Update dependency MongoDB.Driver to 3.12.0

[dependencyupdates]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
MongoDB.Driver (source)	3.10.0 → 3.12.0

---

Release Notes

mongodb/mongo-csharp-driver (MongoDB.Driver)

v3.12.0: .NET Driver Version 3.12.0 Release Notes

This is the general availability release for the 3.12.0 version of the driver.

The main new features in 3.12.0 include:

• CSHARP-6214: Implement srvAllowedHostsSuffix URI option

Fixes:

• CSHARP-6223: Fix client-side projection crash on member-init projections

The full list of issues resolved in this release is available at CSHARP JIRA project.

Documentation on the .NET driver can be found here.

v3.11.2: .NET Driver Version 3.11.2 Release Notes

[!IMPORTANT]
This is a security patch release. It addresses two CVEs reported against the driver, along with a small number of related fixes. There are no public API changes and no application code changes are required to upgrade. Note that the shape of some queries generated by the LINQ provider and by GridFS has changed — see the individual tickets below.

This is a patch release that contains fixes and stability improvements:

• CSHARP-6177 / CVE-2026-88026: Query filter regex injection via unescaped backslash and bracket in LINQ character-set translation
• CSHARP-6190 / CVE-2026-88025: Use exact match for file ID in GridFS delete methods
• CSHARP-6213: Normalize SRV target host names to lower case during SRV polling

The full list of issues resolved in this release is available at CSHARP JIRA project.

Documentation on the .NET driver can be found here.

v3.11.1: .NET Driver Version 3.11.1 Release Notes

[!IMPORTANT]
This is a security patch release. It addresses a number of CVEs reported against the driver and does not include any functional changes or API modifications. Upgrading is recommended for all users; no code changes are required on the application side.

This is a patch release that contains fixes and stability improvements:

• CSHARP-6164 / CVE-2026-81530: KMS master key exposure via unredacted credential serialization in driver settings string
• CSHARP-6171 / CVE-2026-81529: Connection-option injection via unescaped settings in the canonical MongoDB URL builder
• CSHARP-6158 / CVE-2026-81528: NoSQL injection via array replacement bypassing update shape validation in driver write path
• CSHARP-6156 / CVE-2026-81527: NoSQL injection via unquoted constant GroupBy keys in LINQ pipeline translation
• CSHARP-6178 / CVE-2026-81527: NoSQL injection via equality-filter simplification of dollar-keyed documents in the LINQ provider
• CSHARP-6185 / CVE-2026-81527: NoSQL injection via unescaped dollar-prefixed values in LINQ constant arrays and documents

The full list of issues resolved in this release is available at CSHARP JIRA project.

Documentation on the .NET driver can be found here.

v3.11.0: .NET Driver Version 3.11.0 Release Notes

This is the general availability release for the 3.11.0 version of the driver.

The main new features in 3.11.0 include:

• CSHARP-6005: CSFLE/QE support for HTTP Proxies
• CSHARP-6089: Client Backpressure with baseBackoffMS

Fixes:

• CSHARP-6125: Reject non-collection inner sequences in LINQ Join/LeftJoin

The full list of issues resolved in this release is available at CSHARP JIRA project.

Documentation on the .NET driver can be found here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

Commands to ignore dependencies

You can trigger dependency actions by commenting on this PR:

• @particularbot ignore this major version
• @particularbot ignore this minor version
• @particularbot ignore this dependency