feat(NODE-7670): update dependencies, including next BSON minor

[PavelSafronov]

Description

Summary of Changes

Quarterly dependency update.

Covers:

1. ci(deps): bump the prod-dependencies group across 1 directory with 3 updates #5031 — ci(deps): bump the prod-dependencies group across 1 directory with 3 updates
2. ci(deps-dev): bump the development-dependencies group across 1 directory with 9 updates #5023 — ci(deps-dev): bump the development-dependencies group across 1 directory with 9 updates (except prettier, see below)
3. chore(deps): bump actions/checkout from 6 to 7 #4985 — chore(deps): bump actions/checkout from 6 to 7

Production dependencies (3)

Package	From	To
@mongodb-js/saslprep	^1.4.11	^1.5.0
bson	^7.2.0	^7.3.2
mongodb-connection-string-url	^7.0.1	^7.0.2

No peer dependency ranges were changed.

Development dependencies (17)

Package	From	To
@aws-sdk/credential-providers	^3.876.0	^3.1117.0
@microsoft/api-extractor	^7.58.7	^7.59.0
@types/chai-subset	^1.3.5	^1.3.6
@types/mocha	^10.0.9	^10.0.10
@types/node	^22.15.3	^22.20.1
@types/semver	^7.7.0	^7.8.0
@typescript-eslint/eslint-plugin	^8.60.1	^8.68.0
@typescript-eslint/parser	^8.31.1	^8.68.0
esbuild	^0.28.0	^0.28.2
eslint	^9.39.1	^9.39.5
eslint-plugin-mocha	^10.4.1	^10.5.0
js-yaml	^4.2.0	^4.3.1
mocha	^11.7.6	^11.8.0
mongodb-client-encryption	^7.2.0	^7.2.1
semver	^7.7.2	^7.8.5
socks	^2.8.7	^2.8.9
yargs	^18.0.0	^18.1.0

GitHub Actions

actions/checkout v6 -> v7 across 13 call sites in 11 workflows. The only behavioral
change in v7 is that it blocks checking out fork PRs for pull_request_target and
workflow_run; this repo uses neither trigger, so the change is a no-op for us.

Dependabot config fixes

Five ignore rules in .github/dependabot.yml no longer matched their stated intent:

• chai was pinned at >=5.0.0 but we are already on chai 5 (NODE-7473 closed), so
  all chai updates including patches were blocked. Now >=6.0.0.
• sinon-chai had the same problem at >=4.0.0 while we are on ^4.0.1. Now >=5.0.0.
• @types/chai is no longer a direct dependency (only transitive via
  @types/chai-subset), so the rule was dead. Removed.
• mocha-plugin-eslint does not exist in our dependency tree — the real package is
  eslint-plugin-mocha. The rule never took effect, which is why dependabot was able to
  open chore(deps-dev): bump eslint-plugin-mocha from 10.5.0 to 11.3.0 #4812 bumping it to 11.3.0. Renamed and scoped to >=11.0.0, referencing
  NODE-7616 / NODE-7615.
• sinon was set to ["18.x"], which ignores the 18 line and allows 19+ — the inverse
  of the comment's intent. Now >=19.0.0, keeping NODE-3773 blocked.

Also added an ignore rule for github/codeql-action under the github-actions
ecosystem. We track the floating v4 tag on GitHub's own
recommendation, so patch-level pins like #5014 should not be proposed. Major updates are still
surfaced. This supersedes #5014, which can be closed with a plain
close once this lands — no @dependabot ignore command needed, which avoids leaving
hidden ignore state in Dependabot's central store.

Notes for Reviewers

prettier is deliberately held at 3.6.2. The dev-dependency group PR includes
prettier 3.6.2 -> 3.9.6, which reformats the codebase: 92 prettier/prettier errors
across src/operations/list_collections.ts, src/sdam/monitor.ts, src/sdam/topology.ts,
src/sort.ts, src/utils.ts, and test/tools/unified-spec-runner/schema.ts, mostly
union-type wrapping. Per the ticket AC, reformatting must be a separate PR and only if the
team agrees it is worth it. Holding prettier back makes lint clean.

Descoped, tracked elsewhere:

• @types/node 22 -> 24 (chore(deps-dev): bump @types/node from 22.18.12 to 24.10.1 #4811) — NODE-7296, NODE-7622
• eslint 9 -> 10 — NODE-7615 (in progress, chore: Upgrade eslint from v9.x to v10.x #5005)
• eslint-plugin-mocha 10 -> 11 — NODE-7616
• nyc 17 -> 18 — NODE-7325 (migrate to c8 instead)
• typescript — out of scope per AC; NODE-7517 / NODE-7233
• sinon 18 -> 22, @types/sinon 17 -> 22 — blocked by NODE-3773; no upgrade ticket yet
• chai 5 -> 6, chalk 4 -> 6, js-yaml 4 -> 5,
  eslint-plugin-simple-import-sort 12 -> 14 — no tickets yet

Release Highlight

Driver dependencies updated, including BSON

Dependency version changes:

• bson: 7.2.0 -> 7.3.2
• mongodb-connection-string-url: 7.0.1 -> 7.0.2
• mongodb-js/saslprep: 1.4.11 -> 1.5.0

Double check the following

• Lint is passing (npm run check:lint)
• Self-review completed using the steps outlined here
• PR title follows the correct format: type(NODE-xxxx)[!]: description
  • Example: feat(NODE-1234)!: rewriting everything in coffeescript
• Changes are covered by tests
• New TODOs have a related JIRA ticket

[Copilot]

Pull request overview

Quarterly dependency refresh for the MongoDB Node.js driver, updating a small set of production/runtime dependencies plus several dev-tooling dependencies, and aligning GitHub automation (workflows + Dependabot rules) with the intended maintenance strategy.

Changes:

• Bumped runtime dependencies: @mongodb-js/saslprep, bson, and mongodb-connection-string-url.
• Bumped dev dependencies (lint/build/test tooling and helpers), while pinning prettier to 3.6.2 to avoid repo-wide reformat churn.
• Updated GitHub Actions workflow checkouts to actions/checkout@v7 and fixed/clarified Dependabot ignore rules (including ignoring github/codeql-action 4.x patch pins while still surfacing major updates).

Reviewed changes

Copilot reviewed 13 out of 14 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
package.json	Updates runtime + dev dependency versions; pins prettier to 3.6.2.
package-lock.json	Regenerated lockfile to reflect updated dependency graph and resolved versions.
.github/workflows/sbom.yml	Updates checkout action to v7 for SBOM workflow.
.github/workflows/release.yml	Updates checkout action to v7 in release workflows.
.github/workflows/release-nightly.yml	Updates checkout action to v7 in nightly release workflow.
.github/workflows/release-alpha.yml	Updates checkout action to v7 in alpha release workflow.
.github/workflows/release-5.x.yml	Updates checkout action to v7 in 5.x release workflow.
.github/workflows/release_notes.yml	Updates checkout action to v7 in release notes workflow.
.github/workflows/npm-publish.yml	Updates checkout action to v7 in publish workflow.
.github/workflows/dependencies.yml	Updates checkout action to v7 in dependency-check workflow.
.github/workflows/codeql.yml	Updates checkout action to v7 in CodeQL workflow.
.github/workflows/build_docs.yml	Updates checkout action to v7 in docs build workflow.
.github/workflows/build_and_commit_docs.yml	Updates checkout action to v7 in docs build+commit workflow.
.github/dependabot.yml	Fixes/clarifies ignore rules; adds github/codeql-action 4.x ignore under github-actions.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.