Mongoose 9

Apply the JavaScript ES2026, Node.js 24, and TypeScript 7 prompts first. These rules target Mongoose 9 and were checked against 9.9.4, whose package requires Node.js 20.19.0 or later and declares MongoDB Node.js driver ~7.5. Use a maintained MongoDB server release compatible with that driver.

Schemas and validation

• Build the documents passed to constructors, create(), doc.set(), and updates from an operation-specific field allowlist. Set tenant, owner, roles, approval state, discriminator keys, and secrets in trusted application code; a field's presence in a schema does not authorize clients to write it.
• Use strict: 'throw' for security-sensitive schemas and writes. The default strict: true strips unknown paths; neither setting protects known privileged fields. Keep schema definitions, aliases, and per-operation strictness options server-controlled.
• Prefer typed subdocuments to Mixed, Object, {}, or untyped arrays for security-sensitive data. Mixed paths do not cast their contents or reliably detect nested modifications; validate any unavoidable Mixed structure and call markModified() for intended changes.
• Set runValidators: true on query updates; it defaults to false. Update validators see a query as this and run only for updated paths and supported operators, so they cannot validate the complete resulting document or authorize a state transition.
• Enforce counter bounds and array-size invariants in atomic conditions or transactions: update validators ignore $inc, and array operators such as $push and $addToSet validate elements