Bump github.com/xdg-go/scram from 1.1.2 to 1.2.0

[dependabot]

Bumps github.com/xdg-go/scram from 1.1.2 to 1.2.0.

Release notes

Sourced from github.com/xdg-go/scram's releases.

v1.2.0

Added

• Channel binding support for SCRAM-PLUS variants (RFC 5929, RFC 9266)
• GetStoredCredentialsWithError() method that returns errors from PBKDF2 key derivation instead of panicking.
• Support for Go 1.24+ stdlib crypto/pbkdf2 package, which provides FIPS 140-3 compliance when using SHA-256 or SHA-512 hash functions.

Changed

• Minimum Go version bumped from 1.11 to 1.18.
• Migrated from github.com/xdg-go/pbkdf2 to stdlib crypto/pbkdf2 on Go 1.24+. Legacy Go versions (<1.24) continue using the external library via build tags for backward compatibility.
• Internal error handling improved for PBKDF2 key derivation failures.

Deprecated

• GetStoredCredentials() is deprecated in favor of GetStoredCredentialsWithError(). The old method panics on PBKDF2 errors to maintain backward compatibility but will be removed in a future major version.

Notes

• FIPS 140-3 compliance is available on Go 1.24+ when using SCRAM-SHA-256 or SCRAM-SHA-512 with appropriate salt lengths (≥16 bytes). SCRAM-SHA-1 is not FIPS-approved.

Changelog

Sourced from github.com/xdg-go/scram's changelog.

v1.2.0 - 2025-11-24

Added

• Channel binding support for SCRAM-PLUS variants (RFC 5929, RFC 9266)
• GetStoredCredentialsWithError() method that returns errors from PBKDF2 key derivation instead of panicking.
• Support for Go 1.24+ stdlib crypto/pbkdf2 package, which provides FIPS 140-3 compliance when using SHA-256 or SHA-512 hash functions.

Changed

• Minimum Go version bumped from 1.11 to 1.18.
• Migrated from github.com/xdg-go/pbkdf2 to stdlib crypto/pbkdf2 on Go 1.24+. Legacy Go versions (<1.24) continue using the external library via build tags for backward compatibility.
• Internal error handling improved for PBKDF2 key derivation failures.

Deprecated

• GetStoredCredentials() is deprecated in favor of GetStoredCredentialsWithError(). The old method panics on PBKDF2 errors to maintain backward compatibility but will be removed in a future major version.

Notes

• FIPS 140-3 compliance is available on Go 1.24+ when using SCRAM-SHA-256 or SCRAM-SHA-512 with appropriate salt lengths (≥16 bytes). SCRAM-SHA-1 is not FIPS-approved.

Commits

• b6d6a0b Bump version in CHANGELOG
• eb4bcac Add error handling to xorBytes for unequal length arguments
• 711c747 Implement channel binding support for SCRAM-PLUS
• d58dc75 Replace server error strings with typed RFC-compliant constants
• 753038a Further modernize GH actions CI
• 17fcfe4 go mod tidy
• 4dc71f3 Bump minimum Go version to 1.18
• b85dd84 Update Github action versions
• 8dff94c Restore backward-compatible error handling
• 6891e94 Use stdlib pbkdf2 in go 1.24
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[mongodb-drivers-pr-bot]

API Change Report

No changes found!

[mongodb-drivers-pr-bot]

🧪 Performance Results

Commit SHA: ebbd902

The following benchmark tests for version 692e201ba622d70007fcc2a7 had statistically significant changes (i.e., |z-score| > 1.96):

Benchmark	Measurement	% Change	Patch Value	Stable Region	H-Score	Z-Score
BenchmarkMultiFindMany	ops_per_second_min	-86.3660	4714.7794	Avg: 34580.9383 Med: 34651.2353 Stdev: 15103.6131	0.7133	-1.9774
BenchmarkMultiFindMany	ops_per_second_max	-4.4740	4065040.6504	Avg: 4255427.0301 Med: 4255319.1489 Stdev: 22585.6999	0.9372	-8.4295
BenchmarkMultiFindMany	ops_per_second_med	-3.0492	3623188.4058	Avg: 3737141.2500 Med: 3745370.8899 Stdev: 38449.8979	0.8172	-2.9637
BenchmarkBSONFlatDocumentDecoding	ops_per_second_med	2.8617	21192.2775	Avg: 20602.6987 Med: 20638.7858 Stdev: 300.3059	0.7185	1.9633
BenchmarkBSONFlatDocumentDecoding	ops_per_second_max	2.4547	22046.8275	Avg: 21518.6035 Med: 21566.1362 Stdev: 246.0196	0.7439	2.1471
BenchmarkLargeDocInsertOne	allocated_bytes_per_op	-0.2814	5670.0000	Avg: 5686.0000 Med: 5687.0000 Stdev: 7.1351	0.7873	-2.2424

For a comprehensive view of all microbenchmark results for this PR's commit, please check out the Evergreen perf task for this patch.