v3.5.1

2026-09-20

Release 3.5.1

Full notes

Changed

Dependency security updates. Jackson 3 is aligned at 3.1.7 to resolve the seven CVEs reported for 3.1.5. The site build updates Next.js and its ESLint plugin to 16.3.8, and refreshes vulnerable npm dependencies including brace-expansion, browserslist, baseline-browser-mapping and sharp. Trivy still reports CVE-2026-93687 in braces 3.0.3 from the ESLint plugin's fast-glob dependency; no patched release is currently available, and it is used only in the site's development toolchain.
The numeric special-value logic is consolidated onto `NumericCompare`, the single source of truth. A duplicate-code scan found three private copies that still bypassed it: the aggregation comparator (the one carrying the bug above), the filter's finite-number check, and the update engine's non-finite ordering. All now delegate to NumericCompare, which gains isFinite and nonFiniteOrder. Every currently-tested comparison is byte-identical; a new pin asserts the aggregation comparator agrees with NumericCompare across the numeric edge matrix, so the two can never drift again.
The two BSON value comparators (aggregation.ValueComparator, shim.BsonValueComparator) are deliberately different subsets and remain separate. The aggregation one carries the fuller canonical order (MinKey, MaxKey, JavaScript and Pattern have their own brackets); the shim one is the pragmatic subset the query, index and sort paths need. Their intentional divergence is now documented in both, and both share their numeric bracket through NumericCompare.

Fixed

Aggregation numeric comparison decided infinities by casting to `double`. A finite Decimal128("1E6000") overflows a double to +Infinity, so $sort, $min and $max compared that finite value equal to a real Infinity. Finiteness is now decided by the value's own type, matching the server and the shim's find-sort and filter comparisons.