Mongoose 8

Apply the Node.js 24 and TypeScript 5.9 prompts first. These rules cover Mongoose 8 and were checked against 8.24.4 with its MongoDB Node driver dependency ~6.20.0.

Schema strictness and write boundaries

• Construct payloads for create(), insertMany(), updates, and bulk operations from operation-specific field allowlists. Set tenant, owner, roles, prices, and approval state from authorized server logic; schema membership does not make a field client-writable.
• Map public field names to fixed schema paths. Reject unexpected dotted paths, positional operators, aliases, and prototype-related path segments such as __proto__.x before casting; removing only a literal __proto__ property is insufficient.
• Set strict: 'throw' on security-relevant schemas and keep per-operation strictness overrides server-controlled. Strict mode rejects unknown paths but does not authorize writes to known paths.
• Use typed subdocuments for security-sensitive structures instead of Mixed, Object, {}, or untyped arrays. If Mixed is necessary, validate its complete structure and call markModified() after in-place changes that must persist.
• Mark a string path required whenever null is unacceptable, because Mongoose 8 accepts null for a non-required enum path that Mongoose 7 rejected.
• Build Mongoose options separately from request data. Keep strict, runValidators, upsert, overwriteImmutable, overwriteDiscriminatorKey, timestamps, session, and validation-bypass options under application control.

Filter injection and the limits of sanitizeFilter