[Snyk] Upgrade mongodb from 3.5.1 to 3.7.4

[gitafolabi]

Snyk has created this PR to upgrade mongodb from 3.5.1 to 3.7.4.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

• The recommended version is 29 versions ahead of your current version.

• The recommended version was released on a year ago.

Issues fixed by the recommended upgrade:

	Issue	Score	Exploit Maturity
	Remote Memory Exposure SNYK-JS-BL-608877	492	Proof of Concept
	Internal Property Tampering SNYK-JS-BSON-561052	492	No Known Exploit
	Internal Property Tampering SNYK-JS-BSON-6056525	492	No Known Exploit

Release notes

Package name: mongodb

• 3.7.4 - 2023-06-21
  

  The MongoDB Node.js team is pleased to announce version 3.7.4 of the mongodb package!

  Release Highlights

  This release fixes a bug that throws a type error when SCRAM-SHA-256 is used with saslprep in a webpacked environment.

  3.7.4 (2023-06-21)

  Bug Fixes

  • NODE-3711: retry txn end on retryable write (#3047) (1595140)
  • NODE-5355: prevent error when saslprep is not a function (#3733) (152425a)

  Documentation

  • Reference
  • API
  • Changelog

  We invite you to try the mongodb library immediately, and report any issues to the NODE project.

• 3.7.3 - 2021-10-20
• 3.7.2 - 2021-10-05
• 3.7.1 - 2021-09-14
• 3.7.0 - 2021-08-31
• 3.6.12 - 2021-08-30
• 3.6.11 - 2021-08-05
• 3.6.10 - 2021-07-06
• 3.6.9 - 2021-05-26
• 3.6.8 - 2021-05-21
• 3.6.7 - 2021-05-18
• 3.6.6 - 2021-04-06
• 3.6.5 - 2021-03-16
• 3.6.4 - 2021-02-02
• 3.6.3 - 2020-11-06
• 3.6.2 - 2020-09-10
• 3.6.1 - 2020-09-02
• 3.6.0 - 2020-07-30
• 3.6.0-beta.0 - 2020-04-14
• 3.5.11 - 2020-09-10
• 3.5.10 - 2020-07-30
• 3.5.9 - 2020-06-12
• 3.5.8 - 2020-05-28
• 3.5.7 - 2020-04-29
• 3.5.6 - 2020-04-14
• 3.5.5 - 2020-03-11
• 3.5.4 - 2020-02-25
• 3.5.3 - 2020-02-12
• 3.5.2 - 2020-01-20
• 3.5.1 - 2020-01-17

from mongodb GitHub release notes

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• This PR was automatically created by Snyk using the credentials of a real user.
• Max score is 1000. Note that the real score may have changed since the PR was raised.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

• 🧐 View latest project report
• 📜 Customise PR templates
• 🛠 Adjust upgrade PR settings
• 🔕 Ignore this dependency or unsubscribe from future upgrade PRs

[dryrunsecurity]

DryRun Security Summary

The pull request updates the dependencies in the api/package.json and api/package-lock.json files, with the primary change being an update to the mongodb dependency, which is crucial for interacting with MongoDB databases in the application, and the changes also include minor version bumps for other dependencies, indicating bug fixes or small improvements.

Expand for full summary

Summary:

The changes in this pull request focus on updating the dependencies in the api/package.json and api/package-lock.json files. The primary change is an update to the mongodb dependency, which is a crucial component for interacting with MongoDB databases in the application.

From an application security perspective, these dependency updates are generally positive. Keeping dependencies up-to-date is an important security practice, as it helps address known vulnerabilities and ensures the application is running on stable and secure versions of the required libraries. The version changes for the bl, bson, core-util-is, and readable-stream dependencies also indicate minor improvements or bug fixes, which can contribute to the overall security and stability of the application.

While the changes appear to be routine dependency updates, it is still recommended to review the release notes or changelogs for the updated dependencies to ensure there are no security-related changes that could impact the application. Additionally, maintaining a regular dependency review and update process can help mitigate potential security risks in the long run.

Files Changed:

1. api/package.json: The version of the mongodb dependency has been updated from ^3.5.1 to ^3.7.4. This is a significant version bump that likely includes new features, improvements, and bug fixes, including potential security-related changes.

2. api/package-lock.json: The package-lock.json file has been updated to reflect the changes in the package.json file, including updates to the bl, bson, core-util-is, mongodb, and readable-stream dependencies. These updates are generally minor version bumps, indicating bug fixes or small improvements.

Code Analysis

We ran 9 analyzers against 2 files and 1 analyzer had findings. 8 analyzers had no findings.

Analyzer	Findings
Sensitive Files Analyzer	2 findings

Riskiness

🟢 Risk threshold not exceeded.

View PR in the DryRun Dashboard.