From 47e29863a7bc3e8e598e938c05aee5c3702ebc42 Mon Sep 17 00:00:00 2001
From: rasika-chivate <95711051+rasika-chivate@users.noreply.github.com>
Date: Mon, 22 Jun 2026 13:22:36 +0530
Subject: [PATCH 01/24] RN-6.0.29-23
---
docs/release_notes/6.0.29-23.md | 68 +++++++++++++++++++++++++++++++++
1 file changed, 68 insertions(+)
create mode 100644 docs/release_notes/6.0.29-23.md
diff --git a/docs/release_notes/6.0.29-23.md b/docs/release_notes/6.0.29-23.md
new file mode 100644
index 000000000..c2d76454d
--- /dev/null
+++ b/docs/release_notes/6.0.29-23.md
@@ -0,0 +1,68 @@
+---
+version: 6.0.29-23
+---
+
+# Percona Server for MongoDB {{ page.meta.version }} ({{date.6_0_29}})
+
+[Installation](../install/index.md){.md-button}
+[Upgrade from MongoDB Community](../install/upgrade-from-mongodb.md){.md-button}
+
+Percona Server for MongoDB {{ page.meta.version }} is an enhanced, source-available, and highly-scalable database that is a fully-compatible, drop-in replacement for MongoDB Community Edition.
+
+Percona Server for MongoDB **{{ page.meta.version }}** includes the improvements and bug fixes of:
+
+- [MongoDB 7.0.37, 7.0.36, and 7.0.35 Community Edition :octicons-link-external-16:](https://www.mongodb.com/docs/manual/release-notes/7.0/#7.0.37---june-11--2026){:target="_blank"}
+
+- Supports protocols and drivers of MongoDB Community **7.0.37**.
+
+## Upgrade recommendation
+
+This release contains multiple high-severity security fixes affecting all Percona Server for MongoDB 7.0.x versions. We strongly recommend upgrading to version {{ page.meta.version }} as soon as possible.
+
+## Improvements
+
+- [PSMDB-2038](https://perconadev.atlassian.net/browse/PSMDB-2038): Percona Server for MongoDB now exposes LDAP `userToDN` cache statistics through the serverStatus command. These metrics provide visibility into cache utilization and effectiveness, helping administrators troubleshoot LDAP authentication latency, validate cache behavior after configuration changes, and optimize cache sizing for their workloads. The new `ldap.userToDNCache` section reports runtime information such as cache usage, hits, misses, and invalidations, making LDAP authentication performance easier to monitor and tune.
+
+## Security updates: CVE fixes from upstream MongoDB
+
+### Affected versions
+
+These vulnerabilities affect the following versions:
+
+- All Percona Server for MongoDB 7.0.x versions
+
+### High severity
+
+- [SERVER-128125 :octicons-link-external-16:](https://jira.mongodb.org/browse/SERVER-128125){:target="_blank"} **(CVE-2026-11933):** A **use-after-free** vulnerability was identified in MongoDB Server’s server-side JavaScript engine when converting `BSON` documents to JavaScript arrays. An authenticated user with read privileges who can execute server-side JavaScript (e.g., via `$where` or `$function`) may trigger access to freed memory, which could result in information disclosure from the `mongod` process memory or a denial of service through a server crash.
+
+- [SERVER-125063 :octicons-link-external-16:](https://jira.mongodb.org/browse/SERVER-125063){:target="_blank"} **(CVE-2026-9740):** A vulnerability in the `BSON` validator allows an unauthenticated user to supply specially crafted input that could cause the `mongod` process to terminate unexpectedly, resulting in a denial-of-service condition.
+
+- [SERVER-124959 :octicons-link-external-16:](https://jira.mongodb.org/browse/SERVER-124959){:target="_blank"} **(CVE-2026-9753):** A vulnerability in the `$_internalApplyOplogUpdate` aggregation stage allows an authenticated user to supply specially crafted input that could cause the server process to terminate unexpectedly.
+
+- [SERVER-123440 :octicons-link-external-16:](https://jira.mongodb.org/browse/SERVER-123440){:target="_blank"} **(CVE-2026-9752):** Inserting specially crafted documents into a collection with a `2dsphere` index could cause the `mongod` process to terminate unexpectedly, leading to a server crash.
+
+- [SERVER-123633 :octicons-link-external-16:](https://jira.mongodb.org/browse/SERVER-123633){:target="_blank"} **(CVE-2026-9750):** A vulnerability in query execution allows an authenticated user to create specially crafted documents that interfere with internal metadata processing. This can cause the server process to terminate unexpectedly and may result in incorrect query results.
+
+- [SERVER-124031 :octicons-link-external-16:](https://jira.mongodb.org/browse/SERVER-124031){:target="_blank"} **(CVE-2026-9749):** Aggregation pipelines that use the internal `$exchange` stage with key-range partitioning can trigger an unexpected condition when processing large numbers of documents for a single key range. This can cause the server process to terminate unexpectedly.
+
+- [SERVER-123951 :octicons-link-external-16:](https://jira.mongodb.org/browse/SERVER-123951){:target="_blank"} **(CVE-2026-9748):** Under specific conditions, using the internal `$_internalConvertBucketIndexStats` stage together with `$facet` can cause the `mongod` process to terminate unexpectedly.
+
+- [SERVER-123918 :octicons-link-external-16:](https://jira.mongodb.org/browse/SERVER-123918){:target="_blank"} **(CVE-2026-9747):** A vulnerability triggered by using `fromRouter: true` together with `runtimeConstants.userRoles` can cause the `mongod` process to terminate unexpectedly.
+
+- [SERVER-124190 :octicons-link-external-16:](https://jira.mongodb.org/browse/SERVER-124190){:target="_blank"} **(CVE-2026-9746):** A vulnerability in the use of `$changeStream`, `$_requestReshardingResumeToken`, and the exchange option can cause the `mongod` process to terminate unexpectedly. An authenticated user can trigger this behavior without requiring any special privileges.
+
+### Medium severity
+
+- [SERVER-123370 :octicons-link-external-16:](https://jira.mongodb.org/browse/SERVER-123370){:target="_blank"} **(CVE-2026-9751):** When the `ldapQueryPassword` parameter is set using the runtime `setParameter` command, the new password value is written to `mongod.log` in plain text. This can expose sensitive credentials in log files.
+
+## Bugs fixed
+
+- [PSMDB-1977](https://perconadev.atlassian.net/browse/PSMDB-1977): Resolved an issue where Docker-based MongoDB instances could fail to start when replication settings were defined in `mongod.conf`.
+
+## Tools packaged with this release
+
+Percona Server for MongoDB packages the following MongoDB tools:
+
+- MongoDB Shell (mongosh): 2.8.3 — [upstream release notes :octicons-link-external-16:](https://www.mongodb.com/docs/mongodb-shell/changelog/#v2.8.3){:target="_blank"}
+
+- MongoDB Database Tools: 100.17.0 — [upstream release notes :octicons-link-external-16:](https://www.mongodb.com/docs/database-tools/release-notes/dbtools-100.17.0-changelog/){:target="_blank"}
From 8b3e6a250ee17beb99d5e35c47a7a5a4e0cffa64 Mon Sep 17 00:00:00 2001
From: rasika-chivate <95711051+rasika-chivate@users.noreply.github.com>
Date: Mon, 22 Jun 2026 13:26:35 +0530
Subject: [PATCH 02/24] Update 6.0.29-23.md
---
docs/release_notes/6.0.29-23.md | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
diff --git a/docs/release_notes/6.0.29-23.md b/docs/release_notes/6.0.29-23.md
index c2d76454d..e17158ad4 100644
--- a/docs/release_notes/6.0.29-23.md
+++ b/docs/release_notes/6.0.29-23.md
@@ -11,9 +11,7 @@ Percona Server for MongoDB {{ page.meta.version }} is an enhanced, source-availa
Percona Server for MongoDB **{{ page.meta.version }}** includes the improvements and bug fixes of:
-- [MongoDB 7.0.37, 7.0.36, and 7.0.35 Community Edition :octicons-link-external-16:](https://www.mongodb.com/docs/manual/release-notes/7.0/#7.0.37---june-11--2026){:target="_blank"}
-
-- Supports protocols and drivers of MongoDB Community **7.0.37**.
+- Supports protocols and drivers of MongoDB Community **6.0.29**.
## Upgrade recommendation
@@ -29,7 +27,7 @@ This release contains multiple high-severity security fixes affecting all Percon
These vulnerabilities affect the following versions:
-- All Percona Server for MongoDB 7.0.x versions
+- All Percona Server for MongoDB 6.0.x versions
### High severity
From 6fd9a2483503aac84e0f03dffc9b3e4406ca2ebd Mon Sep 17 00:00:00 2001
From: Rasika Chivate <95711051+rasika-chivate@users.noreply.github.com>
Date: Mon, 22 Jun 2026 13:31:48 +0530
Subject: [PATCH 03/24] Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---
docs/release_notes/6.0.29-23.md | 1 -
1 file changed, 1 deletion(-)
diff --git a/docs/release_notes/6.0.29-23.md b/docs/release_notes/6.0.29-23.md
index e17158ad4..88e136a43 100644
--- a/docs/release_notes/6.0.29-23.md
+++ b/docs/release_notes/6.0.29-23.md
@@ -1,4 +1,3 @@
----
version: 6.0.29-23
---
From 07e3f636520b9b79de1430b36a78036ed94a9888 Mon Sep 17 00:00:00 2001
From: Rasika Chivate <95711051+rasika-chivate@users.noreply.github.com>
Date: Mon, 22 Jun 2026 13:32:10 +0530
Subject: [PATCH 04/24] Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---
docs/release_notes/6.0.29-23.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/docs/release_notes/6.0.29-23.md b/docs/release_notes/6.0.29-23.md
index 88e136a43..1c5f381b3 100644
--- a/docs/release_notes/6.0.29-23.md
+++ b/docs/release_notes/6.0.29-23.md
@@ -14,7 +14,7 @@ Percona Server for MongoDB **{{ page.meta.version }}** includes the improvements
## Upgrade recommendation
-This release contains multiple high-severity security fixes affecting all Percona Server for MongoDB 7.0.x versions. We strongly recommend upgrading to version {{ page.meta.version }} as soon as possible.
+This release contains multiple high-severity security fixes affecting all Percona Server for MongoDB 6.0.x versions. We strongly recommend upgrading to version {{ page.meta.version }} as soon as possible.
## Improvements
From 8e1899aa16787c9b665917ee9ffcab14db45cd7a Mon Sep 17 00:00:00 2001
From: Rasika Chivate <95711051+rasika-chivate@users.noreply.github.com>
Date: Mon, 22 Jun 2026 13:32:37 +0530
Subject: [PATCH 05/24] Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---
docs/release_notes/6.0.29-23.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/docs/release_notes/6.0.29-23.md b/docs/release_notes/6.0.29-23.md
index 1c5f381b3..7223d37f6 100644
--- a/docs/release_notes/6.0.29-23.md
+++ b/docs/release_notes/6.0.29-23.md
@@ -18,7 +18,7 @@ This release contains multiple high-severity security fixes affecting all Percon
## Improvements
-- [PSMDB-2038](https://perconadev.atlassian.net/browse/PSMDB-2038): Percona Server for MongoDB now exposes LDAP `userToDN` cache statistics through the serverStatus command. These metrics provide visibility into cache utilization and effectiveness, helping administrators troubleshoot LDAP authentication latency, validate cache behavior after configuration changes, and optimize cache sizing for their workloads. The new `ldap.userToDNCache` section reports runtime information such as cache usage, hits, misses, and invalidations, making LDAP authentication performance easier to monitor and tune.
+- [PSMDB-2038](https://perconadev.atlassian.net/browse/PSMDB-2038): Percona Server for MongoDB now exposes LDAP `userToDN` cache statistics through the `serverStatus` command. These metrics provide visibility into cache utilization and effectiveness, helping administrators troubleshoot LDAP authentication latency, validate cache behavior after configuration changes, and optimize cache sizing for their workloads. The new `ldap.userToDNCache` section reports runtime information such as cache usage, hits, misses, and invalidations, making LDAP authentication performance easier to monitor and tune.
## Security updates: CVE fixes from upstream MongoDB
From 87ebea8cee75a9bcf4dcf548924650cf0dd41fad Mon Sep 17 00:00:00 2001
From: Rasika Chivate <95711051+rasika-chivate@users.noreply.github.com>
Date: Mon, 22 Jun 2026 13:32:55 +0530
Subject: [PATCH 06/24] Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---
docs/release_notes/6.0.29-23.md | 9 ++++-----
1 file changed, 4 insertions(+), 5 deletions(-)
diff --git a/docs/release_notes/6.0.29-23.md b/docs/release_notes/6.0.29-23.md
index 7223d37f6..6ddf57847 100644
--- a/docs/release_notes/6.0.29-23.md
+++ b/docs/release_notes/6.0.29-23.md
@@ -58,8 +58,7 @@ These vulnerabilities affect the following versions:
## Tools packaged with this release
-Percona Server for MongoDB packages the following MongoDB tools:
-
-- MongoDB Shell (mongosh): 2.8.3 — [upstream release notes :octicons-link-external-16:](https://www.mongodb.com/docs/mongodb-shell/changelog/#v2.8.3){:target="_blank"}
-
-- MongoDB Database Tools: 100.17.0 — [upstream release notes :octicons-link-external-16:](https://www.mongodb.com/docs/database-tools/release-notes/dbtools-100.17.0-changelog/){:target="_blank"}
+| **Tool** | **Version** | **Release notes** |
+|---|---|---|
+| MongoDB Shell (`mongosh`) | 2.8.3 | [upstream release notes :octicons-link-external-16:](https://www.mongodb.com/docs/mongodb-shell/changelog/#v2.8.3){:target="_blank"} |
+| Mongo Tools | 100.17.0 | [upstream release notes :octicons-link-external-16:](https://www.mongodb.com/docs/database-tools/release-notes/dbtools-100.17.0-changelog/){:target="_blank"} |
From a209a13404f4d951e444bf494e04e2c5bd7671ea Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 22 Jun 2026 08:04:33 +0000
Subject: [PATCH 07/24] Add 6.0.29 release metadata references
---
docs/release_notes/index.md | 2 ++
variables.yml | 3 ++-
2 files changed, 4 insertions(+), 1 deletion(-)
diff --git a/docs/release_notes/index.md b/docs/release_notes/index.md
index 229e8cd71..9f11236de 100644
--- a/docs/release_notes/index.md
+++ b/docs/release_notes/index.md
@@ -1,5 +1,7 @@
# Percona Server for MongoDB 6.0 Release Notes
+* [Percona Server for MongoDB 6.0.29-23 ({{date.6_0_29}})](6.0.29-23.md)
+
* [Percona Server for MongoDB 6.0.28-22 ({{date.6_0_28}})](6.0.28-22.md)
* [Percona Server for MongoDB 6.0.27-21 ({{date.6_0_27}})](6.0.27-21.md)
diff --git a/variables.yml b/variables.yml
index 3e4e7ea24..88d4dcedf 100644
--- a/variables.yml
+++ b/variables.yml
@@ -1,7 +1,7 @@
# PBM Variables set for HTML output
# See also mkdocs.yml plugins.with-pdf.cover_subtitle and output_path
-release: '6.0.28-22'
+release: '6.0.29-23'
version: '6.0'
mongosh: '2.8.3'
@@ -9,6 +9,7 @@ product:
psmdb_full_name: Percona Server for MongoDB
date:
+ 6_0_29: '2026-06-18'
6_0_28: '2026-05-26'
6_0_27: '2026-01-12'
6_0_25: '2025-07-30'
From 75353dfecb1e43c513ad7b694058bb91fa6d81ae Mon Sep 17 00:00:00 2001
From: rasika-chivate <95711051+rasika-chivate@users.noreply.github.com>
Date: Mon, 22 Jun 2026 13:36:20 +0530
Subject: [PATCH 08/24] Update variables.yml
---
variables.yml | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/variables.yml b/variables.yml
index 88d4dcedf..f86fe0b1c 100644
--- a/variables.yml
+++ b/variables.yml
@@ -1,7 +1,11 @@
# PBM Variables set for HTML output
# See also mkdocs.yml plugins.with-pdf.cover_subtitle and output_path
+<<<<<<< Updated upstream
release: '6.0.29-23'
+=======
+release: '6.0.28-23'
+>>>>>>> Stashed changes
version: '6.0'
mongosh: '2.8.3'
From 685722d697d51d1f1fe6fc400be8c413313d357b Mon Sep 17 00:00:00 2001
From: rasika-chivate <95711051+rasika-chivate@users.noreply.github.com>
Date: Mon, 22 Jun 2026 13:38:12 +0530
Subject: [PATCH 09/24] updated config files and date
---
docs/_templates/pdf_cover_page.tpl | 4 ++--
variables.yml | 6 +-----
2 files changed, 3 insertions(+), 7 deletions(-)
diff --git a/docs/_templates/pdf_cover_page.tpl b/docs/_templates/pdf_cover_page.tpl
index ed944a90b..2c7aeefa8 100644
--- a/docs/_templates/pdf_cover_page.tpl
+++ b/docs/_templates/pdf_cover_page.tpl
@@ -3,11 +3,11 @@
-Server for MongoDB 6.0.28-22
+Server for MongoDB 6.0.29-23
{% if config.site_description %}
{{ config.site_description }}
{% endif %}
-6.0.28-22 (May 26, 2026)
+6.0.29-23 (June 24, 2026)
diff --git a/variables.yml b/variables.yml
index f86fe0b1c..1431f5d73 100644
--- a/variables.yml
+++ b/variables.yml
@@ -1,11 +1,7 @@
# PBM Variables set for HTML output
# See also mkdocs.yml plugins.with-pdf.cover_subtitle and output_path
-<<<<<<< Updated upstream
release: '6.0.29-23'
-=======
-release: '6.0.28-23'
->>>>>>> Stashed changes
version: '6.0'
mongosh: '2.8.3'
@@ -13,7 +9,7 @@ product:
psmdb_full_name: Percona Server for MongoDB
date:
- 6_0_29: '2026-06-18'
+ 6_0_29: '2026-06-24'
6_0_28: '2026-05-26'
6_0_27: '2026-01-12'
6_0_25: '2025-07-30'
From d7c1ea70b115ff2f576746c4945119f4c46415e1 Mon Sep 17 00:00:00 2001
From: Rasika Chivate <95711051+rasika-chivate@users.noreply.github.com>
Date: Mon, 22 Jun 2026 16:56:10 +0530
Subject: [PATCH 10/24] Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---
docs/release_notes/6.0.29-23.md | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/docs/release_notes/6.0.29-23.md b/docs/release_notes/6.0.29-23.md
index 6ddf57847..aa167c349 100644
--- a/docs/release_notes/6.0.29-23.md
+++ b/docs/release_notes/6.0.29-23.md
@@ -8,7 +8,9 @@ version: 6.0.29-23
Percona Server for MongoDB {{ page.meta.version }} is an enhanced, source-available, and highly-scalable database that is a fully-compatible, drop-in replacement for MongoDB Community Edition.
-Percona Server for MongoDB **{{ page.meta.version }}** includes the improvements and bug fixes of:
+Percona Server for MongoDB **{{ page.meta.version }}** includes the following updates from:
+
+- MongoDB 6.0.29 Community Edition
- Supports protocols and drivers of MongoDB Community **6.0.29**.
From 7921b950db746f0343b2a0ae69c3b227f71d89fd Mon Sep 17 00:00:00 2001
From: rasika-chivate <95711051+rasika-chivate@users.noreply.github.com>
Date: Tue, 23 Jun 2026 10:26:45 +0530
Subject: [PATCH 11/24] Update 6.0.29-23.md
---
docs/release_notes/6.0.29-23.md | 9 +--------
1 file changed, 1 insertion(+), 8 deletions(-)
diff --git a/docs/release_notes/6.0.29-23.md b/docs/release_notes/6.0.29-23.md
index aa167c349..3be94d55f 100644
--- a/docs/release_notes/6.0.29-23.md
+++ b/docs/release_notes/6.0.29-23.md
@@ -18,11 +18,8 @@ Percona Server for MongoDB **{{ page.meta.version }}** includes the following up
This release contains multiple high-severity security fixes affecting all Percona Server for MongoDB 6.0.x versions. We strongly recommend upgrading to version {{ page.meta.version }} as soon as possible.
-## Improvements
-- [PSMDB-2038](https://perconadev.atlassian.net/browse/PSMDB-2038): Percona Server for MongoDB now exposes LDAP `userToDN` cache statistics through the `serverStatus` command. These metrics provide visibility into cache utilization and effectiveness, helping administrators troubleshoot LDAP authentication latency, validate cache behavior after configuration changes, and optimize cache sizing for their workloads. The new `ldap.userToDNCache` section reports runtime information such as cache usage, hits, misses, and invalidations, making LDAP authentication performance easier to monitor and tune.
-
-## Security updates: CVE fixes from upstream MongoDB
+## Security updates
### Affected versions
@@ -54,10 +51,6 @@ These vulnerabilities affect the following versions:
- [SERVER-123370 :octicons-link-external-16:](https://jira.mongodb.org/browse/SERVER-123370){:target="_blank"} **(CVE-2026-9751):** When the `ldapQueryPassword` parameter is set using the runtime `setParameter` command, the new password value is written to `mongod.log` in plain text. This can expose sensitive credentials in log files.
-## Bugs fixed
-
-- [PSMDB-1977](https://perconadev.atlassian.net/browse/PSMDB-1977): Resolved an issue where Docker-based MongoDB instances could fail to start when replication settings were defined in `mongod.conf`.
-
## Tools packaged with this release
| **Tool** | **Version** | **Release notes** |
From c212eba9ced4fc2a3c30c9bdc8d9b9ac760e54ac Mon Sep 17 00:00:00 2001
From: rasika-chivate <95711051+rasika-chivate@users.noreply.github.com>
Date: Tue, 23 Jun 2026 10:33:31 +0530
Subject: [PATCH 12/24] Update 6.0.29-23.md
---
docs/release_notes/6.0.29-23.md | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/docs/release_notes/6.0.29-23.md b/docs/release_notes/6.0.29-23.md
index 3be94d55f..4e7e85a73 100644
--- a/docs/release_notes/6.0.29-23.md
+++ b/docs/release_notes/6.0.29-23.md
@@ -49,7 +49,9 @@ These vulnerabilities affect the following versions:
### Medium severity
-- [SERVER-123370 :octicons-link-external-16:](https://jira.mongodb.org/browse/SERVER-123370){:target="_blank"} **(CVE-2026-9751):** When the `ldapQueryPassword` parameter is set using the runtime `setParameter` command, the new password value is written to `mongod.log` in plain text. This can expose sensitive credentials in log files.
+- [SERVER-123370 :octicons-link-external-16:](https://jira.mongodb.org/browse/SERVER-123370){:target="_blank"} **(CVE-2026-9751):** Percona Server for MongoDB no longer logs sensitive parameter values when they are modified using the runtime `setParameter` command. Previously, parameters such as `ldapQueryPassword` could be written to `mongod.log` in plain text, potentially exposing credentials.
+
+ This applies to all `setParameter` operations. Parameters marked as sensitive are automatically redacted from log output, and values associated with unrecognized parameter names are also redacted to prevent accidental exposure caused by typographical errors.
## Tools packaged with this release
From 520cab2f87d094b60aa7a80f04c7a1dd941b4c54 Mon Sep 17 00:00:00 2001
From: rasika-chivate <95711051+rasika-chivate@users.noreply.github.com>
Date: Tue, 23 Jun 2026 10:40:51 +0530
Subject: [PATCH 13/24] Update mkdocs-base.yml
---
mkdocs-base.yml | 1 +
1 file changed, 1 insertion(+)
diff --git a/mkdocs-base.yml b/mkdocs-base.yml
index 3a816ba25..d98e23173 100644
--- a/mkdocs-base.yml
+++ b/mkdocs-base.yml
@@ -228,6 +228,7 @@ nav:
- install/uninstall.md
- Release notes:
- "Release notes index": "release_notes/index.md"
+ - release_notes/6.0.29-23.md
- release_notes/6.0.28-22.md
- release_notes/6.0.27-21.md
- release_notes/6.0.25-20.md
From 87551fdcbe66069854cfd2ec70a855de1098ecc0 Mon Sep 17 00:00:00 2001
From: rasika-chivate <95711051+rasika-chivate@users.noreply.github.com>
Date: Tue, 23 Jun 2026 14:55:37 +0530
Subject: [PATCH 14/24] Update 6.0.29-23.md
---
docs/release_notes/6.0.29-23.md | 26 ++------------------------
1 file changed, 2 insertions(+), 24 deletions(-)
diff --git a/docs/release_notes/6.0.29-23.md b/docs/release_notes/6.0.29-23.md
index 4e7e85a73..3d848fb67 100644
--- a/docs/release_notes/6.0.29-23.md
+++ b/docs/release_notes/6.0.29-23.md
@@ -10,13 +10,13 @@ Percona Server for MongoDB {{ page.meta.version }} is an enhanced, source-availa
Percona Server for MongoDB **{{ page.meta.version }}** includes the following updates from:
-- MongoDB 6.0.29 Community Edition
+- [MongoDB 6.0.29 Community Edition :octicons-link-external-16:](https://www.mongodb.com/docs/v6.0/release-notes/6.0-changelog/#6.0.29-changelog){:target="_blank"}
- Supports protocols and drivers of MongoDB Community **6.0.29**.
## Upgrade recommendation
-This release contains multiple high-severity security fixes affecting all Percona Server for MongoDB 6.0.x versions. We strongly recommend upgrading to version {{ page.meta.version }} as soon as possible.
+This release contains multiple high-severity security fixes affecting all Percona Server for MongoDB 6.0.x versions. We strongly recommend **upgrading to version {{ page.meta.version }}** as soon as possible.
## Security updates
@@ -31,28 +31,6 @@ These vulnerabilities affect the following versions:
- [SERVER-128125 :octicons-link-external-16:](https://jira.mongodb.org/browse/SERVER-128125){:target="_blank"} **(CVE-2026-11933):** A **use-after-free** vulnerability was identified in MongoDB Server’s server-side JavaScript engine when converting `BSON` documents to JavaScript arrays. An authenticated user with read privileges who can execute server-side JavaScript (e.g., via `$where` or `$function`) may trigger access to freed memory, which could result in information disclosure from the `mongod` process memory or a denial of service through a server crash.
-- [SERVER-125063 :octicons-link-external-16:](https://jira.mongodb.org/browse/SERVER-125063){:target="_blank"} **(CVE-2026-9740):** A vulnerability in the `BSON` validator allows an unauthenticated user to supply specially crafted input that could cause the `mongod` process to terminate unexpectedly, resulting in a denial-of-service condition.
-
-- [SERVER-124959 :octicons-link-external-16:](https://jira.mongodb.org/browse/SERVER-124959){:target="_blank"} **(CVE-2026-9753):** A vulnerability in the `$_internalApplyOplogUpdate` aggregation stage allows an authenticated user to supply specially crafted input that could cause the server process to terminate unexpectedly.
-
-- [SERVER-123440 :octicons-link-external-16:](https://jira.mongodb.org/browse/SERVER-123440){:target="_blank"} **(CVE-2026-9752):** Inserting specially crafted documents into a collection with a `2dsphere` index could cause the `mongod` process to terminate unexpectedly, leading to a server crash.
-
-- [SERVER-123633 :octicons-link-external-16:](https://jira.mongodb.org/browse/SERVER-123633){:target="_blank"} **(CVE-2026-9750):** A vulnerability in query execution allows an authenticated user to create specially crafted documents that interfere with internal metadata processing. This can cause the server process to terminate unexpectedly and may result in incorrect query results.
-
-- [SERVER-124031 :octicons-link-external-16:](https://jira.mongodb.org/browse/SERVER-124031){:target="_blank"} **(CVE-2026-9749):** Aggregation pipelines that use the internal `$exchange` stage with key-range partitioning can trigger an unexpected condition when processing large numbers of documents for a single key range. This can cause the server process to terminate unexpectedly.
-
-- [SERVER-123951 :octicons-link-external-16:](https://jira.mongodb.org/browse/SERVER-123951){:target="_blank"} **(CVE-2026-9748):** Under specific conditions, using the internal `$_internalConvertBucketIndexStats` stage together with `$facet` can cause the `mongod` process to terminate unexpectedly.
-
-- [SERVER-123918 :octicons-link-external-16:](https://jira.mongodb.org/browse/SERVER-123918){:target="_blank"} **(CVE-2026-9747):** A vulnerability triggered by using `fromRouter: true` together with `runtimeConstants.userRoles` can cause the `mongod` process to terminate unexpectedly.
-
-- [SERVER-124190 :octicons-link-external-16:](https://jira.mongodb.org/browse/SERVER-124190){:target="_blank"} **(CVE-2026-9746):** A vulnerability in the use of `$changeStream`, `$_requestReshardingResumeToken`, and the exchange option can cause the `mongod` process to terminate unexpectedly. An authenticated user can trigger this behavior without requiring any special privileges.
-
-### Medium severity
-
-- [SERVER-123370 :octicons-link-external-16:](https://jira.mongodb.org/browse/SERVER-123370){:target="_blank"} **(CVE-2026-9751):** Percona Server for MongoDB no longer logs sensitive parameter values when they are modified using the runtime `setParameter` command. Previously, parameters such as `ldapQueryPassword` could be written to `mongod.log` in plain text, potentially exposing credentials.
-
- This applies to all `setParameter` operations. Parameters marked as sensitive are automatically redacted from log output, and values associated with unrecognized parameter names are also redacted to prevent accidental exposure caused by typographical errors.
-
## Tools packaged with this release
| **Tool** | **Version** | **Release notes** |
From a62e9becb6d93665dd70dac131b520a7d74760b0 Mon Sep 17 00:00:00 2001
From: rasika-chivate <95711051+rasika-chivate@users.noreply.github.com>
Date: Tue, 23 Jun 2026 18:00:29 +0530
Subject: [PATCH 15/24] Update 6.0.29-23.md
---
docs/release_notes/6.0.29-23.md | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/docs/release_notes/6.0.29-23.md b/docs/release_notes/6.0.29-23.md
index 3d848fb67..f5ebbaf01 100644
--- a/docs/release_notes/6.0.29-23.md
+++ b/docs/release_notes/6.0.29-23.md
@@ -23,9 +23,7 @@ This release contains multiple high-severity security fixes affecting all Percon
### Affected versions
-These vulnerabilities affect the following versions:
-
-- All Percona Server for MongoDB 6.0.x versions
+These vulnerabilities affect Percona Server for MongoDB 6.0.x versions.
### High severity
From e9f182b81c591de717e3483fbed0eea05adde94c Mon Sep 17 00:00:00 2001
From: rasika-chivate <95711051+rasika-chivate@users.noreply.github.com>
Date: Tue, 23 Jun 2026 18:19:15 +0530
Subject: [PATCH 16/24] Update 6.0.29-23.md
---
docs/release_notes/6.0.29-23.md | 10 ++--------
1 file changed, 2 insertions(+), 8 deletions(-)
diff --git a/docs/release_notes/6.0.29-23.md b/docs/release_notes/6.0.29-23.md
index f5ebbaf01..a93fd392c 100644
--- a/docs/release_notes/6.0.29-23.md
+++ b/docs/release_notes/6.0.29-23.md
@@ -16,16 +16,10 @@ Percona Server for MongoDB **{{ page.meta.version }}** includes the following up
## Upgrade recommendation
-This release contains multiple high-severity security fixes affecting all Percona Server for MongoDB 6.0.x versions. We strongly recommend **upgrading to version {{ page.meta.version }}** as soon as possible.
+This release contains one **high-severity security fix** affecting all Percona Server for MongoDB 6.0.x versions. We strongly recommend **upgrading to version {{ page.meta.version }}** as soon as possible.
-## Security updates
-
-### Affected versions
-
-These vulnerabilities affect Percona Server for MongoDB 6.0.x versions.
-
-### High severity
+## Security update
- [SERVER-128125 :octicons-link-external-16:](https://jira.mongodb.org/browse/SERVER-128125){:target="_blank"} **(CVE-2026-11933):** A **use-after-free** vulnerability was identified in MongoDB Server’s server-side JavaScript engine when converting `BSON` documents to JavaScript arrays. An authenticated user with read privileges who can execute server-side JavaScript (e.g., via `$where` or `$function`) may trigger access to freed memory, which could result in information disclosure from the `mongod` process memory or a denial of service through a server crash.
From 8e072217c53b418072a288a2b1b06dde24f087c5 Mon Sep 17 00:00:00 2001
From: rasika-chivate <95711051+rasika-chivate@users.noreply.github.com>
Date: Tue, 23 Jun 2026 18:20:39 +0530
Subject: [PATCH 17/24] Update 6.0.29-23.md
---
docs/release_notes/6.0.29-23.md | 1 -
1 file changed, 1 deletion(-)
diff --git a/docs/release_notes/6.0.29-23.md b/docs/release_notes/6.0.29-23.md
index a93fd392c..0ac9ae089 100644
--- a/docs/release_notes/6.0.29-23.md
+++ b/docs/release_notes/6.0.29-23.md
@@ -18,7 +18,6 @@ Percona Server for MongoDB **{{ page.meta.version }}** includes the following up
This release contains one **high-severity security fix** affecting all Percona Server for MongoDB 6.0.x versions. We strongly recommend **upgrading to version {{ page.meta.version }}** as soon as possible.
-
## Security update
- [SERVER-128125 :octicons-link-external-16:](https://jira.mongodb.org/browse/SERVER-128125){:target="_blank"} **(CVE-2026-11933):** A **use-after-free** vulnerability was identified in MongoDB Server’s server-side JavaScript engine when converting `BSON` documents to JavaScript arrays. An authenticated user with read privileges who can execute server-side JavaScript (e.g., via `$where` or `$function`) may trigger access to freed memory, which could result in information disclosure from the `mongod` process memory or a denial of service through a server crash.
From b71284c94e1a6725ac926d2239969b9d6dcd6ba8 Mon Sep 17 00:00:00 2001
From: rasika-chivate <95711051+rasika-chivate@users.noreply.github.com>
Date: Tue, 23 Jun 2026 18:33:37 +0530
Subject: [PATCH 18/24] Update 6.0.29-23.md
---
docs/release_notes/6.0.29-23.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/docs/release_notes/6.0.29-23.md b/docs/release_notes/6.0.29-23.md
index 0ac9ae089..c354ce0bc 100644
--- a/docs/release_notes/6.0.29-23.md
+++ b/docs/release_notes/6.0.29-23.md
@@ -16,7 +16,7 @@ Percona Server for MongoDB **{{ page.meta.version }}** includes the following up
## Upgrade recommendation
-This release contains one **high-severity security fix** affecting all Percona Server for MongoDB 6.0.x versions. We strongly recommend **upgrading to version {{ page.meta.version }}** as soon as possible.
+This release contains a **high-severity security fix** affecting all Percona Server for MongoDB 6.0.x versions. We strongly recommend **upgrading to version {{ page.meta.version }}** as soon as possible.
## Security update
From 3315260e0ca0abb4d5b2d0e8fad76ad82f9dc6cb Mon Sep 17 00:00:00 2001
From: Rasika Chivate <95711051+rasika-chivate@users.noreply.github.com>
Date: Tue, 23 Jun 2026 18:46:00 +0530
Subject: [PATCH 19/24] Update docs/release_notes/6.0.29-23.md
Co-authored-by: Radoslaw Szulgo
---
docs/release_notes/6.0.29-23.md | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/docs/release_notes/6.0.29-23.md b/docs/release_notes/6.0.29-23.md
index c354ce0bc..169fad617 100644
--- a/docs/release_notes/6.0.29-23.md
+++ b/docs/release_notes/6.0.29-23.md
@@ -8,9 +8,7 @@ version: 6.0.29-23
Percona Server for MongoDB {{ page.meta.version }} is an enhanced, source-available, and highly-scalable database that is a fully-compatible, drop-in replacement for MongoDB Community Edition.
-Percona Server for MongoDB **{{ page.meta.version }}** includes the following updates from:
-
-- [MongoDB 6.0.29 Community Edition :octicons-link-external-16:](https://www.mongodb.com/docs/v6.0/release-notes/6.0-changelog/#6.0.29-changelog){:target="_blank"}
+Percona Server for MongoDB **{{ page.meta.version }}** includes updates from [MongoDB 6.0.29 Community Edition :octicons-link-external-16:](https://www.mongodb.com/docs/v6.0/release-notes/6.0-changelog/#6.0.29-changelog){:target="_blank"}
- Supports protocols and drivers of MongoDB Community **6.0.29**.
From 3ac807633cc234e556a855590e2b333604997dfe Mon Sep 17 00:00:00 2001
From: rasika-chivate <95711051+rasika-chivate@users.noreply.github.com>
Date: Tue, 23 Jun 2026 18:46:23 +0530
Subject: [PATCH 20/24] Update 6.0.29-23.md
---
docs/release_notes/6.0.29-23.md | 6 +-----
1 file changed, 1 insertion(+), 5 deletions(-)
diff --git a/docs/release_notes/6.0.29-23.md b/docs/release_notes/6.0.29-23.md
index c354ce0bc..a926ca8a0 100644
--- a/docs/release_notes/6.0.29-23.md
+++ b/docs/release_notes/6.0.29-23.md
@@ -8,11 +8,7 @@ version: 6.0.29-23
Percona Server for MongoDB {{ page.meta.version }} is an enhanced, source-available, and highly-scalable database that is a fully-compatible, drop-in replacement for MongoDB Community Edition.
-Percona Server for MongoDB **{{ page.meta.version }}** includes the following updates from:
-
-- [MongoDB 6.0.29 Community Edition :octicons-link-external-16:](https://www.mongodb.com/docs/v6.0/release-notes/6.0-changelog/#6.0.29-changelog){:target="_blank"}
-
-- Supports protocols and drivers of MongoDB Community **6.0.29**.
+Percona Server for MongoDB **{{ page.meta.version }}** includes the updates from [MongoDB 6.0.29 Community Edition :octicons-link-external-16:](https://www.mongodb.com/docs/v6.0/release-notes/6.0-changelog/#6.0.29-changelog){:target="_blank"}. It also supports the protocols and drivers of MongoDB Community **6.0.29**.
## Upgrade recommendation
From cff7f72062d15fa9a3413492f14b2dd2265b1168 Mon Sep 17 00:00:00 2001
From: rasika-chivate <95711051+rasika-chivate@users.noreply.github.com>
Date: Tue, 23 Jun 2026 18:52:26 +0530
Subject: [PATCH 21/24] Update 6.0.29-23.md
---
docs/release_notes/6.0.29-23.md | 6 ------
1 file changed, 6 deletions(-)
diff --git a/docs/release_notes/6.0.29-23.md b/docs/release_notes/6.0.29-23.md
index 92cd81a58..a926ca8a0 100644
--- a/docs/release_notes/6.0.29-23.md
+++ b/docs/release_notes/6.0.29-23.md
@@ -8,13 +8,7 @@ version: 6.0.29-23
Percona Server for MongoDB {{ page.meta.version }} is an enhanced, source-available, and highly-scalable database that is a fully-compatible, drop-in replacement for MongoDB Community Edition.
-<<<<<<< HEAD
Percona Server for MongoDB **{{ page.meta.version }}** includes the updates from [MongoDB 6.0.29 Community Edition :octicons-link-external-16:](https://www.mongodb.com/docs/v6.0/release-notes/6.0-changelog/#6.0.29-changelog){:target="_blank"}. It also supports the protocols and drivers of MongoDB Community **6.0.29**.
-=======
-Percona Server for MongoDB **{{ page.meta.version }}** includes updates from [MongoDB 6.0.29 Community Edition :octicons-link-external-16:](https://www.mongodb.com/docs/v6.0/release-notes/6.0-changelog/#6.0.29-changelog){:target="_blank"}
-
-- Supports protocols and drivers of MongoDB Community **6.0.29**.
->>>>>>> 3315260e0ca0abb4d5b2d0e8fad76ad82f9dc6cb
## Upgrade recommendation
From 3c2ee1a7b3f5bdc0afe733e60f232ea14f4d87e5 Mon Sep 17 00:00:00 2001
From: rasika-chivate <95711051+rasika-chivate@users.noreply.github.com>
Date: Tue, 23 Jun 2026 18:55:17 +0530
Subject: [PATCH 22/24] Update 6.0.29-23.md
---
docs/release_notes/6.0.29-23.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/docs/release_notes/6.0.29-23.md b/docs/release_notes/6.0.29-23.md
index a926ca8a0..481fe302d 100644
--- a/docs/release_notes/6.0.29-23.md
+++ b/docs/release_notes/6.0.29-23.md
@@ -23,4 +23,4 @@ This release contains a **high-severity security fix** affecting all Percona Ser
| **Tool** | **Version** | **Release notes** |
|---|---|---|
| MongoDB Shell (`mongosh`) | 2.8.3 | [upstream release notes :octicons-link-external-16:](https://www.mongodb.com/docs/mongodb-shell/changelog/#v2.8.3){:target="_blank"} |
-| Mongo Tools | 100.17.0 | [upstream release notes :octicons-link-external-16:](https://www.mongodb.com/docs/database-tools/release-notes/dbtools-100.17.0-changelog/){:target="_blank"} |
+| Mongo Tools | 100.17.0 | [upstream release notes :octicons-link-external-16:](https://www.mongodb.com/docs/database-tools/release-notes/dbtools-100.17.0-changelog/){:target="_blank"}|
From 933fa9ad72e9d1a66f775f46d06774c6d80b9cc6 Mon Sep 17 00:00:00 2001
From: Radoslaw Szulgo
Date: Wed, 24 Jun 2026 14:02:16 +0200
Subject: [PATCH 23/24] Update release notes for version 6.0.29-23
Updated release notes for version 6.0.29-23, detailing security vulnerabilities and tool updates.
---
docs/release_notes/6.0.29-23.md | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/docs/release_notes/6.0.29-23.md b/docs/release_notes/6.0.29-23.md
index 481fe302d..c9465a9fd 100644
--- a/docs/release_notes/6.0.29-23.md
+++ b/docs/release_notes/6.0.29-23.md
@@ -20,7 +20,14 @@ This release contains a **high-severity security fix** affecting all Percona Ser
## Tools packaged with this release
-| **Tool** | **Version** | **Release notes** |
+Percona repackages the upstream MongoDB Shell (`mongosh`) as `percona-mongodb-mongosh`, updating all copyright, authorship, and branding from **MongoDB, Inc.** to **Percona LLC** and the full product name "Percona MongoDB Shell." Package filenames now include the OS distribution codename (e.g., el8, jammy) for easier platform identification, and Debian packages switch to gzip compression. The proprietary MongoDB Enterprise crypt library is excluded from Percona's build.
+
+Percona also repackages and patches Mongo Tools, upgrading embedded Go libraries in the `mongodump` binary to address 15 high-severity security vulnerabilities:
+
+- `golang.org/x/crypto` updated from **v0.45.0** to **v0.52.0** — fixes [CVE-2026-39827 :octicons-link-external-16:](https://nvd.nist.gov/vuln/detail/CVE-2026-39827){:target="_blank"}, [CVE-2026-39828 :octicons-link-external-16:](https://nvd.nist.gov/vuln/detail/CVE-2026-39828){:target="_blank"}, [CVE-2026-39829 :octicons-link-external-16:](https://nvd.nist.gov/vuln/detail/CVE-2026-39829){:target="_blank"}, [CVE-2026-39830 :octicons-link-external-16:](https://nvd.nist.gov/vuln/detail/CVE-2026-39830){:target="_blank"}, [CVE-2026-39835 :octicons-link-external-16:](https://nvd.nist.gov/vuln/detail/CVE-2026-39835){:target="_blank"}, [CVE-2026-42508 :octicons-link-external-16:](https://nvd.nist.gov/vuln/detail/CVE-2026-42508){:target="_blank"}, [CVE-2026-46595 :octicons-link-external-16:](https://nvd.nist.gov/vuln/detail/CVE-2026-46595){:target="_blank"}, [CVE-2026-46597 :octicons-link-external-16:](https://nvd.nist.gov/vuln/detail/CVE-2026-46597){:target="_blank"}
+- `golang.org/x/net` updated from **v0.47.0** to **v0.55.0** — fixes [CVE-2026-25680 :octicons-link-external-16:](https://nvd.nist.gov/vuln/detail/CVE-2026-25680){:target="_blank"}, [CVE-2026-25681 :octicons-link-external-16:](https://nvd.nist.gov/vuln/detail/CVE-2026-25681){:target="_blank"}, [CVE-2026-27136 :octicons-link-external-16:](https://nvd.nist.gov/vuln/detail/CVE-2026-27136){:target="_blank"}, [CVE-2026-33814 :octicons-link-external-16:](https://nvd.nist.gov/vuln/detail/CVE-2026-33814){:target="_blank"}, [CVE-2026-39821 :octicons-link-external-16:](https://nvd.nist.gov/vuln/detail/CVE-2026-39821){:target="_blank"}, [CVE-2026-42502 :octicons-link-external-16:](https://nvd.nist.gov/vuln/detail/CVE-2026-42502){:target="_blank"}, [CVE-2026-42506 :octicons-link-external-16:](https://nvd.nist.gov/vuln/detail/CVE-2026-42506){:target="_blank"}
+
+| **Tool** | **Base version** | **Release notes** |
|---|---|---|
| MongoDB Shell (`mongosh`) | 2.8.3 | [upstream release notes :octicons-link-external-16:](https://www.mongodb.com/docs/mongodb-shell/changelog/#v2.8.3){:target="_blank"} |
-| Mongo Tools | 100.17.0 | [upstream release notes :octicons-link-external-16:](https://www.mongodb.com/docs/database-tools/release-notes/dbtools-100.17.0-changelog/){:target="_blank"}|
+| Mongo Tools | 100.17.0 | [upstream release notes :octicons-link-external-16:](https://www.mongodb.com/docs/database-tools/release-notes/dbtools-100.17.0-changelog/){:target="_blank"} |
From 76e1ef2bb97200dc3bed8979bcf8b7f6e2b3ec01 Mon Sep 17 00:00:00 2001
From: Radoslaw Szulgo
Date: Wed, 24 Jun 2026 14:27:16 +0200
Subject: [PATCH 24/24] Update release notes for version 6.0.29-23
Updated release notes for version 6.0.29-23, detailing security vulnerabilities and packaging changes.
---
docs/release_notes/6.0.29-23.md | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/docs/release_notes/6.0.29-23.md b/docs/release_notes/6.0.29-23.md
index c9465a9fd..5bffe6129 100644
--- a/docs/release_notes/6.0.29-23.md
+++ b/docs/release_notes/6.0.29-23.md
@@ -20,9 +20,9 @@ This release contains a **high-severity security fix** affecting all Percona Ser
## Tools packaged with this release
-Percona repackages the upstream MongoDB Shell (`mongosh`) as `percona-mongodb-mongosh`, updating all copyright, authorship, and branding from **MongoDB, Inc.** to **Percona LLC** and the full product name "Percona MongoDB Shell." Package filenames now include the OS distribution codename (e.g., el8, jammy) for easier platform identification, and Debian packages switch to gzip compression. The proprietary MongoDB Enterprise crypt library is excluded from Percona's build.
+Percona repackages the upstream MongoDB Shell (`mongosh`) as `percona-mongodb-mongosh`, updating all copyright, authorship, and branding under the full product name "Percona MongoDB Shell."
-Percona also repackages and patches Mongo Tools, upgrading embedded Go libraries in the `mongodump` binary to address 15 high-severity security vulnerabilities:
+Percona also repackages and patches Mongo Tools. In this release, we've updated embedded Go libraries in the `mongodump` binary to address 15 security (severity from medium to critical) vulnerabilities:
- `golang.org/x/crypto` updated from **v0.45.0** to **v0.52.0** — fixes [CVE-2026-39827 :octicons-link-external-16:](https://nvd.nist.gov/vuln/detail/CVE-2026-39827){:target="_blank"}, [CVE-2026-39828 :octicons-link-external-16:](https://nvd.nist.gov/vuln/detail/CVE-2026-39828){:target="_blank"}, [CVE-2026-39829 :octicons-link-external-16:](https://nvd.nist.gov/vuln/detail/CVE-2026-39829){:target="_blank"}, [CVE-2026-39830 :octicons-link-external-16:](https://nvd.nist.gov/vuln/detail/CVE-2026-39830){:target="_blank"}, [CVE-2026-39835 :octicons-link-external-16:](https://nvd.nist.gov/vuln/detail/CVE-2026-39835){:target="_blank"}, [CVE-2026-42508 :octicons-link-external-16:](https://nvd.nist.gov/vuln/detail/CVE-2026-42508){:target="_blank"}, [CVE-2026-46595 :octicons-link-external-16:](https://nvd.nist.gov/vuln/detail/CVE-2026-46595){:target="_blank"}, [CVE-2026-46597 :octicons-link-external-16:](https://nvd.nist.gov/vuln/detail/CVE-2026-46597){:target="_blank"}
- `golang.org/x/net` updated from **v0.47.0** to **v0.55.0** — fixes [CVE-2026-25680 :octicons-link-external-16:](https://nvd.nist.gov/vuln/detail/CVE-2026-25680){:target="_blank"}, [CVE-2026-25681 :octicons-link-external-16:](https://nvd.nist.gov/vuln/detail/CVE-2026-25681){:target="_blank"}, [CVE-2026-27136 :octicons-link-external-16:](https://nvd.nist.gov/vuln/detail/CVE-2026-27136){:target="_blank"}, [CVE-2026-33814 :octicons-link-external-16:](https://nvd.nist.gov/vuln/detail/CVE-2026-33814){:target="_blank"}, [CVE-2026-39821 :octicons-link-external-16:](https://nvd.nist.gov/vuln/detail/CVE-2026-39821){:target="_blank"}, [CVE-2026-42502 :octicons-link-external-16:](https://nvd.nist.gov/vuln/detail/CVE-2026-42502){:target="_blank"}, [CVE-2026-42506 :octicons-link-external-16:](https://nvd.nist.gov/vuln/detail/CVE-2026-42506){:target="_blank"}