Skip to content

feat(server-services): upgrade mongodb driver from v5 to v6#27243

Open
zhajie wants to merge 2 commits intomicrosoft:mainfrom
zhajie:zhajie/mdbV6
Open

feat(server-services): upgrade mongodb driver from v5 to v6#27243
zhajie wants to merge 2 commits intomicrosoft:mainfrom
zhajie:zhajie/mdbV6

Conversation

@zhajie
Copy link
Copy Markdown
Contributor

@zhajie zhajie commented May 6, 2026

Description

Upgrades the mongodb Node.js driver in @fluidframework/server-services
from ^5.9.2 to ^6.21.0 and fixes all v5→v6 breaking changes in the
MongoDB wrapper layer (src/mongodb.ts).

Breaking changes in the driver addressed

1. findOneAndUpdate return type change
In v6, findOneAndUpdate / findOneAndReplace / findOneAndDelete return
the document directly (T | null) instead of a ModifyResult wrapper.
Fixed in MongoCollection.findOrCreate and MongoCollection.findAndUpdate
by accessing the result directly instead of via .value.

2. returnOriginal option removed
The returnOriginal option was removed in v6 in favor of
returnDocument: "before" | "after". Fixed in MongoCollection.findOrCreate
default options:

  • Before: { returnOriginal: true, upsert: true }
  • After: { returnDocument: "before" as const, upsert: true }

3. keepAlive removed from MongoClientOptions
The keepAlive boolean was removed from MongoClientOptions in v6
(keepAliveInitialDelay remains valid). Removed keepAlive: true from
MongoDbFactory.connect.

Transitive dependency changes

  • bson: 5.5.1 → 6.10.4
  • mongodb-connection-string-url: 2.6.0 → 3.0.2
  • @mongodb-js/saslprep: moved from optional to required (1.1.1 → 1.4.11)
  • socks: moved from required to optional peer dependency
  • whatwg-url: 11.0.0 → 14.2.0 (via mongodb-connection-string-url)

Reviewer Guidance

The review process is outlined on this wiki page.

All MongoDB usage is centralized in packages/services behind the
ICollection/IDb abstraction interfaces, so downstream packages are
unaffected by the driver upgrade. No MapReduce, Collection.count(), or
callback-based find() calls exist in the codebase. All 89 unit tests pass.

Upgrades `@fluidframework/server-services` mongodb dependency from
`^5.9.2` to `^6.21.0` and fixes all v5→v6 breaking changes in the
MongoDB wrapper layer.

## Breaking changes addressed

### 1. `findOneAndUpdate` return type change
In v6, `findOneAndUpdate` / `findOneAndReplace` / `findOneAndDelete`
return the document directly (`T | null`) instead of a `ModifyResult`
wrapper object. The old `result.value` access pattern no longer works
unless `includeResultMetadata: true` is passed.

Fixed in `MongoCollection.findOrCreate` and `MongoCollection.findAndUpdate`
by accessing the result directly instead of via `.value`.

### 2. `returnOriginal` option removed
The `returnOriginal` option was removed in v6 in favor of
`returnDocument: "before" | "after"`.

Fixed in `MongoCollection.findOrCreate` default options:
- Before: `{ returnOriginal: true, upsert: true }`
- After:  `{ returnDocument: "before" as const, upsert: true }`

### 3. `keepAlive` removed from `MongoClientOptions`
The `keepAlive` boolean option was removed from `MongoClientOptions`
in v6 (`keepAliveInitialDelay` remains valid and is unchanged).

Fixed in `MongoDbFactory.connect` by removing the `keepAlive: true` line.

## Dependency changes (v5 → v6)
- `bson`: 5.5.1 → 6.10.4
- `mongodb-connection-string-url`: 2.6.0 → 3.0.2
- `@mongodb-js/saslprep`: moved from optional to required (1.1.1 → 1.4.11)
- `socks`: moved from required to optional peer dependency
- `whatwg-url`: 11.0.0 → 14.2.0 (via mongodb-connection-string-url)

## Risk assessment
All MongoDB usage is centralized in `packages/services` behind the
`ICollection`/`IDb` abstraction interfaces, so downstream packages are
unaffected. No MapReduce, `Collection.count()`, or callback-based
`find()` calls exist in the codebase. `insertMany` already explicitly
sets `ordered: false`, making it independent of the v6 default change.
All 89 unit tests pass.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Copilot AI review requested due to automatic review settings May 6, 2026 16:18
@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented May 6, 2026

Hi! Thank you for opening this PR. Want me to review it?

Based on the diff (104 lines, 3 files), I've queued these reviewers:

  • Correctness — logic errors, race conditions, lifecycle issues
  • Security — vulnerabilities, secret exposure, injection
  • API Compatibility — breaking changes, release tags, type design
  • Performance — algorithmic regressions, memory leaks
  • Testing — coverage gaps, hollow tests

How this works

  • Adjust the reviewer set by ticking/unticking boxes above. Reviewer toggles alone don't trigger anything.

  • Tick Start review below to dispatch the review fleet.

  • After review finishes, tick Start review again to request another run — it auto-resets after each dispatch.

  • This comment updates as new commits land; your reviewer selections are preserved.

  • Start review

@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented May 6, 2026

🔭 PR Review Fleet Report

Note

This report is generated by an experimental AI review fleet and is provided as a beta feature. Findings are a starting point for discussion, not a gate. Use your own judgement.

Verdict: ⚠️ Approve with Suggestions

0 Disastrous, 1 Dangerous, 0 Disagreeable

Findings

Sev # Area File What Fix
🐊 Dangerous H1 Testing server/routerlicious/packages/services/src/mongodb.ts:319 MongoCollection.findOrCreate and findAndUpdate both changed their return-value interpretation from MongoDB v5's result.value (wrapped object) to MongoDB v6's direct result (document or null). No test exercises these methods against the actual (or a mocked) MongoDB driver — the only existing tests (testsForCollection.spec.ts) cover TestCollection, an in-memory stub that has its own independent implementation. A regression where, say, findOneAndUpdate with returnDocument: 'before' and an upsert returns an unexpected shape would cause findOrCreate to silently report existing: false for a document that already existed, allowing duplicate-creation bugs to ship undetected. Add a unit test for MongoCollection.findOrCreate (and findAndUpdate) using a mocked Collection (from the mongodb driver or a hand-rolled double) that stubs findOneAndUpdate to return: (1) a document object (existing case) — assert { existing: true, value: <document> }; (2) null (new-insert case) — assert { existing: false, value: <inserted value> }. This directly exercises the v6 return-value path and would catch the regression if the mapping were wrong.

View workflow run

const options: MongoClientOptions = {
directConnection: this.directConnection ?? false,
keepAlive: true,
keepAliveInitialDelay: this.keepAliveInitialDelay,
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

keepAliveInitialDelay can be removed as well

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

updated

return result.value
? { value: result.value, existing: true }
: { value, existing: false };
return result ? { value: result as T, existing: true } : { value, existing: false };
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Let's do value: result as unknown as T, instead

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

addressed

- Use `result as unknown as T` instead of `result as T` in
  `MongoCollection.findOrCreate` and `MongoCollection.findAndUpdate`
  for safer type assertion through the unknown intermediate.

- Remove `keepAliveInitialDelay` entirely: the option, its default
  constant, the config interface field, the class property, the
  constructor assignment, and the MongoClientOptions entry. TCP
  keep-alive configuration is not needed at the driver level.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants