Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

🚨 [security] [boilerplate/ts/infra/mongo] Update mongodb 4.10.0 → 4.17.1 (minor) #509

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

🚨 [security] [boilerplate/ts/infra/mongo] Update mongodb 4.10.0 → 4.17.1 (minor) #509

wants to merge 1 commit into from

Conversation

depfu[bot]
Copy link
Contributor

@depfu depfu bot commented Aug 30, 2023

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ mongodb (4.10.0 → 4.17.1) · Repo · Changelog

Security Advisories 🚨

🚨 MongoDB Driver may publish events containing authentication-related data

Some MongoDB Drivers may erroneously publish events containing authentication-related data to a command listener configured by an application. The published events may contain security-sensitive data when specific authentication-related commands are executed.

Without due care, an application may inadvertently expose this sensitive information, e.g., by writing it to a log file. This issue only arises if an application enables the command listener feature (this is not enabled by default).

This issue affects the MongoDB C Driver 1.0.0 prior to 1.17.7, MongoDB PHP Driver 1.0.0 prior to 1.9.2, MongoDB Swift Driver 1.0.0 prior to 1.1.1, MongoDB Node.js Driver 3.6 prior to 3.6.10, MongoDB Node.js Driver 4.0 prior to 4.17.0 and MongoDB Node.js Driver 5.0 prior to 5.8.0. This issue also affects users of the MongoDB C++ Driver dependent on the C driver 1.0.0 prior to 1.17.7 (C++ driver prior to 3.7.0).

Release Notes

4.17.1

4.17.1 (2023-08-23)

The MongoDB Node.js team is pleased to announce version 4.17.1 of the mongodb package!

Release Notes

Import of saslprep updated to correct library.

Fixes the import of saslprep to be the correct @mongodb-js/saslprep library.

Bug Fixes

Documentation

We invite you to try the mongodb library immediately, and report any issues to the NODE project.

4.17.0

4.17.0 (2023-08-17)

The MongoDB Node.js team is pleased to announce version 4.17.0 of the mongodb package!

Release Notes

mongodb-js/saslprep is now installed by default

Until v6, the driver included the saslprep package as an optional dependency for SCRAM-SHA-256 authentication. saslprep breaks when bundled with webpack because it attempted to read a file relative to the package location and consequently the driver would throw errors when using SCRAM-SHA-256 if it were bundled.

The driver now depends on mongodb-js/saslprep, a fork of saslprep that can be bundled with webpack because it includes the necessary saslprep data in memory upon loading. This will be installed by default but will only be used if SCRAM-SHA-256 authentication is used.

Remove credential availability on ConnectionPoolCreatedEvent

In order to avoid mistakenly printing credentials the ConnectionPoolCreatedEvent will replace the credentials option with an empty object. The credentials are still accessble via MongoClient options: client.options.credentials.

Features

Bug Fixes

Documentation

We invite you to try the mongodb library immediately, and report any issues to the NODE project.

4.16.0

The MongoDB Node.js team is pleased to announce version 4.16.0 of the mongodb package!

Features

Bug Fixes

Documentation

We invite you to try the mongodb library immediately, and report any issues to the NODE project.

4.14.0

The MongoDB Node.js team is pleased to announce version 4.14.0 of the mongodb package!

Deprecations

Bug Fixes

Documentation

We invite you to try the mongodb library immediately, and report any issues to the NODE project.

4.13.0

The MongoDB Node.js team is pleased to announce version 4.13.0 of the mongodb package!

Features

Bug Fixes

Documentation

We invite you to try the mongodb driver immediately, and report any issues to the NODE project.

4.12.1

The MongoDB Node.js team is pleased to announce version 4.12.1 of the mongodb package!

Release Highlights

This version includes a fix to a regression in our monitoring logic that could cause process crashing errors that was introduced in v4.12.0.

If you are using v4.12.0 of the Node driver, we strongly encourage you to upgrade.

Bug Fixes

Documentation

We invite you to try the mongodb library immediately, and report any issues to the NODE project.

4.12.0

The MongoDB Node.js team is pleased to announce version 4.12.0 of the mongodb package!

Release Highlights

ChangeStreams are now AsyncIterators

ChangeStreams are now async iterables and can be used anywhere that expects an async iterable. Notably, change streams can now be used in Javascript for-await loops:

const changeStream = collection.watch();
for await (const change of changeStream) {
  console.log(“Received change: “, change);
}

Some users may have been using change streams in for-await loops manually by using a for-await loop with the ChangeStream’s internal cursor. For example:

const changeStream = collection.watch();
for await (const change of changeStream.cursor) {
  console.log(“Received change: “, change);
}

The change stream cursor has no support for resumabilty and consequently the change stream will never attempt to resume on any errors. We strongly caution against using a change stream cursor as an async iterable and strongly recommend using the change stream directly.

Server Monitoring Fix When Monitoring Events are Skipped

Version 4.7.0 of the Node driver released an improvement to our server monitoring in FAAS environments by allowing the driver to skip monitoring events if there were more than one monitoring events in the queue when the monitoring code restarted. When skipping monitoring events that contained a topology change, the driver would incorrectly fail to update its view of the topology.

Version 4.12.0 fixes this issue by ensuring that the topology is always updated when monitoring events are processed.

Performance Improvements with Buffering

This release also modifies the data structures used internally in the driver to use linked lists in places where random access is not required and constant time insertion and deletion is beneficial.

External Contributions

Many thanks to @ImRodry for helping us fix the documentation for our deprecated callback overloads in this release!

Features

Deprecations

Bug Fixes

Documentation

We invite you to try the mongodb library immediately, and report any issues to the NODE project.

4.11.0

The MongoDB Node.js team is pleased to announce version 4.11.0 of the mongodb package!

Release Highlights

Recursive Schema Support

Version 4.3.0 of the Node driver added Typescript support for dot notation into our Filter type but
in the process it broke support for recursive schemas. In 4.11.0, we now support recursive schemas and
provide type safety on dot notation queries up to a depth of 9. Beyond a depth of 9, code still compiles
but is no longer type checked (it falls back to a type of any).

interface CircularSchema {
    name: string;
    nestedSchema: CircularSchema;
}

// we have a collection of type Collection<CircularSchema>


// below a depth of 9, type checking is enforced

collection.findOne({ 'nestedSchema.nestedSchema.nestedSchema.name': 25 }) // compilation error - name must be a string


// at a depth greater than 9, code compiles but is not type checked (11 deep)

collection.findOne({

'nestedSchema.nestedSchema.nestedSchema.nestedSchema.nestedSchema.nestedSchema.nestedSchema.nestedSchema.nestedSchema.nestedSchema.name': 25

}) // NO compilation error

Note that our depth limit is a product of Typescript's recursive type limitations.

External Contributions

Many thanks to those who contributed to this release!

  • @ermik provided an extremely large schema to test compilation with, which made testing our new recursive schema support possible with large schemas straightforward.
  • @noahsilas for documentation improvements in change streams and fixing our Typescript types for read preferences.
  • @zendagin for adding Typescript support for hashed indexes.
  • @biniona-mongodb for fixing our parsing of TLS options.
  • @LinusU for removing support for server versions lower than our minimum supported server version and improving error messages for unacknowledged writes with hints.

Features

Bug Fixes

Documentation

We invite you to try the mongodb library immediately, and report any issues to the NODE project.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

Depfu Status

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands
@​depfu rebase
Rebases against your default branch and redoes this update
@​depfu recreate
Recreates this PR, overwriting any edits that you've made to it
@​depfu merge
Merges this PR once your tests are passing and conflicts are resolved
@​depfu cancel merge
Cancels automatic merging of this PR
@​depfu close
Closes this PR and deletes the branch
@​depfu reopen
Restores the branch and reopens this PR (if it's closed)
@​depfu pause
Ignores all future updates for this dependency and closes this PR
@​depfu pause [minor|major]
Ignores all future minor/major updates for this dependency and closes this PR
@​depfu resume
Future versions of this dependency will create PRs again (leaves this PR as is)

@depfu depfu bot added the depfu label Aug 30, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
depfu
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
0 participants