MongoDB Node.js driver version 3.1.0 introduces several key improvements over the previous stable version, 3.0.11. The core dependency, mongodb-core, has been updated from 3.0.11 to 3.1.0, implying enhancements and bug fixes within the underlying driver architecture. While the devDependencies largely remain consistent between the two versions, ensuring a stable development environment through tools like eslint, prettier, and chai, the notable change resides in the core driver. Version 3.1.0 boasts a larger unpacked size (913474 bytes vs. 858051 bytes) and a higher file count (44 vs. 40), suggesting the inclusion of new features, expanded functionalities or significant internal modifications within the mongodb package.
For developers, these changes mean potentially improved performance, enhanced stability, and access to new MongoDB functionalities. While a detailed changelog is necessary to pinpoint specific feature additions, the version bump from 3.0 to 3.1 signals a set of impactful changes, justifying a thorough review of the upgrade process. The update in mongodb-core, in particular, is crucial, as it manages the low-level communication with the MongoDB server. Therefore, users upgrading should consult the official MongoDB Node.js driver documentation to leverage the advantages and adjust the code that relies on the internal driver implementation.
All the vulnerabilities related to the version 3.1.0 of the package
Denial of Service in mongodb
Versions of mongodb
prior to 3.1.13 are vulnerable to Denial of Service. The package fails to properly catch an exception when a collection name is invalid and the DB does not exist, crashing the application.
Upgrade to version 3.1.13 or later.
Deserialization of Untrusted Data in bson
Incorrect parsing of certain JSON input may result in js-bson not correctly serializing BSON. This may cause unexpected application behaviour including data disclosure.
Deserialization of Untrusted Data in bson
All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. The package will ignore an unknown value for an object's _bsontype, leading to cases where an object is serialized as a document rather than the intended BSON type.