chore(deps): bump mongodb from 5.9.2 to 7.6.0

[dependabot]

Bumps mongodb from 5.9.2 to 7.6.0.

Release notes

Sourced from mongodb's releases.

v7.6.0

7.6.0 (2026-08-21)

The MongoDB Node.js team is pleased to announce version 7.6.0 of the mongodb package!

Release Notes

Support for MongoDB 4.2 is removed

[!WARNING] When the driver connects to a MongoDB server of version 4.2 or less, it will now throw an error.

HTTP proxy support for KMS requests in CSFLE and Queryable Encryption

In-use encryption can now route KMS requests through an HTTP proxy. Set kmsConnectCallback on your ClientEncryption or auto-encryption options to control how the driver connects to a KMS host. The callback receives the target host and port and returns a connected socket (for example, a tunnel opened with HTTP CONNECT); the driver then performs the KMS TLS handshake over that socket using the provider's configured TLS options. This unblocks CSFLE and Queryable Encryption in environments that require an HTTP forward proxy for outbound KMS traffic, which the existing SOCKS5 proxyOptions does not cover.

const clientEncryption = new ClientEncryption(keyVaultClient, {
  keyVaultNamespace,
  kmsProviders,
  // Establish the KMS connection through your HTTP proxy; the driver adds TLS.
  kmsConnectCallback: ({ host, port }) => connectThroughHttpProxy(host, port)
});

Improved Intelligent Workload Management

Improved performance for MongoDB 9.0's Intelligent Workload Management (IWM) by only retrying overload errors when doing so is expected to not worsen server conditions

Bundling the driver into ESM no longer throws ReferenceError: require is not defined

v7.2.0 introduced the experimental runtimeAdapters option and, as part of it, replaced the driver’s static import of Node’s os module with a runtime require('os'). That works in a CommonJS build, but when the driver is bundled into ESM output (e.g. a Vite/esbuild/rollup server build with "type": "module"), there is no require in module scope, so constructing a client threw ReferenceError: require is not defined. The driver now loads the default os adapter through a dynamic import() that survives bundling, so new MongoClient() works in ESM bundles. CommonJS usage is unchanged, and supplying your own runtimeAdapters.os continues to work.

Bulk writes serialize each document only once

insertMany and bulkWrite previously processed each document twice - once to measure its size for batch splitting (a full recursive walk via calculateObjectSize) and again to serialize it into the command sent to the server. Documents are now serialized a single time and the resulting bytes are reused for both, decreasing the BSON-encoding CPU spent on bulk writes and reducing event-loop blocking during large batches. The improvement is most noticeable with high document counts and documents that have many fields.

Features

• NODE-7546: add HTTP Proxy support for QE & CSFLE (#5007) (3366c21)
• NODE-7547: bump minimum support server/wire versions to '4.4' & '9' respectively (#4994) (3d97028)
• NODE-7624: support baseBackoffMS and update client backpressure backoff (#5020) (560837b)

Bug Fixes

• NODE-7603: emit dynamic import('os') via tsconfig (#4992) (52f5e61)

Performance Improvements

... (truncated)

Changelog

Sourced from mongodb's changelog.

7.6.0 (2026-08-21)

Features

• NODE-7546: add HTTP Proxy support for QE & CSFLE (#5007) (3366c21)
• NODE-7547: bump minimum support server/wire versions to '4.4' & '9' respectively (#4994) (3d97028)
• NODE-7624: support baseBackoffMS and update client backpressure backoff (#5020) (560837b)

Bug Fixes

• NODE-7603: emit dynamic import('os') via tsconfig (#4992) (52f5e61)

Performance Improvements

• NODE-7660: serialize bulk write documents a single time (#4999) (1217aa1)

7.5.0 (2026-07-07)

Features

• NODE-7537: promote QE string queries (prefix/suffix/substring) (#4996) (dc4900c)

Bug Fixes

• NODE-7411: iterate all servers on close (#4967) (72c0296)

7.4.0 (2026-06-25)

Features

• NODE-7634: remove experimental tag from async dispose methods (#4976) (43ce3eb)
• NODE-7549: send afterClusterTime on writes in causally-consistent sessions (#4963) (3abfd26)

7.3.0 (2026-06-04)

Features

• NODE-7518: bump maxWireVersion (#4950) (4447050)

Bug Fixes

• NODE-7548: SCRAM authentication fails on non-Node runtimes (#4932) (a10d2c9)

... (truncated)

Commits

• 0fb2c13 chore(main): release 7.6.0 (#5001)
• bb35ded docs: Add preliminary checks to release instructions (#5028)
• 560837b feat(NODE-7624): support baseBackoffMS and update client backpressure backoff...
• ce33c59 chore(NODE-7767): bson compat tests snappy fix (#5025)
• 0f2ed29 chore(NODE-7770): add server 9.0 to the test matrix (#5024)
• bc92c29 chore(NODE-7767): snappy 7.4 is incompatible in CI (#5021)
• dce7939 chore(NODE-7759): pin bson-compat server (#5018)
• 7f8edf3 chore: run bson compat tests against latest server (#5017)
• 30c31e5 ci(deps): bump drivers-evergreen-tools from 3741fa9 to e86753e (#5016)
• 3366c21 feat(NODE-7546): add HTTP Proxy support for QE & CSFLE (#5007)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for mongodb since your current version.

[netlify]

✅ Deploy Preview for endearing-brigadeiros-63f9d0 canceled.

Name	Link
🔨 Latest commit	9edb582
🔍 Latest deploy log	https://app.netlify.com/projects/endearing-brigadeiros-63f9d0/deploys/6a9ee029431ae900085a6387

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
npm/@types/whatwg-url	13.0.0	🟢 6.5	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10 Packaging ⚠️ -1 packaging workflow not detected Code-Review 🟢 8 Found 26/30 approved changesets -- score normalized to 8 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Security-Policy 🟢 10 security policy file detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 9 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0 Binary-Artifacts 🟢 10 no binaries found in the repo Pinned-Dependencies 🟢 8 dependency not pinned by hash detected -- score normalized to 8 Fuzzing ⚠️ 0 project is not fuzzed
npm/bson	7.3.2	🟢 6.2	Details Check Score Reason Maintained 🟢 10 19 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 Code-Review 🟢 10 all changesets reviewed Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Packaging ⚠️ -1 packaging workflow not detected Binary-Artifacts 🟢 10 no binaries found in the repo CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Security-Policy ⚠️ 0 security policy file not detected License 🟢 10 license file detected Fuzzing ⚠️ 0 project is not fuzzed Signed-Releases 🟢 8 5 out of the last 5 releases have a total of 5 signed artifacts. Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Branch-Protection 🟢 5 branch protection is not maximal on development and all release branches SAST 🟢 9 SAST tool detected but not run on all commits
npm/mongodb	7.6.0	🟢 6.1	Details Check Score Reason Code-Review 🟢 9 Found 21/22 approved changesets -- score normalized to 9 Maintained 🟢 10 30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Security-Policy ⚠️ 0 security policy file not detected License 🟢 10 license file detected Signed-Releases 🟢 8 5 out of the last 5 releases have a total of 5 signed artifacts. Branch-Protection 🟢 5 branch protection is not maximal on development and all release branches SAST 🟢 9 SAST tool detected but not run on all commits Fuzzing ⚠️ 0 project is not fuzzed Binary-Artifacts 🟢 10 no binaries found in the repo Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0
npm/mongodb-connection-string-url	7.0.2	🟢 6	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Packaging ⚠️ -1 packaging workflow not detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Binary-Artifacts 🟢 10 no binaries found in the repo Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Maintained 🟢 10 14 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Fuzzing ⚠️ 0 project is not fuzzed Security-Policy ⚠️ 0 security policy file not detected License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection 🟢 5 branch protection is not maximal on development and all release branches SAST 🟢 9 SAST tool is not run on all commits -- score normalized to 9
npm/tr46	5.1.1	🟢 3.8	Details Check Score Reason Code-Review ⚠️ 1 Found 5/26 approved changesets -- score normalized to 1 Binary-Artifacts 🟢 10 no binaries found in the repo Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Maintained ⚠️ 0 0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0 Pinned-Dependencies 🟢 3 dependency not pinned by hash detected -- score normalized to 3 Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed Signed-Releases ⚠️ -1 no releases found License 🟢 10 license file detected Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches Security-Policy 🟢 10 security policy file detected SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
npm/whatwg-url	14.2.0	🟢 5	Details Check Score Reason Code-Review ⚠️ 0 Found 2/28 approved changesets -- score normalized to 0 Binary-Artifacts 🟢 10 no binaries found in the repo Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Maintained 🟢 10 19 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10 Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies ⚠️ 2 dependency not pinned by hash detected -- score normalized to 2 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 10 license file detected Fuzzing ⚠️ 0 project is not fuzzed Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches Packaging 🟢 10 packaging workflow detected Signed-Releases ⚠️ -1 no releases found Security-Policy 🟢 10 security policy file detected SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0

Scanned Files

• package-lock.json