Merge tag '1.20.0' into debian/unstable

rcsanchez97 · rcsanchez97 · commit 5bc03a40794e · 2026-06-30T14:52:35.000-04:00
1.20.0 release
diff --git a/.evergreen/config.yml b/.evergreen/config.yml
@@ -1192,19 +1192,32 @@ tasks:
           mkdir libmongocrypt_upload/include
           mv $srcdir/include/mongocrypt libmongocrypt_upload/include
 
-          # Move library
+          # Move library files
           if [ -f "$srcdir/lib64/libmongocrypt.so" ]; then
             mkdir libmongocrypt_upload/lib64
             mv $srcdir/lib64/libmongocrypt.so libmongocrypt_upload/lib64
+            mv $srcdir/lib64/libmongocrypt-static.a libmongocrypt_upload/lib64
+            mv $srcdir/lib64/libbson-static-for-libmongocrypt.a libmongocrypt_upload/lib64
+            mv $srcdir/lib64/libkms_message-static.a libmongocrypt_upload/lib64
           elif [ -f "$srcdir/lib/libmongocrypt.so" ]; then
             mkdir libmongocrypt_upload/lib
             mv $srcdir/lib/libmongocrypt.so libmongocrypt_upload/lib
+            mv $srcdir/lib/libmongocrypt-static.a libmongocrypt_upload/lib
+            mv $srcdir/lib/libbson-static-for-libmongocrypt.a libmongocrypt_upload/lib
+            mv $srcdir/lib/libkms_message-static.a libmongocrypt_upload/lib
           elif [ -f "$srcdir/lib/libmongocrypt.dylib" ]; then
             mkdir libmongocrypt_upload/lib
             mv $srcdir/lib/libmongocrypt.dylib libmongocrypt_upload/lib
+            mv $srcdir/lib/libmongocrypt-static.a libmongocrypt_upload/lib
+            mv $srcdir/lib/libbson-static-for-libmongocrypt.a libmongocrypt_upload/lib
+            mv $srcdir/lib/libkms_message-static.a libmongocrypt_upload/lib
           elif [ -f "$srcdir/bin/mongocrypt.dll" ]; then
             mkdir libmongocrypt_upload/bin
+            mkdir libmongocrypt_upload/lib
             mv $srcdir/bin/mongocrypt.dll libmongocrypt_upload/bin
+            mv $srcdir/lib/mongocrypt-static.lib libmongocrypt_upload/lib
+            mv $srcdir/lib/bson-static-for-libmongocrypt.lib libmongocrypt_upload/lib
+            mv $srcdir/lib/kms_message-static.lib libmongocrypt_upload/lib
           fi
     - command: archive.targz_pack
       params:
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,10 +1,21 @@
 # ChangeLog
 
+## 1.20.0
+
+### Added
+- Stable support for substring queries.
+
+## 1.19.2
+
+### Added
+- Add static library files to GitHub releases.
+
 ## 1.19.1
 
 ### Added
 - Restore support for the experimental `prefixPreview` and `suffixPreview` query types.
 
+
 ## 1.19.0
 
 ### Added
@@ -16,6 +27,13 @@
 ### Removed
 - Support for the experimental `prefixPreview` and `suffixPreview` query types.
 
+
+## 1.18.2
+
+### Fixed
+- Add musl arm64 release to GitHub release. This was an omission in 1.18.0.
+- Reject large KMS replies.
+
 ## 1.18.1
 
 ### Fixed
diff --git a/README.md b/README.md
@@ -78,6 +78,9 @@ A Windows DLL for x86_64 is available on the Github Releases page. See the [late
 
 Use `gpg` to verify the signature. The public key for `libmongocrypt` is available on https://pgp.mongodb.com/.
 
+## Python Releases ##
+Python releases and tags are signed using the MongoDB Python driver PGP key. Use `gpg` to verify the signature. The public key is available at https://pgp.mongodb.com/python-driver.pub.
+
 
 ### Testing ###
 `test-mongocrypt` mocks all I/O with files stored in the `test/data` and `test/example` directories. Run `test-mongocrypt` from the source directory:
diff --git a/kms-message/src/kms_kmip_response_parser.c b/kms-message/src/kms_kmip_response_parser.c
@@ -111,6 +111,10 @@ kms_kmip_response_parser_feed (kms_kmip_response_parser_t *parser,
       uint32_t temp;
       memcpy (&temp, parser->buf->str + FIRST_LENGTH_OFFSET, sizeof (uint32_t));
       parser->first_len = KMS_UINT32_FROM_BE (temp);
+      if (parser->first_len > KMS_PARSER_MAX_RESPONSE_LEN) {
+         KMS_ERROR (parser, "KMS KMIP response too large");
+         return false;
+      }
    }
    return true;
 }
diff --git a/src/mc-efc-private.h b/src/mc-efc-private.h
@@ -28,13 +28,15 @@ typedef enum _supported_query_type_flags {
     SUPPORTS_RANGE_QUERIES = 1 << 1,
     // Range preview query supported
     SUPPORTS_RANGE_PREVIEW_DEPRECATED_QUERIES = 1 << 2,
-    // Text search preview query supported
-    SUPPORTS_SUBSTRING_PREVIEW_QUERIES = 1 << 3,
+    // Text search query supported
+    SUPPORTS_SUBSTRING_QUERIES = 1 << 3,
     SUPPORTS_SUFFIX_QUERIES = 1 << 4,
     SUPPORTS_PREFIX_QUERIES = 1 << 5,
     // suffixPreview and prefixPreview are deprecated aliases for suffix and prefix, respectively.
     SUPPORTS_SUFFIX_PREVIEW_DEPRECATED_QUERIES = 1 << 6,
     SUPPORTS_PREFIX_PREVIEW_DEPRECATED_QUERIES = 1 << 7,
+    // substring preview query supported
+    SUPPORTS_SUBSTRING_PREVIEW_DEPRECATED_QUERIES = 1 << 8,
 } supported_query_type_flags;
 
 typedef struct _mc_EncryptedField_t {
diff --git a/src/mc-efc.c b/src/mc-efc.c
@@ -33,8 +33,9 @@ static bool _parse_query_type_string(const char *queryType, supported_query_type
         *out = SUPPORTS_RANGE_QUERIES;
     } else if (mstr_eq_ignore_case(mstrv_lit(MONGOCRYPT_QUERY_TYPE_RANGEPREVIEW_DEPRECATED_STR), qtv)) {
         *out = SUPPORTS_RANGE_PREVIEW_DEPRECATED_QUERIES;
-    } else if (mstr_eq_ignore_case(mstrv_lit(MONGOCRYPT_QUERY_TYPE_SUBSTRINGPREVIEW_STR), qtv)) {
-        *out = SUPPORTS_SUBSTRING_PREVIEW_QUERIES;
+    } else if (mstr_eq_ignore_case(mstrv_lit(MONGOCRYPT_QUERY_TYPE_SUBSTRINGPREVIEW_DEPRECATED_STR), qtv)
+               || mstr_eq_ignore_case(mstrv_lit(MONGOCRYPT_QUERY_TYPE_SUBSTRING_STR), qtv)) {
+        *out = SUPPORTS_SUBSTRING_QUERIES;
     } else if (mstr_eq_ignore_case(mstrv_lit(MONGOCRYPT_QUERY_TYPE_SUFFIX_STR), qtv)) {
         *out = SUPPORTS_SUFFIX_QUERIES;
     } else if (mstr_eq_ignore_case(mstrv_lit(MONGOCRYPT_QUERY_TYPE_PREFIX_STR), qtv)) {
@@ -244,8 +245,9 @@ bool mc_EncryptedFieldConfig_parse(mc_EncryptedFieldConfig_t *efc,
 
     if (!bson_iter_init_find(&iter, efc_bson, "strEncodeVersion")) {
         if (all_supported_queries
-            & (SUPPORTS_SUBSTRING_PREVIEW_QUERIES | SUPPORTS_SUFFIX_QUERIES | SUPPORTS_PREFIX_QUERIES
-               | SUPPORTS_SUFFIX_PREVIEW_DEPRECATED_QUERIES | SUPPORTS_PREFIX_PREVIEW_DEPRECATED_QUERIES)) {
+            & (SUPPORTS_SUBSTRING_QUERIES | SUPPORTS_SUBSTRING_PREVIEW_DEPRECATED_QUERIES | SUPPORTS_SUFFIX_QUERIES
+               | SUPPORTS_PREFIX_QUERIES | SUPPORTS_SUFFIX_PREVIEW_DEPRECATED_QUERIES
+               | SUPPORTS_PREFIX_PREVIEW_DEPRECATED_QUERIES)) {
             // Has at least one text search query type, set to latest by default.
             efc->str_encode_version = LATEST_STR_ENCODE_VERSION;
         } else {
diff --git a/src/mc-textopts.c b/src/mc-textopts.c
@@ -378,7 +378,8 @@ bool mc_TextOpts_to_FLE2TextSearchInsertSpec_for_query(const mc_TextOpts_t *txo,
         include_suffix = true;
         break;
     }
-    case MONGOCRYPT_QUERY_TYPE_SUBSTRINGPREVIEW: {
+    case MONGOCRYPT_QUERY_TYPE_SUBSTRING:
+    case MONGOCRYPT_QUERY_TYPE_SUBSTRINGPREVIEW_DEPRECATED: {
         include_substring = true;
         break;
     }
diff --git a/src/mongocrypt-ctx-encrypt.c b/src/mongocrypt-ctx-encrypt.c
@@ -890,9 +890,9 @@ static moe_result must_omit_encryptionInformation(const char *command_name,
         bool has_fields_requiring_ei = false;
         for (const mc_EncryptedField_t *ef = efc->fields; ef != NULL; ef = ef->next) {
             if (ef->supported_queries
-                & (SUPPORTS_RANGE_QUERIES | SUPPORTS_SUBSTRING_PREVIEW_QUERIES | SUPPORTS_SUFFIX_QUERIES
-                   | SUPPORTS_PREFIX_QUERIES | SUPPORTS_SUFFIX_PREVIEW_DEPRECATED_QUERIES
-                   | SUPPORTS_PREFIX_PREVIEW_DEPRECATED_QUERIES)) {
+                & (SUPPORTS_RANGE_QUERIES | SUPPORTS_SUBSTRING_QUERIES | SUPPORTS_SUFFIX_QUERIES
+                   | SUPPORTS_PREFIX_QUERIES | SUPPORTS_SUBSTRING_PREVIEW_DEPRECATED_QUERIES
+                   | SUPPORTS_SUFFIX_PREVIEW_DEPRECATED_QUERIES | SUPPORTS_PREFIX_PREVIEW_DEPRECATED_QUERIES)) {
                 has_fields_requiring_ei = true;
                 break;
             }
@@ -1012,8 +1012,8 @@ static bool _fle2_append_compactionTokens(mongocrypt_t *crypt,
         const _mongocrypt_buffer_t *ecoct_buf = mc_ECOCToken_get(ecoct);
 
         if (ptr->supported_queries
-            & (SUPPORTS_RANGE_QUERIES | SUPPORTS_SUBSTRING_PREVIEW_QUERIES | SUPPORTS_SUFFIX_QUERIES
-               | SUPPORTS_PREFIX_QUERIES | SUPPORTS_SUFFIX_PREVIEW_DEPRECATED_QUERIES
+            & (SUPPORTS_RANGE_QUERIES | SUPPORTS_SUBSTRING_QUERIES | SUPPORTS_SUFFIX_QUERIES | SUPPORTS_PREFIX_QUERIES
+               | SUPPORTS_SUBSTRING_PREVIEW_DEPRECATED_QUERIES | SUPPORTS_SUFFIX_PREVIEW_DEPRECATED_QUERIES
                | SUPPORTS_PREFIX_PREVIEW_DEPRECATED_QUERIES)) {
             // Append the document {ecoc: <ECOCToken>, anchorPaddingToken: <AnchorPaddingTokenRoot>}
             esct = mc_ESCToken_new(crypto, cl1t, status);
@@ -1524,9 +1524,10 @@ static bool _fle2_finalize_explicit(mongocrypt_ctx_t *ctx, mongocrypt_binary_t *
         // fallthrough
         case MONGOCRYPT_QUERY_TYPE_SUFFIX:
         case MONGOCRYPT_QUERY_TYPE_PREFIX:
+        case MONGOCRYPT_QUERY_TYPE_SUBSTRING:
         case MONGOCRYPT_QUERY_TYPE_SUFFIXPREVIEW_DEPRECATED:
         case MONGOCRYPT_QUERY_TYPE_PREFIXPREVIEW_DEPRECATED:
-        case MONGOCRYPT_QUERY_TYPE_SUBSTRINGPREVIEW:
+        case MONGOCRYPT_QUERY_TYPE_SUBSTRINGPREVIEW_DEPRECATED:
         case MONGOCRYPT_QUERY_TYPE_RANGE:
         case MONGOCRYPT_QUERY_TYPE_EQUALITY: marking.u.fle2.type = MONGOCRYPT_FLE2_PLACEHOLDER_TYPE_FIND; break;
         default: _mongocrypt_ctx_fail_w_msg(ctx, "Invalid value for EncryptOpts.queryType"); goto fail;
@@ -2101,9 +2102,9 @@ static bool explicit_encrypt_init(mongocrypt_ctx_t *ctx, mongocrypt_binary_t *ms
                 return _mongocrypt_ctx_fail_w_msg(ctx, "suffix query type requires string index type");
             }
         }
-        if (qt == MONGOCRYPT_QUERY_TYPE_SUBSTRINGPREVIEW) {
+        if (qt == MONGOCRYPT_QUERY_TYPE_SUBSTRING || qt == MONGOCRYPT_QUERY_TYPE_SUBSTRINGPREVIEW_DEPRECATED) {
             if (!(ctx->opts.index_type.set && ctx->opts.index_type.value == MONGOCRYPT_INDEX_TYPE_STRING)) {
-                return _mongocrypt_ctx_fail_w_msg(ctx, "substringPreview query type requires string index type");
+                return _mongocrypt_ctx_fail_w_msg(ctx, "substring query type requires string index type");
             }
         }
     }
@@ -2186,9 +2187,10 @@ static bool explicit_encrypt_init(mongocrypt_ctx_t *ctx, mongocrypt_binary_t *ms
         // fallthrough
         case MONGOCRYPT_QUERY_TYPE_PREFIX:
         case MONGOCRYPT_QUERY_TYPE_SUFFIX:
+        case MONGOCRYPT_QUERY_TYPE_SUBSTRING:
         case MONGOCRYPT_QUERY_TYPE_PREFIXPREVIEW_DEPRECATED:
         case MONGOCRYPT_QUERY_TYPE_SUFFIXPREVIEW_DEPRECATED:
-        case MONGOCRYPT_QUERY_TYPE_SUBSTRINGPREVIEW:
+        case MONGOCRYPT_QUERY_TYPE_SUBSTRINGPREVIEW_DEPRECATED:
             matches = (ctx->opts.index_type.value == MONGOCRYPT_INDEX_TYPE_STRING);
             break;
         default:
diff --git a/src/mongocrypt-ctx-private.h b/src/mongocrypt-ctx-private.h
@@ -46,11 +46,12 @@ typedef enum _mongocrypt_query_type_t {
     MONGOCRYPT_QUERY_TYPE_RANGEPREVIEW_DEPRECATED = 3,
     MONGOCRYPT_QUERY_TYPE_PREFIX = 4,
     MONGOCRYPT_QUERY_TYPE_SUFFIX = 5,
-    MONGOCRYPT_QUERY_TYPE_SUBSTRINGPREVIEW = 6,
+    MONGOCRYPT_QUERY_TYPE_SUBSTRING = 6,
     // prefixPreview and suffixPreview are deprecated aliases for prefix and suffix, respectively. They behave
     // identically; the distinct values exist for consistency (cf. rangePreview) and to ease eventual removal.
     MONGOCRYPT_QUERY_TYPE_PREFIXPREVIEW_DEPRECATED = 7,
     MONGOCRYPT_QUERY_TYPE_SUFFIXPREVIEW_DEPRECATED = 8,
+    MONGOCRYPT_QUERY_TYPE_SUBSTRINGPREVIEW_DEPRECATED = 9,
 } mongocrypt_query_type_t;
 
 const char *_mongocrypt_query_type_to_string(mongocrypt_query_type_t val);
diff --git a/src/mongocrypt-ctx.c b/src/mongocrypt-ctx.c
@@ -248,6 +248,9 @@ bool mongocrypt_ctx_setopt_algorithm(mongocrypt_ctx_t *ctx, const char *algorith
     } else if (mstr_eq_ignore_case(algo_str, mstrv_lit(MONGOCRYPT_ALGORITHM_STRING_STR))) {
         ctx->opts.index_type.value = MONGOCRYPT_INDEX_TYPE_STRING;
         ctx->opts.index_type.set = true;
+    } else if (mstr_eq_ignore_case(algo_str, mstrv_lit(MONGOCRYPT_ALGORITHM_TEXTPREVIEW_DEPRECATED_STR))) {
+        _mongocrypt_ctx_fail_w_msg(ctx, "Algorithm 'textPreview' is deprecated, please use 'string'");
+        return false;
     } else {
         char *error = bson_strdup_printf("unsupported algorithm string \"%.*s\"",
                                          algo_str.len <= (size_t)INT_MAX ? (int)algo_str.len : INT_MAX,
@@ -1027,6 +1030,9 @@ bool mongocrypt_ctx_setopt_query_type(mongocrypt_ctx_t *ctx, const char *query_t
     } else if (mstr_eq_ignore_case(qt_str, mstrv_lit(MONGOCRYPT_QUERY_TYPE_SUFFIX_STR))) {
         ctx->opts.query_type.value = MONGOCRYPT_QUERY_TYPE_SUFFIX;
         ctx->opts.query_type.set = true;
+    } else if (mstr_eq_ignore_case(qt_str, mstrv_lit(MONGOCRYPT_QUERY_TYPE_SUBSTRING_STR))) {
+        ctx->opts.query_type.value = MONGOCRYPT_QUERY_TYPE_SUBSTRING;
+        ctx->opts.query_type.set = true;
     } else if (mstr_eq_ignore_case(qt_str, mstrv_lit(MONGOCRYPT_QUERY_TYPE_PREFIXPREVIEW_DEPRECATED_STR))) {
         // 'prefixPreview' is a deprecated alias for 'prefix'.
         ctx->opts.query_type.value = MONGOCRYPT_QUERY_TYPE_PREFIXPREVIEW_DEPRECATED;
@@ -1035,8 +1041,10 @@ bool mongocrypt_ctx_setopt_query_type(mongocrypt_ctx_t *ctx, const char *query_t
         // 'suffixPreview' is a deprecated alias for 'suffix'.
         ctx->opts.query_type.value = MONGOCRYPT_QUERY_TYPE_SUFFIXPREVIEW_DEPRECATED;
         ctx->opts.query_type.set = true;
-    } else if (mstr_eq_ignore_case(qt_str, mstrv_lit(MONGOCRYPT_QUERY_TYPE_SUBSTRINGPREVIEW_STR))) {
-        ctx->opts.query_type.value = MONGOCRYPT_QUERY_TYPE_SUBSTRINGPREVIEW;
+    } else if (mstr_eq_ignore_case(qt_str, mstrv_lit(MONGOCRYPT_QUERY_TYPE_SUBSTRINGPREVIEW_DEPRECATED_STR))) {
+        // TODO: MONGOCRYPT-938 disallow substringPreview
+        // _mongocrypt_ctx_fail_w_msg(ctx, "Query type 'substringPreview' is deprecated, please use 'substring'");
+        ctx->opts.query_type.value = MONGOCRYPT_QUERY_TYPE_SUBSTRINGPREVIEW_DEPRECATED;
         ctx->opts.query_type.set = true;
     } else {
         /* don't check if qt_str.len fits in int; we want the diagnostic output */
@@ -1068,9 +1076,10 @@ const char *_mongocrypt_query_type_to_string(mongocrypt_query_type_t val) {
     case MONGOCRYPT_QUERY_TYPE_RANGE: return "Range";
     case MONGOCRYPT_QUERY_TYPE_PREFIX: return "Prefix";
     case MONGOCRYPT_QUERY_TYPE_SUFFIX: return "Suffix";
+    case MONGOCRYPT_QUERY_TYPE_SUBSTRING: return "Substring";
     case MONGOCRYPT_QUERY_TYPE_PREFIXPREVIEW_DEPRECATED: return "PrefixPreview";
     case MONGOCRYPT_QUERY_TYPE_SUFFIXPREVIEW_DEPRECATED: return "SuffixPreview";
-    case MONGOCRYPT_QUERY_TYPE_SUBSTRINGPREVIEW: return "SubstringPreview";
+    case MONGOCRYPT_QUERY_TYPE_SUBSTRINGPREVIEW_DEPRECATED: return "SubstringPreview";
     default: return "Unknown";
     }
 }
diff --git a/src/mongocrypt.h b/src/mongocrypt.h
@@ -1559,7 +1559,6 @@ bool mongocrypt_ctx_setopt_algorithm_range(mongocrypt_ctx_t *ctx, mongocrypt_bin
 /**
  * Set options for explicit encryption with the "string" algorithm.
  *
- * NOTE: Use of the "substringPreview" query type is experimental only and may be removed in a future non-major release.
  * @p opts is a BSON document of the form:
  * {
  *   "caseSensitive": bool,
@@ -1601,8 +1600,9 @@ bool mongocrypt_setopt_key_expiration(mongocrypt_t *crypt, uint64_t cache_expira
 // DEPRECATED: Support "rangePreview" has been removed in favor of "range".
 #define MONGOCRYPT_QUERY_TYPE_RANGEPREVIEW_DEPRECATED_STR "rangePreview"
 #define MONGOCRYPT_QUERY_TYPE_RANGE_STR "range"
-/// NOTE: "substringPreview" is experimental and may be removed in a future non-major release.
-#define MONGOCRYPT_QUERY_TYPE_SUBSTRINGPREVIEW_STR "substringPreview"
+/// DEPRECATED: Support for "substringPreview" has been removed in favor of "substring"
+#define MONGOCRYPT_QUERY_TYPE_SUBSTRINGPREVIEW_DEPRECATED_STR "substringPreview"
+#define MONGOCRYPT_QUERY_TYPE_SUBSTRING_STR "substring"
 /// DEPRECATED: Support for "suffixPreview" has been removed in favor of "suffix"
 #define MONGOCRYPT_QUERY_TYPE_SUFFIXPREVIEW_DEPRECATED_STR "suffixPreview"
 #define MONGOCRYPT_QUERY_TYPE_SUFFIX_STR "suffix"
diff --git a/test/data/efc/efc-textSearchFields.json b/test/data/efc/efc-textSearchFields.json
@@ -66,6 +66,22 @@
                     }
                 }
             ]
-        }
+        },
+        {
+            "keyId": {
+                "$binary": {
+                    "base64": "q83vqxI0mHYSNBI0VniQEg==",
+                    "subType": "04"
+                }
+            },
+            "path": "preferredName",
+            "bsonType": "string",
+            "queries": {
+                "queryType": "substring",
+                "contention": {
+                    "$numberLong": "0"
+                }
+            }
+         }
     ]
-}
+}
diff --git a/test/test-mc-efc.c b/test/test-mc-efc.c
@@ -31,10 +31,12 @@ static void _test_efc(_mongocrypt_tester_t *tester) {
     _mongocrypt_buffer_t expect_keyId1;
     _mongocrypt_buffer_t expect_keyId2;
     _mongocrypt_buffer_t expect_keyId3;
+    _mongocrypt_buffer_t expect_keyId4;
 
     _mongocrypt_buffer_copy_from_hex(&expect_keyId1, "12345678123498761234123456789012");
     _mongocrypt_buffer_copy_from_hex(&expect_keyId2, "abcdefab123498761234123456789012");
     _mongocrypt_buffer_copy_from_hex(&expect_keyId3, "12345678123498761234123456abcdef");
+    _mongocrypt_buffer_copy_from_hex(&expect_keyId4, "abcdefab123498761234123456789012");
 
     {
         _load_test_file(tester, "./test/data/efc/efc-oneField.json", &efc_bson);
@@ -112,6 +114,11 @@ static void _test_efc(_mongocrypt_tester_t *tester) {
         ASSERT_CMPUINT8(efc.str_encode_version, ==, LATEST_STR_ENCODE_VERSION);
         ptr = efc.fields;
         ASSERT(ptr);
+        ASSERT_STREQUAL(ptr->path, "preferredName");
+        ASSERT_CMPBUF(expect_keyId4, ptr->keyId);
+        ASSERT(ptr->supported_queries == SUPPORTS_SUBSTRING_QUERIES);
+        ASSERT(ptr->next != NULL);
+        ptr = ptr->next;
         ASSERT_STREQUAL(ptr->path, "middleName");
         ASSERT_CMPBUF(expect_keyId3, ptr->keyId);
         ASSERT(ptr->supported_queries == (SUPPORTS_SUFFIX_QUERIES | SUPPORTS_PREFIX_QUERIES));
@@ -124,7 +131,7 @@ static void _test_efc(_mongocrypt_tester_t *tester) {
         ptr = ptr->next;
         ASSERT_STREQUAL(ptr->path, "firstName");
         ASSERT_CMPBUF(expect_keyId1, ptr->keyId);
-        ASSERT(ptr->supported_queries == SUPPORTS_SUBSTRING_PREVIEW_QUERIES);
+        ASSERT(ptr->supported_queries == SUPPORTS_SUBSTRING_QUERIES);
         ASSERT(ptr->next == NULL);
         mc_EncryptedFieldConfig_cleanup(&efc);
     }
@@ -142,7 +149,7 @@ static void _test_efc(_mongocrypt_tester_t *tester) {
         ptr = ptr->next;
         ASSERT_STREQUAL(ptr->path, "firstName");
         ASSERT_CMPBUF(expect_keyId1, ptr->keyId);
-        ASSERT(ptr->supported_queries == SUPPORTS_SUBSTRING_PREVIEW_QUERIES);
+        ASSERT(ptr->supported_queries == SUPPORTS_SUBSTRING_QUERIES);
         ASSERT(ptr->next == NULL);
         mc_EncryptedFieldConfig_cleanup(&efc);
     }
@@ -165,6 +172,7 @@ static void _test_efc(_mongocrypt_tester_t *tester) {
         _mongocrypt_status_reset(status);
     }
 
+    _mongocrypt_buffer_cleanup(&expect_keyId4);
     _mongocrypt_buffer_cleanup(&expect_keyId3);
     _mongocrypt_buffer_cleanup(&expect_keyId2);
     _mongocrypt_buffer_cleanup(&expect_keyId1);
diff --git a/test/test-mc-textopts.c b/test/test-mc-textopts.c
@@ -245,7 +245,7 @@ static void test_mc_TextOpts_to_FLE2TextSearchInsertSpec_for_query(_mongocrypt_t
              "substring" : {"strMaxLength" : 10, "strMinQueryLength" : 3, "strMaxQueryLength" : 8}
          }),
          .v = RAW_STRING({"v" : "test"}),
-         .qt = MONGOCRYPT_QUERY_TYPE_SUBSTRINGPREVIEW,
+         .qt = MONGOCRYPT_QUERY_TYPE_SUBSTRING,
          .expect = RAW_STRING(
              {"v" : {"v" : "test", "casef" : false, "diacf" : true, "substr" : {"mlen" : 10, "ub" : 8, "lb" : 3}}})},
         {.desc = "Works with prefix",
diff --git a/test/test-mongocrypt-ctx-encrypt.c b/test/test-mongocrypt-ctx-encrypt.c
diff --git a/test/test-mongocrypt-ctx-setopt.c b/test/test-mongocrypt-ctx-setopt.c
diff --git a/test/test-mongocrypt-kms-ctx.c b/test/test-mongocrypt-kms-ctx.c

Original file line number	Diff line number	Diff line change
`@@ -111,6 +111,10 @@ kms_kmip_response_parser_feed (kms_kmip_response_parser_t *parser,`
`111`	`111`	`uint32_t temp;`
`112`	`112`	`memcpy (&temp, parser->buf->str + FIRST_LENGTH_OFFSET, sizeof (uint32_t));`
`113`	`113`	`parser->first_len = KMS_UINT32_FROM_BE (temp);`
	`114`	`+ if (parser->first_len > KMS_PARSER_MAX_RESPONSE_LEN) {`
	`115`	`+ KMS_ERROR (parser, "KMS KMIP response too large");`
	`116`	`+ return false;`
	`117`	`+ }`
`114`	`118`	`}`
`115`	`119`	`return true;`
`116`	`120`	`}`
Original file line number	Diff line number	Diff line change
`@@ -378,7 +378,8 @@ bool mc_TextOpts_to_FLE2TextSearchInsertSpec_for_query(const mc_TextOpts_t *txo,`
`378`	`378`	`include_suffix = true;`
`379`	`379`	`break;`
`380`	`380`	`}`
`381`		`- case MONGOCRYPT_QUERY_TYPE_SUBSTRINGPREVIEW: {`
	`381`	`+ case MONGOCRYPT_QUERY_TYPE_SUBSTRING:`
	`382`	`+ case MONGOCRYPT_QUERY_TYPE_SUBSTRINGPREVIEW_DEPRECATED: {`
`382`	`383`	`include_substring = true;`
`383`	`384`	`break;`
`384`	`385`	`}`