mongo 2.25.0 → 2.26.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 846c673e8e85d3e7007bec794833276ed4da9591347e361465b190c10829c504
-  data.tar.gz: ad93e6b640fbdb3c6f757df0c0ae433f4c79d50c209fb0bd3c0b8c84402148a9
+  metadata.gz: 439e028e8b9ce062d109e1760508977f13a87dd6ee4cb9d5221a6a3108fec214
+  data.tar.gz: bb346a893717256c3eac12af4a63c718bfd4f567b1ec17b95727e45f9f8e11d5
 SHA512:
-  metadata.gz: 29750ebefccf852b621847e68bffd039f3e28c63829334880416d7e8348fbd8cc5769d7f5b1cf872030d874610739ef4df90f493d9b325d8bebcfe2dd7d7b638
-  data.tar.gz: fbb6248041e00a490ccf23e62c364ce3c8ea8214f3fd4c6f07ff8df18e090702c53039e30a1b2b66f8a5e464ebf4e9162d993a0c67cd0818911449a91d168b3f
+  metadata.gz: 3d650edf8067fbe760d1c0526e62bef7cfda7c27284b725ffcc5a8e3c33c712011b3aa478e87db2abea876d36e332daf733d1180954ed6bd1e5003a258a05f49
+  data.tar.gz: 6832d11c4cae68a7776c8e5f7ef8e5bd9fcbda45bedf8e8cb208fdc5103060582a315cb75434e003462500b4da05deb5e71618a6856159262ff3655fbe16888d

data/lib/mongo/bulk_write/combineable.rb

@@ -39,7 +39,6 @@ module Mongo
         @requests = requests
         @has_collation = false
         @has_array_filters = false
-        @has_hint = false
       end
 
       # @return [ Boolean ] Whether one or more operation specifies the collation
@@ -54,12 +53,6 @@ module Mongo
         @has_array_filters
       end
 
-      # @return [ Boolean ] Whether one or more operation specifies the
-      #   hint option.
-      def has_hint?
-        @has_hint
-      end
-
       private
 
       def combine_requests(ops)

data/lib/mongo/bulk_write/validatable.rb

@@ -43,10 +43,6 @@ module Mongo
         @has_collation = true if document.respond_to?(:keys) && (document[:collation] || document[Operation::COLLATION])
 
         @has_array_filters = true if document.respond_to?(:keys) && document[:array_filters]
-
-        return unless document.respond_to?(:keys) && document[:hint]
-
-        @has_hint = true
       end
 
       private

data/lib/mongo/bulk_write.rb

@@ -236,8 +236,6 @@ module Mongo
     end
 
     def execute_operation(name, values, connection, context, operation_id, result_combiner, session, txn_num = nil)
-      validate_hint!(connection)
-
       unpin_maybe(session, connection) do
         if values.size > connection.description.max_write_batch_size
           split_execute(name, values, connection, context, operation_id, result_combiner, session, txn_num)
@@ -310,38 +308,6 @@ module Mongo
       Operation::Update.new(spec).bulk_execute(connection, context: context)
     end
 
-    def validate_hint!(connection)
-      return unless op_combiner.has_hint?
-      return unless !can_hint?(connection) && write_concern && !write_concern.acknowledged?
-
-      raise Error::UnsupportedOption.hint_error(unacknowledged_write: true)
-    end
-
-    # Loop through the requests and check if each operation is allowed to send
-    # a hint for each operation on the given server version.
-    #
-    # For the following operations, the client can send a hint for all supported
-    # server versions, and for the rest, the client can only send it for 4.4+:
-    #   - updateOne
-    #   - updateMany
-    #   - replaceOne
-    #
-    # @param [ Connection ] connection The connection object.
-    #
-    # @return [ true | false ] Whether the request is able to send hints for
-    #   the current server version.
-    def can_hint?(connection)
-      gte_4_4 = connection.server.description.server_version_gte?('4.4')
-      op_combiner.requests.all? do |req|
-        op = req.keys.first
-        if req[op].keys.include?(:hint)
-          %i[update_one update_many replace_one].include?(op) || gte_4_4
-        else
-          true
-        end
-      end
-    end
-
     # Perform the request document validation required by driver specifications.
     # This method validates the first key of each update request document to be
     # an operator (i.e. start with $) and the first key of each replacement

data/lib/mongo/client.rb

@@ -241,7 +241,11 @@ module Mongo
     #   printed to the mongod logs upon establishing a connection
     # @option options [ Symbol ] :auth_mech The authentication mechanism to
     #   use. One of :mongodb_cr, :mongodb_x509, :plain, :scram, :scram256
-    # @option options [ Hash ] :auth_mech_properties
+    # @option options [ Hash ] :auth_mech_properties When passed in a
+    #   connection string as authMechanismProperties, key-value pairs are
+    #   delimited by commas, so a value containing a comma (",") must not be
+    #   provided as part of the connection string. Such a value must be passed
+    #   through this option instead. Values may contain colons (":").
     # @option options [ String ] :auth_source The source to authenticate from.
     # @option options [ true | false | nil | Integer ] :bg_error_backtrace
     #   Experimental. Set to true to log complete backtraces for errors in
@@ -509,6 +513,10 @@ module Mongo
     #     (this part of the API is subject to change).
     #   - :encrypted_fields_map => Hash | nil, maps a collection namespace to
     #     a hash describing encrypted fields for queryable encryption.
+    #     - Note: Supplying an encrypted_fields_map provides more security
+    #       than relying on an encryptedFields obtained from the server. It
+    #       protects against a malicious server advertising a false
+    #       encryptedFields.
     #     - Note: If a collection is present on both the encryptedFieldsMap
     #       and schemaMap, an error will be raised.
     #   - :bypass_query_analysis => Boolean | nil, when true disables automatic
@@ -519,6 +527,10 @@ module Mongo
     #   - :crypt_shared_lib_required => [ Boolean | nil ]  Whether
     #     crypt shared library is required. If 'true', an error will be raised
     #     if a crypt_shared library cannot be loaded by libmongocrypt.
+    #   - :key_expiration_ms => Integer | nil, the lifetime of the data
+    #     encryption key cache, in milliseconds. Must be a non-negative
+    #     integer. A value of 0 means the cache never expires. Defaults to
+    #     60000.
     #
     #   Notes on automatic encryption:
     #   - Automatic encryption is an enterprise only feature that only applies
@@ -601,9 +613,7 @@ module Mongo
       sdam_proc.call(self) if sdam_proc
 
       @connect_lock = Mutex.new
-      @retry_policy = Retryable::RetryPolicy.new(
-        max_retries: @options[:max_adaptive_retries] || Retryable::Backpressure::DEFAULT_MAX_RETRIES
-      )
+      @retry_policy = build_retry_policy
       @connect_lock.synchronize do
         @cluster = Cluster.new(
           addresses,
@@ -621,7 +631,11 @@ module Mongo
             build_encrypter
           end
         end
-      rescue StandardError
+      # ScriptError is rescued in addition to StandardError because
+      # Mongo::Crypt::Binding raises a LoadError when libmongocrypt cannot be
+      # found. Without it the cluster built above would be left open, leaking
+      # its monitoring and connection pool threads.
+      rescue StandardError, ScriptError
         begin
           @cluster.close
         rescue StandardError => e
@@ -830,6 +844,12 @@ module Mongo
         options.update(opts)
         @options = options.freeze
 
+        # The retry policy is built from the options, so a client created by
+        # #with needs its own policy when the option changed.
+        if @options[:max_adaptive_retries] != old_options[:max_adaptive_retries]
+          @retry_policy = build_retry_policy
+        end
+
         auto_encryption_options_changed =
           @options[:auto_encryption_options] != old_options[:auto_encryption_options]
 
@@ -1260,6 +1280,16 @@ module Mongo
 
     private
 
+    # Builds the retry policy for the backpressure retry loops from the
+    # client's options.
+    #
+    # @return [ Retryable::RetryPolicy ] The retry policy.
+    def build_retry_policy
+      Retryable::RetryPolicy.new(
+        max_retries: @options[:max_adaptive_retries] || Retryable::Backpressure::DEFAULT_MAX_RETRIES
+      )
+    end
+
     # Attempts to parse the given list of addresses, using the provided options.
     #
     # @param [ String | Array<String> ] addresses the list of addresses

data/lib/mongo/client_encryption.rb

@@ -42,6 +42,10 @@ module Mongo
     # @option options [ Integer ] :timeout_ms The operation timeout in milliseconds.
     #    Must be a non-negative integer. An explicit value of 0 means infinite.
     #    The default value is unset which means the feature is disabled.
+    # @option options [ Integer ] :key_expiration_ms The lifetime of the data
+    #    encryption key cache, in milliseconds. Must be a non-negative integer.
+    #    An explicit value of 0 means the cache never expires. The default is
+    #    60000.
     #
     # @raise [ ArgumentError ] If required options are missing or incorrectly
     #   formatted.
@@ -50,7 +54,9 @@ module Mongo
         key_vault_client,
         options[:key_vault_namespace],
         Crypt::KMS::Credentials.new(options[:kms_providers]),
-        Crypt::KMS::Validations.validate_tls_options(options[:kms_tls_options])
+        Crypt::KMS::Validations.validate_tls_options(options[:kms_tls_options]),
+        options[:timeout_ms],
+        options[:key_expiration_ms]
       )
     end
 
@@ -100,15 +106,34 @@ module Mongo
     #   encryption key.
     # @option options [ String ] :algorithm The algorithm used to encrypt the value.
     #   Valid algorithms are "AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic",
-    #   "AEAD_AES_256_CBC_HMAC_SHA_512-Random", "Indexed", "Unindexed".
+    #   "AEAD_AES_256_CBC_HMAC_SHA_512-Random", "Indexed", "Unindexed", "Range",
+    #   "String".
     # @option options [ Integer | nil ] :contention_factor Contention factor
-    #   to be applied if encryption algorithm is set to "Indexed". If not
-    #   provided, it defaults to a value of 0. Contention factor should be set
-    #   only if encryption algorithm is set to "Indexed".
+    #   to be applied if encryption algorithm is set to "Indexed", "Range", or
+    #   "String". If not provided, it defaults to a value of 0. Contention factor
+    #   should be set only if encryption algorithm is set to "Indexed", "Range",
+    #   or "String".
     # @option options [ String | nil ] query_type Query type to be applied
-    # if encryption algorithm is set to "Indexed". Query type should be set
-    #   only if encryption algorithm is set to "Indexed". The only allowed
-    #   value is "equality".
+    #   if encryption algorithm is set to "Indexed", "Range", or "String".
+    #   Allowed values are "equality" (for "Indexed"), "range" (for "Range"),
+    #   and "prefix", "suffix", "substring" (for "String").
+    # @option options [ Hash | nil ] :range_opts Specifies index options for a
+    #   Queryable Encryption field supporting "range" queries. Required when
+    #   algorithm is "Range". Allowed options are :min, :max, :trim_factor,
+    #   :sparsity, :precision.
+    # @option options [ Hash | nil ] :string_opts Specifies index options for a
+    #   Queryable Encryption field supporting "prefix", "suffix", or "substring"
+    #   queries. Required when algorithm is "String". Allowed options are
+    #   :case_sensitive, :diacritic_sensitive, :prefix, :suffix, :substring.
+    #
+    # @note The result of explicit encryption with the "Indexed", "Range", or
+    #   "String" algorithm must be processed by the server to insert or query.
+    #   To insert or query with such a payload, use a Mongo::Client configured
+    #   with :auto_encryption_options. The :bypass_query_analysis option may be
+    #   true; the :bypass_auto_encryption option must be false.
+    #
+    # @note The "substring" query type is unstable and subject to backwards
+    #   breaking changes.
     #
     # @note The :key_id and :key_alt_name options are mutually exclusive. Only
     #   one is required to perform explicit encryption.
@@ -116,8 +141,8 @@ module Mongo
     # @return [ BSON::Binary ] A BSON Binary object of subtype 6 (ciphertext)
     #   representing the encrypted value.
     #
-    # @raise [ ArgumentError ] if either contention_factor or query_type
-    #   is set, and algorithm is not "Indexed".
+    # @raise [ ArgumentError ] if either contention_factor or query_type is set,
+    #   and algorithm is not "Indexed", "Range", or "String".
     def encrypt(value, options = {})
       @encrypter.encrypt(value, options)
     end
@@ -148,7 +173,7 @@ module Mongo
     #   expression. The only allowed value is "Range"
     # @option options [ Integer | nil ] :contention_factor Contention factor
     #   to be applied If not  provided, it defaults to a value of 0.
-    # @option options [ String | nil ] query_type Query type to be applied.
+    # @option options [ String | nil ] :query_type Query type to be applied.
     #   The only allowed value is "range".
     #
     # @note The :key_id and :key_alt_name options are mutually exclusive. Only

data/lib/mongo/cluster.rb

@@ -586,8 +586,7 @@ module Mongo
     # @option options [ true | false ] :keep_connection_pool Usually when the
     #   new server description is unknown, the connection pool on the
     #   respective server is cleared. Set this option to true to keep the
-    #   existing connection pool (required when handling not master errors
-    #   on 4.2+ servers).
+    #   existing connection pool (required when handling not master errors).
     # @option options [ true | false ] :awaited Whether the updated description
     #   was a result of processing an awaited hello.
     # @option options [ Object ] :service_id Change state for the specified

data/lib/mongo/collection/queryable_encryption.rb

@@ -62,8 +62,8 @@ module Mongo
       def maybe_drop_emm_collections(encrypted_fields, client, session)
         encrypted_fields = if encrypted_fields
                              encrypted_fields
-                           elsif encrypted_fields_map
-                             encrypted_fields_for_drop_from_map
+                           elsif client.options[:auto_encryption_options]
+                             encrypted_fields_for_drop
                            else
                              {}
                            end
@@ -127,12 +127,13 @@ module Mongo
           {}
       end
 
-      # Tries to return the encrypted fields from the {{encrypted_fields_map}}
-      # value, for the current namespace.
+      # Tries to return the encrypted fields for the current namespace from
+      # the {{encrypted_fields_map}} value, falling back to the encrypted
+      # fields advertised by the server for the collection.
       #
       # @return [ Hash | nil ] the encrypted fields, if found
-      def encrypted_fields_for_drop_from_map
-        encrypted_fields_map[namespace] ||
+      def encrypted_fields_for_drop
+        (encrypted_fields_map && encrypted_fields_map[namespace]) ||
           database.list_collections(filter: { name: name })
                   .first
                   &.fetch(:options, {})

data/lib/mongo/collection/view/writable.rb

@@ -88,11 +88,6 @@ module Mongo
               operation_timeouts: operation_timeouts(opts)
             )
             write_with_retry(write_concern, context: context) do |connection, txn_num, context|
-              gte_4_4 = connection.server.description.server_version_gte?('4.4')
-              if !gte_4_4 && opts[:hint] && write_concern && !write_concern.acknowledged?
-                raise Error::UnsupportedOption.hint_error(unacknowledged_write: true)
-              end
-
               Operation::WriteCommand.new(
                 selector: cmd,
                 db_name: database.name,
@@ -216,11 +211,6 @@ module Mongo
             )
             value = tracer.trace_operation(operation, context, op_name: 'findOneAndUpdate') do
               write_with_retry(write_concern, context: context) do |connection, txn_num, context|
-                gte_4_4 = connection.server.description.server_version_gte?('4.4')
-                if !gte_4_4 && opts[:hint] && write_concern && !write_concern.acknowledged?
-                  raise Error::UnsupportedOption.hint_error(unacknowledged_write: true)
-                end
-
                 operation.txn_num = txn_num
                 operation.execute_with_connection(connection, context: context)
               end
@@ -287,11 +277,6 @@ module Mongo
             )
             tracer.trace_operation(operation, context, op_name: 'deleteMany') do
               nro_write_with_retry(write_concern, context: context) do |connection, _txn_num, context|
-                gte_4_4 = connection.server.description.server_version_gte?('4.4')
-                if !gte_4_4 && opts[:hint] && write_concern && !write_concern.acknowledged?
-                  raise Error::UnsupportedOption.hint_error(unacknowledged_write: true)
-                end
-
                 operation.execute_with_connection(connection, context: context)
               end
             end
@@ -346,11 +331,6 @@ module Mongo
               operation_timeouts: operation_timeouts(opts)
             )
             write_with_retry(write_concern, context: context) do |connection, txn_num, context|
-              gte_4_4 = connection.server.description.server_version_gte?('4.4')
-              if !gte_4_4 && opts[:hint] && write_concern && !write_concern.acknowledged?
-                raise Error::UnsupportedOption.hint_error(unacknowledged_write: true)
-              end
-
               Operation::Delete.new(
                 deletes: [ delete_doc ],
                 db_name: collection.database.name,
@@ -428,11 +408,6 @@ module Mongo
               operation_timeouts: operation_timeouts(opts)
             )
             write_with_retry(write_concern, context: context) do |connection, txn_num, context|
-              gte_4_2 = connection.server.description.server_version_gte?('4.2')
-              if !gte_4_2 && opts[:hint] && write_concern && !write_concern.acknowledged?
-                raise Error::UnsupportedOption.hint_error(unacknowledged_write: true)
-              end
-
               Operation::Update.new(
                 updates: [ update_doc ],
                 db_name: collection.database.name,
@@ -507,11 +482,6 @@ module Mongo
               operation_timeouts: operation_timeouts(opts)
             )
             nro_write_with_retry(write_concern, context: context) do |connection, _txn_num, context|
-              gte_4_2 = connection.server.description.server_version_gte?('4.2')
-              if !gte_4_2 && opts[:hint] && write_concern && !write_concern.acknowledged?
-                raise Error::UnsupportedOption.hint_error(unacknowledged_write: true)
-              end
-
               Operation::Update.new(
                 updates: [ update_doc ],
                 db_name: collection.database.name,
@@ -601,11 +571,6 @@ module Mongo
             )
             tracer.trace_operation(operation, context) do
               write_with_retry(write_concern, context: context) do |connection, txn_num, context|
-                gte_4_2 = connection.server.description.server_version_gte?('4.2')
-                if !gte_4_2 && opts[:hint] && write_concern && !write_concern.acknowledged?
-                  raise Error::UnsupportedOption.hint_error(unacknowledged_write: true)
-                end
-
                 operation.txn_num = txn_num
                 operation.execute_with_connection(connection, context: context)
               end

data/lib/mongo/crypt/auto_encrypter.rb

@@ -81,6 +81,9 @@ module Mongo
       # @option options [ Boolean | nil ] :crypt_shared_lib_required Whether
       #   crypt shared library is required. If 'true', an error will be raised
       #   if a crypt_shared library cannot be loaded by libmongocrypt.
+      # @option options [ Integer | nil ] :key_expiration_ms The lifetime of the
+      #   data encryption key cache, in milliseconds. A value of 0 means the
+      #   cache never expires. Defaults to 60000.
       #
       # @raise [ ArgumentError ] If required options are missing or incorrectly
       #   formatted.
@@ -99,7 +102,8 @@ module Mongo
           bypass_query_analysis: @options[:bypass_query_analysis],
           crypt_shared_lib_path: @options[:extra_options][:crypt_shared_lib_path],
           crypt_shared_lib_required: @options[:extra_options][:crypt_shared_lib_required],
-          disable_crypt_shared_lib_search: @options[:extra_options][:disable_crypt_shared_lib_search]
+          disable_crypt_shared_lib_search: @options[:extra_options][:disable_crypt_shared_lib_search],
+          key_expiration_ms: @options[:key_expiration_ms]
         )
 
         @mongocryptd_options = @options[:extra_options].slice(

data/lib/mongo/crypt/binding.rb

@@ -81,7 +81,7 @@ module Mongo
       # will cause a `LoadError`.
       #
       # @api private
-      MIN_LIBMONGOCRYPT_VERSION = Gem::Version.new('1.12.0')
+      MIN_LIBMONGOCRYPT_VERSION = Gem::Version.new('1.20.0')
 
       # @!method self.mongocrypt_version(len)
       #   @api private
@@ -1479,6 +1479,31 @@ module Mongo
         mongocrypt_setopt_bypass_query_analysis(handle.ref)
       end
 
+      # @!method self.mongocrypt_setopt_key_expiration(crypt, cache_expiration_ms)
+      #   @api private
+      #
+      #   Set the expiration time for the data encryption key cache.
+      #
+      #   @param [ FFI::Pointer ] crypt A pointer to a mongocrypt_t object.
+      #   @param [ Integer ] cache_expiration_ms The cache expiration time in
+      #     milliseconds. If zero, the cache never expires.
+      #   @return [ Boolean ] Returns whether the option was set successfully.
+      attach_function(:mongocrypt_setopt_key_expiration, %i[pointer uint64], :bool)
+
+      # Set the expiration time for the data encryption key cache on the
+      # Mongo::Crypt::Handle object.
+      #
+      # @param [ Mongo::Crypt::Handle ] handle
+      # @param [ Integer ] cache_expiration_ms The cache expiration time in
+      #   milliseconds. If zero, the cache never expires.
+      #
+      # @raise [ Mongo::Error::CryptError ] If the option is not set successfully.
+      def self.setopt_key_expiration(handle, cache_expiration_ms)
+        check_status(handle) do
+          mongocrypt_setopt_key_expiration(handle.ref, cache_expiration_ms)
+        end
+      end
+
       # @!method self.mongocrypt_setopt_aes_256_ctr(crypt, aes_256_ctr_encrypt, aes_256_ctr_decrypt, ctx)
       #   @api private
       #
@@ -1873,6 +1898,46 @@ module Mongo
         end
       end
 
+      # @!method self.mongocrypt_ctx_setopt_algorithm_text(ctx, opts)
+      #   @api private
+      #
+      # Set options for explicit encryption with the "String" algorithm.
+      #
+      # @note The libmongocrypt C function is named `..._algorithm_text` (the
+      #   original "text" name), even though the algorithm string passed to
+      #   mongocrypt_ctx_setopt_algorithm is "String" (renamed for GA). There is
+      #   no `..._algorithm_string` symbol; `..._algorithm_text` is the correct
+      #   and only setter for these options.
+      #
+      # @param [ FFI::Pointer ] ctx A pointer to a mongocrypt_ctx_t object.
+      # @param [ FFI::Pointer ] opts A pointer to a string options document.
+      #
+      # @return [ Boolean ] Whether setting this option succeeded.
+      attach_function(
+        :mongocrypt_ctx_setopt_algorithm_text,
+        %i[
+          pointer
+          pointer
+        ],
+        :bool
+      )
+
+      # Set options for explicit encryption with the "String" algorithm.
+      #
+      # @param [ Mongo::Crypt::Context ] context
+      # @param [ Hash ] opts options
+      #
+      # @raise [ Mongo::Error::CryptError ] If the operation failed
+      def self.ctx_setopt_algorithm_text(context, opts)
+        validate_document(opts)
+        data = opts.to_bson.to_s
+        Binary.wrap_string(data) do |data_p|
+          check_ctx_status(context) do
+            mongocrypt_ctx_setopt_algorithm_text(context.ctx_p, data_p)
+          end
+        end
+      end
+
       # Raise a Mongo::Error::CryptError based on the status of the underlying
       # mongocrypt_t object.
       #

data/lib/mongo/crypt/explicit_encrypter.rb

@@ -37,12 +37,19 @@ module Mongo
       #   to TLS connection options of Mongo::Client.
       # @param [ Integer | nil ] timeout_ms Timeout for every operation executed
       #   on this object.
-      def initialize(key_vault_client, key_vault_namespace, kms_providers, kms_tls_options, timeout_ms = nil)
+      # @param [ Integer | nil ] key_expiration_ms The lifetime of the data
+      #   encryption key cache, in milliseconds. A value of 0 means the cache
+      #   never expires. When nil, libmongocrypt's default of 60000 is used.
+      def initialize(
+        key_vault_client, key_vault_namespace, kms_providers, kms_tls_options,
+        timeout_ms = nil, key_expiration_ms = nil
+      )
         Crypt.validate_ffi!
         @crypt_handle = Handle.new(
           kms_providers,
           kms_tls_options,
-          explicit_encryption_only: true
+          explicit_encryption_only: true,
+          key_expiration_ms: key_expiration_ms
         )
         @encryption_io = EncryptionIO.new(
           key_vault_client: key_vault_client,
@@ -93,23 +100,31 @@ module Mongo
       #   encryption key.
       # @option options [ String ] :algorithm The algorithm used to encrypt the value.
       #   Valid algorithms are "AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic",
-      #   "AEAD_AES_256_CBC_HMAC_SHA_512-Random", "Indexed", "Unindexed".
+      #   "AEAD_AES_256_CBC_HMAC_SHA_512-Random", "Indexed", "Unindexed",
+      #   "Range", "String".
       # @option options [ Integer | nil ] :contention_factor Contention factor
-      #   to be applied if encryption algorithm is set to "Indexed". If not
-      #   provided, it defaults to a value of 0. Contention factor should be set
-      #   only if encryption algorithm is set to "Indexed".
-      # @option options [ String | nil ] query_type Query type to be applied
-      # if encryption algorithm is set to "Indexed". Query type should be set
-      #   only if encryption algorithm is set to "Indexed". The only allowed
-      #   value is "equality".
+      #   to be applied if encryption algorithm is set to "Indexed", "Range", or
+      #   "String". If not provided, it defaults to a value of 0. Contention
+      #   factor should be set only if encryption algorithm is set to "Indexed",
+      #   "Range", or "String".
+      # @option options [ String | nil ] :query_type Query type to be applied
+      #   if encryption algorithm is set to "Indexed", "Range", or "String".
+      #   Allowed values are "equality" (for "Indexed"), "range" (for "Range"),
+      #   and "prefix", "suffix", "substring" (for "String").
+      # @option options [ Hash | nil ] :range_opts Specifies index options for a
+      #   Queryable Encryption field supporting "range" queries. Required when
+      #   algorithm is "Range".
+      # @option options [ Hash | nil ] :string_opts Specifies index options for a
+      #   Queryable Encryption field supporting "prefix", "suffix", or
+      #   "substring" queries. Required when algorithm is "String".
       #
       # @note The :key_id and :key_alt_name options are mutually exclusive. Only
       #   one is required to perform explicit encryption.
       #
       # @return [ BSON::Binary ] A BSON Binary object of subtype 6 (ciphertext)
       #   representing the encrypted value
-      # @raise [ ArgumentError ] if either contention_factor or query_type
-      #   is set, and algorithm is not "Indexed".
+      # @raise [ ArgumentError ] if either contention_factor or query_type is
+      #   set, and algorithm is not "Indexed", "Range", or "String".
       def encrypt(value, options)
         Crypt::ExplicitEncryptionContext.new(
           @crypt_handle,

data/lib/mongo/crypt/explicit_encryption_context.rb

@@ -36,14 +36,16 @@ module Mongo
       #   that will be used to encrypt the value.
       # @option options [ String ] :algorithm The algorithm used to encrypt the
       #   value. Valid algorithms are "AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic",
-      #   "AEAD_AES_256_CBC_HMAC_SHA_512-Random", "Indexed", "Unindexed", "Range".
+      #   "AEAD_AES_256_CBC_HMAC_SHA_512-Random", "Indexed", "Unindexed", "Range",
+      #   "String".
       # @option options [ Integer | nil ] :contention_factor Contention factor
-      #   to be applied if encryption algorithm is set to "Indexed". If not
-      #   provided, it defaults to a value of 0. Contention factor should be set
-      #   only if encryption algorithm is set to "Indexed".
+      #   to be applied if encryption algorithm is set to "Indexed", "Range", or "String".
+      #   If not provided, it defaults to a value of 0. Contention factor should be set
+      #   only if encryption algorithm is set to "Indexed", "Range", or "String".
       # @option options [ String | nil ] query_type Query type to be applied
-      #   if encryption algorithm is set to "Indexed" or "Range".
-      #   Allowed values are "equality" and "range".
+      #   if encryption algorithm is set to "Indexed", "Range", or "String".
+      #   Allowed values are "equality", "range", "prefix", "suffix", and
+      #   "substring".
       # @option options [ Hash | nil ] :range_opts Specifies index options for
       #   a Queryable Encryption field supporting "range" queries.
       #   Allowed options are:
@@ -56,9 +58,22 @@ module Mongo
       #   the encryptedFields of the destination collection.
       #   For double and decimal128, min/max/precision must all be set,
       #   or all be unset.
+      # @option options [ Hash | nil ] :string_opts Specifies index options for
+      #   a Queryable Encryption field supporting "prefix", "suffix", or
+      #   "substring" queries (algorithm "String"). Allowed options are:
+      #   - :case_sensitive
+      #   - :diacritic_sensitive
+      #   - :prefix (Hash with :str_min_query_length, :str_max_query_length)
+      #   - :suffix (Hash with :str_min_query_length, :str_max_query_length)
+      #   - :substring (Hash with :str_max_length, :str_min_query_length,
+      #     :str_max_query_length)
+      #   The options must match the values set in the encryptedFields of the
+      #   destination collection.
       #
       # @note The Range algorithm is experimental only. It is not intended for
       # public use.
+      # @note The "substring" query type is unstable and subject to backwards
+      # breaking changes.
       #
       # @raise [ ArgumentError|Mongo::Error::CryptError ] If invalid options are provided
       def initialize(mongocrypt, io, doc, options = {})
@@ -114,28 +129,52 @@ module Mongo
 
       def set_algorithm_opts(options)
         Binding.ctx_setopt_algorithm(self, options[:algorithm])
-        if %w[Indexed Range].include?(options[:algorithm])
+        if %w[Indexed Range String].include?(options[:algorithm])
           Binding.ctx_setopt_contention_factor(self, options[:contention_factor]) if options[:contention_factor]
           Binding.ctx_setopt_query_type(self, options[:query_type]) if options[:query_type]
         else
           if options[:contention_factor]
-            raise ArgumentError.new(':contention_factor is allowed only for "Indexed" or "Range" algorithms')
+            raise ArgumentError.new(':contention_factor is allowed only for "Indexed", "Range", or "String" algorithms')
           end
           if options[:query_type]
-            raise ArgumentError.new(':query_type is allowed only for "Indexed" or "Range" algorithms')
+            raise ArgumentError.new(':query_type is allowed only for "Indexed", "Range", or "String" algorithms')
           end
         end
-        return unless options[:algorithm] == 'Range'
-
-        Binding.ctx_setopt_algorithm_range(self, convert_range_opts(options[:range_opts]))
+        if options[:algorithm] == 'Range'
+          Binding.ctx_setopt_algorithm_range(self, convert_range_opts(options[:range_opts]))
+        elsif options[:algorithm] == 'String'
+          Binding.ctx_setopt_algorithm_text(self, convert_string_opts(options[:string_opts]))
+        end
       end
 
       def convert_range_opts(range_opts)
+        raise ArgumentError.new(':range_opts is required for the "Range" algorithm') if range_opts.nil?
+
         range_opts.dup.tap do |opts|
           opts[:sparsity] = BSON::Int64.new(opts[:sparsity]) if opts[:sparsity] && !opts[:sparsity].is_a?(BSON::Int64)
           opts[:trimFactor] = opts.delete(:trim_factor) if opts[:trim_factor]
         end
       end
+
+      def convert_string_opts(string_opts)
+        raise ArgumentError.new(':string_opts is required for the "String" algorithm') if string_opts.nil?
+
+        string_opts.dup.tap do |opts|
+          opts[:caseSensitive] = opts.delete(:case_sensitive) if opts.key?(:case_sensitive)
+          opts[:diacriticSensitive] = opts.delete(:diacritic_sensitive) if opts.key?(:diacritic_sensitive)
+          %i[substring prefix suffix].each do |query_type|
+            opts[query_type] = convert_string_query_opts(opts[query_type]) if opts[query_type]
+          end
+        end
+      end
+
+      def convert_string_query_opts(query_opts)
+        query_opts.dup.tap do |opts|
+          opts[:strMaxLength] = opts.delete(:str_max_length) if opts.key?(:str_max_length)
+          opts[:strMinQueryLength] = opts.delete(:str_min_query_length) if opts.key?(:str_min_query_length)
+          opts[:strMaxQueryLength] = opts.delete(:str_max_query_length) if opts.key?(:str_max_query_length)
+        end
+      end
     end
   end
 end

data/lib/mongo/crypt/handle.rb

@@ -66,6 +66,10 @@ module Mongo
       #   error that libmongocrypt raises on a subsequent "$SYSTEM" search.
       # @option options [ Logger ] :logger A Logger object to which libmongocrypt logs
       #   will be sent
+      # @option options [ Integer | nil ] :key_expiration_ms The lifetime of the
+      #   data encryption key cache, in milliseconds. A value of 0 means the
+      #   cache never expires. When nil, libmongocrypt's default of 60000 is
+      #   used.
       def initialize(kms_providers, kms_tls_options, options = {})
         # FFI::AutoPointer uses a custom release strategy to automatically free
         # the pointer once this object goes out of scope
@@ -87,6 +91,9 @@ module Mongo
         @bypass_query_analysis = options[:bypass_query_analysis]
         set_bypass_query_analysis if @bypass_query_analysis
 
+        @key_expiration_ms = options[:key_expiration_ms]
+        set_key_expiration unless @key_expiration_ms.nil?
+
         @crypt_shared_lib_path = options[:crypt_shared_lib_path]
         @explicit_encryption_only = options[:explicit_encryption_only]
         @disable_crypt_shared_lib_search = options[:disable_crypt_shared_lib_search]
@@ -200,6 +207,17 @@ module Mongo
         Binding.setopt_bypass_query_analysis(self) if @bypass_query_analysis
       end
 
+      def set_key_expiration
+        unless @key_expiration_ms.is_a?(Integer) && !@key_expiration_ms.negative?
+          raise ArgumentError.new(
+            "#{@key_expiration_ms} is an invalid key_expiration_ms value; " \
+            'must be a non-negative Integer or nil'
+          )
+        end
+
+        Binding.setopt_key_expiration(self, @key_expiration_ms)
+      end
+
       # Send the logs from libmongocrypt to the Mongo::Logger
       def set_logger_callback
         @log_callback = proc do |level, msg|

data/lib/mongo/error/unsupported_option.rb

@@ -18,24 +18,6 @@ module Mongo
   class Error
     # Raised if an unsupported option is specified for an operation.
     class UnsupportedOption < Error
-      # The error message provided when the user passes the hint option to
-      # a write operation against a server that does not support the hint
-      # option and does not provide option validation.
-      #
-      # @api private
-      HINT_MESSAGE = 'The MongoDB server handling this request does not support ' \
-                     'the hint option on this command. The hint option is supported on update ' \
-                     'commands on MongoDB server versions 4.2 and later and on findAndModify ' \
-                     'and delete commands on MongoDB server versions 4.4 and later'
-
-      # The error message provided when the user passes the hint option to
-      # an unacknowledged write operation.
-      #
-      # @api private
-      UNACKNOWLEDGED_HINT_MESSAGE = 'The hint option cannot be specified on ' \
-                                    'an unacknowledged write operation. Remove the hint option or perform ' \
-                                    'this operation with a write concern of at least { w: 1 }'
-
       # The error message provided when the user passes the allow_disk_use
       # option to a find operation against a server that does not support the
       # allow_disk_use operation and does not provide option validation.
@@ -56,28 +38,6 @@ module Mongo
                               'option is supported on createIndexes commands on MongoDB server versions ' \
                               '4.4 and later'
 
-      # Raise an error about an unsupported hint option.
-      #
-      # @option options [ Boolean ] unacknowledged_write Whether this error
-      #   pertains to a hint option passed to an unacknowledged write. Defaults
-      #   to false.
-      #
-      # @return [ Mongo::Error::UnsupportedOption ] An error with a default
-      #   error message.
-      #
-      # @api private
-      def self.hint_error(**options)
-        unacknowledged_write = options[:unacknowledged_write] || false
-
-        error_message = if unacknowledged_write
-                          UNACKNOWLEDGED_HINT_MESSAGE
-                        else
-                          HINT_MESSAGE
-                        end
-
-        new(error_message)
-      end
-
       # Raise an error about an unsupported allow_disk_use option.
       #
       # @return [ Mongo::Error::UnsupportedOption ] An error with a default

data/lib/mongo/grid/fs_bucket.rb

@@ -218,10 +218,10 @@ module Mongo
       def delete(id, opts = {})
         timeout_holder = CsotTimeoutHolder.new(operation_timeouts: operation_timeouts(opts))
         result = files_collection
-                 .find({ _id: id }, @options.merge(timeout_ms: timeout_holder.remaining_timeout_ms))
+                 .find({ _id: { '$eq' => id } }, @options.merge(timeout_ms: timeout_holder.remaining_timeout_ms))
                  .delete_one(timeout_ms: timeout_holder.remaining_timeout_ms)
         chunks_collection
-          .find({ files_id: id }, @options.merge(timeout_ms: timeout_holder.remaining_timeout_ms))
+          .find({ files_id: { '$eq' => id } }, @options.merge(timeout_ms: timeout_holder.remaining_timeout_ms))
           .delete_many(timeout_ms: timeout_holder.remaining_timeout_ms)
         raise Error::FileNotFound.new(id, :id) if result.n == 0
 

data/lib/mongo/grid/stream/read.rb

@@ -182,7 +182,7 @@ module Mongo
             @file_info ||= begin
               doc = options[:file_info_doc] ||
                     fs.files_collection.find(
-                      { _id: file_id },
+                      { _id: { '$eq' => file_id } },
                       { timeout_ms: @timeout_holder.remaining_timeout_ms! }
                     ).first
               File::Info.new(Options::Mapper.transform(doc, File::Info::MAPPINGS.invert)) if doc
@@ -216,7 +216,7 @@ module Mongo
                 opts[:timeout_mode] = :cursor_lifetime
               end
 
-              fs.chunks_collection.find({ files_id: file_id }, opts).sort(n: 1)
+              fs.chunks_collection.find({ files_id: { '$eq' => file_id } }, opts).sort(n: 1)
             end
           end
 

data/lib/mongo/grid/stream/write.rb

@@ -177,7 +177,7 @@ module Mongo
           # @since 2.1.0
           def abort
             fs.chunks_collection.find(
-              { files_id: file_id },
+              { files_id: { '$eq' => file_id } },
               @options.merge(timeout_ms: @timeout_holder.remaining_timeout_ms!)
             ).delete_many
             (@open = false) || true

data/lib/mongo/operation/result.rb

@@ -456,6 +456,15 @@ module Mongo
         doc['cursor']&.[]('atClusterTime') || doc['atClusterTime']
       end
 
+      # Returns the base backoff in milliseconds for a server overload error, if present.
+      #
+      # @return [ Integer | nil ] The base backoff in milliseconds.
+      #
+      # @api private
+      def base_backoff_ms
+        first_document && first_document['baseBackoffMS']
+      end
+
       private
 
       def operation_failure_class

data/lib/mongo/operation/shared/executable.rb

@@ -132,12 +132,7 @@ module Mongo
       def process_result_for_sdam(result, connection)
         if (result.not_master? || result.node_recovering?) &&
            connection.generation >= connection.server.pool.generation(service_id: connection.service_id)
-          keep_pool = if result.node_shutting_down?
-                        false
-                      else
-                        # Max wire version needs to be examined while the server is known
-                        connection.description.server_version_gte?('4.2')
-                      end
+          keep_pool = !result.node_shutting_down?
 
           connection.server.unknown!(
             keep_connection_pool: keep_pool,

data/lib/mongo/protocol/message.rb

@@ -148,10 +148,6 @@ module Mongo
       # @return [ Mongo::Protocol::Msg ] The decrypted message, or the original
       #   message if decryption was not possible or necessary.
       def maybe_decrypt(_context)
-        # TODO: determine if we should be decrypting data coming from pre-4.2
-        # servers, potentially using legacy wire protocols. If so we need
-        # to implement decryption for those wire protocols as our current
-        # encryption/decryption code is OP_MSG-specific.
         self
       end
 

data/lib/mongo/protocol/msg.rb

@@ -201,23 +201,12 @@ module Mongo
       # represents one of the command types allow-listed by libmongocrypt and it
       # contains data that is required to be encrypted by a local or remote json schema.
       #
-      # @param [ Mongo::Server::Connection ] connection The connection on which
-      #   the operation is performed.
       # @param [ Mongo::Operation::Context ] context The operation context.
       #
       # @return [ Mongo::Protocol::Msg ] The encrypted message, or the original
       #   message if encryption was not possible or necessary.
-      def maybe_encrypt(connection, context)
+      def maybe_encrypt(_connection, context)
         if context.encrypt?
-          if connection.description.max_wire_version < 8
-            raise Error::CryptError.new(
-              'Cannot perform encryption against a MongoDB server older than ' +
-              '4.2 (wire version less than 8). Currently connected to server ' +
-              "with max wire version #{connection.description.max_wire_version}} " +
-              '(Auto-encryption requires a minimum MongoDB version of 4.2)'
-            )
-          end
-
           db_name = @main_document[DATABASE_IDENTIFIER]
           cmd = merge_sections
           enc_cmd = context.encrypt(db_name, cmd)

data/lib/mongo/retryable/backpressure.rb

@@ -23,9 +23,24 @@ module Mongo
       #   a random value. Can be injected for deterministic testing.
       #
       # @return [ Float ] The backoff delay in seconds.
-      def self.backoff_delay(attempt, jitter: rand)
-        jitter * [ MAX_BACKOFF, BASE_BACKOFF * (2**(attempt - 1)) ].min
+      def self.backoff_delay(attempt, jitter: rand, err: nil)
+        jitter * [ MAX_BACKOFF, base_backoff(err) * (2**attempt) ].min
       end
+
+      def self.base_backoff(err)
+        return BASE_BACKOFF if err.nil?
+        return BASE_BACKOFF unless err.respond_to?(:result) && err.result.respond_to?(:base_backoff_ms)
+
+        base_backoff_ms = err.result.base_backoff_ms
+
+        if base_backoff_ms && base_backoff_ms > 0
+          err.result.base_backoff_ms / 1000.0
+        else
+          BASE_BACKOFF
+        end
+      end
+
+      private_class_method :base_backoff
     end
   end
 end

data/lib/mongo/retryable/read_worker.rb

@@ -340,7 +340,7 @@ module Mongo
       def overload_read_retry(last_error, session, server_selector, context, failed_server, error_count:)
         last_was_overload = true
         loop do
-          delay = last_was_overload ? retry_policy.backoff_delay(error_count) : 0
+          delay = last_was_overload ? retry_policy.backoff_delay(error_count, err: last_error) : 0
           raise last_error unless retry_policy.should_retry_overload?(error_count, delay, context: context)
 
           log_retry(last_error, message: 'Read retry (overload backoff)')

data/lib/mongo/retryable/retry_policy.rb

@@ -27,8 +27,8 @@ module Mongo
       # @param [ Float ] jitter A random float in [0.0, 1.0).
       #
       # @return [ Float ] The backoff delay in seconds.
-      def backoff_delay(attempt, jitter: rand)
-        Backpressure.backoff_delay(attempt, jitter: jitter)
+      def backoff_delay(attempt, jitter: rand, err: nil)
+        Backpressure.backoff_delay(attempt, jitter: jitter, err: err)
       end
 
       # Determine whether an overload retry should be attempted.

data/lib/mongo/retryable/write_worker.rb

@@ -123,7 +123,7 @@ module Mongo
               unless e.respond_to?(:label?) && e.label?('NoWritesPerformed')
                 error_to_raise = e
               end
-              delay = retry_policy.backoff_delay(error_count)
+              delay = retry_policy.backoff_delay(error_count, err: e)
               raise error_to_raise unless retry_policy.should_retry_overload?(error_count, delay, context: context)
 
               log_retry(e, message: 'Write retry (overload backoff)')
@@ -386,7 +386,7 @@ module Mongo
         last_was_overload = true
 
         loop do
-          delay = last_was_overload ? retry_policy.backoff_delay(error_count) : 0
+          delay = last_was_overload ? retry_policy.backoff_delay(error_count, err: last_error) : 0
           raise error_to_raise unless retry_policy.should_retry_overload?(error_count, delay, context: context)
 
           log_retry(last_error, message: 'Write retry (overload backoff)')

data/lib/mongo/retryable.rb

@@ -129,7 +129,7 @@ module Mongo
 
         error_count += 1
         policy = client.retry_policy
-        delay = policy.backoff_delay(error_count)
+        delay = policy.backoff_delay(error_count, err: e)
         raise e unless policy.should_retry_overload?(error_count, delay, context: context)
 
         Logger.logger.warn("Overload retry due to: #{e.class.name}: #{e.message}")

data/lib/mongo/server/app_metadata.rb

@@ -130,7 +130,7 @@ module Mongo
             doc[:driver] = driver_doc
             doc[:os] = os_doc
             doc[:platform] = platform_string
-            doc[:backpressure] = true
+            doc[:backpressure] = '2'
             env_doc.tap { |env| doc[:env] = env if env }
           end
       end

data/lib/mongo/server/description/features.rb

@@ -24,7 +24,6 @@ module Mongo
         # List of features and the wire protocol version they appear in.
         #
         # Wire protocol versions map to server releases as follows:
-        # -  8 => 4.2
         # -  9 => 4.4
         # - 13 => 5.0
         # - 14 => 5.1
@@ -61,7 +60,7 @@ module Mongo
         # The wire protocol versions that this version of the driver supports.
         #
         # @since 2.0.0
-        DRIVER_WIRE_VERSIONS = 8..29
+        DRIVER_WIRE_VERSIONS = 9..29
 
         # The wire protocol versions that are deprecated in this version of the
         # driver. Support for these versions will be removed in the future.
@@ -74,7 +73,7 @@ module Mongo
         #
         # If there are no currently-deprecated wire versions, this should be
         # set to an empty range (e.g. the EMPTY_RANGE constant).
-        DEPRECATED_WIRE_VERSIONS = 8..8
+        DEPRECATED_WIRE_VERSIONS = EMPTY_RANGE
 
         # make sure the deprecated versions are valid
         if DEPRECATED_WIRE_VERSIONS.min && (DRIVER_WIRE_VERSIONS.min > DEPRECATED_WIRE_VERSIONS.max)

data/lib/mongo/server/description.rb

@@ -905,7 +905,6 @@ module Mongo
         '5.1' => 14,
         '5.0' => 12,
         '4.4' => 9,
-        '4.2' => 8,
       }.freeze
 
       # @api private

data/lib/mongo/server/pending_connection.rb

@@ -52,11 +52,6 @@ module Mongo
           # SCRAM-SHA-1. The use of SCRAM-SHA-256 by default is thus
           # sensible, and it is also mandated by the speculative auth spec.
           #
-          # If no mechanism was specified and we are talking to a 4.2
-          # server, we'll send speculative auth document, the server will
-          # ignore it and we'll perform authentication using explicit
-          # command.
-          #
           # If no mechanism was specified and we are talking to a 4.4+
           # server and the user account doesn't allow SCRAM-SHA-256, we will
           # authenticate in a separate command with SCRAM-SHA-1 after

data/lib/mongo/server.rb

@@ -567,8 +567,7 @@ module Mongo
     # @option options [ true | false ] :keep_connection_pool Usually when the
     #   new server description is unknown, the connection pool on the
     #   respective server is cleared. Set this option to true to keep the
-    #   existing connection pool (required when handling not master errors
-    #   on 4.2+ servers).
+    #   existing connection pool (required when handling not master errors).
     # @option options [ TopologyVersion ] :topology_version Topology version
     #   of the error response that is causing the server to be marked unknown.
     # @option options [ true | false ] :stop_push_monitor Set when the server

data/lib/mongo/session.rb

@@ -471,7 +471,7 @@ module Mongo
       loop do
         if transaction_attempt > 0
           if overload_encountered
-            delay = @client.retry_policy.backoff_delay(overload_error_count)
+            delay = @client.retry_policy.backoff_delay(overload_error_count, err: last_error)
             if backoff_would_exceed_deadline?(deadline, delay)
               make_timeout_error_from(last_error, 'CSOT timeout expired waiting to retry withTransaction')
             end
@@ -562,7 +562,7 @@ module Mongo
               end
 
               if overload_encountered
-                delay = @client.retry_policy.backoff_delay(overload_error_count)
+                delay = @client.retry_policy.backoff_delay(overload_error_count, err: e)
                 if backoff_would_exceed_deadline?(deadline, delay)
                   transaction_in_progress = false
                   make_timeout_error_from(e, 'CSOT timeout expired during withTransaction commit')
@@ -1429,7 +1429,7 @@ module Mongo
     private_constant :BACKOFF_INITIAL, :BACKOFF_MAX
 
     def backoff_seconds_for_retry(transaction_attempt)
-      exponential = BACKOFF_INITIAL * (1.5**(transaction_attempt - 1))
+      exponential = BACKOFF_INITIAL * (1.5**transaction_attempt)
       Random.rand * [ exponential, BACKOFF_MAX ].min
     end
 

data/lib/mongo/uri/options_mapper.rb

@@ -614,7 +614,7 @@ module Mongo
       #
       # @return [ Hash | nil ] The auth mechanism properties hash.
       def convert_auth_mech_props(_name, value)
-        properties = hash_extractor('authMechanismProperties', value)
+        properties = hash_extractor('authMechanismProperties', value, invalidate_on_error: true)
         if properties
           properties.each do |k, v|
             properties[k] = (v.downcase == 'true') if k.to_s.downcase == 'canonicalize_host_name' && v
@@ -863,16 +863,27 @@ module Mongo
 
       # Extract values from the string and put them into a nested hash.
       #
+      # Multiple key-value pairs are delimited by a comma. Within each pair,
+      # the key is everything up to the first colon and the value is everything
+      # after it, so values may themselves contain colons (for example
+      # TOKEN_RESOURCE:mongodb://host).
+      #
       # @param [ String ] name Name of the URI option being processed.
       # @param [ String ] value The string to build a hash from.
+      # @param [ true | false ] invalidate_on_error When a pair is malformed
+      #   (has no value), discard the whole option and return nil instead of
+      #   skipping just that pair. Used for options such as
+      #   authMechanismProperties whose values must not contain commas.
       #
-      # @return [ Hash ] The hash built from the string.
-      def hash_extractor(name, value)
+      # @return [ Hash | nil ] The hash built from the string, or nil.
+      def hash_extractor(name, value, invalidate_on_error: false)
         h = {}
         value.split(',').each do |tag|
-          k, v = tag.split(':')
+          k, v = tag.split(':', 2)
           if v.nil?
             log_warn("Invalid hash value for #{name}: key `#{k}` does not have a value: #{value}")
+            return nil if invalidate_on_error
+
             next
           end
 

data/lib/mongo/version.rb

@@ -5,5 +5,5 @@ module Mongo
   #
   # Note that this file is automatically updated via `rake candidate:create`.
   # Manual changes to this file will be overwritten by that rake task.
-  VERSION = '2.25.0'
+  VERSION = '2.26.0'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: mongo
 version: !ruby/object:Gem::Version
-  version: 2.25.0
+  version: 2.26.0
 platform: ruby
 authors:
 - The MongoDB Ruby Team
@@ -561,7 +561,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.17
+rubygems_version: 4.0.20
 specification_version: 4
 summary: Ruby driver for MongoDB
 test_files: []