Patch Release for CVE Fixes (CVE-2026-88031) #4849
mike-weiner
started this conversation in
General
Replies: 3 comments 2 replies
|
It looks like the following can be done in any projects that you have that might be using |
2 replies
|
We don't want to update indirect dependencies because it may break existing behavior in ways that are hard to detect and test. |
|
@I065450 - Agree. Not ideal, but it could be an option for folks that require a CVE fix faster. |
|
we wait for this fix as well |
0 replies
|
fyi - I've opened #4870 to try and get this dependency bumped up to a fixed version. |
0 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
Is there any regular cadence or release schedule that is available for when CVEs might be fixed?
CVE-2026-88031 can now be fixed by pulling in https://github.com/mongodb/mongo-go-driver/releases/tag/v2.9.1.
Is there any planned patch release to get this CVE fix pulled in?
All reactions