[Snyk] Upgrade mongodb from 3.5.9 to 7.0.0 #1684
Open
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Snyk has created this PR to upgrade mongodb from 3.5.9 to 7.0.0. See this package in npm: mongodb See this project in Snyk: https://app.snyk.io/org/panda-co/project/ebfb2282-581e-4b1b-afb0-8a0e07b1b540?utm_source=github&utm_medium=referral&page=upgrade-pr
Owner
Author
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Snyk has created this PR to upgrade mongodb from 3.5.9 to 7.0.0.
ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.
The recommended version is 414 versions ahead of your current version.
The recommended version was released 22 days ago.
Issues fixed by the recommended upgrade:
SNYK-JS-BL-608877
Release notes
Package name: mongodb
7.0.0 (2025-11-06)
The MongoDB Node.js team is pleased to announce version 7.0.0 of the
mongodbpackage!Release Notes
The following is a detailed collection of the changes in the major v7 release of the
mongodbpackage for Node.js.The main focus of this release was usability improvements and a streamlined API. Read on for details!
Important
This is a list of changes relative to v6.21.0 of the driver. ALL changes listed below are BREAKING unless indicated otherwise.
Users migrating from an older version of the driver are advised to upgrade to at least v6.21.0 before adopting v7.
🛠️ Runtime and dependency updates
Minimum Node.js version is now v20.19.0
The minimum supported Node.js version is now v20.19.0 and our TypeScript target has been updated to ES2023. We strive to keep our minimum supported Node.js version in sync with the runtime's release cadence to keep up with the latest security updates and modern language features.
Notably, the driver now offers native support for explicit resource management.
Symbol.asyncDisposeimplementations are available on theMongoClient,ClientSession,ChangeStreamand on cursors.Note
Explicit resource management is considered experimental in the driver and will be until the TC39 explicit resource management proposal is completed.
bsonandmongodb-connection-string-urlversions 7.0.0This driver version has been updated to use
[email protected]and[email protected], which match the driver's Node.js runtime version support. BSON functionality re-exported from the driver is furthermore subject to the changes outlined in the BSON V7 release notes.Optional peer dependency releases and version bumps
@ mongodb-js/zstdoptional peer dependency minimum version raised to7.0.0, dropped support for1.xand2.x(note that@ mongodb-js/zstddoes not have3.x-6.xversion releases)kerberosoptional peer dependency minimum version raised to7.0.0, dropped support for2.x(note thatkerberosdoes not have3.x-6.xversion releases)mongodb-client-encryptionoptional peer dependency minimum version raised to7.0.0, dropped support for6.xAdditionally, the driver is now compatible with the following packages:
🔐 AWS authentication
To improve long-term maintainability and ensure compatibility with AWS updates, we’ve standardized AWS auth to use the official SDK in all cases and made a number of supporting changes outlined below.
@ aws-sdk/credential-providersis now required for MONGODB-AWS authenticationPrevious versions of the driver contained two implementations for AWS authentication and could run the risk of the custom driver implementation not supporting all AWS authentication features as well as not being correct when AWS makes changes. Using the official AWS SDK in all cases alleviates these issues.
Custom AWS credential provider takes highest precedence
When providing a custom AWS credential provider via the auth mechanism property
AWS_CREDENTIAL_PROVIDER, it will now take the highest precedence over any other AWS auth method.Explicitly provided credentials no longer accepted with MONGODB-AWS authentication
AWS environments (such as AWS Lambda) do not have credentials that are permanent and expire within a set amount of time. Providing credentials in the URI or options would mandate that those credentials would be valid for the life of the
MongoClient, which is problematic. With this change, the fetching of credentials is fully handled by the installed required AWS SDK.This means that for AWS authentication, all client URIs MUST now be specified as:
const client = new MongoClient('mongodb<+srv>://<host>:<port>/?authMechanism=MONGODB-AWS');
The previous method of providing URI encoded credentials based on the
AWS_ACCESS_KEY_IDandAWS_SECRET_ACCESS_KEYdirectly in the connection string will no longer work.⚙️ Error handling improvements
Dropping a collection returns false instead of throwing when NS not found
This change has been made for consistency with the common drivers specifications.
Aggregate with write concern and explain no longer throws client-side
This will now throw a
MongoServerErrorinstead.All encryption-related errors now subclass MongoError
The driver aims to ensure that all errors it throws are subclasses of
MongoError. However, when using CSFLE or QE, the driver's encryption implementation could sometimes throw errors that were not instances ofMongoError.Now, all errors thrown during encryption are subclasses of
MongoError.'PoolRequstedRetry' error label renamed to 'PoolRequestedRetry'
The
PoolClearedErrorthrown in cases where the connection pool was cleared now fixes the typo in the error label.💥 Misc breaking improvements
Change streams no longer filter
$changeStreamstage optionsUsers can now pass any option to
collection.watch(). If an option is invalid for the$changeStreamstage of the pipeline, the server will return an error. This change makes it possible to use newly introduced server options without waiting for them to become available in our public type definitions and eliminates the risk of valid but unrecognized options being silently ignored.Cursors no longer provide a default
batchSizeof 1000 forgetMoresIn driver versions <7.0, the driver provides a default
batchSizeof 1000 for eachgetMorewhen iterating a cursor. This behavior is not ideal because the default is set regardless of the documents being fetched. For example, if a cursor fetches many small documents, the driver's default of 1000 can result in many round-trips to fetch all documents, when the server could fit all documents inside a singlegetMoreif nobatchSizewere set.Now, cursors no longer provide a default
batchSizewhen executing agetMore. AbatchSizewill only be set ongetMorecommands if abatchSizehas been explicitly configured for the cursor.Auto encryption options now include default filenames in TS
A common source of confusion for people configuring auto encryption is where to specify the path to
mongocryptdand where to specify the path tocrypt_shared. We've now made this clearer in our Typescript users. Typescript now reports errors if the specified filename doesn't match the default name of the file. Some examples:var path: AutoEncryptionOptions['extraOptions']['mongocryptdSpawnPath'] = 'mongocryptd'; // OK
var path: AutoEncryptionOptions['extraOptions']['mongocryptdSpawnPath'] =
'/usr/local/bin/mongocryptd'; // OK
var path: AutoEncryptionOptions['extraOptions']['mongocryptdSpawnPath'] = 'mongocryptd.exe'; // OK
var path: AutoEncryptionOptions['extraOptions']['cryptSharedLibPath'] = 'some path'; // ERROR
var path: AutoEncryptionOptions['extraOptions']['cryptSharedLibPath'] = 'mongo_crypt_v1.so'; // OK
var path: AutoEncryptionOptions['extraOptions']['cryptSharedLibPath'] = 'mongo_crypt_v1.dll'; // OK
var path: AutoEncryptionOptions['extraOptions']['cryptSharedLibPath'] = 'mongo_crypt_v1.dylib'; // OK
☀️ Misc non-breaking improvements
Improve
MongoClient.connect()consistency across environmentsThe
MongoClientconnect function will now run a handshake regardless of credentials being defined. The upshot of this change is that connect is more consistent at verifying some fail-fast preconditions regardless of environment. For example, previously, if connecting to aloadBalanced=truecluster without authentication there would not have been an error until a command was attempted.MongoClient.close()no longer sendsendSessionsif the topology does not have session supportMongoClient.close()attempts to free up any server resources that the client has instantiated, including sessions. Previously,MongoClient.close()unconditionally attempted to kill all sessions, regardless of whether or not the topology actually supports sessions.Now,
MongoClient.close()only attempts to clean up sessions if the topology supports sessions.Wrap socket write in a try/catch to ensure errors can be properly wrapped
One
socket.writecall was not correctly wrapped in a try/catch block and network errors could bubble up to the driver. This call is now properly wrapped and will result in a retry.ClientEncryption.rewrapManyDataKey()options now correctly marked as optionalThe options parameter for the
ClientEncryption.rewrapManyDataKey()method is now correctly marked as optional in its TypeScript definition. This change aligns the type signature with the method's implementation and documentation, resolving a type mismatch for TypeScript users.📜 Removal of deprecated functionality
Cursor and ChangeStream
stream()method no longer accepts a transformCursors and ChangeStreams no longer accept a
transformfunction.ReadableStream.map()can be used instead:const stream = cursor.stream({ transform: JSON.stringify });
// after
const stream = cursor.stream().map(JSON.stringify);
MONGODB-CR AuthMechanism has been removed
This mechanism has been unsupported as of MongoDB 4.0 and attempting to use it will still raise an error.
Internal
ClientMetadataproperties have been removed from the public APIPrevious versions of the driver unintentionally exposed the following properties that have now been made internal:
CommandOptions.noResponseoption removedThis option was never intended to be public, and never worked properly for user-facing APIs. It has now been removed.
Assorted deprecated type, class, and option removals
betanamespace and move resource management into driver (#4719)Non-breaking
6.21.0 (2025-11-05)
The MongoDB Node.js team is pleased to announce version 6.21.0 of the
mongodbpackage!Release Notes
Deprecated items to be removed in 7.0.0
The following items have been deprecated and will be removed in 7.0.0:
Features
Documentation
We invite you to try the
mongodblibrary immediately, and report any issues to the NODE project.6.20.0 (2025-09-17)
The MongoDB Node.js team is pleased to announce version 6.20.0 of the
mongodbpackage!Release Notes
CollectionandDbobjects now provide references to theirDbandMongoClientconst client = new MongoClient(process.env.MONGODB_URI);
const db = client.db('test');
assert(db.client === client); // returns the MongoClient associated with the Db object
const collection = db.collection('test');
assert(collection.db === db); // returns the Db associated with the Collection object
Hint is supported with unacknowledged writes for delete, update and findAndModify commands on servers that support hint
The driver no longer throws errors when
hintis provided to unacknowledged writes fordelete,updateandfindAndModifycommands in the following circumstances:updatecommands.deleteandfindAndModifycommands on servers >=4.4.ServerCapabilities and ReadPreference.minWireVersion are deprecated
Neither the
ServerCapabilitiesclass nor theReadPreference.minWireVersionproperty were ever intended for public use and, internally, are effectively dead code with the driver's minimum supported server version being 4.2.Driver info and metadata MongoClient options have been deprecated.
These will be made internal in a future major release:
driverInfoadditionalDriverInfometadataextendedMetadataCommandOperationOptions.retryWritesis deprecatedCommandOperationOptions.retryWritesis deprecated. This per‑command option has no effect; the Node.js driver only honorsretryWriteswhen configured at the client level (MongoClient options) or via the connection string. Do not use this option on individual commands. There is no runtime behavior change because it was already ignored, but it will be removed in an upcoming major release and may cause type or build errors in code that references it. To control retryable writes, setretryWritesin MongoClient options or includeretryWrites=true|falsein the connection string.ChangeStream
.tryNext()now updatesresumeTokento prevent duplicates after resumeWhen
.tryNext()returns a change document, the driver now caches itsresumeToken, aligning its behavior with.next()and the'change'event. If.tryNext()returnsnull(no new changes), nothing is cached, which is unchanged from previous behavior.Previously,
.tryNext()did not update theresumeToken, so a resumable error could cause a resume from an older token and re-deliver already processed changes. With this release, resumes continue from the latest token observed via.tryNext(), preventing duplicates.Applications that poll change streams with
.tryNext()in non-blocking loops benefit directly. There are no API changes; if you previously tracked and passedresumeAfterorstartAftermanually, you can now rely on the driver’s built-in token caching.Huge thanks to @ rkistner for bringing this bug to our attention and for sharing code to reproduce it. Huge thanks as well to @ Omnicpie for investigating and implementing a fix.
Change Streams now resume on
MongoServerSelectionErrorWhen the driver encounters a
MongoServerSelectionErrorwhile processing a Change Stream (e.g., due to a transient network issue or during an election), it now treats the error as resumable and attempts to resume using the latest cached resume token.This applies to both iterator and event-emitter usage:
There are no API changes. If you previously caught
MongoServerSelectionErrorand implemented manual resume logic, you can now rely on the driver’s built-in resume mechanism, which uses the cached resume token from the change event’s_idto continue without losing events.Huge thanks to @ grossbart for bringing this bug to our attention, investigating it and for sharing code to reproduce it!
MongoClient.appendMetadata()ignores duplicate metadataMongoClient.appendMetadata()will no longer append metadata if it duplicates the metadata already appended to the MongoClient.Features
retryWritesinCommandOperationOptions(#4661) (620972d)Bug Fixes
resumeTokeninChangeStream.tryNext()(#4636) (8331a93)Documentation
We invite you to try the
mongodblibrary immediately, and report any issues to the NODE project.6.19.0 (2025-08-26)
The MongoDB Node.js team is pleased to announce version 6.19.0 of the
mongodbpackage!Release Notes
Experimental Support for Queryable Encryption Text Field Prefix, Suffix and Substring Queries
Important
Substring, prefix and suffix search are in preview and should be used for experimental workloads only. These features are unstable and their security is not guaranteed until released as Generally Available (GA). The GA version of these features may not be backwards compatible with the preview version.
When using Queryable Encryption with both automatic encryption and explicit encryption, text fields can now be queried using prefix, suffix and substring queries. This feature requires
mongodb-client-encryption@>=6.5.0.Allow a
secureContextfor Auto Encryption and Client Encryption TLS optionsThis can be provided in the
tlsOptionsoption both both objects.import { ClientEncryption, MongoClient } from 'mongodb';
const caFile = await fs.readFile(process.env.CSFLE_TLS_CA_FILE);
const certFile = await fs.readFile(process.env.CSFLE_TLS_CLIENT_CERT_FILE);
const secureContextOptions = {
ca: caFile,
key: certFile,
cert: certFile
};
const options = {
keyVaultNamespace: 'db.coll',
kmsProviders: {
aws: {}
}
},
tlsOptions: {
aws: {
secureContext: tls.createSecureContext(secureContextOptions),
}
}
};
const client = this.configuration.newClient({}, { autoEncryption: { ...options, schemaMap } });
const clientEncryption = new ClientEncryption(client, options);
collection.findOne()andcollection.find()will no longer potentially leave open cursors on the serverThe
findOnecommand will now always set thelimitoption to1andsingleBatchtotrue. Thelimit,noCursorResponseandbatchSizeoptions have also been deprecated, and the command will guarantee no more cursors can be orphaned and nokillCursorscommand will be potentially executed.findwill now setlimittobatchSize + 1when both options were equal, to avoid leaving cursors open.Clients no longer send a ping on connect
When authentication is enabled, the
MongoClientwill no longer send apingcommand when connecting since it is unnecessary. Instead it will check a connection out of the pool to force the initial handshake, and check it back in.Features