Merge branch 'main' into dependabot/npm_and_yarn/sinon-21.0.0

Author: durran

.eslintrc.json

@@ -13,7 +13,7 @@
     "es6": true
   },
   "parserOptions": {
-    "ecmaVersion": 2019
+    "ecmaVersion": 2023
   },
   "plugins": [
     "@typescript-eslint",
@@ -38,6 +38,15 @@
     "prettier/prettier": "error",
     "no-console": "error",
     "valid-typeof": "error",
+    "@typescript-eslint/no-unused-vars": [
+      "error",
+      {
+        "argsIgnorePattern": "^_",
+        "caughtErrorsIgnorePattern": "^_",
+        "destructuredArrayIgnorePattern": "^_",
+        "varsIgnorePattern": "^_"
+      }
+    ],
     "eqeqeq": [
       "error",
       "always",
@@ -82,4 +91,4 @@
       }
     }
   ]
-}
+}

.github/dependabot.yml

@@ -20,9 +20,6 @@ updates:
       # sinon-chai 4.x+ supports chai 5.x+.
       - dependency-name: "sinon-chai"
         versions: [">=4.0.0"]
-      # nyc is Node18+ only starting on nyc@16.x.
-      - dependency-name: "nyc"
-        versions: [">=16.0.0"]
       # we ignore TS as a part of quarterly dependency updates.
       - dependency-name: "typescript"
       # node-gyp now depends on python 3.10, we install 3.6 in our dockerfile

.github/docker/Dockerfile.glibc

@@ -1,7 +1,6 @@
-ARG UBUNTU_VERSION=bionic
-FROM ubuntu:${UBUNTU_VERSION} AS build
+FROM redhat/ubi8 AS build
 
-ARG NODE_VERSION=16.20.1
+ARG NODE_VERSION=20.19.0
 # Possible values: s390x, arm64, x64
 ARG NODE_ARCH
 ADD https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-${NODE_ARCH}.tar.gz /
@@ -11,7 +10,7 @@ ENV PATH=$PATH:/nodejs/bin
 WORKDIR /mongodb-client-encryption
 COPY . .
 
-RUN apt-get -qq update && apt-get -qq install -y python3 build-essential git && ldd --version
+RUN yum install -y python39 git make gcc-c++
 
 RUN npm run install:libmongocrypt
 

.github/docker/Dockerfile.musl

@@ -1,5 +1,5 @@
 ARG PLATFORM=arm64
-ARG NODE_VERSION=16.20.1
+ARG NODE_VERSION=20.19.0
 
 FROM ${PLATFORM}/node:${NODE_VERSION}-alpine AS build
 

.github/pull_request_template.md

@@ -1,32 +1,44 @@
 ### Description
 
-#### What is changing?
+#### Summary of Changes
 
-##### Is there new documentation needed for these changes?
+<!-- Please describe the changes in this PR in a high-level overview. -->
 
-#### What is the motivation for this change?
+##### Notes for Reviewers
+
+<!-- 
+If there is any additional context on the changes in the PR that reviewers might find helpful, feel free to make notes in this section.
 
-<!-- If this is a bug, it helps to describe the current behavior and a clear outline of the expected behavior -->
-<!-- If this is a feature, it helps to describe the new use case enabled by this change -->
+Otherwise, feel free to remove this section.
+-->
+
+#### What is the motivation for this change?
 
 <!--
-Contributors!
-First of all, thank you so much!!
-If you haven't already, it would greatly help the team review this work in a timely manner if you create a JIRA ticket to track this PR.
-You can do that here: https://jira.mongodb.org/projects/NODE
+Remove this section if there is an associated Jira ticket explaining the motiviation for this change. If there is not, please fill this section out with 
+information explaining why this change is valuable.
 -->
 
 ### Release Highlight
 
+<!-- 
+Contributors: please leave the release notes section for the Node driver team to fill in. The following instructions are for maintainers.
+
+For user facing changes: please provide release notes. Feel free to browse previous releases for example release highlights.
+
+If there are no user-facing changes in this PR, please delete the release highlight section from the PR description.
+-->
+
 <!-- RELEASE_HIGHLIGHT_START -->
 
-### Fill in title or leave empty for no highlight
+<!-- ### Release notes highlight ->
+<!-- LEAVE EMPTY: we do not write release highlights for mongodb-client-encryption -->
 
 <!-- RELEASE_HIGHLIGHT_END -->
 
 ### Double check the following
 
-- [ ] Ran `npm run check:lint` script
+- [ ] Lint is passing (`npm run check:lint`)
 - [ ] Self-review completed using the [steps outlined here](https://github.com/mongodb/node-mongodb-native/blob/HEAD/CONTRIBUTING.md#reviewer-guidelines)
 - [ ] PR title follows the [correct format](https://www.conventionalcommits.org/en/v1.0.0/): `type(NODE-xxxx)[!]: description`
   - Example: `feat(NODE-1234)!: rewriting everything in coffeescript`

.github/scripts/libmongocrypt.mjs

@@ -2,7 +2,7 @@
 
 import util from 'node:util';
 import process from 'node:process';
-import fs from 'node:fs/promises';
+import fs, { readFile } from 'node:fs/promises';
 import child_process from 'node:child_process';
 import events from 'node:events';
 import path from 'node:path';
@@ -189,9 +189,17 @@ async function buildBindings(args, pkg) {
   await run('npm', ['run', 'prepare']);
 
   if (process.platform === 'darwin' && process.arch === 'arm64') {
+    // @ts-ignore
+    const {
+      binary: {
+        napi_versions: [
+          napiVersion
+        ]
+      }
+    } = JSON.parse(await readFile(resolveRoot('package.json'), 'utf-8'));
     // The "arm64" build is actually a universal binary
-    const armTar = `mongodb-client-encryption-v${pkg.version}-napi-v4-darwin-arm64.tar.gz`;
-    const x64Tar = `mongodb-client-encryption-v${pkg.version}-napi-v4-darwin-x64.tar.gz`;
+    const armTar = `mongodb-client-encryption-v${pkg.version}-napi-v${napiVersion}-darwin-arm64.tar.gz`;
+    const x64Tar = `mongodb-client-encryption-v${pkg.version}-napi-v${napiVersion}-darwin-x64.tar.gz`;
     await fs.copyFile(resolveRoot('prebuilds', armTar), resolveRoot('prebuilds', x64Tar));
   }
 }

.github/workflows/build.yml

@@ -18,7 +18,7 @@ jobs:
         os: [macos-latest, windows-2022]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
       - name: Build ${{ matrix.os }} Prebuild
         run: node .github/scripts/libmongocrypt.mjs ${{ runner.os == 'Windows' && '--build' || '' }}
@@ -42,7 +42,7 @@ jobs:
       matrix:
         linux_arch: [s390x, arm64, amd64]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v3
@@ -77,13 +77,7 @@ jobs:
         linux_arch: [amd64, arm64]
       fail-fast: false
     steps:
-      - uses: actions/checkout@v4
-
-      - name: Get Full Node.js Version
-        id: get_nodejs_version
-        shell: bash
-        run: |
-          echo "version=$(node --print 'process.version.slice(1)')" >> "$GITHUB_OUTPUT"
+      - uses: actions/checkout@v5
 
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v3

.github/workflows/codeql.yml

@@ -34,7 +34,7 @@ jobs:
             sourceDirectory: "./src"
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@v5
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL

.github/workflows/lint.yml

@@ -16,10 +16,10 @@ jobs:
         lint-target: ["c++", "typescript"]
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
 
     - name: Use Node.js LTS
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@v5
       with:
         node-version: 'lts/*'
         cache: 'npm'

.github/workflows/release_6.1.yml

@@ -36,20 +36,20 @@ jobs:
     environment: release
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
       - name: Install Node and dependencies
-        uses: mongodb-labs/drivers-github-tools/node/setup@v2
+        uses: mongodb-labs/drivers-github-tools/node/setup@v3
         with:
           ignore_install_scripts: true
 
       - name: Load version and package info
-        uses: mongodb-labs/drivers-github-tools/node/get_version_info@v2
+        uses: mongodb-labs/drivers-github-tools/node/get_version_info@v3
         with:
           npm_package_name: mongodb-client-encryption
 
       - name: actions/compress_sign_and_upload
-        uses: mongodb-labs/drivers-github-tools/node/sign_node_package@v2
+        uses: mongodb-labs/drivers-github-tools/node/sign_node_package@v3
         with:
           aws_role_arn: ${{ secrets.AWS_ROLE_ARN }}
           aws_region_name: us-east-1
@@ -66,13 +66,13 @@ jobs:
       # only used for mongodb-client-encryption
       - name: Augment SBOM and copy to release assets
         if: ${{ 'mongodb-client-encryption-6.1' != '' }}
-        uses: mongodb-labs/drivers-github-tools/sbom@v2
+        uses: mongodb-labs/drivers-github-tools/sbom@v3
         with:
           silk_asset_group: 'mongodb-client-encryption-6.1'
           sbom_file_name: sbom.json
 
       - name: Generate authorized pub report
-        uses: mongodb-labs/drivers-github-tools/full-report@v2
+        uses: mongodb-labs/drivers-github-tools/full-report@v3
         with:
           release_version: ${{ env.package_version }}
           product_name: mongodb-client-encryption
@@ -82,7 +82,7 @@ jobs:
           token: ${{ github.token }}
           sbom_file_name: sbom.json
 
-      - uses: mongodb-labs/drivers-github-tools/upload-s3-assets@v2
+      - uses: mongodb-labs/drivers-github-tools/upload-s3-assets@v3
         with:
           version: ${{ env.package_version }}
           product_name: mongodb-client-encryption
@@ -93,14 +93,14 @@ jobs:
     environment: release
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
       - name: Install Node and dependencies
-        uses: mongodb-labs/drivers-github-tools/node/setup@v2
+        uses: mongodb-labs/drivers-github-tools/node/setup@v3
         with:
           ignore_install_scripts: true
 
-      - run: npm publish --provenance
+      - run: npm publish --provenance --tag alpha
         if: ${{ needs.release_please.outputs.release_created }}
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}