FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

Bump pymongo from 4.6.3 to 4.18.2 in /python/ql/test/query-tests/Security/CWE-943-NoSqlInjection/PoC in the pip group across 1 directory by dependabot[bot] · Pull Request #22758 · github/codeql · GitHub

  1. github
  2. codeql

Repository navigation

Bump pymongo from 4.6.3 to 4.18.2 in /python/ql/test/query-tests/Security/CWE-943-NoSqlInjection/PoC in the pip group across 1 directory - #22758

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/python/ql/test/query-tests/Security/CWE-943-NoSqlInjection/PoC/pip-7c2b408a79
ConversationCommits (1)ChecksFindingsFiles changed
Open

Bump pymongo from 4.6.3 to 4.18.2 in /python/ql/test/query-tests/Security/CWE-943-NoSqlInjection/PoC in the pip group across 1 directory#22758
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/python/ql/test/query-tests/Security/CWE-943-NoSqlInjection/PoC/pip-7c2b408a79

Conversation

dependabot Bot commented on behalf of github Oct 6, 2026

Copy link
Copy Markdown
Contributor

Bumps the pip group with 1 update in the /python/ql/test/query-tests/Security/CWE-943-NoSqlInjection/PoC directory: pymongo.

Updates pymongo from 4.6.3 to 4.18.2

Release notes

Sourced from pymongo's releases.

PyMongo 4.18.2

Community notes: https://www.mongodb.com/community/forums/t/pymongo-4-18-2-released/343732

CVE-2026-96749 CVE-2026-96748 CVE-2026-96747

PyMongo 4.18.1

Community notes: https://www.mongodb.com/community/forums/t/pymongo-4-18-1-released/343338

PyMongo 4.18.0

Community notes: https://www.mongodb.com/community/forums/t/pymongo-4-18-released/343137

PyMongo 4.17.0

Community notes

What's Changed

... (truncated)

Changelog

Sourced from pymongo's changelog.

Changes in Version 4.18.2 (2026/09/24)

Version 4.18.2 is a bug fix release.

  • Hardened the bson buffer size guard against signed integer overflow. (CVE-2026-96749_).
  • Fixed connection string parsing to percent-decode each host individually. (CVE-2026-96748_).
  • Client-side field level encryption now rejects a KMS endpoint ending in .sock. (CVE-2026-96747_).

.. _CVE-2026-96749: https://www.cve.org/CVERecord?id=CVE-2026-96749 .. _CVE-2026-96748: https://www.cve.org/CVERecord?id=CVE-2026-96748 .. _CVE-2026-96747: https://www.cve.org/CVERecord?id=CVE-2026-96747

Issues Resolved ...............

See the PyMongo 4.18.2 release notes in JIRA_ for the list of resolved issues in this release.

.. _PyMongo 4.18.2 release notes in JIRA: https://jira.mongodb.org/secure/ReleaseNote.jspa?projectId=10004&version=52896

Changes in Version 4.18.1 (2026/09/10)

Version 4.18.1 is a bug fix release.

  • Use an exact match for the file ID in GridFS delete methods (CVE-2026-88029_).

.. _CVE-2026-88029: https://www.cve.org/CVERecord?id=CVE-2026-88029

Changes in Version 4.18.0 (2026/09/03)

PyMongo 4.18 brings a number of changes including:

  • Added srvAllowedHostsSuffix as a URI option and keyword argument to :class:~pymongo.synchronous.mongo_client.MongoClient and :class:~pymongo.asynchronous.mongo_client.AsyncMongoClient. When connecting via mongodb+srv://, this option overrides the default requirement that SRV-returned hosts share the same parent domain as the seed hostname, allowing hosts under a different domain suffix to be accepted. The suffix must not be a public suffix (per the Public Suffix List <https://publicsuffix.org/list/>_). See the :class:~pymongo.synchronous.mongo_client.MongoClient and :class:~pymongo.asynchronous.mongo_client.AsyncMongoClient documentation for security considerations.
  • Dropped support for MongoDB 4.2.
  • Added support for MongoDB 9.0.
  • PyPy support is deprecated and will be removed in a future release.

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bump pymongo
40f8083 
Bumps the pip group with 1 update in the /python/ql/test/query-tests/Security/CWE-943-NoSqlInjection/PoC directory: [pymongo](https://github.com/mongodb/mongo-python-driver).


Updates `pymongo` from 4.6.3 to 4.18.2
- [Release notes](https://github.com/mongodb/mongo-python-driver/releases)
- [Changelog](https://github.com/mongodb/mongo-python-driver/blob/main/doc/changelog.rst)
- [Commits](mongodb/mongo-python-driver@4.6.3...4.18.2)

---
updated-dependencies:
- dependency-name: pymongo
  dependency-version: 4.18.2
  dependency-type: direct:production
  dependency-group: pip
...

Signed-off-by: dependabot[bot] <support@github.com>
dependabot Bot added dependencies Pull requests that update a dependency file Python labels Oct 6, 2026
dependabot Bot requested a review from a team as a code owner October 6, 2026 09:47

This branch has not been deployed

No deployments
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Show hidden characters
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file Python

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants

Back | FazBrowse Home | New Git URL