Bump MongoDB.Driver past 3.9.0 so C#MS stop shipping vulnerable Snappier 1.0.0 and SharpCompress 0.30.1

[mhijaziB]

Problem

Beamable.Microservice.Runtime pins MongoDB.Driver 3.3.0 (since #4057, May 2025). That driver version depends on two packages that picked up advisories in May 2026:

Transitive package	Advisory	Severity	First patched
Snappier 1.0.0	GHSA-pggp-6c3x-2xmx / CVE-2026-44302	High	1.3.1
SharpCompress 0.30.1	GHSA-6c8g-7p36-r338 / CVE-2026-44788	Moderate	0.48.0

Chain:

Beamable.Microservice.Runtime
├── MongoDB.Driver 3.3.0
│   ├── Snappier 1.0.0
│   └── SharpCompress 0.30.1
└── Beamable.Tooling.Common
    └── MongoDB.Driver.Core.Extensions.DiagnosticSources 2.0.0
        └── MongoDB.Driver (>= 3.3.0)

Impact

Every customer C#MS shows both warnings in Rider and in dotnet list package --vulnerable --include-transitive. Reported by Barnstorm on 2 Sep 2026.

Real exposure is small. Snappier's bug is an infinite loop on a malformed framed Snappy stream, and SharpCompress's is zip-slip in WriteToDirectory. The driver only uses either for wire-protocol compression against the customer's own Mongo instance and never extracts archives. We should still fix it, because "trust us, unreachable" is not a great answer to a security scanner.

Fix

Bump MongoDB.Driver in microservice/microservice/microservice.csproj to 3.9.0 or later. Per the driver's release history, 3.8.1 lifted Snappier to 1.3.1 and 3.9.0 lifted SharpCompress to 0.48.1. Latest stable at time of writing is 3.11.1.

Check that MongoDB.Driver.Core.Extensions.DiagnosticSources 2.0.0 still restores cleanly against the new driver. It declares a >= floor so it should, but that is the one place a bump could bite.

The risk: 3.3 to 3.9+ crosses several driver minors. Read the driver changelogs for behavior changes in serialization defaults and LINQ, and run the storage-object tests against a real local Mongo before shipping.

Proof to close

• dotnet list package --vulnerable --include-transitive on a fresh beam project new service shows neither Snappier nor SharpCompress.
• Storage object integration tests pass.
• A deployed service with a StorageObject reads and writes correctly on Beamable cloud.