[Snyk] Upgrade mongodb from 6.3.0 to 6.9.0 #279

arenault-pass · 2024-10-13T05:57:56Z

Snyk has created this PR to upgrade mongodb from 6.3.0 to 6.9.0.

As this is a private repository, Snyk-bot does not have access. Therefore, this PR has been created automatically, but appears to have been created by a real user.

✨ Snyk has automatically assigned this pull request, set who gets assigned.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

The recommended version is 102 versions ahead of your current version.
The recommended version was released a month ago, on 2024-09-12.

The recommended version fixes:

Issue	PriorityScore (*)	Exploit Maturity
Regular Expression Denial of Service (ReDoS) SNYK-JS-FASTXMLPARSER-7573289	559/1000 Why? Has a fix available, CVSS 6.9	No Known Exploit
Server-Side Request Forgery (SSRF) SNYK-JS-IP-7148531	559/1000 Why? Has a fix available, CVSS 6.9	Proof of Concept
Cross-site Scripting SNYK-JS-SERVESTATIC-7926865	559/1000 Why? Has a fix available, CVSS 6.9	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Release notes

Package name: mongodb

6.9.0 - 2024-09-12
Read more
6.9.0-dev.20241012.sha.a473de95 - 2024-10-12
6.9.0-dev.20241011.sha.8def42de - 2024-10-11
6.9.0-dev.20241010.sha.6ecf198f - 2024-10-10
6.9.0-dev.20241003.sha.91f30357 - 2024-10-03
6.9.0-dev.20241002.sha.d56e235c - 2024-10-02
6.9.0-dev.20241001.sha.85f7dcf9 - 2024-10-01
6.9.0-dev.20240928.sha.3f9d2437 - 2024-09-28
6.9.0-dev.20240927.sha.681ddd8d - 2024-09-27
6.9.0-dev.20240926.sha.3d3da407 - 2024-09-26
6.9.0-dev.20240918.sha.643a8755 - 2024-09-18
6.9.0-dev.20240917.sha.20396e1b - 2024-09-17
6.9.0-dev.20240913.sha.8b0f3541 - 2024-09-13
6.8.2 - 2024-09-12
6.8.2 (2024-09-12)

The MongoDB Node.js team is pleased to announce version 6.8.2 of the mongodb package!

Release Notes

Fixed mixed use of cursor.next() and cursor[Symbol.asyncIterator]

In 6.8.0, we inadvertently prevented the use of cursor.next() along with using for await syntax to iterate cursors. If your code made use of the following pattern and the call to cursor.next retrieved all your documents in the first batch, then the for-await loop would never be entered. This issue is now fixed.

const firstDoc = await cursor.next();

for await (const doc of cursor) {
// process doc
// ...
}

Bug Fixes
- NODE-6367: enable mixed use of iteration APIs (#4234) (d63bf6f)
Documentation
- Reference
- API
- Changelog
We invite you to try the mongodb library immediately, and report any issues to the NODE project.
6.8.1 - 2024-09-06
6.8.1 (2024-09-06)

The MongoDB Node.js team is pleased to announce version 6.8.1 of the mongodb package!

Release Notes

Fixed enableUtf8Validation option

Starting in v6.8.0 we inadvertently removed the ability to disable UTF-8 validation when deserializing BSON. Validation is normally a good thing, but it was always meant to be configurable and the recent Node.js runtime issues (v22.7.0) make this option indispensable for avoiding errors from mistakenly generated invalid UTF-8 bytes.

Bug Fixes
- NODE-6355: respect utf8 validation option when iterating cursors (#4220) (886cefb)
Documentation
- Reference
- API
- Changelog
We invite you to try the mongodb library immediately, and report any issues to the NODE project.
6.8.0 - 2024-06-27
6.8.0 (2024-06-27)

The MongoDB Node.js team is pleased to announce version 6.8.0 of the mongodb package!

Release Notes

Add ReadConcernMajorityNotAvailableYet to retryable errors

ReadConcernMajorityNotAvailableYet (error code 134) is now a retryable read error.

ClientEncryption.createDataKey() and other helpers now support named KMS providers

KMS providers can now be associated with a name and multiple keys can be provided per-KMS provider. The following example configures a ClientEncryption object with multiple AWS keys:

const clientEncryption = new ClientEncryption(keyVaultClient, {
'aws:key1': {
accessKeyId: ...,
secretAccessKey: ...
},
'aws:key2': {
accessKeyId: ...,
secretAccessKey: ...
},

clientEncryption.createDataKey('aws:key-1', { ... });

Named KMS providers are supported for azure, AWS, KMIP, local and gcp KMS providers. Named KMS providers cannot be used if the application is using the automatic KMS provider refresh capability.

This feature requires mongodb-client-encryption>=6.0.1.

KMIP data keys now support a delegated option

When creating a KMIP data key, delegated can now be specified. If true, the KMIP provider will perform encryption / decryption of the data key locally, ensuring that the encryption key never leaves the KMIP server.
```
clientEncryption.createDataKey('kmip', { masterKey: { delegated: true } } );
```
This feature requires mongodb-client-encryption>=6.0.1.

Cursor responses are now parsed lazily 🦥

MongoDB cursors (find, aggregate, etc.) operate on batches of documents equal to batchSize. Each time the driver runs out of documents for the current batch it gets more (getMore) and returns each document one at a time through APIs like cursor.next() or for await (const doc of cursor).

Prior to this change, the Node.js driver was designed in such a way that the entire BSON response was decoded after it was received. Parsing BSON, just like parsing JSON, is a synchronous blocking operation. This means that throughout a cursor's lifetime invocations of .next() that need to fetch a new batch hold up on parsing batchSize (default 1000) documents before returning to the user.

In an effort to provide more responsiveness, the driver now decodes BSON "on demand". By operating on the layers of data returned by the server, the driver now receives a batch, and only obtains metadata like size, and if there are more documents to iterate after this batch. After that, each document is parsed out of the BSON as the cursor is iterated.

A perfect example of where this comes in handy is our beloved mongosh! 💚
```
test> db.test.find()
[
	{ _id: ObjectId('665f7fc5c9d5d52227434c65'), ... },
  ...
]
Type "it" for more
```
That Type "it" for more message would now print after parsing only the documents displayed rather than after the entire batch is parsed.

Add Signature to Github Releases

The Github release for the mongodb package now contains a detached signature file for the NPM package (named
mongodb-X.Y.Z.tgz.sig), on every major and patch release to 6.x and 5.x. To verify the signature, follow the instructions in the 'Release Integrity' section of the README.md file.

The LocalKMSProviderConfiguration's key property accepts Binary

A local KMS provider at runtime accepted a BSON Binary instance but the Typescript inaccurately only permitted Buffer and string.

Clarified cursor state properties

The cursor has a few properties that represent the current state from the perspective of the driver and server. This PR corrects an issue that never made it to a release but we would like to take the opportunity to re-highlight what each of these properties mean.
- cursor.closed - cursor.close() has been called, and there are no more documents stored in the cursor.
- cursor.killed - cursor.close() was called while the cursor still had a non-zero id, and the driver sent a killCursors command to free server-side resources
- cursor.id == null - The cursor has yet to send it's first command (ex. find, aggregate)
- cursor.id.isZero() - The server sent the driver a cursor id of 0 indicating a cursor no longer exists on the server side because all data has been returned to the driver.
- cursor.bufferedCount() - The amount of documents stored locally in the cursor.
Features
- NODE-5718: add ReadConcernMajorityNotAvailableYet to retryable errors (#4154) (4f32dec)
- NODE-5801: allow multiple providers providers per type (#4137) (4d209ce)
- NODE-5853: support delegated KMIP data key option (#4129) (aa429f8)
- NODE-6136: parse cursor responses on demand (#4112) (3ed6a2a)
- NODE-6157: add signature to github releases (#4119) (f38c5fe)
Bug Fixes
- NODE-5801: use more specific key typing for multiple KMS provider support (#4146) (465ffd9)
- NODE-6085: add TS support for KMIP data key options (#4128) (f790cc1)
- NODE-6241: allow Binary as local KMS provider key (#4160) (fb724eb)
- NODE-6242: close becomes true after calling close when documents still remain (#4161) (e3d70c3)
Documentation
- Reference
- API
- Changelog
We invite you to try the mongodb library immediately, and report any issues to the NODE project.
6.8.0-dev.20240912.sha.8347db9c - 2024-09-12
6.8.0-dev.20240910.sha.833eaa41 - 2024-09-10
6.8.0-dev.20240907.sha.91ceaf05 - 2024-09-07
6.8.0-dev.20240905.sha.65e0e15c - 2024-09-05
6.8.0-dev.20240904.sha.fb13ebfd - 2024-09-04
6.8.0-dev.20240830.sha.1f10bdf8 - 2024-08-30
6.8.0-dev.20240829.sha.6d65ae77 - 2024-08-29
6.8.0-dev.20240824.sha.40ace73c - 2024-08-24
6.8.0-dev.20240822.sha.f5254030 - 2024-08-22
6.8.0-dev.20240821.sha.55bdeaa9 - 2024-08-21
6.8.0-dev.20240813.sha.b70c8850 - 2024-08-13
6.8.0-dev.20240808.sha.5565d500 - 2024-08-08
6.8.0-dev.20240802.sha.54efb7d4 - 2024-08-02
6.8.0-dev.20240731.sha.b26c3280 - 2024-07-31
6.8.0-dev.20240727.sha.e9025843 - 2024-07-27
6.8.0-dev.20240725.sha.74916f29 - 2024-07-25
6.8.0-dev.20240720.sha.357ca086 - 2024-07-20
6.8.0-dev.20240717.sha.35d88404 - 2024-07-17
6.8.0-dev.20240716.sha.4b219d36 - 2024-07-16
6.8.0-dev.20240712.sha.320dde04 - 2024-07-12
6.8.0-dev.20240710.sha.fb442edc - 2024-07-10
6.8.0-dev.20240709.sha.9a5e6110 - 2024-07-09
6.8.0-dev.20240703.sha.5abf5fca - 2024-07-03
6.8.0-dev.20240702.sha.f48f8d36 - 2024-07-02
6.8.0-dev.20240629.sha.d85f827a - 2024-06-29
6.8.0-dev.20240628.sha.45bc0982 - 2024-06-28
6.7.0 - 2024-05-29
Read more
6.7.0-dev.20240627.sha.fb724eb6 - 2024-06-27
6.7.0-dev.20240626.sha.4f32decc - 2024-06-26
6.7.0-dev.20240625.sha.27cb35bb - 2024-06-25
6.7.0-dev.20240621.sha.8fb43f86 - 2024-06-21
6.7.0-dev.20240619.sha.8d5d9846 - 2024-06-19
6.7.0-dev.20240618.sha.ec3cabaf - 2024-06-18
6.7.0-dev.20240615.sha.465ffd97 - 2024-06-15
6.7.0-dev.20240614.sha.3ed6a2ad - 2024-06-14
6.7.0-dev.20240613.sha.c1af6adc - 2024-06-13
6.7.0-dev.20240608.sha.0655c730 - 2024-06-08
6.7.0-dev.20240607.sha.aa429f8c - 2024-06-07
6.7.0-dev.20240530.sha.f56938f - 2024-05-30
6.6.2 - 2024-05-15
6.6.2 (2024-05-15)

The MongoDB Node.js team is pleased to announce version 6.6.2 of the mongodb package!

Release Notes

Server Selection performance regression due to incorrect RTT measurement

Starting in version 6.6.0, when using the stream server monitoring mode, heartbeats were incorrectly timed as having a duration of 0, leading to server selection viewing each server as equally desirable for selection.

Bug Fixes
- NODE-6171: RTT set to zero when serverMonitoringMode=stream (#4110) (7a7ec5b)
Documentation
- Reference
- API
- Changelog
We invite you to try the mongodb library immediately, and report any issues to the NODE project.
6.6.2-dev.20240529.sha.d3031a5 - 2024-05-29
6.6.2-dev.20240525.sha.d1695c4 - 2024-05-25
6.6.2-dev.20240524.sha.652af8d - 2024-05-24
6.6.2-dev.20240523.sha.21b729b - 2024-05-23
6.6.2-dev.20240516.sha.6acb5e5 - 2024-05-16
6.6.1 - 2024-05-06
6.6.1 (2024-05-06)

The MongoDB Node.js team is pleased to announce version 6.6.1 of the mongodb package!

Release Notes

ref()-ed timer keeps event loop running until client.connect() resolves

When the MongoClient is first starting up (client.connect()) monitoring connections begin the process of discovering servers to make them selectable. The ref()-ed serverSelectionTimeoutMS timer keeps Node.js' event loop running as the monitoring connections are created. In the last release we inadvertently unref()-ed this initial timer which would allow Node.js to close before the monitors could create connections.

Bug Fixes
- NODE-6151: MongoClient connect does not keep Node.js running (#4101) (7e0d9e6)
Documentation
- Reference
- API
- Changelog
We invite you to try the mongodb library immediately, and report any issues to the NODE project.
6.6.1-dev.20240511.sha.7c91272 - 2024-05-11
6.6.1-dev.20240508.sha.f73362b - 2024-05-08
6.6.1-dev.20240507.sha.706cc56 - 2024-05-07
6.6.0 - 2024-05-03
Read more
6.6.0-dev.20240504.sha.2609953 - 2024-05-04
6.5.0 - 2024-03-11
Read more
6.5.0-dev.20240503.sha.7f191cf - 2024-05-03
6.5.0-dev.20240502.sha.9d73f45 - 2024-05-02
6.5.0-dev.20240426.sha.6d8ad33 - 2024-04-26
6.5.0-dev.20240424.sha.6abc074 - 2024-04-24
6.5.0-dev.20240423.sha.4a62ec6 - 2024-04-23
6.5.0-dev.20240420.sha.eece8c1 - 2024-04-20
6.5.0-dev.20240419.sha.c213679 - 2024-04-19
6.5.0-dev.20240418.sha.af18c53 - 2024-04-18
6.5.0-dev.20240417.sha.f1f816f - 2024-04-17
6.5.0-dev.20240416.sha.6248174 - 2024-04-16
6.5.0-dev.20240413.sha.8845206 - 2024-04-13
6.5.0-dev.20240412.sha.232bf3c - 2024-04-12
6.5.0-dev.20240411.sha.ddd1e81 - 2024-04-11
6.5.0-dev.20240409.sha.30cac05 - 2024-04-09
6.5.0-dev.20240406.sha.62ea94b - 2024-04-06
6.5.0-dev.20240405.sha.ce55ca9 - 2024-04-05
6.5.0-dev.20240404.sha.0e3d6ea - 2024-04-04
6.5.0-dev.20240403.sha.cb5903f - 2024-04-03
6.5.0-dev.20240328.sha.458cf6d - 2024-03-28
6.5.0-dev.20240326.sha.918fe69 - 2024-03-26
6.5.0-dev.20240323.sha.d94439f - 2024-03-23
6.5.0-dev.20240322.sha.a8670a7 - 2024-03-22
6.5.0-dev.20240321.sha.1879a04 - 2024-03-21
6.5.0-dev.20240320.sha.8b91c30 - 2024-03-20
6.5.0-dev.20240319.sha.0ebc1ac - 2024-03-19
6.5.0-dev.20240316.sha.159ea81 - 2024-03-16
6.5.0-dev.20240315.sha.77d0b47 - 2024-03-15
6.5.0-dev.20240314.sha.8ab2055 - 2024-03-14
6.5.0-dev.20240312.sha.55abb4b - 2024-03-12
6.4.0 - 2024-02-29
Read more
6.4.0-dev.20240307.sha.28b7040 - 2024-03-07
6.4.0-dev.20240306.sha.057c223 - 2024-03-06
6.4.0-dev.20240305.sha.eab8f23 - 2024-03-05
6.4.0-dev.20240301.sha.f2b3484 - 2024-03-01
6.3.0 - 2023-11-16

from mongodb GitHub release notes

Commit messages

Package name: mongodb

1dcf8b1 chore(main): release 6.9.0 [skip-ci] (#4164)
210c572 docs: generate docs from latest main [skip-ci] (#4147)
08912c8 fix(NODE-6367): enable mixed use of iteration APIs (#4231)
8347db9 test(NODE-6323): add performance no-op baseline test (#4194)
833eaa4 fix(NODE-6362): cache cursor deserialization options across deserialize calls (#4221)
d6c147d feat(NODE-6365): pass through `allowPartialTrustChain` TLS flag (#4228)
91ceaf0 chore: specify branch when checking out GHA code (#4226)
27fd8a0 chore: quote branch names to avoid numeric conversion (#4224)
65e0e15 test(NODE-6317): fix test assertions and naming (#4217)
f53e9d9 feat(NODE-6309): Mark range API as stable (#4190)
8bfe187 fix(NODE-6355): respect utf8 validation options when iterating cursors (#4214)
fb13ebf test(NODE-6317): remove flaky unnecessary assertion (#4212)
6073828 chore: add a 6.8 release process workflow (#4215)
1f10bdf test(NODE-6343): unskip Case 4: KMIP should fail with no TLS (#4203)
6d65ae7 feat(NODE-6327): new client bulk write types and builders (#4205)
40ace73 test(NODE-5645): Define wire versions for `too_old` and `too_new` tests (#4200)
c54466c chore(NODE-6268): update dev dependencies and add dependabot config (#4196)
f525403 chore(NODE-6341): followup fix remove node18+ dns resolution order hooks (#4204)
62144ed chore(NODE-6341): remove node18+ dns resolution order hooks (#4202)
55bdeaa refactor(NODE-6325): implement document sequence support (#4201)
8622545 fix(NODE-6284): make sparsity and trimFactor optional (#4189)
1ce2f0d refactor(NODE-6335): remove recursion from transaction APIs (#4198)
b70c885 test(NODE-6318): utf runner withTransaction callback propagates errors from operations (#4193)
5565d50 perf(NODE-5906): optimize toArray to use batches (#4171)

Compare

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

👩‍💻 Set who automatically gets assigned

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs

Snyk has created this PR to upgrade mongodb from 6.3.0 to 6.9.0. See this package in npm: https://www.npmjs.com/package/mongodb See this project in Snyk: https://app.snyk.io/org/axelrenault92/project/597f791c-c192-46a3-91b9-565ac2ff1b69?utm_source=github&utm_medium=referral&page=upgrade-pr

arenault-pass assigned caxewsh Oct 13, 2024

caxewsh closed this Oct 19, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Snyk] Upgrade mongodb from 6.3.0 to 6.9.0 #279

[Snyk] Upgrade mongodb from 6.3.0 to 6.9.0 #279

arenault-pass commented Oct 13, 2024

6.8.2 (2024-09-12)

Release Notes

Fixed mixed use of cursor.next() and cursor[Symbol.asyncIterator]

Bug Fixes

Documentation

6.8.1 (2024-09-06)

Release Notes

Fixed `enableUtf8Validation` option

Bug Fixes

Documentation

6.8.0 (2024-06-27)

Release Notes

Add `ReadConcernMajorityNotAvailableYet` to retryable errors

ClientEncryption.createDataKey() and other helpers now support named KMS providers

KMIP data keys now support a `delegated` option

Cursor responses are now parsed lazily 🦥

Add Signature to Github Releases

The `LocalKMSProviderConfiguration`'s `key` property accepts `Binary`

Clarified cursor state properties

Features

Bug Fixes

Documentation

6.6.2 (2024-05-15)

Release Notes

Server Selection performance regression due to incorrect RTT measurement

Bug Fixes

Documentation

6.6.1 (2024-05-06)

Release Notes

`ref()`-ed timer keeps event loop running until `client.connect()` resolves

Bug Fixes

Documentation

[Snyk] Upgrade mongodb from 6.3.0 to 6.9.0 #279

[Snyk] Upgrade mongodb from 6.3.0 to 6.9.0 #279

Conversation

arenault-pass commented Oct 13, 2024

Snyk has created this PR to upgrade mongodb from 6.3.0 to 6.9.0.

6.8.2 (2024-09-12)

Release Notes

Fixed mixed use of cursor.next() and cursor[Symbol.asyncIterator]

Bug Fixes

Documentation

6.8.1 (2024-09-06)

Release Notes

Fixed enableUtf8Validation option

Bug Fixes

Documentation

6.8.0 (2024-06-27)

Release Notes

Add ReadConcernMajorityNotAvailableYet to retryable errors

ClientEncryption.createDataKey() and other helpers now support named KMS providers

KMIP data keys now support a delegated option

Cursor responses are now parsed lazily 🦥

Add Signature to Github Releases

The LocalKMSProviderConfiguration's key property accepts Binary

Clarified cursor state properties

Features

Bug Fixes

Documentation

6.6.2 (2024-05-15)

Release Notes

Server Selection performance regression due to incorrect RTT measurement

Bug Fixes

Documentation

6.6.1 (2024-05-06)

Release Notes

ref()-ed timer keeps event loop running until client.connect() resolves

Bug Fixes

Documentation

Fixed `enableUtf8Validation` option

Add `ReadConcernMajorityNotAvailableYet` to retryable errors

KMIP data keys now support a `delegated` option

The `LocalKMSProviderConfiguration`'s `key` property accepts `Binary`

`ref()`-ed timer keeps event loop running until `client.connect()` resolves