chore(deps): bump pymongo from 4.17.0 to 4.18.2 in /ppvm-python

[dependabot]

Bumps pymongo from 4.17.0 to 4.18.2.

Release notes

Sourced from pymongo's releases.

PyMongo 4.18.2

Community notes: https://www.mongodb.com/community/forums/t/pymongo-4-18-2-released/343732

CVE-2026-96749 CVE-2026-96748 CVE-2026-96747

PyMongo 4.18.1

Community notes: https://www.mongodb.com/community/forums/t/pymongo-4-18-1-released/343338

PyMongo 4.18.0

Community notes: https://www.mongodb.com/community/forums/t/pymongo-4-18-released/343137

Changelog

Sourced from pymongo's changelog.

Changes in Version 4.18.2 (2026/09/24)

Version 4.18.2 is a bug fix release.

• Hardened the bson buffer size guard against signed integer overflow. (CVE-2026-96749_).
• Fixed connection string parsing to percent-decode each host individually. (CVE-2026-96748_).
• Client-side field level encryption now rejects a KMS endpoint ending in .sock. (CVE-2026-96747_).

.. _CVE-2026-96749: https://www.cve.org/CVERecord?id=CVE-2026-96749 .. _CVE-2026-96748: https://www.cve.org/CVERecord?id=CVE-2026-96748 .. _CVE-2026-96747: https://www.cve.org/CVERecord?id=CVE-2026-96747

Issues Resolved ...............

See the PyMongo 4.18.2 release notes in JIRA_ for the list of resolved issues in this release.

.. _PyMongo 4.18.2 release notes in JIRA: https://jira.mongodb.org/secure/ReleaseNote.jspa?projectId=10004&version=52896

Changes in Version 4.18.1 (2026/09/10)

Version 4.18.1 is a bug fix release.

• Use an exact match for the file ID in GridFS delete methods (CVE-2026-88029_).

.. _CVE-2026-88029: https://www.cve.org/CVERecord?id=CVE-2026-88029

Changes in Version 4.18.0 (2026/09/03)

PyMongo 4.18 brings a number of changes including:

• Added srvAllowedHostsSuffix as a URI option and keyword argument to :class:~pymongo.synchronous.mongo_client.MongoClient and :class:~pymongo.asynchronous.mongo_client.AsyncMongoClient. When connecting via mongodb+srv://, this option overrides the default requirement that SRV-returned hosts share the same parent domain as the seed hostname, allowing hosts under a different domain suffix to be accepted. The suffix must not be a public suffix (per the Public Suffix List <https://publicsuffix.org/list/>_). See the :class:~pymongo.synchronous.mongo_client.MongoClient and :class:~pymongo.asynchronous.mongo_client.AsyncMongoClient documentation for security considerations.
• Dropped support for MongoDB 4.2.
• Added support for MongoDB 9.0.
• PyPy support is deprecated and will be removed in a future release.

... (truncated)

Commits

• 640dd23 Prep 4.18.2 release (#3066)
• 6a0ec65 Update changelog for CVE-2026-88029 reference (#3049)
• 44be553 BUMP 4.18.2.dev0
• 127d140 PYTHON-6085 Prep for 4.18.1 release (#3047)
• fa67658 PYTHON-5994 Use exact match for file ID in GridFS delete methods (#3046)
• 1011e57 Prep branch v4.18
• 4dd7303 PYTHON-6076 Request workflows permission in create-release-branch (#3039)
• e66da83 PYTHON-5956 Use shared python/setup action for CI setup (#2990)
• 22a2ec8 PYTHON-6021 Move _write_concern_for_cmd into BaseObject (#3036)
• 2a4a004 PYTHON-5874 Fix test_fork.py failures on Python 3.15 due to fork() Deprecatio...
• Additional commits viewable in compare view

[github-actions]

PR Preview Action v1.8.1
🚀 View preview at https://QuEraComputing.github.io/ppvm/pr-preview/pr-244/
Built to branch gh-pages at 2026-10-13 14:20 UTC. Preview will be ready when the GitHub Pages deployment is complete.