Repository navigation
refactor: Replace deprecated mongodb-runner with @mongodb-js/mongodb-runner 8.4.3 - #631
Conversation
|
🚀 Thanks for opening this pull request! We appreciate your effort in improving the project. Please let us know once your pull request is ready for review. Tip
Note Please respond to review comments from AI agents just like you would to comments from a human reviewer. Let the reviewer resolve their own comments, unless they have reviewed and accepted your commit, or agreed with your explanation for why the feedback was incorrect. Caution Pull requests must be written using an AI agent with human supervision. Pull requests written entirely by a human will likely be rejected, because of lower code quality, higher review effort and the higher risk of introducing bugs. Please note that AI review comments on this pull request alone do not satisfy this requirement. Our CI and AI review are safeguards, not development tools. If many issues are flagged, rethink your development approach. Invest more effort in planning and design rather than using review cycles to fix low-quality code. |
|
No actionable comments were generated in the recent review.
 |
| Layer / File(s) | Summary |
|---|---|
MongoDB runner dependency update package.json, package-lock.json |
The development dependency changes from mongodb-runner 6.7.3 to @mongodb-js/mongodb-runner 8.4.3. The lockfile updates the MongoDB runner tooling records. |
Related lockfile dependency updates package-lock.json |
The lockfile adds, removes, and updates transitive packages, including file-type, decompression, tokenizer, stream, and ASN.1 packages. |
CI Node.js matrix version .github/workflows/ci.yml |
The Parse Server 8 / Node.js 20 matrix entry changes from Node.js 20.18.0 to 20.19.0. |
Priority:
Estimated code review effort: 2 (Simple) | ~15 minutes
Merge Risk: 
d1ec7
-
The dependency and CI updates appear ready to merge after normal checks.
Pre-merge checks: 
-
Check name Status Explanation Description Check Check skipped - CodeRabbit’s high-level summary is enabled. Title check The title begins with the allowed refactor:prefix. It clearly describes replacingmongodb-runnerwith@mongodb-js/mongodb-runner8.4.3, and the first word after the prefix is capitalized.Linked Issues check Check skipped because no linked issues were found for this pull request. Out of Scope Changes check Check skipped because no linked issues were found for this pull request. Security Check No security vulnerability is introduced by the pull request. The diff changes only development dependencies, the lockfile, and one CI Node.js version. All 106 changed lockfile package entries are deve… Engage In Review Feedback No review feedback comments were returned, and the current review produced zero actionable findings. Therefore, there is no feedback that the contributor ignored or resolved without prior engagement. Full details: Security Check
-
Explanation
No security vulnerability is introduced by the pull request. The diff changes only development dependencies, the lockfile, and one CI Node.js version. All 106 changed lockfile package entries are development-only. The old
decompresspackage and its four archive-extraction advisories are removed. A directnpm audit --package-lock-onlycomparison reports 25 to 22 findings and 1 to 0 critical findings, with no new advisory in the updated dependency tree.
-
Finishing Touches
-
🧪 Generate unit tests (beta)
-
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Comment @coderabbitai help to get the list of available commands.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #631 +/- ##
=======================================
Coverage 97.77% 97.77%
=======================================
Files 2 2
Lines 225 225
=======================================
Hits 220 220
Misses 5 5 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Replaces the deprecated devDependency
mongodb-runner6.7.3 with its maintained successor@mongodb-js/mongodb-runner8.4.3 (exact pin). The old package is deprecated on npm with "This package is not maintained anymore. Please use @mongodb-js/mongodb-runner instead".Security
mongodb-runner6.7.3 pulls indecompress4.2.1 via@mongodb-js/mongodb-downloader1.1.9. There is no patcheddecompressrelease. This change resolves these Dependabot alerts (dev-only, no production impact):@mongodb-js/mongodb-runner8.4.3 uses@mongodb-js/mongodb-downloader3.0.5, which replaceddecompresswith the maintained@xhmikosr/decompress(fix(mongodb-downloader): replace decompress with maintained @xhmikosr/decompress mongodb-js/devtools-shared#927).@xhmikosr/decompress11.1.4. GHSA-mp2f-45pm-3cg9 (alert 363) is fixed since@xhmikosr/decompress11.1.3 and GHSA-hrh2-vp3x-79xf (alert 406) since 11.1.4, so 11.1.4 is the first version that fixes both. Nodecompressentry remains in the lock file.npm audit: 25 → 22 findings, critical 1 → 0, no new findings..zip, the Windows MongoDB builds). On Linux and macOS, including CI, the MongoDB.tgzarchive is extracted withtarin both the old and new version, so the vulnerable extraction code was not reached in CI.Changes
Dependency swap (
package.json,package-lock.json)mongodb-runnerbin, so thetest:mongodb:runnerstartandtest:mongodb:runnerstopscripts are unchanged:-tis still the alias of--topology, andstop --allis unchanged.--are still passed tomongod;--port 27017replaces the default--port 0.*, the latest stable release) resolves the same way. The URL resolver was renamed frommongodb-download-urlto@mongodb-js/mongodb-artifact-url(chore: rename mongodb-build-info, mongodb-ns, mongodb-redact and mongodb-download-url (to mongodb-artifact-url) to @mongodb-js scope COMPASS-11197 mongodb-js/devtools-shared#932). Its only logic changes concernlatest-alphabuilds and Linux arm64 detection.mongodbdriver is unchanged (7.1.0). The runner gets its own nestedmongodb7.5.0.@aws-sdk/client-s3dependency is satisfied by the existing@aws-sdk/client-s33.1151.0, which is unchanged.@mongodb-js/saslprep1.4.6 → 1.6.1: no runtime code change (type declaration and package metadata only).mongodb-connection-string-url7.0.1 → 7.0.2: error messages no longer include the connection string, and connection strings with an@after the host list are rejected. The test connection stringmongodb://127.0.0.1:27017/s3-adapteris unaffected.graceful-fs4.2.6 → 4.2.11: EMFILE/ENFILE retry queue with backoff and a 60 s timeout, guards for missingfsfunctions, Windows rename retry onEBUSY.get-east-asian-width1.4.0 → 1.7.0: internal function rename with a compatibility alias, lookup data moved to a separate file.CI (
.github/workflows/ci.yml)Parse Server 8, Node.js 20job moves from Node.js 20.18.0 to 20.19.0. This is functionally required:yargs18, which is ESM-only ("type": "module", exports onlyindex.mjs). The runner's CommonJS CLI loads it withrequire("yargs").@mongodb-js/mongodb-downloader3.0.5 loads the ESM-only@xhmikosr/decompress11.1.4 ("type": "module", no CommonJS export, engines>=20) with a top-levelrequire()indist/index.js. The runner loads the downloader when the CLI starts, so this applies on every platform, not only when a.ziparchive is extracted.require(esm), which Node.js enables by default only from 20.19.0 and 22.12.0. On 20.18.0,mongodb-runner startinpretestwould fail withERR_REQUIRE_ESM.mongodb7.5.0 dependency also requires Node.js >= 20.19.0.npm ciandnpm run lintand does not execute the runner. The release workflow uses Node.js 24.engines.nodeinpackage.jsonis unchanged. The runner is a devDependency and does not affect consumers.mongodb-runner6.7.3 →@mongodb-js/mongodb-runner8.4.3 (mongodb-js/devtools-shared,packages/mongodb-runner)--portflag on secondaries (fix(mongodb-runner): don't leave a dangling --port flag on secondaries mongodb-js/devtools-shared#821)@mongodb-js/mongodb-runner(chore(mongodb-runner): add @mongodb-js namespace to the package name mongodb-js/devtools-shared#871)--authspawned servers (fix(mongodb-runner): only tolerate unauthorized metadata writes for --auth spawned servers MONGOSH-3619 mongodb-js/devtools-shared#917)--jsonoutput forstartandls(feat(mongodb-runner): add --json output to start and ls mongodb-js/devtools-shared#923)--slsDir(feat(mongodb-runner): locate the DSC directory with --slsDir mongodb-js/devtools-shared#913)mongodattached to the parent process (chore: add option to spawn mongod attached to parent process mongodb-js/devtools-shared#773)yargs17 → 18 (chore(deps): bump yargs from 17.7.2 to 18.0.0 mongodb-js/devtools-shared#644)@peculiar/x5091 → 2 (chore(deps): bump @peculiar/x509 from 1.14.2 to 2.0.0 mongodb-js/devtools-shared#669)mongodb^6.9.0 || ^7.0.0→~7.5.0:^7.2.0(chore(deps): bump mongodb from 7.1.0 to 7.2.0 mongodb-js/devtools-shared#715), superseded by^7.5.0(chore: bump mongodb and bson dependencies mongodb-js/devtools-shared#829) and^7.6.0(chore(deps): bump the npm-production-minor-patch group across 1 directory with 23 updates mongodb-js/devtools-shared#896), then back to^7.5.0for MongoDB 4.2 compatibility (chore(dependencies): revert bson/mongodb upgrades because they break compatibility with MongoDB 4.2 mongodb-js/devtools-shared#907) and~7.5.0(Revert "feat(mongodb-runner): remove support for 4.2 servers" mongodb-js/devtools-shared#919)yargs^18.2.0,@peculiar/x509^2.1.0,mongodb^7.6.0 andmongodb-connection-string-url^7.0.2@mongodb-js/mongodb-downloader^1.1.9 → ^3.0.5s3://download URLs (feat(mongodb-downloader): handle s3:// download URLs MONGOSH-3622 mongodb-js/devtools-shared#900).Breaking Changes
None
Code Changes Required
None in source code or test scripts. CI: the Node.js version of the
Parse Server 8, Node.js 20job is raised to 20.19.0, as described above.Verification
npm ci --ignore-scriptssucceeds with the new lock file.npx mongodb-runner --helpworks (Node.js 22.19.0).start -t standalone -- --port 27017andstop --allverified with the installedyargs18.2.0.Summary by CodeRabbit