Mongoose 7

Apply the Node.js 22 and TypeScript 5.9 prompts first. These rules cover Mongoose 7 and were checked against 7.8.12 with its MongoDB Node.js driver 5.9.2 dependency. The package declares Node.js >= 14.20.1; use the included maintained runtime baseline rather than treating that minimum as a deployment recommendation. Mongoose 7 is in legacy support and receives important fixes.

Schema strictness and write boundaries

• Construct allowlisted documents and update objects before calling new Model(), doc.set(), create(), insertMany(), or update APIs. Assign tenant, owner, role, workflow, billing, discriminator, and version-key paths through authorized server code.
• Reject caller-controlled id as well as _id wherever identity must be server assigned: the built-in id virtual in 7.8.12 has a setter that changes _id, including during construction and doc.set().
• Set strict: "throw" on security-sensitive schemas to reject unknown write paths; the default strict: true strips them. Separately authorize known paths, and keep operation options such as strict, upsert, and overwriteDiscriminatorKey under server control.
• Use explicit nested schemas for security-relevant structures. Mixed, Object, {}, and untyped arrays permit arbitrary content; validate any deliberately schemaless subtree separately and call markModified() when persisting in-place Mixed changes.
• Map allowed update fields to fixed dotted paths and construct operators and arrayFilters in trusted code. Reject unexpected path segments, including prototype-related segments, before