[Snyk] Upgrade bson from 6.9.0 to 6.10.4

 <h3>Snyk has created this PR to upgrade bson from 6.9.0 to 6.10.4.</h3> :information_source: Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project. <hr/> - The recommended version is **6 versions** ahead of your current version. - The recommended version was released **24 days ago**. <details> <summary><b>Release notes</b></summary> <br/> <details> <summary>Package name: <b>bson</b></summary> <ul> <li> <b>6.10.4</b> - <a href="https://redirect.github.com/mongodb/js-bson/releases/tag/v6.10.4">2025-06-02</a></br><h2><a href="https://redirect.github.com/mongodb/js-bson/compare/v6.10.3...v6.10.4">6.10.4</a> (2025-06-02)</h2> <p>The MongoDB Node.js team is pleased to announce version 6.10.4 of the <code>bson</code> package!</p> <h2>Release Notes</h2> <h3>Top-Level Await removed from the browser BSON bundle</h3> <p>In versions &lt;6.10.4, BSON uses a top-level await to asynchronously import the <code>crypto</code> module. This change unintentionally caused headaches for users of webpack, react native, vite and other tools bundlers and tools.</p> <p>The top-level await has been removed from all BSON bundles. Thanks to <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/lourd/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/lourd">@ lourd</a> for this contribution.</p> <h3>Prevent the creation of incorrectly sized float32 vectors</h3> <p>This adds validation to our <code>BSON.serialize</code> and <code>EJSON.stringify</code> methods that will prevent creating float 32 vectors that are not a multiple of 4. Previously created vectors that do not meet this validation will still be <code>deserialized</code> and <code>parsed</code> so they can be fixed.</p> <p>Additionally, the <code>toFloat32Array()</code>, <code>toInt8Array()</code>, and <code>toPackedBits()</code> methods now perform the same validation that serialize does to prevent use of incorrectly formatted Binary vector values. (For example, a packed bits vector with more than 7 bits of padding)</p> <p>Vectors of an incorrect length could only be made manually (directly constructing the bytes and calling <code>new Binary</code>). We recommend using <code>toFloat32Array</code> and <code>fromFloat32Array</code> when interacting with Vectors in MongoDB as they handle the proper creation and translation of this data type.</p> <h3>Bug Fixes</h3> <ul> <li><strong><a class="issue-link js-issue-link notranslate" rel="noopener noreferrer nofollow" href="https://jira.mongodb.org/browse/NODE-6074">NODE-6074</a>:</strong> Removes top-level await in bson with separate node and browser ESM bundles (<a href="https://redirect.github.com/mongodb/js-bson/issues/749" data-hovercard-type="pull_request" data-hovercard-url="/mongodb/js-bson/pull/749/hovercard">#749</a>) (<a href="https://redirect.github.com/mongodb/js-bson/commit/46029739ace8596beb5c397eae7992b23c5872f4">4602973</a>)</li> <li><strong><a class="issue-link js-issue-link notranslate" rel="noopener noreferrer nofollow" href="https://jira.mongodb.org/browse/NODE-6735">NODE-6735</a>, <a class="issue-link js-issue-link notranslate" rel="noopener noreferrer nofollow" href="https://jira.mongodb.org/browse/NODE-6711">NODE-6711</a>:</strong> add BSON vector validation to EJSON stringification, serialization and conversion to native types (<a href="https://redirect.github.com/mongodb/js-bson/issues/748" data-hovercard-type="pull_request" data-hovercard-url="/mongodb/js-bson/pull/748/hovercard">#748</a>) (<a href="https://redirect.github.com/mongodb/js-bson/commit/64ff6a28643c5d7bb2933d2b82ad82483e8cb2e7">64ff6a2</a>)</li> </ul> <h2>Documentation</h2> <ul> <li><a href="https://redirect.github.com/mongodb/js-bson#readme">API</a></li> <li><a href="https://redirect.github.com/mongodb/js-bson/blob/main/HISTORY.md#change-log">Changelog</a></li> </ul> <p>We invite you to try the <code>bson</code> library immediately, and report any issues to the <a href="https://jira.mongodb.org/projects/NODE" rel="nofollow">NODE project</a>.</p> </li> <li> <b>6.10.3</b> - <a href="https://redirect.github.com/mongodb/js-bson/releases/tag/v6.10.3">2025-02-19</a></br><h2><a href="https://redirect.github.com/mongodb/js-bson/compare/v6.10.2...v6.10.3">6.10.3</a> (2025-02-19)</h2> <p>The MongoDB Node.js team is pleased to announce version 6.10.3 of the <code>bson</code> package!</p> <h2>Release Notes</h2> <h3><g-emoji class="g-emoji" alias="warning">⚠️</g-emoji> Fixed potential data corruption bug when <code>useBigInt64</code> is enabled</h3> <p>After refactoring to improve deserialization performance in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="2137244219" data-permission-text="Title is private" data-url="https://github.com/mongodb/js-bson/issues/649" data-hovercard-type="pull_request" data-hovercard-url="/mongodb/js-bson/pull/649/hovercard" href="https://redirect.github.com/mongodb/js-bson/pull/649">#649</a>, we inadvertently introduced a bug that manifested when deserializing <code>Long</code> values with the <code>useBigInt64</code> flag enabled. The bug would lead to negative <code>Long</code> values being deserialized as unsigned integers. This issue has been resolved here.</p> <p>Thanks to <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/rkistner/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/rkistner">@ rkistner</a> for reporting this bug!</p> <h3>Bug Fixes</h3> <ul> <li><strong><a class="issue-link js-issue-link notranslate" rel="noopener noreferrer nofollow" href="https://jira.mongodb.org/browse/NODE-6764">NODE-6764</a>:</strong> incorrect negative bigint handling (<a href="https://redirect.github.com/mongodb/js-bson/issues/752" data-hovercard-type="pull_request" data-hovercard-url="/mongodb/js-bson/pull/752/hovercard">#752</a>) (<a href="https://redirect.github.com/mongodb/js-bson/commit/b3212b42672c887ff31d3fab917b54238aa4de7d">b3212b4</a>)</li> </ul> <h2>Documentation</h2> <ul> <li><a href="https://redirect.github.com/mongodb/js-bson#readme">API</a></li> <li><a href="https://redirect.github.com/mongodb/js-bson/blob/main/HISTORY.md#change-log">Changelog</a></li> </ul> <p>We invite you to try the <code>bson</code> library immediately, and report any issues to the <a href="https://jira.mongodb.org/projects/NODE" rel="nofollow">NODE project</a>.</p> </li> <li> <b>6.10.2</b> - <a href="https://redirect.github.com/mongodb/js-bson/releases/tag/v6.10.2">2025-01-30</a></br><h2><a href="https://redirect.github.com/mongodb/js-bson/compare/v6.10.1...v6.10.2">6.10.2</a> (2025-01-29)</h2> <p>The MongoDB Node.js team is pleased to announce version 6.10.2 of the <code>bson</code> package!</p> <h2>Release Notes</h2> <h3>Fix <code>calculateObjectSize</code> not accounting for <code>BigInt</code> value size</h3> <p><code>BSON.calculateObjectSize</code> was missing a condition for <code>BigInt</code> values, meaning it did not account for them in the same way that it would for <code>Long</code> values. This has been corrected so that <code>Bigint</code> values contribute 8 bytes worth of size to the total count.</p> <p>We also added a new default condition that will catch any new values that may be returned by <code>typeof</code> in the future and will throw an error rather than returning an inaccurate size.</p> <h3>Bug Fixes</h3> <ul> <li><strong><a class="issue-link js-issue-link notranslate" rel="noopener noreferrer nofollow" href="https://jira.mongodb.org/browse/NODE-6608">NODE-6608</a>:</strong> calculateObjectSize returns the wrong value for bigint (<a href="https://redirect.github.com/mongodb/js-bson/issues/742" data-hovercard-type="pull_request" data-hovercard-url="/mongodb/js-bson/pull/742/hovercard">#742</a>) (<a href="https://redirect.github.com/mongodb/js-bson/commit/1fed073464f89b33fc82b0f36c3f3674af106dce">1fed073</a>)</li> </ul> <h2>Documentation</h2> <ul> <li><a href="https://redirect.github.com/mongodb/js-bson#readme">API</a></li> <li><a href="https://redirect.github.com/mongodb/js-bson/blob/main/HISTORY.md#change-log">Changelog</a></li> </ul> <p>We invite you to try the <code>bson</code> library immediately, and report any issues to the <a href="https://jira.mongodb.org/projects/NODE" rel="nofollow">NODE project</a>.</p> </li> <li> <b>6.10.1</b> - <a href="https://redirect.github.com/mongodb/js-bson/releases/tag/v6.10.1">2024-12-03</a></br><h2><a href="https://redirect.github.com/mongodb/js-bson/compare/v6.10.0...v6.10.1">6.10.1</a> (2024-11-27)</h2> <p>The MongoDB Node.js team is pleased to announce version 6.10.1 of the <code>bson</code> package!</p> <h2>Release Notes</h2> <h3>Fix issue with the internal unbounded type cache</h3> <p>As an optimization, a previous performance improvement stored the type information of seen objects to avoid recalculating type information. This caused an issue in the driver under extreme load and high memory usage as the cache grew. The assumption was that garbage collection would clear it enough to sustain normal operation. The cache is now removed and other optimal type checking is used in its place.</p> <h3>Cache the hex string of an ObjectId lazily</h3> <p>When <code>ObjectId.cacheHexString</code> is set to <code>true</code> we no longer convert the buffer to a hex string in the constructor, since the cache is already being filled in any call to <code>objectid.toHexString()</code>.</p> <p>Additionally, if a string is passed into the constructor we can cache this immediately as there is no performance impact and no extra memory that needs to be allocated.</p> <p>This improves the performance for situations where you are parsing ObjectIds from a string (ex. <code>JSON</code>) and want to avoid recalculating the hex. It also improves situations where you have ObjectIds coming from BSON and only convert some of them strings perhaps after applying some filter to eliminate some.</p> <p>With <code>cacheHexString</code> enabled deserializing ObjectIds from BSON shows ~80% performance improvement and <code>toString</code>-ing ObjectIds that were constructed from a string convert ~40% faster!</p> <p>Thanks to <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/SeanReece/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/SeanReece">@ SeanReece</a> for contributing this improvement!</p> <h3>Bug Fixes</h3> <ul> <li><strong><a class="issue-link js-issue-link notranslate" rel="noopener noreferrer nofollow" href="https://jira.mongodb.org/browse/NODE-6552">NODE-6552</a>:</strong> remove cache and use toStringTag in type helpers (<a href="https://redirect.github.com/mongodb/js-bson/issues/740" data-hovercard-type="pull_request" data-hovercard-url="/mongodb/js-bson/pull/740/hovercard">#740</a>) (<a href="https://redirect.github.com/mongodb/js-bson/commit/3ede13e4ff551785af3d459d62c854605fe8b154">3ede13e</a>)</li> </ul> <h3>Performance Improvements</h3> <ul> <li><strong><a class="issue-link js-issue-link notranslate" rel="noopener noreferrer nofollow" href="https://jira.mongodb.org/browse/NODE-6450">NODE-6450</a>:</strong> Lazy objectId hex string cache (<a href="https://redirect.github.com/mongodb/js-bson/issues/722" data-hovercard-type="pull_request" data-hovercard-url="/mongodb/js-bson/pull/722/hovercard">#722</a>) (<a href="https://redirect.github.com/mongodb/js-bson/commit/7c37580c139608d7926d464efa2bb318877104ba">7c37580</a>)</li> </ul> <h2>Documentation</h2> <ul> <li><a href="https://redirect.github.com/mongodb/js-bson#readme">API</a></li> <li><a href="https://redirect.github.com/mongodb/js-bson/blob/main/HISTORY.md#change-log">Changelog</a></li> </ul> <p>We invite you to try the <code>bson</code> library immediately, and report any issues to the <a href="https://jira.mongodb.org/projects/NODE" rel="nofollow">NODE project</a>.</p> </li> <li> <b>6.10.0</b> - 2024-11-19 </li> <li> <b>6.9.1</b> - <a href="https://redirect.github.com/mongodb/js-bson/releases/tag/v6.9.1">2025-03-06</a></br><h2><a href="https://redirect.github.com/mongodb/js-bson/compare/v6.9.0...v6.9.1">6.9.1</a> (2025-03-06)</h2> <p>The MongoDB Node.js team is pleased to announce version 6.9.1 of the <code>bson</code> package!</p> <h2>Release Notes</h2> <h3><g-emoji class="g-emoji" alias="warning">⚠️</g-emoji> Fixed potential data corruption bug when <code>useBigInt64</code> is enabled</h3> <p>After refactoring to improve deserialization performance in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="2137244219" data-permission-text="Title is private" data-url="https://github.com/mongodb/js-bson/issues/649" data-hovercard-type="pull_request" data-hovercard-url="/mongodb/js-bson/pull/649/hovercard" href="https://redirect.github.com/mongodb/js-bson/pull/649">#649</a>, we inadvertently introduced a bug that manifested when deserializing <code>Long</code> values with the <code>useBigInt64</code> flag enabled. The bug would lead to negative <code>Long</code> values being deserialized as unsigned integers. This issue has been resolved here.</p> <p>Thanks to <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/rkistner/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/rkistner">@ rkistner</a> for reporting this bug!</p> <h3>Bug Fixes</h3> <ul> <li><strong><a class="issue-link js-issue-link notranslate" rel="noopener noreferrer nofollow" href="https://jira.mongodb.org/browse/NODE-6830">NODE-6830</a>:</strong> incorrect negative bigint handling (<a href="https://redirect.github.com/mongodb/js-bson/issues/752" data-hovercard-type="pull_request" data-hovercard-url="/mongodb/js-bson/pull/752/hovercard">#752</a>) (<a href="https://redirect.github.com/mongodb/js-bson/issues/776" data-hovercard-type="pull_request" data-hovercard-url="/mongodb/js-bson/pull/776/hovercard">#776</a>) (<a href="https://redirect.github.com/mongodb/js-bson/commit/b13d7308227a74307636d0c68dfba408d2408759">b13d730</a>)</li> </ul> <h2>Documentation</h2> <ul> <li><a href="https://redirect.github.com/mongodb/js-bson#readme">API</a></li> <li><a href="https://redirect.github.com/mongodb/js-bson/blob/main/HISTORY.md#change-log">Changelog</a></li> </ul> <p>We invite you to try the <code>bson</code> library immediately, and report any issues to the <a href="https://jira.mongodb.org/projects/NODE" rel="nofollow">NODE project</a>.</p> </li> <li> <b>6.9.0</b> - 2024-10-21 </li> </ul> from <a href="https://redirect.github.com/mongodb/js-bson/releases">bson GitHub release notes</a> </details> </details> --- > [!IMPORTANT] > > - Check the changes in this PR to ensure they won't cause issues with your project. > - This PR was automatically created by Snyk using the credentials of a real user. --- **Note:** _You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs._ **For more information:** <img src="https://api.segment.io/v1/pixel/track?data=eyJ3cml0ZUtleSI6InJyWmxZcEdHY2RyTHZsb0lYd0dUcVg4WkFRTnNCOUEwIiwiYW5vbnltb3VzSWQiOiJmMDgzMzdjYy1mNGNlLTQ5MWQtYWQ4OS1jZjM3ZDhlNTI4YzYiLCJldmVudCI6IlBSIHZpZXdlZCIsInByb3BlcnRpZXMiOnsicHJJZCI6ImYwODMzN2NjLWY0Y2UtNDkxZC1hZDg5LWNmMzdkOGU1MjhjNiJ9fQ==" width="0" height="0"/> > - 🧐 [View latest project report](https://app.snyk.io/org/biancode/project/ca3a6f1d-7eb7-46ca-9602-da5034e4f631?utm_source&#x3D;github&amp;utm_medium&#x3D;referral&amp;page&#x3D;upgrade-pr) > - 📜 [Customise PR templates](https://docs.snyk.io/scan-using-snyk/pull-requests/snyk-fix-pull-or-merge-requests/customize-pr-templates?utm_source=&utm_content=fix-pr-template) > - 🛠 [Adjust upgrade PR settings](https://app.snyk.io/org/biancode/project/ca3a6f1d-7eb7-46ca-9602-da5034e4f631/settings/integration?utm_source&#x3D;github&amp;utm_medium&#x3D;referral&amp;page&#x3D;upgrade-pr) > - 🔕 [Ignore this dependency or unsubscribe from future upgrade PRs](https://app.snyk.io/org/biancode/project/ca3a6f1d-7eb7-46ca-9602-da5034e4f631/settings/integration?pkg&#x3D;bson&amp;utm_source&#x3D;github&amp;utm_medium&#x3D;referral&amp;page&#x3D;upgrade-pr#auto-dep-upgrades) [//]: # 'snyk:metadata:{"customTemplate":{"variablesUsed":[],"fieldsUsed":[]},"dependencies":[{"name":"bson","from":"6.9.0","to":"6.10.4"}],"env":"prod","hasFixes":false,"isBreakingChange":false,"isMajorUpgrade":false,"issuesToFix":[],"prId":"f08337cc-f4ce-491d-ad89-cf37d8e528c6","prPublicId":"f08337cc-f4ce-491d-ad89-cf37d8e528c6","packageManager":"npm","priorityScoreList":[],"projectPublicId":"ca3a6f1d-7eb7-46ca-9602-da5034e4f631","projectUrl":"https://app.snyk.io/org/biancode/project/ca3a6f1d-7eb7-46ca-9602-da5034e4f631?utm_source=github&utm_medium=referral&page=upgrade-pr","prType":"upgrade","templateFieldSources":{"branchName":"default","commitMessage":"default","description":"default","title":"default"},"templateVariants":[],"type":"auto","upgrade":[],"upgradeInfo":{"versionsDiff":6,"publishedDate":"2025-06-02T20:56:40.889Z"},"vulns":[]}'