mongoose 8.7.3 → 8.8.1

package/lib/cast.js

@@ -28,6 +28,7 @@ const ALLOWED_GEOWITHIN_GEOJSON_TYPES = ['Polygon', 'MultiPolygon'];
  * @param {Object} [options] the query options
  * @param {Boolean|"throw"} [options.strict] Wheter to enable all strict options
  * @param {Boolean|"throw"} [options.strictQuery] Enable strict Queries
+ * @param {Boolean} [options.sanitizeFilter] avoid adding implict query selectors ($in)
  * @param {Boolean} [options.upsert]
  * @param {Query} [context] passed to setters
  * @api private
@@ -372,7 +373,7 @@ module.exports = function cast(schema, obj, options, context) {
 
           }
         }
-      } else if (Array.isArray(val) && ['Buffer', 'Array'].indexOf(schematype.instance) === -1) {
+      } else if (Array.isArray(val) && ['Buffer', 'Array'].indexOf(schematype.instance) === -1 && !options.sanitizeFilter) {
         const casted = [];
         const valuesArray = val;
 

package/lib/helpers/document/applyTimestamps.js

@@ -0,0 +1,105 @@
+'use strict';
+
+const handleTimestampOption = require('../schema/handleTimestampOption');
+const mpath = require('mpath');
+
+module.exports = applyTimestamps;
+
+/**
+ * Apply a given schema's timestamps to the given POJO
+ *
+ * @param {Schema} schema
+ * @param {Object} obj
+ * @param {Object} [options]
+ * @param {Boolean} [options.isUpdate=false] if true, treat this as an update: just set updatedAt, skip setting createdAt. If false, set both createdAt and updatedAt
+ * @param {Function} [options.currentTime] if set, Mongoose will call this function to get the current time.
+ */
+
+function applyTimestamps(schema, obj, options) {
+  if (obj == null) {
+    return obj;
+  }
+
+  applyTimestampsToChildren(schema, obj, options);
+  return applyTimestampsToDoc(schema, obj, options);
+}
+
+/**
+ * Apply timestamps to any subdocuments
+ *
+ * @param {Schema} schema subdocument schema
+ * @param {Object} res subdocument
+ * @param {Object} [options]
+ * @param {Boolean} [options.isUpdate=false] if true, treat this as an update: just set updatedAt, skip setting createdAt. If false, set both createdAt and updatedAt
+ * @param {Function} [options.currentTime] if set, Mongoose will call this function to get the current time.
+ */
+
+function applyTimestampsToChildren(schema, res, options) {
+  for (const childSchema of schema.childSchemas) {
+    const _path = childSchema.model.path;
+    const _schema = childSchema.schema;
+    if (!_path) {
+      continue;
+    }
+    const _obj = mpath.get(_path, res);
+    if (_obj == null || (Array.isArray(_obj) && _obj.flat(Infinity).length === 0)) {
+      continue;
+    }
+
+    applyTimestamps(_schema, _obj, options);
+  }
+}
+
+/**
+ * Apply timestamps to a given document. Does not apply timestamps to subdocuments: use `applyTimestampsToChildren` instead
+ *
+ * @param {Schema} schema
+ * @param {Object} obj
+ * @param {Object} [options]
+ * @param {Boolean} [options.isUpdate=false] if true, treat this as an update: just set updatedAt, skip setting createdAt. If false, set both createdAt and updatedAt
+ * @param {Function} [options.currentTime] if set, Mongoose will call this function to get the current time.
+ */
+
+function applyTimestampsToDoc(schema, obj, options) {
+  if (obj == null || typeof obj !== 'object') {
+    return;
+  }
+  if (Array.isArray(obj)) {
+    for (const el of obj) {
+      applyTimestampsToDoc(schema, el, options);
+    }
+    return;
+  }
+
+  if (schema.discriminators && Object.keys(schema.discriminators).length > 0) {
+    for (const discriminatorKey of Object.keys(schema.discriminators)) {
+      const discriminator = schema.discriminators[discriminatorKey];
+      const key = discriminator.discriminatorMapping.key;
+      const value = discriminator.discriminatorMapping.value;
+      if (obj[key] == value) {
+        schema = discriminator;
+        break;
+      }
+    }
+  }
+
+  const createdAt = handleTimestampOption(schema.options.timestamps, 'createdAt');
+  const updatedAt = handleTimestampOption(schema.options.timestamps, 'updatedAt');
+  const currentTime = options?.currentTime;
+
+  let ts = null;
+  if (currentTime != null) {
+    ts = currentTime();
+  } else if (schema.base?.now) {
+    ts = schema.base.now();
+  } else {
+    ts = new Date();
+  }
+
+  if (createdAt && obj[createdAt] == null && !options?.isUpdate) {
+    obj[createdAt] = ts;
+  }
+  if (updatedAt) {
+    obj[updatedAt] = ts;
+  }
+}

package/lib/helpers/isBsonType.js

@@ -7,8 +7,7 @@
 
 function isBsonType(obj, typename) {
   return (
-    typeof obj === 'object' &&
-    obj !== null &&
+    obj != null &&
     obj._bsontype === typename
   );
 }

package/lib/helpers/query/castUpdate.js

@@ -245,7 +245,7 @@ function walkUpdatePath(schema, obj, op, options, context, filter, pref) {
       }
 
       if (op !== '$setOnInsert' &&
-          handleImmutable(schematype, strict, obj, key, prefix + key, context)) {
+          handleImmutable(schematype, strict, obj, key, prefix + key, options, context)) {
         continue;
       }
 
@@ -353,7 +353,7 @@ function walkUpdatePath(schema, obj, op, options, context, filter, pref) {
 
       // You can use `$setOnInsert` with immutable keys
       if (op !== '$setOnInsert' &&
-          handleImmutable(schematype, strict, obj, key, prefix + key, context)) {
+          handleImmutable(schematype, strict, obj, key, prefix + key, options, context)) {
         continue;
       }
 

package/lib/helpers/query/handleImmutable.js

@@ -2,7 +2,20 @@
 
 const StrictModeError = require('../../error/strict');
 
-module.exports = function handleImmutable(schematype, strict, obj, key, fullPath, ctx) {
+/**
+ * Handle immutable option for a given path when casting updates based on options
+ *
+ * @param {SchemaType} schematype the resolved schematype for this path
+ * @param {Boolean | 'throw' | null} strict whether strict mode is set for this query
+ * @param {Object} obj the object containing the value being checked so we can delete
+ * @param {String} key the key in `obj` which we are checking for immutability
+ * @param {String} fullPath the full path being checked
+ * @param {Object} options the query options
+ * @param {Query} ctx the query. Passed as `this` and first param to the `immutable` option, if `immutable` is a function
+ * @returns true if field was removed, false otherwise
+ */
+
+module.exports = function handleImmutable(schematype, strict, obj, key, fullPath, options, ctx) {
   if (schematype == null || !schematype.options || !schematype.options.immutable) {
     return false;
   }
@@ -15,6 +28,9 @@ module.exports = function handleImmutable(schematype, strict, obj, key, fullPath
     return false;
   }
 
+  if (options && options.overwriteImmutable) {
+    return false;
+  }
   if (strict === false) {
     return false;
   }

package/lib/helpers/schema/applyReadConcern.js

@@ -1,7 +1,5 @@
 'use strict';
 
-const get = require('../get');
-
 module.exports = function applyReadConcern(schema, options) {
   if (options.readConcern !== undefined) {
     return;
@@ -15,7 +13,7 @@ module.exports = function applyReadConcern(schema, options) {
     return;
   }
 
-  const level = get(schema, 'options.readConcern.level', null);
+  const level = schema.options?.readConcern?.level;
   if (level != null) {
     options.readConcern = { level };
   }

package/lib/helpers/schema/applyWriteConcern.js

@@ -1,7 +1,5 @@
 'use strict';
 
-const get = require('../get');
-
 module.exports = function applyWriteConcern(schema, options) {
   if (options.writeConcern != null) {
     return;
@@ -12,7 +10,7 @@ module.exports = function applyWriteConcern(schema, options) {
   if (options && options.session && options.session.transaction) {
     return;
   }
-  const writeConcern = get(schema, 'options.writeConcern', {});
+  const writeConcern = schema.options.writeConcern ?? {};
   if (Object.keys(writeConcern).length != 0) {
     options.writeConcern = {};
     if (!('w' in options) && writeConcern.w != null) {

package/lib/model.js

@@ -10,6 +10,7 @@ const Document = require('./document');
 const DocumentNotFoundError = require('./error/notFound');
 const EventEmitter = require('events').EventEmitter;
 const Kareem = require('kareem');
+const { MongoBulkWriteError } = require('mongodb');
 const MongooseBulkWriteError = require('./error/bulkWriteError');
 const MongooseError = require('./error/index');
 const ObjectParameterError = require('./error/objectParameter');
@@ -30,6 +31,7 @@ const applyReadConcern = require('./helpers/schema/applyReadConcern');
 const applySchemaCollation = require('./helpers/indexes/applySchemaCollation');
 const applyStaticHooks = require('./helpers/model/applyStaticHooks');
 const applyStatics = require('./helpers/model/applyStatics');
+const applyTimestampsHelper = require('./helpers/document/applyTimestamps');
 const applyWriteConcern = require('./helpers/schema/applyWriteConcern');
 const applyVirtualsHelper = require('./helpers/document/applyVirtuals');
 const assignVals = require('./helpers/populate/assignVals');
@@ -1219,6 +1221,7 @@ Model.createCollection = async function createCollection(options) {
  *
  * @param {Object} [options] options to pass to `ensureIndexes()`
  * @param {Boolean} [options.background=null] if specified, overrides each index's `background` property
+ * @param {Boolean} [options.hideIndexes=false] set to `true` to hide indexes instead of dropping. Requires MongoDB server 4.4 or higher
  * @return {Promise}
  * @api public
  */
@@ -1439,8 +1442,10 @@ function getIndexesToDrop(schema, schemaIndexes, dbIndexes) {
  *
  * The returned promise resolves to a list of the dropped indexes' names as an array
  *
- * @param {Function} [callback] optional callback
- * @return {Promise|undefined} Returns `undefined` if callback is specified, returns a promise if no callback.
+ * @param {Object} [options]
+ * @param {Array<String>} [options.toDrop] if specified, contains a list of index names to drop
+ * @param {Boolean} [options.hideIndexes=false] set to `true` to hide indexes instead of dropping. Requires MongoDB server 4.4 or higher
+ * @return {Promise<String>} list of dropped or hidden index names
  * @api public
  */
 
@@ -1451,23 +1456,32 @@ Model.cleanIndexes = async function cleanIndexes(options) {
   }
   const model = this;
 
-  const collection = model.$__collection;
-
   if (Array.isArray(options && options.toDrop)) {
-    const res = await _dropIndexes(options.toDrop, collection);
+    const res = await _dropIndexes(options.toDrop, model, options);
     return res;
   }
 
   const res = await model.diffIndexes();
-  return await _dropIndexes(res.toDrop, collection);
+  return await _dropIndexes(res.toDrop, model, options);
 };
 
-async function _dropIndexes(toDrop, collection) {
+async function _dropIndexes(toDrop, model, options) {
   if (toDrop.length === 0) {
     return [];
   }
 
-  await Promise.all(toDrop.map(indexName => collection.dropIndex(indexName)));
+  const collection = model.$__collection;
+  if (options && options.hideIndexes) {
+    await Promise.all(toDrop.map(indexName => {
+      return model.db.db.command({
+        collMod: collection.collectionName,
+        index: { name: indexName, hidden: true }
+      });
+    }));
+  } else {
+    await Promise.all(toDrop.map(indexName => collection.dropIndex(indexName)));
+  }
+
   return toDrop;
 }
 
@@ -1653,7 +1667,24 @@ function _ensureIndexes(model, options, callback) {
       }
     }
 
-    model.collection.createIndex(indexFields, indexOptions).then(
+    // Just in case `createIndex()` throws a sync error
+    let promise = null;
+    try {
+      promise = model.collection.createIndex(indexFields, indexOptions);
+    } catch (err) {
+      if (!indexError) {
+        indexError = err;
+      }
+      if (!model.$caught) {
+        model.emit('error', err);
+      }
+
+      indexSingleDone(err, indexFields, indexOptions);
+      create();
+      return;
+    }
+
+    promise.then(
       name => {
         indexSingleDone(null, indexFields, indexOptions, name);
         create();
@@ -3417,6 +3448,11 @@ Model.bulkSave = async function bulkSave(documents, options) {
     (err) => ({ bulkWriteResult: null, bulkWriteError: err })
   );
 
+  // If not a MongoBulkWriteError, treat this as all documents failed to save.
+  if (bulkWriteError != null && !(bulkWriteError instanceof MongoBulkWriteError)) {
+    throw bulkWriteError;
+  }
+
   const matchedCount = bulkWriteResult?.matchedCount ?? 0;
   const insertedCount = bulkWriteResult?.insertedCount ?? 0;
   if (writeOperations.length > 0 && matchedCount + insertedCount < writeOperations.length && !bulkWriteError) {
@@ -3540,6 +3576,41 @@ Model.applyVirtuals = function applyVirtuals(obj, virtualsToApply) {
   return obj;
 };
 
+/**
+ * Apply this model's timestamps to a given POJO, including subdocument timestamps
+ *
+ * #### Example:
+ *
+ *     const userSchema = new Schema({ name: String }, { timestamps: true });
+ *     const User = mongoose.model('User', userSchema);
+ *
+ *     const obj = { name: 'John' };
+ *     User.applyTimestamps(obj);
+ *     obj.createdAt; // 2024-06-01T18:00:00.000Z
+ *     obj.updatedAt; // 2024-06-01T18:00:00.000Z
+ *
+ * @param {Object} obj object or document to apply virtuals on
+ * @param {Object} [options]
+ * @param {Boolean} [options.isUpdate=false] if true, treat this as an update: just set updatedAt, skip setting createdAt. If false, set both createdAt and updatedAt
+ * @param {Function} [options.currentTime] if set, Mongoose will call this function to get the current time.
+ * @returns {Object} obj
+ * @api public
+ */
+
+Model.applyTimestamps = function applyTimestamps(obj, options) {
+  if (obj == null) {
+    return obj;
+  }
+  // Nothing to do if this is already a hydrated document - it should already have timestamps
+  if (obj.$__ != null) {
+    return obj;
+  }
+
+  applyTimestampsHelper(this.schema, obj, options);
+
+  return obj;
+};
+
 /**
  * Cast the given POJO to the model's schema
  *

package/lib/mongoose.js

@@ -661,6 +661,8 @@ Mongoose.prototype._model = function(name, schema, collection, options) {
       utils.toCollectionName(name, _mongoose.pluralize());
   }
 
+  applyEmbeddedDiscriminators(schema);
+
   const connection = options.connection || _mongoose.connection;
   model = _mongoose.Model.compile(model || name, schema, collection, connection, _mongoose);
   // Errors handled internally, so safe to ignore error
@@ -678,8 +680,6 @@ Mongoose.prototype._model = function(name, schema, collection, options) {
     }
   }
 
-  applyEmbeddedDiscriminators(schema);
-
   return model;
 };
 

package/lib/query.js

@@ -22,7 +22,6 @@ const castUpdate = require('./helpers/query/castUpdate');
 const clone = require('./helpers/clone');
 const getDiscriminatorByValue = require('./helpers/discriminator/getDiscriminatorByValue');
 const helpers = require('./queryHelpers');
-const immediate = require('./helpers/immediate');
 const internalToObjectOptions = require('./options').internalToObjectOptions;
 const isExclusive = require('./helpers/projection/isExclusive');
 const isInclusive = require('./helpers/projection/isInclusive');
@@ -1142,6 +1141,38 @@ Query.prototype.select = function select() {
   throw new TypeError('Invalid select() argument. Must be string or object.');
 };
 
+/**
+ * Enable or disable schema level projections for this query. Enabled by default.
+ * Set to `false` to include fields with `select: false` in the query result by default.
+ *
+ * #### Example:
+ *
+ *     const userSchema = new Schema({
+ *       email: { type: String, required: true },
+ *       passwordHash: { type: String, select: false, required: true }
+ *     });
+ *     const UserModel = mongoose.model('User', userSchema);
+ *
+ *     const doc = await UserModel.findOne().orFail().schemaLevelProjections(false);
+ *
+ *     // Contains password hash, because `schemaLevelProjections()` overrides `select: false`
+ *     doc.passwordHash;
+ *
+ * @method schemaLevelProjections
+ * @memberOf Query
+ * @instance
+ * @param {Boolean} value
+ * @return {Query} this
+ * @see SchemaTypeOptions https://mongoosejs.com/docs/schematypes.html#all-schema-types
+ * @api public
+ */
+
+Query.prototype.schemaLevelProjections = function schemaLevelProjections(value) {
+  this._mongooseOptions.schemaLevelProjections = value;
+
+  return this;
+};
+
 /**
  * Sets this query's `sanitizeProjection` option. If set, `sanitizeProjection` does
  * two things:
@@ -1594,6 +1625,7 @@ Query.prototype.getOptions = function() {
  * - [writeConcern](https://www.mongodb.com/docs/manual/reference/method/db.collection.update/)
  * - [timestamps](https://mongoosejs.com/docs/guide.html#timestamps): If `timestamps` is set in the schema, set this option to `false` to skip timestamps for that particular update. Has no effect if `timestamps` is not enabled in the schema options.
  * - overwriteDiscriminatorKey: allow setting the discriminator key in the update. Will use the correct discriminator schema if the update changes the discriminator key.
+ * - overwriteImmutable: allow overwriting properties that are set to `immutable` in the schema. Defaults to false.
  *
  * The following options are only for `find()`, `findOne()`, `findById()`, `findOneAndUpdate()`, `findOneAndReplace()`, `findOneAndDelete()`, and `findByIdAndUpdate()`:
  *
@@ -1665,6 +1697,10 @@ Query.prototype.setOptions = function(options, overwrite) {
     this._mongooseOptions.overwriteDiscriminatorKey = options.overwriteDiscriminatorKey;
     delete options.overwriteDiscriminatorKey;
   }
+  if ('overwriteImmutable' in options) {
+    this._mongooseOptions.overwriteImmutable = options.overwriteImmutable;
+    delete options.overwriteImmutable;
+  }
   if ('sanitizeProjection' in options) {
     if (options.sanitizeProjection && !this._mongooseOptions.sanitizeProjection) {
       sanitizeProjection(this._fields);
@@ -1689,6 +1725,10 @@ Query.prototype.setOptions = function(options, overwrite) {
     this._mongooseOptions.translateAliases = options.translateAliases;
     delete options.translateAliases;
   }
+  if ('schemaLevelProjections' in options) {
+    this._mongooseOptions.schemaLevelProjections = options.schemaLevelProjections;
+    delete options.schemaLevelProjections;
+  }
 
   if (options.lean == null && this.schema && 'lean' in this.schema.options) {
     this._mongooseOptions.lean = this.schema.options.lean;
@@ -2207,6 +2247,9 @@ Query.prototype.error = function error(err) {
  */
 
 Query.prototype._unsetCastError = function _unsetCastError() {
+  if (this._error == null) {
+    return;
+  }
   if (this._error != null && !(this._error instanceof CastError)) {
     return;
   }
@@ -2222,6 +2265,7 @@ Query.prototype._unsetCastError = function _unsetCastError() {
  * - `strict`: controls how Mongoose handles keys that aren't in the schema for updates. This option is `true` by default, which means Mongoose will silently strip any paths in the update that aren't in the schema. See the [`strict` mode docs](https://mongoosejs.com/docs/guide.html#strict) for more information.
  * - `strictQuery`: controls how Mongoose handles keys that aren't in the schema for the query `filter`. This option is `false` by default, which means Mongoose will allow `Model.find({ foo: 'bar' })` even if `foo` is not in the schema. See the [`strictQuery` docs](https://mongoosejs.com/docs/guide.html#strictQuery) for more information.
  * - `nearSphere`: use `$nearSphere` instead of `near()`. See the [`Query.prototype.nearSphere()` docs](https://mongoosejs.com/docs/api/query.html#Query.prototype.nearSphere())
+ * - `schemaLevelProjections`: if `false`, Mongoose will not apply schema-level `select: false` or `select: true` for this query
  *
  * Mongoose maintains a separate object for internal options because
  * Mongoose sends `Query.prototype.options` to the MongoDB server, and the
@@ -2249,9 +2293,9 @@ Query.prototype.mongooseOptions = function(v) {
 
 Query.prototype._castConditions = function() {
   let sanitizeFilterOpt = undefined;
-  if (this.model != null && utils.hasUserDefinedProperty(this.model.db.options, 'sanitizeFilter')) {
+  if (this.model?.db.options?.sanitizeFilter != null) {
     sanitizeFilterOpt = this.model.db.options.sanitizeFilter;
-  } else if (this.model != null && utils.hasUserDefinedProperty(this.model.base.options, 'sanitizeFilter')) {
+  } else if (this.model?.base.options?.sanitizeFilter != null) {
     sanitizeFilterOpt = this.model.base.options.sanitizeFilter;
   } else {
     sanitizeFilterOpt = this._mongooseOptions.sanitizeFilter;
@@ -2494,13 +2538,12 @@ Query.prototype.collation = function(value) {
  * @api private
  */
 
-Query.prototype._completeOne = function(doc, res, callback) {
+Query.prototype._completeOne = function(doc, res, projection, callback) {
   if (!doc && !this.options.includeResultMetadata) {
     return callback(null, null);
   }
 
   const model = this.model;
-  const projection = clone(this._fields);
   const userProvidedFields = this._userProvidedFields || {};
   // `populate`, `lean`
   const mongooseOptions = this._mongooseOptions;
@@ -2601,7 +2644,7 @@ Query.prototype._findOne = async function _findOne() {
   // don't pass in the conditions because we already merged them in
   const doc = await this.mongooseCollection.findOne(this._conditions, options);
   return new Promise((resolve, reject) => {
-    this._completeOne(doc, null, (err, res) => {
+    this._completeOne(doc, null, options.projection, (err, res) => {
       if (err) {
         return reject(err);
       }
@@ -3196,7 +3239,7 @@ function completeOne(model, doc, res, options, fields, userProvidedFields, pop,
 
   function _init(err, casted) {
     if (err) {
-      return immediate(() => callback(err));
+      return callback(err);
     }
 
 
@@ -3209,12 +3252,12 @@ function completeOne(model, doc, res, options, fields, userProvidedFields, pop,
       } else {
         res.value = null;
       }
-      return immediate(() => callback(null, res));
+      return callback(null, res);
     }
     if (options.session != null) {
       casted.$session(options.session);
     }
-    immediate(() => callback(null, casted));
+    callback(null, casted);
   }
 }
 
@@ -3281,6 +3324,7 @@ function prepareDiscriminatorCriteria(query) {
  * @param {Boolean} [options.returnOriginal=null] An alias for the `new` option. `returnOriginal: false` is equivalent to `new: true`.
  * @param {Boolean} [options.translateAliases=null] If set to `true`, translates any schema-defined aliases in `filter`, `projection`, `update`, and `distinct`. Throws an error if there are any conflicts where both alias and raw property are defined on the same object.
  * @param {Boolean} [options.overwriteDiscriminatorKey=false] Mongoose removes discriminator key updates from `update` by default, set `overwriteDiscriminatorKey` to `true` to allow updating the discriminator key
+ * @param {Boolean} [options.overwriteImmutable=false] Mongoose removes updated immutable properties from `update` by default (excluding $setOnInsert). Set `overwriteImmutable` to `true` to allow updating immutable properties using other update operators.
  * @see Tutorial https://mongoosejs.com/docs/tutorials/findoneandupdate.html
  * @see findAndModify command https://www.mongodb.com/docs/manual/reference/command/findAndModify/
  * @see ModifyResult https://mongodb.github.io/node-mongodb-native/4.9/interfaces/ModifyResult.html
@@ -3422,7 +3466,7 @@ Query.prototype._findOneAndUpdate = async function _findOneAndUpdate() {
   const doc = !options.includeResultMetadata ? res : res.value;
 
   return new Promise((resolve, reject) => {
-    this._completeOne(doc, res, (err, res) => {
+    this._completeOne(doc, res, options.projection, (err, res) => {
       if (err) {
         return reject(err);
       }
@@ -3518,7 +3562,7 @@ Query.prototype._findOneAndDelete = async function _findOneAndDelete() {
   const doc = !includeResultMetadata ? res : res.value;
 
   return new Promise((resolve, reject) => {
-    this._completeOne(doc, res, (err, res) => {
+    this._completeOne(doc, res, options.projection, (err, res) => {
       if (err) {
         return reject(err);
       }
@@ -3672,7 +3716,7 @@ Query.prototype._findOneAndReplace = async function _findOneAndReplace() {
 
   const doc = !includeResultMetadata ? res : res.value;
   return new Promise((resolve, reject) => {
-    this._completeOne(doc, res, (err, res) => {
+    this._completeOne(doc, res, options.projection, (err, res) => {
       if (err) {
         return reject(err);
       }
@@ -3979,6 +4023,7 @@ Query.prototype._replaceOne = async function _replaceOne() {
  * @param {Boolean} [options.timestamps=null] If set to `false` and [schema-level timestamps](https://mongoosejs.com/docs/guide.html#timestamps) are enabled, skip timestamps for this update. Does nothing if schema-level timestamps are not set.
  * @param {Boolean} [options.translateAliases=null] If set to `true`, translates any schema-defined aliases in `filter`, `projection`, `update`, and `distinct`. Throws an error if there are any conflicts where both alias and raw property are defined on the same object.
  * @param {Boolean} [options.overwriteDiscriminatorKey=false] Mongoose removes discriminator key updates from `update` by default, set `overwriteDiscriminatorKey` to `true` to allow updating the discriminator key
+ * @param {Boolean} [options.overwriteImmutable=false] Mongoose removes updated immutable properties from `update` by default (excluding $setOnInsert). Set `overwriteImmutable` to `true` to allow updating immutable properties using other update operators.
  * @param {Function} [callback] params are (error, writeOpResult)
  * @return {Query} this
  * @see Model.update https://mongoosejs.com/docs/api/model.html#Model.update()
@@ -4049,6 +4094,7 @@ Query.prototype.updateMany = function(conditions, doc, options, callback) {
  * @param {Boolean} [options.timestamps=null] If set to `false` and [schema-level timestamps](https://mongoosejs.com/docs/guide.html#timestamps) are enabled, skip timestamps for this update. Note that this allows you to overwrite timestamps. Does nothing if schema-level timestamps are not set.
  * @param {Boolean} [options.translateAliases=null] If set to `true`, translates any schema-defined aliases in `filter`, `projection`, `update`, and `distinct`. Throws an error if there are any conflicts where both alias and raw property are defined on the same object.
  * @param {Boolean} [options.overwriteDiscriminatorKey=false] Mongoose removes discriminator key updates from `update` by default, set `overwriteDiscriminatorKey` to `true` to allow updating the discriminator key
+ * @param {Boolean} [options.overwriteImmutable=false] Mongoose removes updated immutable properties from `update` by default (excluding $setOnInsert). Set `overwriteImmutable` to `true` to allow updating immutable properties using other update operators.
  * @param {Function} [callback] params are (error, writeOpResult)
  * @return {Query} this
  * @see Model.update https://mongoosejs.com/docs/api/model.html#Model.update()
@@ -4670,7 +4716,8 @@ Query.prototype._castUpdate = function _castUpdate(obj) {
     strict: this._mongooseOptions.strict,
     upsert: upsert,
     arrayFilters: this.options.arrayFilters,
-    overwriteDiscriminatorKey: this._mongooseOptions.overwriteDiscriminatorKey
+    overwriteDiscriminatorKey: this._mongooseOptions.overwriteDiscriminatorKey,
+    overwriteImmutable: this._mongooseOptions.overwriteImmutable
   }, this, this._conditions);
 };
 
@@ -4863,6 +4910,9 @@ Query.prototype.cast = function(model, obj) {
       opts.strictQuery = this.options.strictQuery;
     }
   }
+  if ('sanitizeFilter' in this._mongooseOptions) {
+    opts.sanitizeFilter = this._mongooseOptions.sanitizeFilter;
+  }
 
   try {
     return cast(model.schema, obj, opts, this);
@@ -4946,7 +4996,11 @@ Query.prototype._applyPaths = function applyPaths() {
     sanitizeProjection = this._mongooseOptions.sanitizeProjection;
   }
 
-  helpers.applyPaths(this._fields, this.model.schema, sanitizeProjection);
+  const schemaLevelProjections = this._mongooseOptions.schemaLevelProjections ?? true;
+
+  if (schemaLevelProjections) {
+    helpers.applyPaths(this._fields, this.model.schema, sanitizeProjection);
+  }
 
   let _selectPopulatedPaths = true;