@depup/mongodb 7.5.0-depup.8 → 7.7.0-depup.0

package/src/client-side-encryption/client_encryption.ts

@@ -31,6 +31,11 @@ import {
   MongoCryptCreateEncryptedCollectionError,
   MongoCryptInvalidArgumentError
 } from './errors';
+import {
+  type ClientEncryptionSocketOptions,
+  type CSFLEKMSTlsOptions,
+  type KMSConnectCallback
+} from './kms_options';
 import {
   type ClientEncryptionDataKeyProvider,
   type CredentialProviders,
@@ -38,11 +43,7 @@ import {
   type KMSProviders,
   refreshKMSCredentials
 } from './providers/index';
-import {
-  type ClientEncryptionSocketOptions,
-  type CSFLEKMSTlsOptions,
-  StateMachine
-} from './state_machine';
+import { StateMachine } from './state_machine';
 
 /**
  * @public
@@ -75,6 +76,8 @@ export class ClientEncryption {
   /** @internal */
   _tlsOptions: CSFLEKMSTlsOptions;
   /** @internal */
+  _kmsConnectCallback?: KMSConnectCallback;
+  /** @internal */
   _kmsProviders: KMSProviders;
   /** @internal */
   _timeoutMS?: number;
@@ -125,7 +128,13 @@ export class ClientEncryption {
   constructor(client: MongoClient, options: ClientEncryptionOptions) {
     this._client = client;
     this._proxyOptions = options.proxyOptions ?? {};
+    if (this._proxyOptions.proxyHost && options.kmsConnectCallback) {
+      throw new MongoCryptInvalidArgumentError(
+        'Cannot set both proxyOptions and kmsConnectCallback'
+      );
+    }
     this._tlsOptions = options.tlsOptions ?? {};
+    this._kmsConnectCallback = options.kmsConnectCallback;
     this._kmsProviders = options.kmsProviders || {};
     const { timeoutMS } = resolveTimeoutOptions(client, options);
     this._timeoutMS = timeoutMS;
@@ -226,7 +235,8 @@ export class ClientEncryption {
     const stateMachine = new StateMachine({
       proxyOptions: this._proxyOptions,
       tlsOptions: this._tlsOptions,
-      socketOptions: autoSelectSocketOptions(this._client.s.options)
+      socketOptions: autoSelectSocketOptions(this._client.s.options),
+      kmsConnectCallback: this._kmsConnectCallback
     });
 
     const timeoutContext =
@@ -295,7 +305,8 @@ export class ClientEncryption {
     const stateMachine = new StateMachine({
       proxyOptions: this._proxyOptions,
       tlsOptions: this._tlsOptions,
-      socketOptions: autoSelectSocketOptions(this._client.s.options)
+      socketOptions: autoSelectSocketOptions(this._client.s.options),
+      kmsConnectCallback: this._kmsConnectCallback
     });
 
     const timeoutContext = TimeoutContext.create(
@@ -699,7 +710,8 @@ export class ClientEncryption {
     const stateMachine = new StateMachine({
       proxyOptions: this._proxyOptions,
       tlsOptions: this._tlsOptions,
-      socketOptions: autoSelectSocketOptions(this._client.s.options)
+      socketOptions: autoSelectSocketOptions(this._client.s.options),
+      kmsConnectCallback: this._kmsConnectCallback
     });
 
     const timeoutContext =
@@ -797,7 +809,8 @@ export class ClientEncryption {
     const stateMachine = new StateMachine({
       proxyOptions: this._proxyOptions,
       tlsOptions: this._tlsOptions,
-      socketOptions: autoSelectSocketOptions(this._client.s.options)
+      socketOptions: autoSelectSocketOptions(this._client.s.options),
+      kmsConnectCallback: this._kmsConnectCallback
     });
     const context = this._mongoCrypt.makeExplicitEncryptionContext(valueBuffer, contextOptions);
 
@@ -961,6 +974,13 @@ export interface ClientEncryptionOptions {
    */
   tlsOptions?: CSFLEKMSTlsOptions;
 
+  /**
+   * A callback that establishes the socket used to connect to a KMS host, e.g. to route KMS
+   * requests through an HTTP proxy via the HTTP CONNECT method. Mutually exclusive with `proxyOptions`.
+   * See {@link KMSConnectCallback} for a usage example.
+   */
+  kmsConnectCallback?: KMSConnectCallback;
+
   /**
    * Sets the expiration time for the DEK in the cache in milliseconds. Defaults to 60000. 0 means no timeout.
    */

package/src/client-side-encryption/kms_options.ts

@@ -0,0 +1,93 @@
+import { type Duplex } from 'stream';
+
+import { type MongoClientOptions } from '../mongo_client';
+
+/**
+ * @public
+ *
+ * TLS options to use when connecting. The spec specifically calls out which insecure
+ * tls options are not allowed:
+ *
+ *  - tlsAllowInvalidCertificates
+ *  - tlsAllowInvalidHostnames
+ *  - tlsInsecure
+ *
+ * These options are not included in the type, and are ignored if provided.
+ */
+export type ClientEncryptionTlsOptions = Pick<
+  MongoClientOptions,
+  'tlsCAFile' | 'tlsCertificateKeyFile' | 'tlsCertificateKeyFilePassword' | 'secureContext'
+>;
+
+/** @public */
+export type CSFLEKMSTlsOptions = {
+  aws?: ClientEncryptionTlsOptions;
+  gcp?: ClientEncryptionTlsOptions;
+  kmip?: ClientEncryptionTlsOptions;
+  local?: ClientEncryptionTlsOptions;
+  azure?: ClientEncryptionTlsOptions;
+
+  [key: string]: ClientEncryptionTlsOptions | undefined;
+};
+
+/**
+ * @public
+ *
+ * Socket options to use for KMS requests.
+ */
+export type ClientEncryptionSocketOptions = Pick<
+  MongoClientOptions,
+  'autoSelectFamily' | 'autoSelectFamilyAttemptTimeout'
+>;
+
+/**
+ * @public
+ *
+ * A callback that establishes the connection to a KMS host.
+ *
+ * When provided on `AutoEncryptionOptions` or `ClientEncryptionOptions`, the driver invokes this
+ * callback instead of connecting to the KMS host itself, passing the target `host` and `port`. The
+ * callback MUST return a `Duplex` stream connected to the KMS host, either directly or tunneled
+ * through a proxy; a `net.Socket` satisfies this, as does any other `Duplex`. The returned stream is
+ * passed to Node.js' `tls.connect()` as its `socket`, and the driver performs the KMS host's TLS
+ * handshake over it using the KMS provider's configured TLS options. The callback therefore MUST NOT
+ * perform the KMS host's TLS handshake itself, though it MAY use TLS for its own transport, e.g. when
+ * connecting to an HTTPS proxy. This enables routing KMS requests through an HTTP proxy via the HTTP
+ * CONNECT method.
+ *
+ * When the operation has a client-side operation timeout (CSOT) configured, `timeoutMS` is the
+ * remaining time budget in milliseconds; it is `undefined` otherwise. The `signal` aborts when the
+ * connection attempt exceeds that budget; the callback should stop connecting and reject when it fires.
+ *
+ * @example <caption>Route KMS requests through an HTTP proxy using the HTTP CONNECT method</caption>
+ * ```ts
+ * import * as net from 'net';
+ *
+ * const kmsConnectCallback: KMSConnectCallback = ({ host, port, signal }) =>
+ *   new Promise((resolve, reject) => {
+ *     // Open a plain connection to the proxy, not to the KMS host.
+ *     const socket = net.connect({ host: 'proxy.example.com', port: 8080, signal });
+ *     socket.once('error', reject);
+ *     socket.once('connect', () => {
+ *       // Ask the proxy to tunnel to the KMS host, then hand the socket back for the driver's TLS.
+ *       socket.write(`CONNECT ${host}:${port} HTTP/1.1\r\nHost: ${host}:${port}\r\n\r\n`);
+ *       socket.once('data', chunk => {
+ *         if (chunk.toString('utf8').startsWith('HTTP/1.1 200')) resolve(socket);
+ *         else reject(new Error('Proxy refused the CONNECT request'));
+ *       });
+ *     });
+ *   });
+ *
+ * const clientEncryption = new ClientEncryption(keyVaultClient, {
+ *   keyVaultNamespace,
+ *   kmsProviders,
+ *   kmsConnectCallback
+ * });
+ * ```
+ */
+export type KMSConnectCallback = (options: {
+  host: string;
+  port: number;
+  timeoutMS?: number;
+  signal: AbortSignal;
+}) => Promise<Duplex>;

package/src/client-side-encryption/state_machine.ts

@@ -15,7 +15,7 @@ import { type ProxyOptions } from '../cmap/connection';
 import { CursorTimeoutContext } from '../cursor/abstract_cursor';
 import { getSocks, type SocksLib } from '../deps';
 import { MongoOperationTimeoutError } from '../error';
-import { type MongoClient, type MongoClientOptions } from '../mongo_client';
+import { type MongoClient } from '../mongo_client';
 import { type Abortable } from '../mongo_types';
 import { type CollectionInfo } from '../operations/list_collections';
 import { Timeout, type TimeoutContext, TimeoutError } from '../timeout';
@@ -28,6 +28,12 @@ import {
 } from '../utils';
 import { autoSelectSocketOptions, type DataKey } from './client_encryption';
 import { MongoCryptError } from './errors';
+import {
+  type ClientEncryptionSocketOptions,
+  type ClientEncryptionTlsOptions,
+  type CSFLEKMSTlsOptions,
+  type KMSConnectCallback
+} from './kms_options';
 import { type MongocryptdManager } from './mongocryptd_manager';
 import { type KMSProviders } from './providers';
 
@@ -93,44 +99,6 @@ declare module 'mongodb-client-encryption' {
   }
 }
 
-/**
- * @public
- *
- * TLS options to use when connecting. The spec specifically calls out which insecure
- * tls options are not allowed:
- *
- *  - tlsAllowInvalidCertificates
- *  - tlsAllowInvalidHostnames
- *  - tlsInsecure
- *
- * These options are not included in the type, and are ignored if provided.
- */
-export type ClientEncryptionTlsOptions = Pick<
-  MongoClientOptions,
-  'tlsCAFile' | 'tlsCertificateKeyFile' | 'tlsCertificateKeyFilePassword' | 'secureContext'
->;
-
-/** @public */
-export type CSFLEKMSTlsOptions = {
-  aws?: ClientEncryptionTlsOptions;
-  gcp?: ClientEncryptionTlsOptions;
-  kmip?: ClientEncryptionTlsOptions;
-  local?: ClientEncryptionTlsOptions;
-  azure?: ClientEncryptionTlsOptions;
-
-  [key: string]: ClientEncryptionTlsOptions | undefined;
-};
-
-/**
- * @public
- *
- * Socket options to use for KMS requests.
- */
-export type ClientEncryptionSocketOptions = Pick<
-  MongoClientOptions,
-  'autoSelectFamily' | 'autoSelectFamilyAttemptTimeout'
->;
-
 /**
  * This is kind of a hack.  For `rewrapManyDataKey`, we have tests that
  * guarantee that when there are no matching keys, `rewrapManyDataKey` returns
@@ -173,6 +141,9 @@ export type StateMachineOptions = {
 
   /** Socket specific options we support. */
   socketOptions: ClientEncryptionSocketOptions;
+
+  /** Optional callback that establishes the KMS socket, if set. */
+  kmsConnectCallback?: KMSConnectCallback;
 } & Pick<BSONSerializeOptions, 'promoteLongs' | 'promoteValues'>;
 
 /**
@@ -388,9 +359,55 @@ export class StateMachine {
     }
 
     let abortListener;
+    let kmsRequestTimeout: Timeout | undefined;
 
     try {
-      if (this.options.proxyOptions && this.options.proxyOptions.proxyHost) {
+      options?.signal?.throwIfAborted();
+
+      if (this.options.kmsConnectCallback) {
+        const remainingTimeMS = options?.timeoutContext?.csotEnabled()
+          ? options.timeoutContext.getRemainingTimeMSOrThrow(
+              `KMS request timed out after ${options.timeoutContext.timeoutMS}ms`
+            )
+          : undefined;
+        // A non-finite budget (timeoutMS: 0) means no timeout; otherwise back the callback with one.
+        const timeoutMS = Number.isFinite(remainingTimeMS) ? remainingTimeMS : undefined;
+        const controller = new AbortController();
+        // Forward the operation's own abort signal so aborting the operation also aborts the callback.
+        const forwardAbort = addAbortListener(options?.signal, function () {
+          controller.abort(this.reason);
+        });
+        const connectPromise = this.options.kmsConnectCallback({
+          host: socketOptions.host,
+          port: socketOptions.port,
+          timeoutMS,
+          signal: controller.signal
+        });
+        // If the callback resolves a socket after we already aborted, close it so it does not leak.
+        connectPromise.then(
+          resolvedSocket => {
+            if (controller.signal.aborted) resolvedSocket.destroy();
+          },
+          () => null
+        );
+        const timeout = timeoutMS ? Timeout.expires(timeoutMS) : undefined;
+        try {
+          socketOptions.socket = timeout
+            ? await Promise.race([connectPromise, timeout])
+            : await connectPromise;
+        } catch (err) {
+          if (TimeoutError.is(err)) {
+            const timeoutError = new MongoOperationTimeoutError('KMS request timed out');
+            // Abort with the timeout error as the reason so the callback sees it on `signal.reason`.
+            controller.abort(timeoutError);
+            throw timeoutError;
+          }
+          throw onerror(err);
+        } finally {
+          timeout?.clear();
+          forwardAbort?.[kDispose]();
+        }
+      } else if (this.options.proxyOptions && this.options.proxyOptions.proxyHost) {
         netSocket = new net.Socket();
 
         const {
@@ -465,20 +482,24 @@ export class StateMachine {
             resolve();
           }
         });
-      await (options?.timeoutContext?.csotEnabled()
-        ? Promise.all([
-            willResolveKmsRequest,
-            Timeout.expires(options.timeoutContext?.remainingTimeMS)
-          ])
+      const remainingTimeMS = options?.timeoutContext?.csotEnabled()
+        ? options.timeoutContext.getRemainingTimeMSOrThrow(
+            `KMS request timed out after ${options.timeoutContext.timeoutMS}ms`
+          )
+        : undefined;
+      const timeoutMS = Number.isFinite(remainingTimeMS) ? remainingTimeMS : undefined;
+      kmsRequestTimeout = timeoutMS ? Timeout.expires(timeoutMS) : undefined;
+      await (kmsRequestTimeout
+        ? Promise.race([willResolveKmsRequest, kmsRequestTimeout])
         : willResolveKmsRequest);
     } catch (error) {
-      if (error instanceof TimeoutError)
-        throw new MongoOperationTimeoutError('KMS request timed out');
+      if (TimeoutError.is(error)) throw new MongoOperationTimeoutError('KMS request timed out');
       throw error;
     } finally {
       // There's no need for any more activity on this socket at this point.
       destroySockets();
       abortListener?.[kDispose]();
+      kmsRequestTimeout?.clear();
     }
   }
 

package/src/cmap/auth/gssapi.ts

@@ -69,10 +69,7 @@ export class GSSAPI extends AuthProvider {
 }
 
 async function makeKerberosClient({
-  options: {
-    hostAddress,
-    runtime: { os }
-  },
+  options: { hostAddress, runtime },
   credentials
 }: AuthContext): Promise<KerberosClient> {
   if (!hostAddress || typeof hostAddress.host !== 'string' || !credentials) {
@@ -81,6 +78,8 @@ async function makeKerberosClient({
     );
   }
 
+  const { os } = await runtime;
+
   loadKrb();
   if ('kModuleError' in krb) {
     throw krb['kModuleError'];

package/src/cmap/auth/mongo_credentials.ts

@@ -25,7 +25,6 @@ function getDefaultAuthMechanism(hello: Document | null): AuthMechanism {
     }
   }
 
-  // Default auth mechanism for 4.0 and higher.
   return AuthMechanism.MONGODB_SCRAM_SHA256;
 }
 

package/src/cmap/auth/mongodb_aws.ts

@@ -1,11 +1,7 @@
 import { type Binary, type BSONSerializeOptions, ByteUtils } from '../../bson';
 import * as BSON from '../../bson';
-import {
-  MongoCompatibilityError,
-  MongoMissingCredentialsError,
-  MongoRuntimeError
-} from '../../error';
-import { maxWireVersion, ns, randomBytes } from '../../utils';
+import { MongoMissingCredentialsError, MongoRuntimeError } from '../../error';
+import { ns, randomBytes } from '../../utils';
 import { type AuthContext, AuthProvider } from './auth_provider';
 import {
   type AWSCredentialProvider,
@@ -45,12 +41,6 @@ export class MongoDBAWS extends AuthProvider {
       throw new MongoMissingCredentialsError('AuthContext must provide credentials.');
     }
 
-    if (maxWireVersion(connection) < 9) {
-      throw new MongoCompatibilityError(
-        'MONGODB-AWS authentication requires MongoDB version 4.4 or later'
-      );
-    }
-
     authContext.credentials = await makeTempCredentials(
       authContext.credentials,
       this.credentialFetcher

package/src/cmap/auth/mongodb_oidc/callback_workflow.ts

@@ -154,24 +154,24 @@ export abstract class CallbackWorkflow implements Workflow {
    * to every 100ms.
    */
   protected withLock(callback: OIDCCallbackFunction): OIDCCallbackFunction {
-    let lock: Promise<any> = Promise.resolve();
+    let queue: Promise<void> = Promise.resolve();
     return async (params: OIDCCallbackParams): Promise<OIDCResponse> => {
-      // We do this to ensure that we would never return the result of the
-      // previous lock, only the current callback's value would get returned.
-      await lock;
-      lock = lock
-
-        .catch(() => null)
-
-        .then(async () => {
-          const difference = Date.now() - this.lastExecutionTime;
-          if (difference <= THROTTLE_MS) {
-            await setTimeout(THROTTLE_MS - difference, { signal: params.timeoutContext });
-          }
-          this.lastExecutionTime = Date.now();
-          return await callback(params);
-        });
-      return await lock;
+      const execution = queue.then(async () => {
+        const difference = Date.now() - this.lastExecutionTime;
+        if (difference <= THROTTLE_MS) {
+          await setTimeout(THROTTLE_MS - difference, { signal: params.timeoutContext });
+        }
+        this.lastExecutionTime = Date.now();
+        return await callback(params);
+      });
+      // The queue exists only to order callers, so it must carry neither a
+      // result nor an error: a caller waiting on it gets its own callback
+      // invocation, and a failed callback does not block the callers behind it.
+      queue = execution.then(
+        () => undefined,
+        () => undefined
+      );
+      return await execution;
     };
   }
 }

package/src/cmap/command_monitoring_events.ts

@@ -32,7 +32,7 @@ export class CommandStartedEvent {
   /**
    * Server generated connection id
    * Distinct from the connection id and is returned by the hello or legacy hello response as "connectionId"
-   * from the server on 4.2+.
+   * from the server.
    */
   serverConnectionId: bigint | null;
   serviceId?: ObjectId;
@@ -88,7 +88,7 @@ export class CommandSucceededEvent {
   connectionId?: string | number;
   /**
    * Server generated connection id
-   * Distinct from the connection id and is returned by the hello or legacy hello response as "connectionId" from the server on 4.2+.
+   * Distinct from the connection id and is returned by the hello or legacy hello response as "connectionId" from the server.
    */
   serverConnectionId: bigint | null;
   requestId: number;
@@ -148,7 +148,7 @@ export class CommandFailedEvent {
   connectionId?: string | number;
   /**
    * Server generated connection id
-   * Distinct from the connection id and is returned by the hello or legacy hello response as "connectionId" from the server on 4.2+.
+   * Distinct from the connection id and is returned by the hello or legacy hello response as "connectionId" from the server.
    */
   serverConnectionId: bigint | null;
   requestId: number;
@@ -249,13 +249,12 @@ const LEGACY_FIND_OPTIONS_MAP = {
 function extractCommand(command: WriteProtocolMessageType): Document {
   if (command instanceof OpMsgRequest) {
     const cmd = { ...command.command };
-    // For OP_MSG with payload type 1 we need to pull the documents
-    // array out of the document sequence for monitoring.
-    if (cmd.ops instanceof DocumentSequence) {
-      cmd.ops = cmd.ops.documents;
-    }
-    if (cmd.nsInfo instanceof DocumentSequence) {
-      cmd.nsInfo = cmd.nsInfo.documents;
+    // For OP_MSG payload type 1, replace any document-sequence field with its
+    // documents array for monitoring (ops, nsInfo, documents, updates, deletes).
+    for (const key of Object.keys(cmd)) {
+      if (cmd[key] instanceof DocumentSequence) {
+        cmd[key] = cmd[key].documents;
+      }
     }
     return cmd;
   }

package/src/cmap/commands.ts

@@ -500,6 +500,23 @@ export class DocumentSequence {
   }
 }
 
+/**
+ * Build a DocumentSequence from documents that have already been serialized,
+ * reusing the provided buffers instead of re-serializing.
+ * @internal
+ */
+export function makeDocumentSequence(
+  field: string,
+  documents: Document[],
+  serialized: Uint8Array[]
+): DocumentSequence {
+  const sequence = new DocumentSequence(field);
+  for (let i = 0; i < documents.length; i++) {
+    sequence.push(documents[i], serialized[i]);
+  }
+  return sequence;
+}
+
 /** @internal */
 export class OpMsgRequest {
   requestId: number;

package/src/cmap/connect.ts

@@ -174,7 +174,7 @@ export async function performInitialHandshake(
 
       if (error instanceof MongoError) {
         error.addErrorLabel(MongoErrorLabel.HandshakeError);
-        if (needsRetryableWriteLabel(error, response.maxWireVersion, conn.description.type)) {
+        if (needsRetryableWriteLabel(error)) {
           error.addErrorLabel(MongoErrorLabel.RetryableWriteError);
         }
       }
@@ -224,7 +224,7 @@ export interface HandshakeDocument extends Document {
   compression: string[];
   saslSupportedMechs?: string;
   loadBalanced?: boolean;
-  backpressure: true;
+  backpressure: '2';
 }
 
 /**
@@ -242,7 +242,7 @@ export async function prepareHandshakeDocument(
 
   const handshakeDoc: HandshakeDocument = {
     [serverApi?.version || options.loadBalanced === true ? 'hello' : LEGACY_HELLO_COMMAND]: 1,
-    backpressure: true,
+    backpressure: '2',
     helloOk: true,
     client: clientMetadata,
     compression: compressors

package/src/cmap/connection.ts

@@ -146,7 +146,7 @@ export interface ConnectionOptions
   /** @internal */
   mongoLogger?: MongoLogger | undefined;
   /** @internal */
-  runtime: Runtime;
+  runtime: Promise<Runtime>;
 }
 
 /** @public */
@@ -286,7 +286,9 @@ export class Connection extends TypedEventEmitter<ConnectionEvents> {
   private get supportsOpMsg(): boolean {
     return (
       this.description != null &&
-      // TODO(NODE-6672,NODE-6287): This guard is primarily for maxWireVersion = 0
+      // OP_MSG was introduced in server 3.6 (wire version 6). This also guards
+      // against the pre-handshake case where maxWireVersion() returns 0.
+      // TODO(NODE-6672,NODE-6287): remove this helper once OP_QUERY support is dropped
       maxWireVersion(this) >= 6 &&
       !this.description.__nodejs_mock_server__
     );

package/src/cmap/handshake/client_metadata.ts

@@ -107,8 +107,9 @@ type MakeClientMetadataOptions = Pick<MongoOptions, 'appName' | 'runtime'>;
  */
 export async function makeClientMetadata(
   driverInfoList: DriverInfo[],
-  { appName = '', runtime: { os } }: MakeClientMetadataOptions
+  { appName = '', runtime }: MakeClientMetadataOptions
 ): Promise<ClientMetadata> {
+  const { os } = await runtime;
   const metadataDocument = new LimitedSizeDocument(512);
 
   // Add app name first, it must be sent

package/src/cmap/wire_protocol/constants.ts

@@ -1,8 +1,8 @@
-export const MIN_SUPPORTED_SERVER_VERSION = '4.2';
+export const MIN_SUPPORTED_SERVER_VERSION = '4.4';
 export const MAX_SUPPORTED_SERVER_VERSION = '9.0';
 export const MIN_SUPPORTED_SNAPSHOT_READS_WIRE_VERSION = 13;
 export const MIN_SUPPORTED_SNAPSHOT_READS_SERVER_VERSION = '5.0';
-export const MIN_SUPPORTED_WIRE_VERSION = 8;
+export const MIN_SUPPORTED_WIRE_VERSION = 9;
 export const MAX_SUPPORTED_WIRE_VERSION = 29;
 export const MIN_SUPPORTED_QE_WIRE_VERSION = 21;
 export const MIN_SUPPORTED_QE_SERVER_VERSION = '7.0';

package/src/connection_string.ts

@@ -544,6 +544,10 @@ export function parseOptions(
   );
 
   mongoOptions.runtime = resolveRuntimeAdapters(options);
+  // Mark the promise as handled so a rejection before any consumer awaits it (possible only in
+  // runtimes where the dynamic import of the default os adapter fails) cannot crash the process
+  // as an unhandled rejection; consumers awaiting `runtime` still observe the rejection.
+  mongoOptions.runtime.then(undefined, squashError);
 
   return mongoOptions;
 }

package/src/cursor/abstract_cursor.ts

@@ -126,11 +126,6 @@ export interface AbstractCursorOptions extends BSONSerializeOptions {
   maxAwaitTimeMS?: number;
   /**
    * Comment to apply to the operation.
-   *
-   * In server versions pre-4.4, 'comment' must be string.  A server
-   * error will be thrown if any other type is provided.
-   *
-   * In server versions 4.4 and above, 'comment' can be any valid BSON type.
    */
   comment?: unknown;
   /**