Skip to content

⬆️ chore(deps): update module go.mongodb.org/mongo-driver to v2 - #523

Merged
konih merged 1 commit into
mainfrom
renovate/go.mongodb.org-mongo-driver-2.x
Nov 5, 2026
Merged

⬆️ chore(deps): update module go.mongodb.org/mongo-driver to v2#523
konih merged 1 commit into
mainfrom
renovate/go.mongodb.org-mongo-driver-2.x

Conversation

@konih

@konih konih commented Oct 30, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
go.mongodb.org/mongo-driver v1.17.10 → v2.9.3 age confidence

Release Notes

mongodb/mongo-go-driver (go.mongodb.org/mongo-driver)

v2.9.3: MongoDB Go Driver 2.9.3

Compare Source

The MongoDB Go Driver Team is pleased to release version 2.9.3 of the official MongoDB Go Driver.

Release Highlights

This release fixes cursors and change streams failing when a MONGODB-OIDC access token expires while they are open. The Go Driver now reauthenticates and retries getMore and killCursors commands when the server returns a "ReauthenticationRequired (391)" error, as it currently does for other operations.

What's Changed

🐛 Fixed

New Contributors

Full Changelog: mongodb/mongo-go-driver@v2.9.2...v2.9.3

For a full list of tickets included in this release, please see the list of fixed issues.

Documentation for the Go Driver can be found on pkg.go.dev and the MongoDB documentation site. BSON library documentation is also available on pkg.go.dev. For issues with, questions about, or feedback for the Go Driver, please look into our support channels, including StackOverflow. Bugs can be reported in the Go Driver project in the MongoDB JIRA where a list of current issues can be found. Your feedback on the Go Driver is greatly appreciated!

v2.9.2: MongoDB Go Driver 2.9.2

Compare Source

The MongoDB Go Driver Team is pleased to release version 2.9.2 of the official MongoDB Go Driver.

Release Highlights

[!WARNING]
Go Driver versions v2.1.0 through v2.8.1 and v2.9.0 through v2.9.1 are affected by a security issue CVE-2026-81521 in Client.BulkWrite. The fix shipped in v2.8.2 but was not included in v2.9.0 or v2.9.1. This release restores the fix for the 2.9 line. Users on v2.9.0 or v2.9.1 are encouraged to upgrade to Go Driver v2.9.2 as soon as possible. Go Driver v1 is not affected.

[!WARNING]
Go Driver versions v1.1.0 and later and v2.0.0 through v2.9.1 are affected by a security issue CVE-2026-107325 in the bson.RawArray.Validate method. This release resolves that security issue in Go Driver v2. Users are encouraged to upgrade to Go Driver v2.9.2 as soon as possible.

This release addresses CVE-2026-81521, a security issue in calling Client.BulkWrite. A caller-controlled database name containing a period ('.') may be interpreted as a different namespace when forwarded to MongoDB. This could redirect operations to a database or collection other than the one intended by the application.

This release addresses CVE-2026-107325, a security issue in calling bson.RawArray.Validate. Calling bson.RawArray.Validate on an array whose declared length is 0 causes a runtime panic.

It also restores a fix from v2.8.1 that was likewise missing from v2.9.0 and v2.9.1: when a command's first attempt failed with a server error and the retry reported NoWritesPerformed, operations such as Database.RunCommand could return a nil error instead of the server error. They now return the original server error.

Sessions now inherit timeoutMS from the client, so operations run in a session honor the client-level timeout.

What's Changed

🐛 Fixed

Full Changelog: mongodb/mongo-go-driver@v2.9.1...v2.9.2

v2.9.1: MongoDB Go Driver 2.9.1

Compare Source

The MongoDB Go Driver Team is pleased to release version 2.9.1 of the official MongoDB Go Driver.

Release Highlights

[!WARNING]
Go Driver versions v1.0.0 through v1.17.9 and v2.0.0 through v2.9.0 are affected by a security issue CVE-2026-88031 in the GridFS delete methods. This release resolves that security issue in Go Driver v2. Users are encouraged to upgrade to Go Driver v2.9.1 as soon as possible. For the fix in Go Driver v1, see the v1.17.10 release.

This release addresses CVE-2026-88031, a security issue in GridFS delete methods where the file ID lookup could match more loosely than intended, potentially causing unintended file (and chunk) deletions instead of an exact match on the given file ID.

Users can manually restrict the file ID with a $eq operator before passing it to GridFSBucket methods using code like the following.

func exactMatch(id any) bson.D {
	return bson.D{{"$eq", id}}
}

// e.g., for v2, (*GridFSBucket).Delete() with an exact match on the file ID.
gridFSBucket.Delete(context.TODO(), exactMatch(id))

What's Changed

🐛 Fixed
  • GODRIVER-4081: Use exact match for file ID in GridFS delete methods. by @​qingyang-hu

Full Changelog: v2.9.0...v2.9.1

For a full list of tickets included in this release, please see the list of fixed issues.

Documentation for the Go Driver can be found on pkg.go.dev and the MongoDB documentation site. BSON library documentation is also available on pkg.go.dev. For issues with, questions about, or feedback for the Go Driver, please look into our support channels, including StackOverflow. Bugs can be reported in the Go Driver project in the MongoDB JIRA where a list of current issues can be found. Your feedback on the Go Driver is greatly appreciated!

v2.9.0: MongoDB Go Driver 2.9.0

Compare Source

The MongoDB Go Driver Team is pleased to release version 2.9.0 of the official MongoDB Go Driver.

Release Highlights

[!WARNING]
Go Driver versions v1.0.0 through v1.1.4 and v2.0.0 through v2.8.2 are affected by a security issue CVE-2026-107324 using the bson.Raw.Validate method. This release resolves that security issue in Go Driver v2. Users are encouraged to upgrade to Go Driver v2.9.0 as soon as possible.

[!WARNING]
The minimum supported MongoDB server version is now 4.4.

[!WARNING]
The minimum supported Go version is now 1.25. The Go Driver supports the last 2 Go minor versions.

This release addresses CVE-2026-107324, a security issue in calling bson.Raw.Validate. Calling bson.Raw.Validate on a document containing a binary element whose declared length is math.MaxInt32 causes a runtime panic.

New ext/awsauth module

The new ext/awsauth module adds support for all AWS authentication methods via the official AWS SDK for Go. Applications running on AWS can now use an awsauth.CredentialsProvider in ClientOptions, ClientEncryptionOptions, and AutoEncryptionOptions.

For example, to configure a mongo.Client with the new ext/awsauth module:

import (
    "context"
    "log"

    "github.com/aws/aws-sdk-go-v2/config"
    "go.mongodb.org/mongo-driver/ext/awsauth"
    "go.mongodb.org/mongo-driver/v2/mongo"
    "go.mongodb.org/mongo-driver/v2/mongo/options"
)

func main() {
	cfg, err := config.LoadDefaultConfig(context.Background())
	if err != nil {
		log.Fatal(err)
	}

	provider := awsauth.NewCredentialsProvider(cfg.Credentials)
	credential := options.Credential{
		AuthMechanism:          "MONGODB-AWS",
		AWSCredentialsProvider: provider,
	}

	client, err := mongo.Connect(options.Client().SetAuth(credential))
	if err != nil {
		log.Fatal(err)
	}
	defer client.Disconnect(context.Background())

	// ...
}

[!NOTE]
ext/awsauth is currently released as an experimental module and may have breaking changes in the future.

MongoDB 9.0 Intelligent Workload Management (IWM) Improvements

Improved performance for MongoDB 9.0's Intelligent Workload Management (IWM) by only retrying overload errors when doing so is expected to not worsen server conditions.

What's Changed

✨ New Features
🐛 Fixed
📦 Dependency Updates
📝 Other Changes

New Contributors

Full Changelog: mongodb/mongo-go-driver@v2.8.2...v2.9.0

For a full list of tickets included in this release, please see the list of fixed issues.

Documentation for the Go Driver can be found on pkg.go.dev and the MongoDB documentation site. BSON library documentation is also available on pkg.go.dev. For issues with, questions about, or feedback for the Go Driver, please look into our support channels, including StackOverflow. Bugs can be reported in the Go Driver project in the MongoDB JIRA where a list of current issues can be found. Your feedback on the Go Driver is greatly appreciated!

v2.8.2: MongoDB Go Driver 2.8.2

Compare Source

The MongoDB Go Driver Team is pleased to release version 2.8.2 of the official MongoDB Go Driver.

Release Highlights

[!WARNING]
Driver versions v2.1.0 through v2.8.1 are affected by a security issue CVE-2026-81521 in Client.BulkWrite that is fixed in this release (v2.8.2). Users are encouraged to upgrade to this version as soon as possible.

This release addresses CVE-2026-81521, a security issue in calling Client.BulkWrite. A caller-controlled database name containing a period ('.') may be interpreted as a different namespace when forwarded to MongoDB. This could redirect operations to a database or collection other than the one intended by the application.

It also fixes a bug in Collection.BulkWrite where, for unordered bulk writes split across multiple batches, a write-concern error from an earlier batch could be non-deterministically silently dropped or replaced by subsequent batches. Now the operation will return the last non-nil writeConcern error, if one occured.

What's Changed

🐛 Fixed
  • GODRIVER-4025 fix: Preserve the last non-nil WriteConcernError across bulk write batches by @​zigzagdev in #​2555
  • GODRIVER-4075 Return an error if there are invalid characters in the database name for bulkWrite. by @​matthewdale

Full Changelog: mongodb/mongo-go-driver@v2.8.1...v2.8.2

For a full list of tickets included in this release, please see the list of fixed issues.

Documentation for the Go Driver can be found on pkg.go.dev and the MongoDB documentation site. BSON library documentation is also available on pkg.go.dev. For issues with, questions about, or feedback for the Go Driver, please look into our support channels, including StackOverflow. Bugs can be reported in the Go Driver project in the MongoDB JIRA where a list of current issues can be found. Your feedback on the Go Driver is greatly appreciated!

v2.8.1: MongoDB Go Driver 2.8.1

Compare Source

The MongoDB Go Driver Team is pleased to release version 2.8.1 of the official MongoDB Go Driver.

Release Highlights

This release fixes a bug where failed writes could look like they succeeded. If a write operation's first attempt failed with a NoWritesPerformed error label, the driver could return a nil/ErrNoDocuments result instead of the real failure, and the caller would end up decoding the server's error document as if it were a normal result. The bug has been fixed so the driver now surfaces the real server error, letting applications detect and retry the failure correctly.

What's Changed

🐛 Fixed
  • GODRIVER-4088 Return the server error when the first attempt fails with NoWritesPerformed. by @​qingyang-hu in #​2549

Full Changelog: mongodb/mongo-go-driver@v2.8.0...v2.8.1

For a full list of tickets included in this release, please see the list of fixed issues.

Documentation for the Go Driver can be found on pkg.go.dev and the MongoDB documentation site. BSON library documentation is also available on pkg.go.dev. For issues with, questions about, or feedback for the Go Driver, please look into our support channels, including StackOverflow. Bugs can be reported in the Go Driver project in the MongoDB JIRA where a list of current issues can be found. Your feedback on the Go Driver is greatly appreciated!

v2.8.0: MongoDB Go Driver 2.8.0

Compare Source

The MongoDB Go Driver Team is pleased to release version 2.8.0 of the official MongoDB Go Driver.

Release Highlights

This release supports the general availability of Queryable Encryption string queries. The query types prefix, suffix, and substring are added as generally available for MongoDB 9.0+ and libmongocrypt 1.20.0. The query types prefixPreview, suffixPreview, and substringPreview remain experimental for 8.2–8.x servers and may be removed in a future release.

Other key facts:

  • The algorithm TextPreview is replaced with String.
  • API rename: options.Text() → options.String(); TextOptions* → StringOptions*; EncryptOptionsBuilder.SetTextOptions → SetStringOptions.

What's Changed

✨ New Features
📦 Dependency Updates

Full Changelog: mongodb/mongo-go-driver@v2.7.0...v2.8.0

For a full list of tickets included in this release, please see the list of fixed issues.

Documentation for the Go Driver can be found on pkg.go.dev and the MongoDB documentation site. BSON library documentation is also available on pkg.go.dev. For issues with, questions about, or feedback for the Go Driver, please look into our support channels, including StackOverflow. Bugs can be reported in the Go Driver project in the MongoDB JIRA where a list of current issues can be found. Your feedback on the Go Driver is greatly appreciated!

v2.7.0: MongoDB Go Driver 2.7.0

Compare Source

The MongoDB Go Driver Team is pleased to release version 2.7.0 of the official MongoDB Go Driver.

Release Highlights

This release adds support for sending afterClusterTime on writes in causally consistent sessions, improving alignment between read and write behavior in session-based workflows. It also continues cleanup of session-related and internal-only APIs by deprecating the experimental session API, helping clarify which surfaces are intended for long-term public use. Alongside that, the release includes a handful of targeted quality improvements across BSON validation, change streams, and error reporting to make the driver more predictable and easier to debug.

What's Changed

✨ New Features
🐛 Fixed
📝 Other Changes

New Contributors

Full Changelog: mongodb/mongo-go-driver@v2.6.2...v2.7.0

For a full list of tickets included in this release, please see the list of fixed issues.

Documentation for the Go Driver can be found on pkg.go.dev and the MongoDB documentation site. BSON library documentation is also available on pkg.go.dev. For issues with, questions about, or feedback for the Go Driver, please look into our support channels, including StackOverflow. Bugs can be reported in the Go Driver project in the MongoDB JIRA where a list of current issues can be found. Your feedback on the Go Driver is greatly appreciated!

v2.6.2: MongoDB Go Driver 2.6.2

Compare Source

The MongoDB Go Driver Team is pleased to release version 2.6.2 of the official MongoDB Go Driver.

Release Highlights

This release excludes non-I/O TLS errors from backpressure labels, aligning error labeling more closely with the CMAP specification. This fixes cases where protocol-level TLS handshake failures, such as certificate validation, hostname mismatch, fatal alerts, or malformed record headers, could be incorrectly classified as overload-related errors. As a result, these failures are handled more accurately during connection establishment and SDAM/pool error processing.

What's Changed

🐛 Fixed

Full Changelog: mongodb/mongo-go-driver@v2.6.1...v2.6.2

For a full list of tickets included in this release, please see the list of fixed issues.

Documentation for the Go Driver can be found on pkg.go.dev and the MongoDB documentation site. BSON library documentation is also available on pkg.go.dev. For issues with, questions about, or feedback for the Go Driver, please look into our support channels, including StackOverflow. Bugs can be reported in the Go Driver project in the MongoDB JIRA where a list of current issues can be found. Your feedback on the Go Driver is greatly appreciated!

v2.6.1: MongoDB Go Driver 2.6.1

Compare Source

The MongoDB Go Driver Team is pleased to release version 2.6.1 of the official MongoDB Go Driver.

Release Highlights

This release fixes batched writes to split by full wire-message size instead of document payload size, preventing near-limit InsertMany failures; fixes unmarshaling of null and undefined values into raw BSON types such as bson.Raw, bsoncore.Document, and bsoncore.Array; and fixes mongo.ErrorCodes() to return codes for ClientBulkWriteException, including duplicate-key errors from client bulk writes.

[!WARNING]
This release changed bson.Raw unmarshaling for BSON null values from the long-standing V2 behavior of Raw{} to Raw(nil). Decoding to Raw{} was a bug and was inconsistent with other container types. If you added checks or workarounds that depend on Raw{}, update them to expect Raw(nil) (or nil) after upgrading.

What's Changed

🐛 Fixed

New Contributors

Full Changelog: mongodb/mongo-go-driver@v2.6.0...v2.6.1

For a full list of tickets included in this release, please see the list of fixed issues.

Documentation for the Go Driver can be found on pkg.go.dev and the MongoDB documentation site. BSON library documentation is also available on pkg.go.dev. For issues with, questions about, or feedback for the Go Driver, please look into our support channels, including StackOverflow. Bugs can be reported in the Go Driver project in the MongoDB JIRA where a list of current issues can be found. Your feedback on the Go Driver is greatly appreciated!

v2.6.0: MongoDB Go Driver 2.6.0

Compare Source

The MongoDB Go Driver Team is pleased to release version 2.6.0 of the official MongoDB Go Driver.

Release Highlights

[!IMPORTANT]
A future Go Driver minor release will raise the minimum supported MongoDB Server version from 4.2 to 4.4. This is in accordance with MongoDB Software Lifecycle Schedules. Support for MongoDB Server 4.2 will be dropped in a future release!

This release adds support for MongoDB's Intelligent Workload Management (IWM) and ingress connection rate limiting features. The driver now gracefully handles write-blocking scenarios and optimizes connection establishment during high-load conditions to maintain application availability. These features will be functional with MongoDB Server Version 9.0 and above.

Two new methods of ClientOptions are available:

  • SetMaxAdaptiveRetries - specifies the maximum number of times the driver should retry operations that fail with a server side overload error. If not invoked, the default is 2. MaxAdaptiveRetries can also be set through the "maxAdaptiveRetries" URI option (e.g. "maxAdaptiveRetries=5").
  • SetEnableOverloadRetargeting - specifies whether the driver should enable overload retargeting for operations that fail with a server side overload error. If not invoked, the default is false. EnableOverloadRetargeting can also be set through the "enableOverloadRetargeting" URI option (e.g. "enableOverloadRetargeting=true").

What's Changed

✨ New Features

Full Changelog: mongodb/mongo-go-driver@v2.5.1...v2.6.0

For a full list of tickets included in this release, please see the list of fixed issues.

Documentation for the Go Driver can be found on pkg.go.dev and the MongoDB documentation site. BSON library documentation is also available on pkg.go.dev. For issues with, questions about, or feedback for the Go Driver, please look into our support channels, including StackOverflow. Bugs can be reported in the Go Driver project in the MongoDB JIRA where a list of current issues can be found. Your feedback on the Go Driver is greatly appreciated!

v2.5.1: MongoDB Go Driver 2.5.1

Compare Source

The MongoDB Go Driver Team is pleased to release version 2.5.1 of the official MongoDB Go Driver.

Release Highlights

This release fixes two BSON unmarshaling edge cases.

What's Changed

🐛 Fixed

Full Changelog: mongodb/mongo-go-driver@v2.5.0...v2.5.1

For a full list of tickets included in this release, please see the list of fixed issues.

Documentation for the Go Driver can be found on pkg.go.dev and the MongoDB documentation site. BSON library documentation is also available on pkg.go.dev. For issues with, questions about, or feedback for the Go Driver, please look into our support channels, including StackOverflow. Bugs can be reported in the Go Driver project in the MongoDB JIRA where a list of current issues can be found. Your feedback on the Go Driver is greatly appreciated!

v2.5.0: MongoDB Go Driver 2.5.0

Compare Source

The MongoDB Go Driver Team is pleased to release version 2.5.0 of the official MongoDB Go Driver.

Release Highlights

This release adds a preview of CRUD support for prefix/suffix/substring indexes. Prefix, suffix and substring search are in preview and should be used for experimental workloads only. These features are unstable and their security is not guaranteed until released as Generally Available (GA). The GA version of these features may not be backwards compatible with the preview version.

Also, this release adds AsFloat64(), AsFloat64OK() to bson.RawValue, and DefaultDocumentMap() to bson.Decoder in the BSON package.

Additionally, this release adds ErrorCodes() to parse server error codes from an arbitrary Go error, and exposes atClusterTime in snapshot sessions.

Moreover, this release fixes several bugs, including potential heap out-of-bounds read in GSSAPI error handling.

What's Changed

✨ New Features
🐛 Fixed
📦 Dependency Updates
📝 Other Changes

New Contributors

Full Changelog: mongodb/mongo-go-driver@v2.4.2...v2.5.0

For a full list of tickets included in this release, please see the list of fixed issues.

Documentation for the Go Driver can be found on pkg.go.dev and the MongoDB documentation site. BSON library documentation is also available on pkg.go.dev. For issues with, questions about, or feedback for the Go Driver, please look into our support channels, including StackOverflow. Bugs can be reported in the Go Driver project in the MongoDB JIRA where a list of current issues can be found. Your feedback on the Go Driver is greatly appreciated!

v2.4.4: MongoDB Go Driver 2.4.4

Compare Source

The MongoDB Go Driver Team is pleased to release version 2.4.4 of the official MongoDB Go Driver.

[!NOTE]
Due to a bug in the Go Driver release automation, there are no release notes for version 2.4.3. Go Driver 2.4.4 and 2.4.3 are functionally identical.

Release Highlights

This release fixes a resource leak in the RTT monitor and fixes logging for transaction operations.

What's Changed

🐛 Fixed
  • GODRIVER-3698 Support

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

@konih konih added the dependencies Pull requests that update a dependency file label Oct 30, 2026
@konih

konih commented Oct 30, 2026

Copy link
Copy Markdown
Collaborator Author

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 1 additional dependency was updated

Details:

Package Change
github.com/xdg-go/scram v1.1.2 -> v1.2.0

@codecov

codecov Bot commented Oct 30, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

@konih
konih force-pushed the renovate/go.mongodb.org-mongo-driver-2.x branch 4 times, most recently from 8ebf7dc to bdf4bd9 Compare November 5, 2026 07:01
@konih
⬆️ chore(deps): migrate mongodb sink to mongo-driver v2
148d329 
Renovate added go.mongodb.org/mongo-driver/v2 v2.9.3 next to the v1
require without migrating any import, so go.mod/tidy drifted and
Preflight failed. This moves the mongodb sink to v2 and drops v1.

API changes applied:
- mongo.Connect takes no context in v2. The connect/probe deadline
  still bounds Ping, collection verify/ensure, and the SRV lookup still
  happens in ApplyURI, so the effective timeouts are unchanged.
- ReplaceOne/DeleteMany take options.Lister[...] instead of *Options;
  the exportCollection/deleteManyCollection seams follow.
- mtest moved under the driver's internal/ tree. The admin unit test
  now builds a client on the public x/mongo/driver/drivertest
  MockDeployment (set via xoptions "deployment"), keeps the list,
  create and index assertions, and adds a server-error case that proves
  the mock responses are what the code reads.
- v2 decodes nested documents in an `any` as bson.D, not a map, so the
  integration helper reads the stored attribute from raw BSON instead.

TLS handling (ApplyURI, Validate, TLSConfig, dns.DefaultResolver,
connstring fields) and write-error classification (WriteException,
IsDuplicateKeyError) keep the same shape in v2; the reader-vs-driver
parity test and the integration suite pass against v2.9.3.
@konih
konih force-pushed the renovate/go.mongodb.org-mongo-driver-2.x branch from bdf4bd9 to 148d329 Compare November 5, 2026 10:17
@sonarqubecloud

sonarqubecloud Bot commented Nov 5, 2026

Copy link
Copy Markdown

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

@konih
konih merged commit 99c530c into main Nov 5, 2026
44 checks passed
@konih
konih deleted the renovate/go.mongodb.org-mongo-driver-2.x branch November 5, 2026 10:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@konih