Merge v2.4 into v2.x

[mongodb-drivers-pr-bot]

Merge new changes from v2.4 into v2.x.

Commits

• Merge v2.3 into v2.4 (Merge v2.3 into v2.4 #1964): cbc3387
• Resolve conflicts in v2.4: 4129f61
• Merge v1.21 into v2.3 (Merge v1.21 into v2.3 #1962): 0e85af5
• Resolve conflicts in v2.3: 29ce890
• Update automatic merge up action and evergreen submodule (Update automatic merge up action and evergreen submodule #1958): f9363da

Resolving conflicts

To resolve any conflicts, check out the temporary branch and run the following command:

git merge v2.x -m "Resolve conflicts in v2.x"

Ignoring changes

To ignore from the remote branch, first reset the temporary branch to v2.x and manually merge using the `ours` merge strategy:

git reset --hard v2.x
git merge --strategy=ours v2.4 -m "Ignore changes from v2.4"

Then, push the temporary branch to update the pull request.

[semgrep-code-mongodb]

Semgrep identified an issue in your code:

alcaeus/automatic-merge-up-action@1.1.0 points to a mutable tag, so this workflow can start running different action code without any change here. If that tag is repointed, the new code would run with write access to contents, pull requests, and OIDC tokens.

More details about this

Create pull request runs alcaeus/automatic-merge-up-action@1.1.0, which is a mutable tag rather than a specific commit. If the action owner or anyone who compromises that repository moves 1.1.0 to a different commit, this workflow will silently run the new code with this job’s id-token: write, contents: write, and pull-requests: write permissions.

A plausible attack looks like this:

1. An attacker gains control of the alcaeus/automatic-merge-up-action repository or its release process.
2. They repoint the 1.1.0 tag to a commit that adds a malicious step inside the action.
3. The next push to a branch matching v[0-9]+.[0-9x]+ triggers this merge-up job.
4. When uses: alcaeus/automatic-merge-up-action@1.1.0 runs, GitHub fetches the attacker’s new commit instead of the code originally reviewed.
5. That malicious action can read inputs like ref: ${{ github.ref_name }} and then misuse the job token and granted permissions to push code, open or modify pull requests, or mint an OIDC token from id-token: write for follow-on access.

Because the reference is @1.1.0 instead of a full 40-character commit SHA, the exact code executed by this workflow can change without any change in this repository.

To resolve this comment:

✨ Commit fix suggestion

1. Replace the mutable action reference with a full 40-character commit SHA in the uses line.
   Change uses: alcaeus/automatic-merge-up-action@1.1.0 to uses: alcaeus/automatic-merge-up-action@<full-40-character-commit-sha>.

2. Keep the human-readable version as an inline comment so the pinned revision is easier to maintain, for example uses: alcaeus/automatic-merge-up-action@<sha> # v1.1.0.

3. Resolve the SHA from the exact upstream release you intend to trust, and make sure it is the commit for 1.1.0, not a branch or shortened hash. Pinning to a commit prevents the action owner from silently moving the referenced version later.

Alternatively, if you control the action code and want to avoid third-party pinning, replace the external action with a local action reference such as uses: ./.github/actions/<action-name>.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

• /fp <comment> for false positive
• /ar <comment> for acceptable risk
• /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by github-actions-mutable-action-tag.

🛟 Help? Slack #semgrep-help or go/semgrep-help.

Resolution Options:

• Fix the code
• Reply /fp $reason (if security gap doesn’t exist)
• Reply /ar $reason (if gap is valid but intentional; add mitigations/monitoring)
• Reply /other $reason (e.g., test-only)

_{You can view more details about this finding in the Semgrep AppSec Platform.}

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!