v2.9.2: MongoDB Go Driver 2.9.2

Compare Source

The MongoDB Go Driver Team is pleased to release version 2.9.2 of the official MongoDB Go Driver.

Release Highlights

[!WARNING]
Go Driver versions v2.1.0 through v2.8.1 and v2.9.0 through v2.9.1 are affected by a security issue CVE-2026-81521 in Client.BulkWrite. The fix shipped in v2.8.2 but was not included in v2.9.0 or v2.9.1. This release restores the fix for the 2.9 line. Users on v2.9.0 or v2.9.1 are encouraged to upgrade to Go Driver v2.9.2 as soon as possible. Go Driver v1 is not affected.

[!WARNING]
Go Driver versions v1.1.0 and later and v2.0.0 through v2.9.1 are affected by a security issue CVE-2026-107325 in the bson.RawArray.Validate method. This release resolves that security issue in Go Driver v2. Users are encouraged to upgrade to Go Driver v2.9.2 as soon as possible.

This release addresses CVE-2026-81521, a security issue in calling Client.BulkWrite. A caller-controlled database name containing a period ('.') may be interpreted as a different namespace when forwarded to MongoDB. This could redirect operations to a database or collection other than the one intended by the application.

This release addresses CVE-2026-107325, a security issue in calling bson.RawArray.Validate. Calling bson.RawArray.Validate on an array whose declared length is 0 causes a runtime panic.

It also restores a fix from v2.8.1 that was likewise missing from v2.9.0 and v2.9.1: when a command's first attempt failed with a server error and the retry reported NoWritesPerformed, operations such as Database.RunCommand could return a nil error instead of the server error. They now return the original server error.

Sessions now inherit timeoutMS from the client, so operations run in a session honor the client-level timeout.

What's Changed

🐛 Fixed

• GODRIVER-4142: Inherit timeoutMS at the session level (#​2586) by @​prestonvasquez in #​2598
• GODRIVER-4135 Reject negative uncompressed size in DecompressPayload. by @​qingyang-hu in #​2607
• GODRIVER-4083 fix duplicate error logging for network error by @​ayesha-ilm in #​2595
• GODRIVER-4136: reject BSON lengths below the 5-byte minimum before slicing by @​rajath201 in #​2591
• GODRIVER-4118 fix: correct Truncate boundary handling for multi-byte UTF-8 characters by @​zigzagdev in #​2564
• GODRIVER-4177 guard empty documents slice in decodeOpReply QueryFailure branch by @​rajath201 in #​2638
• GODRIVER-4075 Return an error if there are invalid characters in the … by @​prestonvasquez in #​2665
• GODRIVER-4088 Return the server error when the first attempt fails wi… by @​prestonvasquez in #​2666

Full Changelog: mongodb/mongo-go-driver@v2.9.1...v2.9.2

v2.9.1: MongoDB Go Driver 2.9.1

Compare Source

The MongoDB Go Driver Team is pleased to release version 2.9.1 of the official MongoDB Go Driver.

Release Highlights

[!WARNING]
Go Driver versions v1.0.0 through v1.17.9 and v2.0.0 through v2.9.0 are affected by a security issue CVE-2026-88031 in the GridFS delete methods. This release resolves that security issue in Go Driver v2. Users are encouraged to upgrade to Go Driver v2.9.1 as soon as possible. For the fix in Go Driver v1, see the v1.17.10 release.

This release addresses CVE-2026-88031, a security issue in GridFS delete methods where the file ID lookup could match more loosely than intended, potentially causing unintended file (and chunk) deletions instead of an exact match on the given file ID.

Users can manually restrict the file ID with a $eq operator before passing it to GridFSBucket methods using code like the following.

func exactMatch(id any) bson.D {
	return bson.D{{"$eq", id}}
}

// e.g., for v2, (*GridFSBucket).Delete() with an exact match on the file ID.
gridFSBucket.Delete(context.TODO(), exactMatch(id))

What's Changed

🐛 Fixed

• GODRIVER-4081: Use exact match for file ID in GridFS delete methods. by @​qingyang-hu

Full Changelog: v2.9.0...v2.9.1

For a full list of tickets included in this release, please see the list of fixed issues.

Documentation for the Go Driver can be found on pkg.go.dev and the MongoDB documentation site. BSON library documentation is also available on pkg.go.dev. For issues with, questions about, or feedback for the Go Driver, please look into our support channels, including StackOverflow. Bugs can be reported in the Go Driver project in the MongoDB JIRA where a list of current issues can be found. Your feedback on the Go Driver is greatly appreciated!

v2.9.0: MongoDB Go Driver 2.9.0

Compare Source

The MongoDB Go Driver Team is pleased to release version 2.9.0 of the official MongoDB Go Driver.

Release Highlights

[!WARNING]
Go Driver versions v1.0.0 through v1.1.4 and v2.0.0 through v2.8.2 are affected by a security issue CVE-2026-107324 using the bson.Raw.Validate method. This release resolves that security issue in Go Driver v2. Users are encouraged to upgrade to Go Driver v2.9.0 as soon as possible.

[!WARNING]
The minimum supported MongoDB server version is now 4.4.

[!WARNING]
The minimum supported Go version is now 1.25. The Go Driver supports the last 2 Go minor versions.

This release addresses CVE-2026-107324, a security issue in calling bson.Raw.Validate. Calling bson.Raw.Validate on a document containing a binary element whose declared length is math.MaxInt32 causes a runtime panic.

New ext/awsauth module

The new ext/awsauth module adds support for all AWS authentication methods via the official AWS SDK for Go. Applications running on AWS can now use an awsauth.CredentialsProvider in ClientOptions, ClientEncryptionOptions, and AutoEncryptionOptions.

For example, to configure a mongo.Client with the new ext/awsauth module:

import (
    "context"
    "log"

    "github.com/aws/aws-sdk-go-v2/config"
    "go.mongodb.org/mongo-driver/ext/awsauth"
    "go.mongodb.org/mongo-driver/v2/mongo"
    "go.mongodb.org/mongo-driver/v2/mongo/options"
)

func main() {
	cfg, err := config.LoadDefaultConfig(context.Background())
	if err != nil {
		log.Fatal(err)
	}

	provider := awsauth.NewCredentialsProvider(cfg.Credentials)
	credential := options.Credential{
		AuthMechanism:          "MONGODB-AWS",
		AWSCredentialsProvider: provider,
	}

	client, err := mongo.Connect(options.Client().SetAuth(credential))
	if err != nil {
		log.Fatal(err)
	}
	defer client.Disconnect(context.Background())

	// ...
}

[!NOTE]
ext/awsauth is currently released as an experimental module and may have breaking changes in the future.

MongoDB 9.0 Intelligent Workload Management (IWM) Improvements

Improved performance for MongoDB 9.0's Intelligent Workload Management (IWM) by only retrying overload errors when doing so is expected to not worsen server conditions.

What's Changed

✨ New Features

• GODRIVER-4034 Update the built-in AWS credential interfaces to match aws-sdk-go-v2. by @​qingyang-hu in #​2481
• GODRIVER-3567 Add optional AWS SDK v2-based MONGODB-AWS authenticator submodule by @​qingyang-hu in #​2494
• GODRIVER-3856: Bump maxWireVersion for 9.0 server release by @​prestonvasquez in #​2520
• GODRIVER-3567 Add optional AWS SDK v2-based MONGODB-AWS authenticator submodule by @​qingyang-hu in #​2508
• GODRIVER-3872: Mark Server version 4.2 as EOL by @​prestonvasquez in #​2523
• GODRIVER-3963 Update client backpressure with baseBackoffMS. by @​qingyang-hu in #​2544
• GODRIVER-3956 Fix TLS record header error tests on Windows by @​qingyang-hu in #​2558
• GODRIVER-4013: Remove the goreportcard badge from README.md by @​ayesha-ilm in #​2574
• GODRIVER-4060: Remove unused authenticator field from endSessionsOp by @​zigzagdev in #​2565
• GODRIVER-4101 Add tlsDisableCertificateRevocationCheck option. by @​qingyang-hu in #​2571

🐛 Fixed

• GODRIVER-4102: reject int32 length overflow in bsoncore valueLength by @​rajath201 in #​2548
• GODRIVER-4108: Exclude remote TLS alerts from backpressure labels by @​prestonvasquez in #​2570
• GODRIVER-4096 Fix panic in Collection.insert on out-of-order write errors by @​harmv in #​2557
• GODRIVER-4109: Exclude OCSP errors from backpressure label by @​prestonvasquez in #​2584

📦 Dependency Updates

• Bump github.com/klauspost/compress from 1.17.6 to 1.19.0 by @​dependabot[bot] in #​2464
• GODRIVER-4044 Update golang.org/x/text to v0.39.0 and raise minimum Go version to 1.25. by @​qingyang-hu in #​2522
• Bump github.com/klauspost/compress from 1.17.6 to 1.19.2 by @​dependabot[bot] in #​2539

📝 Other Changes

• GODRIVER-4062 Remove the ServerOverloadedError retry example. by @​matthewdale in #​2568

New Contributors

• @​rajath201 made their first contribution in #​2548
• @​ayesha-ilm made their first contribution in #​2574
• @​harmv made their first contribution in #​2557

Full Changelog: mongodb/mongo-go-driver@v2.8.2...v2.9.0

For a full list of tickets included in this release, please see the list of fixed issues.

Documentation for the Go Driver can be found on pkg.go.dev and the MongoDB documentation site. BSON library documentation is also available on pkg.go.dev. For issues with, questions about, or feedback for the Go Driver, please look into our support channels, including StackOverflow. Bugs can be reported in the Go Driver project in the MongoDB JIRA where a list of current issues can be found. Your feedback on the Go Driver is greatly appreciated!

v2.8.2: MongoDB Go Driver 2.8.2

Compare Source

The MongoDB Go Driver Team is pleased to release version 2.8.2 of the official MongoDB Go Driver.

Release Highlights

[!WARNING]
Driver versions v2.1.0 through v2.8.1 are affected by a security issue CVE-2026-81521 in Client.BulkWrite that is fixed in this release (v2.8.2). Users are encouraged to upgrade to this version as soon as possible.

This release addresses CVE-2026-81521, a security issue in calling Client.BulkWrite. A caller-controlled database name containing a period ('.') may be interpreted as a different namespace when forwarded to MongoDB. This could redirect operations to a database or collection other than the one intended by the application.

It also fixes a bug in Collection.BulkWrite where, for unordered bulk writes split across multiple batches, a write-concern error from an earlier batch could be non-deterministically silently dropped or replaced by subsequent batches. Now the operation will return the last non-nil writeConcern error, if one occured.

What's Changed

🐛 Fixed

• GODRIVER-4025 fix: Preserve the last non-nil WriteConcernError across bulk write batches by @​zigzagdev in #​2555
• GODRIVER-4075 Return an error if there are invalid characters in the database name for bulkWrite. by @​matthewdale

Full Changelog: mongodb/mongo-go-driver@v2.8.1...v2.8.2

For a full list of tickets included in this release, please see the list of fixed issues.

Documentation for the Go Driver can be found on pkg.go.dev and the MongoDB documentation site. BSON library documentation is also available on pkg.go.dev. For issues with, questions about, or feedback for the Go Driver, please look into our support channels, including StackOverflow. Bugs can be reported in the Go Driver project in the MongoDB JIRA where a list of current issues can be found. Your feedback on the Go Driver is greatly appreciated!

v2.8.1: MongoDB Go Driver 2.8.1

Compare Source

The MongoDB Go Driver Team is pleased to release version 2.8.1 of the official MongoDB Go Driver.

Release Highlights

This release fixes a bug where failed writes could look like they succeeded. If a write operation's first attempt failed with a NoWritesPerformed error label, the driver could return a nil/ErrNoDocuments result instead of the real failure, and the caller would end up decoding the server's error document as if it were a normal result. The bug has been fixed so the driver now surfaces the real server error, letting applications detect and retry the failure correctly.

What's Changed

🐛 Fixed

• GODRIVER-4088 Return the server error when the first attempt fails with NoWritesPerformed. by @​qingyang-hu in #​2549

Full Changelog: mongodb/mongo-go-driver@v2.8.0...v2.8.1

For a full list of tickets included in this release, please see the list of fixed issues.

Documentation for the Go Driver can be found on pkg.go.dev and the MongoDB documentation site. BSON library documentation is also available on pkg.go.dev. For issues with, questions about, or feedback for the Go Driver, please look into our support channels, including StackOverflow. Bugs can be reported in the Go Driver project in the MongoDB JIRA where a list of current issues can be found. Your feedback on the Go Driver is greatly appreciated!