v1.11.0

This release introduces significant security enhancements, modernizes the database driver, and includes breaking changes to encryption and dependency management.

🚨 Breaking Changes

• MongoDB Driver Upgrade: Migrated from qmgo (and the official driver v1) to the official MongoDB Go Driver v2. If you are using qmgo or older driver interfaces, you will need to update your database code.
• 2FA Secret Encryption: 2FA secrets are now encrypted exclusively using keys derived from Argon2id. This strengthens the security of stored 2FA tokens.

🛡️ Security & Validation

• NoSQL Injection Prevention:
  • Refactored MongoDB queries in example and example2 to use bson.D (ordered documents) instead of bson.M (unordered maps) for explicit field matching.
  • Added explicit usage of the $eq operator in filters to prevent operator injection attacks.
• Strict Input Sanitization:
  • Implemented strict input validation for geocoding and address data (max length, null-byte checks, UTF-8 validation).
  • Added sanity checks to reject inputs containing MongoDB operator prefixes (e.g., fields starting with $).

🏗️ Refactoring & Improvements

• Architecture: example and example2 applications have been refactored to demonstrate the new strict validation patterns and secure BSON construction.
• Documentation: Updated llms.txt and other documentation to reflect the new repository patterns and security practices.

📦 Dependency Updates

• chore(deps): bump github.com/mrz1836/postmark from 1.8.2 to 1.8.3 by @dependabot[bot] in #357
• chore(deps): bump golang.org/x/crypto from 0.47.0 to 0.48.0 by @dependabot[bot] in #358

⚙️ CI/CD

• Updated golangci-lint to v2.9.0
• Removed go report card integration

Full Changelog: v1.10.6...v1.11.0