Dependencies

Most of MongoDB's external dependencies are vendored under src/third_party/ so the build is reproducible across platforms. The detailed inventory — including upstream URLs, licenses, and update history — is in README.third_party.md. The Bazel-level pinning lives in MODULE.bazel and the MODULE.bazel.lock resolution.

Major C/C++ dependencies

Library	Purpose
WiredTiger	The default storage engine. Vendored at src/third_party/wiredtiger/.
Boost	C++ utility library. Used widely; vendored at src/third_party/boost/.
ASIO	Async network I/O for the transport layer.
gRPC	The gRPC transport.
Abseil	C++ utilities (containers, strings, time).
Protocol Buffers	Used by gRPC and OTel.
OpenTelemetry C++ SDK	Tracing/metrics export.
SpiderMonkey	The JavaScript engine in jstestshell.
Decimal128 (libdecnum)	IEEE 754-2008 decimal128 arithmetic.
ICU	Unicode / collation.
OpenSSL	TLS / crypto (or platform equivalents).
libcurl	Outbound HTTP for the OCSP and free-monitoring features.
zlib / zstd / snappy	Compression.
YAML-cpp	YAML config parsing.
PCRE2	Regular expressions.
fmt	String formatting.
GoogleTest / Google Benchmark	Testing infrastructure used by some unit tests and *_bm.cpp benchmarks.
libfuzzer	Fuzz harness for op_msg_fuzzer* and other fuzz targets.
TLA+ / TLC	Used to model-check the TLA+ specifications under src/mongo/tla_plus/.

The src/third_party/ tree contains 56+ libraries; the table above lists the most user-visible ones. Each library has a corresponding BUILD.bazel plus a small wrapper under src/mongo/ when the consumer-facing API needs adjusting.

Python dependencies

Pinned in poetry.lock (~459 KB). Declared in pyproject.toml with groups:

• main — runtime requirements for buildscripts/ and evergreen/.
• lint — ruff, pylint, mypy, cspell integrations, and the project-specific lint plugins.
• test — testing frameworks for the Python build infrastructure itself.
• idl — the IDL compiler's runtime requirements.

The dependency installer is buildscripts/poetry_sync.sh. The execution model is described in docs/poetry_execution.md.

JavaScript / Node

The package.json and pnpm-lock.yaml describe a tiny set of NPM packages used by the JS lint and prettier toolchain. The jstestshell itself is a C++ binary embedding SpiderMonkey; it does not consume NPM packages.

Bazel modules

MODULE.bazel declares Bazel module dependencies, with MODULE.bazel.lock (~125 KB) pinning every transitive resolution. Bazel rules and toolchains live under bazel/ and bazel/toolchains/.

Vendoring policy

The team vendors third-party C/C++ to:

• Pin specific versions across all platforms.
• Apply local patches when needed.
• Insulate the build from external network access.

Updates go through a documented process in buildscripts/ and are reviewed for license compatibility against the project's SBOM.

Where each dependency is consumed

Dependency	Primary consumer in src/mongo/
WiredTiger	src/mongo/db/storage/wiredtiger/
ASIO	src/mongo/transport/asio/
gRPC	src/mongo/transport/grpc/
OpenSSL	src/mongo/util/net/, src/mongo/crypto/
SpiderMonkey	src/mongo/scripting/
OpenTelemetry	src/mongo/otel/
ICU	src/mongo/db/query/collation/
libcurl	src/mongo/util/net/, src/mongo/db/free_mon/
YAML-cpp	src/mongo/util/options_parser/
Boost	src/mongo/util/, transport, scripting, and many others

The OWNERS files (OWNERS.yml) inside each subsystem list the team responsible for keeping that consumer healthy.