[dependabot]

Bumps mongodb from 6.21.0 to 6.22.0.

Release notes

Sourced from mongodb's releases.

v6.22.0

6.22.0 (2026-11-02)

The MongoDB Node.js team is pleased to announce version 6.22.0 of the mongodb package!

Release Notes

[!WARNING]
Node Driver versions from v6.11.0 before v6.22.0 (this release) and from v7.0.0 before v7.8.0 are affected by a security issue related to the use of the experimental timeoutMS feature where connection pool desynchronization after operation timeout can expose other users' data (CVE-2026-119179). Users are encouraged to discontinue the use of timeoutMS as soon as possible.

timeoutMS is deprecated and now a no-op

[!WARNING] timeoutMS and timeoutMode are deprecated and have no effect starting in this release. They are still accepted and will not throw, but operations will no longer time out because of them. They are slated for removal in a future release.

Use the per-stage timeouts instead: serverSelectionTimeoutMS, waitQueueTimeoutMS, socketTimeoutMS, and maxTimeMS for server-side execution.

Features

• NODE-7974: make timeoutMS a no-op and deprecate it (#5091) (389fb72)

Documentation

• Reference
• API
• Changelog

We invite you to try the mongodb library immediately, and report any issues to the NODE project.

Changelog

Sourced from mongodb's changelog.

6.22.0 (2026-11-02)

Features

• NODE-7974: make timeoutMS a no-op and deprecate it (#5091) (389fb72)

Commits

• 00df15f chore(v6.x): release 6.22.0 (#5096)
• 389fb72 feat(NODE-7974): make timeoutMS a no-op and deprecate it (#5091)
• ecb6fe9 ci: fix release for backport (#5095)
• 012a7f7 chore(NODE-7973): backport main's release tooling to v6.x (#5089)
• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for mongodb since your current version.

[eyevinn-pr-reviewer]

LGTM — Dependabot dependency bump reviewed (Phase 3.5 housekeeping).

mongodb 6.21.0→6.22.0 (minor). Diff is package.json + lockfile only, integrity hashes consistent, CI green.

Reviewed the diff and CI per the Open Intercom dependency policy; approving for merge.

[eyevinn-pr-reviewer]

LGTM — Dependabot dependency bump reviewed (Phase 3.5 housekeeping).

mongodb 6.21.0→6.22.0 (minor). Diff is package.json + lockfile only, integrity hashes consistent, CI green.

Reviewed the diff and CI per the Open Intercom dependency policy; approving for merge.

[eyevinn-developer]

This bump was LGTM and approved in today's daily-backlog-pr Phase 3.5 sweep, but it developed a package-lock.json conflict after sibling Dependabot bumps in the same fastify/npm set merged earlier in the run, so it could not merge cleanly. Triggering a rebase so it becomes mergeable again and a later run can merge it.

@dependabot rebase

[eyevinn-pr-reviewer]

LGTM. Pure dependabot minor bump of the existing mongodb runtime dependency (6.21.0 → 6.22.0): only package.json and package-lock.json change, in lockstep (version, resolved URL, integrity), with no source/config changes, no new or nested transitive packages, and no dependency-policy trigger (the policy's written-justification gate is for new dependencies, not version advances). CI (lint, pretty, ts, unittests) is green on head.

What a human does next: Nothing.