[dependabot]

Bumps go.mongodb.org/mongo-driver from 1.17.3 to 1.17.7.

Release notes

Sourced from go.mongodb.org/mongo-driver's releases.

MongoDB Go Driver 1.17.7

The MongoDB Go Driver Team is pleased to release version 1.17.7 of the official MongoDB Go Driver.

Release Highlights

This release removes the deprecation notice from options.MergeClientOptions and fixes buffer handling in GSSAPI error description and username functions.

What's Changed

🐛 Fixed

• GODRIVER-3770 Fix buffer handling in GSSAPI error description and username functions by @​prestonvasquez in mongodb/mongo-go-driver#2291

📝 Other Changes

• Add more visible deprecation banner to the 1.17 readme by @​alcaeus in mongodb/mongo-go-driver#2233
• GODRIVER-3770 Remove libasan from gssapi tests in CI by @​prestonvasquez in mongodb/mongo-go-driver#2293
• GODRIVER-3766 Remove deprecation notice for MergeClientOptions by @​tadjik1 in mongodb/mongo-go-driver#2294

Full Changelog: mongodb/mongo-go-driver@v1.17.6...v1.17.7

For a full list of tickets included in this release, please see the list of fixed issues.

Documentation for the Go Driver can be found on pkg.go.dev and the MongoDB documentation site. BSON library documentation is also available on pkg.go.dev. Questions and inquiries can be asked on the MongoDB Developer Community. Bugs can be reported in the Go Driver project in the MongoDB JIRA where a list of current issues can be found. Your feedback on the Go Driver is greatly appreciated!

MongoDB Go Driver 1.17.6

The MongoDB Go Driver Team is pleased to release version 1.17.6 of the official MongoDB Go Driver.

[!NOTE] Due to a bug in the Go Driver release automation, there is no 1.17.5 release.

Release Highlights

This release makes various maintainability improvements to the Go Driver development and release automation.

What's Changed

📝 Other Changes

• GODRIVER-3560 Use lambda-specific arn for FaaS by @​prestonvasquez in mongodb/mongo-go-driver#2093
• Use a pinned Go version for golangci-lint. by @​matthewdale in mongodb/mongo-go-driver#2151
• Disable merge-up from release/1.17 by @​alcaeus in mongodb/mongo-go-driver#2202

Full Changelog: mongodb/mongo-go-driver@v1.17.4...v1.17.6

For a full list of tickets included in this release, please see the list of fixed issues.

Documentation for the Go Driver can be found on pkg.go.dev and the MongoDB documentation site. BSON library documentation is also available on pkg.go.dev. For issues with, questions about, or feedback for the Go Driver, please look into our support channels, including StackOverflow. Bugs can be reported in the Go Driver project in the MongoDB JIRA where a list of current issues can be found. Your feedback on the Go Driver is greatly appreciated!

MongoDB Go Driver 1.17.4

... (truncated)

Commits

• eb01e7e BUMP v1.17.7
• 3c55093 GODRIVER-3766 Remove deprecation notice for MergeClientOptions (#2294)
• f6163bf GODRIVER-3770 Remove libasan from gssapi tests in CI (#2293)
• 6798963 GODRIVER-3770 Fix buffer handling in GSSAPI error description and username fu...
• c1e9575 Add more visible deprecation banner to the 1.17 readme (#2233)
• d2fa0ab BUMP v1.17.6
• f1d540b BUMP v1.17.5
• b879028 GODRIVER-3654 Don't test v1 branches against latest server. (#2188)
• 21f47d4 Allow ignore-for-release label to satisfy label checker (#2203)
• 8708ca8 Disable merge-up from release/1.17 (#2202)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

Summary by CodeRabbit

• Chores
  • Updated MongoDB driver dependency to the latest patch version for improved stability and bug fixes.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 62519a55-dd00-4c92-9ef2-3cb0ebe43786

📥 Commits

Reviewing files that changed from the base of the PR and between 18bacf8 and 93bdb84.

⛔ Files ignored due to path filters (3)

• go.sum is excluded by !**/*.sum
• vendor/go.mongodb.org/mongo-driver/bson/bsonrw/extjson_writer.go is excluded by !vendor/**, !**/vendor/**
• vendor/modules.txt is excluded by !vendor/**, !**/vendor/**

📒 Files selected for processing (1)

• go.mod

---

📝 Walkthrough

Walkthrough

The indirect dependency go.mongodb.org/mongo-driver in go.mod is bumped from v1.17.3 to v1.17.7. No other dependency versions, module directives, or replacement entries are changed.

🚥 Pre-merge checks | ✅ 11

✅ Passed checks (11 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main change: bumping the go.mongodb.org/mongo-driver dependency from 1.17.3 to 1.17.7, which is the sole change in this pull request.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	No dynamic test names found in Ginkgo tests. Comprehensive search for fmt.Sprintf, string concatenation, variable interpolation, and UUID/timestamp/pod/namespace patterns in test titles yielded zer...
Test Structure And Quality	✅ Passed	The PR updates go.mongodb.org/mongo-driver dependency and adds test files using standard Go testing framework with Gomega assertions, not Ginkgo BDD tests. The custom check specifically targets Gin...
Topology-Aware Scheduling Compatibility	✅ Passed	PR only updates go.mongodb.org/mongo-driver dependency version in go.mod. No deployment manifests, operator code, or controllers were added or modified, so topology-aware scheduling check does not...
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PR only bumps go.mongodb.org/mongo-driver dependency in go.mod; no new Ginkgo e2e tests are added. Check is not applicable.
No-Weak-Crypto	✅ Passed	PR only bumps indirect mongo-driver dependency; no weak crypto (MD5, SHA1, DES, RC4, ECB) introduced. Pre-existing weak crypto usage is unmodified.
Container-Privileges	✅ Passed	PR only modifies go.mod/go.sum (Go dependency bump); no container/K8s manifests with privileged settings were added or modified.
No-Sensitive-Data-In-Logs	✅ Passed	PR only bumps mongo-driver dependency (v1.17.3→v1.17.7). No logging code added; changes in mongo-driver fix CVE-2026-2303 memory safety, not logging. No sensitive data logging introduced.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dependabot/go_modules/go.mongodb.org/mongo-driver-1.17.7

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[openshift-ci]

Hi @dependabot[bot]. Thanks for your PR.

I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: dependabot[bot]
Once this PR has been reviewed and has the lgtm label, please assign jparrill for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

@dependabot[bot]: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[bryan-cox]

/close

Fixed in #8784

[openshift-ci]

@bryan-cox: Closed this PR.

Details

In response to this:

/close

Fixed in #8784

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.