Mongoose: 4.10.3 was released with database files included

[robertklep]

4.10.3 in the NPM repo extracts to almost 1GB:

$ du -kcs *
925156  package/

There are a few, what look to be, temporary directories in package/tools that are the culprit:

$ du -kcs package/tools/*
307932  package/tools/31000/
307932  package/tools/31001/
307960  package/tools/31002/

They seem to contain MongoDB databases.

[floo51]

To add some insight on the consequences, apart from disclosing the databases of whoever published the npm package... We found out it broke our automated serverless API deployment because the unzipped package archive was over 250MB (actually about 1GB).

[kyrylkov]

We have the same issue. Cannot use 4.10.3 in production, because of the disk space required.

[floo51]

I ended up not using the npm package and changing my package.json to:

"mongoose": "[email protected]:floo51/mongoose.git",

Dirty patch but works for now.

[ChavaSobreyra]

Can confirm problem -- this is breaking my AWS lambda builds for being too large

[vkarpov15]

Released 4.10.4, please upgrade if this issue is causing you grief :+1:

[robertklep]

Thanks, @vkarpov15 :)