MongoDB's version 2.1.0 marked a notable step, released on December 6, 2015, from its previous stable version 2.0.55 released nearly a month later. While both versions maintain the core goal of providing a legacy driver emulation layer on top of mongodb-core, several key differences emerge that developers should be aware of. The dependency on es6-promise was bumped from version 2.1.1 to 3.0.2, which likely incorporates enhanced promise handling or bug fixes. The core driver, mongodb-core, saw a change, moving from 1.2.31 in the older version to 1.2.26 in the newer, that can be interpreted as a targeted regression fix or an intentional change focusing on stability over features in the 2.1.0 release. Development dependencies, including tools for testing and documentation, remained largely consistent, such as co, bson, gleak and jsdoc. Both versions rely on the same infrastructure components like mongodb-version-manager.
Developers considering an upgrade should carefully evaluate the changes in es6-promise and mongodb-core. The older version, despite being labelled as "stable", was published later than the newer one. While the dependency updates hint at internal improvements and potential bug fixes, its imperative for developers to consult the official changelogs for each dependency. Version 2.1.0 might be attractive for those seeking the enhancements of es6-promise version 3, while those prioritizing stability, or observing regressions with the updated core driver, might prefer sticking with version 2.0.55 until further assessment.
All the vulnerabilities related to the version 2.1.0 of the package
Denial of Service in mongodb
Versions of mongodb prior to 3.1.13 are vulnerable to Denial of Service. The package fails to properly catch an exception when a collection name is invalid and the DB does not exist, crashing the application.
Upgrade to version 3.1.13 or later.
Deserialization of Untrusted Data in bson
Incorrect parsing of certain JSON input may result in js-bson not correctly serializing BSON. This may cause unexpected application behaviour including data disclosure.
Deserialization of Untrusted Data in bson
All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. The package will ignore an unknown value for an object's _bsontype, leading to cases where an object is serialized as a document rather than the intended BSON type.
