mongoose 9.9.1 → 9.9.3

package/lib/cast/double.js

@@ -30,6 +30,12 @@ module.exports = function castDouble(val) {
       assert.ok(false);
     }
   } else if (typeof val === 'object') {
+    if (Array.isArray(val)) {
+      // `[5].valueOf()` returns the array itself, so without this guard a
+      // single-element or empty array would fall through to `Number(tempVal)`
+      // below and silently coerce instead of throwing.
+      assert.ok(false);
+    }
     const tempVal = val.valueOf() ?? val.toString();
     // ex: { a: 'im an object, valueOf: () => 'helloworld' } // throw an error
     if (typeof tempVal === 'string') {

package/lib/cast/int32.js

@@ -20,6 +20,12 @@ module.exports = function castInt32(val) {
   if (val === '') {
     return null;
   }
+  if (Array.isArray(val)) {
+    // `Number([5])` is `5` and `Number([])` is `0`, so without this guard a
+    // single-element or empty array would silently coerce instead of throwing,
+    // unlike every other array input and unlike `castNumber()`'s own guard.
+    assert.ok(false);
+  }
 
   const coercedVal = isBsonType(val, 'Long') ? val.toNumber() : Number(val);
 

package/lib/connection.js

@@ -778,6 +778,9 @@ function _resetSessionDocuments(session) {
     if (Object.hasOwn(state, 'versionKey')) {
       doc.set(doc.schema.options.versionKey, state.versionKey);
     }
+    if (Object.hasOwn(state, 'isDeleted')) {
+      doc.$isDeleted(state.isDeleted);
+    }
 
     for (const path of state.modifiedPaths) {
       doc.$__.activePaths.modify(path);

package/lib/document.js

@@ -14,6 +14,7 @@ const ModifiedPathsSnapshot = require('./modifiedPathsSnapshot');
 const ObjectExpectedError = require('./error/objectExpected');
 const ObjectParameterError = require('./error/objectParameter');
 const ParallelValidateError = require('./error/parallelValidate');
+const PathTrie = require('./helpers/pathTrie');
 const Schema = require('./schema');
 const StrictModeError = require('./error/strict');
 const ValidationError = require('./error/validation');
@@ -31,7 +32,6 @@ const getEmbeddedDiscriminatorPath = require('./helpers/document/getEmbeddedDisc
 const getKeysInSchemaOrder = require('./helpers/schema/getKeysInSchemaOrder');
 const getSubdocumentStrictValue = require('./helpers/schema/getSubdocumentStrictValue');
 const handleSpreadDoc = require('./helpers/document/handleSpreadDoc');
-const isBsonType = require('./helpers/isBsonType');
 const isDefiningProjection = require('./helpers/projection/isDefiningProjection');
 const isExclusive = require('./helpers/projection/isExclusive');
 const isPathExcluded = require('./helpers/projection/isPathExcluded');
@@ -2570,25 +2570,15 @@ Document.prototype.isSelected = function isSelected(path) {
     return path.some(p => this.$__isSelected(p));
   }
 
-  const paths = Object.keys(this.$__.selected);
-  let inclusive = null;
+  const index = _getProjectionIndex(this);
+  const paths = index.paths;
+  const inclusive = index.inclusive;
 
-  if (paths.length === 1 && paths[0] === '_id') {
+  if (index.onlyId) {
     // only _id was selected.
     return this.$__.selected._id === 0;
   }
 
-  for (const cur of paths) {
-    if (cur === '_id') {
-      continue;
-    }
-    if (!isDefiningProjection(this.$__.selected[cur])) {
-      continue;
-    }
-    inclusive = !!this.$__.selected[cur];
-    break;
-  }
-
   if (inclusive === null) {
     return true;
   }
@@ -2599,6 +2589,25 @@ Document.prototype.isSelected = function isSelected(path) {
 
   const pathHasDot = path.indexOf('.') !== -1;
 
+  if (!index.hasNestedKey) {
+    // No projection key is nested, so no key can start with `path + '.'` and
+    // only the "is an ancestor of `path` projected?" check below can match.
+    // Every ancestor that matches returns the same value, so we can walk
+    // `path`'s ancestors instead of scanning every projection key. This keeps
+    // `isSelected()` O(depth of path) rather than O(number of projected paths),
+    // which matters because `toObject({ getters: true })` calls this once per
+    // schema path. Re: gh-16373
+    if (pathHasDot) {
+      for (let dot = path.indexOf('.'); dot !== -1; dot = path.indexOf('.', dot + 1)) {
+        const ancestor = path.slice(0, dot);
+        if (ancestor !== '_id' && Object.hasOwn(this.$__.selected, ancestor)) {
+          return inclusive;
+        }
+      }
+    }
+    return !inclusive;
+  }
+
   for (const cur of paths) {
     if (cur === '_id') {
       continue;
@@ -2615,6 +2624,43 @@ Document.prototype.isSelected = function isSelected(path) {
   return !inclusive;
 };
 
+/*!
+ * Computes and caches the derived properties of `doc.$__.selected` that
+ * `isSelected()` and `isDirectSelected()` would otherwise recompute on every
+ * call. `$__.selected` is assigned once in the Document constructor and never
+ * mutated afterwards, so this can safely be cached for the document's lifetime.
+ */
+
+function _getProjectionIndex(doc) {
+  if (doc.$__.selectedIndex !== undefined) {
+    return doc.$__.selectedIndex;
+  }
+
+  const selected = doc.$__.selected;
+  const paths = Object.keys(selected);
+  let inclusive = null;
+  let hasNestedKey = false;
+
+  for (const cur of paths) {
+    if (cur === '_id') {
+      continue;
+    }
+    if (cur.indexOf('.') !== -1) {
+      hasNestedKey = true;
+    }
+    if (inclusive === null && isDefiningProjection(selected[cur])) {
+      inclusive = !!selected[cur];
+    }
+  }
+
+  return (doc.$__.selectedIndex = {
+    paths,
+    inclusive,
+    hasNestedKey,
+    onlyId: paths.length === 1 && paths[0] === '_id'
+  });
+}
+
 Document.prototype.$__isSelected = Document.prototype.isSelected;
 
 /**
@@ -2650,34 +2696,22 @@ Document.prototype.isDirectSelected = function isDirectSelected(path) {
     return path.some(p => this.isDirectSelected(p));
   }
 
-  const paths = Object.keys(this.$__.selected);
-  let inclusive = null;
+  const index = _getProjectionIndex(this);
 
-  if (paths.length === 1 && paths[0] === '_id') {
+  if (index.onlyId) {
     // only _id was selected.
     return this.$__.selected._id === 0;
   }
 
-  for (const cur of paths) {
-    if (cur === '_id') {
-      continue;
-    }
-    if (!isDefiningProjection(this.$__.selected[cur])) {
-      continue;
-    }
-    inclusive = !!this.$__.selected[cur];
-    break;
-  }
-
-  if (inclusive === null) {
+  if (index.inclusive === null) {
     return true;
   }
 
   if (Object.hasOwn(this.$__.selected, path)) {
-    return inclusive;
+    return index.inclusive;
   }
 
-  return !inclusive;
+  return !index.inclusive;
 };
 
 /**
@@ -5242,26 +5276,26 @@ Document.prototype.$__delta = function $__delta(pathsToSave, pathsToSaveSet) {
   const optimisticConcurrency = this.$__schema.options.optimisticConcurrency;
   if (optimisticConcurrency) {
     if (Array.isArray(optimisticConcurrency)) {
-      if (!this.$__schema.options._optimisticConcurrencySet) {
-        this.$__schema.options._optimisticConcurrencySet = new Set(optimisticConcurrency);
+      if (!this.$__schema.options._optimisticConcurrencyTrie) {
+        this.$__schema.options._optimisticConcurrencyTrie = new PathTrie(optimisticConcurrency);
       }
-      const optimisticConcurrencySet = this.$__schema.options._optimisticConcurrencySet;
+      const optimisticConcurrencyTrie = this.$__schema.options._optimisticConcurrencyTrie;
       const modPaths = this.directModifiedPaths();
       const hasRelevantModPaths = pathsToSave == null ?
-        modPaths.find(path => _pathOverlapsSet(path, optimisticConcurrencySet)) :
-        modPaths.find(path => _pathOverlapsSet(path, optimisticConcurrencySet) && isInPathsToSave(path, pathsToSaveSet, pathsToSave));
+        modPaths.find(path => optimisticConcurrencyTrie.overlapsPath(path.indexOf('.') === -1 ? path : path.split('.'))) :
+        modPaths.find(path => optimisticConcurrencyTrie.overlapsPath(path.indexOf('.') === -1 ? path : path.split('.')) && isInPathsToSave(path, pathsToSaveSet, pathsToSave));
       if (hasRelevantModPaths) {
         this.$__.version = dirty.length ? VERSION_ALL : VERSION_WHERE;
       }
     } else if (Array.isArray(optimisticConcurrency?.exclude)) {
-      if (!this.$__schema.options._optimisticConcurrencyExcludeSet) {
-        this.$__schema.options._optimisticConcurrencyExcludeSet = new Set(optimisticConcurrency.exclude);
+      if (!this.$__schema.options._optimisticConcurrencyExcludeTrie) {
+        this.$__schema.options._optimisticConcurrencyExcludeTrie = new PathTrie(optimisticConcurrency.exclude);
       }
-      const optimisticConcurrencyExcludeSet = this.$__schema.options._optimisticConcurrencyExcludeSet;
+      const optimisticConcurrencyExcludeTrie = this.$__schema.options._optimisticConcurrencyExcludeTrie;
       const modPaths = this.directModifiedPaths();
       const hasRelevantModPaths = pathsToSave == null ?
-        modPaths.find(path => !_pathOrAncestorInSet(path, optimisticConcurrencyExcludeSet)) :
-        modPaths.find(path => !_pathOrAncestorInSet(path, optimisticConcurrencyExcludeSet) && isInPathsToSave(path, pathsToSaveSet, pathsToSave));
+        modPaths.find(path => !optimisticConcurrencyExcludeTrie.matchesPathOrAncestor(path.indexOf('.') === -1 ? path : path.split('.'))) :
+        modPaths.find(path => !optimisticConcurrencyExcludeTrie.matchesPathOrAncestor(path.indexOf('.') === -1 ? path : path.split('.')) && isInPathsToSave(path, pathsToSaveSet, pathsToSave));
       if (hasRelevantModPaths) {
         this.$__.version = dirty.length ? VERSION_ALL : VERSION_WHERE;
       }
@@ -5755,11 +5789,21 @@ Document.prototype.$__hasOnlyPrimitiveValues = function $__hasOnlyPrimitiveValue
   const doc = this._doc;
   for (const key in doc) {
     const v = doc[key];
-    if (v == null
-      || typeof v !== 'object'
-      || (utils.isNativeObject(v) && !Array.isArray(v))
-      || isBsonType(v, 'ObjectId')
-      || isBsonType(v, 'Decimal128')) {
+    if (v == null || typeof v !== 'object') {
+      continue;
+    }
+    // Equivalent to `isNativeObject(v) && !Array.isArray(v)`, plus the
+    // `isBsonType()` checks below, but without the helper calls or the
+    // repeated `Array.isArray()`. This runs for every key of every document
+    // that `toObject()` touches, so the call overhead is measurable.
+    if (Array.isArray(v)) {
+      return false;
+    }
+    if (v instanceof Date || v instanceof Boolean || v instanceof Number || v instanceof String) {
+      continue;
+    }
+    const bsontype = v._bsontype;
+    if (bsontype === 'ObjectId' || bsontype === 'Decimal128') {
       continue;
     }
     return false;
@@ -5787,45 +5831,6 @@ Document.prototype._applyVersionIncrement = function _applyVersionIncrement() {
  * Module exports.
  */
 
-/*!
- * Check if `path` or any of its ancestor paths exist in `pathSet`.
- * For example:
- *   _pathOrAncestorInSet('profile.firstName', Set(['profile'])) === true
- *   _pathOrAncestorInSet('profile', Set(['profile.firstName'])) === false
- */
-function _pathOrAncestorInSet(path, pathSet) {
-  if (pathSet.has(path)) {
-    return true;
-  }
-  let idx = path.indexOf('.');
-  while (idx !== -1) {
-    if (pathSet.has(path.substring(0, idx))) {
-      return true;
-    }
-    idx = path.indexOf('.', idx + 1);
-  }
-  return false;
-}
-
-/*!
- * Check if `path`, any of its ancestor paths, or any of its descendant paths
- * exist in `pathSet`.
- * For example:
- *   _pathOverlapsSet('profile.firstName', Set(['profile'])) === true
- *   _pathOverlapsSet('profile', Set(['profile.firstName'])) === true
- */
-function _pathOverlapsSet(path, pathSet) {
-  if (_pathOrAncestorInSet(path, pathSet)) {
-    return true;
-  }
-  for (const p of pathSet) {
-    if (p.length > path.length + 1 && p[path.length] === '.' && p.slice(0, path.length) === path) {
-      return true;
-    }
-  }
-  return false;
-}
-
 Document.VERSION_WHERE = VERSION_WHERE;
 Document.VERSION_INC = VERSION_INC;
 Document.VERSION_ALL = VERSION_ALL;

package/lib/helpers/pathTrie.js

@@ -0,0 +1,167 @@
+'use strict';
+
+const wildcardSegment = '$*';
+const numericSegmentRegex = /^\d+$/;
+
+class PathTrieNode {
+  constructor() {
+    this.children = new Map();
+    this.terminal = false;
+    this.hasWildcard = false;
+  }
+}
+
+/**
+ * Trie of dotted paths for efficient path matching. Supports the map wildcard
+ * segment `$*`, which matches any single segment. For example, a trie
+ * containing `settings.$*` matches `settings.theme` but not `settings` or
+ * `profile.theme`. In array lookups, numeric segments like array indexes are
+ * ignorable: a trie containing `comments.text` matches `comments.0.text`.
+ * Single-segment string lookups skip the numeric check entirely.
+ *
+ * @api private
+ */
+
+class PathTrie {
+  /**
+   * @param {string[]} [paths] paths to add to the trie
+   */
+  constructor(paths) {
+    this.root = new PathTrieNode();
+    if (paths != null) {
+      for (const path of paths) {
+        this.add(path);
+      }
+    }
+  }
+
+  /**
+   * Add a dotted path, like `settings.$*` or `profile.firstName`, to the trie.
+   *
+   * @param {string} path
+   */
+
+  add(path) {
+    if (path.indexOf('.') === -1) {
+      this._addSegment(this.root, path).terminal = true;
+      return;
+    }
+    let node = this.root;
+    for (const segment of path.split('.')) {
+      node = this._addSegment(node, segment);
+    }
+    node.terminal = true;
+  }
+
+  /**
+   * @param {PathTrieNode} node
+   * @param {string} segment
+   */
+  _addSegment(node, segment) {
+    let child = node.children.get(segment);
+    if (child == null) {
+      child = new PathTrieNode();
+      node.children.set(segment, child);
+      if (segment === wildcardSegment) {
+        node.hasWildcard = true;
+      }
+    }
+    return child;
+  }
+
+  /**
+   * Check if `path` or any of its ancestor paths exist in the trie. `path` is
+   * either a single segment string or a pre-split array of segments — lookups
+   * never split, callers are responsible for splitting dotted paths.
+   * For example, with a trie containing 'profile':
+   *   matchesPathOrAncestor(['profile', 'firstName']) === true
+   *   matchesPathOrAncestor('profile') === true
+   * But with a trie containing 'profile.firstName':
+   *   matchesPathOrAncestor('profile') === false
+   *
+   * @param {string|string[]} path
+   */
+
+  matchesPathOrAncestor(path) {
+    return this._walk(path) === true;
+  }
+
+  /**
+   * Check if `path`, any of its ancestor paths, or any of its descendant paths
+   * exist in the trie. `path` is either a single segment string or a pre-split
+   * array of segments — lookups never split, callers are responsible for
+   * splitting dotted paths. For example:
+   *   new PathTrie(['profile']).overlapsPath(['profile', 'firstName']) === true
+   *   new PathTrie(['profile.firstName']).overlapsPath('profile') === true
+   *
+   * @param {string|string[]} path
+   */
+
+  overlapsPath(path) {
+    return this._walk(path) !== false;
+  }
+
+  /**
+   * Walk `path` through the trie. `path` is assumed to be pre-split - if the
+   * path has multiple segments, pass in an array of strings. Returns `true` if
+   * a terminal node was found at `path` or one of its ancestors, `false` if the
+   * walk dead-ended, and the array of reached nodes if `path` is a strict prefix
+   * of entries in the trie.
+   *
+   * @param {string|string[]} path
+   */
+
+  _walk(path) {
+    if (typeof path === 'string') {
+      const next = [];
+      const literal = this.root.children.get(path);
+      if (literal != null) {
+        if (literal.terminal) {
+          return true;
+        }
+        next.push(literal);
+      }
+      if (this.root.hasWildcard) {
+        const wildcard = this.root.children.get(wildcardSegment);
+        if (wildcard.terminal) {
+          return true;
+        }
+        next.push(wildcard);
+      }
+      return next.length === 0 ? false : next;
+    }
+    let nodes = [this.root];
+    for (const segment of path) {
+      const next = [];
+      const isNumericSegment = numericSegmentRegex.test(segment);
+      for (const node of nodes) {
+        if (isNumericSegment) {
+          // Numeric segments like array indexes are ignorable: `comments.text`
+          // in the trie matches the modified path `comments.0.text`.
+          next.push(node);
+        }
+        const literal = node.children.get(segment);
+        if (literal != null) {
+          if (literal.terminal) {
+            return true;
+          }
+          next.push(literal);
+        }
+        if (node.hasWildcard) {
+          const wildcard = node.children.get(wildcardSegment);
+          if (wildcard.terminal) {
+            return true;
+          }
+          next.push(wildcard);
+        }
+      }
+      if (next.length === 0) {
+        return false;
+      }
+      nodes = next;
+    }
+    return nodes;
+  }
+}
+
+module.exports = PathTrie;

package/lib/internal.js

@@ -17,6 +17,8 @@ InternalCache.prototype.strictMode = true;
 
 InternalCache.prototype.fullPath = undefined;
 InternalCache.prototype.selected = undefined;
+// Lazily computed index over `selected`, see `_getProjectionIndex()` in document.js
+InternalCache.prototype.selectedIndex = undefined;
 InternalCache.prototype.shardval = undefined;
 InternalCache.prototype.saveError = undefined;
 InternalCache.prototype.validationError = undefined;

package/lib/model.js

@@ -3622,6 +3622,15 @@ Model.bulkSave = async function bulkSave(documents, options) {
     }
   }
 
+  // Associate the documents with the session like `save()` does, so built-in
+  // `pre('save')` middleware like `trackTransaction` can snapshot document
+  // state and restore it between transaction retries. Re: gh-16432
+  if (Object.hasOwn(options, 'session')) {
+    for (const document of documents) {
+      document.$session(options.session);
+    }
+  }
+
   await Promise.all(documents.map(doc => buildPreSavePromise(doc, options)));
 
   const writeOperations = this.buildBulkWriteOperations(documents, options);

package/lib/plugins/trackTransaction.js

@@ -7,31 +7,45 @@ const utils = require('../utils');
 
 module.exports = function trackTransaction(schema) {
   schema.pre('save', trackTransactionPreSave);
+  schema.pre('deleteOne', { document: true, query: false }, trackTransactionPreDeleteOne);
 };
 
 function trackTransactionPreSave() {
-  const session = this.$session();
+  _getInitialState(this);
+}
+
+function trackTransactionPreDeleteOne() {
+  const initialState = _getInitialState(this);
+  if (initialState != null && !Object.hasOwn(initialState, 'isDeleted')) {
+    initialState.isDeleted = this.$isDeleted();
+  }
+}
+
+function _getInitialState(doc) {
+  const session = doc.$session();
   if (session == null) {
-    return;
+    return null;
   }
   if (session.transaction == null || session[sessionNewDocuments] == null) {
-    return;
+    return null;
   }
 
-  if (!session[sessionNewDocuments].has(this)) {
+  if (!session[sessionNewDocuments].has(doc)) {
     const initialState = {};
-    if (this.isNew) {
+    if (doc.isNew) {
       initialState.isNew = true;
     }
-    if (this.$__schema.options.versionKey) {
-      initialState.versionKey = this.get(this.$__schema.options.versionKey);
+    if (doc.$__schema.options.versionKey) {
+      initialState.versionKey = doc.get(doc.$__schema.options.versionKey);
     }
 
-    initialState.modifiedPaths = new Set(Object.keys(this.$__.activePaths.getStatePaths('modify')));
-    initialState.atomics = _getAtomics(this);
+    initialState.modifiedPaths = new Set(Object.keys(doc.$__.activePaths.getStatePaths('modify')));
+    initialState.atomics = _getAtomics(doc);
 
-    session[sessionNewDocuments].set(this, initialState);
+    session[sessionNewDocuments].set(doc, initialState);
   }
+
+  return session[sessionNewDocuments].get(doc);
 }
 
 function _getAtomics(doc, previous) {
@@ -87,3 +101,4 @@ function mergeAtomics(destination, source) {
 }
 
 trackTransactionPreSave[symbols.builtInMiddleware] = true;
+trackTransactionPreDeleteOne[symbols.builtInMiddleware] = true;

package/lib/query.js

@@ -2849,12 +2849,7 @@ Query.prototype.findOne = function(conditions, projection, options) {
 
 Query.prototype._countDocuments = async function _countDocuments() {
   this._applyTranslateAliases();
-
-  try {
-    this.cast(this.model);
-  } catch (err) {
-    this.error(err);
-  }
+  this._castConditions();
 
   if (this.error()) {
     throw this.error();
@@ -5377,11 +5372,17 @@ Query.prototype.cursor = function cursor(opts) {
   }
 
   try {
-    this.cast(this.model);
+    this._castConditions();
   } catch (err) {
+    // `_castConditions()` reports cast errors on the query, but `sanitizeFilter`
+    // throws for filters it refuses outright, like `$where`.
     return (new QueryCursor(this))._markError(err);
   }
 
+  if (this.error()) {
+    return (new QueryCursor(this))._markError(this.error());
+  }
+
   return new QueryCursor(this);
 };
 

package/lib/schema/number.js

@@ -498,7 +498,7 @@ SchemaNumber.prototype.castForQuery = function($conditional, val, context) {
  */
 
 SchemaNumber.prototype.toJSONSchema = function toJSONSchema(options) {
-  return this._createJSONSchemaTypeDefinition('number', 'number', options);
+  return this._addJSONSchemaEnum(this._createJSONSchemaTypeDefinition('number', 'number', options));
 };
 
 /*!

package/lib/schema/string.js

@@ -719,7 +719,7 @@ SchemaString.prototype.castForQuery = function($conditional, val, context) {
  */
 
 SchemaString.prototype.toJSONSchema = function toJSONSchema(options) {
-  return this._createJSONSchemaTypeDefinition('string', 'string', options);
+  return this._addJSONSchemaEnum(this._createJSONSchemaTypeDefinition('string', 'string', options));
 };
 
 SchemaString.prototype.autoEncryptionType = function autoEncryptionType() {

package/lib/schema.js

@@ -7,6 +7,7 @@
 const EventEmitter = require('events').EventEmitter;
 const Kareem = require('kareem');
 const MongooseError = require('./error/mongooseError');
+const PathTrie = require('./helpers/pathTrie');
 const SchemaType = require('./schemaType');
 const SchemaTypeOptions = require('./options/schemaTypeOptions');
 const VirtualOptions = require('./options/virtualOptions');
@@ -79,7 +80,7 @@ const numberRE = /^\d+$/;
  * - [validateBeforeSave](https://mongoosejs.com/docs/guide.html#validateBeforeSave) - bool - defaults to `true`
  * - [validateModifiedOnly](https://mongoosejs.com/docs/api/document.html#Document.prototype.validate()) - bool - defaults to `false`
  * - [versionKey](https://mongoosejs.com/docs/guide.html#versionKey): string or object - defaults to "__v"
- * - [optimisticConcurrency](https://mongoosejs.com/docs/guide.html#optimisticConcurrency): bool or string[] or { exclude: string[] } - defaults to false. Set to true to enable [optimistic concurrency](https://thecodebarbarian.com/whats-new-in-mongoose-5-10-optimistic-concurrency.html) for all fields. Set to a string array to enable optimistic concurrency only for the specified fields; note that this **replaces** the default array versioning behavior. Set to `{ exclude: string[] }` to enable optimistic concurrency for all fields except the specified ones; this also replaces the default array versioning.
+ * - [optimisticConcurrency](https://mongoosejs.com/docs/guide.html#optimisticConcurrency): bool or string[] or { exclude: string[] } - defaults to false. Set to true to enable [optimistic concurrency](https://thecodebarbarian.com/whats-new-in-mongoose-5-10-optimistic-concurrency.html) for all fields. Set to a string array to enable optimistic concurrency only for the specified fields; note that this **replaces** the default array versioning behavior. Set to `{ exclude: string[] }` to enable optimistic concurrency for all fields except the specified ones; this also replaces the default array versioning. Paths may include the map wildcard `$*`, like `'settings.$*'`, to match all keys of a map.
  * - [collation](https://mongoosejs.com/docs/guide.html#collation): object - defaults to null (which means use no collation)
  * - [timeseries](https://mongoosejs.com/docs/guide.html#timeseries): object - defaults to null (which means this schema's collection won't be a timeseries collection)
  * - [selectPopulatedPaths](https://mongoosejs.com/docs/guide.html#selectPopulatedPaths): boolean - defaults to `true`
@@ -3142,9 +3143,9 @@ Schema.prototype._preCompile = function _preCompile() {
 };
 
 /*!
- * Build precomputed sets for optimisticConcurrency include/exclude,
- * expanding user-specified paths to include all schema subpaths so that
- * lookups at save time are a simple `Set.has()`.
+ * Build precomputed path tries for optimisticConcurrency include/exclude so
+ * that lookups at save time are a single trie walk that handles nested paths
+ * and map wildcards like `settings.$*`.
  */
 
 function _precomputeOptimisticConcurrency(schema) {
@@ -3153,9 +3154,9 @@ function _precomputeOptimisticConcurrency(schema) {
     return;
   }
   if (Array.isArray(opt)) {
-    schema.options._optimisticConcurrencySet = new Set(opt);
+    schema.options._optimisticConcurrencyTrie = new PathTrie(opt);
   } else if (Array.isArray(opt.exclude)) {
-    schema.options._optimisticConcurrencyExcludeSet = new Set(opt.exclude);
+    schema.options._optimisticConcurrencyExcludeTrie = new PathTrie(opt.exclude);
   }
 }
 
@@ -3215,27 +3216,19 @@ Schema.prototype.toJSONSchema = function toJSONSchema(options) {
     }
 
     const lastSubpath = schemaType._presplitPath[schemaType._presplitPath.length - 1];
-    let isRequired = false;
     if (path === '_id') {
       if (!jsonSchemaForPath.required) {
         jsonSchemaForPath.required = [];
       }
       jsonSchemaForPath.required.push('_id');
-      isRequired = true;
     } else if (schemaType.options.required && typeof schemaType.options.required !== 'function') {
       if (!jsonSchemaForPath.required) {
         jsonSchemaForPath.required = [];
       }
       // Only `required: true` paths are required, conditional required is not required
       jsonSchemaForPath.required.push(lastSubpath);
-      isRequired = true;
     }
     jsonSchemaForPath.properties[lastSubpath] = schemaType.toJSONSchema(options);
-    if (schemaType.options.enum) {
-      jsonSchemaForPath.properties[lastSubpath].enum = isRequired
-        ? schemaType.options.enum
-        : [...schemaType.options.enum, null];
-    }
   }
 
   // Otherwise MongoDB errors with "$jsonSchema keyword 'required' cannot be an empty array"

package/lib/schemaType.js

@@ -215,6 +215,27 @@ SchemaType.prototype._createJSONSchemaTypeDefinition = function _createJSONSchem
   return { type: [type, 'null'] };
 };
 
+/**
+ * Helper for adding this SchemaType's enum values to a JSON schema type definition.
+ * Reads `enumValues` rather than `options.enum` because `enum` also accepts an object.
+ *
+ * @param {object} definition the type definition from `_createJSONSchemaTypeDefinition()`
+ * @returns {object} the same definition
+ * @api private
+ */
+
+SchemaType.prototype._addJSONSchemaEnum = function _addJSONSchemaEnum(definition) {
+  if (!Array.isArray(this.enumValues) || this.enumValues.length === 0) {
+    return definition;
+  }
+
+  // The enum validator allows nullish values, so allow `null` wherever the type does.
+  const allowsNull = Array.isArray(definition.type ?? definition.bsonType);
+  definition.enum = allowsNull ? [...this.enumValues, null] : [...this.enumValues];
+
+  return definition;
+};
+
 /**
  * The validators that Mongoose should run to validate properties at this SchemaType's path.
  *

package/lib/utils.js

@@ -421,26 +421,16 @@ exports.isPOJO = require('./helpers/isPOJO');
 
 exports.isNonBuiltinObject = function isNonBuiltinObject(val) {
   return typeof val === 'object' &&
-    !exports.isNativeObject(val) &&
+    !Array.isArray(val) &&
+    !(val instanceof Date) &&
+    !(val instanceof Boolean) &&
+    !(val instanceof Number) &&
+    !(val instanceof String) &&
     !exports.isMongooseType(val) &&
     !(val instanceof UUID) &&
     val != null;
 };
 
-/**
- * Determines if `obj` is a built-in object like an array, date, boolean,
- * etc.
- * @param {any} arg
- */
-
-exports.isNativeObject = function(arg) {
-  return Array.isArray(arg) ||
-    arg instanceof Date ||
-    arg instanceof Boolean ||
-    arg instanceof Number ||
-    arg instanceof String;
-};
-
 /**
  * Determines if `val` is an object that has no own keys
  * @param {any} val

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "mongoose",
   "description": "Mongoose MongoDB ODM",
-  "version": "9.9.1",
+  "version": "9.9.3",
   "author": "Guillermo Rauch <guillermo@learnboost.com>",
   "keywords": [
     "mongodb",
@@ -29,7 +29,7 @@
     "sift": "17.1.3"
   },
   "devDependencies": {
-    "@ark/attest": "0.56.1",
+    "@ark/attest": "0.56.3",
     "@eslint/js": "^9.39.3",
     "@mongodb-js/mongodb-downloader": "^1.0.0",
     "@types/node": "^20.19.0",
@@ -37,30 +37,30 @@
     "acquit-ignore": "0.2.2",
     "acquit-require": "0.1.1",
     "ajv": "8.20.0",
-    "c8": "11.0.0",
+    "c8": "12.0.0",
     "cheerio": "1.2.0",
     "dox": "1.0.0",
-    "eslint": "10.6.0",
+    "eslint": "10.8.0",
     "eslint-plugin-mocha-no-only": "1.2.0",
     "express": "5.2.1",
-    "fs-extra": "~11.3.0",
+    "fs-extra": "~11.4.0",
     "glob": "^13.0.6",
     "globals": "^17.4.0",
     "highlight.js": "11.11.1",
-    "linkinator": "7.x",
+    "linkinator": "8.x",
     "lodash.isequal": "4.5.0",
     "lodash.isequalwith": "4.4.0",
-    "markdownlint-cli2": "0.22.1",
-    "marked": "18.0.5",
+    "markdownlint-cli2": "0.23.2",
+    "marked": "18.0.7",
     "mkdirp": "^3.0.1",
-    "mocha": "12.0.0-beta-10",
+    "mocha": "12.0.0-rc.5",
     "moment": "2.30.1",
     "mongodb-client-encryption": "^7.2.0",
     "mongodb-memory-server": "11.2.0",
     "mongodb-runner": "^6.0.0",
     "ncp": "^2.0.0",
     "pug": "3.0.4",
-    "sinon": "22.0.0",
+    "sinon": "22.1.0",
     "tstyche": "^7.0.0",
     "typescript": "5.9.3",
     "typescript-eslint": "^8.31.1",
@@ -100,7 +100,7 @@
     "publish-7x": "npm publish --tag 7x",
     "create-separate-require-instance": "rm -rf ./node_modules/mongoose-separate-require-instance && node ./scripts/create-tarball && tar -xzf mongoose.tgz -C ./node_modules && mv ./node_modules/package ./node_modules/mongoose-separate-require-instance",
     "test": "mocha --exit --ignore \"test/encryption/**/*.test.js\" \"./test/**/*.test.js\"",
-    "test:ci": "npm run test -- --reporter min",
+    "test:ci": "npm run test -- --reporter min --timeout 10000",
     "test-deno": "deno run --allow-env --allow-read --allow-net --allow-run --allow-sys --allow-write ./test/deno.mjs",
     "test-deno:ci": "npm run test-deno -- --reporter min",
     "test-rs": "START_REPLICA_SET=1 mocha --timeout 30000 --exit --ignore \"test/encryption/**/*.test.js\" \"./test/**/*.test.js\"",

package/types/document.d.ts

@@ -289,9 +289,9 @@ declare module 'mongoose' {
     ): ToObjectReturnType<PopulatedRawDocType, TVirtuals, O, TSchemaOptions>;
     toJSON<PopulatedRawDocType>(
       this: PopulatedDocumentMarker<PopulatedRawDocType, any>
-    ): Default__v<Require_id<PopulatedRawDocType>, TSchemaOptions>;
+    ): DefaultToObjectReturnType<PopulatedRawDocType, TVirtuals, TSchemaOptions, 'toJSON'>;
     toJSON<O extends ToObjectOptions>(options: O): ToObjectReturnType<DocType, TVirtuals, O, TSchemaOptions>;
-    toJSON(options?: ToObjectOptions): Default__v<Require_id<DocType>, TSchemaOptions>;
+    toJSON(options?: ToObjectOptions): DefaultToObjectReturnType<DocType, TVirtuals, TSchemaOptions, 'toJSON'>;
     toJSON<T>(options?: ToObjectOptions): Default__v<Require_id<T>, ResolveSchemaOptions<TSchemaOptions>>;
 
     /** Converts this document into a plain-old JavaScript object ([POJO](https://masteringjs.io/tutorials/fundamentals/pojo)). */
@@ -309,9 +309,9 @@ declare module 'mongoose' {
     ): ToObjectReturnType<PopulatedRawDocType, TVirtuals, O, TSchemaOptions>;
     toObject<PopulatedRawDocType>(
       this: PopulatedDocumentMarker<PopulatedRawDocType, any>
-    ): Default__v<Require_id<PopulatedRawDocType>, TSchemaOptions>;
+    ): DefaultToObjectReturnType<PopulatedRawDocType, TVirtuals, TSchemaOptions, 'toObject'>;
     toObject<O extends ToObjectOptions>(options: O): ToObjectReturnType<DocType, TVirtuals, O, TSchemaOptions>;
-    toObject(options?: ToObjectOptions): Default__v<Require_id<DocType>, TSchemaOptions>;
+    toObject(options?: ToObjectOptions): DefaultToObjectReturnType<DocType, TVirtuals, TSchemaOptions, 'toObject'>;
     toObject<T>(options?: ToObjectOptions): Default__v<Require_id<T>, ResolveSchemaOptions<TSchemaOptions>>;
 
     /** Clears the modified state on the specified path. */

package/types/index.d.ts

@@ -1122,6 +1122,31 @@ declare module 'mongoose' {
       ? { [K in keyof T]: ApplyFlattenTransforms<T[K], O> }
     : T;
 
+  /**
+   * Extracts the `toObject` or `toJSON` options declared in the schema options.
+   * The runtime applies these as defaults when the corresponding method is
+   * called without arguments.
+   */
+  export type SchemaDeclaredToObjectOptions<TSchemaOptions, Key extends 'toObject' | 'toJSON'> =
+    Key extends keyof TSchemaOptions
+      ? NonNullable<TSchemaOptions[Key]> extends infer O extends ToObjectOptions
+        ? O
+        : {}
+      : {};
+
+  /**
+   * Computes the return type of toObject/toJSON when called without arguments,
+   * applying the options declared in the schema like the runtime does. When the
+   * schema declares no options for the method, the plain document shape is
+   * returned without running it through the option transforms.
+   */
+  export type DefaultToObjectReturnType<DocType, TVirtuals, TSchemaOptions, Key extends 'toObject' | 'toJSON'> =
+    SchemaDeclaredToObjectOptions<TSchemaOptions, Key> extends infer O extends ToObjectOptions
+      ? keyof O extends never
+        ? Default__v<Require_id<DocType>, TSchemaOptions>
+        : ToObjectReturnType<DocType, TVirtuals, O, TSchemaOptions>
+      : Default__v<Require_id<DocType>, TSchemaOptions>;
+
   /**
    * Computes the return type of toObject/toJSON based on the provided options.
    * Uses a single-pass transform for flatten operations to correctly handle all combinations.

package/types/schematypes.d.ts

@@ -1,4 +1,4 @@
-import * as BSON from 'bson';
+import { BSON } from 'mongodb';
 
 declare module 'mongoose' {
   /** The Mongoose Date [SchemaType](/docs/schematypes.html). */