MongoDB Node.js driver version 3.0.11 represents a minor update over the previous stable version 3.0.10, primarily focusing on internal dependency upgrades. The most notable difference lies in the mongodb-core dependency, which has been bumped from version 3.0.9 to 3.0.11. This core dependency handles the low-level communication with the MongoDB server, suggesting that the update likely includes bug fixes, performance improvements, or new features within the core database interaction logic.
For developers using the MongoDB driver, this means that upgrading from 3.0.10 to 3.0.11 should be a relatively straightforward process with minimal breaking changes, as indicated by the minor version bump. However, it's always wise to review the changelog for mongodb-core specifically to understand the precise nature of the changes and ensure compatibility with your application's database interactions. Given the large unpacked size staying almost the same, the updates in the core package probably imply small bug corrections or minimal features added. The release date also shows that the change was issued relatively fast (less than 1 month) so should be addressing maybe a bug present in the previous stable version.
All the vulnerabilities related to the version 3.0.11 of the package
Denial of Service in mongodb
Versions of mongodb prior to 3.1.13 are vulnerable to Denial of Service. The package fails to properly catch an exception when a collection name is invalid and the DB does not exist, crashing the application.
Upgrade to version 3.1.13 or later.
Deserialization of Untrusted Data in bson
Incorrect parsing of certain JSON input may result in js-bson not correctly serializing BSON. This may cause unexpected application behaviour including data disclosure.
Deserialization of Untrusted Data in bson
All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. The package will ignore an unknown value for an object's _bsontype, leading to cases where an object is serialized as a document rather than the intended BSON type.
