Bump MongoDB.Driver from 3.11.0 to 3.12.0

[dependabot]

Updated MongoDB.Driver from 3.11.0 to 3.12.0.

Release notes

Sourced from MongoDB.Driver's releases.

3.12.0

This is the general availability release for the 3.12.0 version of the driver.

The main new features in 3.12.0 include:

• CSHARP-6214: Implement srvAllowedHostsSuffix URI option

Fixes:

• CSHARP-6223: Fix client-side projection crash on member-init projections

The full list of issues resolved in this release is available at CSHARP JIRA project.

Documentation on the .NET driver can be found here.

3.11.2

[!IMPORTANT]
This is a security patch release. It addresses two CVEs reported against the driver, along with a small number of related fixes. There are no public API changes and no application code changes are required to upgrade. Note that the shape of some queries generated by the LINQ provider and by GridFS has changed — see the individual tickets below.

This is a patch release that contains fixes and stability improvements:

• CSHARP-6177 / CVE-2026-88026: Query filter regex injection via unescaped backslash and bracket in LINQ character-set translation
• CSHARP-6190 / CVE-2026-88025: Use exact match for file ID in GridFS delete methods
• CSHARP-6213: Normalize SRV target host names to lower case during SRV polling

The full list of issues resolved in this release is available at CSHARP JIRA project.

Documentation on the .NET driver can be found here.

3.11.1

[!IMPORTANT]
This is a security patch release. It addresses a number of CVEs reported against the driver and does not include any functional changes or API modifications. Upgrading is recommended for all users; no code changes are required on the application side.

This is a patch release that contains fixes and stability improvements:

• CSHARP-6164 / CVE-2026-81530: KMS master key exposure via unredacted credential serialization in driver settings string
• CSHARP-6171 / CVE-2026-81529: Connection-option injection via unescaped settings in the canonical MongoDB URL builder
• CSHARP-6158 / CVE-2026-81528: NoSQL injection via array replacement bypassing update shape validation in driver write path
• CSHARP-6156 / CVE-2026-81527: NoSQL injection via unquoted constant GroupBy keys in LINQ pipeline translation
• CSHARP-6178 / CVE-2026-81527: NoSQL injection via equality-filter simplification of dollar-keyed documents in the LINQ provider
• CSHARP-6185 / CVE-2026-81527: NoSQL injection via unescaped dollar-prefixed values in LINQ constant arrays and documents

The full list of issues resolved in this release is available at CSHARP JIRA project.

Documentation on the .NET driver can be found here.

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Assignees

The following users could not be added as assignees: lizperz. Either the username does not exist or it does not have the correct permissions to be added as an assignee.

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.