{"schemaVersion":1,"status":{"id":"bbe62dc3-3316-4f88-8789-47ef9888ec97","scanId":"f04b2634-08d6-4531-b027-f733b40fbc32","invalidatedAt":null,"invalidationReason":null,"replacedBy":null,"snapshotAvailable":true,"policyAllowed":true,"createdAt":"2026-10-09T14:56:13.766Z","observationRevision":0,"previousScanId":null,"previousReportId":null,"current":true},"report":{"schemaVersion":1,"id":"bbe62dc3-3316-4f88-8789-47ef9888ec97","scanId":"f04b2634-08d6-4531-b027-f733b40fbc32","classifierRevision":"classifier_v2","observedAt":"2026-10-09T14:56:12.678Z","classifiedAt":"2026-10-09T14:56:13.768Z","artifact":{"name":"mongoose","version":"9.11.1","integrity":"sha512-fVtjTVACOtAb0PjDDF+O5NebcEJy5JpAH+AXk16/5i36w38YkW6MZ+KWV54bdIOJFymDz1VjjA5Xg6L2QfjQjQ==","tarballUrl":"https://registry.npmjs.org/mongoose/-/mongoose-9.11.1.tgz"},"preparation":{"id":"e87e5044-0c20-4c9c-b76f-7d93eaf57986","outcome":"pass","failure":null,"profileRevision":"npm_11_19_0_linux_amd64_v2","snapshot":{"id":"a7006f95-de30-44a2-b477-4ed3ea0d1dbc","generation":"cc6d7fcd-7e86-4eae-b317-4ba733e1f80c","lockDigest":"2d138b06b0ae87b7350de089b82658140f65d3cc135123ef6dd4bfde3393e56a","treeDigest":"af8aaf1dcd22dda6d448f51e666c9bad02a78c23a269f9bfff04b7f096ad03ae","profileRevision":"npm_11_19_0_linux_amd64_v2","installerImage":"node:24.21.0-bookworm-slim@sha256:5cbc7caba8c2c0f0bca675d1b61b9f2857e1cf1853c6164ee9dd409501a936e7"},"installedCount":19,"omittedOptionalCount":0,"staticObservations":{"native":{"count":0,"paths":[],"buildIndicators":[],"prerequisiteProven":false},"declared":{"main":"./index.js","type":"commonjs","engines":{"node":">=20.19.0"},"scripts":{"tdd":"mocha --watch --inspect --ignore \"test/encryption/**/*.test.js\" \"./test/**/*.test.js\" --watch-files lib/**/*.js test/**/*.js","lint":"eslint .","test":"mocha --exit --ignore \"test/encryption/**/*.test.js\" \"./test/**/*.test.js\"","mongo":"node ./tools/repl.js","lint-js":"eslint . --ext .js --ext .cjs","lint-md":"markdownlint-cli2 \"docs/**/*.md\" \"docs/*.md\" \"*.md\"","lint-ts":"eslint . --ext .ts","release":"git pull && git push origin master --tags && npm publish","test-rs":"START_REPLICA_SET=1 mocha --timeout 30000 --exit --ignore \"test/encryption/**/*.test.js\" \"./test/**/*.test.js\"","test:ci":"npm run test -- --reporter min --timeout 10000","docs:test":"npm run docs:generate","docs:view":"node ./scripts/static.js","test-deno":"deno run --allow-env --allow-read --allow-net --allow-run --allow-sys --allow-write ./test/deno.mjs","docs:clean":"npm run docs:clean:stable","publish-7x":"npm publish --tag 7x","release-5x":"git pull origin 5.x && git push origin 5.x && git push origin 5.x --tags && npm publish --tag 5x","release-6x":"git pull origin 6.x && git push origin 6.x && git push origin 6.x --tags && npm publish --tag 6x","test-rs:ci":"npm run test-rs -- --reporter min","test:types":"tstyche","test-deno:ci":"npm run test-deno -- --reporter min","ts-benchmark":"cd ./benchmarks/typescript/simple && npm install && npm run benchmark | node ../../../scripts/tsc-diagnostics-check","docs:clean:5x":"rm -rf index.html && rm -rf ./docs/5.x && rm -rf ./docs/source/_docs && rm -rf ./tmp","docs:clean:6x":"rm -rf index.html && rm -rf ./docs/6.x && rm -rf ./docs/source/_docs && rm -rf ./tmp","docs:copy:tmp":"mkdirp ./tmp/docs/css && mkdirp ./tmp/docs/js && mkdirp ./tmp/docs/images && mkdirp ./tmp/docs/tutorials && mkdirp ./tmp/docs/typescript && mkdirp ./tmp/docs/api && ncp ./docs/css ./tmp/docs/css --filter=.css$ && ncp ./docs/js ./tmp/docs/js --filter=.js$ && ncp ./docs/images ./tmp/docs/images && ncp ./docs/tutorials ./tmp/docs/tutorials && ncp ./docs/typescript ./tmp/docs/typescript && ncp ./docs/api ./tmp/docs/api && cp index.html ./tmp && cp docs/*.html ./tmp/docs/","docs:generate":"node ./scripts/website.js","test-coverage":"c8 --reporter=html --reporter=text npm test","test-encryption":"mocha --exit ./test/encryption/*.test.js","attest-benchmark":"node ./benchmarks/typescript/infer.bench.mts","docs:check-links":"linkinator http://127.0.0.1:8089 --silent --recurse --skip cdn.carbonads.com --skip m.servedby-buysellads.com --skip \"127\\.0\\.0\\.1:8089/docs/\\d+.x\"","docs:copy:tmp:5x":"rm -rf ./docs/5.x && ncp ./tmp ./docs/5.x","docs:copy:tmp:6x":"rm -rf ./docs/6.x && ncp ./tmp ./docs/6.x","test-coverage:ci":"c8 --reporter=html --reporter=text npm run test:ci","docs:clean:stable":"rm -rf index.html && rm -rf ./docs/*.html  && rm -rf ./docs/api && rm -rf ./docs/tutorials/*.html && rm -rf ./docs/typescript/*.html && rm -rf ./docs/*.html && rm -rf ./docs/source/_docs && rm -rf ./tmp","test-encryption:ci":"npm run test-encryption -- --reporter min","ts-benchmark:local":"node ./scripts/create-tarball && cd ./benchmarks/typescript/simple && rm -rf ./node_modules && npm install && npm run benchmark | node ../../../scripts/tsc-diagnostics-check","setup-test-encryption":"node scripts/setup-encryption-tests.js","docs:prepare:publish:5x":"git checkout 5.x && git merge 5.x && npm run docs:clean:stable && npm run docs:generate && npm run docs:copy:tmp && git checkout gh-pages && npm run docs:copy:tmp:5x","docs:prepare:publish:6x":"git checkout 6.x && git merge 6.x && npm run docs:clean:stable && env DOCS_DEPLOY=true npm run docs:generate && mv ./docs/6.x ./tmp && git checkout gh-pages && npm run docs:copy:tmp:6x","docs:prepare:publish:7x":"env DOCS_DEPLOY=true npm run docs:generate && git checkout gh-pages && rm -rf ./docs/7.x && mv ./tmp ./docs/7.x","docs:prepare:publish:8x":"env DOCS_DEPLOY=true npm run docs:generate && git checkout gh-pages && rm -rf ./docs/8.x && mv ./tmp ./docs/8.x","docs:generate:sponsorData":"node ./scripts/loadSponsorData.js","docs:update-mongodb-links":"node ./scripts/update-mongodb-links.js","docs:prepare:publish:stable":"git checkout gh-pages && git merge master && env GENERATE_SEARCH=true npm run docs:generate","create-separate-require-instance":"rm -rf ./node_modules/mongoose-separate-require-instance && node ./scripts/create-tarball && tar -xzf mongoose.tgz -C ./node_modules && mv ./node_modules/package ./node_modules/mongoose-separate-require-instance"},"dependencies":{"ms":"2.1.3","sift":"17.1.3","mpath":"0.9.0","kareem":"3.4.0","mquery":"6.0.0","mongodb":"~7.7","@standard-schema/spec":"^1.1.0"},"devDependencies":{"c8":"12.0.0","ajv":"8.20.0","dox":"1.0.0","ncp":"^2.0.0","pug":"3.0.4","xss":"1.0.15","glob":"^13.0.6","uuid":"14.0.2","mocha":"12.0.2","sinon":"22.1.0","acquit":"1.4.0","eslint":"10.11.0","marked":"18.0.14","mkdirp":"^3.0.1","moment":"2.31.0","cheerio":"1.2.0","express":"5.2.1","globals":"^17.4.0","tstyche":"^7.0.0","fs-extra":"~11.4.0","@eslint/js":"^9.39.3","linkinator":"8.x","typescript":"5.9.3","@ark/attest":"0.56.5","@types/node":"^20.19.0","highlight.js":"11.12.0","acquit-ignore":"0.2.2","acquit-require":"0.1.1","lodash.isequal":"4.5.0","mongodb-runner":"^6.0.0","markdownlint-cli2":"0.23.3","typescript-eslint":"^8.31.1","lodash.isequalwith":"4.4.0","mongodb-memory-server":"11.3.0","mongodb-client-encryption":"^7.2.0","eslint-plugin-mocha-no-only":"1.2.0","@mongodb-js/mongodb-downloader":"^2.0.2"}},"platform":{"os":true,"cpu":true,"libc":true},"evidenceLevel":"static_only","lifecycleScripts":[]}},"matrix":{"id":"bfab88d7-3f4a-41b5-97a9-5aafd5bda511","revision":"production_ab51508deb208994caf81cb80f14b800","platform":"linux_amd64_glibc","harnessRevision":"load_v2","planRevision":"explicit_exports_v1","policyRevision":"runtime_limits_v2","images":[{"profileId":"node_24_21_0","kind":"node","version":"24.21.0","imageId":"sha256:f2fcbb4dfbd6d5f57f4e43de97e70182d9982ac7cc0cc063dfff2cf1759a411d","builtAt":"2026-10-04T15:20:38.392Z","sourceImage":"node:24.21.0-bookworm-slim@sha256:5cbc7caba8c2c0f0bca675d1b61b9f2857e1cf1853c6164ee9dd409501a936e7","baseImage":"gcr.io/distroless/cc-debian13:nonroot@sha256:20afe6a70f2565277b704cc17289cb557f353a3619f6350f52a2317106598df4","supportImage":"node:26.10.0-bookworm-slim@sha256:0a992e1420e2d70611578f1844a6f10a9d11fe6bb535aabf72efe3007f13d79b","platform":"linux_amd64_glibc","recipeRevision":"runtime_image_v1"},{"profileId":"node_26_10_0","kind":"node","version":"26.10.0","imageId":"sha256:9c1c93cc35d1408d26a61c4efccbde37c35425e362a2e723b885c3333d2be073","builtAt":"2026-10-04T15:20:47.161Z","sourceImage":"node:26.10.0-bookworm-slim@sha256:0a992e1420e2d70611578f1844a6f10a9d11fe6bb535aabf72efe3007f13d79b","baseImage":"gcr.io/distroless/cc-debian13:nonroot@sha256:20afe6a70f2565277b704cc17289cb557f353a3619f6350f52a2317106598df4","supportImage":"node:26.10.0-bookworm-slim@sha256:0a992e1420e2d70611578f1844a6f10a9d11fe6bb535aabf72efe3007f13d79b","platform":"linux_amd64_glibc","recipeRevision":"runtime_image_v1"},{"profileId":"bun_1_4_2","kind":"bun","version":"1.4.2","imageId":"sha256:2343363679fb92d59a395ff081b783b5514f06295b1bc6d61baaeef17e793789","builtAt":"2026-10-04T15:21:07.160Z","sourceImage":"oven/bun:1.4.2-debian@sha256:53710ce0f14eef8312521c586a7ae1d9aeab4011840f09f1966073b68fc2e2ab","baseImage":"gcr.io/distroless/cc-debian13:nonroot@sha256:20afe6a70f2565277b704cc17289cb557f353a3619f6350f52a2317106598df4","supportImage":"node:26.10.0-bookworm-slim@sha256:0a992e1420e2d70611578f1844a6f10a9d11fe6bb535aabf72efe3007f13d79b","platform":"linux_amd64_glibc","recipeRevision":"runtime_image_v1"},{"profileId":"deno_2_9_7","kind":"deno","version":"2.9.7","imageId":"sha256:4292bb23555f98fb9dfc30fb447daa1c301686d89264fd8643ccb86bc0d53c29","builtAt":"2026-10-04T15:21:22.570Z","sourceImage":"denoland/deno:debian-2.9.7@sha256:869d374bdaddda4fde029c492d7219199b0e821c2c53cca5357b3a6f5b9336fc","baseImage":"gcr.io/distroless/cc-debian13:nonroot@sha256:20afe6a70f2565277b704cc17289cb557f353a3619f6350f52a2317106598df4","supportImage":"node:26.10.0-bookworm-slim@sha256:0a992e1420e2d70611578f1844a6f10a9d11fe6bb535aabf72efe3007f13d79b","platform":"linux_amd64_glibc","recipeRevision":"runtime_image_v1"}]},"omissions":{"counts":{"pattern":0,"non_executable":0,"not_exported":0,"invalid_subpath":0,"coverage_limit":0},"samples":[]},"outcome":"pass","evidenceLevel":"smoke_tested","coverageComplete":true,"cells":[{"runId":"1bfb9b32-b434-4b7a-8b9a-ac0044cfc43d","profileId":"node_24_21_0","group":"root","mode":"esm","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":616.5876040002331,"failure":null,"entries":[{"index":0,"specifier":"mongoose","displaySpecifier":"mongoose","outcome":"pass","durationMs":306.15871699999997,"resolvedTo":"file:///workspace/node_modules/mongoose/index.js","failure":null}],"sessions":[{"probeId":"fb4db3fd-2cc0-4bc7-adcf-d5a722a52192","startIndex":0,"stopReason":"completed","exitCode":0,"oomKilled":false,"durationMs":616.5876040002331}]},{"runId":"bbd0a6e4-b1ab-4dc2-9203-6ccaf394d218","profileId":"node_24_21_0","group":"root","mode":"commonjs","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":764.9712040000595,"failure":null,"entries":[{"index":0,"specifier":"mongoose","displaySpecifier":"mongoose","outcome":"pass","durationMs":381.204205,"resolvedTo":"/workspace/node_modules/mongoose/index.js","failure":null}],"sessions":[{"probeId":"e4e0a516-2e76-4df9-9999-ec8331caaa1d","startIndex":0,"stopReason":"completed","exitCode":0,"oomKilled":false,"durationMs":764.9712040000595}]},{"runId":"680cfaf9-a9aa-47c0-88e8-ea9ee5911f00","profileId":"node_24_21_0","group":"subpaths","mode":"esm","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null,"entries":[],"sessions":[]},{"runId":"d5e23e35-4bfb-4386-8b9d-8b47f9bdd4d3","profileId":"node_24_21_0","group":"subpaths","mode":"commonjs","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null,"entries":[],"sessions":[]},{"runId":"abde2f78-6ac8-4a54-bea0-ec780ad0aeb3","profileId":"node_26_10_0","group":"root","mode":"esm","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":738.2761769997887,"failure":null,"entries":[{"index":0,"specifier":"mongoose","displaySpecifier":"mongoose","outcome":"pass","durationMs":312.596562,"resolvedTo":"file:///workspace/node_modules/mongoose/index.js","failure":null}],"sessions":[{"probeId":"868511dd-7b18-4ce2-bb40-8cc94963c17e","startIndex":0,"stopReason":"completed","exitCode":0,"oomKilled":false,"durationMs":738.2761769997887}]},{"runId":"d5bfcbe0-f06a-4d67-9de1-3410be070115","profileId":"node_26_10_0","group":"root","mode":"commonjs","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":748.1106090000831,"failure":null,"entries":[{"index":0,"specifier":"mongoose","displaySpecifier":"mongoose","outcome":"pass","durationMs":357.252702,"resolvedTo":"/workspace/node_modules/mongoose/index.js","failure":null}],"sessions":[{"probeId":"82dc711d-d439-40e5-827e-844f857750c3","startIndex":0,"stopReason":"completed","exitCode":0,"oomKilled":false,"durationMs":748.1106090000831}]},{"runId":"07b1c6c6-0f47-4e7a-a738-83880ac3c59c","profileId":"node_26_10_0","group":"subpaths","mode":"esm","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null,"entries":[],"sessions":[]},{"runId":"9b72fc68-da5b-4dfb-b404-fa183834e205","profileId":"node_26_10_0","group":"subpaths","mode":"commonjs","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null,"entries":[],"sessions":[]},{"runId":"f9d6d778-785d-4fc8-b214-30e716da5fa5","profileId":"bun_1_4_2","group":"root","mode":"esm","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":875.0112879998051,"failure":null,"entries":[{"index":0,"specifier":"mongoose","displaySpecifier":"mongoose","outcome":"pass","durationMs":419.799616,"resolvedTo":"file:///workspace/node_modules/mongoose/index.js","failure":null}],"sessions":[{"probeId":"3d0a95d9-6fe4-4dba-b9d9-35cd4aa322a9","startIndex":0,"stopReason":"completed","exitCode":0,"oomKilled":false,"durationMs":875.0112879998051}]},{"runId":"bad36aa0-7c21-4b2c-abd6-bf76b84aa848","profileId":"bun_1_4_2","group":"root","mode":"commonjs","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":731.1831950000487,"failure":null,"entries":[{"index":0,"specifier":"mongoose","displaySpecifier":"mongoose","outcome":"pass","durationMs":372.558614,"resolvedTo":"/workspace/node_modules/mongoose/index.js","failure":null}],"sessions":[{"probeId":"38c36c2f-da5c-4d57-b792-78c8eafb29f1","startIndex":0,"stopReason":"completed","exitCode":0,"oomKilled":false,"durationMs":731.1831950000487}]},{"runId":"6cfa5658-73fa-4529-83e9-b9ec97a22d5c","profileId":"bun_1_4_2","group":"subpaths","mode":"esm","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null,"entries":[],"sessions":[]},{"runId":"5b15841c-82c9-47a6-934d-9b7dd443bfba","profileId":"bun_1_4_2","group":"subpaths","mode":"commonjs","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null,"entries":[],"sessions":[]},{"runId":"b43e10b0-af2b-4e9b-a83f-8e92f7f25324","profileId":"deno_2_9_7","group":"root","mode":"esm","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":1300.334530999884,"failure":null,"entries":[{"index":0,"specifier":"mongoose","displaySpecifier":"mongoose","outcome":"pass","durationMs":782.118088,"resolvedTo":"file:///workspace/node_modules/mongoose/index.js","failure":null}],"sessions":[{"probeId":"ac7b724d-97df-41ee-b4b4-b0d45a15afd2","startIndex":0,"stopReason":"completed","exitCode":0,"oomKilled":false,"durationMs":1300.334530999884}]},{"runId":"f453040d-92e0-4cda-839d-504946ba9b67","profileId":"deno_2_9_7","group":"root","mode":"commonjs","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":1173.5004480001517,"failure":null,"entries":[{"index":0,"specifier":"mongoose","displaySpecifier":"mongoose","outcome":"pass","durationMs":713.8978870000001,"resolvedTo":"/workspace/node_modules/mongoose/index.js","failure":null}],"sessions":[{"probeId":"fa7ae7ef-1704-43ef-99a7-e62d59c57795","startIndex":0,"stopReason":"completed","exitCode":0,"oomKilled":false,"durationMs":1173.5004480001517}]},{"runId":"85ef1d3e-4d40-482d-bf44-f46d41ee4e98","profileId":"deno_2_9_7","group":"subpaths","mode":"esm","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null,"entries":[],"sessions":[]},{"runId":"77c90536-de34-410c-97e8-7d7649073ae9","profileId":"deno_2_9_7","group":"subpaths","mode":"commonjs","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null,"entries":[],"sessions":[]}],"limitations":["Only installation and loading were observed; functional correctness and package safety are not established.","Subpath batches share module caches and globals; root modes use separate fresh sandboxes.","Package-visible harness observations can be tampered with. They are not adversarial attestation.","Evidence applies to these exact artifacts, dependency snapshot, runtime images and Linux amd64/glibc policy.","Runtime error codes are captured observations and can also be thrown by package code."]}}