Upgrade to 3.x Mongo driver

[ericyhwang]

sharedb-mongo is currently using the 2.x Mongo driver out of the box.

The Mongo driver has been on 3.x for a while now, but from the 3.x release notes, it does introduce some breaking changes that would impact sharedb-mongo.

That includes:

• MongoClient.connect(connectionString, callback) results in a mongodb.Db instance in 2.x, and it results in a mongodb.MongoClient instance in 3.x.
• mongodb.Collection#aggregate results in a result array in 2.x, and it results in a mongodb.AggregationCursor in 3.x.
• The results of mongodb.Collection#mapReduce may have changed in an incompatible way.

To be safe, sharedb-mongo should major version when officially upgrading to mongodb@3.x.

It is possible today to pass a mongodb.Db provider function when constructing a ShareDBMongo, which could allow you to use a 3.x Mongo driver since you skip sharedb-mongo creating its own connection. I think everything would work except aggregations.

It might be possible to make forward-compatible changes to support 3.x drivers, prior to major-versioning sharedb-mongo to officially switch to 3.x.

[ericyhwang]

Capturing discussion from the meeting today around MongoClient.connect compatibility.

MongoClient#db(dbName, options) does not specifically document that dbName is optional, but the source code does fall back to the db name from the connection string if one isn't provided.

So it's possible today to use sharedb-mongo with a 3.x driver like this:

MongoClient.connect('mongodb://127.0.0.1:27017/my-db-name', (err, client) => {
  if (err) {
    // Handle connection error
  }
  const db = client.db();  // Will use my-db-name from connection string
  const shareDbMongo = new ShareDbMongo({
    mongo: (cb) => { cb(null, db); }
  });
});

Forwards-compatibility in sharedb-mongo will probably happen here, by checking if the result objects are mongodb.Dbs or mongodb.MongoClients, and if the latter, calling client.db():

https://github.com/share/sharedb-mongo/blob/v1.0.0-beta.9/index.js#L150-L151

[camsjams]

Recently, a new advisory was published that relates to this proposed upgrade.

There is a new advisory for the npm package mongodb that can be solved by upgrading to the 3.x version of v3.13.13 or higher.

By upgrading, these issues should be fixed:

Denial of Service

• NPM advisory 1203
• SNYK-JS-MONGODB-473855

[ericyhwang]

Yes, the upgrade to driver 3.x was completed in #83! We just didn't link the PR to this issue, so it didn't get auto-closed.