libmongocrypt-helper 1.12.0.0.1001 → 1.13.2.0.1001

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cf00b6a450f6aa77d228d83130381cf15bb20b0d82ae51dbcd82e7b336cd2fd4
-  data.tar.gz: 537ccd4a814e42d8f629d87de31dd031b3b3ef9b5172143b758fe08bd9752b1f
+  metadata.gz: baf822be923fbdd64028517f349c49776bcd49fc71a20b2625bb0e7f947db6ee
+  data.tar.gz: d54d214ba2f0bbab4ad98adb1eb36ec4f1bd301eda8835e02a8f211c787a925a
 SHA512:
-  metadata.gz: 5f05b0d6482958635e20eb894f18f5920ee554b5d6a9dff45014360bcb7253f58b63a3e7a92094d5a12f1ce37aa628625127bd66dcf11844d637a0dfaeed59ac
-  data.tar.gz: aea6e38f174a6befc37016dd379cc20e92683f0c0400dcb014e4906ab5380edf3f89c6de9ff99fd4ff17bd5e1c6c2af62e4ff263286e48715b738e57cc3a6af5
+  metadata.gz: d834c0a45d8f3bdd61e6031f9bb9ef2f66dee31c1155c8ac15b33b22cba6267b6cfc714235c0a93e010a701535ee3e8615276af62239e30d764d4adac10b69f6
+  data.tar.gz: 63e6f9acb70f94690bd11edd415fbfffabb5051c8c5c59b6ddaeeb809e0f423f24297f0541ca3f1e8e3e496b66beaae2fea7b05add2d4dd16af44aa1615b398a

data/ext/libmongocrypt/libmongocrypt/CHANGELOG.md

@@ -1,10 +1,29 @@
 # ChangeLog
+## 1.13.2
+### Notes
+- Bump downloaded libbson version from 1.28.1 to 1.30.3. Fixes a CMake configure error on macOS with CMake 4.
+## 1.13.1
+### Fixed
+- Fix possible double free on parse error of malformed payload.
+- Fix build failure when configuring with `ENABLE_TRACE=ON`.
+- Fix possible redefinition of `_GNU_SOURCE`.
+
+## 1.13.0
+### New features
+- Support automatic encryption for `$lookup` stages in `aggregate` pipelines on MongoDB server 8.1+.
+### Fixed
+- Restore default behavior to disable extra alignment when importing libbson. This was the default behavior in 1.11. This can be overridden by setting the CMake option `ENABLE_EXTRA_ALIGNMENT=ON`.
+### Removed
+- Support for macOS versions older than 11. libmongocrypt is supported and tested with macOS 11+.
+
 ## 1.12.0
 ### New features
 - Add option to configure Data Encryption Key cache lifetime (`mongocrypt_setopt_key_expiration`)
 - Add opt-in retry behavior for KMS operations (`mongocrypt_setopt_retry_kms`)
 ### Removed
 - libmongocrypt is no longer published in the MongoDB package repository for RHEL 6. libmongocrypt may instead be built from source on RHEL 6, but support for RHEL 6 will be dropped in a future release.
+### Notes
+- This release unintentionally changes the default behavior of extra alignment with importing libbson. See 1.13.0 release notes.
 
 ## 1.11.0
 ### New features

data/ext/libmongocrypt/libmongocrypt/CMakeLists.txt

@@ -120,6 +120,9 @@ set (MONGOCRYPT_SOURCES
    src/mc-range-encoding.c
    src/mc-rangeopts.c
    src/mc-reader.c
+   src/mc-schema-broker.c
+   src/mc-str-encode-string-sets.c
+   src/mc-text-search-str-encode.c
    src/mc-tokens.c
    src/mc-writer.c
    src/mongocrypt-binary.c
@@ -151,6 +154,9 @@ set (MONGOCRYPT_SOURCES
    src/os_posix/os_mutex.c
    src/os_win/os_dll.c
    src/os_posix/os_dll.c
+   src/unicode/case-fold-map.c
+   src/unicode/diacritic-fold-map.c
+   src/unicode/fold.c
    )
 
 # If MONGOCRYPT_CRYPTO is not set, choose a system default.
@@ -460,6 +466,7 @@ set (TEST_MONGOCRYPT_SOURCES
    test/test-gcp-auth.c
    test/test-mc-cmp.c
    test/test-mc-efc.c
+   test/test-mc-fle2-encryption-placeholder.c
    test/test-mc-fle2-find-equality-payload-v2.c
    test/test-mc-fle2-find-range-payload-v2.c
    test/test-mc-fle2-payload-iev.c
@@ -474,6 +481,8 @@ set (TEST_MONGOCRYPT_SOURCES
    test/test-mc-range-mincover.c
    test/test-mc-rangeopts.c
    test/test-mc-reader.c
+   test/test-mc-text-search-str-encode.c
+   test/test-mc-schema-broker.c
    test/test-mc-tokens.c
    test/test-mc-range-encoding.c
    test/test-mc-writer.c
@@ -510,6 +519,7 @@ set (TEST_MONGOCRYPT_SOURCES
    test/test-mongocrypt-util.c
    test/test-mongocrypt.c
    test/test-named-kms-providers.c
+   test/test-unicode-fold.c
    )
 
 # Define test-mongocrypt

data/ext/libmongocrypt/libmongocrypt/CODEOWNERS

@@ -1,7 +1,4 @@
 # Code Owners will automatically be added as reviewers on PRs
 
 # Python Bindings
-bindings/python @mongodb/dbx-python
-
-# Java Bindings
-bindings/java @jyemin @rozza
+bindings/python @mongodb/dbx-python

data/ext/libmongocrypt/libmongocrypt/CONTRIBUTING.md

@@ -0,0 +1,14 @@
+# Formatting
+
+To format, install `pipx` and run:
+```bash
+./etc/format-all.sh
+```
+
+To use a specified python install, set `MONGOCRYPT_PYTHON`:
+
+```bash
+# Set MONGOCRYPT_PYTHON to a python install with pipx installed.
+export MONGOCRYPT_PYTHON=python
+./etc/format-all.sh
+```

data/ext/libmongocrypt/libmongocrypt/Earthfile

@@ -54,11 +54,11 @@
     #   • DO NOT: "ubuntu"
     #   • DO NOT: "ubuntu:latest"
     #   • DO NOT: "ubuntu:22.10"
-    #   • DO: "docker.io/library/ubuntu:22.10"
+    #   • DO: "artifactory.corp.mongodb.com/dockerhub/library/ubuntu:22.10"
 # ###
 
 VERSION --use-cache-command 0.6
-FROM docker.io/library/alpine:3.16
+FROM artifactory.corp.mongodb.com/dockerhub/library/alpine:3.16
 WORKDIR /s
 
 init:
@@ -125,24 +125,24 @@ ALPINE_SETUP:
 
 env.c6:
     # A CentOS 6 environment.
-    FROM +init --base=docker.io/library/centos:6
+    FROM +init --base=artifactory.corp.mongodb.com/dockerhub/library/centos:6
     DO +CENTOS6_SETUP
 
 env.c7:
     # A CentOS 7 environment.
-    FROM +init --base=docker.io/library/centos:7
+    FROM +init --base=artifactory.corp.mongodb.com/dockerhub/library/centos:7
     DO +REDHAT_SETUP
 
 env.rl8:
     # CentOS 8 is cancelled. Use RockyLinux 8 for our RHEL 8 environment.
-    FROM +init --base=docker.io/library/rockylinux:8
+    FROM +init --base=artifactory.corp.mongodb.com/dockerhub/library/rockylinux:8
     DO +REDHAT_SETUP
 
 # Utility command for Ubuntu environments
 ENV_UBUNTU:
     COMMAND
     ARG --required version
-    FROM +init --base=docker.io/library/ubuntu:$version
+    FROM +init --base=artifactory.corp.mongodb.com/dockerhub/library/ubuntu:$version
     DO +DEBIAN_SETUP
 
 env.u14:
@@ -167,19 +167,19 @@ env.u22:
 
 env.amzn1:
     # An Amazon "1" environment. (AmazonLinux 2018)
-    FROM +init --base=docker.io/library/amazonlinux:2018.03
+    FROM +init --base=artifactory.corp.mongodb.com/dockerhub/library/amazonlinux:2018.03
     DO +AMZ_SETUP
 
 env.amzn2:
     # An AmazonLinux 2 environment
-    FROM +init --base=docker.io/library/amazonlinux:2
+    FROM +init --base=artifactory.corp.mongodb.com/dockerhub/library/amazonlinux:2
     DO +AMZ_SETUP
 
 # Utility command for Debian setup
 ENV_DEBIAN:
     COMMAND
     ARG --required version
-    FROM +init --base=docker.io/library/debian:$version
+    FROM +init --base=artifactory.corp.mongodb.com/dockerhub/library/debian:$version
     IF [ $version = "9.2" ]
         # Update source list for archived Debian stretch packages.
         # Refer: https://unix.stackexchange.com/a/743865/260858
@@ -208,11 +208,11 @@ env.deb12:
 
 env.sles15:
     # An OpenSUSE Leap 15.0 environment.
-    FROM +init --base=docker.io/opensuse/leap:15.0
+    FROM +init --base=artifactory.corp.mongodb.com/dockerhub/opensuse/leap:15.0
     DO +SLES_SETUP
 
 env.alpine:
-    FROM +init --base=docker.io/library/alpine:3.18
+    FROM +init --base=artifactory.corp.mongodb.com/dockerhub/library/alpine:3.18
     DO +ALPINE_SETUP
 
 # Utility: Warm-up obtaining CMake and Ninja for the build. This is usually
@@ -259,7 +259,7 @@ BUILD_EXAMPLE_STATE_MACHINE:
     RUN cd /s && /s/example-state-machine
 
 rpm-build:
-    FROM +init --base fedora:38
+    FROM +init --base artifactory.corp.mongodb.com/dockerhub/fedora:38
     GIT CLONE https://src.fedoraproject.org/rpms/libmongocrypt.git /R
     # Install the packages listed by "BuildRequires" and rpm-build:
     RUN __install $(awk '/^BuildRequires:/ { print $2 }' /R/libmongocrypt.spec) \
@@ -275,7 +275,7 @@ rpm-build:
 
 rpm-install-runtime:
     # Install the runtime RPM
-    FROM +init --base fedora:38
+    FROM +init --base artifactory.corp.mongodb.com/dockerhub/fedora:38
     COPY +rpm-build/RPMS /tmp/libmongocrypt-rpm/
     RUN dnf makecache
     RUN __install $(find /tmp/libmongocrypt-rpm/ -name 'libmongocrypt-1.*.rpm')
@@ -325,7 +325,7 @@ deb-build:
 
 deb-install-runtime:
     # Install the runtime deb package
-    FROM +init --base=docker.io/library/debian:unstable
+    FROM +init --base=artifactory.corp.mongodb.com/dockerhub/library/debian:unstable
     COPY +deb-build/debs/libmongocrypt0*.deb /tmp/lmc.deb
     RUN __install /tmp/lmc.deb
 
@@ -354,7 +354,8 @@ packaging-full-test:
     BUILD +rpm-runtime-test
 
 check-format:
-    FROM python:3.11.2-slim-buster
+    FROM +init --base=artifactory.corp.mongodb.com/dockerhub/python:3.11.2-slim-buster
+    RUN __install build-essential # To install `make` to install clang-format.
     RUN pip install pipx
     COPY etc/format* /X/etc/
     COPY .evergreen/init.sh /X/.evergreen/
@@ -461,16 +462,15 @@ sign:
 #
 # See https://docs.devprod.prod.corp.mongodb.com/mms/python/src/sbom/silkbomb/ for documentation of silkbomb.
 silkbomb:
-    FROM artifactory.corp.mongodb.com/release-tools-container-registry-public-local/silkbomb:1.0
-    # Alias the silkbom executable to a simpler name:
+    FROM artifactory.corp.mongodb.com/release-tools-container-registry-public-local/silkbomb:2.0
+    # Alias the silkbomb executable to a simpler name:
     RUN ln -s /python/src/sbom/silkbomb/bin /usr/local/bin/silkbomb
 
 # sbom-generate:
 #   Generate/update the etc/cyclonedx.sbom.json file from the etc/purls.txt file.
 #
 # This target will update the existing etc/cyclonedx.sbom.json file in-place based
-# on the content of etc/purls.txt.
-#
+# on the content of etc/purls.txt and etc/cyclonedx.sbom.json.
 sbom-generate:
     FROM +silkbomb
     # Copy in the relevant files:
@@ -478,45 +478,44 @@ sbom-generate:
     COPY etc/purls.txt etc/cyclonedx.sbom.json /s/
     # Update the SBOM file:
     RUN silkbomb update \
+        --refresh \
+        --no-update-sbom-version \
         --purls purls.txt \
         --sbom-in cyclonedx.sbom.json \
         --sbom-out cyclonedx.sbom.json
     # Save the result back to the host:
     SAVE ARTIFACT /s/cyclonedx.sbom.json AS LOCAL etc/cyclonedx.sbom.json
 
-# sbom-download:
-#   Download the Augmented SBOM file from Silk.
-#
-# See https://wiki.corp.mongodb.com/display/DRIVERS/Using+AWS+Secrets+Manager+to+Store+Testing+Secrets for instructions to get secrets from AWS Secrets Manager. Secrets are available under `drivers/libmongocrypt`.
+# sbom-generate-new-serial-number:
+#   Equivalent to +sbom-generate but includes the --generate-new-serial-number
+#   flag to generate a new unique serial number and reset the SBOM version to 1.
 #
-sbom-download:
-    ARG --required out
-    ARG --required branch
+# This target will update the existing etc/cyclonedx.sbom.json file in-place based
+# on the content of etc/purls.txt and etc/cyclonedx.sbom.json.
+sbom-generate-new-serial-number:
     FROM +silkbomb
+    # Copy in the relevant files:
     WORKDIR /s
-    # Download the Augmented SBOM file:
-    RUN --no-cache --secret silk_client_id --secret silk_client_secret \
-        SILK_CLIENT_ID=${silk_client_id} \
-        SILK_CLIENT_SECRET=${silk_client_secret} \
-        silkbomb download \
-        --sbom-out cyclonedx.augmented.sbom.json \
-        --silk-asset-group libmongocrypt-${branch}
+    COPY etc/purls.txt etc/cyclonedx.sbom.json /s/
+    # Update the SBOM file:
+    RUN silkbomb update \
+        --refresh \
+        --generate-new-serial-number \
+        --purls purls.txt \
+        --sbom-in cyclonedx.sbom.json \
+        --sbom-out cyclonedx.sbom.json
     # Save the result back to the host:
-    SAVE ARTIFACT /s/cyclonedx.augmented.sbom.json AS LOCAL ${out}
-    RUN echo "Augmented SBOM saved to ${out}"
+    SAVE ARTIFACT /s/cyclonedx.sbom.json AS LOCAL etc/cyclonedx.sbom.json
 
-# silk-create-asset-group:
-#   Create an asset group for Silk.
-#
-# See https://wiki.corp.mongodb.com/display/DRIVERS/Using+AWS+Secrets+Manager+to+Store+Testing+Secrets for instructions to get secrets from AWS Secrets Manager. Secrets are available under `drivers/libmongocrypt`.
-#
-silk-create-asset-group:
-    ARG --required branch
-    FROM +env.alpine
-    RUN __install curl jq
-    COPY etc/silk-create-asset-group.sh /s/silk-create-asset-group.sh
-    RUN --no-cache --secret silk_client_id --secret silk_client_secret \
-        silk_client_id=${silk_client_id} \
-        silk_client_secret=${silk_client_secret} \
-        branch=${branch} \
-            /s/silk-create-asset-group.sh
+# sbom-validate:
+#   Validate the SBOM Lite for the given branch.
+sbom-validate:
+    FROM +silkbomb
+    # Copy in the relevant files:
+    WORKDIR /s
+    COPY etc/purls.txt etc/cyclonedx.sbom.json /s/
+    # Run the SilkBomb tool to download the artifact that matches the requested branch
+    RUN silkbomb validate \
+        --purls purls.txt \
+        --sbom-in cyclonedx.sbom.json \
+        --exclude jira

data/ext/libmongocrypt/libmongocrypt/README.md

@@ -95,15 +95,6 @@ If there are errors with cmake configuration, send the set of steps you performe
 
 If there are compilation or linker errors, run `make` again, setting `VERBOSE=1` in the environment or on the command line (which shows exact compile and link commands), and send the output to the maintainers of this project.
 
-### Design Principles ###
-The design of libmongocrypt adheres to these principles.
-
-#### Easy to integrate ####
-The main reason behind creating a C library is to make it easier for drivers to support FLE. Some consequences of this principle: the API is minimal, structs are opaque, and global initialization is lazy.
-
-#### Lightweight ####
-We decided against the "have libmongocrypt do everything" approach because it complicated integration, especially with async drivers. Because of this we decided no I/O occurs in libmongocrypt.
-
 ### Releasing ###
 
 See [releasing](./doc/releasing.md).
@@ -112,7 +103,7 @@ See [releasing](./doc/releasing.md).
 Distribution packages (i.e., .deb/.rpm) are built and published for several Linux distributions.  The installation of these packages for supported platforms is documented here.
 
 ### Unstable Development Distribution Packages ###
-To install the latest unstable development package, change `1.12` to `development` in the package URLs listed in the subsequent instructions. For example, `https://libmongocrypt.s3.amazonaws.com/apt/ubuntu <release>/libmongocrypt/1.12` in the instructions would become `https://libmongocrypt.s3.amazonaws.com/apt/ubuntu <release>/libmongocrypt/development`. Do not use the unstable version of libmongocrypt in a production environment.
+To install the latest unstable development package, change `1.13` to `development` in the package URLs listed in the subsequent instructions. For example, `https://libmongocrypt.s3.amazonaws.com/apt/ubuntu <release>/libmongocrypt/1.13` in the instructions would become `https://libmongocrypt.s3.amazonaws.com/apt/ubuntu <release>/libmongocrypt/development`. Do not use the unstable version of libmongocrypt in a production environment.
 
 ### .deb Packages (Debian and Ubuntu) ###
 
@@ -153,13 +144,13 @@ sudo sh -c 'curl -s --location https://pgp.mongodb.com/libmongocrypt.asc | gpg -
 Second, create a list entry for the repository.  For Ubuntu systems (be sure to change `<release>` to `xenial`, `bionic`, `focal`, or `jammy`, as appropriate to your system):
 
 ```
-echo "deb https://libmongocrypt.s3.amazonaws.com/apt/ubuntu <release>/libmongocrypt/1.12 universe" | sudo tee /etc/apt/sources.list.d/libmongocrypt.list
+echo "deb https://libmongocrypt.s3.amazonaws.com/apt/ubuntu <release>/libmongocrypt/1.13 universe" | sudo tee /etc/apt/sources.list.d/libmongocrypt.list
 ```
 
 For Debian systems (be sure to change `<release>` to `stretch`, `buster`, `bullseye`, or `bookworm` as appropriate to your system):
 
 ```
-echo "deb https://libmongocrypt.s3.amazonaws.com/apt/debian <release>/libmongocrypt/1.12 main" | sudo tee /etc/apt/sources.list.d/libmongocrypt.list
+echo "deb https://libmongocrypt.s3.amazonaws.com/apt/debian <release>/libmongocrypt/1.13 main" | sudo tee /etc/apt/sources.list.d/libmongocrypt.list
 ```
 
 #### Package installation ####
@@ -181,7 +172,7 @@ Create the file `/etc/yum.repos.d/libmongocrypt.repo` with contents:
 ```
 [libmongocrypt]
 name=libmongocrypt repository
-baseurl=https://libmongocrypt.s3.amazonaws.com/yum/redhat/$releasever/libmongocrypt/1.12/x86_64
+baseurl=https://libmongocrypt.s3.amazonaws.com/yum/redhat/$releasever/libmongocrypt/1.13/x86_64
 gpgcheck=1
 enabled=1
 gpgkey=https://pgp.mongodb.com/libmongocrypt.asc
@@ -200,7 +191,7 @@ Create the file `/etc/yum.repos.d/libmongocrypt.repo` with contents:
 ```
 [libmongocrypt]
 name=libmongocrypt repository
-baseurl=https://libmongocrypt.s3.amazonaws.com/yum/amazon/2023/libmongocrypt/1.12/x86_64
+baseurl=https://libmongocrypt.s3.amazonaws.com/yum/amazon/2023/libmongocrypt/1.13/x86_64
 gpgcheck=1
 enabled=1
 gpgkey=https://pgp.mongodb.com/libmongocrypt.asc
@@ -219,7 +210,7 @@ Create the file `/etc/yum.repos.d/libmongocrypt.repo` with contents:
 ```
 [libmongocrypt]
 name=libmongocrypt repository
-baseurl=https://libmongocrypt.s3.amazonaws.com/yum/amazon/2/libmongocrypt/1.12/x86_64
+baseurl=https://libmongocrypt.s3.amazonaws.com/yum/amazon/2/libmongocrypt/1.13/x86_64
 gpgcheck=1
 enabled=1
 gpgkey=https://pgp.mongodb.com/libmongocrypt.asc
@@ -238,7 +229,7 @@ Create the file `/etc/yum.repos.d/libmongocrypt.repo` with contents:
 ```
 [libmongocrypt]
 name=libmongocrypt repository
-baseurl=https://libmongocrypt.s3.amazonaws.com/yum/amazon/2013.03/libmongocrypt/1.12/x86_64
+baseurl=https://libmongocrypt.s3.amazonaws.com/yum/amazon/2013.03/libmongocrypt/1.13/x86_64
 gpgcheck=1
 enabled=1
 gpgkey=https://pgp.mongodb.com/libmongocrypt.asc
@@ -261,7 +252,7 @@ sudo rpm --import https://pgp.mongodb.com/libmongocrypt.asc
 Second, add the repository (be sure to change `<release>` to `12` or `15`, as appropriate to your system):
 
 ```
-sudo zypper addrepo --gpgcheck "https://libmongocrypt.s3.amazonaws.com/zypper/suse/<release>/libmongocrypt/1.12/x86_64" libmongocrypt
+sudo zypper addrepo --gpgcheck "https://libmongocrypt.s3.amazonaws.com/zypper/suse/<release>/libmongocrypt/1.13/x86_64" libmongocrypt
 ```
 
 Finally, install the libmongocrypt packages:

data/ext/libmongocrypt/libmongocrypt/bindings/python/CHANGELOG.rst

@@ -1,6 +1,12 @@
 Changelog
 =========
 
+Changes in Version 1.12.0
+-------------------------
+
+- Bundle libmongocrypt 1.12.0 in release wheels.
+- Add support for kms retries.
+
 Changes in Version 1.11.0
 -------------------------
 

data/ext/libmongocrypt/libmongocrypt/bindings/python/README.rst

@@ -34,7 +34,7 @@ Please open a case in our issue management tool, JIRA:
 - Navigate to `the PYTHON project <https://jira.mongodb.org/browse/PYTHON>`_.
 - Click **Create Issue** - Please provide as much information as possible about the issue type and how to reproduce it.
 
-Bug reports in JIRA for all driver projects (i.e. PYTHON, CSHARP, JAVA) and the
+Bug reports in JIRA for all driver projects (i.e. PYTHON, CSHARP) and the
 Core Server (i.e. SERVER) project are **public**.
 
 How To Ask For Help

data/ext/libmongocrypt/libmongocrypt/bindings/python/libmongocrypt-version.txt

@@ -1 +1 @@
-1.11.0
+1.12.0

data/ext/libmongocrypt/libmongocrypt/bindings/python/pymongocrypt/binding.py

@@ -312,6 +312,17 @@ mongocrypt_t *mongocrypt_new(void);
  */
 bool mongocrypt_setopt_log_handler(mongocrypt_t *crypt, mongocrypt_log_fn_t log_fn, void *log_ctx);
 
+/**
+ * Enable or disable KMS retry behavior.
+ *
+ * @param[in] crypt The @ref mongocrypt_t object.
+ * @param[in] enable A boolean indicating whether to retry operations.
+ * @pre @ref mongocrypt_init has not been called on @p crypt.
+ * @returns A boolean indicating success. If false, an error status is set.
+ * Retrieve it with @ref mongocrypt_ctx_status
+ */
+bool mongocrypt_setopt_retry_kms(mongocrypt_t *crypt, bool enable);
+
 /**
  * Configure an AWS KMS provider on the @ref mongocrypt_t object.
  *
@@ -1042,6 +1053,8 @@ typedef struct _mongocrypt_kms_ctx_t mongocrypt_kms_ctx_t;
  * If KMS handles are being handled synchronously, the driver can reuse the same
  * TLS socket to send HTTP requests and receive responses.
  *
+ * The returned KMS handle does not outlive `ctx`.
+ *
  * @param[in] ctx A @ref mongocrypt_ctx_t.
  * @returns a new @ref mongocrypt_kms_ctx_t or NULL.
  */
@@ -1086,6 +1099,14 @@ bool mongocrypt_kms_ctx_endpoint(mongocrypt_kms_ctx_t *kms, const char **endpoin
  */
 uint32_t mongocrypt_kms_ctx_bytes_needed(mongocrypt_kms_ctx_t *kms);
 
+/**
+ * Indicates how long to sleep before sending this request.
+ *
+ * @param[in] kms The @ref mongocrypt_kms_ctx_t.
+ * @returns How long to sleep in microseconds.
+ */
+int64_t mongocrypt_kms_ctx_usleep(mongocrypt_kms_ctx_t *kms);
+
 /**
  * Feed bytes from the HTTP response.
  *
@@ -1100,6 +1121,14 @@ uint32_t mongocrypt_kms_ctx_bytes_needed(mongocrypt_kms_ctx_t *kms);
  */
 bool mongocrypt_kms_ctx_feed(mongocrypt_kms_ctx_t *kms, mongocrypt_binary_t *bytes);
 
+/**
+ * Indicate a network-level failure.
+ *
+ * @param[in] kms The @ref mongocrypt_kms_ctx_t.
+ * @return A boolean indicating whether the failed request may be retried.
+ */
+bool mongocrypt_kms_ctx_fail(mongocrypt_kms_ctx_t *kms);
+
 /**
  * Get the status associated with a @ref mongocrypt_kms_ctx_t object.
  *
@@ -1413,7 +1442,7 @@ bool mongocrypt_ctx_setopt_query_type(mongocrypt_ctx_t *ctx, const char *query_t
  * {
  *    "min": Optional<BSON value>,
  *    "max": Optional<BSON value>,
- *    "sparsity": Int64,
+ *    "sparsity": Optional<Int64>,
  *    "precision": Optional<Int32>,
  *    "trimFactor": Optional<Int32>
  * }
@@ -1426,6 +1455,15 @@ bool mongocrypt_ctx_setopt_query_type(mongocrypt_ctx_t *ctx, const char *query_t
  */
 bool mongocrypt_ctx_setopt_algorithm_range(mongocrypt_ctx_t *ctx, mongocrypt_binary_t *opts);
 
+/**
+ * Set the expiration time for the data encryption key cache. Defaults to 60 seconds if not set.
+ *
+ * @param[in] ctx The @ref mongocrypt_ctx_t object.
+ * @param[in] cache_expiration_ms The cache expiration time in milliseconds. If zero, the cache
+ * never expires.
+ */
+bool mongocrypt_setopt_key_expiration(mongocrypt_t *crypt, uint64_t cache_expiration_ms);
+
 /// String constants for setopt_query_type
 // DEPRECATED: Support "rangePreview" has been removed in favor of "range".
 """

data/ext/libmongocrypt/libmongocrypt/bindings/python/pymongocrypt/mongocrypt.py

@@ -149,6 +149,14 @@ class MongoCrypt:
         if any([on_demand_aws, on_demand_gcp, on_demand_azure]):
             lib.mongocrypt_setopt_use_need_kms_credentials_state(self.__crypt)
 
+        # Enable KMS retry when available, libmongocrypt >= 1.12.0,
+        try:
+            if not lib.mongocrypt_setopt_retry_kms(self.__crypt, True):
+                self.__raise_from_status()
+        except AttributeError:
+            # libmongocrypt < 1.12
+            pass
+
         if not lib.mongocrypt_init(self.__crypt):
             self.__raise_from_status()
 
@@ -670,6 +678,30 @@ class MongoCryptKmsContext:
             if not lib.mongocrypt_kms_ctx_feed(self.__ctx, binary.bin):
                 self.__raise_from_status()
 
+    @property
+    def usleep(self):
+        """Indicates how long to sleep in microseconds before sending this request.
+
+        .. versionadded:: 1.12
+        """
+        try:
+            return lib.mongocrypt_kms_ctx_usleep(self.__ctx)
+        except AttributeError:
+            # libmongocrypt < 1.12
+            return 0
+
+    def fail(self):
+        """Indicate a network-level failure.
+
+        .. versionadded:: 1.12
+        """
+        try:
+            if not lib.mongocrypt_kms_ctx_fail(self.__ctx):
+                self.__raise_from_status()
+        except AttributeError:
+            # libmongocrypt < 1.12
+            pass
+
     def __raise_from_status(self):
         status = lib.mongocrypt_status_new()
         try:

data/ext/libmongocrypt/libmongocrypt/bindings/python/pymongocrypt/version.py

@@ -12,6 +12,6 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-__version__ = "1.12.0.dev0"
+__version__ = "1.13.0.dev0"
 
 _MIN_LIBMONGOCRYPT_VERSION = "1.8.0"

data/ext/libmongocrypt/libmongocrypt/bindings/python/release.sh

@@ -19,7 +19,7 @@ set -o errexit  # Exit the script with error if any of the commands fail
 LIBMONGOCRYPT_VERSION=$(cat ./libmongocrypt-version.txt)
 REVISION=$(git rev-list -n 1 $LIBMONGOCRYPT_VERSION)
 # The libmongocrypt release branch.
-BRANCH="r1.11"
+BRANCH="r1.12"
 # The python executable to use.
 PYTHON=${PYTHON:-python}
 

data/ext/libmongocrypt/libmongocrypt/bindings/python/sbom.json

@@ -1,31 +1,31 @@
 {
   "components": [
     {
-      "bom-ref": "pkg:github/mongodb/libmongocrypt@1.11.0",
+      "bom-ref": "pkg:github/mongodb/libmongocrypt@1.12.0",
       "externalReferences": [
         {
           "type": "distribution",
-          "url": "https://github.com/mongodb/libmongocrypt/archive/refs/tags/1.11.0.tar.gz"
+          "url": "https://github.com/mongodb/libmongocrypt/archive/refs/tags/1.12.0.tar.gz"
         },
         {
           "type": "website",
-          "url": "https://github.com/mongodb/libmongocrypt/tree/1.11.0"
+          "url": "https://github.com/mongodb/libmongocrypt/tree/1.12.0"
         }
       ],
       "group": "mongodb",
       "name": "libmongocrypt",
-      "purl": "pkg:github/mongodb/libmongocrypt@1.11.0",
+      "purl": "pkg:github/mongodb/libmongocrypt@1.12.0",
       "type": "library",
-      "version": "1.11.0"
+      "version": "1.12.0"
     }
   ],
   "dependencies": [
     {
-      "ref": "pkg:github/mongodb/libmongocrypt@1.11.0"
+      "ref": "pkg:github/mongodb/libmongocrypt@1.12.0"
     }
   ],
   "metadata": {
-    "timestamp": "2024-08-08T02:35:36.986098+00:00",
+    "timestamp": "2024-12-30T18:25:06.574241+00:00",
     "tools": [
       {
         "externalReferences": [
@@ -68,7 +68,7 @@
       }
     ]
   },
-  "serialNumber": "urn:uuid:14e22848-7554-4f82-bcd1-76d2891b4c66",
+  "serialNumber": "urn:uuid:5e81b4d2-1313-43dd-9ec0-b958d0d71bca",
   "version": 1,
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",

data/ext/libmongocrypt/libmongocrypt/bindings/python/test/data/compact/success/encrypted-field-config-map.json

@@ -1,7 +1,6 @@
 {
     "db.test": {
         "escCollection": "esc",
-        "eccCollection": "ecc",
         "ecocCollection": "ecoc",
         "fields": [
             {

data/ext/libmongocrypt/libmongocrypt/bindings/python/test/data/encrypted-field-config-map.json

@@ -1,7 +1,6 @@
 {
     "test.test": {
         "escCollection": "fle2.basic.esc",
-        "eccCollection": "fle2.basic.ecc",
         "ecocCollection": "fle2.basic.ecoc",
         "fields": [
             {
@@ -24,7 +23,6 @@
     },
     "test.test2": {
         "escCollection": "fle2.basic.esc",
-        "eccCollection": "fle2.basic.ecc",
         "ecocCollection": "fle2.basic.ecoc",
         "fields": [
             {