MongoDB Node.js driver version 3.0.6 is a minor update from the previous stable version 3.0.5, primarily focusing on core improvements and dependency adjustments. Both versions serve as the official MongoDB driver for Node.js, offering developers a robust interface for interacting with MongoDB databases. The core functionality remains consistent, driven by the mongodb-core dependency, which sees a corresponding version bump from 3.0.5 to 3.0.6.
Developers will find that the development dependencies, crucial for testing and development workflows, are largely the same. Tools like co, bson, chai, jsdoc, sinon, eslint, semver, bluebird, istanbul, prettier, coveralls, worker-farm, mongodb-mock-server, mongodb-test-runner,eslint-plugin-prettier and conventional-changelog-cli are consistent between versions offering a stable dev environment. A key difference in devDependencies revolves around JSON handling and benchmarking dependencies. Version 3.0.5 uses betterbenchmarks and mongodb-extended-json, while version 3.0.6 introduces mongodb-extjson indicating potential changes or updates in working with extended JSON formats and the removal of benchmarks. This might impact developers who rely heavily on the specific features provided by mongodb-extended-json or betterbenchmarks and they should evaluate the differences in new version, altough the overall impact on the final user can be considered minimal. The unpacked size is also slightly smaller in 3.0.6 that may mean some minor optimisation in the release.
All the vulnerabilities related to the version 3.0.6 of the package
Denial of Service in mongodb
Versions of mongodb prior to 3.1.13 are vulnerable to Denial of Service. The package fails to properly catch an exception when a collection name is invalid and the DB does not exist, crashing the application.
Upgrade to version 3.1.13 or later.
Deserialization of Untrusted Data in bson
Incorrect parsing of certain JSON input may result in js-bson not correctly serializing BSON. This may cause unexpected application behaviour including data disclosure.
Deserialization of Untrusted Data in bson
All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. The package will ignore an unknown value for an object's _bsontype, leading to cases where an object is serialized as a document rather than the intended BSON type.
