ci(deps): bump the prod-dependencies group across 1 directory with 3 updates

[dependabot]

Bumps the prod-dependencies group with 3 updates in the / directory: @mongodb-js/saslprep, bson and mongodb-connection-string-url.

Updates @mongodb-js/saslprep from 1.4.11 to 1.5.0

Commits

• 59635f4 chore(ci): bump packages
• aae8420 fix(oidc-http-server-pages): mongodb-query-parser was bumped (#860)
• 7ae2b09 feat: DSC support for mongodb runner (#822)
• 31c1d8e fix(oidc-http-server-pages): bump compass-components version COMPASS-10980 (#...
• 160f9cf chore(ci): bump packages
• a6cd3df fix(query-parser): update DBRef stringify to preserve type information COMPAS...
• c7cfc8a chore: update cidrs.json [skip ci]
• bf3ece9 chore(ci): bump packages
• 185b9a4 feat(query-parser)!: remove stringify (#859)
• 8524908 chore(ci): bump packages
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by devtools-npm-user, a new releaser for @​mongodb-js/saslprep since your current version.

Updates bson from 7.3.1 to 7.3.2

Release notes

Sourced from bson's releases.

v7.3.2

7.3.2 (2026-07-31)

The MongoDB Node.js team is pleased to announce version 7.3.2 of the bson package!

Release Notes

calculateObjectSize() now returns accurate byte counts for Int32 and BSONSymbol

Previously, each Int32 or BSONSymbol value caused a 12-byte overcount.

calculateObjectSize() now yields proper size calculations on ES Map's

This release of js-bson fixes an issue where we were incorrectly considering ES Map objects inside calculateObjectSize. This issue did not impact serialization, just size calculation.

Fixed incorrect date boundary in relaxed EJSON

This release of js-bson fixes an issue where the date boundary for relaxed EJSON was incorrectly set to a date 5 hours after the maximum limit of 10,000 AD.

Fixed an issue with ObjectId initialization in Cloudflare Workers

This release of js-bson fixes an issue where we were making crypto calls during module initialization, which is forbidden by Cloudflare Workers and other environments.

Memory optimization via smaller ObjectIds

ObjectId now stores its 12 bytes as four inline integers instead of a Uint8Array, cutting per-ObjectId memory by about 63% (and roughly 45 to 47% across large result sets) with no serialization slowdown. Deep equality and cloning are preserved (assert.deepStrictEqual, and lodash isEqual / cloneDeep).

Thanks to @​spokodev for contributing their fixes! (NODE-7631 (#901), NODE-7645 (#917), NODE-7646 (#910))

Bug Fixes

• NODE-7631: count Int32 and BSONSymbol in calculateObjectSize (#901) (7f948a6)
• NODE-7645: use the first instant of year 10000 as the relaxed EJSON date bound (#917) (9272c9a)
• NODE-7646: count ES Map entries in calculateObjectSize (#910) (8d28b12)
• NODE-7667: remove early initialization from ObjectId (#916) (665286f)

Performance Improvements

• NODE-6246: store ObjectId bytes as four packed integers (#893) (a84229c)

Documentation

• API
• Changelog

We invite you to try the bson library immediately, and report any issues to the NODE project.

Changelog

Sourced from bson's changelog.

7.3.2 (2026-07-31)

Bug Fixes

• NODE-7631: count Int32 and BSONSymbol in calculateObjectSize (#901) (7f948a6)
• NODE-7645: use the first instant of year 10000 as the relaxed EJSON date bound (#917) (9272c9a)
• NODE-7646: count ES Map entries in calculateObjectSize (#910) (8d28b12)
• NODE-7667: remove early initialization from ObjectId (#916) (665286f)

Performance Improvements

• NODE-6246: store ObjectId bytes as four packed integers (#893) (a84229c)

Commits

• 9cd2e68 chore(main): release 7.3.2 (#902)
• 9272c9a fix(NODE-7645): use the first instant of year 10000 as the relaxed EJSON date...
• 8d28b12 fix(NODE-7646): count ES Map entries in calculateObjectSize (#910)
• 665286f fix(NODE-7667): remove early initialization from ObjectId (#916)
• 1fc57e4 chore(NODE-7681): allow git fetch for npm12 (#914)
• 57b5bf0 chore: use bundled version of NPM (#913)
• a84229c perf(NODE-6246): store ObjectId bytes as four packed integers (#893)
• 7f948a6 fix(NODE-7631): count Int32 and BSONSymbol in calculateObjectSize (#901)
• See full diff in compare view

Updates mongodb-connection-string-url from 7.0.1 to 7.0.2

Release notes

Sourced from mongodb-connection-string-url's releases.

v7.0.2

7.0.2 (2026-07-15)

The MongoDB Node.js team is pleased to announce version 7.0.2 of the mongodb-connection-string-url package!

Release Notes

Loosened type restriction on generic arugments

• .typedSearchParams<...>()
• CommaAndColonSeparatedRecord<...>

The generics passed into these APIs were inadvertently made stricter than desirable. They've been updated to use the extends {} condition which permits string keyed types as a type argument. Notably improving the compatibility with the driver's AuthMechanismProperties type, a possible output of connection string parsing.

Fixed parsing issue

Unescaped @ in credentials now throws instead of silently misparsing.

Error messages no longer reveal invalid connection strings

Invalid connection strings are no longer revealed in error messages, reducing sensitive information disclosure. Historically we've had URI's embedded in error messages from validation failures.

Bug Fixes

• NODE-7449: loosen type requirement for generics on typedSearchParams and CommaAndColonSeparatedRecord (#116) (69bd1af)
• NODE-7597: handle unescaped @ in the password (#125) (9b39443)
• NODE-7663: uri disclosure on error (#131) (7a1f4ce)

Documentation

• Changelog

We invite you to try the mongodb-connection-string-url library immediately, and report any issues to the NODE project.

Changelog

Sourced from mongodb-connection-string-url's changelog.

7.0.2 (2026-07-09)

Bug Fixes

• NODE-7449: loosen type requirement for generics on typedSearchParams and CommaAndColonSeparatedRecord (#116) (69bd1af)
• NODE-7597: handle unescaped @ in the password COMPASS-10688 (#125) (9b39443)
• NODE-7663: uri disclosure on error (#131) (7a1f4ce)

Commits

• a084dac chore(main): release 7.0.2 (#117)
• 1480167 chore: fix release_notes action (#132)
• 7a1f4ce fix(NODE-7663): uri disclosure on error (#131)
• 9b39443 fix(NODE-7597): handle unescaped @ in the password COMPASS-10688 (#125)
• 09fd0f7 chore(deps): bump googleapis/release-please-action from 4 to 5 (#122)
• 342fd88 chore(deps): bump glob from 10.4.5 to 10.5.0 (#110)
• 911fc72 chore(deps): bump actions/checkout from 5 to 6 (#111)
• 1855495 chore(deps-dev): bump minimatch from 3.1.2 to 3.1.5 (#118)
• 6032b5c chore(deps): bump picomatch from 2.3.1 to 2.3.2 (#121)
• 7c64b4b chore(deps-dev): bump flatted from 3.3.3 to 3.4.2 (#120)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for mongodb-connection-string-url since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions