Merge pull request #1142 from percona/RN-6.0.29-23

RN-6.0.29-23

Author: rasika-chivate

docs/_templates/pdf_cover_page.tpl

@@ -3,11 +3,11 @@
 <p>
 <img src="_images/Percona_Logo_Color.png" />
 </p>
-<h1>Server for MongoDB 6.0.28-22</h1>
+<h1>Server for MongoDB 6.0.29-23</h1>
 {% if config.site_description %}
 <h1>{{ config.site_description }}</h1>
 {% endif %} 
-<h2>6.0.28-22 (May 26, 2026)</h2>
+<h2>6.0.29-23 (June 24, 2026)</h2>
 <br>
 <br>
 <br>

docs/release_notes/6.0.29-23.md

@@ -0,0 +1,33 @@
+version: 6.0.29-23
+---
+
+# Percona Server for MongoDB {{ page.meta.version }} ({{date.6_0_29}})
+
+[Installation](../install/index.md){.md-button}
+[Upgrade from MongoDB Community](../install/upgrade-from-mongodb.md){.md-button}
+
+Percona Server for MongoDB {{ page.meta.version }} is an enhanced, source-available, and highly-scalable database that is a fully-compatible, drop-in replacement for MongoDB Community Edition.
+
+Percona Server for MongoDB **{{ page.meta.version }}** includes the updates from [MongoDB 6.0.29 Community Edition :octicons-link-external-16:](https://www.mongodb.com/docs/v6.0/release-notes/6.0-changelog/#6.0.29-changelog){:target="_blank"}. It also supports the protocols and drivers of MongoDB Community **6.0.29**.
+
+## Upgrade recommendation
+
+This release contains a **high-severity security fix** affecting all Percona Server for MongoDB 6.0.x versions. We strongly recommend **upgrading to version {{ page.meta.version }}** as soon as possible.
+
+## Security update
+
+- [SERVER-128125 :octicons-link-external-16:](https://jira.mongodb.org/browse/SERVER-128125){:target="_blank"} **(CVE-2026-11933):** A **use-after-free** vulnerability was identified in MongoDB Server’s server-side JavaScript engine when converting `BSON` documents to JavaScript arrays. An authenticated user with read privileges who can execute server-side JavaScript (e.g., via `$where` or `$function`) may trigger access to freed memory, which could result in information disclosure from the `mongod` process memory or a denial of service through a server crash.
+
+## Tools packaged with this release
+
+Percona repackages the upstream MongoDB Shell (`mongosh`) as `percona-mongodb-mongosh`, updating all copyright, authorship, and branding under the full product name "Percona MongoDB Shell." 
+
+Percona also repackages and patches Mongo Tools. In this release, we've updated embedded Go libraries in the `mongodump` binary to address 15 security (severity from medium to critical) vulnerabilities:
+
+- `golang.org/x/crypto` updated from **v0.45.0** to **v0.52.0** — fixes [CVE-2026-39827 :octicons-link-external-16:](https://nvd.nist.gov/vuln/detail/CVE-2026-39827){:target="_blank"}, [CVE-2026-39828 :octicons-link-external-16:](https://nvd.nist.gov/vuln/detail/CVE-2026-39828){:target="_blank"}, [CVE-2026-39829 :octicons-link-external-16:](https://nvd.nist.gov/vuln/detail/CVE-2026-39829){:target="_blank"}, [CVE-2026-39830 :octicons-link-external-16:](https://nvd.nist.gov/vuln/detail/CVE-2026-39830){:target="_blank"}, [CVE-2026-39835 :octicons-link-external-16:](https://nvd.nist.gov/vuln/detail/CVE-2026-39835){:target="_blank"}, [CVE-2026-42508 :octicons-link-external-16:](https://nvd.nist.gov/vuln/detail/CVE-2026-42508){:target="_blank"}, [CVE-2026-46595 :octicons-link-external-16:](https://nvd.nist.gov/vuln/detail/CVE-2026-46595){:target="_blank"}, [CVE-2026-46597 :octicons-link-external-16:](https://nvd.nist.gov/vuln/detail/CVE-2026-46597){:target="_blank"}
+- `golang.org/x/net` updated from **v0.47.0** to **v0.55.0** — fixes [CVE-2026-25680 :octicons-link-external-16:](https://nvd.nist.gov/vuln/detail/CVE-2026-25680){:target="_blank"}, [CVE-2026-25681 :octicons-link-external-16:](https://nvd.nist.gov/vuln/detail/CVE-2026-25681){:target="_blank"}, [CVE-2026-27136 :octicons-link-external-16:](https://nvd.nist.gov/vuln/detail/CVE-2026-27136){:target="_blank"}, [CVE-2026-33814 :octicons-link-external-16:](https://nvd.nist.gov/vuln/detail/CVE-2026-33814){:target="_blank"}, [CVE-2026-39821 :octicons-link-external-16:](https://nvd.nist.gov/vuln/detail/CVE-2026-39821){:target="_blank"}, [CVE-2026-42502 :octicons-link-external-16:](https://nvd.nist.gov/vuln/detail/CVE-2026-42502){:target="_blank"}, [CVE-2026-42506 :octicons-link-external-16:](https://nvd.nist.gov/vuln/detail/CVE-2026-42506){:target="_blank"}
+
+| **Tool** | **Base version** | **Release notes** |
+|---|---|---|
+| MongoDB Shell (`mongosh`) | 2.8.3 | [upstream release notes :octicons-link-external-16:](https://www.mongodb.com/docs/mongodb-shell/changelog/#v2.8.3){:target="_blank"} |
+| Mongo Tools | 100.17.0 | [upstream release notes :octicons-link-external-16:](https://www.mongodb.com/docs/database-tools/release-notes/dbtools-100.17.0-changelog/){:target="_blank"} |

docs/release_notes/index.md

@@ -1,5 +1,7 @@
 # Percona Server for MongoDB 6.0 Release Notes
 
+* [Percona Server for MongoDB 6.0.29-23 ({{date.6_0_29}})](6.0.29-23.md)
+
 * [Percona Server for MongoDB 6.0.28-22 ({{date.6_0_28}})](6.0.28-22.md)
 
 * [Percona Server for MongoDB 6.0.27-21 ({{date.6_0_27}})](6.0.27-21.md)

mkdocs-base.yml

@@ -228,6 +228,7 @@ nav:
       - install/uninstall.md
   - Release notes:
       - "Release notes index": "release_notes/index.md"
+      - release_notes/6.0.29-23.md
       - release_notes/6.0.28-22.md
       - release_notes/6.0.27-21.md
       - release_notes/6.0.25-20.md

variables.yml

@@ -1,14 +1,15 @@
 # PBM Variables set for HTML output
 # See also mkdocs.yml plugins.with-pdf.cover_subtitle and output_path
 
-release: '6.0.28-22'
+release: '6.0.29-23'
 version: '6.0'
 mongosh: '2.8.3'
 
 product:
   psmdb_full_name:  Percona Server for MongoDB
 
 date:
+  6_0_29: '2026-06-24'
   6_0_28: '2026-05-26'
   6_0_27: '2026-01-12'
   6_0_25: '2025-07-30'