chore(deps): bump mongodb from 5.9.2 to 7.5.0

[dependabot]

Bumps mongodb from 5.9.2 to 7.5.0.

Release notes

Sourced from mongodb's releases.

v7.5.0

7.5.0 (2026-07-07)

The MongoDB Node.js team is pleased to announce version 7.5.0 of the mongodb package!

Release Notes

Support for Queryable Encryption String Query GA in MongoDB 9.0

Queryable Encryption string queries are now available for MongoDB 9.0. Building on the technical preview introduced in earlier releases, this feature lets you run exact and range-style string matching against encrypted fields. As part of the promotion to GA, the API has been renamed:

• The TextOpts API is replaced with StringOpts.
• The TextPreview algorithm is replaced with String.
• The prefix, suffix, and substring query types are now generally available.
• The prefixPreview, suffixPreview, and substringPreview query types are deprecated and will be removed in a future release.

MongoClient.close() now closes in-use connections on all servers

Since v6.17.0, MongoClient.close() has eagerly closed checked-out (in-use) connections so that in-flight operations are interrupted promptly with a MongoClientClosedError instead of holding the client open. However, due to a bug, on replica sets and sharded clusters operations in flight on other servers were not interrupted, and their connections stayed open until the operations completed on their own. Calls to closeCheckedOutConnections() will now ensure all checked out connections are closed across all servers.

Thank you to @​Nepomuk5665 and @​sarthaksoni25 for bringing this to our attention/providing an initial implementation!

Features

• NODE-7537: promote QE string queries (prefix/suffix/substring) (#4996) (dc4900c)

Bug Fixes

• NODE-7411: iterate all servers on close (#4967) (72c0296)

Documentation

• Reference
• API
• Changelog

We invite you to try the mongodb library immediately, and report any issues to the NODE project.

v7.4.0

7.4.0 (2026-06-25)

The MongoDB Node.js team is pleased to announce version 7.4.0 of the mongodb package!

Release Notes

... (truncated)

Changelog

Sourced from mongodb's changelog.

7.5.0 (2026-07-07)

Features

• NODE-7537: promote QE string queries (prefix/suffix/substring) (#4996) (dc4900c)

Bug Fixes

• NODE-7411: iterate all servers on close (#4967) (72c0296)

7.4.0 (2026-06-25)

Features

• NODE-7634: remove experimental tag from async dispose methods (#4976) (43ce3eb)
• NODE-7549: send afterClusterTime on writes in causally-consistent sessions (#4963) (3abfd26)

7.3.0 (2026-06-04)

Features

• NODE-7518: bump maxWireVersion (#4950) (4447050)

Bug Fixes

• NODE-7548: SCRAM authentication fails on non-Node runtimes (#4932) (a10d2c9)

7.2.0 (2026-04-17)

Features

• NODE-7142: Exponential backoff and jitter in retry loops (#4871) (22c6031)
• NODE-7315: Use BSON ByteUtils instead of Nodejs Buffer (#4840) (1add538)
• NODE-7335: Create dedicated mocha runner with isolated vm context (#4876) (a4cba4c)
• NODE-7379: Refactor Crypto to Web Crypto API (#4862) (ac98f4a)
• NODE-7385: add experimental os runtime adapter (#4851) (d2ad07f)
• NODE-7441: add ChangeStream.bufferedCount (#4870) (f7ea421)
• NODE-7452: restrict server deprioritization on replica sets to overload errors (#4875) (87a3465)
• NODE-7467: make token bucket optional in client backpressure (#4878) (4fb0a0a)
• NODE-7491: finalize client backpressure implementation for phase 1 rollout (#4920) (2cc7983)

Bug Fixes

... (truncated)

Commits

• c436831 chore(main): release 7.5.0 (#4978)
• 910f9da docs(NODE-7635): clarify IWM options documentation (#4997)
• 95572f3 chore(deps): bump drivers-evergreen-tools from 4b02eb0 to ea6e66a (#4995)
• dc4900c feat(NODE-7537): promote QE string queries (prefix/suffix/substring) (#4996)
• 72c0296 fix(NODE-7411): iterate all servers on close (#4967)
• b6c60da chore(NODE-7520): update dependencies (#4962)
• 88990e6 test(NODE-7028): fix flaky AbortSignal timing assertions (#4981)
• 371579d fix(NODE-7171): capture resume token before resumeTokenChanged fires (#4973)
• de45b94 test(NODE-7590): use connectionReady in waitUntilPoolsFilled (#4975)
• 53e73a9 docs: add 7.4 docs (#4977)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for mongodb since your current version.

[netlify]

✅ Deploy Preview for endearing-brigadeiros-63f9d0 canceled.

Name	Link
🔨 Latest commit	a83600d
🔍 Latest deploy log	https://app.netlify.com/projects/endearing-brigadeiros-63f9d0/deploys/6a603c19e4d2e80008d530f9

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
npm/@mongodb-js/saslprep	1.4.12	Unknown	Unknown
npm/@types/node	22.19.8	🟢 6.5	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10 Code-Review 🟢 8 Found 25/30 approved changesets -- score normalized to 8 Packaging ⚠️ -1 packaging workflow not detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Security-Policy 🟢 10 security policy file detected License 🟢 9 license file detected Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md Signed-Releases ⚠️ -1 no releases found SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0 Binary-Artifacts 🟢 10 no binaries found in the repo Pinned-Dependencies 🟢 8 dependency not pinned by hash detected -- score normalized to 8 Fuzzing ⚠️ 0 project is not fuzzed
npm/@types/whatwg-url	13.0.0	🟢 6.5	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10 Code-Review 🟢 8 Found 25/30 approved changesets -- score normalized to 8 Packaging ⚠️ -1 packaging workflow not detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Security-Policy 🟢 10 security policy file detected License 🟢 9 license file detected Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md Signed-Releases ⚠️ -1 no releases found SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0 Binary-Artifacts 🟢 10 no binaries found in the repo Pinned-Dependencies 🟢 8 dependency not pinned by hash detected -- score normalized to 8 Fuzzing ⚠️ 0 project is not fuzzed
npm/bson	7.3.1	🟢 6.2	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Packaging ⚠️ -1 packaging workflow not detected Maintained 🟢 10 17 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Security-Policy ⚠️ 0 security policy file not detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Branch-Protection 🟢 5 branch protection is not maximal on development and all release branches Signed-Releases 🟢 8 5 out of the last 5 releases have a total of 5 signed artifacts. SAST 🟢 9 SAST tool detected but not run on all commits
npm/mongodb	7.5.0	🟢 6.2	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 Code-Review 🟢 10 all changesets reviewed CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Security-Policy ⚠️ 0 security policy file not detected License 🟢 10 license file detected Branch-Protection 🟢 5 branch protection is not maximal on development and all release branches Signed-Releases 🟢 8 5 out of the last 5 releases have a total of 5 signed artifacts. SAST 🟢 10 SAST tool is run on all commits Binary-Artifacts 🟢 10 no binaries found in the repo Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Fuzzing ⚠️ 0 project is not fuzzed
npm/mongodb-connection-string-url	7.0.2	🟢 6	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Maintained 🟢 10 12 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Binary-Artifacts 🟢 10 no binaries found in the repo Packaging ⚠️ -1 packaging workflow not detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Security-Policy ⚠️ 0 security policy file not detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection 🟢 5 branch protection is not maximal on development and all release branches SAST 🟢 9 SAST tool is not run on all commits -- score normalized to 9
npm/tr46	5.1.1	🟢 3.8	Details Check Score Reason Code-Review ⚠️ 1 Found 5/26 approved changesets -- score normalized to 1 Packaging ⚠️ -1 packaging workflow not detected Maintained ⚠️ 0 0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0 Pinned-Dependencies 🟢 3 dependency not pinned by hash detected -- score normalized to 3 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches Security-Policy 🟢 10 security policy file detected SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
npm/undici-types	6.21.0	🟢 8.1	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 8 issue activity found in the last 90 days -- score normalized to 10 Code-Review 🟢 10 all changesets reviewed Security-Policy 🟢 10 security policy file detected Dependency-Update-Tool 🟢 10 update tool detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Binary-Artifacts 🟢 8 binaries present in source code Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Pinned-Dependencies 🟢 6 dependency not pinned by hash detected -- score normalized to 6 Signed-Releases ⚠️ -1 no releases found Vulnerabilities 🟢 5 5 existing vulnerabilities detected SAST 🟢 10 SAST tool is run on all commits License 🟢 10 license file detected Packaging 🟢 10 packaging workflow detected Fuzzing 🟢 10 project is fuzzed Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md CI-Tests 🟢 10 30 out of 30 merged PRs checked by a CI test -- score normalized to 10 Contributors 🟢 10 project has 71 contributing companies or organizations
npm/whatwg-url	14.2.0	🟢 5	Details Check Score Reason Code-Review ⚠️ 0 Found 2/28 approved changesets -- score normalized to 0 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Maintained 🟢 10 19 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 Binary-Artifacts 🟢 10 no binaries found in the repo Pinned-Dependencies ⚠️ 2 dependency not pinned by hash detected -- score normalized to 2 Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Packaging 🟢 10 packaging workflow detected Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches Signed-Releases ⚠️ -1 no releases found Security-Policy 🟢 10 security policy file detected SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0

Scanned Files

• package-lock.json