Merge remote-tracking branch 'upstream/main' into harden-array-of-documents-oob

# Conflicts:
#	doc/changelog.rst

Author: AgentGymLeader

.evergreen/run-tests.sh

@@ -26,20 +26,10 @@ else
   exit 1
 fi
 
-cleanup_tests() {
-  # Avoid leaving the lock file in a changed state when we change the resolution type.
-  if [ -n "${TEST_MIN_DEPS:-}" ]; then
-    git checkout uv.lock || true
-  fi
-  cd $PREV_DIR
-}
-
-trap "cleanup_tests" SIGINT ERR
-
 # Start the test runner.
 echo "Running tests with UV_PYTHON=${UV_PYTHON:-}..."
 echo "UV_ARGS=${UV_ARGS}"
 uv run ${UV_ARGS} --reinstall-package pymongo .evergreen/scripts/run_tests.py "$@"
 echo "Running tests with UV_PYTHON=${UV_PYTHON:-}... done."
 
-cleanup_tests
+cd $PREV_DIR

.evergreen/scripts/configure-env.sh

@@ -18,6 +18,12 @@ UV_TOOL_DIR=$PROJECT_DIRECTORY/.local/uv/tools
 UV_CACHE_DIR=$PROJECT_DIRECTORY/.local/uv/cache
 DRIVERS_TOOLS_BINARIES="$DRIVERS_TOOLS/.bin"
 MONGODB_BINARIES="$DRIVERS_TOOLS/mongodb/bin"
+# GNU date on Linux and Windows, BSD date on macOS.
+UV_EXCLUDE_NEWER="$(date -u -d '7 days ago' +%Y-%m-%d 2>/dev/null || date -u -v-7d +%Y-%m-%d)"
+if [ -z "$UV_EXCLUDE_NEWER" ]; then
+  echo "Failed to compute UV_EXCLUDE_NEWER" >&2
+  exit 1
+fi
 
 # On Evergreen jobs, "CI" will be set, and we don't want to write to $HOME.
 if [ "${CI:-}" == "true" ]; then
@@ -65,6 +71,8 @@ export CARGO_HOME="$CARGO_HOME"
 export UV_TOOL_DIR="$UV_TOOL_DIR"
 export UV_CACHE_DIR="$UV_CACHE_DIR"
 export UV_TOOL_BIN_DIR="$DRIVERS_TOOLS_BINARIES"
+export UV_NO_LOCK=1
+export UV_EXCLUDE_NEWER="$UV_EXCLUDE_NEWER"
 export PYMONGO_BIN_DIR="$PYMONGO_BIN_DIR"
 export PATH="$PATH_EXT"
 # shellcheck disable=SC2154

.github/actions/set-uv-exclude-newer/action.yml

@@ -0,0 +1,18 @@
+name: Set UV_EXCLUDE_NEWER
+description: >-
+  Export UV_EXCLUDE_NEWER as 7 days before the current UTC date so uv
+  resolution ignores packages published in the last week.
+runs:
+  using: composite
+  steps:
+    - name: Set UV_EXCLUDE_NEWER
+      shell: bash
+      run: |
+        set -euo pipefail
+        # GNU date on Linux and Windows, BSD date on macOS.
+        value="$(date -u -d '7 days ago' +%Y-%m-%d 2>/dev/null || date -u -v-7d +%Y-%m-%d)"
+        if [ -z "$value" ]; then
+          echo "Failed to compute UV_EXCLUDE_NEWER" >&2
+          exit 1
+        fi
+        echo "UV_EXCLUDE_NEWER=$value" >> "$GITHUB_ENV"

.github/pull_request_template.md

@@ -1,6 +1,6 @@
 <!-- Thanks for contributing! -->
 <!-- Please ensure that the title of the PR is in the following form:
-[JIRA TICKET]: Issue Title
+PYTHON-XXXX Issue Title
 
 If you are an external contributor and there is no JIRA ticket associated with your change, then use your best judgement
 for the PR title. A MongoDB employee will create a JIRA ticket and edit the name and links as appropriate.
@@ -9,7 +9,9 @@ Note on AI Contributions:
 We only accept pull requests that are authored and submitted by human contributors who fully understand the changes they are proposing.
 All contributions must be written and understood by human contributors. Please read about our policy in our contributing guide.
 -->
-[JIRA TICKET]
+<!-- Replace XXXX with the ticket number. If you do not have a ticket (external contributors), you may leave PYTHON-XXXX;
+a MongoDB employee will create a JIRA ticket and update the PR title/links as appropriate. -->
+PYTHON-XXXX
 
 ## Changes in this PR
 <!-- What changes did you make to the code? What new APIs (public or private) were added, removed, or edited to generate

.github/workflows/codeql.yml

@@ -23,7 +23,6 @@ jobs:
     runs-on: "ubuntu-latest"
     timeout-minutes: 360
     permissions:
-      # required for all workflows
       security-events: write
 
     strategy:
@@ -32,37 +31,20 @@ jobs:
         include:
         - language: c-cpp
           build-mode: manual
+          manual-build-command: pip install -e .
         - language: python
           build-mode: none
         - language: actions
           build-mode: none
     steps:
-    - name: Checkout repository
-      uses: actions/checkout@v7.0.0
+    - uses: mongodb-labs/drivers-github-tools/codeql@95f9ce909bf0e44707fffdb92c18ed86e74aa2fd # v3
       with:
-        ref: ${{ inputs.ref }}
-        persist-credentials: false
-    - uses: actions/setup-python@v6
-
-    # Initializes the CodeQL tools for scanning.
-    - name: Initialize CodeQL
-      uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4
-      with:
-        languages: ${{ matrix.language }}
+        language: ${{ matrix.language }}
         build-mode: ${{ matrix.build-mode }}
-        # For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
-        queries: security-extended
+        manual-build-command: ${{ matrix.manual-build-command }}
+        ref: ${{ inputs.ref }}
         config: |
           paths-ignore:
             - 'doc/**'
             - 'tools/**'
             - 'test/**'
-
-    - if: matrix.build-mode == 'manual'
-      run: |
-        pip install -e .
-
-    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4
-      with:
-        category: "/language:${{matrix.language}}"

.github/workflows/release-python.yml

@@ -79,12 +79,6 @@ jobs:
         with:
           name: all-dist-${{ github.run_id }}
           path: dist/
-      - name: Publish package distributions to TestPyPI
-        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # release/v1
-        with:
-          repository-url: https://test.pypi.org/legacy/
-          skip-existing: true
-          attestations: ${{ env.DRY_RUN }}
       - name: Publish package distributions to PyPI
         if: startsWith(env.DRY_RUN, 'false')
         uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # release/v1

.github/workflows/test-python.yml

@@ -17,6 +17,9 @@ defaults:
 permissions:
   contents: read
 
+env:
+  UV_NO_LOCK: "1"
+
 jobs:
 
   static:
@@ -25,6 +28,7 @@ jobs:
       - uses: actions/checkout@v7.0.0
         with:
           persist-credentials: false
+      - uses: ./.github/actions/set-uv-exclude-newer
       - name: Install uv
         uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
@@ -49,6 +53,13 @@ jobs:
       - name: Run synchro smoke test
         run: |
           uv run --extra test --with unasync pytest tools/test_synchro.py -v --override-ini="addopts="
+      - name: Validate pyproject.toml
+        run: |
+          uvx --from 'validate-pyproject[all]' validate-pyproject pyproject.toml
+      - name: Check package metadata
+        run: |
+          uv build
+          uvx twine check --strict dist/*
       - run: |
           sudo apt-get install -y cppcheck
       - run: |
@@ -70,6 +81,7 @@ jobs:
       - uses: actions/checkout@v7.0.0
         with:
           persist-credentials: false
+      - uses: ./.github/actions/set-uv-exclude-newer
       - name: Install uv
         uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
@@ -92,6 +104,7 @@ jobs:
       - uses: actions/checkout@v7.0.0
         with:
           persist-credentials: false
+      - uses: ./.github/actions/set-uv-exclude-newer
       - name: Install uv
         uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
@@ -120,6 +133,7 @@ jobs:
       - uses: actions/checkout@v7.0.0
         with:
           persist-credentials: false
+      - uses: ./.github/actions/set-uv-exclude-newer
       - name: Install uv
         uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
@@ -145,6 +159,7 @@ jobs:
       - uses: actions/checkout@v7.0.0
         with:
           persist-credentials: false
+      - uses: ./.github/actions/set-uv-exclude-newer
       - name: Install uv
         uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
@@ -167,6 +182,7 @@ jobs:
       - uses: actions/checkout@v7.0.0
         with:
           persist-credentials: false
+      - uses: ./.github/actions/set-uv-exclude-newer
       - name: Install uv
         uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
@@ -188,6 +204,7 @@ jobs:
       - uses: actions/checkout@v7.0.0
         with:
           persist-credentials: false
+      - uses: ./.github/actions/set-uv-exclude-newer
       - name: Install uv
         uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
@@ -278,6 +295,7 @@ jobs:
         - uses: actions/checkout@v7.0.0
           with:
             persist-credentials: false
+        - uses: ./.github/actions/set-uv-exclude-newer
         - name: Install uv
           uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
           with:

.gitignore

@@ -45,3 +45,6 @@ xunit-results/
 coverage.xml
 server.log
 .coverage
+
+# uv lockfiles
+uv.lock

.pre-commit-config.yaml

@@ -133,14 +133,3 @@ repos:
     language: python
     require_serial: true
     additional_dependencies: ["shrub.py>=3.10.0", "pyyaml>=6.0.2"]
-
-  - id: uv-lock
-    name: uv-lock
-    entry: uv lock
-    language: python
-    require_serial: true
-    files: ^(uv\.lock|pyproject\.toml|requirements.txt|requirements/.*\.txt)$
-    pass_filenames: false
-    fail_fast: true
-    additional_dependencies:
-      - "uv>=0.8.4"

CONTRIBUTING.md

@@ -566,7 +566,4 @@ From the spawn host or Ubuntu image, do the following:
 ## Dependabot updates
 
 Dependabot will raise PRs at most once per week, grouped by GitHub Actions updates and Python requirement
-file updates.  We have a pre-commit hook that will update the `uv.lock` file when requirements change.
-To update the lock file on a failing PR, you can use a method like `gh pr checkout <pr number>`, then run
-`just lint uv-lock` to update the lock file, and then push the changes.  If a typing dependency has changed,
-also run `just typing` and handle any new findings.
+file updates. If a typing dependency has changed, run `just typing` and handle any new findings.