mongoose 9.0.0-rc1 → 9.0.1

package/README.md

@@ -13,7 +13,7 @@ Mongoose is a [MongoDB](https://www.mongodb.org/) object modeling tool designed
 
 The official documentation website is [mongoosejs.com](http://mongoosejs.com/).
 
-Mongoose 8.0.0 was released on October 31, 2023. You can find more details on [backwards breaking changes in 8.0.0 on our docs site](https://mongoosejs.com/docs/migrating_to_8.html).
+Mongoose 9.0.0 was released on November 21, 2025. You can find more details on [backwards breaking changes in 9.0.0 on our docs site](https://mongoosejs.com/docs/migrating_to_9.html).
 
 ## Support
 

package/lib/aggregate.js

@@ -103,7 +103,7 @@ Aggregate.prototype._optionsForExec = function() {
   const options = this.options || {};
 
   const asyncLocalStorage = this.model()?.db?.base.transactionAsyncLocalStorage?.getStore();
-  if (!options.hasOwnProperty('session') && asyncLocalStorage?.session != null) {
+  if (!Object.hasOwn(options, 'session') && asyncLocalStorage?.session != null) {
     options.session = asyncLocalStorage.session;
   }
 

package/lib/cast/double.js

@@ -34,7 +34,7 @@ module.exports = function castDouble(val) {
     // ex: { a: 'im an object, valueOf: () => 'helloworld' } // throw an error
     if (typeof tempVal === 'string') {
       try {
-        coercedVal = BSON.Double.fromString(val);
+        coercedVal = BSON.Double.fromString(tempVal);
         return coercedVal;
       } catch {
         assert.ok(false);

package/lib/cast.js

@@ -107,7 +107,7 @@ module.exports = function cast(schema, obj, options, context) {
       val = cast(schema, val, options, context);
     } else if (path === '$text') {
       val = castTextSearch(val, path);
-    } else if (path === '$comment' && !schema.paths.hasOwnProperty('$comment')) {
+    } else if (path === '$comment' && !Object.hasOwn(schema.paths, '$comment')) {
       val = castString(val, path);
       obj[path] = val;
     } else {

package/lib/connection.js

@@ -164,7 +164,7 @@ Object.defineProperty(Connection.prototype, 'readyState', {
  */
 
 Connection.prototype.get = function getOption(key) {
-  if (this.config.hasOwnProperty(key)) {
+  if (Object.hasOwn(this.config, key)) {
     return this.config[key];
   }
 
@@ -192,7 +192,7 @@ Connection.prototype.get = function getOption(key) {
  */
 
 Connection.prototype.set = function setOption(key, val) {
-  if (this.config.hasOwnProperty(key)) {
+  if (Object.hasOwn(this.config, key)) {
     this.config[key] = val;
     return val;
   }
@@ -459,7 +459,7 @@ Connection.prototype.bulkWrite = async function bulkWrite(ops, options) {
 
   const ordered = options.ordered == null ? true : options.ordered;
   const asyncLocalStorage = this.base.transactionAsyncLocalStorage?.getStore();
-  if ((!options || !options.hasOwnProperty('session')) && asyncLocalStorage?.session != null) {
+  if ((!options || !Object.hasOwn(options, 'session')) && asyncLocalStorage?.session != null) {
     options = { ...options, session: asyncLocalStorage.session };
   }
 
@@ -477,7 +477,7 @@ Connection.prototype.bulkWrite = async function bulkWrite(ops, options) {
       if (op.name == null) {
         throw new MongooseError('Must specify operation name in Connection.prototype.bulkWrite()');
       }
-      if (!castBulkWrite.cast.hasOwnProperty(op.name)) {
+      if (!Object.hasOwn(castBulkWrite.cast, op.name)) {
         throw new MongooseError(`Unrecognized bulkWrite() operation name ${op.name}`);
       }
 
@@ -513,7 +513,7 @@ Connection.prototype.bulkWrite = async function bulkWrite(ops, options) {
         results[i] = error;
         continue;
       }
-      if (!castBulkWrite.cast.hasOwnProperty(op.name)) {
+      if (!Object.hasOwn(castBulkWrite.cast, op.name)) {
         const error = new MongooseError(`Unrecognized bulkWrite() operation name ${op.name}`);
         validationErrors.push({ index: i, error: error });
         results[i] = error;
@@ -772,10 +772,10 @@ async function _wrapUserTransaction(fn, session, mongoose) {
 function _resetSessionDocuments(session) {
   for (const doc of session[sessionNewDocuments].keys()) {
     const state = session[sessionNewDocuments].get(doc);
-    if (state.hasOwnProperty('isNew')) {
+    if (Object.hasOwn(state, 'isNew')) {
       doc.$isNew = state.isNew;
     }
-    if (state.hasOwnProperty('versionKey')) {
+    if (Object.hasOwn(state, 'versionKey')) {
       doc.set(doc.schema.options.versionKey, state.versionKey);
     }
 
@@ -1013,7 +1013,7 @@ Connection.prototype.onOpen = function() {
   // avoid having the collection subscribe to our event emitter
   // to prevent 0.3 warning
   for (const i in this.collections) {
-    if (utils.object.hasOwnProperty(this.collections, i)) {
+    if (Object.hasOwn(this.collections, i)) {
       this.collections[i].onOpen();
     }
   }
@@ -1321,7 +1321,7 @@ Connection.prototype.onClose = function onClose(force) {
   // avoid having the collection subscribe to our event emitter
   // to prevent 0.3 warning
   for (const i in this.collections) {
-    if (utils.object.hasOwnProperty(this.collections, i)) {
+    if (Object.hasOwn(this.collections, i)) {
       this.collections[i].onClose(force);
     }
   }
@@ -1782,7 +1782,7 @@ Connection.prototype.syncIndexes = async function syncIndexes(options = {}) {
 };
 
 /**
- * Switches to a different database using the same [connection pool](https://mongoosejs.com/docs/api/connectionshtml#connection_pools).
+ * Switches to a different database using the same [connection pool](https://mongoosejs.com/docs/connections.html#connection_pools).
  *
  * Returns a new connection object, with the new db.
  *

package/lib/document.js

@@ -784,7 +784,7 @@ function init(self, obj, doc, opts, prefix) {
       }
     } else {
       // Retain order when overwriting defaults
-      if (doc.hasOwnProperty(i) && value !== void 0 && !opts.hydratedPopulatedDocs) {
+      if (Object.hasOwn(doc, i) && value !== void 0 && !opts.hydratedPopulatedDocs) {
         delete doc[i];
       }
       if (value === null) {
@@ -1167,7 +1167,7 @@ Document.prototype.$set = function $set(path, val, type, options) {
     const orderedKeys = Object.keys(this.$__schema.tree);
     for (let i = 0, len = orderedKeys.length; i < len; ++i) {
       (key = orderedKeys[i]) &&
-      (this._doc.hasOwnProperty(key)) &&
+      (Object.hasOwn(this._doc, key)) &&
       (orderedDoc[key] = undefined);
     }
     this._doc = Object.assign(orderedDoc, this._doc);
@@ -1217,8 +1217,8 @@ Document.prototype.$set = function $set(path, val, type, options) {
         return this;
       }
       const wasModified = this.$isModified(path);
-      const hasInitialVal = this.$__.savedState != null && this.$__.savedState.hasOwnProperty(path);
-      if (this.$__.savedState != null && !this.$isNew && !this.$__.savedState.hasOwnProperty(path)) {
+      const hasInitialVal = this.$__.savedState != null && Object.hasOwn(this.$__.savedState, path);
+      if (this.$__.savedState != null && !this.$isNew && !Object.hasOwn(this.$__.savedState, path)) {
         const initialVal = this.$__getValue(path);
         this.$__.savedState[path] = initialVal;
 
@@ -1523,7 +1523,7 @@ Document.prototype.$set = function $set(path, val, type, options) {
       this.$__.session[sessionNewDocuments].get(this).modifiedPaths &&
       !this.$__.session[sessionNewDocuments].get(this).modifiedPaths.has(savedStatePath);
     if (savedState != null &&
-        savedState.hasOwnProperty(savedStatePath) &&
+        Object.hasOwn(savedState, savedStatePath) &&
         (!isInTransaction || isModifiedWithinTransaction) &&
         utils.deepEqual(val, savedState[savedStatePath])) {
       this.unmarkModified(path);
@@ -2005,7 +2005,7 @@ Document.prototype.$get = Document.prototype.get;
 
 Document.prototype.$__path = function(path) {
   const adhocs = this.$__.adhocPaths;
-  const adhocType = adhocs && adhocs.hasOwnProperty(path) ? adhocs[path] : null;
+  const adhocType = adhocs && Object.hasOwn(adhocs, path) ? adhocs[path] : null;
 
   if (adhocType) {
     return adhocType;
@@ -2049,7 +2049,7 @@ Document.prototype.$__saveInitialState = function $__saveInitialState(path) {
   if (savedState != null) {
     const firstDot = savedStatePath.indexOf('.');
     const topLevelPath = firstDot === -1 ? savedStatePath : savedStatePath.slice(0, firstDot);
-    if (!savedState.hasOwnProperty(topLevelPath)) {
+    if (!Object.hasOwn(savedState, topLevelPath)) {
       savedState[topLevelPath] = clone(this.$__getValue(topLevelPath));
     }
   }
@@ -2360,7 +2360,7 @@ Document.prototype.$isDefault = function(path) {
   }
 
   if (typeof path === 'string' && path.indexOf(' ') === -1) {
-    return this.$__.activePaths.getStatePaths('default').hasOwnProperty(path);
+    return Object.hasOwn(this.$__.activePaths.getStatePaths('default'), path);
   }
 
   let paths = path;
@@ -2368,7 +2368,7 @@ Document.prototype.$isDefault = function(path) {
     paths = paths.split(' ');
   }
 
-  return paths.some(path => this.$__.activePaths.getStatePaths('default').hasOwnProperty(path));
+  return paths.some(path => Object.hasOwn(this.$__.activePaths.getStatePaths('default'), path));
 };
 
 /**
@@ -2422,7 +2422,7 @@ Document.prototype.isDirectModified = function(path) {
   }
 
   if (typeof path === 'string' && path.indexOf(' ') === -1) {
-    const res = this.$__.activePaths.getStatePaths('modify').hasOwnProperty(path);
+    const res = Object.hasOwn(this.$__.activePaths.getStatePaths('modify'), path);
     if (res || path.indexOf('.') === -1) {
       return res;
     }
@@ -2461,7 +2461,7 @@ Document.prototype.isInit = function(path) {
   }
 
   if (typeof path === 'string' && path.indexOf(' ') === -1) {
-    return this.$__.activePaths.getStatePaths('init').hasOwnProperty(path);
+    return Object.hasOwn(this.$__.activePaths.getStatePaths('init'), path);
   }
 
   let paths = path;
@@ -2469,7 +2469,7 @@ Document.prototype.isInit = function(path) {
     paths = paths.split(' ');
   }
 
-  return paths.some(path => this.$__.activePaths.getStatePaths('init').hasOwnProperty(path));
+  return paths.some(path => Object.hasOwn(this.$__.activePaths.getStatePaths('init'), path));
 };
 
 /**
@@ -2607,7 +2607,7 @@ Document.prototype.isDirectSelected = function isDirectSelected(path) {
     return true;
   }
 
-  if (this.$__.selected.hasOwnProperty(path)) {
+  if (Object.hasOwn(this.$__.selected, path)) {
     return inclusive;
   }
 
@@ -2779,7 +2779,7 @@ function _getPathsToValidate(doc, pathsToValidate, pathsToSkip, isNestedValidate
         if (doc.$isModified(fullPathToSubdoc, null, modifiedPaths) &&
               // Avoid using isDirectModified() here because that does additional checks on whether the parent path
               // is direct modified, which can cause performance issues re: gh-14897
-              !subdocParent.$__.activePaths.getStatePaths('modify').hasOwnProperty(fullPathToSubdoc) &&
+              !Object.hasOwn(subdocParent.$__.activePaths.getStatePaths('modify'), fullPathToSubdoc) &&
               !subdocParent.$isDefault(fullPathToSubdoc)) {
           paths.add(fullPathToSubdoc);
 
@@ -2850,7 +2850,12 @@ function _getPathsToValidate(doc, pathsToValidate, pathsToSkip, isNestedValidate
       // Single nested paths (paths embedded under single nested subdocs) will
       // be validated on their own when we call `validate()` on the subdoc itself.
       // Re: gh-8468
-      Object.keys(flat).filter(path => !doc.$__schema.singleNestedPaths.hasOwnProperty(path)).forEach(addToPaths);
+      const singleNestedPaths = doc.$__schema.singleNestedPaths;
+      for (const path of Object.keys(flat)) {
+        if (!Object.hasOwn(singleNestedPaths, path)) {
+          addToPaths(path);
+        }
+      }
     }
   }
 
@@ -4188,7 +4193,7 @@ function applyVirtuals(self, json, options, toObjectOptions) {
     }
 
     // Allow skipping aliases with `toObject({ virtuals: true, aliases: false })`
-    if (!aliases && schema.aliases.hasOwnProperty(path)) {
+    if (!aliases && Object.hasOwn(schema.aliases, path)) {
       continue;
     }
 
@@ -5101,7 +5106,7 @@ function checkDivergentArray(doc, path, array) {
   // would be similarly destructive as we never received all
   // elements of the array and potentially would overwrite data.
   const check = pop.options.match ||
-      pop.options.options && utils.object.hasOwnProperty(pop.options.options, 'limit') || // 0 is not permitted
+      pop.options.options && Object.hasOwn(pop.options.options, 'limit') || // 0 is not permitted
       pop.options.options && pop.options.options.skip || // 0 is permitted
       pop.options.select && // deselected _id?
       (pop.options.select._id === 0 ||
@@ -5426,6 +5431,38 @@ Document.prototype.$__hasOnlyPrimitiveValues = function $__hasOnlyPrimitiveValue
   }));
 };
 
+/*!
+ * Increment this document's version if necessary.
+ */
+
+Document.prototype._applyVersionIncrement = function _applyVersionIncrement() {
+  if (!this.$__.version) return;
+  const doIncrement = VERSION_INC === (VERSION_INC & this.$__.version);
+
+  this.$__.version = undefined;
+  if (doIncrement) {
+    const key = this.$__schema.options.versionKey;
+    const version = this.$__getValue(key) || 0;
+    this.$__setValue(key, version + 1); // increment version if was successful
+  }
+};
+
+/*!
+ * Increment this document's version if necessary.
+ */
+
+Document.prototype._applyVersionIncrement = function _applyVersionIncrement() {
+  if (!this.$__.version) return;
+  const doIncrement = VERSION_INC === (VERSION_INC & this.$__.version);
+
+  this.$__.version = undefined;
+  if (doIncrement) {
+    const key = this.$__schema.options.versionKey;
+    const version = this.$__getValue(key) || 0;
+    this.$__setValue(key, version + 1); // increment version if was successful
+  }
+};
+
 /*!
  * Module exports.
  */

package/lib/drivers/node-mongodb-native/collection.js

@@ -124,6 +124,7 @@ function iter(i) {
 
     let _args = args;
     let callback = null;
+    let timeout = null;
     if (this._shouldBufferCommands() && this.buffer) {
       this.conn.emit('buffer', {
         _id: opId,
@@ -136,7 +137,6 @@ function iter(i) {
       let callback;
       let _args = args;
       let promise = null;
-      let timeout = null;
       if (syncCollectionMethods[i] && typeof lastArg === 'function') {
         this.addQueue(i, _args);
         callback = lastArg;
@@ -239,6 +239,9 @@ function iter(i) {
 
       if (syncCollectionMethods[i] && typeof lastArg === 'function') {
         const result = collection[i].apply(collection, _args.slice(0, _args.length - 1));
+        if (timeout != null) {
+          clearTimeout(timeout);
+        }
         this.conn.emit('operation-end', { _id: opId, modelName: _this.modelName, collectionName: this.name, method: i, result });
         return lastArg.call(this, null, result);
       }
@@ -247,6 +250,9 @@ function iter(i) {
       if (ret != null && typeof ret.then === 'function') {
         return ret.then(
           result => {
+            if (timeout != null) {
+              clearTimeout(timeout);
+            }
             if (typeof lastArg === 'function') {
               lastArg(null, result);
             } else {
@@ -255,6 +261,9 @@ function iter(i) {
             return result;
           },
           error => {
+            if (timeout != null) {
+              clearTimeout(timeout);
+            }
             if (typeof lastArg === 'function') {
               lastArg(error);
               return;
@@ -265,10 +274,16 @@ function iter(i) {
           }
         );
       }
+      if (timeout != null) {
+        clearTimeout(timeout);
+      }
       return ret;
     } catch (error) {
       // Collection operation may throw because of max bson size, catch it here
       // See gh-3906
+      if (timeout != null) {
+        clearTimeout(timeout);
+      }
       if (typeof lastArg === 'function') {
         return lastArg(error);
       } else {

package/lib/drivers/node-mongodb-native/connection.js

@@ -508,7 +508,7 @@ function _setClient(conn, client, options, dbName) {
   conn.onOpen();
 
   for (const i in conn.collections) {
-    if (utils.object.hasOwnProperty(conn.collections, i)) {
+    if (Object.hasOwn(conn.collections, i)) {
       conn.collections[i].onOpen();
     }
   }

package/lib/helpers/common.js

@@ -55,7 +55,7 @@ function flatten(update, path, options, schema) {
     if (isNested) {
       const paths = Object.keys(schema.paths);
       for (const p of paths) {
-        if (p.startsWith(path + key + '.') && !result.hasOwnProperty(p)) {
+        if (p.startsWith(path + key + '.') && !Object.hasOwn(result, p)) {
           result[p] = void 0;
         }
       }

package/lib/helpers/indexes/applySchemaCollation.js

@@ -7,7 +7,7 @@ module.exports = function applySchemaCollation(indexKeys, indexOptions, schemaOp
     return;
   }
 
-  if (schemaOptions.hasOwnProperty('collation') && !indexOptions.hasOwnProperty('collation')) {
+  if (Object.hasOwn(schemaOptions, 'collation') && !Object.hasOwn(indexOptions, 'collation')) {
     indexOptions.collation = schemaOptions.collation;
   }
 };

package/lib/helpers/indexes/isDefaultIdIndex.js

@@ -14,5 +14,5 @@ module.exports = function isDefaultIdIndex(index) {
   }
 
   const key = get(index, 'key', {});
-  return Object.keys(key).length === 1 && key.hasOwnProperty('_id');
+  return Object.keys(key).length === 1 && Object.hasOwn(key, '_id');
 };

package/lib/helpers/model/applyMethods.js

@@ -28,7 +28,7 @@ module.exports = function applyMethods(model, schema) {
   }
   for (const method of Object.keys(schema.methods)) {
     const fn = schema.methods[method];
-    if (schema.tree.hasOwnProperty(method)) {
+    if (Object.hasOwn(schema.tree, method)) {
       throw new Error('You have a method and a property in your schema both ' +
         'named "' + method + '"');
     }

package/lib/helpers/model/castBulkWrite.js

@@ -118,7 +118,10 @@ module.exports.castUpdateOne = function castUpdateOne(originalModel, updateOne,
   if (model.schema.$timestamps != null && doInitTimestamps) {
     const createdAt = model.schema.$timestamps.createdAt;
     const updatedAt = model.schema.$timestamps.updatedAt;
-    applyTimestampsToUpdate(now, createdAt, updatedAt, update, {});
+    applyTimestampsToUpdate(now, createdAt, updatedAt, update, {
+      timestamps: updateOne.timestamps,
+      overwriteImmutable: updateOne.overwriteImmutable
+    });
   }
 
   if (doInitTimestamps) {
@@ -150,7 +153,8 @@ module.exports.castUpdateOne = function castUpdateOne(originalModel, updateOne,
     strict: strict,
     upsert: updateOne.upsert,
     arrayFilters: updateOne.arrayFilters,
-    overwriteDiscriminatorKey: updateOne.overwriteDiscriminatorKey
+    overwriteDiscriminatorKey: updateOne.overwriteDiscriminatorKey,
+    overwriteImmutable: updateOne.overwriteImmutable
   }, model, updateOne['filter']);
 
   return updateOne;
@@ -185,7 +189,10 @@ module.exports.castUpdateMany = function castUpdateMany(originalModel, updateMan
   if (model.schema.$timestamps != null && doInitTimestamps) {
     const createdAt = model.schema.$timestamps.createdAt;
     const updatedAt = model.schema.$timestamps.updatedAt;
-    applyTimestampsToUpdate(now, createdAt, updatedAt, updateMany['update'], {});
+    applyTimestampsToUpdate(now, createdAt, updatedAt, updateMany['update'], {
+      timestamps: updateMany.timestamps,
+      overwriteImmutable: updateMany.overwriteImmutable
+    });
   }
   if (doInitTimestamps) {
     applyTimestampsToChildren(now, updateMany['update'], model.schema);
@@ -208,7 +215,8 @@ module.exports.castUpdateMany = function castUpdateMany(originalModel, updateMan
     strict: strict,
     upsert: updateMany.upsert,
     arrayFilters: updateMany.arrayFilters,
-    overwriteDiscriminatorKey: updateMany.overwriteDiscriminatorKey
+    overwriteDiscriminatorKey: updateMany.overwriteDiscriminatorKey,
+    overwriteImmutable: updateMany.overwriteImmutable
   }, model, updateMany['filter']);
 };
 
@@ -289,13 +297,12 @@ function _addDiscriminatorToObject(schema, obj) {
 
 function decideModelByObject(model, object) {
   const discriminatorKey = model.schema.options.discriminatorKey;
-  if (object != null && object.hasOwnProperty(discriminatorKey)) {
+  if (object != null && Object.hasOwn(object, discriminatorKey)) {
     model = getDiscriminatorByValue(model.discriminators, object[discriminatorKey]) || model;
   }
   return model;
 }
 
-
 /**
  * gets timestamps option for a given operation. If the option is set within an individual operation, use it. Otherwise, use the global timestamps option configured in the `bulkWrite` options. Overall default is `true`.
  * @api private

package/lib/helpers/populate/getModelsMapForPopulate.js

@@ -386,13 +386,13 @@ function _virtualPopulate(model, docs, options, _virtualRes) {
     }
     data.count = virtual.options.count;
 
-    if (virtual.options.skip != null && !options.hasOwnProperty('skip')) {
+    if (virtual.options.skip != null && !Object.hasOwn(options, 'skip')) {
       options.skip = virtual.options.skip;
     }
-    if (virtual.options.limit != null && !options.hasOwnProperty('limit')) {
+    if (virtual.options.limit != null && !Object.hasOwn(options, 'limit')) {
       options.limit = virtual.options.limit;
     }
-    if (virtual.options.perDocumentLimit != null && !options.hasOwnProperty('perDocumentLimit')) {
+    if (virtual.options.perDocumentLimit != null && !Object.hasOwn(options, 'perDocumentLimit')) {
       options.perDocumentLimit = virtual.options.perDocumentLimit;
     }
     let foreignField = virtual.options.foreignField;

package/lib/helpers/populate/modelNamesFromRefPath.js

@@ -56,7 +56,7 @@ module.exports = function modelNamesFromRefPath(refPath, doc, populatedPath, mod
   const refValue = mpath.get(refPath, doc, lookupLocalFields);
 
   let modelNames;
-  if (modelSchema != null && modelSchema.virtuals.hasOwnProperty(refPath)) {
+  if (modelSchema != null && Object.hasOwn(modelSchema.virtuals, refPath)) {
     modelNames = [modelSchema.virtuals[refPath].applyGetters(void 0, doc)];
   } else {
     modelNames = Array.isArray(refValue) ? refValue : [refValue];

package/lib/helpers/populate/removeDeselectedForeignField.js

@@ -16,7 +16,7 @@ module.exports = function removeDeselectedForeignField(foreignFields, options, d
     return;
   }
   for (const foreignField of foreignFields) {
-    if (!projection.hasOwnProperty('-' + foreignField)) {
+    if (!Object.hasOwn(projection, '-' + foreignField)) {
       continue;
     }
 

package/lib/helpers/projection/applyProjection.js

@@ -43,7 +43,7 @@ function applyExclusiveProjection(doc, projection, hasIncludedChildren, projecti
 
   for (const key of Object.keys(ret)) {
     const fullPath = prefix ? prefix + '.' + key : key;
-    if (projection.hasOwnProperty(fullPath) || projectionLimb.hasOwnProperty(key)) {
+    if (Object.hasOwn(projection, fullPath) || Object.hasOwn(projectionLimb, key)) {
       if (isPOJO(projection[fullPath]) || isPOJO(projectionLimb[key])) {
         ret[key] = applyExclusiveProjection(ret[key], projection, hasIncludedChildren, projectionLimb[key], fullPath);
       } else {
@@ -68,7 +68,7 @@ function applyInclusiveProjection(doc, projection, hasIncludedChildren, projecti
 
   for (const key of Object.keys(ret)) {
     const fullPath = prefix ? prefix + '.' + key : key;
-    if (projection.hasOwnProperty(fullPath) || projectionLimb.hasOwnProperty(key)) {
+    if (Object.hasOwn(projection, fullPath) || Object.hasOwn(projectionLimb, key)) {
       if (isPOJO(projection[fullPath]) || isPOJO(projectionLimb[key])) {
         ret[key] = applyInclusiveProjection(ret[key], projection, hasIncludedChildren, projectionLimb[key], fullPath);
       }

package/lib/helpers/query/getEmbeddedDiscriminatorPath.js

@@ -71,7 +71,7 @@ module.exports = function getEmbeddedDiscriminatorPath(schema, update, filter, p
         const schemaKey = updatedPathsByFilter[filterKey] + '.' + key;
         const arrayFilterKey = filterKey + '.' + key;
         if (schemaKey === discriminatorFilterPath) {
-          const filter = arrayFilters.find(filter => filter.hasOwnProperty(arrayFilterKey));
+          const filter = arrayFilters.find(filter => Object.hasOwn(filter, arrayFilterKey));
           if (filter != null) {
             discriminatorKey = filter[arrayFilterKey];
           }

package/lib/helpers/setDefaultsOnInsert.js

@@ -136,14 +136,14 @@ function pathExistsInUpdate(update, targetPath, pathPieces) {
   }
 
   // Check exact match
-  if (update.hasOwnProperty(targetPath)) {
+  if (Object.hasOwn(update, targetPath)) {
     return true;
   }
 
   // Check if any parent path exists
   let cur = pathPieces[0];
   for (let i = 1; i < pathPieces.length; ++i) {
-    if (update.hasOwnProperty(cur)) {
+    if (Object.hasOwn(update, cur)) {
       return true;
     }
     cur += '.' + pathPieces[i];

package/lib/helpers/timestamps/setupTimestamps.js

@@ -23,7 +23,7 @@ module.exports = function setupTimestamps(schema, timestamps) {
   }
   const createdAt = handleTimestampOption(timestamps, 'createdAt');
   const updatedAt = handleTimestampOption(timestamps, 'updatedAt');
-  const currentTime = timestamps != null && timestamps.hasOwnProperty('currentTime') ?
+  const currentTime = timestamps != null && Object.hasOwn(timestamps, 'currentTime') ?
     timestamps.currentTime :
     null;
   const schemaAdditions = {};

package/lib/helpers/update/applyTimestampsToUpdate.js

@@ -74,39 +74,52 @@ function applyTimestampsToUpdate(now, createdAt, updatedAt, currentUpdate, optio
       updates.$set[updatedAt] = now;
     }
 
-    if (updates.hasOwnProperty(updatedAt)) {
+    if (Object.hasOwn(updates, updatedAt)) {
       delete updates[updatedAt];
     }
   }
 
   if (!skipCreatedAt && createdAt) {
-    if (currentUpdate[createdAt]) {
-      delete currentUpdate[createdAt];
-    }
-    if (currentUpdate.$set && currentUpdate.$set[createdAt]) {
-      delete currentUpdate.$set[createdAt];
-    }
-    let timestampSet = false;
-    if (createdAt.indexOf('.') !== -1) {
-      const pieces = createdAt.split('.');
-      for (let i = 1; i < pieces.length; ++i) {
-        const remnant = pieces.slice(-i).join('.');
-        const start = pieces.slice(0, -i).join('.');
-        if (currentUpdate[start] != null) {
-          currentUpdate[start][remnant] = now;
-          timestampSet = true;
-          break;
-        } else if (currentUpdate.$set && currentUpdate.$set[start]) {
-          currentUpdate.$set[start][remnant] = now;
-          timestampSet = true;
-          break;
+    const overwriteImmutable = get(options, 'overwriteImmutable', false);
+    const hasUserCreatedAt = currentUpdate[createdAt] != null || currentUpdate?.$set[createdAt] != null;
+
+    // If overwriteImmutable is true and user provided createdAt, keep their value
+    if (overwriteImmutable && hasUserCreatedAt) {
+      // Move createdAt from top-level to $set if needed
+      if (currentUpdate[createdAt] != null) {
+        updates.$set[createdAt] = currentUpdate[createdAt];
+        delete currentUpdate[createdAt];
+      }
+      // User's value is already in $set, nothing more to do
+    } else {
+      if (currentUpdate[createdAt]) {
+        delete currentUpdate[createdAt];
+      }
+      if (currentUpdate.$set && currentUpdate.$set[createdAt]) {
+        delete currentUpdate.$set[createdAt];
+      }
+      let timestampSet = false;
+      if (createdAt.indexOf('.') !== -1) {
+        const pieces = createdAt.split('.');
+        for (let i = 1; i < pieces.length; ++i) {
+          const remnant = pieces.slice(-i).join('.');
+          const start = pieces.slice(0, -i).join('.');
+          if (currentUpdate[start] != null) {
+            currentUpdate[start][remnant] = now;
+            timestampSet = true;
+            break;
+          } else if (currentUpdate.$set && currentUpdate.$set[start]) {
+            currentUpdate.$set[start][remnant] = now;
+            timestampSet = true;
+            break;
+          }
         }
       }
-    }
 
-    if (!timestampSet) {
-      updates.$setOnInsert = updates.$setOnInsert || {};
-      updates.$setOnInsert[createdAt] = now;
+      if (!timestampSet) {
+        updates.$setOnInsert = updates.$setOnInsert || {};
+        updates.$setOnInsert[createdAt] = now;
+      }
     }
   }