From c2263a006699025b3b234eb658f47482f623a257 Mon Sep 17 00:00:00 2001 From: Pavel Safronov Date: Tue, 17 Mar 2026 14:18:00 -0700 Subject: [PATCH 1/4] added release-7.1 config --- .github/workflows/release-7.1.yml | 105 ++++++++++++++++++++++++++++++ 1 file changed, 105 insertions(+) create mode 100644 .github/workflows/release-7.1.yml diff --git a/.github/workflows/release-7.1.yml b/.github/workflows/release-7.1.yml new file mode 100644 index 00000000000..766ec36fc9c --- /dev/null +++ b/.github/workflows/release-7.1.yml @@ -0,0 +1,105 @@ +on: + push: + branches: ['v7.1.x'] + workflow_dispatch: {} + +permissions: + contents: write + pull-requests: write + id-token: write + +name: release-7.1 + +jobs: + release_please: + runs-on: ubuntu-latest + outputs: + release_created: ${{ steps.release.outputs.release_created }} + steps: + - id: release + uses: googleapis/release-please-action@v4 + with: + target-branch: 'v7.1.x' + + build: + needs: [release_please] + name: "Perform any build or bundling steps, as necessary." + uses: ./.github/workflows/build.yml + + ssdlc: + needs: [release_please, build] + permissions: + # required for all workflows + security-events: write + id-token: write + contents: write + environment: release + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v5 + + - name: Install Node and dependencies + uses: mongodb-labs/drivers-github-tools/node/setup@v3 + with: + ignore_install_scripts: false + + - name: Load version and package info + uses: mongodb-labs/drivers-github-tools/node/get_version_info@v3 + with: + npm_package_name: mongodb + + - name: actions/compress_sign_and_upload + uses: mongodb-labs/drivers-github-tools/node/sign_node_package@v3 + with: + aws_role_arn: ${{ secrets.AWS_ROLE_ARN }} + aws_region_name: us-east-1 + aws_secret_id: ${{ secrets.AWS_SECRET_ID }} + npm_package_name: mongodb + dry_run: ${{ needs.release_please.outputs.release_created == '' }} + + - name: Copy sbom file to release assets + shell: bash + if: ${{ '' == '' }} + run: cp sbom.json ${{ env.S3_ASSETS }}/sbom.json + + # only used for mongodb-client-encryption + - name: Augment SBOM and copy to release assets + if: ${{ '' != '' }} + uses: mongodb-labs/drivers-github-tools/sbom@v3 + with: + silk_asset_group: '' + sbom_file_name: sbom.json + + - name: Generate authorized pub report + uses: mongodb-labs/drivers-github-tools/full-report@v3 + with: + release_version: ${{ env.package_version }} + product_name: mongodb + sarif_report_target_ref: 'v7.1.x' + third_party_dependency_tool: n/a + dist_filenames: artifacts/* + token: ${{ github.token }} + sbom_file_name: sbom.json + evergreen_project: mongo-node-driver-next + evergreen_commit: ${{ env.commit }} + + - uses: mongodb-labs/drivers-github-tools/upload-s3-assets@v3 + with: + version: ${{ env.package_version }} + product_name: mongodb + dry_run: ${{ needs.release_please.outputs.release_created == '' }} + + publish: + needs: [release_please, ssdlc, build] + environment: release + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v5 + + - name: Install Node and dependencies + uses: mongodb-labs/drivers-github-tools/node/setup@v3 + + - run: npm publish --provenance --tag=latest + if: ${{ needs.release_please.outputs.release_created }} + env: + NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} From a19d5e65ae24ecba85818a0823da5a043614c2b8 Mon Sep 17 00:00:00 2001 From: Pavel Safronov Date: Tue, 17 Mar 2026 14:59:40 -0700 Subject: [PATCH 2/4] fix(7477): OIDC host allowlist fix --- src/utils.ts | 24 +++++++++++++++++++----- test/unit/utils.test.ts | 15 +++++++++++++++ 2 files changed, 34 insertions(+), 5 deletions(-) diff --git a/src/utils.ts b/src/utils.ts index 397850649d5..e96864e162b 100644 --- a/src/utils.ts +++ b/src/utils.ts @@ -83,13 +83,27 @@ export function isUint8Array(value: unknown): value is Uint8Array { */ export function hostMatchesWildcards(host: string, wildcards: string[]): boolean { for (const wildcard of wildcards) { - if ( - host === wildcard || - (wildcard.startsWith('*.') && host?.endsWith(wildcard.substring(2, wildcard.length))) || - (wildcard.startsWith('*/') && host?.endsWith(wildcard.substring(2, wildcard.length))) - ) { + // Exact match always wins + if (host === wildcard) { return true; } + + // Wildcard match with leading *. + if (wildcard.startsWith('*.')) { + const suffix = wildcard.substring(2); + // Exact match or strict subdomain match + if (host === suffix || host.endsWith(`.${suffix}`)) { + return true; + } + } + // Wildcard match with leading */ + if (wildcard.startsWith('*/')) { + const suffix = wildcard.substring(2); + // Exact match or strict subpath match + if (host === suffix || host.endsWith(`/${suffix}`)) { + return true; + } + } } return false; } diff --git a/test/unit/utils.test.ts b/test/unit/utils.test.ts index dc393fe0990..1b5cf9908d1 100644 --- a/test/unit/utils.test.ts +++ b/test/unit/utils.test.ts @@ -148,6 +148,13 @@ describe('driver utils', function () { }); }); + context('when the wildcard starts with *.', function () { + it('returns false', function () { + expect(hostMatchesWildcards('test-mongodb.com', ['*.mongodb.com', 'test2'])).to.be + .false; + }); + }); + context('when the host matches a FQDN', function () { it('returns true', function () { expect(hostMatchesWildcards('mongodb.net', ['*.mongodb.net', 'other'])).to.be.true; @@ -221,6 +228,14 @@ describe('driver utils', function () { .to.be.false; }); }); + + context('when the host does not match partial matches', function () { + it('returns false', function () { + expect( + hostMatchesWildcards('/tmp/test-mongodb-27017.sock', ['*/mongodb-27017.sock', 'test2']) + ).to.be.false; + }); + }); }); }); From b6276b4e51adb0152145400874ecae5c708043c3 Mon Sep 17 00:00:00 2001 From: Daria Pardue Date: Mon, 23 Mar 2026 09:18:52 -0400 Subject: [PATCH 3/4] chore: update codeql target for v7.1.x (#4903) --- .github/workflows/codeql.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index fe360b18b69..dc12be9765b 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -2,9 +2,9 @@ name: "CodeQL" on: push: - branches: [ "main", "5.x" ] + branches: [ "main", "v7.1.x" ] pull_request: - branches: [ "main", "5.x" ] + branches: [ "main", "v7.1.x" ] jobs: analyze: From 65783338c4c5f5f66bd60f7a6e067b5cc47aef96 Mon Sep 17 00:00:00 2001 From: Pavel Safronov Date: Mon, 23 Mar 2026 09:04:07 -0700 Subject: [PATCH 4/4] pr feedback: added tests that verify the wildcards in default allowed hosts --- test/unit/utils.test.ts | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/test/unit/utils.test.ts b/test/unit/utils.test.ts index 1b5cf9908d1..98b23ec2863 100644 --- a/test/unit/utils.test.ts +++ b/test/unit/utils.test.ts @@ -4,6 +4,7 @@ import { ObjectId } from 'bson'; import { expect } from 'chai'; import * as sinon from 'sinon'; +import { DEFAULT_ALLOWED_HOSTS } from '../../src/cmap/auth/mongo_credentials'; import { LEGACY_HELLO_COMMAND } from '../../src/constants'; import { MongoInvalidArgumentError, MongoRuntimeError } from '../../src/error'; import { decorateWithExplain, Explain } from '../../src/explain'; @@ -155,6 +156,19 @@ describe('driver utils', function () { }); }); + context('when using default allowed hosts', function () { + it('returns false', function () { + for (const host of DEFAULT_ALLOWED_HOSTS) { + // Only test the wildcard hosts, the non-wildcard hosts are tested in other test cases + if (!host.startsWith('*.')) { + continue; + } + const wrongHost = host.replace('*.', 'test-'); + expect(hostMatchesWildcards(wrongHost, DEFAULT_ALLOWED_HOSTS)).to.be.false; + } + }); + }); + context('when the host matches a FQDN', function () { it('returns true', function () { expect(hostMatchesWildcards('mongodb.net', ['*.mongodb.net', 'other'])).to.be.true;