MongoDB's Node.js driver saw a minor version bump from 1.2.7 to 1.2.8, representing a refinement of the existing codebase. Both versions share the same core dependencies, notably relying on bson version 0.1.5 for efficient BSON serialization and deserialization, the underlying format for data storage in MongoDB. The development dependencies, crucial for testing, documentation, and code quality, remain consistent, including tools like dox for API documentation generation, ejs for templating, step and async for asynchronous flow control, gleak for memory leak detection, github3 for GitHub interactions, markdown for documentation, nodeunit for unit testing, and uglify-js for code minification.
The most significant difference lies in the release date. Version 1.2.8 was published on January 7, 2013, while version 1.2.7 was released on December 23, 2012. This three week gap suggests that version 1.2.8 likely incorporates bug fixes, performance improvements, or minor feature additions that were deemed necessary after the initial release of 1.2.7. Developers using the MongoDB Node.js driver should consider upgrading to version 1.2.8 for the most stable and up-to-date experience. While the changelog isn't provided here, upgrading offers the benefits of incorporating the latest refinements. Both versions retain the same author and repository information, ensuring continuity and familiarity for developers already working with the driver. This makes updating to the newer version a relatively seamless process for existing MongoDB Node.js projects.
All the vulnerabilities related to the version 1.2.8 of the package
Denial of Service in mongodb
Versions of mongodb prior to 3.1.13 are vulnerable to Denial of Service. The package fails to properly catch an exception when a collection name is invalid and the DB does not exist, crashing the application.
Upgrade to version 3.1.13 or later.
Deserialization of Untrusted Data in bson
Incorrect parsing of certain JSON input may result in js-bson not correctly serializing BSON. This may cause unexpected application behaviour including data disclosure.
Deserialization of Untrusted Data in bson
All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. The package will ignore an unknown value for an object's _bsontype, leading to cases where an object is serialized as a document rather than the intended BSON type.
