Bump the runtime group across 1 directory with 3 updates

[dependabot]

Bumps the runtime group with 3 updates in the / directory: @defra/hapi-tracing, dotenv and mongodb.

Updates @defra/hapi-tracing from 1.30.0 to 1.30.1

Commits

• d44bb89 Version package [skip ci]
• 319a24d Merge pull request #247 from DEFRA/CORE-3746
• 309be11 CORE-3746 Update dependencies
• 9669c5f CORE-3746: refresh web identity credentials before session expiry
• e98d055 Version package [skip ci]
• 330c160 Merge pull request #246 from DEFRA/CORE-3746
• 1435cf5 CORE-3746 Add environment validation options for deployment types
• c4f0217 CORE-3876: Bump @​changesets/cli to fix false unpublished detection under npm ...
• 0308ed7 CORe-3876: fix validation kit release (#244)
• a8ef696 CORE-33876: Bump node version (#243)
• Additional commits viewable in compare view

Updates dotenv from 17.4.2 to 18.0.7

Changelog

Sourced from dotenv's changelog.

18.0.7 (2026-10-09)

Changed

• Treat undefined settings like quiet: true as null rather than falsey (#1070)
• CLI should honor DOTENV_QUIET setting in .env file (#1071)

18.0.6 (2026-10-06)

Changed

• Use smarter parseBoolean not Boolean() to fix override (#1069)

18.0.5 (2026-09-30)

Changed

• Fix missing typescript module declaration (#1068)
• Improve performance for large .env files (#1066)

18.0.4 (2026-09-25)

Changed

• import dotenv/config should default quiet: true (#1063)

18.0.3 (2026-09-22)

Changed

• Patch DOTENV_QUIET setting when inside .env file (#1059)

18.0.2 (2026-09-21)

Changed

• Patch additional edge cases for the fast parser (#1056)

18.0.1 (2026-09-18)

Changed

• Handle file urls in config logging (#1054)

18.0.0 (2026-09-17)

Added

• NEW: Dotenv now has a CLI. (#1022)

... (truncated)

Commits

• 2953207 18.0.7
• 9944723 make more readable for undefined -> null
• d455db0 Merge branch 'master' of github.com:motdotla/dotenv
• e411e02 changelog
• 6237c35 Merge pull request #1070 from Utkarsh-Singhal-26/fix/ignore-undefined-config-...
• 9af8c28 Merge pull request #1071 from himanshu748/fix-cli-env-quiet
• c7161c6 fix(cli): honor quiet settings loaded from .env
• 3990466 fix: ignore undefined options so they don't mask DOTENV_* env settings
• 5d7cc39 18.0.6
• 750ba03 changelog
• Additional commits viewable in compare view

Updates mongodb from 7.2.0 to 7.7.0

Release notes

Sourced from mongodb's releases.

v7.7.0

7.7.0 (2026-09-28)

The MongoDB Node.js team is pleased to announce version 7.7.0 of the mongodb package!

Release Notes

OIDC authentication recovers from a failed token fetch

A single failed OIDC token fetch, such as a cloud metadata endpoint timing out, used to leave the driver's token-fetch mutex holding that failure. Every later operation on the affected MongoClient then failed with the original error without attempting a new token fetch, and only restarting the process restored authentication. A failed token fetch now affects only the operation that triggered it.

Driver dependencies updates

Dependency version changes:

• bson: 7.2.0 -> 7.3.2
• mongodb-connection-string-url: 7.0.1 -> 7.0.2
• mongodb-js/saslprep: 1.4.11 -> 1.5.0

Features

• NODE-7670: update dependencies, including next BSON minor (#5034) (995edbf)

Bug Fixes

• NODE-7858: re-arm OIDC callback lock after a rejection (#5056) (7e953ed)

Documentation

• Reference
• API
• Changelog

We invite you to try the mongodb library immediately, and report any issues to the NODE project.

v7.6.0

7.6.0 (2026-08-21)

The MongoDB Node.js team is pleased to announce version 7.6.0 of the mongodb package!

Release Notes

Support for MongoDB 4.2 is removed

[!WARNING] When the driver connects to a MongoDB server of version 4.2 or less, it will now throw an error.

HTTP proxy support for KMS requests in CSFLE and Queryable Encryption

In-use encryption can now route KMS requests through an HTTP proxy. Set kmsConnectCallback on your ClientEncryption or auto-encryption options to control how the driver connects to a KMS host. The callback receives the target host and port and returns a connected socket (for example, a tunnel opened with HTTP CONNECT); the driver then performs the KMS TLS handshake over that socket using the provider's configured TLS options. This unblocks CSFLE and Queryable Encryption in environments that require an HTTP forward proxy for outbound KMS traffic, which the existing SOCKS5 proxyOptions does not cover.

... (truncated)

Changelog

Sourced from mongodb's changelog.

7.7.0 (2026-09-18)

Features

• NODE-7670: update dependencies, including next BSON minor (#5034) (995edbf)

Bug Fixes

• NODE-7858: re-arm OIDC callback lock after a rejection (#5056) (7e953ed)

7.6.0 (2026-08-21)

Features

• NODE-7546: add HTTP Proxy support for QE & CSFLE (#5007) (3366c21)
• NODE-7547: bump minimum support server/wire versions to '4.4' & '9' respectively (#4994) (3d97028)
• NODE-7624: support baseBackoffMS and update client backpressure backoff (#5020) (560837b)

Bug Fixes

• NODE-7603: emit dynamic import('os') via tsconfig (#4992) (52f5e61)

Performance Improvements

• NODE-7660: serialize bulk write documents a single time (#4999) (1217aa1)

7.5.0 (2026-07-07)

Features

• NODE-7537: promote QE string queries (prefix/suffix/substring) (#4996) (dc4900c)

Bug Fixes

• NODE-7411: iterate all servers on close (#4967) (72c0296)

7.4.0 (2026-06-25)

Features

• NODE-7634: remove experimental tag from async dispose methods (#4976) (43ce3eb)
• NODE-7549: send afterClusterTime on writes in causally-consistent sessions (#4963) (3abfd26)

... (truncated)

Commits

• 20b001b chore(main): release 7.7.0 (#5039)
• 7e953ed fix(NODE-7858): re-arm OIDC callback lock after a rejection (#5056)
• 73f4982 test(NODE-7831): widen duration bounds in flaky timing assertions (#5050)
• cca9250 chore(NODE-7856): bump drivers-evergreen-tools submodule to unblock CI (#5055)
• 783d489 chore(NODE-7771): align tags to match their versions on evergreen tasks (#5048)
• af0bcb2 chore(NODE-7691): add optional section into PR template for bug fixes (#5042)
• 83668e6 chore(NODE-7694): Successful lint tasks can precede integration tests as a de...
• 28e455d chore(NODE-7788): remove csot perf tests (#5044)
• dba1544 chore(NODE-7805): restrict release_notes to PRs from this repository (#5043)
• de31f12 chore: bump drivers-evergreen-tools (#5047)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for mongodb since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud