fix(deps): update dependency mongodb to v7 - #163

Open
renovate[bot] wants to merge 1 commit into
devfrom
renovate/mongodb-7.x
Open

fix(deps): update dependency mongodb to v7#163
renovate[bot] wants to merge 1 commit into
devfrom
renovate/mongodb-7.x

Conversation

@renovate

@renovaterenovateBot commented Nov 22, 2025•
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

PackageChangeAgeConfidence
mongodb^6.18.0 → ^7.0.0ageconfidence

Release Notes

mongodb/node-mongodb-native (mongodb)

v7.5.0

Compare Source

Features
  • NODE-7537: promote QE string queries (prefix/suffix/substring) (#​4996) (dc4900c)
Bug Fixes

v7.4.0

Compare Source

Features
  • NODE-7634: remove experimental tag from async dispose methods (#​4976) (43ce3eb)
  • NODE-7549: send afterClusterTime on writes in causally-consistent sessions (#​4963) (3abfd26)

v7.3.0

Compare Source

Features
Bug Fixes
  • NODE-7548: SCRAM authentication fails on non-Node runtimes (#​4932) (a10d2c9)

v7.2.0

Compare Source

Features
  • NODE-7142: Exponential backoff and jitter in retry loops (#​4871) (22c6031)
  • NODE-7315: Use BSON ByteUtils instead of Nodejs Buffer (#​4840) (1add538)
  • NODE-7335: Create dedicated mocha runner with isolated vm context (#​4876) (a4cba4c)
  • NODE-7379: Refactor Crypto to Web Crypto API (#​4862) (ac98f4a)
  • NODE-7385: add experimental os runtime adapter (#​4851) (d2ad07f)
  • NODE-7441: add ChangeStream.bufferedCount (#​4870) (f7ea421)
  • NODE-7452: restrict server deprioritization on replica sets to overload errors (#​4875) (87a3465)
  • NODE-7467: make token bucket optional in client backpressure (#​4878) (4fb0a0a)
  • NODE-7491: finalize client backpressure implementation for phase 1 rollout (#​4920) (2cc7983)
Bug Fixes
  • NODE-7430: throw timeout error when withTransaction retries exceed deadline (#​4897) (16a899d)
  • NODE-7459: explicitly call setKeepAlive and setNoDelay on socket (#​4879) (778a2a1)
  • NODE-7469: overload retry when retryReads/Writes=false (#​4888) (4157b26)
  • NODE-7478: OIDC host allowlist fix (#​4905) (f36b754)

v7.1.1

Compare Source

The MongoDB Node.js team is pleased to announce version 7.1.1 of the mongodb package!

Release Notes
Tighten OIDC ALLOWED_HOSTS wildcard matching

The OIDC ALLOWED_HOSTS wildcard handling has been fixed to require full subdomain/path matches for *. and */ entries, preventing partial suffix matches from being incorrectly accepted.

Fixed TCP keep-alive and no-delay settings not being applied on TLS connections

Due to a Node.js bug, tls.connect() silently ignores keepAlive, keepAliveInitialDelay, and noDelay options passed through its constructor. This could cause idle connections - particularly through cloud load balancers like Azure (240s idle timeout) or AWS PrivateLink/NLB - to be dropped unexpectedly due to missing TCP keep-alive probes.

The driver now explicitly calls setKeepAlive() and setNoDelay() on the socket after creation, ensuring these settings are always applied regardless of whether TLS is used.

Bug Fixes
Documentation

We invite you to try the mongodb library immediately, and report any issues to the NODE project.

v7.1.0

Compare Source

Features
  • NODE-5393: aws4 no longer required for AWS authentication (#​4824) (0f46db8)
  • NODE-7121: prevent connection churn on backpressure errors when establishing connections (#​4800) (4cb2b87)
  • NODE-7122: exponential backoff between retries in convenient transaction API (#​4765) (e70fdc9)
  • NODE-7304: remove usages in src of promisify (#​4799) (761b9bf)
  • NODE-7306: Replace global process with import node:process (#​4820) (cc503cb)
  • NODE-7310: Replace process.arch with os.arch() (#​4823) (f0af829)
  • NODE-7311: Replace process.platform with os.platform() (#​4822) (c58ca1f)
  • NODE-7317: use BSON.NumberUtils to determine endianness (#​4808) (4e9467e)
  • NODE-7319: update allowed hosts list with *.mongo.com (#​4802) (bfb7160)
  • NODE-7330: deprecate RenameCollectionOptions.new_collection (#​4815) (a96fa26)
  • NODE-7333: add support for deprioritized servers to all topologies (#​4821) (a4211e7)
Bug Fixes
  • NODE-7290: use valueof for error code check (#​4791) (1cc3d1c)
  • NODE-7298: ensure commonWireVersion is computed from server maxWireVersion (#​4805) (2b2366d)
  • NODE-7307: Replace node:process.hrtime() with performance.now() (#​4816) (ae2e037)
  • NODE-7308: replace process.nextTick with queueMicrotask (#​4817) (b1b6e81)

v7.0.0

Compare Source

⚠ BREAKING CHANGES
  • NODE-7259: use alphas of all supporting packages (#​4746)
  • NODE-5510: dont filter change stream options (#​4723)
  • NODE-6296: remove cursor default batch size of 1000 (#​4729)
  • NODE-7150: update peer dependency matrix for 3rd party peer deps (#​4720)
  • NODE-7046: remove AWS uri/options support (#​4689)
  • NODE-4808: remove support for stream() transform on cursors and change streams (#​4728)
  • NODE-6377: remove noResponse option (#​4724)
  • NODE-6473: remove MONGODB-CR auth (#​4717)
  • NODE-5994: Remove metadata-related properties from public driver API (#​4716)
  • NODE-7016: remove beta namespace and move resource management into driver (#​4719)
  • NODE-4184: don't throw on aggregate with write concern and explain (#​4718)
  • NODE-7043, NODE-7217: adopt mongodb-client-encryption v7 (#​4705)
  • NODE-6065: throw MongoRuntimeError instead of MissingDependencyError in crypto connection (#​4711)
  • NODE-6584: improve typing for filepaths in AutoEncryptionOptions (#​4341)
  • NODE-6334: rename PoolRequstedRetry to PoolRequestedRetry (#​4696)
  • NODE-7174: drop support for Node16 and Node18 (#​4668)
  • NODE-7047: use custom credential provider first after URI (#​4656)
  • NODE-6988: require aws sdk for aws auth (#​4659)
Features
Bug Fixes
  • NODE-7067: Wrap socket write in a try/catch to ensure errors can be properly wrapped (#​4759) (66c18b7)
  • NODE-7232: only send endSessions during client close if the topology supports sessions (#​4722) (cc85ebf)
  • NODE-7247: clarify #rewrapManyDataKey() parameter types (#​4760) (cb522bf)
  • NODE-7270: remove extra BSONType file in docs/Next/variables (#​4754) (df3aaaa)

v6.21.0

Compare Source

The MongoDB Node.js team is pleased to announce version 6.21.0 of the mongodb package!

Release Notes

Deprecated items to be removed in 7.0.0

The following items have been deprecated and will be removed in 7.0.0:

MongoCredentials.authMechanismProperties.AWS_SESSION_TOKEN// URI & client options for AWS variables will no longer be respectedCommandOptions.noResponse// UnusedConnectionOptions.cancellationToken// UnusedCursorStreamOptions// Only option, transform, removed in favor of Stream#map
Features
  • NODE-7230: add deprecations of items to be removed in v7 (#​4774) (5104c0f)

Documentation

We invite you to try the mongodb library immediately, and report any issues to the NODE project.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • "after 11pm every weekend,before 8am every weekend"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovaterenovateBot added package:npm Pull requests that update node.js deps type:dependencies Pull requests that update a dependency file update:major Major Updates of dependency labels Nov 22, 2025
@snyk-io

snyk-ioBot commented Nov 22, 2025•
edited
Loading

Copy link
Copy Markdown

✅ Snyk checks have passed. No issues have been found so far.

StatusScan Engine Critical High Medium LowTotal (0)
✅Open Source Security0000 0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

@socket-security

socket-securityBot commented Nov 22, 2025•
edited
Loading

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

DiffPackageSupply Chain
Security		VulnerabilityQualityMaintenanceLicense
Updatedmongodb@​6.20.0 ⏵ 7.5.089-510010098100

View full report

@renovate
renovateBotforce-pushed the renovate/mongodb-7.x branch from c4c62f3 to 7255308CompareFebruary 2, 2026 21:06
@renovate
renovateBotforce-pushed the renovate/mongodb-7.x branch 2 times, most recently from ab590d9 to 67ebaf8CompareFebruary 18, 2026 03:10
@renovate
renovateBotforce-pushed the renovate/mongodb-7.x branch from 67ebaf8 to ebbc59fCompareApril 7, 2026 14:59
@renovate
renovateBotforce-pushed the renovate/mongodb-7.x branch from ebbc59f to a6c7dadCompareMay 4, 2026 19:52
@renovate
renovateBotforce-pushed the renovate/mongodb-7.x branch from a6c7dad to ed629f7CompareJune 23, 2026 19:38
@renovate
renovateBotforce-pushed the renovate/mongodb-7.x branch from ed629f7 to 8fd7c45CompareJuly 9, 2026 22:01
@renovate
renovateBotforce-pushed the renovate/mongodb-7.x branch from 8fd7c45 to 64d701bCompareJuly 21, 2026 23:11
@renovate
renovateBotforce-pushed the renovate/mongodb-7.x branch from 64d701b to 4f6d117CompareJuly 30, 2026 17:15
@renovate
renovateBotforce-pushed the renovate/mongodb-7.x branch from 4f6d117 to dca142aCompareAugust 11, 2026 22:31
@socket-security

socket-securityBot commented Aug 11, 2026•
edited
Loading

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

ActionSeverityAlert (click "▶" to expand/collapse)
WarnHigh
Publisher changed: npm @mongodb-js/saslprep is now published by devtools-npm-user

Author:devtools-npm-user

From:package.json → npm/mongodb@7.5.0 → npm/@mongodb-js/saslprep@1.4.13

ℹ Read more on: This package | This alert | What is unstable ownership?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Try to reduce the number of authors you depend on to reduce the risk to malicious actors gaining access to your supply chain. Packages should remove inactive collaborators with publishing rights from packages on npm.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@mongodb-js/saslprep@1.4.13. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@renovate
renovateBotforce-pushed the renovate/mongodb-7.x branch from dca142a to 755c727CompareAugust 26, 2026 12:42
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

package:npmPull requests that update node.js depstype:dependenciesPull requests that update a dependency fileupdate:majorMajor Updates of dependency

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants

, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
fix(deps): update dependency mongodb to v7 - #163
Open
renovate[bot] wants to merge 1 commit into
devfrom 
renovate/mongodb-7.x
Open
fix(deps): update dependency mongodb to v7#163
renovate[bot] wants to merge 1 commit into
devfrom 
renovate/mongodb-7.x
Conversation
@renovate
@renovaterenovateBot
commented
Nov 22, 2025•

edited

Loading

Copy link


Copy Markdown

Contributor
This PR contains the following updates:
PackageChangeAgeConfidence
mongodb^6.18.0 → ^7.0.0ageconfidence
Release Notes
mongodb/node-mongodb-native (mongodb)
v7.5.0
Compare Source
Features
  • NODE-7537: promote QE string queries (prefix/suffix/substring) (#​4996) (dc4900c)
Bug Fixes
v7.4.0
Compare Source
Features
  • NODE-7634: remove experimental tag from async dispose methods (#​4976) (43ce3eb)
  • NODE-7549: send afterClusterTime on writes in causally-consistent sessions (#​4963) (3abfd26)
v7.3.0
Compare Source
Features
Bug Fixes
  • NODE-7548: SCRAM authentication fails on non-Node runtimes (#​4932) (a10d2c9)
v7.2.0
Compare Source
Features
  • NODE-7142: Exponential backoff and jitter in retry loops (#​4871) (22c6031)
  • NODE-7315: Use BSON ByteUtils instead of Nodejs Buffer (#​4840) (1add538)
  • NODE-7335: Create dedicated mocha runner with isolated vm context (#​4876) (a4cba4c)
  • NODE-7379: Refactor Crypto to Web Crypto API (#​4862) (ac98f4a)
  • NODE-7385: add experimental os runtime adapter (#​4851) (d2ad07f)
  • NODE-7441: add ChangeStream.bufferedCount (#​4870) (f7ea421)
  • NODE-7452: restrict server deprioritization on replica sets to overload errors (#​4875) (87a3465)
  • NODE-7467: make token bucket optional in client backpressure (#​4878) (4fb0a0a)
  • NODE-7491: finalize client backpressure implementation for phase 1 rollout (#​4920) (2cc7983)
Bug Fixes
  • NODE-7430: throw timeout error when withTransaction retries exceed deadline (#​4897) (16a899d)
  • NODE-7459: explicitly call setKeepAlive and setNoDelay on socket (#​4879) (778a2a1)
  • NODE-7469: overload retry when retryReads/Writes=false (#​4888) (4157b26)
  • NODE-7478: OIDC host allowlist fix (#​4905) (f36b754)
v7.1.1
Compare Source
The MongoDB Node.js team is pleased to announce version 7.1.1 of the mongodb package!
Release Notes
Tighten OIDC ALLOWED_HOSTS wildcard matching
The OIDC ALLOWED_HOSTS wildcard handling has been fixed to require full subdomain/path matches for *. and */ entries, preventing partial suffix matches from being incorrectly accepted.
Fixed TCP keep-alive and no-delay settings not being applied on TLS connections
Due to a Node.js bug, tls.connect() silently ignores keepAlive, keepAliveInitialDelay, and noDelay options passed through its constructor. This could cause idle connections - particularly through cloud load balancers like Azure (240s idle timeout) or AWS PrivateLink/NLB - to be dropped unexpectedly due to missing TCP keep-alive probes.
The driver now explicitly calls setKeepAlive() and setNoDelay() on the socket after creation, ensuring these settings are always applied regardless of whether TLS is used.
Bug Fixes
Documentation
We invite you to try the mongodb library immediately, and report any issues to the NODE project.
v7.1.0
Compare Source
Features
  • NODE-5393: aws4 no longer required for AWS authentication (#​4824) (0f46db8)
  • NODE-7121: prevent connection churn on backpressure errors when establishing connections (#​4800) (4cb2b87)
  • NODE-7122: exponential backoff between retries in convenient transaction API (#​4765) (e70fdc9)
  • NODE-7304: remove usages in src of promisify (#​4799) (761b9bf)
  • NODE-7306: Replace global process with import node:process (#​4820) (cc503cb)
  • NODE-7310: Replace process.arch with os.arch() (#​4823) (f0af829)
  • NODE-7311: Replace process.platform with os.platform() (#​4822) (c58ca1f)
  • NODE-7317: use BSON.NumberUtils to determine endianness (#​4808) (4e9467e)
  • NODE-7319: update allowed hosts list with *.mongo.com (#​4802) (bfb7160)
  • NODE-7330: deprecate RenameCollectionOptions.new_collection (#​4815) (a96fa26)
  • NODE-7333: add support for deprioritized servers to all topologies (#​4821) (a4211e7)
Bug Fixes
  • NODE-7290: use valueof for error code check (#​4791) (1cc3d1c)
  • NODE-7298: ensure commonWireVersion is computed from server maxWireVersion (#​4805) (2b2366d)
  • NODE-7307: Replace node:process.hrtime() with performance.now() (#​4816) (ae2e037)
  • NODE-7308: replace process.nextTick with queueMicrotask (#​4817) (b1b6e81)
v7.0.0
Compare Source
⚠ BREAKING CHANGES
  • NODE-7259: use alphas of all supporting packages (#​4746)
  • NODE-5510: dont filter change stream options (#​4723)
  • NODE-6296: remove cursor default batch size of 1000 (#​4729)
  • NODE-7150: update peer dependency matrix for 3rd party peer deps (#​4720)
  • NODE-7046: remove AWS uri/options support (#​4689)
  • NODE-4808: remove support for stream() transform on cursors and change streams (#​4728)
  • NODE-6377: remove noResponse option (#​4724)
  • NODE-6473: remove MONGODB-CR auth (#​4717)
  • NODE-5994: Remove metadata-related properties from public driver API (#​4716)
  • NODE-7016: remove beta namespace and move resource management into driver (#​4719)
  • NODE-4184: don't throw on aggregate with write concern and explain (#​4718)
  • NODE-7043, NODE-7217: adopt mongodb-client-encryption v7 (#​4705)
  • NODE-6065: throw MongoRuntimeError instead of MissingDependencyError in crypto connection (#​4711)
  • NODE-6584: improve typing for filepaths in AutoEncryptionOptions (#​4341)
  • NODE-6334: rename PoolRequstedRetry to PoolRequestedRetry (#​4696)
  • NODE-7174: drop support for Node16 and Node18 (#​4668)
  • NODE-7047: use custom credential provider first after URI (#​4656)
  • NODE-6988: require aws sdk for aws auth (#​4659)
Features
Bug Fixes
  • NODE-7067: Wrap socket write in a try/catch to ensure errors can be properly wrapped (#​4759) (66c18b7)
  • NODE-7232: only send endSessions during client close if the topology supports sessions (#​4722) (cc85ebf)
  • NODE-7247: clarify #rewrapManyDataKey() parameter types (#​4760) (cb522bf)
  • NODE-7270: remove extra BSONType file in docs/Next/variables (#​4754) (df3aaaa)
v6.21.0
Compare Source
The MongoDB Node.js team is pleased to announce version 6.21.0 of the mongodb package!
Release Notes
Deprecated items to be removed in 7.0.0
The following items have been deprecated and will be removed in 7.0.0:
MongoCredentials.authMechanismProperties.AWS_SESSION_TOKEN// URI & client options for AWS variables will no longer be respectedCommandOptions.noResponse// UnusedConnectionOptions.cancellationToken// UnusedCursorStreamOptions// Only option, transform, removed in favor of Stream#map
Features
  • NODE-7230: add deprecations of items to be removed in v7 (#​4774) (5104c0f)
Documentation
We invite you to try the mongodb library immediately, and report any issues to the NODE project.
Configuration
📅 Schedule: (UTC)
  • Branch creation

    • "after 11pm every weekend,before 8am every weekend"
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
@renovaterenovateBot
added

package:npm
Pull requests that update node.js deps
type:dependencies
Pull requests that update a dependency file
update:major
Major Updates of dependency
labels
Nov 22, 2025
@snyk-io
snyk-ioBot
commented
Nov 22, 2025•

edited

Loading

Copy link


Copy Markdown

✅ Snyk checks have passed. No issues have been found so far.
StatusScan Engine Critical High Medium LowTotal (0)
✅Open Source Security0000 0 issues
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.
@socket-security
socket-securityBot
commented
Nov 22, 2025•

edited

Loading

Copy link


Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.
DiffPackageSupply Chain
Security		VulnerabilityQualityMaintenanceLicense
Updatedmongodb@​6.20.0 ⏵ 7.5.089-510010098100
View full report
@renovate
renovateBotforce-pushed
the
renovate/mongodb-7.x
branch
from
c4c62f3 to
7255308CompareFebruary 2, 2026 21:06
@renovate
renovateBotforce-pushed
the
renovate/mongodb-7.x
branch
2 times, most recently
from
ab590d9 to
67ebaf8CompareFebruary 18, 2026 03:10
@renovate
renovateBotforce-pushed
the
renovate/mongodb-7.x
branch
from
67ebaf8 to
ebbc59fCompareApril 7, 2026 14:59
@renovate
renovateBotforce-pushed
the
renovate/mongodb-7.x
branch
from
ebbc59f to
a6c7dadCompareMay 4, 2026 19:52
@renovate
renovateBotforce-pushed
the
renovate/mongodb-7.x
branch
from
a6c7dad to
ed629f7CompareJune 23, 2026 19:38
@renovate
renovateBotforce-pushed
the
renovate/mongodb-7.x
branch
from
ed629f7 to
8fd7c45CompareJuly 9, 2026 22:01
@renovate
renovateBotforce-pushed
the
renovate/mongodb-7.x
branch
from
8fd7c45 to
64d701bCompareJuly 21, 2026 23:11
@renovate
renovateBotforce-pushed
the
renovate/mongodb-7.x
branch
from
64d701b to
4f6d117CompareJuly 30, 2026 17:15
@renovate
renovateBotforce-pushed
the
renovate/mongodb-7.x
branch
from
4f6d117 to
dca142aCompareAugust 11, 2026 22:31
@socket-security
socket-securityBot
commented
Aug 11, 2026•

edited

Loading

Copy link


Copy Markdown

Warning
Review the following alerts detected in dependencies.
According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
ActionSeverityAlert (click "▶" to expand/collapse)
WarnHigh
Publisher changed: npm @mongodb-js/saslprep is now published by devtools-npm-user
Author:devtools-npm-user
From:package.json → npm/mongodb@7.5.0 → npm/@mongodb-js/saslprep@1.4.13
ℹ Read more on: This package | This alert | What is unstable ownership?
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.

Suggestion: Try to reduce the number of authors you depend on to reduce the risk to malicious actors gaining access to your supply chain. Packages should remove inactive collaborators with publishing rights from packages on npm.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/@mongodb-js/saslprep@1.4.13. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.

View full report
@renovate
renovateBotforce-pushed
the
renovate/mongodb-7.x
branch
from
dca142a to
755c727CompareAugust 26, 2026 12:42
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels

package:npmPull requests that update node.js depstype:dependenciesPull requests that update a dependency fileupdate:majorMajor Updates of dependency

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
fix(deps): update dependency mongodb to v7 - #163
Open
renovate[bot] wants to merge 1 commit into
devfrom 
renovate/mongodb-7.x
Open
fix(deps): update dependency mongodb to v7#163
renovate[bot] wants to merge 1 commit into
devfrom 
renovate/mongodb-7.x
Conversation
@renovate
@renovaterenovateBot
commented
Nov 22, 2025•

edited

Loading

Copy link


Copy Markdown

Contributor
This PR contains the following updates:
PackageChangeAgeConfidence
mongodb^6.18.0 → ^7.0.0ageconfidence
Release Notes
mongodb/node-mongodb-native (mongodb)
v7.5.0
Compare Source
Features
  • NODE-7537: promote QE string queries (prefix/suffix/substring) (#​4996) (dc4900c)
Bug Fixes
v7.4.0
Compare Source
Features
  • NODE-7634: remove experimental tag from async dispose methods (#​4976) (43ce3eb)
  • NODE-7549: send afterClusterTime on writes in causally-consistent sessions (#​4963) (3abfd26)
v7.3.0
Compare Source
Features
Bug Fixes
  • NODE-7548: SCRAM authentication fails on non-Node runtimes (#​4932) (a10d2c9)
v7.2.0
Compare Source
Features
  • NODE-7142: Exponential backoff and jitter in retry loops (#​4871) (22c6031)
  • NODE-7315: Use BSON ByteUtils instead of Nodejs Buffer (#​4840) (1add538)
  • NODE-7335: Create dedicated mocha runner with isolated vm context (#​4876) (a4cba4c)
  • NODE-7379: Refactor Crypto to Web Crypto API (#​4862) (ac98f4a)
  • NODE-7385: add experimental os runtime adapter (#​4851) (d2ad07f)
  • NODE-7441: add ChangeStream.bufferedCount (#​4870) (f7ea421)
  • NODE-7452: restrict server deprioritization on replica sets to overload errors (#​4875) (87a3465)
  • NODE-7467: make token bucket optional in client backpressure (#​4878) (4fb0a0a)
  • NODE-7491: finalize client backpressure implementation for phase 1 rollout (#​4920) (2cc7983)
Bug Fixes
  • NODE-7430: throw timeout error when withTransaction retries exceed deadline (#​4897) (16a899d)
  • NODE-7459: explicitly call setKeepAlive and setNoDelay on socket (#​4879) (778a2a1)
  • NODE-7469: overload retry when retryReads/Writes=false (#​4888) (4157b26)
  • NODE-7478: OIDC host allowlist fix (#​4905) (f36b754)
v7.1.1
Compare Source
The MongoDB Node.js team is pleased to announce version 7.1.1 of the mongodb package!
Release Notes
Tighten OIDC ALLOWED_HOSTS wildcard matching
The OIDC ALLOWED_HOSTS wildcard handling has been fixed to require full subdomain/path matches for *. and */ entries, preventing partial suffix matches from being incorrectly accepted.
Fixed TCP keep-alive and no-delay settings not being applied on TLS connections
Due to a Node.js bug, tls.connect() silently ignores keepAlive, keepAliveInitialDelay, and noDelay options passed through its constructor. This could cause idle connections - particularly through cloud load balancers like Azure (240s idle timeout) or AWS PrivateLink/NLB - to be dropped unexpectedly due to missing TCP keep-alive probes.
The driver now explicitly calls setKeepAlive() and setNoDelay() on the socket after creation, ensuring these settings are always applied regardless of whether TLS is used.
Bug Fixes
Documentation
We invite you to try the mongodb library immediately, and report any issues to the NODE project.
v7.1.0
Compare Source
Features
  • NODE-5393: aws4 no longer required for AWS authentication (#​4824) (0f46db8)
  • NODE-7121: prevent connection churn on backpressure errors when establishing connections (#​4800) (4cb2b87)
  • NODE-7122: exponential backoff between retries in convenient transaction API (#​4765) (e70fdc9)
  • NODE-7304: remove usages in src of promisify (#​4799) (761b9bf)
  • NODE-7306: Replace global process with import node:process (#​4820) (cc503cb)
  • NODE-7310: Replace process.arch with os.arch() (#​4823) (f0af829)
  • NODE-7311: Replace process.platform with os.platform() (#​4822) (c58ca1f)
  • NODE-7317: use BSON.NumberUtils to determine endianness (#​4808) (4e9467e)
  • NODE-7319: update allowed hosts list with *.mongo.com (#​4802) (bfb7160)
  • NODE-7330: deprecate RenameCollectionOptions.new_collection (#​4815) (a96fa26)
  • NODE-7333: add support for deprioritized servers to all topologies (#​4821) (a4211e7)
Bug Fixes
  • NODE-7290: use valueof for error code check (#​4791) (1cc3d1c)
  • NODE-7298: ensure commonWireVersion is computed from server maxWireVersion (#​4805) (2b2366d)
  • NODE-7307: Replace node:process.hrtime() with performance.now() (#​4816) (ae2e037)
  • NODE-7308: replace process.nextTick with queueMicrotask (#​4817) (b1b6e81)
v7.0.0
Compare Source
⚠ BREAKING CHANGES
  • NODE-7259: use alphas of all supporting packages (#​4746)
  • NODE-5510: dont filter change stream options (#​4723)
  • NODE-6296: remove cursor default batch size of 1000 (#​4729)
  • NODE-7150: update peer dependency matrix for 3rd party peer deps (#​4720)
  • NODE-7046: remove AWS uri/options support (#​4689)
  • NODE-4808: remove support for stream() transform on cursors and change streams (#​4728)
  • NODE-6377: remove noResponse option (#​4724)
  • NODE-6473: remove MONGODB-CR auth (#​4717)
  • NODE-5994: Remove metadata-related properties from public driver API (#​4716)
  • NODE-7016: remove beta namespace and move resource management into driver (#​4719)
  • NODE-4184: don't throw on aggregate with write concern and explain (#​4718)
  • NODE-7043, NODE-7217: adopt mongodb-client-encryption v7 (#​4705)
  • NODE-6065: throw MongoRuntimeError instead of MissingDependencyError in crypto connection (#​4711)
  • NODE-6584: improve typing for filepaths in AutoEncryptionOptions (#​4341)
  • NODE-6334: rename PoolRequstedRetry to PoolRequestedRetry (#​4696)
  • NODE-7174: drop support for Node16 and Node18 (#​4668)
  • NODE-7047: use custom credential provider first after URI (#​4656)
  • NODE-6988: require aws sdk for aws auth (#​4659)
Features
Bug Fixes
  • NODE-7067: Wrap socket write in a try/catch to ensure errors can be properly wrapped (#​4759) (66c18b7)
  • NODE-7232: only send endSessions during client close if the topology supports sessions (#​4722) (cc85ebf)
  • NODE-7247: clarify #rewrapManyDataKey() parameter types (#​4760) (cb522bf)
  • NODE-7270: remove extra BSONType file in docs/Next/variables (#​4754) (df3aaaa)
v6.21.0
Compare Source
The MongoDB Node.js team is pleased to announce version 6.21.0 of the mongodb package!
Release Notes
Deprecated items to be removed in 7.0.0
The following items have been deprecated and will be removed in 7.0.0:
MongoCredentials.authMechanismProperties.AWS_SESSION_TOKEN// URI & client options for AWS variables will no longer be respectedCommandOptions.noResponse// UnusedConnectionOptions.cancellationToken// UnusedCursorStreamOptions// Only option, transform, removed in favor of Stream#map
Features
  • NODE-7230: add deprecations of items to be removed in v7 (#​4774) (5104c0f)
Documentation
We invite you to try the mongodb library immediately, and report any issues to the NODE project.
Configuration
📅 Schedule: (UTC)
  • Branch creation

    • "after 11pm every weekend,before 8am every weekend"
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
@renovaterenovateBot
added

package:npm
Pull requests that update node.js deps
type:dependencies
Pull requests that update a dependency file
update:major
Major Updates of dependency
labels
Nov 22, 2025
@snyk-io
snyk-ioBot
commented
Nov 22, 2025•

edited

Loading

Copy link


Copy Markdown

✅ Snyk checks have passed. No issues have been found so far.
StatusScan Engine Critical High Medium LowTotal (0)
✅Open Source Security0000 0 issues
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.
@socket-security
socket-securityBot
commented
Nov 22, 2025•

edited

Loading

Copy link


Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.
DiffPackageSupply Chain
Security		VulnerabilityQualityMaintenanceLicense
Updatedmongodb@​6.20.0 ⏵ 7.5.089-510010098100
View full report
@renovate
renovateBotforce-pushed
the
renovate/mongodb-7.x
branch
from
c4c62f3 to
7255308CompareFebruary 2, 2026 21:06
@renovate
renovateBotforce-pushed
the
renovate/mongodb-7.x
branch
2 times, most recently
from
ab590d9 to
67ebaf8CompareFebruary 18, 2026 03:10
@renovate
renovateBotforce-pushed
the
renovate/mongodb-7.x
branch
from
67ebaf8 to
ebbc59fCompareApril 7, 2026 14:59
@renovate
renovateBotforce-pushed
the
renovate/mongodb-7.x
branch
from
ebbc59f to
a6c7dadCompareMay 4, 2026 19:52
@renovate
renovateBotforce-pushed
the
renovate/mongodb-7.x
branch
from
a6c7dad to
ed629f7CompareJune 23, 2026 19:38
@renovate
renovateBotforce-pushed
the
renovate/mongodb-7.x
branch
from
ed629f7 to
8fd7c45CompareJuly 9, 2026 22:01
@renovate
renovateBotforce-pushed
the
renovate/mongodb-7.x
branch
from
8fd7c45 to
64d701bCompareJuly 21, 2026 23:11
@renovate
renovateBotforce-pushed
the
renovate/mongodb-7.x
branch
from
64d701b to
4f6d117CompareJuly 30, 2026 17:15
@renovate
renovateBotforce-pushed
the
renovate/mongodb-7.x
branch
from
4f6d117 to
dca142aCompareAugust 11, 2026 22:31
@socket-security
socket-securityBot
commented
Aug 11, 2026•

edited

Loading

Copy link


Copy Markdown

Warning
Review the following alerts detected in dependencies.
According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
ActionSeverityAlert (click "▶" to expand/collapse)
WarnHigh
Publisher changed: npm @mongodb-js/saslprep is now published by devtools-npm-user
Author:devtools-npm-user
From:package.json → npm/mongodb@7.5.0 → npm/@mongodb-js/saslprep@1.4.13
ℹ Read more on: This package | This alert | What is unstable ownership?
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.

Suggestion: Try to reduce the number of authors you depend on to reduce the risk to malicious actors gaining access to your supply chain. Packages should remove inactive collaborators with publishing rights from packages on npm.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/@mongodb-js/saslprep@1.4.13. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.

View full report
@renovate
renovateBotforce-pushed
the
renovate/mongodb-7.x
branch
from
dca142a to
755c727CompareAugust 26, 2026 12:42
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels

package:npmPull requests that update node.js depstype:dependenciesPull requests that update a dependency fileupdate:majorMajor Updates of dependency

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
fix(deps): update dependency mongodb to v7 - #163
Open
renovate[bot] wants to merge 1 commit into
devfrom 
renovate/mongodb-7.x
Open
fix(deps): update dependency mongodb to v7#163
renovate[bot] wants to merge 1 commit into
devfrom 
renovate/mongodb-7.x
Conversation
@renovate
@renovaterenovateBot
commented
Nov 22, 2025•

edited

Loading

Copy link


Copy Markdown

Contributor
This PR contains the following updates:
PackageChangeAgeConfidence
mongodb^6.18.0 → ^7.0.0ageconfidence
Release Notes
mongodb/node-mongodb-native (mongodb)
v7.5.0
Compare Source
Features
  • NODE-7537: promote QE string queries (prefix/suffix/substring) (#​4996) (dc4900c)
Bug Fixes
v7.4.0
Compare Source
Features
  • NODE-7634: remove experimental tag from async dispose methods (#​4976) (43ce3eb)
  • NODE-7549: send afterClusterTime on writes in causally-consistent sessions (#​4963) (3abfd26)
v7.3.0
Compare Source
Features
Bug Fixes
  • NODE-7548: SCRAM authentication fails on non-Node runtimes (#​4932) (a10d2c9)
v7.2.0
Compare Source
Features
  • NODE-7142: Exponential backoff and jitter in retry loops (#​4871) (22c6031)
  • NODE-7315: Use BSON ByteUtils instead of Nodejs Buffer (#​4840) (1add538)
  • NODE-7335: Create dedicated mocha runner with isolated vm context (#​4876) (a4cba4c)
  • NODE-7379: Refactor Crypto to Web Crypto API (#​4862) (ac98f4a)
  • NODE-7385: add experimental os runtime adapter (#​4851) (d2ad07f)
  • NODE-7441: add ChangeStream.bufferedCount (#​4870) (f7ea421)
  • NODE-7452: restrict server deprioritization on replica sets to overload errors (#​4875) (87a3465)
  • NODE-7467: make token bucket optional in client backpressure (#​4878) (4fb0a0a)
  • NODE-7491: finalize client backpressure implementation for phase 1 rollout (#​4920) (2cc7983)
Bug Fixes
  • NODE-7430: throw timeout error when withTransaction retries exceed deadline (#​4897) (16a899d)
  • NODE-7459: explicitly call setKeepAlive and setNoDelay on socket (#​4879) (778a2a1)
  • NODE-7469: overload retry when retryReads/Writes=false (#​4888) (4157b26)
  • NODE-7478: OIDC host allowlist fix (#​4905) (f36b754)
v7.1.1
Compare Source
The MongoDB Node.js team is pleased to announce version 7.1.1 of the mongodb package!
Release Notes
Tighten OIDC ALLOWED_HOSTS wildcard matching
The OIDC ALLOWED_HOSTS wildcard handling has been fixed to require full subdomain/path matches for *. and */ entries, preventing partial suffix matches from being incorrectly accepted.
Fixed TCP keep-alive and no-delay settings not being applied on TLS connections
Due to a Node.js bug, tls.connect() silently ignores keepAlive, keepAliveInitialDelay, and noDelay options passed through its constructor. This could cause idle connections - particularly through cloud load balancers like Azure (240s idle timeout) or AWS PrivateLink/NLB - to be dropped unexpectedly due to missing TCP keep-alive probes.
The driver now explicitly calls setKeepAlive() and setNoDelay() on the socket after creation, ensuring these settings are always applied regardless of whether TLS is used.
Bug Fixes
Documentation
We invite you to try the mongodb library immediately, and report any issues to the NODE project.
v7.1.0
Compare Source
Features
  • NODE-5393: aws4 no longer required for AWS authentication (#​4824) (0f46db8)
  • NODE-7121: prevent connection churn on backpressure errors when establishing connections (#​4800) (4cb2b87)
  • NODE-7122: exponential backoff between retries in convenient transaction API (#​4765) (e70fdc9)
  • NODE-7304: remove usages in src of promisify (#​4799) (761b9bf)
  • NODE-7306: Replace global process with import node:process (#​4820) (cc503cb)
  • NODE-7310: Replace process.arch with os.arch() (#​4823) (f0af829)
  • NODE-7311: Replace process.platform with os.platform() (#​4822) (c58ca1f)
  • NODE-7317: use BSON.NumberUtils to determine endianness (#​4808) (4e9467e)
  • NODE-7319: update allowed hosts list with *.mongo.com (#​4802) (bfb7160)
  • NODE-7330: deprecate RenameCollectionOptions.new_collection (#​4815) (a96fa26)
  • NODE-7333: add support for deprioritized servers to all topologies (#​4821) (a4211e7)
Bug Fixes
  • NODE-7290: use valueof for error code check (#​4791) (1cc3d1c)
  • NODE-7298: ensure commonWireVersion is computed from server maxWireVersion (#​4805) (2b2366d)
  • NODE-7307: Replace node:process.hrtime() with performance.now() (#​4816) (ae2e037)
  • NODE-7308: replace process.nextTick with queueMicrotask (#​4817) (b1b6e81)
v7.0.0
Compare Source
⚠ BREAKING CHANGES
  • NODE-7259: use alphas of all supporting packages (#​4746)
  • NODE-5510: dont filter change stream options (#​4723)
  • NODE-6296: remove cursor default batch size of 1000 (#​4729)
  • NODE-7150: update peer dependency matrix for 3rd party peer deps (#​4720)
  • NODE-7046: remove AWS uri/options support (#​4689)
  • NODE-4808: remove support for stream() transform on cursors and change streams (#​4728)
  • NODE-6377: remove noResponse option (#​4724)
  • NODE-6473: remove MONGODB-CR auth (#​4717)
  • NODE-5994: Remove metadata-related properties from public driver API (#​4716)
  • NODE-7016: remove beta namespace and move resource management into driver (#​4719)
  • NODE-4184: don't throw on aggregate with write concern and explain (#​4718)
  • NODE-7043, NODE-7217: adopt mongodb-client-encryption v7 (#​4705)
  • NODE-6065: throw MongoRuntimeError instead of MissingDependencyError in crypto connection (#​4711)
  • NODE-6584: improve typing for filepaths in AutoEncryptionOptions (#​4341)
  • NODE-6334: rename PoolRequstedRetry to PoolRequestedRetry (#​4696)
  • NODE-7174: drop support for Node16 and Node18 (#​4668)
  • NODE-7047: use custom credential provider first after URI (#​4656)
  • NODE-6988: require aws sdk for aws auth (#​4659)
Features
Bug Fixes
  • NODE-7067: Wrap socket write in a try/catch to ensure errors can be properly wrapped (#​4759) (66c18b7)
  • NODE-7232: only send endSessions during client close if the topology supports sessions (#​4722) (cc85ebf)
  • NODE-7247: clarify #rewrapManyDataKey() parameter types (#​4760) (cb522bf)
  • NODE-7270: remove extra BSONType file in docs/Next/variables (#​4754) (df3aaaa)
v6.21.0
Compare Source
The MongoDB Node.js team is pleased to announce version 6.21.0 of the mongodb package!
Release Notes
Deprecated items to be removed in 7.0.0
The following items have been deprecated and will be removed in 7.0.0:
MongoCredentials.authMechanismProperties.AWS_SESSION_TOKEN// URI & client options for AWS variables will no longer be respectedCommandOptions.noResponse// UnusedConnectionOptions.cancellationToken// UnusedCursorStreamOptions// Only option, transform, removed in favor of Stream#map
Features
  • NODE-7230: add deprecations of items to be removed in v7 (#​4774) (5104c0f)
Documentation
We invite you to try the mongodb library immediately, and report any issues to the NODE project.
Configuration
📅 Schedule: (UTC)
  • Branch creation

    • "after 11pm every weekend,before 8am every weekend"
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
@renovaterenovateBot
added

package:npm
Pull requests that update node.js deps
type:dependencies
Pull requests that update a dependency file
update:major
Major Updates of dependency
labels
Nov 22, 2025
@snyk-io
snyk-ioBot
commented
Nov 22, 2025•

edited

Loading

Copy link


Copy Markdown

✅ Snyk checks have passed. No issues have been found so far.
StatusScan Engine Critical High Medium LowTotal (0)
✅Open Source Security0000 0 issues
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.
@socket-security
socket-securityBot
commented
Nov 22, 2025•

edited

Loading

Copy link


Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.
DiffPackageSupply Chain
Security		VulnerabilityQualityMaintenanceLicense
Updatedmongodb@​6.20.0 ⏵ 7.5.089-510010098100
View full report
@renovate
renovateBotforce-pushed
the
renovate/mongodb-7.x
branch
from
c4c62f3 to
7255308CompareFebruary 2, 2026 21:06
@renovate
renovateBotforce-pushed
the
renovate/mongodb-7.x
branch
2 times, most recently
from
ab590d9 to
67ebaf8CompareFebruary 18, 2026 03:10
@renovate
renovateBotforce-pushed
the
renovate/mongodb-7.x
branch
from
67ebaf8 to
ebbc59fCompareApril 7, 2026 14:59
@renovate
renovateBotforce-pushed
the
renovate/mongodb-7.x
branch
from
ebbc59f to
a6c7dadCompareMay 4, 2026 19:52
@renovate
renovateBotforce-pushed
the
renovate/mongodb-7.x
branch
from
a6c7dad to
ed629f7CompareJune 23, 2026 19:38
@renovate
renovateBotforce-pushed
the
renovate/mongodb-7.x
branch
from
ed629f7 to
8fd7c45CompareJuly 9, 2026 22:01
@renovate
renovateBotforce-pushed
the
renovate/mongodb-7.x
branch
from
8fd7c45 to
64d701bCompareJuly 21, 2026 23:11
@renovate
renovateBotforce-pushed
the
renovate/mongodb-7.x
branch
from
64d701b to
4f6d117CompareJuly 30, 2026 17:15
@renovate
renovateBotforce-pushed
the
renovate/mongodb-7.x
branch
from
4f6d117 to
dca142aCompareAugust 11, 2026 22:31
@socket-security
socket-securityBot
commented
Aug 11, 2026•

edited

Loading

Copy link


Copy Markdown

Warning
Review the following alerts detected in dependencies.
According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
ActionSeverityAlert (click "▶" to expand/collapse)
WarnHigh
Publisher changed: npm @mongodb-js/saslprep is now published by devtools-npm-user
Author:devtools-npm-user
From:package.json → npm/mongodb@7.5.0 → npm/@mongodb-js/saslprep@1.4.13
ℹ Read more on: This package | This alert | What is unstable ownership?
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.

Suggestion: Try to reduce the number of authors you depend on to reduce the risk to malicious actors gaining access to your supply chain. Packages should remove inactive collaborators with publishing rights from packages on npm.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/@mongodb-js/saslprep@1.4.13. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.

View full report
@renovate
renovateBotforce-pushed
the
renovate/mongodb-7.x
branch
from
dca142a to
755c727CompareAugust 26, 2026 12:42
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels

package:npmPull requests that update node.js depstype:dependenciesPull requests that update a dependency fileupdate:majorMajor Updates of dependency

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
fix(deps): update dependency mongodb to v7 - #163
Open
renovate[bot] wants to merge 1 commit into
devfrom 
renovate/mongodb-7.x
Open
fix(deps): update dependency mongodb to v7#163
renovate[bot] wants to merge 1 commit into
devfrom 
renovate/mongodb-7.x
Conversation
@renovate
@renovaterenovateBot
commented
Nov 22, 2025•

edited

Loading

Copy link


Copy Markdown

Contributor
This PR contains the following updates:
PackageChangeAgeConfidence
mongodb^6.18.0 → ^7.0.0ageconfidence
Release Notes
mongodb/node-mongodb-native (mongodb)
v7.5.0
Compare Source
Features
  • NODE-7537: promote QE string queries (prefix/suffix/substring) (#​4996) (dc4900c)
Bug Fixes
v7.4.0
Compare Source
Features
  • NODE-7634: remove experimental tag from async dispose methods (#​4976) (43ce3eb)
  • NODE-7549: send afterClusterTime on writes in causally-consistent sessions (#​4963) (3abfd26)
v7.3.0
Compare Source
Features
Bug Fixes
  • NODE-7548: SCRAM authentication fails on non-Node runtimes (#​4932) (a10d2c9)
v7.2.0
Compare Source
Features
  • NODE-7142: Exponential backoff and jitter in retry loops (#​4871) (22c6031)
  • NODE-7315: Use BSON ByteUtils instead of Nodejs Buffer (#​4840) (1add538)
  • NODE-7335: Create dedicated mocha runner with isolated vm context (#​4876) (a4cba4c)
  • NODE-7379: Refactor Crypto to Web Crypto API (#​4862) (ac98f4a)
  • NODE-7385: add experimental os runtime adapter (#​4851) (d2ad07f)
  • NODE-7441: add ChangeStream.bufferedCount (#​4870) (f7ea421)
  • NODE-7452: restrict server deprioritization on replica sets to overload errors (#​4875) (87a3465)
  • NODE-7467: make token bucket optional in client backpressure (#​4878) (4fb0a0a)
  • NODE-7491: finalize client backpressure implementation for phase 1 rollout (#​4920) (2cc7983)
Bug Fixes
  • NODE-7430: throw timeout error when withTransaction retries exceed deadline (#​4897) (16a899d)
  • NODE-7459: explicitly call setKeepAlive and setNoDelay on socket (#​4879) (778a2a1)
  • NODE-7469: overload retry when retryReads/Writes=false (#​4888) (4157b26)
  • NODE-7478: OIDC host allowlist fix (#​4905) (f36b754)
v7.1.1
Compare Source
The MongoDB Node.js team is pleased to announce version 7.1.1 of the mongodb package!
Release Notes
Tighten OIDC ALLOWED_HOSTS wildcard matching
The OIDC ALLOWED_HOSTS wildcard handling has been fixed to require full subdomain/path matches for *. and */ entries, preventing partial suffix matches from being incorrectly accepted.
Fixed TCP keep-alive and no-delay settings not being applied on TLS connections
Due to a Node.js bug, tls.connect() silently ignores keepAlive, keepAliveInitialDelay, and noDelay options passed through its constructor. This could cause idle connections - particularly through cloud load balancers like Azure (240s idle timeout) or AWS PrivateLink/NLB - to be dropped unexpectedly due to missing TCP keep-alive probes.
The driver now explicitly calls setKeepAlive() and setNoDelay() on the socket after creation, ensuring these settings are always applied regardless of whether TLS is used.
Bug Fixes
Documentation
We invite you to try the mongodb library immediately, and report any issues to the NODE project.
v7.1.0
Compare Source
Features
  • NODE-5393: aws4 no longer required for AWS authentication (#​4824) (0f46db8)
  • NODE-7121: prevent connection churn on backpressure errors when establishing connections (#​4800) (4cb2b87)
  • NODE-7122: exponential backoff between retries in convenient transaction API (#​4765) (e70fdc9)
  • NODE-7304: remove usages in src of promisify (#​4799) (761b9bf)
  • NODE-7306: Replace global process with import node:process (#​4820) (cc503cb)
  • NODE-7310: Replace process.arch with os.arch() (#​4823) (f0af829)
  • NODE-7311: Replace process.platform with os.platform() (#​4822) (c58ca1f)
  • NODE-7317: use BSON.NumberUtils to determine endianness (#​4808) (4e9467e)
  • NODE-7319: update allowed hosts list with *.mongo.com (#​4802) (bfb7160)
  • NODE-7330: deprecate RenameCollectionOptions.new_collection (#​4815) (a96fa26)
  • NODE-7333: add support for deprioritized servers to all topologies (#​4821) (a4211e7)
Bug Fixes
  • NODE-7290: use valueof for error code check (#​4791) (1cc3d1c)
  • NODE-7298: ensure commonWireVersion is computed from server maxWireVersion (#​4805) (2b2366d)
  • NODE-7307: Replace node:process.hrtime() with performance.now() (#​4816) (ae2e037)
  • NODE-7308: replace process.nextTick with queueMicrotask (#​4817) (b1b6e81)
v7.0.0
Compare Source
⚠ BREAKING CHANGES
  • NODE-7259: use alphas of all supporting packages (#​4746)
  • NODE-5510: dont filter change stream options (#​4723)
  • NODE-6296: remove cursor default batch size of 1000 (#​4729)
  • NODE-7150: update peer dependency matrix for 3rd party peer deps (#​4720)
  • NODE-7046: remove AWS uri/options support (#​4689)
  • NODE-4808: remove support for stream() transform on cursors and change streams (#​4728)
  • NODE-6377: remove noResponse option (#​4724)
  • NODE-6473: remove MONGODB-CR auth (#​4717)
  • NODE-5994: Remove metadata-related properties from public driver API (#​4716)
  • NODE-7016: remove beta namespace and move resource management into driver (#​4719)
  • NODE-4184: don't throw on aggregate with write concern and explain (#​4718)
  • NODE-7043, NODE-7217: adopt mongodb-client-encryption v7 (#​4705)
  • NODE-6065: throw MongoRuntimeError instead of MissingDependencyError in crypto connection (#​4711)
  • NODE-6584: improve typing for filepaths in AutoEncryptionOptions (#​4341)
  • NODE-6334: rename PoolRequstedRetry to PoolRequestedRetry (#​4696)
  • NODE-7174: drop support for Node16 and Node18 (#​4668)
  • NODE-7047: use custom credential provider first after URI (#​4656)
  • NODE-6988: require aws sdk for aws auth (#​4659)
Features
Bug Fixes
  • NODE-7067: Wrap socket write in a try/catch to ensure errors can be properly wrapped (#​4759) (66c18b7)
  • NODE-7232: only send endSessions during client close if the topology supports sessions (#​4722) (cc85ebf)
  • NODE-7247: clarify #rewrapManyDataKey() parameter types (#​4760) (cb522bf)
  • NODE-7270: remove extra BSONType file in docs/Next/variables (#​4754) (df3aaaa)
v6.21.0
Compare Source
The MongoDB Node.js team is pleased to announce version 6.21.0 of the mongodb package!
Release Notes
Deprecated items to be removed in 7.0.0
The following items have been deprecated and will be removed in 7.0.0:
MongoCredentials.authMechanismProperties.AWS_SESSION_TOKEN// URI & client options for AWS variables will no longer be respectedCommandOptions.noResponse// UnusedConnectionOptions.cancellationToken// UnusedCursorStreamOptions// Only option, transform, removed in favor of Stream#map
Features
  • NODE-7230: add deprecations of items to be removed in v7 (#​4774) (5104c0f)
Documentation
We invite you to try the mongodb library immediately, and report any issues to the NODE project.
Configuration
📅 Schedule: (UTC)
  • Branch creation

    • "after 11pm every weekend,before 8am every weekend"
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
@renovaterenovateBot
added

package:npm
Pull requests that update node.js deps
type:dependencies
Pull requests that update a dependency file
update:major
Major Updates of dependency
labels
Nov 22, 2025
@snyk-io
snyk-ioBot
commented
Nov 22, 2025•

edited

Loading

Copy link


Copy Markdown

✅ Snyk checks have passed. No issues have been found so far.
StatusScan Engine Critical High Medium LowTotal (0)
✅Open Source Security0000 0 issues
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.
@socket-security
socket-securityBot
commented
Nov 22, 2025•

edited

Loading

Copy link


Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.
DiffPackageSupply Chain
Security		VulnerabilityQualityMaintenanceLicense
Updatedmongodb@​6.20.0 ⏵ 7.5.089-510010098100
View full report
@renovate
renovateBotforce-pushed
the
renovate/mongodb-7.x
branch
from
c4c62f3 to
7255308CompareFebruary 2, 2026 21:06
@renovate
renovateBotforce-pushed
the
renovate/mongodb-7.x
branch
2 times, most recently
from
ab590d9 to
67ebaf8CompareFebruary 18, 2026 03:10
@renovate
renovateBotforce-pushed
the
renovate/mongodb-7.x
branch
from
67ebaf8 to
ebbc59fCompareApril 7, 2026 14:59
@renovate
renovateBotforce-pushed
the
renovate/mongodb-7.x
branch
from
ebbc59f to
a6c7dadCompareMay 4, 2026 19:52
@renovate
renovateBotforce-pushed
the
renovate/mongodb-7.x
branch
from
a6c7dad to
ed629f7CompareJune 23, 2026 19:38
@renovate
renovateBotforce-pushed
the
renovate/mongodb-7.x
branch
from
ed629f7 to
8fd7c45CompareJuly 9, 2026 22:01
@renovate
renovateBotforce-pushed
the
renovate/mongodb-7.x
branch
from
8fd7c45 to
64d701bCompareJuly 21, 2026 23:11
@renovate
renovateBotforce-pushed
the
renovate/mongodb-7.x
branch
from
64d701b to
4f6d117CompareJuly 30, 2026 17:15
@renovate
renovateBotforce-pushed
the
renovate/mongodb-7.x
branch
from
4f6d117 to
dca142aCompareAugust 11, 2026 22:31
@socket-security
socket-securityBot
commented
Aug 11, 2026•

edited

Loading

Copy link


Copy Markdown

Warning
Review the following alerts detected in dependencies.
According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
ActionSeverityAlert (click "▶" to expand/collapse)
WarnHigh
Publisher changed: npm @mongodb-js/saslprep is now published by devtools-npm-user
Author:devtools-npm-user
From:package.json → npm/mongodb@7.5.0 → npm/@mongodb-js/saslprep@1.4.13
ℹ Read more on: This package | This alert | What is unstable ownership?
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.

Suggestion: Try to reduce the number of authors you depend on to reduce the risk to malicious actors gaining access to your supply chain. Packages should remove inactive collaborators with publishing rights from packages on npm.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/@mongodb-js/saslprep@1.4.13. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.

View full report
@renovate
renovateBotforce-pushed
the
renovate/mongodb-7.x
branch
from
dca142a to
755c727CompareAugust 26, 2026 12:42
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels

package:npmPull requests that update node.js depstype:dependenciesPull requests that update a dependency fileupdate:majorMajor Updates of dependency

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
fix(deps): update dependency mongodb to v7 - #163
Open
renovate[bot] wants to merge 1 commit into
devfrom 
renovate/mongodb-7.x
Open
fix(deps): update dependency mongodb to v7#163
renovate[bot] wants to merge 1 commit into
devfrom 
renovate/mongodb-7.x
Conversation
@renovate
@renovaterenovateBot
commented
Nov 22, 2025•

edited

Loading

Copy link


Copy Markdown

Contributor
This PR contains the following updates:
PackageChangeAgeConfidence
mongodb^6.18.0 → ^7.0.0ageconfidence
Release Notes
mongodb/node-mongodb-native (mongodb)
v7.5.0
Compare Source
Features
  • NODE-7537: promote QE string queries (prefix/suffix/substring) (#​4996) (dc4900c)
Bug Fixes
v7.4.0
Compare Source
Features
  • NODE-7634: remove experimental tag from async dispose methods (#​4976) (43ce3eb)
  • NODE-7549: send afterClusterTime on writes in causally-consistent sessions (#​4963) (3abfd26)
v7.3.0
Compare Source
Features
Bug Fixes
  • NODE-7548: SCRAM authentication fails on non-Node runtimes (#​4932) (a10d2c9)
v7.2.0
Compare Source
Features
  • NODE-7142: Exponential backoff and jitter in retry loops (#​4871) (22c6031)
  • NODE-7315: Use BSON ByteUtils instead of Nodejs Buffer (#​4840) (1add538)
  • NODE-7335: Create dedicated mocha runner with isolated vm context (#​4876) (a4cba4c)
  • NODE-7379: Refactor Crypto to Web Crypto API (#​4862) (ac98f4a)
  • NODE-7385: add experimental os runtime adapter (#​4851) (d2ad07f)
  • NODE-7441: add ChangeStream.bufferedCount (#​4870) (f7ea421)
  • NODE-7452: restrict server deprioritization on replica sets to overload errors (#​4875) (87a3465)
  • NODE-7467: make token bucket optional in client backpressure (#​4878) (4fb0a0a)
  • NODE-7491: finalize client backpressure implementation for phase 1 rollout (#​4920) (2cc7983)
Bug Fixes
  • NODE-7430: throw timeout error when withTransaction retries exceed deadline (#​4897) (16a899d)
  • NODE-7459: explicitly call setKeepAlive and setNoDelay on socket (#​4879) (778a2a1)
  • NODE-7469: overload retry when retryReads/Writes=false (#​4888) (4157b26)
  • NODE-7478: OIDC host allowlist fix (#​4905) (f36b754)
v7.1.1
Compare Source
The MongoDB Node.js team is pleased to announce version 7.1.1 of the mongodb package!
Release Notes
Tighten OIDC ALLOWED_HOSTS wildcard matching
The OIDC ALLOWED_HOSTS wildcard handling has been fixed to require full subdomain/path matches for *. and */ entries, preventing partial suffix matches from being incorrectly accepted.
Fixed TCP keep-alive and no-delay settings not being applied on TLS connections
Due to a Node.js bug, tls.connect() silently ignores keepAlive, keepAliveInitialDelay, and noDelay options passed through its constructor. This could cause idle connections - particularly through cloud load balancers like Azure (240s idle timeout) or AWS PrivateLink/NLB - to be dropped unexpectedly due to missing TCP keep-alive probes.
The driver now explicitly calls setKeepAlive() and setNoDelay() on the socket after creation, ensuring these settings are always applied regardless of whether TLS is used.
Bug Fixes
Documentation
We invite you to try the mongodb library immediately, and report any issues to the NODE project.
v7.1.0
Compare Source
Features
  • NODE-5393: aws4 no longer required for AWS authentication (#​4824) (0f46db8)
  • NODE-7121: prevent connection churn on backpressure errors when establishing connections (#​4800) (4cb2b87)
  • NODE-7122: exponential backoff between retries in convenient transaction API (#​4765) (e70fdc9)
  • NODE-7304: remove usages in src of promisify (#​4799) (761b9bf)
  • NODE-7306: Replace global process with import node:process (#​4820) (cc503cb)
  • NODE-7310: Replace process.arch with os.arch() (#​4823) (f0af829)
  • NODE-7311: Replace process.platform with os.platform() (#​4822) (c58ca1f)
  • NODE-7317: use BSON.NumberUtils to determine endianness (#​4808) (4e9467e)
  • NODE-7319: update allowed hosts list with *.mongo.com (#​4802) (bfb7160)
  • NODE-7330: deprecate RenameCollectionOptions.new_collection (#​4815) (a96fa26)
  • NODE-7333: add support for deprioritized servers to all topologies (#​4821) (a4211e7)
Bug Fixes
  • NODE-7290: use valueof for error code check (#​4791) (1cc3d1c)
  • NODE-7298: ensure commonWireVersion is computed from server maxWireVersion (#​4805) (2b2366d)
  • NODE-7307: Replace node:process.hrtime() with performance.now() (#​4816) (ae2e037)
  • NODE-7308: replace process.nextTick with queueMicrotask (#​4817) (b1b6e81)
v7.0.0
Compare Source
⚠ BREAKING CHANGES
  • NODE-7259: use alphas of all supporting packages (#​4746)
  • NODE-5510: dont filter change stream options (#​4723)
  • NODE-6296: remove cursor default batch size of 1000 (#​4729)
  • NODE-7150: update peer dependency matrix for 3rd party peer deps (#​4720)
  • NODE-7046: remove AWS uri/options support (#​4689)
  • NODE-4808: remove support for stream() transform on cursors and change streams (#​4728)
  • NODE-6377: remove noResponse option (#​4724)
  • NODE-6473: remove MONGODB-CR auth (#​4717)
  • NODE-5994: Remove metadata-related properties from public driver API (#​4716)
  • NODE-7016: remove beta namespace and move resource management into driver (#​4719)
  • NODE-4184: don't throw on aggregate with write concern and explain (#​4718)
  • NODE-7043, NODE-7217: adopt mongodb-client-encryption v7 (#​4705)
  • NODE-6065: throw MongoRuntimeError instead of MissingDependencyError in crypto connection (#​4711)
  • NODE-6584: improve typing for filepaths in AutoEncryptionOptions (#​4341)
  • NODE-6334: rename PoolRequstedRetry to PoolRequestedRetry (#​4696)
  • NODE-7174: drop support for Node16 and Node18 (#​4668)
  • NODE-7047: use custom credential provider first after URI (#​4656)
  • NODE-6988: require aws sdk for aws auth (#​4659)
Features
Bug Fixes
  • NODE-7067: Wrap socket write in a try/catch to ensure errors can be properly wrapped (#​4759) (66c18b7)
  • NODE-7232: only send endSessions during client close if the topology supports sessions (#​4722) (cc85ebf)
  • NODE-7247: clarify #rewrapManyDataKey() parameter types (#​4760) (cb522bf)
  • NODE-7270: remove extra BSONType file in docs/Next/variables (#​4754) (df3aaaa)
v6.21.0
Compare Source
The MongoDB Node.js team is pleased to announce version 6.21.0 of the mongodb package!
Release Notes
Deprecated items to be removed in 7.0.0
The following items have been deprecated and will be removed in 7.0.0:
MongoCredentials.authMechanismProperties.AWS_SESSION_TOKEN// URI & client options for AWS variables will no longer be respectedCommandOptions.noResponse// UnusedConnectionOptions.cancellationToken// UnusedCursorStreamOptions// Only option, transform, removed in favor of Stream#map
Features
  • NODE-7230: add deprecations of items to be removed in v7 (#​4774) (5104c0f)
Documentation
We invite you to try the mongodb library immediately, and report any issues to the NODE project.
Configuration
📅 Schedule: (UTC)
  • Branch creation

    • "after 11pm every weekend,before 8am every weekend"
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
@renovaterenovateBot
added

package:npm
Pull requests that update node.js deps
type:dependencies
Pull requests that update a dependency file
update:major
Major Updates of dependency
labels
Nov 22, 2025
@snyk-io
snyk-ioBot
commented
Nov 22, 2025•

edited

Loading

Copy link


Copy Markdown

✅ Snyk checks have passed. No issues have been found so far.
StatusScan Engine Critical High Medium LowTotal (0)
✅Open Source Security0000 0 issues
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.
@socket-security
socket-securityBot
commented
Nov 22, 2025•

edited

Loading

Copy link


Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.
DiffPackageSupply Chain
Security		VulnerabilityQualityMaintenanceLicense
Updatedmongodb@​6.20.0 ⏵ 7.5.089-510010098100
View full report
@renovate
renovateBotforce-pushed
the
renovate/mongodb-7.x
branch
from
c4c62f3 to
7255308CompareFebruary 2, 2026 21:06
@renovate
renovateBotforce-pushed
the
renovate/mongodb-7.x
branch
2 times, most recently
from
ab590d9 to
67ebaf8CompareFebruary 18, 2026 03:10
@renovate
renovateBotforce-pushed
the
renovate/mongodb-7.x
branch
from
67ebaf8 to
ebbc59fCompareApril 7, 2026 14:59
@renovate
renovateBotforce-pushed
the
renovate/mongodb-7.x
branch
from
ebbc59f to
a6c7dadCompareMay 4, 2026 19:52
@renovate
renovateBotforce-pushed
the
renovate/mongodb-7.x
branch
from
a6c7dad to
ed629f7CompareJune 23, 2026 19:38
@renovate
renovateBotforce-pushed
the
renovate/mongodb-7.x
branch
from
ed629f7 to
8fd7c45CompareJuly 9, 2026 22:01
@renovate
renovateBotforce-pushed
the
renovate/mongodb-7.x
branch
from
8fd7c45 to
64d701bCompareJuly 21, 2026 23:11
@renovate
renovateBotforce-pushed
the
renovate/mongodb-7.x
branch
from
64d701b to
4f6d117CompareJuly 30, 2026 17:15
@renovate
renovateBotforce-pushed
the
renovate/mongodb-7.x
branch
from
4f6d117 to
dca142aCompareAugust 11, 2026 22:31
@socket-security
socket-securityBot
commented
Aug 11, 2026•

edited

Loading

Copy link


Copy Markdown

Warning
Review the following alerts detected in dependencies.
According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
ActionSeverityAlert (click "▶" to expand/collapse)
WarnHigh
Publisher changed: npm @mongodb-js/saslprep is now published by devtools-npm-user
Author:devtools-npm-user
From:package.json → npm/mongodb@7.5.0 → npm/@mongodb-js/saslprep@1.4.13
ℹ Read more on: This package | This alert | What is unstable ownership?
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.

Suggestion: Try to reduce the number of authors you depend on to reduce the risk to malicious actors gaining access to your supply chain. Packages should remove inactive collaborators with publishing rights from packages on npm.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/@mongodb-js/saslprep@1.4.13. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.

View full report
@renovate
renovateBotforce-pushed
the
renovate/mongodb-7.x
branch
from
dca142a to
755c727CompareAugust 26, 2026 12:42
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels

package:npmPull requests that update node.js depstype:dependenciesPull requests that update a dependency fileupdate:majorMajor Updates of dependency

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
fix(deps): update dependency mongodb to v7 - #163
Open
renovate[bot] wants to merge 1 commit into
devfrom 
renovate/mongodb-7.x
Open
fix(deps): update dependency mongodb to v7#163
renovate[bot] wants to merge 1 commit into
devfrom 
renovate/mongodb-7.x
Conversation
@renovate
@renovaterenovateBot
commented
Nov 22, 2025•

edited

Loading

Copy link


Copy Markdown

Contributor
This PR contains the following updates:
PackageChangeAgeConfidence
mongodb^6.18.0 → ^7.0.0ageconfidence
Release Notes
mongodb/node-mongodb-native (mongodb)
v7.5.0
Compare Source
Features
  • NODE-7537: promote QE string queries (prefix/suffix/substring) (#​4996) (dc4900c)
Bug Fixes
v7.4.0
Compare Source
Features
  • NODE-7634: remove experimental tag from async dispose methods (#​4976) (43ce3eb)
  • NODE-7549: send afterClusterTime on writes in causally-consistent sessions (#​4963) (3abfd26)
v7.3.0
Compare Source
Features
Bug Fixes
  • NODE-7548: SCRAM authentication fails on non-Node runtimes (#​4932) (a10d2c9)
v7.2.0
Compare Source
Features
  • NODE-7142: Exponential backoff and jitter in retry loops (#​4871) (22c6031)
  • NODE-7315: Use BSON ByteUtils instead of Nodejs Buffer (#​4840) (1add538)
  • NODE-7335: Create dedicated mocha runner with isolated vm context (#​4876) (a4cba4c)
  • NODE-7379: Refactor Crypto to Web Crypto API (#​4862) (ac98f4a)
  • NODE-7385: add experimental os runtime adapter (#​4851) (d2ad07f)
  • NODE-7441: add ChangeStream.bufferedCount (#​4870) (f7ea421)
  • NODE-7452: restrict server deprioritization on replica sets to overload errors (#​4875) (87a3465)
  • NODE-7467: make token bucket optional in client backpressure (#​4878) (4fb0a0a)
  • NODE-7491: finalize client backpressure implementation for phase 1 rollout (#​4920) (2cc7983)
Bug Fixes
  • NODE-7430: throw timeout error when withTransaction retries exceed deadline (#​4897) (16a899d)
  • NODE-7459: explicitly call setKeepAlive and setNoDelay on socket (#​4879) (778a2a1)
  • NODE-7469: overload retry when retryReads/Writes=false (#​4888) (4157b26)
  • NODE-7478: OIDC host allowlist fix (#​4905) (f36b754)
v7.1.1
Compare Source
The MongoDB Node.js team is pleased to announce version 7.1.1 of the mongodb package!
Release Notes
Tighten OIDC ALLOWED_HOSTS wildcard matching
The OIDC ALLOWED_HOSTS wildcard handling has been fixed to require full subdomain/path matches for *. and */ entries, preventing partial suffix matches from being incorrectly accepted.
Fixed TCP keep-alive and no-delay settings not being applied on TLS connections
Due to a Node.js bug, tls.connect() silently ignores keepAlive, keepAliveInitialDelay, and noDelay options passed through its constructor. This could cause idle connections - particularly through cloud load balancers like Azure (240s idle timeout) or AWS PrivateLink/NLB - to be dropped unexpectedly due to missing TCP keep-alive probes.
The driver now explicitly calls setKeepAlive() and setNoDelay() on the socket after creation, ensuring these settings are always applied regardless of whether TLS is used.
Bug Fixes
Documentation
We invite you to try the mongodb library immediately, and report any issues to the NODE project.
v7.1.0
Compare Source
Features
  • NODE-5393: aws4 no longer required for AWS authentication (#​4824) (0f46db8)
  • NODE-7121: prevent connection churn on backpressure errors when establishing connections (#​4800) (4cb2b87)
  • NODE-7122: exponential backoff between retries in convenient transaction API (#​4765) (e70fdc9)
  • NODE-7304: remove usages in src of promisify (#​4799) (761b9bf)
  • NODE-7306: Replace global process with import node:process (#​4820) (cc503cb)
  • NODE-7310: Replace process.arch with os.arch() (#​4823) (f0af829)
  • NODE-7311: Replace process.platform with os.platform() (#​4822) (c58ca1f)
  • NODE-7317: use BSON.NumberUtils to determine endianness (#​4808) (4e9467e)
  • NODE-7319: update allowed hosts list with *.mongo.com (#​4802) (bfb7160)
  • NODE-7330: deprecate RenameCollectionOptions.new_collection (#​4815) (a96fa26)
  • NODE-7333: add support for deprioritized servers to all topologies (#​4821) (a4211e7)
Bug Fixes
  • NODE-7290: use valueof for error code check (#​4791) (1cc3d1c)
  • NODE-7298: ensure commonWireVersion is computed from server maxWireVersion (#​4805) (2b2366d)
  • NODE-7307: Replace node:process.hrtime() with performance.now() (#​4816) (ae2e037)
  • NODE-7308: replace process.nextTick with queueMicrotask (#​4817) (b1b6e81)
v7.0.0
Compare Source
⚠ BREAKING CHANGES
  • NODE-7259: use alphas of all supporting packages (#​4746)
  • NODE-5510: dont filter change stream options (#​4723)
  • NODE-6296: remove cursor default batch size of 1000 (#​4729)
  • NODE-7150: update peer dependency matrix for 3rd party peer deps (#​4720)
  • NODE-7046: remove AWS uri/options support (#​4689)
  • NODE-4808: remove support for stream() transform on cursors and change streams (#​4728)
  • NODE-6377: remove noResponse option (#​4724)
  • NODE-6473: remove MONGODB-CR auth (#​4717)
  • NODE-5994: Remove metadata-related properties from public driver API (#​4716)
  • NODE-7016: remove beta namespace and move resource management into driver (#​4719)
  • NODE-4184: don't throw on aggregate with write concern and explain (#​4718)
  • NODE-7043, NODE-7217: adopt mongodb-client-encryption v7 (#​4705)
  • NODE-6065: throw MongoRuntimeError instead of MissingDependencyError in crypto connection (#​4711)
  • NODE-6584: improve typing for filepaths in AutoEncryptionOptions (#​4341)
  • NODE-6334: rename PoolRequstedRetry to PoolRequestedRetry (#​4696)
  • NODE-7174: drop support for Node16 and Node18 (#​4668)
  • NODE-7047: use custom credential provider first after URI (#​4656)
  • NODE-6988: require aws sdk for aws auth (#​4659)
Features
Bug Fixes
  • NODE-7067: Wrap socket write in a try/catch to ensure errors can be properly wrapped (#​4759) (66c18b7)
  • NODE-7232: only send endSessions during client close if the topology supports sessions (#​4722) (cc85ebf)
  • NODE-7247: clarify #rewrapManyDataKey() parameter types (#​4760) (cb522bf)
  • NODE-7270: remove extra BSONType file in docs/Next/variables (#​4754) (df3aaaa)
v6.21.0
Compare Source
The MongoDB Node.js team is pleased to announce version 6.21.0 of the mongodb package!
Release Notes
Deprecated items to be removed in 7.0.0
The following items have been deprecated and will be removed in 7.0.0:
MongoCredentials.authMechanismProperties.AWS_SESSION_TOKEN// URI & client options for AWS variables will no longer be respectedCommandOptions.noResponse// UnusedConnectionOptions.cancellationToken// UnusedCursorStreamOptions// Only option, transform, removed in favor of Stream#map
Features
  • NODE-7230: add deprecations of items to be removed in v7 (#​4774) (5104c0f)
Documentation
We invite you to try the mongodb library immediately, and report any issues to the NODE project.
Configuration
📅 Schedule: (UTC)
  • Branch creation

    • "after 11pm every weekend,before 8am every weekend"
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
@renovaterenovateBot
added

package:npm
Pull requests that update node.js deps
type:dependencies
Pull requests that update a dependency file
update:major
Major Updates of dependency
labels
Nov 22, 2025
@snyk-io
snyk-ioBot
commented
Nov 22, 2025•

edited

Loading

Copy link


Copy Markdown

✅ Snyk checks have passed. No issues have been found so far.
StatusScan Engine Critical High Medium LowTotal (0)
✅Open Source Security0000 0 issues
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.
@socket-security
socket-securityBot
commented
Nov 22, 2025•

edited

Loading

Copy link


Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.
DiffPackageSupply Chain
Security		VulnerabilityQualityMaintenanceLicense
Updatedmongodb@​6.20.0 ⏵ 7.5.089-510010098100
View full report
@renovate
renovateBotforce-pushed
the
renovate/mongodb-7.x
branch
from
c4c62f3 to
7255308CompareFebruary 2, 2026 21:06
@renovate
renovateBotforce-pushed
the
renovate/mongodb-7.x
branch
2 times, most recently
from
ab590d9 to
67ebaf8CompareFebruary 18, 2026 03:10
@renovate
renovateBotforce-pushed
the
renovate/mongodb-7.x
branch
from
67ebaf8 to
ebbc59fCompareApril 7, 2026 14:59
@renovate
renovateBotforce-pushed
the
renovate/mongodb-7.x
branch
from
ebbc59f to
a6c7dadCompareMay 4, 2026 19:52
@renovate
renovateBotforce-pushed
the
renovate/mongodb-7.x
branch
from
a6c7dad to
ed629f7CompareJune 23, 2026 19:38
@renovate
renovateBotforce-pushed
the
renovate/mongodb-7.x
branch
from
ed629f7 to
8fd7c45CompareJuly 9, 2026 22:01
@renovate
renovateBotforce-pushed
the
renovate/mongodb-7.x
branch
from
8fd7c45 to
64d701bCompareJuly 21, 2026 23:11
@renovate
renovateBotforce-pushed
the
renovate/mongodb-7.x
branch
from
64d701b to
4f6d117CompareJuly 30, 2026 17:15
@renovate
renovateBotforce-pushed
the
renovate/mongodb-7.x
branch
from
4f6d117 to
dca142aCompareAugust 11, 2026 22:31
@socket-security
socket-securityBot
commented
Aug 11, 2026•

edited

Loading

Copy link


Copy Markdown

Warning
Review the following alerts detected in dependencies.
According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
ActionSeverityAlert (click "▶" to expand/collapse)
WarnHigh
Publisher changed: npm @mongodb-js/saslprep is now published by devtools-npm-user
Author:devtools-npm-user
From:package.json → npm/mongodb@7.5.0 → npm/@mongodb-js/saslprep@1.4.13
ℹ Read more on: This package | This alert | What is unstable ownership?
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.

Suggestion: Try to reduce the number of authors you depend on to reduce the risk to malicious actors gaining access to your supply chain. Packages should remove inactive collaborators with publishing rights from packages on npm.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/@mongodb-js/saslprep@1.4.13. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.

View full report
@renovate
renovateBotforce-pushed
the
renovate/mongodb-7.x
branch
from
dca142a to
755c727CompareAugust 26, 2026 12:42
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels

package:npmPull requests that update node.js depstype:dependenciesPull requests that update a dependency fileupdate:majorMajor Updates of dependency

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
fix(deps): update dependency mongodb to v7 - #163
Open
renovate[bot] wants to merge 1 commit into
devfrom 
renovate/mongodb-7.x
Open
fix(deps): update dependency mongodb to v7#163
renovate[bot] wants to merge 1 commit into
devfrom 
renovate/mongodb-7.x
Conversation
@renovate
@renovaterenovateBot
commented
Nov 22, 2025•

edited

Loading

Copy link


Copy Markdown

Contributor
This PR contains the following updates:
PackageChangeAgeConfidence
mongodb^6.18.0 → ^7.0.0ageconfidence
Release Notes
mongodb/node-mongodb-native (mongodb)
v7.5.0
Compare Source
Features
  • NODE-7537: promote QE string queries (prefix/suffix/substring) (#​4996) (dc4900c)
Bug Fixes
v7.4.0
Compare Source
Features
  • NODE-7634: remove experimental tag from async dispose methods (#​4976) (43ce3eb)
  • NODE-7549: send afterClusterTime on writes in causally-consistent sessions (#​4963) (3abfd26)
v7.3.0
Compare Source
Features
Bug Fixes
  • NODE-7548: SCRAM authentication fails on non-Node runtimes (#​4932) (a10d2c9)
v7.2.0
Compare Source
Features
  • NODE-7142: Exponential backoff and jitter in retry loops (#​4871) (22c6031)
  • NODE-7315: Use BSON ByteUtils instead of Nodejs Buffer (#​4840) (1add538)
  • NODE-7335: Create dedicated mocha runner with isolated vm context (#​4876) (a4cba4c)
  • NODE-7379: Refactor Crypto to Web Crypto API (#​4862) (ac98f4a)
  • NODE-7385: add experimental os runtime adapter (#​4851) (d2ad07f)
  • NODE-7441: add ChangeStream.bufferedCount (#​4870) (f7ea421)
  • NODE-7452: restrict server deprioritization on replica sets to overload errors (#​4875) (87a3465)
  • NODE-7467: make token bucket optional in client backpressure (#​4878) (4fb0a0a)
  • NODE-7491: finalize client backpressure implementation for phase 1 rollout (#​4920) (2cc7983)
Bug Fixes
  • NODE-7430: throw timeout error when withTransaction retries exceed deadline (#​4897) (16a899d)
  • NODE-7459: explicitly call setKeepAlive and setNoDelay on socket (#​4879) (778a2a1)
  • NODE-7469: overload retry when retryReads/Writes=false (#​4888) (4157b26)
  • NODE-7478: OIDC host allowlist fix (#​4905) (f36b754)
v7.1.1
Compare Source
The MongoDB Node.js team is pleased to announce version 7.1.1 of the mongodb package!
Release Notes
Tighten OIDC ALLOWED_HOSTS wildcard matching
The OIDC ALLOWED_HOSTS wildcard handling has been fixed to require full subdomain/path matches for *. and */ entries, preventing partial suffix matches from being incorrectly accepted.
Fixed TCP keep-alive and no-delay settings not being applied on TLS connections
Due to a Node.js bug, tls.connect() silently ignores keepAlive, keepAliveInitialDelay, and noDelay options passed through its constructor. This could cause idle connections - particularly through cloud load balancers like Azure (240s idle timeout) or AWS PrivateLink/NLB - to be dropped unexpectedly due to missing TCP keep-alive probes.
The driver now explicitly calls setKeepAlive() and setNoDelay() on the socket after creation, ensuring these settings are always applied regardless of whether TLS is used.
Bug Fixes
Documentation
We invite you to try the mongodb library immediately, and report any issues to the NODE project.
v7.1.0
Compare Source
Features
  • NODE-5393: aws4 no longer required for AWS authentication (#​4824) (0f46db8)
  • NODE-7121: prevent connection churn on backpressure errors when establishing connections (#​4800) (4cb2b87)
  • NODE-7122: exponential backoff between retries in convenient transaction API (#​4765) (e70fdc9)
  • NODE-7304: remove usages in src of promisify (#​4799) (761b9bf)
  • NODE-7306: Replace global process with import node:process (#​4820) (cc503cb)
  • NODE-7310: Replace process.arch with os.arch() (#​4823) (f0af829)
  • NODE-7311: Replace process.platform with os.platform() (#​4822) (c58ca1f)
  • NODE-7317: use BSON.NumberUtils to determine endianness (#​4808) (4e9467e)
  • NODE-7319: update allowed hosts list with *.mongo.com (#​4802) (bfb7160)
  • NODE-7330: deprecate RenameCollectionOptions.new_collection (#​4815) (a96fa26)
  • NODE-7333: add support for deprioritized servers to all topologies (#​4821) (a4211e7)
Bug Fixes
  • NODE-7290: use valueof for error code check (#​4791) (1cc3d1c)
  • NODE-7298: ensure commonWireVersion is computed from server maxWireVersion (#​4805) (2b2366d)
  • NODE-7307: Replace node:process.hrtime() with performance.now() (#​4816) (ae2e037)
  • NODE-7308: replace process.nextTick with queueMicrotask (#​4817) (b1b6e81)
v7.0.0
Compare Source
⚠ BREAKING CHANGES
  • NODE-7259: use alphas of all supporting packages (#​4746)
  • NODE-5510: dont filter change stream options (#​4723)
  • NODE-6296: remove cursor default batch size of 1000 (#​4729)
  • NODE-7150: update peer dependency matrix for 3rd party peer deps (#​4720)
  • NODE-7046: remove AWS uri/options support (#​4689)
  • NODE-4808: remove support for stream() transform on cursors and change streams (#​4728)
  • NODE-6377: remove noResponse option (#​4724)
  • NODE-6473: remove MONGODB-CR auth (#​4717)
  • NODE-5994: Remove metadata-related properties from public driver API (#​4716)
  • NODE-7016: remove beta namespace and move resource management into driver (#​4719)
  • NODE-4184: don't throw on aggregate with write concern and explain (#​4718)
  • NODE-7043, NODE-7217: adopt mongodb-client-encryption v7 (#​4705)
  • NODE-6065: throw MongoRuntimeError instead of MissingDependencyError in crypto connection (#​4711)
  • NODE-6584: improve typing for filepaths in AutoEncryptionOptions (#​4341)
  • NODE-6334: rename PoolRequstedRetry to PoolRequestedRetry (#​4696)
  • NODE-7174: drop support for Node16 and Node18 (#​4668)
  • NODE-7047: use custom credential provider first after URI (#​4656)
  • NODE-6988: require aws sdk for aws auth (#​4659)
Features
Bug Fixes
  • NODE-7067: Wrap socket write in a try/catch to ensure errors can be properly wrapped (#​4759) (66c18b7)
  • NODE-7232: only send endSessions during client close if the topology supports sessions (#​4722) (cc85ebf)
  • NODE-7247: clarify #rewrapManyDataKey() parameter types (#​4760) (cb522bf)
  • NODE-7270: remove extra BSONType file in docs/Next/variables (#​4754) (df3aaaa)
v6.21.0
Compare Source
The MongoDB Node.js team is pleased to announce version 6.21.0 of the mongodb package!
Release Notes
Deprecated items to be removed in 7.0.0
The following items have been deprecated and will be removed in 7.0.0:
MongoCredentials.authMechanismProperties.AWS_SESSION_TOKEN// URI & client options for AWS variables will no longer be respectedCommandOptions.noResponse// UnusedConnectionOptions.cancellationToken// UnusedCursorStreamOptions// Only option, transform, removed in favor of Stream#map
Features
  • NODE-7230: add deprecations of items to be removed in v7 (#​4774) (5104c0f)
Documentation
We invite you to try the mongodb library immediately, and report any issues to the NODE project.
Configuration
📅 Schedule: (UTC)
  • Branch creation

    • "after 11pm every weekend,before 8am every weekend"
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
@renovaterenovateBot
added

package:npm
Pull requests that update node.js deps
type:dependencies
Pull requests that update a dependency file
update:major
Major Updates of dependency
labels
Nov 22, 2025
@snyk-io
snyk-ioBot
commented
Nov 22, 2025•

edited

Loading

Copy link


Copy Markdown

✅ Snyk checks have passed. No issues have been found so far.
StatusScan Engine Critical High Medium LowTotal (0)
✅Open Source Security0000 0 issues
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.
@socket-security
socket-securityBot
commented
Nov 22, 2025•

edited

Loading

Copy link


Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.
DiffPackageSupply Chain
Security		VulnerabilityQualityMaintenanceLicense
Updatedmongodb@​6.20.0 ⏵ 7.5.089-510010098100
View full report
@renovate
renovateBotforce-pushed
the
renovate/mongodb-7.x
branch
from
c4c62f3 to
7255308CompareFebruary 2, 2026 21:06
@renovate
renovateBotforce-pushed
the
renovate/mongodb-7.x
branch
2 times, most recently
from
ab590d9 to
67ebaf8CompareFebruary 18, 2026 03:10
@renovate
renovateBotforce-pushed
the
renovate/mongodb-7.x
branch
from
67ebaf8 to
ebbc59fCompareApril 7, 2026 14:59
@renovate
renovateBotforce-pushed
the
renovate/mongodb-7.x
branch
from
ebbc59f to
a6c7dadCompareMay 4, 2026 19:52
@renovate
renovateBotforce-pushed
the
renovate/mongodb-7.x
branch
from
a6c7dad to
ed629f7CompareJune 23, 2026 19:38
@renovate
renovateBotforce-pushed
the
renovate/mongodb-7.x
branch
from
ed629f7 to
8fd7c45CompareJuly 9, 2026 22:01
@renovate
renovateBotforce-pushed
the
renovate/mongodb-7.x
branch
from
8fd7c45 to
64d701bCompareJuly 21, 2026 23:11
@renovate
renovateBotforce-pushed
the
renovate/mongodb-7.x
branch
from
64d701b to
4f6d117CompareJuly 30, 2026 17:15
@renovate
renovateBotforce-pushed
the
renovate/mongodb-7.x
branch
from
4f6d117 to
dca142aCompareAugust 11, 2026 22:31
@socket-security
socket-securityBot
commented
Aug 11, 2026•

edited

Loading

Copy link


Copy Markdown

Warning
Review the following alerts detected in dependencies.
According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
ActionSeverityAlert (click "▶" to expand/collapse)
WarnHigh
Publisher changed: npm @mongodb-js/saslprep is now published by devtools-npm-user
Author:devtools-npm-user
From:package.json → npm/mongodb@7.5.0 → npm/@mongodb-js/saslprep@1.4.13
ℹ Read more on: This package | This alert | What is unstable ownership?
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.

Suggestion: Try to reduce the number of authors you depend on to reduce the risk to malicious actors gaining access to your supply chain. Packages should remove inactive collaborators with publishing rights from packages on npm.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/@mongodb-js/saslprep@1.4.13. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.

View full report
@renovate
renovateBotforce-pushed
the
renovate/mongodb-7.x
branch
from
dca142a to
755c727CompareAugust 26, 2026 12:42
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels

package:npmPull requests that update node.js depstype:dependenciesPull requests that update a dependency fileupdate:majorMajor Updates of dependency

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants