mongoose
9.11.4 · 23 Oct 2026MIT5.8M / weekRepositoryHomepagenpmAtom feed
Upgrading mongoose from 5.7.4 to 6.13.10
253 releases in betweennotes for 8
Counted from 8 of 253 release notes. Advisories are counted from the advisory database, in full.
Before you upgrade
Tick each one off as you go- deprecated6.8.0
Security
Fixes 8 advisories affecting 5.7.4
- Mongoose: Prototype pollution in mongoose update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter)moderate · GHSA-664h-wqgq-64gw
- Improper Input Validation in Automattic Mongoosecritical · GHSA-8687-vv9j-hgph
- Mongoose Prototype Pollution vulnerabilitycritical · GHSA-9m93-w8w6-76hh
- automattic/mongoose vulnerable to Prototype pollution via Schema.pathhigh · GHSA-f825-f98c-gj3g
- Mongoose Vulnerable to Prototype Pollution in Schema Objectcritical · GHSA-h8hf-x3f4-xwgp
- Mongoose search injection vulnerabilityhigh · GHSA-m7xq-9374-9rvx
- Mongoose search injection vulnerabilitycritical · GHSA-vg7j-7cwx-8wgw
- Mongoose's Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL Injectionhigh · GHSA-wpg9-53fq-2r8h
Release by release
6.10.1 – 6.13.1033 releases, no release note
- new
Upgrade to mongodb driver 4.14.0 #13036
- new
Added Schema.prototype.omit() function #12939 #12931 lpizzinidev
- new
index: Added createInitialConnection option to Mongoose constructor #13021 #12965 lpizzinidev
- new
6.9.1 – 6.9.33 releases, no release note
- new
schema: Add removeVirtual(path) function to schema #12920 IslandRhythms
- fixed
cast: Remove empty
$orconditions after strict applied #12898 0x0a0d
- new
6.8.1 – 6.8.44 releases, no release note
- new
Add alpha support for Deno #12397 #9056
- new
Upgrade to MongoDB driver 4.12.1
- new
schema: Add doc as second params to validation message function #12564 #12651 IslandRhythms
- new
document: Add $clone method #12549 #11849 lpizzinidev
- new
6.7.1 – 6.7.55 releases, no release note
- new
Upgrade to mongodb driver 4.11.0 #12446
- new
Add UUID Schema Type (BSON Buffer SubType 4) #12268 #3208 hasezoey
- new
aggregation: Add $fill pipeline stage #12545 raphael-papazikas
- new
types+schema: Allow defining schema paths using mongoose.Types.* to work around TS type inference issues #12352
- new
schema: Add alias() method that makes it easier to define multiple aliases for a given path #12368
- new
model: Add mergeHooks option to Model.discriminator() to avoid duplicate hooks #12542
- new
document: Add $timestamps() method to set timestamps for save(), bulkSave(), and insertMany() #12540
- new
3 internal lines (docs, tests, tooling) left out.