Skip to content

build(deps): bump go.mongodb.org/mongo-driver/v2 from 2.9.1 to 2.9.2 in the other-dependencies group across 1 directory - #318

Merged
fredbi merged 1 commit into
masterfrom
dependabot/go_modules/other-dependencies-78c21e7b4b
Oct 19, 2026
Merged

fredbi merged 1 commit into
masterfrom
dependabot/go_modules/other-dependencies-78c21e7b4b

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 14, 2026 •

Copy link
Copy Markdown
Contributor

Bumps the other-dependencies group with 1 update in the / directory: go.mongodb.org/mongo-driver/v2.

Updates go.mongodb.org/mongo-driver/v2 from 2.9.1 to 2.9.2

Release notes

Sourced from go.mongodb.org/mongo-driver/v2's releases.

MongoDB Go Driver 2.9.2

The MongoDB Go Driver Team is pleased to release version 2.9.2 of the official MongoDB Go Driver.

Release Highlights

[!WARNING] Go Driver versions v2.1.0 through v2.8.1 and v2.9.0 through v2.9.1 are affected by a security issue CVE-2026-81521 in Client.BulkWrite. The fix shipped in v2.8.2 but was not included in v2.9.0 or v2.9.1. This release restores the fix for the 2.9 line. Users on v2.9.0 or v2.9.1 are encouraged to upgrade to Go Driver v2.9.2 as soon as possible. Go Driver v1 is not affected.

[!WARNING]
Go Driver versions v1.1.0 and later and v2.0.0 through v2.9.1 are affected by a security issue CVE-2026-107325 in the bson.RawArray.Validate method. This release resolves that security issue in Go Driver v2. Users are encouraged to upgrade to Go Driver v2.9.2 as soon as possible.

This release addresses CVE-2026-81521, a security issue in calling Client.BulkWrite. A caller-controlled database name containing a period ('.') may be interpreted as a different namespace when forwarded to MongoDB. This could redirect operations to a database or collection other than the one intended by the application.

This release addresses CVE-2026-107325, a security issue in calling bson.RawArray.Validate. Calling bson.RawArray.Validate on an array whose declared length is 0 causes a runtime panic.

It also restores a fix from v2.8.1 that was likewise missing from v2.9.0 and v2.9.1: when a command's first attempt failed with a server error and the retry reported NoWritesPerformed, operations such as Database.RunCommand could return a nil error instead of the server error. They now return the original server error.

Sessions now inherit timeoutMS from the client, so operations run in a session honor the client-level timeout.

What's Changed

🐛 Fixed

Full Changelog: mongodb/mongo-go-driver@v2.9.1...v2.9.2

Commits
  • df261dc BUMP v2.9.2
  • 16b6195 GODRIVER-4088 Return the server error when the first attempt fails wi… (#2666)
  • de647b7 GODRIVER-4075 Return an error if there are invalid characters in the … (#2665)
  • 59c2e6b GODRIVER-4177 guard empty documents slice in decodeOpReply QueryFailure branc...
  • 15edca6 GODRIVER-4138 Latest server binary downloads require private S3. (#2660)
  • 74278b9 GODRIVER-4118 fix: correct Truncate boundary handling for multi-byte UTF-8 ch...
  • 13954c2 GODRIVER-4168: Authenticate the Claude review with the drivers PR bot app (#2...
  • 8f9da57 GODRIVER-4168: Run Claude review only when the claude-review label is applied...
  • 44ee9af GODRIVER-4168: Add Claude GitHub workflow (#2632)
  • a097394 GODRIVER-4136: reject BSON lengths below the 5-byte minimum before slicing (#...
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the other-dependencies group with 1 update in the / directory: [go.mongodb.org/mongo-driver/v2](https://github.com/mongodb/mongo-go-driver).


Updates `go.mongodb.org/mongo-driver/v2` from 2.9.1 to 2.9.2
- [Release notes](https://github.com/mongodb/mongo-go-driver/releases)
- [Commits](mongodb/mongo-go-driver@v2.9.1...v2.9.2)

---
updated-dependencies:
- dependency-name: go.mongodb.org/mongo-driver/v2
  dependency-version: 2.9.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: other-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Oct 14, 2026
@codecov

codecov Bot commented Oct 14, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 89.13%. Comparing base (9cf99be) to head (e2f5f66).
⚠️ Report is 3 commits behind head on master.
✅ All tests successful. No failed tests found.

Additional details and impacted files
@@           Coverage Diff           @@
##           master     #318   +/-   ##
=======================================
  Coverage   89.13%   89.13%           
=======================================
  Files          24       24           
  Lines        2928     2928           
=======================================
  Hits         2610     2610           
  Misses        317      317           
  Partials        1        1           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

@fredbi
fredbi merged commit f468f40 into master Oct 19, 2026
29 checks passed
@fredbi
fredbi deleted the dependabot/go_modules/other-dependencies-78c21e7b4b branch October 19, 2026 06:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file go Pull requests that update Go code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant