[mtrezza]

Replaces the deprecated development dependency mongodb-runner 6.7.3 with its successor @mongodb-js/mongodb-runner 8.4.3 (exact pin, latest release). The browser-control module loads the runner by package name, so it is updated as well.

mongodb-runner is deprecated on npm ("This package is not maintained anymore. Please use @mongodb-js/mongodb-runner instead"). It installs decompress 4.2.1 through @mongodb-js/mongodb-downloader 1.1.9, and decompress has no patched release. @mongodb-js/mongodb-runner 8.4.3 uses @mongodb-js/mongodb-downloader 3.0.5, which replaced decompress with the maintained fork @xhmikosr/decompress in 3.0.3 (mongodb-js/devtools-shared#927). No copy of decompress remains in the lock file.

Security

This resolves the following Dependabot alerts. They all concern a development dependency, so the published package and the Docker image are not affected.

Alert	Severity	Advisory	Resolution
464	Critical	GHSA-hrh2-vp3x-79xf: path traversal via symlink chain	decompress removed; @xhmikosr/decompress 11.1.4 is the first patched 11.x release
389	Critical	GHSA-mp2f-45pm-3cg9: extraction can create files and links outside the target directory	decompress removed; @xhmikosr/decompress 11.1.4 is newer than the first patched 11.x release 11.1.3
435	Medium	GHSA-jwp9-9v96-94mx: arbitrary hardlink creation during extraction	decompress removed
411	Medium	GHSA-h39j-r5qq-r9mm: arbitrary file write via extraction (Zip Slip)	decompress removed

• @xhmikosr/decompress 11.1.4 is the first 11.x version that fixes both GHSA-mp2f-45pm-3cg9 (fixed since 11.1.3) and GHSA-hrh2-vp3x-79xf (fixed since 11.1.4). In the 10.x line, 10.2.2 fixes both.
• No other Dependabot alert, in any state, covers a version that this PR adds, removes or changes.
• npm audit: 34 → 31 findings (critical 1 → 0, moderate 12 → 10, high unchanged at 21). The removed findings are decompress, @mongodb-js/mongodb-downloader and mongodb-runner. There are no new findings.
• Both downloader versions extract .tgz archives with tar and use the decompress library only for other formats, such as the Windows .zip builds. On Linux and macOS, the vulnerable extraction code is not reached.

Changes

Browser control (Parse-Dashboard/browser-control/setup.js, README.md)

Browser control (npm run browser-control) is a development-only feature that cannot be enabled with NODE_ENV=production. When enabled, it starts MongoDB through the runner's programmatic API, not its CLI. No npm script, workflow or test uses mongodb-runner.

• require('mongodb-runner') becomes require('@mongodb-js/mongodb-runner'). Without this change, browser control would be disabled silently: Parse-Dashboard/server.js ignores MODULE_NOT_FOUND errors from the browser-control setup, because it treats them as a production build without the module.
• The README names the new package.
• The call MongoCluster.start({ topology: 'standalone', version, tmpDir, args: ['--port', port] }), the connectionString getter and close() work the same for a standalone server in 8.4.3. Two differences apply to this call:
  • If the environment variable MONGODB_RUNNER_DOWNLOAD_DIR is set, MongoDB is downloaded there instead of to tmpDir (feat(mongodb-runner): add download dir as env, cache mongodb download on windows ci COMPASS-10932 mongodb-js/devtools-shared#856).
  • If the start fails, the runner now closes the partially started cluster before it rethrows the error (fix(mongodb-runner): tolerate unauthorized metadata bookkeeping and clean up on failed start MONGOSH-3619 mongodb-js/devtools-shared#909).
• Parse-Dashboard/ is part of the published npm package, but the runner is a development dependency and is not installed for consumers. Anyone who installed mongodb-runner separately to use browser control from the npm package needs @mongodb-js/mongodb-runner instead.

Lock file

All 126 changed entries are development-only (dev: true), not counting the root package entry, whose devDependencies change. Each one is in the dependency tree of the removed or the added runner, and each version change is required by a range in the new tree. No production entry changes, so the Docker image is unchanged: its release stage copies only the npm ci --omit=dev --ignore-scripts install. No added or updated entry has an install script.

• Removed:
  • mongodb-runner 6.7.3
  • decompress 4.2.1, with decompress-tar, decompress-tarbz2, decompress-targz, decompress-unzip and their helpers
  • mongodb-download-url 1.8.8
• Added:
  • @mongodb-js/mongodb-runner 8.4.3, with its own yargs 18.2.0 tree and its own mongodb 7.5.0
  • @xhmikosr/decompress 11.1.4 and its plugins
  • @mongodb-js/mongodb-artifact-url 2.0.4
  • @aws-sdk/client-s3 3.1158.0 and its @aws-sdk/* and @smithy/* dependencies, which the 3.x downloader uses for s3:// URLs
  • a nested yargs 18.2.0 tree for @mongodb-js/oidc-mock-provider
• Updated:
  • @mongodb-js/mongodb-downloader 1.1.9 → 3.0.5
  • @mongodb-js/oidc-mock-provider 0.13.7 → 0.13.20
  • @peculiar/x509 1.14.3 → 2.2.0, the @peculiar/asn1-* packages 2.6.0 → 2.11.1, asn1js 3.0.7 → 3.1.0, pvutils 1.1.5 → 1.2.0
  • file-type 5.2.0 → 21.3.4, seek-bzip 1.0.6 → 2.0.0 (its commander 2.20.3 → 6.2.1), strip-dirs 2.1.0 → 3.0.0
• Shared with other development dependencies, updated within the ranges those packages declare:
  • @mongodb-js/saslprep 1.4.6 → 1.6.1: no runtime code change (type declaration and package metadata only). Also used by Parse Server's mongodb driver (^1.3.0).
  • mongodb-connection-string-url 7.0.1 → 7.0.2: error messages no longer include the connection string, and connection strings with an @ after the host list are rejected. Also used by Parse Server's mongodb driver (^7.0.0). The connection string that browser control passes to Parse Server (mongodb://127.0.0.1:<port>/) is unaffected.
  • get-east-asian-width 1.4.0 → 1.7.0: internal function rename with a compatibility alias, lookup data moved to a separate file. Also used by the string-width of semantic-release (^1.0.0).
• Unchanged: Parse Server's mongodb driver 7.1.0 (hoisted), and tar 7.5.22, which already meets the 3.x downloader's ^7.5.22.

Node.js versions

• The new runner's dependencies require ^20.19.0 || ^22.12.0 || >=23 (yargs 18.2.0, yargs-parser 22.0.0) and >=20.19.0 (mongodb 7.5.0).
• Loading the runner relies on require(esm), which Node.js enables by default from 20.19.0 and 22.12.0. @mongodb-js/mongodb-downloader 3.0.5 loads the ESM-only @xhmikosr/decompress 11.1.4 ("type": "module", exports only ./index.js) with a top-level require() in dist/index.js, so this applies to every require('@mongodb-js/mongodb-runner'). The runner's CLI also loads the ESM-only yargs 18; browser control does not use the CLI.
• engines.node (>=20.19.0 <21.0.0 || >=22.12.0 <23.0.0 || >=24.1.0 <25.0.0) already satisfies these. Every workflow that installs dependencies runs on a compatible version:
  • the CI test matrix on Node.js 20.19.0, 22.12.0 and 24.1.0
  • the lint, circular dependency and Node engine checks on Node.js 24
  • the Docker build on node:20.19.0-alpine3.20
  • the release workflow on Node.js 24, and the CI environment check on the latest Node.js 20
• No workflow changes, and engines is unchanged.

@mongodb-js/mongodb-runner (formerly mongodb-runner) 6.7.3 → 8.4.3

mongodb-js/devtools-shared publishes no release notes for this package, so these entries come from the commit history of packages/mongodb-runner. Versions not listed contain only dependency or release tooling updates.

• 6.7.5: Updates yargs from 17 to 18 (chore(deps): bump yargs from 17.7.2 to 18.0.0 mongodb-js/devtools-shared#644).
• 6.7.7: Updates @peculiar/x509 from 1 to 2 (chore(deps): bump @peculiar/x509 from 1.14.2 to 2.0.0 mongodb-js/devtools-shared#669).
• 6.7.9: Requires the mongodb driver 7.2 or later (chore(deps): bump mongodb from 7.1.0 to 7.2.0 mongodb-js/devtools-shared#715).
• 6.7.13: Adds an option to spawn mongod attached to the parent process, in the programmatic API only; the default stays detached (chore: add option to spawn mongod attached to parent process mongodb-js/devtools-shared#773).
• 6.8.1: Fixes an arbiter convergence race in the replica set metadata check (fix(mongodb-runner): handle arbiter RS convergence race in metadata check mongodb-js/devtools-shared#770).
• 6.8.3: Fixes a dangling --port flag on replica set secondaries (fix(mongodb-runner): don't leave a dangling --port flag on secondaries mongodb-js/devtools-shared#821).
• 6.8.4: Requires the mongodb driver 7.5 or later (chore: bump mongodb and bson dependencies mongodb-js/devtools-shared#829).
• 6.9.0: Adds the MONGODB_RUNNER_DOWNLOAD_DIR environment variable as a fallback download directory (feat(mongodb-runner): add download dir as env, cache mongodb download on windows ci COMPASS-10932 mongodb-js/devtools-shared#856).
• 6.10.0 – 6.11.1:
  • Adds disaggregated storage (DSC) support (feat: DSC support for mongodb runner mongodb-js/devtools-shared#822, feat(mongodb-runner) DSC support: Capture logs from containers; retry on startup mongodb-js/devtools-shared#870).
  • Removes support for MongoDB 4.2 servers (feat(mongodb-runner): remove support for 4.2 servers mongodb-js/devtools-shared#869); 8.1.3 restores it.
  • Renames the package to @mongodb-js/mongodb-runner (chore(mongodb-runner): add @mongodb-js namespace to the package name mongodb-js/devtools-shared#871).
• 7.0.0: Major version from the monorepo's release automation. A breaking change in the shared test configuration package (feat(mocha-config-devtools)!: update mocha-config-devtools to support react 18, chai 4x, and remove enzyme - COMPASS-11105 mongodb-js/devtools-shared#882) bumped @mongodb-js/mongodb-downloader to 2.0.0. The runner's CLI and API are unchanged.
• 7.0.3: Dependency group update (chore(deps): bump the npm-production-minor-patch group across 1 directory with 23 updates mongodb-js/devtools-shared#896): mongodb ^7.6.0, yargs ^18.2.0, @peculiar/x509 ^2.1.0 and mongodb-connection-string-url ^7.0.2.
• 8.0.0: Uses @mongodb-js/mongodb-downloader 3, which supports s3:// download URLs (feat(mongodb-downloader): handle s3:// download URLs MONGOSH-3622 mongodb-js/devtools-shared#900).
• 8.0.2: Reverts the mongodb driver and bson upgrades for MongoDB 4.2 compatibility (chore(dependencies): revert bson/mongodb upgrades because they break compatibility with MongoDB 4.2 mongodb-js/devtools-shared#907).
• 8.1.1 – 8.1.3:
  • Tolerates unauthorized metadata bookkeeping on servers started with --auth, and cleans up after a failed start (fix(mongodb-runner): tolerate unauthorized metadata bookkeeping and clean up on failed start MONGOSH-3619 mongodb-js/devtools-shared#909, fix(mongodb-runner): only tolerate unauthorized metadata writes for --auth spawned servers MONGOSH-3619 mongodb-js/devtools-shared#917).
  • Restores support for MongoDB 4.2 servers and pins the mongodb driver to ~7.5.0 (Revert "feat(mongodb-runner): remove support for 4.2 servers" mongodb-js/devtools-shared#919).
• 8.2.0:
  • Reserves SLS host ports to avoid compose collisions (fix(mongodb-runner): reserve SLS host ports to avoid compose collisions mongodb-js/devtools-shared#912).
  • Reads the SLS image tag from the manifest file by default (feat(mongodb-runner): get the SLS tag from the manifest file by default mongodb-js/devtools-shared#911).
• 8.3.0: Adds --json output to start and ls (feat(mongodb-runner): add --json output to start and ls mongodb-js/devtools-shared#923).
• 8.4.0: Adds --slsDir to locate the DSC directory (feat(mongodb-runner): locate the DSC directory with --slsDir mongodb-js/devtools-shared#913).
• 8.4.1: Uses @mongodb-js/mongodb-downloader 3.0.3, which replaces decompress with @xhmikosr/decompress (fix(mongodb-downloader): replace decompress with maintained @xhmikosr/decompress mongodb-js/devtools-shared#927).
• 8.4.3: Uses @mongodb-js/mongodb-downloader 3.0.5. It resolves download URLs with @mongodb-js/mongodb-artifact-url, the renamed mongodb-download-url (chore: rename mongodb-build-info, mongodb-ns, mongodb-redact and mongodb-download-url (to mongodb-artifact-url) to @mongodb-js scope COMPASS-11197 mongodb-js/devtools-shared#932).

@mongodb-js/mongodb-downloader 1.1.9 → 3.0.5

• 1.2.0: Adds an option to download from a direct URL (feat: DSC support for mongodb runner mongodb-js/devtools-shared#822).
• 2.0.0: Major version from the release automation (feat(mocha-config-devtools)!: update mocha-config-devtools to support react 18, chai 4x, and remove enzyme - COMPASS-11105 mongodb-js/devtools-shared#882). The API is unchanged.
• 3.0.0: Downloads s3:// URLs through the AWS SDK; http(s):// URLs still use node-fetch, the downloader's nested 2.7.0 copy, which is unchanged in the lock file (feat(mongodb-downloader): handle s3:// download URLs MONGOSH-3622 mongodb-js/devtools-shared#900).
• 3.0.3: Replaces decompress with @xhmikosr/decompress (fix(mongodb-downloader): replace decompress with maintained @xhmikosr/decompress mongodb-js/devtools-shared#927).
• 3.0.5: Uses @mongodb-js/mongodb-artifact-url 2, the renamed mongodb-download-url (chore: rename mongodb-build-info, mongodb-ns, mongodb-redact and mongodb-download-url (to mongodb-artifact-url) to @mongodb-js scope COMPASS-11197 mongodb-js/devtools-shared#932). The URL resolver's only logic changes concern latest-alpha builds and Linux arm64 detection. Browser control requests an explicit version (MONGO_VERSION, default 8.0.4).

Breaking Changes

None. The runner is a development dependency, and browser control works unchanged with the code change below.

Code Changes Required

• Parse-Dashboard/browser-control/setup.js: loads MongoCluster from @mongodb-js/mongodb-runner instead of mongodb-runner.
• Parse-Dashboard/browser-control/README.md: names the new package.

Testing

CI does not exercise the runner: no test or workflow starts MongoDB through it, and the Jest tests (src/lib) don't load browser control. Tested locally on macOS (arm64) with Node.js 22.19.0:

• npm ci --ignore-scripts succeeds with the new lock file, and eslint passes for setup.js.
• The real setupBrowserControl() from setup.js, with browser control enabled, a temporary directory and a free port:
  • loaded @mongodb-js/mongodb-runner 8.4.3
  • downloaded MongoDB 8.0.4 (the default MONGO_VERSION) and extracted its .tgz archive
  • started a standalone server on the requested port; waitForMongo connected on the first attempt, and a write and read through the mongodb driver succeeded
  • stopped the server through the setup's cleanup(); no mongod process remained
• Not tested: the webpack watch build and the Parse Server child process that browser control also starts (the test skipped both, as neither involves the runner), Linux and Windows, and Node.js 20 and 24.

Summary by CodeRabbit

• Chores
  • Updated the MongoDB auto-start setup to use the current MongoDB runner package.

[parse-github-assistant]

🚀 Thanks for opening this pull request! We appreciate your effort in improving the project. Please let us know once your pull request is ready for review.

Tip

• Keep pull requests small. Large PRs will be rejected. Break complex features into smaller, incremental PRs.
• Use Test Driven Development. Write failing tests before implementing functionality. Ensure tests pass.
• Group code into logical blocks. Add a short comment before each block to explain its purpose.
• We offer conceptual guidance. Coding is up to you. PRs must be merge-ready for human review.
• Our review focuses on concept, not quality. PRs with code issues will be rejected. Use an AI agent.
• Human review time is precious. Avoid review ping-pong. Inspect and test your AI-generated code.

Note

Please respond to review comments from AI agents just like you would to comments from a human reviewer. Let the reviewer resolve their own comments, unless they have reviewed and accepted your commit, or agreed with your explanation for why the feedback was incorrect.

Caution

Pull requests must be written using an AI agent with human supervision. Pull requests written entirely by a human will likely be rejected, because of lower code quality, higher review effort and the higher risk of introducing bugs. Please note that AI review comments on this pull request alone do not satisfy this requirement. Our CI and AI review are safeguards, not development tools. If many issues are flagged, rethink your development approach. Invest more effort in planning and design rather than using review cycles to fix low-quality code.

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Essentials
• Run ID: 01c89717-8b4c-4f9d-8634-bb5fe0b0bf7c

Commits

Reviewing files that changed from the base of the PR and between ffa89d2 and 23df18c.

Files selected for processing: 4

• Parse-Dashboard/browser-control/README.md
• Parse-Dashboard/browser-control/setup.js
• package-lock.json
• package.json

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 7 remain after this review.

Walkthrough

The development dependency changes from mongodb-runner 6.7.3 to @mongodb-js/mongodb-runner 8.4.3. The browser-control setup import and documentation now use the scoped package name.

Changes: MongoDB runner update

Layer / File(s)	Summary
Replace the MongoDB runner dependency package.json, package-lock.json	The development dependency changes to @mongodb-js/mongodb-runner 8.4.3. The lockfile updates the runner and downloader dependency trees and removes superseded packages.
Update browser-control references Parse-Dashboard/browser-control/setup.js, Parse-Dashboard/browser-control/README.md	The setup import and auto-start documentation now use @mongodb-js/mongodb-runner.

Priority: Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: Minimal · up to 23df1

No actionable issue was found in the runner update. The change is ready to merge after normal checks.

Pre-merge checks: 6

Check name	Status	Explanation
Title check		The title starts with the allowed refactor: prefix, uses a capitalized subject, and accurately describes the dependency replacement and related browser-control update.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Security Check		No security vulnerability is introduced by the pull request. The code change only switches the development-only browser-control import to @mongodb-js/mongodb-runner. The lockfile removes `decompress…
Engage In Review Feedback		No review feedback required engagement. The supplied review context reports no CodeRabbit review threads and zero actionable findings in the current review.
Description check		The description is detailed and covers the issue, approach, security impact, code changes, compatibility considerations, and testing. It does not use the template's exact Issue, Approach, and Tasks he…

Full details: Security Check

Explanation

No security vulnerability is introduced by the pull request. The code change only switches the development-only browser-control import to @mongodb-js/mongodb-runner. The lockfile removes decompress 4.2.1 and the old mongodb-runner/downloader chain, and adds @xhmikosr/decompress 11.1.4 with tar 7.5.22. A package-lock audit found no advisory for the new runner, downloader, decompressor, or tar packages. Comparing the reviewed base and head showed audit findings decrease from 39 to 36, with critical findings decreasing from 1 to 0. The remaining findings concern pre-existing dependency paths.

Full details: Description check

Explanation

The description is detailed and covers the issue, approach, security impact, code changes, compatibility considerations, and testing. It does not use the template's exact Issue, Approach, and Tasks headings or task checkboxes, but the required information is present and the omission is non-critical.

Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}