MongoDB Node.js driver version 2.1.11 represents a minor update over its predecessor, version 2.1.10, focusing primarily on internal improvements. The core functionality remains largely the same, ensuring a smooth transition for developers already using the 2.1.x series. The key difference lies in the updated dependency on mongodb-core, which moves from version 1.3.9 to 1.3.10. This likely incorporates bug fixes and performance enhancements within the lower-level MongoDB driver, potentially leading to subtle improvements in connection handling, query execution, or overall stability.
For developers considering upgrading, the change should be straightforward, as no breaking API changes are anticipated between these minor versions. Always consult the official MongoDB Node.js driver changelog for granular details on the specific changes introduced in mongodb-core. As with any upgrade, it's recommended to run thorough testing to ensure compatibility with your application's specific use cases and MongoDB server version.
Both versions rely on a suite of testing and development dependencies intended for the driver's development - these libraries that include tools for benchmarking, code coverage analysis, and extended JSON handling. For users depending on these utilities outside of the main mongodb package's public API, checking for breaking changes in these sub-dependencies is recommended when upgrading to new major versions of mongodb. New versions of mongodb-core could introduce subtle behavioral modifications in the driver. So testing remains essential.
All the vulnerabilities related to the version 2.1.11 of the package
Denial of Service in mongodb
Versions of mongodb prior to 3.1.13 are vulnerable to Denial of Service. The package fails to properly catch an exception when a collection name is invalid and the DB does not exist, crashing the application.
Upgrade to version 3.1.13 or later.
Deserialization of Untrusted Data in bson
Incorrect parsing of certain JSON input may result in js-bson not correctly serializing BSON. This may cause unexpected application behaviour including data disclosure.
Deserialization of Untrusted Data in bson
All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. The package will ignore an unknown value for an object's _bsontype, leading to cases where an object is serialized as a document rather than the intended BSON type.
