[Snyk(Unlimited)] Upgrade mongodb from 3.6.3 to 3.7.4

[snyk-matt]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to upgrade mongodb from 3.6.3 to 3.7.4.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

• The recommended version is 14 versions ahead of your current version.
• The recommended version was released 9 months ago, on 2023-06-21.

The recommended version fixes:

Severity	Issue	PriorityScore (*)	Exploit Maturity
	Improper Input Validation SNYK-JS-FOLLOWREDIRECTS-6141137	472/1000 Why? Proof of Concept exploit, CVSS 7.3	Proof of Concept
	Prototype Pollution SNYK-JS-JSONSCHEMA-1920922	472/1000 Why? Proof of Concept exploit, CVSS 7.3	No Known Exploit
	Denial of Service (DoS) SNYK-JS-DECODEURICOMPONENT-3149970	472/1000 Why? Proof of Concept exploit, CVSS 7.3	Proof of Concept
	Denial of Service (DoS) SNYK-JS-DICER-2311764	472/1000 Why? Proof of Concept exploit, CVSS 7.3	Mature
	Prototype Pollution SNYK-JS-HANDLEBARS-534988	472/1000 Why? Proof of Concept exploit, CVSS 7.3	No Known Exploit
	Remote Code Execution (RCE) SNYK-JS-HANDLEBARS-1056767	472/1000 Why? Proof of Concept exploit, CVSS 7.3	Proof of Concept
	Prototype Pollution SNYK-JS-HANDLEBARS-173692	472/1000 Why? Proof of Concept exploit, CVSS 7.3	No Known Exploit
	Prototype Pollution SNYK-JS-HANDLEBARS-174183	472/1000 Why? Proof of Concept exploit, CVSS 7.3	No Known Exploit
	Prototype Pollution SNYK-JS-HANDLEBARS-469063	472/1000 Why? Proof of Concept exploit, CVSS 7.3	No Known Exploit
	Denial of Service (DoS) SNYK-JS-HANDLEBARS-480388	472/1000 Why? Proof of Concept exploit, CVSS 7.3	No Known Exploit
	Arbitrary Code Execution SNYK-JS-HANDLEBARS-534478	472/1000 Why? Proof of Concept exploit, CVSS 7.3	Proof of Concept
	Prototype Pollution SNYK-JS-Y18N-1021887	472/1000 Why? Proof of Concept exploit, CVSS 7.3	Proof of Concept
	Information Exposure SNYK-JS-MONGODB-5871303	472/1000 Why? Proof of Concept exploit, CVSS 7.3	No Known Exploit
	Prototype Pollution SNYK-JS-HANDLEBARS-567742	472/1000 Why? Proof of Concept exploit, CVSS 7.3	Proof of Concept
	Regular Expression Denial of Service (ReDoS) SNYK-JS-HOSTEDGITINFO-1088355	472/1000 Why? Proof of Concept exploit, CVSS 7.3	Proof of Concept
	Regular Expression Denial of Service (ReDoS) SNYK-JS-MINIMATCH-3050818	472/1000 Why? Proof of Concept exploit, CVSS 7.3	No Known Exploit
	Information Exposure SNYK-JS-FOLLOWREDIRECTS-6444610	472/1000 Why? Proof of Concept exploit, CVSS 7.3	Proof of Concept
	Prototype Pollution SNYK-JS-HANDLEBARS-1279029	472/1000 Why? Proof of Concept exploit, CVSS 7.3	Proof of Concept
	Information Exposure SNYK-JS-FOLLOWREDIRECTS-2332181	472/1000 Why? Proof of Concept exploit, CVSS 7.3	Proof of Concept
	Regular Expression Denial of Service (ReDoS) SNYK-JS-PATHPARSE-1077067	472/1000 Why? Proof of Concept exploit, CVSS 7.3	Proof of Concept
	Regular Expression Denial of Service (ReDoS) SNYK-JS-UGLIFYJS-1727251	472/1000 Why? Proof of Concept exploit, CVSS 7.3	No Known Exploit
	Arbitrary Code Injection SNYK-JS-UNDERSCORE-1080984	472/1000 Why? Proof of Concept exploit, CVSS 7.3	Proof of Concept
	Information Exposure SNYK-JS-FOLLOWREDIRECTS-2396346	472/1000 Why? Proof of Concept exploit, CVSS 7.3	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Release notes

Package name: mongodb

• 3.7.4 - 2023-06-21
  

  The MongoDB Node.js team is pleased to announce version 3.7.4 of the mongodb package!

  Release Highlights

  This release fixes a bug that throws a type error when SCRAM-SHA-256 is used with saslprep in a webpacked environment.

  3.7.4 (2023-06-21)

  Bug Fixes

  • NODE-3711: retry txn end on retryable write (#3047) (1595140)
  • NODE-5355: prevent error when saslprep is not a function (#3733) (152425a)

  Documentation

  • Reference
  • API
  • Changelog

  We invite you to try the mongodb library immediately, and report any issues to the NODE project.

• 3.7.3 - 2021-10-20
• 3.7.2 - 2021-10-05
• 3.7.1 - 2021-09-14
• 3.7.0 - 2021-08-31
• 3.6.12 - 2021-08-30
• 3.6.11 - 2021-08-05
• 3.6.10 - 2021-07-06
• 3.6.9 - 2021-05-26
• 3.6.8 - 2021-05-21
• 3.6.7 - 2021-05-18
• 3.6.6 - 2021-04-06
• 3.6.5 - 2021-03-16
• 3.6.4 - 2021-02-02
• 3.6.3 - 2020-11-06

from mongodb GitHub release notes

Commit messages

Package name: mongodb

• c2b6da1 chore(release): 3.7.4
• 152425a fix(NODE-5355): prevent error when saslprep is not a function ([Snyk(Unlimited)] Upgrade humanize-ms from 1.0.1 to 1.2.1 #3733)
• 1595140 fix(NODE-3711): retry txn end on retryable write ([Snyk(Unlimited)] Upgrade mongodb from 3.6.3 to 3.6.6 #3047)
• 9b980c4 chore(NODE-3736): fix drivers tools cloning ([Snyk(Unlimited)] Upgrade errorhandler from 1.2.0 to 1.5.1 #3025)
• b42e8b3 chore(release): 3.7.3
• 428e6d3 fix(NODE-3515): do proper opTime merging in bulk results ([Snyk(Unlimited)] Upgrade express-fileupload from 0.0.5 to 0.4.0 #3011)
• 564b0d7 test(NODE-3606): legacy and new versions of the CSFLE library ([Snyk(Unlimited)] Upgrade body-parser from 1.9.0 to 1.19.0 #3002)
• 7c5a7bb chore(release): 3.7.2
• ec23d63 chore(NODE-3622): bump optional-require for additional yarn berry pnp support ([Snyk(Unlimited)] Upgrade errorhandler from 1.2.0 to 1.5.1 #2989)
• 28f721d chore(release): 3.7.1
• 910c564 feat(NODE-3424): use hello for monitoring commands ([Snyk(Unlimited)] Upgrade consolidate from 0.14.5 to 0.16.0 #2964)
• 44df7d7 chore(release): 3.7.0
• 1a76618 fix: versioned api low node compat fix ([Snyk(Unlimited)] Upgrade errorhandler from 1.2.0 to 1.5.1 #2970)
• 7602f68 docs(NODE-3406): add versioned api examples ([Snyk(Unlimited)] Upgrade npmconf from 0.0.24 to 0.2.0 #2969)
• a07aa56 test(NODE-3409): support AWS temp credentials in CSFLE tests ([Snyk(Unlimited)] Upgrade express from 4.12.4 to 4.17.1 #2968)
• eae0e05 chore(NODE-3303): deprecate md5 hash and isConnected ([Snyk(Unlimited)] Upgrade dustjs-linkedin from 2.5.0 to 2.7.5 #2960)
• 77ab63e test(NODE-3387): correctly extract findOneX values in unified operations ([Snyk(Unlimited)] Upgrade moment from 2.15.1 to 2.29.1 #2966)
• 96c8ab4 fix(NODE-3377): driver should allow arbitrary explain levels ([Snyk(Unlimited)] Upgrade express-fileupload from 0.0.5 to 0.4.0 #2961)
• 4c25984 chore: sync 3.6 changes to 3.7 ([Snyk(Unlimited)] Upgrade cookie-parser from 1.3.3 to 1.4.5 #2963)
• e5975af fix(NODE-3463): pass explain error through to callback ([Snyk(Unlimited)] Upgrade mongodb from 3.6.3 to 3.6.6 #2949)
• 238a4b0 fix(NODE-3290): versioned api validation and tests ([Snyk(Unlimited)] Upgrade express from 4.12.4 to 4.17.1 #2869)
• 91a2fc9 Merge remote-tracking branch 'origin/3.6' into 3.7
• 6ee945e chore(NODE-3316): add author info and update bug url in package.json ([Snyk(Unlimited)] Upgrade express from 4.12.4 to 4.17.1 #2887)
• ecc930b test(NODE-3381): command monitoring redaction tests ([Snyk(Unlimited)] Upgrade adm-zip from 0.4.7 to 0.5.5 #2873)

Compare

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs