[Snyk] Upgrade mongodb from 3.5.9 to 6.3.0 #6
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Snyk has created this PR to upgrade mongodb from 3.5.9 to 6.3.0. See this package in npm: https://www.npmjs.com/package/mongodb See this project in Snyk: https://app.snyk.io/org/nath-enterprise-ltd-default/project/3aa451f6-bcb4-4bc1-9638-2333a77f7a01?utm_source=github-enterprise&utm_medium=referral&page=upgrade-pr
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR was automatically created by Snyk using the credentials of a real user.
Snyk has created this PR to upgrade mongodb from 3.5.9 to 6.3.0.
ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.
Warning: This is a major version upgrade, and may be a breaking change.
The recommended version fixes:
SNYK-JS-BL-608877
Why? Proof of Concept exploit, CVSS 7.7
(*) Note that the real score may have changed since the PR was raised.
Release notes
Package name: mongodb
-
6.3.0 - 2023-11-16
// In the connection string.
- NODE-3881: require hello command + OP_MSG when 'loadBalanced=True' (#3907) (fd58eec)
- NODE-5197: add server monitoring mode (#3899) (ae4c94a)
- NODE-5590: deprecate GridFS fields (#3905) (d2225da)
- NODE-4863: do not use RetryableWriteError for non-server errors (#3914) (08c9fb4)
- NODE-5709: bump mongodb-connection-string-url to 3.0.0 (#3909) (1c3dc02)
- NODE-5749: RTTPinger always sends legacy hello (#3921) (ebbfb8a)
- Reference
- API
- Changelog
-
6.3.0-dev.20240229.sha.99a0059 - 2024-02-29
-
6.3.0-dev.20240228.sha.f26de76 - 2024-02-28
-
6.3.0-dev.20240227.sha.09c9b0b - 2024-02-27
-
6.3.0-dev.20240224.sha.233a2e0 - 2024-02-24
-
6.3.0-dev.20240223.sha.17952d2 - 2024-02-23
-
6.3.0-dev.20240222.sha.46b7bbb - 2024-02-22
-
6.3.0-dev.20240221.sha.38742c2 - 2024-02-21
-
6.3.0-dev.20240220.sha.90cb6fa - 2024-02-20
-
6.3.0-dev.20240216.sha.10a5c5a - 2024-02-16
-
6.3.0-dev.20240214.sha.ecfc615 - 2024-02-14
-
6.3.0-dev.20240210.sha.a63fbc2 - 2024-02-10
-
6.3.0-dev.20240209.sha.ca3780a - 2024-02-09
-
6.3.0-dev.20240202.sha.9401d09 - 2024-02-02
-
6.3.0-dev.20240131.sha.a42039b - 2024-01-31
-
6.3.0-dev.20240127.sha.b7d28d3 - 2024-01-27
-
6.3.0-dev.20240126.sha.8f7bb59 - 2024-01-26
-
6.3.0-dev.20240125.sha.38fb2e4 - 2024-01-25
-
6.3.0-dev.20240123.sha.7f97c2a - 2024-01-23
-
6.3.0-dev.20240120.sha.f506b6a - 2024-01-20
-
6.3.0-dev.20240119.sha.9b76a43 - 2024-01-19
-
6.3.0-dev.20240113.sha.86e2659 - 2024-01-13
-
6.3.0-dev.20240110.sha.8504d91 - 2024-01-10
-
6.3.0-dev.20240108.sha.7f3ce0b - 2024-01-08
-
6.2.0 - 2023-10-20
- NODE-5613: add
- update bson to 6.2.0 (#3898) (32b7176)
- NODE-5496: remove client-side collection and database name check validation (#3873) (98550c6)
- NODE-5628: bulkWriteResult.insertedIds does not filter out _ids that are not actually inserted (#3867) (09f2a67)
- NODE-5706: make findOne() close implicit session to avoid memory leak (#3897) (995d138)
- Reference
- API
- Changelog
-
6.1.0 - 2023-09-14
- NODE-5634: bump bson version to ^6.1.0 (#3866) (c6edabb)
- NODE-5551: set AWS region from environment variable for STSClient (#3831) (e9a5079)
- NODE-5588: recursive calls to next cause memory leak (#3841) (9a8fdb2)
- Reference
- API
- Changelog
-
6.0.0 - 2023-08-28
-
6.0.0-alpha.2 - 2023-08-24
-
6.0.0-alpha.1 - 2023-08-24
-
6.0.0-alpha.0 - 2023-08-08
-
5.9.2 - 2023-12-05
-
5.9.1 - 2023-10-20
- NODE-5627: BulkWriteResult.insertedIds includes ids that were not inserted (#3870) (d766ae2)
- NODE-5691: make findOne() close implicit session to avoid memory leak (#3889) (0d6c9cd)
- Reference
- API
- Changelog
-
5.9.0 - 2023-09-14
-
5.8.1 - 2023-08-23
- NODE-5572: fix saslprep import (#3837) (250dc21)
- Reference
- API
- Changelog
-
5.8.0 - 2023-08-21
-
5.7.0 - 2023-07-06
-
5.6.0 - 2023-06-01
-
5.6.0-dev.20230606.sha.2b83ea4 - 2023-06-06
-
5.6.0-dev.20230603.sha.008fd6f - 2023-06-03
-
5.5.0 - 2023-05-11
-
5.4.0 - 2023-05-04
-
5.3.0 - 2023-04-18
-
5.2.0 - 2023-04-04
-
5.1.0 - 2023-02-23
-
5.0.1 - 2023-02-07
-
5.0.0 - 2023-01-31
-
5.0.0-alpha.0 - 2023-01-24
-
4.17.2 - 2023-12-05
-
4.17.1 - 2023-08-23
-
4.17.0 - 2023-08-17
-
4.16.0 - 2023-04-18
-
4.15.0 - 2023-04-04
-
4.14.0 - 2023-02-07
-
4.13.0 - 2022-12-19
-
4.12.1 - 2022-11-23
-
4.12.0 - 2022-11-16
-
4.11.0 - 2022-10-19
-
4.10.0 - 2022-09-19
-
4.9.1 - 2022-08-31
-
4.9.0 - 2022-08-18
-
4.8.1 - 2022-07-26
-
4.8.0 - 2022-07-13
-
4.7.0 - 2022-06-06
-
4.6.0 - 2022-05-11
-
4.6.0-alpha.0 - 2022-05-04
-
4.5.0 - 2022-04-04
-
4.4.1 - 2022-03-03
-
4.4.0 - 2022-02-17
-
4.3.1 - 2022-01-18
-
4.3.0 - 2022-01-06
-
4.2.2 - 2021-12-13
-
4.2.1 - 2021-11-30
-
4.2.0 - 2021-11-17
-
4.1.4 - 2021-11-03
-
4.1.3 - 2021-10-05
-
4.1.2 - 2021-09-14
-
4.1.1 - 2021-08-24
-
4.1.0 - 2021-08-03
-
4.0.1 - 2021-07-20
-
4.0.0 - 2021-07-13
-
4.0.0-beta.6 - 2021-07-01
-
4.0.0-beta.5 - 2021-05-26
-
4.0.0-beta.4 - 2021-05-18
-
4.0.0-beta.3 - 2021-04-06
-
4.0.0-beta.2 - 2021-03-16
-
4.0.0-beta.1 - 2021-02-02
-
4.0.0-beta.0 - 2021-01-19
-
3.7.4 - 2023-06-21
-
3.7.3 - 2021-10-20
-
3.7.2 - 2021-10-05
-
3.7.1 - 2021-09-14
-
3.7.0 - 2021-08-31
-
3.6.12 - 2021-08-30
-
3.6.11 - 2021-08-05
-
3.6.10 - 2021-07-06
-
3.6.9 - 2021-05-26
-
3.6.8 - 2021-05-21
-
3.6.7 - 2021-05-18
-
3.6.6 - 2021-04-06
-
3.6.5 - 2021-03-16
-
3.6.4 - 2021-02-02
-
3.6.3 - 2020-11-06
-
3.6.2 - 2020-09-10
-
3.6.1 - 2020-09-02
-
3.6.0 - 2020-07-30
-
3.6.0-beta.0 - 2020-04-14
-
3.5.11 - 2020-09-10
-
3.5.10 - 2020-07-30
-
3.5.9 - 2020-06-12
from mongodb GitHub release notes6.3.0 (2023-11-15)
The MongoDB Node.js team is pleased to announce version 6.3.0 of the
mongodbpackage!Release Notes
New client option
serverMonitoringModeFor users that want to control the behaviour of the monitoring connection between each node in the topology, a new option,
serverMonitoringMode, has been added. This defaults toautobut can be forced into a specific mode by providing a value ofpollorstream. When the setting isautothe monitoring mode will be determined by the environment the driver is running in, specifically, FaaS environments prefer "polling" mode and all others prefer "streaming".A polling monitor periodically issues a
hellocommand to the node at an interval ofheartbeatFrequencyMS. A streaming monitor sends an initialhelloand then will automatically get a response from the Node when a change in server configuration occurs or at a maximum time ofheartbeatFrequencyMS. The value of that option defaults to 10000 milliseconds.This new option can be provided in the connection string or as an option to the
MongoClient.new MongoClient('mongodb://127.0.0.1:27017/?serverMonitoringMode=stream');
// In the options
new MongoClient('mongodb://127.0.0.1:27017/', { serverMonitoringMode: 'stream' });
Fix connection leak when
serverApiis enabledWhen enabling
serverApithe driver's RTT measurement logic (used to determine the closest node) still sent the legacy hello command "isMaster" causing the server to return an error. Unfortunately, the error handling logic did not correctly destroy the socket which would cause a leak.Both sending the correct hello command and the error handling connection clean-up logic are fixed in this change.
GridFS fields deprecated
The GridFS
contentTypeandaliasesoptions are deprecated. According to the GridFS spec, applications wishing to storecontentTypeandaliasesshould add a corresponding field to themetadatadocument instead.Remove deprecation warning about punycode
The
mongodb-connection-string-urlpackage which parses connection strings relied on Node's punycode module, the package now imports the community package removing the deprecation warning on Node.js 20+.Features
Bug Fixes
Documentation
We invite you to try the
mongodblibrary immediately and report any issues to the NODE project.6.2.0 (2023-10-19)
The MongoDB Node.js team is pleased to announce version 6.2.0 of the
mongodbpackage!Release Notes
Updated to BSON 6.2.0
BSON now prints in full color! 🌈 🚀
See our release notes for BSON 6.2.0 here for more examples!
insertedIdsin bulk write now contain only successful insertionsPrior to this fix, the bulk write error's
result.insertedIdsproperty contained the_idof each attempted insert in a bulk operation.Now, when a
bulkwrite()or aninsertMany()operation rejects one or more inserts, throwing an error, the error'sresult.insertedIdsproperty will only contain the_idfields of successfully inserted documents.Fixed edge case leak in
findOne()When running a
findOneagainst a time series collection, the driver left the implicit session for the cursor un-ended due to the way the server returns the resulting cursor information. Now the cursor will always be cleaned up regardless of the outcome of the find operation.Removed client-side collection and database name validation
Database and collection name checking will now be in sync with the MongoDB server's naming restrictions. Specifically, users can now create collections that start or end with the '.' character.
Features
awaitedfield to SDAM heartbeat events (#3895) (b50aadc)Bug Fixes
Documentation
We invite you to try the
mongodblibrary immediately, and report any issues to the NODE project.6.1.0 (2023-09-14)
The MongoDB Node.js team is pleased to announce version 6.1.0 of the
mongodbpackage!Release Notes
Bump bson version to expose new
Decimal128.fromStringWithRounding()methodIn this release, we have adopted the changes made to Decimal128 in bson version 6.1.0. We have added a new
fromStringWithRounding()method which exposes the previously available inexact rounding behaviour.See the bson v6.1.0 release notes for more information.
Use region settings for STS AWS credentials request
When using IAM AssumeRoleWithWebIdentity AWS authentication the driver uses the @ aws-sdk/credential-providers package to contact the Security Token Service API for temporary credentials. AWS recommends using Regional AWS STS endpoints instead of the global endpoint to reduce latency, build-in redundancy, and increase session token validity. Unfortunately, environment variables
AWS_STS_REGIONAL_ENDPOINTSandAWS_REGIONdo not directly control the region the SDK's STS client contacts for credentials.The driver now has added support for detecting these variables and setting the appropriate options when calling the SDK's API: fromNodeProviderChain().
Important
The driver will only set region options if BOTH environment variables are present.
AWS_STS_REGIONAL_ENDPOINTSMUST be set to either'legacy'or'regional', andAWS_REGIONmust be set.Fix memory leak with ChangeStreams
In a previous release, 5.7.0, we refactored cursor internals from callbacks to async/await. In particular, the
nextfunction that powers cursors was written with callbacks and would recursively call itself depending on the cursor type. ForChangeStreams, this function would call itself if there were no new changes to return to the user. After converting that code to async/await each recursive call created a new promise that saved the current async context. This would slowly build up memory usage if no new changes came in to unwind the recursive calls.The function is now implemented as a loop, memory leak be gone!
Features
Bug Fixes
Documentation
We invite you to try the
mongodblibrary immediately, and report any issues to the NODE project.Read more
5.9.1 (2023-10-18)
The MongoDB Node.js team is pleased to announce version 5.9.1 of the
mongodbpackage!Release Notes
insertedIdsin bulk write now contain only successful insertionsPrior to this fix, the bulk write error's
result.insertedIdsproperty contained the_idof each attempted insert in a bulk operation.Now, when a
bulkwrite()or aninsertMany()operation rejects one or more inserts, throwing an error, the error'sresult.insertedIdsproperty will only contain the_idfields of successfully inserted documents.Fixed edge case leak in
findOne()When running a
findOneagainst a time series collection, the driver left the implicit session for the cursor un-ended due to the way the server returns the resulting cursor information. Now the cursor will always be cleaned up regardless of the outcome of the find operation.Bug Fixes
Documentation
We invite you to try the
mongodblibrary immediately, and report any issues to the NODE project.Read more
5.8.1 (2023-08-23)
The MongoDB Node.js team is pleased to announce version 5.8.1 of the
mongodbpackage!Release Notes
Import of
saslprepupdated to correct library.Fixes the import of saslprep to be the correct
@ mongodb-js/saslpreplibrary.Bug Fixes
Documentation
We invite you to try the
mongodblibrary immediately, and report any issues to the NODE project.Read more
Read more
Read more
Commit messages
Package name: mongodb
Compare
Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.
For more information:
🧐 View latest project report
🛠 Adjust upgrade PR settings
🔕 Ignore this dependency or unsubscribe from future upgrade PRs