dependabot[bot] opened a new pull request, #40111: URL: https://github.com/apache/beam/pull/40111
Bumps [go.mongodb.org/mongo-driver](https://github.com/mongodb/mongo-go-driver) from 1.17.9 to 1.17.10. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/mongodb/mongo-go-driver/releases";>go.mongodb.org/mongo-driver's releases</a>.</em></p> <blockquote> <h2>MongoDB Go Driver 1.17.10</h2> <p>The MongoDB Go Driver Team is pleased to release version 1.17.10 of the official MongoDB Go Driver.</p> <h2>Release Highlights</h2> <blockquote> <p>[!WARNING]<br /> Go Driver versions v1.0.0 through v1.17.9 and v2.0.0 through v2.9.0 are affected by a security issue <a href="https://www.cve.org/CVERecord?id=CVE-2026-88031";>CVE-2026-88031</a> in the GridFS delete methods. This release resolves that security issue in Go Driver v1. Users are encouraged to upgrade to Go Driver v1.17.10 as soon as possible. For the fix in Go Driver v2, see the <a href="https://github.com/mongodb/mongo-go-driver/releases/tag/v2.9.1";>v2.9.1</a> release.</p> </blockquote> <p>This release addresses <a href="https://www.cve.org/CVERecord?id=CVE-2026-88031";>CVE-2026-88031</a>, a security issue in GridFS delete methods where the file ID lookup could match more loosely than intended, potentially causing unintended file (and chunk) deletions instead of an exact match on the given file ID.</p> <p>Users can manually restrict the file ID with a <code>$eq</code> operator before passing it to GridFSBucket methods using code like the following.</p> <pre lang="go"><code>func exactMatch(id any) bson.D { return bson.D{{"$eq", id}} } <p>// e.g., for v1, (*Bucket).DeleteContext() with an exact match on the file ID. bucket.DeleteContext(context.TODO(), exactMatch(id)) </code></pre></p> <h2>What's Changed</h2> <h3>🐛 Fixed</h3> <ul> <li>GODRIVER-4081: Use exact match for file ID in GridFS delete methods. by <a href="https://github.com/qingyang-hu";><code>@qingyang-hu</code></a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/mongodb/mongo-go-driver/compare/v1.17.9...v1.17.10";>https://github.com/mongodb/mongo-go-driver/compare/v1.17.9...v1.17.10</a></p> <p>For a full list of tickets included in this release, please see the <a href="https://jira.mongodb.org/issues/?jql=project%3Dgodriver%20and%20fixVersion%3D1.17.10";>list of fixed issues</a>.</p> <p>Documentation for the Go Driver can be found on <a href="https://pkg.go.dev/go.mongodb.org/mongo-driver/mongo?tab=doc";>pkg.go.dev</a> and the <a href="https://docs.mongodb.com/ecosystem/drivers/go/v1.x";>MongoDB documentation site</a>. BSON library documentation is also available on <a href="https://pkg.go.dev/go.mongodb.org/mongo-driver/bson?tab=doc";>pkg.go.dev</a>. For issues with, questions about, or feedback for the Go Driver, please look into our <a href="https://www.mongodb.com/docs/manual/support/";>support channels</a>, including <a href="https://stackoverflow.com/questions/tagged/mongodb%20go?sort=Newest";>StackOverflow</a>. Bugs can be reported in the <a href="https://jira.mongodb.org/secure/CreateIssue!default.jspa?pid=14289";>Go Driver project in the MongoDB JIRA</a> where a list of <a href="https://jira.mongodb.org/browse/GODRIVER";>current issues</a> can be found. Your feedback on the Go Driver is greatly appreciated!</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/mongodb/mongo-go-driver/commit/d13e5a543a925a20c924c863acb97c6e5bafbf5e";><code>d13e5a5</code></a> BUMP v1.17.10</li> <li><a href="https://github.com/mongodb/mongo-go-driver/commit/1cdec85df93ede289cf50bf371d48ce98ad93409";><code>1cdec85</code></a> Merge pull request <a href="https://redirect.github.com/mongodb/mongo-go-driver/issues/2596";>#2596</a> from prestonvasquez/pin-det-to-890a93bdb</li> <li><a href="https://github.com/mongodb/mongo-go-driver/commit/9635a5fdd3a364f0bc2e34f43282f35334808090";><code>9635a5f</code></a> Pin DET to 890a93bdb</li> <li><a href="https://github.com/mongodb/mongo-go-driver/commit/65af5ff64857e65caa1abb42dd424a69508b414c";><code>65af5ff</code></a> bump github tools for release to 89904229</li> <li><a href="https://github.com/mongodb/mongo-go-driver/commit/e8462ed7ec300c8a8391e5e42df848bd6773e2a4";><code>e8462ed</code></a> bump github tools for release to 89904229</li> <li><a href="https://github.com/mongodb/mongo-go-driver/commit/2428d94c5aa8bd51797fcca11a3f1bf7bf044375";><code>2428d94</code></a> Merge commit from fork</li> <li><a href="https://github.com/mongodb/mongo-go-driver/commit/6da3d8fd0ae194efc1ead9944cfcf5d2daad5655";><code>6da3d8f</code></a> update spec test cases</li> <li><a href="https://github.com/mongodb/mongo-go-driver/commit/806e132f9501a2665d05ebaba3b6f0d787ceaa96";><code>806e132</code></a> GODRIVER-4081 Use exact match for file ID in GridFS delete methods.</li> <li>See full diff in <a href="https://github.com/mongodb/mongo-go-driver/compare/v1.17.9...v1.17.10";>compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
