refactor(deps): move off the deprecated v1 BSON driver entirely

.claude/skills/fix-issue/findings/other/2026-10-20-exprcheck-roundtrip-test-rotted-behind-unused-tag.json

@@ -0,0 +1 @@
+{"area": "mdl/exprcheck", "date": "2026-10-20", "symptom": "`go mod tidy` could not run in the repo at all: \"finding module for package github.com/mendixlabs/mxcli/mdl/backend/mpr ... no matching versions for query latest\". Surfaced while dropping the v1 BSON driver from go.mod, which needs tidy; the workaround was `go mod edit -droprequire` plus hand-pruning go.sum", "cause": "mdl/exprcheck/roundtrip_test.go imported three things that no longer exist: mdl/backend/mpr (the legacy engine, deleted), executor.GetHierarchyForMining and executor.DescribeMicroflowToString. It never failed a build because it sat behind `//go:build roundtrip` — a tag NO Makefile target and no CI job ever passes, and the only file in the tree that uses it. go mod tidy considers every build tag, so it was the one command that still saw the file", "file": "`mdl/exprcheck/roundtrip_test.go` deleted; ported to `mdl/executor/exprcheck_roundtrip_test.go` under the `integration` tag", "insight": "A build tag nothing runs is not a disabled test, it is a deleted test that still looks present — `grep -rl 'go:build <tag>'` returning exactly one file, with no Makefile target naming that tag, is the signal. This one rotted through the legacy-engine deletion AND two executor API removals without a single red build, and the only thing that ever noticed was `go mod tidy`, whose failure reads as a module-resolution problem rather than a dead test. So when tidy complains about a package that was deliberately deleted, look for a test behind an orphan tag, not for a dependency problem. Porting beat deleting: the assertion (describe every microflow, re-parse each expression, expect zero hints from the robust parser) covers grammar gaps the unit tests cannot, since they only feed the parser expressions someone thought to write. Port target is `package executor` under the `integration` tag, where setupTestEnv/describeMDL already provide the real-project harness and `make test-integration-executor` actually runs it; the import cycle the original file's header warned about does not arise in that direction, because mdl/exprcheck does not import mdl/executor. The removed executor.GetHierarchyForMining is replaced by building the containerID->module-name map from backend.ListModules(). Two vacuity guards matter here because the fixture project lives in a separate repo (mx-test-projects/) and TestMain SKIPS the whole suite when it is absent: assert the microflow count is non-zero and the expression-slot count is non-zero, or an empty fixture passes silently. After the port, `go mod tidy` ran clean and pruned 35 more stale go.sum lines than the hand-edit had", "refs": ["ako/mxcli#1497"]}

.claude/skills/fix-issue/findings/other/2026-10-20-mongo-driver-v1-to-v2-migration.json

@@ -0,0 +1 @@
+{"area": "modelsdk/bsoncompat", "date": "2026-10-20", "symptom": "go.mongodb.org/mongo-driver v1 stayed on a customer's blocking dependency scan (CVE-2026-107325) with no fix available on the v1 line ever — v1.17.10 is its last release and the module is deprecated. Dropping it meant moving 107 non-test and 179 test files off v1 bson, through the BSON serialization core", "cause": "v1 and v2 decode nested documents into DIFFERENT Go types, and the type assertions mxcli reads them back with were written against v1. Measured on identical bytes: destination bson.D nests primitive.D under v1 and bson.D under v2 (equivalent, no action); destination bson.M nests primitive.M under v1 and bson.D under v2 (BREAKS `doc[k].(bson.M)`); destination map[string]any nests map[string]any under v1 and bson.D under v2 (BREAKS `doc[k].(map[string]any)`). A failed type assertion is not an error, so the value is silently dropped and the next write emits a document with a property missing — unmergeable in Studio Pro (canon.CompletePropertySets, #1373). v2 also removed bson.D.Map()", "file": "`modelsdk/bsoncompat/unmarshal.go` (new leaf package: UnmarshalDocM, UnmarshalDocMap, DMap), 294 files repointed at v2, `go.mod`/`go.sum` v1 requirement dropped", "insight": "Do NOT audit the type assertions — 618 of them in the migrated files, and a wrong one compiles clean. v2's decoder already has the switch: `Decoder.DefaultDocumentM()` restores v1's nested-bson.M and `DefaultDocumentMap()` restores v1's nested-map[string]any, both at every depth including inside arrays. That turns a 1-2 day assertion audit into 2 helpers plus 73 mechanical call-site swaps (39 bson.M destinations + 34 map[string]any), found by grepping each file for how its Unmarshal target was DECLARED, not by reading the call. The two helpers are NOT interchangeable: bson.M is a named type (type M map[string]any), so a bson.M value fails `.(map[string]any)` and vice versa — mdl/executor's TestResolveWebServiceName_ReadsMapDecodedDocuments exists because that exact confusion already cost a debugging round, and it caught this migration too (it pins its own precondition, so it reports \"this test no longer pins the trap it was written for\" rather than passing vacuously — copy that pattern). bson.D destinations need NO helper, and applying one there re-introduces the bug inverted. Placement is load-bearing: the helpers cannot live in modelsdk/codec, which imports modelsdk/mpr, which imports canon and meta — whose own tests then could not import codec (\"import cycle not allowed in test\"); a leaf package depending only on the driver is the only placement every layer can use. Mechanically: the rewrite is a script (284 files in minutes), and the only real breakage is files that imported BOTH drivers with v2 aliased — they end up with two identical imports. Guard against regression with a test that walks the tree for the v1 import AND reads go.mod, since re-adding either is not a build error; verified by control (names the file and the go.mod line). go mod tidy cannot run in this repo at all — mdl/exprcheck/roundtrip_test.go, //go:build roundtrip, imports the long-deleted mdl/backend/mpr — so the requirement was dropped with `go mod edit -droprequire` plus a manual go.sum prune, proven by `go version -m bin/mxcli` showing only v2", "refs": ["CVE-2026-107325", "ako/mxcli#1372", "ako/mxcli#1493", "mendixlabs/mxcli#1373"]}

CHANGELOG.md

@@ -6,6 +6,16 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+### Fixed
+
+- **`go mod tidy` runs again, and the expression round-trip test runs for the first time** — `mdl/exprcheck/roundtrip_test.go` imported `mdl/backend/mpr` (the legacy engine, deleted) plus `executor.GetHierarchyForMining` and `executor.DescribeMicroflowToString` (both removed). It never broke a build because it sat behind `//go:build roundtrip`, a tag no Makefile target and no CI job has ever passed — the only file in the tree using it. `go mod tidy` considers every build tag, so it was the one command that still saw the file, and it failed with "no matching versions for query latest" on the deleted package, which reads as a dependency problem rather than a dead test. The test is ported to `mdl/executor/exprcheck_roundtrip_test.go` under the `integration` tag, where `setupTestEnv`/`describeMDL` already provide the real-project harness and `make test-integration-executor` actually runs it; the removed hierarchy helper is replaced by building the container-to-module map from `backend.ListModules()`. Its assertion is worth keeping: describing every microflow and re-parsing each expression with the robust parser catches grammar gaps — a missing `parsePrimary` branch, a missing `funcTable` entry, a missing slot constraint — that the unit tests cannot, since those only feed the parser expressions someone thought to write down. It now also fails rather than passing silently when the fixture project yields no microflows or no expression slots.
+
+### Security
+
+- **The deprecated v1 BSON driver is gone: mxcli runs on `mongo-driver/v2` alone** — `go.mongodb.org/mongo-driver` v1.17.10 is removed from `go.mod`, and `go version -m bin/mxcli` now lists only `mongo-driver/v2 v2.9.2`. It was the last component left on a customer's blocking dependency scan, flagged for CVE-2026-107325, which **has no fix on the v1 line and never will** — v1.17.10 is that line's final release and the module is marked deprecated, so no upgrade could ever have cleared it. mxcli was never exposed (the panic is in `bsoncore.Array.Validate`, which no file imported), but the finding would have recurred on every scan.
+- **New `modelsdk/bsoncompat` — the decode shims that make v2 read like v1** — the two drivers decode nested documents into *different Go types*, and mxcli's type assertions were written against v1's. Measured on identical bytes: a `bson.D` destination nests `primitive.D` under v1 and `bson.D` under v2 (equivalent); a `bson.M` destination nests `primitive.M` under v1 but `bson.D` under v2; a `map[string]any` destination nests `map[string]any` under v1 but `bson.D` under v2. The last two silently break a `doc["Key"].(bson.M)` read — a failed type assertion is not an error, so the value is dropped and the next write emits a document with a property missing, which Studio Pro refuses to merge (the `canon.CompletePropertySets` class, mendixlabs/mxcli#1373). `UnmarshalDocM` and `UnmarshalDocMap` restore v1's shape at every depth, arrays included; `DMap` replaces the `bson.D.Map()` method v2 removed. The two Unmarshal helpers are **not** interchangeable — `bson.M` is a named type, so a `bson.M` value does not satisfy `.(map[string]any)` — and a `bson.D` destination needs neither, since applying one there re-introduces the bug inverted. All three shapes are pinned by tests that fail loudly if a future driver release makes a helper unnecessary, rather than passing vacuously.
+- **A guard keeps v1 from coming back** — `TestNoV1DriverImports` walks the tree for the v1 import path and `TestGoModDoesNotRequireV1Driver` reads `go.mod`, because re-adding either is not a build error and nothing else would notice until the next dependency scan. Verified by control: both name the offending file and the offending `go.mod` line.
+
 ### Security
 
 - **Dependency scan follow-up: `klauspost/compress` and `go-mssqldb` raised to their fixed versions** — `github.com/klauspost/compress` v1.19.2 -> v1.20.3 and `github.com/microsoft/go-mssqldb` v1.10.0 -> v1.11.2. A second scan of the published `.exe`, run after the mongo-driver upgrade, still blocked the release. `klauspost/compress` v1.19.2 predates GHSA-fpmh-frq8-7rj8 (a zstd `DecodeAll` crash on crafted input, fixed in v1.20.2) — the earlier upgrade had only raised it to whatever `mongo-driver/v2` declared, which is not a security floor; it is now an explicit requirement. As before, that module is compiled into no mxcli build (no `go.sum` entry, no `go version -m` line), so the bump moves only the requirement graph the scanner reads. `go-mssqldb` is a blank import in `sql/drivers.go` for driver registration and mxcli calls none of its API, so the bump has no API surface; `TestExternalDriversRegistered` now pins that contract, which had no coverage, and fails with `driver "sqlserver" is not registered` when the import is dropped.

cmd/bsondump/main.go

@@ -5,9 +5,10 @@ package main
 
 import (
 	"fmt"
+	"github.com/mendixlabs/mxcli/modelsdk/bsoncompat"
 	"os"
 
-	"go.mongodb.org/mongo-driver/bson"
+	"go.mongodb.org/mongo-driver/v2/bson"
 )
 
 func main() {
@@ -21,7 +22,7 @@ func main() {
 		os.Exit(1)
 	}
 	var doc bson.M
-	if err := bson.Unmarshal(data, &doc); err != nil {
+	if err := bsoncompat.UnmarshalDocM(data, &doc); err != nil {
 		fmt.Fprintln(os.Stderr, err)
 		os.Exit(1)
 	}

cmd/check_bson/main.go

@@ -8,7 +8,7 @@ import (
 	"fmt"
 	"os"
 
-	"go.mongodb.org/mongo-driver/bson"
+	"go.mongodb.org/mongo-driver/v2/bson"
 	_ "modernc.org/sqlite"
 )
 

cmd/compare_pages/main.go

@@ -8,7 +8,7 @@ import (
 	"os"
 	"strings"
 
-	"go.mongodb.org/mongo-driver/bson"
+	"go.mongodb.org/mongo-driver/v2/bson"
 )
 
 func main() {

cmd/debug/main.go

@@ -6,10 +6,11 @@ import (
 	"database/sql"
 	"encoding/json"
 	"fmt"
+	"github.com/mendixlabs/mxcli/modelsdk/bsoncompat"
 	"os"
 	"path/filepath"
 
-	"go.mongodb.org/mongo-driver/bson"
+	"go.mongodb.org/mongo-driver/v2/bson"
 	_ "modernc.org/sqlite"
 )
 
@@ -46,7 +47,7 @@ func main() {
 	}
 
 	var doc bson.M
-	if err := bson.Unmarshal(content, &doc); err != nil {
+	if err := bsoncompat.UnmarshalDocM(content, &doc); err != nil {
 		fmt.Fprintf(os.Stderr, "Failed to unmarshal BSON: %v\n", err)
 		os.Exit(1)
 	}

cmd/dump_page/main.go

@@ -10,7 +10,7 @@ import (
 	"path/filepath"
 	"strings"
 
-	"go.mongodb.org/mongo-driver/bson"
+	"go.mongodb.org/mongo-driver/v2/bson"
 )
 
 func main() {

cmd/extract_page/main.go

@@ -9,7 +9,7 @@ import (
 	"os"
 	"strings"
 
-	"go.mongodb.org/mongo-driver/bson"
+	"go.mongodb.org/mongo-driver/v2/bson"
 	_ "modernc.org/sqlite"
 )
 

cmd/mxcli/bson/render.go

@@ -5,8 +5,7 @@ import (
 	"sort"
 	"strings"
 
-	"go.mongodb.org/mongo-driver/bson"
-	"go.mongodb.org/mongo-driver/bson/primitive"
+	"go.mongodb.org/mongo-driver/v2/bson"
 )
 
 // Render converts a bson.D document to Normalized DSL text.
@@ -65,7 +64,7 @@ func renderField(sb *strings.Builder, key string, val any, indent int) {
 	case nil:
 		fmt.Fprintf(sb, "%s%s: null\n", pad, key)
 
-	case primitive.Binary:
+	case bson.Binary:
 		fmt.Fprintf(sb, "%s%s: <uuid>\n", pad, key)
 
 	case bson.D:

cmd/mxcli/bson/render_test.go

@@ -3,8 +3,7 @@ package bson
 import (
 	"testing"
 
-	"go.mongodb.org/mongo-driver/bson"
-	"go.mongodb.org/mongo-driver/bson/primitive"
+	"go.mongodb.org/mongo-driver/v2/bson"
 )
 
 func TestRenderScalarFields(t *testing.T) {
@@ -27,8 +26,8 @@ func TestRenderScalarFields(t *testing.T) {
 func TestRenderUUIDNormalized(t *testing.T) {
 	doc := bson.D{
 		{Key: "$Type", Value: "Workflows$Flow"},
-		{Key: "$ID", Value: primitive.Binary{Subtype: 3, Data: []byte("anything")}},
-		{Key: "PersistentId", Value: primitive.Binary{Subtype: 3, Data: []byte("anything")}},
+		{Key: "$ID", Value: bson.Binary{Subtype: 3, Data: []byte("anything")}},
+		{Key: "PersistentId", Value: bson.Binary{Subtype: 3, Data: []byte("anything")}},
 	}
 	got := Render(doc, 0)
 	want := `Workflows$Flow

cmd/mxcli/cmd_bson_discover.go

@@ -4,10 +4,11 @@ import (
 	"fmt"
 	"os"
 
+	"github.com/mendixlabs/mxcli/modelsdk/bsoncompat"
+
 	bsondiscover "github.com/mendixlabs/mxcli/cmd/mxcli/bson"
 	mpr "github.com/mendixlabs/mxcli/modelsdk/mpr"
 	"github.com/spf13/cobra"
-	"go.mongodb.org/mongo-driver/bson"
 )
 
 // discoverCmd is the "bson discover" subcommand for field coverage analysis.
@@ -96,7 +97,7 @@ func runDiscover(cmd *cobra.Command, args []string) {
 // unmarshalBsonFields parses raw BSON bytes into a map.
 func unmarshalBsonFields(contents []byte) (map[string]any, error) {
 	var fields map[string]any
-	if err := bson.Unmarshal(contents, &fields); err != nil {
+	if err := bsoncompat.UnmarshalDocMap(contents, &fields); err != nil {
 		return nil, err
 	}
 	return fields, nil

cmd/mxcli/cmd_bson_dump.go

@@ -11,7 +11,7 @@ import (
 	bsondebug "github.com/mendixlabs/mxcli/cmd/mxcli/bson"
 	mpr "github.com/mendixlabs/mxcli/modelsdk/mpr"
 	"github.com/spf13/cobra"
-	"go.mongodb.org/mongo-driver/bson"
+	"go.mongodb.org/mongo-driver/v2/bson"
 )
 
 var bsonDumpCmd = &cobra.Command{

cmd/mxcli/cmd_extract_templates.go

@@ -10,8 +10,7 @@ import (
 	"strings"
 
 	"github.com/spf13/cobra"
-	"go.mongodb.org/mongo-driver/bson"
-	"go.mongodb.org/mongo-driver/bson/primitive"
+	"go.mongodb.org/mongo-driver/v2/bson"
 )
 
 var extractTemplatesCmd = &cobra.Command{
@@ -181,7 +180,7 @@ func convertBsonValue(v any) any {
 			arr[i] = convertBsonValue(item)
 		}
 		return arr
-	case primitive.Binary:
+	case bson.Binary:
 		// Convert binary IDs to hex strings
 		return fmt.Sprintf("%x", val.Data)
 	case []byte:

cmd/mxcli/docker/harvest_test.go

@@ -23,7 +23,7 @@ import (
 
 	"github.com/mendixlabs/mxcli/mdl/types"
 	"github.com/mendixlabs/mxcli/model"
-	"go.mongodb.org/mongo-driver/bson"
+	"go.mongodb.org/mongo-driver/v2/bson"
 )
 
 // stubMxTool swaps the mx invocation for the duration of a test.

cmd/mxcli/marketplace/identity.go

@@ -11,8 +11,7 @@ import (
 	"github.com/mendixlabs/mxcli/mdl/backend"
 	"github.com/mendixlabs/mxcli/mdl/types"
 	"github.com/mendixlabs/mxcli/model"
-	"go.mongodb.org/mongo-driver/bson"
-	"go.mongodb.org/mongo-driver/bson/primitive"
+	"go.mongodb.org/mongo-driver/v2/bson"
 )
 
 // Identities maps an element's path within its module to the `GUID` the stored
@@ -119,7 +118,7 @@ func nameAndGUID(d bson.D) (name string, guid []byte, hasGUID bool) {
 				name = s
 			}
 		case "GUID":
-			if b, ok := e.Value.(primitive.Binary); ok && len(b.Data) > 0 {
+			if b, ok := e.Value.(bson.Binary); ok && len(b.Data) > 0 {
 				guid, hasGUID = b.Data, true
 			}
 		}
@@ -286,9 +285,9 @@ func applyIdentities(v any, trail []string, ids Identities, placed map[string]bo
 						if e.Key != "GUID" {
 							continue
 						}
-						b := e.Value.(primitive.Binary)
+						b := e.Value.(bson.Binary)
 						if !bytesEqual(b.Data, want) {
-							t[i].Value = primitive.Binary{Subtype: b.Subtype, Data: append([]byte{}, want...)}
+							t[i].Value = bson.Binary{Subtype: b.Subtype, Data: append([]byte{}, want...)}
 							changed++
 						}
 						break

cmd/mxcli/marketplace/security_test.go

@@ -11,7 +11,7 @@ import (
 
 	modelsdk "github.com/mendixlabs/mxcli"
 	"github.com/mendixlabs/mxcli/mdl/backend"
-	"go.mongodb.org/mongo-driver/bson"
+	"go.mongodb.org/mongo-driver/v2/bson"
 )
 
 // This ran over both engines while the legacy sdk/mpr writer existed, because

cmd/mxcli/marketplace/theme.go

@@ -11,7 +11,7 @@ import (
 
 	modelsdk "github.com/mendixlabs/mxcli"
 	"github.com/mendixlabs/mxcli/internal/zipentry"
-	"go.mongodb.org/mongo-driver/bson"
+	"go.mongodb.org/mongo-driver/v2/bson"
 )
 
 // packageProjectEntry is the full model of the module being published, carried

cmd/mxcli/marketplace/update.go

@@ -15,7 +15,7 @@ import (
 	modelsdk "github.com/mendixlabs/mxcli"
 	"github.com/mendixlabs/mxcli/internal/zipentry"
 	"github.com/mendixlabs/mxcli/mdl/backend"
-	"go.mongodb.org/mongo-driver/bson"
+	"go.mongodb.org/mongo-driver/v2/bson"
 )
 
 // SaveEdits writes each locally modified element's current definition to dir as

examples/compare_bson/main.go

@@ -8,7 +8,7 @@ import (
 	"os"
 	"path/filepath"
 
-	"go.mongodb.org/mongo-driver/bson"
+	"github.com/mendixlabs/mxcli/modelsdk/bsoncompat"
 )
 
 func main() {
@@ -33,7 +33,7 @@ func main() {
 	}
 
 	var raw map[string]any
-	if err := bson.Unmarshal(data, &raw); err != nil {
+	if err := bsoncompat.UnmarshalDocMap(data, &raw); err != nil {
 		fmt.Printf("Error unmarshaling BSON: %v\n", err)
 		os.Exit(1)
 	}

examples/compare_datagrid2/main.go

@@ -13,8 +13,7 @@ import (
 	"strings"
 
 	modelsdkbackend "github.com/mendixlabs/mxcli/mdl/backend/modelsdk"
-	"go.mongodb.org/mongo-driver/bson"
-	"go.mongodb.org/mongo-driver/bson/primitive"
+	"go.mongodb.org/mongo-driver/v2/bson"
 )
 
 func main() {
@@ -489,10 +488,10 @@ func getTypePointerString(prop map[string]any) string {
 		return "<nil>"
 	}
 	switch t := tp.(type) {
-	case primitive.Binary:
+	case bson.Binary:
 		return base64.StdEncoding.EncodeToString(t.Data)
 	case map[string]any:
-		if data, ok := t["Data"].(primitive.Binary); ok {
+		if data, ok := t["Data"].(bson.Binary); ok {
 			return base64.StdEncoding.EncodeToString(data.Data)
 		}
 	}

examples/debug_bson/main.go

@@ -9,7 +9,8 @@ import (
 	"fmt"
 	"os"
 
-	"go.mongodb.org/mongo-driver/bson"
+	"github.com/mendixlabs/mxcli/modelsdk/bsoncompat"
+
 	_ "modernc.org/sqlite"
 )
 
@@ -48,7 +49,7 @@ func main() {
 		rows.Scan(&unitID, &containerID, &containmentName, &contents)
 
 		var raw map[string]any
-		if err := bson.Unmarshal(contents, &raw); err != nil {
+		if err := bsoncompat.UnmarshalDocMap(contents, &raw); err != nil {
 			continue
 		}
 

examples/debug_enum/main.go

@@ -5,11 +5,12 @@ package main
 import (
 	"database/sql"
 	"fmt"
+	"github.com/mendixlabs/mxcli/modelsdk/bsoncompat"
 	"os"
 	"path/filepath"
 	"reflect"
 
-	"go.mongodb.org/mongo-driver/bson"
+	"go.mongodb.org/mongo-driver/v2/bson"
 	_ "modernc.org/sqlite"
 )
 
@@ -47,7 +48,7 @@ func main() {
 		}
 
 		var raw map[string]any
-		if err := bson.Unmarshal(data, &raw); err != nil {
+		if err := bsoncompat.UnmarshalDocMap(data, &raw); err != nil {
 			continue
 		}
 

examples/debug_modules/main.go

@@ -9,7 +9,8 @@ import (
 	"os"
 	"path/filepath"
 
-	"go.mongodb.org/mongo-driver/bson"
+	"github.com/mendixlabs/mxcli/modelsdk/bsoncompat"
+
 	_ "modernc.org/sqlite"
 )
 
@@ -49,7 +50,7 @@ func main() {
 		}
 
 		var raw map[string]any
-		if err := bson.Unmarshal(data, &raw); err != nil {
+		if err := bsoncompat.UnmarshalDocMap(data, &raw); err != nil {
 			continue
 		}