[Snyk] Security upgrade mongodb-client-encryption from 2.1.0 to 6.0.0

[sb-cecilialiu]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • package.json

⚠️ Warning

Failed to update the package-lock.json, please update manually before merging.

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	823/1000 Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 8.6	Server-side Request Forgery (SSRF) SNYK-JS-IP-6240864	Yes	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: mongodb-client-encryption

The new version differs by 250 commits.

• 8e7f69f chore(release): 6.0.0
• ae6ada1 docs: Update Node bindings README.md
• b8f3eb8 (Debian packaging) skip tests in debian/rules
• 43ccc19 (Debian packaging) fix clean target (Closes: #1047944)
• 44234cf build Debian package a second time
• 7e7f3aa MONGOCRYPT-512 fix warnings from -Wsign-compare (#688)
• 4ebe317 MONGOCRYPT-586 port in C driver-specific KMS changes (#686)
• 857595b docs(NODE-5527): add nodejs driver compat table (#687)
• 3337460 docs(NODE-5425): update Node bindings docs (#685)
• 525e4be chore(NODE-5448): update mongodb-client-encryption dependencies (#684)
• 0be9ccc chore(release): 6.0.0-alpha.3
• 8cd5850 fix(NODE-5516): allow `undefined` values for optional Uint8Arrays arguments (#683)
• f5aafa7 chore(release): 6.0.0-alpha.2
• b6292cc refactor(NODE-5432): Remove usages of Buffer from Node C++ bindings (#682)
• ef5b0b5 MONGOCRYPT-580 Add package publication for missing os/arch combinations (#678)
• 9f3aab4 assert return of `EVP_CIPHER_CTX_new` (#679)
• f6817fa check return of `_mongocrypt_buffer_concat` (#677)
• e065410 MONGOCRYPT-582 fix leaks on errors (#676)
• 35d8c24 check return of `kms_response_parser_get_response` (#680)
• df0ddb3 chore: type definition improvements for driver internal usage (#675)
• 974a461 PYTHON-3853 [pymongocrypt] Bump to dev version (#674)
• 76a1719 PYTHON-3853 [pymongocrypt] Release 1.7.0 (#673)
• 11df186 PYTHON-3849 [pymongocrypt] Address utcnow deprecation (#671)
• 2f7bd46 feat(NODE-5420)!: remove JS bindings from libmongocrypt (#667)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Server-side Request Forgery (SSRF)