[renovate]

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
mongodb	^5.9.2 → ^7.9.0

---

Release Notes

mongodb/node-mongodb-native (mongodb)

v7.9.0

Compare Source

Features

• NODE-7743: deprecate SelectServerOptions (#​5108) (b22b432)
• NODE-7968: un-deprecate single parameter overload of createIndex (#​5106) (18f21e5)

Bug Fixes

• NODE-6517: drop indexes swallowing errors (#​5100) (035bffb)
• NODE-7848: honor Node's process-level autoSelectFamily default (#​5107) (7d64ea2)

v7.8.0

Compare Source

Features

• NODE-6893: Distinguish between command-level options and index-level options when creating indexes (#​5012) (ca0e451)
• NODE-7097: use Node.js built-in zstd when available (#​5073) (b7eb8fd)
• NODE-7657: remove @​experimental tags from no-longer-experimental features (#​5058) (694a848)
• NODE-7830: add srvAllowedHostsSuffix and srvHostValidator options (#​5065) (19e2d3b)
• NODE-7958: make timeoutMS a no-op and deprecate it (#​5085) (8345fe1)

Bug Fixes

• NODE-7643: preserve $meta direction in [field, direction] sort pair (#​4988) (16136bb)
• NODE-7659: key unordered bulk insertedIds by originating operation index (#​4989) (df513cf)
• NODE-7764: use $eq to match file IDs in GridFS queries (#​5068) (218b6d7)
• NODE-7881: hello command is compressed (#​5072) (399045a)

v7.7.0

Compare Source

Features

• NODE-7670: update dependencies, including next BSON minor (#​5034) (995edbf)

Bug Fixes

• NODE-7858: re-arm OIDC callback lock after a rejection (#​5056) (7e953ed)

v7.6.0

Compare Source

Features

• NODE-7546: add HTTP Proxy support for QE & CSFLE (#​5007) (3366c21)
• NODE-7547: bump minimum support server/wire versions to '4.4' & '9' respectively (#​4994) (3d97028)
• NODE-7624: support baseBackoffMS and update client backpressure backoff (#​5020) (560837b)

Bug Fixes

• NODE-7603: emit dynamic import('os') via tsconfig (#​4992) (52f5e61)

Performance Improvements

• NODE-7660: serialize bulk write documents a single time (#​4999) (1217aa1)

v7.5.0

Compare Source

Features

• NODE-7537: promote QE string queries (prefix/suffix/substring) (#​4996) (dc4900c)

Bug Fixes

• NODE-7411: iterate all servers on close (#​4967) (72c0296)

v7.4.0

Compare Source

Features

• NODE-7634: remove experimental tag from async dispose methods (#​4976) (43ce3eb)
• NODE-7549: send afterClusterTime on writes in causally-consistent sessions (#​4963) (3abfd26)

v7.3.0

Compare Source

Features

• NODE-7518: bump maxWireVersion (#​4950) (4447050)

Bug Fixes

• NODE-7548: SCRAM authentication fails on non-Node runtimes (#​4932) (a10d2c9)

v7.2.0

Compare Source

Features

• NODE-7142: Exponential backoff and jitter in retry loops (#​4871) (22c6031)
• NODE-7315: Use BSON ByteUtils instead of Nodejs Buffer (#​4840) (1add538)
• NODE-7335: Create dedicated mocha runner with isolated vm context (#​4876) (a4cba4c)
• NODE-7379: Refactor Crypto to Web Crypto API (#​4862) (ac98f4a)
• NODE-7385: add experimental os runtime adapter (#​4851) (d2ad07f)
• NODE-7441: add ChangeStream.bufferedCount (#​4870) (f7ea421)
• NODE-7452: restrict server deprioritization on replica sets to overload errors (#​4875) (87a3465)
• NODE-7467: make token bucket optional in client backpressure (#​4878) (4fb0a0a)
• NODE-7491: finalize client backpressure implementation for phase 1 rollout (#​4920) (2cc7983)

Bug Fixes

• NODE-7430: throw timeout error when withTransaction retries exceed deadline (#​4897) (16a899d)
• NODE-7459: explicitly call setKeepAlive and setNoDelay on socket (#​4879) (778a2a1)
• NODE-7469: overload retry when retryReads/Writes=false (#​4888) (4157b26)
• NODE-7478: OIDC host allowlist fix (#​4905) (f36b754)

v7.1.1

Compare Source

The MongoDB Node.js team is pleased to announce version 7.1.1 of the mongodb package!

Release Notes

Tighten OIDC ALLOWED_HOSTS wildcard matching

The OIDC ALLOWED_HOSTS wildcard handling has been fixed to require full subdomain/path matches for *. and */ entries, preventing partial suffix matches from being incorrectly accepted.

Fixed TCP keep-alive and no-delay settings not being applied on TLS connections

Due to a Node.js bug, tls.connect() silently ignores keepAlive, keepAliveInitialDelay, and noDelay options passed through its constructor. This could cause idle connections - particularly through cloud load balancers like Azure (240s idle timeout) or AWS PrivateLink/NLB - to be dropped unexpectedly due to missing TCP keep-alive probes.

The driver now explicitly calls setKeepAlive() and setNoDelay() on the socket after creation, ensuring these settings are always applied regardless of whether TLS is used.

Bug Fixes

• NODE-7477: OIDC host allowlist fix (#​4896) (237c9ab)
• NODE-7482: explicitly call setKeepAlive and setNoDelay on socket (#​4900) (b14ba21)

Documentation

• Reference
• API
• Changelog

We invite you to try the mongodb library immediately, and report any issues to the NODE project.

v7.1.0

Compare Source

Features

• NODE-5393: aws4 no longer required for AWS authentication (#​4824) (0f46db8)
• NODE-7121: prevent connection churn on backpressure errors when establishing connections (#​4800) (4cb2b87)
• NODE-7122: exponential backoff between retries in convenient transaction API (#​4765) (e70fdc9)
• NODE-7304: remove usages in src of promisify (#​4799) (761b9bf)
• NODE-7306: Replace global process with import node:process (#​4820) (cc503cb)
• NODE-7310: Replace process.arch with os.arch() (#​4823) (f0af829)
• NODE-7311: Replace process.platform with os.platform() (#​4822) (c58ca1f)
• NODE-7317: use BSON.NumberUtils to determine endianness (#​4808) (4e9467e)
• NODE-7319: update allowed hosts list with *.mongo.com (#​4802) (bfb7160)
• NODE-7330: deprecate RenameCollectionOptions.new_collection (#​4815) (a96fa26)
• NODE-7333: add support for deprioritized servers to all topologies (#​4821) (a4211e7)

Bug Fixes

• NODE-7290: use valueof for error code check (#​4791) (1cc3d1c)
• NODE-7298: ensure commonWireVersion is computed from server maxWireVersion (#​4805) (2b2366d)
• NODE-7307: Replace node:process.hrtime() with performance.now() (#​4816) (ae2e037)
• NODE-7308: replace process.nextTick with queueMicrotask (#​4817) (b1b6e81)

v7.0.0

Compare Source

⚠ BREAKING CHANGES

• NODE-7259: use alphas of all supporting packages (#​4746)
• NODE-5510: dont filter change stream options (#​4723)
• NODE-6296: remove cursor default batch size of 1000 (#​4729)
• NODE-7150: update peer dependency matrix for 3rd party peer deps (#​4720)
• NODE-7046: remove AWS uri/options support (#​4689)
• NODE-4808: remove support for stream() transform on cursors and change streams (#​4728)
• NODE-6377: remove noResponse option (#​4724)
• NODE-6473: remove MONGODB-CR auth (#​4717)
• NODE-5994: Remove metadata-related properties from public driver API (#​4716)
• NODE-7016: remove beta namespace and move resource management into driver (#​4719)
• NODE-4184: don't throw on aggregate with write concern and explain (#​4718)
• NODE-7043, NODE-7217: adopt mongodb-client-encryption v7 (#​4705)
• NODE-6065: throw MongoRuntimeError instead of MissingDependencyError in crypto connection (#​4711)
• NODE-6584: improve typing for filepaths in AutoEncryptionOptions (#​4341)
• NODE-6334: rename PoolRequstedRetry to PoolRequestedRetry (#​4696)
• NODE-7174: drop support for Node16 and Node18 (#​4668)
• NODE-7047: use custom credential provider first after URI (#​4656)
• NODE-6988: require aws sdk for aws auth (#​4659)

Features

• bump bson to 7.0.0-alpha.2 (#​4756) (9b34953)
• NODE-4184: don't throw on aggregate with write concern and explain (#​4718) (88e02a4)
• NODE-4243: drop collection checks ns not found (#​4742) (a8d7c5f)
• NODE-4808: remove support for stream() transform on cursors and change streams (#​4728) (1702987)
• NODE-5510: dont filter change stream options (#​4723) (a2daf76)
• NODE-5545: remove deprecated objects (#​4704) (cfbada6)
• NODE-5994: Remove metadata-related properties from public driver API (#​4716) (b59c5ce)
• NODE-6065: throw MongoRuntimeError instead of MissingDependencyError in crypto connection (#​4711) (ff229fa)
• NODE-6296: remove cursor default batch size of 1000 (#​4729) (f8a855f)
• NODE-6334: rename PoolRequstedRetry to PoolRequestedRetry (#​4696) (84db848)
• NODE-6377: remove noResponse option (#​4724) (9e9059a)
• NODE-6473: remove MONGODB-CR auth (#​4717) (9a1bc65)
• NODE-6584: improve typing for filepaths in AutoEncryptionOptions (#​4341) (dab4c7c)
• NODE-6988: require aws sdk for aws auth (#​4659) (b7c6750)
• NODE-7016: remove beta namespace and move resource management into driver (#​4719) (fb2824f)
• NODE-7043, NODE-7217: adopt mongodb-client-encryption v7 (#​4705) (3f7196e)
• NODE-7046: remove AWS uri/options support (#​4689) (d14ac3f)
• NODE-7047: use custom credential provider first after URI (#​4656) (2a47bbb)
• NODE-7150: update peer dependency matrix for 3rd party peer deps (#​4720) (0451dae)
• NODE-7174: drop support for Node16 and Node18 (#​4668) (a576b7d)
• NODE-7223: run checkout on connect regardless of credentials (#​4715) (c5f74ab)
• NODE-7259: use alphas of all supporting packages (#​4746) (e1ea14c)
• NODE-7260: update bson alpha to latest (#​4748) (4e88559)

Bug Fixes

• NODE-7067: Wrap socket write in a try/catch to ensure errors can be properly wrapped (#​4759) (66c18b7)
• NODE-7232: only send endSessions during client close if the topology supports sessions (#​4722) (cc85ebf)
• NODE-7247: clarify #rewrapManyDataKey() parameter types (#​4760) (cb522bf)
• NODE-7270: remove extra BSONType file in docs/Next/variables (#​4754) (df3aaaa)

v6.22.0

Compare Source

The MongoDB Node.js team is pleased to announce version 6.22.0 of the mongodb package!

Release Notes

[!WARNING]
Node Driver versions from v6.11.0 before v6.22.0 (this release) and from v7.0.0 before v7.8.0 are affected by a security issue related to the use of the experimental timeoutMS feature where connection pool desynchronization after operation timeout can expose other users' data (CVE-2026-119179). Users are encouraged to discontinue the use of timeoutMS as soon as possible.

timeoutMS is deprecated and now a no-op

[!WARNING]
timeoutMS and timeoutMode are deprecated and have no effect starting in this release. They are still accepted and will not throw, but operations will no longer time out because of them. They are slated for removal in a future release.

Use the per-stage timeouts instead: serverSelectionTimeoutMS, waitQueueTimeoutMS, socketTimeoutMS, and maxTimeMS for server-side execution.

Features

• NODE-7974: make timeoutMS a no-op and deprecate it (#​5091) (389fb72)

Documentation

• Reference
• API
• Changelog

We invite you to try the mongodb library immediately, and report any issues to the NODE project.

v6.21.0

Compare Source

The MongoDB Node.js team is pleased to announce version 6.21.0 of the mongodb package!

Release Notes

Deprecated items to be removed in 7.0.0

The following items have been deprecated and will be removed in 7.0.0:

MongoCredentials.authMechanismProperties.AWS_SESSION_TOKEN // URI & client options for AWS variables will no longer be respected
CommandOptions.noResponse // Unused
ConnectionOptions.cancellationToken // Unused
CursorStreamOptions // Only option, transform, removed in favor of Stream#map

Features

• NODE-7230: add deprecations of items to be removed in v7 (#​4774) (5104c0f)

Documentation

• Reference
• API
• Changelog

We invite you to try the mongodb library immediately, and report any issues to the NODE project.

v6.20.0

Compare Source

Features

• NODE-6883: allow rawData option on time series collections (#​4642) (0fa3cd4)
• NODE-7125: add db and client properties to collection and database objects (#​4640) (3469f86)
• NODE-7134: allow hint with unacknowledged writes for delete, update and findAndModify commands (#​4647) (82d6ce6)
• NODE-7139: remove pre-4.2 logic and deprecate dead code (#​4657) (14303bc)
• NODE-7140: deprecate driver info options (#​4654) (b813c85)
• NODE-7157: deprecate retryWrites in CommandOperationOptions (#​4661) (620972d)

Bug Fixes

• NODE-4763: cache resumeToken in ChangeStream.tryNext() (#​4636) (8331a93)
• NODE-6858: treat MongoServerSelectionError as a resumable error for Change Streams (#​4653) (c6d64e7)
• NODE-7138: prevent duplicate metadata from being appended to handshake metadata (#​4651) (05c230c)

v6.19.0

Compare Source

Features

• NODE-4179: allow secureContext in KMS TLS options (#​4578) (0ea6eaa)
• NODE-6472: findOne and find no longer keep open cursors (#​4580) (be7f808)
• NODE-7020: remove ping on connect (#​4607) (3d296b7)
• NODE-7059, NODE-7008: add support for text queries for QE string fields (#​4597) (e4492f3)

v6.18.0

Compare Source

Features

• NODE-5055: Add databaseName property to command monitoring events (#​4586) (3faf0c9)
• NODE-6865: deprecate transaction getters (#​4567) (da46aea)
• NODE-6991: deprecate unintentionally public client metadata types (#​4566) (ca6554b)
• NODE-7009: add client metadata on demand (#​4574) (b9636ee)
• NODE-7053: deprecate noResponse option (#​4589) (1115319)

Bug Fixes

• NODE-4845: allocate sessions lazily in cursors (#​4575) (5761703)
• NODE-6589: background task does not prune idle connections when minPoolSize=0 (#​4569) (7cbb641)
• NODE-6955: add missing wallTime property TS change stream event interfaces (#​4541) (f153c6f)

v6.17.0

Compare Source

Features

• NODE-6245: add keepAliveInitialDelay config (#​4510) (d6c0eb3)
• NODE-6290: add sort support to updateOne and replaceOne (#​4515) (28857b7)
• NODE-6882: eagerly close checked out connections when client is closed (#​4499) (64fdb3e)
• NODE-6884: remove support for 4.0 (#​4534) (6fe6ccc)
• NODE-6952: support configuring DEK cache expiration (#​4538) (c529f07)
• NODE-6963: use BSON 6.10.4 (#​4549) (aee490a)

Bug Fixes

• NODE-6638: throw if all atomic updates are undefined (#​4519) (9625b2d)
• NODE-6864: socket errors are not always converted to MongoNetworkErrors (#​4473) (2d86095)
• NODE-6962: OIDC machine workflows use OIDCCallbacks internally (#​4546) (bd6030f)

v6.16.0

Compare Source

Features

• NODE-6494: add support for hint on distinct commands (#​4487) (40d0e87)
• NODE-6515: deprecate driver support for server 4.0 (#​4517) (4c1a8a7)

Bug Fixes

• NODE-6630: read all messages in buffer when chunk arrives (#​4512) (8c86e30)
• NODE-6878: documents.clear() throws a TypeError after cursor is rewound (#​4488) (a1fffeb)

v6.15.0

Compare Source

Features

• NODE-6141: allow custom aws sdk config (#​4373) (3d047ed)

Bug Fixes

• NODE-6845: ensure internal rejections are handled (#​4448) (06e941a)

v6.14.2

Compare Source

Bug Fixes

• NODE-6803: kms proxy socket creates unhandled rejection (#​4444) (ed69cf9)

v6.14.1

Compare Source

Bug Fixes

• NODE-6801: set token on connection from cache (#​4438) (cb13746)

v6.14.0

Compare Source

Features

• NODE-6676: add support for nsType in change stream create events (#​4431) (7800067)
• NODE-6773: add support for $lookup with automatic encryption (#​4427) (965b21a)

Bug Fixes

• NODE-6765: FindOneAndUpdateOptions supports aggregation expressions (#​4423) (421ddeb)
• NODE-6792: use isUint8Array from driver's utils instead of util/types (#​4436) (dfe1fba)
• NODE-6794: revert @aws-sdk/credential-providers peer compatibility change (#​4437) (488c407)

v6.13.1

Compare Source

Bug Fixes

• NODE-6407: use conversationId returned from server in saslContinue (#​4368) (fbefa6b)
• NODE-6613: Update error messages when primaries go stale (#​4397) (6528c8d)
• NODE-6690: Remove extraneous Document in replaceOne return type (#​4383) (6c81d4e)
• NODE-6763: pass WriteConcernOptions instead on WriteConcernSettings (#​4421) (26f15d7)
• NODE-6777: update BSON to 6.10.3 (#​4428) (db5b9e0)

v6.13.0

Compare Source

Features

• NODE-5672: support standardized logging (#​4387) (d1b2453)
• NODE-6258: add signal support to find and aggregate ([#​4364](https://redirect.gi

[!IMPORTANT]
✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.