Bump MongoDB.Bson from 3.9.0 to 3.11.1

[dependabot]

Updated MongoDB.Bson from 3.9.0 to 3.11.1.

Release notes

Sourced from MongoDB.Bson's releases.

3.11.1

[!IMPORTANT]
This is a security patch release. It addresses a number of CVEs reported against the driver and does not include any functional changes or API modifications. Upgrading is recommended for all users; no code changes are required on the application side.

This is a patch release that contains fixes and stability improvements:

• CSHARP-6164 / CVE-2026-81530: KMS master key exposure via unredacted credential serialization in driver settings string
• CSHARP-6171 / CVE-2026-81529: Connection-option injection via unescaped settings in the canonical MongoDB URL builder
• CSHARP-6158 / CVE-2026-81528: NoSQL injection via array replacement bypassing update shape validation in driver write path
• CSHARP-6156 / CVE-2026-81527: NoSQL injection via unquoted constant GroupBy keys in LINQ pipeline translation
• CSHARP-6178 / CVE-2026-81527: NoSQL injection via equality-filter simplification of dollar-keyed documents in the LINQ provider
• CSHARP-6185 / CVE-2026-81527: NoSQL injection via unescaped dollar-prefixed values in LINQ constant arrays and documents

The full list of issues resolved in this release is available at CSHARP JIRA project.

Documentation on the .NET driver can be found here.

3.11.0

This is the general availability release for the 3.11.0 version of the driver.

The main new features in 3.11.0 include:

• CSHARP-6005: CSFLE/QE support for HTTP Proxies
• CSHARP-6089: Client Backpressure with baseBackoffMS

Fixes:

• CSHARP-6125: Reject non-collection inner sequences in LINQ Join/LeftJoin

The full list of issues resolved in this release is available at CSHARP JIRA project.

Documentation on the .NET driver can be found here.

3.10.0

This is the general availability release for the 3.10.0 version of the driver.

[!IMPORTANT]

In-Use Encryption String (renamed from Text) API GA

The GA API requires mongodb server version 9.0. The preview API can continue to be used with pre-9.0 server versions.

The main new features in 3.10.0 include:

• CSHARP-6017: Support LINQ LeftJoin for joins and includes
• CSHARP-3791: Allow hint for unacknowledged writes using OP_MSG when supported by the server
• CSHARP-5826: Add $top, $bottom, $topN and $bottomN expression operators
• CSHARP-6024: Support ReadOnlySet Serialization
• CSHARP-6020: Add builders for the doesNotAffect field for in, range, equals and compound Atlas Search operators
• CSHARP-4216: Support $topN and similar accumulators in $setWindowFields
• CSHARP-5750: Add support for new QE prefix/substring/suffix aggregation expression operators
• CSHARP-5495: Support $concatArrays and $setUnion aggregation accumulators
• CSHARP-6041: Add $setWindowFields support for the $minMaxScaler window operator
• CSHARP-6091: Support checked arithmetic operators in LINQ translation
• CSHARP-5984: Add QE prefix+suffix GA and rename API to string
• CSHARP-6105: Add QE substring GA
• CSHARP-5693: Allow Instantiated MongoClients to Send Client Metadata On-Demand

Improvements:

• CSHARP-6094: Use minimum supported wire version for CompatibilityLevel when null
• CSHARP-5964: Investigate a way to read into BsonBinaryData property if it's missed in the stored document
• CSHARP-6093: Compile one-shot LINQ eval lambdas with preferInterpretation
• CSHARP-6096: Optimize AsyncCursor<> disposal to consume less resources

Fixes:

• CSHARP-5816: Insonsistent behavior of EnsureNoMemberMapConflicts for discriminator convention
• CSHARP-5740: Remove duplicate read concern for operations in snapshot sessions
• CSHARP-5846: Global GuidSerializer settings ignored for object-typed properties
• CSHARP-5658: Queries using Equals with different types throw
• CSHARP-6066: FilteredMongoCollectionBase.FindOneAndUpdate throws NullReferenceException when options is null
• CSHARP-6080: Pool clear with closeInUseConnections leaks raw ObjectDisposedException to the application instead of a retryable connection error

Maintenance:

• CSHARP-5746: Update $lookup prose test for MONGOCRYPT-793
• CSHARP-6062: Add empty permissions section to PR workflow
• CSHARP-6007: Mark Server version 4.2 as EOL from driver's PoV (Min server version as 4.4, minWireVersion as 9)
• CSHARP-5992: Add LINQ translation benchmark suite
• CSHARP-6030: Add case and diacritic sensitivity prose tests for text explicit encryption
• CSHARP-5943: Add per-area AGENTS.md files and reviewer sub-agents
• CSHARP-6071: Script to create a local Docker container with a single replica set
• CSHARP-6100: Clarify status and semver treatment for shipped IWM driver APIs

The full list of issues resolved in this release is available at CSHARP JIRA project.
... (truncated)

Commits viewable in compare view.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[dependabot]

Looks like MongoDB.Bson is updatable in another way, so this is no longer needed.