This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!
Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.
Release Notes
4.17.1 (2023-08-23)
The MongoDB Node.js team is pleased to announce version 4.17.1 of themongodb package!
Release Notes
Import ofsaslprep updated to correct library.
Fixes the import of saslprep to be the correct@mongodb-js/saslprep library.
Bug Fixes
Documentation
We invite you to try themongodb library immediately, and report any issues to theNODE project.
4.17.0 (2023-08-17)
The MongoDB Node.js team is pleased to announce version 4.17.0 of themongodb package!
Release Notes
mongodb-js/saslprep is now installed by default
Until v6, the driver included thesaslprep package as an optional dependency for SCRAM-SHA-256 authentication.saslprep breaks when bundled with webpack because it attempted to read a file relative to the package location and consequently the driver would throw errors when using SCRAM-SHA-256 if it were bundled.
The driver now depends onmongodb-js/saslprep, a fork ofsaslprep that can be bundled with webpack because it includes the necessary saslprep data in memory upon loading. This will be installed by default but will only be used if SCRAM-SHA-256 authentication is used.
Remove credential availability onConnectionPoolCreatedEvent
In order to avoid mistakenly printing credentials theConnectionPoolCreatedEvent will replace the credentials option with an empty object. The credentials are still accessble via MongoClient options:client.options.credentials.
Features
Bug Fixes
Documentation
We invite you to try themongodb library immediately, and report any issues to theNODE project.
The MongoDB Node.js team is pleased to announce version 4.16.0 of themongodb package!
Features
Bug Fixes
Documentation
We invite you to try themongodb library immediately, and report any issues to theNODE project.
The MongoDB Node.js team is pleased to announce version 4.14.0 of the mongodb package!
Deprecations
Bug Fixes
Documentation
We invite you to try the mongodb library immediately, and report any issues to theNODE project.
The MongoDB Node.js team is pleased to announce version 4.13.0 of the mongodb package!
Features
Bug Fixes
Documentation
We invite you to try the mongodb driver immediately, and report any issues to theNODE project.
The MongoDB Node.js team is pleased to announce version 4.12.1 of the mongodb package!
Release Highlights
This version includes a fix to a regression in our monitoring logic that could cause process crashing errors that was introduced in v4.12.0.
If you are using v4.12.0 of the Node driver, we strongly encourage you to upgrade.
Bug Fixes
Documentation
We invite you to try themongodb library immediately, and report any issues to theNODE project.
The MongoDB Node.js team is pleased to announce version 4.12.0 of the mongodb package!
Release Highlights
ChangeStreams are now AsyncIterators
ChangeStreams are now async iterables and can be used anywhere that expects an async iterable. Notably, change streams can now be used in Javascript for-await loops:
constchangeStream=collection.watch();forawait(constchangeofchangeStream){console.log(“Receivedchange:“,change);}Some users may have been using change streams in for-await loops manually by using a for-await loop with the ChangeStream’s internal cursor. For example:
constchangeStream=collection.watch();forawait(constchangeofchangeStream.cursor){console.log(“Receivedchange:“,change);}The change stream cursor has no support for resumabilty and consequently the change stream will never attempt to resume on any errors. Westrongly caution against using a change stream cursor as an async iterable andstrongly recommend using the change stream directly.
Server Monitoring Fix When Monitoring Events are Skipped
Version 4.7.0 of the Node driver released an improvement to our server monitoring in FAAS environments by allowing the driver to skip monitoring events if there were more than one monitoring events in the queue when the monitoring code restarted. When skipping monitoring events that contained a topology change, the driver would incorrectly fail to update its view of the topology.
Version 4.12.0 fixes this issue by ensuring that the topology is always updated when monitoring events are processed.
Performance Improvements with Buffering
This release also modifies the data structures used internally in the driver to use linked lists in places where random access is not required and constant time insertion and deletion is beneficial.
External Contributions
Many thanks to@ImRodry for helping us fix the documentation for our deprecated callback overloads in this release!
Features
Deprecations
Bug Fixes
Documentation
We invite you to try themongodb library immediately, and report any issues to theNODE project.
The MongoDB Node.js team is pleased to announce version 4.11.0 of the mongodb package!
Release Highlights
Recursive Schema Support
Version 4.3.0 of the Node driver added Typescript support for dot notation into ourFilter type but
in the process it broke support for recursive schemas. In 4.11.0, we now support recursive schemas and
provide type safety on dot notation queries up to a depth of 9. Beyond a depth of 9, code still compiles
but is no longer type checked (it falls back to a type ofany).
interfaceCircularSchema{name:string;nestedSchema:CircularSchema;}// we have a collection of type Collection<CircularSchema>
// below a depth of 9, type checking is enforced
collection.findOne({'nestedSchema.nestedSchema.nestedSchema.name':25})// compilation error - name must be a string
// at a depth greater than 9, code compiles but is not type checked (11 deep)
collection.findOne({
'nestedSchema.nestedSchema.nestedSchema.nestedSchema.nestedSchema.nestedSchema.nestedSchema.nestedSchema.nestedSchema.nestedSchema.name':25
})// NO compilation error
Note that our depth limit is a product of Typescript's recursive type limitations.
External Contributions
Many thanks to those who contributed to this release!
- @ermik provided an extremely large schema to test compilation with, which made testing our new recursive schema support possible with large schemas straightforward.
- @noahsilas for documentation improvements in change streams and fixing our Typescript types for read preferences.
- @zendagin for adding Typescript support for hashed indexes.
- @biniona-mongodb for fixing our parsing of TLS options.
- @LinusU for removing support for server versions lower than our minimum supported server version and improving error messages for unacknowledged writes with hints.
Features
Bug Fixes
Documentation
We invite you to try the mongodb library immediately, and report any issues to theNODE project.
Does any of this look wrong?Please let us know.
🚨Your current dependencies have known security vulnerabilities 🚨
This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!
Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.
What changed?
✳️ mongodb (4.10.0 → 4.17.1) ·Repo ·Changelog
Security Advisories 🚨
🚨 MongoDB Driver may publish events containing authentication-related data
Release Notes
4.17.1
4.17.0
4.16.0
4.14.0
4.13.0
4.12.1
4.12.0
4.11.0
Does any of this look wrong?Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with
@depfu rebase.All Depfu comment commands