[dependabot]

Bumps the npm-minor-and-patch group with 3 updates in the / directory: webpack, mongodb and ip-address.

Updates webpack from 5.110.1 to 5.110.2

Release notes

Sourced from webpack's releases.

v5.110.2

Patch Changes

• Fix analyzable ESM baking around cycles, mixed-served wasm and style url maps. (by @​alexander-akait in #21851)

• Minify more HTML and CSS shorthands, and cut two costs off printing. (by @​alexander-akait in #21842)

• Report a named import that is never read when it names a missing export. (by @​alexander-akait in #21856)

• Fix ESM circular reexports, cyclic const TDZ, and defer evaluation order. (by @​alexander-akait in #21852)

• Stop output.html emitting an unused JS chunk for each generated page. (by @​alexander-akait in #21859)

• Stop emitting the CSS chunk loading runtime when every CSS chunk is initial. (by @​alexander-akait in #21862)

• Strip a BOM a loader put on a string, and shift a source map that counted it. (by @​alexander-akait in #21857)

Changelog

Sourced from webpack's changelog.

5.110.2

Patch Changes

• Fix analyzable ESM baking around cycles, mixed-served wasm and style url maps. (by @​alexander-akait in #21851)

• Minify more HTML and CSS shorthands, and cut two costs off printing. (by @​alexander-akait in #21842)

• Report a named import that is never read when it names a missing export. (by @​alexander-akait in #21856)

• Fix ESM circular reexports, cyclic const TDZ, and defer evaluation order. (by @​alexander-akait in #21852)

• Stop output.html emitting an unused JS chunk for each generated page. (by @​alexander-akait in #21859)

• Stop emitting the CSS chunk loading runtime when every CSS chunk is initial. (by @​alexander-akait in #21862)

• Strip a BOM a loader put on a string, and shift a source map that counted it. (by @​alexander-akait in #21857)

Commits

• 75eec50 chore(release): new release (#21850)
• 0b28311 fix: move the source map with a removed BOM (#21861)
• c5fb111 fix(css): skip the loading runtime when every css chunk is initial (#21862)
• 17fa705 docs: update examples (#21860)
• e7ad244 fix: do not emit a JS chunk for an output.html generated page (#21859)
• b74192f fix(loaders): strip a BOM from a string result in the loader chain (#21857)
• 852e759 fix: report an unused named import that names a missing export (#21856)
• 2a6a4fa docs: drop the built-in-superseded loaders and plugins from the README (#21855)
• 1f3264e fix: ESM correctness in circular re-exports, imported bindings and defer orde...
• e9a34ae fix(analyzable): bake urls past cycles, mixed-served wasm and partial style m...
• Additional commits viewable in compare view

Updates mongodb from 7.5.0 to 7.6.0

Release notes

Sourced from mongodb's releases.

v7.6.0

7.6.0 (2026-08-21)

The MongoDB Node.js team is pleased to announce version 7.6.0 of the mongodb package!

Release Notes

Support for MongoDB 4.2 is removed

[!WARNING] When the driver connects to a MongoDB server of version 4.2 or less, it will now throw an error.

HTTP proxy support for KMS requests in CSFLE and Queryable Encryption

In-use encryption can now route KMS requests through an HTTP proxy. Set kmsConnectCallback on your ClientEncryption or auto-encryption options to control how the driver connects to a KMS host. The callback receives the target host and port and returns a connected socket (for example, a tunnel opened with HTTP CONNECT); the driver then performs the KMS TLS handshake over that socket using the provider's configured TLS options. This unblocks CSFLE and Queryable Encryption in environments that require an HTTP forward proxy for outbound KMS traffic, which the existing SOCKS5 proxyOptions does not cover.

const clientEncryption = new ClientEncryption(keyVaultClient, {
  keyVaultNamespace,
  kmsProviders,
  // Establish the KMS connection through your HTTP proxy; the driver adds TLS.
  kmsConnectCallback: ({ host, port }) => connectThroughHttpProxy(host, port)
});

Improved Intelligent Workload Management

Improved performance for MongoDB 9.0's Intelligent Workload Management (IWM) by only retrying overload errors when doing so is expected to not worsen server conditions

Bundling the driver into ESM no longer throws ReferenceError: require is not defined

v7.2.0 introduced the experimental runtimeAdapters option and, as part of it, replaced the driver’s static import of Node’s os module with a runtime require('os'). That works in a CommonJS build, but when the driver is bundled into ESM output (e.g. a Vite/esbuild/rollup server build with "type": "module"), there is no require in module scope, so constructing a client threw ReferenceError: require is not defined. The driver now loads the default os adapter through a dynamic import() that survives bundling, so new MongoClient() works in ESM bundles. CommonJS usage is unchanged, and supplying your own runtimeAdapters.os continues to work.

Bulk writes serialize each document only once

insertMany and bulkWrite previously processed each document twice - once to measure its size for batch splitting (a full recursive walk via calculateObjectSize) and again to serialize it into the command sent to the server. Documents are now serialized a single time and the resulting bytes are reused for both, decreasing the BSON-encoding CPU spent on bulk writes and reducing event-loop blocking during large batches. The improvement is most noticeable with high document counts and documents that have many fields.

Features

• NODE-7546: add HTTP Proxy support for QE & CSFLE (#5007) (3366c21)
• NODE-7547: bump minimum support server/wire versions to '4.4' & '9' respectively (#4994) (3d97028)
• NODE-7624: support baseBackoffMS and update client backpressure backoff (#5020) (560837b)

Bug Fixes

• NODE-7603: emit dynamic import('os') via tsconfig (#4992) (52f5e61)

Performance Improvements

... (truncated)

Changelog

Sourced from mongodb's changelog.

7.6.0 (2026-08-21)

Features

• NODE-7546: add HTTP Proxy support for QE & CSFLE (#5007) (3366c21)
• NODE-7547: bump minimum support server/wire versions to '4.4' & '9' respectively (#4994) (3d97028)
• NODE-7624: support baseBackoffMS and update client backpressure backoff (#5020) (560837b)

Bug Fixes

• NODE-7603: emit dynamic import('os') via tsconfig (#4992) (52f5e61)

Performance Improvements

• NODE-7660: serialize bulk write documents a single time (#4999) (1217aa1)

Commits

• 0fb2c13 chore(main): release 7.6.0 (#5001)
• bb35ded docs: Add preliminary checks to release instructions (#5028)
• 560837b feat(NODE-7624): support baseBackoffMS and update client backpressure backoff...
• ce33c59 chore(NODE-7767): bson compat tests snappy fix (#5025)
• 0f2ed29 chore(NODE-7770): add server 9.0 to the test matrix (#5024)
• bc92c29 chore(NODE-7767): snappy 7.4 is incompatible in CI (#5021)
• dce7939 chore(NODE-7759): pin bson-compat server (#5018)
• 7f8edf3 chore: run bson compat tests against latest server (#5017)
• 30c31e5 ci(deps): bump drivers-evergreen-tools from 3741fa9 to e86753e (#5016)
• 3366c21 feat(NODE-7546): add HTTP Proxy support for QE & CSFLE (#5007)
• Additional commits viewable in compare view

Updates ip-address from 10.5.0 to 10.7.0

Release notes

Sourced from ip-address's releases.

v10.7.0

What's Changed

• Add offset() and nextNetwork(), accept prefix-length ip6.arpa names, correct the IPv6 end-address docs by @​beaugunderson in beaugunderson/ip-address#225

Full Changelog: beaugunderson/ip-address@v10.6.0...v10.7.0

v10.6.0

What's Changed

• Add isGlobal() and pin the classifiers to the IANA special-purpose registries by @​beaugunderson in beaugunderson/ip-address#224

Full Changelog: beaugunderson/ip-address@v10.5.1...v10.6.0

v10.5.1

Full Changelog: beaugunderson/ip-address@v10.5.0...v10.5.1

Commits

• 2b7cab5 10.7.0
• 87fae23 Add offset() and nextNetwork(), accept prefix-length ip6.arpa names, correct ...
• 42c1f8b 10.6.0
• fb12583 Add isGlobal() and pin the classifiers to the IANA special-purpose registries...
• 38b02d7 10.5.1
• d03e960 Merge commit from fork
• ab3dc88 Merge commit from fork
• See full diff in compare view

[github-actions]

No updates since 2026-09-03T15:12:51Z (over 1 days), so this PR has been converted to draft. That stops it holding CI runners.

Nothing is lost — gh pr ready 3188, or the "Ready for review" button, picks it straight back up. Add the keep-ready label to exempt it permanently.

Converting to draft disables auto-merge, so PRs with auto-merge enabled are excluded from this entirely.

[github-actions]

No updates since 2026-09-04T18:01:05Z (over 1 days), so this PR has been converted to draft. That stops it holding CI runners.

Nothing is lost — gh pr ready 3188, or the "Ready for review" button, picks it straight back up. Add the keep-ready label to exempt it permanently.

Converting to draft disables auto-merge, so PRs with auto-merge enabled are excluded from this entirely.

[github-actions]

No updates since 2026-09-06T00:02:15Z (over 1 days), so this PR has been converted to draft. That stops it holding CI runners.

Nothing is lost — gh pr ready 3188, or the "Ready for review" button, picks it straight back up. Add the keep-ready label to exempt it permanently.

Converting to draft disables auto-merge, so PRs with auto-merge enabled are excluded from this entirely.

[HughParry]

Superseded by #3195, which combines this with the other open Dependabot updates.

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml