mongodb 7.0.0 → 7.1.0-dev.20260205.sha.d2ad07f2

package/mongodb.d.ts

@@ -24,6 +24,7 @@ import type { SrvRecord } from 'dns';
 import { EventEmitter } from 'events';
 import type { Socket } from 'net';
 import type { TcpNetConnectOpts } from 'net';
+import type * as os from 'os';
 import { Readable } from 'stream';
 import { Writable } from 'stream';
 import type { ConnectionOptions as ConnectionOptions_2 } from 'tls';
@@ -3513,6 +3514,7 @@ export declare interface ConnectionOptions extends SupportedNodeConnectionOption
     /* Excluded from this release type: cancellationToken */
     /* Excluded from this release type: metadata */
     /* Excluded from this release type: mongoLogger */
+    /* Excluded from this release type: runtime */
 }
 
 /* Excluded from this release type: ConnectionPool */
@@ -4198,6 +4200,7 @@ export declare interface DeleteStatement {
     hint?: Hint;
 }
 
+/* Excluded from this release type: DeprioritizedServers */
 export { deserialize }
 
 /** @public */
@@ -6185,6 +6188,12 @@ export declare interface MongoClientOptions extends BSONSerializeOptions, Suppor
     /* Excluded from this release type: srvPoller */
     /* Excluded from this release type: connectionType */
     /* Excluded from this release type: __skipPingOnConnect */
+    /**
+     * @experimental
+     *
+     * If provided, any adapters provided will be used in place of the corresponding Node.js module.
+     */
+    runtimeAdapters?: RuntimeAdapters;
 }
 
 /* Excluded from this release type: MongoClientPrivate */
@@ -6578,6 +6587,8 @@ export declare const MongoErrorLabel: Readonly<{
     readonly PoolRequestedRetry: "PoolRequestedRetry";
     readonly InterruptInUseConnections: "InterruptInUseConnections";
     readonly NoWritesPerformed: "NoWritesPerformed";
+    readonly RetryableError: "RetryableError";
+    readonly SystemOverloadedError: "SystemOverloadedError";
 }>;
 
 /** @public */
@@ -7004,6 +7015,7 @@ export declare interface MongoOptions extends Required<Pick<MongoClientOptions,
     /* Excluded from this release type: mongodbLogPath */
     timeoutMS?: number;
     /* Excluded from this release type: __skipPingOnConnect */
+    /* Excluded from this release type: runtime */
 }
 
 /**
@@ -7502,6 +7514,14 @@ export declare class OrderedBulkOperation extends BulkOperationBase {
     addToOperationsList(batchType: BatchType, document: Document | UpdateStatement | DeleteStatement): this;
 }
 
+/**
+ * @public
+ * @experimental
+ *
+ * Represents the set of dependencies that the driver uses from the [Node.js OS module](https://nodejs.org/api/os.html).
+ */
+export declare type OsAdapter = Pick<typeof os, 'release' | 'platform' | 'arch' | 'type'>;
+
 /** @public */
 export declare interface PkFactory {
     createPk(): any;
@@ -7733,7 +7753,12 @@ export declare type RemoveUserOptions = Omit<CommandOperationOptions, 'rawData'>
 export declare interface RenameOptions extends Omit<CommandOperationOptions, 'rawData'> {
     /** Drop the target name collection if it previously exists. */
     dropTarget?: boolean;
-    /** Unclear */
+    /**
+     * @deprecated
+     *
+     * This option has been dead code since at least Node driver version 4.x. It will
+     * be removed in a future major release.
+     */
     new_collection?: boolean;
 }
 
@@ -7907,6 +7932,18 @@ export declare type RunCursorCommandOptions = {
     awaitData?: boolean;
 } & BSONSerializeOptions;
 
+/* Excluded from this release type: Runtime */
+
+/**
+ * @public
+ * @experimental
+ *
+ * This type represents the set of dependencies that the driver needs from the Javascript runtime in order to function.
+ */
+export declare interface RuntimeAdapters {
+    os?: OsAdapter;
+}
+
 /** @public */
 export declare type SchemaMember<T, V> = {
     [P in keyof T]?: V;
@@ -7933,7 +7970,7 @@ export declare interface SelectServerOptions {
     serverSelectionTimeoutMS?: number;
     session?: ClientSession;
     operationName: string;
-    previousServer?: ServerDescription;
+    /* Excluded from this release type: deprioritizedServers */
     /* Excluded from this release type: timeoutContext */
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mongodb",
-  "version": "7.0.0",
+  "version": "7.1.0-dev.20260205.sha.d2ad07f2",
   "description": "The official MongoDB driver for Node.js",
   "main": "lib/index.js",
   "files": [
@@ -26,7 +26,7 @@
   },
   "dependencies": {
     "@mongodb-js/saslprep": "^1.3.0",
-    "bson": "^7.0.0",
+    "bson": "^7.1.1",
     "mongodb-connection-string-url": "^7.0.0"
   },
   "peerDependencies": {
@@ -65,12 +65,12 @@
     "@aws-sdk/credential-providers": "^3.876.0",
     "@iarna/toml": "^2.2.5",
     "@istanbuljs/nyc-config-typescript": "^1.0.2",
-    "@microsoft/api-extractor": "^7.52.11",
+    "@microsoft/api-extractor": "^7.54.0",
     "@microsoft/tsdoc-config": "^0.17.1",
     "@mongodb-js/zstd": "^7.0.0",
     "@types/chai": "^4.3.17",
     "@types/chai-subset": "^1.3.5",
-    "@types/express": "^5.0.3",
+    "@types/express": "^5.0.5",
     "@types/kerberos": "^1.1.5",
     "@types/mocha": "^10.0.9",
     "@types/node": "^22.15.3",
@@ -79,12 +79,13 @@
     "@types/sinon": "^17.0.4",
     "@types/sinon-chai": "^4.0.0",
     "@types/whatwg-url": "^13.0.0",
-    "@typescript-eslint/eslint-plugin": "^8.41.0",
+    "@typescript-eslint/eslint-plugin": "^8.46.3",
     "@typescript-eslint/parser": "^8.31.1",
+    "aws4": "^1.13.2",
     "chai": "^4.4.1",
     "chai-subset": "^1.6.0",
     "chalk": "^4.1.2",
-    "eslint": "^9.34.0",
+    "eslint": "^9.39.1",
     "eslint-config-prettier": "^10.1.8",
     "eslint-plugin-mocha": "^10.4.1",
     "eslint-plugin-prettier": "^5.5.4",
@@ -94,10 +95,10 @@
     "express": "^5.1.0",
     "gcp-metadata": "^7.0.1",
     "js-yaml": "^4.1.0",
-    "mocha": "^11.7.1",
+    "mocha": "^11.7.5",
     "mocha-sinon": "^2.1.2",
     "mongodb-client-encryption": "^7.0.0",
-    "nyc": "^15.1.0",
+    "nyc": "^17.1.0",
     "prettier": "^3.6.2",
     "semver": "^7.7.2",
     "sinon": "^18.0.1",
@@ -146,9 +147,6 @@
     "check:aws": "nyc mocha --config test/mocha_mongodb.js test/integration/auth/mongodb_aws.test.ts test/integration/auth/mongodb_aws.prose.test.ts",
     "check:oidc-auth": "nyc mocha --config test/mocha_mongodb.js test/integration/auth/auth.spec.test.ts",
     "check:oidc-test": "nyc mocha --config test/mocha_mongodb.js test/integration/auth/mongodb_oidc.prose.test.ts",
-    "check:oidc-azure": "nyc mocha --config test/mocha_mongodb.js test/integration/auth/mongodb_oidc_azure.prose.05.test.ts",
-    "check:oidc-gcp": "nyc mocha --config test/mocha_mongodb.js test/integration/auth/mongodb_oidc_gcp.prose.06.test.ts",
-    "check:oidc-k8s": "nyc mocha --config test/mocha_mongodb.js test/integration/auth/mongodb_oidc_k8s.prose.07.test.ts",
     "check:kerberos": "nyc mocha --config test/manual/mocharc.js test/manual/kerberos.test.ts",
     "check:tls": "nyc mocha --config test/manual/mocharc.js test/manual/tls_support.test.ts",
     "check:ldap": "nyc mocha --config test/manual/mocharc.js test/manual/ldap.test.ts",
@@ -172,4 +170,4 @@
       "moduleResolution": "node"
     }
   }
-}
+}

package/src/bson.ts

@@ -22,6 +22,7 @@ export {
   Long,
   MaxKey,
   MinKey,
+  NumberUtils,
   ObjectId,
   type ObjectIdLike,
   serialize,

package/src/change_stream.ts

@@ -18,6 +18,7 @@ import { MongoClient } from './mongo_client';
 import { type InferIdType, TypedEventEmitter } from './mongo_types';
 import type { AggregateOptions } from './operations/aggregate';
 import type { OperationParent } from './operations/command';
+import { DeprioritizedServers } from './sdam/server_selection';
 import type { ServerSessionId } from './sessions';
 import { CSOTTimeoutContext, type TimeoutContext } from './timeout';
 import { type AnyOptions, getTopology, type MongoDBNamespace, squashError } from './utils';
@@ -1073,7 +1074,8 @@ export class ChangeStream<
     try {
       await topology.selectServer(this.cursor.readPreference, {
         operationName: 'reconnect topology in change stream',
-        timeoutContext: this.timeoutContext
+        timeoutContext: this.timeoutContext,
+        deprioritizedServers: new DeprioritizedServers()
       });
       this.cursor = this._createChangeStreamCursor(this.cursor.resumeOptions);
     } catch {

package/src/client-side-encryption/state_machine.ts

@@ -1,6 +1,7 @@
 import * as fs from 'fs/promises';
 import { type MongoCryptContext, type MongoCryptKMSRequest } from 'mongodb-client-encryption';
 import * as net from 'net';
+import * as process from 'process';
 import * as tls from 'tls';
 
 import {

package/src/cmap/auth/aws4.ts

@@ -0,0 +1,207 @@
+import { BSON } from '../../bson';
+import { type AWSCredentials } from '../../deps';
+
+export type AwsSigv4Options = {
+  path: '/';
+  body: string;
+  host: string;
+  method: 'POST';
+  headers: {
+    'Content-Type': 'application/x-www-form-urlencoded';
+    'Content-Length': number;
+    'X-MongoDB-Server-Nonce': string;
+    'X-MongoDB-GS2-CB-Flag': 'n';
+  };
+  service: string;
+  region: string;
+  date: Date;
+};
+
+export type SignedHeaders = {
+  Authorization: string;
+  'X-Amz-Date': string;
+};
+
+/**
+ * Calculates the SHA-256 hash of a string.
+ *
+ * @param str - String to hash.
+ * @returns Hexadecimal representation of the hash.
+ */
+const getHexSha256 = async (str: string): Promise<string> => {
+  const data = stringToBuffer(str);
+  const hashBuffer = await crypto.subtle.digest('SHA-256', data);
+  const hashHex = BSON.onDemand.ByteUtils.toHex(new Uint8Array(hashBuffer));
+  return hashHex;
+};
+
+/**
+ * Calculates the HMAC-SHA256 of a string using the provided key.
+ * @param key - Key to use for HMAC calculation. Can be a string or Uint8Array.
+ * @param str - String to calculate HMAC for.
+ * @returns Uint8Array containing the HMAC-SHA256 digest.
+ */
+const getHmacSha256 = async (key: string | Uint8Array, str: string): Promise<Uint8Array> => {
+  let keyData: Uint8Array;
+  if (typeof key === 'string') {
+    keyData = stringToBuffer(key);
+  } else {
+    keyData = key;
+  }
+
+  const importedKey = await crypto.subtle.importKey(
+    'raw',
+    keyData,
+    { name: 'HMAC', hash: { name: 'SHA-256' } },
+    false,
+    ['sign']
+  );
+  const strData = stringToBuffer(str);
+  const signature = await crypto.subtle.sign('HMAC', importedKey, strData);
+  const digest = new Uint8Array(signature);
+  return digest;
+};
+
+/**
+ * Converts header values according to AWS requirements,
+ * From https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_sigv-create-signed-request.html#create-canonical-request
+ * For values, you must:
+    - trim any leading or trailing spaces.
+    - convert sequential spaces to a single space.
+ * @param value - Header value to convert.
+ * @returns - Converted header value.
+ */
+const convertHeaderValue = (value: string | number) => {
+  return value.toString().trim().replace(/\s+/g, ' ');
+};
+
+/**
+ * Returns a Uint8Array representation of a string, encoded in UTF-8.
+ * @param str - String to convert.
+ * @returns Uint8Array containing the UTF-8 encoded string.
+ */
+function stringToBuffer(str: string): Uint8Array {
+  const data = new Uint8Array(BSON.onDemand.ByteUtils.utf8ByteLength(str));
+  BSON.onDemand.ByteUtils.encodeUTF8Into(data, str, 0);
+  return data;
+}
+
+/**
+ * This method implements AWS Signature 4 logic for a very specific request format.
+ * The signing logic is described here: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_sigv-create-signed-request.html
+ */
+export async function aws4Sign(
+  options: AwsSigv4Options,
+  credentials: AWSCredentials
+): Promise<SignedHeaders> {
+  /**
+   * From the spec: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_sigv-create-signed-request.html
+   *
+   * Summary of signing steps
+   * 1. Create a canonical request
+   *    Arrange the contents of your request (host, action, headers, etc.) into a standard canonical format. The canonical request is one of the inputs used to create the string to sign.
+   * 2. Create a hash of the canonical request
+   *    Hash the canonical request using the same algorithm that you used to create the hash of the payload. The hash of the canonical request is a string of lowercase hexadecimal characters.
+   * 3. Create a string to sign
+   *    Create a string to sign with the canonical request and extra information such as the algorithm, request date, credential scope, and the hash of the canonical request.
+   * 4. Derive a signing key
+   *    Use the secret access key to derive the key used to sign the request.
+   * 5. Calculate the signature
+   *    Perform a keyed hash operation on the string to sign using the derived signing key as the hash key.
+   * 6. Add the signature to the request
+   *    Add the calculated signature to an HTTP header or to the query string of the request.
+   */
+
+  // 1: Create a canonical request
+
+  // Date – The date and time used to sign the request.
+  const date = options.date;
+  // RequestDateTime – The date and time used in the credential scope. This value is the current UTC time in ISO 8601 format (for example, 20130524T000000Z).
+  const requestDateTime = date.toISOString().replace(/[:-]|\.\d{3}/g, '');
+  // RequestDate – The date used in the credential scope. This value is the current UTC date in YYYYMMDD format (for example, 20130524).
+  const requestDate = requestDateTime.substring(0, 8);
+  // Method – The HTTP request method. For us, this is always 'POST'.
+  const method = options.method;
+  // CanonicalUri – The URI-encoded version of the absolute path component URI, starting with the / that follows the domain name and up to the end of the string
+  // For our requests, this is always '/'
+  const canonicalUri = options.path;
+  // CanonicalQueryString – The URI-encoded query string parameters. For our requests, there are no query string parameters, so this is always an empty string.
+  const canonicalQuerystring = '';
+
+  // CanonicalHeaders – A list of request headers with their values. Individual header name and value pairs are separated by the newline character ("\n").
+  // All of our known/expected headers are included here, there are no extra headers.
+  const headers = new Headers({
+    'content-length': convertHeaderValue(options.headers['Content-Length']),
+    'content-type': convertHeaderValue(options.headers['Content-Type']),
+    host: convertHeaderValue(options.host),
+    'x-amz-date': convertHeaderValue(requestDateTime),
+    'x-mongodb-gs2-cb-flag': convertHeaderValue(options.headers['X-MongoDB-GS2-CB-Flag']),
+    'x-mongodb-server-nonce': convertHeaderValue(options.headers['X-MongoDB-Server-Nonce'])
+  });
+  // If session token is provided, include it in the headers
+  if ('sessionToken' in credentials && credentials.sessionToken) {
+    headers.append('x-amz-security-token', convertHeaderValue(credentials.sessionToken));
+  }
+
+  // Canonical headers are lowercased and sorted.
+  const canonicalHeaders = Array.from(headers.entries())
+    .map(([key, value]) => `${key.toLowerCase()}:${value}`)
+    .sort()
+    .join('\n');
+  const canonicalHeaderNames = Array.from(headers.keys()).map(header => header.toLowerCase());
+  // SignedHeaders – An alphabetically sorted, semicolon-separated list of lowercase request header names.
+  const signedHeaders = canonicalHeaderNames.sort().join(';');
+
+  // HashedPayload – A string created using the payload in the body of the HTTP request as input to a hash function. This string uses lowercase hexadecimal characters.
+  const hashedPayload = await getHexSha256(options.body);
+
+  // CanonicalRequest – A string that includes the above elements, separated by newline characters.
+  const canonicalRequest = [
+    method,
+    canonicalUri,
+    canonicalQuerystring,
+    canonicalHeaders + '\n',
+    signedHeaders,
+    hashedPayload
+  ].join('\n');
+
+  // 2. Create a hash of the canonical request
+  // HashedCanonicalRequest – A string created by using the canonical request as input to a hash function.
+  const hashedCanonicalRequest = await getHexSha256(canonicalRequest);
+
+  // 3. Create a string to sign
+  // Algorithm – The algorithm used to create the hash of the canonical request. For SigV4, use AWS4-HMAC-SHA256.
+  const algorithm = 'AWS4-HMAC-SHA256';
+  // CredentialScope – The credential scope, which restricts the resulting signature to the specified Region and service.
+  // Has the following format: YYYYMMDD/region/service/aws4_request.
+  const credentialScope = `${requestDate}/${options.region}/${options.service}/aws4_request`;
+  // StringToSign – A string that includes the above elements, separated by newline characters.
+  const stringToSign = [algorithm, requestDateTime, credentialScope, hashedCanonicalRequest].join(
+    '\n'
+  );
+
+  // 4. Derive a signing key
+  // To derive a signing key for SigV4, perform a succession of keyed hash operations (HMAC) on the request date, Region, and service, with your AWS secret access key as the key for the initial hashing operation.
+  const dateKey = await getHmacSha256('AWS4' + credentials.secretAccessKey, requestDate);
+  const dateRegionKey = await getHmacSha256(dateKey, options.region);
+  const dateRegionServiceKey = await getHmacSha256(dateRegionKey, options.service);
+  const signingKey = await getHmacSha256(dateRegionServiceKey, 'aws4_request');
+
+  // 5. Calculate the signature
+  const signatureBuffer = await getHmacSha256(signingKey, stringToSign);
+  const signature = BSON.onDemand.ByteUtils.toHex(signatureBuffer);
+
+  // 6. Add the signature to the request
+  // Calculate the Authorization header
+  const authorizationHeader = [
+    'AWS4-HMAC-SHA256 Credential=' + credentials.accessKeyId + '/' + credentialScope,
+    'SignedHeaders=' + signedHeaders,
+    'Signature=' + signature
+  ].join(', ');
+
+  // Return the calculated headers
+  return {
+    Authorization: authorizationHeader,
+    'X-Amz-Date': requestDateTime
+  };
+}

package/src/cmap/auth/aws_temporary_credentials.ts

@@ -1,3 +1,5 @@
+import * as process from 'process';
+
 import { type AWSCredentials, getAwsCredentialProvider } from '../../deps';
 import { MongoAWSError } from '../../error';
 

package/src/cmap/auth/gssapi.ts

@@ -68,9 +68,13 @@ export class GSSAPI extends AuthProvider {
   }
 }
 
-async function makeKerberosClient(authContext: AuthContext): Promise<KerberosClient> {
-  const { hostAddress } = authContext.options;
-  const { credentials } = authContext;
+async function makeKerberosClient({
+  options: {
+    hostAddress,
+    runtime: { os }
+  },
+  credentials
+}: AuthContext): Promise<KerberosClient> {
   if (!hostAddress || typeof hostAddress.host !== 'string' || !credentials) {
     throw new MongoInvalidArgumentError(
       'Connection must have host and port and credentials defined.'
@@ -97,7 +101,7 @@ async function makeKerberosClient(authContext: AuthContext): Promise<KerberosCli
   }
 
   const spnHost = mechanismProperties.SERVICE_HOST ?? host;
-  let spn = `${serviceName}${process.platform === 'win32' ? '/' : '@'}${spnHost}`;
+  let spn = `${serviceName}${os.platform() === 'win32' ? '/' : '@'}${spnHost}`;
   if ('SERVICE_REALM' in mechanismProperties) {
     spn = `${spn}@${mechanismProperties.SERVICE_REALM}`;
   }

package/src/cmap/auth/mongo_credentials.ts

@@ -45,7 +45,8 @@ export const DEFAULT_ALLOWED_HOSTS = [
   '*.mongodbgov.net',
   'localhost',
   '127.0.0.1',
-  '::1'
+  '::1',
+  '*.mongo.com'
 ];
 
 /** Error for when the token audience is missing in the environment. */

package/src/cmap/auth/mongodb_aws.ts

@@ -1,6 +1,5 @@
 import type { Binary, BSONSerializeOptions } from '../../bson';
 import * as BSON from '../../bson';
-import { aws4 } from '../../deps';
 import {
   MongoCompatibilityError,
   MongoMissingCredentialsError,
@@ -13,6 +12,7 @@ import {
   AWSSDKCredentialProvider,
   type AWSTempCredentials
 } from './aws_temporary_credentials';
+import { aws4Sign } from './aws4';
 import { MongoCredentials } from './mongo_credentials';
 import { AuthMechanism } from './providers';
 
@@ -45,11 +45,6 @@ export class MongoDBAWS extends AuthProvider {
       throw new MongoMissingCredentialsError('AuthContext must provide credentials.');
     }
 
-    if ('kModuleError' in aws4) {
-      throw aws4['kModuleError'];
-    }
-    const { sign } = aws4;
-
     if (maxWireVersion(connection) < 9) {
       throw new MongoCompatibilityError(
         'MONGODB-AWS authentication requires MongoDB version 4.4 or later'
@@ -68,13 +63,10 @@ export class MongoDBAWS extends AuthProvider {
     // Allow the user to specify an AWS session token for authentication with temporary credentials.
     const sessionToken = credentials.mechanismProperties.AWS_SESSION_TOKEN;
 
-    // If all three defined, include sessionToken, else include username and pass, else no credentials
-    const awsCredentials =
-      accessKeyId && secretAccessKey && sessionToken
-        ? { accessKeyId, secretAccessKey, sessionToken }
-        : accessKeyId && secretAccessKey
-          ? { accessKeyId, secretAccessKey }
-          : undefined;
+    // If all three defined, include sessionToken, else only include username and pass
+    const awsCredentials = sessionToken
+      ? { accessKeyId, secretAccessKey, sessionToken }
+      : { accessKeyId, secretAccessKey };
 
     const db = credentials.source;
     const nonce = await randomBytes(32);
@@ -114,7 +106,7 @@ export class MongoDBAWS extends AuthProvider {
     }
 
     const body = 'Action=GetCallerIdentity&Version=2011-06-15';
-    const options = sign(
+    const headers = await aws4Sign(
       {
         method: 'POST',
         host,
@@ -127,14 +119,15 @@ export class MongoDBAWS extends AuthProvider {
           'X-MongoDB-GS2-CB-Flag': 'n'
         },
         path: '/',
-        body
+        body,
+        date: new Date()
       },
       awsCredentials
     );
 
     const payload: AWSSaslContinuePayload = {
-      a: options.headers.Authorization,
-      d: options.headers['X-Amz-Date']
+      a: headers.Authorization,
+      d: headers['X-Amz-Date']
     };
 
     if (sessionToken) {

package/src/cmap/auth/mongodb_oidc/k8s_machine_workflow.ts

@@ -1,4 +1,5 @@
 import { readFile } from 'fs/promises';
+import * as process from 'process';
 
 import type { OIDCCallbackFunction, OIDCResponse } from '../mongodb_oidc';
 

package/src/cmap/auth/mongodb_oidc/token_machine_workflow.ts

@@ -1,4 +1,5 @@
 import * as fs from 'fs';
+import * as process from 'process';
 
 import { MongoAWSError } from '../../../error';
 import type { OIDCCallbackFunction, OIDCResponse } from '../mongodb_oidc';

package/src/cmap/connect.ts

@@ -35,6 +35,11 @@ import {
 /** @public */
 export type Stream = Socket | TLSSocket;
 
+function applyBackpressureLabels(error: MongoError) {
+  error.addErrorLabel(MongoErrorLabel.SystemOverloadedError);
+  error.addErrorLabel(MongoErrorLabel.RetryableError);
+}
+
 export async function connect(options: ConnectionOptions): Promise<Connection> {
   let connection: Connection | null = null;
   try {
@@ -103,6 +108,8 @@ export async function performInitialHandshake(
   const authContext = new AuthContext(conn, credentials, options);
   conn.authContext = authContext;
 
+  // If we encounter an error preparing the handshake document, do NOT apply backpressure labels.  Errors
+  // encountered building the handshake document are all client-side, and do not indicate an overloaded server.
   const handshakeDoc = await prepareHandshakeDocument(authContext);
 
   // @ts-expect-error: TODO(NODE-5141): The options need to be filtered properly, Connection options differ from Command options
@@ -163,12 +170,15 @@ export async function performInitialHandshake(
     try {
       await provider.auth(authContext);
     } catch (error) {
+      // NOTE: If we encounter an error authenticating a connection, do NOT apply backpressure labels.
+
       if (error instanceof MongoError) {
         error.addErrorLabel(MongoErrorLabel.HandshakeError);
         if (needsRetryableWriteLabel(error, response.maxWireVersion, conn.description.type)) {
           error.addErrorLabel(MongoErrorLabel.RetryableWriteError);
         }
       }
+
       throw error;
     }
   }
@@ -189,6 +199,11 @@ export async function performInitialHandshake(
       if (error instanceof MongoError) {
         error.addErrorLabel(MongoErrorLabel.HandshakeError);
       }
+      // If we encounter a network error executing the initial handshake, apply backpressure labels.
+      if (error instanceof MongoNetworkError) {
+        applyBackpressureLabels(error);
+      }
+
       throw error;
     }
   }
@@ -424,6 +439,10 @@ export async function makeSocket(options: MakeConnectionOptions): Promise<Stream
     socket = await connectedSocket;
     return socket;
   } catch (error) {
+    // If we encounter an error while establishing a socket, apply the backpressure labels to it.  We cannot
+    // differentiate between DNS, TLS errors and network errors without refactoring our connection establishment to
+    // handle all three steps separately.
+    applyBackpressureLabels(error);
     socket.destroy();
     throw error;
   } finally {

package/src/cmap/connection.ts

@@ -35,6 +35,7 @@ import { type MongoClientAuthProviders } from '../mongo_client_auth_providers';
 import { MongoLoggableComponent, type MongoLogger, SeverityLevel } from '../mongo_logger';
 import { type Abortable, type CancellationToken, TypedEventEmitter } from '../mongo_types';
 import { ReadPreference, type ReadPreferenceLike } from '../read_preference';
+import { type Runtime } from '../runtime_adapters';
 import { ServerType } from '../sdam/common';
 import { applySession, type ClientSession, updateSessionFromResponse } from '../sessions';
 import { type TimeoutContext, TimeoutError } from '../timeout';
@@ -47,8 +48,8 @@ import {
   maxWireVersion,
   type MongoDBNamespace,
   noop,
-  now,
   once,
+  processTimeMS,
   squashError,
   uuidV4
 } from '../utils';
@@ -143,6 +144,8 @@ export interface ConnectionOptions
   metadata: Promise<ClientMetadata>;
   /** @internal */
   mongoLogger?: MongoLogger | undefined;
+  /** @internal */
+  runtime: Runtime;
 }
 
 /** @public */
@@ -241,7 +244,7 @@ export class Connection extends TypedEventEmitter<ConnectionEvents> {
 
     this.description = new StreamDescription(this.address, options);
     this.generation = options.generation;
-    this.lastUseTime = now();
+    this.lastUseTime = processTimeMS();
 
     this.messageStream = this.socket
       .on('error', this.onSocketError.bind(this))
@@ -299,7 +302,7 @@ export class Connection extends TypedEventEmitter<ConnectionEvents> {
   }
 
   public markAvailable(): void {
-    this.lastUseTime = now();
+    this.lastUseTime = processTimeMS();
   }
 
   private onSocketError(cause: Error) {
@@ -510,7 +513,7 @@ export class Connection extends TypedEventEmitter<ConnectionEvents> {
     const message = this.prepareCommand(ns.db, command, options);
     let started = 0;
     if (this.shouldEmitAndLogCommand) {
-      started = now();
+      started = processTimeMS();
       this.emitAndLogCommand(
         this.monitorCommands,
         Connection.COMMAND_STARTED,