Merge branch 'main' into feat/NODE-7512_smoke_test_windows

Author: tadjik1

.evergreen/ci_matrix_constants.js

@@ -20,6 +20,7 @@ const UBUNTU_OS = 'ubuntu1804-large';
 const UBUNTU_20_OS = 'ubuntu2004-small';
 const UBUNTU_22_OS = 'ubuntu2204-large';
 const DEBIAN_OS = 'debian11-small';
+const GRAVITON_OS = 'amazon2023-arm64-latest-large-m8g';
 
 module.exports = {
   MONGODB_VERSIONS,
@@ -37,5 +38,6 @@ module.exports = {
   UBUNTU_OS,
   UBUNTU_20_OS,
   UBUNTU_22_OS,
-  DEBIAN_OS
+  DEBIAN_OS,
+  GRAVITON_OS
 };

.evergreen/config.yml

@@ -4120,3 +4120,17 @@ buildvariants:
       NODE_LTS_VERSION: 24
       CLIENT_ENCRYPTION: true
       MONGODB_BUNDLED: true
+  - name: amazon-linux-2023-arm64-graviton4
+    display_name: Graviton4 AL2023 Node24
+    run_on: amazon2023-arm64-latest-large-m8g
+    expansions:
+      NODE_LTS_VERSION: 24
+      CLIENT_ENCRYPTION: true
+      TEST_CSFLE: true
+    tasks:
+      - test-latest-server
+      - test-latest-replica_set
+      - test-latest-sharded_cluster
+      - test-latest-server-v1-api
+      - test-zstd-compression
+      - test-snappy-compression

.evergreen/generate_evergreen_tasks.js

@@ -17,7 +17,8 @@ const {
   MACOS_OS,
   UBUNTU_20_OS,
   DEBIAN_OS,
-  UBUNTU_22_OS
+  UBUNTU_22_OS,
+  GRAVITON_OS
 } = require('./ci_matrix_constants');
 
 // TODO(NODE-7499): unpin npm version once Node 22 ships a bundled npm that can upgrade itself
@@ -875,6 +876,27 @@ BUILD_VARIANTS.push({
   expansions: nodelessExpansions
 });
 
+const gravitonTasks = [
+  'test-latest-server',
+  'test-latest-replica_set',
+  'test-latest-sharded_cluster',
+  'test-latest-server-v1-api',
+  'test-zstd-compression',
+  'test-snappy-compression'
+];
+
+BUILD_VARIANTS.push({
+  name: 'amazon-linux-2023-arm64-graviton4',
+  display_name: `Graviton4 AL2023 Node${LATEST_LTS}`,
+  run_on: GRAVITON_OS,
+  expansions: {
+    NODE_LTS_VERSION: LATEST_LTS,
+    CLIENT_ENCRYPTION: true,
+    TEST_CSFLE: true
+  },
+  tasks: gravitonTasks
+});
+
 // TODO(NODE-4897): Debug socks5 tests on node latest
 for (const variant of BUILD_VARIANTS.filter(
   variant => variant.expansions && ['latest'].includes(variant.expansions.NODE_LTS_VERSION)

.github/workflows/npm-publish.yml

@@ -36,5 +36,9 @@ jobs:
           ref: ${{ inputs.ref }}
       - name: Install Node and dependencies
         uses: mongodb-labs/drivers-github-tools/node/setup@v3
-      - run: npm version "${{ inputs.version }}" --git-tag-version=false --allow-same-version
-      - run: npm publish --provenance --tag="${{ inputs.tag }}"
+      - run: npm version "$VERSION" --git-tag-version=false --allow-same-version
+        env:
+          VERSION: ${{ inputs.version }}
+      - run: npm publish --provenance --tag="$TAG"
+        env:
+          TAG: ${{ inputs.tag }}

.github/workflows/release-6.8.yml

@@ -9,7 +9,8 @@ on:
         type: string
 
 permissions:
-  id-token: write
+  actions: write
+  contents: read
 
 name: release-alpha
 
@@ -18,17 +19,22 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - shell: bash
+        env:
+          ALPHA_VERSION: ${{ inputs.alphaVersion }}
         run: |
           ALPHA_SEMVER_REGEXP="-alpha(\.([0-9]|[1-9][0-9]+))?$"
 
-          if ! [[ "${{ inputs.alphaVersion }}" =~ $ALPHA_SEMVER_REGEXP ]]; then
+          if ! [[ "$ALPHA_VERSION" =~ $ALPHA_SEMVER_REGEXP ]]; then
             echo "Invalid alphaVersion string"
             exit 1
           fi
       - uses: actions/checkout@v5
-      - name: Install Node and dependencies
-        uses: mongodb-labs/drivers-github-tools/node/setup@v3
-      - run: npm version "${{ inputs.alphaVersion }}" --git-tag-version=false
-      - run: npm publish --provenance --tag=alpha
+      - name: Dispatch npm-publish workflow
         env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          GH_TOKEN: ${{ github.token }}
+          ALPHA_VERSION: ${{ inputs.alphaVersion }}
+        run: |
+          node ./.github/scripts/dispatch-and-wait.mjs npm-publish.yml \
+            tag=alpha \
+            version="$ALPHA_VERSION" \
+            ref="${{ github.sha }}"

.github/workflows/release-alpha.yml

@@ -6,7 +6,6 @@ on:
 permissions:
   contents: write
   pull-requests: write
-  id-token: write
 
 name: release-latest
 
@@ -91,15 +90,20 @@ jobs:
 
   publish:
     needs: [release_please, ssdlc, build]
+    permissions:
+      actions: write
+      contents: read
     environment: release
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v5
 
-      - name: Install Node and dependencies
-        uses: mongodb-labs/drivers-github-tools/node/setup@v3
-
-      - run: npm publish --provenance --tag=latest
+      - name: Dispatch npm-publish workflow
         if: ${{ needs.release_please.outputs.release_created }}
         env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          node ./.github/scripts/dispatch-and-wait.mjs npm-publish.yml \
+            tag=latest \
+            version="$(node -p "require('./package.json').version")" \
+            ref="${{ github.sha }}"

.github/workflows/release.yml

@@ -17,15 +17,14 @@ await esbuild.build({
   entryPoints: [path.join(rootDir, 'test/mongodb_all.ts')],
   bundle: true,
   outfile: outputBundleFile,
-  platform: 'node',
+  platform: 'browser',
   format: 'cjs',
-  target: 'node20',
+  target: 'chrome112',
   external: [
     '@aws-sdk/credential-providers',
     '@mongodb-js/saslprep',
     '@mongodb-js/zstd',
     '@napi-rs/snappy*',
-    'bson',
     'gcp-metadata',
     'kerberos',
     'mongodb-client-encryption',

etc/bundle-driver.mjs

@@ -55,6 +55,12 @@ export const readInt32LE = (buffer: Uint8Array, offset: number): number => {
   return NumberUtils.getInt32LE(buffer, offset);
 };
 
+// readUint8, reads a single unsigned byte from buffer at given offset
+export const readUint8 = (buffer: Uint8Array, offset: number): number => {
+  validateBufferInputs(buffer, offset, 1);
+  return buffer[offset];
+};
+
 export const setUint32LE = (destination: Uint8Array, offset: number, value: number): 4 => {
   destination[offset] = value;
   value >>>= 8;

src/bson.ts

@@ -166,11 +166,10 @@ async function continueScramConversation(
   const clientKey = await HMAC(cryptoMethod, saltedPassword, 'Client Key');
   const serverKey = await HMAC(cryptoMethod, saltedPassword, 'Server Key');
   const storedKey = await H(cryptoMethod, clientKey);
-  const authMessage = [
-    clientFirstMessageBare(username, nonce),
-    payload.toString('utf8'),
-    withoutProof
-  ].join(',');
+  const firstMessageBytes = clientFirstMessageBare(username, nonce);
+  const firstMessage = ByteUtils.toUTF8(firstMessageBytes, 0, firstMessageBytes.length, false);
+  const payloadString = ByteUtils.toUTF8(payload.buffer, 0, payload.position, false);
+  const authMessage = [firstMessage, payloadString, withoutProof].join(',');
 
   const clientSignature = await HMAC(cryptoMethod, storedKey, authMessage);
   const clientProof = `p=${xor(clientKey, clientSignature)}`;
@@ -205,7 +204,7 @@ async function continueScramConversation(
 }
 
 function parsePayload(payload: Binary) {
-  const payloadStr = payload.toString('utf8');
+  const payloadStr = ByteUtils.toUTF8(payload.buffer, 0, payload.position, false);
   const dict: Document = {};
   const parts = payloadStr.split(',');
   for (let i = 0; i < parts.length; i++) {