The MongoDB Go Driver Team is pleased to release version 2.8.2 of the official MongoDB Go Driver.
Release Highlights
Warning
Driver versions v2.1.0 through v2.8.1 are affected by a security issue CVE-2026-81521 in Client.BulkWrite that is fixed in this release (v2.8.2). Users are encouraged to upgrade to this version as soon as possible.
This release addresses CVE-2026-81521, a security issue in calling Client.BulkWrite. A caller-controlled database name containing a period ('.') may be interpreted as a different namespace when forwarded to MongoDB. This could redirect operations to a database or collection other than the one intended by the application.
It also fixes a bug in Collection.BulkWrite where, for unordered bulk writes split across multiple batches, a write-concern error from an earlier batch could be non-deterministically silently dropped or replaced by subsequent batches. Now the operation will return the last non-nil writeConcern error, if one occured.
What's Changed
🐛 Fixed
- GODRIVER-4025 fix: Preserve the last non-nil WriteConcernError across bulk write batches by @zigzagdev in #2555
- GODRIVER-4075 Return an error if there are invalid characters in the database name for bulkWrite. by @matthewdale
Full Changelog: v2.8.1...v2.8.2
For a full list of tickets included in this release, please see the list of fixed issues.
Documentation for the Go Driver can be found on pkg.go.dev and the MongoDB documentation site. BSON library documentation is also available on pkg.go.dev. For issues with, questions about, or feedback for the Go Driver, please look into our support channels, including StackOverflow. Bugs can be reported in the Go Driver project in the MongoDB JIRA where a list of current issues can be found. Your feedback on the Go Driver is greatly appreciated!