Packages

mongoose

9.11.4 · 23 Oct 2026MIT5.8M / weekRepositoryHomepagenpmAtom feed

Upgrading mongoose from 1.3.7 to 9.11.4

959 releases in betweennotes for 278

Other targets from 1.3.7Newest 1.x1.8.4Clears its 7 advisories6.13.10
6.0.0, 5.0.0, 4.0.0, 3.0.0, 2.0.0 have no release note on GitHub or in the repository's changelog, so their breaking changes are missing from the counts below.
27+
changes to make
7
advisories fixed
353+
new
827+
fixes

Counted from 278 of 959 release notes. Advisories are counted from the advisory database, in full.

Before you upgrade

Tick each one off as you go
  • breaking9.3.0
  • breaking9.0.0
  • breaking9.0.0
  • breaking9.0.0
  • breaking9.0.0
  • breaking9.0.0
  • breaking9.0.0
  • breaking9.0.0
  • breaking9.0.0
  • breaking9.0.0

Security

Fixes 7 advisories affecting 1.3.7

  • setDefaultsOnInsert: Check child filter paths before applying defaults, fix dot-notation handling, and prevent prototype pollution #16031 #16030

    9.2.2

  • Avoid prototype pollution on init

    7.3.3

Release by release

  1. 9.11.4

    23 Oct 20265 fixes
    • fixed

      Avoid walking into inherited properties like toString when hydrating documents, setting dotted paths, and merging updates

    • fixed

      Only use own properties when looking up discriminators by key

    • fixed

      schema: Disallow setting special properties via virtual()

    • fixed

      query: Respect connection-level sanitizeFilter in queries

    • fixed

      query: Disallow special properties like __proto__ as paths in where() and mod()

  2. 9.11.3

    21 Oct 20263 fixes
    • fixed

      update: Honor overwriteImmutable in upserts and nested timestamps #16614 #15781 #8619 AbdelrahmanHafez

    • fixed

      model: Stop Model.validate() crashing on missing nested objects #16600 NotAFlightRisk

    • fixed

      connection: Don't disable autoIndex/autoCreate for a primary ReadPreference instance #16592 NgoQuocViet2001

  3. 9.11.2

    12 Oct 20262 new · 2 fixes
    • new

      Avoid applying saveSubdocs and sharding plugins to subdocuments #16585

    • new

      Upgrade to kareem@3.4.1 for mongoosejs/kareem#47 #16588

    • fixed

      model: Cast array filter values in bulkWrite() #16574 #16573 OmBhandwaldar

    • fixed

      schema: Allow function messages for number min/max and string minlength #16579 #16572 #8512 NotAFlightRisk

  4. 9.11.1

    7 Oct 20268 fixes
    • fixed

      document: Call recursive toObject() when setting a path to a nested object #16571

    • fixed

      update: Keep casting array filters after a path not in the schema #16558 giaBaoJS

    • fixed

      document: Apply flattenDecimals when toObject() takes the shallow fast path #16569 #16568 jeremyml

    • fixed

      query: Cast operators under $not inside $elemMatch on primitive arrays #16542 #13880 breken-ai

  5. 9.11.0

    5 Oct 20262 new · 1 fix
    • new

      Use MongoDB Node.js driver 7.7.x #16550

    • new

      query: Add Query.prototype.findAndCount() for composable paginated queries #16508 #16504 lokeshllkumar

    • fixed

      Avoid double-calling validators on document arrays underneath nested paths #16484 #16291 #5411

  6. 9.10.4

    3 Oct 20265 fixes
    • fixed

      Handle MongoDB server 9.x returning collation: { locale: 'simple' } on all indexes #16557

    • fixed

      populate: Resolve dotted parent path when collecting deferred sub-populate children #16538 jfits

    • fixed

      array: Compare dates by value in indexOf() so pull() removes them #16535 giaBaoJS

    • fixed

      map: Register $set when Map#set() replaces an array #16540 #16539 luantaraschi

    • fixed

      query: Cast case and then expressions in $expr $switch branches #16534 kwy404

  7. 9.10.3

    29 Sep 20265 fixes
    • fixed

      model: Preserve unsaved documents after ordered bulkSave errors #16533 #16532 IbrahimHafez1

    • fixed

      model: Don't mutate the caller's update object in bulkWrite updateMany #16526 fadiroot

    • fixed

      schema: Run setters declared on the union path itself #16528 giaBaoJS

    • fixed

      collection: Open collection if connection was already opened #16527 #16525 #16524

    • fixed

      query+model: Replace {MODEL} in cast error messages from update and bulkWrite casting #16529 #16502 #16480

  8. 9.10.2

    22 Sep 20264 fixes
    • fixed

      schema: Drop subpaths and singleNestedPaths when a path is removed #16521 #16520 luantaraschi

    • fixed

      schema: Register path-level setters on Map paths #16518 giaBaoJS

    • fixed

      model: Replace {MODEL} in castObject() cast error messages #16502 #16480 dylanpulver

    • fixed

      Preserve circular arrays when cloning with a seen map #16514 Shubham-Padkonde

106 other lines we could not sort, mostly version bumps

  • types: Make MergeType more efficiently handle MergeType<A, {}> #16581 #16580

    9.11.2

  • types(schema): treat Int32 paths as number #16565 #16564 lazerg

    9.11.1

  • types(models): align UpdateOneModel and UpdateManyModel update typing with UpdateQuery #16559 #16545 aipd506

    9.11.1

  • types: Pass TLeanResultType into query for type narrowing support with lean() #16523 #16519

    9.11.0

  • types: Relax populate Model generics to allow typed virtuals to be passed to populate in TypeScript 7 with skipLibCheck #16503

    9.10.1

  • types: Make Schema.prototype.static() return type with new static #16464

    9.10.0

  • types(document): respect schema toObject and toJSON options #16431 #15594 samuelmbabhazi

    9.9.2

  • types: Import BSON from mongodb instead of bson #16434

    9.9.2

  • types: Respect the _id option when inferring StandardSchema types #16402

    9.8.1

  • types(model): keep Model.schema typed when TSchema is omitted samuelmbabhazi

    9.8.1

407 internal lines (docs, tests, tooling) left out.