[Snyk] Upgrade bson from 4.6.5 to 4.7.0 #2222

admin-token-bot · 2022-10-14T15:39:49Z

Snyk has created this PR to upgrade bson from 4.6.5 to 4.7.0.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

The recommended version is 1 version ahead of your current version.
The recommended version was released 2 months ago, on 2022-08-18.

The recommended version fixes:

Severity	Issue	PriorityScore (*)	Exploit Maturity
	Prototype Pollution SNYK-JS-UNSETVALUE-2400660	375/1000 Why? CVSS 7.5	No Known Exploit
	Denial of Service (DoS) SNYK-JS-NWSAPI-2841516	375/1000 Why? CVSS 7.5	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Release notes

Package name: bson

4.7.0 - 2022-08-18
The MongoDB Node.js team is pleased to announce version 4.7.0 of the bson package!

Release Highlights

This release adds automatic UUID support. Now when serializing or deserializing BSON you can work directly with the UUID type without explicit conversion methods. The UUID class is now a subclass of binary so all existing code will continue to work (including the explicit conversion methods .toUUID/.toBinary). The same automatic support for UUID is also present in EJSON .parse/.stringify.

Take a look at the following for the expected behavior:
```
const document = BSON.deserialize(bytes)
// { uuid: UUID('xxx') }
BSON.serialize(document)
// Buffer < document with uuid (binary subtype 4) >
```
Special thanks to @ aditi-khare-mongoDB for all her hard work on this feature!! 🎉

Features
- NODE-4405: support serializing UUID class (#508) (f5dc9ed)
- NODE-4419: UUID class deserialization (#509) (ff2b975)
- NODE-4506: Make UUID a subclass of binary (#512) (e9afa9d)
- NODE-4535: automatically promote UUIDs when deserializing and parsing UUIDs (#513) (1dc7eae)
Documentation
- API: https://github.com/mongodb/js-bson#readme
- Changelog: https://github.com/mongodb/js-bson/blob/main/HISTORY.md#change-log
We invite you to try the bson library immediately, and report any issues to the NODE project.
4.6.5 - 2022-07-07
The MongoDB Node.js team is pleased to announce version 4.6.5 of the bson package!

Release Highlights

Along with some other bug fixes listed below in this release we've fixed the float parser logic for both deserialize and serialize to use JS Dataview APIs. The most delightful part of this change is an improvement to performance of serializing 64-bit floats. 🎉 🐎

NODE-3630: remove float parser and test edge cases for Double (#502) (54ca603)
NODE-4211: Do not require crypto in browser builds (#500) (b32ab40)
NODE-4302: remove downlevel ts and typesVersions (#501) (651b60e)
NODE-4381: handle __proto__ well in EJSON (#506) (4bda57d)