blink1073 · blink1073 · Jul 31, 2026 · Aug 3, 2026 · Aug 3, 2026 · Aug 4, 2026
diff --git a/.evergreen/generated_configs/tasks.yml b/.evergreen/generated_configs/tasks.yml
diff --git a/.evergreen/generated_configs/variants.yml b/.evergreen/generated_configs/variants.yml
@@ -326,6 +326,7 @@ buildvariants:
       - name: .test-non-standard .server-6.0 .sharded_cluster-auth-ssl
       - name: .test-non-standard .server-7.0 .sharded_cluster-auth-ssl
       - name: .test-non-standard .server-8.0 .sharded_cluster-auth-ssl
+      - name: .test-non-standard .server-9.0 .sharded_cluster-auth-ssl
       - name: .test-non-standard .server-rapid .sharded_cluster-auth-ssl
       - name: .test-non-standard .server-latest .sharded_cluster-auth-ssl
     display_name: Load Balancer
@@ -467,7 +468,7 @@ buildvariants:
       - name: .test-standard !.pypy .async .replica_set-noauth-ssl
     display_name: PyOpenSSL macOS
     run_on:
-      - rhel87-small
+      - macos-14
     batchtime: 1440
     expansions:
       SUB_TEST_NAME: pyopenssl
@@ -545,6 +546,15 @@ buildvariants:
     expansions:
       VERSION: "8.0"
     tags: [coverage_tag]
+  - name: mongodb-v9.0
+    tasks:
+      - name: .server-version
+    display_name: "* MongoDB v9.0"
+    run_on:
+      - rhel87-small
+    expansions:
+      VERSION: "9.0"
+    tags: [coverage_tag]
   - name: mongodb-rapid
     tasks:
       - name: .server-version
@@ -582,6 +592,7 @@ buildvariants:
       - name: .test-standard !.replica_set-noauth-ssl .server-6.0
       - name: .test-standard !.replica_set-noauth-ssl .server-7.0
       - name: .test-standard !.replica_set-noauth-ssl .server-8.0
+      - name: .test-standard !.replica_set-noauth-ssl .server-9.0
       - name: .test-standard !.replica_set-noauth-ssl .server-rapid
       - name: .test-standard !.replica_set-noauth-ssl .server-latest
     display_name: Stable API require v1 RHEL8 Auth
@@ -598,6 +609,7 @@ buildvariants:
       - name: .test-standard .server-6.0 .standalone-noauth-nossl
       - name: .test-standard .server-7.0 .standalone-noauth-nossl
       - name: .test-standard .server-8.0 .standalone-noauth-nossl
+      - name: .test-standard .server-9.0 .standalone-noauth-nossl
       - name: .test-standard .server-rapid .standalone-noauth-nossl
       - name: .test-standard .server-latest .standalone-noauth-nossl
     display_name: Stable API accept v2 RHEL8 Auth
@@ -621,6 +633,7 @@ buildvariants:
       - name: .test-standard !.pypy .server-6.0
       - name: .test-standard !.pypy .server-7.0
       - name: .test-standard !.pypy .server-8.0
+      - name: .test-standard !.pypy .server-9.0
       - name: .test-standard !.pypy .server-rapid
       - name: .test-standard !.pypy .server-latest
     display_name: "* Test macOS Arm64"

diff --git a/.evergreen/run-mongodb-aws-ecs-test.sh b/.evergreen/run-mongodb-aws-ecs-test.sh
@@ -19,15 +19,13 @@ fi
 # Now we can safely enable xtrace
 set -o xtrace
 
-# Install a c compiler.
+# Install a C compiler (for the C extensions) and git (needed by uv to
+# resolve the mockupdb git dependency)
 apt-get -qq update  < /dev/null > /dev/null
-apt-get -q install -y build-essential
+apt-get -q install -y build-essential git
 
 export SET_XTRACE_ON=1
 export CI=true
-# This container has no git, so uv must never try to resolve the mockupdb
-# git dependency; UV_NO_LOCK makes uv ignore any lock file entirely.
-export UV_NO_LOCK=1
 cd src
 rm -rf .venv
 rm -f .evergreen/scripts/test-env.sh || true

diff --git a/.evergreen/run-tests.sh b/.evergreen/run-tests.sh
@@ -27,8 +27,6 @@ else
 fi
 
 # Start the test runner.
-# Never create or read a uv.lock; hosts without git can't resolve mockupdb.
-export UV_NO_LOCK=1
 echo "Running tests with UV_PYTHON=${UV_PYTHON:-}..."
 echo "UV_ARGS=${UV_ARGS}"
 uv run ${UV_ARGS} --reinstall-package pymongo .evergreen/scripts/run_tests.py "$@"

diff --git a/.evergreen/scripts/configure-env.sh b/.evergreen/scripts/configure-env.sh
@@ -65,7 +65,6 @@ export CARGO_HOME="$CARGO_HOME"
 export UV_TOOL_DIR="$UV_TOOL_DIR"
 export UV_CACHE_DIR="$UV_CACHE_DIR"
 export UV_TOOL_BIN_DIR="$DRIVERS_TOOLS_BINARIES"
-export UV_NO_LOCK=1
 export PYMONGO_BIN_DIR="$PYMONGO_BIN_DIR"
 export PATH="$PATH_EXT"
 # shellcheck disable=SC2154

diff --git a/.evergreen/scripts/generate_config.py b/.evergreen/scripts/generate_config.py
@@ -251,6 +251,7 @@ def create_pyopenssl_variants():
             create_variant(
                 tasks,
                 display_name,
+                host=host,
                 expansions=expansions,
                 batchtime=batchtime,
             )

diff --git a/.evergreen/scripts/generate_config_utils.py b/.evergreen/scripts/generate_config_utils.py
@@ -21,7 +21,7 @@
 # Globals
 ##############
 
-ALL_VERSIONS = ["4.2", "4.4", "5.0", "6.0", "7.0", "8.0", "rapid", "latest"]
+ALL_VERSIONS = ["4.2", "4.4", "5.0", "6.0", "7.0", "8.0", "9.0", "rapid", "latest"]
 CPYTHONS = ["3.10", "3.11", "3.12", "3.13", "3.14t", "3.14"]
 PYPYS = ["pypy3.11"]
 MIN_SUPPORT_VERSIONS = ["3.9", "pypy3.9", "pypy3.10"]

diff --git a/.evergreen/scripts/kms_tester.py b/.evergreen/scripts/kms_tester.py
@@ -33,9 +33,7 @@ def _setup_azure_vm(base_env: dict[str, str]) -> None:
     env["AZUREKMS_CMD"] = "sudo apt-get install -y python3-dev build-essential"
     run_command(f"{azure_dir}/run-command.sh", env=env)
 
-    env["AZUREKMS_CMD"] = (
-        "CI=true UV_NO_LOCK=1 bash .evergreen/just.sh setup-tests kms azure-remote"
-    )
+    env["AZUREKMS_CMD"] = "CI=true bash .evergreen/just.sh setup-tests kms azure-remote"
     run_command(f"{azure_dir}/run-command.sh", env=env)
     LOGGER.info("Setting up Azure VM... done.")
 
@@ -55,7 +53,7 @@ def _setup_gcp_vm(base_env: dict[str, str]) -> None:
     env["GCPKMS_CMD"] = "sudo apt-get install -y python3-dev build-essential"
     run_command(f"{gcp_dir}/run-command.sh", env=env)
 
-    env["GCPKMS_CMD"] = "CI=true UV_NO_LOCK=1 bash ./.evergreen/just.sh setup-tests kms gcp-remote"
+    env["GCPKMS_CMD"] = "CI=true bash ./.evergreen/just.sh setup-tests kms gcp-remote"
     run_command(f"{gcp_dir}/run-command.sh", env=env)
     LOGGER.info("Setting up GCP VM...")
 
@@ -132,10 +130,10 @@ def test_kms_send_to_remote(sub_test_name: str) -> None:
         key_name = os.environ["KEY_NAME"]
         key_vault_endpoint = os.environ["KEY_VAULT_ENDPOINT"]
         env["AZUREKMS_CMD"] = (
-            f'KEY_NAME="{key_name}" KEY_VAULT_ENDPOINT="{key_vault_endpoint}" CI=true UV_NO_LOCK=1 bash ./.evergreen/just.sh run-tests'
+            f'KEY_NAME="{key_name}" KEY_VAULT_ENDPOINT="{key_vault_endpoint}" CI=true bash ./.evergreen/just.sh run-tests'
         )
     else:
-        env["GCPKMS_CMD"] = "CI=true UV_NO_LOCK=1 ./.evergreen/just.sh run-tests"
+        env["GCPKMS_CMD"] = "CI=true ./.evergreen/just.sh run-tests"
     cmd = f"{DIRS[sub_test_name]}/run-command.sh"
     run_command(cmd, env=env)
 

diff --git a/.evergreen/scripts/setup-tests.sh b/.evergreen/scripts/setup-tests.sh
@@ -21,9 +21,6 @@ if [ -f $SCRIPT_DIR/env.sh ]; then
   source $SCRIPT_DIR/env.sh
 fi
 
-# Never create or read a uv.lock; hosts without git can't resolve mockupdb.
-export UV_NO_LOCK=1
-
 echo "Setting up tests with args \"$*\"..."
 uv run ${USE_ACTIVE_VENV:+--active} "$SCRIPT_DIR/setup_tests.py" "$@"
 echo "Setting up tests with args \"$*\"... done."
diff --git a/.github/actions/set-uv-exclude-newer/action.yml b/.github/actions/set-uv-exclude-newer/action.yml
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
@@ -11,10 +11,11 @@ updates:
       actions:
         patterns:
           - "*"
-  # Python (uv)
+  # Python (uv). Routine version updates are handled by the uv-lock-update
+  # workflow, so a limit of 0 turns off Dependabot version-update PRs here.
+  # Security updates are exempt from this limit and still open normally.
   - package-ecosystem: "uv"
     directory: "/"
     schedule:
       interval: "weekly"
-    cooldown:
-      default-days: 7
+    open-pull-requests-limit: 0
diff --git a/.github/workflows/dist.yml b/.github/workflows/dist.yml
@@ -52,7 +52,7 @@
           persist-credentials: false
           ref: ${{ inputs.ref }}
 
-      - uses: actions/setup-python@v6.3.0
+      - uses: actions/setup-python@v7.0.0
         with:
           cache: 'pip'
           python-version: 3.11
@@ -111,7 +111,7 @@
           persist-credentials: false
           ref: ${{ inputs.ref }}
 
-      - uses: actions/setup-python@v6.3.0
+      - uses: actions/setup-python@v7.0.0
         with:
           # Build sdist on lowest supported Python
           python-version: "3.9"

diff --git a/.github/workflows/release-python.yml b/.github/workflows/release-python.yml
@@ -81,7 +81,7 @@ jobs:
           path: dist/
       - name: Publish package distributions to PyPI
         if: startsWith(env.DRY_RUN, 'false')
-        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # release/v1
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1
 
   post-publish:
     needs: [publish]

diff --git a/.github/workflows/sbom.yml b/.github/workflows/sbom.yml
@@ -34,7 +34,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Python
-        uses: actions/setup-python@v6.3.0
+        uses: actions/setup-python@v7.0.0
         with:
           python-version: "3.10"
 

diff --git a/.github/workflows/test-python.yml b/.github/workflows/test-python.yml
@@ -17,9 +17,6 @@ defaults:
 permissions:
   contents: read
 
-env:
-  UV_NO_LOCK: "1"
-
 jobs:
 
   static:
@@ -28,12 +25,16 @@ jobs:
       - uses: actions/checkout@v7.0.1
         with:
           persist-credentials: false
-      - uses: ./.github/actions/set-uv-exclude-newer
       - name: Install uv
-        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
         with:
           enable-cache: true
           python-version: "3.10"
+      # Runs before the install so a stale lock fails in seconds rather than
+      # after the build and typecheck.
+      - name: Check lockfile is up to date
+        run: |
+          uv lock --check
       - name: Install just
         run: uv tool install rust-just
       - name: Install Python dependencies
@@ -81,9 +82,8 @@ jobs:
       - uses: actions/checkout@v7.0.1
         with:
           persist-credentials: false
-      - uses: ./.github/actions/set-uv-exclude-newer
       - name: Install uv
-        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
         with:
           enable-cache: true
           python-version: ${{ matrix.python-version }}
@@ -104,9 +104,8 @@ jobs:
       - uses: actions/checkout@v7.0.1
         with:
           persist-credentials: false
-      - uses: ./.github/actions/set-uv-exclude-newer
       - name: Install uv
-        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
         with:
           enable-cache: true
           python-version: "3.10"
@@ -133,9 +132,8 @@ jobs:
       - uses: actions/checkout@v7.0.1
         with:
           persist-credentials: false
-      - uses: ./.github/actions/set-uv-exclude-newer
       - name: Install uv
-        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
         with:
           enable-cache: true
           python-version: "3.10"
@@ -159,9 +157,8 @@ jobs:
       - uses: actions/checkout@v7.0.1
         with:
           persist-credentials: false
-      - uses: ./.github/actions/set-uv-exclude-newer
       - name: Install uv
-        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
         with:
           enable-cache: true
           python-version: "3.10"
@@ -182,9 +179,8 @@ jobs:
       - uses: actions/checkout@v7.0.1
         with:
           persist-credentials: false
-      - uses: ./.github/actions/set-uv-exclude-newer
       - name: Install uv
-        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
         with:
           enable-cache: true
           python-version: "${{matrix.python}}"
@@ -204,9 +200,8 @@ jobs:
       - uses: actions/checkout@v7.0.1
         with:
           persist-credentials: false
-      - uses: ./.github/actions/set-uv-exclude-newer
       - name: Install uv
-        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
         with:
           enable-cache: true
           python-version: "3.10"
@@ -235,7 +230,7 @@ jobs:
       - uses: actions/checkout@v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/setup-python@v6.3.0
+      - uses: actions/setup-python@v7.0.0
         with:
           cache: 'pip'
           cache-dependency-path: 'pyproject.toml'
@@ -269,7 +264,7 @@ jobs:
             mkdir test
             tar --strip-components=1 -zxf *.tar.gz -C ./test
             ls test
-        - uses: actions/setup-python@v6.3.0
+        - uses: actions/setup-python@v7.0.0
           with:
             cache: 'pip'
             cache-dependency-path: 'sdist/test/pyproject.toml'
@@ -295,9 +290,8 @@ jobs:
         - uses: actions/checkout@v7.0.1
           with:
             persist-credentials: false
-        - uses: ./.github/actions/set-uv-exclude-newer
         - name: Install uv
-          uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
+          uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
           with:
             python-version: "3.9"
         - id: setup-mongodb

diff --git a/.github/workflows/uv-lock-update.yml b/.github/workflows/uv-lock-update.yml
@@ -0,0 +1,42 @@
+name: uv Lock Update
+
+on:
+  schedule:
+    # Tuesdays at 12:00 UTC.
+    - cron: "0 12 * * 2"
+  workflow_dispatch:
+    inputs:
+      dry_run:
+        description: "Run without pushing or opening a pull request"
+        type: boolean
+        default: false
+
+permissions:
+  contents: read
+  # A live run uses the app token, but a dry run looks up the existing pull
+  # request with github.token, so that read has to be granted here.
+  pull-requests: read
+
+concurrency:
+  group: uv-lock-update
+  cancel-in-progress: false
+
+jobs:
+  update:
+    name: Update uv.lock
+    runs-on: ubuntu-latest
+    environment: automation
+    if: github.repository_owner == 'mongodb' || github.event_name == 'workflow_dispatch'
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Install uv
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        with:
+          python-version: "3.10"
+      - uses: mongodb-labs/drivers-github-tools/python/uv-lock-update@bc33fb6aca874b4c37a4ee79bc7061a1ee68baad # v3
+        with:
+          app_id: ${{ vars.APP_ID }}
+          private_key: ${{ secrets.APP_PRIVATE_KEY }}
+          dry_run: ${{ inputs.dry_run || 'false' }}
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
@@ -18,4 +18,4 @@ jobs:
         with:
           persist-credentials: false
       - name: Run zizmor 🌈
-        uses: zizmorcore/zizmor-action@6599ee8b7a49aef6a770f63d261d214911a7ce02 # v0.6.0
+        uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2