The latest of the mongo-go-driver imports 2 packages which in turn import gopkg.in/yaml.v2-v2.2.2, this has a vulnerability identified in https://nvd.nist.gov/vuln/detail/CVE-2019-11254 and first exposed in the kubernetes API - https://github.com/kubernetes/kubernetes/issues/89535 

The 2 packages are:

github.com/pelletier/go-toml@v1.4.0

github.com/stretchr/testify@v1.4.0

the current versions of both package are patched to a higher level of the yaml package.