MongoDB Node.js driver version 3.0.9 represents a minor update over the previous stable version, 3.0.8. Both versions share the same core dependency, mongodb-core v3.0.8, indicating that the fundamental connection and command execution logic remains consistent. The drivers are described as the official MongoDB drivers for Node.js. Examining the devDependencies, we observe that most tools remained unchanged, suggesting a focus on bug fixes and minor enhancements rather than substantial feature additions. A notable difference lies in the prettier version, shifting from ^1.5.3 in 3.0.8 to ~1.12.0 in 3.0.9, indicating an upgrade in code formatting tooling. This change likely targets code style improvements and consistency, which indirectly benefits developers by aiding in code readability and maintainability.
The dist section reveals that version 3.0.9 has a slightly larger unpacked size (856003 bytes) and file count (40) compared to 3.0.8 (733469 bytes, 39 files), suggesting that the newer version contains additional or modified files, possibly related to the prettier update or other minor improvements. Version 3.0.9 was released on 2018-06-01, while version 3.0.8 was released earlier on 2018-05-08. Developers considering upgrading should be aware of the potential formatting changes introduced by the prettier update and any subtle bug fixes or performance improvements included in the newer version. Despite minimal visible changes in dependencies, the increment in size and recent release suggest a worthwhile upgrade for those seeking the most current and refined version of the MongoDB Node.js driver within the 3.0.x series.
All the vulnerabilities related to the version 3.0.9 of the package
Denial of Service in mongodb
Versions of mongodb prior to 3.1.13 are vulnerable to Denial of Service. The package fails to properly catch an exception when a collection name is invalid and the DB does not exist, crashing the application.
Upgrade to version 3.1.13 or later.
Deserialization of Untrusted Data in bson
Incorrect parsing of certain JSON input may result in js-bson not correctly serializing BSON. This may cause unexpected application behaviour including data disclosure.
Deserialization of Untrusted Data in bson
All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. The package will ignore an unknown value for an object's _bsontype, leading to cases where an object is serialized as a document rather than the intended BSON type.
