[dependabot]

Updated MongoDB.Driver from 3.11.0 to 3.13.0.

Release notes

Sourced from MongoDB.Driver's releases.

3.13.0

[!IMPORTANT]
This release addresses a number of CVEs reported against the driver, along with a small number of related fixes. Several fixes make the driver stricter about invalid input: it now rejects malformed raw BSON, out-of-range binary subtypes, GeoJSON extra members that collide with declared members, replacement documents that start with an operator, and LINQ field names that the server would reinterpret. A few generated updates and schema patterns also change shape, and BsonSymbolTable and one CSFLE PatternProperty overload are now marked obsolete. Please review the behavior changes listed under each security fix below before upgrading.

This is the general availability release for the 3.13.0 version of the driver.

Security fixes:

• CSHARP-6157 / CVE-2026-114646: NoSQL command injection via mismatched raw BSON length prefix written verbatim to the wire
  • Behavior change: writing a raw BSON document or array now throws ArgumentException if its declared length is inconsistent with the buffer. Bytes past the declared length are ignored.
• CSHARP-6162 / CVE-2026-114644: Memory-exhaustion denial of service via unbounded symbol interning during BSON/JSON deserialization
  • Behavior change: BsonSymbol values are no longer interned and BsonSymbolTable is marked obsolete. Use BsonSymbol.Create or the implicit string conversion instead. Equality still compares by name; only reference identity changes.
• CSHARP-6166 / CVE-2026-114654: BSON output corruption via out-of-range binary subtype bypassing UUID and OldBinary guards
  • Behavior change: BsonBinaryData, the JSON reader (BinData, HexData and legacy $type) and the binary writer now reject binary subtypes outside 0 to 255.
• CSHARP-6168 / CVE-2026-114652: Update operator injection via single-element list rewriting in the update builder
  • Behavior change: PushEach and AddToSetEach with a single value now always render $each, and PullAll with a single value now always renders $pullAll. Previously a single value was unwrapped or rendered as $pull.
• CSHARP-6170 / CVE-2026-114651: Cross-document data leak via malformed BSON array parsing in reused thread buffer
• CSHARP-6174 / CVE-2026-114653: Silent client-side encryption bypass via unescaped field-name regex in CSFLE schema builder
  • Behavior change: the PatternProperty overload that takes a field expression is now obsolete; use Property to configure a specific field. Field names passed to PatternProperty are now matched both as literal field names and as regular expressions.
• CSHARP-6179 / CVE-2026-114643: Geometry override via duplicate-key BSON injection through GeoJSON extra members
  • Behavior change: GeoJSON serialization now throws BsonSerializationException when an extra member has the same name as a declared member.
• CSHARP-6180 / CVE-2026-114650: Plaintext exposure of encrypted fields via ANSI code-page corruption of database name
  • Behavior change: automatic encryption now passes the database name to libmongocrypt as UTF-8 instead of the Windows ANSI code page, so databases with non-ASCII names match schema map namespaces correctly.
• CSHARP-6181 / CVE-2026-114648: Query redirection via unvalidated string keys spliced into LINQ filter field paths
  • Behavior change: LINQ translation now throws NotSupportedException for dictionary keys, BsonDocument keys and Mql.Field names that the server would reinterpret: names containing ".", names starting with "$" at the start of a path, and positional operators.
• CSHARP-6184 / CVE-2026-114649: Authentication bypass via issuer-and-serial-only certificate equality in shared cluster cache
  • Behavior change: client certificate comparison in SslSettings, which decides whether clients share a cluster, now compares the full certificate (SHA-256 hash) and whether a private key is present, instead of only issuer and serial number.
• CSHARP-6186 / CVE-2026-114647: NoSQL operator injection via unvalidated replacement document in findOneAndReplace
  • Behavior change: FindOneAndReplace now throws ArgumentException when the first element name of the replacement document starts with $, consistent with ReplaceOne.

Improvements:

• CSHARP-5030: Only modify TCP buffer sizes if explicitly configured

Fixes:

• CSHARP-6237: LINQ Concat throws NullReferenceException when the second queryable has no pipeline stages
• CSHARP-6257: Fix WithTransaction not retrying TransientTransactionError when MongoClientSettings is created with its constructor
• CSHARP-6220: Prevent cancellation-token retention in pre-.NET 6 WaitAsync

Maintenance:

• CSHARP-6225: Latest server binary downloads require private S3
• CSHARP-6263: Fix incorrect XML doc summaries for PullAll and Pop update builders

The full list of issues resolved in this release is available at CSHARP JIRA project.

Documentation on the .NET driver can be found here.

3.12.0

This is the general availability release for the 3.12.0 version of the driver.

The main new features in 3.12.0 include:

• CSHARP-6214: Implement srvAllowedHostsSuffix URI option

Fixes:

• CSHARP-6223: Fix client-side projection crash on member-init projections

The full list of issues resolved in this release is available at CSHARP JIRA project.

Documentation on the .NET driver can be found here.

3.11.2

[!IMPORTANT]
This is a security patch release. It addresses two CVEs reported against the driver, along with a small number of related fixes. There are no public API changes and no application code changes are required to upgrade. Note that the shape of some queries generated by the LINQ provider and by GridFS has changed — see the individual tickets below.

This is a patch release that contains fixes and stability improvements:

• CSHARP-6177 / CVE-2026-88026: Query filter regex injection via unescaped backslash and bracket in LINQ character-set translation
• CSHARP-6190 / CVE-2026-88025: Use exact match for file ID in GridFS delete methods
• CSHARP-6213: Normalize SRV target host names to lower case during SRV polling

The full list of issues resolved in this release is available at CSHARP JIRA project.

Documentation on the .NET driver can be found here.

3.11.1

[!IMPORTANT]
This is a security patch release. It addresses a number of CVEs reported against the driver and does not include any functional changes or API modifications. Upgrading is recommended for all users; no code changes are required on the application side.

This is a patch release that contains fixes and stability improvements:

• CSHARP-6164 / CVE-2026-81530: KMS master key exposure via unredacted credential serialization in driver settings string
• CSHARP-6171 / CVE-2026-81529: Connection-option injection via unescaped settings in the canonical MongoDB URL builder
• CSHARP-6158 / CVE-2026-81528: NoSQL injection via array replacement bypassing update shape validation in driver write path
• CSHARP-6156 / CVE-2026-81527: NoSQL injection via unquoted constant GroupBy keys in LINQ pipeline translation
• CSHARP-6178 / CVE-2026-81527: NoSQL injection via equality-filter simplification of dollar-keyed documents in the LINQ provider
• CSHARP-6185 / CVE-2026-81527: NoSQL injection via unescaped dollar-prefixed values in LINQ constant arrays and documents

The full list of issues resolved in this release is available at CSHARP JIRA project.

Documentation on the .NET driver can be found here.

Commits viewable in compare view.

[SebHenn]

@dependabot rebase