chore(deps): bump mongodb from 7.2.0 to 7.5.0 in /paaster

[dependabot]

Bumps mongodb from 7.2.0 to 7.5.0.

Release notes

Sourced from mongodb's releases.

v7.5.0

7.5.0 (2026-07-07)

The MongoDB Node.js team is pleased to announce version 7.5.0 of the mongodb package!

Release Notes

Support for Queryable Encryption String Query GA in MongoDB 9.0

Queryable Encryption string queries are now available for MongoDB 9.0. Building on the technical preview introduced in earlier releases, this feature lets you run exact and range-style string matching against encrypted fields. As part of the promotion to GA, the API has been renamed:

• The TextOpts API is replaced with StringOpts.
• The TextPreview algorithm is replaced with String.
• The prefix, suffix, and substring query types are now generally available.
• The prefixPreview, suffixPreview, and substringPreview query types are deprecated and will be removed in a future release.

MongoClient.close() now closes in-use connections on all servers

Since v6.17.0, MongoClient.close() has eagerly closed checked-out (in-use) connections so that in-flight operations are interrupted promptly with a MongoClientClosedError instead of holding the client open. However, due to a bug, on replica sets and sharded clusters operations in flight on other servers were not interrupted, and their connections stayed open until the operations completed on their own. Calls to closeCheckedOutConnections() will now ensure all checked out connections are closed across all servers.

Thank you to @​Nepomuk5665 and @​sarthaksoni25 for bringing this to our attention/providing an initial implementation!

Features

• NODE-7537: promote QE string queries (prefix/suffix/substring) (#4996) (dc4900c)

Bug Fixes

• NODE-7411: iterate all servers on close (#4967) (72c0296)

Documentation

• Reference
• API
• Changelog

We invite you to try the mongodb library immediately, and report any issues to the NODE project.

v7.4.0

7.4.0 (2026-06-25)

The MongoDB Node.js team is pleased to announce version 7.4.0 of the mongodb package!

Release Notes

... (truncated)

Changelog

Sourced from mongodb's changelog.

7.5.0 (2026-07-07)

Features

• NODE-7537: promote QE string queries (prefix/suffix/substring) (#4996) (dc4900c)

Bug Fixes

• NODE-7411: iterate all servers on close (#4967) (72c0296)

7.4.0 (2026-06-25)

Features

• NODE-7634: remove experimental tag from async dispose methods (#4976) (43ce3eb)
• NODE-7549: send afterClusterTime on writes in causally-consistent sessions (#4963) (3abfd26)

7.3.0 (2026-06-04)

Features

• NODE-7518: bump maxWireVersion (#4950) (4447050)

Bug Fixes

• NODE-7548: SCRAM authentication fails on non-Node runtimes (#4932) (a10d2c9)

Commits

• c436831 chore(main): release 7.5.0 (#4978)
• 910f9da docs(NODE-7635): clarify IWM options documentation (#4997)
• 95572f3 chore(deps): bump drivers-evergreen-tools from 4b02eb0 to ea6e66a (#4995)
• dc4900c feat(NODE-7537): promote QE string queries (prefix/suffix/substring) (#4996)
• 72c0296 fix(NODE-7411): iterate all servers on close (#4967)
• b6c60da chore(NODE-7520): update dependencies (#4962)
• 88990e6 test(NODE-7028): fix flaky AbortSignal timing assertions (#4981)
• 371579d fix(NODE-7171): capture resume token before resumeTokenChanged fires (#4973)
• de45b94 test(NODE-7590): use connectionReady in waitUntilPoolsFilled (#4975)
• 53e73a9 docs: add 7.4 docs (#4977)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for mongodb since your current version.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	mongodb@​7.2.0 ⏵ 7.5.0	-6			+1

View full report

[socket-security]

Caution

Review the following alerts detected in dependencies.

According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Block		Potential code anomaly (AI signal): npm mongodb is 65.0% likely to have a medium risk anomaly Notes: The analyzed code fragment appears to implement a standard OpenID Connect callback workflow for MongoDB authentication with proper timeout protection and token handling. There are no clear malicious indicators (no hardcoded secrets, no data exfiltration, and no backdoor behavior) within this fragment. The primary security concerns relate to input validation of deserialized idpInfo and secure handling of tokens in memory and logs. Overall security risk is low to moderate, contingent on surrounding code performing appropriate validation and safe storage of tokens. Confidence: 0.65 Severity: 0.58 From: paaster/package-lock.json → npm/mongodb@7.5.0 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/mongodb@7.5.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report