spuru9 opened a new pull request, #74: URL: https://github.com/apache/flink-connector-mongodb/pull/74
## Purpose of the change `mongodb-driver-sync` 5.1.1 is affected by CVE-2026-88033 (High, CVSS 8.3) — a GridFS query-injection flaw allowing an authenticated user to read/delete file content outside their target, or hijack a rename. Fixed in 5.11.1. ## Verifying this change - Driver >=5.5 drops MongoDB Server 4.0 support (requires wire version 8 / MongoDB 4.2+). Verified directly: a live MongoDB 4.0.28 server is rejected with `MongoIncompatibleDriverException`. The `mongodb4` CI profile's server version is moved forward accordingly (4.0.28 → 4.4.30). - Verified against the full current server range per the driver's compatibility matrix (5.8–5.11 supports 4.2 through 8.3); live tests against 4.4.30, 8.0.29, and 8.0.32 pass (insert/find/count/aggregate). - `mvn clean test-compile` passes for both the default profile and `-P mongodb4`, confirming no source-incompatible API changes from the driver bump. Full MongoDB 8.x support is only partial on 5.1.1; a follow-up ticket will add a `mongodb8` CI profile once this lands. ## Significant changes - `mongodb.driver.version`: 5.1.1 → 5.11.1 - `mongodb4.version`: 4.0.28 → 4.4.30 Generated-by: Claude Sonnet 5 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
