chore(deps): bump go.mongodb.org/mongo-driver/v2 from 2.9.0 to 2.9.1

[dependabot]

Bumps go.mongodb.org/mongo-driver/v2 from 2.9.0 to 2.9.1.

Release notes

Sourced from go.mongodb.org/mongo-driver/v2's releases.

MongoDB Go Driver 2.9.1

The MongoDB Go Driver Team is pleased to release version 2.9.1 of the official MongoDB Go Driver.

Release Highlights

[!WARNING]
Go Driver versions v1.0.0 through v1.17.9 and v2.0.0 through v2.9.0 are affected by a security issue CVE-2026-88031 in the GridFS delete methods. This release resolves that security issue in Go Driver v2. Users are encouraged to upgrade to Go Driver v2.9.1 as soon as possible. For the fix in Go Driver v1, see the v1.17.10 release.

This release addresses CVE-2026-88031, a security issue in GridFS delete methods where the file ID lookup could match more loosely than intended, potentially causing unintended file (and chunk) deletions instead of an exact match on the given file ID.

Users can manually restrict the file ID with a $eq operator before passing it to GridFSBucket methods using code like the following.

func exactMatch(id any) bson.D {
	return bson.D{{"$eq", id}}
}
// e.g., for v2, (*GridFSBucket).Delete() with an exact match on the file ID.
gridFSBucket.Delete(context.TODO(), exactMatch(id))

What's Changed

🐛 Fixed

• GODRIVER-4081: Use exact match for file ID in GridFS delete methods. by @​qingyang-hu

Full Changelog: v2.9.0...v2.9.1

For a full list of tickets included in this release, please see the list of fixed issues.

Documentation for the Go Driver can be found on pkg.go.dev and the MongoDB documentation site. BSON library documentation is also available on pkg.go.dev. For issues with, questions about, or feedback for the Go Driver, please look into our support channels, including StackOverflow. Bugs can be reported in the Go Driver project in the MongoDB JIRA where a list of current issues can be found. Your feedback on the Go Driver is greatly appreciated!

Commits

• 5d8c3a2 BUMP v2.9.1
• ba2ddbf Merge commit from fork
• 9a88e59 Merge branch 'release/2.9' into godriver4081-gridFsId
• 0241bcf update prose test
• 81d1fde GODRIVER-4081 Use exact match for file ID in GridFS delete methods.
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: f1bee727-f16a-4ab4-a93b-deecb6f0c0af

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	go.mongodb.org/​mongo-driver/​v2@​v2.9.0 ⏵ v2.9.1	+1

View full report

[lerian-studio]

🔒 Security Scan Results — lib-streaming

✅ PR Mergeable — no blocking findings

Stage	Status	Blocking?
Filesystem Scan	✅ Clean	—
Docker Image Scan	➖ Skipped	—
Docker Hub Health Score	➖ Skipped	—
Pre-release Version Check	✅ Clean	—

Trivy

Filesystem Scan

✅ No vulnerabilities or secrets found.

---

Pre-release Version Check

✅ No unstable version pins found.

---

_{🔍 View full scan logs}

[github-actions]

🔍 PR Validation Summary

🚫 PR Blocked — 2 blocking failures

Check	Status	Blocking
Source Branch	❌ failure	yes
PR Title	✅ success	yes
PR Description	✅ success	yes
Breaking Change Guard	✅ success	yes
Blocking Checks Runtime	❌ failure	yes
Commit Signatures	✅ success	yes
PR Size	⏭️ skipped	no
Auto Labels	⏭️ skipped	no
PR Metadata	⏭️ skipped	no

Fix the blocking checks above before merge.

---

_{🔍 View workflow run}

[github-actions]

⚠️ Invalid Source Branch

Pull requests to main can only come from:

• develop
• release-candidate
• hotfix/*

Your source branch: dependabot/go_modules/develop/go.mongodb.org/mongo-driver/v2-2.9.1

Please change the base branch or create a PR from an allowed branch.