Repository navigation
Update dependency mongodb/mongodb to v2.4.2 [SECURITY] - #24
Open
renovate[bot] wants to merge 1 commit into
Open
renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
Contributor
Author
Branch automerge failureThis PR was configured for branch automerge. However, this is not possible, so it has been raised as a PR instead.
|
| datasource | package | from | to | | ---------- | --------------- | ----- | ----- | | packagist | mongodb/mongodb | 2.2.0 | 2.4.2 | Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
renovate
Bot
force-pushed
the
renovate/packagist-mongodb-mongodb-vulnerability
branch
from
October 6, 2026 20:27
839d2ec to
138f956
Compare
renovate
Bot
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
2.2.0→2.4.2mongodb: Reject "." and NUL bytes in database and collection names
CVE-2026-81525 / GHSA-65fr-j4p9-vc33
More information
Details
Impact
Passing untrusted input as part of a database or collection name may result in targeting a different database or collection than specified.
Patches
Fixed in PHP library 1.21.4 and 2.4.1.
Workarounds
Validate database and collection names prior to passing into APIs.
Severity
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:NReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
MongoDB: GridFS data disclosure and deletion via query-operator injection in file IDs
CVE-2026-88023 / GHSA-8fxw-fmj8-xp7j
More information
Details
Impact
Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB PHP Library can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable. The affected rename operation may also rename a stored file other than the intended target.
Patches
Fixed in 1.21.5 and 2.4.2.
Workarounds
Validate GridFS IDs.
References
https://jira.mongodb.org/browse/PHPLIB-1929
Severity
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:NReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Release Notes
mongodb/mongo-php-library (mongodb/mongodb)
v2.4.2Compare Source
The PHP team is happy to announce that version 2.4.2 of the MongoDB PHP library is now available.
Release Highlights
A complete list of resolved issues in this release may be found in JIRA.
Documentation
Documentation for this library may be found in the PHP Library Manual.
Installation
This library may be installed or upgraded with:
composer require mongodb/mongodb:2.4.2
Installation instructions for the
mongodbextension may be found in the PHP.net documentation.v2.4.1Compare Source
The PHP team is happy to announce that version 2.4.1 of the MongoDB PHP library is now available.
Release Highlights
A complete list of resolved issues in this release may be found in JIRA.
Documentation
Documentation for this library may be found in the PHP Library Manual.
Installation
This library may be installed or upgraded with:
composer require mongodb/mongodb:2.4.1
Installation instructions for the
mongodbextension may be found in the PHP.net documentation.v2.4.0Compare Source
The PHP team is happy to announce that version 2.4.0 of the MongoDB PHP library is now available.
Release Highlights
$rankFusionstage and$sigmoidexpression by @GromNaN in #1885$hashand$hexHashoperators by @paulinevos in #1887$rerankstage by @GromNaN in #1892returnStoredSourcein$vectorSearchby @paulinevos in #1896flatindexing method for vector search by @paulinevos in #1917vectorSearchby @paulinevos in #1912doesNotAffectarg for relevant operators by @paulinevos in #1927arrayIndexAssupport for$filterand$reduceoperators by @GromNaN in #1936A complete list of resolved issues in this release may be found in JIRA.
Documentation
Documentation for this library may be found in the PHP Library Manual.
Installation
This library may be installed or upgraded with:
Installation instructions for the
mongodbextension may be found in the PHP.net documentation.v2.3.0Compare Source
The PHP team is happy to announce that version 2.3.0 of the MongoDB PHP library is now available.
Release Highlights
Added support for MongoDB 's Intelligent Workload Management (IWM) and ingress connection rate limiting features. The driver now gracefully handles write-blocking scenarios and optimizes connection establishment during high-load conditions to maintain application availability. These features will be functional with MongoDB Atlas Server Version 9.0 and above.
mongodb+srvconnection string in connection test tool by @alcaeus in #1841ext-mongodb: ^2.3and test against dev branch by @GromNaN in #1879A complete list of resolved issues in this release may be found in JIRA.
Server compatibility
MongoDB 4.4+ Required: Future versions of the library will require MongoDB 4.4 or later. MongoDB 4.2 support is deprecated.
The Client Backpressure features will be functional with MongoDB Atlas Server Version 9.0 and above.
Documentation
Documentation for this library may be found in the PHP Library Manual.
Installation
This library may be installed or upgraded with:
Installation instructions for the
mongodbextension may be found in the PHP.net documentation.Configuration
📅 Schedule: (in timezone UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.