mongoose 9.4.0 → 9.5.0

package/lib/document.js

@@ -5112,20 +5112,26 @@ Document.prototype.$__delta = function $__delta(pathsToSave, pathsToSaveSet) {
   const optimisticConcurrency = this.$__schema.options.optimisticConcurrency;
   if (optimisticConcurrency) {
     if (Array.isArray(optimisticConcurrency)) {
-      const optCon = new Set(optimisticConcurrency);
-      const modPaths = this.modifiedPaths();
+      if (!this.$__schema.options._optimisticConcurrencySet) {
+        this.$__schema.options._optimisticConcurrencySet = new Set(optimisticConcurrency);
+      }
+      const optimisticConcurrencySet = this.$__schema.options._optimisticConcurrencySet;
+      const modPaths = this.directModifiedPaths();
       const hasRelevantModPaths = pathsToSave == null ?
-        modPaths.find(path => optCon.has(path)) :
-        modPaths.find(path => optCon.has(path) && isInPathsToSave(path, pathsToSaveSet, pathsToSave));
+        modPaths.find(path => _pathOverlapsSet(path, optimisticConcurrencySet)) :
+        modPaths.find(path => _pathOverlapsSet(path, optimisticConcurrencySet) && isInPathsToSave(path, pathsToSaveSet, pathsToSave));
       if (hasRelevantModPaths) {
         this.$__.version = dirty.length ? VERSION_ALL : VERSION_WHERE;
       }
     } else if (Array.isArray(optimisticConcurrency?.exclude)) {
-      const excluded = new Set(optimisticConcurrency.exclude);
-      const modPaths = this.modifiedPaths();
+      if (!this.$__schema.options._optimisticConcurrencyExcludeSet) {
+        this.$__schema.options._optimisticConcurrencyExcludeSet = new Set(optimisticConcurrency.exclude);
+      }
+      const optimisticConcurrencyExcludeSet = this.$__schema.options._optimisticConcurrencyExcludeSet;
+      const modPaths = this.directModifiedPaths();
       const hasRelevantModPaths = pathsToSave == null ?
-        modPaths.find(path => !excluded.has(path)) :
-        modPaths.find(path => !excluded.has(path) && isInPathsToSave(path, pathsToSaveSet, pathsToSave));
+        modPaths.find(path => !_pathOverlapsSet(path, optimisticConcurrencyExcludeSet)) :
+        modPaths.find(path => !_pathOverlapsSet(path, optimisticConcurrencyExcludeSet) && isInPathsToSave(path, pathsToSaveSet, pathsToSave));
       if (hasRelevantModPaths) {
         this.$__.version = dirty.length ? VERSION_ALL : VERSION_WHERE;
       }
@@ -5652,6 +5658,32 @@ Document.prototype._applyVersionIncrement = function _applyVersionIncrement() {
  * Module exports.
  */
 
+/*!
+ * Check if `path`, any of its ancestor paths, or any of its descendant paths
+ * exist in `pathSet`.
+ * For example:
+ *   _pathOverlapsSet('profile.firstName', Set(['profile'])) === true
+ *   _pathOverlapsSet('profile', Set(['profile.firstName'])) === true
+ */
+function _pathOverlapsSet(path, pathSet) {
+  if (pathSet.has(path)) {
+    return true;
+  }
+  let idx = path.indexOf('.');
+  while (idx !== -1) {
+    if (pathSet.has(path.substring(0, idx))) {
+      return true;
+    }
+    idx = path.indexOf('.', idx + 1);
+  }
+  for (const p of pathSet) {
+    if (p.length > path.length + 1 && p[path.length] === '.' && p.slice(0, path.length) === path) {
+      return true;
+    }
+  }
+  return false;
+}
+
 Document.VERSION_WHERE = VERSION_WHERE;
 Document.VERSION_INC = VERSION_INC;
 Document.VERSION_ALL = VERSION_ALL;

package/lib/drivers/node-mongodb-native/collection.js

@@ -172,7 +172,8 @@ function iter(i) {
       } else {
         const color = debug.color == null ? true : debug.color;
         const shell = debug.shell == null ? false : debug.shell;
-        this.$print(_this.name, i, args, color, shell);
+        const timestamp = debug.timestamp == null ? false : debug.timestamp;
+        this.$print(_this.name, i, args, color, shell, timestamp);
       }
     }
 
@@ -256,7 +257,12 @@ for (const key of Object.getOwnPropertyNames(Collection.prototype)) {
  * @method $print
  */
 
-NativeCollection.prototype.$print = function(name, i, args, color, shell) {
+NativeCollection.prototype.$print = function(name, i, args, color, shell, timestamp) {
+  let prefix = '';
+  if (timestamp) {
+    const ts = new Date().toISOString();
+    prefix = color ? `\x1B[0;90m[${ts}]\x1B[0m ` : `[${ts}] `;
+  }
   const moduleName = color ? '\x1B[0;36mMongoose:\x1B[0m ' : 'Mongoose: ';
   const functionCall = [name, i].join('.');
   const _args = [];
@@ -267,14 +273,14 @@ NativeCollection.prototype.$print = function(name, i, args, color, shell) {
   }
   const params = '(' + _args.join(', ') + ')';
 
-  console.info(moduleName + functionCall + params);
+  console.info(prefix + moduleName + functionCall + params);
 };
 
 /**
  * Debug print helper
  *
  * @api public
- * @method $print
+ * @method $printToStream
  */
 
 NativeCollection.prototype.$printToStream = function(name, i, args, stream) {

package/lib/error/cast.js

@@ -42,6 +42,7 @@ class CastError extends MongooseError {
       message: this.message
     };
   }
+
   /*!
    * ignore
    */
@@ -76,7 +77,7 @@ class CastError extends MongooseError {
    */
   setModel(model) {
     this.message = formatMessage(model, this.kind, this.value, this.path,
-      this.messageFormat, this.valueType);
+      this.messageFormat, this.valueType, this.reason);
   }
 }
 
@@ -122,10 +123,11 @@ function getMessageFormat(schemaType) {
 function formatMessage(model, kind, value, path, messageFormat, valueType, reason) {
   if (typeof messageFormat === 'string') {
     const stringValue = getStringValue(value);
-    let ret = messageFormat.
-      replace('{KIND}', kind).
-      replace('{VALUE}', stringValue).
-      replace('{PATH}', path);
+    let ret = messageFormat
+      .replace('{KIND}', kind)
+      .replace('{VALUE}', stringValue)
+      .replace('{PATH}', path);
+
     if (model != null) {
       ret = ret.replace('{MODEL}', model.modelName);
     }
@@ -136,17 +138,24 @@ function formatMessage(model, kind, value, path, messageFormat, valueType, reaso
   } else {
     const stringValue = getStringValue(value);
     const valueTypeMsg = valueType ? ' (type ' + valueType + ')' : '';
+
     let ret = 'Cast to ' + kind + ' failed for value ' +
       stringValue + valueTypeMsg + ' at path "' + path + '"';
+
     if (model != null) {
       ret += ' for model "' + model.modelName + '"';
     }
-    if (reason != null &&
-        typeof reason.constructor === 'function' &&
-        reason.constructor.name !== 'AssertionError' &&
-        reason.constructor.name !== 'Error') {
+
+    if (
+      reason != null &&
+      typeof reason.constructor === 'function' &&
+      reason.constructor.name !== 'AssertionError' &&
+      reason.constructor.name !== 'Error' &&
+      reason.constructor.name !== 'BSONError'
+    ) {
       ret += ' because of "' + reason.constructor.name + '"';
     }
+
     return ret;
   }
 }

package/lib/helpers/query/castUpdate.js

@@ -98,6 +98,10 @@ module.exports = function castUpdate(schema, obj, options, context, filter) {
     moveImmutableProperties(schema, obj, context);
   }
 
+  if (obj?.$__ && typeof obj.toObject === 'function') {
+    obj = obj.toObject(internalToObjectOptions);
+  }
+
   const ops = Object.keys(obj);
   let i = ops.length;
   const ret = {};

package/lib/helpers/setDefaultsOnInsert.js

@@ -84,7 +84,7 @@ module.exports = function(filter, schema, castedDoc, options, queryMongooseOptio
     if (schemaType.path === '_id' && schemaType.options.auto) {
       return;
     }
-    const def = schemaType.getDefault(null, false, { context });
+    const def = schemaType.getDefault(null, true, { context });
     if (typeof def === 'undefined') {
       return;
     }

package/lib/model.js

@@ -2418,13 +2418,6 @@ Model.findOneAndUpdate = function(conditions, update, options) {
     fields = options.fields || options.projection;
   }
 
-  update = clone(update, {
-    depopulate: true,
-    _isNested: true
-  });
-
-  decorateUpdateWithVersionKey(update, options, this.schema.options.versionKey);
-
   const mq = new this.Query({}, {}, this, this.$__collection);
   mq.select(fields);
 
@@ -2864,6 +2857,10 @@ Model.create = async function create(doc, options) {
 Model.insertOne = async function insertOne(doc, options) {
   _checkContext(this, 'insertOne');
 
+  if (doc == null || typeof doc !== 'object') {
+    throw new ObjectParameterError(doc, 'doc', 'insertOne');
+  }
+
   const discriminatorKey = this.schema.options.discriminatorKey;
   const Model = this.discriminators && doc[discriminatorKey] != null ?
     this.discriminators[doc[discriminatorKey]] || getDiscriminatorByValue(this.discriminators, doc[discriminatorKey]) :

package/lib/mongoose.js

@@ -228,7 +228,7 @@ Mongoose.prototype.setDriver = function setDriver(driver) {
  * - `bufferCommands`: enable/disable mongoose's buffering mechanism for all connections and models
  * - `bufferTimeoutMS`: If bufferCommands is on, this option sets the maximum amount of time Mongoose buffering will wait before throwing an error. If not specified, Mongoose will use 10000 (10 seconds).
  * - `cloneSchemas`: `false` by default. Set to `true` to `clone()` all schemas before compiling into a model.
- * - `debug`: If `true`, prints the operations mongoose sends to MongoDB to the console. If a writable stream is passed, it will log to that stream, without colorization. If a callback function is passed, it will receive the collection name, the method name, then all arguments passed to the method. For example, if you wanted to replicate the default logging, you could output from the callback `Mongoose: ${collectionName}.${methodName}(${methodArgs.join(', ')})`.
+ * - `debug`: If `true`, prints the operations mongoose sends to MongoDB to the console. If an object is passed, you can set `color`, `shell`, and `timestamp` options. If `timestamp` is `true`, Mongoose prefixes console debug output with an ISO timestamp in brackets. If a writable stream is passed, it will log to that stream, without colorization. If a callback function is passed, it will receive the collection name, the method name, then all arguments passed to the method. For example, if you wanted to replicate the default logging, you could output from the callback `Mongoose: ${collectionName}.${methodName}(${methodArgs.join(', ')})`.
  * - `id`: If `true`, adds a `id` virtual to all schemas unless overwritten on a per-schema basis.
  * - `maxTimeMS`: If set, attaches [maxTimeMS](https://www.mongodb.com/docs/manual/reference/operator/meta/maxTimeMS/) to every query
  * - `objectIdGetter`: `true` by default. Mongoose adds a getter to MongoDB ObjectId's called `_id` that returns `this` for convenience with populate. Set this to false to remove the getter.

package/lib/query.js

@@ -20,6 +20,7 @@ const castArrayFilters = require('./helpers/update/castArrayFilters');
 const castNumber = require('./cast/number');
 const castUpdate = require('./helpers/query/castUpdate');
 const clone = require('./helpers/clone');
+const decorateUpdateWithVersionKey = require('./helpers/update/decorateUpdateWithVersionKey');
 const getDiscriminatorByValue = require('./helpers/discriminator/getDiscriminatorByValue');
 const helpers = require('./queryHelpers');
 const internalToObjectOptions = require('./options').internalToObjectOptions;
@@ -85,6 +86,8 @@ const opToThunk = new Map([
   ['findOneAndDelete', '_findOneAndDelete']
 ]);
 
+const queryUpdateSymbol = Symbol('mongoose#Query#update');
+
 /**
  * Query constructor used for building queries. You do not need
  * to instantiate a `Query` directly. Instead use Model functions like
@@ -196,6 +199,18 @@ function checkRequireFilter(filter, options) {
 Query.prototype = new mquery();
 Query.prototype.constructor = Query;
 
+Object.defineProperty(Query.prototype, '_update', {
+  configurable: true,
+  enumerable: true,
+  get: function() {
+    _cloneUpdateIfShared(this);
+    return this[queryUpdateSymbol];
+  },
+  set: function(v) {
+    this[queryUpdateSymbol] = v;
+  }
+});
+
 // Remove some legacy methods that we removed in Mongoose 8, but
 // are still in mquery 5.
 Query.prototype.count = undefined;
@@ -300,7 +315,7 @@ Query.prototype.toConstructor = function toConstructor() {
   p.op = this.op;
   p._conditions = clone(this._conditions);
   p._fields = clone(this._fields);
-  p._update = clone(this._update, {
+  p[queryUpdateSymbol] = clone(this[queryUpdateSymbol], {
     flattenDecimals: false
   });
   p._path = this._path;
@@ -348,7 +363,7 @@ Query.prototype.clone = function() {
   q.op = this.op;
   q._conditions = clone(this._conditions);
   q._fields = clone(this._fields);
-  q._update = clone(this._update, {
+  q[queryUpdateSymbol] = clone(this[queryUpdateSymbol], {
     flattenDecimals: false
   });
   q._path = this._path;
@@ -1365,7 +1380,7 @@ Query.prototype.toString = function toString() {
       this.op === 'update' ||
       this.op === 'updateMany' ||
       this.op === 'updateOne') {
-    return `${this.model.modelName}.${this.op}(${util.inspect(this._conditions)}, ${util.inspect(this._update)})`;
+    return `${this.model.modelName}.${this.op}(${util.inspect(this._conditions)}, ${util.inspect(this[queryUpdateSymbol])})`;
   }
 
   // 'estimatedDocumentCount' or any others
@@ -1669,6 +1684,7 @@ Query.prototype.getOptions = function() {
  * - [upsert](https://www.mongodb.com/docs/manual/reference/method/db.collection.update/)
  * - [writeConcern](https://www.mongodb.com/docs/manual/reference/method/db.collection.update/)
  * - [timestamps](https://mongoosejs.com/docs/guide.html#timestamps): If `timestamps` is set in the schema, set this option to `false` to skip timestamps for that particular update. Has no effect if `timestamps` is not enabled in the schema options.
+ * - cloneUpdate: set to `false` to skip cloning the update before executing the query.
  * - overwriteDiscriminatorKey: allow setting the discriminator key in the update. Will use the correct discriminator schema if the update changes the discriminator key.
  * - overwriteImmutable: allow overwriting properties that are set to `immutable` in the schema. Defaults to false.
  *
@@ -1679,6 +1695,7 @@ Query.prototype.getOptions = function() {
  * - [projection](https://mongoosejs.com/docs/api/query.html#Query.prototype.projection())
  * - sanitizeProjection
  * - useBigInt64
+ * - defaults: if `false`, skip applying default values to the returned document(s). Defaults to true.
  *
  * The following options are only for all operations **except** `updateOne()`, `updateMany()`, `deleteOne()`, and `deleteMany()`:
  *
@@ -1751,6 +1768,10 @@ Query.prototype.setOptions = function(options, overwrite) {
     this._mongooseOptions.updatePipeline = options.updatePipeline;
     delete options.updatePipeline;
   }
+  if ('cloneUpdate' in options) {
+    this._mongooseOptions.cloneUpdate = options.cloneUpdate;
+    delete options.cloneUpdate;
+  }
   if ('sanitizeProjection' in options) {
     if (options.sanitizeProjection && !this._mongooseOptions.sanitizeProjection) {
       sanitizeProjection(this._fields);
@@ -1984,12 +2005,17 @@ Query.prototype.getUpdate = function() {
  *     query.getUpdate(); // { $set: { b: 6 } }
  *
  * @param {object} new update operation
+ * @param {boolean} [cloneUpdate=true] if `false`, Mongoose will not clone the update
  * @return {undefined}
  * @api public
  */
 
-Query.prototype.setUpdate = function(val) {
-  this._update = clone(val);
+Query.prototype.setUpdate = function(val, cloneUpdate) {
+  this[queryUpdateSymbol] = cloneUpdate === false ? val : clone(val);
+  if (cloneUpdate != null) {
+    this._mongooseOptions.cloneUpdate = cloneUpdate;
+  }
+  this._updateIsShared = false;
 };
 
 /**
@@ -2022,7 +2048,7 @@ Query.prototype._fieldsForExec = function() {
  */
 
 Query.prototype._updateForExec = function() {
-  const update = clone(this._update, {
+  const update = clone(this[queryUpdateSymbol], {
     transform: false,
     depopulate: true
   });
@@ -2216,6 +2242,8 @@ Query.prototype.lean = function(v) {
  */
 
 Query.prototype.set = function(path, val) {
+  _cloneUpdateIfShared(this);
+
   if (typeof path === 'object') {
     const keys = Object.keys(path);
     for (const key of keys) {
@@ -2224,12 +2252,16 @@ Query.prototype.set = function(path, val) {
     return this;
   }
 
-  this._update = this._update || {};
-  if (path in this._update) {
-    delete this._update[path];
+  let update = this[queryUpdateSymbol];
+  if (update == null) {
+    update = {};
+    this[queryUpdateSymbol] = update;
+  }
+  if (path in update) {
+    delete update[path];
   }
-  this._update.$set = this._update.$set || {};
-  this._update.$set[path] = val;
+  update.$set = update.$set || {};
+  update.$set[path] = val;
   return this;
 };
 
@@ -2249,7 +2281,7 @@ Query.prototype.set = function(path, val) {
  */
 
 Query.prototype.get = function get(path) {
-  const update = this._update;
+  const update = this[queryUpdateSymbol];
   if (update == null) {
     return void 0;
   }
@@ -2333,6 +2365,7 @@ Query.prototype._unsetCastError = function _unsetCastError() {
  * - `strictQuery`: controls how Mongoose handles keys that aren't in the schema for the query `filter`. This option is `false` by default, which means Mongoose will allow `Model.find({ foo: 'bar' })` even if `foo` is not in the schema. See the [`strictQuery` docs](https://mongoosejs.com/docs/guide.html#strictQuery) for more information.
  * - `nearSphere`: use `$nearSphere` instead of `near()`. See the [`Query.prototype.nearSphere()` docs](https://mongoosejs.com/docs/api/query.html#Query.prototype.nearSphere())
  * - `schemaLevelProjections`: if `false`, Mongoose will not apply schema-level `select: false` or `select: true` for this query
+ * - `cloneUpdate`: if `false`, Mongoose will not clone updates before executing the query
  *
  * Mongoose maintains a separate object for internal options because
  * Mongoose sends `Query.prototype.options` to the MongoDB server, and the
@@ -2421,6 +2454,12 @@ Query.prototype._find = async function _find() {
     lean: mongooseOptions.lean || null
   };
 
+  // Only pass `defaults` through when it is non-nullish; `null` and
+  // `undefined` are treated as "not set" and omitted from `createModel()`.
+  if (mongooseOptions.defaults != null) {
+    completeManyOptions.defaults = mongooseOptions.defaults;
+  }
+
   const options = this._optionsForExec();
 
   const filter = this._conditions;
@@ -2553,9 +2592,10 @@ Query.prototype.merge = function(source) {
       utils.merge(this.options, source.options, opts);
     }
 
-    if (source._update) {
-      this._update || (this._update = {});
-      utils.mergeClone(this._update, source._update);
+    if (source[queryUpdateSymbol] != null) {
+      _cloneUpdateIfShared(this);
+      this[queryUpdateSymbol] || (this[queryUpdateSymbol] = {});
+      utils.mergeClone(this[queryUpdateSymbol], source[queryUpdateSymbol]);
     }
 
     if (source._distinct) {
@@ -2691,7 +2731,7 @@ Query.prototype._completeMany = async function _completeMany(docs, fields, userP
   const model = this.model;
   return Promise.all(docs.map(doc => new Promise((resolve, reject) => {
     const rawDoc = doc;
-    doc = helpers.createModel(model, doc, fields, userProvidedFields);
+    doc = helpers.createModel(model, doc, fields, userProvidedFields, opts);
     if (opts.session != null) {
       doc.$session(opts.session);
     }
@@ -2849,9 +2889,10 @@ Query.prototype._applyTranslateAliases = function _applyTranslateAliases() {
   }
 
   if (this.model?.schema?.aliases && utils.hasOwnKeys(this.model.schema.aliases)) {
+    _cloneUpdateIfShared(this);
     this.model.translateAliases(this._conditions, true);
     this.model.translateAliases(this._fields, true);
-    this.model.translateAliases(this._update, true);
+    this.model.translateAliases(this[queryUpdateSymbol], true);
     if (this._distinct != null && this.model.schema.aliases[this._distinct] != null) {
       this._distinct = this.model.schema.aliases[this._distinct];
     }
@@ -3405,6 +3446,7 @@ function prepareDiscriminatorCriteria(query) {
  * @param {object|Query} [filter]
  * @param {object} [update]
  * @param {object} [options]
+ * @param {boolean} [options.cloneUpdate=true] if `false`, Mongoose will not clone the update before executing the query
  * @param {boolean} [options.includeResultMetadata] if true, returns the full [ModifyResult from the MongoDB driver](https://mongodb.github.io/node-mongodb-native/7.0/interfaces/ModifyResult.html) rather than just the document
  * @param {boolean|'throw'} [options.strict] overwrites the schema's [strict mode option](https://mongoosejs.com/docs/guide.html#strict)
  * @param {ClientSession} [options.session=null] The session associated with this query. See [transactions docs](https://mongoosejs.com/docs/transactions.html).
@@ -3481,11 +3523,20 @@ Query.prototype.findOneAndUpdate = function(filter, update, options) {
     options.updatePipeline = updatePipeline;
   }
 
+  if (!options.updatePipeline && Array.isArray(update)) {
+    throw new MongooseError('Cannot pass an array to query updates unless the `updatePipeline` option is set.');
+  }
+
   this.setOptions(options);
 
   // apply doc
   if (update) {
-    this._mergeUpdate(update);
+    if (this[queryUpdateSymbol] == null || utils.isEmptyObject(this[queryUpdateSymbol])) {
+      this[queryUpdateSymbol] = update;
+      this._updateIsShared = true;
+    } else {
+      this._mergeUpdate(update);
+    }
   }
 
   return this;
@@ -3523,49 +3574,51 @@ Query.prototype._findOneAndUpdate = async function _findOneAndUpdate() {
   const options = this._optionsForExec(this.model);
   convertNewToReturnDocument(options);
 
-  this._update = this._castUpdate(this._update);
+  this[queryUpdateSymbol] = this._castUpdate(this[queryUpdateSymbol]);
+  this._updateIsShared = false;
+  decorateUpdateWithVersionKey(this[queryUpdateSymbol], options, this.schema.options.versionKey);
 
-  this._update = setDefaultsOnInsert(
+  this[queryUpdateSymbol] = setDefaultsOnInsert(
     this._conditions,
     this.model.schema,
-    this._update,
+    this[queryUpdateSymbol],
     options,
     this._mongooseOptions,
     this
   );
 
-  if (!this._update || utils.hasOwnKeys(this._update) === false) {
+  if (!this[queryUpdateSymbol] || utils.hasOwnKeys(this[queryUpdateSymbol]) === false) {
     if (options.upsert) {
       // still need to do the upsert to empty doc
-      const $set = clone(this._update);
+      const $set = clone(this[queryUpdateSymbol]);
       delete $set._id;
-      this._update = { $set };
+      this[queryUpdateSymbol] = { $set };
     } else {
       this._execCount = 0;
       const res = await this._findOne();
       return res;
     }
-  } else if (this._update instanceof Error) {
-    throw this._update;
+  } else if (this[queryUpdateSymbol] instanceof Error) {
+    throw this[queryUpdateSymbol];
   } else {
     // In order to make MongoDB 2.6 happy (see
     // https://jira.mongodb.org/browse/SERVER-12266 and related issues)
     // if we have an actual update document but $set is empty, junk the $set.
-    if (this._update.$set && utils.hasOwnKeys(this._update.$set) === false) {
-      delete this._update.$set;
+    if (this[queryUpdateSymbol].$set && utils.hasOwnKeys(this[queryUpdateSymbol].$set) === false) {
+      delete this[queryUpdateSymbol].$set;
     }
   }
 
   const runValidators = _getOption(this, 'runValidators', false);
   if (runValidators) {
-    await this.validate(this._update, options, false);
+    await this.validate(this[queryUpdateSymbol], options, false);
   }
 
-  if (typeof this._update.toBSON === 'function') {
-    this._update = this._update.toBSON();
+  if (typeof this[queryUpdateSymbol].toBSON === 'function') {
+    this[queryUpdateSymbol] = this[queryUpdateSymbol].toBSON();
   }
 
-  let res = await this.mongooseCollection.findOneAndUpdate(this._conditions, this._update, options);
+  let res = await this.mongooseCollection.findOneAndUpdate(this._conditions, this[queryUpdateSymbol], options);
   for (const fn of this._transforms) {
     res = fn(res);
   }
@@ -3701,6 +3754,7 @@ Query.prototype._findOneAndDelete = async function _findOneAndDelete() {
  * @param {object} [filter]
  * @param {object} [replacement]
  * @param {object} [options]
+ * @param {boolean} [options.cloneUpdate=true] if `false`, Mongoose will not clone the update before executing the query
  * @param {boolean} [options.includeResultMetadata] if true, returns the full [ModifyResult from the MongoDB driver](https://mongodb.github.io/node-mongodb-native/7.0/interfaces/ModifyResult.html) rather than just the document
  * @param {ClientSession} [options.session=null] The session associated with this query. See [transactions docs](https://mongoosejs.com/docs/transactions.html).
  * @param {boolean|'throw'} [options.strict] overwrites the schema's [strict mode option](https://mongoosejs.com/docs/guide.html#strict)
@@ -3796,13 +3850,13 @@ Query.prototype._findOneAndReplace = async function _findOneAndReplace() {
   const runValidators = _getOption(this, 'runValidators', false);
 
   try {
-    const update = new this.model(this._update, null, modelOpts);
+    const update = new this.model(this[queryUpdateSymbol], null, modelOpts);
     if (runValidators) {
       await update.validate();
     } else if (update.$__.validationError) {
       throw update.$__.validationError;
     }
-    this._update = update.toBSON();
+    this[queryUpdateSymbol] = update.toBSON();
   } catch (err) {
     if (err instanceof ValidationError) {
       throw err;
@@ -3812,7 +3866,7 @@ Query.prototype._findOneAndReplace = async function _findOneAndReplace() {
     throw validationError;
   }
 
-  let res = await this.mongooseCollection.findOneAndReplace(filter, this._update, options);
+  let res = await this.mongooseCollection.findOneAndReplace(filter, this[queryUpdateSymbol], options);
 
   for (const fn of this._transforms) {
     res = fn(res);
@@ -3874,6 +3928,7 @@ Query.prototype.findById = function(id, projection, options) {
  * @param {any} id value of `_id` to query by
  * @param {object} [doc]
  * @param {object} [options]
+ * @param {boolean} [options.cloneUpdate=true] if `false`, Mongoose will not clone the update before executing the query
  * @param {boolean} [options.includeResultMetadata] if true, returns the full [ModifyResult from the MongoDB driver](https://mongodb.github.io/node-mongodb-native/7.0/interfaces/ModifyResult.html) rather than just the document
  * @param {boolean|'throw'} [options.strict] overwrites the schema's [strict mode option](https://mongoosejs.com/docs/guide.html#strict)
  * @param {ClientSession} [options.session=null] The session associated with this query. See [transactions docs](https://mongoosejs.com/docs/transactions.html).
@@ -4049,12 +4104,14 @@ function _completeManyLean(schema, docs, path, opts) {
  */
 
 Query.prototype._mergeUpdate = function(update) {
+  _cloneUpdateIfShared(this);
+
   const updatePipeline = this._mongooseOptions.updatePipeline;
   if (!updatePipeline && Array.isArray(update)) {
     throw new MongooseError('Cannot pass an array to query updates unless the `updatePipeline` option is set.');
   }
-  if (!this._update) {
-    this._update = Array.isArray(update) ? [] : {};
+  if (!this[queryUpdateSymbol]) {
+    this[queryUpdateSymbol] = Array.isArray(update) ? [] : {};
   }
 
   if (update == null || (typeof update === 'object' && utils.hasOwnKeys(update) === false)) {
@@ -4062,28 +4119,28 @@ Query.prototype._mergeUpdate = function(update) {
   }
 
   if (update instanceof Query) {
-    if (Array.isArray(this._update)) {
-      throw new MongooseError(`Cannot mix array and object updates (current: ${_previewUpdate(this._update)}, incoming: ${_previewUpdate(update._update)})`);
+    if (Array.isArray(this[queryUpdateSymbol])) {
+      throw new MongooseError(`Cannot mix array and object updates (current: ${_previewUpdate(this[queryUpdateSymbol])}, incoming: ${_previewUpdate(update[queryUpdateSymbol])})`);
     }
-    if (update._update) {
-      utils.mergeClone(this._update, update._update);
+    if (update[queryUpdateSymbol]) {
+      utils.mergeClone(this[queryUpdateSymbol], update[queryUpdateSymbol]);
     }
   } else if (Array.isArray(update)) {
-    if (!Array.isArray(this._update)) {
+    if (!Array.isArray(this[queryUpdateSymbol])) {
       // `_update` may be empty object by default, like in `doc.updateOne()`
       // because we create the query first, then run hooks, then apply the update.
-      if (this._update == null || utils.isEmptyObject(this._update)) {
-        this._update = [];
+      if (this[queryUpdateSymbol] == null || utils.isEmptyObject(this[queryUpdateSymbol])) {
+        this[queryUpdateSymbol] = [];
       } else {
-        throw new MongooseError(`Cannot mix array and object updates (current: ${_previewUpdate(this._update)}, incoming: ${_previewUpdate(update)})`);
+        throw new MongooseError(`Cannot mix array and object updates (current: ${_previewUpdate(this[queryUpdateSymbol])}, incoming: ${_previewUpdate(update)})`);
       }
     }
-    this._update = this._update.concat(update);
+    this[queryUpdateSymbol] = this[queryUpdateSymbol].concat(update);
   } else {
-    if (Array.isArray(this._update)) {
-      throw new MongooseError(`Cannot mix array and object updates (current: ${_previewUpdate(this._update)}, incoming: ${_previewUpdate(update)})`);
+    if (Array.isArray(this[queryUpdateSymbol])) {
+      throw new MongooseError(`Cannot mix array and object updates (current: ${_previewUpdate(this[queryUpdateSymbol])}, incoming: ${_previewUpdate(update)})`);
     }
-    utils.mergeClone(this._update, update);
+    utils.mergeClone(this[queryUpdateSymbol], update);
   }
 };
 
@@ -4157,30 +4214,31 @@ Query.prototype._updateMany = async function _updateMany() {
   }
 
   const options = this._optionsForExec(this.model);
-  this._update = this._castUpdate(this._update);
-  if (this._update == null || utils.hasOwnKeys(this._update) === false) {
+  _cloneUpdateIfShared(this);
+  this[queryUpdateSymbol] = this._castUpdate(this[queryUpdateSymbol]);
+  if (this[queryUpdateSymbol] == null || utils.hasOwnKeys(this[queryUpdateSymbol]) === false) {
     return { acknowledged: false };
   }
-  removeUnusedArrayFilters(this._update, options);
+  removeUnusedArrayFilters(this[queryUpdateSymbol], options);
 
-  this._update = setDefaultsOnInsert(
+  this[queryUpdateSymbol] = setDefaultsOnInsert(
     this._conditions,
     this.model.schema,
-    this._update,
+    this[queryUpdateSymbol],
     options,
     this._mongooseOptions,
     this
   );
 
   if (_getOption(this, 'runValidators', false)) {
-    await this.validate(this._update, options, false);
+    await this.validate(this[queryUpdateSymbol], options, false);
   }
 
-  if (typeof this._update.toBSON === 'function') {
-    this._update = this._update.toBSON();
+  if (typeof this[queryUpdateSymbol].toBSON === 'function') {
+    this[queryUpdateSymbol] = this[queryUpdateSymbol].toBSON();
   }
 
-  return this.mongooseCollection.updateMany(this._conditions, this._update, options);
+  return this.mongooseCollection.updateMany(this._conditions, this[queryUpdateSymbol], options);
 };
 
 /**
@@ -4202,30 +4260,31 @@ Query.prototype._updateOne = async function _updateOne() {
   }
 
   const options = this._optionsForExec(this.model);
-  this._update = this._castUpdate(this._update);
-  if (this._update == null || utils.hasOwnKeys(this._update) === false) {
+  _cloneUpdateIfShared(this);
+  this[queryUpdateSymbol] = this._castUpdate(this[queryUpdateSymbol]);
+  if (this[queryUpdateSymbol] == null || utils.hasOwnKeys(this[queryUpdateSymbol]) === false) {
     return { acknowledged: false };
   }
-  removeUnusedArrayFilters(this._update, options);
+  removeUnusedArrayFilters(this[queryUpdateSymbol], options);
 
-  this._update = setDefaultsOnInsert(
+  this[queryUpdateSymbol] = setDefaultsOnInsert(
     this._conditions,
     this.model.schema,
-    this._update,
+    this[queryUpdateSymbol],
     options,
     this._mongooseOptions,
     this
   );
 
   if (_getOption(this, 'runValidators', false)) {
-    await this.validate(this._update, options, false);
+    await this.validate(this[queryUpdateSymbol], options, false);
   }
 
-  if (typeof this._update.toBSON === 'function') {
-    this._update = this._update.toBSON();
+  if (typeof this[queryUpdateSymbol].toBSON === 'function') {
+    this[queryUpdateSymbol] = this[queryUpdateSymbol].toBSON();
   }
 
-  return this.mongooseCollection.updateOne(this._conditions, this._update, options);
+  return this.mongooseCollection.updateOne(this._conditions, this[queryUpdateSymbol], options);
 };
 
 /**
@@ -4247,18 +4306,18 @@ Query.prototype._replaceOne = async function _replaceOne() {
   }
 
   const options = this._optionsForExec(this.model);
-  this._update = new this.model(this._update, null, { skipId: true });
-  removeUnusedArrayFilters(this._update, options);
+  this[queryUpdateSymbol] = new this.model(this[queryUpdateSymbol], null, { skipId: true });
+  removeUnusedArrayFilters(this[queryUpdateSymbol], options);
 
   if (_getOption(this, 'runValidators', false)) {
-    await this.validate(this._update, options, true);
+    await this.validate(this[queryUpdateSymbol], options, true);
   }
 
-  if (typeof this._update.toBSON === 'function') {
-    this._update = this._update.toBSON();
+  if (typeof this[queryUpdateSymbol].toBSON === 'function') {
+    this[queryUpdateSymbol] = this[queryUpdateSymbol].toBSON();
   }
 
-  return this.mongooseCollection.replaceOne(this._conditions, this._update, options);
+  return this.mongooseCollection.replaceOne(this._conditions, this[queryUpdateSymbol], options);
 };
 
 /**
@@ -4285,6 +4344,7 @@ Query.prototype._replaceOne = async function _replaceOne() {
  * @param {object} [filter]
  * @param {object|Array} [update] the update command. If array, this update will be treated as an update pipeline and not casted.
  * @param {object} [options]
+ * @param {boolean} [options.cloneUpdate=true] if `false`, Mongoose will not clone the update before executing the query
  * @param {boolean} [options.multipleCastError] by default, mongoose only returns the first error that occurred in casting the query. Turn on this option to aggregate all the cast errors.
  * @param {boolean|'throw'} [options.strict] overwrites the schema's [strict mode option](https://mongoosejs.com/docs/guide.html#strict)
  * @param {boolean} [options.upsert=false] if true, and no documents found, insert a new document
@@ -4360,6 +4420,7 @@ Query.prototype.updateMany = function(conditions, doc, options, callback) {
  * @param {object} [filter]
  * @param {object|Array} [update] the update command. If array, this update will be treated as an update pipeline and not casted.
  * @param {object} [options]
+ * @param {boolean} [options.cloneUpdate=true] if `false`, Mongoose will not clone the update before executing the query
  * @param {boolean} [options.multipleCastError] by default, mongoose only returns the first error that occurred in casting the query. Turn on this option to aggregate all the cast errors.
  * @param {boolean|'throw'} [options.strict] overwrites the schema's [strict mode option](https://mongoosejs.com/docs/guide.html#strict)
  * @param {boolean} [options.upsert=false] if true, and no documents found, insert a new document
@@ -4429,6 +4490,7 @@ Query.prototype.updateOne = function(conditions, doc, options, callback) {
  * @param {object} [filter]
  * @param {object} [doc] the update command
  * @param {object} [options]
+ * @param {boolean} [options.cloneUpdate=true] if `false`, Mongoose will not clone the update before executing the query
  * @param {boolean} [options.multipleCastError] by default, mongoose only returns the first error that occurred in casting the query. Turn on this option to aggregate all the cast errors.
  * @param {boolean|'throw'} [options.strict] overwrites the schema's [strict mode option](https://mongoosejs.com/docs/guide.html#strict)
  * @param {boolean} [options.upsert=false] if true, and no documents found, insert a new document
@@ -4510,11 +4572,20 @@ function _update(query, op, filter, doc, options, callback) {
     options.updatePipeline = updatePipeline;
   }
 
+  if (!options?.updatePipeline && Array.isArray(doc)) {
+    throw new MongooseError('Cannot pass an array to query updates unless the `updatePipeline` option is set.');
+  }
+
   if (utils.isObject(options)) {
     query.setOptions(options);
   }
 
-  query._mergeUpdate(doc);
+  if (query[queryUpdateSymbol] == null || utils.isEmptyObject(query[queryUpdateSymbol])) {
+    query[queryUpdateSymbol] = doc;
+    query._updateIsShared = true;
+  } else {
+    query._mergeUpdate(doc);
+  }
 
   // Hooks
   if (callback) {
@@ -4789,6 +4860,20 @@ function _executePreHooks(query, op) {
   );
 }
 
+function _cloneUpdateIfShared(query) {
+  if (!query._updateIsShared) {
+    return;
+  }
+  if (query.mongooseOptions().cloneUpdate === false) {
+    return;
+  }
+
+  query[queryUpdateSymbol] = clone(query[queryUpdateSymbol], {
+    flattenDecimals: false
+  });
+  query._updateIsShared = false;
+}
+
 /**
  * Executes the query returning a `Promise` which will be
  * resolved with either the doc(s) or rejected with the error.

package/lib/queryHelpers.js

@@ -84,28 +84,29 @@ exports.createModel = function createModel(model, doc, fields, userProvidedField
     discriminatorMapping.key :
     null;
 
+  const _opts = {
+    skipId: true,
+    isNew: false,
+    willInit: true
+  };
+  if (options?.defaults != null) {
+    _opts.defaults = options.defaults;
+  }
+  if (options?.strict != null) {
+    _opts.strict = options.strict;
+  }
+
   const value = doc[key];
   if (key && value && model.discriminators) {
     const discriminator = model.discriminators[value] || getDiscriminatorByValue(model.discriminators, value);
     if (discriminator) {
       const _fields = clone(userProvidedFields);
       exports.applyPaths(_fields, discriminator.schema);
-      const _opts = { strict: options?.strict };
+
       return new discriminator(undefined, _fields, _opts);
     }
   }
 
-  const _opts = {
-    skipId: true,
-    isNew: false,
-    willInit: true
-  };
-  if (options != null && 'defaults' in options) {
-    _opts.defaults = options.defaults;
-  }
-  if (options != null && 'strict' in options) {
-    _opts.strict = options.strict;
-  }
   return new model(undefined, fields, _opts);
 };
 

package/lib/schema.js

@@ -3089,8 +3089,27 @@ function isArrayFilter(piece) {
 
 Schema.prototype._preCompile = function _preCompile() {
   this.plugin(idGetter, { deduplicate: true });
+  _precomputeOptimisticConcurrency(this);
 };
 
+/*!
+ * Build precomputed sets for optimisticConcurrency include/exclude,
+ * expanding user-specified paths to include all schema subpaths so that
+ * lookups at save time are a simple `Set.has()`.
+ */
+
+function _precomputeOptimisticConcurrency(schema) {
+  const opt = schema.options.optimisticConcurrency;
+  if (!opt || opt === true) {
+    return;
+  }
+  if (Array.isArray(opt)) {
+    schema.options._optimisticConcurrencySet = new Set(opt);
+  } else if (Array.isArray(opt.exclude)) {
+    schema.options._optimisticConcurrencyExcludeSet = new Set(opt.exclude);
+  }
+}
+
 /**
  * Returns a JSON schema representation of this Schema.
  *

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "mongoose",
   "description": "Mongoose MongoDB ODM",
-  "version": "9.4.0",
+  "version": "9.5.0",
   "author": "Guillermo Rauch <guillermo@learnboost.com>",
   "keywords": [
     "mongodb",
@@ -20,7 +20,7 @@
   "type": "commonjs",
   "license": "MIT",
   "dependencies": {
-    "kareem": "3.2.0",
+    "kareem": "3.3.0",
     "mongodb": "~7.1",
     "mpath": "0.9.0",
     "mquery": "6.0.0",
@@ -49,8 +49,8 @@
     "linkinator": "7.x",
     "lodash.isequal": "4.5.0",
     "lodash.isequalwith": "4.4.0",
-    "markdownlint-cli2": "^0.21.0",
-    "marked": "15.x",
+    "markdownlint-cli2": "0.22.0",
+    "marked": "17.0.5",
     "mkdirp": "^3.0.1",
     "mocha": "11.7.5",
     "moment": "2.30.1",
@@ -58,9 +58,9 @@
     "mongodb-memory-server": "11.0.1",
     "mongodb-runner": "^6.0.0",
     "ncp": "^2.0.0",
-    "pug": "3.0.3",
-    "sinon": "21.0.1",
-    "tstyche": "^7.0.0-rc.0",
+    "pug": "3.0.4",
+    "sinon": "21.0.3",
+    "tstyche": "^7.0.0",
     "typescript": "5.9.3",
     "typescript-eslint": "^8.31.1",
     "uuid": "11.1.0"

package/types/mongooseoptions.d.ts

@@ -82,7 +82,7 @@ declare module 'mongoose' {
      */
     debug?:
     | boolean
-    | { color?: boolean; shell?: boolean; }
+    | { color?: boolean; shell?: boolean; timestamp?: boolean; }
     | stream.Writable
     | ((collectionName: string, methodName: string, ...methodArgs: any[]) => void);
 

package/types/query.d.ts

@@ -51,6 +51,7 @@ declare module 'mongoose' {
   type QueryFilter<T> = IsItRecordAndNotAny<T> extends true ? _QueryFilter<WithLevel1NestedPaths<T>> : _QueryFilterLooseId<Record<string, any>>;
 
   type MongooseBaseQueryOptionKeys =
+    | 'cloneUpdate'
     | 'context'
     | 'middleware'
     | 'multipleCastError'
@@ -108,6 +109,10 @@ declare module 'mongoose' {
     collation?: mongodb.CollationOptions;
     comment?: any;
     context?: string;
+    /**
+     * If `false`, Mongoose will not clone the update before executing the query.
+     */
+    cloneUpdate?: boolean;
     explain?: mongodb.ExplainVerbosityLike;
     fields?: any | string;
     hint?: mongodb.Hint;
@@ -129,6 +134,11 @@ declare module 'mongoose' {
      */
     new?: boolean;
 
+    /**
+     * If `false`, skip applying default schema values to the returned document(s).
+     * @default true
+     */
+    defaults?: boolean;
     overwriteDiscriminatorKey?: boolean;
     /**
      * Mongoose removes updated immutable properties from `update` by default (excluding $setOnInsert).
@@ -884,7 +894,7 @@ declare module 'mongoose' {
     setQuery(val: QueryFilter<RawDocType> | null): void;
     setQuery(val: Query<any, any> | null): void;
 
-    setUpdate(update: UpdateQuery<RawDocType> | UpdateWithAggregationPipeline): void;
+    setUpdate(update: UpdateQuery<RawDocType> | UpdateWithAggregationPipeline, cloneUpdate?: boolean): void;
 
     /** Specifies an `$size` query condition. When called with one argument, the most recent path passed to `where()` is used. */
     size(path: string, val: number): this;