Sourced from bson's releases.

v6.10.4

6.10.4 (2025-06-02)

The MongoDB Node.js team is pleased to announce version 6.10.4 of the bson package!

Release Notes

Top-Level Await removed from the browser BSON bundle

In versions <6.10.4, BSON uses a top-level await to asynchronously import the crypto module. This change unintentionally caused headaches for users of webpack, react native, vite and other tools bundlers and tools.

The top-level await has been removed from all BSON bundles. Thanks to @​lourd for this contribution.

Prevent the creation of incorrectly sized float32 vectors

This adds validation to our BSON.serialize and EJSON.stringify methods that will prevent creating float 32 vectors that are not a multiple of 4. Previously created vectors that do not meet this validation will still be deserialized and parsed so they can be fixed.

Additionally, the toFloat32Array(), toInt8Array(), and toPackedBits() methods now perform the same validation that serialize does to prevent use of incorrectly formatted Binary vector values. (For example, a packed bits vector with more than 7 bits of padding)

Vectors of an incorrect length could only be made manually (directly constructing the bytes and calling new Binary). We recommend using toFloat32Array and fromFloat32Array when interacting with Vectors in MongoDB as they handle the proper creation and translation of this data type.

Bug Fixes

• NODE-6074: Removes top-level await in bson with separate node and browser ESM bundles (#749) (4602973)
• NODE-6735, NODE-6711: add BSON vector validation to EJSON stringification, serialization and conversion to native types (#748) (64ff6a2)

Documentation

• API
• Changelog

We invite you to try the bson library immediately, and report any issues to the NODE project.

Sourced from bson's changelog.

6.10.4 (2025-06-02)

Bug Fixes

• NODE-6074: Removes top-level await in bson with separate node and browser ESM bundles (#749) (4602973)
• NODE-6735, NODE-6711: add BSON vector validation to EJSON stringification, serialization and conversion to native types (#748) (64ff6a2)

• 302f96e chore(main): release 6.10.4 (#803)
• da8a4bf chore: revert release 6.10.4 (#802)
• 8d712be chore(main): release 6.10.4 (#800)
• 0203beb chore: revert 6.10 release to try again (#799)
• b021bd8 chore(main): release 6.10.4 (#789)
• 86f9dc4 chore(NODE-6938): update typescript to 5.8.3 (#793)
• 3e5f1f8 deps(NODE-6898): FY26Q2 dependency updates (#795)
• 17650e1 chore(NODE-6921): perf tests default to cwd and errexit (#791)
• 7f2a6d3 test(NODE-6920): esm bundles do not have top-level await (#790)
• 4602973 fix(NODE-6074): Removes top-level await in bson with separate node and browse...
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)