Skip to main content
interlace
Plugin: mongodb-security

Changelog

Release history and version updates for eslint-plugin-mongodb-security

Generated from the release history

Built from this package's CHANGELOG.md at deploy time, so it matches the version these docs describe. The full cross-package history lives on the changelog.

9.1.3

  • FixThe README logo now links to the plugin's own documentation.

9.1.2

  • Fixsanitiser, logger, postMessage and query gates read a subscripted member
  • FixMIME, helmet, TLS and stream gates read a subscripted member
  • Fixremaining Mongo gates resolve a subscripted method
  • Fixmongoose['connect'](uri) opens the same unauthenticated connection
  • FixModel['find']({…}) is the same unlean read
  • Fixcollection('u')['findOne'] is the same query as .findOne
  • Maintenancethe Mongo evidence helper no longer casts an unnameable member
  • Dependenciesupdated workspace dependencies: @interlace/eslint-devkit@1.19.0

9.1.1

  • FixAdd an install-size badge to the README prelude, linking to each package's packagephobia page. npm renders the README from the last publish, so a badge only appears on npmjs.com after a release.
  • Dependenciesupdated workspace dependencies: @interlace/eslint-devkit@1.18.2

9.1.0

  • Feature🐛 Fix — a template literal is a string, in 82 rules that disagreed
  • Feature🐛 Fix — no-unsafe-query was wrong in both directions
  • Dependenciesupdated workspace dependencies: @interlace/eslint-devkit@1.18.0

9.0.2

  • Fixpoint meta.docs.url at documentation that exists #683
  • Dependenciesupdated workspace dependencies: @interlace/eslint-devkit@1.17.2

9.0.1

  • require-lean-queries no longer asks the native driver for .lean(). #548
  • DependenciesUpdated internal dependencies

9.0.0

  • Every rule now abstains in files without local MongoDB evidence #491
  • Close the relative-wrapper false negative in the MongoDB evidence gate #492
  • DependenciesUpdated internal dependencies

8.4.0

  • meta.hasSuggestions now matches what each rule actually emits. #309
  • Correct the declared ESLint floor: ^8.0.0 → ^8.40.0. #407
  • Test infrastructure only — no rule, config, or API behavior changes. These #329
  • Correct the ESLint peer range shown in the README Compatibility table. #423
  • DependenciesUpdated internal dependencies

8.3.5

  • require-projection and require-lean-queries no longer report #415

8.3.4

  • Ship the JavaScript without tsc's layout. #411
  • DependenciesUpdated internal dependencies

8.3.3

  • Document every rule option, and add description to the schemas that had none #383
  • Load rule modules on demand instead of at plugin load. #381
  • Declare what we support, load only what we use #381
  • Fix the ./oxlint subpath export, which pointed at src/oxlint.js — a file no build produces. require('<package>/oxlint') threw MODULE_NOT_FOUND on every published package, while every README documented that exact wiring for oxlint's jsPlugins. The export now points at the build output, dist/src/oxlint.js. #335
  • DependenciesUpdated internal dependencies

8.3.2

  • Add the ecosystem and oxlint marks to the README logo row. Each plugin now #364

8.3.1

  • Re-publish every package so npm carries the optimised artifact #338
  • DependenciesUpdated internal dependencies

8.2.8

  • Rewrite description and keywords on every published package for npm search discovery. npm ranks on name, description, and keywords, and the registry only picks up these fields at publish — so this is metadata-only and takes effect for each package on its next release. #294
  • DependenciesUpdated internal dependencies

8.2.7

  • Widen optional peer ranges to accept mongoose ^9 and mongodb driver ^7. The rules lint call patterns statically and never import either library, and the interface-compatibility suite passes against mongoose 9.7 / mongodb 7.5 — the old caps just broke npm install in current-major repos. #274

8.2.6

  • Docsdocs: dual-logo README header (Interlace mark + ESLint mark side by side) and closing Interlace footer — refreshes the README rendered on npmjs.com. No runtime changes. #269
  • DependenciesUpdated internal dependencies

8.2.5

  • Fix Codecov badge showing "unknown" — switch from flag to component URL format #252

8.2.4

  • Fixfix(no-missing-null-checks): eliminate 53 false positives via three new narrowing patterns #143
  • DependenciesUpdated internal dependencies
  • no-hardcoded-connection-string: Detect hardcoded mongodb:// and mongodb+srv:// URIs in string and template literals (CWE-798, CVSS 7.5)
  • no-hardcoded-credentials: Flag user, username, pass, password, auth properties with literal string values (CWE-798, CVSS 7.5)
  • no-debug-mode-production: Detect mongoose.set('debug', true) calls exposing query details (CWE-489, CVSS 3.1)
  • no-unsafe-where: Detect $where operator in object literals and .where('$where') method calls — RCE vector (CWE-943, CVSS 9.0)
  • no-operator-injection: Flag dangerous MongoDB operators ($ne, $gt, $lt, etc.) when values reference user input (CWE-943, CVSS 9.1)
  • no-unbounded-find: Require .limit() on find()/findOne() queries to prevent resource exhaustion (CWE-400, CVSS 4.3)
  • require-tls-connection: Require tls: true or ssl: true in connect()/createConnection() options (CWE-295, CVSS 7.4)
  • no-bypass-middleware: Flag Mongoose methods that bypass pre/post middleware hooks (updateOne, deleteMany, insertMany, bulkWrite, etc.) (CWE-284, CVSS 5.3)
  • Comprehensive test suites for all 8 rules (163 total tests)
  • Test coverage improved from 72.61% to 91.30% lines

8.2.3

  • align codecov component IDs with full package names
  • fix changelog header format across all packages
  • Ofri Peretz

8.2.2

  • align codecov component names and update docs components
  • Ofri Peretz

1.0.0

  • Initial release with 16 security rules
  • NoSQL Injection Prevention (4 rules)
  • Credentials & Connection Security (4 rules)
  • Mongoose ODM Security (5 rules)
  • Best Practices (3 rules)
  • Full support for mongodb, mongoose, mongodb-client-encryption, @typegoose/typegoose
  • AI-optimized error messages with CWE and OWASP references
  • Three configuration presets: recommended, strict, mongoose
  • OWASP Top 10 2021 mapping (A01-A07 coverage)

View on GitHub →

Building secure JavaScript with Interlace? Star the repo to get new rules and CWE coverage as we ship them — or follow the AI-code-security benchmarks behind them.

Follow the benchmarksStar on GitHub

eslint-plugin-mongodb-security

NoSQL injection, operator attacks, and MongoDB/Mongoose security rules

Rules

All ESLint security rules provided by eslint-plugin-mongodb-security