Skip to content

Bump the runtime group across 1 directory with 3 updates - #869

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/runtime-0fe7f2a1ee
Open

Bump the runtime group across 1 directory with 3 updates#869
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/runtime-0fe7f2a1ee

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 14, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the runtime group with 3 updates in the / directory: @defra/hapi-tracing, dotenv and mongodb.

Updates @defra/hapi-tracing from 1.30.0 to 1.30.1

Commits
  • d44bb89 Version package [skip ci]
  • 319a24d Merge pull request #247 from DEFRA/CORE-3746
  • 309be11 CORE-3746 Update dependencies
  • 9669c5f CORE-3746: refresh web identity credentials before session expiry
  • e98d055 Version package [skip ci]
  • 330c160 Merge pull request #246 from DEFRA/CORE-3746
  • 1435cf5 CORE-3746 Add environment validation options for deployment types
  • c4f0217 CORE-3876: Bump @​changesets/cli to fix false unpublished detection under npm ...
  • 0308ed7 CORe-3876: fix validation kit release (#244)
  • a8ef696 CORE-33876: Bump node version (#243)
  • Additional commits viewable in compare view

Updates dotenv from 17.4.2 to 18.0.8

Changelog

Sourced from dotenv's changelog.

18.0.8 (2026-10-14)

Changed

  • Fast parser should strip appended extra quotes (#1073)
  • Type detail improvement (#1074)

18.0.7 (2026-10-09)

Changed

  • Treat undefined settings like quiet: true as null rather than falsey (#1070)
  • CLI should honor DOTENV_QUIET setting in .env file (#1071)

18.0.6 (2026-10-06)

Changed

  • Use smarter parseBoolean not Boolean() to fix override (#1069)

18.0.5 (2026-09-30)

Changed

  • Fix missing typescript module declaration (#1068)
  • Improve performance for large .env files (#1066)

18.0.4 (2026-09-25)

Changed

  • import dotenv/config should default quiet: true (#1063)

18.0.3 (2026-09-22)

Changed

  • Patch DOTENV_QUIET setting when inside .env file (#1059)

18.0.2 (2026-09-21)

Changed

  • Patch additional edge cases for the fast parser (#1056)

18.0.1 (2026-09-18)

Changed

  • Handle file urls in config logging (#1054)

... (truncated)

Commits
  • e2fe95e 18.0.8
  • 7aa712a type detail improvement
  • 53405b0 Merge pull request #1074 from himanshu748/codex/fix-dotenv-populate-undefined...
  • 0b4843a changelog
  • 55855ab Merge pull request #1073 from xiehuanyi/fix/unicode-unquoting-parity
  • f757811 fix(types): allow undefined values in populate output
  • fde5db2 Keep fast-parser unquoting consistent at Unicode line boundaries
  • 2953207 18.0.7
  • 9944723 make more readable for undefined -> null
  • d455db0 Merge branch 'master' of github.com:motdotla/dotenv
  • Additional commits viewable in compare view

Updates mongodb from 7.2.0 to 7.7.0

Release notes

Sourced from mongodb's releases.

v7.7.0

7.7.0 (2026-09-28)

The MongoDB Node.js team is pleased to announce version 7.7.0 of the mongodb package!

Release Notes

OIDC authentication recovers from a failed token fetch

A single failed OIDC token fetch, such as a cloud metadata endpoint timing out, used to leave the driver's token-fetch mutex holding that failure. Every later operation on the affected MongoClient then failed with the original error without attempting a new token fetch, and only restarting the process restored authentication. A failed token fetch now affects only the operation that triggered it.

Driver dependencies updates

Dependency version changes:

  • bson: 7.2.0 -> 7.3.2
  • mongodb-connection-string-url: 7.0.1 -> 7.0.2
  • mongodb-js/saslprep: 1.4.11 -> 1.5.0

Features

  • NODE-7670: update dependencies, including next BSON minor (#5034) (995edbf)

Bug Fixes

  • NODE-7858: re-arm OIDC callback lock after a rejection (#5056) (7e953ed)

Documentation

We invite you to try the mongodb library immediately, and report any issues to the NODE project.

v7.6.0

7.6.0 (2026-08-21)

The MongoDB Node.js team is pleased to announce version 7.6.0 of the mongodb package!

Release Notes

Support for MongoDB 4.2 is removed

[!WARNING] When the driver connects to a MongoDB server of version 4.2 or less, it will now throw an error.

HTTP proxy support for KMS requests in CSFLE and Queryable Encryption

In-use encryption can now route KMS requests through an HTTP proxy. Set kmsConnectCallback on your ClientEncryption or auto-encryption options to control how the driver connects to a KMS host. The callback receives the target host and port and returns a connected socket (for example, a tunnel opened with HTTP CONNECT); the driver then performs the KMS TLS handshake over that socket using the provider's configured TLS options. This unblocks CSFLE and Queryable Encryption in environments that require an HTTP forward proxy for outbound KMS traffic, which the existing SOCKS5 proxyOptions does not cover.

... (truncated)

Changelog

Sourced from mongodb's changelog.

7.7.0 (2026-09-18)

Features

  • NODE-7670: update dependencies, including next BSON minor (#5034) (995edbf)

Bug Fixes

  • NODE-7858: re-arm OIDC callback lock after a rejection (#5056) (7e953ed)

7.6.0 (2026-08-21)

Features

  • NODE-7546: add HTTP Proxy support for QE & CSFLE (#5007) (3366c21)
  • NODE-7547: bump minimum support server/wire versions to '4.4' & '9' respectively (#4994) (3d97028)
  • NODE-7624: support baseBackoffMS and update client backpressure backoff (#5020) (560837b)

Bug Fixes

  • NODE-7603: emit dynamic import('os') via tsconfig (#4992) (52f5e61)

Performance Improvements

  • NODE-7660: serialize bulk write documents a single time (#4999) (1217aa1)

7.5.0 (2026-07-07)

Features

  • NODE-7537: promote QE string queries (prefix/suffix/substring) (#4996) (dc4900c)

Bug Fixes

7.4.0 (2026-06-25)

Features

  • NODE-7634: remove experimental tag from async dispose methods (#4976) (43ce3eb)
  • NODE-7549: send afterClusterTime on writes in causally-consistent sessions (#4963) (3abfd26)

... (truncated)

Commits
  • 20b001b chore(main): release 7.7.0 (#5039)
  • 7e953ed fix(NODE-7858): re-arm OIDC callback lock after a rejection (#5056)
  • 73f4982 test(NODE-7831): widen duration bounds in flaky timing assertions (#5050)
  • cca9250 chore(NODE-7856): bump drivers-evergreen-tools submodule to unblock CI (#5055)
  • 783d489 chore(NODE-7771): align tags to match their versions on evergreen tasks (#5048)
  • af0bcb2 chore(NODE-7691): add optional section into PR template for bug fixes (#5042)
  • 83668e6 chore(NODE-7694): Successful lint tasks can precede integration tests as a de...
  • 28e455d chore(NODE-7788): remove csot perf tests (#5044)
  • dba1544 chore(NODE-7805): restrict release_notes to PRs from this repository (#5043)
  • de31f12 chore: bump drivers-evergreen-tools (#5047)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for mongodb since your current version.

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Oct 14, 2026
@dependabot dependabot Bot mentioned this pull request Oct 14, 2026
Closed
@dependabot
Bump the runtime group across 1 directory with 3 updates
7253d90 
Bumps the runtime group with 3 updates in the / directory: [@defra/hapi-tracing](https://github.com/DEFRA/cdp-libraries), [dotenv](https://github.com/motdotla/dotenv) and [mongodb](https://github.com/mongodb/node-mongodb-native).


Updates `@defra/hapi-tracing` from 1.30.0 to 1.30.1
- [Release notes](https://github.com/DEFRA/cdp-libraries/releases)
- [Commits](DEFRA/cdp-libraries@hapi-tracing-1.30.0...hapi-tracing-1.30.1)

Updates `dotenv` from 17.4.2 to 18.0.8
- [Changelog](https://github.com/motdotla/dotenv/blob/master/CHANGELOG.md)
- [Commits](motdotla/dotenv@v17.4.2...v18.0.8)

Updates `mongodb` from 7.2.0 to 7.7.0
- [Release notes](https://github.com/mongodb/node-mongodb-native/releases)
- [Changelog](https://github.com/mongodb/node-mongodb-native/blob/main/HISTORY.md)
- [Commits](mongodb/node-mongodb-native@v7.2.0...v7.7.0)

---
updated-dependencies:
- dependency-name: "@defra/hapi-tracing"
  dependency-version: 1.30.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: runtime
- dependency-name: dotenv
  dependency-version: 18.0.7
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: runtime
- dependency-name: mongodb
  dependency-version: 7.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: runtime
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/runtime-0fe7f2a1ee branch from 8e860c1 to 7253d90 Compare October 22, 2026 16:47
@sonarqubecloud

sonarqubecloud Bot commented Oct 22, 2026

Copy link
Copy Markdown

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants