Repository navigation
fix(devtools-connect): do not mutate the client options passed in COMPASS-9694 - #958
Merged
Merged
Conversation
Contributor
There was a problem hiding this comment.
🟢 Approval recommended
No active review issues are reported for the change to preserve caller-owned connection options.
No open issues 🎉
What changed in this PR
Fixes a regression introduced in #628 where connectMongoClient mutated caller-owned options, allowing OIDC callbacks to persist across connections when options were reused.
Changes:
- Merges connection options into a fresh object instead of modifying the caller’s object.
- Adds a regression test confirming that OIDC callbacks reach the client while the original options remain unchanged.
| File | Description |
|---|---|
packages/devtools-connect/src/connect.ts |
Uses an empty object as the merge target to preserve caller-owned options. |
packages/devtools-connect/src/connect.spec.ts |
Tests that merging OIDC callbacks leaves the supplied options unchanged. |
Review effort: Balanced
mabaasit
approved these changes
Nov 5, 2026
esvm
approved these changes
Nov 5, 2026
|
Coverage is 80.513% — COMPASS-9694-client-mutation into main. No base build found for |
1 similar comment
|
Coverage is 80.513% — COMPASS-9694-client-mutation into main. No base build found for |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
connectMongoClientmerged its result into the caller'sclientOptionsobject. lodashmerge()modifies its first argument, so nested options of the caller (for exampleauthMechanismProperties) were changed during connect, and the OIDC callbacks of that connection ended up in them.This was introduced in #628, which removed the
{ __skipPingOnConnect: true }object that used to be the merge target. Before that, options were merged into a fresh object.Callers that keep and reuse their options across connections are affected. In mongosh this breaks
keeps authentication state when resetting connection options(OIDC e2e), which fetches a token twice instead of once after bumping to this version of devtools-connect (mongodb-js/mongosh#2899). Compass is not affected, because it deep-clones the options before each call.The merge now goes into a new object, and a test checks that the options passed in stay unchanged.
Open Questions
Checklist