chore(NODE-7670): update dependencies - #5034
Conversation
Quarterly dependency refresh for the driver on main (subtask of NODE-7669). - 3 production and 17 development dependencies updated to the latest semver-compatible versions. No peer dependency ranges changed. - actions/checkout v6 -> v7 across 13 call sites. The only behavioral change in v7 blocks fork-PR checkout for pull_request_target and workflow_run; this repo uses neither trigger. - prettier held at ^3.6.2. 3.9.6 reformats the codebase (92 prettier/prettier errors across 6 files), which the AC requires be done in a separate PR only if the team agrees it is worthwhile. - Fixed five dependabot ignore rules that no longer matched their stated intent: chai and sinon-chai were pinned at versions we already ship, so all updates including patches were blocked; @types/chai is no longer a direct dependency; mocha-plugin-eslint named a package absent from our tree (the real one is eslint-plugin-mocha), so the rule never took effect; and sinon used "18.x", which ignores the 18 line and allows 19+, inverting the intent recorded in its comment. - Added a github-actions ignore rule for github/codeql-action so we keep tracking the floating v4 tag per GitHub's recommendation instead of being pinned to an exact patch. Supersedes #5031, #5023 (except prettier), #4985 and #5014.
There was a problem hiding this comment.
Pull request overview
Quarterly dependency refresh for the MongoDB Node.js driver, updating a small set of production/runtime dependencies plus several dev-tooling dependencies, and aligning GitHub automation (workflows + Dependabot rules) with the intended maintenance strategy.
Changes:
- Bumped runtime dependencies:
@mongodb-js/saslprep,bson, andmongodb-connection-string-url. - Bumped dev dependencies (lint/build/test tooling and helpers), while pinning
prettierto3.6.2to avoid repo-wide reformat churn. - Updated GitHub Actions workflow checkouts to
actions/checkout@v7and fixed/clarified Dependabot ignore rules (including ignoringgithub/codeql-action4.x patch pins while still surfacing major updates).
Reviewed changes
Copilot reviewed 13 out of 14 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| package.json | Updates runtime + dev dependency versions; pins prettier to 3.6.2. |
| package-lock.json | Regenerated lockfile to reflect updated dependency graph and resolved versions. |
| .github/workflows/sbom.yml | Updates checkout action to v7 for SBOM workflow. |
| .github/workflows/release.yml | Updates checkout action to v7 in release workflows. |
| .github/workflows/release-nightly.yml | Updates checkout action to v7 in nightly release workflow. |
| .github/workflows/release-alpha.yml | Updates checkout action to v7 in alpha release workflow. |
| .github/workflows/release-5.x.yml | Updates checkout action to v7 in 5.x release workflow. |
| .github/workflows/release_notes.yml | Updates checkout action to v7 in release notes workflow. |
| .github/workflows/npm-publish.yml | Updates checkout action to v7 in publish workflow. |
| .github/workflows/dependencies.yml | Updates checkout action to v7 in dependency-check workflow. |
| .github/workflows/codeql.yml | Updates checkout action to v7 in CodeQL workflow. |
| .github/workflows/build_docs.yml | Updates checkout action to v7 in docs build workflow. |
| .github/workflows/build_and_commit_docs.yml | Updates checkout action to v7 in docs build+commit workflow. |
| .github/dependabot.yml | Fixes/clarifies ignore rules; adds github/codeql-action 4.x ignore under github-actions. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
johnmtll
added
the
Primary Review
| # sinon-chai 5.x+ is not yet evaluated against our chai version. | ||
| - dependency-name: "sinon-chai" |
There was a problem hiding this comment.
"not yet evaluated against our current chai version"
This comment is a little misleading I think. There is no release of sinon-chai v5. I suggest we remove this rule. If this is intended to guard against incompatibility we can discover that when they release v5 and dependabot opens a PR.
There was a problem hiding this comment.
Yup, oversight, removed.
| # NODE-7473 moved us to chai 5; chai 6 is not yet evaluated. | ||
| - dependency-name: "chai" |
There was a problem hiding this comment.
chai 6 is not yet evaluated
This seems like a strange ignore. 'Not yet evaluated' implies that there will be an effort at some point to do so, and a dedicated ticket is the prompt to do so if we're ignoring. Ideally shouldn't we discover whether or not going from v5->v6 in a dependency update cycle actually introduces enough complexity to warrant a dedicated ticket? With this rule we'll need to proactively evaluate it, whereas a future dependabot PR will prompt that evaluation within scope of a future dependency update cycle ticket. I suggest we remove this rule.
There was a problem hiding this comment.
Removed, next month we should get a dependabot update for chai 6, can start investigating the upgrade then.
| ignore: | ||
| # We intentionally track the floating v4 tag so CodeQL CLI updates and | ||
| # server-side flag changes are picked up automatically. Pinning to an exact | ||
| # patch makes this a recurring manual chore and risks breaking when a | ||
| # server-side flag is removed. Major bumps are still surfaced; update this | ||
| # range when we move to v5. | ||
| - dependency-name: "github/codeql-action" | ||
| versions: ["4.x"] |
There was a problem hiding this comment.
This reasoning regresses when https://jira.mongodb.org/browse/NODE-7720 is worked. Assuming we're being unversal with the rule and even applying it to first-party action providers. Can we get a comment on here calling out that this ignore rule should be removed when that task is actioned?
There was a problem hiding this comment.
Comment updated, now references NODE-7721, which will need to delete the codeql rule.
- Remove the chai and sinon-chai ignore rules. sinon-chai has no v5 release, so that rule guarded a version that does not exist. chai 6 has no tracking ticket, so ignoring it deferred the decision with nothing to surface it again; letting dependabot open the major-bump PR is what prompts evaluation during a future dependency update cycle, per our practice of handling majors in those cycles. - Note on the github/codeql-action rule that it must be removed when NODE-7721 pins our actions to commit SHAs. That work makes tag mutability the thing we are defending against rather than something we rely on, and dependabot needs to stay free to advance the pinned SHA. This leaves every remaining versioned ignore rule pointing at a ticket that will surface the decision again.
Description
Summary of Changes
Quarterly dependency update.
Covers:
ci(deps): bump the prod-dependencies group across 1 directory with 3 updatesci(deps-dev): bump the development-dependencies group across 1 directory with 9 updates(exceptprettier, see below)chore(deps): bump actions/checkout from 6 to 7Production dependencies (3)
@mongodb-js/saslprep^1.4.11^1.5.0bson^7.2.0^7.3.2mongodb-connection-string-url^7.0.1^7.0.2No peer dependency ranges were changed.
Development dependencies (17)
@aws-sdk/credential-providers^3.876.0^3.1117.0@microsoft/api-extractor^7.58.7^7.59.0@types/chai-subset^1.3.5^1.3.6@types/mocha^10.0.9^10.0.10@types/node^22.15.3^22.20.1@types/semver^7.7.0^7.8.0@typescript-eslint/eslint-plugin^8.60.1^8.68.0@typescript-eslint/parser^8.31.1^8.68.0esbuild^0.28.0^0.28.2eslint^9.39.1^9.39.5eslint-plugin-mocha^10.4.1^10.5.0js-yaml^4.2.0^4.3.1mocha^11.7.6^11.8.0mongodb-client-encryption^7.2.0^7.2.1semver^7.7.2^7.8.5socks^2.8.7^2.8.9yargs^18.0.0^18.1.0GitHub Actions
actions/checkoutv6 -> v7 across 13 call sites in 11 workflows. The only behavioralchange in v7 is that it blocks checking out fork PRs for
pull_request_targetandworkflow_run; this repo uses neither trigger, so the change is a no-op for us.Dependabot config fixes
Five
ignorerules in.github/dependabot.ymlno longer matched their stated intent:chaiwas pinned at>=5.0.0but we are already on chai 5 (NODE-7473 closed), soall chai updates including patches were blocked. Now
>=6.0.0.sinon-chaihad the same problem at>=4.0.0while we are on^4.0.1. Now>=5.0.0.@types/chaiis no longer a direct dependency (only transitive via@types/chai-subset), so the rule was dead. Removed.mocha-plugin-eslintdoes not exist in our dependency tree — the real package iseslint-plugin-mocha. The rule never took effect, which is why dependabot was able toopen chore(deps-dev): bump eslint-plugin-mocha from 10.5.0 to 11.3.0 #4812 bumping it to 11.3.0. Renamed and scoped to
>=11.0.0, referencingNODE-7616 / NODE-7615.
sinonwas set to["18.x"], which ignores the 18 line and allows 19+ — the inverseof the comment's intent. Now
>=19.0.0, keeping NODE-3773 blocked.Also added an ignore rule for
github/codeql-actionunder thegithub-actionsecosystem. We track the floating
v4tag on GitHub's ownrecommendation, so patch-level pins like #5014 should not be proposed. Major updates are still
surfaced. This supersedes #5014, which can be closed with a plain
close once this lands — no
@dependabot ignorecommand needed, which avoids leavinghidden ignore state in Dependabot's central store.
Notes for Reviewers
prettieris deliberately held at3.6.2. The dev-dependency group PR includesprettier
3.6.2 -> 3.9.6, which reformats the codebase: 92prettier/prettiererrorsacross
src/operations/list_collections.ts,src/sdam/monitor.ts,src/sdam/topology.ts,src/sort.ts,src/utils.ts, andtest/tools/unified-spec-runner/schema.ts, mostlyunion-type wrapping. Per the ticket AC, reformatting must be a separate PR and only if the
team agrees it is worth it. Holding prettier back makes lint clean.
Descoped, tracked elsewhere:
@types/node22 -> 24 (chore(deps-dev): bump @types/node from 22.18.12 to 24.10.1 #4811) — NODE-7296, NODE-7622eslint9 -> 10 — NODE-7615 (in progress, chore: Upgrade eslint from v9.x to v10.x #5005)eslint-plugin-mocha10 -> 11 — NODE-7616nyc17 -> 18 — NODE-7325 (migrate to c8 instead)typescript— out of scope per AC; NODE-7517 / NODE-7233sinon18 -> 22,@types/sinon17 -> 22 — blocked by NODE-3773; no upgrade ticket yetchai5 -> 6,chalk4 -> 6,js-yaml4 -> 5,eslint-plugin-simple-import-sort12 -> 14 — no tickets yetDouble check the following
npm run check:lint)type(NODE-xxxx)[!]: descriptionfeat(NODE-1234)!: rewriting everything in coffeescript