mongoose 8.9.3 → 8.9.5

package/lib/document.js

@@ -55,6 +55,7 @@ const documentIsModified = require('./helpers/symbols').documentIsModified;
 const documentModifiedPaths = require('./helpers/symbols').documentModifiedPaths;
 const documentSchemaSymbol = require('./helpers/symbols').documentSchemaSymbol;
 const getSymbol = require('./helpers/symbols').getSymbol;
+const modelSymbol = require('./helpers/symbols').modelSymbol;
 const populateModelSymbol = require('./helpers/symbols').populateModelSymbol;
 const scopeSymbol = require('./helpers/symbols').scopeSymbol;
 const schemaMixedSymbol = require('./schema/symbols').schemaMixedSymbol;
@@ -1386,7 +1387,9 @@ Document.prototype.$set = function $set(path, val, type, options) {
       const model = val.constructor;
 
       // Check ref
-      const ref = schema.options.ref;
+      const refOpt = typeof schema.options.ref === 'function' && !schema.options.ref[modelSymbol] ? schema.options.ref.call(this, this) : schema.options.ref;
+
+      const ref = refOpt?.modelName || refOpt;
       if (ref != null && (ref === model.modelName || ref === model.baseModelName)) {
         return true;
       }

package/lib/helpers/populate/getModelsMapForPopulate.js

@@ -191,15 +191,7 @@ module.exports = function getModelsMapForPopulate(model, docs, options) {
     if (hasMatchFunction) {
       match = match.call(doc, doc);
     }
-    if (Array.isArray(match)) {
-      for (const item of match) {
-        if (item != null && item.$where) {
-          throw new MongooseError('Cannot use $where filter with populate() match');
-        }
-      }
-    } else if (match != null && match.$where != null) {
-      throw new MongooseError('Cannot use $where filter with populate() match');
-    }
+    throwOn$where(match);
     data.match = match;
     data.hasMatchFunction = hasMatchFunction;
     data.isRefPath = isRefPath;
@@ -463,15 +455,7 @@ function _virtualPopulate(model, docs, options, _virtualRes) {
     data.match = match;
     data.hasMatchFunction = hasMatchFunction;
 
-    if (Array.isArray(match)) {
-      for (const item of match) {
-        if (item != null && item.$where) {
-          throw new MongooseError('Cannot use $where filter with populate() match');
-        }
-      }
-    } else if (match != null && match.$where != null) {
-      throw new MongooseError('Cannot use $where filter with populate() match');
-    }
+    throwOn$where(match);
 
     // Get local fields
     const ret = _getLocalFieldValues(doc, localField, model, options, virtual);
@@ -759,3 +743,24 @@ function _findRefPathForDiscriminators(doc, modelSchema, data, options, normaliz
 
   return modelNames;
 }
+
+/**
+ * Throw an error if there are any $where keys
+ */
+
+function throwOn$where(match) {
+  if (match == null) {
+    return;
+  }
+  if (typeof match !== 'object') {
+    return;
+  }
+  for (const key of Object.keys(match)) {
+    if (key === '$where') {
+      throw new MongooseError('Cannot use $where filter with populate() match');
+    }
+    if (match[key] != null && typeof match[key] === 'object') {
+      throwOn$where(match[key]);
+    }
+  }
+}

package/lib/model.js

@@ -3436,6 +3436,7 @@ Model.bulkWrite = async function bulkWrite(ops, options) {
  * @param {String|number} [options.w=1] The [write concern](https://www.mongodb.com/docs/manual/reference/write-concern/). See [`Query#w()`](https://mongoosejs.com/docs/api/query.html#Query.prototype.w()) for more information.
  * @param {number} [options.wtimeout=null] The [write concern timeout](https://www.mongodb.com/docs/manual/reference/write-concern/#wtimeout).
  * @param {Boolean} [options.j=true] If false, disable [journal acknowledgement](https://www.mongodb.com/docs/manual/reference/write-concern/#j-option)
+ * @param {Boolean} [options.validateBeforeSave=true] set to `false` to skip Mongoose validation on all documents
  * @return {BulkWriteResult} the return value from `bulkWrite()`
  */
 Model.bulkSave = async function bulkSave(documents, options) {
@@ -3455,15 +3456,13 @@ Model.bulkSave = async function bulkSave(documents, options) {
     }
   }
 
-  await Promise.all(documents.map(buildPreSavePromise));
+  await Promise.all(documents.map(doc => buildPreSavePromise(doc, options)));
 
   const writeOperations = this.buildBulkWriteOperations(documents, { skipValidation: true, timestamps: options.timestamps });
-
-  const { bulkWriteResult, bulkWriteError } = await this.bulkWrite(writeOperations, options).then(
+  const { bulkWriteResult, bulkWriteError } = await this.bulkWrite(writeOperations, { skipValidation: true, ...options }).then(
     (res) => ({ bulkWriteResult: res, bulkWriteError: null }),
     (err) => ({ bulkWriteResult: null, bulkWriteError: err })
   );
-
   // If not a MongoBulkWriteError, treat this as all documents failed to save.
   if (bulkWriteError != null && !(bulkWriteError instanceof MongoBulkWriteError)) {
     throw bulkWriteError;
@@ -3491,7 +3490,6 @@ Model.bulkSave = async function bulkSave(documents, options) {
       successfulDocuments.push(document);
     }
   }
-
   await Promise.all(successfulDocuments.map(document => handleSuccessfulWrite(document)));
 
   if (bulkWriteError && bulkWriteError.writeErrors && bulkWriteError.writeErrors.length) {
@@ -3501,9 +3499,9 @@ Model.bulkSave = async function bulkSave(documents, options) {
   return bulkWriteResult;
 };
 
-function buildPreSavePromise(document) {
+function buildPreSavePromise(document, options) {
   return new Promise((resolve, reject) => {
-    document.schema.s.hooks.execPre('save', document, (err) => {
+    document.schema.s.hooks.execPre('save', document, [options], (err) => {
       if (err) {
         reject(err);
         return;
@@ -3704,8 +3702,9 @@ Model.castObject = function castObject(obj, options) {
             Model.castObject.call(schemaType.caster, val)
           ];
         }
+
+        continue;
       }
-      continue;
     }
     if (schemaType.$isSingleNested || schemaType.$isMongooseDocumentArrayElement) {
       try {

package/lib/schema/bigint.js

@@ -209,7 +209,7 @@ SchemaBigInt.prototype.castForQuery = function($conditional, val, context) {
       return handler.call(this, val);
     }
 
-    return this.applySetters(null, val, context);
+    return this.applySetters(val, context);
   }
 
   try {

package/lib/schema/boolean.js

@@ -253,7 +253,7 @@ SchemaBoolean.prototype.castForQuery = function($conditional, val, context) {
       return handler.call(this, val);
     }
 
-    return this.applySetters(null, val, context);
+    return this.applySetters(val, context);
   }
 
   try {

package/lib/schema/documentArray.js

@@ -522,6 +522,7 @@ SchemaDocumentArray.prototype.clone = function() {
   }
   schematype.Constructor.discriminators = Object.assign({},
     this.Constructor.discriminators);
+  schematype._appliedDiscriminators = this._appliedDiscriminators;
   return schematype;
 };
 

package/lib/schema/int32.js

@@ -7,6 +7,7 @@
 const CastError = require('../error/cast');
 const SchemaType = require('../schemaType');
 const castInt32 = require('../cast/int32');
+const handleBitwiseOperator = require('./operators/bitwise');
 
 /**
  * Int32 SchemaType constructor.
@@ -200,7 +201,11 @@ SchemaInt32.$conditionalHandlers = {
   $gt: handleSingle,
   $gte: handleSingle,
   $lt: handleSingle,
-  $lte: handleSingle
+  $lte: handleSingle,
+  $bitsAllClear: handleBitwiseOperator,
+  $bitsAnyClear: handleBitwiseOperator,
+  $bitsAllSet: handleBitwiseOperator,
+  $bitsAnySet: handleBitwiseOperator
 };
 
 /*!
@@ -228,7 +233,7 @@ SchemaInt32.prototype.castForQuery = function($conditional, val, context) {
       return handler.call(this, val);
     }
 
-    return this.applySetters(null, val, context);
+    return this.applySetters(val, context);
   }
 
   try {

package/lib/schema/subdocument.js

@@ -393,5 +393,6 @@ SchemaSubdocument.prototype.clone = function() {
     schematype.requiredValidator = this.requiredValidator;
   }
   schematype.caster.discriminators = Object.assign({}, this.caster.discriminators);
+  schematype._appliedDiscriminators = this._appliedDiscriminators;
   return schematype;
 };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "mongoose",
   "description": "Mongoose MongoDB ODM",
-  "version": "8.9.3",
+  "version": "8.9.5",
   "author": "Guillermo Rauch <guillermo@learnboost.com>",
   "keywords": [
     "mongodb",
@@ -30,34 +30,32 @@
   "devDependencies": {
     "@babel/core": "7.26.0",
     "@babel/preset-env": "7.26.0",
-    "@typescript-eslint/eslint-plugin": "^8.18.0",
-    "@typescript-eslint/parser": "^8.18.0",
+    "@typescript-eslint/eslint-plugin": "^8.19.1",
+    "@typescript-eslint/parser": "^8.19.1",
     "acquit": "1.3.0",
     "acquit-ignore": "0.2.1",
     "acquit-require": "0.1.1",
     "assert-browserify": "2.0.0",
-    "axios": "1.1.3",
     "babel-loader": "8.2.5",
     "broken-link-checker": "^0.7.8",
     "buffer": "^5.6.0",
     "cheerio": "1.0.0",
     "crypto-browserify": "3.12.1",
-    "dotenv": "16.4.5",
     "dox": "1.0.0",
-    "eslint": "8.57.0",
-    "eslint-plugin-markdown": "^5.0.0",
+    "eslint": "8.57.1",
+    "eslint-plugin-markdown": "^5.1.0",
     "eslint-plugin-mocha-no-only": "1.2.0",
     "express": "^4.19.2",
     "fs-extra": "~11.2.0",
-    "highlight.js": "11.10.0",
+    "highlight.js": "11.11.1",
     "lodash.isequal": "4.5.0",
     "lodash.isequalwith": "4.4.0",
-    "markdownlint-cli2": "^0.15.0",
-    "marked": "15.0.3",
+    "markdownlint-cli2": "^0.17.1",
+    "marked": "15.0.4",
     "mkdirp": "^3.0.1",
-    "mocha": "10.8.2",
+    "mocha": "11.0.1",
     "moment": "2.30.1",
-    "mongodb-memory-server": "10.1.2",
+    "mongodb-memory-server": "10.1.3",
     "ncp": "^2.0.0",
     "nyc": "15.1.0",
     "pug": "3.0.3",
@@ -67,7 +65,7 @@
     "tsd": "0.31.2",
     "typescript": "5.7.2",
     "uuid": "11.0.3",
-    "webpack": "5.96.1"
+    "webpack": "5.97.1"
   },
   "directories": {
     "lib": "./lib/mongoose"

package/types/index.d.ts

@@ -710,6 +710,14 @@ declare module 'mongoose' {
     [K in keyof T]: FlattenProperty<T[K]>;
   };
 
+  export type BufferToBinaryProperty<T> = T extends Buffer
+    ? mongodb.Binary
+    : T extends Types.DocumentArray<infer ItemType>
+      ? Types.DocumentArray<BufferToBinary<ItemType>>
+      : T extends Types.Subdocument<unknown, unknown, infer SubdocType>
+        ? HydratedSingleSubdocument<BufferToBinary<SubdocType>>
+        : BufferToBinary<T>;
+
   /**
    * Converts any Buffer properties into mongodb.Binary instances, which is what `lean()` returns
    */
@@ -719,15 +727,11 @@ declare module 'mongoose' {
       ? T
       : T extends TreatAsPrimitives
         ? T
-        : T extends Record<string, any> ? {
-          [K in keyof T]: T[K] extends Buffer
-            ? mongodb.Binary
-            : T[K] extends Types.DocumentArray<infer ItemType>
-              ? Types.DocumentArray<BufferToBinary<ItemType>>
-              : T[K] extends Types.Subdocument<unknown, unknown, infer SubdocType>
-                ? HydratedSingleSubdocument<BufferToBinary<SubdocType>>
-                : BufferToBinary<T[K]>;
-      } : T;
+        : T extends Record<string, any>
+          ? {
+              [K in keyof T]: BufferToBinaryProperty<T[K]>
+            }
+          : T;
 
   /**
    * Converts any Buffer properties into { type: 'buffer', data: [1, 2, 3] } format for JSON serialization

package/types/models.d.ts

@@ -35,6 +35,7 @@ declare module 'mongoose' {
   interface MongooseBulkSaveOptions extends mongodb.BulkWriteOptions {
     timestamps?: boolean;
     session?: ClientSession;
+    validateBeforeSave?: boolean;
   }
 
   /**

package/types/query.d.ts

@@ -223,7 +223,7 @@ declare module 'mongoose' {
   type QueryOpThatReturnsDocument = 'find' | 'findOne' | 'findOneAndUpdate' | 'findOneAndReplace' | 'findOneAndDelete';
 
   type GetLeanResultType<RawDocType, ResultType, QueryOp> = QueryOp extends QueryOpThatReturnsDocument
-    ? (ResultType extends any[] ? Default__v<Require_id<BufferToBinary<FlattenMaps<RawDocType>>>>[] : Default__v<Require_id<BufferToBinary<FlattenMaps<RawDocType>>>>)
+    ? (ResultType extends any[] ? Default__v<Require_id<FlattenMaps<BufferToBinary<RawDocType>>>>[] : Default__v<Require_id<FlattenMaps<BufferToBinary<RawDocType>>>>)
     : ResultType;
 
   type MergePopulatePaths<RawDocType, ResultType, QueryOp, Paths, TQueryHelpers, TDocOverrides = Record<string, never>> = QueryOp extends QueryOpThatReturnsDocument

package/valnotes.md

@@ -0,0 +1,85 @@
+## sift where
+
+```
+      it('match prevents using $where', async function() {
+        const ParentSchema = new Schema({
+          name: String,
+          child: {
+            type: mongoose.Schema.Types.ObjectId,
+            ref: 'Child'
+          },
+          children: [{
+            type: mongoose.Schema.Types.ObjectId,
+            ref: 'Child'
+          }]
+        });
+
+        const ChildSchema = new Schema({
+          name: String
+        });
+        ChildSchema.virtual('parent', {
+          ref: 'Parent',
+          localField: '_id',
+          foreignField: 'parent'
+        });
+
+        const Parent = db.model('Parent', ParentSchema);
+        const Child = db.model('Child', ChildSchema);
+
+        const child = await Child.create({ name: 'Luke' });
+        const parent = await Parent.create({ name: 'Anakin', child: child._id });
+
+        await assert.rejects(
+          () => Parent.findOne().populate({ path: 'child', match: () => ({ $where: 'typeof console !== "undefined" ? doesNotExist("foo") : true;' }) }),
+          /Cannot use \$where filter with populate\(\) match/
+        );
+        await assert.rejects(
+          () => Parent.find().populate({ path: 'child', match: () => ({ $where: 'typeof console !== "undefined" ? doesNotExist("foo") : true;' }) }),
+          /Cannot use \$where filter with populate\(\) match/
+        );
+        await assert.rejects(
+          () => parent.populate({ path: 'child', match: () => ({ $where: 'typeof console !== "undefined" ? doesNotExist("foo") : true;' }) }),
+          /Cannot use \$where filter with populate\(\) match/
+        );
+        await assert.rejects(
+          () => Child.find().populate({ path: 'parent', match: () => ({ $where: 'typeof console !== "undefined" ? doesNotExist("foo") : true;' }) }),
+          /Cannot use \$where filter with populate\(\) match/
+        );
+        await assert.rejects(
+          () => Child.find().populate({ path: 'parent', match: () => ({ $or: [{ $where: 'typeof console !== "undefined" ? doesNotExist("foo") : true;' }] }) }),
+          /Cannot use \$where filter with populate\(\) match/
+        );
+        await assert.rejects(
+          () => Child.find().populate({ path: 'parent', match: () => ({ $and: [{ $where: 'typeof console !== "undefined" ? doesNotExist("foo") : true;' }] }) }),
+          /Cannot use \$where filter with populate\(\) match/
+        );
+
+        class MyClass {}
+        MyClass.prototype.$where = 'typeof console !== "undefined" ? doesNotExist("foo") : true;';
+        // OK because sift only looks through own properties
+        await Child.find().populate({ path: 'parent', match: () => new MyClass() });
+      });
+```
+
+```
+/**
+ * Throw an error if there are any $where keys
+ */
+
+function throwOn$where(match) {
+  if (match == null) {
+    return;
+  }
+  if (typeof match !== 'object') {
+    return;
+  }
+  for (const key of Object.keys(match)) {
+    if (key === '$where') {
+      throw new MongooseError('Cannot use $where filter with populate() match');
+    }
+    if (match[key] != null && typeof match[key] === 'object') {
+      throwOn$where(match[key]);
+    }
+  }
+}
+```