Merge branch 'master' into PYTHON-5344

Author: sleepyStick

.evergreen/generated_configs/tasks.yml

@@ -118,6 +118,7 @@ tasks:
   # Backport pr tests
   - name: backport-pr
     commands:
+      - func: assume ec2 role
       - command: subprocess.exec
         params:
           binary: bash
@@ -3060,16 +3061,6 @@ tasks:
       - sharded_cluster-auth-ssl
       - sync
 
-  # Serverless tests
-  - name: test-serverless
-    commands:
-      - func: run tests
-        vars:
-          TEST_NAME: serverless
-          AUTH: auth
-          SSL: ssl
-    tags: [serverless]
-
   # Standard tests
   - name: test-standard-v4.0-python3.9-sync-noauth-nossl-standalone
     commands:

.evergreen/generated_configs/variants.yml

@@ -586,26 +586,6 @@ buildvariants:
       - rhel87-small
     tags: [coverage_tag]
 
-  # Serverless tests
-  - name: serverless-rhel8-python3.9
-    tasks:
-      - name: .serverless
-    display_name: Serverless RHEL8 Python3.9
-    run_on:
-      - rhel87-small
-    batchtime: 10080
-    expansions:
-      PYTHON_BINARY: /opt/python/3.9/bin/python3
-  - name: serverless-rhel8-python3.13
-    tasks:
-      - name: .serverless
-    display_name: Serverless RHEL8 Python3.13
-    run_on:
-      - rhel87-small
-    batchtime: 10080
-    expansions:
-      PYTHON_BINARY: /opt/python/3.13/bin/python3
-
   # Stable api tests
   - name: stable-api-require-v1-rhel8-auth
     tasks:

.evergreen/scripts/generate_config.py

@@ -352,23 +352,6 @@ def create_disable_test_commands_variants():
     return [create_variant(tasks, display_name, host=host, python=python, expansions=expansions)]
 
 
-def create_serverless_variants():
-    host = DEFAULT_HOST
-    batchtime = BATCHTIME_WEEK
-    tasks = [".serverless"]
-    base_name = "Serverless"
-    return [
-        create_variant(
-            tasks,
-            get_variant_name(base_name, host, python=python),
-            host=host,
-            python=python,
-            batchtime=batchtime,
-        )
-        for python in MIN_MAX_PYTHON
-    ]
-
-
 def create_oidc_auth_variants():
     variants = []
     for host_name in ["ubuntu22", "macos", "win64"]:
@@ -920,7 +903,8 @@ def create_backport_pr_tasks():
         "${github_commit}",
     ]
     cmd = get_subprocess_exec(args=args)
-    return [EvgTask(name=name, commands=[cmd], allowed_requesters=["commit"])]
+    assume_func = FunctionCall(func="assume ec2 role")
+    return [EvgTask(name=name, commands=[assume_func, cmd], allowed_requesters=["commit"])]
 
 
 def create_ocsp_tasks():
@@ -968,14 +952,6 @@ def create_free_threading_tasks():
     return [EvgTask(name=task_name, tags=tags, commands=[server_func, test_func])]
 
 
-def create_serverless_tasks():
-    vars = dict(TEST_NAME="serverless", AUTH="auth", SSL="ssl")
-    test_func = FunctionCall(func="run tests", vars=vars)
-    tags = ["serverless"]
-    task_name = "test-serverless"
-    return [EvgTask(name=task_name, tags=tags, commands=[test_func])]
-
-
 ##############
 # Functions
 ##############

.evergreen/scripts/setup_tests.py

@@ -229,14 +229,6 @@ def handle_test_env() -> None:
             config = read_env(f"{DRIVERS_TOOLS}/.evergreen/atlas_data_lake/secrets-export.sh")
             DB_USER = config["ADL_USERNAME"]
             DB_PASSWORD = config["ADL_PASSWORD"]
-        elif test_name == "serverless":
-            run_command(f"bash {DRIVERS_TOOLS}/.evergreen/serverless/setup.sh")
-            config = read_env(f"{DRIVERS_TOOLS}/.evergreen/serverless/secrets-export.sh")
-            DB_USER = config["SERVERLESS_ATLAS_USER"]
-            DB_PASSWORD = config["SERVERLESS_ATLAS_PASSWORD"]
-            write_env("MONGODB_URI", config["SERVERLESS_URI"])
-            write_env("SINGLE_MONGOS_LB_URI", config["SERVERLESS_URI"])
-            write_env("MULTI_MONGOS_LB_URI", config["SERVERLESS_URI"])
         elif test_name == "auth_oidc":
             DB_USER = config["OIDC_ADMIN_USER"]
             DB_PASSWORD = config["OIDC_ADMIN_PWD"]

.evergreen/scripts/teardown_tests.py

@@ -36,10 +36,6 @@
 elif TEST_NAME == "ocsp":
     run_command(f"bash {DRIVERS_TOOLS}/.evergreen/ocsp/teardown.sh")
 
-# Tear down serverless if applicable.
-elif TEST_NAME == "serverless":
-    run_command(f"bash {DRIVERS_TOOLS}/.evergreen/serverless/teardown.sh")
-
 # Tear down atlas cluster if applicable.
 if TEST_NAME in ["aws_lambda", "search_index"]:
     run_command(f"bash {DRIVERS_TOOLS}/.evergreen/atlas/teardown-atlas-cluster.sh")

.evergreen/scripts/utils.py

@@ -45,7 +45,6 @@ class Distro:
     "mockupdb": "mockupdb",
     "ocsp": "ocsp",
     "perf": "perf",
-    "serverless": "",
 }
 
 # Tests that require a sub test suite.
@@ -60,7 +59,6 @@ class Distro:
     "aws_lambda",
     "data_lake",
     "mockupdb",
-    "serverless",
     "ocsp",
 ]
 

.github/workflows/codeql.yml

@@ -46,7 +46,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@fca7ace96b7d713c7035871441bd52efbe39e27e # v3
+      uses: github/codeql-action/init@ce28f5bb42b7a9f2c824e633a3f6ee835bab6858 # v3
       with:
         languages: ${{ matrix.language }}
         build-mode: ${{ matrix.build-mode }}
@@ -63,6 +63,6 @@ jobs:
         pip install -e .
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@fca7ace96b7d713c7035871441bd52efbe39e27e # v3
+      uses: github/codeql-action/analyze@ce28f5bb42b7a9f2c824e633a3f6ee835bab6858 # v3
       with:
         category: "/language:${{matrix.language}}"

.github/workflows/zizmor.yml

@@ -26,7 +26,7 @@ jobs:
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       - name: Upload SARIF file
-        uses: github/codeql-action/upload-sarif@fca7ace96b7d713c7035871441bd52efbe39e27e # v3
+        uses: github/codeql-action/upload-sarif@ce28f5bb42b7a9f2c824e633a3f6ee835bab6858 # v3
         with:
           sarif_file: results.sarif
           category: zizmor

CONTRIBUTING.md

@@ -190,13 +190,15 @@ just docs-serve
 Browse to the link provided, and then as you make changes to docstrings or narrative docs,
 the pages will re-render and the browser will automatically refresh.
 
-
 ## Running Tests Locally
 
--   Ensure you have started the appropriate Mongo Server(s).
 -   Run `just install` to set a local virtual environment, or you can manually
     create a virtual environment and run `pytest` directly.  If you want to use a specific
     version of Python, remove the `.venv` folder and set `PYTHON_BINARY` before running `just install`.
+-   Ensure you have started the appropriate Mongo Server(s).  You can run `just run-server` with optional args
+    to set up the server.  All given options will be passed to
+    [`run-orchestration.sh`](https://github.com/mongodb-labs/drivers-evergreen-tools/blob/master/.evergreen/run-orchestration.sh).  Run `$DRIVERS_TOOLS/evergreen/run-orchestration.sh -h`
+    for a full list of options.
 -   Run `just test` or `pytest` to run all of the tests.
 -   Append `test/<mod_name>.py::<class_name>::<test_name>` to run
     specific tests. You can omit the `<test_name>` to test a full class
@@ -213,18 +215,36 @@ the pages will re-render and the browser will automatically refresh.
     `git clone [email protected]:mongodb-labs/drivers-evergreen-tools.git`.
 - Run `export DRIVERS_TOOLS=$PWD/drivers-evergreen-tools`.  This can be put into a `.bashrc` file
   for convenience.
-- Set up access to [Drivers test secrets](https://github.com/mongodb-labs/drivers-evergreen-tools/tree/master/.evergreen/secrets_handling#secrets-handling).
+- Some tests require access to [Drivers test secrets](https://github.com/mongodb-labs/drivers-evergreen-tools/tree/master/.evergreen/secrets_handling#secrets-handling).
 
 ### Usage
 
-- Run `just run-server` with optional args to set up the server.  All given options will be passed to
-  `run-orchestration.sh` in `$DRIVERS_TOOLS`.  See `$DRIVERS_TOOLS/evergreen/run-orchestration.sh -h`
-  for a full list of options.
+- Run `just run-server` with optional args to set up the server.
 - Run `just setup-tests` with optional args to set up the test environment, secrets, etc.
   See `just setup-tests -h` for a full list of available options.
 - Run `just run-tests` to run the tests in an appropriate Python environment.
 - When done, run `just teardown-tests` to clean up and `just stop-server` to stop the server.
 
+### SSL tests
+
+- Run `just run-server --ssl` to start the server with TLS enabled.
+- Run `just setup-tests --ssl`.
+- Run `just run-tests`.
+
+Note: for general testing purposes with an TLS-enabled server, you can use the following (this should ONLY be used
+for local testing):
+
+```python
+from pymongo import MongoClient
+
+client = MongoClient(
+    "mongodb://localhost:27017?tls=true&tlsAllowInvalidCertificates=true"
+)
+```
+
+If you want to use the actual certificate file then set `tlsCertificateKeyFile` to the local path
+to `<repo_roo>/test/certificates/client.pem` and `tlsCAFile` to the local path to `<repo_roo>/test/certificates/ca.pem`.
+
 ### Encryption tests
 
 - Run `just run-server` to start the server.
@@ -434,6 +454,7 @@ run `pre-commit run --all-files --hook-stage manual ruff` and fix all reported e
 hook again.
 
 ## Converting a test to async
+
 The `tools/convert_test_to_async.py` script takes in an existing synchronous test file and outputs a
 partially-converted asynchronous version of the same name to the `test/asynchronous` directory.
 Use this generated file as a starting point for the completed conversion.

doc/changelog.rst

@@ -8,6 +8,39 @@ PyMongo 4.14 brings a number of changes including:
 - Added :attr:`bson.codec_options.TypeRegistry.codecs` and :attr:`bson.codec_options.TypeRegistry.fallback_encoder` properties
   to allow users to directly access the type codecs and fallback encoder for a given :class:`bson.codec_options.TypeRegistry`.
 
+Changes in Version 4.13.2 (2025/06/17)
+--------------------------------------
+
+Version 4.13.2 is a bug fix release.
+
+- Fixed a bug where ``AsyncMongoClient`` would block the event loop while creating new connections,
+  potentially significantly increasing latency for ongoing operations.
+
+Issues Resolved
+...............
+
+See the `PyMongo 4.13.2 release notes in JIRA`_ for the list of resolved issues
+in this release.
+
+.. _PyMongo 4.13.2 release notes in JIRA: https://jira.mongodb.org/secure/ReleaseNote.jspa?projectId=10004&version=43937
+
+
+Changes in Version 4.13.1 (2025/06/10)
+--------------------------------------
+
+Version 4.13.1 is a bug fix release.
+
+- Fixed a bug that could raise ``ServerSelectionTimeoutError`` when using timeouts with ``AsyncMongoClient``.
+- Fixed a bug that could raise ``NetworkTimeout`` errors on Windows.
+
+Issues Resolved
+...............
+
+See the `PyMongo 4.13.1 release notes in JIRA`_ for the list of resolved issues
+in this release.
+
+.. _PyMongo 4.13.1 release notes in JIRA: https://jira.mongodb.org/secure/ReleaseNote.jspa?projectId=10004&version=43924
+
 Changes in Version 4.13.0 (2025/05/14)
 --------------------------------------
 
@@ -1700,8 +1733,7 @@ Changes in Version 3.8.0 (2019/04/22)
 -------------------------------------
 
 .. warning:: PyMongo no longer supports Python 2.6. RHEL 6 users should install
-  Python 2.7 or newer from `Red Hat Software Collections
-  <https://developers.redhat.com/products/softwarecollections/overview>`_.
+  Python 2.7 or newer from Red Hat Software Collections.
   CentOS 6 users should install Python 2.7 or newer from `SCL
   <https://wiki.centos.org/AdditionalResources/Repositories/SCL>`_
 

doc/conf.py

@@ -82,7 +82,7 @@
 # Options for link checking
 # The anchors on the rendered markdown page are created after the fact,
 # so those link results in a 404.
-# wiki.centos.org has been flakey.
+# wiki.centos.org has been flaky.
 # sourceforge.net is giving a 403 error, but is still accessible from the browser.
 linkcheck_ignore = [
     "https://github.com/mongodb/specifications/blob/master/source/server-discovery-and-monitoring/server-monitoring.md#requesting-an-immediate-check",
@@ -91,6 +91,9 @@
     r"https://sourceforge.net/",
 ]
 
+# Allow for flaky links.
+linkcheck_retries = 3
+
 # -- Options for extensions ----------------------------------------------------
 autoclass_content = "init"
 

pymongo/network_layer.py

@@ -286,6 +286,7 @@ async def _async_socket_receive(
 
 
 _PYPY = "PyPy" in sys.version
+_WINDOWS = sys.platform == "win32"
 
 
 def wait_for_read(conn: Connection, deadline: Optional[float]) -> None:
@@ -337,7 +338,8 @@ def receive_data(conn: Connection, length: int, deadline: Optional[float]) -> me
         while bytes_read < length:
             try:
                 # Use the legacy wait_for_read cancellation approach on PyPy due to PYTHON-5011.
-                if _PYPY:
+                # also use it on Windows due to PYTHON-5405
+                if _PYPY or _WINDOWS:
                     wait_for_read(conn, deadline)
                     if _csot.get_timeout() and deadline is not None:
                         conn.set_conn_timeout(max(deadline - time.monotonic(), 0))
@@ -359,6 +361,7 @@ def receive_data(conn: Connection, length: int, deadline: Optional[float]) -> me
                     raise _OperationCancelled("operation cancelled") from None
                 if (
                     _PYPY
+                    or _WINDOWS
                     or not conn.is_sdam
                     and deadline is not None
                     and deadline - time.monotonic() < 0

pymongo/pool_shared.py

@@ -206,7 +206,8 @@ async def _async_create_connection(address: _Address, options: PoolOptions) -> s
         # SOCK_CLOEXEC not supported for Unix sockets.
         _set_non_inheritable_non_atomic(sock.fileno())
         try:
-            sock.connect(host)
+            sock.setblocking(False)
+            await asyncio.get_running_loop().sock_connect(sock, host)
             return sock
         except OSError:
             sock.close()
@@ -241,14 +242,22 @@ async def _async_create_connection(address: _Address, options: PoolOptions) -> s
                 timeout = options.connect_timeout
             elif timeout <= 0:
                 raise socket.timeout("timed out")
-            sock.settimeout(timeout)
             sock.setsockopt(socket.SOL_SOCKET, socket.SO_KEEPALIVE, True)
             _set_keepalive_times(sock)
-            sock.connect(sa)
+            # Socket needs to be non-blocking during connection to not block the event loop
+            sock.setblocking(False)
+            await asyncio.wait_for(
+                asyncio.get_running_loop().sock_connect(sock, sa), timeout=timeout
+            )
+            sock.settimeout(timeout)
             return sock
+        except asyncio.TimeoutError as e:
+            sock.close()
+            err = socket.timeout("timed out")
+            err.__cause__ = e
         except OSError as e:
-            err = e
             sock.close()
+            err = e  # type: ignore[assignment]
 
     if err is not None:
         raise err

pymongo/pyopenssl_context.py

@@ -420,9 +420,9 @@ def wrap_socket(
                         pyopenssl.verify_ip_address(ssl_conn, server_hostname)
                     else:
                         pyopenssl.verify_hostname(ssl_conn, server_hostname)
-                except (  # type:ignore[misc]
-                    service_identity.SICertificateError,
-                    service_identity.SIVerificationError,
+                except (
+                    service_identity.CertificateError,
+                    service_identity.VerificationError,
                 ) as exc:
                     raise _CertificateError(str(exc)) from None
         return ssl_conn