Skip to content

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Aug 27, 2025

Bumps bson from 4.7.2 to 6.10.4.

Release notes

Sourced from bson's releases.

v6.10.4

6.10.4 (2025-06-02)

The MongoDB Node.js team is pleased to announce version 6.10.4 of the bson package!

Release Notes

Top-Level Await removed from the browser BSON bundle

In versions <6.10.4, BSON uses a top-level await to asynchronously import the crypto module. This change unintentionally caused headaches for users of webpack, react native, vite and other tools bundlers and tools.

The top-level await has been removed from all BSON bundles. Thanks to @​lourd for this contribution.

Prevent the creation of incorrectly sized float32 vectors

This adds validation to our BSON.serialize and EJSON.stringify methods that will prevent creating float 32 vectors that are not a multiple of 4. Previously created vectors that do not meet this validation will still be deserialized and parsed so they can be fixed.

Additionally, the toFloat32Array(), toInt8Array(), and toPackedBits() methods now perform the same validation that serialize does to prevent use of incorrectly formatted Binary vector values. (For example, a packed bits vector with more than 7 bits of padding)

Vectors of an incorrect length could only be made manually (directly constructing the bytes and calling new Binary). We recommend using toFloat32Array and fromFloat32Array when interacting with Vectors in MongoDB as they handle the proper creation and translation of this data type.

Bug Fixes

  • NODE-6074: Removes top-level await in bson with separate node and browser ESM bundles (#749) (4602973)
  • NODE-6735, NODE-6711: add BSON vector validation to EJSON stringification, serialization and conversion to native types (#748) (64ff6a2)

Documentation

We invite you to try the bson library immediately, and report any issues to the NODE project.

v6.10.3

6.10.3 (2025-02-19)

The MongoDB Node.js team is pleased to announce version 6.10.3 of the bson package!

Release Notes

⚠️ Fixed potential data corruption bug when useBigInt64 is enabled

After refactoring to improve deserialization performance in #649, we inadvertently introduced a bug that manifested when deserializing Long values with the useBigInt64 flag enabled. The bug would lead to negative Long values being deserialized as unsigned integers. This issue has been resolved here.

Thanks to @​rkistner for reporting this bug!

Bug Fixes

  • NODE-6764: incorrect negative bigint handling (#752) (b3212b4)

... (truncated)

Changelog

Sourced from bson's changelog.

6.10.4 (2025-06-02)

Bug Fixes

  • NODE-6074: Removes top-level await in bson with separate node and browser ESM bundles (#749) (4602973)
  • NODE-6735, NODE-6711: add BSON vector validation to EJSON stringification, serialization and conversion to native types (#748) (64ff6a2)

6.10.3 (2025-02-19)

Bug Fixes

  • NODE-6764: incorrect negative bigint handling (#752) (b3212b4)

6.10.2 (2025-01-29)

Bug Fixes

  • NODE-6608: calculateObjectSize returns the wrong value for bigint (#742) (1fed073)

6.10.1 (2024-11-27)

Bug Fixes

  • NODE-6552: remove cache and use toStringTag in type helpers (#740) (3ede13e)

Performance Improvements

  • NODE-6450: Lazy objectId hex string cache (#722) (7c37580)

6.10.0 (2024-11-18)

Features

  • NODE-6537: add support for binary vectors (#730) (d7bdcec)

Bug Fixes

  • NODE-6536: Binary.read never returns number[] and reads beyond content (#727) (f99fdfd)

6.9.0 (2024-10-15)

Features

... (truncated)

Commits
  • 302f96e chore(main): release 6.10.4 (#803)
  • da8a4bf chore: revert release 6.10.4 (#802)
  • 8d712be chore(main): release 6.10.4 (#800)
  • 0203beb chore: revert 6.10 release to try again (#799)
  • b021bd8 chore(main): release 6.10.4 (#789)
  • 86f9dc4 chore(NODE-6938): update typescript to 5.8.3 (#793)
  • 3e5f1f8 deps(NODE-6898): FY26Q2 dependency updates (#795)
  • 17650e1 chore(NODE-6921): perf tests default to cwd and errexit (#791)
  • 7f2a6d3 test(NODE-6920): esm bundles do not have top-level await (#790)
  • 4602973 fix(NODE-6074): Removes top-level await in bson with separate node and browse...
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by dbx-node, a new releaser for bson since your current version.


Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [bson](https://github.com/mongodb/js-bson) from 4.7.2 to 6.10.4.
- [Release notes](https://github.com/mongodb/js-bson/releases)
- [Changelog](https://github.com/mongodb/js-bson/blob/main/HISTORY.md)
- [Commits](mongodb/js-bson@v4.7.2...v6.10.4)

---
updated-dependencies:
- dependency-name: bson
  dependency-version: 6.10.4
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Aug 27, 2025
@dependabot dependabot bot requested a review from a team as a code owner August 27, 2025 09:09
@dependabot dependabot bot added the javascript Pull requests that update Javascript code label Aug 27, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code
Projects
None yet
Development

Successfully merging this pull request may close these issues.

0 participants