chore(deps): bump pymongo from 4.17.0 to 4.18.0 in /reference-apps/fastapi in the fastapi-minor-patch group

[dependabot]

Bumps the fastapi-minor-patch group in /reference-apps/fastapi with 1 update: pymongo.

Updates pymongo from 4.17.0 to 4.18.0

Release notes

Sourced from pymongo's releases.

PyMongo 4.18.0

Community notes: https://www.mongodb.com/community/forums/t/pymongo-4-18-released/343137

Changelog

Sourced from pymongo's changelog.

Changes in Version 4.18.0 (2026/09/03)

PyMongo 4.18 brings a number of changes including:

• Added srvAllowedHostsSuffix as a URI option and keyword argument to :class:~pymongo.synchronous.mongo_client.MongoClient and :class:~pymongo.asynchronous.mongo_client.AsyncMongoClient. When connecting via mongodb+srv://, this option overrides the default requirement that SRV-returned hosts share the same parent domain as the seed hostname, allowing hosts under a different domain suffix to be accepted. The suffix must not be a public suffix (per the Public Suffix List <https://publicsuffix.org/list/>_). See the :class:~pymongo.synchronous.mongo_client.MongoClient and :class:~pymongo.asynchronous.mongo_client.AsyncMongoClient documentation for security considerations.
• Dropped support for MongoDB 4.2.
• Added support for MongoDB 9.0.
• PyPy support is deprecated and will be removed in a future release.
• Improved TLS connection performance by reusing TLS sessions across connections to the same server, avoiding a full handshake on each new connection. Session resumption is supported on all Python versions for synchronous clients and on Python 3.11+ for async clients.
• Improved performance for MongoDB 9.0's Intelligent Workload Management (IWM) by only retrying overload errors when doing so is expected to not worsen server conditions.
• Added support for exhaust cursors (:attr:~pymongo.cursor.CursorType.EXHAUST) against mongos 7.1+. An older mongos still raises :class:~pymongo.errors.InvalidOperation, now on the first iteration of the cursor rather than from :meth:~pymongo.synchronous.collection.Collection.find, since the requirement is checked against the connection in use. Separately, async cursors combining limit with :attr:~pymongo.cursor.CursorType.EXHAUST now raise at find rather than on first iteration, matching the synchronous API.
• Redacted potentially sensitive authentication mechanism properties, including AWS session tokens, from the representations of :class:~pymongo.synchronous.mongo_client.MongoClient and :class:~pymongo.asynchronous.mongo_client.AsyncMongoClient.
• Command monitoring events and command log messages for a single logical operation now share one stable operation_id across all of its retry attempts, so consumers can correlate a retried operation's events. As a result, operation_id is no longer equal to the per-attempt request_id for these operations.
• Added validation of OP_COMPRESSED decompressed message size against max_message_size to prevent memory exhaustion from maliciously crafted compressed server responses.
• Improved the performance and memory usage of decoding large documents to :class:~bson.raw_bson.RawBSONDocument. Documents and subdocuments that are 4KB or greater and decoded from an immutable buffer are now exposed as read-only :class:memoryview slices instead of :class:bytes copies. Documents decoded from mutable buffers such as a :class:bytearray are always :class:bytes copies.
• :func:bson.get_data_and_view now returns a view of a private :class:bytes copy

... (truncated)

Commits

• 8e7ece4 PYTHON-6072 - Update changelog for 4.18 release (#3038)
• f4d0ca6 PYTHON-5814 Configurable DNS domain validation for SRV records (#2868)
• 3ed144a PYTHON-6070 Improve help output for just run-server and just setup-tests (#3035)
• 003c9cc PYTHON-6020 Move _have_dnspython into uri_parser_shared.py (#3032)
• a3c768d PYTHON-5983 Validate uncompressed size in OP_COMPRESSED messages (#2976)
• 1a99d50 PYTHON 5790 Standardize references to test collections in tests (#3026)
• 364c1ea PYTHON-5884 Explicit Encryption prose test "Case 2" fails on latest server: p...
• cc5deb2 PYTHON-6017 Consolidate QE enums into shared class (#3024)
• 6506f48 PYTHON-6007 Fix versionchanged marker for text_opts in ClientEncryption.encry...
• f9f9b03 PYTHON-6019 Consolidate mongo_client module-level helpers into shared… (#3031)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions