[dependabot]

Bumps mongodb from 6.20.0 to 7.8.0.

Release notes

Sourced from mongodb's releases.

v7.8.0

7.8.0 (2026-10-30)

The MongoDB Node.js team is pleased to announce version 7.8.0 of the mongodb package!

Release Notes

[!WARNING]
Node Driver versions from v6.11.0 and from v7.0.0 before v7.8.0 (this release) are affected by a security issue related to the use of the experimental timeoutMS feature where connection pool desynchronization after operation timeout can expose other users' data. Users are encouraged to discontinue the use of timeoutMS as soon as possible.

[!WARNING] Node Driver versions from v3.3.3 before v7.8.0 (this release) are affected by a security issue concerning the verification of host names returned by SRV lookups, which could allow an attacker in control of the DNS response to redirect the driver to a host outside the user's domain. Users using SRV records are encouraged to upgrade to v7.8.0 as soon as possible.

timeoutMS is deprecated and now a no-op

[!WARNING] timeoutMS and timeoutMode are deprecated and have no effect starting in this release. They are still accepted and will not throw, but operations will no longer time out because of them. They are slated for removal in a future release.

Use the per-stage timeouts instead: serverSelectionTimeoutMS, waitQueueTimeoutMS, socketTimeoutMS, and maxTimeMS for server-side execution.

Configurable SRV host validation

This release adds two new methods of validating DNS:

1. srvAllowedHostsSuffix - A host name suffix that every host returned by the SRV lookup must end with. This option can be configured on the client or the connection string.
2. srvHostValidator - A synchronous function that decides whether a host returned by the SRV lookup may be used. This option can only be configured on the client. This function must accept a string and has to return a boolean; returning anything else, including the Promise returned by an async function, will result in an error.

[!WARNING] Modifying the default SRV domain name validation can create vulnerabilities.

SRV host names are now compared in a normalized form (case-insensitively, without a trailing dot, and with internationalized names in xn-- form). Connection strings whose SRV host name differs in case from the host names returned by DNS, such as mongodb+srv://TEST1.TEST.BUILD.10GEN.CC, previously failed SRV verification and now connect.

zstd compression no longer requires @mongodb-js/zstd on Node.js 22.15.0+

The driver now uses Node.js' built-in zstd implementation when it is available. On older Node.js versions it continues to use @mongodb-js/zstd, so no changes are needed for existing setups.

Thanks to @​axelonet for the original contribution!

Distinguish between command-level options and index-level options when creating indexes

Before:

// Index options and command options were on the same object
await collection.createIndex(
  { email: 1 },
  {
    // index options
    unique: true,
    name: 'email_unique',
    // command options
    commitQuorum: 'majority',
</tr></table> 

... (truncated)

Changelog

Sourced from mongodb's changelog.

7.8.0 (2026-10-30)

Features

• NODE-6893: Distinguish between command-level options and index-level options when creating indexes (#5012) (ca0e451)
• NODE-7097: use Node.js built-in zstd when available (#5073) (b7eb8fd)
• NODE-7657: remove @​experimental tags from no-longer-experimental features (#5058) (694a848)
• NODE-7830: add srvAllowedHostsSuffix and srvHostValidator options (#5065) (19e2d3b)
• NODE-7958: make timeoutMS a no-op and deprecate it (#5085) (8345fe1)

Bug Fixes

• NODE-7643: preserve $meta direction in [field, direction] sort pair (#4988) (16136bb)
• NODE-7659: key unordered bulk insertedIds by originating operation index (#4989) (df513cf)
• NODE-7764: use $eq to match file IDs in GridFS queries (#5068) (218b6d7)
• NODE-7881: hello command is compressed (#5072) (399045a)

7.7.0 (2026-09-18)

Features

• NODE-7670: update dependencies, including next BSON minor (#5034) (995edbf)

Bug Fixes

• NODE-7858: re-arm OIDC callback lock after a rejection (#5056) (7e953ed)

7.6.0 (2026-08-21)

Features

• NODE-7546: add HTTP Proxy support for QE & CSFLE (#5007) (3366c21)
• NODE-7547: bump minimum support server/wire versions to '4.4' & '9' respectively (#4994) (3d97028)
• NODE-7624: support baseBackoffMS and update client backpressure backoff (#5020) (560837b)

Bug Fixes

• NODE-7603: emit dynamic import('os') via tsconfig (#4992) (52f5e61)

Performance Improvements

• NODE-7660: serialize bulk write documents a single time (#4999) (1217aa1)

... (truncated)

Commits

• c406cab chore(main): release 7.8.0 (#5070)
• 9c54464 docs: remove timeoutMS from experimental features (#5087)
• 8345fe1 feat(NODE-7958): make timeoutMS a no-op and deprecate it (#5085)
• 853ff46 ci(NODE-7963): pin node v26 in ci (#5086)
• 19e2d3b feat(NODE-7830): add srvAllowedHostsSuffix and srvHostValidator options (#5065)
• b7eb8fd feat(NODE-7097): use Node.js built-in zstd when available (#5073)
• 2a13e4b chore(NODE-6984): skip flaky CSOT test (#5079)
• 399045a fix(NODE-7881): hello command is compressed (#5072)
• ef6f6f3 chore(NODE-7833): 'latest' server binary behind s3 (#5074)
• 16136bb fix(NODE-7643): preserve $meta direction in [field, direction] sort pair (#4988)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for mongodb since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)