[dependabot]

Bumps the runtime group with 3 updates in the / directory: @defra/hapi-tracing, dotenv and mongodb.

Updates @defra/hapi-tracing from 1.30.0 to 1.30.2

Commits

• bb67a1b Version package [skip ci]
• 8d1572c Merge pull request #265 from DEFRA/CORE-4444
• 90aade0 CORE-4444 Bump dependencies
• 8af9e77 CORE-4444 Only patch TLS context when custom certs exist
• 8dfe434 Version package [skip ci]
• 1d15ce0 CORE-4360 Add cdp-log-pipeline to simulate the CDP log pipeline locally (#249)
• d44bb89 Version package [skip ci]
• 319a24d Merge pull request #247 from DEFRA/CORE-3746
• 309be11 CORE-3746 Update dependencies
• 9669c5f CORE-3746: refresh web identity credentials before session expiry
• Additional commits viewable in compare view

Updates dotenv from 17.4.2 to 18.0.9

Changelog

Sourced from dotenv's changelog.

18.0.9 (2026-10-14)

Changed

• Permit DOTENV_PATH being empty string with the CLI (#1076)

18.0.8 (2026-10-14)

Changed

• Fast parser should strip appended extra quotes (#1073)
• Type detail improvement (#1074)

18.0.7 (2026-10-09)

Changed

• Treat undefined settings like quiet: true as null rather than falsey (#1070)
• CLI should honor DOTENV_QUIET setting in .env file (#1071)

18.0.6 (2026-10-06)

Changed

• Use smarter parseBoolean not Boolean() to fix override (#1069)

18.0.5 (2026-09-30)

Changed

• Fix missing typescript module declaration (#1068)
• Improve performance for large .env files (#1066)

18.0.4 (2026-09-25)

Changed

• import dotenv/config should default quiet: true (#1063)

18.0.3 (2026-09-22)

Changed

• Patch DOTENV_QUIET setting when inside .env file (#1059)

18.0.2 (2026-09-21)

Changed

• Patch additional edge cases for the fast parser (#1056)

... (truncated)

Commits

• 8d1ab85 18.0.9
• 59a40ce changelog
• 88228bd Merge pull request #1076 from Enesuygurs/fix/cli-empty-dotenv-path
• bc6ef94 fix(cli): load the default .env when DOTENV_PATH is empty
• 6d6e6c5 Merge pull request #1075 from kory-kaai/test/fast-parser-branch-coverage
• 10218f1 test(parse-fast): cover the size-dependent and export-prefix branches
• e2fe95e 18.0.8
• 7aa712a type detail improvement
• 53405b0 Merge pull request #1074 from himanshu748/codex/fix-dotenv-populate-undefined...
• 0b4843a changelog
• Additional commits viewable in compare view

Updates mongodb from 7.2.0 to 7.8.0

Release notes

Sourced from mongodb's releases.

v7.8.0

7.8.0 (2026-10-30)

The MongoDB Node.js team is pleased to announce version 7.8.0 of the mongodb package!

Release Notes

[!WARNING]
Node Driver versions from v6.11.0 and from v7.0.0 before v7.8.0 (this release) are affected by a security issue related to the use of the experimental timeoutMS feature where connection pool desynchronization after operation timeout can expose other users' data (CVE-2026-119179). Users are encouraged to discontinue the use of timeoutMS as soon as possible.

[!WARNING] Node Driver versions from v3.3.3 before v7.8.0 (this release) are affected by a security issue concerning the verification of host names returned by SRV lookups, which could allow an attacker in control of the DNS response to redirect the driver to a host outside the user's domain. Users using SRV records are encouraged to upgrade to v7.8.0 as soon as possible.

timeoutMS is deprecated and now a no-op

[!WARNING] timeoutMS and timeoutMode are deprecated and have no effect starting in this release. They are still accepted and will not throw, but operations will no longer time out because of them. They are slated for removal in a future release.

Use the per-stage timeouts instead: serverSelectionTimeoutMS, waitQueueTimeoutMS, socketTimeoutMS, and maxTimeMS for server-side execution.

Configurable SRV host validation

This release adds two new methods of validating DNS:

1. srvAllowedHostsSuffix - A host name suffix that every host returned by the SRV lookup must end with. This option can be configured on the client or the connection string.
2. srvHostValidator - A synchronous function that decides whether a host returned by the SRV lookup may be used. This option can only be configured on the client. This function must accept a string and has to return a boolean; returning anything else, including the Promise returned by an async function, will result in an error.

[!WARNING] Modifying the default SRV domain name validation can create vulnerabilities.

SRV host names are now compared in a normalized form (case-insensitively, without a trailing dot, and with internationalized names in xn-- form). Connection strings whose SRV host name differs in case from the host names returned by DNS, such as mongodb+srv://TEST1.TEST.BUILD.10GEN.CC, previously failed SRV verification and now connect.

zstd compression no longer requires @mongodb-js/zstd on Node.js 22.15.0+

The driver now uses Node.js' built-in zstd implementation when it is available. On older Node.js versions it continues to use @mongodb-js/zstd, so no changes are needed for existing setups.

Thanks to @​axelonet for the original contribution!

Distinguish between command-level options and index-level options when creating indexes

Before:

// Index options and command options were on the same object
await collection.createIndex(
  { email: 1 },
  {
    // index options
    unique: true,
    name: 'email_unique',
    // command options
    commitQuorum: 'majority',
</tr></table> 

... (truncated)

Changelog

Sourced from mongodb's changelog.

7.8.0 (2026-10-30)

Features

• NODE-6893: Distinguish between command-level options and index-level options when creating indexes (#5012) (ca0e451)
• NODE-7097: use Node.js built-in zstd when available (#5073) (b7eb8fd)
• NODE-7657: remove @​experimental tags from no-longer-experimental features (#5058) (694a848)
• NODE-7830: add srvAllowedHostsSuffix and srvHostValidator options (#5065) (19e2d3b)
• NODE-7958: make timeoutMS a no-op and deprecate it (#5085) (8345fe1)

Bug Fixes

• NODE-7643: preserve $meta direction in [field, direction] sort pair (#4988) (16136bb)
• NODE-7659: key unordered bulk insertedIds by originating operation index (#4989) (df513cf)
• NODE-7764: use $eq to match file IDs in GridFS queries (#5068) (218b6d7)
• NODE-7881: hello command is compressed (#5072) (399045a)

7.7.0 (2026-09-18)

Features

• NODE-7670: update dependencies, including next BSON minor (#5034) (995edbf)

Bug Fixes

• NODE-7858: re-arm OIDC callback lock after a rejection (#5056) (7e953ed)

7.6.0 (2026-08-21)

Features

• NODE-7546: add HTTP Proxy support for QE & CSFLE (#5007) (3366c21)
• NODE-7547: bump minimum support server/wire versions to '4.4' & '9' respectively (#4994) (3d97028)
• NODE-7624: support baseBackoffMS and update client backpressure backoff (#5020) (560837b)

Bug Fixes

• NODE-7603: emit dynamic import('os') via tsconfig (#4992) (52f5e61)

Performance Improvements

• NODE-7660: serialize bulk write documents a single time (#4999) (1217aa1)

... (truncated)

Commits

• c406cab chore(main): release 7.8.0 (#5070)
• 9c54464 docs: remove timeoutMS from experimental features (#5087)
• 8345fe1 feat(NODE-7958): make timeoutMS a no-op and deprecate it (#5085)
• 853ff46 ci(NODE-7963): pin node v26 in ci (#5086)
• 19e2d3b feat(NODE-7830): add srvAllowedHostsSuffix and srvHostValidator options (#5065)
• b7eb8fd feat(NODE-7097): use Node.js built-in zstd when available (#5073)
• 2a13e4b chore(NODE-6984): skip flaky CSOT test (#5079)
• 399045a fix(NODE-7881): hello command is compressed (#5072)
• ef6f6f3 chore(NODE-7833): 'latest' server binary behind s3 (#5074)
• 16136bb fix(NODE-7643): preserve $meta direction in [field, direction] sort pair (#4988)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for mongodb since your current version.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud