[Snyk] Upgrade bson from 6.9.0 to 6.10.4

[biancode]

Snyk has created this PR to upgrade bson from 6.9.0 to 6.10.4.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

• The recommended version is 6 versions ahead of your current version.

• The recommended version was released 24 days ago.

Release notes

Package name: bson

• 6.10.4 - 2025-06-02
  

  6.10.4 (2025-06-02)

  The MongoDB Node.js team is pleased to announce version 6.10.4 of the bson package!

  Release Notes

  Top-Level Await removed from the browser BSON bundle

  In versions <6.10.4, BSON uses a top-level await to asynchronously import the crypto module. This change unintentionally caused headaches for users of webpack, react native, vite and other tools bundlers and tools.

  The top-level await has been removed from all BSON bundles. Thanks to @ lourd for this contribution.

  Prevent the creation of incorrectly sized float32 vectors

  This adds validation to our BSON.serialize and EJSON.stringify methods that will prevent creating float 32 vectors that are not a multiple of 4. Previously created vectors that do not meet this validation will still be deserialized and parsed so they can be fixed.

  Additionally, the toFloat32Array(), toInt8Array(), and toPackedBits() methods now perform the same validation that serialize does to prevent use of incorrectly formatted Binary vector values. (For example, a packed bits vector with more than 7 bits of padding)

  Vectors of an incorrect length could only be made manually (directly constructing the bytes and calling new Binary). We recommend using toFloat32Array and fromFloat32Array when interacting with Vectors in MongoDB as they handle the proper creation and translation of this data type.

  Bug Fixes

  • NODE-6074: Removes top-level await in bson with separate node and browser ESM bundles (#749) (4602973)
  • NODE-6735, NODE-6711: add BSON vector validation to EJSON stringification, serialization and conversion to native types (#748) (64ff6a2)

  Documentation

  • API
  • Changelog

  We invite you to try the bson library immediately, and report any issues to the NODE project.

• 6.10.3 - 2025-02-19
  

  6.10.3 (2025-02-19)

  The MongoDB Node.js team is pleased to announce version 6.10.3 of the bson package!

  Release Notes

  ⚠️ Fixed potential data corruption bug when useBigInt64 is enabled

  After refactoring to improve deserialization performance in #649, we inadvertently introduced a bug that manifested when deserializing Long values with the useBigInt64 flag enabled. The bug would lead to negative Long values being deserialized as unsigned integers. This issue has been resolved here.

  Thanks to @ rkistner for reporting this bug!

  Bug Fixes

  • NODE-6764: incorrect negative bigint handling (#752) (b3212b4)

  Documentation

  • API
  • Changelog

  We invite you to try the bson library immediately, and report any issues to the NODE project.

• 6.10.2 - 2025-01-30
  

  6.10.2 (2025-01-29)

  The MongoDB Node.js team is pleased to announce version 6.10.2 of the bson package!

  Release Notes

  Fix calculateObjectSize not accounting for BigInt value size

  BSON.calculateObjectSize was missing a condition for BigInt values, meaning it did not account for them in the same way that it would for Long values. This has been corrected so that Bigint values contribute 8 bytes worth of size to the total count.

  We also added a new default condition that will catch any new values that may be returned by typeof in the future and will throw an error rather than returning an inaccurate size.

  Bug Fixes

  • NODE-6608: calculateObjectSize returns the wrong value for bigint (#742) (1fed073)

  Documentation

  • API
  • Changelog

  We invite you to try the bson library immediately, and report any issues to the NODE project.

• 6.10.1 - 2024-12-03
  

  6.10.1 (2024-11-27)

  The MongoDB Node.js team is pleased to announce version 6.10.1 of the bson package!

  Release Notes

  Fix issue with the internal unbounded type cache

  As an optimization, a previous performance improvement stored the type information of seen objects to avoid recalculating type information. This caused an issue in the driver under extreme load and high memory usage as the cache grew. The assumption was that garbage collection would clear it enough to sustain normal operation. The cache is now removed and other optimal type checking is used in its place.

  Cache the hex string of an ObjectId lazily

  When ObjectId.cacheHexString is set to true we no longer convert the buffer to a hex string in the constructor, since the cache is already being filled in any call to objectid.toHexString().

  Additionally, if a string is passed into the constructor we can cache this immediately as there is no performance impact and no extra memory that needs to be allocated.

  This improves the performance for situations where you are parsing ObjectIds from a string (ex. JSON) and want to avoid recalculating the hex. It also improves situations where you have ObjectIds coming from BSON and only convert some of them strings perhaps after applying some filter to eliminate some.

  With cacheHexString enabled deserializing ObjectIds from BSON shows ~80% performance improvement and toString-ing ObjectIds that were constructed from a string convert ~40% faster!

  Thanks to @ SeanReece for contributing this improvement!

  Bug Fixes

  • NODE-6552: remove cache and use toStringTag in type helpers (#740) (3ede13e)

  Performance Improvements

  • NODE-6450: Lazy objectId hex string cache (#722) (7c37580)

  Documentation

  • API
  • Changelog

  We invite you to try the bson library immediately, and report any issues to the NODE project.

• 6.10.0 - 2024-11-19
• 6.9.1 - 2025-03-06
  

  6.9.1 (2025-03-06)

  The MongoDB Node.js team is pleased to announce version 6.9.1 of the bson package!

  Release Notes

  ⚠️ Fixed potential data corruption bug when useBigInt64 is enabled

  After refactoring to improve deserialization performance in #649, we inadvertently introduced a bug that manifested when deserializing Long values with the useBigInt64 flag enabled. The bug would lead to negative Long values being deserialized as unsigned integers. This issue has been resolved here.

  Thanks to @ rkistner for reporting this bug!

  Bug Fixes

  • NODE-6830: incorrect negative bigint handling (#752) (#776) (b13d730)

  Documentation

  • API
  • Changelog

  We invite you to try the bson library immediately, and report any issues to the NODE project.

• 6.9.0 - 2024-10-21

from bson GitHub release notes

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

• 🧐 View latest project report
• 📜 Customise PR templates
• 🛠 Adjust upgrade PR settings
• 🔕 Ignore this dependency or unsubscribe from future upgrade PRs

[github-actions]

Greet Contributors Bot
Thank you for taking your time and effort for your contribution, we truly value it. 🎉

The amazing contributor in this pull request is @snyk-bot

[Copilot]

Pull Request Overview

This PR updates the bson dependency to address bundling and vector validation fixes in the latest release.

• Bumps bson from ~6.9.0 to ~6.10.4