MongoDB version 1.1.5 represents a minor update to the popular Node.js driver for MongoDB, building upon the foundation of the 1.1.4 release. The core functionality, centered around providing a robust and efficient interface for interacting with MongoDB databases, remains consistent. Developers familiar with version 1.1.4 will find the transition to 1.1.5 seamless.
The notable differences reside primarily in the dependency updates. Version 1.1.5 upgrades the bson dependency from version 0.1.1 to 0.1.3. This updated bson dependency likely incorporates bug fixes, performance improvements, and potentially new features related to the handling of Binary JSON (BSON) data, the format used for data storage and transmission in MongoDB. Developers leveraging BSON directly within their applications might observe subtle behavioral changes or performance gains due to this upgrade.
The development dependencies remain unchanged ensuring that the toolchain used for building, testing, and documenting the package, including tools like dox, ejs, nodeunit, and uglify-js remain consistent. This suggests a focus on incremental improvements and bug fixes rather than a significant overhaul of the driver's core architecture. The core feature set of the MongoDB Node.js driver, providing capabilities for connecting to MongoDB servers, executing CRUD operations (Create, Read, Update, Delete), managing indexes, and handling complex queries, remains consistent between the two versions providing a stable API for developers to rely on. Be aware that the repository URL changed from git:// protocol to http:// protocol.
All the vulnerabilities related to the version 1.1.5 of the package
Denial of Service in mongodb
Versions of mongodb prior to 3.1.13 are vulnerable to Denial of Service. The package fails to properly catch an exception when a collection name is invalid and the DB does not exist, crashing the application.
Upgrade to version 3.1.13 or later.
Deserialization of Untrusted Data in bson
Incorrect parsing of certain JSON input may result in js-bson not correctly serializing BSON. This may cause unexpected application behaviour including data disclosure.
Deserialization of Untrusted Data in bson
All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. The package will ignore an unknown value for an object's _bsontype, leading to cases where an object is serialized as a document rather than the intended BSON type.
