Merge branch 'master' into dependabot/pip/mypy-1.18.2

blink1073 · web-flow · commit 2a58cc3bc02f · 2025-09-23T14:08:40.000-05:00
diff --git a/.evergreen/scripts/setup-dev-env.sh b/.evergreen/scripts/setup-dev-env.sh
@@ -47,13 +47,13 @@ if [ -f $HOME/.visualStudioEnv.sh ]; then
   SSH_TTY=1 source $HOME/.visualStudioEnv.sh
   set -u
 fi
-uv sync --frozen
+uv sync
 
 echo "Setting up python environment... done."
 
 # Ensure there is a pre-commit hook if there is a git checkout.
 if [ -d .git ] && [ ! -f .git/hooks/pre-commit ]; then
-    uv run --frozen pre-commit install
+    uv run pre-commit install
 fi
 
 popd > /dev/null
diff --git a/.github/workflows/create-release-branch.yml b/.github/workflows/create-release-branch.yml
@@ -33,19 +33,19 @@ jobs:
     outputs:
       version: ${{ steps.pre-publish.outputs.version }}
     steps:
-      - uses: mongodb-labs/drivers-github-tools/secure-checkout@v2
+      - uses: mongodb-labs/drivers-github-tools/secure-checkout@v3
         with:
           app_id: ${{ vars.APP_ID }}
           private_key: ${{ secrets.APP_PRIVATE_KEY }}
-      - uses: mongodb-labs/drivers-github-tools/setup@v2
+      - uses: mongodb-labs/drivers-github-tools/setup@v3
         with:
           aws_role_arn: ${{ secrets.AWS_ROLE_ARN }}
           aws_region_name: ${{ vars.AWS_REGION_NAME }}
           aws_secret_id: ${{ secrets.AWS_SECRET_ID }}
           artifactory_username: ${{ vars.ARTIFACTORY_USERNAME }}
       - name: Get hatch
         run: pip install hatch
-      - uses: mongodb-labs/drivers-github-tools/create-branch@v2
+      - uses: mongodb-labs/drivers-github-tools/create-branch@v3
         id: create-branch
         with:
           branch_name: ${{ inputs.branch_name }}
diff --git a/.github/workflows/release-python.yml b/.github/workflows/release-python.yml
@@ -38,17 +38,16 @@ jobs:
     outputs:
       version: ${{ steps.pre-publish.outputs.version }}
     steps:
-      - uses: mongodb-labs/drivers-github-tools/secure-checkout@v2
+      - uses: mongodb-labs/drivers-github-tools/secure-checkout@v3
         with:
           app_id: ${{ vars.APP_ID }}
           private_key: ${{ secrets.APP_PRIVATE_KEY }}
-      - uses: mongodb-labs/drivers-github-tools/setup@v2
+      - uses: mongodb-labs/drivers-github-tools/setup@v3
         with:
           aws_role_arn: ${{ secrets.AWS_ROLE_ARN }}
           aws_region_name: ${{ vars.AWS_REGION_NAME }}
           aws_secret_id: ${{ secrets.AWS_SECRET_ID }}
-          artifactory_username: ${{ vars.ARTIFACTORY_USERNAME }}
-      - uses: mongodb-labs/drivers-github-tools/python/pre-publish@v2
+      - uses: mongodb-labs/drivers-github-tools/python/pre-publish@v3
         id: pre-publish
         with:
           dry_run: ${{ env.DRY_RUN }}
@@ -100,17 +99,16 @@ jobs:
       attestations: write
       security-events: write
     steps:
-      - uses: mongodb-labs/drivers-github-tools/secure-checkout@v2
+      - uses: mongodb-labs/drivers-github-tools/secure-checkout@v3
         with:
           app_id: ${{ vars.APP_ID }}
           private_key: ${{ secrets.APP_PRIVATE_KEY }}
-      - uses: mongodb-labs/drivers-github-tools/setup@v2
+      - uses: mongodb-labs/drivers-github-tools/setup@v3
         with:
           aws_role_arn: ${{ secrets.AWS_ROLE_ARN }}
           aws_region_name: ${{ vars.AWS_REGION_NAME }}
           aws_secret_id: ${{ secrets.AWS_SECRET_ID }}
-          artifactory_username: ${{ vars.ARTIFACTORY_USERNAME }}
-      - uses: mongodb-labs/drivers-github-tools/python/post-publish@v2
+      - uses: mongodb-labs/drivers-github-tools/python/post-publish@v3
         with:
           following_version: ${{ env.FOLLOWING_VERSION }}
           product_name: ${{ env.PRODUCT_NAME }}
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
@@ -18,4 +18,4 @@ jobs:
         with:
           persist-credentials: false
       - name: Run zizmor 🌈
-        uses: zizmorcore/zizmor-action@873539476a7f9b0da7504d0d9e9a6a5275094d98
+        uses: zizmorcore/zizmor-action@0696496a48b64e0568faa46ddaf5f6fe48b83b04
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
@@ -105,12 +105,6 @@ repos:
     # - test/test_client.py:188: te ==> the, be, we, to
     args: ["-L", "fle,fo,infinit,isnt,nin,te,aks"]
 
-- repo: https://github.com/astral-sh/uv-pre-commit
-  # uv version.
-  rev: 0.8.17
-  hooks:
-    - id: uv-lock
-
 - repo: local
   hooks:
   - id: executable-shell
@@ -128,3 +122,14 @@ repos:
     language: python
     require_serial: true
     additional_dependencies: ["shrub.py>=3.10.0", "pyyaml>=6.0.2"]
+
+  - id: uv-lock
+    name: uv-lock
+    entry: uv lock
+    language: python
+    require_serial: true
+    files: ^(uv\.lock|pyproject\.toml|requirements.txt|requirements/.*\.txt)$
+    pass_filenames: false
+    fail_fast: true
+    additional_dependencies:
+      - "uv>=0.8.4"
diff --git a/bson/__init__.py b/bson/__init__.py
@@ -1009,7 +1009,7 @@ def _dict_to_bson(
                 try:
                     elements.append(_element_to_bson(key, value, check_keys, opts))
                 except InvalidDocument as err:
-                    raise InvalidDocument(f"Invalid document {doc} | {err}") from err
+                    raise InvalidDocument(f"Invalid document: {err}", doc) from err
     except AttributeError:
         raise TypeError(f"encoder expected a mapping type but got: {doc!r}") from None
 
diff --git a/bson/_cbsonmodule.c b/bson/_cbsonmodule.c
@@ -1645,11 +1645,11 @@ static int write_raw_doc(buffer_t buffer, PyObject* raw, PyObject* _raw_str) {
 }
 
 
-/* Update Invalid Document error message to include doc.
+/* Update Invalid Document error to include doc as a property.
  */
 void handle_invalid_doc_error(PyObject* dict) {
     PyObject *etype = NULL, *evalue = NULL, *etrace = NULL;
-    PyObject *msg = NULL, *dict_str = NULL, *new_msg = NULL;
+    PyObject *msg = NULL, *new_msg = NULL, *new_evalue = NULL;
     PyErr_Fetch(&etype, &evalue, &etrace);
     PyObject *InvalidDocument = _error("InvalidDocument");
     if (InvalidDocument == NULL) {
@@ -1659,26 +1659,22 @@ void handle_invalid_doc_error(PyObject* dict) {
     if (evalue && PyErr_GivenExceptionMatches(etype, InvalidDocument)) {
         PyObject *msg = PyObject_Str(evalue);
         if (msg) {
-            // Prepend doc to the existing message
-            PyObject *dict_str = PyObject_Str(dict);
-            if (dict_str == NULL) {
-                goto cleanup;
-            }
-            const char * dict_str_utf8 = PyUnicode_AsUTF8(dict_str);
-            if (dict_str_utf8 == NULL) {
-                goto cleanup;
-            }
             const char * msg_utf8 = PyUnicode_AsUTF8(msg);
             if (msg_utf8 == NULL) {
                 goto cleanup;
             }
-            PyObject *new_msg = PyUnicode_FromFormat("Invalid document %s | %s", dict_str_utf8, msg_utf8);
+            PyObject *new_msg = PyUnicode_FromFormat("Invalid document: %s", msg_utf8);
+            if (new_msg == NULL) {
+                goto cleanup;
+            }
+            // Add doc to the error instance as a property.
+            PyObject *new_evalue = PyObject_CallFunctionObjArgs(InvalidDocument, new_msg, dict, NULL);
             Py_DECREF(evalue);
             Py_DECREF(etype);
             etype = InvalidDocument;
             InvalidDocument = NULL;
-            if (new_msg) {
-                evalue = new_msg;
+            if (new_evalue) {
+                evalue = new_evalue;
             } else {
                 evalue = msg;
             }
@@ -1689,7 +1685,7 @@ void handle_invalid_doc_error(PyObject* dict) {
     PyErr_Restore(etype, evalue, etrace);
     Py_XDECREF(msg);
     Py_XDECREF(InvalidDocument);
-    Py_XDECREF(dict_str);
+    Py_XDECREF(new_evalue);
     Py_XDECREF(new_msg);
 }
 
diff --git a/bson/errors.py b/bson/errors.py
@@ -15,6 +15,8 @@
 """Exceptions raised by the BSON package."""
 from __future__ import annotations
 
+from typing import Any, Optional
+
 
 class BSONError(Exception):
     """Base class for all BSON exceptions."""
@@ -31,6 +33,17 @@ class InvalidStringData(BSONError):
 class InvalidDocument(BSONError):
     """Raised when trying to create a BSON object from an invalid document."""
 
+    def __init__(self, message: str, document: Optional[Any] = None) -> None:
+        super().__init__(message)
+        self._document = document
+
+    @property
+    def document(self) -> Any:
+        """The invalid document that caused the error.
+
+        ..versionadded:: 4.16"""
+        return self._document
+
 
 class InvalidId(BSONError):
     """Raised when trying to create an ObjectId from invalid data."""
diff --git a/doc/changelog.rst b/doc/changelog.rst
@@ -1,6 +1,15 @@
 Changelog
 =========
 
+Changes in Version 4.16.0 (XXXX/XX/XX)
+--------------------------------------
+
+PyMongo 4.16 brings a number of changes including:
+
+- Removed invalid documents from :class:`bson.errors.InvalidDocument` error messages as
+  doing so may leak sensitive user data.
+  Instead, invalid documents are stored in :attr:`bson.errors.InvalidDocument.document`.
+
 Changes in Version 4.15.1 (2025/09/16)
 --------------------------------------
 
diff --git a/justfile b/justfile
@@ -1,7 +1,5 @@
 # See https://just.systems/man/en/ for instructions
 set shell := ["bash", "-c"]
-# Do not modify the lock file when running justfile commands.
-export UV_FROZEN := "1"
 
 # Commonly used command segments.
 typing_run := "uv run --group typing --extra aws --extra encryption --extra ocsp --extra snappy --extra test --extra zstd"
@@ -16,7 +14,7 @@ default:
 
 [private]
 resync:
- @uv sync --quiet --frozen
+ @uv sync --quiet
 
 install:
    bash .evergreen/scripts/setup-dev-env.sh
diff --git a/pymongo/asynchronous/encryption.py b/pymongo/asynchronous/encryption.py
@@ -66,7 +66,12 @@
 from pymongo.asynchronous.mongo_client import AsyncMongoClient
 from pymongo.common import CONNECT_TIMEOUT
 from pymongo.daemon import _spawn_daemon
-from pymongo.encryption_options import AutoEncryptionOpts, RangeOpts, TextOpts
+from pymongo.encryption_options import (
+    AutoEncryptionOpts,
+    RangeOpts,
+    TextOpts,
+    check_min_pymongocrypt,
+)
 from pymongo.errors import (
     ConfigurationError,
     EncryptedCollectionError,
@@ -675,6 +680,8 @@ def __init__(
                 "python -m pip install --upgrade 'pymongo[encryption]'"
             )
 
+        check_min_pymongocrypt()
+
         if not isinstance(codec_options, CodecOptions):
             raise TypeError(
                 f"codec_options must be an instance of bson.codec_options.CodecOptions, not {type(codec_options)}"
diff --git a/pymongo/asynchronous/srv_resolver.py b/pymongo/asynchronous/srv_resolver.py
@@ -19,7 +19,7 @@
 import random
 from typing import TYPE_CHECKING, Any, Optional, Union
 
-from pymongo.common import CONNECT_TIMEOUT
+from pymongo.common import CONNECT_TIMEOUT, check_for_min_version
 from pymongo.errors import ConfigurationError
 
 if TYPE_CHECKING:
@@ -32,6 +32,14 @@ def _have_dnspython() -> bool:
     try:
         import dns  # noqa: F401
 
+        dns_version, required_version, is_valid = check_for_min_version("dnspython")
+        if not is_valid:
+            raise RuntimeError(
+                f"pymongo requires dnspython>={required_version}, "
+                f"found version {dns_version}. "
+                "Install a compatible version with pip"
+            )
+
         return True
     except ImportError:
         return False
@@ -80,6 +88,8 @@ def __init__(
         srv_service_name: str,
         srv_max_hosts: int = 0,
     ):
+        # Ensure the version of dnspython is compatible.
+        _have_dnspython()
         self.__fqdn = fqdn
         self.__srv = srv_service_name
         self.__connect_timeout = connect_timeout or CONNECT_TIMEOUT
diff --git a/pymongo/common.py b/pymongo/common.py
@@ -20,6 +20,7 @@
 import warnings
 from collections import OrderedDict, abc
 from difflib import get_close_matches
+from importlib.metadata import requires, version
 from typing import (
     TYPE_CHECKING,
     Any,
@@ -1092,3 +1093,91 @@ def has_c() -> bool:
         return True
     except ImportError:
         return False
+
+
+class Version(tuple[int, ...]):
+    """A class that can be used to compare version strings."""
+
+    def __new__(cls, *version: int) -> Version:
+        padded_version = cls._padded(version, 4)
+        return super().__new__(cls, tuple(padded_version))
+
+    @classmethod
+    def _padded(cls, iter: Any, length: int, padding: int = 0) -> list[int]:
+        as_list = list(iter)
+        if len(as_list) < length:
+            for _ in range(length - len(as_list)):
+                as_list.append(padding)
+        return as_list
+
+    @classmethod
+    def from_string(cls, version_string: str) -> Version:
+        mod = 0
+        bump_patch_level = False
+        if version_string.endswith("+"):
+            version_string = version_string[0:-1]
+            mod = 1
+        elif version_string.endswith("-pre-"):
+            version_string = version_string[0:-5]
+            mod = -1
+        elif version_string.endswith("-"):
+            version_string = version_string[0:-1]
+            mod = -1
+        # Deal with .devX substrings
+        if ".dev" in version_string:
+            version_string = version_string[0 : version_string.find(".dev")]
+            mod = -1
+        # Deal with '-rcX' substrings
+        if "-rc" in version_string:
+            version_string = version_string[0 : version_string.find("-rc")]
+            mod = -1
+        # Deal with git describe generated substrings
+        elif "-" in version_string:
+            version_string = version_string[0 : version_string.find("-")]
+            mod = -1
+            bump_patch_level = True
+
+        version = [int(part) for part in version_string.split(".")]
+        version = cls._padded(version, 3)
+        # Make from_string and from_version_array agree. For example:
+        # MongoDB Enterprise > db.runCommand('buildInfo').versionArray
+        # [ 3, 2, 1, -100 ]
+        # MongoDB Enterprise > db.runCommand('buildInfo').version
+        # 3.2.0-97-g1ef94fe
+        if bump_patch_level:
+            version[-1] += 1
+        version.append(mod)
+
+        return Version(*version)
+
+    @classmethod
+    def from_version_array(cls, version_array: Any) -> Version:
+        version = list(version_array)
+        if version[-1] < 0:
+            version[-1] = -1
+        version = cls._padded(version, 3)
+        return Version(*version)
+
+    def at_least(self, *other_version: Any) -> bool:
+        return self >= Version(*other_version)
+
+    def __str__(self) -> str:
+        return ".".join(map(str, self))
+
+
+def check_for_min_version(package_name: str) -> tuple[str, str, bool]:
+    """Test whether an installed package is of the desired version."""
+    package_version_str = version(package_name)
+    package_version = Version.from_string(package_version_str)
+    # Dependency is expected to be in one of the forms:
+    # "pymongocrypt<2.0.0,>=1.13.0; extra == 'encryption'"
+    # 'dnspython<3.0.0,>=1.16.0'
+    #
+    requirements = requires("pymongo")
+    assert requirements is not None
+    requirement = [i for i in requirements if i.startswith(package_name)][0]  # noqa: RUF015
+    if ";" in requirement:
+        requirement = requirement.split(";")[0]
+    required_version = requirement[requirement.find(">=") + 2 :]
+    is_valid = package_version >= Version.from_string(required_version)
+    return package_version_str, required_version, is_valid
diff --git a/pymongo/encryption_options.py b/pymongo/encryption_options.py
diff --git a/pymongo/synchronous/encryption.py b/pymongo/synchronous/encryption.py
diff --git a/pymongo/synchronous/srv_resolver.py b/pymongo/synchronous/srv_resolver.py
diff --git a/test/test_bson.py b/test/test_bson.py
diff --git a/test/version.py b/test/version.py
diff --git a/uv.lock b/uv.lock
