Limit recursion depth and bump dependencies

[hdm]

Summary

This PR addresses two issues:

• A BSON response with deeply nested records can trigger a runtime panic (stack overflow)
• Dependencies needed an update for security warnings

Background & Motivation

A review of the mongo-db-driver found that deeply nested BSON could consume excess resources and trigger a stack overflow. Upon creating the PR, GH complained about the dependencies being out of date.

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Adds a maximum BSON document nesting depth (100) to the value reader to prevent unbounded recursion when decoding deeply nested BSON, with accompanying tests. Also bumps the Go toolchain and several dependency versions.

Changes:

• Track per-frame nesting depth in valueReader and return errMaxDocumentNestingDepth from ReadDocument, ReadArray, and ReadCodeWithScope when depth exceeds 100.
• Add tests verifying that overly nested documents and arrays are rejected.
• Bump go directive to 1.25.0 and upgrade klauspost/compress, golang.org/x/crypto, golang.org/x/sync, and golang.org/x/text.

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated 4 comments.

File	Description
bson/value_reader.go	Adds depth field to vrState, depth-check helper, and threads depth through container/element/value reads.
bson/unmarshal_test.go	Adds two tests for rejecting over-deep document and array nesting.
go.mod	Bumps minimum Go version to 1.25.0 and upgrades several dependencies.
go.sum	Adds checksums for upgraded dependencies.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.