Skip to content

chore(deps): bump various devtools-shared deps and qs MONGOSH-3206#2661

Merged
addaleax merged 3 commits intomainfrom
bump-deps-feb13
Feb 14, 2026
Merged

chore(deps): bump various devtools-shared deps and qs MONGOSH-3206#2661
addaleax merged 3 commits intomainfrom
bump-deps-feb13

Conversation

@addaleax
Copy link
Collaborator

MONGOSH-3206 calls for an update to qs, so we add that here. I'm planning to close the ticket as rejected though, since the vulnerability reported in qs does not affect mongosh users as a security issue.

Also, updating @mongodb-js/mongodb-ts-autocomplete allows making progress on updating mongosh to the latest version in Compass.

MONGOSH-3206 calls for an update to `qs`, so we add that here.
I'm planning to close the ticket as rejected though, since the
vulnerability reported in `qs` does not affect mongosh users
as a security issue.

Also, updating `@mongodb-js/mongodb-ts-autocomplete` allows
making progress on updating mongosh to the latest version in
Compass.
@addaleax addaleax requested a review from a team as a code owner February 13, 2026 17:11
Copilot AI review requested due to automatic review settings February 13, 2026 17:11
Copy link

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR updates a set of dependency versions across the mongosh monorepo, including a qs bump via the lockfile and updates intended to unblock newer @mongodb-js/mongodb-ts-autocomplete usage (e.g., for Compass alignment).

Changes:

  • Bump various @mongodb-js/* devtools-related dependencies (e.g., devtools-connect, devtools-proxy-support, OIDC tooling).
  • Update autocomplete toolchain deps (@mongodb-js/mongodb-ts-autocomplete, @mongodb-js/mongodb-constants).
  • Refresh logging/build-related deps and update the lockfile (including qs).

Reviewed changes

Copilot reviewed 12 out of 13 changed files in this pull request and generated 2 comments.

Show a summary per file
File Description
packages/types/package.json Bumps @mongodb-js/devtools-connect.
packages/snippet-manager/package.json Bumps @mongodb-js/devtools-proxy-support.
packages/shell-api/package.json Bumps @mongodb-js/mongodb-ts-autocomplete.
packages/service-provider-node-driver/package.json Bumps OIDC/devtools-connect and mongodb-build-info.
packages/logging/package.json Bumps device/log writer/redaction/native-machine-id dependencies.
packages/e2e-tests/package.json Bumps OIDC mock tooling and log-writer.
packages/cli-repl/package.json Bumps proxy support + updates several internal dependency specifiers.
packages/build/package.json Updates build-time MongoDB JS tooling deps (dl-center, monorepo-tools, etc.).
packages/browser-runtime-core/package.json Bumps @mongodb-js/mongodb-ts-autocomplete.
packages/autocomplete/package.json Bumps @mongodb-js/mongodb-constants and @mongodb-js/mongodb-ts-autocomplete.
packages/arg-parser/package.json Bumps @mongodb-js/devtools-connect (devDep).
package.json Bumps root @mongodb-js/monorepo-tools.
package-lock.json Locks updated dependency graph; includes qs@6.14.2 and related transitive changes.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@addaleax addaleax merged commit cadc85c into main Feb 14, 2026
155 of 158 checks passed
@addaleax addaleax deleted the bump-deps-feb13 branch February 14, 2026 17:18
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants