MongoDB EOL Concern

[237833VB]

Security Alerts raised for MongoDB EOL version used in StackStorm 3.8.1 . Is there any update on when the 3.9 version will be available ? Also is there any temporary fix or suggestion to handle this MongoDB EOL vulnerability being reported ?

[chain312]

I will upgrade directly to 4.0, and you can test it locally. It shouldn't be a problem.

[nzlosh]

While unofficially supported, people have reported successfully using the v3.9 unstable releases. There are packages & images available of the development stage for St2 v3.9 which has MongoDB support for versions greater than 4.4.

System packages: https://packagecloud.io/StackStorm/unstable
Docker Images: https://hub.docker.com/u/stackstorm

Follow the official mongodb documentation for details on how to preform the database upgrade.

[fdrab]

Even though unsupported officially, I'm using MongoDB 7 in my setup with ST2 3.8.0 and it works fine so far (3+ months no issues)

[albertoacebeseviden]

With or without Auth? Default SCRAM-SHA-1?

[fdrab]

yes, SCRAM-SHA-1. I'm using bitnami mongodb helm chart for deployment and it works fine. in the process of migrating to enterprise mongodb for encryption at rest.