Update dependency mongodb to v3 [SECURITY] by renovate[bot] · Pull Request #310 · abstratt/cloudfier

renovate · 2023-05-28T21:48:45Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
mongodb	`1.4.19` → `3.1.13`

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Denial of Service in mongodb

GHSA-mh5c-679w-hh4r

More information

Details

Versions of mongodb prior to 3.1.13 are vulnerable to Denial of Service. The package fails to properly catch an exception when a collection name is invalid and the DB does not exist, crashing the application.

Recommendation

Upgrade to version 3.1.13 or later.

Severity

High

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

mongodb/node-mongodb-native (mongodb)

update mongodb-core to 2.2.15
allow auth option in MongoClient.connect
remove duplicate option promoteLongs from MongoClient's connect
bulk operations should not throw an error on empty batch

`v2.2.30`

Compare Source

Update mongodb-core to 2.2.14
MongoClient
- add appname to list of valid option names
- added test for passing appname as option
NODE-1052 ensure user options are applied while parsing connection string uris

`v2.2.29`

Compare Source

Update mongodb-core to 2.1.13
- NODE-1039 ensure we force destroy server instances, forcing queue to be flushed.
- Use actual server type in standalone SDAM events.
Allow multiple map calls (Issue #1521, https://github.com/Robbilie).
Clone insertMany options before mutating (Issue #1522, https://github.com/vkarpov15).
NODE-1034 Fix GridStore issue caused by Node 8.0.0 breaking backward compatible fs.read API.
NODE-1026, use operator instead of skip function in order to avoid useless fetch stage.

`v2.2.28`

Compare Source

Update mongodb-core to 2.1.12
- NODE-1019 Set keepAlive to 300 seconds or 1/2 of socketTimeout if socketTimeout < keepAlive.
- Minor fix to report the correct state on error.
- NODE-1020 'family' was added to options to provide high priority for ipv6 addresses (Issue #1518, https://github.com/firej).
- Fix require_optional loading of bson-ext.
- Ensure no errors are thrown by replset if topology is destroyed before it finished connecting.
- NODE-999 SDAM fixes for Mongos and single Server event emitting.
- NODE-1014 Set socketTimeout to default to 360 seconds.
- NODE-1019 Set keepAlive to 300 seconds or 1/2 of socketTimeout if socketTimeout < keepAlive.
Just handle Collection name errors distinctly from general callback errors avoiding double callbacks in Db.collection.
NODE-999 SDAM fixes for Mongos and single Server event emitting.
NODE-1000 Added guard condition for upload.js checkDone function in case of race condition caused by late arriving chunk write.

`v2.2.27`

Compare Source

Updated mongodb-core to 2.1.11
- NODE-987 Clear out old intervalIds on when calling topologyMonitor.
- NODE-987 Moved filtering to pingServer method and added test case.
- Check for connection destroyed just before writing out and flush out operations correctly if it is (Issue #179, https://github.com/jmholzinger).
- NODE-989 Refactored Replicaset monitoring to correcly monitor newly added servers, Also extracted setTimeout and setInterval to use custom wrappers Timeout and Interval.
NODE-985 Deprecated Db.authenticate and Admin.authenticate and moved auth methods into authenticate.js to ensure MongoClient.connect does not print deprecation warnings.
NODE-988 Merged readConcern and hint correctly on collection(...).find(...).count()
Fix passing the readConcern option to MongoClient.connect (Issue #1514, https://github.com/bausmeier).
NODE-996 Propegate all events up to a MongoClient instance.
Allow saving doc with null _id (Issue #1517, https://github.com/vkarpov15).
NODE-993 Expose hasNext for command cursor and add docs for both CommandCursor and Aggregation Cursor.

`v2.2.26`

Compare Source

Updated mongodb-core to 2.1.10
- NODE-981 delegate auth to replset/mongos if inTopology is set.
- NODE-978 Wrap connection.end in try/catch for node 0.10.x issue causing exceptions to be thrown, Also surfaced getConnection for mongos and replset.
- Remove dynamic require (Issue #175, https://github.com/tellnes).
- NODE-696 Handle interrupted error for createIndexes.
- Fixed isse when user is executing find command using Server.command and it get interpreted as a wire protcol message, #172.
- NODE-966 promoteValues not being promoted correctly to getMore.
- Merged in fix for flushing out monitoring operations.
NODE-983 Add cursorId to aggregate and listCollections commands (Issue, #1510).
Mark group and profilingInfo as deprecated methods
NODE-956 DOCS Examples.
Update readable-stream to version 2.2.7.
NODE-978 Added test case to uncover connection.end issue for node 0.10.x.
NODE-972 Fix(db): don't remove database name if collectionName == dbName (Issue, #1502)
Fixed merging of writeConcerns on db.collection method.
NODE-970 mix in readPreference for strict mode listCollections callback.
NODE-966 added testcase for promoteValues being applied to getMore commands.
NODE-962 Merge in ignoreUndefined from collection level for find/findOne.
Remove multi option from updateMany tests/docs (Issue #1499, https://github.com/spratt).
NODE-963 Correctly handle cursor.count when using APM.

`v2.2.25`

Compare Source

Don't rely on global toString() for checking if object (Issue #1494, https://github.com/vkarpov15).
Remove obsolete option uri_decode_auth (Issue #1488, https://github.com/kamagatos).
NODE-936 Correctly translate ReadPreference to CoreReadPreference for mongos queries.
Exposed BSONRegExp type.
NODE-950 push correct index for INSERT ops (https://github.com/mbroadst).
NODE-951 Added support for sslCRL option and added a test case for it.
NODE-953 Made batchSize issue general at cursor level.
NODE-954 Remove write concern from reindex helper as it will not be supported in 3.6.
Updated mongodb-core to 2.1.9.
- Return lastIsMaster correctly when connecting with secondaryOnlyConnectionAllowed is set to true and only a secondary is available in replica state.
- Clone options when passed to wireProtocol handler to avoid intermittent modifications causing errors.
- Ensure SSL error propegates better for Replset connections when there is a SSL validation error.
- NODE-957 Fixed issue where < batchSize not causing cursor to be closed on execution of first batch.
- NODE-958 Store reconnectConnection on pool object to allow destroy to close immediately.

`v2.2.24`

Compare Source

NODE-935, NODE-931 Make MongoClient strict options validation optional and instead print annoying console.warn entries.

`v2.2.23`

Compare Source

Updated mongodb-core to 2.1.8.
- NODE-925 ensure we reschedule operations while pool is < poolSize while pool is growing and there are no connections with not currently performing work.
- NODE-927 fixes issue where authentication was performed against arbiter instances.
- NODE-915 Normalize all host names to avoid comparison issues.
- Fixed issue where pool.destroy would never finish due to a single operation not being executed and keeping it open.
NODE-931 Validates all the options for MongoClient.connect and fixes missing connection settings.
NODE-929 Update SSL tutorial to correctly reflect the non-need for server/mongos/replset subobjects
Fix sensitive command check (Issue #1473, https://github.com/Annoraaq)

`v2.2.22`

Compare Source

Updated mongodb-core to 2.1.7.
- NODE-919 ReplicaSet connection does not close immediately (Issue #156).
- NODE-901 Fixed bug when normalizing host names.
- NODE-909 Fixed readPreference issue caused by direct connection to primary.
- NODE-910 Fixed issue when bufferMaxEntries == 0 and read preference set to nearest.
Add missing unref implementations for replset, mongos (Issue #1455, https://github.com/zbjornson)

`v2.2.21`

Compare Source

Updated mongodb-core to 2.1.6.
- NODE-908 Keep auth contexts in replset and mongos topology to ensure correct application of authentication credentials when primary is first server to be detected causing an immediate connect event to happen.

`v2.2.20`

Compare Source

Updated mongodb-core to 2.1.5 to include bson 1.0.4 and bson-ext 1.0.4 due to Buffer.from being broken in early node 4.x versions.

`v2.2.19`

Compare Source

Corrupted Npm release fix.

`v2.2.18`

Compare Source

Updated mongodb-core to 2.1.4 to fix bson ObjectId toString issue with utils.inspect messing with toString parameters in node 6.

`v2.2.17`

Compare Source

updated createCollection doc options and linked to create command.
Updated mongodb-core to 2.1.3.
- Monitoring operations are re-scheduled in pool if it cannot find a connection that does not already have scheduled work on it, this is to avoid the monitoring socket timeout being applied to any existing operations on the socket due to pipelining
- Moved replicaset monitoring away from serial mode and to parallel mode.
- updated bson and bson-ext dependencies to 1.0.2.

`v2.2.16`

Compare Source

NODE-899 reversed upsertedId change to bring back old behavior.

`v2.2.15`

Compare Source

Bug Fixes

aggregation: ensure that the cursor key is always present (f16f314)
apm: give users access to raw server responses (88b206b)
apm: only rebuilt cursor if reply is non-null (96052c8)
apm: rebuild lost cursor info on pre-OP_QUERY responses (4242d49)
bulk-unordered: add check for ignoreUndefined (f38641a)
change stream examples: use timeouts, cleanup (c5fec5f)
change-streams: ensure a majority read concern on initial agg (23011e9)
changeStreams: fixing node4 issue with util.inherits (#1587) (168bb3d)
collection: allow { upsert: 1 } for findOneAndUpdate() and update() (5bcedd6)
collection: allow passing noCursorTimeout as an option to find() (e9c4ffc)
collection: make the parameters of findOne very explicit (3054f1a)
cursor: hasNext should propagate errors when using callback (6339625)
cursor: close readable on null response for dead cursor (6aca2c5)
dns txt records: check options are set (e5caf4f)
docs: Represent each valid option in docs in both places (fde6e5d)
grid-store: add missing callback (66a9a05)
grid-store: move into callback scope (b53f65f)
GridFS: fix TypeError: doc.data.length is not a function (#1570) (22a4628)
list-collections: ensure default of primary ReadPreference (4a0cfeb)
mongo client: close client before calling done (c828aab)
mongo client: do not connect if url parse error (cd10084)
mongo client: send error to cb (eafc9e2)
mongo-client: move to inside of callback (68b0fca)
mongo-client: options should not be passed to connect (474ac65)
tests: migrate 2.x tests to 3.x (3a5232a)
updateOne/updateMany: ensure that update documents contain atomic operators (8b4255a)
url parser: add check for options as cb (52b6039)
url parser: compare srv address and parent domains (daa186d)
url parser: compare string from first period on (9e5d77e)
url parser: default to ssl true for mongodb+srv (0fbca4b)
url parser: error when multiple hostnames used (c1aa681)
url parser: keep original uri options and default to ssl true (e876a72)
url parser: log instead of throw error for unsupported url options (155de2d)
url parser: make sure uri has 3 parts (aa9871b)
url parser: only 1 txt record allowed with 2 possible options (d9f4218)
url parser: only check for multiple hostnames with srv protocol (5542bcc)
url parser: remove .only from test (642e39e)
url parser: return callback (6096afc)
url parser: support single text record with multiple strings (356fa57)
url parser: try catch bug, not actually returning from try loop (758892b)
url parser: use warn instead of info (40ed27d)
url-parser: remove comment, send error to cb (d44420b)

Features

aggregate: support hit field for aggregate command (aa7da15)
aggregation: adds support for comment in aggregation command (#1571) (4ac475c)
aggregation: fail aggregation on explain + readConcern/writeConcern (e0ca1b4)
causal-consistency: support afterClusterTime in readConcern (a9097f7)
change-streams: add support for change streams (c02d25c)
collection: updating find API (f26362d)
execute-operation: implementation for common op execution (67c344f)
listDatabases: add support for nameOnly option to listDatabases (eb79b5a)
maxTimeMS: adding maxTimeMS option to createIndexes and dropIndexes (90d4a63)
mongo-client: implement MongoClient.prototype.startSession (bce5adf)
retryable-writes: add support for retryWrites cs option (2321870)
sessions: MongoClient will now track sessions and release (6829f47)
sessions: support passing sessions via objects in all methods (a531f05)
shared: add helper utilities for assertion and suite setup (b6cc34e)
ssl: adds missing ssl options ssl options for ciphers and ecdhCurve (441b7b1)
test-shared: add notEqual assertion (41d93fd)
test-shared: add strictEqual assertion method (cad8e19)
topologies: expose underlaying `logicalSessionTimeoutMinutes' (1609a37)
url parser: better error message for slash in hostname (457bc29)

BREAKING CHANGES

aggregation: If you use aggregation, and try to use the explain flag while you
have a readConcern or writeConcern, your query will fail
collection: find and findOne no longer support the fields parameter.
You can achieve the same results as the fields parameter by
either using Cursor.prototype.project, or by passing the projection
property in on the options object. Additionally, find does not
support individual options like skip and limit as positional
parameters. You must pass in these parameters in the options object

3.0.0 2017-??-??

NODE-1043 URI-escaping authentication and hostname details in connection string

2.2.31 2017-08-08

update mongodb-core to 2.2.15
allow auth option in MongoClient.connect
remove duplicate option promoteLongs from MongoClient's connect
bulk operations should not throw an error on empty batch

2.2.30 2017-07-07

Update mongodb-core to 2.2.14
MongoClient
- add appname to list of valid option names
- added test for passing appname as option
NODE-1052 ensure user options are applied while parsing connection string uris

2.2.29 2017-06-19

Update mongodb-core to 2.1.13
- NODE-1039 ensure we force destroy server instances, forcing queue to be flushed.
- Use actual server type in standalone SDAM events.
Allow multiple map calls (Issue #1521, https://github.com/Robbilie).
Clone insertMany options before mutating (Issue #1522, https://github.com/vkarpov15).
NODE-1034 Fix GridStore issue caused by Node 8.0.0 breaking backward compatible fs.read API.
NODE-1026, use operator instead of skip function in order to avoid useless fetch stage.

2.2.28 2017-06-02

Update mongodb-core to 2.1.12
- NODE-1019 Set keepAlive to 300 seconds or 1/2 of socketTimeout if socketTimeout < keepAlive.
- Minor fix to report the correct state on error.
- NODE-1020 'family' was added to options to provide high priority for ipv6 addresses (Issue #1518, https://github.com/firej).
- Fix require_optional loading of bson-ext.
- Ensure no errors are thrown by replset if topology is destroyed before it finished connecting.
- NODE-999 SDAM fixes for Mongos and single Server event emitting.
- NODE-1014 Set socketTimeout to default to 360 seconds.
- NODE-1019 Set keepAlive to 300 seconds or 1/2 of socketTimeout if socketTimeout < keepAlive.
Just handle Collection name errors distinctly from general callback errors avoiding double callbacks in Db.collection.
NODE-999 SDAM fixes for Mongos and single Server event emitting.
NODE-1000 Added guard condition for upload.js checkDone function in case of race condition caused by late arriving chunk write.

2.2.27 2017-05-22

Updated mongodb-core to 2.1.11
- NODE-987 Clear out old intervalIds on when calling topologyMonitor.
- NODE-987 Moved filtering to pingServer method and added test case.
- Check for connection destroyed just before writing out and flush out operations correctly if it is (Issue #179, https://github.com/jmholzinger).
- NODE-989 Refactored Replicaset monitoring to correcly monitor newly added servers, Also extracted setTimeout and setInterval to use custom wrappers Timeout and Interval.
NODE-985 Deprecated Db.authenticate and Admin.authenticate and moved auth methods into authenticate.js to ensure MongoClient.connect does not print deprecation warnings.
NODE-988 Merged readConcern and hint correctly on collection(...).find(...).count()
Fix passing the readConcern option to MongoClient.connect (Issue #1514, https://github.com/bausmeier).
NODE-996 Propegate all events up to a MongoClient instance.
Allow saving doc with null _id (Issue #1517, https://github.com/vkarpov15).
NODE-993 Expose hasNext for command cursor and add docs for both CommandCursor and Aggregation Cursor.

2.2.26 2017-04-18

Updated mongodb-core to 2.1.10
- NODE-981 delegate auth to replset/mongos if inTopology is set.
- NODE-978 Wrap connection.end in try/catch for node 0.10.x issue causing exceptions to be thrown, Also surfaced getConnection for mongos and replset.
- Remove dynamic require (Issue #175, https://github.com/tellnes).
- NODE-696 Handle interrupted error for createIndexes.
- Fixed isse when user is executing find command using Server.command and it get interpreted as a wire protcol message, #172.
- NODE-966 promoteValues not being promoted correctly to getMore.
- Merged in fix for flushing out monitoring operations.
NODE-983 Add cursorId to aggregate and listCollections commands (Issue, #1510).
Mark group and profilingInfo as deprecated methods
NODE-956 DOCS Examples.
Update readable-stream to version 2.2.7.
NODE-978 Added test case to uncover connection.end issue for node 0.10.x.
NODE-972 Fix(db): don't remove database name if collectionName == dbName (Issue, #1502)
Fixed merging of writeConcerns on db.collection method.
NODE-970 mix in readPreference for strict mode listCollections callback.
NODE-966 added testcase for promoteValues being applied to getMore commands.
NODE-962 Merge in ignoreUndefined from collection level for find/findOne.
Remove multi option from updateMany tests/docs (Issue #1499, https://github.com/spratt).
NODE-963 Correctly handle cursor.count when using APM.

2.2.25 2017-03-17

Don't rely on global toString() for checking if object (Issue #1494, https://github.com/vkarpov15).
Remove obsolete option uri_decode_auth (Issue #1488, https://github.com/kamagatos).
NODE-936 Correctly translate ReadPreference to CoreReadPreference for mongos queries.
Exposed BSONRegExp type.
NODE-950 push correct index for INSERT ops (https://github.com/mbroadst).
NODE-951 Added support for sslCRL option and added a test case for it.
NODE-953 Made batchSize issue general at cursor level.
NODE-954 Remove write concern from reindex helper as it will not be supported in 3.6.
Updated mongodb-core to 2.1.9.
- Return lastIsMaster correctly when connecting with secondaryOnlyConnectionAllowed is set to true and only a secondary is available in replica state.
- Clone options when passed to wireProtocol handler to avoid intermittent modifications causing errors.
- Ensure SSL error propegates better for Replset connections when there is a SSL validation error.
- NODE-957 Fixed issue where < batchSize not causing cursor to be closed on execution of first batch.
- NODE-958 Store reconnectConnection on pool object to allow destroy to close immediately.

2.2.24 2017-02-14

NODE-935, NODE-931 Make MongoClient strict options validation optional and instead print annoying console.warn entries.

2.2.23 2017-02-13

Updated mongodb-core to 2.1.8.
- NODE-925 ensure we reschedule operations while pool is < poolSize while pool is growing and there are no connections with not currently performing work.
- NODE-927 fixes issue where authentication was performed against arbiter instances.
- NODE-915 Normalize all host names to avoid comparison issues.
- Fixed issue where pool.destroy would never finish due to a single operation not being executed and keeping it open.
NODE-931 Validates all the options for MongoClient.connect and fixes missing connection settings.
NODE-929 Update SSL tutorial to correctly reflect the non-need for server/mongos/replset subobjects
Fix sensitive command check (Issue #1473, https://github.com/Annoraaq)

2.2.22 2017-01-24

Updated mongodb-core to 2.1.7.
- NODE-919 ReplicaSet connection does not close immediately (Issue #156).
- NODE-901 Fixed bug when normalizing host names.
- NODE-909 Fixed readPreference issue caused by direct connection to primary.
- NODE-910 Fixed issue when bufferMaxEntries == 0 and read preference set to nearest.
Add missing unref implementations for replset, mongos (Issue #1455, https://github.com/zbjornson)

2.2.21 2017-01-13

Updated mongodb-core to 2.1.6.
- NODE-908 Keep auth contexts in replset and mongos topology to ensure correct application of authentication credentials when primary is first server to be detected causing an immediate connect event to happen.

2.2.20 2017-01-11

Updated mongodb-core to 2.1.5 to include bson 1.0.4 and bson-ext 1.0.4 due to Buffer.from being broken in early node 4.x versions.

2.2.19 2017-01-03

Corrupted Npm release fix.

2.2.18 2017-01-03

Updated mongodb-core to 2.1.4 to fix bson ObjectId toString issue with utils.inspect messing with toString parameters in node 6.

2.2.17 2017-01-02

updated createCollection doc options and linked to create command.
Updated mongodb-core to 2.1.3.
- Monitoring operations are re-scheduled in pool if it cannot find a connection that does not already have scheduled work on it, this is to avoid the monitoring socket timeout being applied to any existing operations on the socket due to pipelining
- Moved replicaset monitoring away from serial mode and to parallel mode.
- updated bson and bson-ext dependencies to 1.0.2.

2.2.16 2016-12-13

NODE-899 reversed upsertedId change to bring back old behavior.

2.2.15 2016-12-10

Updated mongodb-core to 2.1.2.
- Delay topologyMonitoring on successful attemptReconnect as no need to run a full scan immediately.
- Emit reconnect event in primary joining when in connected status for a replicaset (Fixes mongoose reconnect issue).

2.2.14 2016-12-08

Updated mongodb-core to 2.1.1.
NODE-892 Passthrough options.readPreference to mongodb-core ReplSet instance.

2.2.13 2016-12-05

Updated mongodb-core to 2.1.0.
NODE-889 Fixed issue where legacy killcursor wire protocol messages would not be sent when APM is enabled.
Expose parserType as property on topology objects.

2.2.12 2016-11-29

Updated mongodb-core to 2.0.14.
- Updated bson library to 0.5.7.
- Dont leak connection.workItems elments when killCursor is called (Issue #150, https://github.com/mdlavin).
- Remove unnecessary errors formatting (Issue #149, https://github.com/akryvomaz).
- Only check isConnected against availableConnections (Issue #142).
- NODE-838 Provide better error message on failed to connect on first retry for Mongos topology.
- Set default servername to host is not passed through for sni.
- Made monitoring happen on exclusive connection and using connectionTimeout to handle the wait time before failure (Issue #148).
- NODE-859 Make minimum value of maxStalenessSeconds 90 seconds.
- NODE-852 Fix Kerberos module deprecations on linux and windows and release new kerberos version.
- NODE-850 Update Max Staleness implementation.
- NODE-849 username no longer required for MONGODB-X509 auth.
- NODE-848 BSON Regex flags must be alphabetically ordered.
- NODE-846 Create notice for all third party libraries.
- NODE-843 Executing bulk operations overwrites write concern parameter.
- NODE-842 Re-sync SDAM and SDAM Monitoring tests from Specs repo.
- NODE-840 Resync CRUD spec tests.
- Unescapable while(true) loop (Issue #152).
NODE-864 close event not emits during network issues using single server topology.
Introduced maxStalenessSeconds.
NODE-840 Added CRUD specification test cases and fix minor issues with upserts reporting matchedCount > 0.
Don't ignore Db-level authSource when using auth method. (https://github.com/donaldguy).

2.2.11 2016-10-21

Updated mongodb-core to 2.0.13.
- Fire callback when topology was destroyed (Issue #147, https://github.com/vkarpov15).
- Refactoring to support pipelining ala 1.4.x branch will retaining the benefits of the growing/shrinking pool (Issue #146).
- Fix typo in serverHeartbeatFailed event name (Issue #143, https://github.com/jakesjews).
- NODE-798 Driver hangs on count command in replica set with one member (Issue #141, https://github.com/isayme).
Updated bson library to 0.5.6.
- Included cyclic dependency detection
Fix typo in serverHeartbeatFailed event name (Issue #1418, https://github.com/jakesjews).
NODE-824, readPreference "nearest" does not work when specified at collection level.
NODE-822, GridFSBucketWriteStream end method does not handle optional parameters.
NODE-823, GridFSBucketWriteStream end: callback is invoked with invalid parameters.
NODE-829, Using Start/End offset option in GridFSBucketReadStream doesn't return the right sized buffer.

2.2.10 2016-09-15

Updated mongodb-core to 2.0.12.
fix debug logging message not printing server name.
fixed application metadata being sent by wrong ismaster.
NODE-812 Fixed mongos stall due to proxy monitoring ismaster failure causing reconnect.
NODE-818 Replicaset timeouts in initial connect sequence can "no primary found".
Updated bson library to 0.5.5.
Added DBPointer up conversion to DBRef.
MongoDB 3.4-RC Pass appname through MongoClient.connect uri or options to allow metadata to be passed.
MongoDB 3.4-RC Pass collation options on update, findOne, find, createIndex, aggregate.
MongoDB 3.4-RC Allow write concerns to be passed to all supporting server commands.
MongoDB 3.4-RC Allow passing of servername as SSL options to support SNI.

2.2.9 2016-08-29

Updated mongodb-core to 2.0.11.
NODE-803, Fixed issue in how the latency window is calculated for Mongos topology causing issues for single proxy connections.
Avoid timeout in attemptReconnect causing multiple attemptReconnect attempts to happen (Issue #134, https://github.com/dead-horse).
Ensure promoteBuffers is propegated in same fashion as promoteValues and promoteLongs.
Don't treat ObjectId as object for mapReduce scope (Issue #1397, https://github.com/vkarpov15).

2.2.8 2016-08-23

Updated mongodb-core to 2.0.10.
Added promoteValues flag (default to true) to allow user to specify they only want wrapped BSON values back instead of promotion to native types.
Do not close mongos proxy connection on failed ismaster check in ha process (Issue #130).

2.2.7 2016-08-19

If only a single mongos is provided in the seedlist, fix issue where it would be assigned as single standalone server instead of mongos topology (Issue #130).
Updated mongodb-core to 2.0.9.
Allow promoteLongs to be passed in through Response.parse method and overrides default set on the connection.
NODE-798 Driver hangs on count command in replica set with one member.
Allow promoteLongs to be passed in through Response.parse method and overrides default set on the connection.
Allow passing in servername for TLS connections for SNI support.

2.2.6 2016-08-16

Updated mongodb-core to 2.0.8.
Allow execution of store operations independent of having both a primary and secondary available (Issue #123).
Fixed command execution issue for mongos to ensure buffering of commands when no mongos available.
Allow passing in an array of tags to ReadPreference constructor (Issue #1382, https://github.com/vkarpov15)
Added hashed connection names and fullResult.
Updated bson library to 0.5.3.
Enable maxTimeMS in count, distinct, findAndModify.

2.2.5 2016-07-28

Updated mongodb-core to 2.0.7.
Allow primary to be returned when secondaryPreferred is passed (Issue #117, https://github.com/dhendo).
Added better warnings when passing in illegal seed list members to a Mongos topology.
Minor attemptReconnect bug that would cause multiple attemptReconnect to run in parallel.
Fix wrong opType passed to disconnectHandler.add (Issue #121, https://github.com/adrian-gierakowski)
Implemented domain backward comp support enabled via domainsEnabled options on Server/ReplSet/Mongos and MongoClient.connect.

2.2.4 2016-07-19

NPM corrupted upload fix.

2.2.3 2016-07-19

Updated mongodb-core to 2.0.6.
Destroy connection on socket timeout due to newer node versions not closing the socket.

2.2.2 2016-07-15

Updated mongodb-core to 2.0.5.
Minor fixes to handle faster MongoClient connectivity from the driver, allowing single server instances to detect if they are a proxy.
Added numberOfConsecutiveTimeouts to pool that will destroy the pool if the number of consecutive timeouts > reconnectTries.
Print warning if seedlist servers host name does not match the one provided in it's ismaster.me field for Replicaset members.
Fix issue where Replicaset connection would not succeeed if there the replicaset was a single primary server setup.

2.2.1 2016-07-11

Updated mongodb-core to 2.0.4.
handle situation where user is providing seedlist names that do not match host list. fix allows for a single full discovery connection sweep before erroring out.
NODE-747 Polyfill for Object.assign for 0.12.x or 0.10.x.
NODE-746 Improves replicaset errors for wrong setName.

2.2.0 2016-07-05

Updated mongodb-core to 2.0.3.
Moved all authentication and handling of growing/shrinking of pool connections into actual pool.
All authentication methods now handle both auth/reauthenticate and logout events.
Introduced logout method to get rid of onAll option for logout command.
Updated bson to 0.5.0 that includes Decimal128 support.
Fixed logger error serialization issue.
Documentation fixes.
Implemented Server Selection Specification test suite.
Added warning level to logger.
Added warning message when sockeTimeout < haInterval for Replset/Mongos.
Mongos emits close event on no proxies available or when reconnect attempt fails.
Replset emits close event when no servers available or when attemptReconnect fails to reconnect.
Don't throw in auth methods but return error in callback.

2.1.21 2016-05-30

Updated mongodb-core to 1.3.21.
Pool gets stuck if a connection marked for immediateRelease times out (Issue #99, https://github.com/nbrachet).
Make authentication process retry up to authenticationRetries at authenticationRetryIntervalMS interval.
Made ismaster replicaset calls operate with connectTimeout or monitorSocketTimeout to lower impact of big socketTimeouts on monitoring performance.
Make sure connections mark as "immediateRelease" don't linger the inUserConnections list. Otherwise, after that connection times out, getAll() incorrectly returns more connections than are effectively present, causing the pool to not get restarted by reconnectServer. (Issue #99, https://github.com/nbrachet).
Make cursor getMore or killCursor correctly trigger pool reconnect to single server if pool has not been destroyed.
Make ismaster monitoring for single server connection default to avoid user confusion due to change in behavior.

2.1.20 2016-05-25

Refactored MongoClient options handling to simplify the logic, unifying it.
NODE-707 Implemented openUploadStreamWithId on GridFS to allow for custom fileIds so users are able to customize shard key and shard distribution.
NODE-710 Allow setting driver loggerLevel and logger function from MongoClient options.
Updated mongodb-core to 1.3.20.
Minor fix for SSL errors on connection attempts, minor fix to reconnect handler for the server.
Don't write to socket before having registered the callback for commands, work around for windows issuing error events twice on node.js when socket gets destroyed by firewall.
Fix minor issue where connectingServers would not be removed correctly causing single server connections to not auto-reconnect.

2.1.19 2016-05-17

Handle situation where a server connection in a replicaset sometimes fails to be destroyed properly due to being in the middle of authentication when the destroy method is called on the replicaset causing it to be orphaned and never collected.
Ensure replicaset topology destroy is never called by SDAM.
Ensure all paths are correctly returned on inspectServer in replset.
Updated mongodb-core to 1.3.19 to fix minor connectivity issue on quick open/close of MongoClient connections on auth enabled mongodb Replicasets.

2.1.18 2016-04-27

Updated mongodb-core to 1.3.18 to fix Node 6.0 issues.

2.1.17 2016-04-26

Updated mongodb-core to 1.3.16 to work around issue with early versions of node 0.10.x due to missing unref method on ClearText streams.
INT-1308: Allow listIndexes to inherit readPreference from Collection or DB.
Fix timeout issue using new flags #1361.
Updated mongodb-core to 1.3.17.
Better handling of unique createIndex error.
Emit error only if db instance has an error listener.
DEFAULT authMechanism; don't throw error if explicitly set by user.

2.1.16 2016-04-06

Updated mongodb-core to 1.3.16.

2.1.15 2016-04-06

Updated mongodb-core to 1.3.15.
Set ssl, sslValidate etc to mongosOptions on url_parser (Issue #1352, https://github.com/rubenstolk).

NODE-687 Fixed issue where a server object failed to be destroyed if the replicaset state did not update successfully. This could leave active connections accumulating over time.
Fixed some situations where all connections are flushed due to a single connection in the connection pool closing.

2.1.14 2016-03-29

Updated mongodb-core to 1.3.13.
Handle missing cursor on getMore when going through a mongos proxy by pinning to socket connection and not server.

2.1.13 2016-03-29

Updated mongodb-core to 1.3.12.

2.1.12 2016-03-29

Updated mongodb-core to 1.3.11.
Mongos setting acceptableLatencyMS exp

❗ Important

✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

Update dependency mongodb to v3 [SECURITY]

d32c935

Navigation Menu

Update dependency mongodb to v3 [SECURITY] - #310

Update dependency mongodb to v3 [SECURITY]#310
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/npm-mongodb-vulnerability

renovate Bot commented May 28, 2023 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented May 28, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Denial of Service in mongodb

Details

Recommendation

Severity

References

Release Notes

Bug Fixes

Features

BREAKING CHANGES

3.0.0 2017-??-??

2.2.31 2017-08-08

2.2.30 2017-07-07

2.2.29 2017-06-19

2.2.28 2017-06-02

2.2.27 2017-05-22

2.2.26 2017-04-18

2.2.25 2017-03-17

2.2.24 2017-02-14

2.2.23 2017-02-13

2.2.22 2017-01-24

2.2.21 2017-01-13

2.2.20 2017-01-11

2.2.19 2017-01-03

2.2.18 2017-01-03

2.2.17 2017-01-02

2.2.16 2016-12-13

2.2.15 2016-12-10

2.2.14 2016-12-08

2.2.13 2016-12-05

2.2.12 2016-11-29

2.2.11 2016-10-21

2.2.10 2016-09-15

2.2.9 2016-08-29

2.2.8 2016-08-23

2.2.7 2016-08-19

2.2.6 2016-08-16

2.2.5 2016-07-28

2.2.4 2016-07-19

2.2.3 2016-07-19

2.2.2 2016-07-15

2.2.1 2016-07-11

2.2.0 2016-07-05

2.1.21 2016-05-30

2.1.20 2016-05-25

2.1.19 2016-05-17

2.1.18 2016-04-27

2.1.17 2016-04-26

2.1.16 2016-04-06

2.1.15 2016-04-06

2.1.14 2016-03-29

2.1.13 2016-03-29

2.1.12 2016-03-29

Configuration

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented May 28, 2023 •

edited

Loading