Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(security): updated mongodb dependency due to vulnerabilities #10871

Merged
merged 2 commits into from
Oct 12, 2021

Conversation

winstonralph
Copy link

Thanks for submitting a pull request! Please provide enough information so that others can review your pull request. The two fields below are mandatory.

If you're making a change to documentation, do not modify a .html file directly. Instead find the corresponding .pug file or test case in the test/docs directory.

Summary
Version 3.6.11 of MongoDB is getting flagged by our security scans (White Hat) as having the following vulnerabilities:

Medium: VULNDB-210509
Medium: VULNDB-228951
Medium: VULNDB-243320
High: VULNDB-243321
Medium: VULNDB-243324
Medium: VULNDB-243343
High: VULNDB-243412
Medium: VULNDB-243413
Medium: VULNDB-250889
Medium: VULNDB-262684

Examples

Only involves MongoDB version change. We have tested this within our own project without issues.

Copy link
Collaborator

@vkarpov15 vkarpov15 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, except for the version bump. The only feature change in mongodb@3.7 is this one: https://github.com/mongodb/node-mongodb-native/pull/2850/files, which should be sufficiently minor to only require a patch release for Mongoose.

@vkarpov15 vkarpov15 added this to the 5.13.11 milestone Oct 12, 2021
@vkarpov15 vkarpov15 merged commit f516c7f into Automattic:5.x Oct 12, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants