[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
mongodb/mongodb (source)	2.5.0 → 2.5.1

---

Release Notes

mongodb/mongo-php-library (mongodb/mongodb)

v2.5.1

Compare Source

The PHP team is happy to announce that version 2.5.1 of the MongoDB PHP library is now available.

Release Highlights

• Do not modify a shared stdClass operator when encoding OutputWindow by @​zigzagdev in #​2000
• Fix explain empty filter by @​zigzagdev in #​2006
• Fix CachingIterator::count() ending the current iteration by @​zigzagdev in #​2034
• PHPLIB-1977: Report writeConcernError for aggregate write stages by @​GromNaN in #​2061
• PHPLIB-1981: Fix array and stdClass queries being encoded as integer fields in QueryObject by @​zigzagdev in #​2033
• PHPLIB-1970: Remove deprecation of capped collection helpers in CollectionInfo by @​GromNaN in #​2011

A complete list of resolved issues in this release may be found in JIRA.

Documentation

Documentation for this library may be found in the PHP Library Manual.

Installation

This library may be installed or upgraded with:

composer require mongodb/mongodb:2.5.1

Installation instructions for the mongodb extension may be found in the PHP.net documentation.

Full Changelog: mongodb/mongo-php-library@2.5.0...2.5.1

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[artidezi-etke-cc]

The agent prepared adaptations for human review. The original change remains open.

Propose the MongoDB 2.5.1 update plus a separate lockfile commit upgrading four Symfony components to 8.1.11, fixing five pre-existing advisories that fail the PHP audit gate. The actual PHP image supports the updated library; Composer validation/audit, PHPStan, PHP/Twig style checks, frontend lint/type checking/build and npm audit passed on the replacement candidate. Installation required an exact-commit codeload cache workaround for a GitHub API 504; live database and browser behavior were not exercised. Remaining debt: no new deprecations, shutdown dates or required migrations identified in this update.

Agent-assessed risk: Medium. The MongoDB patch is compatible, but the proposal also applies Symfony security behavior fixes and database/browser integration was not exercised.

Evidence (13 items)

• Local check: git merge-base 84388ccdeb841cb1c9d9ccdcf0cd9ad6fd846d0d refs/artidezi/inputs/source-pr; git diff 84388ccdeb841cb1c9d9ccdcf0cd9ad6fd846d0d...refs/artidezi/inputs/source-pr — Merge base equals recorded target. Original PR changes only app/composer.lock: mongodb/mongodb 2.5.0 to 2.5.1. Replacement includes that exact update and only four additional Symfony patch updates; target content is preserved. Working tree clean.
• Release notes: source — Patch fixes query encoding, empty explain filters, iterator counting, shared OutputWindow operators and aggregate write concern reporting. No new runtime requirement or removal announced.
• Documentation: source — Requires PHP ^8.1 and ext-mongodb ^2.5. Dockerfile pins driver 2.5.6; docker build --iidfile /tmp/pr65-php-image.id etc/docker/php passed using cached layers. docker run --rm --network none --entrypoint php <built-image> -r <version probe> confirmed actual PHP 8.5.12 and MongoDB extension 2.5.6. No runtime or local build tag change needed.
• Upstream diff: source — Capped collection helpers getCappedMax/getCappedSize/isCapped lose misleading PHPDoc deprecations because they remain supported with no removal path. Repository searches found no uses of these helpers or capped collection configuration. No migration or suppression needed.
• Local check: ./bin/composer audit --locked (original source candidate) — Failed with five advisories in unchanged symfony/config, http-kernel, routing and security-http 8.1.10. This reproduces a failing PHP workflow gate, although the supplied truncated CI excerpt does not establish the exact forge failure.
• Documentation: source — Config XML external entity issue patched in 8.1.11. Focused update command: ./bin/composer update symfony/config symfony/http-kernel symfony/routing symfony/security-http --with-dependencies --minimal-changes --no-install --no-interaction. Only these four packages changed; all existing Symfony 8.1 constraints retained.
• Documentation: source — HttpKernel inline fragment forwarded header security fix included via 8.1.11.
• Documentation: source — Routing host placeholder path rule bypass patched in 8.1.11.
• Documentation: source — Security HTTP X509 identity parsing patched in 8.1.11.
• Documentation: source — Security HTTP programmatic logins now run post-authentication checks; no programmatic login or custom user checker use found in application source.
• Local check: ./bin/composer install --no-interaction --prefer-dist; ./bin/composer validate --strict; ./bin/composer audit --locked — Final candidate passed install, strict validation and audit (zero advisories) in isolated git archive of source plus the exact committed replacement lockfile. Install initially failed twice downloading unchanged symfony/filesystem commit 58f57b6a33e3495f7f41e01258f1ae5ef76cccd2 through GitHub API (HTTP 504); succeeded after caching the exact-commit archive fetched from GitHub codeload. Clean installs still depend on archive endpoint availability.
• Local check: docker run --rm --network none --user <uid:gid> --mount type=bind,src=<isolated-candidate>,dst=/code --workdir /code/app --entrypoint /bin/sh <built-image> -ec <autoload probe; vendor/bin/phpstan analyse -c phpstan.neon --no-progress; vendor/bin/php-cs-fixer check --config=.php-cs-fixer.dist.php; vendor/bin/twig-cs-fixer lint --config=.twig-cs-fixer.dist.php> — Passed autoload and PHPStan; PHP style: 0/146 files need fixing; Twig: 38 files, zero notices/warnings/errors. PHP CS Fixer reports existing PHP minimum 8.4 versus runtime 8.5 warning. No database integration test performed.
• Local check: just js-analyze js-build; ./bin/node /bin/sh -c 'cd /app/src && npm audit --omit=dev' — Passed Docker-backed ESLint, TypeScript checking, asset build and production npm audit (zero vulnerabilities). Node helper built from lock via cached npm ci layer. Frontend inputs and peer dependencies unchanged. Generated assets stayed outside the checkout; browser interaction not exercised because React loading/assets did not change.

Adaptation: #68

Assessed source b15ce17c36d18226c1e423181c13e44a683b7c56.

[artidezi-etke-cc]

Approved: no adaptation is required under the configured project policy.

Approve unchanged: the PR only updates mongodb/mongodb from 2.5.0 to 2.5.1 and integrates directly with the recorded target. The patch fixes library behavior without changing runtime requirements; the built PHP 8.5.12 image provides compatible MongoDB driver 2.5.7. Composer validation/install and isolated runtime checks passed; supplied PHP/frontend CI is successful. No live database operations were tested. Remaining debt: no new deprecations or required migrations identified; capped-collection helper deprecations were withdrawn upstream with no removal planned.

Agent-assessed risk: Low. A narrowly scoped patch with unchanged runtime requirements, compatible built driver, successful focused checks and supplied green CI; live database behavior remains untested.

Evidence (9 items)

• Local check: git diff 4cc9fc0a268261f88d5d1a3a41a111ca84bf33c3...refs/artidezi/inputs/source-pr; git merge-base — Merge base equals recorded target base. Only app/composer.lock changes: MongoDB library version/reference and package metadata; no unrelated packages or target changes to reconcile.
• Release notes: source — Official patch highlights fix OutputWindow shared operators, explain empty filters, CachingIterator counting, aggregate write concern reporting and QueryObject encoding; removes capped-helper deprecation annotations.
• Documentation: source — Requires PHP ^8.1 and ext-mongodb ^2.5, matching the actual PHP 8.5.12/driver 2.5.7 image. Existing application constraints remain coherent; library development-only PHPStan metadata does not alter root dependencies.
• Upstream diff: source — Upstream explains capped helpers are supported wrappers with no removal path; misleading PHPDoc deprecations were removed without behavior changes. Repository search found no uses of these helpers or the affected builder/explain/aggregate APIs.
• Local check: Temporary source-ref archive: ./bin/composer validate --strict; ./bin/composer install --no-interaction --prefer-dist — Both exited 0; composer.json valid and all 92 locked dependencies installed. Checked candidate outside checkout; no tracked files changed.
• Local check: docker build --iidfile <temporary-copy>/var/assessment-php-image.id <temporary-copy>/etc/docker/php — Exited 0 (cached image build). Uses repository Dockerfile, including pinned PHP and compiled MongoDB driver.
• Local check: docker run --rm -i --network none --mount type=bind,src=<temporary-copy>,dst=/code,readonly --workdir /code/app --entrypoint php <built-image> (inline PHP probe) — Passed autoload/Composer platform checks, Client/selectDatabase/selectCollection wiring and BSON array round-trip using BSON\Document::fromPHP()->toPHP(). Reported PHP 8.5.12, ext-mongodb 2.5.7 and mongodb/mongodb 2.5.1. Initial probe failed because it used removed BSON\toPHP/fromPHP functions; corrected probe passed. No database connection or application data accessed.
• Evidence: Supplied source CI snapshot at b2d3814bf0a9690a90d5d5beeb1f94071d051a94 — PHP and frontend checks reported successful. Broader PHPStan/PHP/Twig style and frontend lint/type/build checks were not rerun locally to duplicate successful CI; snapshot is point-in-time evidence, independently refreshed by controller.
• Local check: git status --porcelain; git rev-parse HEAD — Working tree clean; checkout remains at recorded target base with no commits or modifications.

Assessed source b2d3814bf0a9690a90d5d5beeb1f94071d051a94.