mongoose 9.9.2 → 9.9.4

package/README.md

@@ -340,7 +340,7 @@ new Schema({
 
 ### Driver Access
 
-Mongoose is built on top of the [official MongoDB Node.js driver](https://github.com/mongodb/node-mongodb-native). Each mongoose model keeps a reference to a [native MongoDB driver collection](http://mongodb.github.io/node-mongodb-native/2.1/api/Collection.html). The collection object can be accessed using `YourModel.collection`. However, using the collection object directly bypasses all mongoose features, including hooks, validation, etc. The one
+Mongoose is built on top of the [official MongoDB Node.js driver](https://github.com/mongodb/node-mongodb-native). Each mongoose model keeps a reference to a [native MongoDB driver collection](https://mongodb.github.io/node-mongodb-native/7.5/classes/Collection.html). The collection object can be accessed using `YourModel.collection`. However, using the collection object directly bypasses all mongoose features, including hooks, validation, etc. The one
 notable exception is that `YourModel.collection` still buffers
 commands. As such, `YourModel.collection.find()` will **not**
 return a cursor.

package/lib/cast/double.js

@@ -30,6 +30,12 @@ module.exports = function castDouble(val) {
       assert.ok(false);
     }
   } else if (typeof val === 'object') {
+    if (Array.isArray(val)) {
+      // `[5].valueOf()` returns the array itself, so without this guard a
+      // single-element or empty array would fall through to `Number(tempVal)`
+      // below and silently coerce instead of throwing.
+      assert.ok(false);
+    }
     const tempVal = val.valueOf() ?? val.toString();
     // ex: { a: 'im an object, valueOf: () => 'helloworld' } // throw an error
     if (typeof tempVal === 'string') {

package/lib/cast/int32.js

@@ -20,6 +20,12 @@ module.exports = function castInt32(val) {
   if (val === '') {
     return null;
   }
+  if (Array.isArray(val)) {
+    // `Number([5])` is `5` and `Number([])` is `0`, so without this guard a
+    // single-element or empty array would silently coerce instead of throwing,
+    // unlike every other array input and unlike `castNumber()`'s own guard.
+    assert.ok(false);
+  }
 
   const coercedVal = isBsonType(val, 'Long') ? val.toNumber() : Number(val);
 

package/lib/document.js

@@ -2570,25 +2570,15 @@ Document.prototype.isSelected = function isSelected(path) {
     return path.some(p => this.$__isSelected(p));
   }
 
-  const paths = Object.keys(this.$__.selected);
-  let inclusive = null;
+  const index = _getProjectionIndex(this);
+  const paths = index.paths;
+  const inclusive = index.inclusive;
 
-  if (paths.length === 1 && paths[0] === '_id') {
+  if (index.onlyId) {
     // only _id was selected.
     return this.$__.selected._id === 0;
   }
 
-  for (const cur of paths) {
-    if (cur === '_id') {
-      continue;
-    }
-    if (!isDefiningProjection(this.$__.selected[cur])) {
-      continue;
-    }
-    inclusive = !!this.$__.selected[cur];
-    break;
-  }
-
   if (inclusive === null) {
     return true;
   }
@@ -2599,6 +2589,25 @@ Document.prototype.isSelected = function isSelected(path) {
 
   const pathHasDot = path.indexOf('.') !== -1;
 
+  if (!index.hasNestedKey) {
+    // No projection key is nested, so no key can start with `path + '.'` and
+    // only the "is an ancestor of `path` projected?" check below can match.
+    // Every ancestor that matches returns the same value, so we can walk
+    // `path`'s ancestors instead of scanning every projection key. This keeps
+    // `isSelected()` O(depth of path) rather than O(number of projected paths),
+    // which matters because `toObject({ getters: true })` calls this once per
+    // schema path. Re: gh-16373
+    if (pathHasDot) {
+      for (let dot = path.indexOf('.'); dot !== -1; dot = path.indexOf('.', dot + 1)) {
+        const ancestor = path.slice(0, dot);
+        if (ancestor !== '_id' && Object.hasOwn(this.$__.selected, ancestor)) {
+          return inclusive;
+        }
+      }
+    }
+    return !inclusive;
+  }
+
   for (const cur of paths) {
     if (cur === '_id') {
       continue;
@@ -2615,6 +2624,43 @@ Document.prototype.isSelected = function isSelected(path) {
   return !inclusive;
 };
 
+/*!
+ * Computes and caches the derived properties of `doc.$__.selected` that
+ * `isSelected()` and `isDirectSelected()` would otherwise recompute on every
+ * call. `$__.selected` is assigned once in the Document constructor and never
+ * mutated afterwards, so this can safely be cached for the document's lifetime.
+ */
+
+function _getProjectionIndex(doc) {
+  if (doc.$__.selectedIndex !== undefined) {
+    return doc.$__.selectedIndex;
+  }
+
+  const selected = doc.$__.selected;
+  const paths = Object.keys(selected);
+  let inclusive = null;
+  let hasNestedKey = false;
+
+  for (const cur of paths) {
+    if (cur === '_id') {
+      continue;
+    }
+    if (cur.indexOf('.') !== -1) {
+      hasNestedKey = true;
+    }
+    if (inclusive === null && isDefiningProjection(selected[cur])) {
+      inclusive = !!selected[cur];
+    }
+  }
+
+  return (doc.$__.selectedIndex = {
+    paths,
+    inclusive,
+    hasNestedKey,
+    onlyId: paths.length === 1 && paths[0] === '_id'
+  });
+}
+
 Document.prototype.$__isSelected = Document.prototype.isSelected;
 
 /**
@@ -2650,34 +2696,22 @@ Document.prototype.isDirectSelected = function isDirectSelected(path) {
     return path.some(p => this.isDirectSelected(p));
   }
 
-  const paths = Object.keys(this.$__.selected);
-  let inclusive = null;
+  const index = _getProjectionIndex(this);
 
-  if (paths.length === 1 && paths[0] === '_id') {
+  if (index.onlyId) {
     // only _id was selected.
     return this.$__.selected._id === 0;
   }
 
-  for (const cur of paths) {
-    if (cur === '_id') {
-      continue;
-    }
-    if (!isDefiningProjection(this.$__.selected[cur])) {
-      continue;
-    }
-    inclusive = !!this.$__.selected[cur];
-    break;
-  }
-
-  if (inclusive === null) {
+  if (index.inclusive === null) {
     return true;
   }
 
   if (Object.hasOwn(this.$__.selected, path)) {
-    return inclusive;
+    return index.inclusive;
   }
 
-  return !inclusive;
+  return !index.inclusive;
 };
 
 /**

package/lib/internal.js

@@ -17,6 +17,8 @@ InternalCache.prototype.strictMode = true;
 
 InternalCache.prototype.fullPath = undefined;
 InternalCache.prototype.selected = undefined;
+// Lazily computed index over `selected`, see `_getProjectionIndex()` in document.js
+InternalCache.prototype.selectedIndex = undefined;
 InternalCache.prototype.shardval = undefined;
 InternalCache.prototype.saveError = undefined;
 InternalCache.prototype.validationError = undefined;

package/lib/model.js

@@ -1727,6 +1727,7 @@ function _ensureIndexes(model, options, callback) {
           utils.warn('mongoose: Duplicate schema index on ' + JSON.stringify(fields) +
             ' for model "' + model.modelName + '". ' +
             'This is often due to declaring an index using both "index: true" and "schema.index()". ' +
+            'MongoDB will not create the duplicate index and options on the duplicate definition (such as expireAfterSeconds or unique) will not be applied. ' +
             'Please remove the duplicate index definition.');
           break;
         }
@@ -3654,15 +3655,19 @@ Model.bulkSave = async function bulkSave(documents, options) {
     );
   }
 
+  const failedDocumentIds = documents.length >= 25 ? new Set(bulkWriteError?.writeErrors?.map(writeError => {
+    const writeErrorDocumentId = writeError.err.op._id || writeError.err.op.q._id;
+    return writeErrorDocumentId.toString();
+  })) : null;
   const successfulDocuments = [];
   for (let i = 0; i < documents.length; i++) {
     const document = documents[i];
-    const documentError = bulkWriteError?.writeErrors.find(writeError => {
+    const documentId = document._doc._id.toString();
+    const failed = failedDocumentIds == null ? bulkWriteError?.writeErrors.find(writeError => {
       const writeErrorDocumentId = writeError.err.op._id || writeError.err.op.q._id;
-      return writeErrorDocumentId.toString() === document._doc._id.toString();
-    });
-
-    if (documentError == null) {
+      return writeErrorDocumentId.toString() === documentId;
+    }) != null : failedDocumentIds.has(documentId);
+    if (!failed) {
       successfulDocuments.push(document);
     }
   }

package/lib/query.js

@@ -1754,9 +1754,16 @@ Query.prototype.setOptions = function(options, overwrite) {
     }
   }
 
-  if ('setDefaultsOnInsert' in options) {
-    this._mongooseOptions.setDefaultsOnInsert = options.setDefaultsOnInsert;
-    delete options.setDefaultsOnInsert;
+  if ('cloneUpdate' in options) {
+    this._mongooseOptions.cloneUpdate = options.cloneUpdate;
+    delete options.cloneUpdate;
+  }
+  if ('defaults' in options) {
+    this._mongooseOptions.defaults = options.defaults;
+    // deleting options.defaults will cause 7287 to fail
+  }
+  if (options.lean == null && this.schema && 'lean' in this.schema.options) {
+    this._mongooseOptions.lean = this.schema.options.lean;
   }
   if ('overwriteDiscriminatorKey' in options) {
     this._mongooseOptions.overwriteDiscriminatorKey = options.overwriteDiscriminatorKey;
@@ -1766,13 +1773,9 @@ Query.prototype.setOptions = function(options, overwrite) {
     this._mongooseOptions.overwriteImmutable = options.overwriteImmutable;
     delete options.overwriteImmutable;
   }
-  if ('updatePipeline' in options) {
-    this._mongooseOptions.updatePipeline = options.updatePipeline;
-    delete options.updatePipeline;
-  }
-  if ('cloneUpdate' in options) {
-    this._mongooseOptions.cloneUpdate = options.cloneUpdate;
-    delete options.cloneUpdate;
+  if ('sanitizeFilter' in options) {
+    this._mongooseOptions.sanitizeFilter = options.sanitizeFilter;
+    delete options.sanitizeFilter;
   }
   if ('sanitizeProjection' in options) {
     if (options.sanitizeProjection && !this._mongooseOptions.sanitizeProjection) {
@@ -1782,29 +1785,33 @@ Query.prototype.setOptions = function(options, overwrite) {
     this._mongooseOptions.sanitizeProjection = options.sanitizeProjection;
     delete options.sanitizeProjection;
   }
-  if ('sanitizeFilter' in options) {
-    this._mongooseOptions.sanitizeFilter = options.sanitizeFilter;
-    delete options.sanitizeFilter;
+  if ('schemaLevelProjections' in options) {
+    this._mongooseOptions.schemaLevelProjections = options.schemaLevelProjections;
+    delete options.schemaLevelProjections;
+  }
+  if ('setDefaultsOnInsert' in options) {
+    this._mongooseOptions.setDefaultsOnInsert = options.setDefaultsOnInsert;
+    delete options.setDefaultsOnInsert;
+  }
+  if ('strict' in options) {
+    this._mongooseOptions.strict = options.strict;
+    delete options.strict;
+  }
+  if ('strictQuery' in options) {
+    this._mongooseOptions.strictQuery = options.strictQuery;
+    delete options.strictQuery;
   }
   if ('timestamps' in options) {
     this._mongooseOptions.timestamps = options.timestamps;
     delete options.timestamps;
   }
-  if ('defaults' in options) {
-    this._mongooseOptions.defaults = options.defaults;
-    // deleting options.defaults will cause 7287 to fail
-  }
   if ('translateAliases' in options) {
     this._mongooseOptions.translateAliases = options.translateAliases;
     delete options.translateAliases;
   }
-  if ('schemaLevelProjections' in options) {
-    this._mongooseOptions.schemaLevelProjections = options.schemaLevelProjections;
-    delete options.schemaLevelProjections;
-  }
-
-  if (options.lean == null && this.schema && 'lean' in this.schema.options) {
-    this._mongooseOptions.lean = this.schema.options.lean;
+  if ('updatePipeline' in options) {
+    this._mongooseOptions.updatePipeline = options.updatePipeline;
+    delete options.updatePipeline;
   }
 
   if (typeof options.limit === 'string') {
@@ -2361,13 +2368,22 @@ Query.prototype._unsetCastError = function _unsetCastError() {
  * Getter/setter around the current mongoose-specific options for this query
  * Below are the current Mongoose-specific options.
  *
- * - `populate`: an array representing what paths will be populated. Should have one entry for each call to [`Query.prototype.populate()`](https://mongoosejs.com/docs/api/query.html#Query.prototype.populate())
+ * - `cloneUpdate`: if `false`, Mongoose will not clone updates before executing the query
+ * - `defaults`: if `false`, Mongoose will not apply defaults to the returned document(s)
  * - `lean`: if truthy, Mongoose will not [hydrate](https://mongoosejs.com/docs/api/model.html#Model.hydrate()) any documents that are returned from this query. See [`Query.prototype.lean()`](https://mongoosejs.com/docs/api/query.html#Query.prototype.lean()) for more information.
- * - `strict`: controls how Mongoose handles keys that aren't in the schema for updates. This option is `true` by default, which means Mongoose will silently strip any paths in the update that aren't in the schema. See the [`strict` mode docs](https://mongoosejs.com/docs/guide.html#strict) for more information.
- * - `strictQuery`: controls how Mongoose handles keys that aren't in the schema for the query `filter`. This option is `false` by default, which means Mongoose will allow `Model.find({ foo: 'bar' })` even if `foo` is not in the schema. See the [`strictQuery` docs](https://mongoosejs.com/docs/guide.html#strictQuery) for more information.
  * - `nearSphere`: use `$nearSphere` instead of `near()`. See the [`Query.prototype.nearSphere()` docs](https://mongoosejs.com/docs/api/query.html#Query.prototype.nearSphere())
+ * - `overwriteDiscriminatorKey`: allow setting the discriminator key in the update
+ * - `overwriteImmutable`: allow overwriting properties that are set to `immutable` in the schema
+ * - `populate`: an array representing what paths will be populated. Should have one entry for each call to [`Query.prototype.populate()`](https://mongoosejs.com/docs/api/query.html#Query.prototype.populate())
+ * - `sanitizeFilter`: if truthy, Mongoose will sanitize query filters before executing the query
+ * - `sanitizeProjection`: if truthy, Mongoose will sanitize projections before executing the query
  * - `schemaLevelProjections`: if `false`, Mongoose will not apply schema-level `select: false` or `select: true` for this query
- * - `cloneUpdate`: if `false`, Mongoose will not clone updates before executing the query
+ * - `setDefaultsOnInsert`: if `true`, Mongoose will apply defaults to upserted documents
+ * - `strict`: controls how Mongoose handles keys that aren't in the schema for updates. This option is `true` by default, which means Mongoose will silently strip any paths in the update that aren't in the schema. See the [`strict` mode docs](https://mongoosejs.com/docs/guide.html#strict) for more information.
+ * - `strictQuery`: controls how Mongoose handles keys that aren't in the schema for the query `filter`. This option is `false` by default, which means Mongoose will allow `Model.find({ foo: 'bar' })` even if `foo` is not in the schema. See the [`strictQuery` docs](https://mongoosejs.com/docs/guide.html#strictQuery) for more information.
+ * - `timestamps`: if `false`, Mongoose will not apply timestamps to the update
+ * - `translateAliases`: if `true`, Mongoose will translate schema aliases in the query
+ * - `updatePipeline`: if `true`, Mongoose will treat the update as an update pipeline
  *
  * Mongoose maintains a separate object for internal options because
  * Mongoose sends `Query.prototype.options` to the MongoDB server, and the
@@ -3565,9 +3581,6 @@ Query.prototype._findOneAndUpdate = async function _findOneAndUpdate() {
   applyGlobalMaxTimeMS(this.options, dbOptions, baseOptions);
   applyGlobalDiskUse(this.options, dbOptions, baseOptions);
 
-  if ('strict' in this.options) {
-    this._mongooseOptions.strict = this.options.strict;
-  }
   const options = this._optionsForExec(this.model);
   convertNewToReturnDocument(options);
 
@@ -3828,11 +3841,6 @@ Query.prototype._findOneAndReplace = async function _findOneAndReplace() {
     throw this.error();
   }
 
-  if ('strict' in this.options) {
-    this._mongooseOptions.strict = this.options.strict;
-    delete this.options.strict;
-  }
-
   const filter = this._conditions;
   const options = this._optionsForExec();
   convertNewToReturnDocument(options);
@@ -4548,13 +4556,6 @@ function _update(query, op, filter, doc, options, callback) {
   query.op = op;
   doc = doc || {};
 
-  // strict is an option used in the update checking, make sure it gets set
-  if (options != null) {
-    if ('strict' in options) {
-      query._mongooseOptions.strict = options.strict;
-    }
-  }
-
   if (!(filter instanceof Query) &&
       filter != null &&
       filter.toString() !== '[object Object]') {
@@ -5212,13 +5213,11 @@ Query.prototype.cast = function(model, obj) {
   }
 
   const opts = { upsert: this.options?.upsert };
-  if (this.options) {
-    if ('strict' in this.options) {
-      opts.strict = this.options.strict;
-    }
-    if ('strictQuery' in this.options) {
-      opts.strictQuery = this.options.strictQuery;
-    }
+  if ('strict' in this._mongooseOptions) {
+    opts.strict = this._mongooseOptions.strict;
+  }
+  if ('strictQuery' in this._mongooseOptions) {
+    opts.strictQuery = this._mongooseOptions.strictQuery;
   }
   if ('sanitizeFilter' in this._mongooseOptions) {
     opts.sanitizeFilter = this._mongooseOptions.sanitizeFilter;

package/lib/schema/documentArrayElement.js

@@ -119,14 +119,26 @@ SchemaDocumentArrayElement.prototype.doValidate = async function doValidate(valu
  */
 
 SchemaDocumentArrayElement.prototype.clone = function() {
-  this.options.$parentSchemaType = this.$parentSchemaType;
-  const ret = SchemaType.prototype.clone.apply(this, arguments);
-  delete this.options.$parentSchemaType;
-
-  ret.Constructor = this.Constructor;
-  ret.schema = this.schema;
+  // This schematype takes the subdocument schema where `SchemaType` takes the
+  // options, so it cannot go through `SchemaType.prototype.clone()`: the
+  // arguments would land in the wrong parameters and `$parentSchemaType` would
+  // never reach the constructor.
+  const options = Object.assign({}, this.options, {
+    $parentSchemaType: this.$parentSchemaType,
+    Constructor: this.Constructor
+  });
+  const schematype = new this.constructor(
+    this.path,
+    this.schema,
+    options,
+    this.parentSchema
+  );
+  schematype.validators = this.validators.slice();
+  if (this.requiredValidator !== undefined) {
+    schematype.requiredValidator = this.requiredValidator;
+  }
 
-  return ret;
+  return schematype;
 };
 
 /*!

package/lib/schema.js

@@ -451,6 +451,16 @@ Schema.prototype._clone = function _clone(Constructor) {
   );
   s.nested = clone(this.nested);
   s.subpaths = clone(this.subpaths);
+
+  s.mapPaths = [];
+  for (const [path, schemaType] of Object.entries(s.paths)) {
+    const mapPath = path + '.$*';
+    if (!schemaType.$isSchemaMap || !Object.hasOwn(s.paths, mapPath)) {
+      continue;
+    }
+    s.paths[mapPath] = schemaType.$__schemaType;
+    s.mapPaths.push(s.paths[mapPath]);
+  }
   for (const schemaType of Object.values(s.paths)) {
     if (schemaType.$isSingleNested) {
       const path = schemaType.path;
@@ -478,7 +488,6 @@ Schema.prototype._clone = function _clone(Constructor) {
   s.$implicitlyCreated = this.$implicitlyCreated;
   s.$id = ++id;
   s.$originalSchemaId = this.$id;
-  s.mapPaths = [].concat(this.mapPaths);
 
   if (this.discriminatorMapping != null) {
     s.discriminatorMapping = Object.assign({}, this.discriminatorMapping);
@@ -2764,12 +2773,27 @@ Schema.prototype.remove = function(path) {
           }
         }
 
+        this.mapPaths = this.mapPaths.filter(
+          schemaType => !schemaType.path.startsWith(name + '.')
+        );
+
         delete this.nested[name];
         _deletePath(this, name);
         return;
       }
 
       delete this.paths[name];
+      // A map registers its values under `<path>.$*`, both in `paths` and in
+      // `mapPaths`. Left behind, they keep answering `pathType()` and casting queries
+      // for a path the schema no longer has.
+      for (const subpath of Object.keys(this.paths)) {
+        if (subpath.startsWith(name + '.')) {
+          delete this.paths[subpath];
+        }
+      }
+      this.mapPaths = this.mapPaths.filter(
+        schemaType => !schemaType.path.startsWith(name + '.')
+      );
       _deletePath(this, name);
 
       this._removeEncryptedField(name);
@@ -2790,6 +2814,9 @@ function _deletePath(schema, name) {
 
   for (const piece of pieces) {
     branch = branch[piece];
+    if (branch == null) {
+      return;
+    }
   }
 
   delete branch[last];

package/lib/schemaType.js

@@ -230,8 +230,12 @@ SchemaType.prototype._addJSONSchemaEnum = function _addJSONSchemaEnum(definition
   }
 
   // The enum validator allows nullish values, so allow `null` wherever the type does.
+  // Skip that when the user already listed `null`: MongoDB refuses a `$jsonSchema`
+  // whose `enum` repeats a value, and so does Ajv.
   const allowsNull = Array.isArray(definition.type ?? definition.bsonType);
-  definition.enum = allowsNull ? [...this.enumValues, null] : [...this.enumValues];
+  definition.enum = allowsNull && !this.enumValues.includes(null)
+    ? [...this.enumValues, null]
+    : [...this.enumValues];
 
   return definition;
 };
@@ -1722,7 +1726,7 @@ SchemaType.prototype._castRef = function _castRef(value, doc, init, options) {
     !doc.$__.populated[path].options ||
     !doc.$__.populated[path].options.options ||
     !doc.$__.populated[path].options.options.lean) {
-    const PopulatedModel = pop ? pop.options[populateModelSymbol] : doc.constructor.db.model(this.options.ref);
+    const PopulatedModel = pop ? pop.options[populateModelSymbol] : owner.constructor.db.model(this.options.ref);
     ret = PopulatedModel.hydrate(value, null, options);
     ret.$__.wasPopulated = { value: ret._doc._id, options: { [populateModelSymbol]: PopulatedModel } };
   }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "mongoose",
   "description": "Mongoose MongoDB ODM",
-  "version": "9.9.2",
+  "version": "9.9.4",
   "author": "Guillermo Rauch <guillermo@learnboost.com>",
   "keywords": [
     "mongodb",