Merge branch 'master' into retry-inplace

Author: mdb-ad

.evergreen/config.yml

@@ -106,7 +106,7 @@ functions:
           export LSAN_OPTIONS="suppressions=$LIBMONGOCRYPT_DIR/.lsan-suppressions"
           export VS_VERSION=${vs_version|}
           export VS_TARGET_ARCH=${vs_target_arch|amd64}
-          export USE_NINJA=ON
+          export USE_NINJA=${use_ninja|ON}
           env ${compile_env|} \
             bash "$EVG_DIR/env-run.sh" \
               bash "$EVG_DIR/build_all.sh"
@@ -151,7 +151,7 @@ functions:
     - command: "shell.exec"
       params:
         script: |-
-          if test "$OS_NAME" != "windows"; then export USE_NINJA=ON; fi
+          if test "$OS_NAME" != "windows"; then export USE_NINJA=${use_ninja|ON}; fi
           env ${compile_env|} CONFIGURE_ONLY=ON ${clang_env|CC=clang CXX=clang++} \
               bash libmongocrypt/.evergreen/build_all.sh
           ./libmongocrypt/.evergreen/clang-tidy.sh
@@ -563,7 +563,7 @@ tasks:
   commands:
     - func: "fetch source"
     - func: "build python release"
-      vars: { PYTHON: /opt/python/3.8/bin/python3 }
+      vars: { PYTHON: /opt/python/3.9/bin/python3 }
     - func: "upload python release"
 
 - name: "release-python-windows"
@@ -572,7 +572,7 @@ tasks:
   commands:
     - func: "fetch source"
     - func: "build python release"
-      vars: { PYTHON: C:/python/Python38/python.exe }
+      vars: { PYTHON: C:/python/Python39/python.exe }
     - func: "upload python release"
 
 - name: "release-python-combine"
@@ -1624,9 +1624,12 @@ buildvariants:
   run_on: macos-1100-arm64
   expansions:
     compile_env: MACOS_UNIVERSAL=ON CMAKE=/opt/homebrew/bin/cmake
+    # Disable Ninja to work around error "Bad CPU type in executable"
+    use_ninja: OFF
   tasks:
   - build-and-test-and-upload
-  - test-python
+  - name: test-python
+    distros: macos-14-arm64
 - name: windows-vs2017-32bit
   # Test Windows 32 bit builds for PHPC. PHPC builds libmongocrypt from source. See MONGOCRYPT-391.
   display_name: "Windows VS 2017 32-bit compile"

.evergreen/earthly.sh

@@ -4,14 +4,7 @@
 
 set -euo pipefail
 
-: "${EARTHLY_VERSION:=0.7.8}"
-
-# Bring in the debian/ directory from the debian/unstable branch
-pushd "$(dirname "${BASH_SOURCE[0]}")/../"
-    (git remote | grep -q upstream) || git remote add upstream https://github.com/mongodb/libmongocrypt
-    git fetch upstream
-    git checkout $(git rev-parse upstream/debian/unstable) -- debian
-popd
+: "${EARTHLY_VERSION:=0.8.16}"
 
 # Calc the arch of the executable we want
 arch="$(uname -m)"

.evergreen/ensure-cmake.sh

@@ -58,7 +58,7 @@ _download_cmake() {
         url="$url_base/cmake-$CMAKE_VERSION-Linux-$arch.tar.gz"
         ;;
     macos)
-        url="$url_base/cmake-$CMAKE_VERSION-macos10.10-universal.tar.gz"
+        url="$url_base/cmake-$CMAKE_VERSION-macos-universal.tar.gz"
         # We're pulling out the app bundle contents, so we need to skip more intermediate directories
         strip_components=3
         ;;

.evergreen/linker_tests_deps/app/CMakeLists.txt

@@ -1,9 +1,9 @@
-cmake_minimum_required (VERSION 3.5)
+cmake_minimum_required (VERSION 3.15...4.0)
 project (app C)
 add_executable (app app.c)
 find_package (bson-1.0 1.11 REQUIRED)
 message ("--   libbson found version \"${bson-1.0_VERSION}\"")
 target_link_libraries (app PRIVATE mongo::bson_static)
 
 find_package (mongocrypt REQUIRED)
-target_link_libraries (app PRIVATE mongo::mongocrypt)
+target_link_libraries (app PRIVATE mongo::mongocrypt)

.github/workflows/codeql-actions.yml

@@ -29,22 +29,22 @@ jobs:
       packages: read
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@v5
       with:
         fetch-depth: 0
         ref: ${{ inputs.ref }}
         persist-credentials: false
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@39edc492dbe16b1465b0cafca41432d857bdb31a # v3
+      uses: github/codeql-action/init@f1f6e5f6af878fb37288ce1c627459e94dbf7d01 # v3
       with:
         languages: actions
         build-mode: none
         # For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
         queries: security-extended
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@39edc492dbe16b1465b0cafca41432d857bdb31a # v3
+      uses: github/codeql-action/analyze@f1f6e5f6af878fb37288ce1c627459e94dbf7d01 # v3
       with:
         category: "/language:actions"

.github/workflows/codeql-python.yml

@@ -31,18 +31,18 @@ jobs:
       packages: read
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@v5
       with:
         fetch-depth: 0
         ref: ${{ inputs.ref }}
         persist-credentials: false
-    - uses: actions/setup-python@v5
+    - uses: actions/setup-python@v6
       with:
         python-version: 3.x
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@39edc492dbe16b1465b0cafca41432d857bdb31a # v3
+      uses: github/codeql-action/init@f1f6e5f6af878fb37288ce1c627459e94dbf7d01 # v3
       with:
         languages: python
         build-mode: none
@@ -61,6 +61,6 @@ jobs:
         pip install dist/*.whl
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@39edc492dbe16b1465b0cafca41432d857bdb31a # v3
+      uses: github/codeql-action/analyze@f1f6e5f6af878fb37288ce1c627459e94dbf7d01 # v3
       with:
         category: "/language:python"

.github/workflows/dist-python.yml

@@ -39,15 +39,15 @@ jobs:
 
     steps:  
       - name: Checkout libmongocrypt
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           fetch-depth: 0
           ref: ${{ inputs.ref }}
           persist-credentials: false
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v6
         with:
-          python-version: 3.8
+          python-version: "3.9"
           cache: 'pip'
           cache-dependency-path: 'bindings/python/pyproject.toml'
           allow-prereleases: true
@@ -70,7 +70,7 @@ jobs:
     name: Collect dist files
     steps:
       - name: Download all workflow run artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v5
       - name: Flatten directory
         working-directory: .
         run: |

.github/workflows/release-python.yml

@@ -82,19 +82,19 @@ jobs:
       id-token: write
     steps:
       - name: Download all the dists
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v5
         with:
           name: all-dist-${{ github.run_id }}
           path: dist/
       - name: Publish package distributions to TestPyPI
-        uses: pypa/gh-action-pypi-publish@76f52bc884231f62b9a034ebfe128415bbaabdfc # release/v1
+        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # release/v1
         with:
           repository-url: https://test.pypi.org/legacy/
           skip-existing: true
           attestations: ${{ env.DRY_RUN }}
       - name: Publish package distributions to PyPI
         if: startsWith(env.DRY_RUN, 'false')
-        uses: pypa/gh-action-pypi-publish@76f52bc884231f62b9a034ebfe128415bbaabdfc # release/v1
+        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # release/v1
 
   post-publish:
     needs: [publish]

.github/workflows/test-python.yml

@@ -23,10 +23,10 @@ jobs:
     if: github.repository_owner == 'mongodb'
     runs-on: ubuntu-latest
     steps:
-     - uses: actions/checkout@v4
+     - uses: actions/checkout@v5
        with:
         persist-credentials: false
-     - uses: actions/setup-python@v5
+     - uses: actions/setup-python@v6
      - name: "Run pre-commit"
        working-directory: .
        run: |
@@ -43,21 +43,21 @@ jobs:
       fail-fast: false
       matrix:
         os: [ubuntu-latest, windows-latest, macos-latest]
-        python-version: ["3.8", "3.13"]
+        python-version: ["3.9", "3.13", "3.14"]
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
         with:
           fetch-depth: 0
           persist-credentials: false
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           allow-prereleases: true
           python-version: ${{ matrix.python-version }}
       - name: Build and test dist files
         run: |
-          if [ "${{ matrix.python-version }}" == "3.13" ]; then 
+          if [ "${{ matrix.python-version }}" == "3.14" ]; then 
             export PIP_PRE=1
           fi
           export LIBMONGOCRYPT_VERSION=$(cat ./scripts/libmongocrypt-version.txt)

.github/workflows/zizmor.yml

@@ -9,25 +9,13 @@ on:
 jobs:
   zizmor:
     name: zizmor latest via Cargo
-    if: github.repository_owner == 'mongodb'
     runs-on: ubuntu-latest
     permissions:
       security-events: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           persist-credentials: false
-      - name: Setup Rust
-        uses: actions-rust-lang/setup-rust-toolchain@fb51252c7ba57d633bc668f941da052e410add48 # v1
-      - name: Get zizmor
-        run: cargo install zizmor
       - name: Run zizmor
-        run: zizmor --format sarif . > results.sarif
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      - name: Upload SARIF file
-        uses: github/codeql-action/upload-sarif@39edc492dbe16b1465b0cafca41432d857bdb31a # v3
-        with:
-          sarif_file: results.sarif
-          category: zizmor
+        uses: zizmorcore/zizmor-action@a016d81e77496751b5c04eb1e8f00214bd396553