pypi / pymongo
pymongo
What changed in pymongo 4, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-22.
3 breaking4 security2 deprecations1 new APIs and options3 performance3 behavior and defaults3 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli initpymongo 419 changes
Breaking changes 3
Client-side field level encryption now rejects KMS endpoints ending in .sock.
Support for MongoDB 4.2 was dropped.
Server selection deprioritization now applies only to overload errors on replica sets.
Security 4
The release notes reference CVE-2026-106435 but provide no details about the security change.
PyMongo: PYTHON-5986 Host injection in PyMongo connection string parsing via percent-encoded delimiters
PyMongo: PYTHON-5996 Heap out-of-bounds write via signed size overflow in BSON document encoding
GridFS delete_many now matches the file ID exactly, fixing inexact matches.
Deprecations 2
PyPy support is deprecated and will be removed in a future release.
Python 2 methods in SON are deprecated.
New APIs and options 1
Added as a URI option and MongoClient keyword argument; for mongodb+srv:// connections, it allows SRV-returned hosts under a different domain suffix, provided the suffix is not a public suffix.
Performance 3
Improved MongoDB 9.0’s IWM performance by retrying overload errors only when doing so is not expected to worsen server conditions.
TLS sessions are reused across connections to the same server to improve connection performance.
BSON encoding and decoding performance improvements may benefit applications that process BSON data.
Behavior and default changes 3
General availability support was added for prefix, suffix, and substring queries against MongoDB 9.0+; requires libmongocrypt 1.20.0 or later.
Simple collation is now included in index information.
The callback type now accepts the broader Awaitable type rather than only Coroutine objects.
Fixes and other changes 3
Added support for MongoDB 9.0.
The sessions API was improved; the notes do not specify the details.
Fixes a bug that could cause AutoReconnect("connection pool paused") errors when cursors fetched more documents after SDAM heartbeat failures.