[dependabot]

Bumps mongoose from 8.1.0 to 9.12.0.

Release notes

Sourced from mongoose's releases.

9.12.0 / 2026-11-04

• feat: upgrade to mongodb driver 7.8 #16772 #16667
• perf: improve for document arrays: cache paths with defaults and schemas with select paths; avoid unnecessary $isModified() lookup #16595
• fix: make recompileSchema recompute derived caches and delay _preCompile() until an actual model is compiled (not subdocs or doc arrays) #16595
• fix(array): compare UUIDs by value in indexOf() so pull() and addToSet() work #16606 luantaraschi
• docs(query): remove unused use$geoWithin docs and property #16589 #16583

9.11.4 / 2026-10-23

• fix: avoid walking into inherited properties like toString when hydrating documents, setting dotted paths, and merging updates
• fix: only use own properties when looking up discriminators by key
• fix(schema): disallow setting special properties via virtual()
• fix(query): respect connection-level sanitizeFilter in queries
• fix(query): disallow special properties like __proto__ as paths in where() and mod()
• fix(deps): upgrade mquery -> 6.0.1 to avoid prototype pollution with query helpers like gt() and in()

9.11.3 / 2026-10-21

• fix(update): honor overwriteImmutable in upserts and nested timestamps #16614 #15781 #8619 AbdelrahmanHafez
• fix(model): stop Model.validate() crashing on missing nested objects #16600 NotAFlightRisk
• fix(connection): don't disable autoIndex/autoCreate for a primary ReadPreference instance #16592 NgoQuocViet2001
• docs: remove references to MongoDB versions older than 6.x #16593

9.11.2 / 2026-10-12

• perf: avoid applying saveSubdocs and sharding plugins to subdocuments #16585
• perf: upgrade to kareem@3.4.1 for mongoosejs/kareem#47 #16588
• fix(model): cast array filter values in bulkWrite() #16574 #16573 OmBhandwaldar
• fix(schema): allow function messages for number min/max and string minlength #16579 #16572 #8512 NotAFlightRisk
• types: make MergeType more efficiently handle MergeType<A, {}> #16581 #16580
• docs: fix broken API anchors and a malformed link #16583 SatvikMishra08

9.11.1 / 2026-10-07

• fix(document): call recursive toObject() when setting a path to a nested object #16571
• fix(update): keep casting array filters after a path not in the schema #16558 giaBaoJS
• fix(document): apply flattenDecimals when toObject() takes the shallow fast path #16569 #16568 jeremyml
• fix(query): cast operators under $not inside $elemMatch on primitive arrays #16542 #13880 breken-ai
• fix(query): use embedded discriminator schema when filter selects the key with $eq or $in #16543 breken-ai
• fix(documentarray): don't pass arrayPathIndex to subdocuments when initializing nested document arrays #16546 Mohamed-Elshesheny
• fix(cursor): await driver cleanup when destroying query cursors #16562 #16560 IbrahimHafez1
• fix(cursor): reject getDriverCursor after initialization errors #16563 #16561 IbrahimHafez1
• types(schema): treat Int32 paths as number #16565 #16564 lazerg
• types(models): align UpdateOneModel and UpdateManyModel update typing with UpdateQuery #16559 #16545 aipd506

9.11.0 / 2026-10-05

• feat: use MongoDB Node.js driver 7.7.x #16550
• feat(query): add Query.prototype.findAndCount() for composable paginated queries #16508 #16504 lokeshllkumar

... (truncated)

Changelog

Sourced from mongoose's changelog.

9.12.0 / 2026-11-04

• feat: upgrade to mongodb driver 7.8 #16772 #16667
• perf: improve for document arrays: cache paths with defaults and schemas with select paths; avoid unnecessary $isModified() lookup #16595
• fix: make recompileSchema recompute derived caches and delay _preCompile() until an actual model is compiled (not subdocs or doc arrays) #16595
• fix(array): compare UUIDs by value in indexOf() so pull() and addToSet() work #16606 luantaraschi
• docs(query): remove unused use$geoWithin docs and property #16589 #16583

9.11.5 / 2026-11-03

• fix(query): pass explain verbosity to the driver cursor in find() #16635 jasontd92
• fix(map): support ObjectId keys in MongooseMap#has() NgoQuocViet2001
• fix(schema): clear enumValues when enum validator is removed with enum(false) #16631 Enesuygurs
• fix: respect disabled updatedAt in pipeline updates #16642 #16641 ItsM0rty
• fix: make schema clone() copy $timestamps #16651 #16650 Oleksii-Pavliuk
• fix(model): preserve WriteError instances in insertMany() writeErrors #16608 #16607 Majny
• fix: bump sift -> 17.1.4 rishabhnehra
• docs(production): add production indexes guide #16627
• docs(ask-ai): send session cookie and continue stored conversations #16652 nlarew

8.24.8 / 2026-11-02

• fix(schema): remove map paths cleanly, including maps under nested paths (backport to 8.x) #16625 #16461 #16457 mrityunjay-pandey
• fix(schema): keep the map value schematype a single object when cloning (backport to 8.x) #16624 #16473 mrityunjay-pandey
• fix(map): support ObjectId keys in MongooseMap#has() (backport to 8.x #16634 mrityunjay-pandey
• fix(hydration): use the doc model for looking up a ref (backport to 8.x) #16623 #16453 mrityunjay-pandey
• fix(document): replace {MODEL} in custom cast error messages from document validation (backport to 8.x) #16622 #16480 mrityunjay-pandey
• fix(schema): run setters declared on the union path itself (backport to 8.x) #16621 #16528 mrityunjay-pandey

9.11.4 / 2026-10-23

• fix: avoid walking into inherited properties like toString when hydrating documents, setting dotted paths, and merging updates
• fix: only use own properties when looking up discriminators by key
• fix(schema): disallow setting special properties via virtual()
• fix(query): respect connection-level sanitizeFilter in queries
• fix(query): disallow special properties like __proto__ as paths in where() and mod()
• fix(deps): upgrade mquery -> 6.0.1 to avoid prototype pollution with query helpers like gt() and in()

8.24.7 / 2026-10-23

• fix: avoid walking into inherited properties like toString when hydrating documents, setting dotted paths, and merging updates
• fix: only use own properties when looking up discriminators by key
• fix(schema): disallow setting special properties via virtual()
• fix(query): respect connection-level sanitizeFilter in queries
• fix(query): disallow special properties like __proto__ as paths in where() and mod()
• fix(deps): upgrade mquery -> 4.0.4 to avoid prototype pollution with query helpers like gt() and in()

9.11.3 / 2026-10-21

• fix(update): honor overwriteImmutable in upserts and nested timestamps #16614 #15781 #8619 AbdelrahmanHafez

... (truncated)

Commits

• be57670 chore: release 9.12.0
• 0f620fa Merge pull request #16675 from Automattic/9.12
• 2a92806 fix: make recompileSchema recompute derived caches and delay _preCompile() un...
• f8d4fd8 Merge pull request #16672 from Automattic/vkarpov15/20261103/gh-16667
• 21ad530 feat: upgrade to mongodb 7.8
• b8a882a Merge branch 'master' into 9.12
• 157c8fb chore: release 9.11.5
• c032c07 Merge pull request #16608 from Majny/fix/insertmany-preserve-writeerror
• 028a295 Fix WriteError index assignment in error handling
• 2702238 Merge branch '8.x'
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for mongoose since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)