[Snyk] Upgrade mongodb from 6.18.0 to 6.19.0

[Softeng310-project]

Snyk has created this PR to upgrade mongodb from 6.18.0 to 6.19.0.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

• The recommended version is 13 versions ahead of your current version.

• The recommended version was released 25 days ago.

Release notes

Package name: mongodb

• 6.19.0 - 2025-08-26
  

  6.19.0 (2025-08-26)

  The MongoDB Node.js team is pleased to announce version 6.19.0 of the mongodb package!

  Release Notes

  Experimental Support for Queryable Encryption Text Field Prefix, Suffix and Substring Queries

  Important

  Substring, prefix and suffix search are in preview and should be used for experimental workloads only. These features are unstable and their security is not guaranteed until released as Generally Available (GA). The GA version of these features may not be backwards compatible with the preview version.

  When using Queryable Encryption with both automatic encryption and explicit encryption, text fields can now be queried using prefix, suffix and substring queries. This feature requires mongodb-client-encryption@>=6.5.0.

  Allow a secureContext for Auto Encryption and Client Encryption TLS options

  This can be provided in the tlsOptions option both both objects.

  import * as tls from 'tls';
  import { ClientEncryption, MongoClient } from 'mongodb';

  const caFile = await fs.readFile(process.env.CSFLE_TLS_CA_FILE);
  const certFile = await fs.readFile(process.env.CSFLE_TLS_CLIENT_CERT_FILE);
  const secureContextOptions = {
  ca: caFile,
  key: certFile,
  cert: certFile
  };
  const options = {
  keyVaultNamespace: 'db.coll',
  kmsProviders: {
  aws: {}
  }
  },
  tlsOptions: {
  aws: {
  secureContext: tls.createSecureContext(secureContextOptions),
  }
  }
  };

  const client = this.configuration.newClient({}, { autoEncryption: { ...options, schemaMap } });
  const clientEncryption = new ClientEncryption(client, options);

  collection.findOne() and collection.find() will no longer potentially leave open cursors on the server

  The findOne command will now always set the limit option to 1 and singleBatch to true. The limit, noCursorResponse and batchSize options have also been deprecated, and the command will guarantee no more cursors can be orphaned and no killCursors command will be potentially executed.

  find will now set limit to batchSize + 1 when both options were equal, to avoid leaving cursors open.

  Clients no longer send a ping on connect

  When authentication is enabled, the MongoClient will no longer send a ping command when connecting since it is unnecessary. Instead it will check a connection out of the pool to force the initial handshake, and check it back in.

  Features

  • NODE-4179: allow secureContext in KMS TLS options (#4578) (0ea6eaa)
  • NODE-6472: findOne and find no longer keep open cursors (#4580) (be7f808)
  • NODE-7020: remove ping on connect (#4607) (3d296b7)
  • NODE-7059, NODE-7008: add support for text queries for QE string fields (#4597) (e4492f3)

  Documentation

  • Reference
  • API
  • Changelog

  We invite you to try the mongodb library immediately, and report any issues to the NODE project.

• 6.19.0-dev.20250918.sha.7c485ef7 - 2025-09-18
• 6.19.0-dev.20250917.sha.a6eca88c - 2025-09-17
• 6.19.0-dev.20250916.sha.14303bc8 - 2025-09-16
• 6.19.0-dev.20250911.sha.c6172940 - 2025-09-11
• 6.19.0-dev.20250910.sha.b813c858 - 2025-09-10
• 6.19.0-dev.20250909.sha.43c85189 - 2025-09-09
• 6.19.0-dev.20250906.sha.82d6ce6a - 2025-09-06
• 6.19.0-dev.20250903.sha.98c5d830 - 2025-09-03
• 6.19.0-dev.20250830.sha.d03a6bd9 - 2025-08-30
• 6.19.0-dev.20250829.sha.4a6447c9 - 2025-08-29
• 6.19.0-dev.20250828.sha.41034f16 - 2025-08-28
• 6.19.0-dev.20250827.sha.3c5bb1d5 - 2025-08-27
• 6.18.0 - 2025-07-22
  

  6.18.0 (2025-07-22)

  The MongoDB Node.js team is pleased to announce version 6.18.0 of the mongodb package!

  Release Notes

  New appendMetadata API allows clients to add handshake metadata post construction

  Driver information such as name, version, and platform are allowed:

  import { MongoClient } from 'mongodb';

  const client = new MongoClient(process.env.MONGODB_URI);
  client.appendMetadata({ name: 'my library', version: '1.0', platform: 'NodeJS' });

  Cursors lazily instantiate sessions

  In previous versions, sessions were eagerly allocated whenever a cursor was created, regardless of whether or not a cursor was actually iterated (and the session was actually needed). Some driver APIs (FindCursor.count(), AggregationCursor.explain() and FindCursor.explain()) don't actually iterate the cursor they are executed on. This can lead to client sessions being created and never being cleaned up.

  With this update, sessions are not allocated until the cursor is iterated.

  Idle connections are now pruned during periods of no activity even when minPoolSize=0

  A MongoClient configured with a maxIdleTimeMS and minPoolSize of 0 is advantageous for workloads that have sustained periods of little or no activity because it allows the connection pool to close connections that are unused during these periods of inactivity. However, due to a bug in the ConnectionPool implementation, idle / perished connections were not cleaned up unless minPoolSize was non-zero.

  With the changes in this PR, the ConnectionPool now always cleans up idle connections, regardless of minPoolSize.

  ChangeStream event interfaces include a wallTime property

  This property is available on all types with the exception of reshard collection and refine collection shard key events. Thanks to @ qhello for bringing this bug to our attention!

  CommandSucceededEvent and CommandFailedEvent events now have a databaseName property

  CommandSucceededEvent and CommandFailedEvent now include the name of the database against which the command was executed.

  Deprecations

  Transaction state getters are deprecated

  These were for internal use only and include:

  Transaction#options
  Transaction#recoveryToken
  Transaction#isPinned
  Transaction#isStarting
  Transaction#isActive
  Transaction#isCommitted

  ClientMetadata, ClientMetadataOptions, and CancellationToken have been deprecated

  These types will be removed in an upcoming major version of the driver.

  CommandOptions.noResponse is deprecated

  Caution

  noResponse is not intended for use outside of MongoClient.close(). Do not use this option.

  The Node driver has historically supported an option, noResponse, that is used internally when a MongoClient is closed. This option was accidentally public. This option will be removed in an upcoming major release.

  Features

  • NODE-5055: Add databaseName property to command monitoring events (#4586) (3faf0c9)
  • NODE-7009: add client metadata on demand (#4574) (b9636ee)
  • NODE-7053: deprecate noResponse option (#4589) (1115319)
  • NODE-6865: deprecate transaction getters (#4567) (da46aea)
  • NODE-6991: deprecate unintentionally public client metadata types (#4566) (ca6554b)

  Bug Fixes

  • NODE-4845: allocate sessions lazily in cursors (#4575) (5761703)
  • NODE-6589: background task does not prune idle connections when minPoolSize=0 (#4569) (7cbb641)
  • NODE-6955: add missing wallTime property TS change stream event interfaces (#4541) (f153c6f)

  Documentation

  • Reference
  • API
  • Changelog

  We invite you to try the mongodb library immediately, and report any issues to the NODE project.

from mongodb GitHub release notes

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

• 🧐 View latest project report
• 📜 Customise PR templates
• 🛠 Adjust upgrade PR settings
• 🔕 Ignore this dependency or unsubscribe from future upgrade PRs

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud