesForRefPath, modelName);
     }
 
     const perDocumentLimit = options.perDocumentLimit == null ?
@@ -569,6 +569,20 @@ function _getModelFromConn(conn, modelName) {
   return conn.model(modelName);
 }
 
+function matchIdsToRefPaths(ids, refPaths, refPathToFind) {
+  if (!Array.isArray(refPaths)) {
+    return refPaths === refPathToFind
+      ? Array.isArray(ids)
+        ? utils.array.flatten(ids)
+        : [ids]
+      : [];
+  }
+  if (Array.isArray(ids) && Array.isArray(refPaths)) {
+    return ids.flatMap((id, index) => matchIdsToRefPaths(id, refPaths[index], refPathToFind));
+  }
+  return [];
+}
+
 /*!
  * ignore
  */

package/lib/helpers/populate/modelNamesFromRefPath.js

@@ -62,7 +62,5 @@ module.exports = function modelNamesFromRefPath(refPath, doc, populatedPath, mod
     modelNames = Array.isArray(refValue) ? refValue : [refValue];
   }
 
-  modelNames = utils.array.flatten(modelNames);
-
   return modelNames;
 };

package/lib/model.js

@@ -3771,7 +3771,7 @@ Model.hydrate = function(obj, projection, options) {
  *     const res = await Person.updateMany({ name: /Stark$/ }, { isDeleted: true });
  *     res.matchedCount; // Number of documents matched
  *     res.modifiedCount; // Number of documents modified
- *     res.acknowledged; // Boolean indicating everything went smoothly.
+ *     res.acknowledged; // Boolean indicating the MongoDB server received the operation. This may be false if Mongoose did not send an update to the server because the update was empty.
  *     res.upsertedId; // null or an id containing a document that had to be upserted.
  *     res.upsertedCount; // Number indicating how many documents had to be upserted. Will either be 0 or 1.
  *
@@ -3811,7 +3811,7 @@ Model.updateMany = function updateMany(conditions, doc, options) {
  *     const res = await Person.updateOne({ name: 'Jean-Luc Picard' }, { ship: 'USS Enterprise' });
  *     res.matchedCount; // Number of documents matched
  *     res.modifiedCount; // Number of documents modified
- *     res.acknowledged; // Boolean indicating everything went smoothly.
+ *     res.acknowledged; // Boolean indicating the MongoDB server received the operation. This may be false if Mongoose did not send an update to the server because the update was empty.
  *     res.upsertedId; // null or an id containing a document that had to be upserted.
  *     res.upsertedCount; // Number indicating how many documents had to be upserted. Will either be 0 or 1.
  *
@@ -3849,7 +3849,7 @@ Model.updateOne = function updateOne(conditions, doc, options) {
  *     const res = await Person.replaceOne({ _id: 24601 }, { name: 'Jean Valjean' });
  *     res.matchedCount; // Number of documents matched
  *     res.modifiedCount; // Number of documents modified
- *     res.acknowledged; // Boolean indicating everything went smoothly.
+ *     res.acknowledged; // Boolean indicating the MongoDB server received the operation.
  *     res.upsertedId; // null or an id containing a document that had to be upserted.
  *     res.upsertedCount; // Number indicating how many documents had to be upserted. Will either be 0 or 1.
  *

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "mongoose",
   "description": "Mongoose MongoDB ODM",
-  "version": "8.7.1",
+  "version": "8.7.3",
   "author": "Guillermo Rauch <guillermo@learnboost.com>",
   "keywords": [
     "mongodb",
@@ -92,7 +92,7 @@
     "lint": "eslint .",
     "lint-js": "eslint . --ext .js --ext .cjs",
     "lint-ts": "eslint . --ext .ts",
-    "lint-md": "markdownlint-cli2 \"**/*.md\"",
+    "lint-md": "markdownlint-cli2 \"**/*.md\" \"#node_modules\" \"#benchmarks\"",
     "build-browser": "(rm ./dist/* || true) && node ./scripts/build-browser.js",
     "prepublishOnly": "npm run build-browser",
     "release": "git pull && git push origin master --tags && npm publish",

package/types/connection.d.ts

@@ -50,6 +50,12 @@ declare module 'mongoose' {
     autoIndex?: boolean;
     /** Set to `false` to disable Mongoose automatically calling `createCollection()` on every model created on this connection. */
     autoCreate?: boolean;
+    /**
+     * Sanitizes query filters against [query selector injection attacks](
+     * https://thecodebarbarian.com/2014/09/04/defending-against-query-selector-injection-attacks.html
+     * ) by wrapping any nested objects that have a property whose name starts with $ in a $eq.
+     */
+    sanitizeFilter?: boolean;
   }
 
   class Connection extends events.EventEmitter implements SessionStarter {

package/types/cursor.d.ts

@@ -26,6 +26,12 @@ declare module 'mongoose' {
      */
     close(): Promise<void>;
 
+    /**
+     * Destroy this cursor, closing the underlying cursor. Will stop streaming
+     * and subsequent calls to `next()` will error.
+     */
+    destroy(): this;
+
     /**
      * Rewind this cursor to its uninitialized state. Any options that are present on the cursor will
      * remain in effect. Iterating this cursor will cause new queries to be sent to the server, even

package/types/index.d.ts

@@ -706,6 +706,91 @@ declare module 'mongoose' {
     [K in keyof T]: FlattenProperty<T[K]>;
   };
 
+  /**
+   * Converts any Buffer properties into mongodb.Binary instances, which is what `lean()` returns
+   */
+  export type BufferToBinary<T> = T extends TreatAsPrimitives ? T : T extends Record<string, any> ? {
+    [K in keyof T]: T[K] extends Buffer
+      ? mongodb.Binary
+      : T[K] extends (Buffer | null | undefined)
+        ? mongodb.Binary | null | undefined
+        : T[K] extends Types.DocumentArray<infer ItemType>
+            ? Types.DocumentArray<BufferToBinary<ItemType>>
+            : T[K] extends Types.Subdocument<unknown, unknown, infer SubdocType>
+              ? HydratedSingleSubdocument<SubdocType>
+              : BufferToBinary<T[K]>;
+  } : T;
+
+  /**
+   * Converts any Buffer properties into { type: 'buffer', data: [1, 2, 3] } format for JSON serialization
+   */
+  export type BufferToJSON<T> = T extends TreatAsPrimitives ? T : T extends Record<string, any> ? {
+    [K in keyof T]: T[K] extends Buffer
+      ? { type: 'buffer', data: number[] }
+      : T[K] extends (Buffer | null | undefined)
+        ? { type: 'buffer', data: number[] } | null | undefined
+        : T[K] extends Types.DocumentArray<infer ItemType>
+            ? Types.DocumentArray<BufferToBinary<ItemType>>
+            : T[K] extends Types.Subdocument<unknown, unknown, infer SubdocType>
+              ? HydratedSingleSubdocument<SubdocType>
+              : BufferToBinary<T[K]>;
+  } : T;
+
+  /**
+   * Converts any ObjectId properties into strings for JSON serialization
+   */
+  export type ObjectIdToString<T> = T extends TreatAsPrimitives ? T : T extends Record<string, any> ? {
+    [K in keyof T]: T[K] extends mongodb.ObjectId
+      ? string
+      : T[K] extends (mongodb.ObjectId | null | undefined)
+        ? string | null | undefined
+        : T[K] extends Types.DocumentArray<infer ItemType>
+            ? Types.DocumentArray<ObjectIdToString<ItemType>>
+            : T[K] extends Types.Subdocument<unknown, unknown, infer SubdocType>
+              ? HydratedSingleSubdocument<ObjectIdToString<SubdocType>>
+              : ObjectIdToString<T[K]>;
+  } : T;
+
+  /**
+   * Converts any Date properties into strings for JSON serialization
+   */
+  export type DateToString<T> = T extends TreatAsPrimitives ? T : T extends Record<string, any> ? {
+    [K in keyof T]: T[K] extends NativeDate
+      ? string
+      : T[K] extends (NativeDate | null | undefined)
+        ? string | null | undefined
+        : T[K] extends Types.DocumentArray<infer ItemType>
+            ? Types.DocumentArray<DateToString<ItemType>>
+            : T[K] extends Types.Subdocument<unknown, unknown, infer SubdocType>
+              ? HydratedSingleSubdocument<DateToString<SubdocType>>
+              : DateToString<T[K]>;
+  } : T;
+
+  /**
+   * Converts any Mongoose subdocuments (single nested or doc arrays) into POJO equivalents
+   */
+  export type SubdocsToPOJOs<T> = T extends TreatAsPrimitives ? T : T extends Record<string, any> ? {
+    [K in keyof T]: T[K] extends NativeDate
+      ? string
+      : T[K] extends (NativeDate | null | undefined)
+        ? string | null | undefined
+        : T[K] extends Types.DocumentArray<infer ItemType>
+            ? ItemType[]
+            : T[K] extends Types.Subdocument<unknown, unknown, infer SubdocType>
+              ? SubdocType
+              : SubdocsToPOJOs<T[K]>;
+  } : T;
+
+  export type JSONSerialized<T> = SubdocsToPOJOs<
+    FlattenMaps<
+      BufferToJSON<
+        ObjectIdToString<
+          DateToString<T>
+        >
+      >
+    >
+  >;
+
   /**
    * Separate type is needed for properties of union type (for example, Types.DocumentArray | undefined) to apply conditional check to each member of it
    * https://www.typescriptlang.org/docs/handbook/2/conditional-types.html#distributive-conditional-types
@@ -716,7 +801,7 @@ declare module 'mongoose' {
         ? Types.DocumentArray<FlattenMaps<ItemType>> : FlattenMaps<T>;
 
   export type actualPrimitives = string | boolean | number | bigint | symbol | null | undefined;
-  export type TreatAsPrimitives = actualPrimitives | NativeDate | RegExp | symbol | Error | BigInt | Types.ObjectId | Buffer | Function;
+  export type TreatAsPrimitives = actualPrimitives | NativeDate | RegExp | symbol | Error | BigInt | Types.ObjectId | Buffer | Function | mongodb.Binary;
 
   export type SchemaDefinitionType<T> = T extends Document ? Omit<T, Exclude<keyof Document, '_id' | 'id' | '__v'>> : T;
 

package/types/inferschematype.d.ts

@@ -146,9 +146,10 @@ type RequiredPathKeys<T, TypeKey extends string = DefaultTypeKey> = {
  * @param {TypeKey} TypeKey A generic of literal string type."Refers to the property used for path type definition".
  * @returns a record contains required paths with the corresponding type.
  */
-type RequiredPaths<T, TypeKey extends string = DefaultTypeKey> = {
-  [K in RequiredPathKeys<T, TypeKey>]: T[K];
-};
+type RequiredPaths<T, TypeKey extends string = DefaultTypeKey> = Pick<
+  { -readonly [K in keyof T]: T[K] },
+  RequiredPathKeys<T, TypeKey>
+>;
 
 /**
  * @summary A Utility to obtain schema's optional path keys.
@@ -166,9 +167,10 @@ type OptionalPathKeys<T, TypeKey extends string = DefaultTypeKey> = {
  * @param {TypeKey} TypeKey A generic of literal string type."Refers to the property used for path type definition".
  * @returns a record contains optional paths with the corresponding type.
  */
-type OptionalPaths<T, TypeKey extends string = DefaultTypeKey> = {
-  [K in OptionalPathKeys<T, TypeKey>]?: T[K];
-};
+type OptionalPaths<T, TypeKey extends string = DefaultTypeKey> = Pick<
+  { -readonly [K in keyof T]?: T[K] },
+  OptionalPathKeys<T, TypeKey>
+>;
 
 /**
  * @summary Allows users to optionally choose their own type for a schema field for stronger typing.
@@ -183,8 +185,16 @@ type TypeHint<T> = T extends { __typehint: infer U } ? U: never;
  * @param {TypeKey} TypeKey A generic refers to document definition.
  */
 type ObtainDocumentPathType<PathValueType, TypeKey extends string = DefaultTypeKey> = ResolvePathType<
-PathValueType extends PathWithTypePropertyBaseType<TypeKey> ? PathValueType[TypeKey] : PathValueType,
-PathValueType extends PathWithTypePropertyBaseType<TypeKey> ? Omit<PathValueType, TypeKey> : {},
+  PathValueType extends PathWithTypePropertyBaseType<TypeKey>
+    ? PathValueType[TypeKey] extends PathWithTypePropertyBaseType<TypeKey>
+      ? PathValueType
+      : PathValueType[TypeKey]
+    : PathValueType,
+  PathValueType extends PathWithTypePropertyBaseType<TypeKey>
+    ? PathValueType[TypeKey] extends PathWithTypePropertyBaseType<TypeKey>
+      ? {}
+      : Omit<PathValueType, TypeKey>
+    : {},
 TypeKey,
 TypeHint<PathValueType>
 >;

package/types/models.d.ts

@@ -64,14 +64,13 @@ declare module 'mongoose' {
     throwOnValidationError?: boolean;
   }
 
-  type InsertManyResult<T> = mongodb.InsertManyResult<T> & {
-    insertedIds: {
-      [key: number]: InferId<T>;
-    };
+  interface InsertManyResult<T> extends mongodb.InsertManyResult<T> {
     mongoose?: { validationErrors?: Array<Error.CastError | Error.ValidatorError> };
-  };
+  }
 
   type UpdateWriteOpResult = mongodb.UpdateResult;
+  type UpdateResult = mongodb.UpdateResult;
+  type DeleteResult = mongodb.DeleteResult;
 
   interface MapReduceOptions<T, K, R> {
     map: Function | string;

package/types/query.d.ts

@@ -211,7 +211,7 @@ declare module 'mongoose' {
   type QueryOpThatReturnsDocument = 'find' | 'findOne' | 'findOneAndUpdate' | 'findOneAndReplace' | 'findOneAndDelete';
 
   type GetLeanResultType<RawDocType, ResultType, QueryOp> = QueryOp extends QueryOpThatReturnsDocument
-    ? (ResultType extends any[] ? Require_id<FlattenMaps<RawDocType>>[] : Require_id<FlattenMaps<RawDocType>>)
+    ? (ResultType extends any[] ? Require_id<BufferToBinary<FlattenMaps<RawDocType>>>[] : Require_id<BufferToBinary<FlattenMaps<RawDocType>>>)
     : ResultType;
 
   type MergePopulatePaths<RawDocType, ResultType, QueryOp, Paths, TQueryHelpers, TInstanceMethods = Record<string, never>> = QueryOp extends QueryOpThatReturnsDocument