fix(deps): update all non-major dependencies

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update
github.com/go-sql-driver/mysql	v1.10.0 → v1.10.1			require	patch
github.com/jackc/pgx/v5	v5.9.2 → v5.11.0			require	minor
go.mongodb.org/mongo-driver/v2	v2.6.0 → v2.9.1			require	minor
go.opentelemetry.io/contrib/bridges/otelslog	v0.19.0 → v0.20.1			require	minor
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp	v0.69.0 → v0.71.0			require	minor
go.opentelemetry.io/otel	v1.44.0 → v1.46.0			require	minor
go.opentelemetry.io/otel/metric	v1.44.0 → v1.46.0			require	minor
go.opentelemetry.io/otel/trace	v1.44.0 → v1.46.0			require	minor
golang (source)	1.26-bookworm → 1.27-bookworm			stage	minor

---

Release Notes

go-sql-driver/mysql (github.com/go-sql-driver/mysql)

v1.10.1

Compare Source

• Fix Config.FormatDSN() dropping Addr when Net is empty.
  It now uses the default tcp network so configs with only Addr round-trip correctly. (#​1770)

• Fix typed-nil json.RawMessage with interpolateParams=true being interpolated as an empty string.
  It is now interpolated as SQL NULL, matching server-side prepared statements. (#​1782)

• Add MariaDB 11.8 and 12.3 to the test matrix. (#​1774)

jackc/pgx (github.com/jackc/pgx/v5)

v5.11.0

Compare Source

This release adds direct PostgreSQL type scanning through database/sql on Go 1.27, improves compatibility with
libpq connection strings and PostgreSQL date/time values, and includes further decoder hardening. See Changes for
connection-string and date/time behavior changes that may affect existing applications.

Features

• stdlib: support Go 1.27's driver.RowsColumnScanner, allowing PostgreSQL types such as arrays and ranges to be
  scanned directly into Go values without pgtype.Map.SQLScanner. Existing database/sql scalar conversions and
  sql.Scanner behavior are preserved. The minimum supported Go version remains 1.25.
• Add Rows.TypeMap to expose the type map used to decode rows, including rows created by RowsFromResultReader
  that have no underlying Conn. Custom implementations of Rows, including mocks, must add this method.
• pgconn: add Config.MaxProtocolMessageBodyLen to configure the maximum incoming protocol message body size
  (carter-ya)
• pgconn: add ErrReadOnlyConnection, ErrReadWriteConnection, ErrPrimaryConnection, and ErrStandbyConnection
  sentinel errors for target_session_attrs validation, allowing callers to use errors.Is (Adrian-Stefan Mares)
• pgxpool: accept pool_ping_timeout in connection strings to configure Config.PingTimeout. The default is zero;
  zero and negative durations mean no timeout (1991santhu)

Changes

• Name-based row-to-struct mapping now matches explicit db tags case-insensitively, with exact matches taking
  precedence so tags can still distinguish quoted column names that differ only by case (AlisinaDevelo)

• pgconn: resolve the OS user account only when no user is supplied by the connection string, environment, or service
  file, avoiding unnecessary account lookups and crashes in some restricted container environments. Home-directory
  defaults for password, service, and TLS files remain available independently of the account lookup. On Unix these
  now use $HOME rather than the OS account's home directory (Mohamed MAACHE)

• pgtype: date, timestamp and timestamptz text values are now parsed and written by a hand-written parser and
  encoder for PostgreSQL's ISO date/time format instead of time.Parse and time.Format. Go's layout language cannot
  express a variable-width year or the BC era, which is the root of the bugs below. The text scan path is roughly 2.5x
  faster for timestamp and timestamptz. Bug fixes:

  • timestamp and timestamptz no longer silently move February 29 of a BC leap year to March 1 when encoding.
    time.Date(-4712, 2, 29, ...) was written as 4713-03-01 BC and is now written as 4713-02-29 BC. This
    affected ordinary four-digit BC years, not only extended-range ones. date was never affected.
  • timestamp and timestamptz can now scan BC leap days. 4713-02-29 BC previously failed with
    day out of range. date could already scan them.
  • Years past 9999 can now be scanned. 10000-01-02 03:04:05 previously failed to parse, so timestamp and
    timestamptz values at the high end of PostgreSQL's range were unreadable over the simple protocol and in any
    other text-format result.
  • time.Time arguments in the simple protocol now encode BC dates correctly, using the same timestamp encoder.
  • Fractional seconds beyond microsecond precision are rounded the way the server rounds them (round half to even,
    carrying into the rest of the value) instead of being kept at full precision. PostgreSQL never sends more than six
    fractional digits, so this only affects values from other sources.

  Behavior changes:

  • date now rejects impossible dates instead of normalizing them. 2024-02-30 returned 2024-03-01 and
    2024-13-01 returned 2025-01-01; both are now errors. timestamp and timestamptz already rejected them.
  • All three types now reject values outside PostgreSQL's range for that type, in the binary format as well as the
    text format. PostgreSQL never sends out-of-range dates, so this only affects corrupt or hand-built input; the range
    is checked in both formats so that whether a value is accepted does not depend on QueryExecMode.
    timestamptz also rejects time zone displacements outside PostgreSQL's signed 32-bit seconds range, while accepting
    the wider offsets emitted for POSIX time zones, such as +16.
  • timestamptz values scanned from the text format are now returned in time.Local, or in ScanLocation when it is
    set, matching what the binary format has always returned. Previously the text path kept whatever location
    time.Parse derived from the offset the server sent, so the same value scanned in the two formats could report a
    different Location() and Zone(). The instant is unchanged, but everything that renders the location changes
    with it: Timestamptz.MarshalJSON now writes the client's offset rather than the server's, so a value the server
    sent as +05:30 marshals as 2024-01-01T13:34:05-08:00 on a UTC-8 client instead of 2024-01-02T03:04:05+05:30,
    and DecodeDatabaseSQLValue hands database/sql a time.Time in that same location. Set the codec's
    ScanLocation to time.UTC to pin the location regardless of the client's zone.
  • Error messages from these paths have changed.

• pgconn: connection URIs (postgres://...) are now parsed by a new parser designed to exactly match libpq's URI
  parser behavior instead of net/url,
  making pgx accept and reject exactly the same URIs as libpq (verified by differential fuzzing against libpq itself).
  Most connection strings are unaffected. Edge-case behavior changes, all matching libpq:

  • + in query values is literal, no longer decoded as a space.
  • Malformed percent-encoding is a parse error instead of the parameter being silently dropped. %00 is rejected.
  • Leading/trailing spaces in URI components are trimmed; interior spaces are a parse error (encode them as %20).
  • # is ordinary data, not a fragment delimiter.
  • The userinfo terminator is the first @ before any / (previously the last @).
  • When a query parameter is repeated, the last occurrence wins (previously the first).
  • ssl=true is accepted as an alias for sslmode=require in URIs (JDBC compatibility). A repeated ssl key
    follows the same last-occurrence-wins rule as other repeated parameters, even across the rewrite to sslmode. If
    the final ssl value is not true, an independent explicit sslmode remains in effect.
  • Multiple hosts with mixed port specs are positionally aligned: postgres://h1,h2:5433/db now means h1:5432 and
    h2:5433 (previously both hosts got port 5433). A port list that is neither a single port nor exactly one port per
    host is an error (could not match N port numbers to M hosts), also for keyword/value connection strings.
  • An IPv6 address in a URI must be enclosed in brackets. A bare postgres://::1/db was previously accepted as host
    ::1; it is now read as an empty host followed by port :1 and fails with an invalid port error. Write it as
    postgres://[::1]/db.
  • Empty host list elements (e.g. h1,,h2) get the default host instead of being dropped. Likewise, an empty host in
    a keyword/value string (host=) now means the default host -- typically the Unix socket directory -- where it
    previously meant a TCP connection to an empty hostname.
  • An empty port (?port= in a URI or port= in a keyword/value string) now means the default port 5432 for the
    affected hosts; previously it was an invalid port error. Like any connection-string port, a present-but-empty port
    takes precedence over PGPORT.
  • ASCII control characters (tab, newline, ...) in a URI are ordinary data bytes, as they are to libpq; net/url
    rejected any URI containing one. The exception is a literal NUL byte, which is still rejected, as net/url did.
    (libpq never sees one -- C strings end at the first NUL -- but in Go a raw NUL could otherwise pass through into
    the NUL-delimited startup message and inject extra parameters.)

  Unlike libpq, unrecognized URI query parameters are still accepted (they become runtime parameters or pgx-specific
  options). Parse error messages avoid quoting the unredacted connection string and redact recognizable password
  fields on a best-effort basis. Invalid connection strings can be structurally ambiguous, so password redaction
  cannot be guaranteed for every malformed input.

• pgconn: keyword/value connection strings (host=... user=...) now match libpq's parser exactly, the same treatment
  the URI parser received above and verified the same way, by differential fuzzing against libpq itself. Most
  connection strings are unaffected. Behavior changes, all matching libpq:

  • A backslash escapes whatever character follows it and is dropped, where previously only \\ and \' were
    unescaped and every other backslash was kept. A value containing a backslash must now escape it, as libpq
    requires: sslcert=C:\path\to\cert reads as C:pathtocert and has to be written sslcert=C:\\path\\to\\cert.
    This mainly affects Windows certificate and key paths, which previously came through intact without doubling.
  • A trailing backslash in an unquoted value escapes the end of the string, so it is dropped and the value ends
    there; it was previously rejected with invalid backslash. Inside a quoted value the escaped terminator leaves
    the string unterminated, which is still an error.
  • Whitespace inside a keyword is an error (missing "=" after "us" in connection info string) instead of becoming
    part of the key. Whitespace around the = is unaffected. This most often shows up with an unquoted value
    containing a space: application_name=my app host=x previously set neither parameter and sent app host to the
    server as a runtime parameter, and now fails to parse.

  As with URIs, unrecognized keywords are still accepted where libpq rejects them, and an empty user= is still
  dropped so that PGUSER and the OS user still apply.

Fixes

• Keep the connection open after a recoverable PostgreSQL error from Begin or BeginTx
  (Victor Alejandro Sanz Ararat)
• Call TraceQueryEnd when Exec fails while deallocating invalidated cached statements (Chris Bandy)
• Deallocate a failed prepare using the statement name actually sent to the server, and skip cleanup if Parse never
  completed, avoiding leaked prepared statements and unnecessary cleanup errors (Eliran Ben-Zikri)
• Fix LoadTypes overwriting scalar codecs such as box and point with an incorrect ArrayCodec (Arsen Ozhetov)
• pgconn: retrieve field descriptions when cached descriptions are empty, such as for cursor FETCH statements,
  including batch and pipeline execution (water)
• pgconn: keep batch statement descriptions and result formats aligned when commands return no rows or when
  Batch.ExecStatement is mixed with other batch commands; preserve field descriptions for empty results
• pgconn: handle empty and comment-only queries in pipeline mode, discard stale statement data after bind errors,
  and return a nil result from Pipeline.GetResults on error
• pgconn: skip reading the password file when a password is already set (Jared Fowkes)
• pgxpool: treat non-positive MaxConnLifetime values as unlimited instead of immediately expiring connections
  (Aurelien Pillevesse)
• pgtype: support non-comma text array delimiters through ArrayCodec.Delimiter, including the semicolon delimiter
  used by box[]. LoadType and LoadTypes now load the delimiter from PostgreSQL (Sueun Cho)
• pgtype: quote text array elements containing internal whitespace (Louisa Huang)
• pgtype: quote and escape text range bounds containing delimiters, quotes, or backslashes, and distinguish empty
  string bounds from unbounded ranges (Sueun Cho)
• pgtype: preserve decimal precision in Numeric.ScanScientific and accept scientific notation in
  Numeric.UnmarshalJSON; reject out-of-range scientific exponents and preserve the original input in parse errors
  (Sueun Cho)
• pgtype: encode and decode numeric infinity in JSON as "Infinity" and "-Infinity" instead of encoding it as zero
  (Vladimir Saraikin)
• pgtype: treat a valid Numeric with a nil Int as zero in Int64Value, and return errors when converting NaN or
  infinity to an integer instead of panicking (Vladimir Saraikin)
• pgtype: fix an infinite loop when decoding binary numeric zero with a nonzero digit count (Vladimir Saraikin)
• pgtype: fix binary numeric digit-count overflow and trailing-byte handling. Binary encoding now rejects values
  whose digit count, weight, or scale cannot fit the wire format, while accepting the full unsigned digit-count range.
• pgtype: fix scanning through multiple pointer levels, including SQL NULL and XML values, and return an error
  instead of panicking when a pointer-to-pointer scan destination is nil (Rangel Reale)
• pgtype: use bounds-checked binary reads throughout the codecs and reject malformed lengths, counts, and trailing
  data. This includes fixes for panics on malformed records and truncated multiranges (Vladimir Saraikin), and
  validation of bit / varbit bit lengths against the actual data (g3m0sis).
• pgtype: return errors instead of panicking on malformed interval text (greymoth-jp), unterminated composite text
  fields, and text arrays whose dimensions and element counts disagree
• pgtype: cap the initial allocation estimate when parsing hstore text to avoid excessive allocation from unvalidated
  separator counts; valid hstores may still contain any number of pairs (AshSgDe29071999)
• pgtype: correct reversed bounds in integer scan error messages
• pgconn: a backslash as the last byte of a quoted value in a keyword/value connection string no longer panics with
  slice bounds out of range. host='a\ -- and the shorter ='\, reachable through pgx.ParseConfig and
  pgxpool.ParseConfig -- now return unterminated quoted string in connection info string, libpq's own message for
  the same input. The unquoted branch has been guarded since be69c1c; the quoted branch carried the same unguarded
  increment since the parser was ported from pgx v3. Found by fuzzing (Maxim Korotkov)
• pgconn: error messages that embed the connection string now also redact password and sslpassword values supplied
  as URI query parameters; previously only the userinfo password was redacted. Redaction matches keys the way the
  parser does -- percent-encoded spellings such as pass%77ord= are recognized -- and masks the entire raw value, so
  a password containing a space cannot leak its tail into the error message. Credentials stranded outside the
  userinfo by a malformed URI are masked whole, and invalid-port errors no longer embed the offending text (which in
  a malformed URI can be a mislaid password). Redaction of invalid connection strings is necessarily best effort:
  their structure may be ambiguous, so some malformed inputs can still expose password text in an error.
• pgconn: ParseConfigOptions.ConnStringAllowedKeys no longer exempts an explicitly supplied empty port (?port= in
  a URI or port= in a keyword/value string) from the allow-list. Only the implied all-empty port list of a
  multi-host URI without ports (postgres://h1,h2/db) is exempt. An explicit empty port shadows PGPORT even though
  it is empty, so it must be allowed like any other user-supplied key. The URI-only ssl=true alias is accepted when
  either ssl or sslmode is allowed, and every ssl/sslmode spelling written in the URI is validated --
  including occurrences superseded by later repeated parameters.
• pgconn: drain socket before close in asyncClose so context cancellation produces a TCP FIN instead of RST, avoiding "connection reset by peer" on the server / proxy (Sean Chittenden at CrowdStrike, Inc.)
• pgproto3: StartupMessage.Encode rejects a NUL byte in any parameter name or value instead of writing it. The
  startup message body is a run of NUL-delimited strings whose length is data-driven, so a NUL in a value ends that
  parameter and everything after it is read by the server as further parameters -- an application_name of
  x\x00user\x00admin changed the role the connection logged in as. libpq cannot reach this state because its
  parameters are NUL-terminated C strings. Connect now fails with nothing written to the wire, which covers
  settings that bypass connection string parsing: service files and direct assignment to Config.RuntimeParams,
  Config.User, or Config.Database.
• pgconn: keyword/value connection strings containing a NUL byte are rejected by ParseConfig, as URIs already were.

v5.10.0

Compare Source

mongodb/mongo-go-driver (go.mongodb.org/mongo-driver/v2)

v2.9.1: MongoDB Go Driver 2.9.1

Compare Source

The MongoDB Go Driver Team is pleased to release version 2.9.1 of the official MongoDB Go Driver.

Release Highlights

[!WARNING]
Go Driver versions v1.0.0 through v1.17.9 and v2.0.0 through v2.9.0 are affected by a security issue CVE-2026-88031 in the GridFS delete methods. This release resolves that security issue in Go Driver v2. Users are encouraged to upgrade to Go Driver v2.9.1 as soon as possible. For the fix in Go Driver v1, see the v1.17.10 release.

This release addresses CVE-2026-88031, a security issue in GridFS delete methods where the file ID lookup could match more loosely than intended, potentially causing unintended file (and chunk) deletions instead of an exact match on the given file ID.

Users can manually restrict the file ID with a $eq operator before passing it to GridFSBucket methods using code like the following.

func exactMatch(id any) bson.D {
	return bson.D{{"$eq", id}}
}

// e.g., for v2, (*GridFSBucket).Delete() with an exact match on the file ID.
gridFSBucket.Delete(context.TODO(), exactMatch(id))

What's Changed

🐛 Fixed

• GODRIVER-4081: Use exact match for file ID in GridFS delete methods. by @​qingyang-hu

Full Changelog: v2.9.0...v2.9.1

For a full list of tickets included in this release, please see the list of fixed issues.

Documentation for the Go Driver can be found on pkg.go.dev and the MongoDB documentation site. BSON library documentation is also available on pkg.go.dev. For issues with, questions about, or feedback for the Go Driver, please look into our support channels, including StackOverflow. Bugs can be reported in the Go Driver project in the MongoDB JIRA where a list of current issues can be found. Your feedback on the Go Driver is greatly appreciated!

v2.9.0: MongoDB Go Driver 2.9.0

Compare Source

The MongoDB Go Driver Team is pleased to release version 2.9.0 of the official MongoDB Go Driver.

Release Highlights

[!WARNING]
The minimum supported MongoDB server version is now 4.4.

[!WARNING]
The minimum supported Go version is now 1.25. The Go Driver supports the last 2 Go minor versions.

New ext/awsauth module

The new ext/awsauth module adds support for all AWS authentication methods via the official AWS SDK for Go. Applications running on AWS can now use an awsauth.CredentialsProvider in ClientOptions, ClientEncryptionOptions, and AutoEncryptionOptions.

For example, to configure a mongo.Client with the new ext/awsauth module:

import (
    "context"
    "log"

    "github.com/aws/aws-sdk-go-v2/config"
    "go.mongodb.org/mongo-driver/ext/awsauth"
    "go.mongodb.org/mongo-driver/v2/mongo"
    "go.mongodb.org/mongo-driver/v2/mongo/options"
)

func main() {
	cfg, err := config.LoadDefaultConfig(context.Background())
	if err != nil {
		log.Fatal(err)
	}

	provider := awsauth.NewCredentialsProvider(cfg.Credentials)
	credential := options.Credential{
		AuthMechanism:          "MONGODB-AWS",
		AWSCredentialsProvider: provider,
	}

	client, err := mongo.Connect(options.Client().SetAuth(credential))
	if err != nil {
		log.Fatal(err)
	}
	defer client.Disconnect(context.Background())

	// ...
}

[!NOTE]
ext/awsauth is currently released as an experimental module and may have breaking changes in the future.

MongoDB 9.0 Intelligent Workload Management (IWM) Improvements

Improved performance for MongoDB 9.0's Intelligent Workload Management (IWM) by only retrying overload errors when doing so is expected to not worsen server conditions.

What's Changed

✨ New Features

• GODRIVER-4034 Update the built-in AWS credential interfaces to match aws-sdk-go-v2. by @​qingyang-hu in #​2481
• GODRIVER-3567 Add optional AWS SDK v2-based MONGODB-AWS authenticator submodule by @​qingyang-hu in #​2494
• GODRIVER-3856: Bump maxWireVersion for 9.0 server release by @​prestonvasquez in #​2520
• GODRIVER-3567 Add optional AWS SDK v2-based MONGODB-AWS authenticator submodule by @​qingyang-hu in #​2508
• GODRIVER-3872: Mark Server version 4.2 as EOL by @​prestonvasquez in #​2523
• GODRIVER-3963 Update client backpressure with baseBackoffMS. by @​qingyang-hu in #​2544
• GODRIVER-3956 Fix TLS record header error tests on Windows by @​qingyang-hu in #​2558
• GODRIVER-4013: Remove the goreportcard badge from README.md by @​ayesha-ilm in #​2574
• GODRIVER-4060: Remove unused authenticator field from endSessionsOp by @​zigzagdev in #​2565
• GODRIVER-4101 Add tlsDisableCertificateRevocationCheck option. by @​qingyang-hu in #​2571

🐛 Fixed

• GODRIVER-4102: reject int32 length overflow in bsoncore valueLength by @​rajath201 in #​2548
• GODRIVER-4108: Exclude remote TLS alerts from backpressure labels by @​prestonvasquez in #​2570
• GODRIVER-4096 Fix panic in Collection.insert on out-of-order write errors by @​harmv in #​2557
• GODRIVER-4109: Exclude OCSP errors from backpressure label by @​prestonvasquez in #​2584

📦 Dependency Updates

• Bump github.com/klauspost/compress from 1.17.6 to 1.19.0 by @​dependabot[bot] in #​2464
• GODRIVER-4044 Update golang.org/x/text to v0.39.0 and raise minimum Go version to 1.25. by @​qingyang-hu in #​2522
• Bump github.com/klauspost/compress from 1.17.6 to 1.19.2 by @​dependabot[bot] in #​2539

📝 Other Changes

• GODRIVER-4062 Remove the ServerOverloadedError retry example. by @​matthewdale in #​2568

New Contributors

• @​rajath201 made their first contribution in #​2548
• @​ayesha-ilm made their first contribution in #​2574
• @​harmv made their first contribution in #​2557

Full Changelog: mongodb/mongo-go-driver@v2.8.2...v2.9.0

For a full list of tickets included in this release, please see the list of fixed issues.

Documentation for the Go Driver can be found on pkg.go.dev and the MongoDB documentation site. BSON library documentation is also available on pkg.go.dev. For issues with, questions about, or feedback for the Go Driver, please look into our support channels, including StackOverflow. Bugs can be reported in the Go Driver project in the MongoDB JIRA where a list of current issues can be found. Your feedback on the Go Driver is greatly appreciated!

v2.8.2: MongoDB Go Driver 2.8.2

Compare Source

The MongoDB Go Driver Team is pleased to release version 2.8.2 of the official MongoDB Go Driver.

Release Highlights

[!WARNING]
Driver versions v2.1.0 through v2.8.1 are affected by a security issue CVE-2026-81521 in Client.BulkWrite that is fixed in this release (v2.8.2). Users are encouraged to upgrade to this version as soon as possible.

This release addresses CVE-2026-81521, a security issue in calling Client.BulkWrite. A caller-controlled database name containing a period ('.') may be interpreted as a different namespace when forwarded to MongoDB. This could redirect operations to a database or collection other than the one intended by the application.

It also fixes a bug in Collection.BulkWrite where, for unordered bulk writes split across multiple batches, a write-concern error from an earlier batch could be non-deterministically silently dropped or replaced by subsequent batches. Now the operation will return the last non-nil writeConcern error, if one occured.

What's Changed

🐛 Fixed

• GODRIVER-4025 fix: Preserve the last non-nil WriteConcernError across bulk write batches by @​zigzagdev in #​2555
• GODRIVER-4075 Return an error if there are invalid characters in the database name for bulkWrite. by @​matthewdale

Full Changelog: mongodb/mongo-go-driver@v2.8.1...v2.8.2

For a full list of tickets included in this release, please see the list of fixed issues.

Documentation for the Go Driver can be found on pkg.go.dev and the MongoDB documentation site. BSON library documentation is also available on pkg.go.dev. For issues with, questions about, or feedback for the Go Driver, please look into our support channels, including StackOverflow. Bugs can be reported in the Go Driver project in the MongoDB JIRA where a list of current issues can be found. Your feedback on the Go Driver is greatly appreciated!

v2.8.1: MongoDB Go Driver 2.8.1

Compare Source

The MongoDB Go Driver Team is pleased to release version 2.8.1 of the official MongoDB Go Driver.

Release Highlights

This release fixes a bug where failed writes could look like they succeeded. If a write operation's first attempt failed with a NoWritesPerformed error label, the driver could return a nil/ErrNoDocuments result instead of the real failure, and the caller would end up decoding the server's error document as if it were a normal result. The bug has been fixed so the driver now surfaces the real server error, letting applications detect and retry the failure correctly.

What's Changed

🐛 Fixed

• GODRIVER-4088 Return the server error when the first attempt fails with NoWritesPerformed. by @​qingyang-hu in #​2549

Full Changelog: mongodb/mongo-go-driver@v2.8.0...v2.8.1

For a full list of tickets included in this release, please see the list of fixed issues.

Documentation for the Go Driver can be found on pkg.go.dev and the MongoDB documentation site. BSON library documentation is also available on pkg.go.dev. For issues with, questions about, or feedback for the Go Driver, please look into our support channels, including StackOverflow. Bugs can be reported in the Go Driver project in the MongoDB JIRA where a list of current issues can be found. Your feedback on the Go Driver is greatly appreciated!

v2.8.0: MongoDB Go Driver 2.8.0

Compare Source

The MongoDB Go Driver Team is pleased to release version 2.8.0 of the official MongoDB Go Driver.

Release Highlights

This release supports the general availability of Queryable Encryption string queries. The query types prefix, suffix, and substring are added as generally available for MongoDB 9.0+ and libmongocrypt 1.20.0. The query types prefixPreview, suffixPreview, and substringPreview remain experimental for 8.2–8.x servers and may be removed in a future release.

Other key facts:

• The algorithm TextPreview is replaced with String.
• API rename: options.Text() → options.String(); TextOptions* → StringOptions*; EncryptOptionsBuilder.SetTextOptions → SetStringOptions.

What's Changed

✨ New Features

• GODRIVER-3863: Add QE prefix and suffix GA by @​prestonvasquez in #​2447
• GODRIVER-4002: Add substring to QE GA by @​prestonvasquez in #​2471

📦 Dependency Updates

• Bump golang.org/x/net from 0.53.0 to 0.55.0 in /examples by @​dependabot[bot] in #​2461
• Bump golang.org/x/net from 0.53.0 to 0.55.0 in /internal/test/compilecheck by @​dependabot[bot] in #​2456
• Bump golang.org/x/crypto from 0.50.0 to 0.52.0 in /internal/test/goleak by @​dependabot[bot] in #​2469

Full Changelog: mongodb/mongo-go-driver@v2.7.0...v2.8.0

For a full list of tickets included in this release, please see the list of fixed issues.

Documentation for the Go Driver can be found on pkg.go.dev and the MongoDB documentation site. BSON library documentation is also available on pkg.go.dev. For issues with, questions about, or feedback for the Go Driver, please look into our support channels, including StackOverflow. Bugs can be reported in the Go Driver project in the MongoDB JIRA where a list of current issues can be found. Your feedback on the Go Driver is greatly appreciated!

v2.7.0: MongoDB Go Driver 2.7.0

Compare Source

The MongoDB Go Driver Team is pleased to release version 2.7.0 of the official MongoDB Go Driver.

Release Highlights

This release adds support for sending afterClusterTime on writes in causally consistent sessions, improving alignment between read and write behavior in session-based workflows. It also continues cleanup of session-related and internal-only APIs by deprecating the experimental session API, helping clarify which surfaces are intended for long-term public use. Alongside that, the release includes a handful of targeted quality improvements across BSON validation, change streams, and error reporting to make the driver more predictable and easier to debug.

What's Changed

✨ New Features

• GODRIVER-3921 retro backpressure cleanup by @​prestonvasquez in #​2394
• GODRIVER-3912 Add prose test for database.ListCollection routing by @​prestonvasquez in #​2390
• GODRIVER-3874 Send afterClusterTime on writes in causally-consistent sessions by @​matthewdale in #​2412
• GODRIVER-3957 Fix long lines in bson/decoder_example_test.go and expand check-fmt to cover both *_example_test.go and *_examples_test.go files by @​linborland in #​2428
• GODRIVER-3962 fix: change stream set batch size nil cursor by @​zigzagdev in #​2424
• GODRIVER-3965 fix: misleading error message type info in rewrap function by @​zigzagdev in #​2430

🐛 Fixed

• GODRIVER-3862: Collection.Clone propegates BSONOptions by @​softprops in #​2364
• GODRIVER-3858 Split write batches by wire-message size, not document payload (Merge up from release/2.6). by @​qingyang-hu in #​2397
• GODRIVER-3931 Fix bson.Raw.Validate panic on zero-length BSON document by @​linborland in #​2418
• GODRIVER-3832: Fix mongo.ErrorCodes() with ClientBulkWriteException by @​FGasper in #​2420
• GODRIVER-3960 fix: format Arguments swapping by @​zigzagdev in #​2423

📝 Other Changes

• GODRIVER-3838 Update comments on SetLimit(). by @​qingyang-hu in #​2372
• GODRIVER-3871 Make files in "examples" runnable. by @​qingyang-hu in #​2381
• GODRIVER-3880 Skip QE "prefixPreview" and "suffixPreview" tests on server 9.0.0+. by @​qingyang-hu in #​2378
• GODRIVER-3917 Replace curl | sh with go install in etc/golangci-lint.sh by @​prestonvasquez in #​2391
• GODRIVER-3829 Cleanup skip list. by @​qingyang-hu in #​2392
• GODRIVER-3884 Use gpg verification for libmongocrypt windows build variant by @​prestonvasquez in #​2404
• GODRIVER-3868 Update extended bson cases. by @​qingyang-hu in #​2400
• GODRIVER-3623 Deprecate AggregateOptions Custom functionality as internal-only. by @​linborland in #​2411
• Move the 2125 skips to standalone container by @​prestonvasquez in #​2421
• GODRIVER-3904 Add QE string prefix/suffix/substring case and diacritic insensitive prose tests by @​prestonvasquez in #​2415
• GODRIVER-3937 Deprecate x/mongo/driver/session package. by @​matthewdale in #​2416
• GODRIVER-3936 Migrate check_fmt.sh to a Go script under internal/cmd/check-fmt by @​linborland in #​2414
• GODRIVER-3726 Use unmarshaling for AutoEncryptOpts in the unified spec test by @​linborland in #​2413
• Make capitalization of MongoDB Go Driver consistent in the README. by @​matthewdale in #​2422
• GODRIVER-3113 Skip flaky test in commit.json. by @​qingyang-hu in #​2435
• GODRIVER-3559 Skip Docker Runner Tests by @​qingyang-hu in #​2432

New Contributors

• @​softprops made their first contribution in #​2364
• @​linborland made their first contribution in #​2411
• @​zigzagdev made their first contribution in #​2423

Full Changelog: mongodb/mongo-go-driver@v2.6.2...v2.7.0

For a full list of tickets included in this release, please see the list of fixed issues.

Documentation for the Go Driver can be found on pkg.go.dev and the MongoDB documentation site. BSON library documentation is also available on pkg.go.dev. For issues with, questions about, or feedback for the Go Driver, please look into our support channels, including StackOverflow. Bugs can be reported in the Go Driver project in the MongoDB JIRA where a list of current issues can be found. Your feedback on the Go Driver is greatly appreciated!

v2.6.2: MongoDB Go Driver 2.6.2

Compare Source

The MongoDB Go Driver Team is pleased to release version 2.6.2 of the official MongoDB Go Driver.

Release Highlights

This release excludes non-I/O TLS errors from backpressure labels, aligning error labeling more closely with the CMAP specification. This fixes cases where protocol-level TLS handshake failures, such as certificate validation, hostname mismatch, fatal alerts, or malformed record headers, could be incorrectly classified as overload-related errors. As a result, these failures are handled more accurately during connection establishment and SDAM/pool error processing.

What's Changed

🐛 Fixed

• GODRIVER-3906 Exclude tls.RecordHeaderError from backpressure labels by @​matthewdale in #​2417

Full Changelog: mongodb/mongo-go-driver@v2.6.1...v2.6.2

For a full list of tickets included in this release, please see the list of fixed issues.

Documentation for the Go Driver can be found on pkg.go.dev and the MongoDB documentation site. BSON library documentation is also available on pkg.go.dev. For issues with, questions about, or feedback for the Go Driver, please look into our support channels, including StackOverflow. Bugs can be reported in the Go Driver project in the MongoDB JIRA where a list of current issues can be found. Your feedback on the Go Driver is greatly appreciated!

v2.6.1: MongoDB Go Driver 2.6.1

Compare Source

The MongoDB Go Driver Team is pleased to release version 2.6.1 of the official MongoDB Go Driver.

Release Highlights

This release fixes batched writes to split by full wire-message size instead of document payload size, preventing near-limit InsertMany failures; fixes unmarshaling of null and undefined values into raw BSON types such as bson.Raw, bsoncore.Document, and bsoncore.Array; and fixes mongo.ErrorCodes() to return codes for ClientBulkWriteException, including duplicate-key errors from client bulk writes.

What's Changed

🐛 Fixed

• GODRIVER-3858 Split write batches by wire-message size, not document payload by @​koenno in #​2360
• GODRIVER-3858 split write batches by wire-message size, not document payload by @​qingyang-hu in #​2382
• GODRIVER-3924 Fix bug of unmarshaling null. by @​qingyang-hu in #​2401
• GODRIVER-3832: Fix mongo.ErrorCodes() with ClientBulkWriteException (… by @​prestonvasquez in #​2426

New Contributors

• @​koenno made their first contribution in #​2360

Full Changelog: mongodb/mongo-go-driver@v2.6.0...v2.6.1

For a full list of tickets included in this release, please see the list of fixed issues.

Documentation for the Go Driver can be found on pkg.go.dev and the MongoDB documentation site. BSON library documentation is also available on pkg.go.dev. For issues with, questions about, or feedback for the Go Driver, please look into our support channels, including StackOverflow. Bugs can be reported in the Go Driver project in the MongoDB JIRA where a list of current issues can be found. Your feedback on the Go Driver is greatly appreciated!

open-telemetry/opentelemetry-go-contrib (go.opentelemetry.io/contrib/bridges/otelslog)

v0.20.0

Compare Source

Changed

• The go.opentelemetry.io/contrib/instrumentation/go.mongodb.org/mongo-driver/mongo/otelmongo instrumentation now accepts a WithCommandAttributeDisabled,
  so the caller can specify whether to opt-out of tracing the mongo command. (#​712)
• Upgrade to v0.20.0 of go.opentelemetry.io/otel. (#​758)
• The B3 and Jaeger propagators now store their debug or deferred state in the context.Context instead of the SpanContext. (#​758)

---

Raw changes made between v0.19.0 and v0.20.0

0e5bef9 (HEAD -> main, tag: v0.20.0, tag: propagators/v0.20.0, tag: propagators/opencensus/v0.20.0, tag: propagators/opencensus/examples/v0.20.0, tag: propagators/aws/v0.20.0, tag: instrumentation/runtime/v0.20.0, tag: instrumentation/runtime/example/v0.20.0, tag: instrumentation/net/http/otelhttp/v0.20.0, tag: instrumentation/net/http/otelhttp/example/v0.20.0, tag: instrumentation/net/http/httptrace/otelhttptrace/v0.20.0, tag: instrumentation/net/http/httptrace/otelhttptrace/example/v0.20.0, tag: instrumentation/host/v0.20.0, tag: instrumentation/host/example/v0.20.0, tag: instrumentation/gopkg.in/macaron.v1/otelmacaron/v0.20.0, tag: instrumentation/gopkg.in/macaron.v1/otelmacaron/example/v0.20.0, tag: instrumentation/

❗ Important

✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Only on Sunday and Saturday (* * * * 0,6)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 40.95%. Comparing base (6738681) to head (63f9f42).

Additional details and impacted files

@@            Coverage Diff             @@
##             main       #8      +/-   ##
==========================================
+ Coverage   39.31%   40.95%   +1.64%     
==========================================
  Files          58       58              
  Lines        6746     5958     -788     
==========================================
- Hits         2652     2440     -212     
+ Misses       3951     3518     -433     
+ Partials      143        0     -143     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 10 additional dependencies were updated

Details:

Package	Change
github.com/felixge/httpsnoop	v1.0.4 -> v1.1.0
github.com/go-logr/logr	v1.4.3 -> v1.4.4
github.com/klauspost/compress	v1.18.6 -> v1.19.2
go.opentelemetry.io/otel/log	v0.20.0 -> v0.22.0
go.opentelemetry.io/otel/sdk	v1.44.0 -> v1.46.0
go.opentelemetry.io/otel/sdk/metric	v1.44.0 -> v1.46.0
golang.org/x/crypto	v0.52.0 -> v0.53.0
golang.org/x/sync	v0.20.0 -> v0.21.0
golang.org/x/sys	v0.45.0 -> v0.47.0
golang.org/x/text	v0.37.0 -> v0.39.0