MongoDB's Node.js driver saw a minor version bump from 3.0.1 to 3.0.2, marking a subtle but potentially relevant shift for developers utilizing the popular database with JavaScript. Both versions share the same core description as the official MongoDB driver for Node.js, and are licensed under Apache-2.0, and maintains the same repository URL, pointing to the node-mongodb-native project on GitHub and same author.
A key difference lies in the dependency versions. While the development dependencies (devDependencies) remain identical, listing tools like co, bson, chai, eslint, prettier and others for testing and linting, the core dependency mongodb-core is updated from version 3.0.1 to 3.0.2. This suggests that the primary changes in version 3.0.2 are likely focused on improvements and fixes within the mongodb-core library, which handles the fundamental interactions with the MongoDB server.
Developers should investigate the changelog or release notes for mongodb-core@3.0.2 to understand the specific changes included in this update. These changes could include bug fixes, performance enhancements, or new features related to connection management, query execution, or data serialization. Given the core nature of mongodb-core, the update to version 3.0.2 is recommended for any users of the 3.x line, to ensure stability and benefit from the latest improvements. The release date further differentiates the versions, with 3.0.1 arriving in December 2017 and 3.0.2 in late January 2018. Thus, by upgrading to 3.0.2, developers are using the most recent version, indicating any bug fixes or dependency updates.
All the vulnerabilities related to the version 3.0.2 of the package
Denial of Service in mongodb
Versions of mongodb prior to 3.1.13 are vulnerable to Denial of Service. The package fails to properly catch an exception when a collection name is invalid and the DB does not exist, crashing the application.
Upgrade to version 3.1.13 or later.
Deserialization of Untrusted Data in bson
Incorrect parsing of certain JSON input may result in js-bson not correctly serializing BSON. This may cause unexpected application behaviour including data disclosure.
Deserialization of Untrusted Data in bson
All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. The package will ignore an unknown value for an object's _bsontype, leading to cases where an object is serialized as a document rather than the intended BSON type.
