mongoose
9.11.4 · 23 Oct 2026MIT5.8M / weekRepositoryHomepagenpmAtom feed
Upgrading mongoose from 4.7.2 to 9.11.4
673 releases in betweennotes for 35
Counted from 35 of 673 release notes. Advisories are counted from the advisory database, in full.
Before you upgrade
Tick each one off as you go- breaking9.3.0
- breaking9.0.0
- breaking9.0.0
- breaking9.0.0
- breaking9.0.0
- breaking9.0.0
- breaking9.0.0
- breaking9.0.0
- breaking9.0.0
- breaking9.0.0
Security
Fixes 8 advisories affecting 4.7.2
- Mongoose: Prototype pollution in mongoose update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter)moderate · GHSA-664h-wqgq-64gw
- Improper Input Validation in Automattic Mongoosecritical · GHSA-8687-vv9j-hgph
- Mongoose Prototype Pollution vulnerabilitycritical · GHSA-9m93-w8w6-76hh
- automattic/mongoose vulnerable to Prototype pollution via Schema.pathhigh · GHSA-f825-f98c-gj3g
- Mongoose Vulnerable to Prototype Pollution in Schema Objectcritical · GHSA-h8hf-x3f4-xwgp
- Mongoose search injection vulnerabilityhigh · GHSA-m7xq-9374-9rvx
- Mongoose search injection vulnerabilitycritical · GHSA-vg7j-7cwx-8wgw
- Mongoose's Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL Injectionhigh · GHSA-wpg9-53fq-2r8h
Release by release
9.11.1 – 9.11.44 releases, no release note
- new
Use MongoDB Node.js driver 7.7.x #16550
- new
query: Add Query.prototype.findAndCount() for composable paginated queries #16508 #16504 lokeshllkumar
- fixed
Avoid double-calling validators on document arrays underneath nested paths #16484 #16291 #5411
- new
9.10.1 – 9.10.44 releases, no release note
- new
Upgrade mongodb driver -> 7.6.0
- new
model: Add Model.findAndCount() wrapper for limit+skip based pagination with countDocuments #16460 #16454
- new
schema: Add Schema.prototype.queryHelper() to make it easier to define query helpers in TypeScript #16464 #16410
- new
Support middleware skip option for cursors and custom hooks #16350 #15883 #8768 AbdelrahmanHafez
- new
types: Support for type narrowing when using projection in find and findOne #16500 #15545
- fixed
Apply defaults to undefined array elements #16542 #9232
- new
9.9.1 – 9.9.55 releases, no release note
- new
document: Improve toObject perf with faster string checks and avoiding unnecessary isSelected on paths with no getters #16407 #16373 #16385
- new
model: Improve insertMany() performance and general change tracking performance #16370
- new
timestamps: Avoid adding $setOnInsert for createdAt unless upsert set #16411
- new
Improve toObject() performance #16408 #16405 #16378 #14394 BIGSUS24
- new
types: Add discriminator key to each member of embedded discriminator enum- #16412 #16045
- new
9.8.1no release note
- new
schema: Add
strictReadoption to filter or throw on unknown fields during document hydration #16345 #4279 GourabSingha - new
Upgrade MongoDB Node.js driver to 7.5 #16391
- new
types(model): add
pathsToSavetoSaveOptions#16375 AbdelrahmanHafez - new
types(model): support extra fields in
hydrate()withstrict: false#16374 #15940 AbdelrahmanHafez
- new
16 other lines we could not sort, mostly version bumps
- 9.11.0
types: Pass TLeanResultType into query for type narrowing support with lean() #16523 #16519
- 9.10.0
types: Make Schema.prototype.static() return type with new static #16464
- 9.7.0
types: Cast primitive types within unions when applying create casting #16320 #16316
- 9.6.0
types(query): make QueryFilter respect string unions and enums #16242 #16240
- 9.6.0
types: Export Projector and ArrayProjectionOperators #16243 #16235
- 9.4.0
types(populate): use marker type to track populated vs depopulated type for perf
- 9.4.0
types(populate): retain populated paths in toObject() and toJSON() unless depopulate: true set #16085
- 9.4.0
types(query): make TypeScript error on $and with unrecognized query operator
- 9.3.0
types(InferRawDocType): fall back to using InferRawDocType instead of pulling non-raw inferred doc type if EnforcedDocType not set #16053
- 9.2.0
types(models): remove dead MapReduce and GeoSearch types #15984
33 internal lines (docs, tests, tooling) left out.