[mtrezza]

Replaces the deprecated development dependency mongodb-runner 6.8.3 with its successor @mongodb-js/mongodb-runner 8.4.3 (exact pin, latest release). The test scripts, the workflows and engines are unchanged.

mongodb-runner is deprecated on npm ("This package is not maintained anymore. Please use @mongodb-js/mongodb-runner instead"). It installs decompress 4.2.1 through @mongodb-js/mongodb-downloader 1.1.16, and decompress has no patched release. @mongodb-js/mongodb-runner 8.4.3 uses @mongodb-js/mongodb-downloader 3.0.5, which replaced decompress with the maintained fork @xhmikosr/decompress. No copy of decompress remains in the lock file.

Security

This resolves the following Dependabot alerts. They all concern a development dependency.

Alert	Severity	Advisory	Resolution
444	Critical	GHSA-hrh2-vp3x-79xf: path traversal via symlink chain	decompress removed; @xhmikosr/decompress 11.1.4 is the first patched 11.x release
405	Critical	GHSA-mp2f-45pm-3cg9: extraction can create files and links outside the target directory	decompress removed; @xhmikosr/decompress 11.1.4 is newer than the first patched 11.x release 11.1.3
431	Medium	GHSA-jwp9-9v96-94mx: arbitrary hardlink creation during extraction	decompress removed
415	Medium	GHSA-h39j-r5qq-r9mm: arbitrary file write via extraction (Zip Slip)	decompress removed

• The new downloader also takes tar from 7.5.20 to 7.5.22, which is outside the range of the auto-dismissed alert 414 (GHSA-r292-9mhp-454m, tar <= 7.5.20).
• No other Dependabot alert, in any state, covers a version that this PR adds, removes or changes.
• npm audit: 24 → 20 findings (critical 1 → 0, high 11 → 10, moderate 12 → 10). The removed findings are decompress, tar, @mongodb-js/mongodb-downloader and mongodb-runner. There are no new findings.
• Both downloader versions extract the .tgz archives for Linux and macOS with tar, and use the decompress library only for other formats, such as the Windows .zip builds. The vulnerable extraction code was therefore not reached in CI.

Production and Docker impact

One production lock entry changes, without any code change:

• @mongodb-js/saslprep 1.4.12 → 1.6.1. Parse Server's own mongodb driver 7.1.0 (^1.3.0) uses this hoisted copy, and the new runner requires ^1.6.1, so npm keeps a single copy at 1.6.1. The published dist files of 1.4.12 and 1.6.1 are byte-identical; only package.json metadata differs (version, repository URL format, development dependencies). Every deployment that installs from the lock file gets 1.6.1.
• end-of-stream stays at 1.4.4. Its only development dependent, tar-stream 1.6.2, is gone, so its lock flag changes from devOptional to optional. It is still an optional dependency of duplexify and is still installed with --omit=dev, so what gets installed does not change.

No other production entry changes.

The Docker image contains the development dependencies: the builder stage runs a full npm install, and the final stage copies its whole node_modules. After this PR, decompress 4.2.1 is no longer in the image, and the new runner tree, including @aws-sdk/client-s3, is. None of it runs, since the image's command is node index.js.

Changes

Test scripts

pretest and posttest are unchanged. The new package installs the same mongodb-runner binary.

• --version still selects the MongoDB server version. Both 6.8.3 and 8.4.3 disable the built-in version flag of yargs (.version(false)) and define --version as a string option ("MongoDB server version to use").
• With the real pretest script, both versions parse to the command start, the topology standalone, the version 7.0.1 and the mongod arguments --port 27017. posttest parses to stop with --all in both. This was checked with each runner's own CLI, with its start and stop functions intercepted so that no server was started.
• MongoDB 7.0.1 resolves to the same download in both versions:
  • The URL resolver was renamed from mongodb-download-url 1.8.14 to @mongodb-js/mongodb-artifact-url 2.0.4. Its version list and Linux distribution detection code are byte-identical. Its only logic changes concern latest-alpha builds and Linux arm64 detection.
  • Both resolvers return identical URLs for 7.0.1 on Linux x64 (for example mongodb-linux-x86_64-ubuntu2204-7.0.1.tgz), macOS and Windows.
• The downloader still extracts the .tgz archive with tar into a directory with the same name. New between 1.1.16 and 3.0.5: a failed HTTP response raises an error instead of a failed extraction, and the debug output shows the download progress.

Node.js versions

• engines.node (>=18.20.4 <19.0.0 || >=20.18.0 <21.0.0 || >=22.12.0 <23.0.0) is unchanged. The runner is a development dependency and does not run in deployments.
• The new runner tree requires Node.js ^20.19.0 || ^22.12.0 || >=23 (yargs 18.2.0) and >=20.19.0 (the runner's mongodb 7.5.0). The current 6.8.3 tree has the same requirements (yargs 18.0.0 and the same mongodb 7.5.0), so this PR does not raise them. Node.js 18 and 20.18, which engines.node allows, could not run the test scripts before either.
• The underlying reason is require(esm), which Node.js enables by default from 20.19.0 and 22.12.0. As before, the CLI loads the ESM-only yargs 18 with require(). In addition, the downloader 3.0.5 loads the ESM-only @xhmikosr/decompress 11.1.4 with a top-level require().
• Every workflow that installs dependencies runs on a compatible version:
  • The Lint and Tests jobs and the release workflow use Node.js 22 (the latest 22.x). Only the Tests job runs the runner, through npm test.
  • The Docker builder uses Node.js 20.19.1 and does not run the runner.

Lock file

All added and removed entries are development-only, and no added entry has an install script. Every changed entry belongs to the dependency tree of the removed or the added runner. Every version change is required by a range in the new tree, except the two listed under "Not required by a range".

• Removed:
  • mongodb-runner 6.8.3 and its own yargs 18.0.0 tree
  • decompress 4.2.1, with decompress-tar, decompress-tarbz2, decompress-targz, decompress-unzip and their helpers
  • mongodb-download-url 1.8.14
• Added:
  • @mongodb-js/mongodb-runner 8.4.3 with its own yargs 18.2.0 tree
  • @xhmikosr/decompress 11.1.4 and its plugins, with the dependencies of file-type 21, tar-stream 3 and strip-dirs 3
  • @mongodb-js/mongodb-artifact-url 2.0.4
  • @aws-sdk/client-s3 3.1158.0, which the 3.x downloader uses for s3:// URLs, with 16 other @aws-sdk/* packages, 6 @smithy/* packages, @aws/lambda-invoke-store and bowser
  • @peculiar/asn1-asym-key and @peculiar/asn1-x509-post-quantum 2.11.1, new dependencies of @peculiar/x509 2.2.0
• Updated:
  • @mongodb-js/mongodb-downloader 1.1.16 → 3.0.5
  • @mongodb-js/oidc-mock-provider 0.13.13 → 0.13.20, with its nested yargs 18.0.0 → 18.2.0 and string-width 7.2.0 → 8.3.0
  • @peculiar/x509 2.0.0 → 2.2.0 and the @peculiar/asn1-* packages 2.8.0 → 2.11.1
  • file-type 5.2.0 → 21.3.4, seek-bzip 1.0.6 → 2.0.0 (its commander 2.20.3 → 6.2.1), strip-dirs 2.1.0 → 3.0.0, tar-stream 1.6.2 → 3.1.7, yauzl 2.10.0 → 3.4.0
  • tar 7.5.20 → 7.5.22
  • @mongodb-js/saslprep 1.4.12 → 1.6.1 (production entry, see above)
  • get-east-asian-width 1.4.0 → 1.7.0: required by the new string-width 8.3.0 (^1.5.0); the string-width of semantic-release (^1.0.0) uses it as well
• Not required by a range: npm resolved these two to the latest matching release when it rebuilt the trees of updated packages above them. A single-pass install and --prefer-dedupe produce the same versions. Both are development-only.
  • asn1js 3.0.10 → 3.1.0. Its direct parents, the @peculiar/asn1-* packages, were updated from 2.8.0 or newly added at 2.11.1, and all of them accept ^3.0.10. asn1js 3.1.0 then requires pvutils 1.1.5 → 1.2.0.
  • The nested ansi-regex 6.2.2 → 6.4.0 under @mongodb-js/oidc-mock-provider. Its direct parent, strip-ansi 7.2.0, is unchanged and requires ^6.2.2. Only its ancestors changed: @mongodb-js/oidc-mock-provider 0.13.13 → 0.13.20, with its nested yargs 18.0.0 → 18.2.0 and string-width 7.2.0 → 8.3.0.
• Moved: get-stream 9.0.1, which @xhmikosr/decompress-unzip needs, is now hoisted. The nested copy of the same version under @semantic-release/npm is deduplicated into it.
• Unchanged: the runner's mongodb 7.5.0, Parse Server's mongodb 7.1.0, bson 7.3.1 and mongodb-connection-string-url 7.0.2.

@mongodb-js/mongodb-runner (formerly mongodb-runner) 6.8.3 → 8.4.3

mongodb-js/devtools-shared publishes no release notes for this package, so these entries come from the commit history of packages/mongodb-runner. Versions not listed contain only dependency or release tooling updates.

• 6.8.4: Requires the mongodb driver 7.5 or later.
• 6.9.0: Adds the MONGODB_RUNNER_DOWNLOAD_DIR environment variable as a fallback download directory.
• 6.10.0 – 6.11.1:
  • Adds disaggregated storage (DSC) support.
  • Removes support for MongoDB 4.2 servers; 8.1.3 restores it.
  • Renames the package to @mongodb-js/mongodb-runner.
• 6.12.0: DSC support: capture logs from containers and retry on startup (feat(mongodb-runner) DSC support: Capture logs from containers; retry on startup mongodb-js/devtools-shared#870); affects only the DSC/SLS code path, not standalone start/stop.
• 7.0.0: Major version from the monorepo's release automation, which bumped @mongodb-js/mongodb-downloader to 2.0.0. The runner's CLI and API are unchanged.
• 7.0.3: Raises the dependency ranges to mongodb ^7.6.0, mongodb-connection-string-url ^7.0.2, yargs ^18.2.0 and @peculiar/x509 ^2.1.0. Its @mongodb-js/mongodb-downloader 2.0.3 raises tar to ^7.5.22.
• 8.0.0: Uses @mongodb-js/mongodb-downloader 3, which supports s3:// download URLs.
• 8.0.2: Reverts the mongodb driver range to ^7.5.0 for MongoDB 4.2 compatibility.
• 8.1.1 – 8.1.3:
  • Tolerates unauthorized metadata bookkeeping on servers started with --auth, and cleans up after a failed start.
  • Restores support for MongoDB 4.2 servers and pins the mongodb driver to ~7.5.0.
• 8.2.0: Reserves SLS host ports to avoid compose collisions, and reads the SLS image tag from the manifest file by default.
• 8.3.0: Adds --json output to start and ls. The default output is unchanged.
• 8.4.0: Adds --slsDir to locate the DSC directory.
• 8.4.1: Uses @mongodb-js/mongodb-downloader 3.0.3, which replaces decompress with @xhmikosr/decompress.
• 8.4.3: Uses @mongodb-js/mongodb-downloader 3.0.5. It resolves download URLs with @mongodb-js/mongodb-artifact-url, the renamed mongodb-download-url.

@mongodb-js/mongodb-downloader 1.1.16 → 3.0.5

• 1.2.0: Adds an option to download from a direct URL, which the runner exposes as --downloadUrl.
• 2.0.0: Major version from the release automation. The API is unchanged.
• 2.0.3: Raises tar to ^7.5.22.
• 3.0.0: Downloads s3:// URLs through the AWS SDK. http(s):// URLs still use node-fetch.
• 3.0.3: Replaces decompress with @xhmikosr/decompress.
• 3.0.5: Uses @mongodb-js/mongodb-artifact-url 2, the renamed mongodb-download-url.

Main upstream changes: mongodb-js/devtools-shared#856 (download directory variable), mongodb-js/devtools-shared#896 (dependency ranges), mongodb-js/devtools-shared#900 (s3:// downloads), mongodb-js/devtools-shared#909 (cleanup after a failed start), mongodb-js/devtools-shared#927 (@xhmikosr/decompress) and mongodb-js/devtools-shared#932 (@mongodb-js/mongodb-artifact-url).

Breaking Changes

None. The runner is a development dependency, and the test scripts work unchanged.

Code Changes Required

None. Only package.json and package-lock.json change.

Verification

• npm ci --ignore-scripts succeeds with the new lock file (Node.js 22.19.0).
• npx mongodb-runner start --help lists --version as "MongoDB server version to use".
• The argument parsing and download URL checks are described under "Test scripts".
• The CI Tests job starts and stops MongoDB 7.0.1 with the new runner through npm test.

Summary by CodeRabbit

• Chores
  • Updated the MongoDB development tooling. No user-facing changes are included in this update.

[parse-github-assistant]

🚀 Thanks for opening this pull request! We appreciate your effort in improving the project. Please let us know once your pull request is ready for review.

Tip

• Keep pull requests small. Large PRs will be rejected. Break complex features into smaller, incremental PRs.
• Use Test Driven Development. Write failing tests before implementing functionality. Ensure tests pass.
• Group code into logical blocks. Add a short comment before each block to explain its purpose.
• We offer conceptual guidance. Coding is up to you. PRs must be merge-ready for human review.
• Our review focuses on concept, not quality. PRs with code issues will be rejected. Use an AI agent.
• Human review time is precious. Avoid review ping-pong. Inspect and test your AI-generated code.

Note

Please respond to review comments from AI agents just like you would to comments from a human reviewer. Let the reviewer resolve their own comments, unless they have reviewed and accepted your commit, or agreed with your explanation for why the feedback was incorrect.

Caution

Pull requests must be written using an AI agent with human supervision. Pull requests written entirely by a human will likely be rejected, because of lower code quality, higher review effort and the higher risk of introducing bugs. Please note that AI review comments on this pull request alone do not satisfy this requirement. Our CI and AI review are safeguards, not development tools. If many issues are flagged, rethink your development approach. Invest more effort in planning and design rather than using review cycles to fix low-quality code.

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Essentials
• Run ID: 5878e2bc-7b6f-4a06-9060-c4686be20e4e

Commits

Reviewing files that changed from the base of the PR and between 0e632cd and 658c471.

Files selected for processing: 2

• package-lock.json
• package.json

Included review availability: This review used your included allowance. Your plan provides up to 5 included reviews per hour; 3 remain after this review.

Walkthrough

The development dependency changes from mongodb-runner 6.8.3 to @mongodb-js/mongodb-runner 8.4.3.

Changes: Runner Dependency

Layer / File(s)	Summary
Replace the runner dependency package.json	Adds @mongodb-js/mongodb-runner 8.4.3 and removes mongodb-runner 6.8.3 from development dependencies.

Priority: Low

Estimated code review effort: 1 (Trivial) | ~3 minutes

Possibly related PRs

• parse-community/parse-server-example#915: Updates the mongodb-runner development dependency to version 6.8.3, the version replaced here.
• parse-community/parse-server-example#856: Updates the same development dependency and its downloader requirement.
• parse-community/parse-server-example#826: Updates the same development dependency in package.json and package-lock.json.

Merge Risk: Minimal · up to 658c4

The dependency replacement is ready to merge with no identified behavioral or operational risk.

Pre-merge checks: 6

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title begins with the required refactor: prefix, uses a capitalized first letter after the prefix, and accurately describes the dependency replacement.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Security Check		PASS. The PR changes only dependency manifests. It removes mongodb-runner 6.8.3 and decompress 4.2.1, and adds @mongodb-js/mongodb-runner 8.4.3 with @mongodb-js/mongodb-downloader 3.0.5, `@xhm…
Engage In Review Feedback		No review feedback required engagement. The supplied review data reports zero actionable findings and no returned CodeRabbit review threads.

Full details: Security Check

Explanation

PASS. The PR changes only dependency manifests. It removes mongodb-runner 6.8.3 and decompress 4.2.1, and adds @mongodb-js/mongodb-runner 8.4.3 with @mongodb-js/mongodb-downloader 3.0.5, @xhmikosr/decompress 11.1.4, and tar 7.5.22. The new packages are marked development-only, use registry URLs with integrity hashes, and introduce no install scripts or source-code security patterns. The diff contains no application-code changes.

Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}