# What changed in mongoose

> 21 changes in mongoose 8 to 9 from its official release notes, upgrade guides and advisories: 1 breaking, 2 security. Each one cited. Sources checked 2026-10-21. HTML: https://unstale.sh/npm/mongoose/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## mongoose 9

### Security

- Mongoose: Prototype pollution in mongoose update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter) (7.8.10, 8.24.1, 9.7.2) — [security advisory](https://github.com/advisories/GHSA-664H-WQGQ-64GW)
- Mongoose's Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL Injection (6.13.9, 8.22.1, 9.1.6) — [security advisory](https://github.com/advisories/GHSA-WPG9-53FQ-2R8H)

### Performance

- Makes MergeType more efficiently handle MergeType<A, {}>. (9.11.2) — [release notes](https://github.com/Automattic/mongoose/releases/tag/9.11.2)
- Avoids applying saveSubdocs and sharding plugins to subdocuments. (9.11.2) — [release notes](https://github.com/Automattic/mongoose/releases/tag/9.11.2)

### Behavior and default changes

- Int32 paths are now treated as number in schema types. (9.11.1) — [release notes](https://github.com/Automattic/mongoose/releases/tag/9.11.1)

### Fixes and other changes

- Casts array filter values in bulkWrite(). (9.11.2) — [release notes](https://github.com/Automattic/mongoose/releases/tag/9.11.2)
- Allows function messages for number min/max and string minlength validators. (9.11.2) — [release notes](https://github.com/Automattic/mongoose/releases/tag/9.11.2)
- Array filters continue to be cast after a path not in the schema. (9.11.1) — [release notes](https://github.com/Automattic/mongoose/releases/tag/9.11.1)
- Filters selecting a discriminator key with $eq or $in now use the embedded discriminator schema. (9.11.1) — [release notes](https://github.com/Automattic/mongoose/releases/tag/9.11.1)
- flattenDecimals is now applied when toObject() takes the shallow fast path. (9.11.1) — [release notes](https://github.com/Automattic/mongoose/releases/tag/9.11.1)
- Initializing nested document arrays no longer passes arrayPathIndex to subdocuments. (9.11.1) — [release notes](https://github.com/Automattic/mongoose/releases/tag/9.11.1)
- Operators under $not inside $elemMatch on primitive arrays are now cast. (9.11.1) — [release notes](https://github.com/Automattic/mongoose/releases/tag/9.11.1)
- Destroying query cursors now awaits driver cleanup. (9.11.1) — [release notes](https://github.com/Automattic/mongoose/releases/tag/9.11.1)
- Setting a path to a nested object now calls recursive toObject(). (9.11.1) — [release notes](https://github.com/Automattic/mongoose/releases/tag/9.11.1)
- UpdateManyModel update typing is now aligned with UpdateQuery. (9.11.1) — [release notes](https://github.com/Automattic/mongoose/releases/tag/9.11.1)
- UpdateOneModel update typing is now aligned with UpdateQuery. (9.11.1) — [release notes](https://github.com/Automattic/mongoose/releases/tag/9.11.1)

## mongoose 8

### Breaking changes

- Casting to Int32 or Double now rejects arrays. (8.24.6) — [release notes](https://github.com/Automattic/mongoose/releases/tag/8.24.6)

### Fixes and other changes

- Cloning with a seen map now preserves circular arrays. (8.24.6) — [release notes](https://github.com/Automattic/mongoose/releases/tag/8.24.6)
- The schema is now passed through when casting a nested comparison. (8.24.6) — [release notes](https://github.com/Automattic/mongoose/releases/tag/8.24.6)
- pull() now removes dates by comparing their values in indexOf(), rather than relying on reference equality. (8.24.6) — [release notes](https://github.com/Automattic/mongoose/releases/tag/8.24.6)
- Query path collisions are avoided when excluding a subdocument that has a select: false child. (8.24.6) — [release notes](https://github.com/Automattic/mongoose/releases/tag/8.24.6)