[Snyk] Upgrade mongodb from 4.1.1 to 4.17.2

[bryanpinheiro]

This PR was automatically created by Snyk using the credentials of a real user.


Snyk has created this PR to upgrade mongodb from 4.1.1 to 4.17.2.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

• The recommended version is 29 versions ahead of your current version.

• The recommended version was released 6 months ago, on 2023-12-05.

The recommended version fixes:

Severity	Issue	PriorityScore (*)	Exploit Maturity
	Information Exposure SNYK-JS-MONGODB-5871303	424/1000 Why? Has a fix available, CVSS 4.2	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Release notes

Package name: mongodb

• 4.17.2 - 2023-12-05
  

  4.17.2 (2023-11-16)

  The MongoDB Node.js team is pleased to announce version 4.17.2 of the mongodb package!

  Release Notes

  Fix connection leak when serverApi is enabled

  When enabling serverApi the driver's RTT mesurment logic (used to determine the closest node) still sent the legacy hello command "isMaster" causing the server to return an error. Unfortunately, the error handling logic did not correctly destroy the socket which would cause a leak.

  Both sending the correct hello command and the error handling connection clean up logic are fixed in this change.

  Bug Fixes

  • NODE-5751: RTTPinger always sends legacy hello (#3923) (bc3d020)

  Documentation

  • Reference
  • API
  • Changelog

  We invite you to try the mongodb library immediately, and report any issues to the NODE project.

• 4.17.1 - 2023-08-23
  

  4.17.1 (2023-08-23)

  The MongoDB Node.js team is pleased to announce version 4.17.1 of the mongodb package!

  Release Notes

  Import of saslprep updated to correct library.

  Fixes the import of saslprep to be the correct @ mongodb-js/saslprep library.

  Bug Fixes

  • NODE-5573: fix saslprep import (#3838) (ff6c293)

  Documentation

  • Reference
  • API
  • Changelog

  We invite you to try the mongodb library immediately, and report any issues to the NODE project.

• 4.17.0 - 2023-08-17
• 4.16.0 - 2023-04-18
• 4.15.0 - 2023-04-04
• 4.14.0 - 2023-02-07
• 4.13.0 - 2022-12-19
• 4.12.1 - 2022-11-23
• 4.12.0 - 2022-11-16
• 4.11.0 - 2022-10-19
• 4.10.0 - 2022-09-19
• 4.9.1 - 2022-08-31
• 4.9.0 - 2022-08-18
• 4.8.1 - 2022-07-26
• 4.8.0 - 2022-07-13
• 4.7.0 - 2022-06-06
• 4.6.0 - 2022-05-11
• 4.6.0-alpha.0 - 2022-05-04
• 4.5.0 - 2022-04-04
• 4.4.1 - 2022-03-03
• 4.4.0 - 2022-02-17
• 4.3.1 - 2022-01-18
• 4.3.0 - 2022-01-06
• 4.2.2 - 2021-12-13
• 4.2.1 - 2021-11-30
• 4.2.0 - 2021-11-17
• 4.1.4 - 2021-11-03
• 4.1.3 - 2021-10-05
• 4.1.2 - 2021-09-14
• 4.1.1 - 2021-08-24

from mongodb GitHub release notes

Commit messages

Package name: mongodb

• aab9c46 chore(4.x): release 4.17.2 [skip-ci] (#3926)
• bc3d020 fix(NODE-5751): RTTPinger always sends legacy hello (#3923)
• c698918 test(NODE-5738): update data lake test scripts (#3920)
• 3934465 ci(NODE-5654): remove vars from evergreen config (#3881)
• 278523a ci(NODE-5667): remove custom dep tests against master and fix prose test 14 (#3883)
• 85996c3 test(NODE-5618): use npm 9 on eol node versions (#3862)
• cdc3d53 chore(4.x): release 4.17.1 [skip-ci] (#3840)
• ff6c293 fix(NODE-5573): fix saslprep import (#3838)
• c83a801 chore(4.x): release 4.17.0 [skip-ci] (#3763)
• 1b59955 chore: update release automation scripts 4.x (#3824)
• 5244711 feat(NODE-5398): use mongodb-js/saslprep instead of saslprep (#3820)
• 2910dca fix(NODE-5536): remove credentials from ConnectionPoolCreatedEvent options (#3812)
• 0c1b654 chore(NODE-5400): add @ octokit/core as a devDep (#3750)
• 4adff37 chore(NODE-5382): backport release automation scripts (#3747)
• 2d028af fix(NODE-5356): prevent scram auth from throwing TypeError if saslprep is not a function (#3732)
• 0e1afc0 ci(Node 5335): clean up instance profile from instance after CI runs (#3719)
• 7f5b334 ci(NODE-5334): install npm to node_artifacts directory in CI (#3709)
• e13038d fix(NODE-5316): prevent parallel topology creation in MongoClient.connect (#3696)
• 261199f ci(NODE-5313): change windows hosts to vsCurrent (#3690)
• 8fb0611 test(NODE-5315): regenerate config.yml (#3689)
• 8a73735 test(NODE-5300): add 7.0 to CI (#3676)
• 98b7bdf fix(NODE-5311): construct error messages for AggregateErrors in Node16+ (#3683)
• c0c3d99 fix(NODE-5262): AWS Lambda metadata detection logic is too permissive (#3683)
• 1c36949 test(no-story): bump mongodb-client-encryption pinned commits to 2.8.0 release (#3683)

Compare

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs

Note: This is a default PR template raised by Snyk. Find out more about how you can customise Snyk PRs in our documentation.