refactor: Bump mongodb-runner from 5.9.3 to 6.8.3#10591
Conversation
|
🚀 Thanks for opening this pull request! We appreciate your effort in improving the project. Please let us know once your pull request is ready for review. Tip
Note Please respond to review comments from AI agents just like you would to comments from a human reviewer. Let the reviewer resolve their own comments, unless they have reviewed and accepted your commit, or agreed with your explanation for why the feedback was incorrect. Caution Pull requests must be written using an AI agent with human supervision. Pull requests written entirely by a human will likely be rejected, because of lower code quality, higher review effort and the higher risk of introducing bugs. Please note that AI review comments on this pull request alone do not satisfy this requirement. Our CI and AI review are safeguards, not development tools. If many issues are flagged, rethink your development approach. Invest more effort in planning and design rather than using review cycles to fix low-quality code. |
📝 WalkthroughWalkthroughChangesThe development dependency MongoDB runner upgrade
Estimated code review effort: 2 (Simple) | ~10 minutes Important Pre-merge checks failedPlease resolve all errors before merging. Addressing warnings is optional. ❌ Failed checks (1 inconclusive)
✅ Passed checks (6 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@package-lock.json`:
- Around line 3456-3459: Update the dependency resolution for
`@mongodb-js/mongodb-downloader` so it no longer requires or resolves
decompress@4.2.1. Replace the downloader with a release that removes this
dependency, or use a patched alternative, then regenerate package-lock.json and
verify both decompress entries are absent.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: d5eec4dd-09d2-4d9f-b803-bbc7ebdb73fa
📒 Files selected for processing (2)
package-lock.jsonpackage.json
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## alpha #10591 +/- ##
=======================================
Coverage 92.69% 92.69%
=======================================
Files 193 193
Lines 17027 17027
Branches 248 248
=======================================
Hits 15784 15784
Misses 1222 1222
Partials 21 21 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
998706b to
858447f
Compare
There was a problem hiding this comment.
♻️ Duplicate comments (1)
package-lock.json (1)
3515-3518:⚠️ Potential issue | 🔴 CriticalThe previously reported
decompress@4.2.1vulnerability is still present.Both lockfile representations still resolve
decompress:^4.2.1, which can extract archive entries outside the target directory. Updatemongodb-runner/its downloader to a release without this dependency, or use a verified patched alternative, then regenerate the lockfile and confirm both entries are gone.Also applies to: 29613-29616
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@package-lock.json` around lines 3515 - 3518, Remove the vulnerable decompress@4.2.1 resolution from both lockfile representations by updating mongodb-runner or its downloader to a release using a verified patched alternative, then regenerate the lockfile and confirm neither decompress:^4.2.1 entry remains.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Duplicate comments:
In `@package-lock.json`:
- Around line 3515-3518: Remove the vulnerable decompress@4.2.1 resolution from
both lockfile representations by updating mongodb-runner or its downloader to a
release using a verified patched alternative, then regenerate the lockfile and
confirm neither decompress:^4.2.1 entry remains.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 0e12646b-1b5f-4610-ae43-5f0234fb14be
📒 Files selected for processing (2)
package-lock.jsonpackage.json
🚧 Files skipped from review as they are similar to previous changes (1)
- package.json
1 participant
Closes #10586
Bumps the
mongodb-runnerdevDependency (test tooling) from5.9.3to6.8.3. This is a MAJOR upgrade (5.x → 6.x).mongodb-runneris used only in thetest,coverage:mongodb, andbenchmarknpm scripts to spin up a MongoDB server for the test suite (mongodb-runner exec -t <topology> --version <version> -- --port 27017 -- <cmd>); it is not shipped to consumers.Changes
feat(mongodb-downloader)!: use a lockfile to prevent redundant parallel downloads). The breaking change is internal to the binary downloader (addsproper-lockfileto coordinate concurrent MongoDB binary downloads); it does not change themongodb-runnerCLI.mongodb@^6tomongodb@^7.2.0(used only internally to check server readiness),yargsbumped to^18, and OIDC mock-provider / x509 helper dependencies added (@peculiar/x509,reflect-metadata,@mongodb-js/oidc-mock-provider). Includesfix(mongodb-runner): don't leave a dangling --port flag on secondaries(fix(mongodb-runner): don't leave a dangling --port flag on secondaries mongodb-js/devtools-shared#821), improving replica-set--porthandling.The
execsubcommand and the-t/--topology,--version,--port, and--passthrough options that our npm scripts rely on are all unchanged in6.8.3(verified against the6.8.3CLI source and by running the installed binary).Breaking Changes
None affecting this repository. The upstream major-version breaking change is confined to
mongodb-downloader's internal download coordination and does not alter the CLI interface, the required Node.js version, or the MongoDB server versions our tests use (7.0.16 / 8.0.4 / 8.3.4). The tightest Node.js requirement introduced (mongodb@7andyargs@18:>=20.19.0) is satisfied by every Node version in the CI matrix (20.19.0, 22.12.0, 24.11.0) and matches the declaredengines.nodeminimum;engines.nodeis unchanged.lockfileVersionremains2.Code Changes Required
None — drop-in replacement. Only
package.json(devDependency version) andpackage-lock.jsonchanged.npm ciinstalls cleanly and themongodb-runnerCLI resolves theexeccommand as before.Summary by CodeRabbit