diff -pruN 2.0.2-1/.clang-format 2.1.0-1/.clang-format
--- 2.0.2-1/.clang-format	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/.clang-format	2025-08-14 18:37:23.000000000 +0000
@@ -1,6 +1,6 @@
 ---
-Language:        Cpp
-# BasedOnStyle:  LLVM
+# Note: the "Language" option is omitted to apply this format style to all files
+# regardless of the detected language.
 AccessModifierOffset: -2
 AlignAfterOpenBracket: Align
 AlignArrayOfStructures: None
@@ -9,30 +9,63 @@ AlignConsecutiveAssignments:
   AcrossEmptyLines: false
   AcrossComments:  false
   AlignCompound:   false
+  AlignFunctionDeclarations: false
+  AlignFunctionPointers: false
   PadOperators:    true
 AlignConsecutiveBitFields:
   Enabled:         false
   AcrossEmptyLines: false
   AcrossComments:  false
   AlignCompound:   false
+  AlignFunctionDeclarations: false
+  AlignFunctionPointers: false
   PadOperators:    false
 AlignConsecutiveDeclarations:
   Enabled:         false
   AcrossEmptyLines: false
   AcrossComments:  false
   AlignCompound:   false
+  AlignFunctionDeclarations: true
+  AlignFunctionPointers: false
   PadOperators:    false
 AlignConsecutiveMacros:
   Enabled:         false
   AcrossEmptyLines: false
   AcrossComments:  false
   AlignCompound:   false
+  AlignFunctionDeclarations: false
+  AlignFunctionPointers: false
   PadOperators:    false
 AlignConsecutiveShortCaseStatements:
   Enabled:         false
   AcrossEmptyLines: false
   AcrossComments:  false
+  AlignCaseArrows: false
   AlignCaseColons: false
+AlignConsecutiveTableGenBreakingDAGArgColons:
+  Enabled:         false
+  AcrossEmptyLines: false
+  AcrossComments:  false
+  AlignCompound:   false
+  AlignFunctionDeclarations: false
+  AlignFunctionPointers: false
+  PadOperators:    false
+AlignConsecutiveTableGenCondOperatorColons:
+  Enabled:         false
+  AcrossEmptyLines: false
+  AcrossComments:  false
+  AlignCompound:   false
+  AlignFunctionDeclarations: false
+  AlignFunctionPointers: false
+  PadOperators:    false
+AlignConsecutiveTableGenDefinitionColons:
+  Enabled:         false
+  AcrossEmptyLines: false
+  AcrossComments:  false
+  AlignCompound:   false
+  AlignFunctionDeclarations: false
+  AlignFunctionPointers: false
+  PadOperators:    false
 AlignEscapedNewlines: Left
 AlignOperands:   Align
 AlignTrailingComments:
@@ -40,17 +73,19 @@ AlignTrailingComments:
   OverEmptyLines:  0
 AllowAllArgumentsOnNextLine: true
 AllowAllParametersOfDeclarationOnNextLine: true
+AllowBreakBeforeNoexceptSpecifier: Never
 AllowShortBlocksOnASingleLine: Never
+AllowShortCaseExpressionOnASingleLine: true
 AllowShortCaseLabelsOnASingleLine: false
+AllowShortCompoundRequirementOnASingleLine: true
 AllowShortEnumsOnASingleLine: true
 AllowShortFunctionsOnASingleLine: None
 AllowShortIfStatementsOnASingleLine: Never
 AllowShortLambdasOnASingleLine: All
 AllowShortLoopsOnASingleLine: false
+AllowShortNamespacesOnASingleLine: false
 AlwaysBreakAfterDefinitionReturnType: None
-AlwaysBreakAfterReturnType: All
 AlwaysBreakBeforeMultilineStrings: false
-AlwaysBreakTemplateDeclarations: MultiLine
 AttributeMacros:
   - __capability
   - BSON_GNUC_WARN_UNUSED_RESULT
@@ -78,17 +113,22 @@ BraceWrapping:
   SplitEmptyFunction: true
   SplitEmptyRecord: true
   SplitEmptyNamespace: true
+BreakAdjacentStringLiterals: true
 BreakAfterAttributes: Never
 BreakAfterJavaFieldAnnotations: false
+BreakAfterReturnType: All
 BreakArrays:     true
 BreakBeforeBinaryOperators: None
 BreakBeforeConceptDeclarations: Always
 BreakBeforeBraces: Linux
 BreakBeforeInlineASMColon: OnlyMultiline
 BreakBeforeTernaryOperators: true
+BreakBinaryOperations: Never
 BreakConstructorInitializers: BeforeColon
+BreakFunctionDefinitionParameters: false
 BreakInheritanceList: BeforeColon
 BreakStringLiterals: true
+BreakTemplateDeclarations: MultiLine
 ColumnLimit:     120
 CommentPragmas:  '^ IWYU pragma:'
 CompactNamespaces: false
@@ -112,25 +152,55 @@ ForEachMacros:
 IfMacros:
   - mlib_assert_aborts
   - KJ_IF_MAYBE
-IncludeBlocks:   Preserve
+IncludeBlocks: Regroup
 IncludeCategories:
-  - Regex:           '^"(llvm|llvm-c|clang|clang-c)/'
-    Priority:        2
-    SortPriority:    0
-    CaseSensitive:   false
-  - Regex:           '^(<|"(gtest|gmock|isl|json)/)'
-    Priority:        3
-    SortPriority:    0
-    CaseSensitive:   false
-  - Regex:           '.*'
-    Priority:        1
-    SortPriority:    0
-    CaseSensitive:   false
+  # The prelude header must always come first
+  - Regex: '-prelude\.h>'
+    Priority: 1
+  # Relative "in this directory" headers next
+  - Regex: '"\./|"\.\./'
+    Priority: 2
+  # Private API headers
+  - Regex: '-private\.h>'
+    Priority: 5
+  # All other `mongoc/` headers
+  - Regex: '<mongoc/'
+    Priority: 10
+  # all `bson/` headers come after `mongoc` headers
+  - Regex: '<bson/|<bsonutil/'
+    Priority: 20
+  # Private API components
+  - Regex: '<mlib/|<common'
+    Priority: 30
+  # Library Headers
+  - Regex: '<(openssl/|jsonsl/|utf8proc\.h|bcrypt|sasl/|kms_message/)'
+    Priority: 40
+  # Testing Headers
+  - Regex: '<(TestSuite|test-|(json|ssl)-test|mock_server/|unified/)'
+    Priority: 50
+  # Unix platform headers
+  - Regex: '<(unistd|netdb|pthread|netinet/.*|sys/.*|netdb|fcntl|arpa/.*|resolv|sched|poll)\.h>'
+    Priority: 90
+  # Darwin platform headers
+  - Regex: '<(Availability|AvailabilityMacros|TargetConditionals|CommonCrypto/.*|Security/.*|CoreFoundation/.*)\.h>'
+    CaseSensitive: false
+    Priority: 90
+  # Windows platform headers
+  - Regex: '<(win(dows|sock2|error|trnl|error|crypt|ver|dns)|sspi|ws2tcpip|ntstatus|mstcpip|process)\.h>'
+    CaseSensitive: false
+    Priority: 90
+  # Standard library headers are near last
+  - Regex: '<(assert|string|ctype|limits|time|math|errno|inttypes|signal).h>|<std|<[^.]+>'
+    Priority: 100
+  # Other -I headers get sorted before platform headers
+  - Regex: '<'
+    Priority: 80
 IncludeIsMainRegex: '(Test)?$'
 IncludeIsMainSourceRegex: ''
 IndentAccessModifiers: false
 IndentCaseBlocks: false
 IndentCaseLabels: false
+IndentExportBlock: true
 IndentExternBlock: AfterExternBlock
 IndentGotoLabels: true
 IndentPPDirectives: None
@@ -149,12 +219,16 @@ IntegerLiteralSeparator:
   HexMinDigits:    0
 JavaScriptQuotes: Leave
 JavaScriptWrapImports: true
-KeepEmptyLinesAtTheStartOfBlocks: false
-KeepEmptyLinesAtEOF: false
+KeepEmptyLines:
+  AtEndOfFile:     false
+  AtStartOfBlock:  false
+  AtStartOfFile:   false
+KeepFormFeed:    false
 LambdaBodyIndentation: Signature
 LineEnding:      DeriveLF
 MacroBlockBegin: ''
 MacroBlockEnd:   ''
+MainIncludeChar: AngleBracket
 MaxEmptyLinesToKeep: 2
 NamespaceIndentation: None
 ObjCBinPackProtocolList: Auto
@@ -165,9 +239,11 @@ ObjCSpaceBeforeProtocolList: true
 PackConstructorInitializers: BinPack
 PenaltyBreakAssignment: 2
 PenaltyBreakBeforeFirstCallParameter: 19
+PenaltyBreakBeforeMemberAccess: 150
 PenaltyBreakComment: 300
 PenaltyBreakFirstLessLess: 120
 PenaltyBreakOpenParenthesis: 0
+PenaltyBreakScopeResolution: 500
 PenaltyBreakString: 1000
 PenaltyBreakTemplateDeclaration: 10
 PenaltyExcessCharacter: 1000000
@@ -177,15 +253,17 @@ PointerAlignment: Right
 PPIndentWidth:   -1
 QualifierAlignment: Leave
 ReferenceAlignment: Pointer
-ReflowComments:  true
+ReflowComments:  Always
 RemoveBracesLLVM: false
+RemoveEmptyLinesInUnwrappedLines: false
 RemoveParentheses: Leave
 RemoveSemicolon: false
 RequiresClausePosition: OwnLine
 RequiresExpressionIndentation: OuterScope
 SeparateDefinitionBlocks: Leave
 ShortNamespaceLines: 1
-SortIncludes:    Never
+SkipMacroDefinitionBody: false
+SortIncludes: CaseSensitive
 SortJavaStaticImport: Before
 SortUsingDeclarations: LexicographicNumeric
 SpaceAfterCStyleCast: true
@@ -206,6 +284,7 @@ SpaceBeforeParensOptions:
   AfterFunctionDeclarationName: false
   AfterIfMacros:   true
   AfterOverloadedOperator: false
+  AfterPlacementOperator: false
   AfterRequiresInClause: false
   AfterRequiresInExpression: false
   BeforeNonEmptyParentheses: false
@@ -220,6 +299,7 @@ SpacesInLineCommentPrefix:
   Maximum:         -1
 SpacesInParens:  Never
 SpacesInParensOptions:
+  ExceptDoubleParentheses: false
   InCStyleCasts:   false
   InConditionalStatements: false
   InEmptyParentheses: false
@@ -231,6 +311,7 @@ StatementAttributeLikeMacros:
 StatementMacros:
   - Q_UNUSED
   - QT_REQUIRE_VERSION
+TableGenBreakInsideDAGArg: DontBreak
 TabWidth:        3
 UseTab:          Never
 VerilogBreakBetweenInstancePorts: true
@@ -240,4 +321,5 @@ WhitespaceSensitiveMacros:
   - NS_SWIFT_NAME
   - PP_STRINGIZE
   - STRINGIZE
+WrapNamespaceBodyWithEmptyLines: Leave
 ...
diff -pruN 2.0.2-1/.evergreen/benchmark.yml 2.1.0-1/.evergreen/benchmark.yml
--- 2.0.2-1/.evergreen/benchmark.yml	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/.evergreen/benchmark.yml	2025-08-14 18:37:23.000000000 +0000
@@ -170,10 +170,44 @@ functions:
       file_location: mongo-c-driver/report.json
 
   "send dashboard data" :
-    command: perf.send
-    params:
-      name: perf
-      file: mongo-c-driver/results.json
+    # Here we begin to generate the request to send the data to Signal Processing Service (SPS)
+    - command: shell.exec
+      params:
+        script: |
+          # We use the requester expansion to determine whether the data is from a mainline evergreen run or not
+          if [ "${requester}" == "commit" ]; then
+            echo "is_mainline: true" >> expansion.yml
+          else
+            echo "is_mainline: false" >> expansion.yml
+          fi
+
+          # We parse the username out of the order_id as patches append that in and SPS does not need that information
+          echo "parsed_order_id: $(echo "${revision_order_id}" | awk -F'_' '{print $NF}')"  >> expansion.yml
+    - command: expansions.update
+      params:
+        file: expansion.yml
+    - command: shell.exec
+      params:
+        script: |
+          # Submit the performance data to the SPS endpoint
+          response=$(curl -s -w "\nHTTP_STATUS:%{http_code}" -X 'POST' \
+            "https://performance-monitoring-api.corp.mongodb.com/raw_perf_results/cedar_report?project=${project_id}&version=${version_id}&variant=${build_variant}&order=${parsed_order_id}&task_name=${task_name}&task_id=${task_id}&execution=${execution}&mainline=${is_mainline}" \
+            -H 'accept: application/json' \
+            -H 'Content-Type: application/json' \
+            -d @mongo-c-driver/results.json)
+
+          http_status=$(echo "$response" | grep "HTTP_STATUS" | awk -F':' '{print $2}')
+          response_body=$(echo "$response" | sed '/HTTP_STATUS/d')
+
+          # We want to throw an error if the data was not successfully submitted
+          if [ "$http_status" -ne 200 ]; then
+            echo "Error: Received HTTP status $http_status"
+            echo "Response Body: $response_body"
+            exit 1
+          fi
+
+          echo "Response Body: $response_body"
+          echo "HTTP Status: $http_status"
 
   "backtrace":
     - command: shell.exec
diff -pruN 2.0.2-1/.evergreen/config_generator/README.md 2.1.0-1/.evergreen/config_generator/README.md
--- 2.0.2-1/.evergreen/config_generator/README.md	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/.evergreen/config_generator/README.md	2025-08-14 18:37:23.000000000 +0000
@@ -3,36 +3,22 @@
 The scripts in this directory are used to generate the Evergreen configuration
 files stored in `.evergreen/generated_configs/`.
 
-The easiest way to execute these scripts is using the Poetry to install the
-dependencies and then run the scripts.
+The easiest way to execute these scripts is to use [uv](https://docs.astral.sh/uv/) to run the scripts.
 
 **Note**: These scripts require Python 3.10 or newer.
 
 
 ## Setting Up
 
-Before running, use Poetry to install a virtualenv containing the dependencies.
-This can be done by using the `poetry.sh` (or `poetry.ps1`) script contained in
-the `tools/` directory at the root of the `mongo-c-driver` repository:
-
-```sh
-./tools/poetry.sh install --with=dev
-```
-
-Or with PowerShell:
-
-```pwsh
-./tools/poetry.ps1 install --with=dev
-```
+`uv` is required to run Python scripts. See ["Installing uv"](https://docs.astral.sh/uv/getting-started/installation/) for instructions on how to obtain `uv`.
 
 
 ## Running the Generator
 
-The package defines a program `mc-evg-generate`, which can be run within the
-virtualenv. This can be done via Poetry as well, following the setup:
+The package provides the `mc-evg-generate` [entry point](https://packaging.python.org/en/latest/specifications/entry-points):
 
 ```sh
-./tools/poetry.sh run mc-evg-generate
+uv run --frozen mc-evg-generate
 ```
 
 This command will ready the generation files and generate a new set of Evergreen
diff -pruN 2.0.2-1/.evergreen/config_generator/components/abi_compliance_check.py 2.1.0-1/.evergreen/config_generator/components/abi_compliance_check.py
--- 2.0.2-1/.evergreen/config_generator/components/abi_compliance_check.py	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/.evergreen/config_generator/components/abi_compliance_check.py	2025-08-14 18:37:23.000000000 +0000
@@ -33,7 +33,7 @@ class CheckABICompliance(Function):
             display_name='ABI Compliance Check: ',
             local_files_include_filter='abi-compliance/compat_reports/**/compat_report.html',
             permissions='public-read',
-            remote_file='mongo-c-driver/${branch_name}/${revision}/${version_id}/${build_id}/${task_id}/${execution}/abi-compliance-check/',
+            remote_file='${project}/${branch_name}/${revision}/${version_id}/${build_id}/${task_id}/${execution}/abi-compliance-check/',
         ),
         s3_put(
             command_type=EvgCommandType.SYSTEM,
@@ -44,14 +44,10 @@ class CheckABICompliance(Function):
             display_name='ABI Compliance Check: ',
             local_files_include_filter='abi-compliance/logs/**/log.txt',
             permissions='public-read',
-            remote_file='mongo-c-driver/${branch_name}/${revision}/${version_id}/${build_id}/${task_id}/${execution}/abi-compliance-check/',
+            remote_file='${project}/${branch_name}/${revision}/${version_id}/${build_id}/${task_id}/${execution}/abi-compliance-check/',
         ),
     ]
 
-    @classmethod
-    def call(cls, **kwargs):
-        return cls.default_call(**kwargs)
-
 
 def functions():
     return CheckABICompliance.defn()
diff -pruN 2.0.2-1/.evergreen/config_generator/components/c_std_compile.py 2.1.0-1/.evergreen/config_generator/components/c_std_compile.py
--- 2.0.2-1/.evergreen/config_generator/components/c_std_compile.py	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/.evergreen/config_generator/components/c_std_compile.py	2025-08-14 18:37:23.000000000 +0000
@@ -28,20 +28,21 @@ MATRIX = [
     ('rhel94',     'clang',    None, [99, 11, 17, 23]), # Clang 17.0 (max: C2x)
     ('rhel95',     'clang',    None, [99, 11, 17, 23]), # Clang 18.0 (max: C23)
 
-    ('rhel76',     'gcc',    None, [99, 11,       ]), # GCC 4.8 (max: C11)
-    ('rhel80',     'gcc',    None, [99, 11, 17,   ]), # GCC 8.2 (max: C17)
-    ('debian10',   'gcc-8',  None, [99, 11, 17,   ]), # GCC 8.3 (max: C17)
-    ('rhel84',     'gcc',    None, [99, 11, 17,   ]), # GCC 8.4 (max: C17)
-    ('ubuntu2004', 'gcc-9',  None, [99, 11, 17, 23]), # GCC 9.4 (max: C2x)
-    ('debian11',   'gcc-10', None, [99, 11, 17, 23]), # GCC 10.2 (max: C2x)
-    ('rhel90',     'gcc',    None, [99, 11, 17, 23]), # GCC 11.2 (max: C2x)
-    ('rhel92',     'gcc',    None, [99, 11, 17, 23]), # GCC 11.3 (max: C2x)
-    ('rhel94',     'gcc',    None, [99, 11, 17, 23]), # GCC 11.4 (max: C2x)
-    ('rhel95',     'gcc',    None, [99, 11, 17, 23]), # GCC 11.5 (max: C2x)
-
-    ('windows-vsCurrent', 'vs2017x64', None, [99, 11, 17, 'latest']), # Max: C17, clatest (C2x)
-    ('windows-vsCurrent', 'vs2019x64', None, [99, 11, 17, 'latest']), # Max: C17, clatest (C2x)
-    ('windows-vsCurrent', 'vs2022x64', None, [99, 11, 17, 'latest']), # Max: C17, clatest (C2x)
+    ('rhel7-latest', 'gcc',    None, [99, 11,       ]), # GCC 4.8 (max: C11)
+    ('rhel80',       'gcc',    None, [99, 11, 17,   ]), # GCC 8.2 (max: C17)
+    ('rhel84',       'gcc',    None, [99, 11, 17,   ]), # GCC 8.4 (max: C17)
+    ('ubuntu2004',   'gcc-9',  None, [99, 11, 17, 23]), # GCC 9.4 (max: C2x)
+    ('debian11',     'gcc-10', None, [99, 11, 17, 23]), # GCC 10.2 (max: C2x)
+    ('rhel90',       'gcc',    None, [99, 11, 17, 23]), # GCC 11.2 (max: C2x)
+    ('rhel92',       'gcc',    None, [99, 11, 17, 23]), # GCC 11.3 (max: C2x)
+    ('rhel94',       'gcc',    None, [99, 11, 17, 23]), # GCC 11.4 (max: C2x)
+    ('rhel95',       'gcc',    None, [99, 11, 17, 23]), # GCC 11.5 (max: C2x)
+    ('ubuntu2404',   'gcc-13', None, [99, 11, 17, 23]), # GCC 13.3 (max: C2x)
+
+    ('windows-vsCurrent', 'vs2015x64', None, [99, 11,   ]), # Max: C11
+    ('windows-vsCurrent', 'vs2017x64', None, [99, 11,   ]), # Max: C11
+    ('windows-vsCurrent', 'vs2019x64', None, [99, 11, 17]), # Max: C17
+    ('windows-vsCurrent', 'vs2022x64', None, [99, 11, 17]), # Max: C17
 ]
 # fmt: on
 # pylint: enable=line-too-long
@@ -58,10 +59,6 @@ class StdCompile(Function):
         ),
     ]
 
-    @classmethod
-    def call(cls, **kwargs):
-        return cls.default_call(**kwargs)
-
 
 def functions():
     return StdCompile.defn()
diff -pruN 2.0.2-1/.evergreen/config_generator/components/check_mongoc_public_headers.py 2.1.0-1/.evergreen/config_generator/components/check_mongoc_public_headers.py
--- 2.0.2-1/.evergreen/config_generator/components/check_mongoc_public_headers.py	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/.evergreen/config_generator/components/check_mongoc_public_headers.py	2025-08-14 18:37:23.000000000 +0000
@@ -20,10 +20,6 @@ class CheckMongocPublicHeaders(Function)
         ),
     ]
 
-    @classmethod
-    def call(cls, **kwargs):
-        return cls.default_call(**kwargs)
-
 
 def functions():
     return CheckMongocPublicHeaders.defn()
diff -pruN 2.0.2-1/.evergreen/config_generator/components/clang_format.py 2.1.0-1/.evergreen/config_generator/components/clang_format.py
--- 2.0.2-1/.evergreen/config_generator/components/clang_format.py	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/.evergreen/config_generator/components/clang_format.py	2025-08-14 18:37:23.000000000 +0000
@@ -3,41 +3,27 @@ from shrub.v3.evg_command import EvgComm
 from shrub.v3.evg_task import EvgTask
 from shrub.v3.evg_task import EvgTaskRef
 
-from config_generator.etc.distros import find_large_distro
+from config_generator.etc.distros import find_small_distro
 from config_generator.etc.function import Function
 from config_generator.etc.utils import bash_exec
 
 
 TAG = "clang-format"
 
-DISTROS = [
-    find_large_distro("ubuntu2204").name,
-    find_large_distro("ubuntu2004").name,
-]
-
 
 class ClangFormat(Function):
     name = TAG
     commands = [
         bash_exec(
-            command_type=EvgCommandType.SETUP,
-            working_dir="mongoc",
-            script="./tools/poetry.sh install --with=dev"
-        ),
-        bash_exec(
             command_type=EvgCommandType.TEST,
             working_dir="mongoc",
             env={
                 "DRYRUN": "1",
             },
-            script="./tools/poetry.sh run .evergreen/scripts/clang-format-all.sh",
+            script="uv run --frozen --only-group=format tools/format.py --mode=check",
         ),
     ]
 
-    @classmethod
-    def call(cls, **kwargs):
-        return cls.default_call(**kwargs)
-
 
 def functions():
     return ClangFormat.defn()
@@ -56,7 +42,7 @@ def variants():
         BuildVariant(
             name=TAG,
             display_name=TAG,
-            run_on=DISTROS,
-            tasks=[EvgTaskRef(name=f'.{TAG}')],
+            run_on=[find_small_distro("ubuntu2204").name],
+            tasks=[EvgTaskRef(name=f".{TAG}")],
         ),
     ]
diff -pruN 2.0.2-1/.evergreen/config_generator/components/cse/openssl.py 2.1.0-1/.evergreen/config_generator/components/cse/openssl.py
--- 2.0.2-1/.evergreen/config_generator/components/cse/openssl.py	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/.evergreen/config_generator/components/cse/openssl.py	2025-08-14 18:37:23.000000000 +0000
@@ -15,35 +15,40 @@ TAG = f'cse-matrix-{SSL}'
 # pylint: disable=line-too-long
 # fmt: off
 COMPILE_MATRIX = [
-    ('debian92', 'clang', None, ['cyrus']),
-    ('debian92', 'gcc',   None, ['cyrus']),
-    ('debian10', 'clang', None, ['cyrus']),
-    ('debian10', 'gcc',   None, ['cyrus']),
-    ('debian11', 'clang', None, ['cyrus']),
-    ('debian11', 'gcc',   None, ['cyrus']),
-    ('rhel80',            'gcc',       None, ['cyrus']),
+    # For test matrix.
+    ('rhel8-latest',      'gcc',       None, ['cyrus']),
     ('rhel8-zseries',     'gcc',       None, ['cyrus']),
-    ('ubuntu2004',        'clang',     None, ['cyrus']),
-    ('ubuntu2004',        'gcc',       None, ['cyrus']),
     ('ubuntu2004-arm64',  'gcc',       None, ['cyrus']),
     ('windows-vsCurrent', 'vs2017x64', None, ['cyrus']),
+
+    # For compile only.
+    ('debian11',   'clang',    None, ['cyrus']),
+    ('debian11',   'gcc',      None, ['cyrus']),
+    ('debian12',   'clang',    None, ['cyrus']),
+    ('debian12',   'gcc',      None, ['cyrus']),
+    ('rhel80',     'gcc',      None, ['cyrus']),
+    ('ubuntu2004', 'gcc',      None, ['cyrus']),
+    ('ubuntu2004', 'clang',    None, ['cyrus']),
+    ('ubuntu2204', 'gcc',      None, ['cyrus']),
+    ('ubuntu2204', 'clang-12', None, ['cyrus']),
+    ('ubuntu2404', 'gcc',      None, ['cyrus']),
+    ('ubuntu2404', 'clang-14', None, ['cyrus']),
 ]
 
 # TODO (CDRIVER-3789): test cse with the 'sharded' topology.
+# CSFLE requires 4.2+. QE requires 7.0+ and are skipped on "server" tasks.
 TEST_MATRIX = [
-    # 4.2 and 4.4 not available on rhel8-zseries.
-    ('rhel8-zseries', 'gcc', None, 'cyrus', ['auth'], ['server'], ['5.0']),
+    # rhel8-latest provides 4.2+.
+    ('rhel8-latest', 'gcc', None, 'cyrus', ['auth'], ['server', 'replica'], ['4.2', '4.4', '5.0', '6.0', '7.0', '8.0', 'latest']),
 
-    ('windows-vsCurrent', 'vs2017x64', None, 'cyrus', ['auth'], ['server'], ['4.2', '4.4', '5.0', '6.0' ]),
+    # windows-vsCurrent provides 4.2+.
+    ('windows-vsCurrent', 'vs2017x64', None, 'cyrus', ['auth'], ['server', 'replica'], ['4.2', '4.4', '5.0', '6.0', '7.0', '8.0', 'latest']),
 
-    # Test 7.0+ with a replica set since Queryable Encryption does not support the 'server' topology. Queryable Encryption tests require 7.0+.
-    ('ubuntu2004',        'gcc',       None, 'cyrus', ['auth'], ['server', 'replica'], ['4.4', '5.0', '6.0', '7.0', '8.0', 'latest']),
-    ('rhel8-zseries',     'gcc',       None, 'cyrus', ['auth'], ['server', 'replica'], [ '7.0', '8.0', 'latest']),
-    ('ubuntu2004-arm64',  'gcc',       None, 'cyrus', ['auth'], ['server', 'replica'], ['4.4', '5.0', '6.0', '7.0', '8.0', 'latest']),
-    ('windows-vsCurrent', 'vs2017x64', None, 'cyrus', ['auth'], ['server', 'replica'], [ '7.0', '8.0', 'latest']),
+    # ubuntu2004-arm64 provides 4.4+.
+    ('ubuntu2004-arm64', 'gcc', None, 'cyrus', ['auth'], ['server', 'replica'], ['4.4', '5.0', '6.0', '7.0', '8.0', 'latest']),
 
-    # Test 4.2 with Debian 10 since 4.2 does not ship on Ubuntu 20.04+.
-    ('debian10',          'gcc',       None, 'cyrus', ['auth'], ['server', 'replica'], ['4.2']),
+    # rhel8-zseries provides 5.0+.
+    ('rhel8-zseries', 'gcc', None, 'cyrus', ['auth'], ['server', 'replica'], ['5.0', '6.0', '7.0', '8.0', 'latest']),
 ]
 # fmt: on
 # pylint: enable=line-too-long
@@ -106,6 +111,8 @@ def variants():
         else:
             tasks.append(task.get_task_ref())
 
+    tasks.sort(key=lambda t: t.name)
+
     return [
         BuildVariant(
             name=TAG,
diff -pruN 2.0.2-1/.evergreen/config_generator/components/earthly.py 2.1.0-1/.evergreen/config_generator/components/earthly.py
--- 2.0.2-1/.evergreen/config_generator/components/earthly.py	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/.evergreen/config_generator/components/earthly.py	2025-08-14 18:37:23.000000000 +0000
@@ -5,9 +5,18 @@ import re
 from typing import Iterable, Literal, Mapping, NamedTuple, TypeVar
 
 from shrub.v3.evg_build_variant import BuildVariant
-from shrub.v3.evg_command import BuiltInCommand, EvgCommandType, subprocess_exec
+from shrub.v3.evg_command import (
+    BuiltInCommand,
+    EvgCommandType,
+    KeyValueParam,
+    ec2_assume_role,
+    expansions_update,
+    subprocess_exec,
+)
 from shrub.v3.evg_task import EvgTask, EvgTaskRef
 
+from config_generator.etc.function import Function
+
 from ..etc.utils import all_possible
 
 T = TypeVar("T")
@@ -38,7 +47,7 @@ SASLOption = Literal["Cyrus", "off"]
 "Valid options for the SASL configuration parameter"
 TLSOption = Literal["OpenSSL", "off"]
 "Options for the TLS backend configuration parameter (AKA 'ENABLE_SSL')"
-CxxVersion = Literal["none"] # TODO: Once CXX-3103 is released, add latest C++ release tag.
+CxxVersion = Literal["master", "r4.1.0", "none"]
 "C++ driver refs that are under CI test"
 
 # A separator character, since we cannot use whitespace
@@ -59,7 +68,9 @@ def os_split(env: EnvKey) -> tuple[str,
         case "centos7":
             return "CentOS", "7.0"
         case _:
-            raise ValueError(f"Failed to split OS env key {env=} into a name+version pair (unrecognized)")
+            raise ValueError(
+                f"Failed to split OS env key {env=} into a name+version pair (unrecognized)"
+            )
 
 
 class EarthlyVariant(NamedTuple):
@@ -136,14 +147,44 @@ class Configuration(NamedTuple):
         return _SEPARATOR.join(f"{k}={v}" for k, v in self._asdict().items())
 
 
+# Authenticate with DevProd-provided Amazon ECR instance to use as pull-through cache for DockerHub.
+class DockerLoginAmazonECR(Function):
+    name = "docker-login-amazon-ecr"
+    commands = [
+        # Avoid inadvertently using a pre-existing and potentially conflicting Docker config.
+        expansions_update(
+            updates=[KeyValueParam(key="DOCKER_CONFIG", value="${workdir}/.docker")]
+        ),
+        ec2_assume_role(
+            role_arn="arn:aws:iam::901841024863:role/ecr-role-evergreen-ro"
+        ),
+        subprocess_exec(
+            binary="bash",
+            command_type=EvgCommandType.SETUP,
+            include_expansions_in_env=[
+                "AWS_ACCESS_KEY_ID",
+                "AWS_SECRET_ACCESS_KEY",
+                "AWS_SESSION_TOKEN",
+                "DOCKER_CONFIG",
+            ],
+            args=[
+                "-c",
+                "aws ecr get-login-password --region us-east-1 | docker login --username AWS --password-stdin 901841024863.dkr.ecr.us-east-1.amazonaws.com",
+            ],
+        ),
+    ]
+
+
 def task_filter(env: EarthlyVariant, conf: Configuration) -> bool:
     """
     Control which tasks are actually defined by matching on the platform and
     configuration values.
     """
     match env, conf:
-        # u16/centos7 are not capable of building mongocxx
-        case e, (_sasl, _tls, cxx) if re.match(r"^Ubuntu 16|^CentOS 7", e.display_name):
+        # u16/u18/centos7 are not capable of building mongocxx
+        case e, (_sasl, _tls, cxx) if re.match(
+            r"^Ubuntu 16|^Ubuntu 18|^CentOS 7", e.display_name
+        ):
             # Only build if C++ driver is test is disabled
             return cxx == "none"
         # Anything else: Allow it to run:
@@ -170,11 +211,16 @@ def earthly_exec(
     return subprocess_exec(
         "./tools/earthly.sh",
         args=[
+            # Use Amazon ECR as pull-through cache for DockerHub to avoid rate limits.
+            "--buildkit-image=901841024863.dkr.ecr.us-east-1.amazonaws.com/dockerhub/earthly/buildkitd:v0.8.3",
             *(f"--secret={k}" for k in (secrets or ())),
             f"+{target}",
+            # Use Amazon ECR as pull-through cache for DockerHub to avoid rate limits.
+            "--default_search_registry=901841024863.dkr.ecr.us-east-1.amazonaws.com/dockerhub",
             *(f"--{arg}={val}" for arg, val in (args or {}).items()),
         ],
         command_type=EvgCommandType(kind),
+        include_expansions_in_env=["DOCKER_CONFIG"],
         env=env if env else None,
         working_dir="mongoc",
     )
@@ -209,15 +255,7 @@ def earthly_task(
     return EvgTask(
         name=name,
         commands=[
-            # Ensure subsequent Docker commands are authenticated.
-            subprocess_exec(
-                binary="bash",
-                command_type=EvgCommandType.SETUP,
-                args=[
-                    "-c",
-                    r'docker login -u "${artifactory_username}" --password-stdin artifactory.corp.mongodb.com <<<"${artifactory_password}"',
-                ],
-            ),
+            DockerLoginAmazonECR.call(),
             # First, just build the "env-warmup" which will prepare the build environment.
             # This won't generate any output, but allows EVG to track it as a separate build step
             # for timing and logging purposes. The subequent build step will cache-hit the
@@ -241,13 +279,18 @@ def earthly_task(
 
 
 CONTAINER_RUN_DISTROS = [
-    "ubuntu2204-large",
-    "debian10-large",
-    "debian11-large",
     "amazon2",
+    "debian11-large",
+    "debian12-large",
+    "ubuntu2204-large",
+    "ubuntu2404-large",
 ]
 
 
+def functions():
+    return DockerLoginAmazonECR.defn()
+
+
 def tasks() -> Iterable[EvgTask]:
     for conf in all_possible(Configuration):
         # test-example is a target in all configurations
@@ -265,6 +308,16 @@ def tasks() -> Iterable[EvgTask]:
         if task is not None:
             yield task
 
+    yield EvgTask(
+        name="verify-headers",
+        commands=[
+            DockerLoginAmazonECR.call(),
+            earthly_exec(kind="test", target="verify-headers"),
+        ],
+        tags=["pr-merge-gate"],
+        run_on=CONTAINER_RUN_DISTROS,
+    )
+
 
 def variants() -> Iterable[BuildVariant]:
     yield from (ev.as_evg_variant() for ev in all_possible(EarthlyVariant))
diff -pruN 2.0.2-1/.evergreen/config_generator/components/funcs/backtrace.py 2.1.0-1/.evergreen/config_generator/components/funcs/backtrace.py
--- 2.0.2-1/.evergreen/config_generator/components/funcs/backtrace.py	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/.evergreen/config_generator/components/funcs/backtrace.py	2025-08-14 18:37:23.000000000 +0000
@@ -11,10 +11,6 @@ class Backtrace(Function):
         ),
     ]
 
-    @classmethod
-    def call(cls, **kwargs):
-        return cls.default_call(**kwargs)
-
 
 def functions():
     return Backtrace.defn()
diff -pruN 2.0.2-1/.evergreen/config_generator/components/funcs/bootstrap_mongo_orchestration.py 2.1.0-1/.evergreen/config_generator/components/funcs/bootstrap_mongo_orchestration.py
--- 2.0.2-1/.evergreen/config_generator/components/funcs/bootstrap_mongo_orchestration.py	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/.evergreen/config_generator/components/funcs/bootstrap_mongo_orchestration.py	2025-08-14 18:37:23.000000000 +0000
@@ -21,10 +21,6 @@ class BootstrapMongoOrchestration(Functi
         ),
     ]
 
-    @classmethod
-    def call(cls, **kwargs):
-        return cls.default_call(**kwargs)
-
 
 def functions():
     return BootstrapMongoOrchestration.defn()
diff -pruN 2.0.2-1/.evergreen/config_generator/components/funcs/fetch_det.py 2.1.0-1/.evergreen/config_generator/components/funcs/fetch_det.py
--- 2.0.2-1/.evergreen/config_generator/components/funcs/fetch_det.py	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/.evergreen/config_generator/components/funcs/fetch_det.py	2025-08-14 18:37:23.000000000 +0000
@@ -40,10 +40,6 @@ class FetchDET(Function):
         ),
     ]
 
-    @classmethod
-    def call(cls, **kwargs):
-        return cls.default_call(**kwargs)
-
 
 def functions():
     return FetchDET.defn()
diff -pruN 2.0.2-1/.evergreen/config_generator/components/funcs/fetch_source.py 2.1.0-1/.evergreen/config_generator/components/funcs/fetch_source.py
--- 2.0.2-1/.evergreen/config_generator/components/funcs/fetch_source.py	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/.evergreen/config_generator/components/funcs/fetch_source.py	2025-08-14 18:37:23.000000000 +0000
@@ -39,10 +39,6 @@ class FetchSource(Function):
         ),
     ]
 
-    @classmethod
-    def call(cls, **kwargs):
-        return cls.default_call(**kwargs)
-
 
 def functions():
     return FetchSource.defn()
diff -pruN 2.0.2-1/.evergreen/config_generator/components/funcs/restore_instance_profile.py 2.1.0-1/.evergreen/config_generator/components/funcs/restore_instance_profile.py
--- 2.0.2-1/.evergreen/config_generator/components/funcs/restore_instance_profile.py	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/.evergreen/config_generator/components/funcs/restore_instance_profile.py	2025-08-14 18:37:23.000000000 +0000
@@ -34,10 +34,6 @@ class RestoreInstanceProfile(Function):
         ),
     ]
 
-    @classmethod
-    def call(cls, **kwargs):
-        return cls.default_call(**kwargs)
-
 
 def functions():
     return RestoreInstanceProfile.defn()
diff -pruN 2.0.2-1/.evergreen/config_generator/components/funcs/run_mock_kms_servers.py 2.1.0-1/.evergreen/config_generator/components/funcs/run_mock_kms_servers.py
--- 2.0.2-1/.evergreen/config_generator/components/funcs/run_mock_kms_servers.py	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/.evergreen/config_generator/components/funcs/run_mock_kms_servers.py	2025-08-14 18:37:23.000000000 +0000
@@ -55,10 +55,6 @@ class RunMockKMSServers(Function):
         ),
     ]
 
-    @classmethod
-    def call(cls, **kwargs):
-        return cls.default_call(**kwargs)
-
 
 def functions():
     return RunMockKMSServers.defn()
diff -pruN 2.0.2-1/.evergreen/config_generator/components/funcs/run_simple_http_server.py 2.1.0-1/.evergreen/config_generator/components/funcs/run_simple_http_server.py
--- 2.0.2-1/.evergreen/config_generator/components/funcs/run_simple_http_server.py	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/.evergreen/config_generator/components/funcs/run_simple_http_server.py	2025-08-14 18:37:23.000000000 +0000
@@ -22,10 +22,6 @@ class RunSimpleHTTPServer(Function):
         ),
     ]
 
-    @classmethod
-    def call(cls, **kwargs):
-        return cls.default_call(**kwargs)
-
 
 def functions():
     return RunSimpleHTTPServer.defn()
diff -pruN 2.0.2-1/.evergreen/config_generator/components/funcs/run_tests.py 2.1.0-1/.evergreen/config_generator/components/funcs/run_tests.py
--- 2.0.2-1/.evergreen/config_generator/components/funcs/run_tests.py	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/.evergreen/config_generator/components/funcs/run_tests.py	2025-08-14 18:37:23.000000000 +0000
@@ -15,10 +15,6 @@ class RunTests(Function):
         ),
     ]
 
-    @classmethod
-    def call(cls, **kwargs):
-        return cls.default_call(**kwargs)
-
 
 def functions():
     return RunTests.defn()
diff -pruN 2.0.2-1/.evergreen/config_generator/components/funcs/stop_load_balancer.py 2.1.0-1/.evergreen/config_generator/components/funcs/stop_load_balancer.py
--- 2.0.2-1/.evergreen/config_generator/components/funcs/stop_load_balancer.py	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/.evergreen/config_generator/components/funcs/stop_load_balancer.py	2025-08-14 18:37:23.000000000 +0000
@@ -19,10 +19,6 @@ class StopLoadBalancer(Function):
         ),
     ]
 
-    @classmethod
-    def call(cls, **kwargs):
-        return cls.default_call(**kwargs)
-
 
 def functions():
     return StopLoadBalancer.defn()
diff -pruN 2.0.2-1/.evergreen/config_generator/components/funcs/stop_mongo_orchestration.py 2.1.0-1/.evergreen/config_generator/components/funcs/stop_mongo_orchestration.py
--- 2.0.2-1/.evergreen/config_generator/components/funcs/stop_mongo_orchestration.py	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/.evergreen/config_generator/components/funcs/stop_mongo_orchestration.py	2025-08-14 18:37:23.000000000 +0000
@@ -14,10 +14,6 @@ class StopMongoOrchestration(Function):
         ),
     ]
 
-    @classmethod
-    def call(cls, **kwargs):
-        return cls.default_call(**kwargs)
-
 
 def functions():
     return StopMongoOrchestration.defn()
diff -pruN 2.0.2-1/.evergreen/config_generator/components/funcs/upload_build.py 2.1.0-1/.evergreen/config_generator/components/funcs/upload_build.py
--- 2.0.2-1/.evergreen/config_generator/components/funcs/upload_build.py	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/.evergreen/config_generator/components/funcs/upload_build.py	2025-08-14 18:37:23.000000000 +0000
@@ -22,10 +22,6 @@ class UploadBuild(Function):
         ),
     ]
 
-    @classmethod
-    def call(cls, **kwargs):
-        return cls.default_call(**kwargs)
-
 
 def functions():
     return UploadBuild.defn()
diff -pruN 2.0.2-1/.evergreen/config_generator/components/funcs/upload_mo_artifacts.py 2.1.0-1/.evergreen/config_generator/components/funcs/upload_mo_artifacts.py
--- 2.0.2-1/.evergreen/config_generator/components/funcs/upload_mo_artifacts.py	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/.evergreen/config_generator/components/funcs/upload_mo_artifacts.py	2025-08-14 18:37:23.000000000 +0000
@@ -87,10 +87,6 @@ class UploadMOArtifacts(Function):
         ),
     ]
 
-    @classmethod
-    def call(cls, **kwargs):
-        return cls.default_call(**kwargs)
-
 
 def functions():
     return UploadMOArtifacts.defn()
diff -pruN 2.0.2-1/.evergreen/config_generator/components/funcs/upload_test_results.py 2.1.0-1/.evergreen/config_generator/components/funcs/upload_test_results.py
--- 2.0.2-1/.evergreen/config_generator/components/funcs/upload_test_results.py	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/.evergreen/config_generator/components/funcs/upload_test_results.py	2025-08-14 18:37:23.000000000 +0000
@@ -19,10 +19,6 @@ class UploadTestResults(Function):
         ),
     ]
 
-    @classmethod
-    def call(cls, **kwargs):
-        return cls.default_call(**kwargs)
-
 
 def functions():
     return UploadTestResults.defn()
diff -pruN 2.0.2-1/.evergreen/config_generator/components/kms_divergence_check.py 2.1.0-1/.evergreen/config_generator/components/kms_divergence_check.py
--- 2.0.2-1/.evergreen/config_generator/components/kms_divergence_check.py	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/.evergreen/config_generator/components/kms_divergence_check.py	2025-08-14 18:37:23.000000000 +0000
@@ -16,10 +16,6 @@ class KmsDivergenceCheck(Function):
         ),
     ]
 
-    @classmethod
-    def call(cls, **kwargs):
-        return cls.default_call(**kwargs)
-
 
 def functions():
     return KmsDivergenceCheck.defn()
diff -pruN 2.0.2-1/.evergreen/config_generator/components/loadbalanced.py 2.1.0-1/.evergreen/config_generator/components/loadbalanced.py
--- 2.0.2-1/.evergreen/config_generator/components/loadbalanced.py	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/.evergreen/config_generator/components/loadbalanced.py	2025-08-14 18:37:23.000000000 +0000
@@ -12,8 +12,8 @@ from config_generator.components.funcs.u
 from config_generator.etc.distros import make_distro_str, find_small_distro, find_large_distro
 from config_generator.etc.utils import bash_exec
 
-# Use `rhel8.9` distro. `rhel8.9` distro includes necessary dependency: `haproxy`.
-_DISTRO_NAME = "rhel8.9"
+# Use `rhel8-latest` distro. `rhel8-latest` distro includes necessary dependency: `haproxy`.
+_DISTRO_NAME = "rhel8-latest"
 _COMPILER = "gcc"
 
 
@@ -44,7 +44,7 @@ def make_test_task(auth: bool, ssl: bool
         name=f"loadbalanced-{distro_str}-test-{server_version}-{auth_str}-{ssl_str}",
         depends_on=[EvgTaskDependency(
             name=f"loadbalanced-{distro_str}-compile")],
-        run_on=find_small_distro(_DISTRO_NAME).name,
+        run_on=find_large_distro(_DISTRO_NAME).name, # DEVPROD-18763
         tags=['loadbalanced', _DISTRO_NAME, _COMPILER, auth_str, ssl_str],
         commands=[
             FetchBuild.call(build_name=f"loadbalanced-{distro_str}-compile"),
diff -pruN 2.0.2-1/.evergreen/config_generator/components/make_docs.py 2.1.0-1/.evergreen/config_generator/components/make_docs.py
--- 2.0.2-1/.evergreen/config_generator/components/make_docs.py	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/.evergreen/config_generator/components/make_docs.py	2025-08-14 18:37:23.000000000 +0000
@@ -17,18 +17,12 @@ class MakeDocs(Function):
             working_dir="mongoc",
             include_expansions_in_env=["distro_id"],
             script="""\
-                set -o errexit
-                ./tools/poetry.sh install --with=docs
                 # See SphinxBuild.cmake for EVG_DOCS_BUILD reasoning
-                ./tools/poetry.sh run env EVG_DOCS_BUILD=1 .evergreen/scripts/build-docs.sh
-                """,
+                uv run --frozen --only-group docs env EVG_DOCS_BUILD=1 .evergreen/scripts/build-docs.sh
+            """,
         ),
     ]
 
-    @classmethod
-    def call(cls, **kwargs):
-        return cls.default_call(**kwargs)
-
 
 class UploadDocs(Function):
     name = "upload-docs"
@@ -71,10 +65,6 @@ class UploadDocs(Function):
         ),
     ]
 
-    @classmethod
-    def call(cls, **kwargs):
-        return cls.default_call(**kwargs)
-
 
 class UploadManPages(Function):
     name = "upload-man-pages"
@@ -116,10 +106,6 @@ class UploadManPages(Function):
         ),
     ]
 
-    @classmethod
-    def call(cls, **kwargs):
-        return cls.default_call(**kwargs)
-
 
 def functions():
     return merge_defns(
diff -pruN 2.0.2-1/.evergreen/config_generator/components/openssl_static_compile.py 2.1.0-1/.evergreen/config_generator/components/openssl_static_compile.py
--- 2.0.2-1/.evergreen/config_generator/components/openssl_static_compile.py	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/.evergreen/config_generator/components/openssl_static_compile.py	2025-08-14 18:37:23.000000000 +0000
@@ -17,10 +17,11 @@ TAG = f'{SSL}-matrix'
 # pylint: disable=line-too-long
 # fmt: off
 MATRIX = [
-  ('debian92',   'gcc', None),
-  ('debian10',   'gcc', None),
   ('debian11',   'gcc', None),
+  ('debian12',   'gcc', None),
   ('ubuntu2004', 'gcc', None),
+  ('ubuntu2204', 'gcc', None),
+  ('ubuntu2404', 'gcc', None),
 ]
 # fmt: on
 # pylint: enable=line-too-long
@@ -37,10 +38,6 @@ class StaticOpenSSLCompile(Function):
         ),
     ]
 
-    @classmethod
-    def call(cls, **kwargs):
-        return cls.default_call(**kwargs)
-
 
 def functions():
     return StaticOpenSSLCompile.defn()
diff -pruN 2.0.2-1/.evergreen/config_generator/components/sanitizers/asan_cse.py 2.1.0-1/.evergreen/config_generator/components/sanitizers/asan_cse.py
--- 2.0.2-1/.evergreen/config_generator/components/sanitizers/asan_cse.py	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/.evergreen/config_generator/components/sanitizers/asan_cse.py	2025-08-14 18:37:23.000000000 +0000
@@ -10,16 +10,13 @@ from config_generator.components.sanitiz
 # pylint: disable=line-too-long
 # fmt: off
 COMPILE_MATRIX = [
-    ('ubuntu2004', 'clang', None, ['cyrus']),
-    ('debian10',   'clang', None, ['cyrus']),
+    ('rhel8-latest',     'clang', None, ['cyrus']),
 ]
 
+# CSFLE requires 4.2+. QE requires 7.0+ and are skipped on "server" tasks.
 TEST_MATRIX = [
-    # Test 7.0+ with a replica set since Queryable Encryption does not support the 'server' topology. Queryable Encryption tests require 7.0+.
-    ('ubuntu2004', 'clang', None, 'cyrus', ['auth'], ['server', 'replica'], ['4.4', '5.0', '6.0', '7.0', '8.0', 'latest']),
-
-    # Test 4.2 with Debian 10 since 4.2 does not ship on Ubuntu 20.04+.
-    ('debian10',   'clang', None, 'cyrus', ['auth'], ['server'], ['4.2']), 
+    # rhel8-latest provides 4.2 through latest.
+    ('rhel8-latest', 'clang', None, 'cyrus', ['auth'], ['server', 'replica'], ['4.2', '4.4', '5.0', '6.0', '7.0', '8.0', 'latest']),
 ]
 # fmt: on
 # pylint: enable=line-too-long
diff -pruN 2.0.2-1/.evergreen/config_generator/components/sanitizers/asan_sasl.py 2.1.0-1/.evergreen/config_generator/components/sanitizers/asan_sasl.py
--- 2.0.2-1/.evergreen/config_generator/components/sanitizers/asan_sasl.py	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/.evergreen/config_generator/components/sanitizers/asan_sasl.py	2025-08-14 18:37:23.000000000 +0000
@@ -10,15 +10,12 @@ from config_generator.components.sanitiz
 # pylint: disable=line-too-long
 # fmt: off
 COMPILE_MATRIX = [
-    ('ubuntu2004', 'clang', None, ['cyrus']),
-    ('debian10',   'clang', None, ['cyrus']),
+    ('rhel8-latest', 'clang', None, ['cyrus']),
 ]
 
 TEST_MATRIX = [
-    ('ubuntu2004', 'clang', None, 'cyrus', ['auth'], ['server', 'replica', 'sharded'], ['4.4', '5.0', '6.0', '7.0', '8.0', 'latest']),
-
-    # Test 4.2 with Debian 10 since 4.2 does not ship on Ubuntu 20.04+.
-    ('debian10',   'clang', None, 'cyrus', ['auth'], ['server', 'replica', 'sharded'], ['4.2']), 
+    # rhel8-latest provides 4.2 through latest.
+    ('rhel8-latest', 'clang', None, 'cyrus', ['auth'], ['server', 'replica', 'sharded'], ['4.2', '4.4', '5.0', '6.0', '7.0', '8.0', 'latest']),
 ]
 # fmt: on
 # pylint: enable=line-too-long
diff -pruN 2.0.2-1/.evergreen/config_generator/components/sanitizers/tsan_sasl.py 2.1.0-1/.evergreen/config_generator/components/sanitizers/tsan_sasl.py
--- 2.0.2-1/.evergreen/config_generator/components/sanitizers/tsan_sasl.py	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/.evergreen/config_generator/components/sanitizers/tsan_sasl.py	2025-08-14 18:37:23.000000000 +0000
@@ -10,15 +10,12 @@ from config_generator.components.sanitiz
 # pylint: disable=line-too-long
 # fmt: off
 COMPILE_MATRIX = [
-    ('ubuntu2004', 'clang', None, ['cyrus']),
-    ('debian10',   'clang', None, ['cyrus']),
+    ('rhel8-latest', 'clang', None, ['cyrus']),
 ]
 
 TEST_OPENSSL_MATRIX = [
-    ('ubuntu2004', 'clang', None, 'cyrus', ['auth'], ['server', 'replica', 'sharded'], ['4.4', '5.0', '6.0', '7.0', '8.0', 'latest']),
-
-    # Test 4.2 with Debian 10 since 4.2 does not ship on Ubuntu 20.04+.
-    ('debian10',   'clang', None, 'cyrus', ['auth'], ['server', 'replica', 'sharded'], ['4.2']), 
+    # rhel8-latest provides 4.2 through latest.
+    ('rhel8-latest', 'clang', None, 'cyrus', ['auth'], ['server', 'replica', 'sharded'], ['4.2', '4.4', '5.0', '6.0', '7.0', '8.0', 'latest']),
 ]
 # fmt: on
 # pylint: enable=line-too-long
diff -pruN 2.0.2-1/.evergreen/config_generator/components/sasl/darwinssl.py 2.1.0-1/.evergreen/config_generator/components/sasl/darwinssl.py
--- 2.0.2-1/.evergreen/config_generator/components/sasl/darwinssl.py	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/.evergreen/config_generator/components/sasl/darwinssl.py	2025-08-14 18:37:23.000000000 +0000
@@ -22,7 +22,7 @@ COMPILE_MATRIX = [
 ]
 
 TEST_MATRIX = [
-    ('macos-14', 'clang', None, 'cyrus', ['auth'], ['server'], ['4.0', '4.2', '4.4', '5.0']),
+    ('macos-14', 'clang', None, 'cyrus', ['auth'], ['server'], ['4.2', '4.4', '5.0']),
 
     ('macos-11-arm64', 'clang', None, 'cyrus', ['auth'], ['server'], ['6.0', '7.0',                ]),
     ('macos-14-arm64', 'clang', None, 'cyrus', ['auth'], ['server'], ['6.0', '7.0', '8.0', 'latest']),
diff -pruN 2.0.2-1/.evergreen/config_generator/components/sasl/nossl.py 2.1.0-1/.evergreen/config_generator/components/sasl/nossl.py
--- 2.0.2-1/.evergreen/config_generator/components/sasl/nossl.py	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/.evergreen/config_generator/components/sasl/nossl.py	2025-08-14 18:37:23.000000000 +0000
@@ -15,16 +15,17 @@ TAG = f'sasl-matrix-{SSL}'
 # pylint: disable=line-too-long
 # fmt: off
 COMPILE_MATRIX = [
-    ('ubuntu2004',        'gcc',         None,   ['off']),
-    ('windows-vsCurrent', 'vs2017x64',   None,   ['off']),
-    ('debian10',          'gcc',         None,   ['off']),
+    # For test matrix.
+    ('rhel8-latest', 'gcc', None, ['off']),
+
+    # For compile only.
+    ('ubuntu2204', 'gcc', None, ['off']),
+    ('ubuntu2404', 'gcc', None, ['off']),
+    ('windows-vsCurrent', 'vs2017x64', None, ['off']),
 ]
 
 TEST_MATRIX = [
-    ('ubuntu2004', 'gcc', None, 'off', ['noauth'], ['server', 'replica', 'sharded'], ['4.4', '5.0', '6.0', '7.0', '8.0', 'latest']),
-
-    # Test 4.2 with Debian 10 since 4.2 does not ship on Ubuntu 20.04+.
-    ('debian10',   'gcc', None, 'off', ['noauth'], ['server', 'replica', 'sharded'], ['4.2']), 
+    ('rhel8-latest', 'gcc', None, 'off', ['noauth'], ['server', 'replica', 'sharded'], ['4.2', '4.4', '5.0', '6.0', '7.0', '8.0', 'latest']),
 ]
 # fmt: on
 # pylint: enable=line-too-long
diff -pruN 2.0.2-1/.evergreen/config_generator/components/sasl/openssl.py 2.1.0-1/.evergreen/config_generator/components/sasl/openssl.py
--- 2.0.2-1/.evergreen/config_generator/components/sasl/openssl.py	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/.evergreen/config_generator/components/sasl/openssl.py	2025-08-14 18:37:23.000000000 +0000
@@ -15,31 +15,33 @@ TAG = f'sasl-matrix-{SSL}'
 # pylint: disable=line-too-long
 # fmt: off
 COMPILE_MATRIX = [
-    ('debian92',          'clang',      None, ['cyrus']),
-    ('debian92',          'gcc',        None, ['cyrus']),
-    ('debian10',          'gcc',        None, ['cyrus']),
-    ('debian11',          'gcc',        None, ['cyrus']),
-    ('rhel80',            'gcc',        None, ['cyrus']),
+    # For test matrix.
+    ('amazon2023-arm64-latest-large-m8g', 'gcc', None, ['cyrus']),
+    ('rhel8-latest',      'gcc',        None, ['cyrus']),
     ('rhel8-power',       'gcc',        None, ['cyrus']),
     ('rhel8-zseries',     'gcc',        None, ['cyrus']),
-    ('ubuntu2004',        'clang',      None, ['cyrus']),
     ('ubuntu2004-arm64',  'gcc',        None, ['cyrus']),
-    ('ubuntu2004',        'gcc',        None, ['cyrus']),
     ('windows-vsCurrent', 'vs2017x64',  None, ['cyrus']),
-    ('amazon2023-arm64-latest-large-m8g', 'gcc', None, ['cyrus']),
+
+    # For compile only.
+    ('debian11',   'gcc',      None, ['cyrus']),
+    ('debian12',   'gcc',      None, ['cyrus']),
+    ('rhel80',     'gcc',      None, ['cyrus']),
+    ('ubuntu2004', 'clang',    None, ['cyrus']),
+    ('ubuntu2204', 'gcc',      None, ['cyrus']),
+    ('ubuntu2204', 'clang-12', None, ['cyrus']),
+    ('ubuntu2404', 'gcc',      None, ['cyrus']),
+    ('ubuntu2404', 'clang-14', None, ['cyrus']),
 ]
 
 TEST_MATRIX = [
-    ('rhel8-power',  'gcc', None, 'cyrus', ['auth'], ['server'], ['4.2', '4.4', '5.0', '6.0', '7.0', '8.0', 'latest']),
+    ('rhel8-latest',  'gcc', None, 'cyrus', ['auth'], ['server'], ['4.2', '4.4', '5.0', '6.0', '7.0', '8.0', 'latest']),
+    ('rhel8-power',   'gcc', None, 'cyrus', ['auth'], ['server'], ['4.2', '4.4', '5.0', '6.0', '7.0', '8.0', 'latest']),
     ('rhel8-zseries', 'gcc', None, 'cyrus', ['auth'], ['server'], [              '5.0', '6.0', '7.0', '8.0', 'latest']),
 
     ('ubuntu2004-arm64',  'gcc',       None, 'cyrus', ['auth'], ['server'], ['4.4', '5.0', '6.0', '7.0', '8.0', 'latest']),
-    ('ubuntu2004',        'gcc',       None, 'cyrus', ['auth'], ['server'], ['4.4', '5.0', '6.0', '7.0', '8.0', 'latest']),
     ('windows-vsCurrent', 'vs2017x64', None, 'cyrus', ['auth'], ['server'], [       'latest']),
 
-    # Test 4.2 with Debian 10 since 4.2 does not ship on Ubuntu 20.04+.
-    ('debian10',          'gcc',       None, 'cyrus', ['auth'], ['server', 'replica'], ['4.2']), 
-
     # Test with Graviton processor:
     ('amazon2023-arm64-latest-large-m8g', 'gcc',  None, 'cyrus', ['auth'], ['server', 'replica', 'sharded'], ['latest']),
 ]
@@ -100,6 +102,8 @@ def variants():
         else:
             tasks.append(task.get_task_ref())
 
+    tasks.sort(key=lambda t: t.name)
+
     return [
         BuildVariant(
             name=TAG,
diff -pruN 2.0.2-1/.evergreen/config_generator/components/sasl/winssl.py 2.1.0-1/.evergreen/config_generator/components/sasl/winssl.py
--- 2.0.2-1/.evergreen/config_generator/components/sasl/winssl.py	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/.evergreen/config_generator/components/sasl/winssl.py	2025-08-14 18:37:23.000000000 +0000
@@ -21,7 +21,7 @@ COMPILE_MATRIX = [
 ]
 
 TEST_MATRIX = [
-    ('windows-vsCurrent', 'vs2017x64', None, 'sspi', ['auth'], ['server'], ['4.0', '4.2', '4.4', '5.0', '6.0', '7.0', '8.0', 'latest']),
+    ('windows-vsCurrent', 'vs2017x64', None, 'sspi', ['auth'], ['server'], ['4.2', '4.4', '5.0', '6.0', '7.0', '8.0', 'latest']),
 
     ('windows-vsCurrent', 'mingw',     None, 'sspi',  ['auth'], ['server'], ['8.0', 'latest']),
     ('windows-vsCurrent', 'vs2017x86', None, 'sspi',  ['auth'], ['server'], ['8.0', 'latest']),
diff -pruN 2.0.2-1/.evergreen/config_generator/components/sbom.py 2.1.0-1/.evergreen/config_generator/components/sbom.py
--- 2.0.2-1/.evergreen/config_generator/components/sbom.py	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/.evergreen/config_generator/components/sbom.py	2025-08-14 18:37:23.000000000 +0000
@@ -3,11 +3,17 @@ from config_generator.etc.function impor
 from config_generator.etc.utils import bash_exec
 
 from shrub.v3.evg_build_variant import BuildVariant
-from shrub.v3.evg_command import BuiltInCommand, EvgCommandType, expansions_update, s3_put
+from shrub.v3.evg_command import (
+    BuiltInCommand,
+    EvgCommandType,
+    KeyValueParam,
+    ec2_assume_role,
+    expansions_update,
+    s3_put,
+)
 from shrub.v3.evg_task import EvgTask, EvgTaskRef
 
 from pydantic import ConfigDict
-from typing import Optional
 
 
 TAG = 'sbom'
@@ -18,56 +24,58 @@ class CustomCommand(BuiltInCommand):
     model_config = ConfigDict(arbitrary_types_allowed=True)
 
 
-def ec2_assume_role(
-    role_arn: Optional[str] = None,
-    policy: Optional[str] = None,
-    duration_seconds: Optional[int] = None,
-    command_type: Optional[EvgCommandType] = None,
-) -> CustomCommand:
-    return CustomCommand(
-        command="ec2.assume_role",
-        params={
-            "role_arn": role_arn,
-            "policy": policy,
-            "duration_seconds": duration_seconds,
-        },
-        type=command_type,
-    )
-
-
 class SBOM(Function):
     name = 'sbom'
     commands = [
-        ec2_assume_role(
-            command_type=EvgCommandType.SETUP,
-            role_arn='${kondukto_role_arn}',
-        ),
-        bash_exec(
-            command_type=EvgCommandType.SETUP,
-            include_expansions_in_env=[
-                'AWS_ACCESS_KEY_ID',
-                'AWS_SECRET_ACCESS_KEY',
-                'AWS_SESSION_TOKEN',
-            ],
-            script='''\
+        # Authenticate with Kondukto.
+        *[
+            ec2_assume_role(
+                command_type=EvgCommandType.SETUP,
+                role_arn='${kondukto_role_arn}',
+            ),
+            bash_exec(
+                command_type=EvgCommandType.SETUP,
+                include_expansions_in_env=[
+                    'AWS_ACCESS_KEY_ID',
+                    'AWS_SECRET_ACCESS_KEY',
+                    'AWS_SESSION_TOKEN',
+                ],
+                script='''\
                 set -o errexit
                 set -o pipefail
                 kondukto_token="$(aws secretsmanager get-secret-value --secret-id "kondukto-token" --region "us-east-1" --query 'SecretString' --output text)"
                 printf "KONDUKTO_TOKEN: %s\\n" "$kondukto_token" >|expansions.kondukto.yml
             ''',
-        ),
-        expansions_update(
-            command_type=EvgCommandType.SETUP,
-            file='expansions.kondukto.yml',
-        ),
+            ),
+            expansions_update(
+                command_type=EvgCommandType.SETUP,
+                file='expansions.kondukto.yml',
+            ),
+        ],
+        # Authenticate with Amazon ECR.
+        *[
+            # Avoid inadvertently using a pre-existing and potentially conflicting Podman config.
+            # Note: podman understands and uses DOCKER_CONFIG despite the name.
+            expansions_update(updates=[KeyValueParam(key='DOCKER_CONFIG', value='${workdir}/.docker')]),
+            ec2_assume_role(role_arn="arn:aws:iam::901841024863:role/ecr-role-evergreen-ro"),
+            bash_exec(
+                command_type=EvgCommandType.SETUP,
+                include_expansions_in_env=[
+                    "AWS_ACCESS_KEY_ID",
+                    "AWS_SECRET_ACCESS_KEY",
+                    "AWS_SESSION_TOKEN",
+                    "DOCKER_CONFIG",
+                ],
+                script='aws ecr get-login-password --region us-east-1 | podman login --username AWS --password-stdin 901841024863.dkr.ecr.us-east-1.amazonaws.com',
+            ),
+        ],
         bash_exec(
             command_type=EvgCommandType.TEST,
             working_dir='mongoc',
             include_expansions_in_env=[
-                'artifactory_password',
-                'artifactory_username',
                 'branch_name',
-                'KONDUKTO_TOKEN',
+                'DOCKER_CONFIG',
+                "KONDUKTO_TOKEN",
             ],
             script='.evergreen/scripts/sbom.sh',
         ),
@@ -84,10 +92,6 @@ class SBOM(Function):
         ),
     ]
 
-    @classmethod
-    def call(cls, **kwargs):
-        return cls.default_call(**kwargs)
-
 
 def functions():
     return merge_defns(
diff -pruN 2.0.2-1/.evergreen/config_generator/components/scan_build.py 2.1.0-1/.evergreen/config_generator/components/scan_build.py
--- 2.0.2-1/.evergreen/config_generator/components/scan_build.py	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/.evergreen/config_generator/components/scan_build.py	2025-08-14 18:37:23.000000000 +0000
@@ -38,10 +38,6 @@ class ScanBuild(Function):
         ),
     ]
 
-    @classmethod
-    def call(cls, **kwargs):
-        return cls.default_call(**kwargs)
-
 
 def functions():
     return ScanBuild.defn()
diff -pruN 2.0.2-1/.evergreen/config_generator/etc/cse/compile.py 2.1.0-1/.evergreen/config_generator/etc/cse/compile.py
--- 2.0.2-1/.evergreen/config_generator/etc/cse/compile.py	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/.evergreen/config_generator/etc/cse/compile.py	2025-08-14 18:37:23.000000000 +0000
@@ -35,7 +35,3 @@ class CompileCommon(Function):
                 },
             ),
         ]
-
-    @classmethod
-    def call(cls, **kwargs):
-        return cls.default_call(**kwargs)
diff -pruN 2.0.2-1/.evergreen/config_generator/etc/cse/test.py 2.1.0-1/.evergreen/config_generator/etc/cse/test.py
--- 2.0.2-1/.evergreen/config_generator/etc/cse/test.py	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/.evergreen/config_generator/etc/cse/test.py	2025-08-14 18:37:23.000000000 +0000
@@ -4,7 +4,7 @@ from shrub.v3.evg_command import expansi
 from shrub.v3.evg_command import KeyValueParam
 from shrub.v3.evg_task import EvgTask, EvgTaskDependency
 
-from config_generator.etc.distros import find_small_distro
+from config_generator.etc.distros import find_large_distro, find_small_distro
 from config_generator.etc.distros import make_distro_str
 from config_generator.etc.distros import compiler_to_vars
 
@@ -26,7 +26,10 @@ def generate_test_tasks(SSL, TAG, MATRIX
 
     for distro_name, compiler, arch, sasl, auths, topologies, server_vers in MATRIX:
         tags = [TAG, 'test', distro_name, compiler, f'sasl-{sasl}', 'cse']
-        test_distro = find_small_distro(distro_name)
+        if distro_name == 'rhel8-latest':
+            test_distro = find_large_distro(distro_name) # DEVPROD-18763
+        else:
+            test_distro = find_small_distro(distro_name)
 
         compile_vars = []
         compile_vars = [KeyValueParam(key=key, value=value) for key, value in compiler_to_vars(compiler).items()]
diff -pruN 2.0.2-1/.evergreen/config_generator/etc/distros.py 2.1.0-1/.evergreen/config_generator/etc/distros.py
--- 2.0.2-1/.evergreen/config_generator/etc/distros.py	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/.evergreen/config_generator/etc/distros.py	2025-08-14 18:37:23.000000000 +0000
@@ -28,8 +28,6 @@ class Distro(BaseModel):
         '2019',
         '2022',
         'vsCurrent',
-        'vsCurrent2',
-        'vsMulti',
     ] | None = None
     size: Literal['small', 'large'] | None = None
     arch: Literal['arm64', 'power', 'zseries'] | None = None
@@ -37,7 +35,7 @@ class Distro(BaseModel):
     @validator('os_ver')
     @classmethod
     def validate_os_ver(cls, value):
-        return Version(value)
+        return value == 'latest' or Version(value)
 
 
 def ls_distro(name, **kwargs):
@@ -48,9 +46,8 @@ def ls_distro(name, **kwargs):
 
 
 DEBIAN_DISTROS = [
-    *ls_distro(name='debian92', os='debian', os_type='linux', os_ver='9.2'),  # CDRIVER-5873
-    *ls_distro(name='debian10', os='debian', os_type='linux', os_ver='10'),  # CDRIVER-5874
     *ls_distro(name='debian11', os='debian', os_type='linux', os_ver='11'),
+    *ls_distro(name='debian12', os='debian', os_type='linux', os_ver='12'),
 ]
 
 MACOS_DISTROS = [
@@ -63,7 +60,9 @@ MACOS_ARM64_DISTROS = [
 ]
 
 RHEL_DISTROS = [
-    *ls_distro(name='rhel76', os='rhel', os_type='linux', os_ver='7.6'),
+    *ls_distro(name='rhel7-latest', os='rhel', os_type='linux', os_ver='7'),
+    *ls_distro(name='rhel8-latest', os='rhel', os_type='linux', os_ver='8'),
+
     *ls_distro(name='rhel80', os='rhel', os_type='linux', os_ver='8.0'),
     *ls_distro(name='rhel84', os='rhel', os_type='linux', os_ver='8.4'),
     *ls_distro(name='rhel90', os='rhel', os_type='linux', os_ver='9.0'),
@@ -71,9 +70,7 @@ RHEL_DISTROS = [
     *ls_distro(name='rhel92', os='rhel', os_type='linux', os_ver='9.2'),
     *ls_distro(name='rhel93', os='rhel', os_type='linux', os_ver='9.3'),
     *ls_distro(name='rhel94', os='rhel', os_type='linux', os_ver='9.4'),
-    *ls_distro(name='rhel95', os='rhel', os_type='linux', os_ver='9.5'),
-    *ls_distro(name='rhel8.9', os='rhel', os_type='linux', os_ver='8.7'),
-    *ls_distro(name='rhel92', os='rhel', os_type='linux', os_ver='9.0'),
+    *ls_distro(name='rhel95', os='rhel', os_type='linux', os_ver='9.5'), # rhel9-latest
 ]
 
 RHEL_POWER_DISTROS = [
@@ -87,6 +84,7 @@ RHEL_ZSERIES_DISTROS = [
 UBUNTU_DISTROS = [
     *ls_distro(name='ubuntu2004', os='ubuntu', os_type='linux', os_ver='20.04'),
     *ls_distro(name='ubuntu2204', os='ubuntu', os_type='linux', os_ver='22.04'),
+    *ls_distro(name='ubuntu2404', os='ubuntu', os_type='linux', os_ver='24.04'),
 ]
 
 UBUNTU_ARM64_DISTROS = [
@@ -94,9 +92,6 @@ UBUNTU_ARM64_DISTROS = [
 ]
 
 WINDOWS_DISTROS = [
-    *ls_distro(name='windows-64-vs2017', os='windows', os_type='windows', vs_ver='2017'),
-    *ls_distro(name='windows-64-vs2019', os='windows', os_type='windows', vs_ver='2019'),
-
     *ls_distro(name='windows-vsCurrent', os='windows', os_type='windows', vs_ver='vsCurrent'),  # Windows Server 2019
 ]
 
@@ -109,6 +104,7 @@ GRAVITON_DISTROS = [
 # Ensure no-arch distros are ordered before arch-specific distros.
 ALL_DISTROS = [
     *DEBIAN_DISTROS,
+    *GRAVITON_DISTROS,
     *MACOS_DISTROS,
     *MACOS_ARM64_DISTROS,
     *RHEL_DISTROS,
@@ -117,7 +113,6 @@ ALL_DISTROS = [
     *UBUNTU_DISTROS,
     *UBUNTU_ARM64_DISTROS,
     *WINDOWS_DISTROS,
-    *GRAVITON_DISTROS
 ]
 
 
@@ -165,20 +160,7 @@ def make_distro_str(distro_name, compile
             distro_str = 'windows-' + \
                 distro_name[len('windows-vsCurrent-'):] + f'-{compiler_str}'
         else:
-            distro_str = 'windows-2019' + f'-{compiler_str}'
-    elif distro_name.startswith('windows-64-vs'):
-        # Abbreviate 'windows-64-vs<type>' as 'vs<type>' and append '-<arch>' if
-        # given in compiler string as 'vs<type><arch>', e.g.:
-        #     ('windows-64-vs2017', 'vs2017x64', None) -> vs2017-x64
-        #     ('windows-64-vs2017', 'mingw',     None) -> vs2017-mingw
-        distro_str = distro_name[len('windows-64-'):] + {
-            'vs2017x64': '-x64',
-            'vs2017x86': '-x86',
-            'vs2019x64': '-x64',
-            'vs2019x86': '-x86',
-            'vs2022x64': '-x64',
-            'vs2022x86': '-x86',
-        }.get(compiler, f'-{compiler}')
+            distro_str = 'windows-2019-' + compiler_str
     else:
         distro_str = distro_name
         if compiler:
@@ -192,6 +174,8 @@ def make_distro_str(distro_name, compile
 
 def to_cc(compiler):
     return {
+        'vs2015x64': 'Visual Studio 14 2015',
+        'vs2015x86': 'Visual Studio 14 2015',
         'vs2017x64': 'Visual Studio 15 2017',
         'vs2017x86': 'Visual Studio 15 2017',
         'vs2019x64': 'Visual Studio 16 2019',
@@ -203,6 +187,8 @@ def to_cc(compiler):
 
 def to_platform(compiler):
     return {
+        'vs2015x64': 'x64',
+        'vs2015x86': 'Win32',
         'vs2017x64': 'x64',
         'vs2017x86': 'Win32',
         'vs2019x64': 'x64',
@@ -213,6 +199,9 @@ def to_platform(compiler):
 
 
 def compiler_to_vars(compiler):
+    if compiler is None:
+        return {}
+
     match compiler, compiler.split('-'):
         case _, ['gcc', *rest]:
             return {
@@ -232,6 +221,12 @@ def compiler_to_vars(compiler):
                 'CMAKE_GENERATOR_PLATFORM': to_platform(vs),
             }
 
+        case _, ['mingw', *rest]:
+            return {
+                'CC': '-'.join(['gcc'] + rest),
+                'CXX': '-'.join(['g++'] + rest),
+            }
+
         case compiler, _:
             return {
                 'CC': compiler,
diff -pruN 2.0.2-1/.evergreen/config_generator/etc/function.py 2.1.0-1/.evergreen/config_generator/etc/function.py
--- 2.0.2-1/.evergreen/config_generator/etc/function.py	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/.evergreen/config_generator/etc/function.py	2025-08-14 18:37:23.000000000 +0000
@@ -18,6 +18,10 @@ class Function:
     def default_call(cls, **kwargs) -> FunctionCall:
         return FunctionCall(func=cls.name, **kwargs)
 
+    @classmethod
+    def call(cls, **kwargs) -> FunctionCall:
+        return cls.default_call(**kwargs)
+
 
 def merge_defns(*args):
     return ChainMap(*args)
diff -pruN 2.0.2-1/.evergreen/config_generator/etc/sanitizers/test.py 2.1.0-1/.evergreen/config_generator/etc/sanitizers/test.py
--- 2.0.2-1/.evergreen/config_generator/etc/sanitizers/test.py	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/.evergreen/config_generator/etc/sanitizers/test.py	2025-08-14 18:37:23.000000000 +0000
@@ -4,7 +4,7 @@ from shrub.v3.evg_command import expansi
 from shrub.v3.evg_command import KeyValueParam
 from shrub.v3.evg_task import EvgTask, EvgTaskDependency
 
-from config_generator.etc.distros import find_small_distro
+from config_generator.etc.distros import find_large_distro, find_small_distro
 from config_generator.etc.distros import make_distro_str
 from config_generator.etc.distros import compiler_to_vars
 
@@ -34,7 +34,10 @@ def generate_test_tasks(SSL, TAG, MATRIX
             TAG, 'test', distro_name, compiler, f'sasl-{sasl}'
         ] + MORE_COMPILE_TAGS
 
-        test_distro = find_small_distro(distro_name)
+        if distro_name == 'rhel8-latest':
+            test_distro = find_large_distro(distro_name) # DEVPROD-18763
+        else:
+            test_distro = find_small_distro(distro_name)
 
         compile_vars = []
         compile_vars = [KeyValueParam(key=key, value=value) for key, value in compiler_to_vars(compiler).items()]
diff -pruN 2.0.2-1/.evergreen/config_generator/etc/sasl/compile.py 2.1.0-1/.evergreen/config_generator/etc/sasl/compile.py
--- 2.0.2-1/.evergreen/config_generator/etc/sasl/compile.py	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/.evergreen/config_generator/etc/sasl/compile.py	2025-08-14 18:37:23.000000000 +0000
@@ -30,7 +30,3 @@ class CompileCommon(Function):
                 script='.evergreen/scripts/compile.sh',
             ),
         ]
-
-    @classmethod
-    def call(cls, **kwargs):
-        return cls.default_call(**kwargs)
diff -pruN 2.0.2-1/.evergreen/config_generator/etc/sasl/test.py 2.1.0-1/.evergreen/config_generator/etc/sasl/test.py
--- 2.0.2-1/.evergreen/config_generator/etc/sasl/test.py	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/.evergreen/config_generator/etc/sasl/test.py	2025-08-14 18:37:23.000000000 +0000
@@ -4,7 +4,7 @@ from shrub.v3.evg_command import expansi
 from shrub.v3.evg_command import KeyValueParam
 from shrub.v3.evg_task import EvgTask, EvgTaskDependency
 
-from config_generator.etc.distros import find_small_distro
+from config_generator.etc.distros import find_large_distro, find_small_distro
 from config_generator.etc.distros import make_distro_str
 from config_generator.etc.distros import compiler_to_vars
 
@@ -26,7 +26,10 @@ def generate_test_tasks(SSL, TAG, MATRIX
 
     for distro_name, compiler, arch, sasl, auths, topologies, server_vers in MATRIX:
         tags = [TAG, 'test', distro_name, compiler]
-        test_distro = find_small_distro(distro_name)
+        if distro_name == 'rhel8-latest':
+            test_distro = find_large_distro(distro_name) # DEVPROD-18763
+        else:
+            test_distro = find_small_distro(distro_name)
 
         compile_vars = []
         compile_vars = [KeyValueParam(key=key, value=value) for key, value in compiler_to_vars(compiler).items()]
diff -pruN 2.0.2-1/.evergreen/generated_configs/functions.yml 2.1.0-1/.evergreen/generated_configs/functions.yml
--- 2.0.2-1/.evergreen/generated_configs/functions.yml	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/.evergreen/generated_configs/functions.yml	2025-08-14 18:37:23.000000000 +0000
@@ -62,7 +62,7 @@ functions:
         content_type: text/html
         local_files_include_filter: abi-compliance/compat_reports/**/compat_report.html
         permissions: public-read
-        remote_file: mongo-c-driver/${branch_name}/${revision}/${version_id}/${build_id}/${task_id}/${execution}/abi-compliance-check/
+        remote_file: ${project}/${branch_name}/${revision}/${version_id}/${build_id}/${task_id}/${execution}/abi-compliance-check/
     - command: s3.put
       type: system
       params:
@@ -73,7 +73,7 @@ functions:
         content_type: text/plain
         local_files_include_filter: abi-compliance/logs/**/log.txt
         permissions: public-read
-        remote_file: mongo-c-driver/${branch_name}/${revision}/${version_id}/${build_id}/${task_id}/${execution}/abi-compliance-check/
+        remote_file: ${project}/${branch_name}/${revision}/${version_id}/${build_id}/${task_id}/${execution}/abi-compliance-check/
   backtrace:
     - command: subprocess.exec
       params:
@@ -115,14 +115,6 @@ functions:
           - .evergreen/scripts/check-preludes.py .
   clang-format:
     - command: subprocess.exec
-      type: setup
-      params:
-        binary: bash
-        working_dir: mongoc
-        args:
-          - -c
-          - ./tools/poetry.sh install --with=dev
-    - command: subprocess.exec
       type: test
       params:
         binary: bash
@@ -131,7 +123,7 @@ functions:
           DRYRUN: "1"
         args:
           - -c
-          - ./tools/poetry.sh run .evergreen/scripts/clang-format-all.sh
+          - uv run --frozen --only-group=format tools/format.py --mode=check
   cse-sasl-cyrus-darwinssl-compile:
     - command: expansions.update
       params:
@@ -183,6 +175,26 @@ functions:
         args:
           - -c
           - EXTRA_CONFIGURE_FLAGS="-DENABLE_PIC=ON ${EXTRA_CONFIGURE_FLAGS}" .evergreen/scripts/compile.sh
+  docker-login-amazon-ecr:
+    - command: expansions.update
+      params:
+        updates:
+          - { key: DOCKER_CONFIG, value: "${workdir}/.docker" }
+    - command: ec2.assume_role
+      params:
+        role_arn: arn:aws:iam::901841024863:role/ecr-role-evergreen-ro
+    - command: subprocess.exec
+      type: setup
+      params:
+        binary: bash
+        include_expansions_in_env:
+          - AWS_ACCESS_KEY_ID
+          - AWS_SECRET_ACCESS_KEY
+          - AWS_SESSION_TOKEN
+          - DOCKER_CONFIG
+        args:
+          - -c
+          - aws ecr get-login-password --region us-east-1 | docker login --username AWS --password-stdin 901841024863.dkr.ecr.us-east-1.amazonaws.com
   fetch-build:
     - command: subprocess.exec
       type: setup
@@ -313,10 +325,8 @@ functions:
         args:
           - -c
           - |
-            set -o errexit
-            ./tools/poetry.sh install --with=docs
             # See SphinxBuild.cmake for EVG_DOCS_BUILD reasoning
-            ./tools/poetry.sh run env EVG_DOCS_BUILD=1 .evergreen/scripts/build-docs.sh
+            uv run --frozen --only-group docs env EVG_DOCS_BUILD=1 .evergreen/scripts/build-docs.sh
   openssl-static-compile:
     - command: subprocess.exec
       type: test
@@ -516,15 +526,33 @@ functions:
       type: setup
       params:
         file: expansions.kondukto.yml
+    - command: expansions.update
+      params:
+        updates:
+          - { key: DOCKER_CONFIG, value: "${workdir}/.docker" }
+    - command: ec2.assume_role
+      params:
+        role_arn: arn:aws:iam::901841024863:role/ecr-role-evergreen-ro
+    - command: subprocess.exec
+      type: setup
+      params:
+        binary: bash
+        include_expansions_in_env:
+          - AWS_ACCESS_KEY_ID
+          - AWS_SECRET_ACCESS_KEY
+          - AWS_SESSION_TOKEN
+          - DOCKER_CONFIG
+        args:
+          - -c
+          - aws ecr get-login-password --region us-east-1 | podman login --username AWS --password-stdin 901841024863.dkr.ecr.us-east-1.amazonaws.com
     - command: subprocess.exec
       type: test
       params:
         binary: bash
         working_dir: mongoc
         include_expansions_in_env:
-          - artifactory_password
-          - artifactory_username
           - branch_name
+          - DOCKER_CONFIG
           - KONDUKTO_TOKEN
         args:
           - -c
diff -pruN 2.0.2-1/.evergreen/generated_configs/legacy-config.yml 2.1.0-1/.evergreen/generated_configs/legacy-config.yml
--- 2.0.2-1/.evergreen/generated_configs/legacy-config.yml	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/.evergreen/generated_configs/legacy-config.yml	2025-08-14 18:37:23.000000000 +0000
@@ -212,9 +212,16 @@ functions:
         set -o errexit
         COVERAGE=ON .evergreen/scripts/compile.sh
   build mongohouse:
+  - command: ec2.assume_role
+    params:
+      role_arn: ${aws_test_secrets_role}
   - command: shell.exec
     type: test
     params:
+      include_expansions_in_env:
+      - AWS_ACCESS_KEY_ID
+      - AWS_SECRET_ACCESS_KEY
+      - AWS_SESSION_TOKEN
       shell: bash
       script: |-
         set -o errexit
@@ -790,57 +797,6 @@ tasks:
         sudo rm -rf ../build ../mock-result ../rpm.tar.gz
         export MOCK_TARGET_CONFIG=rocky+epel-8-aarch64
         .evergreen/scripts/build_snapshot_rpm.sh
-- name: install-uninstall-check-mingw
-  commands:
-  - func: find-cmake-latest
-  - command: shell.exec
-    type: test
-    params:
-      working_dir: mongoc
-      include_expansions_in_env:
-      - distro_id
-      shell: bash
-      script: |-
-        set -o errexit
-        . .evergreen/scripts/find-cmake-latest.sh
-        export CMAKE="$(find_cmake_latest)"
-        export CC="C:/mingw-w64/x86_64-4.9.1-posix-seh-rt_v3-rev1/mingw64/bin/gcc.exe"
-        BSON_ONLY=1 cmd.exe /c .\\.evergreen\\scripts\\install-uninstall-check-windows.cmd
-        cmd.exe /c .\\.evergreen\\scripts\\install-uninstall-check-windows.cmd
-- name: install-uninstall-check-msvc
-  commands:
-  - func: find-cmake-latest
-  - command: shell.exec
-    type: test
-    params:
-      working_dir: mongoc
-      include_expansions_in_env:
-      - distro_id
-      shell: bash
-      script: |-
-        set -o errexit
-        . .evergreen/scripts/find-cmake-latest.sh
-        export CMAKE="$(find_cmake_latest)"
-        export CC="Visual Studio 14 2015 Win64"
-        BSON_ONLY=1 cmd.exe /c .\\.evergreen\\scripts\\install-uninstall-check-windows.cmd
-        cmd.exe /c .\\.evergreen\\scripts\\install-uninstall-check-windows.cmd
-- name: install-uninstall-check
-  commands:
-  - func: find-cmake-latest
-  - command: shell.exec
-    type: test
-    params:
-      working_dir: mongoc
-      include_expansions_in_env:
-      - distro_id
-      shell: bash
-      script: |-
-        set -o errexit
-        . .evergreen/scripts/find-cmake-latest.sh
-        export CMAKE="$(find_cmake_latest)"
-        DESTDIR="$(pwd)/dest" .evergreen/scripts/install-uninstall-check.sh
-        BSON_ONLY=1 .evergreen/scripts/install-uninstall-check.sh
-        .evergreen/scripts/install-uninstall-check.sh
 - name: debug-compile-with-warnings
   commands:
   - func: find-cmake-latest
@@ -16140,8 +16096,15 @@ task_groups:
 - name: testazurekms_task_group
   setup_group:
   - func: fetch-det
+  - command: ec2.assume_role
+    params:
+      role_arn: ${aws_test_secrets_role}
   - command: shell.exec
     params:
+      include_expansions_in_env:
+      - AWS_ACCESS_KEY_ID
+      - AWS_SECRET_ACCESS_KEY
+      - AWS_SESSION_TOKEN
       shell: bash
       script: |-
         set -o errexit
@@ -16236,12 +16199,10 @@ buildvariants:
   - link-with-cmake
   - link-with-cmake-ssl
   - link-with-cmake-snappy
+  - verify-headers
   - name: link-with-cmake-mac
     distros:
     - macos-14-arm64
-  - name: link-with-cmake-mac-deprecated
-    distros:
-    - macos-14-arm64
   - name: link-with-cmake-windows
     distros:
     - windows-vsCurrent-large
@@ -16272,17 +16233,10 @@ buildvariants:
     distros:
     - windows-vsCurrent-large
   - check-headers
-  - install-uninstall-check
-  - name: install-uninstall-check-mingw
-    distros:
-    - windows-vsCurrent-large
-  - name: install-uninstall-check-msvc
-    distros:
-    - windows-vsCurrent-large
   - debug-compile-with-warnings
   - name: build-and-test-with-toolchain
     distros:
-    - debian10-small
+    - debian11-small
   - install-libmongoc-after-libbson
   tags:
   - pr-merge-gate
@@ -16329,15 +16283,6 @@ buildvariants:
   - debug-compile-sasl-openssl
   - .authentication-tests .openssl
   - .latest .nossl
-- name: gcc83
-  display_name: GCC 8.3 (Debian 10.0)
-  expansions:
-    CC: gcc
-  run_on: debian10-test
-  tasks:
-  - release-compile
-  - debug-compile-nosasl-nossl
-  - .latest .nossl
 - name: gcc102
   display_name: GCC 10.2 (Debian 11.0)
   expansions:
@@ -16576,7 +16521,7 @@ buildvariants:
   - .versioned-api .8.0
 - name: testazurekms-variant
   display_name: Azure KMS
-  run_on: debian10-small
+  run_on: debian11-small
   tasks:
   - testazurekms_task_group
   - testazurekms-fail-task
diff -pruN 2.0.2-1/.evergreen/generated_configs/tasks.yml 2.1.0-1/.evergreen/generated_configs/tasks.yml
--- 2.0.2-1/.evergreen/generated_configs/tasks.yml	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/.evergreen/generated_configs/tasks.yml	2025-08-14 18:37:23.000000000 +0000
@@ -2,9 +2,9 @@ tasks:
   - name: abi-compliance-check
     commands:
       - func: abi-compliance-check
-  - name: asan-cse-sasl-cyrus-openssl-debian10-clang-compile
-    run_on: debian10-large
-    tags: [sanitizers-matrix-asan, compile, debian10, clang, cse, asan, sasl-cyrus]
+  - name: asan-cse-sasl-cyrus-openssl-rhel8-latest-clang-compile
+    run_on: rhel8-latest-large
+    tags: [sanitizers-matrix-asan, compile, rhel8-latest, clang, cse, asan, sasl-cyrus]
     commands:
       - func: find-cmake-latest
       - func: cse-sasl-cyrus-openssl-compile
@@ -12,14 +12,14 @@ tasks:
           CC: clang
           CXX: clang++
       - func: upload-build
-  - name: asan-cse-sasl-cyrus-openssl-debian10-clang-test-4.2-server-auth
-    run_on: debian10-small
-    tags: [sanitizers-matrix-asan, test, debian10, clang, sasl-cyrus, cse, asan, auth, server, "4.2", openssl]
-    depends_on: [{ name: asan-cse-sasl-cyrus-openssl-debian10-clang-compile }]
+  - name: asan-cse-sasl-cyrus-openssl-rhel8-latest-clang-test-4.2-replica-auth
+    run_on: rhel8-latest-large
+    tags: [sanitizers-matrix-asan, test, rhel8-latest, clang, sasl-cyrus, cse, asan, auth, replica, "4.2", openssl]
+    depends_on: [{ name: asan-cse-sasl-cyrus-openssl-rhel8-latest-clang-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: asan-cse-sasl-cyrus-openssl-debian10-clang-compile
+          BUILD_NAME: asan-cse-sasl-cyrus-openssl-rhel8-latest-clang-compile
       - command: expansions.update
         params:
           updates:
@@ -27,7 +27,7 @@ tasks:
             - { key: CXX, value: clang++ }
             - { key: AUTH, value: auth }
             - { key: MONGODB_VERSION, value: "4.2" }
-            - { key: TOPOLOGY, value: server }
+            - { key: TOPOLOGY, value: replica_set }
             - { key: SSL, value: openssl }
             - { key: CLIENT_SIDE_ENCRYPTION, value: "on" }
       - func: fetch-det
@@ -35,14 +35,14 @@ tasks:
       - func: run-simple-http-server
       - func: run-mock-kms-servers
       - func: run-tests
-  - name: asan-cse-sasl-cyrus-openssl-debian10-clang-test-4.2-server-auth-with-mongocrypt
-    run_on: debian10-small
-    tags: [sanitizers-matrix-asan, test, debian10, clang, sasl-cyrus, cse, asan, auth, server, "4.2", with-mongocrypt, openssl]
-    depends_on: [{ name: asan-cse-sasl-cyrus-openssl-debian10-clang-compile }]
+  - name: asan-cse-sasl-cyrus-openssl-rhel8-latest-clang-test-4.2-replica-auth-with-mongocrypt
+    run_on: rhel8-latest-large
+    tags: [sanitizers-matrix-asan, test, rhel8-latest, clang, sasl-cyrus, cse, asan, auth, replica, "4.2", with-mongocrypt, openssl]
+    depends_on: [{ name: asan-cse-sasl-cyrus-openssl-rhel8-latest-clang-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: asan-cse-sasl-cyrus-openssl-debian10-clang-compile
+          BUILD_NAME: asan-cse-sasl-cyrus-openssl-rhel8-latest-clang-compile
       - command: expansions.update
         params:
           updates:
@@ -50,7 +50,7 @@ tasks:
             - { key: CXX, value: clang++ }
             - { key: AUTH, value: auth }
             - { key: MONGODB_VERSION, value: "4.2" }
-            - { key: TOPOLOGY, value: server }
+            - { key: TOPOLOGY, value: replica_set }
             - { key: SSL, value: openssl }
             - { key: CLIENT_SIDE_ENCRYPTION, value: "on" }
             - { key: SKIP_CRYPT_SHARED_LIB, value: "on" }
@@ -59,24 +59,61 @@ tasks:
       - func: run-simple-http-server
       - func: run-mock-kms-servers
       - func: run-tests
-  - name: asan-cse-sasl-cyrus-openssl-ubuntu2004-clang-compile
-    run_on: ubuntu2004-large
-    tags: [sanitizers-matrix-asan, compile, ubuntu2004, clang, cse, asan, sasl-cyrus]
+  - name: asan-cse-sasl-cyrus-openssl-rhel8-latest-clang-test-4.2-server-auth
+    run_on: rhel8-latest-large
+    tags: [sanitizers-matrix-asan, test, rhel8-latest, clang, sasl-cyrus, cse, asan, auth, server, "4.2", openssl]
+    depends_on: [{ name: asan-cse-sasl-cyrus-openssl-rhel8-latest-clang-compile }]
     commands:
-      - func: find-cmake-latest
-      - func: cse-sasl-cyrus-openssl-compile
+      - func: fetch-build
         vars:
-          CC: clang
-          CXX: clang++
-      - func: upload-build
-  - name: asan-cse-sasl-cyrus-openssl-ubuntu2004-clang-test-4.4-replica-auth
-    run_on: ubuntu2004-small
-    tags: [sanitizers-matrix-asan, test, ubuntu2004, clang, sasl-cyrus, cse, asan, auth, replica, "4.4", openssl]
-    depends_on: [{ name: asan-cse-sasl-cyrus-openssl-ubuntu2004-clang-compile }]
+          BUILD_NAME: asan-cse-sasl-cyrus-openssl-rhel8-latest-clang-compile
+      - command: expansions.update
+        params:
+          updates:
+            - { key: CC, value: clang }
+            - { key: CXX, value: clang++ }
+            - { key: AUTH, value: auth }
+            - { key: MONGODB_VERSION, value: "4.2" }
+            - { key: TOPOLOGY, value: server }
+            - { key: SSL, value: openssl }
+            - { key: CLIENT_SIDE_ENCRYPTION, value: "on" }
+      - func: fetch-det
+      - func: bootstrap-mongo-orchestration
+      - func: run-simple-http-server
+      - func: run-mock-kms-servers
+      - func: run-tests
+  - name: asan-cse-sasl-cyrus-openssl-rhel8-latest-clang-test-4.2-server-auth-with-mongocrypt
+    run_on: rhel8-latest-large
+    tags: [sanitizers-matrix-asan, test, rhel8-latest, clang, sasl-cyrus, cse, asan, auth, server, "4.2", with-mongocrypt, openssl]
+    depends_on: [{ name: asan-cse-sasl-cyrus-openssl-rhel8-latest-clang-compile }]
+    commands:
+      - func: fetch-build
+        vars:
+          BUILD_NAME: asan-cse-sasl-cyrus-openssl-rhel8-latest-clang-compile
+      - command: expansions.update
+        params:
+          updates:
+            - { key: CC, value: clang }
+            - { key: CXX, value: clang++ }
+            - { key: AUTH, value: auth }
+            - { key: MONGODB_VERSION, value: "4.2" }
+            - { key: TOPOLOGY, value: server }
+            - { key: SSL, value: openssl }
+            - { key: CLIENT_SIDE_ENCRYPTION, value: "on" }
+            - { key: SKIP_CRYPT_SHARED_LIB, value: "on" }
+      - func: fetch-det
+      - func: bootstrap-mongo-orchestration
+      - func: run-simple-http-server
+      - func: run-mock-kms-servers
+      - func: run-tests
+  - name: asan-cse-sasl-cyrus-openssl-rhel8-latest-clang-test-4.4-replica-auth
+    run_on: rhel8-latest-large
+    tags: [sanitizers-matrix-asan, test, rhel8-latest, clang, sasl-cyrus, cse, asan, auth, replica, "4.4", openssl]
+    depends_on: [{ name: asan-cse-sasl-cyrus-openssl-rhel8-latest-clang-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: asan-cse-sasl-cyrus-openssl-ubuntu2004-clang-compile
+          BUILD_NAME: asan-cse-sasl-cyrus-openssl-rhel8-latest-clang-compile
       - command: expansions.update
         params:
           updates:
@@ -92,14 +129,14 @@ tasks:
       - func: run-simple-http-server
       - func: run-mock-kms-servers
       - func: run-tests
-  - name: asan-cse-sasl-cyrus-openssl-ubuntu2004-clang-test-4.4-replica-auth-with-mongocrypt
-    run_on: ubuntu2004-small
-    tags: [sanitizers-matrix-asan, test, ubuntu2004, clang, sasl-cyrus, cse, asan, auth, replica, "4.4", with-mongocrypt, openssl]
-    depends_on: [{ name: asan-cse-sasl-cyrus-openssl-ubuntu2004-clang-compile }]
+  - name: asan-cse-sasl-cyrus-openssl-rhel8-latest-clang-test-4.4-replica-auth-with-mongocrypt
+    run_on: rhel8-latest-large
+    tags: [sanitizers-matrix-asan, test, rhel8-latest, clang, sasl-cyrus, cse, asan, auth, replica, "4.4", with-mongocrypt, openssl]
+    depends_on: [{ name: asan-cse-sasl-cyrus-openssl-rhel8-latest-clang-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: asan-cse-sasl-cyrus-openssl-ubuntu2004-clang-compile
+          BUILD_NAME: asan-cse-sasl-cyrus-openssl-rhel8-latest-clang-compile
       - command: expansions.update
         params:
           updates:
@@ -116,14 +153,14 @@ tasks:
       - func: run-simple-http-server
       - func: run-mock-kms-servers
       - func: run-tests
-  - name: asan-cse-sasl-cyrus-openssl-ubuntu2004-clang-test-4.4-server-auth
-    run_on: ubuntu2004-small
-    tags: [sanitizers-matrix-asan, test, ubuntu2004, clang, sasl-cyrus, cse, asan, auth, server, "4.4", openssl]
-    depends_on: [{ name: asan-cse-sasl-cyrus-openssl-ubuntu2004-clang-compile }]
+  - name: asan-cse-sasl-cyrus-openssl-rhel8-latest-clang-test-4.4-server-auth
+    run_on: rhel8-latest-large
+    tags: [sanitizers-matrix-asan, test, rhel8-latest, clang, sasl-cyrus, cse, asan, auth, server, "4.4", openssl]
+    depends_on: [{ name: asan-cse-sasl-cyrus-openssl-rhel8-latest-clang-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: asan-cse-sasl-cyrus-openssl-ubuntu2004-clang-compile
+          BUILD_NAME: asan-cse-sasl-cyrus-openssl-rhel8-latest-clang-compile
       - command: expansions.update
         params:
           updates:
@@ -139,14 +176,14 @@ tasks:
       - func: run-simple-http-server
       - func: run-mock-kms-servers
       - func: run-tests
-  - name: asan-cse-sasl-cyrus-openssl-ubuntu2004-clang-test-4.4-server-auth-with-mongocrypt
-    run_on: ubuntu2004-small
-    tags: [sanitizers-matrix-asan, test, ubuntu2004, clang, sasl-cyrus, cse, asan, auth, server, "4.4", with-mongocrypt, openssl]
-    depends_on: [{ name: asan-cse-sasl-cyrus-openssl-ubuntu2004-clang-compile }]
+  - name: asan-cse-sasl-cyrus-openssl-rhel8-latest-clang-test-4.4-server-auth-with-mongocrypt
+    run_on: rhel8-latest-large
+    tags: [sanitizers-matrix-asan, test, rhel8-latest, clang, sasl-cyrus, cse, asan, auth, server, "4.4", with-mongocrypt, openssl]
+    depends_on: [{ name: asan-cse-sasl-cyrus-openssl-rhel8-latest-clang-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: asan-cse-sasl-cyrus-openssl-ubuntu2004-clang-compile
+          BUILD_NAME: asan-cse-sasl-cyrus-openssl-rhel8-latest-clang-compile
       - command: expansions.update
         params:
           updates:
@@ -163,14 +200,14 @@ tasks:
       - func: run-simple-http-server
       - func: run-mock-kms-servers
       - func: run-tests
-  - name: asan-cse-sasl-cyrus-openssl-ubuntu2004-clang-test-5.0-replica-auth
-    run_on: ubuntu2004-small
-    tags: [sanitizers-matrix-asan, test, ubuntu2004, clang, sasl-cyrus, cse, asan, auth, replica, "5.0", openssl]
-    depends_on: [{ name: asan-cse-sasl-cyrus-openssl-ubuntu2004-clang-compile }]
+  - name: asan-cse-sasl-cyrus-openssl-rhel8-latest-clang-test-5.0-replica-auth
+    run_on: rhel8-latest-large
+    tags: [sanitizers-matrix-asan, test, rhel8-latest, clang, sasl-cyrus, cse, asan, auth, replica, "5.0", openssl]
+    depends_on: [{ name: asan-cse-sasl-cyrus-openssl-rhel8-latest-clang-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: asan-cse-sasl-cyrus-openssl-ubuntu2004-clang-compile
+          BUILD_NAME: asan-cse-sasl-cyrus-openssl-rhel8-latest-clang-compile
       - command: expansions.update
         params:
           updates:
@@ -186,14 +223,14 @@ tasks:
       - func: run-simple-http-server
       - func: run-mock-kms-servers
       - func: run-tests
-  - name: asan-cse-sasl-cyrus-openssl-ubuntu2004-clang-test-5.0-replica-auth-with-mongocrypt
-    run_on: ubuntu2004-small
-    tags: [sanitizers-matrix-asan, test, ubuntu2004, clang, sasl-cyrus, cse, asan, auth, replica, "5.0", with-mongocrypt, openssl]
-    depends_on: [{ name: asan-cse-sasl-cyrus-openssl-ubuntu2004-clang-compile }]
+  - name: asan-cse-sasl-cyrus-openssl-rhel8-latest-clang-test-5.0-replica-auth-with-mongocrypt
+    run_on: rhel8-latest-large
+    tags: [sanitizers-matrix-asan, test, rhel8-latest, clang, sasl-cyrus, cse, asan, auth, replica, "5.0", with-mongocrypt, openssl]
+    depends_on: [{ name: asan-cse-sasl-cyrus-openssl-rhel8-latest-clang-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: asan-cse-sasl-cyrus-openssl-ubuntu2004-clang-compile
+          BUILD_NAME: asan-cse-sasl-cyrus-openssl-rhel8-latest-clang-compile
       - command: expansions.update
         params:
           updates:
@@ -210,14 +247,14 @@ tasks:
       - func: run-simple-http-server
       - func: run-mock-kms-servers
       - func: run-tests
-  - name: asan-cse-sasl-cyrus-openssl-ubuntu2004-clang-test-5.0-server-auth
-    run_on: ubuntu2004-small
-    tags: [sanitizers-matrix-asan, test, ubuntu2004, clang, sasl-cyrus, cse, asan, auth, server, "5.0", openssl]
-    depends_on: [{ name: asan-cse-sasl-cyrus-openssl-ubuntu2004-clang-compile }]
+  - name: asan-cse-sasl-cyrus-openssl-rhel8-latest-clang-test-5.0-server-auth
+    run_on: rhel8-latest-large
+    tags: [sanitizers-matrix-asan, test, rhel8-latest, clang, sasl-cyrus, cse, asan, auth, server, "5.0", openssl]
+    depends_on: [{ name: asan-cse-sasl-cyrus-openssl-rhel8-latest-clang-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: asan-cse-sasl-cyrus-openssl-ubuntu2004-clang-compile
+          BUILD_NAME: asan-cse-sasl-cyrus-openssl-rhel8-latest-clang-compile
       - command: expansions.update
         params:
           updates:
@@ -233,14 +270,14 @@ tasks:
       - func: run-simple-http-server
       - func: run-mock-kms-servers
       - func: run-tests
-  - name: asan-cse-sasl-cyrus-openssl-ubuntu2004-clang-test-5.0-server-auth-with-mongocrypt
-    run_on: ubuntu2004-small
-    tags: [sanitizers-matrix-asan, test, ubuntu2004, clang, sasl-cyrus, cse, asan, auth, server, "5.0", with-mongocrypt, openssl]
-    depends_on: [{ name: asan-cse-sasl-cyrus-openssl-ubuntu2004-clang-compile }]
+  - name: asan-cse-sasl-cyrus-openssl-rhel8-latest-clang-test-5.0-server-auth-with-mongocrypt
+    run_on: rhel8-latest-large
+    tags: [sanitizers-matrix-asan, test, rhel8-latest, clang, sasl-cyrus, cse, asan, auth, server, "5.0", with-mongocrypt, openssl]
+    depends_on: [{ name: asan-cse-sasl-cyrus-openssl-rhel8-latest-clang-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: asan-cse-sasl-cyrus-openssl-ubuntu2004-clang-compile
+          BUILD_NAME: asan-cse-sasl-cyrus-openssl-rhel8-latest-clang-compile
       - command: expansions.update
         params:
           updates:
@@ -257,14 +294,14 @@ tasks:
       - func: run-simple-http-server
       - func: run-mock-kms-servers
       - func: run-tests
-  - name: asan-cse-sasl-cyrus-openssl-ubuntu2004-clang-test-6.0-replica-auth
-    run_on: ubuntu2004-small
-    tags: [sanitizers-matrix-asan, test, ubuntu2004, clang, sasl-cyrus, cse, asan, auth, replica, "6.0", openssl]
-    depends_on: [{ name: asan-cse-sasl-cyrus-openssl-ubuntu2004-clang-compile }]
+  - name: asan-cse-sasl-cyrus-openssl-rhel8-latest-clang-test-6.0-replica-auth
+    run_on: rhel8-latest-large
+    tags: [sanitizers-matrix-asan, test, rhel8-latest, clang, sasl-cyrus, cse, asan, auth, replica, "6.0", openssl]
+    depends_on: [{ name: asan-cse-sasl-cyrus-openssl-rhel8-latest-clang-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: asan-cse-sasl-cyrus-openssl-ubuntu2004-clang-compile
+          BUILD_NAME: asan-cse-sasl-cyrus-openssl-rhel8-latest-clang-compile
       - command: expansions.update
         params:
           updates:
@@ -280,14 +317,14 @@ tasks:
       - func: run-simple-http-server
       - func: run-mock-kms-servers
       - func: run-tests
-  - name: asan-cse-sasl-cyrus-openssl-ubuntu2004-clang-test-6.0-replica-auth-with-mongocrypt
-    run_on: ubuntu2004-small
-    tags: [sanitizers-matrix-asan, test, ubuntu2004, clang, sasl-cyrus, cse, asan, auth, replica, "6.0", with-mongocrypt, openssl]
-    depends_on: [{ name: asan-cse-sasl-cyrus-openssl-ubuntu2004-clang-compile }]
+  - name: asan-cse-sasl-cyrus-openssl-rhel8-latest-clang-test-6.0-replica-auth-with-mongocrypt
+    run_on: rhel8-latest-large
+    tags: [sanitizers-matrix-asan, test, rhel8-latest, clang, sasl-cyrus, cse, asan, auth, replica, "6.0", with-mongocrypt, openssl]
+    depends_on: [{ name: asan-cse-sasl-cyrus-openssl-rhel8-latest-clang-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: asan-cse-sasl-cyrus-openssl-ubuntu2004-clang-compile
+          BUILD_NAME: asan-cse-sasl-cyrus-openssl-rhel8-latest-clang-compile
       - command: expansions.update
         params:
           updates:
@@ -304,14 +341,14 @@ tasks:
       - func: run-simple-http-server
       - func: run-mock-kms-servers
       - func: run-tests
-  - name: asan-cse-sasl-cyrus-openssl-ubuntu2004-clang-test-6.0-server-auth
-    run_on: ubuntu2004-small
-    tags: [sanitizers-matrix-asan, test, ubuntu2004, clang, sasl-cyrus, cse, asan, auth, server, "6.0", openssl]
-    depends_on: [{ name: asan-cse-sasl-cyrus-openssl-ubuntu2004-clang-compile }]
+  - name: asan-cse-sasl-cyrus-openssl-rhel8-latest-clang-test-6.0-server-auth
+    run_on: rhel8-latest-large
+    tags: [sanitizers-matrix-asan, test, rhel8-latest, clang, sasl-cyrus, cse, asan, auth, server, "6.0", openssl]
+    depends_on: [{ name: asan-cse-sasl-cyrus-openssl-rhel8-latest-clang-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: asan-cse-sasl-cyrus-openssl-ubuntu2004-clang-compile
+          BUILD_NAME: asan-cse-sasl-cyrus-openssl-rhel8-latest-clang-compile
       - command: expansions.update
         params:
           updates:
@@ -327,14 +364,14 @@ tasks:
       - func: run-simple-http-server
       - func: run-mock-kms-servers
       - func: run-tests
-  - name: asan-cse-sasl-cyrus-openssl-ubuntu2004-clang-test-6.0-server-auth-with-mongocrypt
-    run_on: ubuntu2004-small
-    tags: [sanitizers-matrix-asan, test, ubuntu2004, clang, sasl-cyrus, cse, asan, auth, server, "6.0", with-mongocrypt, openssl]
-    depends_on: [{ name: asan-cse-sasl-cyrus-openssl-ubuntu2004-clang-compile }]
+  - name: asan-cse-sasl-cyrus-openssl-rhel8-latest-clang-test-6.0-server-auth-with-mongocrypt
+    run_on: rhel8-latest-large
+    tags: [sanitizers-matrix-asan, test, rhel8-latest, clang, sasl-cyrus, cse, asan, auth, server, "6.0", with-mongocrypt, openssl]
+    depends_on: [{ name: asan-cse-sasl-cyrus-openssl-rhel8-latest-clang-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: asan-cse-sasl-cyrus-openssl-ubuntu2004-clang-compile
+          BUILD_NAME: asan-cse-sasl-cyrus-openssl-rhel8-latest-clang-compile
       - command: expansions.update
         params:
           updates:
@@ -351,14 +388,14 @@ tasks:
       - func: run-simple-http-server
       - func: run-mock-kms-servers
       - func: run-tests
-  - name: asan-cse-sasl-cyrus-openssl-ubuntu2004-clang-test-7.0-replica-auth
-    run_on: ubuntu2004-small
-    tags: [sanitizers-matrix-asan, test, ubuntu2004, clang, sasl-cyrus, cse, asan, auth, replica, "7.0", openssl]
-    depends_on: [{ name: asan-cse-sasl-cyrus-openssl-ubuntu2004-clang-compile }]
+  - name: asan-cse-sasl-cyrus-openssl-rhel8-latest-clang-test-7.0-replica-auth
+    run_on: rhel8-latest-large
+    tags: [sanitizers-matrix-asan, test, rhel8-latest, clang, sasl-cyrus, cse, asan, auth, replica, "7.0", openssl]
+    depends_on: [{ name: asan-cse-sasl-cyrus-openssl-rhel8-latest-clang-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: asan-cse-sasl-cyrus-openssl-ubuntu2004-clang-compile
+          BUILD_NAME: asan-cse-sasl-cyrus-openssl-rhel8-latest-clang-compile
       - command: expansions.update
         params:
           updates:
@@ -374,14 +411,14 @@ tasks:
       - func: run-simple-http-server
       - func: run-mock-kms-servers
       - func: run-tests
-  - name: asan-cse-sasl-cyrus-openssl-ubuntu2004-clang-test-7.0-replica-auth-with-mongocrypt
-    run_on: ubuntu2004-small
-    tags: [sanitizers-matrix-asan, test, ubuntu2004, clang, sasl-cyrus, cse, asan, auth, replica, "7.0", with-mongocrypt, openssl]
-    depends_on: [{ name: asan-cse-sasl-cyrus-openssl-ubuntu2004-clang-compile }]
+  - name: asan-cse-sasl-cyrus-openssl-rhel8-latest-clang-test-7.0-replica-auth-with-mongocrypt
+    run_on: rhel8-latest-large
+    tags: [sanitizers-matrix-asan, test, rhel8-latest, clang, sasl-cyrus, cse, asan, auth, replica, "7.0", with-mongocrypt, openssl]
+    depends_on: [{ name: asan-cse-sasl-cyrus-openssl-rhel8-latest-clang-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: asan-cse-sasl-cyrus-openssl-ubuntu2004-clang-compile
+          BUILD_NAME: asan-cse-sasl-cyrus-openssl-rhel8-latest-clang-compile
       - command: expansions.update
         params:
           updates:
@@ -398,14 +435,14 @@ tasks:
       - func: run-simple-http-server
       - func: run-mock-kms-servers
       - func: run-tests
-  - name: asan-cse-sasl-cyrus-openssl-ubuntu2004-clang-test-7.0-server-auth
-    run_on: ubuntu2004-small
-    tags: [sanitizers-matrix-asan, test, ubuntu2004, clang, sasl-cyrus, cse, asan, auth, server, "7.0", openssl]
-    depends_on: [{ name: asan-cse-sasl-cyrus-openssl-ubuntu2004-clang-compile }]
+  - name: asan-cse-sasl-cyrus-openssl-rhel8-latest-clang-test-7.0-server-auth
+    run_on: rhel8-latest-large
+    tags: [sanitizers-matrix-asan, test, rhel8-latest, clang, sasl-cyrus, cse, asan, auth, server, "7.0", openssl]
+    depends_on: [{ name: asan-cse-sasl-cyrus-openssl-rhel8-latest-clang-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: asan-cse-sasl-cyrus-openssl-ubuntu2004-clang-compile
+          BUILD_NAME: asan-cse-sasl-cyrus-openssl-rhel8-latest-clang-compile
       - command: expansions.update
         params:
           updates:
@@ -421,14 +458,14 @@ tasks:
       - func: run-simple-http-server
       - func: run-mock-kms-servers
       - func: run-tests
-  - name: asan-cse-sasl-cyrus-openssl-ubuntu2004-clang-test-7.0-server-auth-with-mongocrypt
-    run_on: ubuntu2004-small
-    tags: [sanitizers-matrix-asan, test, ubuntu2004, clang, sasl-cyrus, cse, asan, auth, server, "7.0", with-mongocrypt, openssl]
-    depends_on: [{ name: asan-cse-sasl-cyrus-openssl-ubuntu2004-clang-compile }]
+  - name: asan-cse-sasl-cyrus-openssl-rhel8-latest-clang-test-7.0-server-auth-with-mongocrypt
+    run_on: rhel8-latest-large
+    tags: [sanitizers-matrix-asan, test, rhel8-latest, clang, sasl-cyrus, cse, asan, auth, server, "7.0", with-mongocrypt, openssl]
+    depends_on: [{ name: asan-cse-sasl-cyrus-openssl-rhel8-latest-clang-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: asan-cse-sasl-cyrus-openssl-ubuntu2004-clang-compile
+          BUILD_NAME: asan-cse-sasl-cyrus-openssl-rhel8-latest-clang-compile
       - command: expansions.update
         params:
           updates:
@@ -445,14 +482,14 @@ tasks:
       - func: run-simple-http-server
       - func: run-mock-kms-servers
       - func: run-tests
-  - name: asan-cse-sasl-cyrus-openssl-ubuntu2004-clang-test-8.0-replica-auth
-    run_on: ubuntu2004-small
-    tags: [sanitizers-matrix-asan, test, ubuntu2004, clang, sasl-cyrus, cse, asan, auth, replica, "8.0", openssl]
-    depends_on: [{ name: asan-cse-sasl-cyrus-openssl-ubuntu2004-clang-compile }]
+  - name: asan-cse-sasl-cyrus-openssl-rhel8-latest-clang-test-8.0-replica-auth
+    run_on: rhel8-latest-large
+    tags: [sanitizers-matrix-asan, test, rhel8-latest, clang, sasl-cyrus, cse, asan, auth, replica, "8.0", openssl]
+    depends_on: [{ name: asan-cse-sasl-cyrus-openssl-rhel8-latest-clang-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: asan-cse-sasl-cyrus-openssl-ubuntu2004-clang-compile
+          BUILD_NAME: asan-cse-sasl-cyrus-openssl-rhel8-latest-clang-compile
       - command: expansions.update
         params:
           updates:
@@ -468,14 +505,14 @@ tasks:
       - func: run-simple-http-server
       - func: run-mock-kms-servers
       - func: run-tests
-  - name: asan-cse-sasl-cyrus-openssl-ubuntu2004-clang-test-8.0-replica-auth-with-mongocrypt
-    run_on: ubuntu2004-small
-    tags: [sanitizers-matrix-asan, test, ubuntu2004, clang, sasl-cyrus, cse, asan, auth, replica, "8.0", with-mongocrypt, openssl]
-    depends_on: [{ name: asan-cse-sasl-cyrus-openssl-ubuntu2004-clang-compile }]
+  - name: asan-cse-sasl-cyrus-openssl-rhel8-latest-clang-test-8.0-replica-auth-with-mongocrypt
+    run_on: rhel8-latest-large
+    tags: [sanitizers-matrix-asan, test, rhel8-latest, clang, sasl-cyrus, cse, asan, auth, replica, "8.0", with-mongocrypt, openssl]
+    depends_on: [{ name: asan-cse-sasl-cyrus-openssl-rhel8-latest-clang-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: asan-cse-sasl-cyrus-openssl-ubuntu2004-clang-compile
+          BUILD_NAME: asan-cse-sasl-cyrus-openssl-rhel8-latest-clang-compile
       - command: expansions.update
         params:
           updates:
@@ -492,14 +529,14 @@ tasks:
       - func: run-simple-http-server
       - func: run-mock-kms-servers
       - func: run-tests
-  - name: asan-cse-sasl-cyrus-openssl-ubuntu2004-clang-test-8.0-server-auth
-    run_on: ubuntu2004-small
-    tags: [sanitizers-matrix-asan, test, ubuntu2004, clang, sasl-cyrus, cse, asan, auth, server, "8.0", openssl]
-    depends_on: [{ name: asan-cse-sasl-cyrus-openssl-ubuntu2004-clang-compile }]
+  - name: asan-cse-sasl-cyrus-openssl-rhel8-latest-clang-test-8.0-server-auth
+    run_on: rhel8-latest-large
+    tags: [sanitizers-matrix-asan, test, rhel8-latest, clang, sasl-cyrus, cse, asan, auth, server, "8.0", openssl]
+    depends_on: [{ name: asan-cse-sasl-cyrus-openssl-rhel8-latest-clang-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: asan-cse-sasl-cyrus-openssl-ubuntu2004-clang-compile
+          BUILD_NAME: asan-cse-sasl-cyrus-openssl-rhel8-latest-clang-compile
       - command: expansions.update
         params:
           updates:
@@ -515,14 +552,14 @@ tasks:
       - func: run-simple-http-server
       - func: run-mock-kms-servers
       - func: run-tests
-  - name: asan-cse-sasl-cyrus-openssl-ubuntu2004-clang-test-8.0-server-auth-with-mongocrypt
-    run_on: ubuntu2004-small
-    tags: [sanitizers-matrix-asan, test, ubuntu2004, clang, sasl-cyrus, cse, asan, auth, server, "8.0", with-mongocrypt, openssl]
-    depends_on: [{ name: asan-cse-sasl-cyrus-openssl-ubuntu2004-clang-compile }]
+  - name: asan-cse-sasl-cyrus-openssl-rhel8-latest-clang-test-8.0-server-auth-with-mongocrypt
+    run_on: rhel8-latest-large
+    tags: [sanitizers-matrix-asan, test, rhel8-latest, clang, sasl-cyrus, cse, asan, auth, server, "8.0", with-mongocrypt, openssl]
+    depends_on: [{ name: asan-cse-sasl-cyrus-openssl-rhel8-latest-clang-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: asan-cse-sasl-cyrus-openssl-ubuntu2004-clang-compile
+          BUILD_NAME: asan-cse-sasl-cyrus-openssl-rhel8-latest-clang-compile
       - command: expansions.update
         params:
           updates:
@@ -539,14 +576,14 @@ tasks:
       - func: run-simple-http-server
       - func: run-mock-kms-servers
       - func: run-tests
-  - name: asan-cse-sasl-cyrus-openssl-ubuntu2004-clang-test-latest-replica-auth
-    run_on: ubuntu2004-small
-    tags: [sanitizers-matrix-asan, test, ubuntu2004, clang, sasl-cyrus, cse, asan, auth, replica, latest, openssl]
-    depends_on: [{ name: asan-cse-sasl-cyrus-openssl-ubuntu2004-clang-compile }]
+  - name: asan-cse-sasl-cyrus-openssl-rhel8-latest-clang-test-latest-replica-auth
+    run_on: rhel8-latest-large
+    tags: [sanitizers-matrix-asan, test, rhel8-latest, clang, sasl-cyrus, cse, asan, auth, replica, latest, openssl]
+    depends_on: [{ name: asan-cse-sasl-cyrus-openssl-rhel8-latest-clang-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: asan-cse-sasl-cyrus-openssl-ubuntu2004-clang-compile
+          BUILD_NAME: asan-cse-sasl-cyrus-openssl-rhel8-latest-clang-compile
       - command: expansions.update
         params:
           updates:
@@ -562,14 +599,14 @@ tasks:
       - func: run-simple-http-server
       - func: run-mock-kms-servers
       - func: run-tests
-  - name: asan-cse-sasl-cyrus-openssl-ubuntu2004-clang-test-latest-replica-auth-with-mongocrypt
-    run_on: ubuntu2004-small
-    tags: [sanitizers-matrix-asan, test, ubuntu2004, clang, sasl-cyrus, cse, asan, auth, replica, latest, with-mongocrypt, openssl]
-    depends_on: [{ name: asan-cse-sasl-cyrus-openssl-ubuntu2004-clang-compile }]
+  - name: asan-cse-sasl-cyrus-openssl-rhel8-latest-clang-test-latest-replica-auth-with-mongocrypt
+    run_on: rhel8-latest-large
+    tags: [sanitizers-matrix-asan, test, rhel8-latest, clang, sasl-cyrus, cse, asan, auth, replica, latest, with-mongocrypt, openssl]
+    depends_on: [{ name: asan-cse-sasl-cyrus-openssl-rhel8-latest-clang-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: asan-cse-sasl-cyrus-openssl-ubuntu2004-clang-compile
+          BUILD_NAME: asan-cse-sasl-cyrus-openssl-rhel8-latest-clang-compile
       - command: expansions.update
         params:
           updates:
@@ -586,14 +623,14 @@ tasks:
       - func: run-simple-http-server
       - func: run-mock-kms-servers
       - func: run-tests
-  - name: asan-cse-sasl-cyrus-openssl-ubuntu2004-clang-test-latest-server-auth
-    run_on: ubuntu2004-small
-    tags: [sanitizers-matrix-asan, test, ubuntu2004, clang, sasl-cyrus, cse, asan, auth, server, latest, openssl]
-    depends_on: [{ name: asan-cse-sasl-cyrus-openssl-ubuntu2004-clang-compile }]
+  - name: asan-cse-sasl-cyrus-openssl-rhel8-latest-clang-test-latest-server-auth
+    run_on: rhel8-latest-large
+    tags: [sanitizers-matrix-asan, test, rhel8-latest, clang, sasl-cyrus, cse, asan, auth, server, latest, openssl]
+    depends_on: [{ name: asan-cse-sasl-cyrus-openssl-rhel8-latest-clang-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: asan-cse-sasl-cyrus-openssl-ubuntu2004-clang-compile
+          BUILD_NAME: asan-cse-sasl-cyrus-openssl-rhel8-latest-clang-compile
       - command: expansions.update
         params:
           updates:
@@ -609,14 +646,14 @@ tasks:
       - func: run-simple-http-server
       - func: run-mock-kms-servers
       - func: run-tests
-  - name: asan-cse-sasl-cyrus-openssl-ubuntu2004-clang-test-latest-server-auth-with-mongocrypt
-    run_on: ubuntu2004-small
-    tags: [sanitizers-matrix-asan, test, ubuntu2004, clang, sasl-cyrus, cse, asan, auth, server, latest, with-mongocrypt, openssl]
-    depends_on: [{ name: asan-cse-sasl-cyrus-openssl-ubuntu2004-clang-compile }]
+  - name: asan-cse-sasl-cyrus-openssl-rhel8-latest-clang-test-latest-server-auth-with-mongocrypt
+    run_on: rhel8-latest-large
+    tags: [sanitizers-matrix-asan, test, rhel8-latest, clang, sasl-cyrus, cse, asan, auth, server, latest, with-mongocrypt, openssl]
+    depends_on: [{ name: asan-cse-sasl-cyrus-openssl-rhel8-latest-clang-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: asan-cse-sasl-cyrus-openssl-ubuntu2004-clang-compile
+          BUILD_NAME: asan-cse-sasl-cyrus-openssl-rhel8-latest-clang-compile
       - command: expansions.update
         params:
           updates:
@@ -633,9 +670,9 @@ tasks:
       - func: run-simple-http-server
       - func: run-mock-kms-servers
       - func: run-tests
-  - name: asan-sasl-cyrus-openssl-debian10-clang-compile
-    run_on: debian10-large
-    tags: [sanitizers-matrix-asan, compile, debian10, clang, asan, sasl-cyrus]
+  - name: asan-sasl-cyrus-openssl-rhel8-latest-clang-compile
+    run_on: rhel8-latest-large
+    tags: [sanitizers-matrix-asan, compile, rhel8-latest, clang, asan, sasl-cyrus]
     commands:
       - func: find-cmake-latest
       - func: sasl-cyrus-openssl-compile
@@ -643,14 +680,14 @@ tasks:
           CC: clang
           CXX: clang++
       - func: upload-build
-  - name: asan-sasl-cyrus-openssl-debian10-clang-test-4.2-replica-auth
-    run_on: debian10-small
-    tags: [sanitizers-matrix-asan, test, debian10, clang, sasl-cyrus, asan, auth, replica, "4.2", openssl]
-    depends_on: [{ name: asan-sasl-cyrus-openssl-debian10-clang-compile }]
+  - name: asan-sasl-cyrus-openssl-rhel8-latest-clang-test-4.2-replica-auth
+    run_on: rhel8-latest-large
+    tags: [sanitizers-matrix-asan, test, rhel8-latest, clang, sasl-cyrus, asan, auth, replica, "4.2", openssl]
+    depends_on: [{ name: asan-sasl-cyrus-openssl-rhel8-latest-clang-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: asan-sasl-cyrus-openssl-debian10-clang-compile
+          BUILD_NAME: asan-sasl-cyrus-openssl-rhel8-latest-clang-compile
       - command: expansions.update
         params:
           updates:
@@ -664,14 +701,14 @@ tasks:
       - func: bootstrap-mongo-orchestration
       - func: run-simple-http-server
       - func: run-tests
-  - name: asan-sasl-cyrus-openssl-debian10-clang-test-4.2-server-auth
-    run_on: debian10-small
-    tags: [sanitizers-matrix-asan, test, debian10, clang, sasl-cyrus, asan, auth, server, "4.2", openssl]
-    depends_on: [{ name: asan-sasl-cyrus-openssl-debian10-clang-compile }]
+  - name: asan-sasl-cyrus-openssl-rhel8-latest-clang-test-4.2-server-auth
+    run_on: rhel8-latest-large
+    tags: [sanitizers-matrix-asan, test, rhel8-latest, clang, sasl-cyrus, asan, auth, server, "4.2", openssl]
+    depends_on: [{ name: asan-sasl-cyrus-openssl-rhel8-latest-clang-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: asan-sasl-cyrus-openssl-debian10-clang-compile
+          BUILD_NAME: asan-sasl-cyrus-openssl-rhel8-latest-clang-compile
       - command: expansions.update
         params:
           updates:
@@ -685,14 +722,14 @@ tasks:
       - func: bootstrap-mongo-orchestration
       - func: run-simple-http-server
       - func: run-tests
-  - name: asan-sasl-cyrus-openssl-debian10-clang-test-4.2-sharded-auth
-    run_on: debian10-small
-    tags: [sanitizers-matrix-asan, test, debian10, clang, sasl-cyrus, asan, auth, sharded, "4.2", openssl]
-    depends_on: [{ name: asan-sasl-cyrus-openssl-debian10-clang-compile }]
+  - name: asan-sasl-cyrus-openssl-rhel8-latest-clang-test-4.2-sharded-auth
+    run_on: rhel8-latest-large
+    tags: [sanitizers-matrix-asan, test, rhel8-latest, clang, sasl-cyrus, asan, auth, sharded, "4.2", openssl]
+    depends_on: [{ name: asan-sasl-cyrus-openssl-rhel8-latest-clang-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: asan-sasl-cyrus-openssl-debian10-clang-compile
+          BUILD_NAME: asan-sasl-cyrus-openssl-rhel8-latest-clang-compile
       - command: expansions.update
         params:
           updates:
@@ -706,24 +743,14 @@ tasks:
       - func: bootstrap-mongo-orchestration
       - func: run-simple-http-server
       - func: run-tests
-  - name: asan-sasl-cyrus-openssl-ubuntu2004-clang-compile
-    run_on: ubuntu2004-large
-    tags: [sanitizers-matrix-asan, compile, ubuntu2004, clang, asan, sasl-cyrus]
-    commands:
-      - func: find-cmake-latest
-      - func: sasl-cyrus-openssl-compile
-        vars:
-          CC: clang
-          CXX: clang++
-      - func: upload-build
-  - name: asan-sasl-cyrus-openssl-ubuntu2004-clang-test-4.4-replica-auth
-    run_on: ubuntu2004-small
-    tags: [sanitizers-matrix-asan, test, ubuntu2004, clang, sasl-cyrus, asan, auth, replica, "4.4", openssl]
-    depends_on: [{ name: asan-sasl-cyrus-openssl-ubuntu2004-clang-compile }]
+  - name: asan-sasl-cyrus-openssl-rhel8-latest-clang-test-4.4-replica-auth
+    run_on: rhel8-latest-large
+    tags: [sanitizers-matrix-asan, test, rhel8-latest, clang, sasl-cyrus, asan, auth, replica, "4.4", openssl]
+    depends_on: [{ name: asan-sasl-cyrus-openssl-rhel8-latest-clang-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: asan-sasl-cyrus-openssl-ubuntu2004-clang-compile
+          BUILD_NAME: asan-sasl-cyrus-openssl-rhel8-latest-clang-compile
       - command: expansions.update
         params:
           updates:
@@ -737,14 +764,14 @@ tasks:
       - func: bootstrap-mongo-orchestration
       - func: run-simple-http-server
       - func: run-tests
-  - name: asan-sasl-cyrus-openssl-ubuntu2004-clang-test-4.4-server-auth
-    run_on: ubuntu2004-small
-    tags: [sanitizers-matrix-asan, test, ubuntu2004, clang, sasl-cyrus, asan, auth, server, "4.4", openssl]
-    depends_on: [{ name: asan-sasl-cyrus-openssl-ubuntu2004-clang-compile }]
+  - name: asan-sasl-cyrus-openssl-rhel8-latest-clang-test-4.4-server-auth
+    run_on: rhel8-latest-large
+    tags: [sanitizers-matrix-asan, test, rhel8-latest, clang, sasl-cyrus, asan, auth, server, "4.4", openssl]
+    depends_on: [{ name: asan-sasl-cyrus-openssl-rhel8-latest-clang-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: asan-sasl-cyrus-openssl-ubuntu2004-clang-compile
+          BUILD_NAME: asan-sasl-cyrus-openssl-rhel8-latest-clang-compile
       - command: expansions.update
         params:
           updates:
@@ -758,14 +785,14 @@ tasks:
       - func: bootstrap-mongo-orchestration
       - func: run-simple-http-server
       - func: run-tests
-  - name: asan-sasl-cyrus-openssl-ubuntu2004-clang-test-4.4-sharded-auth
-    run_on: ubuntu2004-small
-    tags: [sanitizers-matrix-asan, test, ubuntu2004, clang, sasl-cyrus, asan, auth, sharded, "4.4", openssl]
-    depends_on: [{ name: asan-sasl-cyrus-openssl-ubuntu2004-clang-compile }]
+  - name: asan-sasl-cyrus-openssl-rhel8-latest-clang-test-4.4-sharded-auth
+    run_on: rhel8-latest-large
+    tags: [sanitizers-matrix-asan, test, rhel8-latest, clang, sasl-cyrus, asan, auth, sharded, "4.4", openssl]
+    depends_on: [{ name: asan-sasl-cyrus-openssl-rhel8-latest-clang-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: asan-sasl-cyrus-openssl-ubuntu2004-clang-compile
+          BUILD_NAME: asan-sasl-cyrus-openssl-rhel8-latest-clang-compile
       - command: expansions.update
         params:
           updates:
@@ -779,14 +806,14 @@ tasks:
       - func: bootstrap-mongo-orchestration
       - func: run-simple-http-server
       - func: run-tests
-  - name: asan-sasl-cyrus-openssl-ubuntu2004-clang-test-5.0-replica-auth
-    run_on: ubuntu2004-small
-    tags: [sanitizers-matrix-asan, test, ubuntu2004, clang, sasl-cyrus, asan, auth, replica, "5.0", openssl]
-    depends_on: [{ name: asan-sasl-cyrus-openssl-ubuntu2004-clang-compile }]
+  - name: asan-sasl-cyrus-openssl-rhel8-latest-clang-test-5.0-replica-auth
+    run_on: rhel8-latest-large
+    tags: [sanitizers-matrix-asan, test, rhel8-latest, clang, sasl-cyrus, asan, auth, replica, "5.0", openssl]
+    depends_on: [{ name: asan-sasl-cyrus-openssl-rhel8-latest-clang-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: asan-sasl-cyrus-openssl-ubuntu2004-clang-compile
+          BUILD_NAME: asan-sasl-cyrus-openssl-rhel8-latest-clang-compile
       - command: expansions.update
         params:
           updates:
@@ -800,14 +827,14 @@ tasks:
       - func: bootstrap-mongo-orchestration
       - func: run-simple-http-server
       - func: run-tests
-  - name: asan-sasl-cyrus-openssl-ubuntu2004-clang-test-5.0-server-auth
-    run_on: ubuntu2004-small
-    tags: [sanitizers-matrix-asan, test, ubuntu2004, clang, sasl-cyrus, asan, auth, server, "5.0", openssl]
-    depends_on: [{ name: asan-sasl-cyrus-openssl-ubuntu2004-clang-compile }]
+  - name: asan-sasl-cyrus-openssl-rhel8-latest-clang-test-5.0-server-auth
+    run_on: rhel8-latest-large
+    tags: [sanitizers-matrix-asan, test, rhel8-latest, clang, sasl-cyrus, asan, auth, server, "5.0", openssl]
+    depends_on: [{ name: asan-sasl-cyrus-openssl-rhel8-latest-clang-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: asan-sasl-cyrus-openssl-ubuntu2004-clang-compile
+          BUILD_NAME: asan-sasl-cyrus-openssl-rhel8-latest-clang-compile
       - command: expansions.update
         params:
           updates:
@@ -821,14 +848,14 @@ tasks:
       - func: bootstrap-mongo-orchestration
       - func: run-simple-http-server
       - func: run-tests
-  - name: asan-sasl-cyrus-openssl-ubuntu2004-clang-test-5.0-sharded-auth
-    run_on: ubuntu2004-small
-    tags: [sanitizers-matrix-asan, test, ubuntu2004, clang, sasl-cyrus, asan, auth, sharded, "5.0", openssl]
-    depends_on: [{ name: asan-sasl-cyrus-openssl-ubuntu2004-clang-compile }]
+  - name: asan-sasl-cyrus-openssl-rhel8-latest-clang-test-5.0-sharded-auth
+    run_on: rhel8-latest-large
+    tags: [sanitizers-matrix-asan, test, rhel8-latest, clang, sasl-cyrus, asan, auth, sharded, "5.0", openssl]
+    depends_on: [{ name: asan-sasl-cyrus-openssl-rhel8-latest-clang-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: asan-sasl-cyrus-openssl-ubuntu2004-clang-compile
+          BUILD_NAME: asan-sasl-cyrus-openssl-rhel8-latest-clang-compile
       - command: expansions.update
         params:
           updates:
@@ -842,14 +869,14 @@ tasks:
       - func: bootstrap-mongo-orchestration
       - func: run-simple-http-server
       - func: run-tests
-  - name: asan-sasl-cyrus-openssl-ubuntu2004-clang-test-6.0-replica-auth
-    run_on: ubuntu2004-small
-    tags: [sanitizers-matrix-asan, test, ubuntu2004, clang, sasl-cyrus, asan, auth, replica, "6.0", openssl]
-    depends_on: [{ name: asan-sasl-cyrus-openssl-ubuntu2004-clang-compile }]
+  - name: asan-sasl-cyrus-openssl-rhel8-latest-clang-test-6.0-replica-auth
+    run_on: rhel8-latest-large
+    tags: [sanitizers-matrix-asan, test, rhel8-latest, clang, sasl-cyrus, asan, auth, replica, "6.0", openssl]
+    depends_on: [{ name: asan-sasl-cyrus-openssl-rhel8-latest-clang-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: asan-sasl-cyrus-openssl-ubuntu2004-clang-compile
+          BUILD_NAME: asan-sasl-cyrus-openssl-rhel8-latest-clang-compile
       - command: expansions.update
         params:
           updates:
@@ -863,14 +890,14 @@ tasks:
       - func: bootstrap-mongo-orchestration
       - func: run-simple-http-server
       - func: run-tests
-  - name: asan-sasl-cyrus-openssl-ubuntu2004-clang-test-6.0-server-auth
-    run_on: ubuntu2004-small
-    tags: [sanitizers-matrix-asan, test, ubuntu2004, clang, sasl-cyrus, asan, auth, server, "6.0", openssl]
-    depends_on: [{ name: asan-sasl-cyrus-openssl-ubuntu2004-clang-compile }]
+  - name: asan-sasl-cyrus-openssl-rhel8-latest-clang-test-6.0-server-auth
+    run_on: rhel8-latest-large
+    tags: [sanitizers-matrix-asan, test, rhel8-latest, clang, sasl-cyrus, asan, auth, server, "6.0", openssl]
+    depends_on: [{ name: asan-sasl-cyrus-openssl-rhel8-latest-clang-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: asan-sasl-cyrus-openssl-ubuntu2004-clang-compile
+          BUILD_NAME: asan-sasl-cyrus-openssl-rhel8-latest-clang-compile
       - command: expansions.update
         params:
           updates:
@@ -884,14 +911,14 @@ tasks:
       - func: bootstrap-mongo-orchestration
       - func: run-simple-http-server
       - func: run-tests
-  - name: asan-sasl-cyrus-openssl-ubuntu2004-clang-test-6.0-sharded-auth
-    run_on: ubuntu2004-small
-    tags: [sanitizers-matrix-asan, test, ubuntu2004, clang, sasl-cyrus, asan, auth, sharded, "6.0", openssl]
-    depends_on: [{ name: asan-sasl-cyrus-openssl-ubuntu2004-clang-compile }]
+  - name: asan-sasl-cyrus-openssl-rhel8-latest-clang-test-6.0-sharded-auth
+    run_on: rhel8-latest-large
+    tags: [sanitizers-matrix-asan, test, rhel8-latest, clang, sasl-cyrus, asan, auth, sharded, "6.0", openssl]
+    depends_on: [{ name: asan-sasl-cyrus-openssl-rhel8-latest-clang-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: asan-sasl-cyrus-openssl-ubuntu2004-clang-compile
+          BUILD_NAME: asan-sasl-cyrus-openssl-rhel8-latest-clang-compile
       - command: expansions.update
         params:
           updates:
@@ -905,14 +932,14 @@ tasks:
       - func: bootstrap-mongo-orchestration
       - func: run-simple-http-server
       - func: run-tests
-  - name: asan-sasl-cyrus-openssl-ubuntu2004-clang-test-7.0-replica-auth
-    run_on: ubuntu2004-small
-    tags: [sanitizers-matrix-asan, test, ubuntu2004, clang, sasl-cyrus, asan, auth, replica, "7.0", openssl]
-    depends_on: [{ name: asan-sasl-cyrus-openssl-ubuntu2004-clang-compile }]
+  - name: asan-sasl-cyrus-openssl-rhel8-latest-clang-test-7.0-replica-auth
+    run_on: rhel8-latest-large
+    tags: [sanitizers-matrix-asan, test, rhel8-latest, clang, sasl-cyrus, asan, auth, replica, "7.0", openssl]
+    depends_on: [{ name: asan-sasl-cyrus-openssl-rhel8-latest-clang-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: asan-sasl-cyrus-openssl-ubuntu2004-clang-compile
+          BUILD_NAME: asan-sasl-cyrus-openssl-rhel8-latest-clang-compile
       - command: expansions.update
         params:
           updates:
@@ -926,14 +953,14 @@ tasks:
       - func: bootstrap-mongo-orchestration
       - func: run-simple-http-server
       - func: run-tests
-  - name: asan-sasl-cyrus-openssl-ubuntu2004-clang-test-7.0-server-auth
-    run_on: ubuntu2004-small
-    tags: [sanitizers-matrix-asan, test, ubuntu2004, clang, sasl-cyrus, asan, auth, server, "7.0", openssl]
-    depends_on: [{ name: asan-sasl-cyrus-openssl-ubuntu2004-clang-compile }]
+  - name: asan-sasl-cyrus-openssl-rhel8-latest-clang-test-7.0-server-auth
+    run_on: rhel8-latest-large
+    tags: [sanitizers-matrix-asan, test, rhel8-latest, clang, sasl-cyrus, asan, auth, server, "7.0", openssl]
+    depends_on: [{ name: asan-sasl-cyrus-openssl-rhel8-latest-clang-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: asan-sasl-cyrus-openssl-ubuntu2004-clang-compile
+          BUILD_NAME: asan-sasl-cyrus-openssl-rhel8-latest-clang-compile
       - command: expansions.update
         params:
           updates:
@@ -947,14 +974,14 @@ tasks:
       - func: bootstrap-mongo-orchestration
       - func: run-simple-http-server
       - func: run-tests
-  - name: asan-sasl-cyrus-openssl-ubuntu2004-clang-test-7.0-sharded-auth
-    run_on: ubuntu2004-small
-    tags: [sanitizers-matrix-asan, test, ubuntu2004, clang, sasl-cyrus, asan, auth, sharded, "7.0", openssl]
-    depends_on: [{ name: asan-sasl-cyrus-openssl-ubuntu2004-clang-compile }]
+  - name: asan-sasl-cyrus-openssl-rhel8-latest-clang-test-7.0-sharded-auth
+    run_on: rhel8-latest-large
+    tags: [sanitizers-matrix-asan, test, rhel8-latest, clang, sasl-cyrus, asan, auth, sharded, "7.0", openssl]
+    depends_on: [{ name: asan-sasl-cyrus-openssl-rhel8-latest-clang-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: asan-sasl-cyrus-openssl-ubuntu2004-clang-compile
+          BUILD_NAME: asan-sasl-cyrus-openssl-rhel8-latest-clang-compile
       - command: expansions.update
         params:
           updates:
@@ -968,14 +995,14 @@ tasks:
       - func: bootstrap-mongo-orchestration
       - func: run-simple-http-server
       - func: run-tests
-  - name: asan-sasl-cyrus-openssl-ubuntu2004-clang-test-8.0-replica-auth
-    run_on: ubuntu2004-small
-    tags: [sanitizers-matrix-asan, test, ubuntu2004, clang, sasl-cyrus, asan, auth, replica, "8.0", openssl]
-    depends_on: [{ name: asan-sasl-cyrus-openssl-ubuntu2004-clang-compile }]
+  - name: asan-sasl-cyrus-openssl-rhel8-latest-clang-test-8.0-replica-auth
+    run_on: rhel8-latest-large
+    tags: [sanitizers-matrix-asan, test, rhel8-latest, clang, sasl-cyrus, asan, auth, replica, "8.0", openssl]
+    depends_on: [{ name: asan-sasl-cyrus-openssl-rhel8-latest-clang-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: asan-sasl-cyrus-openssl-ubuntu2004-clang-compile
+          BUILD_NAME: asan-sasl-cyrus-openssl-rhel8-latest-clang-compile
       - command: expansions.update
         params:
           updates:
@@ -989,14 +1016,14 @@ tasks:
       - func: bootstrap-mongo-orchestration
       - func: run-simple-http-server
       - func: run-tests
-  - name: asan-sasl-cyrus-openssl-ubuntu2004-clang-test-8.0-server-auth
-    run_on: ubuntu2004-small
-    tags: [sanitizers-matrix-asan, test, ubuntu2004, clang, sasl-cyrus, asan, auth, server, "8.0", openssl]
-    depends_on: [{ name: asan-sasl-cyrus-openssl-ubuntu2004-clang-compile }]
+  - name: asan-sasl-cyrus-openssl-rhel8-latest-clang-test-8.0-server-auth
+    run_on: rhel8-latest-large
+    tags: [sanitizers-matrix-asan, test, rhel8-latest, clang, sasl-cyrus, asan, auth, server, "8.0", openssl]
+    depends_on: [{ name: asan-sasl-cyrus-openssl-rhel8-latest-clang-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: asan-sasl-cyrus-openssl-ubuntu2004-clang-compile
+          BUILD_NAME: asan-sasl-cyrus-openssl-rhel8-latest-clang-compile
       - command: expansions.update
         params:
           updates:
@@ -1010,14 +1037,14 @@ tasks:
       - func: bootstrap-mongo-orchestration
       - func: run-simple-http-server
       - func: run-tests
-  - name: asan-sasl-cyrus-openssl-ubuntu2004-clang-test-8.0-sharded-auth
-    run_on: ubuntu2004-small
-    tags: [sanitizers-matrix-asan, test, ubuntu2004, clang, sasl-cyrus, asan, auth, sharded, "8.0", openssl]
-    depends_on: [{ name: asan-sasl-cyrus-openssl-ubuntu2004-clang-compile }]
+  - name: asan-sasl-cyrus-openssl-rhel8-latest-clang-test-8.0-sharded-auth
+    run_on: rhel8-latest-large
+    tags: [sanitizers-matrix-asan, test, rhel8-latest, clang, sasl-cyrus, asan, auth, sharded, "8.0", openssl]
+    depends_on: [{ name: asan-sasl-cyrus-openssl-rhel8-latest-clang-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: asan-sasl-cyrus-openssl-ubuntu2004-clang-compile
+          BUILD_NAME: asan-sasl-cyrus-openssl-rhel8-latest-clang-compile
       - command: expansions.update
         params:
           updates:
@@ -1031,14 +1058,14 @@ tasks:
       - func: bootstrap-mongo-orchestration
       - func: run-simple-http-server
       - func: run-tests
-  - name: asan-sasl-cyrus-openssl-ubuntu2004-clang-test-latest-replica-auth
-    run_on: ubuntu2004-small
-    tags: [sanitizers-matrix-asan, test, ubuntu2004, clang, sasl-cyrus, asan, auth, replica, latest, openssl]
-    depends_on: [{ name: asan-sasl-cyrus-openssl-ubuntu2004-clang-compile }]
+  - name: asan-sasl-cyrus-openssl-rhel8-latest-clang-test-latest-replica-auth
+    run_on: rhel8-latest-large
+    tags: [sanitizers-matrix-asan, test, rhel8-latest, clang, sasl-cyrus, asan, auth, replica, latest, openssl]
+    depends_on: [{ name: asan-sasl-cyrus-openssl-rhel8-latest-clang-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: asan-sasl-cyrus-openssl-ubuntu2004-clang-compile
+          BUILD_NAME: asan-sasl-cyrus-openssl-rhel8-latest-clang-compile
       - command: expansions.update
         params:
           updates:
@@ -1052,14 +1079,14 @@ tasks:
       - func: bootstrap-mongo-orchestration
       - func: run-simple-http-server
       - func: run-tests
-  - name: asan-sasl-cyrus-openssl-ubuntu2004-clang-test-latest-server-auth
-    run_on: ubuntu2004-small
-    tags: [sanitizers-matrix-asan, test, ubuntu2004, clang, sasl-cyrus, asan, auth, server, latest, openssl]
-    depends_on: [{ name: asan-sasl-cyrus-openssl-ubuntu2004-clang-compile }]
+  - name: asan-sasl-cyrus-openssl-rhel8-latest-clang-test-latest-server-auth
+    run_on: rhel8-latest-large
+    tags: [sanitizers-matrix-asan, test, rhel8-latest, clang, sasl-cyrus, asan, auth, server, latest, openssl]
+    depends_on: [{ name: asan-sasl-cyrus-openssl-rhel8-latest-clang-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: asan-sasl-cyrus-openssl-ubuntu2004-clang-compile
+          BUILD_NAME: asan-sasl-cyrus-openssl-rhel8-latest-clang-compile
       - command: expansions.update
         params:
           updates:
@@ -1073,14 +1100,14 @@ tasks:
       - func: bootstrap-mongo-orchestration
       - func: run-simple-http-server
       - func: run-tests
-  - name: asan-sasl-cyrus-openssl-ubuntu2004-clang-test-latest-sharded-auth
-    run_on: ubuntu2004-small
-    tags: [sanitizers-matrix-asan, test, ubuntu2004, clang, sasl-cyrus, asan, auth, sharded, latest, openssl]
-    depends_on: [{ name: asan-sasl-cyrus-openssl-ubuntu2004-clang-compile }]
+  - name: asan-sasl-cyrus-openssl-rhel8-latest-clang-test-latest-sharded-auth
+    run_on: rhel8-latest-large
+    tags: [sanitizers-matrix-asan, test, rhel8-latest, clang, sasl-cyrus, asan, auth, sharded, latest, openssl]
+    depends_on: [{ name: asan-sasl-cyrus-openssl-rhel8-latest-clang-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: asan-sasl-cyrus-openssl-ubuntu2004-clang-compile
+          BUILD_NAME: asan-sasl-cyrus-openssl-rhel8-latest-clang-compile
       - command: expansions.update
         params:
           updates:
@@ -1097,28 +1124,70 @@ tasks:
   - name: check-headers
     commands:
       - func: check-headers
-  - name: "check:sasl=Cyrus\_\u2022\_tls=OpenSSL\_\u2022\_test_mongocxx_ref=none"
+  - name: "check:sasl=Cyrus\_\u2022\_tls=OpenSSL\_\u2022\_test_mongocxx_ref=master"
     run_on:
-      - ubuntu2204-large
-      - debian10-large
-      - debian11-large
       - amazon2
-    tags: [earthly, pr-merge-gate, alpine3.16-clang, alpine3.16-gcc, alpine3.17-clang, alpine3.17-gcc, alpine3.18-clang, alpine3.18-gcc, alpine3.19-clang, alpine3.19-gcc, archlinux-clang, archlinux-gcc, centos7-clang, centos7-gcc, u16-clang, u16-gcc, u18-clang, u18-gcc, u20-clang, u20-gcc, u22-clang, u22-gcc]
+      - debian11-large
+      - debian12-large
+      - ubuntu2204-large
+      - ubuntu2404-large
+    tags: [earthly, pr-merge-gate, alpine3.16-clang, alpine3.16-gcc, alpine3.17-clang, alpine3.17-gcc, alpine3.18-clang, alpine3.18-gcc, alpine3.19-clang, alpine3.19-gcc, archlinux-clang, archlinux-gcc, u20-clang, u20-gcc, u22-clang, u22-gcc]
     commands:
+      - func: docker-login-amazon-ecr
       - command: subprocess.exec
         type: setup
         params:
-          binary: bash
+          binary: ./tools/earthly.sh
+          working_dir: mongoc
+          include_expansions_in_env:
+            - DOCKER_CONFIG
           args:
-            - -c
-            - docker login -u "${artifactory_username}" --password-stdin artifactory.corp.mongodb.com <<<"${artifactory_password}"
+            - --buildkit-image=901841024863.dkr.ecr.us-east-1.amazonaws.com/dockerhub/earthly/buildkitd:v0.8.3
+            - +env-warmup
+            - --default_search_registry=901841024863.dkr.ecr.us-east-1.amazonaws.com/dockerhub
+            - --sasl=Cyrus
+            - --tls=OpenSSL
+            - --test_mongocxx_ref=master
+            - --env=${MONGOC_EARTHLY_ENV}
+            - --c_compiler=${MONGOC_EARTHLY_C_COMPILER}
+      - command: subprocess.exec
+        type: test
+        params:
+          binary: ./tools/earthly.sh
+          working_dir: mongoc
+          include_expansions_in_env:
+            - DOCKER_CONFIG
+          args:
+            - --buildkit-image=901841024863.dkr.ecr.us-east-1.amazonaws.com/dockerhub/earthly/buildkitd:v0.8.3
+            - +run
+            - --default_search_registry=901841024863.dkr.ecr.us-east-1.amazonaws.com/dockerhub
+            - --targets=test-example test-cxx-driver
+            - --sasl=Cyrus
+            - --tls=OpenSSL
+            - --test_mongocxx_ref=master
+            - --env=${MONGOC_EARTHLY_ENV}
+            - --c_compiler=${MONGOC_EARTHLY_C_COMPILER}
+  - name: "check:sasl=Cyrus\_\u2022\_tls=OpenSSL\_\u2022\_test_mongocxx_ref=none"
+    run_on:
+      - amazon2
+      - debian11-large
+      - debian12-large
+      - ubuntu2204-large
+      - ubuntu2404-large
+    tags: [earthly, pr-merge-gate, alpine3.16-clang, alpine3.16-gcc, alpine3.17-clang, alpine3.17-gcc, alpine3.18-clang, alpine3.18-gcc, alpine3.19-clang, alpine3.19-gcc, archlinux-clang, archlinux-gcc, centos7-clang, centos7-gcc, u16-clang, u16-gcc, u18-clang, u18-gcc, u20-clang, u20-gcc, u22-clang, u22-gcc]
+    commands:
+      - func: docker-login-amazon-ecr
       - command: subprocess.exec
         type: setup
         params:
           binary: ./tools/earthly.sh
           working_dir: mongoc
+          include_expansions_in_env:
+            - DOCKER_CONFIG
           args:
+            - --buildkit-image=901841024863.dkr.ecr.us-east-1.amazonaws.com/dockerhub/earthly/buildkitd:v0.8.3
             - +env-warmup
+            - --default_search_registry=901841024863.dkr.ecr.us-east-1.amazonaws.com/dockerhub
             - --sasl=Cyrus
             - --tls=OpenSSL
             - --test_mongocxx_ref=none
@@ -1129,36 +1198,125 @@ tasks:
         params:
           binary: ./tools/earthly.sh
           working_dir: mongoc
+          include_expansions_in_env:
+            - DOCKER_CONFIG
           args:
+            - --buildkit-image=901841024863.dkr.ecr.us-east-1.amazonaws.com/dockerhub/earthly/buildkitd:v0.8.3
             - +run
+            - --default_search_registry=901841024863.dkr.ecr.us-east-1.amazonaws.com/dockerhub
             - --targets=test-example
             - --sasl=Cyrus
             - --tls=OpenSSL
             - --test_mongocxx_ref=none
             - --env=${MONGOC_EARTHLY_ENV}
             - --c_compiler=${MONGOC_EARTHLY_C_COMPILER}
-  - name: "check:sasl=Cyrus\_\u2022\_tls=off\_\u2022\_test_mongocxx_ref=none"
+  - name: "check:sasl=Cyrus\_\u2022\_tls=OpenSSL\_\u2022\_test_mongocxx_ref=r4.1.0"
     run_on:
-      - ubuntu2204-large
-      - debian10-large
+      - amazon2
       - debian11-large
+      - debian12-large
+      - ubuntu2204-large
+      - ubuntu2404-large
+    tags: [earthly, pr-merge-gate, alpine3.16-clang, alpine3.16-gcc, alpine3.17-clang, alpine3.17-gcc, alpine3.18-clang, alpine3.18-gcc, alpine3.19-clang, alpine3.19-gcc, archlinux-clang, archlinux-gcc, u20-clang, u20-gcc, u22-clang, u22-gcc]
+    commands:
+      - func: docker-login-amazon-ecr
+      - command: subprocess.exec
+        type: setup
+        params:
+          binary: ./tools/earthly.sh
+          working_dir: mongoc
+          include_expansions_in_env:
+            - DOCKER_CONFIG
+          args:
+            - --buildkit-image=901841024863.dkr.ecr.us-east-1.amazonaws.com/dockerhub/earthly/buildkitd:v0.8.3
+            - +env-warmup
+            - --default_search_registry=901841024863.dkr.ecr.us-east-1.amazonaws.com/dockerhub
+            - --sasl=Cyrus
+            - --tls=OpenSSL
+            - --test_mongocxx_ref=r4.1.0
+            - --env=${MONGOC_EARTHLY_ENV}
+            - --c_compiler=${MONGOC_EARTHLY_C_COMPILER}
+      - command: subprocess.exec
+        type: test
+        params:
+          binary: ./tools/earthly.sh
+          working_dir: mongoc
+          include_expansions_in_env:
+            - DOCKER_CONFIG
+          args:
+            - --buildkit-image=901841024863.dkr.ecr.us-east-1.amazonaws.com/dockerhub/earthly/buildkitd:v0.8.3
+            - +run
+            - --default_search_registry=901841024863.dkr.ecr.us-east-1.amazonaws.com/dockerhub
+            - --targets=test-example test-cxx-driver
+            - --sasl=Cyrus
+            - --tls=OpenSSL
+            - --test_mongocxx_ref=r4.1.0
+            - --env=${MONGOC_EARTHLY_ENV}
+            - --c_compiler=${MONGOC_EARTHLY_C_COMPILER}
+  - name: "check:sasl=Cyrus\_\u2022\_tls=off\_\u2022\_test_mongocxx_ref=master"
+    run_on:
       - amazon2
-    tags: [earthly, pr-merge-gate, alpine3.16-clang, alpine3.16-gcc, alpine3.17-clang, alpine3.17-gcc, alpine3.18-clang, alpine3.18-gcc, alpine3.19-clang, alpine3.19-gcc, archlinux-clang, archlinux-gcc, centos7-clang, centos7-gcc, u16-clang, u16-gcc, u18-clang, u18-gcc, u20-clang, u20-gcc, u22-clang, u22-gcc]
+      - debian11-large
+      - debian12-large
+      - ubuntu2204-large
+      - ubuntu2404-large
+    tags: [earthly, pr-merge-gate, alpine3.16-clang, alpine3.16-gcc, alpine3.17-clang, alpine3.17-gcc, alpine3.18-clang, alpine3.18-gcc, alpine3.19-clang, alpine3.19-gcc, archlinux-clang, archlinux-gcc, u20-clang, u20-gcc, u22-clang, u22-gcc]
     commands:
+      - func: docker-login-amazon-ecr
       - command: subprocess.exec
         type: setup
         params:
-          binary: bash
+          binary: ./tools/earthly.sh
+          working_dir: mongoc
+          include_expansions_in_env:
+            - DOCKER_CONFIG
           args:
-            - -c
-            - docker login -u "${artifactory_username}" --password-stdin artifactory.corp.mongodb.com <<<"${artifactory_password}"
+            - --buildkit-image=901841024863.dkr.ecr.us-east-1.amazonaws.com/dockerhub/earthly/buildkitd:v0.8.3
+            - +env-warmup
+            - --default_search_registry=901841024863.dkr.ecr.us-east-1.amazonaws.com/dockerhub
+            - --sasl=Cyrus
+            - --tls=off
+            - --test_mongocxx_ref=master
+            - --env=${MONGOC_EARTHLY_ENV}
+            - --c_compiler=${MONGOC_EARTHLY_C_COMPILER}
+      - command: subprocess.exec
+        type: test
+        params:
+          binary: ./tools/earthly.sh
+          working_dir: mongoc
+          include_expansions_in_env:
+            - DOCKER_CONFIG
+          args:
+            - --buildkit-image=901841024863.dkr.ecr.us-east-1.amazonaws.com/dockerhub/earthly/buildkitd:v0.8.3
+            - +run
+            - --default_search_registry=901841024863.dkr.ecr.us-east-1.amazonaws.com/dockerhub
+            - --targets=test-example test-cxx-driver
+            - --sasl=Cyrus
+            - --tls=off
+            - --test_mongocxx_ref=master
+            - --env=${MONGOC_EARTHLY_ENV}
+            - --c_compiler=${MONGOC_EARTHLY_C_COMPILER}
+  - name: "check:sasl=Cyrus\_\u2022\_tls=off\_\u2022\_test_mongocxx_ref=none"
+    run_on:
+      - amazon2
+      - debian11-large
+      - debian12-large
+      - ubuntu2204-large
+      - ubuntu2404-large
+    tags: [earthly, pr-merge-gate, alpine3.16-clang, alpine3.16-gcc, alpine3.17-clang, alpine3.17-gcc, alpine3.18-clang, alpine3.18-gcc, alpine3.19-clang, alpine3.19-gcc, archlinux-clang, archlinux-gcc, centos7-clang, centos7-gcc, u16-clang, u16-gcc, u18-clang, u18-gcc, u20-clang, u20-gcc, u22-clang, u22-gcc]
+    commands:
+      - func: docker-login-amazon-ecr
       - command: subprocess.exec
         type: setup
         params:
           binary: ./tools/earthly.sh
           working_dir: mongoc
+          include_expansions_in_env:
+            - DOCKER_CONFIG
           args:
+            - --buildkit-image=901841024863.dkr.ecr.us-east-1.amazonaws.com/dockerhub/earthly/buildkitd:v0.8.3
             - +env-warmup
+            - --default_search_registry=901841024863.dkr.ecr.us-east-1.amazonaws.com/dockerhub
             - --sasl=Cyrus
             - --tls=off
             - --test_mongocxx_ref=none
@@ -1169,36 +1327,125 @@ tasks:
         params:
           binary: ./tools/earthly.sh
           working_dir: mongoc
+          include_expansions_in_env:
+            - DOCKER_CONFIG
           args:
+            - --buildkit-image=901841024863.dkr.ecr.us-east-1.amazonaws.com/dockerhub/earthly/buildkitd:v0.8.3
             - +run
+            - --default_search_registry=901841024863.dkr.ecr.us-east-1.amazonaws.com/dockerhub
             - --targets=test-example
             - --sasl=Cyrus
             - --tls=off
             - --test_mongocxx_ref=none
             - --env=${MONGOC_EARTHLY_ENV}
             - --c_compiler=${MONGOC_EARTHLY_C_COMPILER}
-  - name: "check:sasl=off\_\u2022\_tls=OpenSSL\_\u2022\_test_mongocxx_ref=none"
+  - name: "check:sasl=Cyrus\_\u2022\_tls=off\_\u2022\_test_mongocxx_ref=r4.1.0"
     run_on:
-      - ubuntu2204-large
-      - debian10-large
+      - amazon2
       - debian11-large
+      - debian12-large
+      - ubuntu2204-large
+      - ubuntu2404-large
+    tags: [earthly, pr-merge-gate, alpine3.16-clang, alpine3.16-gcc, alpine3.17-clang, alpine3.17-gcc, alpine3.18-clang, alpine3.18-gcc, alpine3.19-clang, alpine3.19-gcc, archlinux-clang, archlinux-gcc, u20-clang, u20-gcc, u22-clang, u22-gcc]
+    commands:
+      - func: docker-login-amazon-ecr
+      - command: subprocess.exec
+        type: setup
+        params:
+          binary: ./tools/earthly.sh
+          working_dir: mongoc
+          include_expansions_in_env:
+            - DOCKER_CONFIG
+          args:
+            - --buildkit-image=901841024863.dkr.ecr.us-east-1.amazonaws.com/dockerhub/earthly/buildkitd:v0.8.3
+            - +env-warmup
+            - --default_search_registry=901841024863.dkr.ecr.us-east-1.amazonaws.com/dockerhub
+            - --sasl=Cyrus
+            - --tls=off
+            - --test_mongocxx_ref=r4.1.0
+            - --env=${MONGOC_EARTHLY_ENV}
+            - --c_compiler=${MONGOC_EARTHLY_C_COMPILER}
+      - command: subprocess.exec
+        type: test
+        params:
+          binary: ./tools/earthly.sh
+          working_dir: mongoc
+          include_expansions_in_env:
+            - DOCKER_CONFIG
+          args:
+            - --buildkit-image=901841024863.dkr.ecr.us-east-1.amazonaws.com/dockerhub/earthly/buildkitd:v0.8.3
+            - +run
+            - --default_search_registry=901841024863.dkr.ecr.us-east-1.amazonaws.com/dockerhub
+            - --targets=test-example test-cxx-driver
+            - --sasl=Cyrus
+            - --tls=off
+            - --test_mongocxx_ref=r4.1.0
+            - --env=${MONGOC_EARTHLY_ENV}
+            - --c_compiler=${MONGOC_EARTHLY_C_COMPILER}
+  - name: "check:sasl=off\_\u2022\_tls=OpenSSL\_\u2022\_test_mongocxx_ref=master"
+    run_on:
       - amazon2
-    tags: [earthly, pr-merge-gate, alpine3.16-clang, alpine3.16-gcc, alpine3.17-clang, alpine3.17-gcc, alpine3.18-clang, alpine3.18-gcc, alpine3.19-clang, alpine3.19-gcc, archlinux-clang, archlinux-gcc, centos7-clang, centos7-gcc, u16-clang, u16-gcc, u18-clang, u18-gcc, u20-clang, u20-gcc, u22-clang, u22-gcc]
+      - debian11-large
+      - debian12-large
+      - ubuntu2204-large
+      - ubuntu2404-large
+    tags: [earthly, pr-merge-gate, alpine3.16-clang, alpine3.16-gcc, alpine3.17-clang, alpine3.17-gcc, alpine3.18-clang, alpine3.18-gcc, alpine3.19-clang, alpine3.19-gcc, archlinux-clang, archlinux-gcc, u20-clang, u20-gcc, u22-clang, u22-gcc]
     commands:
+      - func: docker-login-amazon-ecr
       - command: subprocess.exec
         type: setup
         params:
-          binary: bash
+          binary: ./tools/earthly.sh
+          working_dir: mongoc
+          include_expansions_in_env:
+            - DOCKER_CONFIG
           args:
-            - -c
-            - docker login -u "${artifactory_username}" --password-stdin artifactory.corp.mongodb.com <<<"${artifactory_password}"
+            - --buildkit-image=901841024863.dkr.ecr.us-east-1.amazonaws.com/dockerhub/earthly/buildkitd:v0.8.3
+            - +env-warmup
+            - --default_search_registry=901841024863.dkr.ecr.us-east-1.amazonaws.com/dockerhub
+            - --sasl=off
+            - --tls=OpenSSL
+            - --test_mongocxx_ref=master
+            - --env=${MONGOC_EARTHLY_ENV}
+            - --c_compiler=${MONGOC_EARTHLY_C_COMPILER}
+      - command: subprocess.exec
+        type: test
+        params:
+          binary: ./tools/earthly.sh
+          working_dir: mongoc
+          include_expansions_in_env:
+            - DOCKER_CONFIG
+          args:
+            - --buildkit-image=901841024863.dkr.ecr.us-east-1.amazonaws.com/dockerhub/earthly/buildkitd:v0.8.3
+            - +run
+            - --default_search_registry=901841024863.dkr.ecr.us-east-1.amazonaws.com/dockerhub
+            - --targets=test-example test-cxx-driver
+            - --sasl=off
+            - --tls=OpenSSL
+            - --test_mongocxx_ref=master
+            - --env=${MONGOC_EARTHLY_ENV}
+            - --c_compiler=${MONGOC_EARTHLY_C_COMPILER}
+  - name: "check:sasl=off\_\u2022\_tls=OpenSSL\_\u2022\_test_mongocxx_ref=none"
+    run_on:
+      - amazon2
+      - debian11-large
+      - debian12-large
+      - ubuntu2204-large
+      - ubuntu2404-large
+    tags: [earthly, pr-merge-gate, alpine3.16-clang, alpine3.16-gcc, alpine3.17-clang, alpine3.17-gcc, alpine3.18-clang, alpine3.18-gcc, alpine3.19-clang, alpine3.19-gcc, archlinux-clang, archlinux-gcc, centos7-clang, centos7-gcc, u16-clang, u16-gcc, u18-clang, u18-gcc, u20-clang, u20-gcc, u22-clang, u22-gcc]
+    commands:
+      - func: docker-login-amazon-ecr
       - command: subprocess.exec
         type: setup
         params:
           binary: ./tools/earthly.sh
           working_dir: mongoc
+          include_expansions_in_env:
+            - DOCKER_CONFIG
           args:
+            - --buildkit-image=901841024863.dkr.ecr.us-east-1.amazonaws.com/dockerhub/earthly/buildkitd:v0.8.3
             - +env-warmup
+            - --default_search_registry=901841024863.dkr.ecr.us-east-1.amazonaws.com/dockerhub
             - --sasl=off
             - --tls=OpenSSL
             - --test_mongocxx_ref=none
@@ -1209,36 +1456,125 @@ tasks:
         params:
           binary: ./tools/earthly.sh
           working_dir: mongoc
+          include_expansions_in_env:
+            - DOCKER_CONFIG
           args:
+            - --buildkit-image=901841024863.dkr.ecr.us-east-1.amazonaws.com/dockerhub/earthly/buildkitd:v0.8.3
             - +run
+            - --default_search_registry=901841024863.dkr.ecr.us-east-1.amazonaws.com/dockerhub
             - --targets=test-example
             - --sasl=off
             - --tls=OpenSSL
             - --test_mongocxx_ref=none
             - --env=${MONGOC_EARTHLY_ENV}
             - --c_compiler=${MONGOC_EARTHLY_C_COMPILER}
-  - name: "check:sasl=off\_\u2022\_tls=off\_\u2022\_test_mongocxx_ref=none"
+  - name: "check:sasl=off\_\u2022\_tls=OpenSSL\_\u2022\_test_mongocxx_ref=r4.1.0"
     run_on:
-      - ubuntu2204-large
-      - debian10-large
+      - amazon2
       - debian11-large
+      - debian12-large
+      - ubuntu2204-large
+      - ubuntu2404-large
+    tags: [earthly, pr-merge-gate, alpine3.16-clang, alpine3.16-gcc, alpine3.17-clang, alpine3.17-gcc, alpine3.18-clang, alpine3.18-gcc, alpine3.19-clang, alpine3.19-gcc, archlinux-clang, archlinux-gcc, u20-clang, u20-gcc, u22-clang, u22-gcc]
+    commands:
+      - func: docker-login-amazon-ecr
+      - command: subprocess.exec
+        type: setup
+        params:
+          binary: ./tools/earthly.sh
+          working_dir: mongoc
+          include_expansions_in_env:
+            - DOCKER_CONFIG
+          args:
+            - --buildkit-image=901841024863.dkr.ecr.us-east-1.amazonaws.com/dockerhub/earthly/buildkitd:v0.8.3
+            - +env-warmup
+            - --default_search_registry=901841024863.dkr.ecr.us-east-1.amazonaws.com/dockerhub
+            - --sasl=off
+            - --tls=OpenSSL
+            - --test_mongocxx_ref=r4.1.0
+            - --env=${MONGOC_EARTHLY_ENV}
+            - --c_compiler=${MONGOC_EARTHLY_C_COMPILER}
+      - command: subprocess.exec
+        type: test
+        params:
+          binary: ./tools/earthly.sh
+          working_dir: mongoc
+          include_expansions_in_env:
+            - DOCKER_CONFIG
+          args:
+            - --buildkit-image=901841024863.dkr.ecr.us-east-1.amazonaws.com/dockerhub/earthly/buildkitd:v0.8.3
+            - +run
+            - --default_search_registry=901841024863.dkr.ecr.us-east-1.amazonaws.com/dockerhub
+            - --targets=test-example test-cxx-driver
+            - --sasl=off
+            - --tls=OpenSSL
+            - --test_mongocxx_ref=r4.1.0
+            - --env=${MONGOC_EARTHLY_ENV}
+            - --c_compiler=${MONGOC_EARTHLY_C_COMPILER}
+  - name: "check:sasl=off\_\u2022\_tls=off\_\u2022\_test_mongocxx_ref=master"
+    run_on:
       - amazon2
-    tags: [earthly, pr-merge-gate, alpine3.16-clang, alpine3.16-gcc, alpine3.17-clang, alpine3.17-gcc, alpine3.18-clang, alpine3.18-gcc, alpine3.19-clang, alpine3.19-gcc, archlinux-clang, archlinux-gcc, centos7-clang, centos7-gcc, u16-clang, u16-gcc, u18-clang, u18-gcc, u20-clang, u20-gcc, u22-clang, u22-gcc]
+      - debian11-large
+      - debian12-large
+      - ubuntu2204-large
+      - ubuntu2404-large
+    tags: [earthly, pr-merge-gate, alpine3.16-clang, alpine3.16-gcc, alpine3.17-clang, alpine3.17-gcc, alpine3.18-clang, alpine3.18-gcc, alpine3.19-clang, alpine3.19-gcc, archlinux-clang, archlinux-gcc, u20-clang, u20-gcc, u22-clang, u22-gcc]
     commands:
+      - func: docker-login-amazon-ecr
       - command: subprocess.exec
         type: setup
         params:
-          binary: bash
+          binary: ./tools/earthly.sh
+          working_dir: mongoc
+          include_expansions_in_env:
+            - DOCKER_CONFIG
           args:
-            - -c
-            - docker login -u "${artifactory_username}" --password-stdin artifactory.corp.mongodb.com <<<"${artifactory_password}"
+            - --buildkit-image=901841024863.dkr.ecr.us-east-1.amazonaws.com/dockerhub/earthly/buildkitd:v0.8.3
+            - +env-warmup
+            - --default_search_registry=901841024863.dkr.ecr.us-east-1.amazonaws.com/dockerhub
+            - --sasl=off
+            - --tls=off
+            - --test_mongocxx_ref=master
+            - --env=${MONGOC_EARTHLY_ENV}
+            - --c_compiler=${MONGOC_EARTHLY_C_COMPILER}
+      - command: subprocess.exec
+        type: test
+        params:
+          binary: ./tools/earthly.sh
+          working_dir: mongoc
+          include_expansions_in_env:
+            - DOCKER_CONFIG
+          args:
+            - --buildkit-image=901841024863.dkr.ecr.us-east-1.amazonaws.com/dockerhub/earthly/buildkitd:v0.8.3
+            - +run
+            - --default_search_registry=901841024863.dkr.ecr.us-east-1.amazonaws.com/dockerhub
+            - --targets=test-example test-cxx-driver
+            - --sasl=off
+            - --tls=off
+            - --test_mongocxx_ref=master
+            - --env=${MONGOC_EARTHLY_ENV}
+            - --c_compiler=${MONGOC_EARTHLY_C_COMPILER}
+  - name: "check:sasl=off\_\u2022\_tls=off\_\u2022\_test_mongocxx_ref=none"
+    run_on:
+      - amazon2
+      - debian11-large
+      - debian12-large
+      - ubuntu2204-large
+      - ubuntu2404-large
+    tags: [earthly, pr-merge-gate, alpine3.16-clang, alpine3.16-gcc, alpine3.17-clang, alpine3.17-gcc, alpine3.18-clang, alpine3.18-gcc, alpine3.19-clang, alpine3.19-gcc, archlinux-clang, archlinux-gcc, centos7-clang, centos7-gcc, u16-clang, u16-gcc, u18-clang, u18-gcc, u20-clang, u20-gcc, u22-clang, u22-gcc]
+    commands:
+      - func: docker-login-amazon-ecr
       - command: subprocess.exec
         type: setup
         params:
           binary: ./tools/earthly.sh
           working_dir: mongoc
+          include_expansions_in_env:
+            - DOCKER_CONFIG
           args:
+            - --buildkit-image=901841024863.dkr.ecr.us-east-1.amazonaws.com/dockerhub/earthly/buildkitd:v0.8.3
             - +env-warmup
+            - --default_search_registry=901841024863.dkr.ecr.us-east-1.amazonaws.com/dockerhub
             - --sasl=off
             - --tls=off
             - --test_mongocxx_ref=none
@@ -1249,14 +1585,61 @@ tasks:
         params:
           binary: ./tools/earthly.sh
           working_dir: mongoc
+          include_expansions_in_env:
+            - DOCKER_CONFIG
           args:
+            - --buildkit-image=901841024863.dkr.ecr.us-east-1.amazonaws.com/dockerhub/earthly/buildkitd:v0.8.3
             - +run
+            - --default_search_registry=901841024863.dkr.ecr.us-east-1.amazonaws.com/dockerhub
             - --targets=test-example
             - --sasl=off
             - --tls=off
             - --test_mongocxx_ref=none
             - --env=${MONGOC_EARTHLY_ENV}
             - --c_compiler=${MONGOC_EARTHLY_C_COMPILER}
+  - name: "check:sasl=off\_\u2022\_tls=off\_\u2022\_test_mongocxx_ref=r4.1.0"
+    run_on:
+      - amazon2
+      - debian11-large
+      - debian12-large
+      - ubuntu2204-large
+      - ubuntu2404-large
+    tags: [earthly, pr-merge-gate, alpine3.16-clang, alpine3.16-gcc, alpine3.17-clang, alpine3.17-gcc, alpine3.18-clang, alpine3.18-gcc, alpine3.19-clang, alpine3.19-gcc, archlinux-clang, archlinux-gcc, u20-clang, u20-gcc, u22-clang, u22-gcc]
+    commands:
+      - func: docker-login-amazon-ecr
+      - command: subprocess.exec
+        type: setup
+        params:
+          binary: ./tools/earthly.sh
+          working_dir: mongoc
+          include_expansions_in_env:
+            - DOCKER_CONFIG
+          args:
+            - --buildkit-image=901841024863.dkr.ecr.us-east-1.amazonaws.com/dockerhub/earthly/buildkitd:v0.8.3
+            - +env-warmup
+            - --default_search_registry=901841024863.dkr.ecr.us-east-1.amazonaws.com/dockerhub
+            - --sasl=off
+            - --tls=off
+            - --test_mongocxx_ref=r4.1.0
+            - --env=${MONGOC_EARTHLY_ENV}
+            - --c_compiler=${MONGOC_EARTHLY_C_COMPILER}
+      - command: subprocess.exec
+        type: test
+        params:
+          binary: ./tools/earthly.sh
+          working_dir: mongoc
+          include_expansions_in_env:
+            - DOCKER_CONFIG
+          args:
+            - --buildkit-image=901841024863.dkr.ecr.us-east-1.amazonaws.com/dockerhub/earthly/buildkitd:v0.8.3
+            - +run
+            - --default_search_registry=901841024863.dkr.ecr.us-east-1.amazonaws.com/dockerhub
+            - --targets=test-example test-cxx-driver
+            - --sasl=off
+            - --tls=off
+            - --test_mongocxx_ref=r4.1.0
+            - --env=${MONGOC_EARTHLY_ENV}
+            - --c_compiler=${MONGOC_EARTHLY_C_COMPILER}
   - name: clang-format
     tags: [clang-format]
     commands:
@@ -1522,9 +1905,9 @@ tasks:
       - func: bootstrap-mongo-orchestration
       - func: run-mock-kms-servers
       - func: run-tests
-  - name: cse-sasl-cyrus-openssl-debian10-clang-compile
-    run_on: debian10-large
-    tags: [cse-matrix-openssl, compile, debian10, clang, cse, sasl-cyrus]
+  - name: cse-sasl-cyrus-openssl-debian11-clang-compile
+    run_on: debian11-large
+    tags: [cse-matrix-openssl, compile, debian11, clang, cse, sasl-cyrus]
     commands:
       - func: find-cmake-latest
       - func: cse-sasl-cyrus-openssl-compile
@@ -1532,9 +1915,9 @@ tasks:
           CC: clang
           CXX: clang++
       - func: upload-build
-  - name: cse-sasl-cyrus-openssl-debian10-gcc-compile
-    run_on: debian10-large
-    tags: [cse-matrix-openssl, compile, debian10, gcc, cse, sasl-cyrus]
+  - name: cse-sasl-cyrus-openssl-debian11-gcc-compile
+    run_on: debian11-large
+    tags: [cse-matrix-openssl, compile, debian11, gcc, cse, sasl-cyrus]
     commands:
       - func: find-cmake-latest
       - func: cse-sasl-cyrus-openssl-compile
@@ -1542,14 +1925,44 @@ tasks:
           CC: gcc
           CXX: g++
       - func: upload-build
-  - name: cse-sasl-cyrus-openssl-debian10-gcc-test-4.2-replica-auth
-    run_on: debian10-small
-    tags: [cse-matrix-openssl, test, debian10, gcc, sasl-cyrus, cse, auth, replica, "4.2", openssl]
-    depends_on: [{ name: cse-sasl-cyrus-openssl-debian10-gcc-compile }]
+  - name: cse-sasl-cyrus-openssl-debian12-clang-compile
+    run_on: debian12-large
+    tags: [cse-matrix-openssl, compile, debian12, clang, cse, sasl-cyrus]
+    commands:
+      - func: find-cmake-latest
+      - func: cse-sasl-cyrus-openssl-compile
+        vars:
+          CC: clang
+          CXX: clang++
+      - func: upload-build
+  - name: cse-sasl-cyrus-openssl-debian12-gcc-compile
+    run_on: debian12-large
+    tags: [cse-matrix-openssl, compile, debian12, gcc, cse, sasl-cyrus]
+    commands:
+      - func: find-cmake-latest
+      - func: cse-sasl-cyrus-openssl-compile
+        vars:
+          CC: gcc
+          CXX: g++
+      - func: upload-build
+  - name: cse-sasl-cyrus-openssl-rhel8-latest-gcc-compile
+    run_on: rhel8-latest-large
+    tags: [cse-matrix-openssl, compile, rhel8-latest, gcc, cse, sasl-cyrus]
+    commands:
+      - func: find-cmake-latest
+      - func: cse-sasl-cyrus-openssl-compile
+        vars:
+          CC: gcc
+          CXX: g++
+      - func: upload-build
+  - name: cse-sasl-cyrus-openssl-rhel8-latest-gcc-test-4.2-replica-auth
+    run_on: rhel8-latest-large
+    tags: [cse-matrix-openssl, test, rhel8-latest, gcc, sasl-cyrus, cse, auth, replica, "4.2", openssl]
+    depends_on: [{ name: cse-sasl-cyrus-openssl-rhel8-latest-gcc-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: cse-sasl-cyrus-openssl-debian10-gcc-compile
+          BUILD_NAME: cse-sasl-cyrus-openssl-rhel8-latest-gcc-compile
       - command: expansions.update
         params:
           updates:
@@ -1563,14 +1976,14 @@ tasks:
       - func: bootstrap-mongo-orchestration
       - func: run-mock-kms-servers
       - func: run-tests
-  - name: cse-sasl-cyrus-openssl-debian10-gcc-test-4.2-server-auth
-    run_on: debian10-small
-    tags: [cse-matrix-openssl, test, debian10, gcc, sasl-cyrus, cse, auth, server, "4.2", openssl]
-    depends_on: [{ name: cse-sasl-cyrus-openssl-debian10-gcc-compile }]
+  - name: cse-sasl-cyrus-openssl-rhel8-latest-gcc-test-4.2-server-auth
+    run_on: rhel8-latest-large
+    tags: [cse-matrix-openssl, test, rhel8-latest, gcc, sasl-cyrus, cse, auth, server, "4.2", openssl]
+    depends_on: [{ name: cse-sasl-cyrus-openssl-rhel8-latest-gcc-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: cse-sasl-cyrus-openssl-debian10-gcc-compile
+          BUILD_NAME: cse-sasl-cyrus-openssl-rhel8-latest-gcc-compile
       - command: expansions.update
         params:
           updates:
@@ -1584,66 +1997,77 @@ tasks:
       - func: bootstrap-mongo-orchestration
       - func: run-mock-kms-servers
       - func: run-tests
-  - name: cse-sasl-cyrus-openssl-debian11-clang-compile
-    run_on: debian11-large
-    tags: [cse-matrix-openssl, compile, debian11, clang, cse, sasl-cyrus]
-    commands:
-      - func: find-cmake-latest
-      - func: cse-sasl-cyrus-openssl-compile
-        vars:
-          CC: clang
-          CXX: clang++
-      - func: upload-build
-  - name: cse-sasl-cyrus-openssl-debian11-gcc-compile
-    run_on: debian11-large
-    tags: [cse-matrix-openssl, compile, debian11, gcc, cse, sasl-cyrus]
-    commands:
-      - func: find-cmake-latest
-      - func: cse-sasl-cyrus-openssl-compile
-        vars:
-          CC: gcc
-          CXX: g++
-      - func: upload-build
-  - name: cse-sasl-cyrus-openssl-debian92-clang-compile
-    run_on: debian92-large
-    tags: [cse-matrix-openssl, compile, debian92, clang, cse, sasl-cyrus]
+  - name: cse-sasl-cyrus-openssl-rhel8-latest-gcc-test-4.4-replica-auth
+    run_on: rhel8-latest-large
+    tags: [cse-matrix-openssl, test, rhel8-latest, gcc, sasl-cyrus, cse, auth, replica, "4.4", openssl]
+    depends_on: [{ name: cse-sasl-cyrus-openssl-rhel8-latest-gcc-compile }]
     commands:
-      - func: find-cmake-latest
-      - func: cse-sasl-cyrus-openssl-compile
+      - func: fetch-build
         vars:
-          CC: clang
-          CXX: clang++
-      - func: upload-build
-  - name: cse-sasl-cyrus-openssl-debian92-gcc-compile
-    run_on: debian92-large
-    tags: [cse-matrix-openssl, compile, debian92, gcc, cse, sasl-cyrus]
+          BUILD_NAME: cse-sasl-cyrus-openssl-rhel8-latest-gcc-compile
+      - command: expansions.update
+        params:
+          updates:
+            - { key: CC, value: gcc }
+            - { key: CXX, value: g++ }
+            - { key: AUTH, value: auth }
+            - { key: MONGODB_VERSION, value: "4.4" }
+            - { key: TOPOLOGY, value: replica_set }
+            - { key: SSL, value: openssl }
+      - func: fetch-det
+      - func: bootstrap-mongo-orchestration
+      - func: run-mock-kms-servers
+      - func: run-tests
+  - name: cse-sasl-cyrus-openssl-rhel8-latest-gcc-test-4.4-server-auth
+    run_on: rhel8-latest-large
+    tags: [cse-matrix-openssl, test, rhel8-latest, gcc, sasl-cyrus, cse, auth, server, "4.4", openssl]
+    depends_on: [{ name: cse-sasl-cyrus-openssl-rhel8-latest-gcc-compile }]
     commands:
-      - func: find-cmake-latest
-      - func: cse-sasl-cyrus-openssl-compile
+      - func: fetch-build
         vars:
-          CC: gcc
-          CXX: g++
-      - func: upload-build
-  - name: cse-sasl-cyrus-openssl-rhel8-zseries-gcc-compile
-    run_on: rhel8-zseries-large
-    tags: [cse-matrix-openssl, compile, rhel8-zseries, gcc, cse, sasl-cyrus]
-    patchable: false
+          BUILD_NAME: cse-sasl-cyrus-openssl-rhel8-latest-gcc-compile
+      - command: expansions.update
+        params:
+          updates:
+            - { key: CC, value: gcc }
+            - { key: CXX, value: g++ }
+            - { key: AUTH, value: auth }
+            - { key: MONGODB_VERSION, value: "4.4" }
+            - { key: TOPOLOGY, value: server }
+            - { key: SSL, value: openssl }
+      - func: fetch-det
+      - func: bootstrap-mongo-orchestration
+      - func: run-mock-kms-servers
+      - func: run-tests
+  - name: cse-sasl-cyrus-openssl-rhel8-latest-gcc-test-5.0-replica-auth
+    run_on: rhel8-latest-large
+    tags: [cse-matrix-openssl, test, rhel8-latest, gcc, sasl-cyrus, cse, auth, replica, "5.0", openssl]
+    depends_on: [{ name: cse-sasl-cyrus-openssl-rhel8-latest-gcc-compile }]
     commands:
-      - func: find-cmake-latest
-      - func: cse-sasl-cyrus-openssl-compile
+      - func: fetch-build
         vars:
-          CC: gcc
-          CXX: g++
-      - func: upload-build
-  - name: cse-sasl-cyrus-openssl-rhel8-zseries-gcc-test-5.0-server-auth
-    run_on: rhel8-zseries-small
-    tags: [cse-matrix-openssl, test, rhel8-zseries, gcc, sasl-cyrus, cse, auth, server, "5.0", openssl]
-    depends_on: [{ name: cse-sasl-cyrus-openssl-rhel8-zseries-gcc-compile }]
-    patchable: false
+          BUILD_NAME: cse-sasl-cyrus-openssl-rhel8-latest-gcc-compile
+      - command: expansions.update
+        params:
+          updates:
+            - { key: CC, value: gcc }
+            - { key: CXX, value: g++ }
+            - { key: AUTH, value: auth }
+            - { key: MONGODB_VERSION, value: "5.0" }
+            - { key: TOPOLOGY, value: replica_set }
+            - { key: SSL, value: openssl }
+      - func: fetch-det
+      - func: bootstrap-mongo-orchestration
+      - func: run-mock-kms-servers
+      - func: run-tests
+  - name: cse-sasl-cyrus-openssl-rhel8-latest-gcc-test-5.0-server-auth
+    run_on: rhel8-latest-large
+    tags: [cse-matrix-openssl, test, rhel8-latest, gcc, sasl-cyrus, cse, auth, server, "5.0", openssl]
+    depends_on: [{ name: cse-sasl-cyrus-openssl-rhel8-latest-gcc-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: cse-sasl-cyrus-openssl-rhel8-zseries-gcc-compile
+          BUILD_NAME: cse-sasl-cyrus-openssl-rhel8-latest-gcc-compile
       - command: expansions.update
         params:
           updates:
@@ -1657,208 +2081,194 @@ tasks:
       - func: bootstrap-mongo-orchestration
       - func: run-mock-kms-servers
       - func: run-tests
-  - name: cse-sasl-cyrus-openssl-rhel8-zseries-gcc-test-7.0-replica-auth
-    run_on: rhel8-zseries-small
-    tags: [cse-matrix-openssl, test, rhel8-zseries, gcc, sasl-cyrus, cse, auth, replica, "7.0", openssl]
-    depends_on: [{ name: cse-sasl-cyrus-openssl-rhel8-zseries-gcc-compile }]
-    patchable: false
+  - name: cse-sasl-cyrus-openssl-rhel8-latest-gcc-test-6.0-replica-auth
+    run_on: rhel8-latest-large
+    tags: [cse-matrix-openssl, test, rhel8-latest, gcc, sasl-cyrus, cse, auth, replica, "6.0", openssl]
+    depends_on: [{ name: cse-sasl-cyrus-openssl-rhel8-latest-gcc-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: cse-sasl-cyrus-openssl-rhel8-zseries-gcc-compile
+          BUILD_NAME: cse-sasl-cyrus-openssl-rhel8-latest-gcc-compile
       - command: expansions.update
         params:
           updates:
             - { key: CC, value: gcc }
             - { key: CXX, value: g++ }
             - { key: AUTH, value: auth }
-            - { key: MONGODB_VERSION, value: "7.0" }
+            - { key: MONGODB_VERSION, value: "6.0" }
             - { key: TOPOLOGY, value: replica_set }
             - { key: SSL, value: openssl }
       - func: fetch-det
       - func: bootstrap-mongo-orchestration
       - func: run-mock-kms-servers
       - func: run-tests
-  - name: cse-sasl-cyrus-openssl-rhel8-zseries-gcc-test-7.0-server-auth
-    run_on: rhel8-zseries-small
-    tags: [cse-matrix-openssl, test, rhel8-zseries, gcc, sasl-cyrus, cse, auth, server, "7.0", openssl]
-    depends_on: [{ name: cse-sasl-cyrus-openssl-rhel8-zseries-gcc-compile }]
-    patchable: false
+  - name: cse-sasl-cyrus-openssl-rhel8-latest-gcc-test-6.0-server-auth
+    run_on: rhel8-latest-large
+    tags: [cse-matrix-openssl, test, rhel8-latest, gcc, sasl-cyrus, cse, auth, server, "6.0", openssl]
+    depends_on: [{ name: cse-sasl-cyrus-openssl-rhel8-latest-gcc-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: cse-sasl-cyrus-openssl-rhel8-zseries-gcc-compile
+          BUILD_NAME: cse-sasl-cyrus-openssl-rhel8-latest-gcc-compile
       - command: expansions.update
         params:
           updates:
             - { key: CC, value: gcc }
             - { key: CXX, value: g++ }
             - { key: AUTH, value: auth }
-            - { key: MONGODB_VERSION, value: "7.0" }
+            - { key: MONGODB_VERSION, value: "6.0" }
             - { key: TOPOLOGY, value: server }
             - { key: SSL, value: openssl }
       - func: fetch-det
       - func: bootstrap-mongo-orchestration
       - func: run-mock-kms-servers
       - func: run-tests
-  - name: cse-sasl-cyrus-openssl-rhel8-zseries-gcc-test-8.0-replica-auth
-    run_on: rhel8-zseries-small
-    tags: [cse-matrix-openssl, test, rhel8-zseries, gcc, sasl-cyrus, cse, auth, replica, "8.0", openssl]
-    depends_on: [{ name: cse-sasl-cyrus-openssl-rhel8-zseries-gcc-compile }]
-    patchable: false
+  - name: cse-sasl-cyrus-openssl-rhel8-latest-gcc-test-7.0-replica-auth
+    run_on: rhel8-latest-large
+    tags: [cse-matrix-openssl, test, rhel8-latest, gcc, sasl-cyrus, cse, auth, replica, "7.0", openssl]
+    depends_on: [{ name: cse-sasl-cyrus-openssl-rhel8-latest-gcc-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: cse-sasl-cyrus-openssl-rhel8-zseries-gcc-compile
+          BUILD_NAME: cse-sasl-cyrus-openssl-rhel8-latest-gcc-compile
       - command: expansions.update
         params:
           updates:
             - { key: CC, value: gcc }
             - { key: CXX, value: g++ }
             - { key: AUTH, value: auth }
-            - { key: MONGODB_VERSION, value: "8.0" }
+            - { key: MONGODB_VERSION, value: "7.0" }
             - { key: TOPOLOGY, value: replica_set }
             - { key: SSL, value: openssl }
       - func: fetch-det
       - func: bootstrap-mongo-orchestration
       - func: run-mock-kms-servers
       - func: run-tests
-  - name: cse-sasl-cyrus-openssl-rhel8-zseries-gcc-test-8.0-server-auth
-    run_on: rhel8-zseries-small
-    tags: [cse-matrix-openssl, test, rhel8-zseries, gcc, sasl-cyrus, cse, auth, server, "8.0", openssl]
-    depends_on: [{ name: cse-sasl-cyrus-openssl-rhel8-zseries-gcc-compile }]
-    patchable: false
+  - name: cse-sasl-cyrus-openssl-rhel8-latest-gcc-test-7.0-server-auth
+    run_on: rhel8-latest-large
+    tags: [cse-matrix-openssl, test, rhel8-latest, gcc, sasl-cyrus, cse, auth, server, "7.0", openssl]
+    depends_on: [{ name: cse-sasl-cyrus-openssl-rhel8-latest-gcc-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: cse-sasl-cyrus-openssl-rhel8-zseries-gcc-compile
+          BUILD_NAME: cse-sasl-cyrus-openssl-rhel8-latest-gcc-compile
       - command: expansions.update
         params:
           updates:
             - { key: CC, value: gcc }
             - { key: CXX, value: g++ }
             - { key: AUTH, value: auth }
-            - { key: MONGODB_VERSION, value: "8.0" }
+            - { key: MONGODB_VERSION, value: "7.0" }
             - { key: TOPOLOGY, value: server }
             - { key: SSL, value: openssl }
       - func: fetch-det
       - func: bootstrap-mongo-orchestration
       - func: run-mock-kms-servers
       - func: run-tests
-  - name: cse-sasl-cyrus-openssl-rhel8-zseries-gcc-test-latest-replica-auth
-    run_on: rhel8-zseries-small
-    tags: [cse-matrix-openssl, test, rhel8-zseries, gcc, sasl-cyrus, cse, auth, replica, latest, openssl]
-    depends_on: [{ name: cse-sasl-cyrus-openssl-rhel8-zseries-gcc-compile }]
-    patchable: false
+  - name: cse-sasl-cyrus-openssl-rhel8-latest-gcc-test-8.0-replica-auth
+    run_on: rhel8-latest-large
+    tags: [cse-matrix-openssl, test, rhel8-latest, gcc, sasl-cyrus, cse, auth, replica, "8.0", openssl]
+    depends_on: [{ name: cse-sasl-cyrus-openssl-rhel8-latest-gcc-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: cse-sasl-cyrus-openssl-rhel8-zseries-gcc-compile
+          BUILD_NAME: cse-sasl-cyrus-openssl-rhel8-latest-gcc-compile
       - command: expansions.update
         params:
           updates:
             - { key: CC, value: gcc }
             - { key: CXX, value: g++ }
             - { key: AUTH, value: auth }
-            - { key: MONGODB_VERSION, value: latest }
+            - { key: MONGODB_VERSION, value: "8.0" }
             - { key: TOPOLOGY, value: replica_set }
             - { key: SSL, value: openssl }
       - func: fetch-det
       - func: bootstrap-mongo-orchestration
       - func: run-mock-kms-servers
       - func: run-tests
-  - name: cse-sasl-cyrus-openssl-rhel8-zseries-gcc-test-latest-server-auth
-    run_on: rhel8-zseries-small
-    tags: [cse-matrix-openssl, test, rhel8-zseries, gcc, sasl-cyrus, cse, auth, server, latest, openssl]
-    depends_on: [{ name: cse-sasl-cyrus-openssl-rhel8-zseries-gcc-compile }]
-    patchable: false
+  - name: cse-sasl-cyrus-openssl-rhel8-latest-gcc-test-8.0-server-auth
+    run_on: rhel8-latest-large
+    tags: [cse-matrix-openssl, test, rhel8-latest, gcc, sasl-cyrus, cse, auth, server, "8.0", openssl]
+    depends_on: [{ name: cse-sasl-cyrus-openssl-rhel8-latest-gcc-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: cse-sasl-cyrus-openssl-rhel8-zseries-gcc-compile
+          BUILD_NAME: cse-sasl-cyrus-openssl-rhel8-latest-gcc-compile
       - command: expansions.update
         params:
           updates:
             - { key: CC, value: gcc }
             - { key: CXX, value: g++ }
             - { key: AUTH, value: auth }
-            - { key: MONGODB_VERSION, value: latest }
+            - { key: MONGODB_VERSION, value: "8.0" }
             - { key: TOPOLOGY, value: server }
             - { key: SSL, value: openssl }
       - func: fetch-det
       - func: bootstrap-mongo-orchestration
       - func: run-mock-kms-servers
       - func: run-tests
-  - name: cse-sasl-cyrus-openssl-rhel80-gcc-compile
-    run_on: rhel80-large
-    tags: [cse-matrix-openssl, compile, rhel80, gcc, cse, sasl-cyrus]
-    commands:
-      - func: find-cmake-latest
-      - func: cse-sasl-cyrus-openssl-compile
-        vars:
-          CC: gcc
-          CXX: g++
-      - func: upload-build
-  - name: cse-sasl-cyrus-openssl-ubuntu2004-arm64-gcc-compile
-    run_on: ubuntu2004-arm64-large
-    tags: [cse-matrix-openssl, compile, ubuntu2004-arm64, gcc, cse, sasl-cyrus]
-    commands:
-      - func: find-cmake-latest
-      - func: cse-sasl-cyrus-openssl-compile
-        vars:
-          CC: gcc
-          CXX: g++
-      - func: upload-build
-  - name: cse-sasl-cyrus-openssl-ubuntu2004-arm64-gcc-test-4.4-replica-auth
-    run_on: ubuntu2004-arm64-small
-    tags: [cse-matrix-openssl, test, ubuntu2004-arm64, gcc, sasl-cyrus, cse, auth, replica, "4.4", openssl]
-    depends_on: [{ name: cse-sasl-cyrus-openssl-ubuntu2004-arm64-gcc-compile }]
+  - name: cse-sasl-cyrus-openssl-rhel8-latest-gcc-test-latest-replica-auth
+    run_on: rhel8-latest-large
+    tags: [cse-matrix-openssl, test, rhel8-latest, gcc, sasl-cyrus, cse, auth, replica, latest, openssl]
+    depends_on: [{ name: cse-sasl-cyrus-openssl-rhel8-latest-gcc-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: cse-sasl-cyrus-openssl-ubuntu2004-arm64-gcc-compile
+          BUILD_NAME: cse-sasl-cyrus-openssl-rhel8-latest-gcc-compile
       - command: expansions.update
         params:
           updates:
             - { key: CC, value: gcc }
             - { key: CXX, value: g++ }
             - { key: AUTH, value: auth }
-            - { key: MONGODB_VERSION, value: "4.4" }
+            - { key: MONGODB_VERSION, value: latest }
             - { key: TOPOLOGY, value: replica_set }
             - { key: SSL, value: openssl }
       - func: fetch-det
       - func: bootstrap-mongo-orchestration
       - func: run-mock-kms-servers
       - func: run-tests
-  - name: cse-sasl-cyrus-openssl-ubuntu2004-arm64-gcc-test-4.4-server-auth
-    run_on: ubuntu2004-arm64-small
-    tags: [cse-matrix-openssl, test, ubuntu2004-arm64, gcc, sasl-cyrus, cse, auth, server, "4.4", openssl]
-    depends_on: [{ name: cse-sasl-cyrus-openssl-ubuntu2004-arm64-gcc-compile }]
+  - name: cse-sasl-cyrus-openssl-rhel8-latest-gcc-test-latest-server-auth
+    run_on: rhel8-latest-large
+    tags: [cse-matrix-openssl, test, rhel8-latest, gcc, sasl-cyrus, cse, auth, server, latest, openssl]
+    depends_on: [{ name: cse-sasl-cyrus-openssl-rhel8-latest-gcc-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: cse-sasl-cyrus-openssl-ubuntu2004-arm64-gcc-compile
+          BUILD_NAME: cse-sasl-cyrus-openssl-rhel8-latest-gcc-compile
       - command: expansions.update
         params:
           updates:
             - { key: CC, value: gcc }
             - { key: CXX, value: g++ }
             - { key: AUTH, value: auth }
-            - { key: MONGODB_VERSION, value: "4.4" }
+            - { key: MONGODB_VERSION, value: latest }
             - { key: TOPOLOGY, value: server }
             - { key: SSL, value: openssl }
       - func: fetch-det
       - func: bootstrap-mongo-orchestration
       - func: run-mock-kms-servers
       - func: run-tests
-  - name: cse-sasl-cyrus-openssl-ubuntu2004-arm64-gcc-test-5.0-replica-auth
-    run_on: ubuntu2004-arm64-small
-    tags: [cse-matrix-openssl, test, ubuntu2004-arm64, gcc, sasl-cyrus, cse, auth, replica, "5.0", openssl]
-    depends_on: [{ name: cse-sasl-cyrus-openssl-ubuntu2004-arm64-gcc-compile }]
+  - name: cse-sasl-cyrus-openssl-rhel8-zseries-gcc-compile
+    run_on: rhel8-zseries-large
+    tags: [cse-matrix-openssl, compile, rhel8-zseries, gcc, cse, sasl-cyrus]
+    patchable: false
+    commands:
+      - func: find-cmake-latest
+      - func: cse-sasl-cyrus-openssl-compile
+        vars:
+          CC: gcc
+          CXX: g++
+      - func: upload-build
+  - name: cse-sasl-cyrus-openssl-rhel8-zseries-gcc-test-5.0-replica-auth
+    run_on: rhel8-zseries-small
+    tags: [cse-matrix-openssl, test, rhel8-zseries, gcc, sasl-cyrus, cse, auth, replica, "5.0", openssl]
+    depends_on: [{ name: cse-sasl-cyrus-openssl-rhel8-zseries-gcc-compile }]
+    patchable: false
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: cse-sasl-cyrus-openssl-ubuntu2004-arm64-gcc-compile
+          BUILD_NAME: cse-sasl-cyrus-openssl-rhel8-zseries-gcc-compile
       - command: expansions.update
         params:
           updates:
@@ -1872,14 +2282,15 @@ tasks:
       - func: bootstrap-mongo-orchestration
       - func: run-mock-kms-servers
       - func: run-tests
-  - name: cse-sasl-cyrus-openssl-ubuntu2004-arm64-gcc-test-5.0-server-auth
-    run_on: ubuntu2004-arm64-small
-    tags: [cse-matrix-openssl, test, ubuntu2004-arm64, gcc, sasl-cyrus, cse, auth, server, "5.0", openssl]
-    depends_on: [{ name: cse-sasl-cyrus-openssl-ubuntu2004-arm64-gcc-compile }]
+  - name: cse-sasl-cyrus-openssl-rhel8-zseries-gcc-test-5.0-server-auth
+    run_on: rhel8-zseries-small
+    tags: [cse-matrix-openssl, test, rhel8-zseries, gcc, sasl-cyrus, cse, auth, server, "5.0", openssl]
+    depends_on: [{ name: cse-sasl-cyrus-openssl-rhel8-zseries-gcc-compile }]
+    patchable: false
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: cse-sasl-cyrus-openssl-ubuntu2004-arm64-gcc-compile
+          BUILD_NAME: cse-sasl-cyrus-openssl-rhel8-zseries-gcc-compile
       - command: expansions.update
         params:
           updates:
@@ -1893,14 +2304,15 @@ tasks:
       - func: bootstrap-mongo-orchestration
       - func: run-mock-kms-servers
       - func: run-tests
-  - name: cse-sasl-cyrus-openssl-ubuntu2004-arm64-gcc-test-6.0-replica-auth
-    run_on: ubuntu2004-arm64-small
-    tags: [cse-matrix-openssl, test, ubuntu2004-arm64, gcc, sasl-cyrus, cse, auth, replica, "6.0", openssl]
-    depends_on: [{ name: cse-sasl-cyrus-openssl-ubuntu2004-arm64-gcc-compile }]
+  - name: cse-sasl-cyrus-openssl-rhel8-zseries-gcc-test-6.0-replica-auth
+    run_on: rhel8-zseries-small
+    tags: [cse-matrix-openssl, test, rhel8-zseries, gcc, sasl-cyrus, cse, auth, replica, "6.0", openssl]
+    depends_on: [{ name: cse-sasl-cyrus-openssl-rhel8-zseries-gcc-compile }]
+    patchable: false
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: cse-sasl-cyrus-openssl-ubuntu2004-arm64-gcc-compile
+          BUILD_NAME: cse-sasl-cyrus-openssl-rhel8-zseries-gcc-compile
       - command: expansions.update
         params:
           updates:
@@ -1914,14 +2326,15 @@ tasks:
       - func: bootstrap-mongo-orchestration
       - func: run-mock-kms-servers
       - func: run-tests
-  - name: cse-sasl-cyrus-openssl-ubuntu2004-arm64-gcc-test-6.0-server-auth
-    run_on: ubuntu2004-arm64-small
-    tags: [cse-matrix-openssl, test, ubuntu2004-arm64, gcc, sasl-cyrus, cse, auth, server, "6.0", openssl]
-    depends_on: [{ name: cse-sasl-cyrus-openssl-ubuntu2004-arm64-gcc-compile }]
+  - name: cse-sasl-cyrus-openssl-rhel8-zseries-gcc-test-6.0-server-auth
+    run_on: rhel8-zseries-small
+    tags: [cse-matrix-openssl, test, rhel8-zseries, gcc, sasl-cyrus, cse, auth, server, "6.0", openssl]
+    depends_on: [{ name: cse-sasl-cyrus-openssl-rhel8-zseries-gcc-compile }]
+    patchable: false
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: cse-sasl-cyrus-openssl-ubuntu2004-arm64-gcc-compile
+          BUILD_NAME: cse-sasl-cyrus-openssl-rhel8-zseries-gcc-compile
       - command: expansions.update
         params:
           updates:
@@ -1935,14 +2348,15 @@ tasks:
       - func: bootstrap-mongo-orchestration
       - func: run-mock-kms-servers
       - func: run-tests
-  - name: cse-sasl-cyrus-openssl-ubuntu2004-arm64-gcc-test-7.0-replica-auth
-    run_on: ubuntu2004-arm64-small
-    tags: [cse-matrix-openssl, test, ubuntu2004-arm64, gcc, sasl-cyrus, cse, auth, replica, "7.0", openssl]
-    depends_on: [{ name: cse-sasl-cyrus-openssl-ubuntu2004-arm64-gcc-compile }]
+  - name: cse-sasl-cyrus-openssl-rhel8-zseries-gcc-test-7.0-replica-auth
+    run_on: rhel8-zseries-small
+    tags: [cse-matrix-openssl, test, rhel8-zseries, gcc, sasl-cyrus, cse, auth, replica, "7.0", openssl]
+    depends_on: [{ name: cse-sasl-cyrus-openssl-rhel8-zseries-gcc-compile }]
+    patchable: false
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: cse-sasl-cyrus-openssl-ubuntu2004-arm64-gcc-compile
+          BUILD_NAME: cse-sasl-cyrus-openssl-rhel8-zseries-gcc-compile
       - command: expansions.update
         params:
           updates:
@@ -1956,14 +2370,15 @@ tasks:
       - func: bootstrap-mongo-orchestration
       - func: run-mock-kms-servers
       - func: run-tests
-  - name: cse-sasl-cyrus-openssl-ubuntu2004-arm64-gcc-test-7.0-server-auth
-    run_on: ubuntu2004-arm64-small
-    tags: [cse-matrix-openssl, test, ubuntu2004-arm64, gcc, sasl-cyrus, cse, auth, server, "7.0", openssl]
-    depends_on: [{ name: cse-sasl-cyrus-openssl-ubuntu2004-arm64-gcc-compile }]
+  - name: cse-sasl-cyrus-openssl-rhel8-zseries-gcc-test-7.0-server-auth
+    run_on: rhel8-zseries-small
+    tags: [cse-matrix-openssl, test, rhel8-zseries, gcc, sasl-cyrus, cse, auth, server, "7.0", openssl]
+    depends_on: [{ name: cse-sasl-cyrus-openssl-rhel8-zseries-gcc-compile }]
+    patchable: false
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: cse-sasl-cyrus-openssl-ubuntu2004-arm64-gcc-compile
+          BUILD_NAME: cse-sasl-cyrus-openssl-rhel8-zseries-gcc-compile
       - command: expansions.update
         params:
           updates:
@@ -1977,14 +2392,15 @@ tasks:
       - func: bootstrap-mongo-orchestration
       - func: run-mock-kms-servers
       - func: run-tests
-  - name: cse-sasl-cyrus-openssl-ubuntu2004-arm64-gcc-test-8.0-replica-auth
-    run_on: ubuntu2004-arm64-small
-    tags: [cse-matrix-openssl, test, ubuntu2004-arm64, gcc, sasl-cyrus, cse, auth, replica, "8.0", openssl]
-    depends_on: [{ name: cse-sasl-cyrus-openssl-ubuntu2004-arm64-gcc-compile }]
+  - name: cse-sasl-cyrus-openssl-rhel8-zseries-gcc-test-8.0-replica-auth
+    run_on: rhel8-zseries-small
+    tags: [cse-matrix-openssl, test, rhel8-zseries, gcc, sasl-cyrus, cse, auth, replica, "8.0", openssl]
+    depends_on: [{ name: cse-sasl-cyrus-openssl-rhel8-zseries-gcc-compile }]
+    patchable: false
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: cse-sasl-cyrus-openssl-ubuntu2004-arm64-gcc-compile
+          BUILD_NAME: cse-sasl-cyrus-openssl-rhel8-zseries-gcc-compile
       - command: expansions.update
         params:
           updates:
@@ -1998,14 +2414,15 @@ tasks:
       - func: bootstrap-mongo-orchestration
       - func: run-mock-kms-servers
       - func: run-tests
-  - name: cse-sasl-cyrus-openssl-ubuntu2004-arm64-gcc-test-8.0-server-auth
-    run_on: ubuntu2004-arm64-small
-    tags: [cse-matrix-openssl, test, ubuntu2004-arm64, gcc, sasl-cyrus, cse, auth, server, "8.0", openssl]
-    depends_on: [{ name: cse-sasl-cyrus-openssl-ubuntu2004-arm64-gcc-compile }]
+  - name: cse-sasl-cyrus-openssl-rhel8-zseries-gcc-test-8.0-server-auth
+    run_on: rhel8-zseries-small
+    tags: [cse-matrix-openssl, test, rhel8-zseries, gcc, sasl-cyrus, cse, auth, server, "8.0", openssl]
+    depends_on: [{ name: cse-sasl-cyrus-openssl-rhel8-zseries-gcc-compile }]
+    patchable: false
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: cse-sasl-cyrus-openssl-ubuntu2004-arm64-gcc-compile
+          BUILD_NAME: cse-sasl-cyrus-openssl-rhel8-zseries-gcc-compile
       - command: expansions.update
         params:
           updates:
@@ -2019,14 +2436,15 @@ tasks:
       - func: bootstrap-mongo-orchestration
       - func: run-mock-kms-servers
       - func: run-tests
-  - name: cse-sasl-cyrus-openssl-ubuntu2004-arm64-gcc-test-latest-replica-auth
-    run_on: ubuntu2004-arm64-small
-    tags: [cse-matrix-openssl, test, ubuntu2004-arm64, gcc, sasl-cyrus, cse, auth, replica, latest, openssl]
-    depends_on: [{ name: cse-sasl-cyrus-openssl-ubuntu2004-arm64-gcc-compile }]
+  - name: cse-sasl-cyrus-openssl-rhel8-zseries-gcc-test-latest-replica-auth
+    run_on: rhel8-zseries-small
+    tags: [cse-matrix-openssl, test, rhel8-zseries, gcc, sasl-cyrus, cse, auth, replica, latest, openssl]
+    depends_on: [{ name: cse-sasl-cyrus-openssl-rhel8-zseries-gcc-compile }]
+    patchable: false
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: cse-sasl-cyrus-openssl-ubuntu2004-arm64-gcc-compile
+          BUILD_NAME: cse-sasl-cyrus-openssl-rhel8-zseries-gcc-compile
       - command: expansions.update
         params:
           updates:
@@ -2040,14 +2458,15 @@ tasks:
       - func: bootstrap-mongo-orchestration
       - func: run-mock-kms-servers
       - func: run-tests
-  - name: cse-sasl-cyrus-openssl-ubuntu2004-arm64-gcc-test-latest-server-auth
-    run_on: ubuntu2004-arm64-small
-    tags: [cse-matrix-openssl, test, ubuntu2004-arm64, gcc, sasl-cyrus, cse, auth, server, latest, openssl]
-    depends_on: [{ name: cse-sasl-cyrus-openssl-ubuntu2004-arm64-gcc-compile }]
+  - name: cse-sasl-cyrus-openssl-rhel8-zseries-gcc-test-latest-server-auth
+    run_on: rhel8-zseries-small
+    tags: [cse-matrix-openssl, test, rhel8-zseries, gcc, sasl-cyrus, cse, auth, server, latest, openssl]
+    depends_on: [{ name: cse-sasl-cyrus-openssl-rhel8-zseries-gcc-compile }]
+    patchable: false
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: cse-sasl-cyrus-openssl-ubuntu2004-arm64-gcc-compile
+          BUILD_NAME: cse-sasl-cyrus-openssl-rhel8-zseries-gcc-compile
       - command: expansions.update
         params:
           updates:
@@ -2061,19 +2480,19 @@ tasks:
       - func: bootstrap-mongo-orchestration
       - func: run-mock-kms-servers
       - func: run-tests
-  - name: cse-sasl-cyrus-openssl-ubuntu2004-clang-compile
-    run_on: ubuntu2004-large
-    tags: [cse-matrix-openssl, compile, ubuntu2004, clang, cse, sasl-cyrus]
+  - name: cse-sasl-cyrus-openssl-rhel80-gcc-compile
+    run_on: rhel80-large
+    tags: [cse-matrix-openssl, compile, rhel80, gcc, cse, sasl-cyrus]
     commands:
       - func: find-cmake-latest
       - func: cse-sasl-cyrus-openssl-compile
         vars:
-          CC: clang
-          CXX: clang++
+          CC: gcc
+          CXX: g++
       - func: upload-build
-  - name: cse-sasl-cyrus-openssl-ubuntu2004-gcc-compile
-    run_on: ubuntu2004-large
-    tags: [cse-matrix-openssl, compile, ubuntu2004, gcc, cse, sasl-cyrus]
+  - name: cse-sasl-cyrus-openssl-ubuntu2004-arm64-gcc-compile
+    run_on: ubuntu2004-arm64-large
+    tags: [cse-matrix-openssl, compile, ubuntu2004-arm64, gcc, cse, sasl-cyrus]
     commands:
       - func: find-cmake-latest
       - func: cse-sasl-cyrus-openssl-compile
@@ -2081,14 +2500,14 @@ tasks:
           CC: gcc
           CXX: g++
       - func: upload-build
-  - name: cse-sasl-cyrus-openssl-ubuntu2004-gcc-test-4.4-replica-auth
-    run_on: ubuntu2004-small
-    tags: [cse-matrix-openssl, test, ubuntu2004, gcc, sasl-cyrus, cse, auth, replica, "4.4", openssl]
-    depends_on: [{ name: cse-sasl-cyrus-openssl-ubuntu2004-gcc-compile }]
+  - name: cse-sasl-cyrus-openssl-ubuntu2004-arm64-gcc-test-4.4-replica-auth
+    run_on: ubuntu2004-arm64-small
+    tags: [cse-matrix-openssl, test, ubuntu2004-arm64, gcc, sasl-cyrus, cse, auth, replica, "4.4", openssl]
+    depends_on: [{ name: cse-sasl-cyrus-openssl-ubuntu2004-arm64-gcc-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: cse-sasl-cyrus-openssl-ubuntu2004-gcc-compile
+          BUILD_NAME: cse-sasl-cyrus-openssl-ubuntu2004-arm64-gcc-compile
       - command: expansions.update
         params:
           updates:
@@ -2102,14 +2521,14 @@ tasks:
       - func: bootstrap-mongo-orchestration
       - func: run-mock-kms-servers
       - func: run-tests
-  - name: cse-sasl-cyrus-openssl-ubuntu2004-gcc-test-4.4-server-auth
-    run_on: ubuntu2004-small
-    tags: [cse-matrix-openssl, test, ubuntu2004, gcc, sasl-cyrus, cse, auth, server, "4.4", openssl]
-    depends_on: [{ name: cse-sasl-cyrus-openssl-ubuntu2004-gcc-compile }]
+  - name: cse-sasl-cyrus-openssl-ubuntu2004-arm64-gcc-test-4.4-server-auth
+    run_on: ubuntu2004-arm64-small
+    tags: [cse-matrix-openssl, test, ubuntu2004-arm64, gcc, sasl-cyrus, cse, auth, server, "4.4", openssl]
+    depends_on: [{ name: cse-sasl-cyrus-openssl-ubuntu2004-arm64-gcc-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: cse-sasl-cyrus-openssl-ubuntu2004-gcc-compile
+          BUILD_NAME: cse-sasl-cyrus-openssl-ubuntu2004-arm64-gcc-compile
       - command: expansions.update
         params:
           updates:
@@ -2123,14 +2542,14 @@ tasks:
       - func: bootstrap-mongo-orchestration
       - func: run-mock-kms-servers
       - func: run-tests
-  - name: cse-sasl-cyrus-openssl-ubuntu2004-gcc-test-5.0-replica-auth
-    run_on: ubuntu2004-small
-    tags: [cse-matrix-openssl, test, ubuntu2004, gcc, sasl-cyrus, cse, auth, replica, "5.0", openssl]
-    depends_on: [{ name: cse-sasl-cyrus-openssl-ubuntu2004-gcc-compile }]
+  - name: cse-sasl-cyrus-openssl-ubuntu2004-arm64-gcc-test-5.0-replica-auth
+    run_on: ubuntu2004-arm64-small
+    tags: [cse-matrix-openssl, test, ubuntu2004-arm64, gcc, sasl-cyrus, cse, auth, replica, "5.0", openssl]
+    depends_on: [{ name: cse-sasl-cyrus-openssl-ubuntu2004-arm64-gcc-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: cse-sasl-cyrus-openssl-ubuntu2004-gcc-compile
+          BUILD_NAME: cse-sasl-cyrus-openssl-ubuntu2004-arm64-gcc-compile
       - command: expansions.update
         params:
           updates:
@@ -2144,14 +2563,14 @@ tasks:
       - func: bootstrap-mongo-orchestration
       - func: run-mock-kms-servers
       - func: run-tests
-  - name: cse-sasl-cyrus-openssl-ubuntu2004-gcc-test-5.0-server-auth
-    run_on: ubuntu2004-small
-    tags: [cse-matrix-openssl, test, ubuntu2004, gcc, sasl-cyrus, cse, auth, server, "5.0", openssl]
-    depends_on: [{ name: cse-sasl-cyrus-openssl-ubuntu2004-gcc-compile }]
+  - name: cse-sasl-cyrus-openssl-ubuntu2004-arm64-gcc-test-5.0-server-auth
+    run_on: ubuntu2004-arm64-small
+    tags: [cse-matrix-openssl, test, ubuntu2004-arm64, gcc, sasl-cyrus, cse, auth, server, "5.0", openssl]
+    depends_on: [{ name: cse-sasl-cyrus-openssl-ubuntu2004-arm64-gcc-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: cse-sasl-cyrus-openssl-ubuntu2004-gcc-compile
+          BUILD_NAME: cse-sasl-cyrus-openssl-ubuntu2004-arm64-gcc-compile
       - command: expansions.update
         params:
           updates:
@@ -2165,14 +2584,14 @@ tasks:
       - func: bootstrap-mongo-orchestration
       - func: run-mock-kms-servers
       - func: run-tests
-  - name: cse-sasl-cyrus-openssl-ubuntu2004-gcc-test-6.0-replica-auth
-    run_on: ubuntu2004-small
-    tags: [cse-matrix-openssl, test, ubuntu2004, gcc, sasl-cyrus, cse, auth, replica, "6.0", openssl]
-    depends_on: [{ name: cse-sasl-cyrus-openssl-ubuntu2004-gcc-compile }]
+  - name: cse-sasl-cyrus-openssl-ubuntu2004-arm64-gcc-test-6.0-replica-auth
+    run_on: ubuntu2004-arm64-small
+    tags: [cse-matrix-openssl, test, ubuntu2004-arm64, gcc, sasl-cyrus, cse, auth, replica, "6.0", openssl]
+    depends_on: [{ name: cse-sasl-cyrus-openssl-ubuntu2004-arm64-gcc-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: cse-sasl-cyrus-openssl-ubuntu2004-gcc-compile
+          BUILD_NAME: cse-sasl-cyrus-openssl-ubuntu2004-arm64-gcc-compile
       - command: expansions.update
         params:
           updates:
@@ -2186,14 +2605,14 @@ tasks:
       - func: bootstrap-mongo-orchestration
       - func: run-mock-kms-servers
       - func: run-tests
-  - name: cse-sasl-cyrus-openssl-ubuntu2004-gcc-test-6.0-server-auth
-    run_on: ubuntu2004-small
-    tags: [cse-matrix-openssl, test, ubuntu2004, gcc, sasl-cyrus, cse, auth, server, "6.0", openssl]
-    depends_on: [{ name: cse-sasl-cyrus-openssl-ubuntu2004-gcc-compile }]
+  - name: cse-sasl-cyrus-openssl-ubuntu2004-arm64-gcc-test-6.0-server-auth
+    run_on: ubuntu2004-arm64-small
+    tags: [cse-matrix-openssl, test, ubuntu2004-arm64, gcc, sasl-cyrus, cse, auth, server, "6.0", openssl]
+    depends_on: [{ name: cse-sasl-cyrus-openssl-ubuntu2004-arm64-gcc-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: cse-sasl-cyrus-openssl-ubuntu2004-gcc-compile
+          BUILD_NAME: cse-sasl-cyrus-openssl-ubuntu2004-arm64-gcc-compile
       - command: expansions.update
         params:
           updates:
@@ -2207,14 +2626,14 @@ tasks:
       - func: bootstrap-mongo-orchestration
       - func: run-mock-kms-servers
       - func: run-tests
-  - name: cse-sasl-cyrus-openssl-ubuntu2004-gcc-test-7.0-replica-auth
-    run_on: ubuntu2004-small
-    tags: [cse-matrix-openssl, test, ubuntu2004, gcc, sasl-cyrus, cse, auth, replica, "7.0", openssl]
-    depends_on: [{ name: cse-sasl-cyrus-openssl-ubuntu2004-gcc-compile }]
+  - name: cse-sasl-cyrus-openssl-ubuntu2004-arm64-gcc-test-7.0-replica-auth
+    run_on: ubuntu2004-arm64-small
+    tags: [cse-matrix-openssl, test, ubuntu2004-arm64, gcc, sasl-cyrus, cse, auth, replica, "7.0", openssl]
+    depends_on: [{ name: cse-sasl-cyrus-openssl-ubuntu2004-arm64-gcc-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: cse-sasl-cyrus-openssl-ubuntu2004-gcc-compile
+          BUILD_NAME: cse-sasl-cyrus-openssl-ubuntu2004-arm64-gcc-compile
       - command: expansions.update
         params:
           updates:
@@ -2228,14 +2647,14 @@ tasks:
       - func: bootstrap-mongo-orchestration
       - func: run-mock-kms-servers
       - func: run-tests
-  - name: cse-sasl-cyrus-openssl-ubuntu2004-gcc-test-7.0-server-auth
-    run_on: ubuntu2004-small
-    tags: [cse-matrix-openssl, test, ubuntu2004, gcc, sasl-cyrus, cse, auth, server, "7.0", openssl]
-    depends_on: [{ name: cse-sasl-cyrus-openssl-ubuntu2004-gcc-compile }]
+  - name: cse-sasl-cyrus-openssl-ubuntu2004-arm64-gcc-test-7.0-server-auth
+    run_on: ubuntu2004-arm64-small
+    tags: [cse-matrix-openssl, test, ubuntu2004-arm64, gcc, sasl-cyrus, cse, auth, server, "7.0", openssl]
+    depends_on: [{ name: cse-sasl-cyrus-openssl-ubuntu2004-arm64-gcc-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: cse-sasl-cyrus-openssl-ubuntu2004-gcc-compile
+          BUILD_NAME: cse-sasl-cyrus-openssl-ubuntu2004-arm64-gcc-compile
       - command: expansions.update
         params:
           updates:
@@ -2249,14 +2668,14 @@ tasks:
       - func: bootstrap-mongo-orchestration
       - func: run-mock-kms-servers
       - func: run-tests
-  - name: cse-sasl-cyrus-openssl-ubuntu2004-gcc-test-8.0-replica-auth
-    run_on: ubuntu2004-small
-    tags: [cse-matrix-openssl, test, ubuntu2004, gcc, sasl-cyrus, cse, auth, replica, "8.0", openssl]
-    depends_on: [{ name: cse-sasl-cyrus-openssl-ubuntu2004-gcc-compile }]
+  - name: cse-sasl-cyrus-openssl-ubuntu2004-arm64-gcc-test-8.0-replica-auth
+    run_on: ubuntu2004-arm64-small
+    tags: [cse-matrix-openssl, test, ubuntu2004-arm64, gcc, sasl-cyrus, cse, auth, replica, "8.0", openssl]
+    depends_on: [{ name: cse-sasl-cyrus-openssl-ubuntu2004-arm64-gcc-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: cse-sasl-cyrus-openssl-ubuntu2004-gcc-compile
+          BUILD_NAME: cse-sasl-cyrus-openssl-ubuntu2004-arm64-gcc-compile
       - command: expansions.update
         params:
           updates:
@@ -2270,14 +2689,14 @@ tasks:
       - func: bootstrap-mongo-orchestration
       - func: run-mock-kms-servers
       - func: run-tests
-  - name: cse-sasl-cyrus-openssl-ubuntu2004-gcc-test-8.0-server-auth
-    run_on: ubuntu2004-small
-    tags: [cse-matrix-openssl, test, ubuntu2004, gcc, sasl-cyrus, cse, auth, server, "8.0", openssl]
-    depends_on: [{ name: cse-sasl-cyrus-openssl-ubuntu2004-gcc-compile }]
+  - name: cse-sasl-cyrus-openssl-ubuntu2004-arm64-gcc-test-8.0-server-auth
+    run_on: ubuntu2004-arm64-small
+    tags: [cse-matrix-openssl, test, ubuntu2004-arm64, gcc, sasl-cyrus, cse, auth, server, "8.0", openssl]
+    depends_on: [{ name: cse-sasl-cyrus-openssl-ubuntu2004-arm64-gcc-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: cse-sasl-cyrus-openssl-ubuntu2004-gcc-compile
+          BUILD_NAME: cse-sasl-cyrus-openssl-ubuntu2004-arm64-gcc-compile
       - command: expansions.update
         params:
           updates:
@@ -2291,14 +2710,14 @@ tasks:
       - func: bootstrap-mongo-orchestration
       - func: run-mock-kms-servers
       - func: run-tests
-  - name: cse-sasl-cyrus-openssl-ubuntu2004-gcc-test-latest-replica-auth
-    run_on: ubuntu2004-small
-    tags: [cse-matrix-openssl, test, ubuntu2004, gcc, sasl-cyrus, cse, auth, replica, latest, openssl]
-    depends_on: [{ name: cse-sasl-cyrus-openssl-ubuntu2004-gcc-compile }]
+  - name: cse-sasl-cyrus-openssl-ubuntu2004-arm64-gcc-test-latest-replica-auth
+    run_on: ubuntu2004-arm64-small
+    tags: [cse-matrix-openssl, test, ubuntu2004-arm64, gcc, sasl-cyrus, cse, auth, replica, latest, openssl]
+    depends_on: [{ name: cse-sasl-cyrus-openssl-ubuntu2004-arm64-gcc-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: cse-sasl-cyrus-openssl-ubuntu2004-gcc-compile
+          BUILD_NAME: cse-sasl-cyrus-openssl-ubuntu2004-arm64-gcc-compile
       - command: expansions.update
         params:
           updates:
@@ -2312,14 +2731,14 @@ tasks:
       - func: bootstrap-mongo-orchestration
       - func: run-mock-kms-servers
       - func: run-tests
-  - name: cse-sasl-cyrus-openssl-ubuntu2004-gcc-test-latest-server-auth
-    run_on: ubuntu2004-small
-    tags: [cse-matrix-openssl, test, ubuntu2004, gcc, sasl-cyrus, cse, auth, server, latest, openssl]
-    depends_on: [{ name: cse-sasl-cyrus-openssl-ubuntu2004-gcc-compile }]
+  - name: cse-sasl-cyrus-openssl-ubuntu2004-arm64-gcc-test-latest-server-auth
+    run_on: ubuntu2004-arm64-small
+    tags: [cse-matrix-openssl, test, ubuntu2004-arm64, gcc, sasl-cyrus, cse, auth, server, latest, openssl]
+    depends_on: [{ name: cse-sasl-cyrus-openssl-ubuntu2004-arm64-gcc-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: cse-sasl-cyrus-openssl-ubuntu2004-gcc-compile
+          BUILD_NAME: cse-sasl-cyrus-openssl-ubuntu2004-arm64-gcc-compile
       - command: expansions.update
         params:
           updates:
@@ -2333,6 +2752,66 @@ tasks:
       - func: bootstrap-mongo-orchestration
       - func: run-mock-kms-servers
       - func: run-tests
+  - name: cse-sasl-cyrus-openssl-ubuntu2004-clang-compile
+    run_on: ubuntu2004-large
+    tags: [cse-matrix-openssl, compile, ubuntu2004, clang, cse, sasl-cyrus]
+    commands:
+      - func: find-cmake-latest
+      - func: cse-sasl-cyrus-openssl-compile
+        vars:
+          CC: clang
+          CXX: clang++
+      - func: upload-build
+  - name: cse-sasl-cyrus-openssl-ubuntu2004-gcc-compile
+    run_on: ubuntu2004-large
+    tags: [cse-matrix-openssl, compile, ubuntu2004, gcc, cse, sasl-cyrus]
+    commands:
+      - func: find-cmake-latest
+      - func: cse-sasl-cyrus-openssl-compile
+        vars:
+          CC: gcc
+          CXX: g++
+      - func: upload-build
+  - name: cse-sasl-cyrus-openssl-ubuntu2204-clang-12-compile
+    run_on: ubuntu2204-large
+    tags: [cse-matrix-openssl, compile, ubuntu2204, clang-12, cse, sasl-cyrus]
+    commands:
+      - func: find-cmake-latest
+      - func: cse-sasl-cyrus-openssl-compile
+        vars:
+          CC: clang-12
+          CXX: clang++-12
+      - func: upload-build
+  - name: cse-sasl-cyrus-openssl-ubuntu2204-gcc-compile
+    run_on: ubuntu2204-large
+    tags: [cse-matrix-openssl, compile, ubuntu2204, gcc, cse, sasl-cyrus]
+    commands:
+      - func: find-cmake-latest
+      - func: cse-sasl-cyrus-openssl-compile
+        vars:
+          CC: gcc
+          CXX: g++
+      - func: upload-build
+  - name: cse-sasl-cyrus-openssl-ubuntu2404-clang-14-compile
+    run_on: ubuntu2404-large
+    tags: [cse-matrix-openssl, compile, ubuntu2404, clang-14, cse, sasl-cyrus]
+    commands:
+      - func: find-cmake-latest
+      - func: cse-sasl-cyrus-openssl-compile
+        vars:
+          CC: clang-14
+          CXX: clang++-14
+      - func: upload-build
+  - name: cse-sasl-cyrus-openssl-ubuntu2404-gcc-compile
+    run_on: ubuntu2404-large
+    tags: [cse-matrix-openssl, compile, ubuntu2404, gcc, cse, sasl-cyrus]
+    commands:
+      - func: find-cmake-latest
+      - func: cse-sasl-cyrus-openssl-compile
+        vars:
+          CC: gcc
+          CXX: g++
+      - func: upload-build
   - name: cse-sasl-cyrus-openssl-windows-2019-vs2017-x64-compile
     run_on: windows-vsCurrent-large
     tags: [cse-matrix-openssl, compile, windows-vsCurrent, vs2017x64, cse, sasl-cyrus]
@@ -2343,6 +2822,27 @@ tasks:
           CMAKE_GENERATOR: Visual Studio 15 2017
           CMAKE_GENERATOR_PLATFORM: x64
       - func: upload-build
+  - name: cse-sasl-cyrus-openssl-windows-2019-vs2017-x64-test-4.2-replica-auth
+    run_on: windows-vsCurrent-small
+    tags: [cse-matrix-openssl, test, windows-vsCurrent, vs2017x64, sasl-cyrus, cse, auth, replica, "4.2", openssl]
+    depends_on: [{ name: cse-sasl-cyrus-openssl-windows-2019-vs2017-x64-compile }]
+    commands:
+      - func: fetch-build
+        vars:
+          BUILD_NAME: cse-sasl-cyrus-openssl-windows-2019-vs2017-x64-compile
+      - command: expansions.update
+        params:
+          updates:
+            - { key: CMAKE_GENERATOR, value: Visual Studio 15 2017 }
+            - { key: CMAKE_GENERATOR_PLATFORM, value: x64 }
+            - { key: AUTH, value: auth }
+            - { key: MONGODB_VERSION, value: "4.2" }
+            - { key: TOPOLOGY, value: replica_set }
+            - { key: SSL, value: openssl }
+      - func: fetch-det
+      - func: bootstrap-mongo-orchestration
+      - func: run-mock-kms-servers
+      - func: run-tests
   - name: cse-sasl-cyrus-openssl-windows-2019-vs2017-x64-test-4.2-server-auth
     run_on: windows-vsCurrent-small
     tags: [cse-matrix-openssl, test, windows-vsCurrent, vs2017x64, sasl-cyrus, cse, auth, server, "4.2", openssl]
@@ -2364,6 +2864,27 @@ tasks:
       - func: bootstrap-mongo-orchestration
       - func: run-mock-kms-servers
       - func: run-tests
+  - name: cse-sasl-cyrus-openssl-windows-2019-vs2017-x64-test-4.4-replica-auth
+    run_on: windows-vsCurrent-small
+    tags: [cse-matrix-openssl, test, windows-vsCurrent, vs2017x64, sasl-cyrus, cse, auth, replica, "4.4", openssl]
+    depends_on: [{ name: cse-sasl-cyrus-openssl-windows-2019-vs2017-x64-compile }]
+    commands:
+      - func: fetch-build
+        vars:
+          BUILD_NAME: cse-sasl-cyrus-openssl-windows-2019-vs2017-x64-compile
+      - command: expansions.update
+        params:
+          updates:
+            - { key: CMAKE_GENERATOR, value: Visual Studio 15 2017 }
+            - { key: CMAKE_GENERATOR_PLATFORM, value: x64 }
+            - { key: AUTH, value: auth }
+            - { key: MONGODB_VERSION, value: "4.4" }
+            - { key: TOPOLOGY, value: replica_set }
+            - { key: SSL, value: openssl }
+      - func: fetch-det
+      - func: bootstrap-mongo-orchestration
+      - func: run-mock-kms-servers
+      - func: run-tests
   - name: cse-sasl-cyrus-openssl-windows-2019-vs2017-x64-test-4.4-server-auth
     run_on: windows-vsCurrent-small
     tags: [cse-matrix-openssl, test, windows-vsCurrent, vs2017x64, sasl-cyrus, cse, auth, server, "4.4", openssl]
@@ -2385,6 +2906,27 @@ tasks:
       - func: bootstrap-mongo-orchestration
       - func: run-mock-kms-servers
       - func: run-tests
+  - name: cse-sasl-cyrus-openssl-windows-2019-vs2017-x64-test-5.0-replica-auth
+    run_on: windows-vsCurrent-small
+    tags: [cse-matrix-openssl, test, windows-vsCurrent, vs2017x64, sasl-cyrus, cse, auth, replica, "5.0", openssl]
+    depends_on: [{ name: cse-sasl-cyrus-openssl-windows-2019-vs2017-x64-compile }]
+    commands:
+      - func: fetch-build
+        vars:
+          BUILD_NAME: cse-sasl-cyrus-openssl-windows-2019-vs2017-x64-compile
+      - command: expansions.update
+        params:
+          updates:
+            - { key: CMAKE_GENERATOR, value: Visual Studio 15 2017 }
+            - { key: CMAKE_GENERATOR_PLATFORM, value: x64 }
+            - { key: AUTH, value: auth }
+            - { key: MONGODB_VERSION, value: "5.0" }
+            - { key: TOPOLOGY, value: replica_set }
+            - { key: SSL, value: openssl }
+      - func: fetch-det
+      - func: bootstrap-mongo-orchestration
+      - func: run-mock-kms-servers
+      - func: run-tests
   - name: cse-sasl-cyrus-openssl-windows-2019-vs2017-x64-test-5.0-server-auth
     run_on: windows-vsCurrent-small
     tags: [cse-matrix-openssl, test, windows-vsCurrent, vs2017x64, sasl-cyrus, cse, auth, server, "5.0", openssl]
@@ -2406,6 +2948,27 @@ tasks:
       - func: bootstrap-mongo-orchestration
       - func: run-mock-kms-servers
       - func: run-tests
+  - name: cse-sasl-cyrus-openssl-windows-2019-vs2017-x64-test-6.0-replica-auth
+    run_on: windows-vsCurrent-small
+    tags: [cse-matrix-openssl, test, windows-vsCurrent, vs2017x64, sasl-cyrus, cse, auth, replica, "6.0", openssl]
+    depends_on: [{ name: cse-sasl-cyrus-openssl-windows-2019-vs2017-x64-compile }]
+    commands:
+      - func: fetch-build
+        vars:
+          BUILD_NAME: cse-sasl-cyrus-openssl-windows-2019-vs2017-x64-compile
+      - command: expansions.update
+        params:
+          updates:
+            - { key: CMAKE_GENERATOR, value: Visual Studio 15 2017 }
+            - { key: CMAKE_GENERATOR_PLATFORM, value: x64 }
+            - { key: AUTH, value: auth }
+            - { key: MONGODB_VERSION, value: "6.0" }
+            - { key: TOPOLOGY, value: replica_set }
+            - { key: SSL, value: openssl }
+      - func: fetch-det
+      - func: bootstrap-mongo-orchestration
+      - func: run-mock-kms-servers
+      - func: run-tests
   - name: cse-sasl-cyrus-openssl-windows-2019-vs2017-x64-test-6.0-server-auth
     run_on: windows-vsCurrent-small
     tags: [cse-matrix-openssl, test, windows-vsCurrent, vs2017x64, sasl-cyrus, cse, auth, server, "6.0", openssl]
@@ -2776,9 +3339,9 @@ tasks:
   - name: kms-divergence-check
     commands:
       - func: kms-divergence-check
-  - name: loadbalanced-rhel8.9-gcc-compile
-    run_on: rhel8.9-large
-    tags: [loadbalanced, rhel8.9, gcc]
+  - name: loadbalanced-rhel8-latest-gcc-compile
+    run_on: rhel8-latest-large
+    tags: [loadbalanced, rhel8-latest, gcc]
     commands:
       - func: find-cmake-latest
       - command: subprocess.exec
@@ -2794,14 +3357,14 @@ tasks:
             - -c
             - .evergreen/scripts/compile.sh
       - func: upload-build
-  - name: loadbalanced-rhel8.9-gcc-test-5.0-auth-openssl
-    run_on: rhel8.9-small
-    tags: [loadbalanced, rhel8.9, gcc, auth, openssl]
-    depends_on: [{ name: loadbalanced-rhel8.9-gcc-compile }]
+  - name: loadbalanced-rhel8-latest-gcc-test-5.0-auth-openssl
+    run_on: rhel8-latest-large
+    tags: [loadbalanced, rhel8-latest, gcc, auth, openssl]
+    depends_on: [{ name: loadbalanced-rhel8-latest-gcc-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: loadbalanced-rhel8.9-gcc-compile
+          BUILD_NAME: loadbalanced-rhel8-latest-gcc-compile
       - func: fetch-det
       - func: bootstrap-mongo-orchestration
         vars:
@@ -2820,14 +3383,14 @@ tasks:
           CC: gcc
           LOADBALANCED: loadbalanced
           SSL: openssl
-  - name: loadbalanced-rhel8.9-gcc-test-5.0-noauth-nossl
-    run_on: rhel8.9-small
-    tags: [loadbalanced, rhel8.9, gcc, noauth, nossl]
-    depends_on: [{ name: loadbalanced-rhel8.9-gcc-compile }]
+  - name: loadbalanced-rhel8-latest-gcc-test-5.0-noauth-nossl
+    run_on: rhel8-latest-large
+    tags: [loadbalanced, rhel8-latest, gcc, noauth, nossl]
+    depends_on: [{ name: loadbalanced-rhel8-latest-gcc-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: loadbalanced-rhel8.9-gcc-compile
+          BUILD_NAME: loadbalanced-rhel8-latest-gcc-compile
       - func: fetch-det
       - func: bootstrap-mongo-orchestration
         vars:
@@ -2846,14 +3409,14 @@ tasks:
           CC: gcc
           LOADBALANCED: loadbalanced
           SSL: nossl
-  - name: loadbalanced-rhel8.9-gcc-test-6.0-auth-openssl
-    run_on: rhel8.9-small
-    tags: [loadbalanced, rhel8.9, gcc, auth, openssl]
-    depends_on: [{ name: loadbalanced-rhel8.9-gcc-compile }]
+  - name: loadbalanced-rhel8-latest-gcc-test-6.0-auth-openssl
+    run_on: rhel8-latest-large
+    tags: [loadbalanced, rhel8-latest, gcc, auth, openssl]
+    depends_on: [{ name: loadbalanced-rhel8-latest-gcc-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: loadbalanced-rhel8.9-gcc-compile
+          BUILD_NAME: loadbalanced-rhel8-latest-gcc-compile
       - func: fetch-det
       - func: bootstrap-mongo-orchestration
         vars:
@@ -2872,14 +3435,14 @@ tasks:
           CC: gcc
           LOADBALANCED: loadbalanced
           SSL: openssl
-  - name: loadbalanced-rhel8.9-gcc-test-6.0-noauth-nossl
-    run_on: rhel8.9-small
-    tags: [loadbalanced, rhel8.9, gcc, noauth, nossl]
-    depends_on: [{ name: loadbalanced-rhel8.9-gcc-compile }]
+  - name: loadbalanced-rhel8-latest-gcc-test-6.0-noauth-nossl
+    run_on: rhel8-latest-large
+    tags: [loadbalanced, rhel8-latest, gcc, noauth, nossl]
+    depends_on: [{ name: loadbalanced-rhel8-latest-gcc-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: loadbalanced-rhel8.9-gcc-compile
+          BUILD_NAME: loadbalanced-rhel8-latest-gcc-compile
       - func: fetch-det
       - func: bootstrap-mongo-orchestration
         vars:
@@ -2898,14 +3461,14 @@ tasks:
           CC: gcc
           LOADBALANCED: loadbalanced
           SSL: nossl
-  - name: loadbalanced-rhel8.9-gcc-test-7.0-auth-openssl
-    run_on: rhel8.9-small
-    tags: [loadbalanced, rhel8.9, gcc, auth, openssl]
-    depends_on: [{ name: loadbalanced-rhel8.9-gcc-compile }]
+  - name: loadbalanced-rhel8-latest-gcc-test-7.0-auth-openssl
+    run_on: rhel8-latest-large
+    tags: [loadbalanced, rhel8-latest, gcc, auth, openssl]
+    depends_on: [{ name: loadbalanced-rhel8-latest-gcc-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: loadbalanced-rhel8.9-gcc-compile
+          BUILD_NAME: loadbalanced-rhel8-latest-gcc-compile
       - func: fetch-det
       - func: bootstrap-mongo-orchestration
         vars:
@@ -2924,14 +3487,14 @@ tasks:
           CC: gcc
           LOADBALANCED: loadbalanced
           SSL: openssl
-  - name: loadbalanced-rhel8.9-gcc-test-7.0-noauth-nossl
-    run_on: rhel8.9-small
-    tags: [loadbalanced, rhel8.9, gcc, noauth, nossl]
-    depends_on: [{ name: loadbalanced-rhel8.9-gcc-compile }]
+  - name: loadbalanced-rhel8-latest-gcc-test-7.0-noauth-nossl
+    run_on: rhel8-latest-large
+    tags: [loadbalanced, rhel8-latest, gcc, noauth, nossl]
+    depends_on: [{ name: loadbalanced-rhel8-latest-gcc-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: loadbalanced-rhel8.9-gcc-compile
+          BUILD_NAME: loadbalanced-rhel8-latest-gcc-compile
       - func: fetch-det
       - func: bootstrap-mongo-orchestration
         vars:
@@ -2950,14 +3513,14 @@ tasks:
           CC: gcc
           LOADBALANCED: loadbalanced
           SSL: nossl
-  - name: loadbalanced-rhel8.9-gcc-test-8.0-auth-openssl
-    run_on: rhel8.9-small
-    tags: [loadbalanced, rhel8.9, gcc, auth, openssl]
-    depends_on: [{ name: loadbalanced-rhel8.9-gcc-compile }]
+  - name: loadbalanced-rhel8-latest-gcc-test-8.0-auth-openssl
+    run_on: rhel8-latest-large
+    tags: [loadbalanced, rhel8-latest, gcc, auth, openssl]
+    depends_on: [{ name: loadbalanced-rhel8-latest-gcc-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: loadbalanced-rhel8.9-gcc-compile
+          BUILD_NAME: loadbalanced-rhel8-latest-gcc-compile
       - func: fetch-det
       - func: bootstrap-mongo-orchestration
         vars:
@@ -2976,14 +3539,14 @@ tasks:
           CC: gcc
           LOADBALANCED: loadbalanced
           SSL: openssl
-  - name: loadbalanced-rhel8.9-gcc-test-8.0-noauth-nossl
-    run_on: rhel8.9-small
-    tags: [loadbalanced, rhel8.9, gcc, noauth, nossl]
-    depends_on: [{ name: loadbalanced-rhel8.9-gcc-compile }]
+  - name: loadbalanced-rhel8-latest-gcc-test-8.0-noauth-nossl
+    run_on: rhel8-latest-large
+    tags: [loadbalanced, rhel8-latest, gcc, noauth, nossl]
+    depends_on: [{ name: loadbalanced-rhel8-latest-gcc-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: loadbalanced-rhel8.9-gcc-compile
+          BUILD_NAME: loadbalanced-rhel8-latest-gcc-compile
       - func: fetch-det
       - func: bootstrap-mongo-orchestration
         vars:
@@ -3002,14 +3565,14 @@ tasks:
           CC: gcc
           LOADBALANCED: loadbalanced
           SSL: nossl
-  - name: loadbalanced-rhel8.9-gcc-test-latest-auth-openssl
-    run_on: rhel8.9-small
-    tags: [loadbalanced, rhel8.9, gcc, auth, openssl]
-    depends_on: [{ name: loadbalanced-rhel8.9-gcc-compile }]
+  - name: loadbalanced-rhel8-latest-gcc-test-latest-auth-openssl
+    run_on: rhel8-latest-large
+    tags: [loadbalanced, rhel8-latest, gcc, auth, openssl]
+    depends_on: [{ name: loadbalanced-rhel8-latest-gcc-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: loadbalanced-rhel8.9-gcc-compile
+          BUILD_NAME: loadbalanced-rhel8-latest-gcc-compile
       - func: fetch-det
       - func: bootstrap-mongo-orchestration
         vars:
@@ -3028,14 +3591,14 @@ tasks:
           CC: gcc
           LOADBALANCED: loadbalanced
           SSL: openssl
-  - name: loadbalanced-rhel8.9-gcc-test-latest-noauth-nossl
-    run_on: rhel8.9-small
-    tags: [loadbalanced, rhel8.9, gcc, noauth, nossl]
-    depends_on: [{ name: loadbalanced-rhel8.9-gcc-compile }]
+  - name: loadbalanced-rhel8-latest-gcc-test-latest-noauth-nossl
+    run_on: rhel8-latest-large
+    tags: [loadbalanced, rhel8-latest, gcc, noauth, nossl]
+    depends_on: [{ name: loadbalanced-rhel8-latest-gcc-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: loadbalanced-rhel8.9-gcc-compile
+          BUILD_NAME: loadbalanced-rhel8-latest-gcc-compile
       - func: fetch-det
       - func: bootstrap-mongo-orchestration
         vars:
@@ -3083,15 +3646,6 @@ tasks:
           args:
             - -c
             - .evergreen/scripts/run-mock-server-tests.sh
-  - name: openssl-static-compile-debian10-gcc
-    run_on: debian10-large
-    tags: [openssl-static-matrix, debian10, gcc]
-    commands:
-      - func: find-cmake-latest
-      - func: openssl-static-compile
-        vars:
-          CC: gcc
-          CXX: g++
   - name: openssl-static-compile-debian11-gcc
     run_on: debian11-large
     tags: [openssl-static-matrix, debian11, gcc]
@@ -3101,9 +3655,9 @@ tasks:
         vars:
           CC: gcc
           CXX: g++
-  - name: openssl-static-compile-debian92-gcc
-    run_on: debian92-large
-    tags: [openssl-static-matrix, debian92, gcc]
+  - name: openssl-static-compile-debian12-gcc
+    run_on: debian12-large
+    tags: [openssl-static-matrix, debian12, gcc]
     commands:
       - func: find-cmake-latest
       - func: openssl-static-compile
@@ -3119,6 +3673,24 @@ tasks:
         vars:
           CC: gcc
           CXX: g++
+  - name: openssl-static-compile-ubuntu2204-gcc
+    run_on: ubuntu2204-large
+    tags: [openssl-static-matrix, ubuntu2204, gcc]
+    commands:
+      - func: find-cmake-latest
+      - func: openssl-static-compile
+        vars:
+          CC: gcc
+          CXX: g++
+  - name: openssl-static-compile-ubuntu2404-gcc
+    run_on: ubuntu2404-large
+    tags: [openssl-static-matrix, ubuntu2404, gcc]
+    commands:
+      - func: find-cmake-latest
+      - func: openssl-static-compile
+        vars:
+          CC: gcc
+          CXX: g++
   - name: sasl-cyrus-darwinssl-macos-11-arm64-clang-compile
     run_on: macos-11-arm64
     tags: [sasl-matrix-darwinssl, compile, macos-11-arm64, clang, sasl-cyrus]
@@ -3275,27 +3847,6 @@ tasks:
           CC: clang
           CXX: clang++
       - func: upload-build
-  - name: sasl-cyrus-darwinssl-macos-14-clang-test-4.0-server-auth
-    run_on: macos-14
-    tags: [sasl-matrix-darwinssl, test, macos-14, clang, sasl-cyrus, auth, server, "4.0", darwinssl]
-    depends_on: [{ name: sasl-cyrus-darwinssl-macos-14-clang-compile }]
-    commands:
-      - func: fetch-build
-        vars:
-          BUILD_NAME: sasl-cyrus-darwinssl-macos-14-clang-compile
-      - command: expansions.update
-        params:
-          updates:
-            - { key: CC, value: clang }
-            - { key: CXX, value: clang++ }
-            - { key: AUTH, value: auth }
-            - { key: MONGODB_VERSION, value: "4.0" }
-            - { key: TOPOLOGY, value: server }
-            - { key: SSL, value: darwinssl }
-      - func: fetch-det
-      - func: bootstrap-mongo-orchestration
-      - func: run-simple-http-server
-      - func: run-tests
   - name: sasl-cyrus-darwinssl-macos-14-clang-test-4.2-server-auth
     run_on: macos-14
     tags: [sasl-matrix-darwinssl, test, macos-14, clang, sasl-cyrus, auth, server, "4.2", darwinssl]
@@ -3432,9 +3983,19 @@ tasks:
       - func: bootstrap-mongo-orchestration
       - func: run-simple-http-server
       - func: run-tests
-  - name: sasl-cyrus-openssl-debian10-gcc-compile
-    run_on: debian10-large
-    tags: [sasl-matrix-openssl, compile, debian10, gcc, sasl-cyrus]
+  - name: sasl-cyrus-openssl-debian11-gcc-compile
+    run_on: debian11-large
+    tags: [sasl-matrix-openssl, compile, debian11, gcc, sasl-cyrus]
+    commands:
+      - func: find-cmake-latest
+      - func: sasl-cyrus-openssl-compile
+        vars:
+          CC: gcc
+          CXX: g++
+      - func: upload-build
+  - name: sasl-cyrus-openssl-debian12-gcc-compile
+    run_on: debian12-large
+    tags: [sasl-matrix-openssl, compile, debian12, gcc, sasl-cyrus]
     commands:
       - func: find-cmake-latest
       - func: sasl-cyrus-openssl-compile
@@ -3442,14 +4003,24 @@ tasks:
           CC: gcc
           CXX: g++
       - func: upload-build
-  - name: sasl-cyrus-openssl-debian10-gcc-test-4.2-replica-auth
-    run_on: debian10-small
-    tags: [sasl-matrix-openssl, test, debian10, gcc, sasl-cyrus, auth, replica, "4.2", openssl]
-    depends_on: [{ name: sasl-cyrus-openssl-debian10-gcc-compile }]
+  - name: sasl-cyrus-openssl-rhel8-latest-gcc-compile
+    run_on: rhel8-latest-large
+    tags: [sasl-matrix-openssl, compile, rhel8-latest, gcc, sasl-cyrus]
+    commands:
+      - func: find-cmake-latest
+      - func: sasl-cyrus-openssl-compile
+        vars:
+          CC: gcc
+          CXX: g++
+      - func: upload-build
+  - name: sasl-cyrus-openssl-rhel8-latest-gcc-test-4.2-server-auth
+    run_on: rhel8-latest-large
+    tags: [sasl-matrix-openssl, test, rhel8-latest, gcc, sasl-cyrus, auth, server, "4.2", openssl]
+    depends_on: [{ name: sasl-cyrus-openssl-rhel8-latest-gcc-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: sasl-cyrus-openssl-debian10-gcc-compile
+          BUILD_NAME: sasl-cyrus-openssl-rhel8-latest-gcc-compile
       - command: expansions.update
         params:
           updates:
@@ -3457,63 +4028,138 @@ tasks:
             - { key: CXX, value: g++ }
             - { key: AUTH, value: auth }
             - { key: MONGODB_VERSION, value: "4.2" }
-            - { key: TOPOLOGY, value: replica_set }
+            - { key: TOPOLOGY, value: server }
             - { key: SSL, value: openssl }
       - func: fetch-det
       - func: bootstrap-mongo-orchestration
       - func: run-simple-http-server
       - func: run-tests
-  - name: sasl-cyrus-openssl-debian10-gcc-test-4.2-server-auth
-    run_on: debian10-small
-    tags: [sasl-matrix-openssl, test, debian10, gcc, sasl-cyrus, auth, server, "4.2", openssl]
-    depends_on: [{ name: sasl-cyrus-openssl-debian10-gcc-compile }]
+  - name: sasl-cyrus-openssl-rhel8-latest-gcc-test-4.4-server-auth
+    run_on: rhel8-latest-large
+    tags: [sasl-matrix-openssl, test, rhel8-latest, gcc, sasl-cyrus, auth, server, "4.4", openssl]
+    depends_on: [{ name: sasl-cyrus-openssl-rhel8-latest-gcc-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: sasl-cyrus-openssl-debian10-gcc-compile
+          BUILD_NAME: sasl-cyrus-openssl-rhel8-latest-gcc-compile
       - command: expansions.update
         params:
           updates:
             - { key: CC, value: gcc }
             - { key: CXX, value: g++ }
             - { key: AUTH, value: auth }
-            - { key: MONGODB_VERSION, value: "4.2" }
+            - { key: MONGODB_VERSION, value: "4.4" }
             - { key: TOPOLOGY, value: server }
             - { key: SSL, value: openssl }
       - func: fetch-det
       - func: bootstrap-mongo-orchestration
       - func: run-simple-http-server
       - func: run-tests
-  - name: sasl-cyrus-openssl-debian11-gcc-compile
-    run_on: debian11-large
-    tags: [sasl-matrix-openssl, compile, debian11, gcc, sasl-cyrus]
+  - name: sasl-cyrus-openssl-rhel8-latest-gcc-test-5.0-server-auth
+    run_on: rhel8-latest-large
+    tags: [sasl-matrix-openssl, test, rhel8-latest, gcc, sasl-cyrus, auth, server, "5.0", openssl]
+    depends_on: [{ name: sasl-cyrus-openssl-rhel8-latest-gcc-compile }]
     commands:
-      - func: find-cmake-latest
-      - func: sasl-cyrus-openssl-compile
+      - func: fetch-build
         vars:
-          CC: gcc
-          CXX: g++
-      - func: upload-build
-  - name: sasl-cyrus-openssl-debian92-clang-compile
-    run_on: debian92-large
-    tags: [sasl-matrix-openssl, compile, debian92, clang, sasl-cyrus]
+          BUILD_NAME: sasl-cyrus-openssl-rhel8-latest-gcc-compile
+      - command: expansions.update
+        params:
+          updates:
+            - { key: CC, value: gcc }
+            - { key: CXX, value: g++ }
+            - { key: AUTH, value: auth }
+            - { key: MONGODB_VERSION, value: "5.0" }
+            - { key: TOPOLOGY, value: server }
+            - { key: SSL, value: openssl }
+      - func: fetch-det
+      - func: bootstrap-mongo-orchestration
+      - func: run-simple-http-server
+      - func: run-tests
+  - name: sasl-cyrus-openssl-rhel8-latest-gcc-test-6.0-server-auth
+    run_on: rhel8-latest-large
+    tags: [sasl-matrix-openssl, test, rhel8-latest, gcc, sasl-cyrus, auth, server, "6.0", openssl]
+    depends_on: [{ name: sasl-cyrus-openssl-rhel8-latest-gcc-compile }]
     commands:
-      - func: find-cmake-latest
-      - func: sasl-cyrus-openssl-compile
+      - func: fetch-build
         vars:
-          CC: clang
-          CXX: clang++
-      - func: upload-build
-  - name: sasl-cyrus-openssl-debian92-gcc-compile
-    run_on: debian92-large
-    tags: [sasl-matrix-openssl, compile, debian92, gcc, sasl-cyrus]
+          BUILD_NAME: sasl-cyrus-openssl-rhel8-latest-gcc-compile
+      - command: expansions.update
+        params:
+          updates:
+            - { key: CC, value: gcc }
+            - { key: CXX, value: g++ }
+            - { key: AUTH, value: auth }
+            - { key: MONGODB_VERSION, value: "6.0" }
+            - { key: TOPOLOGY, value: server }
+            - { key: SSL, value: openssl }
+      - func: fetch-det
+      - func: bootstrap-mongo-orchestration
+      - func: run-simple-http-server
+      - func: run-tests
+  - name: sasl-cyrus-openssl-rhel8-latest-gcc-test-7.0-server-auth
+    run_on: rhel8-latest-large
+    tags: [sasl-matrix-openssl, test, rhel8-latest, gcc, sasl-cyrus, auth, server, "7.0", openssl]
+    depends_on: [{ name: sasl-cyrus-openssl-rhel8-latest-gcc-compile }]
     commands:
-      - func: find-cmake-latest
-      - func: sasl-cyrus-openssl-compile
+      - func: fetch-build
         vars:
-          CC: gcc
-          CXX: g++
-      - func: upload-build
+          BUILD_NAME: sasl-cyrus-openssl-rhel8-latest-gcc-compile
+      - command: expansions.update
+        params:
+          updates:
+            - { key: CC, value: gcc }
+            - { key: CXX, value: g++ }
+            - { key: AUTH, value: auth }
+            - { key: MONGODB_VERSION, value: "7.0" }
+            - { key: TOPOLOGY, value: server }
+            - { key: SSL, value: openssl }
+      - func: fetch-det
+      - func: bootstrap-mongo-orchestration
+      - func: run-simple-http-server
+      - func: run-tests
+  - name: sasl-cyrus-openssl-rhel8-latest-gcc-test-8.0-server-auth
+    run_on: rhel8-latest-large
+    tags: [sasl-matrix-openssl, test, rhel8-latest, gcc, sasl-cyrus, auth, server, "8.0", openssl]
+    depends_on: [{ name: sasl-cyrus-openssl-rhel8-latest-gcc-compile }]
+    commands:
+      - func: fetch-build
+        vars:
+          BUILD_NAME: sasl-cyrus-openssl-rhel8-latest-gcc-compile
+      - command: expansions.update
+        params:
+          updates:
+            - { key: CC, value: gcc }
+            - { key: CXX, value: g++ }
+            - { key: AUTH, value: auth }
+            - { key: MONGODB_VERSION, value: "8.0" }
+            - { key: TOPOLOGY, value: server }
+            - { key: SSL, value: openssl }
+      - func: fetch-det
+      - func: bootstrap-mongo-orchestration
+      - func: run-simple-http-server
+      - func: run-tests
+  - name: sasl-cyrus-openssl-rhel8-latest-gcc-test-latest-server-auth
+    run_on: rhel8-latest-large
+    tags: [sasl-matrix-openssl, test, rhel8-latest, gcc, sasl-cyrus, auth, server, latest, openssl]
+    depends_on: [{ name: sasl-cyrus-openssl-rhel8-latest-gcc-compile }]
+    commands:
+      - func: fetch-build
+        vars:
+          BUILD_NAME: sasl-cyrus-openssl-rhel8-latest-gcc-compile
+      - command: expansions.update
+        params:
+          updates:
+            - { key: CC, value: gcc }
+            - { key: CXX, value: g++ }
+            - { key: AUTH, value: auth }
+            - { key: MONGODB_VERSION, value: latest }
+            - { key: TOPOLOGY, value: server }
+            - { key: SSL, value: openssl }
+      - func: fetch-det
+      - func: bootstrap-mongo-orchestration
+      - func: run-simple-http-server
+      - func: run-tests
   - name: sasl-cyrus-openssl-rhel8-power-gcc-compile
     run_on: rhel8-power-large
     tags: [sasl-matrix-openssl, compile, rhel8-power, gcc, sasl-cyrus]
@@ -3956,142 +4602,46 @@ tasks:
           CC: clang
           CXX: clang++
       - func: upload-build
-  - name: sasl-cyrus-openssl-ubuntu2004-gcc-compile
-    run_on: ubuntu2004-large
-    tags: [sasl-matrix-openssl, compile, ubuntu2004, gcc, sasl-cyrus]
+  - name: sasl-cyrus-openssl-ubuntu2204-clang-12-compile
+    run_on: ubuntu2204-large
+    tags: [sasl-matrix-openssl, compile, ubuntu2204, clang-12, sasl-cyrus]
     commands:
       - func: find-cmake-latest
       - func: sasl-cyrus-openssl-compile
         vars:
-          CC: gcc
-          CXX: g++
+          CC: clang-12
+          CXX: clang++-12
       - func: upload-build
-  - name: sasl-cyrus-openssl-ubuntu2004-gcc-test-4.4-server-auth
-    run_on: ubuntu2004-small
-    tags: [sasl-matrix-openssl, test, ubuntu2004, gcc, sasl-cyrus, auth, server, "4.4", openssl]
-    depends_on: [{ name: sasl-cyrus-openssl-ubuntu2004-gcc-compile }]
-    commands:
-      - func: fetch-build
-        vars:
-          BUILD_NAME: sasl-cyrus-openssl-ubuntu2004-gcc-compile
-      - command: expansions.update
-        params:
-          updates:
-            - { key: CC, value: gcc }
-            - { key: CXX, value: g++ }
-            - { key: AUTH, value: auth }
-            - { key: MONGODB_VERSION, value: "4.4" }
-            - { key: TOPOLOGY, value: server }
-            - { key: SSL, value: openssl }
-      - func: fetch-det
-      - func: bootstrap-mongo-orchestration
-      - func: run-simple-http-server
-      - func: run-tests
-  - name: sasl-cyrus-openssl-ubuntu2004-gcc-test-5.0-server-auth
-    run_on: ubuntu2004-small
-    tags: [sasl-matrix-openssl, test, ubuntu2004, gcc, sasl-cyrus, auth, server, "5.0", openssl]
-    depends_on: [{ name: sasl-cyrus-openssl-ubuntu2004-gcc-compile }]
-    commands:
-      - func: fetch-build
-        vars:
-          BUILD_NAME: sasl-cyrus-openssl-ubuntu2004-gcc-compile
-      - command: expansions.update
-        params:
-          updates:
-            - { key: CC, value: gcc }
-            - { key: CXX, value: g++ }
-            - { key: AUTH, value: auth }
-            - { key: MONGODB_VERSION, value: "5.0" }
-            - { key: TOPOLOGY, value: server }
-            - { key: SSL, value: openssl }
-      - func: fetch-det
-      - func: bootstrap-mongo-orchestration
-      - func: run-simple-http-server
-      - func: run-tests
-  - name: sasl-cyrus-openssl-ubuntu2004-gcc-test-6.0-server-auth
-    run_on: ubuntu2004-small
-    tags: [sasl-matrix-openssl, test, ubuntu2004, gcc, sasl-cyrus, auth, server, "6.0", openssl]
-    depends_on: [{ name: sasl-cyrus-openssl-ubuntu2004-gcc-compile }]
-    commands:
-      - func: fetch-build
-        vars:
-          BUILD_NAME: sasl-cyrus-openssl-ubuntu2004-gcc-compile
-      - command: expansions.update
-        params:
-          updates:
-            - { key: CC, value: gcc }
-            - { key: CXX, value: g++ }
-            - { key: AUTH, value: auth }
-            - { key: MONGODB_VERSION, value: "6.0" }
-            - { key: TOPOLOGY, value: server }
-            - { key: SSL, value: openssl }
-      - func: fetch-det
-      - func: bootstrap-mongo-orchestration
-      - func: run-simple-http-server
-      - func: run-tests
-  - name: sasl-cyrus-openssl-ubuntu2004-gcc-test-7.0-server-auth
-    run_on: ubuntu2004-small
-    tags: [sasl-matrix-openssl, test, ubuntu2004, gcc, sasl-cyrus, auth, server, "7.0", openssl]
-    depends_on: [{ name: sasl-cyrus-openssl-ubuntu2004-gcc-compile }]
+  - name: sasl-cyrus-openssl-ubuntu2204-gcc-compile
+    run_on: ubuntu2204-large
+    tags: [sasl-matrix-openssl, compile, ubuntu2204, gcc, sasl-cyrus]
     commands:
-      - func: fetch-build
+      - func: find-cmake-latest
+      - func: sasl-cyrus-openssl-compile
         vars:
-          BUILD_NAME: sasl-cyrus-openssl-ubuntu2004-gcc-compile
-      - command: expansions.update
-        params:
-          updates:
-            - { key: CC, value: gcc }
-            - { key: CXX, value: g++ }
-            - { key: AUTH, value: auth }
-            - { key: MONGODB_VERSION, value: "7.0" }
-            - { key: TOPOLOGY, value: server }
-            - { key: SSL, value: openssl }
-      - func: fetch-det
-      - func: bootstrap-mongo-orchestration
-      - func: run-simple-http-server
-      - func: run-tests
-  - name: sasl-cyrus-openssl-ubuntu2004-gcc-test-8.0-server-auth
-    run_on: ubuntu2004-small
-    tags: [sasl-matrix-openssl, test, ubuntu2004, gcc, sasl-cyrus, auth, server, "8.0", openssl]
-    depends_on: [{ name: sasl-cyrus-openssl-ubuntu2004-gcc-compile }]
+          CC: gcc
+          CXX: g++
+      - func: upload-build
+  - name: sasl-cyrus-openssl-ubuntu2404-clang-14-compile
+    run_on: ubuntu2404-large
+    tags: [sasl-matrix-openssl, compile, ubuntu2404, clang-14, sasl-cyrus]
     commands:
-      - func: fetch-build
+      - func: find-cmake-latest
+      - func: sasl-cyrus-openssl-compile
         vars:
-          BUILD_NAME: sasl-cyrus-openssl-ubuntu2004-gcc-compile
-      - command: expansions.update
-        params:
-          updates:
-            - { key: CC, value: gcc }
-            - { key: CXX, value: g++ }
-            - { key: AUTH, value: auth }
-            - { key: MONGODB_VERSION, value: "8.0" }
-            - { key: TOPOLOGY, value: server }
-            - { key: SSL, value: openssl }
-      - func: fetch-det
-      - func: bootstrap-mongo-orchestration
-      - func: run-simple-http-server
-      - func: run-tests
-  - name: sasl-cyrus-openssl-ubuntu2004-gcc-test-latest-server-auth
-    run_on: ubuntu2004-small
-    tags: [sasl-matrix-openssl, test, ubuntu2004, gcc, sasl-cyrus, auth, server, latest, openssl]
-    depends_on: [{ name: sasl-cyrus-openssl-ubuntu2004-gcc-compile }]
+          CC: clang-14
+          CXX: clang++-14
+      - func: upload-build
+  - name: sasl-cyrus-openssl-ubuntu2404-gcc-compile
+    run_on: ubuntu2404-large
+    tags: [sasl-matrix-openssl, compile, ubuntu2404, gcc, sasl-cyrus]
     commands:
-      - func: fetch-build
+      - func: find-cmake-latest
+      - func: sasl-cyrus-openssl-compile
         vars:
-          BUILD_NAME: sasl-cyrus-openssl-ubuntu2004-gcc-compile
-      - command: expansions.update
-        params:
-          updates:
-            - { key: CC, value: gcc }
-            - { key: CXX, value: g++ }
-            - { key: AUTH, value: auth }
-            - { key: MONGODB_VERSION, value: latest }
-            - { key: TOPOLOGY, value: server }
-            - { key: SSL, value: openssl }
-      - func: fetch-det
-      - func: bootstrap-mongo-orchestration
-      - func: run-simple-http-server
-      - func: run-tests
+          CC: gcc
+          CXX: g++
+      - func: upload-build
   - name: sasl-cyrus-openssl-windows-2019-vs2017-x64-compile
     run_on: windows-vsCurrent-large
     tags: [sasl-matrix-openssl, compile, windows-vsCurrent, vs2017x64, sasl-cyrus]
@@ -4123,9 +4673,9 @@ tasks:
       - func: bootstrap-mongo-orchestration
       - func: run-simple-http-server
       - func: run-tests
-  - name: sasl-off-nossl-debian10-gcc-compile
-    run_on: debian10-large
-    tags: [sasl-matrix-nossl, compile, debian10, gcc, sasl-off]
+  - name: sasl-off-nossl-rhel8-latest-gcc-compile
+    run_on: rhel8-latest-large
+    tags: [sasl-matrix-nossl, compile, rhel8-latest, gcc, sasl-off]
     commands:
       - func: find-cmake-latest
       - func: sasl-off-nossl-compile
@@ -4133,14 +4683,14 @@ tasks:
           CC: gcc
           CXX: g++
       - func: upload-build
-  - name: sasl-off-nossl-debian10-gcc-test-4.2-replica-noauth
-    run_on: debian10-small
-    tags: [sasl-matrix-nossl, test, debian10, gcc, sasl-off, noauth, replica, "4.2"]
-    depends_on: [{ name: sasl-off-nossl-debian10-gcc-compile }]
+  - name: sasl-off-nossl-rhel8-latest-gcc-test-4.2-replica-noauth
+    run_on: rhel8-latest-large
+    tags: [sasl-matrix-nossl, test, rhel8-latest, gcc, sasl-off, noauth, replica, "4.2"]
+    depends_on: [{ name: sasl-off-nossl-rhel8-latest-gcc-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: sasl-off-nossl-debian10-gcc-compile
+          BUILD_NAME: sasl-off-nossl-rhel8-latest-gcc-compile
       - command: expansions.update
         params:
           updates:
@@ -4154,14 +4704,14 @@ tasks:
       - func: bootstrap-mongo-orchestration
       - func: run-simple-http-server
       - func: run-tests
-  - name: sasl-off-nossl-debian10-gcc-test-4.2-server-noauth
-    run_on: debian10-small
-    tags: [sasl-matrix-nossl, test, debian10, gcc, sasl-off, noauth, server, "4.2"]
-    depends_on: [{ name: sasl-off-nossl-debian10-gcc-compile }]
+  - name: sasl-off-nossl-rhel8-latest-gcc-test-4.2-server-noauth
+    run_on: rhel8-latest-large
+    tags: [sasl-matrix-nossl, test, rhel8-latest, gcc, sasl-off, noauth, server, "4.2"]
+    depends_on: [{ name: sasl-off-nossl-rhel8-latest-gcc-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: sasl-off-nossl-debian10-gcc-compile
+          BUILD_NAME: sasl-off-nossl-rhel8-latest-gcc-compile
       - command: expansions.update
         params:
           updates:
@@ -4175,14 +4725,14 @@ tasks:
       - func: bootstrap-mongo-orchestration
       - func: run-simple-http-server
       - func: run-tests
-  - name: sasl-off-nossl-debian10-gcc-test-4.2-sharded-noauth
-    run_on: debian10-small
-    tags: [sasl-matrix-nossl, test, debian10, gcc, sasl-off, noauth, sharded, "4.2"]
-    depends_on: [{ name: sasl-off-nossl-debian10-gcc-compile }]
+  - name: sasl-off-nossl-rhel8-latest-gcc-test-4.2-sharded-noauth
+    run_on: rhel8-latest-large
+    tags: [sasl-matrix-nossl, test, rhel8-latest, gcc, sasl-off, noauth, sharded, "4.2"]
+    depends_on: [{ name: sasl-off-nossl-rhel8-latest-gcc-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: sasl-off-nossl-debian10-gcc-compile
+          BUILD_NAME: sasl-off-nossl-rhel8-latest-gcc-compile
       - command: expansions.update
         params:
           updates:
@@ -4196,24 +4746,14 @@ tasks:
       - func: bootstrap-mongo-orchestration
       - func: run-simple-http-server
       - func: run-tests
-  - name: sasl-off-nossl-ubuntu2004-gcc-compile
-    run_on: ubuntu2004-large
-    tags: [sasl-matrix-nossl, compile, ubuntu2004, gcc, sasl-off]
-    commands:
-      - func: find-cmake-latest
-      - func: sasl-off-nossl-compile
-        vars:
-          CC: gcc
-          CXX: g++
-      - func: upload-build
-  - name: sasl-off-nossl-ubuntu2004-gcc-test-4.4-replica-noauth
-    run_on: ubuntu2004-small
-    tags: [sasl-matrix-nossl, test, ubuntu2004, gcc, sasl-off, noauth, replica, "4.4"]
-    depends_on: [{ name: sasl-off-nossl-ubuntu2004-gcc-compile }]
+  - name: sasl-off-nossl-rhel8-latest-gcc-test-4.4-replica-noauth
+    run_on: rhel8-latest-large
+    tags: [sasl-matrix-nossl, test, rhel8-latest, gcc, sasl-off, noauth, replica, "4.4"]
+    depends_on: [{ name: sasl-off-nossl-rhel8-latest-gcc-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: sasl-off-nossl-ubuntu2004-gcc-compile
+          BUILD_NAME: sasl-off-nossl-rhel8-latest-gcc-compile
       - command: expansions.update
         params:
           updates:
@@ -4227,14 +4767,14 @@ tasks:
       - func: bootstrap-mongo-orchestration
       - func: run-simple-http-server
       - func: run-tests
-  - name: sasl-off-nossl-ubuntu2004-gcc-test-4.4-server-noauth
-    run_on: ubuntu2004-small
-    tags: [sasl-matrix-nossl, test, ubuntu2004, gcc, sasl-off, noauth, server, "4.4"]
-    depends_on: [{ name: sasl-off-nossl-ubuntu2004-gcc-compile }]
+  - name: sasl-off-nossl-rhel8-latest-gcc-test-4.4-server-noauth
+    run_on: rhel8-latest-large
+    tags: [sasl-matrix-nossl, test, rhel8-latest, gcc, sasl-off, noauth, server, "4.4"]
+    depends_on: [{ name: sasl-off-nossl-rhel8-latest-gcc-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: sasl-off-nossl-ubuntu2004-gcc-compile
+          BUILD_NAME: sasl-off-nossl-rhel8-latest-gcc-compile
       - command: expansions.update
         params:
           updates:
@@ -4248,14 +4788,14 @@ tasks:
       - func: bootstrap-mongo-orchestration
       - func: run-simple-http-server
       - func: run-tests
-  - name: sasl-off-nossl-ubuntu2004-gcc-test-4.4-sharded-noauth
-    run_on: ubuntu2004-small
-    tags: [sasl-matrix-nossl, test, ubuntu2004, gcc, sasl-off, noauth, sharded, "4.4"]
-    depends_on: [{ name: sasl-off-nossl-ubuntu2004-gcc-compile }]
+  - name: sasl-off-nossl-rhel8-latest-gcc-test-4.4-sharded-noauth
+    run_on: rhel8-latest-large
+    tags: [sasl-matrix-nossl, test, rhel8-latest, gcc, sasl-off, noauth, sharded, "4.4"]
+    depends_on: [{ name: sasl-off-nossl-rhel8-latest-gcc-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: sasl-off-nossl-ubuntu2004-gcc-compile
+          BUILD_NAME: sasl-off-nossl-rhel8-latest-gcc-compile
       - command: expansions.update
         params:
           updates:
@@ -4269,14 +4809,14 @@ tasks:
       - func: bootstrap-mongo-orchestration
       - func: run-simple-http-server
       - func: run-tests
-  - name: sasl-off-nossl-ubuntu2004-gcc-test-5.0-replica-noauth
-    run_on: ubuntu2004-small
-    tags: [sasl-matrix-nossl, test, ubuntu2004, gcc, sasl-off, noauth, replica, "5.0"]
-    depends_on: [{ name: sasl-off-nossl-ubuntu2004-gcc-compile }]
+  - name: sasl-off-nossl-rhel8-latest-gcc-test-5.0-replica-noauth
+    run_on: rhel8-latest-large
+    tags: [sasl-matrix-nossl, test, rhel8-latest, gcc, sasl-off, noauth, replica, "5.0"]
+    depends_on: [{ name: sasl-off-nossl-rhel8-latest-gcc-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: sasl-off-nossl-ubuntu2004-gcc-compile
+          BUILD_NAME: sasl-off-nossl-rhel8-latest-gcc-compile
       - command: expansions.update
         params:
           updates:
@@ -4290,14 +4830,14 @@ tasks:
       - func: bootstrap-mongo-orchestration
       - func: run-simple-http-server
       - func: run-tests
-  - name: sasl-off-nossl-ubuntu2004-gcc-test-5.0-server-noauth
-    run_on: ubuntu2004-small
-    tags: [sasl-matrix-nossl, test, ubuntu2004, gcc, sasl-off, noauth, server, "5.0"]
-    depends_on: [{ name: sasl-off-nossl-ubuntu2004-gcc-compile }]
+  - name: sasl-off-nossl-rhel8-latest-gcc-test-5.0-server-noauth
+    run_on: rhel8-latest-large
+    tags: [sasl-matrix-nossl, test, rhel8-latest, gcc, sasl-off, noauth, server, "5.0"]
+    depends_on: [{ name: sasl-off-nossl-rhel8-latest-gcc-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: sasl-off-nossl-ubuntu2004-gcc-compile
+          BUILD_NAME: sasl-off-nossl-rhel8-latest-gcc-compile
       - command: expansions.update
         params:
           updates:
@@ -4311,14 +4851,14 @@ tasks:
       - func: bootstrap-mongo-orchestration
       - func: run-simple-http-server
       - func: run-tests
-  - name: sasl-off-nossl-ubuntu2004-gcc-test-5.0-sharded-noauth
-    run_on: ubuntu2004-small
-    tags: [sasl-matrix-nossl, test, ubuntu2004, gcc, sasl-off, noauth, sharded, "5.0"]
-    depends_on: [{ name: sasl-off-nossl-ubuntu2004-gcc-compile }]
+  - name: sasl-off-nossl-rhel8-latest-gcc-test-5.0-sharded-noauth
+    run_on: rhel8-latest-large
+    tags: [sasl-matrix-nossl, test, rhel8-latest, gcc, sasl-off, noauth, sharded, "5.0"]
+    depends_on: [{ name: sasl-off-nossl-rhel8-latest-gcc-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: sasl-off-nossl-ubuntu2004-gcc-compile
+          BUILD_NAME: sasl-off-nossl-rhel8-latest-gcc-compile
       - command: expansions.update
         params:
           updates:
@@ -4332,14 +4872,14 @@ tasks:
       - func: bootstrap-mongo-orchestration
       - func: run-simple-http-server
       - func: run-tests
-  - name: sasl-off-nossl-ubuntu2004-gcc-test-6.0-replica-noauth
-    run_on: ubuntu2004-small
-    tags: [sasl-matrix-nossl, test, ubuntu2004, gcc, sasl-off, noauth, replica, "6.0"]
-    depends_on: [{ name: sasl-off-nossl-ubuntu2004-gcc-compile }]
+  - name: sasl-off-nossl-rhel8-latest-gcc-test-6.0-replica-noauth
+    run_on: rhel8-latest-large
+    tags: [sasl-matrix-nossl, test, rhel8-latest, gcc, sasl-off, noauth, replica, "6.0"]
+    depends_on: [{ name: sasl-off-nossl-rhel8-latest-gcc-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: sasl-off-nossl-ubuntu2004-gcc-compile
+          BUILD_NAME: sasl-off-nossl-rhel8-latest-gcc-compile
       - command: expansions.update
         params:
           updates:
@@ -4353,14 +4893,14 @@ tasks:
       - func: bootstrap-mongo-orchestration
       - func: run-simple-http-server
       - func: run-tests
-  - name: sasl-off-nossl-ubuntu2004-gcc-test-6.0-server-noauth
-    run_on: ubuntu2004-small
-    tags: [sasl-matrix-nossl, test, ubuntu2004, gcc, sasl-off, noauth, server, "6.0"]
-    depends_on: [{ name: sasl-off-nossl-ubuntu2004-gcc-compile }]
+  - name: sasl-off-nossl-rhel8-latest-gcc-test-6.0-server-noauth
+    run_on: rhel8-latest-large
+    tags: [sasl-matrix-nossl, test, rhel8-latest, gcc, sasl-off, noauth, server, "6.0"]
+    depends_on: [{ name: sasl-off-nossl-rhel8-latest-gcc-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: sasl-off-nossl-ubuntu2004-gcc-compile
+          BUILD_NAME: sasl-off-nossl-rhel8-latest-gcc-compile
       - command: expansions.update
         params:
           updates:
@@ -4374,14 +4914,14 @@ tasks:
       - func: bootstrap-mongo-orchestration
       - func: run-simple-http-server
       - func: run-tests
-  - name: sasl-off-nossl-ubuntu2004-gcc-test-6.0-sharded-noauth
-    run_on: ubuntu2004-small
-    tags: [sasl-matrix-nossl, test, ubuntu2004, gcc, sasl-off, noauth, sharded, "6.0"]
-    depends_on: [{ name: sasl-off-nossl-ubuntu2004-gcc-compile }]
+  - name: sasl-off-nossl-rhel8-latest-gcc-test-6.0-sharded-noauth
+    run_on: rhel8-latest-large
+    tags: [sasl-matrix-nossl, test, rhel8-latest, gcc, sasl-off, noauth, sharded, "6.0"]
+    depends_on: [{ name: sasl-off-nossl-rhel8-latest-gcc-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: sasl-off-nossl-ubuntu2004-gcc-compile
+          BUILD_NAME: sasl-off-nossl-rhel8-latest-gcc-compile
       - command: expansions.update
         params:
           updates:
@@ -4395,14 +4935,14 @@ tasks:
       - func: bootstrap-mongo-orchestration
       - func: run-simple-http-server
       - func: run-tests
-  - name: sasl-off-nossl-ubuntu2004-gcc-test-7.0-replica-noauth
-    run_on: ubuntu2004-small
-    tags: [sasl-matrix-nossl, test, ubuntu2004, gcc, sasl-off, noauth, replica, "7.0"]
-    depends_on: [{ name: sasl-off-nossl-ubuntu2004-gcc-compile }]
+  - name: sasl-off-nossl-rhel8-latest-gcc-test-7.0-replica-noauth
+    run_on: rhel8-latest-large
+    tags: [sasl-matrix-nossl, test, rhel8-latest, gcc, sasl-off, noauth, replica, "7.0"]
+    depends_on: [{ name: sasl-off-nossl-rhel8-latest-gcc-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: sasl-off-nossl-ubuntu2004-gcc-compile
+          BUILD_NAME: sasl-off-nossl-rhel8-latest-gcc-compile
       - command: expansions.update
         params:
           updates:
@@ -4416,14 +4956,14 @@ tasks:
       - func: bootstrap-mongo-orchestration
       - func: run-simple-http-server
       - func: run-tests
-  - name: sasl-off-nossl-ubuntu2004-gcc-test-7.0-server-noauth
-    run_on: ubuntu2004-small
-    tags: [sasl-matrix-nossl, test, ubuntu2004, gcc, sasl-off, noauth, server, "7.0"]
-    depends_on: [{ name: sasl-off-nossl-ubuntu2004-gcc-compile }]
+  - name: sasl-off-nossl-rhel8-latest-gcc-test-7.0-server-noauth
+    run_on: rhel8-latest-large
+    tags: [sasl-matrix-nossl, test, rhel8-latest, gcc, sasl-off, noauth, server, "7.0"]
+    depends_on: [{ name: sasl-off-nossl-rhel8-latest-gcc-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: sasl-off-nossl-ubuntu2004-gcc-compile
+          BUILD_NAME: sasl-off-nossl-rhel8-latest-gcc-compile
       - command: expansions.update
         params:
           updates:
@@ -4437,14 +4977,14 @@ tasks:
       - func: bootstrap-mongo-orchestration
       - func: run-simple-http-server
       - func: run-tests
-  - name: sasl-off-nossl-ubuntu2004-gcc-test-7.0-sharded-noauth
-    run_on: ubuntu2004-small
-    tags: [sasl-matrix-nossl, test, ubuntu2004, gcc, sasl-off, noauth, sharded, "7.0"]
-    depends_on: [{ name: sasl-off-nossl-ubuntu2004-gcc-compile }]
+  - name: sasl-off-nossl-rhel8-latest-gcc-test-7.0-sharded-noauth
+    run_on: rhel8-latest-large
+    tags: [sasl-matrix-nossl, test, rhel8-latest, gcc, sasl-off, noauth, sharded, "7.0"]
+    depends_on: [{ name: sasl-off-nossl-rhel8-latest-gcc-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: sasl-off-nossl-ubuntu2004-gcc-compile
+          BUILD_NAME: sasl-off-nossl-rhel8-latest-gcc-compile
       - command: expansions.update
         params:
           updates:
@@ -4458,14 +4998,14 @@ tasks:
       - func: bootstrap-mongo-orchestration
       - func: run-simple-http-server
       - func: run-tests
-  - name: sasl-off-nossl-ubuntu2004-gcc-test-8.0-replica-noauth
-    run_on: ubuntu2004-small
-    tags: [sasl-matrix-nossl, test, ubuntu2004, gcc, sasl-off, noauth, replica, "8.0"]
-    depends_on: [{ name: sasl-off-nossl-ubuntu2004-gcc-compile }]
+  - name: sasl-off-nossl-rhel8-latest-gcc-test-8.0-replica-noauth
+    run_on: rhel8-latest-large
+    tags: [sasl-matrix-nossl, test, rhel8-latest, gcc, sasl-off, noauth, replica, "8.0"]
+    depends_on: [{ name: sasl-off-nossl-rhel8-latest-gcc-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: sasl-off-nossl-ubuntu2004-gcc-compile
+          BUILD_NAME: sasl-off-nossl-rhel8-latest-gcc-compile
       - command: expansions.update
         params:
           updates:
@@ -4479,14 +5019,14 @@ tasks:
       - func: bootstrap-mongo-orchestration
       - func: run-simple-http-server
       - func: run-tests
-  - name: sasl-off-nossl-ubuntu2004-gcc-test-8.0-server-noauth
-    run_on: ubuntu2004-small
-    tags: [sasl-matrix-nossl, test, ubuntu2004, gcc, sasl-off, noauth, server, "8.0"]
-    depends_on: [{ name: sasl-off-nossl-ubuntu2004-gcc-compile }]
+  - name: sasl-off-nossl-rhel8-latest-gcc-test-8.0-server-noauth
+    run_on: rhel8-latest-large
+    tags: [sasl-matrix-nossl, test, rhel8-latest, gcc, sasl-off, noauth, server, "8.0"]
+    depends_on: [{ name: sasl-off-nossl-rhel8-latest-gcc-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: sasl-off-nossl-ubuntu2004-gcc-compile
+          BUILD_NAME: sasl-off-nossl-rhel8-latest-gcc-compile
       - command: expansions.update
         params:
           updates:
@@ -4500,14 +5040,14 @@ tasks:
       - func: bootstrap-mongo-orchestration
       - func: run-simple-http-server
       - func: run-tests
-  - name: sasl-off-nossl-ubuntu2004-gcc-test-8.0-sharded-noauth
-    run_on: ubuntu2004-small
-    tags: [sasl-matrix-nossl, test, ubuntu2004, gcc, sasl-off, noauth, sharded, "8.0"]
-    depends_on: [{ name: sasl-off-nossl-ubuntu2004-gcc-compile }]
+  - name: sasl-off-nossl-rhel8-latest-gcc-test-8.0-sharded-noauth
+    run_on: rhel8-latest-large
+    tags: [sasl-matrix-nossl, test, rhel8-latest, gcc, sasl-off, noauth, sharded, "8.0"]
+    depends_on: [{ name: sasl-off-nossl-rhel8-latest-gcc-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: sasl-off-nossl-ubuntu2004-gcc-compile
+          BUILD_NAME: sasl-off-nossl-rhel8-latest-gcc-compile
       - command: expansions.update
         params:
           updates:
@@ -4521,14 +5061,14 @@ tasks:
       - func: bootstrap-mongo-orchestration
       - func: run-simple-http-server
       - func: run-tests
-  - name: sasl-off-nossl-ubuntu2004-gcc-test-latest-replica-noauth
-    run_on: ubuntu2004-small
-    tags: [sasl-matrix-nossl, test, ubuntu2004, gcc, sasl-off, noauth, replica, latest]
-    depends_on: [{ name: sasl-off-nossl-ubuntu2004-gcc-compile }]
+  - name: sasl-off-nossl-rhel8-latest-gcc-test-latest-replica-noauth
+    run_on: rhel8-latest-large
+    tags: [sasl-matrix-nossl, test, rhel8-latest, gcc, sasl-off, noauth, replica, latest]
+    depends_on: [{ name: sasl-off-nossl-rhel8-latest-gcc-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: sasl-off-nossl-ubuntu2004-gcc-compile
+          BUILD_NAME: sasl-off-nossl-rhel8-latest-gcc-compile
       - command: expansions.update
         params:
           updates:
@@ -4542,14 +5082,14 @@ tasks:
       - func: bootstrap-mongo-orchestration
       - func: run-simple-http-server
       - func: run-tests
-  - name: sasl-off-nossl-ubuntu2004-gcc-test-latest-server-noauth
-    run_on: ubuntu2004-small
-    tags: [sasl-matrix-nossl, test, ubuntu2004, gcc, sasl-off, noauth, server, latest]
-    depends_on: [{ name: sasl-off-nossl-ubuntu2004-gcc-compile }]
+  - name: sasl-off-nossl-rhel8-latest-gcc-test-latest-server-noauth
+    run_on: rhel8-latest-large
+    tags: [sasl-matrix-nossl, test, rhel8-latest, gcc, sasl-off, noauth, server, latest]
+    depends_on: [{ name: sasl-off-nossl-rhel8-latest-gcc-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: sasl-off-nossl-ubuntu2004-gcc-compile
+          BUILD_NAME: sasl-off-nossl-rhel8-latest-gcc-compile
       - command: expansions.update
         params:
           updates:
@@ -4563,14 +5103,14 @@ tasks:
       - func: bootstrap-mongo-orchestration
       - func: run-simple-http-server
       - func: run-tests
-  - name: sasl-off-nossl-ubuntu2004-gcc-test-latest-sharded-noauth
-    run_on: ubuntu2004-small
-    tags: [sasl-matrix-nossl, test, ubuntu2004, gcc, sasl-off, noauth, sharded, latest]
-    depends_on: [{ name: sasl-off-nossl-ubuntu2004-gcc-compile }]
+  - name: sasl-off-nossl-rhel8-latest-gcc-test-latest-sharded-noauth
+    run_on: rhel8-latest-large
+    tags: [sasl-matrix-nossl, test, rhel8-latest, gcc, sasl-off, noauth, sharded, latest]
+    depends_on: [{ name: sasl-off-nossl-rhel8-latest-gcc-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: sasl-off-nossl-ubuntu2004-gcc-compile
+          BUILD_NAME: sasl-off-nossl-rhel8-latest-gcc-compile
       - command: expansions.update
         params:
           updates:
@@ -4584,6 +5124,26 @@ tasks:
       - func: bootstrap-mongo-orchestration
       - func: run-simple-http-server
       - func: run-tests
+  - name: sasl-off-nossl-ubuntu2204-gcc-compile
+    run_on: ubuntu2204-large
+    tags: [sasl-matrix-nossl, compile, ubuntu2204, gcc, sasl-off]
+    commands:
+      - func: find-cmake-latest
+      - func: sasl-off-nossl-compile
+        vars:
+          CC: gcc
+          CXX: g++
+      - func: upload-build
+  - name: sasl-off-nossl-ubuntu2404-gcc-compile
+    run_on: ubuntu2404-large
+    tags: [sasl-matrix-nossl, compile, ubuntu2404, gcc, sasl-off]
+    commands:
+      - func: find-cmake-latest
+      - func: sasl-off-nossl-compile
+        vars:
+          CC: gcc
+          CXX: g++
+      - func: upload-build
   - name: sasl-off-nossl-windows-2019-vs2017-x64-compile
     run_on: windows-vsCurrent-large
     tags: [sasl-matrix-nossl, compile, windows-vsCurrent, vs2017x64, sasl-off]
@@ -4621,8 +5181,8 @@ tasks:
       - func: find-cmake-latest
       - func: sasl-sspi-winssl-compile
         vars:
-          CC: mingw
-          CXX: mingw
+          CC: gcc
+          CXX: g++
       - func: upload-build
   - name: sasl-sspi-winssl-windows-2019-mingw-test-8.0-server-auth
     run_on: windows-vsCurrent-small
@@ -4635,8 +5195,8 @@ tasks:
       - command: expansions.update
         params:
           updates:
-            - { key: CC, value: mingw }
-            - { key: CXX, value: mingw }
+            - { key: CC, value: gcc }
+            - { key: CXX, value: g++ }
             - { key: AUTH, value: auth }
             - { key: MONGODB_VERSION, value: "8.0" }
             - { key: TOPOLOGY, value: server }
@@ -4656,8 +5216,8 @@ tasks:
       - command: expansions.update
         params:
           updates:
-            - { key: CC, value: mingw }
-            - { key: CXX, value: mingw }
+            - { key: CC, value: gcc }
+            - { key: CXX, value: g++ }
             - { key: AUTH, value: auth }
             - { key: MONGODB_VERSION, value: latest }
             - { key: TOPOLOGY, value: server }
@@ -4676,27 +5236,6 @@ tasks:
           CMAKE_GENERATOR: Visual Studio 15 2017
           CMAKE_GENERATOR_PLATFORM: x64
       - func: upload-build
-  - name: sasl-sspi-winssl-windows-2019-vs2017-x64-test-4.0-server-auth
-    run_on: windows-vsCurrent-small
-    tags: [sasl-matrix-winssl, test, windows-vsCurrent, vs2017x64, sasl-sspi, auth, server, "4.0", winssl]
-    depends_on: [{ name: sasl-sspi-winssl-windows-2019-vs2017-x64-compile }]
-    commands:
-      - func: fetch-build
-        vars:
-          BUILD_NAME: sasl-sspi-winssl-windows-2019-vs2017-x64-compile
-      - command: expansions.update
-        params:
-          updates:
-            - { key: CMAKE_GENERATOR, value: Visual Studio 15 2017 }
-            - { key: CMAKE_GENERATOR_PLATFORM, value: x64 }
-            - { key: AUTH, value: auth }
-            - { key: MONGODB_VERSION, value: "4.0" }
-            - { key: TOPOLOGY, value: server }
-            - { key: SSL, value: winssl }
-      - func: fetch-det
-      - func: bootstrap-mongo-orchestration
-      - func: run-simple-http-server
-      - func: run-tests
   - name: sasl-sspi-winssl-windows-2019-vs2017-x64-test-4.2-server-auth
     run_on: windows-vsCurrent-small
     tags: [sasl-matrix-winssl, test, windows-vsCurrent, vs2017x64, sasl-sspi, auth, server, "4.2", winssl]
@@ -4932,16 +5471,6 @@ tasks:
           CXX: clang++
           MARCH: i686
       - func: upload scan artifacts
-  - name: std-c11-debian10-gcc-compile
-    run_on: debian10-large
-    tags: [std-matrix, debian10, gcc, compile, std-c11]
-    commands:
-      - func: find-cmake-latest
-      - func: std-compile
-        vars:
-          CC: gcc-8
-          CXX: g++-8
-          C_STD_VERSION: 11
   - name: std-c11-debian11-gcc-compile
     run_on: debian11-large
     tags: [std-matrix, debian11, gcc, compile, std-c11]
@@ -4952,9 +5481,9 @@ tasks:
           CC: gcc-10
           CXX: g++-10
           C_STD_VERSION: 11
-  - name: std-c11-rhel76-gcc-compile
-    run_on: rhel76-large
-    tags: [std-matrix, rhel76, gcc, compile, std-c11]
+  - name: std-c11-rhel7-latest-gcc-compile
+    run_on: rhel7-latest-large
+    tags: [std-matrix, rhel7-latest, gcc, compile, std-c11]
     commands:
       - func: find-cmake-latest
       - func: std-compile
@@ -5132,6 +5661,26 @@ tasks:
           CC: clang-12
           CXX: clang++-12
           C_STD_VERSION: 11
+  - name: std-c11-ubuntu2404-gcc-compile
+    run_on: ubuntu2404-large
+    tags: [std-matrix, ubuntu2404, gcc, compile, std-c11]
+    commands:
+      - func: find-cmake-latest
+      - func: std-compile
+        vars:
+          CC: gcc-13
+          CXX: g++-13
+          C_STD_VERSION: 11
+  - name: std-c11-windows-2019-vs2015-x64-compile
+    run_on: windows-vsCurrent-large
+    tags: [std-matrix, windows-vsCurrent, vs2015x64, compile, std-c11]
+    commands:
+      - func: find-cmake-latest
+      - func: std-compile
+        vars:
+          CMAKE_GENERATOR: Visual Studio 14 2015
+          CMAKE_GENERATOR_PLATFORM: x64
+          C_STD_VERSION: 11
   - name: std-c11-windows-2019-vs2017-x64-compile
     run_on: windows-vsCurrent-large
     tags: [std-matrix, windows-vsCurrent, vs2017x64, compile, std-c11]
@@ -5162,16 +5711,6 @@ tasks:
           CMAKE_GENERATOR: Visual Studio 17 2022
           CMAKE_GENERATOR_PLATFORM: x64
           C_STD_VERSION: 11
-  - name: std-c17-debian10-gcc-compile
-    run_on: debian10-large
-    tags: [std-matrix, debian10, gcc, compile, std-c17]
-    commands:
-      - func: find-cmake-latest
-      - func: std-compile
-        vars:
-          CC: gcc-8
-          CXX: g++-8
-          C_STD_VERSION: 17
   - name: std-c17-debian11-gcc-compile
     run_on: debian11-large
     tags: [std-matrix, debian11, gcc, compile, std-c17]
@@ -5352,15 +5891,15 @@ tasks:
           CC: clang-12
           CXX: clang++-12
           C_STD_VERSION: 17
-  - name: std-c17-windows-2019-vs2017-x64-compile
-    run_on: windows-vsCurrent-large
-    tags: [std-matrix, windows-vsCurrent, vs2017x64, compile, std-c17]
+  - name: std-c17-ubuntu2404-gcc-compile
+    run_on: ubuntu2404-large
+    tags: [std-matrix, ubuntu2404, gcc, compile, std-c17]
     commands:
       - func: find-cmake-latest
       - func: std-compile
         vars:
-          CMAKE_GENERATOR: Visual Studio 15 2017
-          CMAKE_GENERATOR_PLATFORM: x64
+          CC: gcc-13
+          CXX: g++-13
           C_STD_VERSION: 17
   - name: std-c17-windows-2019-vs2019-x64-compile
     run_on: windows-vsCurrent-large
@@ -5532,16 +6071,16 @@ tasks:
           CC: clang-12
           CXX: clang++-12
           C_STD_VERSION: 23
-  - name: std-c99-debian10-gcc-compile
-    run_on: debian10-large
-    tags: [std-matrix, debian10, gcc, compile, std-c99]
+  - name: std-c23-ubuntu2404-gcc-compile
+    run_on: ubuntu2404-large
+    tags: [std-matrix, ubuntu2404, gcc, compile, std-c23]
     commands:
       - func: find-cmake-latest
       - func: std-compile
         vars:
-          CC: gcc-8
-          CXX: g++-8
-          C_STD_VERSION: 99
+          CC: gcc-13
+          CXX: g++-13
+          C_STD_VERSION: 23
   - name: std-c99-debian11-gcc-compile
     run_on: debian11-large
     tags: [std-matrix, debian11, gcc, compile, std-c99]
@@ -5552,9 +6091,9 @@ tasks:
           CC: gcc-10
           CXX: g++-10
           C_STD_VERSION: 99
-  - name: std-c99-rhel76-gcc-compile
-    run_on: rhel76-large
-    tags: [std-matrix, rhel76, gcc, compile, std-c99]
+  - name: std-c99-rhel7-latest-gcc-compile
+    run_on: rhel7-latest-large
+    tags: [std-matrix, rhel7-latest, gcc, compile, std-c99]
     commands:
       - func: find-cmake-latest
       - func: std-compile
@@ -5732,69 +6271,59 @@ tasks:
           CC: clang-12
           CXX: clang++-12
           C_STD_VERSION: 99
-  - name: std-c99-windows-2019-vs2017-x64-compile
-    run_on: windows-vsCurrent-large
-    tags: [std-matrix, windows-vsCurrent, vs2017x64, compile, std-c99]
+  - name: std-c99-ubuntu2404-gcc-compile
+    run_on: ubuntu2404-large
+    tags: [std-matrix, ubuntu2404, gcc, compile, std-c99]
     commands:
       - func: find-cmake-latest
       - func: std-compile
         vars:
-          CMAKE_GENERATOR: Visual Studio 15 2017
-          CMAKE_GENERATOR_PLATFORM: x64
+          CC: gcc-13
+          CXX: g++-13
           C_STD_VERSION: 99
-  - name: std-c99-windows-2019-vs2019-x64-compile
+  - name: std-c99-windows-2019-vs2015-x64-compile
     run_on: windows-vsCurrent-large
-    tags: [std-matrix, windows-vsCurrent, vs2019x64, compile, std-c99]
+    tags: [std-matrix, windows-vsCurrent, vs2015x64, compile, std-c99]
     commands:
       - func: find-cmake-latest
       - func: std-compile
         vars:
-          CMAKE_GENERATOR: Visual Studio 16 2019
+          CMAKE_GENERATOR: Visual Studio 14 2015
           CMAKE_GENERATOR_PLATFORM: x64
           C_STD_VERSION: 99
-  - name: std-c99-windows-2019-vs2022-x64-compile
-    run_on: windows-vsCurrent-large
-    tags: [std-matrix, windows-vsCurrent, vs2022x64, compile, std-c99]
-    commands:
-      - func: find-cmake-latest
-      - func: std-compile
-        vars:
-          CMAKE_GENERATOR: Visual Studio 17 2022
-          CMAKE_GENERATOR_PLATFORM: x64
-          C_STD_VERSION: 99
-  - name: std-clatest-windows-2019-vs2017-x64-compile
+  - name: std-c99-windows-2019-vs2017-x64-compile
     run_on: windows-vsCurrent-large
-    tags: [std-matrix, windows-vsCurrent, vs2017x64, compile, std-clatest]
+    tags: [std-matrix, windows-vsCurrent, vs2017x64, compile, std-c99]
     commands:
       - func: find-cmake-latest
       - func: std-compile
         vars:
           CMAKE_GENERATOR: Visual Studio 15 2017
           CMAKE_GENERATOR_PLATFORM: x64
-          C_STD_VERSION: latest
-  - name: std-clatest-windows-2019-vs2019-x64-compile
+          C_STD_VERSION: 99
+  - name: std-c99-windows-2019-vs2019-x64-compile
     run_on: windows-vsCurrent-large
-    tags: [std-matrix, windows-vsCurrent, vs2019x64, compile, std-clatest]
+    tags: [std-matrix, windows-vsCurrent, vs2019x64, compile, std-c99]
     commands:
       - func: find-cmake-latest
       - func: std-compile
         vars:
           CMAKE_GENERATOR: Visual Studio 16 2019
           CMAKE_GENERATOR_PLATFORM: x64
-          C_STD_VERSION: latest
-  - name: std-clatest-windows-2019-vs2022-x64-compile
+          C_STD_VERSION: 99
+  - name: std-c99-windows-2019-vs2022-x64-compile
     run_on: windows-vsCurrent-large
-    tags: [std-matrix, windows-vsCurrent, vs2022x64, compile, std-clatest]
+    tags: [std-matrix, windows-vsCurrent, vs2022x64, compile, std-c99]
     commands:
       - func: find-cmake-latest
       - func: std-compile
         vars:
           CMAKE_GENERATOR: Visual Studio 17 2022
           CMAKE_GENERATOR_PLATFORM: x64
-          C_STD_VERSION: latest
-  - name: tsan-sasl-cyrus-openssl-debian10-clang-compile
-    run_on: debian10-large
-    tags: [sanitizers-matrix-tsan, compile, debian10, clang, tsan, sasl-cyrus]
+          C_STD_VERSION: 99
+  - name: tsan-sasl-cyrus-openssl-rhel8-latest-clang-compile
+    run_on: rhel8-latest-large
+    tags: [sanitizers-matrix-tsan, compile, rhel8-latest, clang, tsan, sasl-cyrus]
     commands:
       - func: find-cmake-latest
       - func: sasl-cyrus-openssl-compile
@@ -5802,14 +6331,14 @@ tasks:
           CC: clang
           CXX: clang++
       - func: upload-build
-  - name: tsan-sasl-cyrus-openssl-debian10-clang-test-4.2-replica-auth
-    run_on: debian10-small
-    tags: [sanitizers-matrix-tsan, test, debian10, clang, sasl-cyrus, tsan, auth, replica, "4.2", openssl]
-    depends_on: [{ name: tsan-sasl-cyrus-openssl-debian10-clang-compile }]
+  - name: tsan-sasl-cyrus-openssl-rhel8-latest-clang-test-4.2-replica-auth
+    run_on: rhel8-latest-large
+    tags: [sanitizers-matrix-tsan, test, rhel8-latest, clang, sasl-cyrus, tsan, auth, replica, "4.2", openssl]
+    depends_on: [{ name: tsan-sasl-cyrus-openssl-rhel8-latest-clang-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: tsan-sasl-cyrus-openssl-debian10-clang-compile
+          BUILD_NAME: tsan-sasl-cyrus-openssl-rhel8-latest-clang-compile
       - command: expansions.update
         params:
           updates:
@@ -5823,14 +6352,14 @@ tasks:
       - func: bootstrap-mongo-orchestration
       - func: run-simple-http-server
       - func: run-tests
-  - name: tsan-sasl-cyrus-openssl-debian10-clang-test-4.2-server-auth
-    run_on: debian10-small
-    tags: [sanitizers-matrix-tsan, test, debian10, clang, sasl-cyrus, tsan, auth, server, "4.2", openssl]
-    depends_on: [{ name: tsan-sasl-cyrus-openssl-debian10-clang-compile }]
+  - name: tsan-sasl-cyrus-openssl-rhel8-latest-clang-test-4.2-server-auth
+    run_on: rhel8-latest-large
+    tags: [sanitizers-matrix-tsan, test, rhel8-latest, clang, sasl-cyrus, tsan, auth, server, "4.2", openssl]
+    depends_on: [{ name: tsan-sasl-cyrus-openssl-rhel8-latest-clang-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: tsan-sasl-cyrus-openssl-debian10-clang-compile
+          BUILD_NAME: tsan-sasl-cyrus-openssl-rhel8-latest-clang-compile
       - command: expansions.update
         params:
           updates:
@@ -5844,14 +6373,14 @@ tasks:
       - func: bootstrap-mongo-orchestration
       - func: run-simple-http-server
       - func: run-tests
-  - name: tsan-sasl-cyrus-openssl-debian10-clang-test-4.2-sharded-auth
-    run_on: debian10-small
-    tags: [sanitizers-matrix-tsan, test, debian10, clang, sasl-cyrus, tsan, auth, sharded, "4.2", openssl]
-    depends_on: [{ name: tsan-sasl-cyrus-openssl-debian10-clang-compile }]
+  - name: tsan-sasl-cyrus-openssl-rhel8-latest-clang-test-4.2-sharded-auth
+    run_on: rhel8-latest-large
+    tags: [sanitizers-matrix-tsan, test, rhel8-latest, clang, sasl-cyrus, tsan, auth, sharded, "4.2", openssl]
+    depends_on: [{ name: tsan-sasl-cyrus-openssl-rhel8-latest-clang-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: tsan-sasl-cyrus-openssl-debian10-clang-compile
+          BUILD_NAME: tsan-sasl-cyrus-openssl-rhel8-latest-clang-compile
       - command: expansions.update
         params:
           updates:
@@ -5865,24 +6394,14 @@ tasks:
       - func: bootstrap-mongo-orchestration
       - func: run-simple-http-server
       - func: run-tests
-  - name: tsan-sasl-cyrus-openssl-ubuntu2004-clang-compile
-    run_on: ubuntu2004-large
-    tags: [sanitizers-matrix-tsan, compile, ubuntu2004, clang, tsan, sasl-cyrus]
-    commands:
-      - func: find-cmake-latest
-      - func: sasl-cyrus-openssl-compile
-        vars:
-          CC: clang
-          CXX: clang++
-      - func: upload-build
-  - name: tsan-sasl-cyrus-openssl-ubuntu2004-clang-test-4.4-replica-auth
-    run_on: ubuntu2004-small
-    tags: [sanitizers-matrix-tsan, test, ubuntu2004, clang, sasl-cyrus, tsan, auth, replica, "4.4", openssl]
-    depends_on: [{ name: tsan-sasl-cyrus-openssl-ubuntu2004-clang-compile }]
+  - name: tsan-sasl-cyrus-openssl-rhel8-latest-clang-test-4.4-replica-auth
+    run_on: rhel8-latest-large
+    tags: [sanitizers-matrix-tsan, test, rhel8-latest, clang, sasl-cyrus, tsan, auth, replica, "4.4", openssl]
+    depends_on: [{ name: tsan-sasl-cyrus-openssl-rhel8-latest-clang-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: tsan-sasl-cyrus-openssl-ubuntu2004-clang-compile
+          BUILD_NAME: tsan-sasl-cyrus-openssl-rhel8-latest-clang-compile
       - command: expansions.update
         params:
           updates:
@@ -5896,14 +6415,14 @@ tasks:
       - func: bootstrap-mongo-orchestration
       - func: run-simple-http-server
       - func: run-tests
-  - name: tsan-sasl-cyrus-openssl-ubuntu2004-clang-test-4.4-server-auth
-    run_on: ubuntu2004-small
-    tags: [sanitizers-matrix-tsan, test, ubuntu2004, clang, sasl-cyrus, tsan, auth, server, "4.4", openssl]
-    depends_on: [{ name: tsan-sasl-cyrus-openssl-ubuntu2004-clang-compile }]
+  - name: tsan-sasl-cyrus-openssl-rhel8-latest-clang-test-4.4-server-auth
+    run_on: rhel8-latest-large
+    tags: [sanitizers-matrix-tsan, test, rhel8-latest, clang, sasl-cyrus, tsan, auth, server, "4.4", openssl]
+    depends_on: [{ name: tsan-sasl-cyrus-openssl-rhel8-latest-clang-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: tsan-sasl-cyrus-openssl-ubuntu2004-clang-compile
+          BUILD_NAME: tsan-sasl-cyrus-openssl-rhel8-latest-clang-compile
       - command: expansions.update
         params:
           updates:
@@ -5917,14 +6436,14 @@ tasks:
       - func: bootstrap-mongo-orchestration
       - func: run-simple-http-server
       - func: run-tests
-  - name: tsan-sasl-cyrus-openssl-ubuntu2004-clang-test-4.4-sharded-auth
-    run_on: ubuntu2004-small
-    tags: [sanitizers-matrix-tsan, test, ubuntu2004, clang, sasl-cyrus, tsan, auth, sharded, "4.4", openssl]
-    depends_on: [{ name: tsan-sasl-cyrus-openssl-ubuntu2004-clang-compile }]
+  - name: tsan-sasl-cyrus-openssl-rhel8-latest-clang-test-4.4-sharded-auth
+    run_on: rhel8-latest-large
+    tags: [sanitizers-matrix-tsan, test, rhel8-latest, clang, sasl-cyrus, tsan, auth, sharded, "4.4", openssl]
+    depends_on: [{ name: tsan-sasl-cyrus-openssl-rhel8-latest-clang-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: tsan-sasl-cyrus-openssl-ubuntu2004-clang-compile
+          BUILD_NAME: tsan-sasl-cyrus-openssl-rhel8-latest-clang-compile
       - command: expansions.update
         params:
           updates:
@@ -5938,14 +6457,14 @@ tasks:
       - func: bootstrap-mongo-orchestration
       - func: run-simple-http-server
       - func: run-tests
-  - name: tsan-sasl-cyrus-openssl-ubuntu2004-clang-test-5.0-replica-auth
-    run_on: ubuntu2004-small
-    tags: [sanitizers-matrix-tsan, test, ubuntu2004, clang, sasl-cyrus, tsan, auth, replica, "5.0", openssl]
-    depends_on: [{ name: tsan-sasl-cyrus-openssl-ubuntu2004-clang-compile }]
+  - name: tsan-sasl-cyrus-openssl-rhel8-latest-clang-test-5.0-replica-auth
+    run_on: rhel8-latest-large
+    tags: [sanitizers-matrix-tsan, test, rhel8-latest, clang, sasl-cyrus, tsan, auth, replica, "5.0", openssl]
+    depends_on: [{ name: tsan-sasl-cyrus-openssl-rhel8-latest-clang-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: tsan-sasl-cyrus-openssl-ubuntu2004-clang-compile
+          BUILD_NAME: tsan-sasl-cyrus-openssl-rhel8-latest-clang-compile
       - command: expansions.update
         params:
           updates:
@@ -5959,14 +6478,14 @@ tasks:
       - func: bootstrap-mongo-orchestration
       - func: run-simple-http-server
       - func: run-tests
-  - name: tsan-sasl-cyrus-openssl-ubuntu2004-clang-test-5.0-server-auth
-    run_on: ubuntu2004-small
-    tags: [sanitizers-matrix-tsan, test, ubuntu2004, clang, sasl-cyrus, tsan, auth, server, "5.0", openssl]
-    depends_on: [{ name: tsan-sasl-cyrus-openssl-ubuntu2004-clang-compile }]
+  - name: tsan-sasl-cyrus-openssl-rhel8-latest-clang-test-5.0-server-auth
+    run_on: rhel8-latest-large
+    tags: [sanitizers-matrix-tsan, test, rhel8-latest, clang, sasl-cyrus, tsan, auth, server, "5.0", openssl]
+    depends_on: [{ name: tsan-sasl-cyrus-openssl-rhel8-latest-clang-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: tsan-sasl-cyrus-openssl-ubuntu2004-clang-compile
+          BUILD_NAME: tsan-sasl-cyrus-openssl-rhel8-latest-clang-compile
       - command: expansions.update
         params:
           updates:
@@ -5980,14 +6499,14 @@ tasks:
       - func: bootstrap-mongo-orchestration
       - func: run-simple-http-server
       - func: run-tests
-  - name: tsan-sasl-cyrus-openssl-ubuntu2004-clang-test-5.0-sharded-auth
-    run_on: ubuntu2004-small
-    tags: [sanitizers-matrix-tsan, test, ubuntu2004, clang, sasl-cyrus, tsan, auth, sharded, "5.0", openssl]
-    depends_on: [{ name: tsan-sasl-cyrus-openssl-ubuntu2004-clang-compile }]
+  - name: tsan-sasl-cyrus-openssl-rhel8-latest-clang-test-5.0-sharded-auth
+    run_on: rhel8-latest-large
+    tags: [sanitizers-matrix-tsan, test, rhel8-latest, clang, sasl-cyrus, tsan, auth, sharded, "5.0", openssl]
+    depends_on: [{ name: tsan-sasl-cyrus-openssl-rhel8-latest-clang-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: tsan-sasl-cyrus-openssl-ubuntu2004-clang-compile
+          BUILD_NAME: tsan-sasl-cyrus-openssl-rhel8-latest-clang-compile
       - command: expansions.update
         params:
           updates:
@@ -6001,14 +6520,14 @@ tasks:
       - func: bootstrap-mongo-orchestration
       - func: run-simple-http-server
       - func: run-tests
-  - name: tsan-sasl-cyrus-openssl-ubuntu2004-clang-test-6.0-replica-auth
-    run_on: ubuntu2004-small
-    tags: [sanitizers-matrix-tsan, test, ubuntu2004, clang, sasl-cyrus, tsan, auth, replica, "6.0", openssl]
-    depends_on: [{ name: tsan-sasl-cyrus-openssl-ubuntu2004-clang-compile }]
+  - name: tsan-sasl-cyrus-openssl-rhel8-latest-clang-test-6.0-replica-auth
+    run_on: rhel8-latest-large
+    tags: [sanitizers-matrix-tsan, test, rhel8-latest, clang, sasl-cyrus, tsan, auth, replica, "6.0", openssl]
+    depends_on: [{ name: tsan-sasl-cyrus-openssl-rhel8-latest-clang-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: tsan-sasl-cyrus-openssl-ubuntu2004-clang-compile
+          BUILD_NAME: tsan-sasl-cyrus-openssl-rhel8-latest-clang-compile
       - command: expansions.update
         params:
           updates:
@@ -6022,14 +6541,14 @@ tasks:
       - func: bootstrap-mongo-orchestration
       - func: run-simple-http-server
       - func: run-tests
-  - name: tsan-sasl-cyrus-openssl-ubuntu2004-clang-test-6.0-server-auth
-    run_on: ubuntu2004-small
-    tags: [sanitizers-matrix-tsan, test, ubuntu2004, clang, sasl-cyrus, tsan, auth, server, "6.0", openssl]
-    depends_on: [{ name: tsan-sasl-cyrus-openssl-ubuntu2004-clang-compile }]
+  - name: tsan-sasl-cyrus-openssl-rhel8-latest-clang-test-6.0-server-auth
+    run_on: rhel8-latest-large
+    tags: [sanitizers-matrix-tsan, test, rhel8-latest, clang, sasl-cyrus, tsan, auth, server, "6.0", openssl]
+    depends_on: [{ name: tsan-sasl-cyrus-openssl-rhel8-latest-clang-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: tsan-sasl-cyrus-openssl-ubuntu2004-clang-compile
+          BUILD_NAME: tsan-sasl-cyrus-openssl-rhel8-latest-clang-compile
       - command: expansions.update
         params:
           updates:
@@ -6043,14 +6562,14 @@ tasks:
       - func: bootstrap-mongo-orchestration
       - func: run-simple-http-server
       - func: run-tests
-  - name: tsan-sasl-cyrus-openssl-ubuntu2004-clang-test-6.0-sharded-auth
-    run_on: ubuntu2004-small
-    tags: [sanitizers-matrix-tsan, test, ubuntu2004, clang, sasl-cyrus, tsan, auth, sharded, "6.0", openssl]
-    depends_on: [{ name: tsan-sasl-cyrus-openssl-ubuntu2004-clang-compile }]
+  - name: tsan-sasl-cyrus-openssl-rhel8-latest-clang-test-6.0-sharded-auth
+    run_on: rhel8-latest-large
+    tags: [sanitizers-matrix-tsan, test, rhel8-latest, clang, sasl-cyrus, tsan, auth, sharded, "6.0", openssl]
+    depends_on: [{ name: tsan-sasl-cyrus-openssl-rhel8-latest-clang-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: tsan-sasl-cyrus-openssl-ubuntu2004-clang-compile
+          BUILD_NAME: tsan-sasl-cyrus-openssl-rhel8-latest-clang-compile
       - command: expansions.update
         params:
           updates:
@@ -6064,14 +6583,14 @@ tasks:
       - func: bootstrap-mongo-orchestration
       - func: run-simple-http-server
       - func: run-tests
-  - name: tsan-sasl-cyrus-openssl-ubuntu2004-clang-test-7.0-replica-auth
-    run_on: ubuntu2004-small
-    tags: [sanitizers-matrix-tsan, test, ubuntu2004, clang, sasl-cyrus, tsan, auth, replica, "7.0", openssl]
-    depends_on: [{ name: tsan-sasl-cyrus-openssl-ubuntu2004-clang-compile }]
+  - name: tsan-sasl-cyrus-openssl-rhel8-latest-clang-test-7.0-replica-auth
+    run_on: rhel8-latest-large
+    tags: [sanitizers-matrix-tsan, test, rhel8-latest, clang, sasl-cyrus, tsan, auth, replica, "7.0", openssl]
+    depends_on: [{ name: tsan-sasl-cyrus-openssl-rhel8-latest-clang-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: tsan-sasl-cyrus-openssl-ubuntu2004-clang-compile
+          BUILD_NAME: tsan-sasl-cyrus-openssl-rhel8-latest-clang-compile
       - command: expansions.update
         params:
           updates:
@@ -6085,14 +6604,14 @@ tasks:
       - func: bootstrap-mongo-orchestration
       - func: run-simple-http-server
       - func: run-tests
-  - name: tsan-sasl-cyrus-openssl-ubuntu2004-clang-test-7.0-server-auth
-    run_on: ubuntu2004-small
-    tags: [sanitizers-matrix-tsan, test, ubuntu2004, clang, sasl-cyrus, tsan, auth, server, "7.0", openssl]
-    depends_on: [{ name: tsan-sasl-cyrus-openssl-ubuntu2004-clang-compile }]
+  - name: tsan-sasl-cyrus-openssl-rhel8-latest-clang-test-7.0-server-auth
+    run_on: rhel8-latest-large
+    tags: [sanitizers-matrix-tsan, test, rhel8-latest, clang, sasl-cyrus, tsan, auth, server, "7.0", openssl]
+    depends_on: [{ name: tsan-sasl-cyrus-openssl-rhel8-latest-clang-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: tsan-sasl-cyrus-openssl-ubuntu2004-clang-compile
+          BUILD_NAME: tsan-sasl-cyrus-openssl-rhel8-latest-clang-compile
       - command: expansions.update
         params:
           updates:
@@ -6106,14 +6625,14 @@ tasks:
       - func: bootstrap-mongo-orchestration
       - func: run-simple-http-server
       - func: run-tests
-  - name: tsan-sasl-cyrus-openssl-ubuntu2004-clang-test-7.0-sharded-auth
-    run_on: ubuntu2004-small
-    tags: [sanitizers-matrix-tsan, test, ubuntu2004, clang, sasl-cyrus, tsan, auth, sharded, "7.0", openssl]
-    depends_on: [{ name: tsan-sasl-cyrus-openssl-ubuntu2004-clang-compile }]
+  - name: tsan-sasl-cyrus-openssl-rhel8-latest-clang-test-7.0-sharded-auth
+    run_on: rhel8-latest-large
+    tags: [sanitizers-matrix-tsan, test, rhel8-latest, clang, sasl-cyrus, tsan, auth, sharded, "7.0", openssl]
+    depends_on: [{ name: tsan-sasl-cyrus-openssl-rhel8-latest-clang-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: tsan-sasl-cyrus-openssl-ubuntu2004-clang-compile
+          BUILD_NAME: tsan-sasl-cyrus-openssl-rhel8-latest-clang-compile
       - command: expansions.update
         params:
           updates:
@@ -6127,14 +6646,14 @@ tasks:
       - func: bootstrap-mongo-orchestration
       - func: run-simple-http-server
       - func: run-tests
-  - name: tsan-sasl-cyrus-openssl-ubuntu2004-clang-test-8.0-replica-auth
-    run_on: ubuntu2004-small
-    tags: [sanitizers-matrix-tsan, test, ubuntu2004, clang, sasl-cyrus, tsan, auth, replica, "8.0", openssl]
-    depends_on: [{ name: tsan-sasl-cyrus-openssl-ubuntu2004-clang-compile }]
+  - name: tsan-sasl-cyrus-openssl-rhel8-latest-clang-test-8.0-replica-auth
+    run_on: rhel8-latest-large
+    tags: [sanitizers-matrix-tsan, test, rhel8-latest, clang, sasl-cyrus, tsan, auth, replica, "8.0", openssl]
+    depends_on: [{ name: tsan-sasl-cyrus-openssl-rhel8-latest-clang-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: tsan-sasl-cyrus-openssl-ubuntu2004-clang-compile
+          BUILD_NAME: tsan-sasl-cyrus-openssl-rhel8-latest-clang-compile
       - command: expansions.update
         params:
           updates:
@@ -6148,14 +6667,14 @@ tasks:
       - func: bootstrap-mongo-orchestration
       - func: run-simple-http-server
       - func: run-tests
-  - name: tsan-sasl-cyrus-openssl-ubuntu2004-clang-test-8.0-server-auth
-    run_on: ubuntu2004-small
-    tags: [sanitizers-matrix-tsan, test, ubuntu2004, clang, sasl-cyrus, tsan, auth, server, "8.0", openssl]
-    depends_on: [{ name: tsan-sasl-cyrus-openssl-ubuntu2004-clang-compile }]
+  - name: tsan-sasl-cyrus-openssl-rhel8-latest-clang-test-8.0-server-auth
+    run_on: rhel8-latest-large
+    tags: [sanitizers-matrix-tsan, test, rhel8-latest, clang, sasl-cyrus, tsan, auth, server, "8.0", openssl]
+    depends_on: [{ name: tsan-sasl-cyrus-openssl-rhel8-latest-clang-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: tsan-sasl-cyrus-openssl-ubuntu2004-clang-compile
+          BUILD_NAME: tsan-sasl-cyrus-openssl-rhel8-latest-clang-compile
       - command: expansions.update
         params:
           updates:
@@ -6169,14 +6688,14 @@ tasks:
       - func: bootstrap-mongo-orchestration
       - func: run-simple-http-server
       - func: run-tests
-  - name: tsan-sasl-cyrus-openssl-ubuntu2004-clang-test-8.0-sharded-auth
-    run_on: ubuntu2004-small
-    tags: [sanitizers-matrix-tsan, test, ubuntu2004, clang, sasl-cyrus, tsan, auth, sharded, "8.0", openssl]
-    depends_on: [{ name: tsan-sasl-cyrus-openssl-ubuntu2004-clang-compile }]
+  - name: tsan-sasl-cyrus-openssl-rhel8-latest-clang-test-8.0-sharded-auth
+    run_on: rhel8-latest-large
+    tags: [sanitizers-matrix-tsan, test, rhel8-latest, clang, sasl-cyrus, tsan, auth, sharded, "8.0", openssl]
+    depends_on: [{ name: tsan-sasl-cyrus-openssl-rhel8-latest-clang-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: tsan-sasl-cyrus-openssl-ubuntu2004-clang-compile
+          BUILD_NAME: tsan-sasl-cyrus-openssl-rhel8-latest-clang-compile
       - command: expansions.update
         params:
           updates:
@@ -6190,14 +6709,14 @@ tasks:
       - func: bootstrap-mongo-orchestration
       - func: run-simple-http-server
       - func: run-tests
-  - name: tsan-sasl-cyrus-openssl-ubuntu2004-clang-test-latest-replica-auth
-    run_on: ubuntu2004-small
-    tags: [sanitizers-matrix-tsan, test, ubuntu2004, clang, sasl-cyrus, tsan, auth, replica, latest, openssl]
-    depends_on: [{ name: tsan-sasl-cyrus-openssl-ubuntu2004-clang-compile }]
+  - name: tsan-sasl-cyrus-openssl-rhel8-latest-clang-test-latest-replica-auth
+    run_on: rhel8-latest-large
+    tags: [sanitizers-matrix-tsan, test, rhel8-latest, clang, sasl-cyrus, tsan, auth, replica, latest, openssl]
+    depends_on: [{ name: tsan-sasl-cyrus-openssl-rhel8-latest-clang-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: tsan-sasl-cyrus-openssl-ubuntu2004-clang-compile
+          BUILD_NAME: tsan-sasl-cyrus-openssl-rhel8-latest-clang-compile
       - command: expansions.update
         params:
           updates:
@@ -6211,14 +6730,14 @@ tasks:
       - func: bootstrap-mongo-orchestration
       - func: run-simple-http-server
       - func: run-tests
-  - name: tsan-sasl-cyrus-openssl-ubuntu2004-clang-test-latest-server-auth
-    run_on: ubuntu2004-small
-    tags: [sanitizers-matrix-tsan, test, ubuntu2004, clang, sasl-cyrus, tsan, auth, server, latest, openssl]
-    depends_on: [{ name: tsan-sasl-cyrus-openssl-ubuntu2004-clang-compile }]
+  - name: tsan-sasl-cyrus-openssl-rhel8-latest-clang-test-latest-server-auth
+    run_on: rhel8-latest-large
+    tags: [sanitizers-matrix-tsan, test, rhel8-latest, clang, sasl-cyrus, tsan, auth, server, latest, openssl]
+    depends_on: [{ name: tsan-sasl-cyrus-openssl-rhel8-latest-clang-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: tsan-sasl-cyrus-openssl-ubuntu2004-clang-compile
+          BUILD_NAME: tsan-sasl-cyrus-openssl-rhel8-latest-clang-compile
       - command: expansions.update
         params:
           updates:
@@ -6232,14 +6751,14 @@ tasks:
       - func: bootstrap-mongo-orchestration
       - func: run-simple-http-server
       - func: run-tests
-  - name: tsan-sasl-cyrus-openssl-ubuntu2004-clang-test-latest-sharded-auth
-    run_on: ubuntu2004-small
-    tags: [sanitizers-matrix-tsan, test, ubuntu2004, clang, sasl-cyrus, tsan, auth, sharded, latest, openssl]
-    depends_on: [{ name: tsan-sasl-cyrus-openssl-ubuntu2004-clang-compile }]
+  - name: tsan-sasl-cyrus-openssl-rhel8-latest-clang-test-latest-sharded-auth
+    run_on: rhel8-latest-large
+    tags: [sanitizers-matrix-tsan, test, rhel8-latest, clang, sasl-cyrus, tsan, auth, sharded, latest, openssl]
+    depends_on: [{ name: tsan-sasl-cyrus-openssl-rhel8-latest-clang-compile }]
     commands:
       - func: fetch-build
         vars:
-          BUILD_NAME: tsan-sasl-cyrus-openssl-ubuntu2004-clang-compile
+          BUILD_NAME: tsan-sasl-cyrus-openssl-rhel8-latest-clang-compile
       - command: expansions.update
         params:
           updates:
@@ -6253,3 +6772,24 @@ tasks:
       - func: bootstrap-mongo-orchestration
       - func: run-simple-http-server
       - func: run-tests
+  - name: verify-headers
+    run_on:
+      - amazon2
+      - debian11-large
+      - debian12-large
+      - ubuntu2204-large
+      - ubuntu2404-large
+    tags: [pr-merge-gate]
+    commands:
+      - func: docker-login-amazon-ecr
+      - command: subprocess.exec
+        type: test
+        params:
+          binary: ./tools/earthly.sh
+          working_dir: mongoc
+          include_expansions_in_env:
+            - DOCKER_CONFIG
+          args:
+            - --buildkit-image=901841024863.dkr.ecr.us-east-1.amazonaws.com/dockerhub/earthly/buildkitd:v0.8.3
+            - +verify-headers
+            - --default_search_registry=901841024863.dkr.ecr.us-east-1.amazonaws.com/dockerhub
diff -pruN 2.0.2-1/.evergreen/generated_configs/variants.yml 2.1.0-1/.evergreen/generated_configs/variants.yml
--- 2.0.2-1/.evergreen/generated_configs/variants.yml	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/.evergreen/generated_configs/variants.yml	2025-08-14 18:37:23.000000000 +0000
@@ -86,8 +86,7 @@ buildvariants:
   - name: clang-format
     display_name: clang-format
     run_on:
-      - ubuntu2204-large
-      - ubuntu2004-large
+      - ubuntu2204-small
     tasks:
       - name: .clang-format
   - name: cse-matrix-darwinssl
@@ -101,69 +100,82 @@ buildvariants:
     expansions:
       CLIENT_SIDE_ENCRYPTION: "on"
     tasks:
-      - name: cse-sasl-cyrus-openssl-debian92-clang-compile
-      - name: cse-sasl-cyrus-openssl-debian92-gcc-compile
-      - name: cse-sasl-cyrus-openssl-debian10-clang-compile
-      - name: cse-sasl-cyrus-openssl-debian10-gcc-compile
       - name: cse-sasl-cyrus-openssl-debian11-clang-compile
       - name: cse-sasl-cyrus-openssl-debian11-gcc-compile
-      - name: cse-sasl-cyrus-openssl-rhel80-gcc-compile
+      - name: cse-sasl-cyrus-openssl-debian12-clang-compile
+      - name: cse-sasl-cyrus-openssl-debian12-gcc-compile
+      - name: cse-sasl-cyrus-openssl-rhel8-latest-gcc-compile
+      - name: cse-sasl-cyrus-openssl-rhel8-latest-gcc-test-4.2-replica-auth
+      - name: cse-sasl-cyrus-openssl-rhel8-latest-gcc-test-4.2-server-auth
+      - name: cse-sasl-cyrus-openssl-rhel8-latest-gcc-test-4.4-replica-auth
+      - name: cse-sasl-cyrus-openssl-rhel8-latest-gcc-test-4.4-server-auth
+      - name: cse-sasl-cyrus-openssl-rhel8-latest-gcc-test-5.0-replica-auth
+      - name: cse-sasl-cyrus-openssl-rhel8-latest-gcc-test-5.0-server-auth
+      - name: cse-sasl-cyrus-openssl-rhel8-latest-gcc-test-6.0-replica-auth
+      - name: cse-sasl-cyrus-openssl-rhel8-latest-gcc-test-6.0-server-auth
+      - name: cse-sasl-cyrus-openssl-rhel8-latest-gcc-test-7.0-replica-auth
+      - name: cse-sasl-cyrus-openssl-rhel8-latest-gcc-test-7.0-server-auth
+      - name: cse-sasl-cyrus-openssl-rhel8-latest-gcc-test-8.0-replica-auth
+      - name: cse-sasl-cyrus-openssl-rhel8-latest-gcc-test-8.0-server-auth
+      - name: cse-sasl-cyrus-openssl-rhel8-latest-gcc-test-latest-replica-auth
+      - name: cse-sasl-cyrus-openssl-rhel8-latest-gcc-test-latest-server-auth
       - name: cse-sasl-cyrus-openssl-rhel8-zseries-gcc-compile
         batchtime: 1440
-      - name: cse-sasl-cyrus-openssl-ubuntu2004-clang-compile
-      - name: cse-sasl-cyrus-openssl-ubuntu2004-gcc-compile
-      - name: cse-sasl-cyrus-openssl-ubuntu2004-arm64-gcc-compile
-      - name: cse-sasl-cyrus-openssl-windows-2019-vs2017-x64-compile
-      - name: cse-sasl-cyrus-openssl-rhel8-zseries-gcc-test-5.0-server-auth
+      - name: cse-sasl-cyrus-openssl-rhel8-zseries-gcc-test-5.0-replica-auth
         batchtime: 1440
-      - name: cse-sasl-cyrus-openssl-windows-2019-vs2017-x64-test-4.2-server-auth
-      - name: cse-sasl-cyrus-openssl-windows-2019-vs2017-x64-test-4.4-server-auth
-      - name: cse-sasl-cyrus-openssl-windows-2019-vs2017-x64-test-5.0-server-auth
-      - name: cse-sasl-cyrus-openssl-windows-2019-vs2017-x64-test-6.0-server-auth
-      - name: cse-sasl-cyrus-openssl-ubuntu2004-gcc-test-4.4-server-auth
-      - name: cse-sasl-cyrus-openssl-ubuntu2004-gcc-test-5.0-server-auth
-      - name: cse-sasl-cyrus-openssl-ubuntu2004-gcc-test-6.0-server-auth
-      - name: cse-sasl-cyrus-openssl-ubuntu2004-gcc-test-7.0-server-auth
-      - name: cse-sasl-cyrus-openssl-ubuntu2004-gcc-test-8.0-server-auth
-      - name: cse-sasl-cyrus-openssl-ubuntu2004-gcc-test-latest-server-auth
-      - name: cse-sasl-cyrus-openssl-ubuntu2004-gcc-test-4.4-replica-auth
-      - name: cse-sasl-cyrus-openssl-ubuntu2004-gcc-test-5.0-replica-auth
-      - name: cse-sasl-cyrus-openssl-ubuntu2004-gcc-test-6.0-replica-auth
-      - name: cse-sasl-cyrus-openssl-ubuntu2004-gcc-test-7.0-replica-auth
-      - name: cse-sasl-cyrus-openssl-ubuntu2004-gcc-test-8.0-replica-auth
-      - name: cse-sasl-cyrus-openssl-ubuntu2004-gcc-test-latest-replica-auth
-      - name: cse-sasl-cyrus-openssl-rhel8-zseries-gcc-test-7.0-server-auth
+      - name: cse-sasl-cyrus-openssl-rhel8-zseries-gcc-test-5.0-server-auth
         batchtime: 1440
-      - name: cse-sasl-cyrus-openssl-rhel8-zseries-gcc-test-8.0-server-auth
+      - name: cse-sasl-cyrus-openssl-rhel8-zseries-gcc-test-6.0-replica-auth
         batchtime: 1440
-      - name: cse-sasl-cyrus-openssl-rhel8-zseries-gcc-test-latest-server-auth
+      - name: cse-sasl-cyrus-openssl-rhel8-zseries-gcc-test-6.0-server-auth
         batchtime: 1440
       - name: cse-sasl-cyrus-openssl-rhel8-zseries-gcc-test-7.0-replica-auth
         batchtime: 1440
+      - name: cse-sasl-cyrus-openssl-rhel8-zseries-gcc-test-7.0-server-auth
+        batchtime: 1440
       - name: cse-sasl-cyrus-openssl-rhel8-zseries-gcc-test-8.0-replica-auth
         batchtime: 1440
+      - name: cse-sasl-cyrus-openssl-rhel8-zseries-gcc-test-8.0-server-auth
+        batchtime: 1440
       - name: cse-sasl-cyrus-openssl-rhel8-zseries-gcc-test-latest-replica-auth
         batchtime: 1440
-      - name: cse-sasl-cyrus-openssl-ubuntu2004-arm64-gcc-test-4.4-server-auth
-      - name: cse-sasl-cyrus-openssl-ubuntu2004-arm64-gcc-test-5.0-server-auth
-      - name: cse-sasl-cyrus-openssl-ubuntu2004-arm64-gcc-test-6.0-server-auth
-      - name: cse-sasl-cyrus-openssl-ubuntu2004-arm64-gcc-test-7.0-server-auth
-      - name: cse-sasl-cyrus-openssl-ubuntu2004-arm64-gcc-test-8.0-server-auth
-      - name: cse-sasl-cyrus-openssl-ubuntu2004-arm64-gcc-test-latest-server-auth
+      - name: cse-sasl-cyrus-openssl-rhel8-zseries-gcc-test-latest-server-auth
+        batchtime: 1440
+      - name: cse-sasl-cyrus-openssl-rhel80-gcc-compile
+      - name: cse-sasl-cyrus-openssl-ubuntu2004-arm64-gcc-compile
       - name: cse-sasl-cyrus-openssl-ubuntu2004-arm64-gcc-test-4.4-replica-auth
+      - name: cse-sasl-cyrus-openssl-ubuntu2004-arm64-gcc-test-4.4-server-auth
       - name: cse-sasl-cyrus-openssl-ubuntu2004-arm64-gcc-test-5.0-replica-auth
+      - name: cse-sasl-cyrus-openssl-ubuntu2004-arm64-gcc-test-5.0-server-auth
       - name: cse-sasl-cyrus-openssl-ubuntu2004-arm64-gcc-test-6.0-replica-auth
+      - name: cse-sasl-cyrus-openssl-ubuntu2004-arm64-gcc-test-6.0-server-auth
       - name: cse-sasl-cyrus-openssl-ubuntu2004-arm64-gcc-test-7.0-replica-auth
+      - name: cse-sasl-cyrus-openssl-ubuntu2004-arm64-gcc-test-7.0-server-auth
       - name: cse-sasl-cyrus-openssl-ubuntu2004-arm64-gcc-test-8.0-replica-auth
+      - name: cse-sasl-cyrus-openssl-ubuntu2004-arm64-gcc-test-8.0-server-auth
       - name: cse-sasl-cyrus-openssl-ubuntu2004-arm64-gcc-test-latest-replica-auth
-      - name: cse-sasl-cyrus-openssl-windows-2019-vs2017-x64-test-7.0-server-auth
-      - name: cse-sasl-cyrus-openssl-windows-2019-vs2017-x64-test-8.0-server-auth
-      - name: cse-sasl-cyrus-openssl-windows-2019-vs2017-x64-test-latest-server-auth
+      - name: cse-sasl-cyrus-openssl-ubuntu2004-arm64-gcc-test-latest-server-auth
+      - name: cse-sasl-cyrus-openssl-ubuntu2004-clang-compile
+      - name: cse-sasl-cyrus-openssl-ubuntu2004-gcc-compile
+      - name: cse-sasl-cyrus-openssl-ubuntu2204-clang-12-compile
+      - name: cse-sasl-cyrus-openssl-ubuntu2204-gcc-compile
+      - name: cse-sasl-cyrus-openssl-ubuntu2404-clang-14-compile
+      - name: cse-sasl-cyrus-openssl-ubuntu2404-gcc-compile
+      - name: cse-sasl-cyrus-openssl-windows-2019-vs2017-x64-compile
+      - name: cse-sasl-cyrus-openssl-windows-2019-vs2017-x64-test-4.2-replica-auth
+      - name: cse-sasl-cyrus-openssl-windows-2019-vs2017-x64-test-4.2-server-auth
+      - name: cse-sasl-cyrus-openssl-windows-2019-vs2017-x64-test-4.4-replica-auth
+      - name: cse-sasl-cyrus-openssl-windows-2019-vs2017-x64-test-4.4-server-auth
+      - name: cse-sasl-cyrus-openssl-windows-2019-vs2017-x64-test-5.0-replica-auth
+      - name: cse-sasl-cyrus-openssl-windows-2019-vs2017-x64-test-5.0-server-auth
+      - name: cse-sasl-cyrus-openssl-windows-2019-vs2017-x64-test-6.0-replica-auth
+      - name: cse-sasl-cyrus-openssl-windows-2019-vs2017-x64-test-6.0-server-auth
       - name: cse-sasl-cyrus-openssl-windows-2019-vs2017-x64-test-7.0-replica-auth
+      - name: cse-sasl-cyrus-openssl-windows-2019-vs2017-x64-test-7.0-server-auth
       - name: cse-sasl-cyrus-openssl-windows-2019-vs2017-x64-test-8.0-replica-auth
+      - name: cse-sasl-cyrus-openssl-windows-2019-vs2017-x64-test-8.0-server-auth
       - name: cse-sasl-cyrus-openssl-windows-2019-vs2017-x64-test-latest-replica-auth
-      - name: cse-sasl-cyrus-openssl-debian10-gcc-test-4.2-server-auth
-      - name: cse-sasl-cyrus-openssl-debian10-gcc-test-4.2-replica-auth
+      - name: cse-sasl-cyrus-openssl-windows-2019-vs2017-x64-test-latest-server-auth
   - name: cse-matrix-winssl
     display_name: cse-matrix-winssl
     expansions:
@@ -219,20 +231,22 @@ buildvariants:
     display_name: sasl-matrix-openssl
     expansions: {}
     tasks:
-      - name: sasl-cyrus-openssl-debian92-clang-compile
-      - name: sasl-cyrus-openssl-debian92-gcc-compile
-      - name: sasl-cyrus-openssl-debian10-gcc-compile
+      - name: sasl-cyrus-openssl-amazon2023-arm64-latest-large-m8g-gcc-compile
+      - name: sasl-cyrus-openssl-amazon2023-arm64-latest-large-m8g-gcc-test-latest-replica-auth
+      - name: sasl-cyrus-openssl-amazon2023-arm64-latest-large-m8g-gcc-test-latest-server-auth
+      - name: sasl-cyrus-openssl-amazon2023-arm64-latest-large-m8g-gcc-test-latest-sharded-auth
       - name: sasl-cyrus-openssl-debian11-gcc-compile
-      - name: sasl-cyrus-openssl-rhel80-gcc-compile
+      - name: sasl-cyrus-openssl-debian12-gcc-compile
+      - name: sasl-cyrus-openssl-rhel8-latest-gcc-compile
+      - name: sasl-cyrus-openssl-rhel8-latest-gcc-test-4.2-server-auth
+      - name: sasl-cyrus-openssl-rhel8-latest-gcc-test-4.4-server-auth
+      - name: sasl-cyrus-openssl-rhel8-latest-gcc-test-5.0-server-auth
+      - name: sasl-cyrus-openssl-rhel8-latest-gcc-test-6.0-server-auth
+      - name: sasl-cyrus-openssl-rhel8-latest-gcc-test-7.0-server-auth
+      - name: sasl-cyrus-openssl-rhel8-latest-gcc-test-8.0-server-auth
+      - name: sasl-cyrus-openssl-rhel8-latest-gcc-test-latest-server-auth
       - name: sasl-cyrus-openssl-rhel8-power-gcc-compile
         batchtime: 1440
-      - name: sasl-cyrus-openssl-rhel8-zseries-gcc-compile
-        batchtime: 1440
-      - name: sasl-cyrus-openssl-ubuntu2004-clang-compile
-      - name: sasl-cyrus-openssl-ubuntu2004-arm64-gcc-compile
-      - name: sasl-cyrus-openssl-ubuntu2004-gcc-compile
-      - name: sasl-cyrus-openssl-windows-2019-vs2017-x64-compile
-      - name: sasl-cyrus-openssl-amazon2023-arm64-latest-large-m8g-gcc-compile
       - name: sasl-cyrus-openssl-rhel8-power-gcc-test-4.2-server-auth
         batchtime: 1440
       - name: sasl-cyrus-openssl-rhel8-power-gcc-test-4.4-server-auth
@@ -247,6 +261,8 @@ buildvariants:
         batchtime: 1440
       - name: sasl-cyrus-openssl-rhel8-power-gcc-test-latest-server-auth
         batchtime: 1440
+      - name: sasl-cyrus-openssl-rhel8-zseries-gcc-compile
+        batchtime: 1440
       - name: sasl-cyrus-openssl-rhel8-zseries-gcc-test-5.0-server-auth
         batchtime: 1440
       - name: sasl-cyrus-openssl-rhel8-zseries-gcc-test-6.0-server-auth
@@ -257,24 +273,21 @@ buildvariants:
         batchtime: 1440
       - name: sasl-cyrus-openssl-rhel8-zseries-gcc-test-latest-server-auth
         batchtime: 1440
+      - name: sasl-cyrus-openssl-rhel80-gcc-compile
+      - name: sasl-cyrus-openssl-ubuntu2004-arm64-gcc-compile
       - name: sasl-cyrus-openssl-ubuntu2004-arm64-gcc-test-4.4-server-auth
       - name: sasl-cyrus-openssl-ubuntu2004-arm64-gcc-test-5.0-server-auth
       - name: sasl-cyrus-openssl-ubuntu2004-arm64-gcc-test-6.0-server-auth
       - name: sasl-cyrus-openssl-ubuntu2004-arm64-gcc-test-7.0-server-auth
       - name: sasl-cyrus-openssl-ubuntu2004-arm64-gcc-test-8.0-server-auth
       - name: sasl-cyrus-openssl-ubuntu2004-arm64-gcc-test-latest-server-auth
-      - name: sasl-cyrus-openssl-ubuntu2004-gcc-test-4.4-server-auth
-      - name: sasl-cyrus-openssl-ubuntu2004-gcc-test-5.0-server-auth
-      - name: sasl-cyrus-openssl-ubuntu2004-gcc-test-6.0-server-auth
-      - name: sasl-cyrus-openssl-ubuntu2004-gcc-test-7.0-server-auth
-      - name: sasl-cyrus-openssl-ubuntu2004-gcc-test-8.0-server-auth
-      - name: sasl-cyrus-openssl-ubuntu2004-gcc-test-latest-server-auth
+      - name: sasl-cyrus-openssl-ubuntu2004-clang-compile
+      - name: sasl-cyrus-openssl-ubuntu2204-clang-12-compile
+      - name: sasl-cyrus-openssl-ubuntu2204-gcc-compile
+      - name: sasl-cyrus-openssl-ubuntu2404-clang-14-compile
+      - name: sasl-cyrus-openssl-ubuntu2404-gcc-compile
+      - name: sasl-cyrus-openssl-windows-2019-vs2017-x64-compile
       - name: sasl-cyrus-openssl-windows-2019-vs2017-x64-test-latest-server-auth
-      - name: sasl-cyrus-openssl-debian10-gcc-test-4.2-server-auth
-      - name: sasl-cyrus-openssl-debian10-gcc-test-4.2-replica-auth
-      - name: sasl-cyrus-openssl-amazon2023-arm64-latest-large-m8g-gcc-test-latest-server-auth
-      - name: sasl-cyrus-openssl-amazon2023-arm64-latest-large-m8g-gcc-test-latest-replica-auth
-      - name: sasl-cyrus-openssl-amazon2023-arm64-latest-large-m8g-gcc-test-latest-sharded-auth
   - name: sasl-matrix-winssl
     display_name: sasl-matrix-winssl
     expansions: {}
diff -pruN 2.0.2-1/.evergreen/legacy_config_generator/evergreen_config_generator/__init__.py 2.1.0-1/.evergreen/legacy_config_generator/evergreen_config_generator/__init__.py
--- 2.0.2-1/.evergreen/legacy_config_generator/evergreen_config_generator/__init__.py	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/.evergreen/legacy_config_generator/evergreen_config_generator/__init__.py	2025-08-14 18:37:23.000000000 +0000
@@ -36,12 +36,8 @@ ValueOrderedDict = OD[Scalar, Value]
 "An OrderedDict of YAML values"
 
 
-try:
-    import yaml
-    import yamlordereddictloader  # type: ignore
-except ImportError:
-    sys.stderr.write("try 'poetry install --with=dev'\n")
-    raise
+import yaml
+import yamlloader
 
 
 class ConfigObject(object):
@@ -68,7 +64,7 @@ class ConfigObject(object):
 # tag sets as lists.
 
 
-class _Dumper(yamlordereddictloader.Dumper):
+class _Dumper(yamlloader.ordereddict.Dumper):
     def __init__(self, *args: Value, **kwargs: Value):
         super().__init__(*args, **kwargs)  # type: ignore
         self.add_representer(set, type(self).represent_set)
diff -pruN 2.0.2-1/.evergreen/legacy_config_generator/evergreen_config_lib/functions.py 2.1.0-1/.evergreen/legacy_config_generator/evergreen_config_lib/functions.py
--- 2.0.2-1/.evergreen/legacy_config_generator/evergreen_config_lib/functions.py	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/.evergreen/legacy_config_generator/evergreen_config_lib/functions.py	2025-08-14 18:37:23.000000000 +0000
@@ -156,11 +156,19 @@ all_functions = OD([
         ''', add_expansions_to_env=True),
     )),
     ('build mongohouse', Function(
+        # Assume role to get AWS secrets.
+        {
+            "command": "ec2.assume_role",
+            "params": {
+                "role_arn": "${aws_test_secrets_role}"
+            }
+        },
+
         shell_exec(r'''
         cd drivers-evergreen-tools
         export DRIVERS_TOOLS=$(pwd)
         .evergreen/atlas_data_lake/pull-mongohouse-image.sh
-        '''),
+        ''', include_expansions_in_env=[ "AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "AWS_SESSION_TOKEN" ]),
     )),
     ('run mongohouse', Function(
         shell_exec(r'''
diff -pruN 2.0.2-1/.evergreen/legacy_config_generator/evergreen_config_lib/tasks.py 2.1.0-1/.evergreen/legacy_config_generator/evergreen_config_lib/tasks.py
--- 2.0.2-1/.evergreen/legacy_config_generator/evergreen_config_lib/tasks.py	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/.evergreen/legacy_config_generator/evergreen_config_lib/tasks.py	2025-08-14 18:37:23.000000000 +0000
@@ -279,51 +279,6 @@ all_tasks = [
             shell_mongoc("sudo rm -rf ../build ../mock-result ../rpm.tar.gz\n" "export MOCK_TARGET_CONFIG=rocky+epel-8-aarch64\n" ".evergreen/scripts/build_snapshot_rpm.sh"),
         ],
     ),
-    NamedTask(
-        "install-uninstall-check-mingw",
-        commands=[
-            func("find-cmake-latest"),
-            shell_mongoc(
-                r"""
-                . .evergreen/scripts/find-cmake-latest.sh
-                export CMAKE="$(find_cmake_latest)"
-                export CC="C:/mingw-w64/x86_64-4.9.1-posix-seh-rt_v3-rev1/mingw64/bin/gcc.exe"
-                BSON_ONLY=1 cmd.exe /c .\\.evergreen\\scripts\\install-uninstall-check-windows.cmd
-                cmd.exe /c .\\.evergreen\\scripts\\install-uninstall-check-windows.cmd""",
-                include_expansions_in_env=["distro_id"],
-            )
-        ],
-    ),
-    NamedTask(
-        "install-uninstall-check-msvc",
-        commands=[
-            func("find-cmake-latest"),
-            shell_mongoc(
-                r"""
-                . .evergreen/scripts/find-cmake-latest.sh
-                export CMAKE="$(find_cmake_latest)"
-                export CC="Visual Studio 14 2015 Win64"
-                BSON_ONLY=1 cmd.exe /c .\\.evergreen\\scripts\\install-uninstall-check-windows.cmd
-                cmd.exe /c .\\.evergreen\\scripts\\install-uninstall-check-windows.cmd""",
-                include_expansions_in_env=["distro_id"],
-            )
-        ],
-    ),
-    NamedTask(
-        "install-uninstall-check",
-        commands=[
-            func("find-cmake-latest"),
-            shell_mongoc(
-                r"""
-                . .evergreen/scripts/find-cmake-latest.sh
-                export CMAKE="$(find_cmake_latest)"
-                DESTDIR="$(pwd)/dest" .evergreen/scripts/install-uninstall-check.sh
-                BSON_ONLY=1 .evergreen/scripts/install-uninstall-check.sh
-                .evergreen/scripts/install-uninstall-check.sh""",
-                include_expansions_in_env=["distro_id"],
-            )
-        ],
-    ),
     CompileTask("debug-compile-with-warnings", CFLAGS="-Werror -Wno-cast-align"),
     CompileTask(
         "debug-compile-nosasl-openssl-1.0.1",
diff -pruN 2.0.2-1/.evergreen/legacy_config_generator/evergreen_config_lib/testazurekms.py 2.1.0-1/.evergreen/legacy_config_generator/evergreen_config_lib/testazurekms.py
--- 2.0.2-1/.evergreen/legacy_config_generator/evergreen_config_lib/testazurekms.py	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/.evergreen/legacy_config_generator/evergreen_config_lib/testazurekms.py	2025-08-14 18:37:23.000000000 +0000
@@ -18,8 +18,6 @@
 from collections import OrderedDict as OD
 from typing import MutableSequence
 
-from config_generator.components.funcs.find_cmake_latest import FindCMakeLatest
-
 from evergreen_config_generator.functions import shell_exec, func
 from evergreen_config_generator.tasks import NamedTask
 from evergreen_config_generator.variants import Variant
@@ -105,7 +103,7 @@ def _create_variant():
         name="testazurekms-variant",
         display_name="Azure KMS",
         # Azure Virtual Machine created is Debian 10.
-        run_on="debian10-small",
+        run_on="debian11-small",
         tasks=["testazurekms_task_group", "testazurekms-fail-task"],
         batchtime=20160,
     )  # Use a batchtime of 14 days as suggested by the CSFLE test README
@@ -117,6 +115,13 @@ def _create_task_group():
     task_group.setup_group_timeout_secs = 1800  # 30 minutes
     task_group.setup_group = [
         func("fetch-det"),
+        # Assume role to get AWS secrets.
+        {
+            "command": "ec2.assume_role",
+            "params": {
+                "role_arn": "${aws_test_secrets_role}"
+            }
+        },
         shell_exec(
             r"""
             DRIVERS_TOOLS=$(pwd)/drivers-evergreen-tools
@@ -136,6 +141,7 @@ def _create_task_group():
             $DRIVERS_TOOLS/.evergreen/csfle/azurekms/create-and-setup-vm.sh
             """,
             test=False,
+            include_expansions_in_env=[ "AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "AWS_SESSION_TOKEN" ]
         ),
         # Load the AZUREKMS_VMNAME expansion.
         OD(
diff -pruN 2.0.2-1/.evergreen/legacy_config_generator/evergreen_config_lib/variants.py 2.1.0-1/.evergreen/legacy_config_generator/evergreen_config_lib/variants.py
--- 2.0.2-1/.evergreen/legacy_config_generator/evergreen_config_lib/variants.py	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/.evergreen/legacy_config_generator/evergreen_config_lib/variants.py	2025-08-14 18:37:23.000000000 +0000
@@ -50,8 +50,8 @@ all_variants = [
             "link-with-cmake",
             "link-with-cmake-ssl",
             "link-with-cmake-snappy",
+            "verify-headers",
             OD([("name", "link-with-cmake-mac"), ("distros", ["macos-14-arm64"])]),
-            OD([("name", "link-with-cmake-mac-deprecated"), ("distros", ["macos-14-arm64"])]),
             OD([("name", "link-with-cmake-windows"), ("distros", ["windows-vsCurrent-large"])]),
             OD([("name", "link-with-cmake-windows-ssl"), ("distros", ["windows-vsCurrent-large"])]),
             OD([("name", "link-with-cmake-windows-snappy"), ("distros", ["windows-vsCurrent-large"])]),
@@ -64,11 +64,8 @@ all_variants = [
             OD([("name", "link-with-bson-mac"), ("distros", ["macos-14-arm64"])]),
             OD([("name", "link-with-bson-mingw"), ("distros", ["windows-vsCurrent-large"])]),
             "check-headers",
-            "install-uninstall-check",
-            OD([("name", "install-uninstall-check-mingw"), ("distros", ["windows-vsCurrent-large"])]),
-            OD([("name", "install-uninstall-check-msvc"), ("distros", ["windows-vsCurrent-large"])]),
             "debug-compile-with-warnings",
-            OD([("name", "build-and-test-with-toolchain"), ("distros", ["debian10-small"])]),
+            OD([("name", "build-and-test-with-toolchain"), ("distros", ["debian11-small"])]),
             "install-libmongoc-after-libbson",
         ],
         {
@@ -85,7 +82,7 @@ all_variants = [
             "build-and-run-authentication-tests-openssl-1.0.1",
             "build-and-run-authentication-tests-openssl-1.0.2",
             "build-and-run-authentication-tests-openssl-1.1.0",
-            "build-and-run-authentication-tests-openssl-1.0.1-fips"
+            "build-and-run-authentication-tests-openssl-1.0.1-fips",
         ],
         {},
     ),
@@ -130,13 +127,6 @@ all_variants = [
         {"CC": "gcc"},
     ),
     Variant(
-        "gcc83",
-        "GCC 8.3 (Debian 10.0)",
-        "debian10-test",
-        ["release-compile", "debug-compile-nosasl-nossl", ".latest .nossl"],
-        {"CC": "gcc"},
-    ),
-    Variant(
         "gcc102",
         "GCC 10.2 (Debian 11.0)",
         "debian11-large",
@@ -364,7 +354,7 @@ all_variants = [
                 "name": "ocsp-openssl-1.0.1",
                 "execution_tasks": [".ocsp-openssl-1.0.1"],
             },
-        ]
+        ],
     ),
     Variant(
         "packaging",
@@ -388,7 +378,7 @@ all_variants = [
             ".versioned-api .5.0",
             ".versioned-api .6.0",
             ".versioned-api .7.0",
-            ".versioned-api .8.0"
+            ".versioned-api .8.0",
         ],
         {},
     ),
diff -pruN 2.0.2-1/.evergreen/scripts/build-docs.sh 2.1.0-1/.evergreen/scripts/build-docs.sh
--- 2.0.2-1/.evergreen/scripts/build-docs.sh	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/.evergreen/scripts/build-docs.sh	2025-08-14 18:37:23.000000000 +0000
@@ -10,7 +10,7 @@ CMAKE=$(find_cmake_latest)
 grep "á" NEWS > /dev/null || (echo "NEWS file appears to have lost its UTF-8 encoding?" || exit 1)
 
 build_dir=$MONGOC_DIR/_build/for-docs
-"$CMAKE" -S "$MONGOC_DIR" -B "$build_dir" \
+"$CMAKE" --fresh -S "$MONGOC_DIR" -B "$build_dir" \
   -D ENABLE_MAN_PAGES=ON \
   -D ENABLE_HTML_DOCS=ON \
   -D ENABLE_ZLIB=BUNDLED
diff -pruN 2.0.2-1/.evergreen/scripts/check-files.py 2.1.0-1/.evergreen/scripts/check-files.py
--- 2.0.2-1/.evergreen/scripts/check-files.py	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/.evergreen/scripts/check-files.py	1970-01-01 00:00:00.000000000 +0000
@@ -1,67 +0,0 @@
-#!/usr/bin/env python3
-
-# Copyright 2009-present MongoDB, Inc.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#   http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-"""Check that there are no missing .c or .h files in the release tarball.
-"""
-import os
-import re
-import sys
-
-if len(sys.argv) != 3:
-    print("Usage: python check_files.py"
-          " <src directory from repo>"
-          " <src directory produced by tarball>")
-    sys.exit(1)
-
-REPO_SRC_DIR = sys.argv[1]
-TAR_SRC_DIR = sys.argv[2]
-
-pattern = re.compile(r".*\.(c|h)$")
-
-repo_src_files = set()
-tar_src_files = set()
-
-# Files that are generated by cmake are expected not to be in the repository.
-cmake_produced = [
-    "libbson/src/bson/bson-version.h",
-    "libmongoc/src/mongoc/mongoc-version.h",
-    "zlib-1.2.13/zconf.h",
-]
-
-for root, dirs, files in os.walk(REPO_SRC_DIR):
-    for file in files:
-        relpath = os.path.relpath(os.path.join(root, file), REPO_SRC_DIR)
-
-        if pattern.match(relpath):
-            repo_src_files.add(relpath)
-
-for root, dirs, files in os.walk(TAR_SRC_DIR):
-    for file in files:
-        relpath = os.path.relpath(os.path.join(root, file), TAR_SRC_DIR)
-        if relpath in cmake_produced:
-            continue
-        if pattern.match(relpath):
-            tar_src_files.add(relpath)
-
-if tar_src_files != repo_src_files:
-    print("Files produced from tarball differ from repository")
-    print("Tarball produced the following files NOT in repository")
-    for file in sorted(tar_src_files.difference(repo_src_files)):
-        print(" " + file)
-    print("Repository has the following files NOT in tarball")
-    for file in sorted(repo_src_files.difference(tar_src_files)):
-        print(" " + file)
-    sys.exit(1)
diff -pruN 2.0.2-1/.evergreen/scripts/check-preludes.py 2.1.0-1/.evergreen/scripts/check-preludes.py
--- 2.0.2-1/.evergreen/scripts/check-preludes.py	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/.evergreen/scripts/check-preludes.py	2025-08-14 18:37:23.000000000 +0000
@@ -39,7 +39,7 @@ checks = [
     },
     {
         "name": "libbson",
-        "headers": list(BSON_PREFIX.glob("*.h")),
+        "headers": list(BSON_PREFIX.glob("bson-*.h")),
         "exclusions": [
             BSON_PREFIX / "bson-prelude.h",
             BSON_PREFIX / "bson.h",
diff -pruN 2.0.2-1/.evergreen/scripts/clang-format-all.sh 2.1.0-1/.evergreen/scripts/clang-format-all.sh
--- 2.0.2-1/.evergreen/scripts/clang-format-all.sh	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/.evergreen/scripts/clang-format-all.sh	1970-01-01 00:00:00.000000000 +0000
@@ -1,39 +0,0 @@
-#!/usr/bin/env bash
-#
-# clang-format-all.sh
-#
-# Usage:
-#   ./tools/poetry.sh install --with=dev
-#   ./tools/poetry.sh run .evergreen/scripts/clang-format-all.sh
-#   DRYRUN=1 ./tools/poetry.sh run .evergreen/scripts/clang-format-all.sh
-#   ./tools/poetry.sh run env DRYRUN=1 .evergreen/scripts/clang-format-all.sh
-#
-# This script is meant to be run from the project root directory.
-
-: "${DRYRUN:-}"
-
-set -o errexit
-set -o pipefail
-
-clang-format --version
-
-source_dirs=(
-  src/common
-  src/libbson
-  src/libmongoc
-)
-
-exclude_patterns=(
-  -e src/libbson/src/jsonsl
-)
-
-mapfile -t source_files < <(
-  find "${source_dirs[@]:?}" -name '*.[ch]' |
-    grep -E -v "${exclude_patterns[@]}"
-)
-
-if [[ -n "${DRYRUN:-}" ]]; then
-  clang-format --dry-run -Werror "${source_files[@]:?}"
-else
-  clang-format --verbose -i "${source_files[@]:?}"
-fi
diff -pruN 2.0.2-1/.evergreen/scripts/compile-std.sh 2.1.0-1/.evergreen/scripts/compile-std.sh
--- 2.0.2-1/.evergreen/scripts/compile-std.sh	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/.evergreen/scripts/compile-std.sh	2025-08-14 18:37:23.000000000 +0000
@@ -22,7 +22,7 @@ script_dir="$(to_absolute "$(dirname "${
 declare mongoc_dir
 mongoc_dir="$(to_absolute "${script_dir}/../..")"
 
-declare install_dir="${mongoc_dir}/install-dir"
+declare libmongocrypt_install_dir="${mongoc_dir}/libmongocrypt-install-dir"
 
 declare -a configure_flags
 
@@ -38,7 +38,7 @@ configure_flags_append_if_not_null() {
   fi
 }
 
-configure_flags_append "-DCMAKE_PREFIX_PATH=${install_dir}"
+configure_flags_append "-DCMAKE_PREFIX_PATH=${libmongocrypt_install_dir:?}"
 configure_flags_append "-DCMAKE_SKIP_RPATH=TRUE" # Avoid hardcoding absolute paths to dependency libraries.
 configure_flags_append "-DENABLE_CLIENT_SIDE_ENCRYPTION=ON"
 configure_flags_append "-DENABLE_DEBUG_ASSERTIONS=ON"
@@ -90,15 +90,15 @@ CXXFLAGS+=" ${flags+${flags[*]}}"
 declare cmake_binary
 cmake_binary="$(find_cmake_latest)"
 
-declare build_dir
-build_dir="cmake-build"
+declare mongoc_build_dir mongoc_install_dir
+mongoc_build_dir="cmake-build"
+mongoc_install_dir="cmake-install"
+
+configure_flags_append "-DCMAKE_INSTALL_PREFIX=${mongoc_install_dir:?}"
 
 # shellcheck source=.evergreen/scripts/add-build-dirs-to-paths.sh
 . "${script_dir}/add-build-dirs-to-paths.sh"
 
-export PKG_CONFIG_PATH
-PKG_CONFIG_PATH="${install_dir}/lib/pkgconfig:${PKG_CONFIG_PATH:-}"
-
 if [[ "${OSTYPE}" == darwin* ]]; then
   # MacOS does not have nproc.
   nproc() {
@@ -116,9 +116,55 @@ if [[ "${CMAKE_GENERATOR:-}" =~ "Visual
   export EnforceProcessCountAcrossBuilds=1
 fi
 
+echo "Checking requested C standard is supported..."
+pushd "$(mktemp -d)"
+cat >CMakeLists.txt <<DOC
+cmake_minimum_required(VERSION 3.30...4.0)
+project(c_standard_latest LANGUAGES C)
+set(c_std_version "${C_STD_VERSION:?}")
+if(c_std_version STREQUAL "latest") # Special-case MSVC's /std:clatest flag.
+  include(CheckCCompilerFlag)
+  check_c_compiler_flag("/std:clatest" cflag_std_clatest)
+  if(cflag_std_clatest)
+    message(STATUS "/std:clatest is supported")
+  else()
+    message(FATAL_ERROR "/std:clatest is not supported")
+  endif()
+else()
+  # Ensure "old" standard versions are not compared as "newer" than C11/C17/etc.
+  set(old_std_versions 90 99)
+
+  macro(success)
+    message(STATUS "Latest C standard \${CMAKE_C_STANDARD_LATEST} is newer than \${c_std_version}")
+  endmacro()
+  macro(failure)
+    message(FATAL_ERROR "Latest C standard \${CMAKE_C_STANDARD_LATEST} is older than \${c_std_version}")
+  endmacro()
+
+  if (CMAKE_C_STANDARD_LATEST IN_LIST old_std_versions AND c_std_standard IN_LIST old_std_versions)
+    if (CMAKE_C_STANDARD_LATEST GREATER_EQUAL c_std_version)
+      success() # Both are old: latest >= version
+    else()
+      failure() # Both are old: latest < version
+    endif()
+  elseif(CMAKE_C_STANDARD_LATEST IN_LIST old_std_versions)
+    failure() # latest (old) < version (new)
+  elseif(c_std_version IN_LIST old_std_versions)
+    success() # latest (new) >= version (old)
+  elseif(CMAKE_C_STANDARD_LATEST GREATER_EQUAL c_std_version)
+    success() # Both are new: latest >= version.
+  else()
+    failure() # Both are new: latest < version.
+  endif()
+endif()
+DOC
+"${cmake_binary:?}" -S . -B build
+popd # "$(tmpfile -d)"
+echo "Checking requested C standard is supported... done."
+
 echo "Installing libmongocrypt..."
 # shellcheck source=.evergreen/scripts/compile-libmongocrypt.sh
-"${script_dir}/compile-libmongocrypt.sh" "${cmake_binary}" "${mongoc_dir}" "${install_dir}" &>output.txt || {
+"${script_dir}/compile-libmongocrypt.sh" "${cmake_binary}" "${mongoc_dir}" "${libmongocrypt_install_dir:?}" &>output.txt || {
   cat output.txt 1>&2
   exit 1
 }
@@ -141,9 +187,39 @@ else
   all_target="all"
 fi
 
-"${cmake_binary}" -S . -B "${build_dir:?}" "${configure_flags[@]}"
-"${cmake_binary}" --build "${build_dir:?}" --config Debug \
+# Ensure we're starting with a clean slate.
+rm -rf "${mongoc_build_dir:?}" "${mongoc_install_dir:?}"
+
+"${cmake_binary}" -S . -B "${mongoc_build_dir:?}" "${configure_flags[@]}"
+"${cmake_binary}" --build "${mongoc_build_dir:?}" --config Debug \
   --target mongo_c_driver_tests \
   --target mongo_c_driver_examples \
   --target public-header-warnings \
   --target "${all_target:?}"
+"${cmake_binary}" --install "${mongoc_build_dir:?}" --config Debug
+
+# "lib" vs. "lib64"
+if [[ -d "${mongoc_install_dir:?}/lib64" ]]; then
+  lib_dir="lib64"
+else
+  lib_dir="lib"
+fi
+
+# This file should not be deleted!
+touch "${mongoc_install_dir:?}/${lib_dir:?}/canary.txt"
+
+# Linux/MacOS: uninstall.sh
+# Windows:     uninstall.cmd
+"${cmake_binary}" --build "${mongoc_build_dir:?}" --target uninstall
+
+# No files should remain except canary.txt.
+# No directories except top-level directories should remain.
+echo "Checking results of uninstall..."
+diff <(cd "${mongoc_install_dir:?}" && find . -mindepth 1 | sort) <(
+  echo "./bin"
+  echo "./include"
+  echo "./${lib_dir:?}"
+  echo "./${lib_dir:?}/canary.txt"
+  echo "./share"
+)
+echo "Checking results of uninstall... done."
diff -pruN 2.0.2-1/.evergreen/scripts/compile-windows.sh 2.1.0-1/.evergreen/scripts/compile-windows.sh
--- 2.0.2-1/.evergreen/scripts/compile-windows.sh	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/.evergreen/scripts/compile-windows.sh	2025-08-14 18:37:23.000000000 +0000
@@ -56,7 +56,6 @@ IFS=' ' read -ra extra_configure_flags <
 
 configure_flags_append "-DCMAKE_INSTALL_PREFIX=$(native-path "${install_dir}")"
 configure_flags_append "-DCMAKE_PREFIX_PATH=$(native-path "${install_dir}")"
-configure_flags_append "-DENABLE_AUTOMATIC_INIT_AND_CLEANUP=OFF"
 configure_flags_append "-DENABLE_MAINTAINER_FLAGS=ON"
 
 configure_flags_append_if_not_null C_STD_VERSION "-DCMAKE_C_STANDARD=${C_STD_VERSION:-}"
@@ -98,17 +97,15 @@ CMAKE_BUILD_PARALLEL_LEVEL="$(nproc)"
 declare build_dir
 build_dir="cmake-build"
 
-if [[ "${CC}" =~ mingw ]]; then
+if [[ "${CC}" =~ 'gcc' ]]; then
   # MinGW has trouble compiling src/cpp-check.cpp without some assistance.
   configure_flags_append "-DCMAKE_CXX_STANDARD=11"
 
   env \
-    "CC=gcc" \
-    "CXX=g++" \
     "${cmake_binary:?}" \
     -S . \
     -B "${build_dir:?}" \
-    -G "MinGW Makefiles" \
+    -G "Ninja" \
     "${configure_flags[@]}" \
     "${extra_configure_flags[@]}"
 
diff -pruN 2.0.2-1/.evergreen/scripts/debian_package_build.sh 2.1.0-1/.evergreen/scripts/debian_package_build.sh
--- 2.0.2-1/.evergreen/scripts/debian_package_build.sh	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/.evergreen/scripts/debian_package_build.sh	2025-08-14 18:37:23.000000000 +0000
@@ -66,7 +66,7 @@ sudo chroot ./unstable-chroot /bin/bash
   LANG=C /bin/bash ./debian/build_snapshot.sh && \
   debc ../*.changes && \
   dpkg -i ../*.deb && \
-  gcc -I/usr/include/libmongoc-1.0 -I/usr/include/libbson-1.0 -o example-client src/libmongoc/examples/example-client.c -lmongoc-1.0 -lbson-1.0 )'
+  gcc $(pkgconf --cflags bson2 mongoc2) -o example-client src/libmongoc/examples/example-client.c -lmongoc2 -lbson2 )'
 
 [ -e ./unstable-chroot/tmp/mongoc/example-client ] || (echo "Example was not built!" ; exit 1)
 (cd ./unstable-chroot/tmp/ ; tar zcvf ../../deb.tar.gz *.dsc *.orig.tar.gz *.debian.tar.xz *.build *.deb)
@@ -98,7 +98,7 @@ sudo chroot ./unstable-i386-chroot /bin/
   LANG=C /bin/bash ./debian/build_snapshot.sh && \
   debc ../*.changes && \
   dpkg -i ../*.deb && \
-  gcc -I/usr/include/libmongoc-1.0 -I/usr/include/libbson-1.0 -o example-client src/libmongoc/examples/example-client.c -lmongoc-1.0 -lbson-1.0 )'
+  gcc $(pkgconf --cflags bson2 mongoc2) -o example-client src/libmongoc/examples/example-client.c -lmongoc2 -lbson2 )'
 
 [ -e ./unstable-i386-chroot/tmp/mongoc/example-client ] || (echo "Example was not built!" ; exit 1)
 (cd ./unstable-i386-chroot/tmp/ ; tar zcvf ../../deb-i386.tar.gz *.dsc *.orig.tar.gz *.debian.tar.xz *.build *.deb)
diff -pruN 2.0.2-1/.evergreen/scripts/install-uninstall-check-windows.cmd 2.1.0-1/.evergreen/scripts/install-uninstall-check-windows.cmd
--- 2.0.2-1/.evergreen/scripts/install-uninstall-check-windows.cmd	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/.evergreen/scripts/install-uninstall-check-windows.cmd	1970-01-01 00:00:00.000000000 +0000
@@ -1,231 +0,0 @@
-REM Supported/used environment variables:
-REM    CC             Compiler, "mingw" or "Visual Studio 14 2015 Win64".
-REM    BSON_ONLY      Whether to build only the BSON library.
-
-rem Ensure Cygwin executables like sh.exe are not in PATH
-rem set PATH=C:\Windows\system32;C:\Windows
-
-echo on
-echo
-
-set SRCROOT=%CD%
-set TAR=C:\cygwin\bin\tar
-set CMAKE=C:\cmake\bin\cmake
-set CMAKE_MAKE_PROGRAM=C:\mingw-w64\x86_64-4.9.1-posix-seh-rt_v3-rev1\mingw64\bin\mingw32-make.exe
-rem Ensure Cygwin executables like sh.exe are not in PATH
-set PATH=C:\cygwin\bin;C:\Windows\system32;C:\Windows;C:\mingw-w64\x86_64-4.9.1-posix-seh-rt_v3-rev1\mingw64\bin;C:\mongoc;src\libbson;src\libmongoc
-
-set version=1.31.0
-set major=1
-
-if "%BSON_ONLY%"=="1" (
-   set BUILD_DIR=%CD%\build-dir-bson
-   set INSTALL_DIR=%CD%\install-dir-bson
-) else (
-   set BUILD_DIR=%CD%\build-dir-mongoc
-   set INSTALL_DIR=%CD%\install-dir-mongoc
-)
-rmdir /S /Q %BUILD_DIR%
-mkdir %BUILD_DIR%
-
-rmdir /S /Q %INSTALL_DIR%
-mkdir %INSTALL_DIR%
-
-set PATH=%PATH%;%INSTALL_DIR%\bin
-
-cd %BUILD_DIR%
-robocopy "%SRCROOT%" "%BUILD_DIR%" /E /XD ".git" "%BUILD_DIR%" "_build" "cmake-build" /NP /NFL /NDL
-
-if "%BSON_ONLY%"=="1" (
-  set BSON_ONLY_OPTION=-DENABLE_MONGOC=OFF
-) else (
-  set BSON_ONLY_OPTION=-DENABLE_MONGOC=ON
-)
-
-echo.%CC%| findstr /I "gcc">Nul && (
-  rem Build libmongoc, with flags that the downstream R driver mongolite uses
-  %CMAKE% -G "MinGW Makefiles" -DCMAKE_MAKE_PROGRAM=%CMAKE_MAKE_PROGRAM% -DCMAKE_INSTALL_PREFIX=%INSTALL_DIR% -DCMAKE_PREFIX_PATH=%INSTALL_DIR%\lib\cmake %BSON_ONLY_OPTION% .
-  %CMAKE% --build .
-  if errorlevel 1 (
-     exit /B 1
-  )
-  %CMAKE% --build . --target install
-  if errorlevel 1 (
-     exit /B 1
-  )
-
-  REM no kms-message components should be installed
-  if exist %INSTALL_DIR%\include\kms_message\kms_message.h (
-     echo kms_message.h found!
-     exit /B 1
-  ) else (
-     echo kms_message.h check ok
-  )
-  if exist %INSTALL_DIR%\lib\libkms_message-static.a (
-     echo libkms_message-static.a found!
-     exit /B 1
-  ) else (
-     echo libkms_message-static.a check ok
-  )
-  if exist %INSTALL_DIR%\lib\cmake\kms_message\kms_message-config.cmake (
-     echo kms_message-config.cmake found!
-     exit /B 1
-  ) else (
-     echo kms_message-config.cmake check ok
-  )
-
-  echo > %INSTALL_DIR%\lib\canary.txt
-
-  dir %INSTALL_DIR%\share\mongo-c-driver
-
-  %CMAKE% --build . --target uninstall
-  if errorlevel 1 (
-     exit /B 1
-  )
-) || (
-  %CMAKE% -G "%CC%" "-DCMAKE_INSTALL_PREFIX=%INSTALL_DIR%" "-DCMAKE_BUILD_TYPE=Debug" %BSON_ONLY_OPTION% .
-  %CMAKE% --build . --config Debug
-  if errorlevel 1 (
-     exit /B 1
-  )
-  %CMAKE% --build . --config Debug --target install
-  if errorlevel 1 (
-     exit /B 1
-  )
-
-  echo > %INSTALL_DIR%\lib\canary.txt
-
-  REM no kms-message components should be installed
-  if exist %INSTALL_DIR%\include\kms_message\kms_message.h (
-     echo kms_message.h found!
-     exit /B 1
-  ) else (
-     echo kms_message.h check ok
-  )
-  if exist %INSTALL_DIR%\lib\libkms_message-static.a (
-     echo libkms_message-static.a found!
-     exit /B 1
-  ) else (
-     echo libkms_message-static.a check ok
-  )
-  if exist %INSTALL_DIR%\lib\cmake\kms_message\kms_message-config.cmake (
-     echo kms_message-config.cmake found!
-     exit /B 1
-  ) else (
-     echo kms_message-config.cmake check ok
-  )
-
-  dir %INSTALL_DIR%\share\mongo-c-driver
-
-  %CMAKE% --build . --target uninstall
-  if errorlevel 1 (
-     exit /B 1
-  )
-)
-
-if exist %INSTALL_DIR%\lib\pkgconfig\bson%major%.pc (
-   echo bson%major%.pc found!
-   exit /B 1
-) else (
-   echo bson%major%.pc check ok
-)
-if not exist %INSTALL_DIR%\lib\canary.txt (
-   echo canary.txt not found!
-   exit /B 1
-) else (
-   echo canary.txt check ok
-)
-if not exist %INSTALL_DIR%\lib (
-   echo %INSTALL_DIR%\lib not found!
-   exit /B 1
-) else (
-   echo %INSTALL_DIR%\lib check ok
-)
-if "%BSON_ONLY%" NEQ "1" (
-   if exist %INSTALL_DIR%\lib\pkgconfig\mongoc%major%.pc (
-     echo mongoc%major%.pc found!
-     exit /B 1
-   ) else (
-     echo mongoc%major%.pc check ok
-   )
-   if exist %INSTALL_DIR%\lib\cmake\mongoc-1.0\mongoc-1.0-config.cmake (
-     echo mongoc-1.0-config.cmake found!
-     exit /B 1
-   ) else (
-     echo mongoc-1.0-config.cmake check ok
-   )
-   if exist %INSTALL_DIR%\lib\cmake\mongoc-1.0\mongoc-1.0-config-version.cmake (
-     echo mongoc-1.0-config-version.cmake found!
-     exit /B 1
-   ) else (
-     echo mongoc-1.0-config-version.cmake check ok
-   )
-   if exist %INSTALL_DIR%\lib\cmake\mongoc-1.0\mongoc-targets.cmake (
-     echo mongoc-targets.cmake found!
-     exit /B 1
-   ) else (
-     echo mongoc-targets.cmake check ok
-   )
-)
-if exist %INSTALL_DIR%\include\bson-%version%\bson\bson.h (
-   echo bson\bson.h found!
-   exit /B 1
-) else (
-   echo bson\bson.h check ok
-)
-if exist %INSTALL_DIR%\include\bson-%version% (
-   echo $INSTALL_DIR\include\bson-%version% found!
-   exit /B 1
-) else (
-   echo $INSTALL_DIR\include\bson-%version% check ok
-)
-if "%BSON_ONLY%" NEQ "1" (
-   if exist %INSTALL_DIR%\include\libmongoc-1.0\mongoc\mongoc.h (
-     echo mongoc\mongoc.h found!
-     exit /B 1
-   ) else (
-     echo mongoc\mongoc.h check ok
-   )
-   if exist %INSTALL_DIR%\include\libmongoc-1.0\mongoc.h (
-     echo mongoc.h found!
-     exit /B 1
-   ) else (
-     echo mongoc.h check ok
-   )
-   if exist %INSTALL_DIR%\include\libmongoc-1.0 (
-     echo $INSTALL_DIR\include\libmongoc-1.0 found!
-     exit /B 1
-   ) else (
-     echo $INSTALL_DIR\include\libmongoc-1.0 check ok
-   )
-)
-if exist %INSTALL_DIR%\share\mongo-c-driver\uninstall-bson.cmd (
-   echo uninstall-bson.cmd found!
-   exit /B 1
-) else (
-   echo uninstall-bson.cmd check ok
-)
-if exist %INSTALL_DIR%\share\mongo-c-driver\uninstall.cmd (
-   echo uninstall.cmd found!
-   exit /B 1
-) else (
-   echo uninstall.cmd check ok
-)
-if exist %INSTALL_DIR%\share\mongo-c-driver\uninstall-bson.sh (
-   echo uninstall-bson.sh found!
-   exit /B 1
-) else (
-   echo uninstall-bson.sh check ok
-)
-if exist %INSTALL_DIR%\share\mongo-c-driver\uninstall.sh (
-   echo uninstall.sh found!
-   exit /B 1
-) else (
-   echo uninstall.sh check ok
-)
-if exist %INSTALL_DIR%\share\mongo-c-driver (
-   echo $INSTALL_DIR\share\mongo-c-driver found!
-   exit /B 1
-) else (
-   echo $INSTALL_DIR\share\mongo-c-driver check ok
-)
diff -pruN 2.0.2-1/.evergreen/scripts/install-uninstall-check.sh 2.1.0-1/.evergreen/scripts/install-uninstall-check.sh
--- 2.0.2-1/.evergreen/scripts/install-uninstall-check.sh	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/.evergreen/scripts/install-uninstall-check.sh	1970-01-01 00:00:00.000000000 +0000
@@ -1,202 +0,0 @@
-#!/usr/bin/env bash
-
-set -o errexit  # Exit the script with error if any of the commands fail
-
-# Supported/used environment variables:
-#   CMAKE                      Path to cmake executable.
-#   BSON_ONLY                  Whether to build only the BSON library.
-
-
-DIR=$(dirname $0)
-. $DIR/find-cmake-latest.sh
-CMAKE=$(find_cmake_latest)
-. $DIR/check-symlink.sh
-SRCROOT=$(pwd)
-
-# The major version of the project. Appears in certain install filenames.
-_full_version=$(cat "$DIR/../../VERSION_CURRENT")
-version="${_full_version%-*}"  # 1.2.3-dev → 1.2.3
-major="${version%%.*}"         # 1.2.3     → 1
-echo "major version: $major"
-echo " full version: $version"
-
-# Use ccache if able.
-. $DIR/find-ccache.sh
-find_ccache_and_export_vars "$(pwd)" || true
-
-SCRATCH_DIR=$(pwd)/.scratch
-rm -rf "$SCRATCH_DIR"
-mkdir -p "$SCRATCH_DIR"
-cp -r -- "$SRCROOT"/* "$SCRATCH_DIR"
-
-if [ "$BSON_ONLY" ]; then
-  BUILD_DIR=$SCRATCH_DIR/build-dir-bson
-  INSTALL_PREFIX=$SCRATCH_DIR/install-dir-bson
-else
-  BUILD_DIR=$SCRATCH_DIR/build-dir-mongoc
-  INSTALL_PREFIX=$SCRATCH_DIR/install-dir-mongoc
-fi
-
-if [ "$DESTDIR" ]; then
-   INSTALL_DIR="${DESTDIR}/${INSTALL_PREFIX}"
-else
-   INSTALL_DIR=$INSTALL_PREFIX
-fi
-
-rm -rf $BUILD_DIR
-mkdir $BUILD_DIR
-
-rm -rf $INSTALL_DIR
-mkdir -p $INSTALL_DIR
-
-cd $BUILD_DIR
-
-cp -r -- "$SRCROOT"/* "$SCRATCH_DIR"
-
-if [ "$BSON_ONLY" ]; then
-  BSON_ONLY_OPTION="-DENABLE_MONGOC=OFF"
-else
-  BSON_ONLY_OPTION="-DENABLE_MONGOC=ON"
-fi
-
-# Use ccache if able.
-if [[ -f $DIR/find-ccache.sh ]]; then
-  . $DIR/find-ccache.sh
-  find_ccache_and_export_vars "$SCRATCH_DIR" || true
-fi
-
-$CMAKE -DCMAKE_INSTALL_PREFIX=$INSTALL_PREFIX -DBUILD_TESTING=OFF -DCMAKE_PREFIX_PATH=$INSTALL_DIR/lib/cmake $BSON_ONLY_OPTION "$SCRATCH_DIR"
-$CMAKE --build . --parallel
-if [ "$DESTDIR" ]; then
-   DESTDIR=$DESTDIR $CMAKE --build . --target install
-else
-   $CMAKE --build . --target install
-fi
-touch $INSTALL_DIR/lib/canary.txt
-
-# no kms-message components should be installed
-if test -f $INSTALL_DIR/include/kms_message/kms_message.h; then
-  echo "kms_message.h found!"
-  exit 1
-else
-  echo "kms_message.h check ok"
-fi
-if test -f $INSTALL_DIR/lib/libkms_message-static.a; then
-  echo "libkms_message-static.a found!"
-  exit 1
-else
-  echo "libkms_message-static.a check ok"
-fi
-if test -f $INSTALL_DIR/lib/cmake/kms_message/kms_message-config.cmake; then
-  echo "kms_message-config.cmake found!"
-  exit 1
-else
-  echo "kms_message-config.cmake check ok"
-fi
-
-ls -l $INSTALL_DIR/share/mongo-c-driver
-
-$CMAKE --build . --target uninstall
-
-set +o xtrace
-
-if test -f $INSTALL_DIR/lib/pkgconfig/bson$major.pc; then
-  echo "bson$major.pc found!"
-  exit 1
-else
-  echo "bson$major.pc check ok"
-fi
-if test -f $INSTALL_DIR/lib/cmake/bson-$version/bsonConfig.cmake; then
-  echo "bsonConfig.cmake found!"
-  exit 1
-else
-  echo "bsonConfig.cmake check ok"
-fi
-if test -f $INSTALL_DIR/lib/cmake/bson-$version/bsonConfigVersion.cmake; then
-  echo "bsonConfigVersion.cmake found!"
-  exit 1
-else
-  echo "bsonConfigVersion.cmake check ok"
-fi
-if test ! -f $INSTALL_DIR/lib/canary.txt; then
-  echo "canary.txt not found!"
-  exit 1
-else
-  echo "canary.txt check ok"
-fi
-if test ! -d $INSTALL_DIR/lib; then
-  echo "$INSTALL_DIR/lib not found!"
-  exit 1
-else
-  echo "$INSTALL_DIR/lib check ok"
-fi
-if [ -z "$BSON_ONLY" ]; then
-  if test -f $INSTALL_DIR/lib/pkgconfig/mongoc$major.pc; then
-    echo "mongoc$major.pc found!"
-    exit 1
-  else
-    echo "mongoc$major.pc check ok"
-  fi
-  if test -f $INSTALL_DIR/lib/cmake/mongoc-1.0/mongoc-1.0-config.cmake; then
-    echo "mongoc-1.0-config.cmake found!"
-    exit 1
-  else
-    echo "mongoc-1.0-config.cmake check ok"
-  fi
-  if test -f $INSTALL_DIR/lib/cmake/mongoc-1.0/mongoc-1.0-config-version.cmake; then
-    echo "mongoc-1.0-config-version.cmake found!"
-    exit 1
-  else
-    echo "mongoc-1.0-config-version.cmake check ok"
-  fi
-  if test -f $INSTALL_DIR/lib/cmake/mongoc-1.0/mongoc-targets.cmake; then
-    echo "mongoc-targets.cmake found!"
-    exit 1
-  else
-    echo "mongoc-targets.cmake check ok"
-  fi
-fi
-if test -f $INSTALL_DIR/include/bson-$version/bson/bson.h; then
-  echo "bson/bson.h found!"
-  exit 1
-else
-  echo "bson/bson.h check ok"
-fi
-if test -d $INSTALL_DIR/include/bson-$version; then
-  echo "$INSTALL_DIR/include/bson-$version found!"
-  exit 1
-else
-  echo "$INSTALL_DIR/include/bson-$version check ok"
-fi
-if [ -z "$BSON_ONLY" ]; then
-  if test -f $INSTALL_DIR/include/libmongoc-1.0/mongoc/mongoc.h; then
-    echo "mongoc/mongoc.h found!"
-    exit 1
-  else
-    echo "mongoc/mongoc.h check ok"
-  fi
-  if test -d $INSTALL_DIR/include/libmongoc-1.0; then
-    echo "$INSTALL_DIR/include/libmongoc-1.0 found!"
-    exit 1
-  else
-    echo "$INSTALL_DIR/include/libmongoc-1.0 check ok"
-  fi
-fi
-if test -f $INSTALL_DIR/share/mongo-c-driver/uninstall-bson.sh; then
-  echo "uninstall-bson.sh found!"
-  exit 1
-else
-  echo "uninstall-bson.sh check ok"
-fi
-if test -f $INSTALL_DIR/share/mongo-c-driver/uninstall.sh; then
-  echo "uninstall.sh found!"
-  exit 1
-else
-  echo "uninstall.sh check ok"
-fi
-if test -d $INSTALL_DIR/share/mongo-c-driver; then
-  echo "$INSTALL_DIR/share/mongo-c-driver found!"
-  exit 1
-else
-  echo "$INSTALL_DIR/share/mongo-c-driver check ok"
-fi
diff -pruN 2.0.2-1/.evergreen/scripts/link-sample-program-mingw-bson.cmd 2.1.0-1/.evergreen/scripts/link-sample-program-mingw-bson.cmd
--- 2.0.2-1/.evergreen/scripts/link-sample-program-mingw-bson.cmd	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/.evergreen/scripts/link-sample-program-mingw-bson.cmd	2025-08-14 18:37:23.000000000 +0000
@@ -1,45 +1,37 @@
+rem Load environment for Visual Studio 15 2017.
+rem https://learn.microsoft.com/en-us/cpp/build/building-on-the-command-line?view=msvc-150
+call "C:\Program Files (x86)\Microsoft Visual Studio\2017\Professional\VC\Auxiliary\Build\vcvars64.bat" || goto :error
+
 echo on
 echo
 
 set TAR=C:\cygwin\bin\tar
-set CMAKE_MAKE_PROGRAM=C:\mingw-w64\x86_64-4.9.1-posix-seh-rt_v3-rev1\mingw64\bin\mingw32-make.exe
-set CC=C:\mingw-w64\x86_64-4.9.1-posix-seh-rt_v3-rev1\mingw64\bin\gcc.exe
-rem Ensure Cygwin executables like sh.exe are not in PATH
-set "PATH=C:\cygwin\bin;C:\Windows\system32;C:\Windows;C:\mingw-w64\x86_64-4.9.1-posix-seh-rt_v3-rev1\mingw64\bin;C:\mongoc;src\libbson;src\libmongoc;C:\Program Files\Git\cmd"
 set LINK_STATIC=1
 
 set SRCROOT=%CD%
 set BUILD_DIR=%CD%\build-dir
-rmdir /S /Q %BUILD_DIR%
-mkdir %BUILD_DIR%
+rmdir /S /Q %BUILD_DIR% 2>nul || true
+mkdir %BUILD_DIR% || goto :error
 
 set INSTALL_DIR=%CD%\install-dir
-rmdir /S /Q %INSTALL_DIR%
-mkdir %INSTALL_DIR%
+rmdir /S /Q %INSTALL_DIR% 2>nul || true
+mkdir %INSTALL_DIR% || goto :error
 
 set PATH=%PATH%;%INSTALL_DIR%\bin
 
 set major=1
 set version=1.31.0
 
-cd %BUILD_DIR%
-robocopy "%SRCROOT%" "%BUILD_DIR%" /E /XD ".git" "%BUILD_DIR%" "_build" "cmake-build" /NP /NFL /NDL
+cd %BUILD_DIR% || goto :error
 
 rem Build libmongoc, with flags that the downstream R driver mongolite uses
-%CMAKE% -G "MinGW Makefiles" -DCMAKE_MAKE_PROGRAM=%CMAKE_MAKE_PROGRAM% -DCMAKE_INSTALL_PREFIX=%INSTALL_DIR% -DCMAKE_CFLAGS="-pedantic" -DCMAKE_PREFIX_PATH=%INSTALL_DIR%\lib\cmake -DENABLE_STATIC=ON .
-%CMAKE% --build . --parallel
-if errorlevel 1 (
-   exit /B 1
-)
-
-%CMAKE% --build . --target install
-if errorlevel 1 (
-   exit /B 1
-)
+%CMAKE% -G "Ninja" DCMAKE_INSTALL_PREFIX=%INSTALL_DIR% -DCMAKE_C_FLAGS="-pedantic" -DCMAKE_PREFIX_PATH=%INSTALL_DIR%\lib\cmake -DENABLE_STATIC=ON .. || goto :error
+%CMAKE% --build . --parallel || goto :error
+%CMAKE% --build . --target install || goto :error
 
 rem Test our pkg-config file
 set EXAMPLE_DIR=%SRCROOT%\src\libbson\examples\
-cd %EXAMPLE_DIR%
+cd %EXAMPLE_DIR% || goto :error
 
 rem Proceed from here once we have pkg-config on Windows
 exit /B 0
@@ -51,13 +43,15 @@ for /f %%i in ('pkg-config --libs --cfla
 
 echo PKG_CONFIG_OUT is %PKG_CONFIG_OUT%
 
-%CC% -o hello_bson hello_bson.c %PKG_CONFIG_OUT%
+%CC% -o hello_bson hello_bson.c %PKG_CONFIG_OUT% || goto :error
 
-rem Works on windows-64-vs2013-compile, VS 2013 is a.k.a. "Visual Studio 12"
-rem And yes, they should've named the flag "dependencies".
-"c:\Program Files (x86)\Microsoft Visual Studio 12.0\VC\bin\dumpbin.exe" /dependents Debug\hello_bson.exe
+dumpbin.exe /dependents Debug\hello_bson.exe || goto :error
 
 rem Add DLLs to PATH
 set PATH=%PATH%;%INSTALL_DIR%\bin
 
-Debug\hello_bson.exe %MONGODB_EXAMPLE_URI%
+Debug\hello_bson.exe %MONGODB_EXAMPLE_URI% || goto :error
+
+goto :EOF
+:error
+exit /B %errorlevel%
diff -pruN 2.0.2-1/.evergreen/scripts/link-sample-program-mingw.cmd 2.1.0-1/.evergreen/scripts/link-sample-program-mingw.cmd
--- 2.0.2-1/.evergreen/scripts/link-sample-program-mingw.cmd	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/.evergreen/scripts/link-sample-program-mingw.cmd	2025-08-14 18:37:23.000000000 +0000
@@ -1,45 +1,37 @@
+rem Load environment for Visual Studio 15 2017.
+rem https://learn.microsoft.com/en-us/cpp/build/building-on-the-command-line?view=msvc-150
+call "C:\Program Files (x86)\Microsoft Visual Studio\2017\Professional\VC\Auxiliary\Build\vcvars64.bat" || goto :error
+
 echo on
 echo
 
 rem Use DENABLE_SSL=OFF. Windows hosts do not have a MinGW ABI compatible OpenSSL install.
 set CMAKE_FLAGS=-DENABLE_SSL=OFF -DENABLE_SASL=CYRUS
 set TAR=C:\cygwin\bin\tar
-set CMAKE_MAKE_PROGRAM=C:\mingw-w64\x86_64-4.9.1-posix-seh-rt_v3-rev1\mingw64\bin\mingw32-make.exe
-set CC=C:\mingw-w64\x86_64-4.9.1-posix-seh-rt_v3-rev1\mingw64\bin\gcc.exe
-rem Ensure Cygwin executables like sh.exe are not in PATH
-set "PATH=C:\cygwin\bin;C:\Windows\system32;C:\Windows;C:\mingw-w64\x86_64-4.9.1-posix-seh-rt_v3-rev1\mingw64\bin;C:\mongoc;src\libbson;src\libmongoc;C:\Program Files\Git\cmd"
 
 set SRCROOT=%CD%
 set BUILD_DIR=%CD%\build-dir
-rmdir /S /Q %BUILD_DIR%
-mkdir %BUILD_DIR%
+rmdir /S /Q %BUILD_DIR% 2>nul || true
+mkdir %BUILD_DIR% || goto :error
 
 set INSTALL_DIR=%CD%\install-dir
-rmdir /S /Q %INSTALL_DIR%
-mkdir %INSTALL_DIR%
+rmdir /S /Q %INSTALL_DIR% 2>nul || true
+mkdir %INSTALL_DIR% || goto :error
 
 set PATH=%PATH%;%INSTALL_DIR%\bin
 
 set major=1
 
-cd %BUILD_DIR%
-robocopy "%SRCROOT%" "%BUILD_DIR%" /E /XD ".git" "%BUILD_DIR%" "_build" "cmake-build" /NP /NFL /NDL
+cd %BUILD_DIR% || goto :error
 
 rem Build libmongoc, with flags that the downstream R driver mongolite uses
-%CMAKE% -G "MinGW Makefiles" -DCMAKE_MAKE_PROGRAM=%CMAKE_MAKE_PROGRAM% -DCMAKE_INSTALL_PREFIX=%INSTALL_DIR% -DCMAKE_CFLAGS="-pedantic" -DCMAKE_PREFIX_PATH=%INSTALL_DIR%\lib\cmake %CMAKE_FLAGS% .
-%CMAKE% --build . --parallel
-if errorlevel 1 (
-   exit /B 1
-)
-
-%CMAKE% --build . --target install
-if errorlevel 1 (
-   exit /B 1
-)
+%CMAKE% -G "Ninja" -DCMAKE_INSTALL_PREFIX=%INSTALL_DIR% -DCMAKE_C_FLAGS="-pedantic" -DCMAKE_PREFIX_PATH=%INSTALL_DIR%\lib\cmake %CMAKE_FLAGS% .. || goto :error
+%CMAKE% --build . --parallel || goto :error
+%CMAKE% --build . --target install || goto :error
 
 rem Test our pkg-config file
 set EXAMPLE_DIR=%SRCROOT%\src\libmongoc\examples\
-cd %EXAMPLE_DIR%
+cd %EXAMPLE_DIR% || goto :error
 
 rem Proceed from here once we have pkg-config on Windows
 exit /B 0
@@ -51,13 +43,15 @@ for /f %%i in ('pkg-config --libs --cfla
 
 echo PKG_CONFIG_OUT is %PKG_CONFIG_OUT%
 
-%CC% -o hello_mongoc hello_mongoc.c %PKG_CONFIG_OUT%
+%CC% -o hello_mongoc hello_mongoc.c %PKG_CONFIG_OUT% || goto :error
 
-rem Works on windows-64-vs2013-compile, VS 2013 is a.k.a. "Visual Studio 12"
-rem And yes, they should've named the flag "dependencies".
-"c:\Program Files (x86)\Microsoft Visual Studio 12.0\VC\bin\dumpbin.exe" /dependents Debug\hello_mongoc.exe
+dumpbin.exe /dependents Debug\hello_mongoc.exe || goto :error
 
 rem Add DLLs to PATH
 set PATH=%PATH%;%INSTALL_DIR%\bin
 
-Debug\hello_mongoc.exe %MONGODB_EXAMPLE_URI%
+Debug\hello_mongoc.exe %MONGODB_EXAMPLE_URI% || goto :error
+
+goto :EOF
+:error
+exit /B %errorlevel%
diff -pruN 2.0.2-1/.evergreen/scripts/link-sample-program-msvc-bson.cmd 2.1.0-1/.evergreen/scripts/link-sample-program-msvc-bson.cmd
--- 2.0.2-1/.evergreen/scripts/link-sample-program-msvc-bson.cmd	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/.evergreen/scripts/link-sample-program-msvc-bson.cmd	2025-08-14 18:37:23.000000000 +0000
@@ -4,6 +4,10 @@ REM   LINK_STATIC              Whether t
 rem Ensure Cygwin executables like sh.exe are not in PATH
 rem set PATH=C:\Windows\system32;C:\Windows
 
+rem Load environment for Visual Studio 15 2017.
+rem https://learn.microsoft.com/en-us/cpp/build/building-on-the-command-line?view=msvc-150
+call "C:\Program Files (x86)\Microsoft Visual Studio\2017\Professional\VC\Auxiliary\Build\vcvars64.bat" || goto :error
+
 echo on
 echo
 
@@ -11,28 +15,25 @@ set TAR=C:\cygwin\bin\tar
 
 set SRCROOT=%CD%
 set BUILD_DIR=%CD%\build-dir
-rmdir /S /Q %BUILD_DIR%
-mkdir %BUILD_DIR%
+rmdir /S /Q %BUILD_DIR% 2>nul || true
+mkdir %BUILD_DIR% || goto :error
 
 set INSTALL_DIR=%CD%\install-dir
-rmdir /S /Q %INSTALL_DIR%
-mkdir %INSTALL_DIR%
+rmdir /S /Q %INSTALL_DIR% 2>nul || true
+mkdir %INSTALL_DIR% || goto :error
 
 set PATH=%PATH%;%INSTALL_DIR%\bin
-rem Set path to dumpbin.exe and other VS tools.
-call "C:\Program Files (x86)\Microsoft Visual Studio\2017\Professional\VC\Auxiliary\Build\vcvars64.bat"
 
-cd %BUILD_DIR%
-robocopy "%SRCROOT%" "%BUILD_DIR%" /E /XD ".git" "%BUILD_DIR%" "_build" "cmake-build" /NP /NFL /NDL
+cd %BUILD_DIR% || goto :error
 
 if "%LINK_STATIC%"=="1" (
-  %CMAKE% -G "Visual Studio 15 2017" -A x64 -DCMAKE_INSTALL_PREFIX=%INSTALL_DIR% -DENABLE_TESTS=OFF .
+  %CMAKE% -G "Visual Studio 15 2017" -A x64 -DCMAKE_INSTALL_PREFIX=%INSTALL_DIR% -DENABLE_TESTS=OFF .. || goto :error
 ) else (
-  %CMAKE% -G "Visual Studio 15 2017" -A x64 -DCMAKE_INSTALL_PREFIX=%INSTALL_DIR% -DENABLE_TESTS=OFF -DENABLE_STATIC=OFF .
+  %CMAKE% -G "Visual Studio 15 2017" -A x64 -DCMAKE_INSTALL_PREFIX=%INSTALL_DIR% -DENABLE_TESTS=OFF -DENABLE_STATIC=OFF .. || goto :error
 )
 
-%CMAKE% --build . --target ALL_BUILD --config "Debug" -- /m
-%CMAKE% --build . --target INSTALL --config "Debug" -- /m
+%CMAKE% --build . --config "Debug" --target ALL_BUILD -- /m || goto :error
+%CMAKE% --build . --config "Debug" --target INSTALL -- /m || goto :error
 
 rem Test our CMake package config file with CMake's find_package command.
 set EXAMPLE_DIR=%SRCROOT%\src\libbson\examples\cmake\find_package
@@ -41,11 +42,15 @@ if "%LINK_STATIC%"=="1" (
   set EXAMPLE_DIR="%EXAMPLE_DIR%_static"
 )
 
-cd %EXAMPLE_DIR%
-%CMAKE% -G "Visual Studio 15 2017" -A x64 -DCMAKE_PREFIX_PATH=%INSTALL_DIR%\lib\cmake .
-%CMAKE% --build . --target ALL_BUILD --config "Debug" -- /m
+cd %EXAMPLE_DIR% || goto :error
+%CMAKE% -G "Visual Studio 15 2017" -A x64 -DCMAKE_PREFIX_PATH=%INSTALL_DIR%\lib\cmake . || goto :error
+%CMAKE% --build . --config "Debug" --target ALL_BUILD -- /m || goto :error
 
 rem Yes, they should've named it "dependencies".
-dumpbin.exe /dependents Debug\hello_bson.exe
+dumpbin.exe /dependents Debug\hello_bson.exe || goto :error
+
+Debug\hello_bson.exe || goto :error
 
-Debug\hello_bson.exe
+goto :EOF
+:error
+exit /B %errorlevel%
diff -pruN 2.0.2-1/.evergreen/scripts/link-sample-program-msvc.cmd 2.1.0-1/.evergreen/scripts/link-sample-program-msvc.cmd
--- 2.0.2-1/.evergreen/scripts/link-sample-program-msvc.cmd	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/.evergreen/scripts/link-sample-program-msvc.cmd	2025-08-14 18:37:23.000000000 +0000
@@ -6,6 +6,10 @@ REM   ENABLE_SNAPPY            Enable Sn
 rem Ensure Cygwin executables like sh.exe are not in PATH
 rem set PATH=C:\Windows\system32;C:\Windows
 
+rem Load environment for Visual Studio 15 2017.
+rem https://learn.microsoft.com/en-us/cpp/build/building-on-the-command-line?view=msvc-150
+call "C:\Program Files (x86)\Microsoft Visual Studio\2017\Professional\VC\Auxiliary\Build\vcvars64.bat" || goto :error
+
 echo on
 echo
 
@@ -13,44 +17,40 @@ set TAR=C:\cygwin\bin\tar
 
 set SRCROOT=%CD%
 set BUILD_DIR=%CD%\build-dir
-rmdir /S /Q %BUILD_DIR%
-mkdir %BUILD_DIR%
+rmdir /S /Q %BUILD_DIR% 2>nul || true
+mkdir %BUILD_DIR% || goto :error
 
 set INSTALL_DIR=%CD%\install-dir
-rmdir /S /Q %INSTALL_DIR%
-mkdir %INSTALL_DIR%
+rmdir /S /Q %INSTALL_DIR% 2>nul || true
+mkdir %INSTALL_DIR% || goto :error
 
 set PATH=%PATH%;%INSTALL_DIR%\bin
 
-rem Set path to dumpbin.exe and other VS tools.
-call "C:\Program Files (x86)\Microsoft Visual Studio\2017\BuildTools\VC\Auxiliary\Build\vcvars64.bat"
-
-cd %BUILD_DIR%
-robocopy "%SRCROOT%" "%BUILD_DIR%" /E /XD ".git" "%BUILD_DIR%" "_build" "cmake-build" /NP /NFL /NDL
+cd %BUILD_DIR% || goto :error
 
 if "%ENABLE_SNAPPY%"=="1" (
   rem Enable Snappy
-  curl -sS --retry 5 -LO https://github.com/google/snappy/archive/1.1.7.tar.gz
-  %TAR% xzf 1.1.7.tar.gz
-  cd snappy-1.1.7
-  %CMAKE% -G "Visual Studio 15 2017" -A x64 -DCMAKE_INSTALL_PREFIX=%INSTALL_DIR% .
-  %CMAKE% --build . --target ALL_BUILD --config "Debug" -- /m
-  %CMAKE% --build . --target INSTALL --config "Debug" -- /m
+  curl -sS --retry 5 -LO https://github.com/google/snappy/archive/1.1.7.tar.gz || goto :error
+  %TAR% xzf 1.1.7.tar.gz || goto :error
+  cd snappy-1.1.7 || goto :error
+  %CMAKE% -G "Visual Studio 15 2017" -A x64 -DCMAKE_INSTALL_PREFIX=%INSTALL_DIR% -S snappy-1.1.7 -B snappy-1.1.7-build || goto :error
+  %CMAKE% --build snappy-1.1.7-build --config "Debug" --target ALL_BUILD -- /m || goto :error
+  %CMAKE% --build snappy-1.1.7-build --config "Debug" --target INSTALL -- /m || goto :error
   set SNAPPY_OPTION=-DENABLE_SNAPPY=ON
 ) else (
   set SNAPPY_OPTION=-DENABLE_SNAPPY=OFF
 )
 
-cd %BUILD_DIR%
+cd %BUILD_DIR% || goto :error
 rem Build libmongoc
 if "%ENABLE_SSL%"=="1" (
-  %CMAKE% -G "Visual Studio 15 2017" -A x64 -DCMAKE_PREFIX_PATH=%INSTALL_DIR%\lib\cmake -DCMAKE_INSTALL_PREFIX=%INSTALL_DIR% -DENABLE_SSL=WINDOWS %ENABLE_SNAPPY_OPTION% .
+  %CMAKE% -G "Visual Studio 15 2017" -A x64 -DCMAKE_PREFIX_PATH=%INSTALL_DIR%\lib\cmake -DCMAKE_INSTALL_PREFIX=%INSTALL_DIR% -DENABLE_SSL=WINDOWS %ENABLE_SNAPPY_OPTION% .. || goto :error
 ) else (
-  %CMAKE% -G "Visual Studio 15 2017" -A x64 -DCMAKE_PREFIX_PATH=%INSTALL_DIR%\lib\cmake -DCMAKE_INSTALL_PREFIX=%INSTALL_DIR% -DENABLE_SSL=OFF %ENABLE_SNAPPY_OPTION% .
+  %CMAKE% -G "Visual Studio 15 2017" -A x64 -DCMAKE_PREFIX_PATH=%INSTALL_DIR%\lib\cmake -DCMAKE_INSTALL_PREFIX=%INSTALL_DIR% -DENABLE_SSL=OFF %ENABLE_SNAPPY_OPTION% .. || goto :error
 )
 
-%CMAKE% --build . --target ALL_BUILD --config "Debug" -- /m
-%CMAKE% --build . --target INSTALL --config "Debug" -- /m
+%CMAKE% --build . --config "Debug" --target ALL_BUILD -- /m || goto :error
+%CMAKE% --build . --config "Debug" --target INSTALL -- /m || goto :error
 
 rem Test our CMake package config file with CMake's find_package command.
 set EXAMPLE_DIR=%SRCROOT%\src\libmongoc\examples\cmake\find_package
@@ -59,18 +59,22 @@ if "%LINK_STATIC%"=="1" (
   set EXAMPLE_DIR="%EXAMPLE_DIR%_static"
 )
 
-cd %EXAMPLE_DIR%
+cd %EXAMPLE_DIR% || goto :error
 
 if "%ENABLE_SSL%"=="1" (
-  cp ..\..\..\tests\x509gen\client.pem .
-  cp ..\..\..\tests\x509gen\ca.pem .
+  cp ..\..\..\tests\x509gen\client.pem . || goto :error
+  cp ..\..\..\tests\x509gen\ca.pem . || goto :error
   set MONGODB_EXAMPLE_URI="mongodb://localhost/?ssl=true&sslclientcertificatekeyfile=client.pem&sslcertificateauthorityfile=ca.pem&sslallowinvalidhostnames=true"
 )
 
-%CMAKE% -G "Visual Studio 15 2017" -A x64 -DCMAKE_PREFIX_PATH=%INSTALL_DIR%\lib\cmake .
-%CMAKE% --build . --target ALL_BUILD --config "Debug" -- /m
+%CMAKE% -G "Visual Studio 15 2017" -A x64 -DCMAKE_PREFIX_PATH=%INSTALL_DIR%\lib\cmake . || goto :error
+%CMAKE% --build . --config "Debug" --target ALL_BUILD -- /m || goto :error
 
 rem Yes, they should've named it "dependencies".
-dumpbin.exe /dependents Debug\hello_mongoc.exe
+dumpbin.exe /dependents Debug\hello_mongoc.exe || goto :error
+
+Debug\hello_mongoc.exe %MONGODB_EXAMPLE_URI% || goto :error
 
-Debug\hello_mongoc.exe %MONGODB_EXAMPLE_URI%
+goto :EOF
+:error
+exit /B %errorlevel%
diff -pruN 2.0.2-1/.evergreen/scripts/run-auth-tests.sh 2.1.0-1/.evergreen/scripts/run-auth-tests.sh
--- 2.0.2-1/.evergreen/scripts/run-auth-tests.sh	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/.evergreen/scripts/run-auth-tests.sh	2025-08-14 18:37:23.000000000 +0000
@@ -7,7 +7,7 @@ set +o xtrace # Don't echo commands
 
 # shellcheck source=.evergreen/scripts/env-var-utils.sh
 . "$(dirname "${BASH_SOURCE[0]}")/env-var-utils.sh"
-. "$(dirname "${BASH_SOURCE[0]}")/use-tools.sh" paths
+. "$(dirname "${BASH_SOURCE[0]}")/use-tools.sh" platform paths
 
 declare script_dir
 script_dir="$(to_absolute "$(dirname "${BASH_SOURCE[0]}")")"
@@ -24,12 +24,20 @@ secrets_dir="$(to_absolute "${mongoc_dir
 mkdir -p "${secrets_dir}"
 chmod 700 "${secrets_dir}"
 
-# Create certificate to test X509 auth with Atlas:
+# Create certificate to test X509 auth with Atlas on cloud-prod:
 atlas_x509_path="${secrets_dir:?}/atlas_x509.pem"
 echo "${atlas_x509_cert_base64:?}" | base64 --decode > "${secrets_dir:?}/atlas_x509.pem"
 # Fix path on Windows:
 if $IS_WINDOWS; then
-    atlas_x509_path="$(cygpath -m "${secrets_dir:?}/atlas_x509.pem")"
+    atlas_x509_path="$(cygpath -m "${atlas_x509_path}")"
+fi
+
+# Create certificate to test X509 auth with Atlas on cloud-dev
+atlas_x509_dev_path="${secrets_dir:?}/atlas_x509_dev.pem"
+echo "${atlas_x509_dev_cert_base64:?}" | base64 --decode > "${atlas_x509_dev_path:?}"
+# Fix path on Windows:
+if $IS_WINDOWS; then
+    atlas_x509_dev_path="$(cygpath -m "${atlas_x509_dev_path}")"
 fi
 
 # Create Kerberos config and keytab files.
@@ -127,11 +135,27 @@ elif command -v otool >/dev/null; then
   LD_LIBRARY_PATH="${openssl_lib_prefix}" otool -L "${test_gssapi}" | grep "libssl" || true
 fi
 
+maybe_skip() {
+  if true; then
+    # TODO: Remove if-block when resolving CDRIVER-5995.
+    echo "Skipping test until DEVPROD-9029 is resolved."
+    return 
+  fi
+
+  if $IS_ZSERIES; then
+    # TODO: Remove if-block when resolving CDRIVER-5990.
+    echo "Skipping test until DEVPROD-16954 is resolved."
+    return
+  fi
+  # Run the test command:
+  "$@"
+}
+
 if [[ "${ssl}" != "OFF" ]]; then
   # FIXME: CDRIVER-2008 for the cygwin check
   if [[ "${OSTYPE}" != "cygwin" ]]; then
     echo "Authenticating using X.509"
-    LD_LIBRARY_PATH="${openssl_lib_prefix}" "${ping}" "mongodb://CN=client,OU=kerneluser,O=10Gen,L=New York City,ST=New York,C=US@${auth_host}/?ssl=true&authMechanism=MONGODB-X509&sslClientCertificateKeyFile=src/libmongoc/tests/x509gen/ldaptest-client-key-and-cert.pem&sslCertificateAuthorityFile=src/libmongoc/tests/x509gen/ldaptest-ca-cert.crt&sslAllowInvalidHostnames=true&${c_timeout}"
+    LD_LIBRARY_PATH="${openssl_lib_prefix}" maybe_skip "${ping}" "mongodb://CN=client,OU=kerneluser,O=10Gen,L=New York City,ST=New York,C=US@${auth_host}/?ssl=true&authMechanism=MONGODB-X509&sslClientCertificateKeyFile=src/libmongoc/tests/x509gen/ldaptest-client-key-and-cert.pem&sslCertificateAuthorityFile=src/libmongoc/tests/x509gen/ldaptest-ca-cert.crt&sslAllowInvalidHostnames=true&${c_timeout}"
   fi
   echo "Connecting to Atlas Free Tier"
   LD_LIBRARY_PATH="${openssl_lib_prefix}" "${ping}" "${atlas_free:?}&${c_timeout}"
@@ -171,24 +195,27 @@ if [[ "${ssl}" != "OFF" ]]; then
     LD_LIBRARY_PATH="${openssl_lib_prefix}" "${ping}" "${atlas_serverless:?}&${c_timeout}"
   fi
 
-  echo "Connecting to Atlas with X509"
+  echo "Connecting to Atlas (cloud-prod) with X509"
   LD_LIBRARY_PATH="${openssl_lib_prefix}" "${ping}" "${atlas_x509:?}&tlsCertificateKeyFile=${atlas_x509_path}&${c_timeout}"
 
+  echo "Connecting to Atlas (cloud-dev) with X509"
+  LD_LIBRARY_PATH="${openssl_lib_prefix}" "${ping}" "${atlas_x509_dev:?}&tlsCertificateKeyFile=${atlas_x509_dev_path}&${c_timeout}"
+
 fi
 
 echo "Authenticating using PLAIN"
-LD_LIBRARY_PATH="${openssl_lib_prefix}" "${ping}" "mongodb://${auth_plain:?}@${auth_host}/?authMechanism=PLAIN&${c_timeout}"
+LD_LIBRARY_PATH="${openssl_lib_prefix}" maybe_skip "${ping}" "mongodb://${auth_plain:?}@${auth_host}/?authMechanism=PLAIN&${c_timeout}"
 
 echo "Authenticating using default auth mechanism"
 # Though the auth source is named "mongodb-cr", authentication uses the default mechanism (currently SCRAM-SHA-1).
-LD_LIBRARY_PATH="${openssl_lib_prefix}" "${ping}" "mongodb://${auth_mongodbcr:?}@${auth_host}/mongodb-cr?${c_timeout}"
+LD_LIBRARY_PATH="${openssl_lib_prefix}" maybe_skip "${ping}" "mongodb://${auth_mongodbcr:?}@${auth_host}/mongodb-cr?${c_timeout}"
 
 if [[ "${sasl}" != "OFF" ]]; then
   echo "Authenticating using GSSAPI"
-  LD_LIBRARY_PATH="${openssl_lib_prefix}" "${ping}" "mongodb://${auth_gssapi:?}@${auth_host}/?authMechanism=GSSAPI&${c_timeout}"
+  LD_LIBRARY_PATH="${openssl_lib_prefix}" maybe_skip "${ping}" "mongodb://${auth_gssapi:?}@${auth_host}/?authMechanism=GSSAPI&${c_timeout}"
 
   echo "Authenticating with CANONICALIZE_HOST_NAME"
-  LD_LIBRARY_PATH="${openssl_lib_prefix}" "${ping}" "mongodb://${auth_gssapi:?}@${ip_addr}/?authMechanism=GSSAPI&authMechanismProperties=CANONICALIZE_HOST_NAME:true&${c_timeout}"
+  LD_LIBRARY_PATH="${openssl_lib_prefix}" maybe_skip "${ping}" "mongodb://${auth_gssapi:?}@${ip_addr}/?authMechanism=GSSAPI&authMechanismProperties=CANONICALIZE_HOST_NAME:true&${c_timeout}"
 
   declare ld_preload="${LD_PRELOAD:-}"
   if [[ "${ASAN:-}" == "on" ]]; then
@@ -196,13 +223,13 @@ if [[ "${sasl}" != "OFF" ]]; then
   fi
 
   echo "Test threaded GSSAPI auth"
-  LD_LIBRARY_PATH="${openssl_lib_prefix}" MONGOC_TEST_GSSAPI_HOST="${auth_host}" MONGOC_TEST_GSSAPI_USER="${auth_gssapi}" LD_PRELOAD="${ld_preload:-}" "${test_gssapi}"
+  LD_LIBRARY_PATH="${openssl_lib_prefix}" MONGOC_TEST_GSSAPI_HOST="${auth_host}" MONGOC_TEST_GSSAPI_USER="${auth_gssapi}" LD_PRELOAD="${ld_preload:-}" maybe_skip "${test_gssapi}"
   echo "Threaded GSSAPI auth OK"
 
   if [[ "${OSTYPE}" == "cygwin" ]]; then
     echo "Authenticating using GSSAPI (service realm: LDAPTEST.10GEN.CC)"
-    LD_LIBRARY_PATH="${openssl_lib_prefix}" "${ping}" "mongodb://${auth_crossrealm:?}@${auth_host}/?authMechanism=GSSAPI&authMechanismProperties=SERVICE_REALM:LDAPTEST.10GEN.CC&${c_timeout}"
+    LD_LIBRARY_PATH="${openssl_lib_prefix}" maybe_skip "${ping}" "mongodb://${auth_crossrealm:?}@${auth_host}/?authMechanism=GSSAPI&authMechanismProperties=SERVICE_REALM:LDAPTEST.10GEN.CC&${c_timeout}"
     echo "Authenticating using GSSAPI (UTF-8 credentials)"
-    LD_LIBRARY_PATH="${openssl_lib_prefix}" "${ping}" "mongodb://${auth_gssapi_utf8:?}@${auth_host}/?authMechanism=GSSAPI&${c_timeout}"
+    LD_LIBRARY_PATH="${openssl_lib_prefix}" maybe_skip "${ping}" "mongodb://${auth_gssapi_utf8:?}@${auth_host}/?authMechanism=GSSAPI&${c_timeout}"
   fi
 fi
diff -pruN 2.0.2-1/.evergreen/scripts/run-tests-mingw.bat 2.1.0-1/.evergreen/scripts/run-tests-mingw.bat
--- 2.0.2-1/.evergreen/scripts/run-tests-mingw.bat	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/.evergreen/scripts/run-tests-mingw.bat	2025-08-14 18:37:23.000000000 +0000
@@ -1,17 +1,15 @@
-set PATH=C:\Windows\system32;C:\Windows;C:\mingw-w64\x86_64-4.9.1-posix-seh-rt_v3-rev1\mingw64\bin;C:\mongo-c-driver\bin
-
-rem "make install" would work, except we run tests on different Evergreen hosts,
-rem in different working directories, than where the driver was built. This
-rem causes errors in "make install" like:
-rem CMake Error at cmake_install cannot find
-rem "C:/data/mci/d3ba3391950aca9119e841818a8884bc/mongoc/src/libbson/libbson-1.0.dll"
-rem
-rem So just copy files manually
-
-rmdir /Q /S C:\mongo-c-driver
-md C:\mongo-c-driver
-md C:\mongo-c-driver\bin
-copy /Y libmongoc-1.0.dll C:\mongo-c-driver\bin
-copy /Y cmake-build\src\libbson\libbson-1.0.dll C:\mongo-c-driver\bin
-
-.\cmake-build\src\libmongoc\test-libmongoc.exe --no-fork -d -F test-results.json --skip-tests .evergreen\etc\skip-tests.txt
+rem "make install" would work, except we run tests on different Evergreen hosts,
+rem in different working directories, than where the driver was built. This
+rem causes errors in "make install" like:
+rem CMake Error at cmake_install cannot find
+rem "C:/data/mci/d3ba3391950aca9119e841818a8884bc/mongoc/src/libbson/libbson-1.0.dll"
+rem
+rem So just copy files manually
+
+rmdir /Q /S C:\mongo-c-driver
+md C:\mongo-c-driver
+md C:\mongo-c-driver\bin
+copy /Y libmongoc-1.0.dll C:\mongo-c-driver\bin
+copy /Y cmake-build\src\libbson\libbson-1.0.dll C:\mongo-c-driver\bin
+
+.\cmake-build\src\libmongoc\test-libmongoc.exe --no-fork -d -F test-results.json --skip-tests .evergreen\etc\skip-tests.txt
diff -pruN 2.0.2-1/.evergreen/scripts/run-tests.sh 2.1.0-1/.evergreen/scripts/run-tests.sh
--- 2.0.2-1/.evergreen/scripts/run-tests.sh	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/.evergreen/scripts/run-tests.sh	2025-08-14 18:37:23.000000000 +0000
@@ -168,9 +168,9 @@ wait_for_server() {
   return 1
 }
 
-if [[ "${CC}" =~ mingw ]]; then
+if [[ "${OSTYPE:?}" == cygwin && "${CC}" =~ gcc ]]; then
   echo "Waiting for simple HTTP server to start..."
-  wait_for_server "simple HTTP" 8000
+  wait_for_server "simple HTTP" 18000
   echo "Waiting for simple HTTP server to start... done."
 
   chmod -f +x ./cmake-build/src/libmongoc/test-libmongoc.exe
diff -pruN 2.0.2-1/.evergreen/scripts/sbom.sh 2.1.0-1/.evergreen/scripts/sbom.sh
--- 2.0.2-1/.evergreen/scripts/sbom.sh	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/.evergreen/scripts/sbom.sh	2025-08-14 18:37:23.000000000 +0000
@@ -3,9 +3,8 @@
 set -o errexit
 set -o pipefail
 
-: "${artifactory_username:?}"
-: "${artifactory_password:?}"
 : "${branch_name:?}"
+: "${DOCKER_CONFIG:?}"
 : "${KONDUKTO_TOKEN:?}"
 
 command -v podman >/dev/null || {
@@ -13,9 +12,7 @@ command -v podman >/dev/null || {
   exit 1
 }
 
-podman login --password-stdin --username "${artifactory_username:?}" artifactory.corp.mongodb.com <<<"${artifactory_password:?}"
-
-silkbomb="artifactory.corp.mongodb.com/release-tools-container-registry-public-local/silkbomb:2.0"
+silkbomb="901841024863.dkr.ecr.us-east-1.amazonaws.com/release-infrastructure/silkbomb:2.0"
 
 # Ensure latest version of SilkBomb is being used.
 podman pull "${silkbomb:?}"
diff -pruN 2.0.2-1/.gitattributes 2.1.0-1/.gitattributes
--- 2.0.2-1/.gitattributes	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/.gitattributes	2025-08-14 18:37:23.000000000 +0000
@@ -1 +1,2 @@
 tests/binary/* text eol=lf
+*.bat text eol=crlf
diff -pruN 2.0.2-1/CMakeLists.txt 2.1.0-1/CMakeLists.txt
--- 2.0.2-1/CMakeLists.txt	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/CMakeLists.txt	2025-08-14 18:37:23.000000000 +0000
@@ -1,4 +1,4 @@
-cmake_minimum_required (VERSION 3.15)
+cmake_minimum_required (VERSION 3.15...4.0)
 
 list (INSERT CMAKE_MODULE_PATH 0 "${CMAKE_CURRENT_LIST_DIR}/build/cmake")
 # Defines BUILD_VERSION, which we use throughout:
@@ -28,6 +28,7 @@ include(FeatureSummary)
 include (MongoSettings)
 include (MongoPlatform)
 include (GeneratePkgConfig)
+include (VerifyHeaders)
 
 # Subcomponents:
 mongo_bool_setting(ENABLE_MONGOC "Enable the build of libmongoc libraries (The MongoDB C database driver)")
@@ -348,11 +349,6 @@ if(WIN32)
    set (CMAKE_IMPORT_LIBRARY_SUFFIX .dll.lib)
 endif()
 
-# https://cmake.org/cmake/help/v3.11/policy/CMP0042.html
-# Enable a CMake 3.0+ policy that sets CMAKE_MACOSX_RPATH by default, and
-# silence a CMake 3.11 warning that the old behavior is deprecated.
-cmake_policy (SET CMP0042 NEW)
-
 # By default, ensure conformance with a minimum C standard.
 # Required extensions to the language (i.e. POSIX) are (re)enabled further below.
 if (NOT DEFINED CMAKE_C_STANDARD)
diff -pruN 2.0.2-1/CONTRIBUTING.md 2.1.0-1/CONTRIBUTING.md
--- 2.0.2-1/CONTRIBUTING.md	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/CONTRIBUTING.md	2025-08-14 18:37:23.000000000 +0000
@@ -111,27 +111,17 @@ a block comment like the following:
 Public functions do not need these comment blocks, since they are documented in
 the .rst files.
 
-To build the documentation, it is recommended to use the Poetry-managed Python
-project to ensure that the exact tooling versions match. If you do not have
-Poetry installed, you can use the `poetry.sh` or `poetry.ps1` scripts in the
-`tools/` directory. First, install dependencies:
+To build the documentation, it is recommended to run Sphinx commands through `uv`:
 
-```sh
-./tools/poetry.sh install --with=docs
-```
-
-Then, execute `sphinx-build` in the Python environment, using the paths to the
-documentation to be generated:
-
-```sh
-./tools/poetry.sh run sphinx-build -WEn -bhtml src/libmongoc/doc/ src/libmongoc/doc/html
+```bash
+uv run --frozen sphinx-build -WEn -bhtml src/libmongoc/doc/ src/libmongoc/doc/html
 ```
 
 `sphinx-autobuild` can be used to serve docs locally. This can be convenient when editing. Files are rebuilt
 when changes are detected:
 
-```sh
-./tools/poetry.sh run sphinx-autobuild -b html src/libmongoc/doc/ src/libmongoc/doc/html --re-ignore ".*.pickle" --re-ignore ".*.doctree" -j auto
+```bash
+uv run --frozen --with 'sphinx-autobuild' sphinx-autobuild -b html src/libmongoc/doc/ src/libmongoc/doc/html --re-ignore ".*.pickle" --re-ignore ".*.doctree" -j auto
 ```
 
 ### Testing
@@ -189,6 +179,13 @@ If you start `mongod` with SSL, set thes
 * `MONGOC_TEST_SSL_CRL_FILE`: path to a certificate revocation list.
 * `MONGOC_TEST_SSL_WEAK_CERT_VALIDATION`: set to `on` to relax the client's
   validation of the server's certificate.
+* `MONGOC_TEST_SCHANNEL_CRL=on`: set to `on` to enable Windows Secure Channel tests loading CRL files.
+  * If CRL tests abort before deleting the CRL file, this may cause later test errors like `The certificate is revoked`. Manually remove the CRL file with:
+    ```powershell
+    $crl = ".\src\libmongoc\tests\x509gen\crl.pem"
+    $fingerprint = (openssl crl -in ".\src\libmongoc\tests\x509gen\crl.pem" -noout -fingerprint) -replace 'SHA1 Fingerprint=', '' -replace ':', ''
+    certutil -delstore Root $fingerprint
+    ```
 
 The SASL / GSSAPI / Kerberos tests are skipped by default. To run them, set up a
 separate `mongod` with Kerberos and set its host and Kerberos principal name
diff -pruN 2.0.2-1/Earthfile 2.1.0-1/Earthfile
--- 2.0.2-1/Earthfile	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/Earthfile	2025-08-14 18:37:23.000000000 +0000
@@ -1,30 +1,19 @@
-VERSION --arg-scope-and-set --pass-args 0.7
+VERSION --arg-scope-and-set --pass-args --use-function-keyword 0.7
 LOCALLY
 
+# Allow setting the "default" container image registry to use for image short names (e.g. to Amazon ECR).
+ARG --global default_search_registry=docker.io
+
 IMPORT ./tools/ AS tools
 
 # For target names, descriptions, and build parameters, run the "doc" Earthly subcommand.
 # Example use: <earthly> +build --env=u22 --sasl=off --tls=OpenSSL --c_compiler=gcc
 
-# build :
-#   Build libmongoc and libbson using the specified environment.
-#
-# The --env argument specifies the build environment among the `+env.xyz` environment
-# targets, using --purpose=build for the build environment. Refer to the target
-# list for a list of available build environments.
-build:
-    # env is an argument
-    ARG --required env
-    FROM --pass-args +env.$env --purpose=build
-    # The configuration to be built
-    ARG config=RelWithDebInfo
-    # The prefix at which to install the built result
-    ARG install_prefix=/opt/mongo-c-driver
-    # Build configuration parameters. Will be case-normalized for CMake usage.
-    ARG --required sasl
-    ARG --required tls
-    LET source_dir=/opt/mongoc/source
-    LET build_dir=/opt/mongoc/build
+# COPY_SOURCE :
+#   Copy source files required for the build into the specified "--into" directory
+COPY_SOURCE:
+    FUNCTION
+    ARG --required into
     COPY --dir \
         build/ \
         CMakeLists.txt \
@@ -34,8 +23,16 @@ build:
         src/ \
         THIRD_PARTY_NOTICES \
         VERSION_CURRENT \
-        "$source_dir"
-    ENV CCACHE_HOME=/root/.cache/ccache
+        "$into"
+
+# CONFIGURE :
+#   Configure the project in $source_dir into $build_dir with a common set of configuration options
+CONFIGURE:
+    FUNCTION
+    ARG --required source_dir
+    ARG --required build_dir
+    ARG --required tls
+    ARG --required sasl
     RUN cmake -S "$source_dir" -B "$build_dir" -G "Ninja Multi-Config" \
         -D ENABLE_MAINTAINER_FLAGS=ON \
         -D ENABLE_SHM_COUNTERS=ON \
@@ -47,6 +44,29 @@ build:
         -D ENABLE_COVERAGE=ON \
         -D ENABLE_DEBUG_ASSERTIONS=ON \
         -Werror
+
+# build :
+#   Build libmongoc and libbson using the specified environment.
+#
+# The --env argument specifies the build environment among the `+env.xyz` environment
+# targets, using --purpose=build for the build environment. Refer to the target
+# list for a list of available build environments.
+build:
+    # env is an argument
+    ARG --required env
+    FROM --pass-args +env.$env --purpose=build
+    # The configuration to be built
+    ARG config=RelWithDebInfo
+    # The prefix at which to install the built result
+    ARG install_prefix=/opt/mongo-c-driver
+    # Build configuration parameters. Will be case-normalized for CMake usage.
+    ARG --required sasl
+    ARG --required tls
+    LET source_dir=/opt/mongoc/source
+    LET build_dir=/opt/mongoc/build
+    DO +COPY_SOURCE --into=$source_dir
+    ENV CCACHE_HOME=/root/.cache/ccache
+    DO --pass-args +CONFIGURE --source_dir=$source_dir --build_dir=$build_dir
     RUN --mount=type=cache,target=$CCACHE_HOME \
         env CCACHE_BASE="$source_dir" \
             cmake --build $build_dir --config $config
@@ -114,7 +134,7 @@ test-cxx-driver:
 
 # PREP_CMAKE "warms up" the CMake installation cache for the current environment
 PREP_CMAKE:
-    COMMAND
+    FUNCTION
     LET scratch=/opt/mongoc-cmake
     # Copy the minimal amount that we need, as to avoid cache invalidation
     COPY tools/use.sh tools/platform.sh tools/paths.sh tools/base.sh tools/download.sh \
@@ -148,7 +168,7 @@ multibuild:
 # release-archive :
 #   Create a release archive of the source tree. (Refer to dev docs)
 release-archive:
-    FROM alpine:3.20
+    FROM $default_search_registry/library/alpine:3.20
     RUN apk add git bash
     ARG --required prefix
     ARG --required ref
@@ -193,7 +213,7 @@ release-archive:
 
 # Obtain the signing public key. Exported as an artifact /c-driver.pub
 signing-pubkey:
-    FROM alpine:3.20
+    FROM $default_search_registry/library/alpine:3.20
     RUN apk add curl
     RUN curl --location --silent --fail "https://pgp.mongodb.com/c-driver.pub" -o /c-driver.pub
     SAVE ARTIFACT /c-driver.pub
@@ -203,7 +223,7 @@ signing-pubkey:
 #   to be used to access them. (Refer to dev docs)
 sign-file:
     # Pull from Garasign:
-    FROM artifactory.corp.mongodb.com/release-tools-container-registry-local/garasign-gpg
+    FROM 901841024863.dkr.ecr.us-east-1.amazonaws.com/release-infrastructure/garasign-gpg
     # Copy the file to be signed
     ARG --required file
     COPY $file /s/file
@@ -223,7 +243,7 @@ sign-file:
 #   Generate a signed release artifact. Refer to the "Earthly" page of our dev docs for more information.
 #   (Refer to dev docs)
 signed-release:
-    FROM alpine:3.20
+    FROM $default_search_registry/library/alpine:3.20
     RUN apk add git
     # The version of the release. This affects the filepaths of the output and is the default for --ref
     ARG --required version
@@ -253,7 +273,7 @@ signed-release:
 
 # This target is simply an environment in which the SilkBomb executable is available.
 silkbomb:
-    FROM artifactory.corp.mongodb.com/release-tools-container-registry-public-local/silkbomb:2.0
+    FROM 901841024863.dkr.ecr.us-east-1.amazonaws.com/release-infrastructure/silkbomb:2.0
     # Alias the silkbomb executable to a simpler name:
     RUN ln -s /python/src/sbom/silkbomb/bin /usr/local/bin/silkbomb
 
@@ -312,7 +332,7 @@ sbom-validate:
             --exclude jira
 
 snyk:
-    FROM --platform=linux/amd64 ubuntu:24.04
+    FROM --platform=linux/amd64 $default_search_registry/library/ubuntu:24.04
     RUN apt-get update && apt-get -y install curl
     RUN curl --location https://github.com/snyk/cli/releases/download/v1.1291.1/snyk-linux -o /usr/local/bin/snyk
     RUN chmod a+x /usr/local/bin/snyk
@@ -384,7 +404,7 @@ test-vcpkg-manifest-mode:
         make test-manifest-mode
 
 vcpkg-base:
-    FROM alpine:3.18
+    FROM $default_search_registry/library/alpine:3.18
     RUN apk add cmake curl gcc g++ musl-dev ninja-is-really-ninja zip unzip tar \
                 build-base git pkgconf perl bash linux-headers
     ENV VCPKG_ROOT=/opt/vcpkg-git
@@ -396,6 +416,34 @@ vcpkg-base:
     COPY src/libmongoc/examples/cmake/vcpkg/ $src_dir
     WORKDIR $src_dir
 
+# verify-headers :
+#   Execute CMake header verification on the sources
+#
+#   See `earthly.rst` for more details.
+verify-headers:
+    # We test against multiple different platforms, because glibc/musl versions may
+    # rearrange their header contents and requirements, so we want to check against as
+    # many as possible.
+    BUILD +do-verify-headers-impl \
+        --from +env.alpine3.19 \
+        --from +env.u22 \
+        --from +env.centos7 \
+        --sasl=off --tls=off --cxx_compiler=gcc --c_compiler=gcc
+
+do-verify-headers-impl:
+    ARG --required from
+    # We don't really care about the specifics of the build env/settings, so set some
+    # reasonable defaults so the caller doesn't need to specify. In the future, it is
+    # possible that we will need to test other environments and build settings.
+    FROM --pass-args "$from" --purpose=build
+    # Add C++ so we can test as C++ headers
+    DO --pass-args tools+ADD_CXX_COMPILER
+    DO +COPY_SOURCE --into=/s
+    DO --pass-args +CONFIGURE --source_dir /s --build_dir /s/_build
+    # The "all_verify_interface_header_sets" target is created automatically
+    # by CMake for the VERIFY_INTERFACE_HEADER_SETS target property.
+    RUN cmake --build /s/_build --target all_verify_interface_header_sets
+
 # run :
 #   Run one or more targets simultaneously.
 #
@@ -443,7 +491,7 @@ env.alpine3.19:
     DO --pass-args +ALPINE_ENV --version=3.19
 
 env.archlinux:
-    FROM --pass-args tools+init-env --from archlinux
+    FROM --pass-args tools+init-env --from $default_search_registry/library/archlinux
     RUN pacman-key --init
     ARG --required purpose
 
@@ -462,9 +510,9 @@ env.centos7:
     DO --pass-args +CENTOS_ENV --version=7
 
 ALPINE_ENV:
-    COMMAND
+    FUNCTION
     ARG --required version
-    FROM --pass-args tools+init-env --from alpine:$version
+    FROM --pass-args tools+init-env --from $default_search_registry/library/alpine:$version
     # XXX: On Alpine, we just use the system's CMake. At time of writing, it is
     # very up-to-date and much faster than building our own from source (since
     # Kitware does not (yet) provide libmuslc builds of CMake)
@@ -484,9 +532,9 @@ ALPINE_ENV:
     DO --pass-args tools+ADD_C_COMPILER --clang_pkg="gcc clang compiler-rt"
 
 UBUNTU_ENV:
-    COMMAND
+    FUNCTION
     ARG --required version
-    FROM --pass-args tools+init-env --from ubuntu:$version
+    FROM --pass-args tools+init-env --from $default_search_registry/library/ubuntu:$version
     RUN __install curl build-essential
     ARG --required purpose
 
@@ -502,13 +550,13 @@ UBUNTU_ENV:
     DO +PREP_CMAKE
 
 CENTOS_ENV:
-    COMMAND
+    FUNCTION
     ARG --required version
-    FROM --pass-args tools+init-env --from centos:$version
+    FROM --pass-args tools+init-env --from $default_search_registry/library/centos:$version
     # Update repositories to use vault.centos.org
     RUN sed -i 's/mirrorlist/#mirrorlist/g' /etc/yum.repos.d/CentOS-* && \
         sed -i 's|#baseurl=http://mirror.centos.org|baseurl=http://vault.centos.org|g' /etc/yum.repos.d/CentOS-*
-    RUN yum -y install epel-release && yum -y update
+    RUN yum -y --enablerepo=extras install epel-release && yum -y update
     RUN yum -y install curl gcc gcc-c++ make
     ARG --required purpose
 
diff -pruN 2.0.2-1/NEWS 2.1.0-1/NEWS
--- 2.0.2-1/NEWS	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/NEWS	2025-08-14 18:37:23.000000000 +0000
@@ -1,3 +1,35 @@
+libmongoc 2.1.0
+===============
+
+## Fixes
+
+* The uninstall script for Windows is fixed so it no longer "succeeds" with a non-zero `%ERRORLABEL%` value.
+* The uninstall script for non-Windows environments now calls `find "$dir" -maxdepth 1` instead of `ls --almost-all "$dir"` when detecting non-empty directories to fix macOS compatibility.
+
+## Notes
+
+* The minimum supported MongoDB Server version is raised from 4.0 to 4.2. This is in accordance with [MongoDB Software Lifecycle Schedules](https://www.mongodb.com/legal/support-policy/lifecycles).
+
+## Changes
+
+* The CMake project now sets a CMake policy max version of `4.0` (previously unset).
+
+## Removed
+
+* Support for Debian 9 and Debian 10.
+
+Thanks to everyone who contributed to the development of this release.
+
+  * Kevin Albertson
+  * Ezra Chung
+  * Colby Pike
+  * Adrian Dole
+  * Azat Khuzhin
+  * Jeroen Ooms
+  * Roberto C. Sánchez
+  * Micah Scott
+
+
 libmongoc 2.0.2
 ===============
 
@@ -13,6 +45,20 @@ Thanks to everyone who contributed to th
   * Colby Pike
 
 
+libmongoc 1.30.5
+================
+
+Fixes:
+
+  * Fix message of `bson_strerror_r` on Windows.
+  * Fix memory leaks with Windows Secure Channel.
+  * Fix loading PKCS#8 RSA keys with Windows Secure Channel.
+
+Thanks to everyone who contributed to the development of this release.
+
+  * Kevin Albertson
+  * Colby Pike
+
 
 libmongoc 2.0.1
 ===============
@@ -27,6 +73,45 @@ Thanks to everyone who contributed to th
   * Kevin Albertson
 
 
+libmongoc 1.30.4
+================
+
+Fixes:
+
+  * Fix username handling for MONGODB-X509 authentication when C driver is configured to use Secure Transport (CMake option `ENABLE_SSL=DARWIN`) or Secure Channel (CMake option `ENABLE_SSL=WINDOWS`).
+  * Do not set empty partial result on client error for `mongoc_bulkwrite_execute`.
+
+Thanks to everyone who contributed to the development of this release.
+
+  * Kevin Albertson
+
+
+libmongoc 1.30.3
+================
+
+New Features:
+
+* In anticipation of the 2.0 release of mongo-c-driver, new CMake packages and
+  imported targets have been defined (for both `bson` and `mongoc`). To import
+  `mongoc` with the new names, call `find_package` for the `mongoc` package. The
+  new imported targets are named `mongoc::static`, `mongoc::shared`, and
+  `mongoc::mongoc` (which points to either the static or the shared library,
+  depending on an import-time configuration option).
+
+  The new package and target names will remain unchanged when upgrading to the
+  2.0 release, allowing consumers to support both major versions without
+  modifying their CMake project. The current imported target names will be
+  removed from the 2.0 release, and should not be used for
+  forward-compatibility.
+
+  Programs that link to BSON libraries directly should also use the new target
+  names `bson::static`, `bson::shared`, or `bson::bson`.
+
+Thanks to everyone who contributed to the development of this release.
+
+  * Kevin Albertson
+  * Ezra Chung
+  * Colby Pike
 
 libmongoc 2.0.0
 ===============
diff -pruN 2.0.2-1/README.rst 2.1.0-1/README.rst
--- 2.0.2-1/README.rst	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/README.rst	2025-08-14 18:37:23.000000000 +0000
@@ -12,6 +12,8 @@ mongo-c-driver is a project that include
 
 If libmongoc is not needed, it is possible to build and install only libbson.
 
+This project uses `Semantic Versioning <https://semver.org/>`_.
+
 Documentation / Support / Feedback
 ==================================
 
diff -pruN 2.0.2-1/VERSION_CURRENT 2.1.0-1/VERSION_CURRENT
--- 2.0.2-1/VERSION_CURRENT	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/VERSION_CURRENT	2025-08-14 18:37:23.000000000 +0000
@@ -1 +1 @@
-2.0.2
+2.1.0
diff -pruN 2.0.2-1/build/bottle.py 2.1.0-1/build/bottle.py
--- 2.0.2-1/build/bottle.py	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/build/bottle.py	2025-08-14 18:37:23.000000000 +0000
@@ -2,78 +2,89 @@
 # -*- coding: utf-8 -*-
 """
 Bottle is a fast and simple micro-framework for small web applications. It
-offers request dispatching (Routes) with url parameter support, templates,
+offers request dispatching (Routes) with URL parameter support, templates,
 a built-in HTTP Server and adapters for many third party WSGI/HTTP-server and
 template engines - all in a single file and with no dependencies other than the
 Python Standard Library.
 
 Homepage and documentation: http://bottlepy.org/
 
-Copyright (c) 2016, Marcel Hellkamp.
+Copyright (c) 2009-2024, Marcel Hellkamp.
 License: MIT (see LICENSE for details)
 """
 
-from __future__ import with_statement
+from __future__ import print_function
+import sys
 
 __author__ = 'Marcel Hellkamp'
-__version__ = '0.12.23'
+__version__ = '0.13.2'
 __license__ = 'MIT'
 
-# The gevent server adapter needs to patch some modules before they are imported
-# This is why we parse the commandline parameters here but handle them later
+###############################################################################
+# Command-line interface ######################################################
+###############################################################################
+# INFO: Some server adapters need to monkey-patch std-lib modules before they
+# are imported. This is why some of the command-line handling is done here, but
+# the actual call to _main() is at the end of the file.
+
+
+def _cli_parse(args):  # pragma: no coverage
+    from argparse import ArgumentParser
+
+    parser = ArgumentParser(prog=args[0], usage="%(prog)s [options] package.module:app")
+    opt = parser.add_argument
+    opt("--version", action="store_true", help="show version number.")
+    opt("-b", "--bind", metavar="ADDRESS", help="bind socket to ADDRESS.")
+    opt("-s", "--server", default='wsgiref', help="use SERVER as backend.")
+    opt("-p", "--plugin", action="append", help="install additional plugin/s.")
+    opt("-c", "--conf", action="append", metavar="FILE",
+        help="load config values from FILE.")
+    opt("-C", "--param", action="append", metavar="NAME=VALUE",
+        help="override config values.")
+    opt("--debug", action="store_true", help="start server in debug mode.")
+    opt("--reload", action="store_true", help="auto-reload on file changes.")
+    opt('app', help='WSGI app entry point.', nargs='?')
+
+    cli_args = parser.parse_args(args[1:])
+
+    return cli_args, parser
+
+
+def _cli_patch(cli_args):  # pragma: no coverage
+    parsed_args, _ = _cli_parse(cli_args)
+    opts = parsed_args
+    if opts.server:
+        if opts.server.startswith('gevent'):
+            import gevent.monkey
+            gevent.monkey.patch_all()
+        elif opts.server.startswith('eventlet'):
+            import eventlet
+            eventlet.monkey_patch()
+
+
 if __name__ == '__main__':
-    from optparse import OptionParser
-    _cmd_parser = OptionParser(usage="usage: %prog [options] package.module:app")
-    _opt = _cmd_parser.add_option
-    _opt("--version", action="store_true", help="show version number.")
-    _opt("-b", "--bind", metavar="ADDRESS", help="bind socket to ADDRESS.")
-    _opt("-s", "--server", default='wsgiref', help="use SERVER as backend.")
-    _opt("-p", "--plugin", action="append", help="install additional plugin/s.")
-    _opt("--debug", action="store_true", help="start server in debug mode.")
-    _opt("--reload", action="store_true", help="auto-reload on file changes.")
-    _cmd_options, _cmd_args = _cmd_parser.parse_args()
-    if _cmd_options.server and _cmd_options.server.startswith('gevent'):
-        import gevent.monkey; gevent.monkey.patch_all()
+    _cli_patch(sys.argv)
 
-import base64, cgi, email.utils, functools, hmac, itertools, mimetypes,\
-        os, re, subprocess, sys, tempfile, threading, time, warnings, hashlib
+###############################################################################
+# Imports and Python 2/3 unification ##########################################
+###############################################################################
 
+import base64, calendar, email.utils, functools, hmac, itertools,\
+       mimetypes, os, re, tempfile, threading, time, warnings, weakref, hashlib
+
+from types import FunctionType
 from datetime import date as datedate, datetime, timedelta
-from tempfile import TemporaryFile
+from tempfile import NamedTemporaryFile
 from traceback import format_exc, print_exc
 from unicodedata import normalize
 
-
-try: from simplejson import dumps as json_dumps, loads as json_lds
-except ImportError: # pragma: no cover
-    try: from json import dumps as json_dumps, loads as json_lds
-    except ImportError:
-        try: from django.utils.simplejson import dumps as json_dumps, loads as json_lds
-        except ImportError:
-            def json_dumps(data):
-                raise ImportError("JSON support requires Python 2.6 or simplejson.")
-            json_lds = json_dumps
-
-
-
-# We now try to fix 2.5/2.6/3.1/3.2 incompatibilities.
-# It ain't pretty but it works... Sorry for the mess.
-
-py   = sys.version_info
-py3k = py >= (3, 0, 0)
-py25 = py <  (2, 6, 0)
-py31 = (3, 1, 0) <= py < (3, 2, 0)
-
-# Workaround for the missing "as" keyword in py3k.
-def _e(): return sys.exc_info()[1]
-
-# Workaround for the "print is a keyword/function" Python 2/3 dilemma
-# and a fallback for mod_wsgi (resticts stdout/err attribute access)
 try:
-    _stdout, _stderr = sys.stdout.write, sys.stderr.write
-except IOError:
-    _stdout = lambda x: sys.stdout.write(x)
-    _stderr = lambda x: sys.stderr.write(x)
+    from ujson import dumps as json_dumps, loads as json_lds
+except ImportError:
+    from json import dumps as json_dumps, loads as json_lds
+
+py = sys.version_info
+py3k = py.major > 2
 
 # Lots of stdlib and builtin differences.
 if py3k:
@@ -82,16 +93,16 @@ if py3k:
     from urllib.parse import urljoin, SplitResult as UrlSplitResult
     from urllib.parse import urlencode, quote as urlquote, unquote as urlunquote
     urlunquote = functools.partial(urlunquote, encoding='latin1')
-    from http.cookies import SimpleCookie
-    if py >= (3, 3, 0):
-        from collections.abc import MutableMapping as DictMixin
-        from types import ModuleType as new_module
-    else:
-        from collections import MutableMapping as DictMixin
-        from imp import new_module
+    from http.cookies import SimpleCookie, Morsel, CookieError
+    from collections.abc import MutableMapping as DictMixin
+    from types import ModuleType as new_module
     import pickle
     from io import BytesIO
-    from configparser import ConfigParser
+    import configparser
+    from datetime import timezone
+    UTC = timezone.utc
+    # getfullargspec was deprecated in 3.5 and un-deprecated in 3.6
+    # getargspec was deprecated in 3.0 and removed in 3.11
     from inspect import getfullargspec
     def getargspec(func):
         spec = getfullargspec(func)
@@ -103,67 +114,92 @@ if py3k:
     json_loads = lambda s: json_lds(touni(s))
     callable = lambda x: hasattr(x, '__call__')
     imap = map
-    def _raise(*a): raise a[0](a[1]).with_traceback(a[2])
-else: # 2.x
+
+    def _raise(*a):
+        raise a[0](a[1]).with_traceback(a[2])
+else:  # 2.x
+    warnings.warn("Python 2 support will be dropped in Bottle 0.14", DeprecationWarning)
     import httplib
     import thread
     from urlparse import urljoin, SplitResult as UrlSplitResult
     from urllib import urlencode, quote as urlquote, unquote as urlunquote
-    from Cookie import SimpleCookie
+    from Cookie import SimpleCookie, Morsel, CookieError
     from itertools import imap
     import cPickle as pickle
     from imp import new_module
     from StringIO import StringIO as BytesIO
-    from ConfigParser import SafeConfigParser as ConfigParser
+    import ConfigParser as configparser
+    from collections import MutableMapping as DictMixin
     from inspect import getargspec
-    if py25:
-        msg  = "Python 2.5 support may be dropped in future versions of Bottle."
-        warnings.warn(msg, DeprecationWarning)
-        from UserDict import DictMixin
-        def next(it): return it.next()
-        bytes = str
-    else: # 2.6, 2.7
-        from collections import MutableMapping as DictMixin
+    from datetime import tzinfo
+
+    class _UTC(tzinfo):
+        def utcoffset(self, dt): return timedelta(0)
+        def tzname(self, dt): return "UTC"
+        def dst(self, dt): return timedelta(0)
+    UTC = _UTC()
+
     unicode = unicode
     json_loads = json_lds
-    eval(compile('def _raise(*a): raise a[0], a[1], a[2]', '<py3fix>', 'exec'))
+
+    exec(compile('def _raise(*a): raise a[0], a[1], a[2]', '<py3fix>', 'exec'))
 
 # Some helpers for string/byte handling
 def tob(s, enc='utf8'):
-    return s.encode(enc) if isinstance(s, unicode) else bytes(s)
+    if isinstance(s, unicode):
+        return s.encode(enc)
+    return b'' if s is None else bytes(s)
+
+
 def touni(s, enc='utf8', err='strict'):
-    return s.decode(enc, err) if isinstance(s, bytes) else unicode(s)
+    if isinstance(s, bytes):
+        return s.decode(enc, err)
+    return unicode("" if s is None else s)
+
+
 tonat = touni if py3k else tob
 
-# 3.2 fixes cgi.FieldStorage to accept bytes (which makes a lot of sense).
-# 3.1 needs a workaround.
-if py31:
-    from io import TextIOWrapper
-    class NCTextIOWrapper(TextIOWrapper):
-        def close(self): pass # Keep wrapped buffer open.
+
+def _stderr(*args):
+    try:
+        print(*args, file=sys.stderr)
+    except (IOError, AttributeError):
+        pass # Some environments do not allow printing (mod_wsgi)
 
 
 # A bug in functools causes it to break if the wrapper is an instance method
 def update_wrapper(wrapper, wrapped, *a, **ka):
-    try: functools.update_wrapper(wrapper, wrapped, *a, **ka)
-    except AttributeError: pass
-
-
+    try:
+        functools.update_wrapper(wrapper, wrapped, *a, **ka)
+    except AttributeError:
+        pass
 
 # These helpers are used at module level and need to be defined first.
 # And yes, I know PEP-8, but sometimes a lower-case classname makes more sense.
 
-def depr(message, hard=False):
-    warnings.warn(message, DeprecationWarning, stacklevel=3)
 
-def makelist(data): # This is just to handy
-    if isinstance(data, (tuple, list, set, dict)): return list(data)
-    elif data: return [data]
-    else: return []
+def depr(major, minor, cause, fix, stacklevel=3):
+    text = "Warning: Use of deprecated feature or API. (Deprecated in Bottle-%d.%d)\n"\
+           "Cause: %s\n"\
+           "Fix: %s\n" % (major, minor, cause, fix)
+    if DEBUG == 'strict':
+        raise DeprecationWarning(text)
+    warnings.warn(text, DeprecationWarning, stacklevel=stacklevel)
+    return DeprecationWarning(text)
+
+
+def makelist(data):  # This is just too handy
+    if isinstance(data, (tuple, list, set, dict)):
+        return list(data)
+    elif data:
+        return [data]
+    else:
+        return []
 
 
 class DictProperty(object):
-    ''' Property that maps to a key in a local dict-like attribute. '''
+    """ Property that maps to a key in a local dict-like attribute. """
+
     def __init__(self, attr, key=None, read_only=False):
         self.attr, self.key, self.read_only = attr, key, read_only
 
@@ -188,12 +224,12 @@ class DictProperty(object):
 
 
 class cached_property(object):
-    ''' A property that is only computed once per instance and then replaces
+    """ A property that is only computed once per instance and then replaces
         itself with an ordinary attribute. Deleting the attribute resets the
-        property. '''
+        property. """
 
     def __init__(self, func):
-        self.__doc__ = getattr(func, '__doc__')
+        update_wrapper(self, func)
         self.func = func
 
     def __get__(self, obj, cls):
@@ -203,7 +239,8 @@ class cached_property(object):
 
 
 class lazy_attribute(object):
-    ''' A property that caches itself to the class object. '''
+    """ A property that caches itself to the class object. """
+
     def __init__(self, func):
         functools.update_wrapper(self, func, updated=[])
         self.getter = func
@@ -214,12 +251,8 @@ class lazy_attribute(object):
         return value
 
 
-
-
-
-
 ###############################################################################
-# Exceptions and Events ########################################################
+# Exceptions and Events #######################################################
 ###############################################################################
 
 
@@ -227,11 +260,6 @@ class BottleException(Exception):
     """ A base class for exceptions used by bottle. """
     pass
 
-
-
-
-
-
 ###############################################################################
 # Routing ######################################################################
 ###############################################################################
@@ -245,7 +273,10 @@ class RouteReset(BottleException):
     """ If raised by a plugin or request handler, the route is reset and all
         plugins are re-applied. """
 
-class RouterUnknownModeError(RouteError): pass
+
+class RouterUnknownModeError(RouteError):
+
+    pass
 
 
 class RouteSyntaxError(RouteError):
@@ -257,15 +288,16 @@ class RouteBuildError(RouteError):
 
 
 def _re_flatten(p):
-    ''' Turn all capturing groups in a regular expression pattern into
-        non-capturing groups. '''
-    if '(' not in p: return p
-    return re.sub(r'(\\*)(\(\?P<[^>]+>|\((?!\?))',
-        lambda m: m.group(0) if len(m.group(1)) % 2 else m.group(1) + '(?:', p)
+    """ Turn all capturing groups in a regular expression pattern into
+        non-capturing groups. """
+    if '(' not in p:
+        return p
+    return re.sub(r'(\\*)(\(\?P<[^>]+>|\((?!\?))', lambda m: m.group(0) if
+                  len(m.group(1)) % 2 else m.group(1) + '(?:', p)
 
 
 class Router(object):
-    ''' A Router is an ordered collection of route->target pairs. It is used to
+    """ A Router is an ordered collection of route->target pairs. It is used to
         efficiently match WSGI requests against a number of routes and return
         the first target that satisfies the request. The target may be anything,
         usually a string, ID or callable object. A route consists of a path-rule
@@ -274,48 +306,53 @@ class Router(object):
         The path-rule is either a static path (e.g. `/contact`) or a dynamic
         path that contains wildcards (e.g. `/wiki/<page>`). The wildcard syntax
         and details on the matching order are described in docs:`routing`.
-    '''
+    """
 
     default_pattern = '[^/]+'
-    default_filter  = 're'
+    default_filter = 're'
 
     #: The current CPython regexp implementation does not allow more
     #: than 99 matching groups per regular expression.
     _MAX_GROUPS_PER_PATTERN = 99
 
     def __init__(self, strict=False):
-        self.rules    = [] # All rules in order
-        self._groups  = {} # index of regexes to find them in dyna_routes
-        self.builder  = {} # Data structure for the url builder
-        self.static   = {} # Search structure for static routes
-        self.dyna_routes   = {}
-        self.dyna_regexes  = {} # Search structure for dynamic routes
+        self.rules = []  # All rules in order
+        self._groups = {}  # index of regexes to find them in dyna_routes
+        self.builder = {}  # Data structure for the url builder
+        self.static = {}  # Search structure for static routes
+        self.dyna_routes = {}
+        self.dyna_regexes = {}  # Search structure for dynamic routes
         #: If true, static routes are no longer checked first.
         self.strict_order = strict
         self.filters = {
-            're':    lambda conf:
-                (_re_flatten(conf or self.default_pattern), None, None),
-            'int':   lambda conf: (r'-?\d+', int, lambda x: str(int(x))),
+            're': lambda conf: (_re_flatten(conf or self.default_pattern),
+                                None, None),
+            'int': lambda conf: (r'-?\d+', int, lambda x: str(int(x))),
             'float': lambda conf: (r'-?[\d.]+', float, lambda x: str(float(x))),
-            'path':  lambda conf: (r'.+?', None, None)}
+            'path': lambda conf: (r'.+?', None, None)
+        }
 
     def add_filter(self, name, func):
-        ''' Add a filter. The provided function is called with the configuration
+        """ Add a filter. The provided function is called with the configuration
         string as parameter and must return a (regexp, to_python, to_url) tuple.
-        The first element is a string, the last two are callables or None. '''
+        The first element is a string, the last two are callables or None. """
         self.filters[name] = func
 
-    rule_syntax = re.compile('(\\\\*)'\
-        '(?:(?::([a-zA-Z_][a-zA-Z_0-9]*)?()(?:#(.*?)#)?)'\
-          '|(?:<([a-zA-Z_][a-zA-Z_0-9]*)?(?::([a-zA-Z_]*)'\
-            '(?::((?:\\\\.|[^\\\\>]+)+)?)?)?>))')
+    rule_syntax = re.compile('(\\\\*)'
+        '(?:(?::([a-zA-Z_][a-zA-Z_0-9]*)?()(?:#(.*?)#)?)'
+          '|(?:<([a-zA-Z_][a-zA-Z_0-9]*)?(?::([a-zA-Z_]*)'
+            '(?::((?:\\\\.|[^\\\\>])+)?)?)?>))')
 
     def _itertokens(self, rule):
         offset, prefix = 0, ''
         for match in self.rule_syntax.finditer(rule):
             prefix += rule[offset:match.start()]
             g = match.groups()
-            if len(g[0])%2: # Escaped wildcard
+            if g[2] is not None:
+                depr(0, 13, "Use of old route syntax.",
+                            "Use <name> instead of :name in routes.",
+                            stacklevel=4)
+            if len(g[0]) % 2:  # Escaped wildcard
                 prefix += match.group(0)[len(g[0]):]
                 offset = match.end()
                 continue
@@ -325,15 +362,15 @@ class Router(object):
             yield name, filtr or 'default', conf or None
             offset, prefix = match.end(), ''
         if offset <= len(rule) or prefix:
-            yield prefix+rule[offset:], None, None
+            yield prefix + rule[offset:], None, None
 
     def add(self, rule, method, target, name=None):
-        ''' Add a new rule or replace the target for an existing rule. '''
-        anons     = 0    # Number of anonymous wildcards found
-        keys      = []   # Names of keys
-        pattern   = ''   # Regular expression pattern with named groups
-        filters   = []   # Lists of wildcard input filters
-        builder   = []   # Data structure for the URL builder
+        """ Add a new rule or replace the target for an existing rule. """
+        anons = 0  # Number of anonymous wildcards found
+        keys = []  # Names of keys
+        pattern = ''  # Regular expression pattern with named groups
+        filters = []  # Lists of wildcard input filters
+        builder = []  # Data structure for the URL builder
         is_static = True
 
         for key, mode, conf in self._itertokens(rule):
@@ -365,10 +402,11 @@ class Router(object):
         try:
             re_pattern = re.compile('^(%s)$' % pattern)
             re_match = re_pattern.match
-        except re.error:
-            raise RouteSyntaxError("Could not add Route: %s (%s)" % (rule, _e()))
+        except re.error as e:
+            raise RouteSyntaxError("Could not add Route: %s (%s)" % (rule, e))
 
         if filters:
+
             def getargs(path):
                 url_args = re_match(path).groupdict()
                 for name, wildcard_filter in filters:
@@ -378,6 +416,7 @@ class Router(object):
                         raise HTTPError(400, 'Path has wrong format.')
                 return url_args
         elif re_pattern.groupindex:
+
             def getargs(path):
                 return re_match(path).groupdict()
         else:
@@ -389,8 +428,9 @@ class Router(object):
         if (flatpat, method) in self._groups:
             if DEBUG:
                 msg = 'Route <%s %s> overwrites a previously defined route'
-                warnings.warn(msg % (method, rule), RuntimeWarning)
-            self.dyna_routes[method][self._groups[flatpat, method]] = whole_rule
+                warnings.warn(msg % (method, rule), RuntimeWarning, stacklevel=3)
+            self.dyna_routes[method][
+                self._groups[flatpat, method]] = whole_rule
         else:
             self.dyna_routes.setdefault(method, []).append(whole_rule)
             self._groups[flatpat, method] = len(self.dyna_routes[method]) - 1
@@ -402,7 +442,7 @@ class Router(object):
         comborules = self.dyna_regexes[method] = []
         maxgroups = self._MAX_GROUPS_PER_PATTERN
         for x in range(0, len(all_rules), maxgroups):
-            some = all_rules[x:x+maxgroups]
+            some = all_rules[x:x + maxgroups]
             combined = (flatpat for (_, flatpat, _, _) in some)
             combined = '|'.join('(^%s$)' % flatpat for flatpat in combined)
             combined = re.compile(combined).match
@@ -410,25 +450,24 @@ class Router(object):
             comborules.append((combined, rules))
 
     def build(self, _name, *anons, **query):
-        ''' Build an URL by filling the wildcards in a rule. '''
+        """ Build an URL by filling the wildcards in a rule. """
         builder = self.builder.get(_name)
-        if not builder: raise RouteBuildError("No route with that name.", _name)
+        if not builder:
+            raise RouteBuildError("No route with that name.", _name)
         try:
-            for i, value in enumerate(anons): query['anon%d'%i] = value
-            url = ''.join([f(query.pop(n)) if n else f for (n,f) in builder])
-            return url if not query else url+'?'+urlencode(query)
-        except KeyError:
-            raise RouteBuildError('Missing URL argument: %r' % _e().args[0])
+            for i, value in enumerate(anons):
+                query['anon%d' % i] = value
+            url = ''.join([f(query.pop(n)) if n else f for (n, f) in builder])
+            return url if not query else url + '?' + urlencode(query)
+        except KeyError as E:
+            raise RouteBuildError('Missing URL argument: %r' % E.args[0])
 
     def match(self, environ):
-        ''' Return a (target, url_agrs) tuple or raise HTTPError(400/404/405). '''
+        """ Return a (target, url_args) tuple or raise HTTPError(400/404/405). """
         verb = environ['REQUEST_METHOD'].upper()
         path = environ['PATH_INFO'] or '/'
-        target = None
-        if verb == 'HEAD':
-            methods = ['PROXY', verb, 'GET', 'ANY']
-        else:
-            methods = ['PROXY', verb, 'ANY']
+
+        methods = ('PROXY', 'HEAD', 'GET', 'ANY') if verb == 'HEAD' else ('PROXY', verb, 'ANY')
 
         for method in methods:
             if method in self.static and path in self.static[method]:
@@ -460,21 +499,19 @@ class Router(object):
         raise HTTPError(404, "Not found: " + repr(path))
 
 
-
-
-
-
 class Route(object):
-    ''' This class wraps a route callback along with route specific metadata and
+    """ This class wraps a route callback along with route specific metadata and
         configuration and applies Plugins on demand. It is also responsible for
-        turing an URL path rule into a regular expression usable by the Router.
-    '''
+        turning an URL path rule into a regular expression usable by the Router.
+    """
 
-    def __init__(self, app, rule, method, callback, name=None,
-                 plugins=None, skiplist=None, **config):
+    def __init__(self, app, rule, method, callback,
+                 name=None,
+                 plugins=None,
+                 skiplist=None, **config):
         #: The application this route is installed to.
         self.app = app
-        #: The path-rule string (e.g. ``/wiki/:page``).
+        #: The path-rule string (e.g. ``/wiki/<page>``).
         self.rule = rule
         #: The HTTP method as a string (e.g. ``GET``).
         self.method = method
@@ -489,38 +526,26 @@ class Route(object):
         #: Additional keyword arguments passed to the :meth:`Bottle.route`
         #: decorator are stored in this dictionary. Used for route-specific
         #: plugin configuration and meta-data.
-        self.config = ConfigDict().load_dict(config, make_namespaces=True)
-
-    def __call__(self, *a, **ka):
-        depr("Some APIs changed to return Route() instances instead of"\
-             " callables. Make sure to use the Route.call method and not to"\
-             " call Route instances directly.") #0.12
-        return self.call(*a, **ka)
+        self.config = app.config._make_overlay()
+        self.config.load_dict(config)
 
     @cached_property
     def call(self):
-        ''' The route callback with all plugins applied. This property is
-            created on demand and then cached to speed up subsequent requests.'''
+        """ The route callback with all plugins applied. This property is
+            created on demand and then cached to speed up subsequent requests."""
         return self._make_callback()
 
     def reset(self):
-        ''' Forget any cached values. The next time :attr:`call` is accessed,
-            all plugins are re-applied. '''
+        """ Forget any cached values. The next time :attr:`call` is accessed,
+            all plugins are re-applied. """
         self.__dict__.pop('call', None)
 
     def prepare(self):
-        ''' Do all on-demand work immediately (useful for debugging).'''
+        """ Do all on-demand work immediately (useful for debugging)."""
         self.call
 
-    @property
-    def _context(self):
-        depr('Switch to Plugin API v2 and access the Route object directly.')  #0.12
-        return dict(rule=self.rule, method=self.method, callback=self.callback,
-                    name=self.name, app=self.app, config=self.config,
-                    apply=self.plugins, skip=self.skiplist)
-
     def all_plugins(self):
-        ''' Yield all Plugins affecting this route. '''
+        """ Yield all Plugins affecting this route. """
         unique = set()
         for p in reversed(self.app.plugins + self.plugins):
             if True in self.skiplist: break
@@ -535,48 +560,50 @@ class Route(object):
         for plugin in self.all_plugins():
             try:
                 if hasattr(plugin, 'apply'):
-                    api = getattr(plugin, 'api', 1)
-                    context = self if api > 1 else self._context
-                    callback = plugin.apply(callback, context)
+                    callback = plugin.apply(callback, self)
                 else:
                     callback = plugin(callback)
-            except RouteReset: # Try again with changed configuration.
+            except RouteReset:  # Try again with changed configuration.
                 return self._make_callback()
-            if not callback is self.callback:
+            if callback is not self.callback:
                 update_wrapper(callback, self.callback)
         return callback
 
     def get_undecorated_callback(self):
-        ''' Return the callback. If the callback is a decorated function, try to
-            recover the original function. '''
+        """ Return the callback. If the callback is a decorated function, try to
+            recover the original function. """
         func = self.callback
         func = getattr(func, '__func__' if py3k else 'im_func', func)
         closure_attr = '__closure__' if py3k else 'func_closure'
         while hasattr(func, closure_attr) and getattr(func, closure_attr):
-            func = getattr(func, closure_attr)[0].cell_contents
+            attributes = getattr(func, closure_attr)
+            func = attributes[0].cell_contents
+
+            # in case of decorators with multiple arguments
+            if not isinstance(func, FunctionType):
+                # pick first FunctionType instance from multiple arguments
+                func = filter(lambda x: isinstance(x, FunctionType),
+                              map(lambda x: x.cell_contents, attributes))
+                func = list(func)[0]  # py3 support
         return func
 
     def get_callback_args(self):
-        ''' Return a list of argument names the callback (most likely) accepts
+        """ Return a list of argument names the callback (most likely) accepts
             as keyword arguments. If the callback is a decorated function, try
-            to recover the original function before inspection. '''
+            to recover the original function before inspection. """
         return getargspec(self.get_undecorated_callback())[0]
 
     def get_config(self, key, default=None):
-        ''' Lookup a config field and return its value, first checking the
-            route.config, then route.app.config.'''
-        for conf in (self.config, self.app.conifg):
-            if key in conf: return conf[key]
-        return default
+        """ Lookup a config field and return its value, first checking the
+            route.config, then route.app.config."""
+        depr(0, 13, "Route.get_config() is deprecated.",
+                    "The Route.config property already includes values from the"
+                    " application config for missing keys. Access it directly.")
+        return self.config.get(key, default)
 
     def __repr__(self):
         cb = self.get_undecorated_callback()
-        return '<%s %r %r>' % (self.method, self.rule, cb)
-
-
-
-
-
+        return '<%s %s -> %s:%s>' % (self.method, self.rule, cb.__module__, cb.__name__)
 
 ###############################################################################
 # Application Object ###########################################################
@@ -592,41 +619,59 @@ class Bottle(object):
                          let debugging middleware handle exceptions.
     """
 
-    def __init__(self, catchall=True, autojson=True):
+    @lazy_attribute
+    def _global_config(cls):
+        cfg = ConfigDict()
+        cfg.meta_set('catchall', 'validate', bool)
+        return cfg
 
+    def __init__(self, **kwargs):
         #: A :class:`ConfigDict` for app specific configuration.
-        self.config = ConfigDict()
-        self.config._on_change = functools.partial(self.trigger_hook, 'config')
-        self.config.meta_set('autojson', 'validate', bool)
-        self.config.meta_set('catchall', 'validate', bool)
-        self.config['catchall'] = catchall
-        self.config['autojson'] = autojson
+        self.config = self._global_config._make_overlay()
+        self.config._add_change_listener(
+            functools.partial(self.trigger_hook, 'config'))
+
+        self.config.update({
+            "catchall": True
+        })
+
+        if kwargs.get('catchall') is False:
+            depr(0, 13, "Bottle(catchall) keyword argument.",
+                        "The 'catchall' setting is now part of the app "
+                        "configuration. Fix: `app.config['catchall'] = False`")
+            self.config['catchall'] = False
+        if kwargs.get('autojson') is False:
+            depr(0, 13, "Bottle(autojson) keyword argument.",
+                 "The 'autojson' setting is now part of the app "
+                 "configuration. Fix: `app.config['json.enable'] = False`")
+            self.config['json.disable'] = True
+
+        self._mounts = []
 
         #: A :class:`ResourceManager` for application files
         self.resources = ResourceManager()
 
-        self.routes = [] # List of installed :class:`Route` instances.
-        self.router = Router() # Maps requests to :class:`Route` instances.
+        self.routes = []  # List of installed :class:`Route` instances.
+        self.router = Router()  # Maps requests to :class:`Route` instances.
         self.error_handler = {}
 
         # Core plugins
-        self.plugins = [] # List of installed plugins.
-        if self.config['autojson']:
-            self.install(JSONPlugin())
+        self.plugins = []  # List of installed plugins.
+        self.install(JSONPlugin())
         self.install(TemplatePlugin())
 
     #: If true, most exceptions are caught and returned as :exc:`HTTPError`
     catchall = DictProperty('config', 'catchall')
 
     __hook_names = 'before_request', 'after_request', 'app_reset', 'config'
-    __hook_reversed = 'after_request'
+    __hook_reversed = {'after_request'}
 
     @cached_property
     def _hooks(self):
         return dict((name, []) for name in self.__hook_names)
 
     def add_hook(self, name, func):
-        ''' Attach a callback to a hook. Three hooks are currently implemented:
+        """ Attach a callback to a hook. Three hooks are currently implemented:
 
             before_request
                 Executed once before each request. The request context is
@@ -635,65 +680,60 @@ class Bottle(object):
                 Executed once after each request regardless of its outcome.
             app_reset
                 Called whenever :meth:`Bottle.reset` is called.
-        '''
+        """
         if name in self.__hook_reversed:
             self._hooks[name].insert(0, func)
         else:
             self._hooks[name].append(func)
 
     def remove_hook(self, name, func):
-        ''' Remove a callback from a hook. '''
+        """ Remove a callback from a hook. """
         if name in self._hooks and func in self._hooks[name]:
             self._hooks[name].remove(func)
             return True
 
     def trigger_hook(self, __name, *args, **kwargs):
-        ''' Trigger a hook and return a list of results. '''
+        """ Trigger a hook and return a list of results. """
         return [hook(*args, **kwargs) for hook in self._hooks[__name][:]]
 
     def hook(self, name):
         """ Return a decorator that attaches a callback to a hook. See
             :meth:`add_hook` for details."""
+
         def decorator(func):
             self.add_hook(name, func)
             return func
-        return decorator
-
-    def mount(self, prefix, app, **options):
-        ''' Mount an application (:class:`Bottle` or plain WSGI) to a specific
-            URL prefix. Example::
-
-                root_app.mount('/admin/', admin_app)
-
-            :param prefix: path prefix or `mount-point`. If it ends in a slash,
-                that slash is mandatory.
-            :param app: an instance of :class:`Bottle` or a WSGI application.
 
-            All other parameters are passed to the underlying :meth:`route` call.
-        '''
-        if isinstance(app, basestring):
-            depr('Parameter order of Bottle.mount() changed.', True) # 0.10
+        return decorator
 
+    def _mount_wsgi(self, prefix, app, **options):
         segments = [p for p in prefix.split('/') if p]
-        if not segments: raise ValueError('Empty path prefix.')
+        if not segments:
+            raise ValueError('WSGI applications cannot be mounted to "/".')
         path_depth = len(segments)
 
         def mountpoint_wrapper():
             try:
                 request.path_shift(path_depth)
                 rs = HTTPResponse([])
+
                 def start_response(status, headerlist, exc_info=None):
                     if exc_info:
-                        try:
-                            _raise(*exc_info)
-                        finally:
-                            exc_info = None
+                        _raise(*exc_info)
+                    if py3k:
+                        # Errors here mean that the mounted WSGI app did not
+                        # follow PEP-3333 (which requires latin1) or used a
+                        # pre-encoding other than utf8 :/
+                        status = status.encode('latin1').decode('utf8')
+                        headerlist = [(k, v.encode('latin1').decode('utf8'))
+                                      for (k, v) in headerlist]
                     rs.status = status
-                    for name, value in headerlist: rs.add_header(name, value)
+                    for name, value in headerlist:
+                        rs.add_header(name, value)
                     return rs.body.append
+
                 body = app(request.environ, start_response)
-                if body and rs.body: body = itertools.chain(rs.body, body)
-                rs.body = body or rs.body
+                rs.body = itertools.chain(rs.body, body) if rs.body else body
                 return rs
             finally:
                 request.path_shift(-path_depth)
@@ -707,21 +747,74 @@ class Bottle(object):
         if not prefix.endswith('/'):
             self.route('/' + '/'.join(segments), **options)
 
+    def _mount_app(self, prefix, app, **options):
+        if app in self._mounts or '_mount.app' in app.config:
+            depr(0, 13, "Application mounted multiple times. Falling back to WSGI mount.",
+                 "Clone application before mounting to a different location.")
+            return self._mount_wsgi(prefix, app, **options)
+
+        if options:
+            depr(0, 13, "Unsupported mount options. Falling back to WSGI mount.",
+                 "Do not specify any route options when mounting bottle application.")
+            return self._mount_wsgi(prefix, app, **options)
+
+        if not prefix.endswith("/"):
+            depr(0, 13, "Prefix must end in '/'. Falling back to WSGI mount.",
+                 "Consider adding an explicit redirect from '/prefix' to '/prefix/' in the parent application.")
+            return self._mount_wsgi(prefix, app, **options)
+
+        self._mounts.append(app)
+        app.config['_mount.prefix'] = prefix
+        app.config['_mount.app'] = self
+        for route in app.routes:
+            route.rule = prefix + route.rule.lstrip('/')
+            self.add_route(route)
+
+    def mount(self, prefix, app, **options):
+        """ Mount an application (:class:`Bottle` or plain WSGI) to a specific
+            URL prefix. Example::
+
+                parent_app.mount('/prefix/', child_app)
+
+            :param prefix: path prefix or `mount-point`.
+            :param app: an instance of :class:`Bottle` or a WSGI application.
+
+            Plugins from the parent application are not applied to the routes
+            of the mounted child application. If you need plugins in the child
+            application, install them separately.
+
+            While it is possible to use path wildcards within the prefix path
+            (:class:`Bottle` childs only), it is highly discouraged.
+
+            The prefix path must end with a slash. If you want to access the
+            root of the child application via `/prefix` in addition to
+            `/prefix/`, consider adding a route with a 307 redirect to the
+            parent application.
+        """
+
+        if not prefix.startswith('/'):
+            raise ValueError("Prefix must start with '/'")
+
+        if isinstance(app, Bottle):
+            return self._mount_app(prefix, app, **options)
+        else:
+            return self._mount_wsgi(prefix, app, **options)
+
     def merge(self, routes):
-        ''' Merge the routes of another :class:`Bottle` application or a list of
+        """ Merge the routes of another :class:`Bottle` application or a list of
             :class:`Route` objects into this application. The routes keep their
             'owner', meaning that the :data:`Route.app` attribute is not
-            changed. '''
+            changed. """
         if isinstance(routes, Bottle):
             routes = routes.routes
         for route in routes:
             self.add_route(route)
 
     def install(self, plugin):
-        ''' Add a plugin to the list of plugins and prepare it for being
+        """ Add a plugin to the list of plugins and prepare it for being
             applied to all routes of this application. A plugin may be a simple
             decorator or an object that implements the :class:`Plugin` API.
-        '''
+        """
         if hasattr(plugin, 'setup'): plugin.setup(self)
         if not callable(plugin) and not hasattr(plugin, 'apply'):
             raise TypeError("Plugins must be callable or implement .apply()")
@@ -730,10 +823,10 @@ class Bottle(object):
         return plugin
 
     def uninstall(self, plugin):
-        ''' Uninstall plugins. Pass an instance to remove a specific plugin, a type
+        """ Uninstall plugins. Pass an instance to remove a specific plugin, a type
             object to remove all plugins that match that type, a string to remove
             all plugins with a matching ``name`` attribute or ``True`` to remove all
-            plugins. Return the list of removed plugins. '''
+            plugins. Return the list of removed plugins. """
         removed, remove = [], plugin
         for i, plugin in list(enumerate(self.plugins))[::-1]:
             if remove is True or remove is plugin or remove is type(plugin) \
@@ -745,29 +838,30 @@ class Bottle(object):
         return removed
 
     def reset(self, route=None):
-        ''' Reset all routes (force plugins to be re-applied) and clear all
+        """ Reset all routes (force plugins to be re-applied) and clear all
             caches. If an ID or route object is given, only that specific route
-            is affected. '''
+            is affected. """
         if route is None: routes = self.routes
         elif isinstance(route, Route): routes = [route]
         else: routes = [self.routes[route]]
-        for route in routes: route.reset()
+        for route in routes:
+            route.reset()
         if DEBUG:
-            for route in routes: route.prepare()
+            for route in routes:
+                route.prepare()
         self.trigger_hook('app_reset')
 
     def close(self):
-        ''' Close the application and all installed plugins. '''
+        """ Close the application and all installed plugins. """
         for plugin in self.plugins:
             if hasattr(plugin, 'close'): plugin.close()
-        self.stopped = True
 
     def run(self, **kwargs):
-        ''' Calls :func:`run` with the same parameters. '''
+        """ Calls :func:`run` with the same parameters. """
         run(self, **kwargs)
 
     def match(self, environ):
-        """ Search for a matching route and return a (:class:`Route` , urlargs)
+        """ Search for a matching route and return a (:class:`Route`, urlargs)
             tuple. The second value is a dictionary with parameters extracted
             from the URL. Raise :exc:`HTTPError` (404/405) on a non-match."""
         return self.router.match(environ)
@@ -779,21 +873,26 @@ class Bottle(object):
         return urljoin(urljoin('/', scriptname), location)
 
     def add_route(self, route):
-        ''' Add a route object, but do not change the :data:`Route.app`
-            attribute.'''
+        """ Add a route object, but do not change the :data:`Route.app`
+            attribute."""
         self.routes.append(route)
         self.router.add(route.rule, route.method, route, name=route.name)
         if DEBUG: route.prepare()
 
-    def route(self, path=None, method='GET', callback=None, name=None,
-              apply=None, skip=None, **config):
+    def route(self,
+              path=None,
+              method='GET',
+              callback=None,
+              name=None,
+              apply=None,
+              skip=None, **config):
         """ A decorator to bind a function to a request URL. Example::
 
-                @app.route('/hello/:name')
+                @app.route('/hello/<name>')
                 def hello(name):
                     return 'Hello %s' % name
 
-            The ``:name`` part is a wildcard. See :class:`Router` for syntax
+            The ``<name>`` part is a wildcard. See :class:`Router` for syntax
             details.
 
             :param path: Request path or a list of paths to listen to. If no
@@ -815,16 +914,19 @@ class Bottle(object):
         if callable(path): path, callback = None, path
         plugins = makelist(apply)
         skiplist = makelist(skip)
+
         def decorator(callback):
-            # TODO: Documentation and tests
             if isinstance(callback, basestring): callback = load(callback)
             for rule in makelist(path) or yieldroutes(callback):
                 for verb in makelist(method):
                     verb = verb.upper()
-                    route = Route(self, rule, verb, callback, name=name,
-                                  plugins=plugins, skiplist=skiplist, **config)
+                    route = Route(self, rule, verb, callback,
+                                  name=name,
+                                  plugins=plugins,
+                                  skiplist=skiplist, **config)
                     self.add_route(route)
             return callback
+
         return decorator(callback) if callback else decorator
 
     def get(self, path=None, method='GET', **options):
@@ -843,52 +945,84 @@ class Bottle(object):
         """ Equals :meth:`route` with a ``DELETE`` method parameter. """
         return self.route(path, method, **options)
 
-    def error(self, code=500):
-        """ Decorator: Register an output handler for a HTTP error code"""
-        def wrapper(handler):
-            self.error_handler[int(code)] = handler
-            return handler
-        return wrapper
+    def patch(self, path=None, method='PATCH', **options):
+        """ Equals :meth:`route` with a ``PATCH`` method parameter. """
+        return self.route(path, method, **options)
+
+    def error(self, code=500, callback=None):
+        """ Register an output handler for a HTTP error code. Can
+            be used as a decorator or called directly ::
+
+                def error_handler_500(error):
+                    return 'error_handler_500'
+
+                app.error(code=500, callback=error_handler_500)
+
+                @app.error(404)
+                def error_handler_404(error):
+                    return 'error_handler_404'
+
+        """
+
+        def decorator(callback):
+            if isinstance(callback, basestring): callback = load(callback)
+            self.error_handler[int(code)] = callback
+            return callback
+
+        return decorator(callback) if callback else decorator
 
     def default_error_handler(self, res):
-        return tob(template(ERROR_PAGE_TEMPLATE, e=res))
+        return tob(template(ERROR_PAGE_TEMPLATE, e=res, template_settings=dict(name='__ERROR_PAGE_TEMPLATE')))
 
     def _handle(self, environ):
-        try:
+        path = environ['bottle.raw_path'] = environ['PATH_INFO']
+        if py3k:
+            environ['PATH_INFO'] = path.encode('latin1').decode('utf8', 'ignore')
 
-            environ['bottle.app'] = self
-            request.bind(environ)
-            response.bind()
+        environ['bottle.app'] = self
+        request.bind(environ)
+        response.bind()
 
-            path = environ['bottle.raw_path'] = environ['PATH_INFO']
-            if py3k:
+        try:
+            while True: # Remove in 0.14 together with RouteReset
+                out = None
                 try:
-                    environ['PATH_INFO'] = path.encode('latin1').decode('utf8')
-                except UnicodeError:
-                    return HTTPError(400, 'Invalid path string. Expected UTF-8')
-
-            try:
-                self.trigger_hook('before_request')
-                route, args = self.router.match(environ)
-                environ['route.handle'] = route
-                environ['bottle.route'] = route
-                environ['route.url_args'] = args
-                return route.call(**args)
-            finally:
-                self.trigger_hook('after_request')
-
-        except HTTPResponse:
-            return _e()
-        except RouteReset:
-            route.reset()
-            return self._handle(environ)
+                    self.trigger_hook('before_request')
+                    route, args = self.router.match(environ)
+                    environ['route.handle'] = route
+                    environ['bottle.route'] = route
+                    environ['route.url_args'] = args
+                    out = route.call(**args)
+                    break
+                except HTTPResponse as E:
+                    out = E
+                    break
+                except RouteReset:
+                    depr(0, 13, "RouteReset exception deprecated",
+                                "Call route.call() after route.reset() and "
+                                "return the result.")
+                    route.reset()
+                    continue
+                finally:
+                    if isinstance(out, HTTPResponse):
+                        out.apply(response)
+                    try:
+                        self.trigger_hook('after_request')
+                    except HTTPResponse as E:
+                        out = E
+                        out.apply(response)
         except (KeyboardInterrupt, SystemExit, MemoryError):
             raise
-        except Exception:
+        except Exception as E:
             if not self.catchall: raise
             stacktrace = format_exc()
             environ['wsgi.errors'].write(stacktrace)
-            return HTTPError(500, "Internal Server Error", _e(), stacktrace)
+            environ['wsgi.errors'].flush()
+            environ['bottle.exc_info'] = sys.exc_info()
+            out = HTTPError(500, "Internal Server Error", E, stacktrace)
+            out.apply(response)
+
+        return out
 
     def _cast(self, out, peek=None):
         """ Try to convert the parameter into something WSGI compatible and set
@@ -905,7 +1039,7 @@ class Bottle(object):
         # Join lists of byte or unicode strings. Mixed lists are NOT supported
         if isinstance(out, (tuple, list))\
         and isinstance(out[0], (bytes, unicode)):
-            out = out[0][0:0].join(out) # b'abc'[0:0] -> b''
+            out = out[0][0:0].join(out)  # b'abc'[0:0] -> b''
         # Encode unicode strings
         if isinstance(out, unicode):
             out = out.encode(response.charset)
@@ -918,7 +1052,8 @@ class Bottle(object):
         # TODO: Handle these explicitly in handle() or make them iterable.
         if isinstance(out, HTTPError):
             out.apply(response)
-            out = self.error_handler.get(out.status_code, self.default_error_handler)(out)
+            out = self.error_handler.get(out.status_code,
+                                         self.default_error_handler)(out)
             return self._cast(out)
         if isinstance(out, HTTPResponse):
             out.apply(response)
@@ -939,13 +1074,13 @@ class Bottle(object):
                 first = next(iout)
         except StopIteration:
             return self._cast('')
-        except HTTPResponse:
-            first = _e()
+        except HTTPResponse as E:
+            first = E
         except (KeyboardInterrupt, SystemExit, MemoryError):
             raise
-        except Exception:
+        except Exception as error:
             if not self.catchall: raise
-            first = HTTPError(500, 'Unhandled exception', _e(), format_exc())
+            first = HTTPError(500, 'Unhandled exception', error, format_exc())
 
         # These are the inner types allowed in iterator or generator objects.
         if isinstance(first, HTTPResponse):
@@ -971,36 +1106,49 @@ class Bottle(object):
             or environ['REQUEST_METHOD'] == 'HEAD':
                 if hasattr(out, 'close'): out.close()
                 out = []
-            start_response(response._status_line, response.headerlist)
+            exc_info = environ.get('bottle.exc_info')
+            if exc_info is not None:
+                del environ['bottle.exc_info']
+            start_response(response._wsgi_status_line(), response.headerlist, exc_info)
             return out
         except (KeyboardInterrupt, SystemExit, MemoryError):
             raise
-        except Exception:
+        except Exception as E:
             if not self.catchall: raise
             err = '<h1>Critical error while processing request: %s</h1>' \
                   % html_escape(environ.get('PATH_INFO', '/'))
             if DEBUG:
                 err += '<h2>Error:</h2>\n<pre>\n%s\n</pre>\n' \
                        '<h2>Traceback:</h2>\n<pre>\n%s\n</pre>\n' \
-                       % (html_escape(repr(_e())), html_escape(format_exc()))
+                       % (html_escape(repr(E)), html_escape(format_exc()))
             environ['wsgi.errors'].write(err)
+            environ['wsgi.errors'].flush()
             headers = [('Content-Type', 'text/html; charset=UTF-8')]
             start_response('500 INTERNAL SERVER ERROR', headers, sys.exc_info())
             return [tob(err)]
 
     def __call__(self, environ, start_response):
-        ''' Each instance of :class:'Bottle' is a WSGI application. '''
+        """ Each instance of :class:'Bottle' is a WSGI application. """
         return self.wsgi(environ, start_response)
 
+    def __enter__(self):
+        """ Use this application as default for all module-level shortcuts. """
+        default_app.push(self)
+        return self
 
+    def __exit__(self, exc_type, exc_value, traceback):
+        default_app.pop()
 
-
-
+    def __setattr__(self, name, value):
+        if name in self.__dict__:
+            raise AttributeError("Attribute %s already defined. Plugin conflict?" % name)
+        object.__setattr__(self, name, value)
 
 ###############################################################################
 # HTTP and WSGI Tools ##########################################################
 ###############################################################################
 
+
 class BaseRequest(object):
     """ A wrapper for WSGI environment dictionaries that adds a lot of
         convenient access methods and properties. Most of them are read-only.
@@ -1010,7 +1158,7 @@ class BaseRequest(object):
         way to store and access request-specific data.
     """
 
-    __slots__ = ('environ')
+    __slots__ = ('environ', )
 
     #: Maximum size of memory buffer for :attr:`body` in bytes.
     MEMFILE_MAX = 102400
@@ -1024,7 +1172,7 @@ class BaseRequest(object):
 
     @DictProperty('environ', 'bottle.app', read_only=True)
     def app(self):
-        ''' Bottle application handling this request. '''
+        """ Bottle application handling this request. """
         raise RuntimeError('This request is not connected to an application.')
 
     @DictProperty('environ', 'bottle.route', read_only=True)
@@ -1039,49 +1187,56 @@ class BaseRequest(object):
 
     @property
     def path(self):
-        ''' The value of ``PATH_INFO`` with exactly one prefixed slash (to fix
-            broken clients and avoid the "empty path" edge case). '''
-        return '/' + self.environ.get('PATH_INFO','').lstrip('/')
+        """ The value of ``PATH_INFO`` with exactly one prefixed slash (to fix
+            broken clients and avoid the "empty path" edge case). """
+        return '/' + self.environ.get('PATH_INFO', '').lstrip('/')
 
     @property
     def method(self):
-        ''' The ``REQUEST_METHOD`` value as an uppercase string. '''
+        """ The ``REQUEST_METHOD`` value as an uppercase string. """
         return self.environ.get('REQUEST_METHOD', 'GET').upper()
 
     @DictProperty('environ', 'bottle.request.headers', read_only=True)
     def headers(self):
-        ''' A :class:`WSGIHeaderDict` that provides case-insensitive access to
-            HTTP request headers. '''
+        """ A :class:`WSGIHeaderDict` that provides case-insensitive access to
+            HTTP request headers. """
         return WSGIHeaderDict(self.environ)
 
     def get_header(self, name, default=None):
-        ''' Return the value of a request header, or a given default value. '''
+        """ Return the value of a request header, or a given default value. """
         return self.headers.get(name, default)
 
     @DictProperty('environ', 'bottle.request.cookies', read_only=True)
     def cookies(self):
         """ Cookies parsed into a :class:`FormsDict`. Signed cookies are NOT
             decoded. Use :meth:`get_cookie` if you expect signed cookies. """
-        cookies = SimpleCookie(self.environ.get('HTTP_COOKIE','')).values()
+        cookies = SimpleCookie(self.environ.get('HTTP_COOKIE', '')).values()
         return FormsDict((c.key, c.value) for c in cookies)
 
-    def get_cookie(self, key, default=None, secret=None):
+    def get_cookie(self, key, default=None, secret=None, digestmod=hashlib.sha256):
         """ Return the content of a cookie. To read a `Signed Cookie`, the
             `secret` must match the one used to create the cookie (see
             :meth:`BaseResponse.set_cookie`). If anything goes wrong (missing
             cookie or wrong signature), return a default value. """
         value = self.cookies.get(key)
-        if secret and value:
-            dec = cookie_decode(value, secret) # (key, value) tuple or None
-            return dec[1] if dec and dec[0] == key else default
+        if secret:
+            # See BaseResponse.set_cookie for details on signed cookies.
+            if value and value.startswith('!') and '?' in value:
+                sig, msg = map(tob, value[1:].split('?', 1))
+                hash = hmac.new(tob(secret), msg, digestmod=digestmod).digest()
+                if _lscmp(sig, base64.b64encode(hash)):
+                    dst = pickle.loads(base64.b64decode(msg))
+                    if dst and dst[0] == key:
+                        return dst[1]
+            return default
         return value or default
 
     @DictProperty('environ', 'bottle.request.query', read_only=True)
     def query(self):
-        ''' The :attr:`query_string` parsed into a :class:`FormsDict`. These
+        """ The :attr:`query_string` parsed into a :class:`FormsDict`. These
             values are sometimes called "URL arguments" or "GET parameters", but
             not to be confused with "URL wildcards" as they are provided by the
-            :class:`Router`. '''
+            :class:`Router`. """
         get = self.environ['bottle.get'] = FormsDict()
         pairs = _parse_qsl(self.environ.get('QUERY_STRING', ''))
         for key, value in pairs:
@@ -1095,6 +1250,7 @@ class BaseRequest(object):
             :class:`FormsDict`. All keys and values are strings. File uploads
             are stored separately in :attr:`files`. """
         forms = FormsDict()
+        forms.recode_unicode = self.POST.recode_unicode
         for name, item in self.POST.allitems():
             if not isinstance(item, FileUpload):
                 forms[name] = item
@@ -1118,6 +1274,7 @@ class BaseRequest(object):
 
         """
         files = FormsDict()
+        files.recode_unicode = self.POST.recode_unicode
         for name, item in self.POST.allitems():
             if isinstance(item, FileUpload):
                 files[name] = item
@@ -1125,16 +1282,21 @@ class BaseRequest(object):
 
     @DictProperty('environ', 'bottle.request.json', read_only=True)
     def json(self):
-        ''' If the ``Content-Type`` header is ``application/json``, this
-            property holds the parsed content of the request body. Only requests
-            smaller than :attr:`MEMFILE_MAX` are processed to avoid memory
-            exhaustion. '''
+        """ If the ``Content-Type`` header is ``application/json`` or
+            ``application/json-rpc``, this property holds the parsed content
+            of the request body. Only requests smaller than :attr:`MEMFILE_MAX`
+            are processed to avoid memory exhaustion.
+            Invalid JSON raises a 400 error response.
+        """
         ctype = self.environ.get('CONTENT_TYPE', '').lower().split(';')[0]
-        if ctype == 'application/json':
-            b = self._get_body_string()
+        if ctype in ('application/json', 'application/json-rpc'):
+            b = self._get_body_string(self.MEMFILE_MAX)
             if not b:
                 return None
-            return json_loads(b)
+            try:
+                return json_loads(b)
+            except (ValueError, TypeError):
+                raise HTTPError(400, 'Invalid JSON')
         return None
 
     def _iter_body(self, read, bufsize):
@@ -1145,7 +1307,8 @@ class BaseRequest(object):
             yield part
             maxread -= len(part)
 
-    def _iter_chunked(self, read, bufsize):
+    @staticmethod
+    def _iter_chunked(read, bufsize):
         err = HTTPError(400, 'Error while parsing chunked transfer body.')
         rn, sem, bs = tob('\r\n'), tob(';'), tob('')
         while True:
@@ -1174,14 +1337,18 @@ class BaseRequest(object):
 
     @DictProperty('environ', 'bottle.request.body', read_only=True)
     def _body(self):
+        try:
+            read_func = self.environ['wsgi.input'].read
+        except KeyError:
+            self.environ['wsgi.input'] = BytesIO()
+            return self.environ['wsgi.input']
         body_iter = self._iter_chunked if self.chunked else self._iter_body
-        read_func = self.environ['wsgi.input'].read
         body, body_size, is_temp_file = BytesIO(), 0, False
         for part in body_iter(read_func, self.MEMFILE_MAX):
             body.write(part)
             body_size += len(part)
             if not is_temp_file and body_size > self.MEMFILE_MAX:
-                body, tmp = TemporaryFile(mode='w+b'), body
+                body, tmp = NamedTemporaryFile(mode='w+b'), body
                 body.write(tmp.getvalue())
                 del tmp
                 is_temp_file = True
@@ -1189,16 +1356,14 @@ class BaseRequest(object):
         body.seek(0)
         return body
 
-    def _get_body_string(self):
-        ''' read body until content-length or MEMFILE_MAX into a string. Raise
-            HTTPError(413) on requests that are to large. '''
-        clen = self.content_length
-        if clen > self.MEMFILE_MAX:
-            raise HTTPError(413, 'Request to large')
-        if clen < 0: clen = self.MEMFILE_MAX + 1
-        data = self.body.read(clen)
-        if len(data) > self.MEMFILE_MAX: # Fail fast
-            raise HTTPError(413, 'Request to large')
+    def _get_body_string(self, maxread):
+        """ Read body into a string. Raise HTTPError(413) on requests that are
+            too large. """
+        if self.content_length > maxread:
+            raise HTTPError(413, 'Request entity too large')
+        data = self.body.read(maxread + 1)
+        if len(data) > maxread:
+            raise HTTPError(413, 'Request entity too large')
         return data
 
     @property
@@ -1213,8 +1378,9 @@ class BaseRequest(object):
 
     @property
     def chunked(self):
-        ''' True if Chunked transfer encoding was. '''
-        return 'chunked' in self.environ.get('HTTP_TRANSFER_ENCODING', '').lower()
+        """ True if Chunked transfer encoding was. """
+        return 'chunked' in self.environ.get(
+            'HTTP_TRANSFER_ENCODING', '').lower()
 
     #: An alias for :attr:`query`.
     GET = query
@@ -1223,35 +1389,35 @@ class BaseRequest(object):
     def POST(self):
         """ The values of :attr:`forms` and :attr:`files` combined into a single
             :class:`FormsDict`. Values are either strings (form values) or
-            instances of :class:`cgi.FieldStorage` (file uploads).
+            instances of :class:`FileUpload`.
         """
         post = FormsDict()
+        content_type = self.environ.get('CONTENT_TYPE', '')
+        content_type, options = _parse_http_header(content_type)[0]
         # We default to application/x-www-form-urlencoded for everything that
         # is not multipart and take the fast path (also: 3.1 workaround)
-        if not self.content_type.startswith('multipart/'):
-            pairs = _parse_qsl(tonat(self._get_body_string(), 'latin1'))
-            for key, value in pairs:
+        if not content_type.startswith('multipart/'):
+            body = tonat(self._get_body_string(self.MEMFILE_MAX), 'latin1')
+            for key, value in _parse_qsl(body):
                 post[key] = value
             return post
 
-        safe_env = {'QUERY_STRING':''} # Build a safe environment for cgi
-        for key in ('REQUEST_METHOD', 'CONTENT_TYPE', 'CONTENT_LENGTH'):
-            if key in self.environ: safe_env[key] = self.environ[key]
-        args = dict(fp=self.body, environ=safe_env, keep_blank_values=True)
-        if py31:
-            args['fp'] = NCTextIOWrapper(args['fp'], encoding='utf8',
-                                         newline='\n')
-        elif py3k:
-            args['encoding'] = 'utf8'
-        data = cgi.FieldStorage(**args)
-        self['_cgi.FieldStorage'] = data #http://bugs.python.org/issue18394#msg207958
-        data = data.list or []
-        for item in data:
-            if item.filename is None:
-                post[item.name] = item.value
+        post.recode_unicode = False
+        charset = options.get("charset", "utf8")
+        boundary = options.get("boundary")
+        if not boundary:
+            raise MultipartError("Invalid content type header, missing boundary")
+        parser = _MultipartParser(self.body, boundary, self.content_length,
+            mem_limit=self.MEMFILE_MAX, memfile_limit=self.MEMFILE_MAX,
+            charset=charset)
+
+        for part in parser.parse():
+            if not part.filename and part.is_buffered():
+                post[part.name] = tonat(part.value, 'utf8')
             else:
-                post[item.name] = FileUpload(item.file, item.name,
-                                             item.filename, item.headers)
+                post[part.name] = FileUpload(part.file, part.name,
+                                            part.filename, part.headerlist)
+
         return post
 
     @property
@@ -1264,12 +1430,13 @@ class BaseRequest(object):
 
     @DictProperty('environ', 'bottle.request.urlparts', read_only=True)
     def urlparts(self):
-        ''' The :attr:`url` string as an :class:`urlparse.SplitResult` tuple.
+        """ The :attr:`url` string as an :class:`urlparse.SplitResult` tuple.
             The tuple contains (scheme, host, path, query_string and fragment),
             but the fragment is always empty because it is not visible to the
-            server. '''
+            server. """
         env = self.environ
-        http = env.get('HTTP_X_FORWARDED_PROTO') or env.get('wsgi.url_scheme', 'http')
+        http = env.get('HTTP_X_FORWARDED_PROTO') \
+             or env.get('wsgi.url_scheme', 'http')
         host = env.get('HTTP_X_FORWARDED_HOST') or env.get('HTTP_HOST')
         if not host:
             # HTTP 1.1 requires a Host-header. This is for HTTP/1.0 clients.
@@ -1293,46 +1460,46 @@ class BaseRequest(object):
 
     @property
     def script_name(self):
-        ''' The initial portion of the URL's `path` that was removed by a higher
+        """ The initial portion of the URL's `path` that was removed by a higher
             level (server or routing middleware) before the application was
             called. This script path is returned with leading and tailing
-            slashes. '''
+            slashes. """
         script_name = self.environ.get('SCRIPT_NAME', '').strip('/')
         return '/' + script_name + '/' if script_name else '/'
 
     def path_shift(self, shift=1):
-        ''' Shift path segments from :attr:`path` to :attr:`script_name` and
+        """ Shift path segments from :attr:`path` to :attr:`script_name` and
             vice versa.
 
            :param shift: The number of path segments to shift. May be negative
                          to change the shift direction. (default: 1)
-        '''
-        script = self.environ.get('SCRIPT_NAME','/')
-        self['SCRIPT_NAME'], self['PATH_INFO'] = path_shift(script, self.path, shift)
+        """
+        script, path = path_shift(self.environ.get('SCRIPT_NAME', '/'), self.path, shift)
+        self['SCRIPT_NAME'], self['PATH_INFO'] = script, path
 
     @property
     def content_length(self):
-        ''' The request body length as an integer. The client is responsible to
+        """ The request body length as an integer. The client is responsible to
             set this header. Otherwise, the real length of the body is unknown
-            and -1 is returned. In this case, :attr:`body` will be empty. '''
+            and -1 is returned. In this case, :attr:`body` will be empty. """
         return int(self.environ.get('CONTENT_LENGTH') or -1)
 
     @property
     def content_type(self):
-        ''' The Content-Type header as a lowercase-string (default: empty). '''
+        """ The Content-Type header as a lowercase-string (default: empty). """
         return self.environ.get('CONTENT_TYPE', '').lower()
 
     @property
     def is_xhr(self):
-        ''' True if the request was triggered by a XMLHttpRequest. This only
+        """ True if the request was triggered by a XMLHttpRequest. This only
             works with JavaScript libraries that support the `X-Requested-With`
-            header (most of the popular libraries do). '''
-        requested_with = self.environ.get('HTTP_X_REQUESTED_WITH','')
+            header (most of the popular libraries do). """
+        requested_with = self.environ.get('HTTP_X_REQUESTED_WITH', '')
         return requested_with.lower() == 'xmlhttprequest'
 
     @property
     def is_ajax(self):
-        ''' Alias for :attr:`is_xhr`. "Ajax" is not the right term. '''
+        """ Alias for :attr:`is_xhr`. "Ajax" is not the right term. """
         return self.is_xhr
 
     @property
@@ -1343,7 +1510,7 @@ class BaseRequest(object):
             front web-server or a middleware), the password field is None, but
             the user field is looked up from the ``REMOTE_USER`` environ
             variable. On any errors, None is returned. """
-        basic = parse_auth(self.environ.get('HTTP_AUTHORIZATION',''))
+        basic = parse_auth(self.environ.get('HTTP_AUTHORIZATION', ''))
         if basic: return basic
         ruser = self.environ.get('REMOTE_USER')
         if ruser: return (ruser, None)
@@ -1371,12 +1538,25 @@ class BaseRequest(object):
         """ Return a new :class:`Request` with a shallow :attr:`environ` copy. """
         return Request(self.environ.copy())
 
-    def get(self, value, default=None): return self.environ.get(value, default)
-    def __getitem__(self, key): return self.environ[key]
-    def __delitem__(self, key): self[key] = ""; del(self.environ[key])
-    def __iter__(self): return iter(self.environ)
-    def __len__(self): return len(self.environ)
-    def keys(self): return self.environ.keys()
+    def get(self, value, default=None):
+        return self.environ.get(value, default)
+
+    def __getitem__(self, key):
+        return self.environ[key]
+
+    def __delitem__(self, key):
+        self[key] = ""
+        del (self.environ[key])
+
+    def __iter__(self):
+        return iter(self.environ)
+
+    def __len__(self):
+        return len(self.environ)
+
+    def keys(self):
+        return self.environ.keys()
+
     def __setitem__(self, key, value):
         """ Change an environ value and clear all caches that depend on it. """
 
@@ -1394,22 +1574,32 @@ class BaseRequest(object):
             todelete = ('headers', 'cookies')
 
         for key in todelete:
-            self.environ.pop('bottle.request.'+key, None)
+            self.environ.pop('bottle.request.' + key, None)
 
     def __repr__(self):
         return '<%s: %s %s>' % (self.__class__.__name__, self.method, self.url)
 
     def __getattr__(self, name):
-        ''' Search in self.environ for additional user defined attributes. '''
+        """ Search in self.environ for additional user defined attributes. """
         try:
-            var = self.environ['bottle.request.ext.%s'%name]
+            var = self.environ['bottle.request.ext.%s' % name]
             return var.__get__(self) if hasattr(var, '__get__') else var
         except KeyError:
             raise AttributeError('Attribute %r not defined.' % name)
 
     def __setattr__(self, name, value):
+        """ Define new attributes that are local to the bound request environment. """
         if name == 'environ': return object.__setattr__(self, name, value)
-        self.environ['bottle.request.ext.%s'%name] = value
+        key = 'bottle.request.ext.%s' % name
+        if hasattr(self, name):
+            raise AttributeError("Attribute already defined: %s" % name)
+        self.environ[key] = value
+
+    def __delattr__(self, name):
+        try:
+            del self.environ['bottle.request.ext.%s' % name]
+        except KeyError:
+            raise AttributeError("Attribute not defined: %s" % name)
 
 
 def _hkey(key):
@@ -1425,14 +1615,13 @@ def _hval(value):
     return value
 
 
-
 class HeaderProperty(object):
     def __init__(self, name, reader=None, writer=None, default=''):
         self.name, self.default = name, default
         self.reader, self.writer = reader, writer
         self.__doc__ = 'Current value of the %r header.' % name.title()
 
-    def __get__(self, obj, cls):
+    def __get__(self, obj, _):
         if obj is None: return self
         value = obj.get_header(self.name, self.default)
         return self.reader(value) if self.reader else value
@@ -1450,28 +1639,31 @@ class BaseResponse(object):
         This class does support dict-like case-insensitive item-access to
         headers, but is NOT a dict. Most notably, iterating over a response
         yields parts of the body and not the headers.
-
-        :param body: The response body as one of the supported types.
-        :param status: Either an HTTP status code (e.g. 200) or a status line
-                       including the reason phrase (e.g. '200 OK').
-        :param headers: A dictionary or a list of name-value pairs.
-
-        Additional keyword arguments are added to the list of headers.
-        Underscores in the header name are replaced with dashes.
     """
 
     default_status = 200
     default_content_type = 'text/html; charset=UTF-8'
 
-    # Header blacklist for specific response codes
+    # Header denylist for specific response codes
     # (rfc2616 section 10.2.3 and 10.3.5)
     bad_headers = {
-        204: set(('Content-Type',)),
-        304: set(('Allow', 'Content-Encoding', 'Content-Language',
+        204: frozenset(('Content-Type', 'Content-Length')),
+        304: frozenset(('Allow', 'Content-Encoding', 'Content-Language',
                   'Content-Length', 'Content-Range', 'Content-Type',
-                  'Content-Md5', 'Last-Modified'))}
+                  'Content-Md5', 'Last-Modified'))
+    }
 
     def __init__(self, body='', status=None, headers=None, **more_headers):
+        """ Create a new response object.
+
+        :param body: The response body as one of the supported types.
+        :param status: Either an HTTP status code (e.g. 200) or a status line
+                       including the reason phrase (e.g. '200 OK').
+        :param headers: A dictionary or a list of name-value pairs.
+
+        Additional keyword arguments are added to the list of headers.
+        Underscores in the header name are replaced with dashes.
+        """
         self._cookies = None
         self._headers = {}
         self.body = body
@@ -1486,15 +1678,17 @@ class BaseResponse(object):
                 self.add_header(name, value)
 
     def copy(self, cls=None):
-        ''' Returns a copy of self. '''
+        """ Returns a copy of self. """
         cls = cls or BaseResponse
         assert issubclass(cls, BaseResponse)
         copy = cls()
         copy.status = self.status
         copy._headers = dict((k, v[:]) for (k, v) in self._headers.items())
         if self._cookies:
-            copy._cookies = SimpleCookie()
-            copy._cookies.load(self._cookies.output(header=''))
+            cookies = copy._cookies = SimpleCookie()
+            for k,v in self._cookies.items():
+                cookies[k] = v.value
+                cookies[k].update(v) # also copy cookie attributes
         return copy
 
     def __iter__(self):
@@ -1506,30 +1700,34 @@ class BaseResponse(object):
 
     @property
     def status_line(self):
-        ''' The HTTP status line as a string (e.g. ``404 Not Found``).'''
+        """ The HTTP status line as a string (e.g. ``404 Not Found``)."""
         return self._status_line
 
     @property
     def status_code(self):
-        ''' The HTTP status code as an integer (e.g. 404).'''
+        """ The HTTP status code as an integer (e.g. 404)."""
         return self._status_code
 
     def _set_status(self, status):
         if isinstance(status, int):
             code, status = status, _HTTP_STATUS_LINES.get(status)
         elif ' ' in status:
+            if '\n' in status or '\r' in status or '\0' in status:
+                raise ValueError('Status line must not include control chars.')
             status = status.strip()
-            code   = int(status.split()[0])
+            code = int(status.split()[0])
         else:
             raise ValueError('String status line without a reason phrase.')
-        if not 100 <= code <= 999: raise ValueError('Status code out of range.')
+        if not 100 <= code <= 999:
+            raise ValueError('Status code out of range.')
         self._status_code = code
         self._status_line = str(status or ('%d Unknown' % code))
 
     def _get_status(self):
         return self._status_line
 
-    status = property(_get_status, _set_status, None,
+    status = property(
+        _get_status, _set_status, None,
         ''' A writeable property to change the HTTP response status. It accepts
             either a numeric code (100-999) or a string with a custom reason
             phrase (e.g. "404 Brain not found"). Both :data:`status_line` and
@@ -1539,36 +1737,49 @@ class BaseResponse(object):
 
     @property
     def headers(self):
-        ''' An instance of :class:`HeaderDict`, a case-insensitive dict-like
-            view on the response headers. '''
+        """ An instance of :class:`HeaderDict`, a case-insensitive dict-like
+            view on the response headers. """
         hdict = HeaderDict()
         hdict.dict = self._headers
         return hdict
 
-    def __contains__(self, name): return _hkey(name) in self._headers
-    def __delitem__(self, name):  del self._headers[_hkey(name)]
-    def __getitem__(self, name):  return self._headers[_hkey(name)][-1]
-    def __setitem__(self, name, value): self._headers[_hkey(name)] = [_hval(value)]
+    def __contains__(self, name):
+        return _hkey(name) in self._headers
+
+    def __delitem__(self, name):
+        del self._headers[_hkey(name)]
+
+    def __getitem__(self, name):
+        return self._headers[_hkey(name)][-1]
+
+    def __setitem__(self, name, value):
+        self._headers[_hkey(name)] = [_hval(value)]
 
     def get_header(self, name, default=None):
-        ''' Return the value of a previously defined header. If there is no
-            header with that name, return a default value. '''
+        """ Return the value of a previously defined header. If there is no
+            header with that name, return a default value. """
         return self._headers.get(_hkey(name), [default])[-1]
 
     def set_header(self, name, value):
-        ''' Create a new response header, replacing any previously defined
-            headers with the same name. '''
+        """ Create a new response header, replacing any previously defined
+            headers with the same name. """
         self._headers[_hkey(name)] = [_hval(value)]
 
     def add_header(self, name, value):
-        ''' Add an additional response header, not removing duplicates. '''
+        """ Add an additional response header, not removing duplicates. """
         self._headers.setdefault(_hkey(name), []).append(_hval(value))
 
     def iter_headers(self):
-        ''' Yield (header, value) tuples, skipping headers that are not
-            allowed with the current response status code. '''
+        """ Yield (header, value) tuples, skipping headers that are not
+            allowed with the current response status code. """
         return self.headerlist
 
+    def _wsgi_status_line(self):
+        """ WSGI conform status line (latin1-encodeable) """
+        if py3k:
+            return self._status_line.encode('utf8').decode('latin1')
+        return self._status_line
+
     @property
     def headerlist(self):
         """ WSGI conform list of (header, value) tuples. """
@@ -1588,9 +1799,10 @@ class BaseResponse(object):
         return out
 
     content_type = HeaderProperty('Content-Type')
-    content_length = HeaderProperty('Content-Length', reader=int)
-    expires = HeaderProperty('Expires',
-        reader=lambda x: datetime.utcfromtimestamp(parse_date(x)),
+    content_length = HeaderProperty('Content-Length', reader=int, default=-1)
+    expires = HeaderProperty(
+        'Expires',
+        reader=lambda x: datetime.fromtimestamp(parse_date(x), UTC),
         writer=lambda x: http_date(x))
 
     @property
@@ -1600,8 +1812,8 @@ class BaseResponse(object):
             return self.content_type.split('charset=')[-1].split(';')[0].strip()
         return default
 
-    def set_cookie(self, name, value, secret=None, **options):
-        ''' Create a new cookie or replace an old one. If the `secret` parameter is
+    def set_cookie(self, name, value, secret=None, digestmod=hashlib.sha256, **options):
+        """ Create a new cookie or replace an old one. If the `secret` parameter is
             set, create a `Signed Cookie` (described below).
 
             :param name: the name of the cookie.
@@ -1611,7 +1823,7 @@ class BaseResponse(object):
             Additionally, this method accepts all RFC 2109 attributes that are
             supported by :class:`cookie.Morsel`, including:
 
-            :param max_age: maximum age in seconds. (default: None)
+            :param maxage: maximum age in seconds. (default: None)
             :param expires: a datetime object or UNIX timestamp. (default: None)
             :param domain: the domain that is allowed to read the cookie.
               (default: current domain)
@@ -1619,8 +1831,10 @@ class BaseResponse(object):
             :param secure: limit the cookie to HTTPS connections (default: off).
             :param httponly: prevents client-side javascript to read this cookie
               (default: off, requires Python 2.6 or newer).
+            :param samesite: Control or disable third-party use for this cookie.
+              Possible values: `lax`, `strict` or `none` (default).
 
-            If neither `expires` nor `max_age` is set (default), the cookie will
+            If neither `expires` nor `maxage` is set (default), the cookie will
             expire at the end of the browser session (as soon as the browser
             window is closed).
 
@@ -1628,37 +1842,60 @@ class BaseResponse(object):
             cryptographically signed to prevent manipulation. Keep in mind that
             cookies are limited to 4kb in most browsers.
 
+            Warning: Pickle is a potentially dangerous format. If an attacker
+            gains access to the secret key, he could forge cookies that execute
+            code on server side if unpickled. Using pickle is discouraged and
+            support for it will be removed in later versions of bottle.
+
             Warning: Signed cookies are not encrypted (the client can still see
             the content) and not copy-protected (the client can restore an old
             cookie). The main intention is to make pickling and unpickling
             save, not to store secret information at client side.
-        '''
+        """
         if not self._cookies:
             self._cookies = SimpleCookie()
 
+        # Monkey-patch Cookie lib to support 'SameSite' parameter
+        # https://tools.ietf.org/html/draft-west-first-party-cookies-07#section-4.1
+        if py < (3, 8, 0):
+            Morsel._reserved.setdefault('samesite', 'SameSite')
+
         if secret:
-            value = touni(cookie_encode((name, value), secret))
+            if not isinstance(value, basestring):
+                depr(0, 13, "Pickling of arbitrary objects into cookies is "
+                            "deprecated.", "Only store strings in cookies. "
+                            "JSON strings are fine, too.")
+            encoded = base64.b64encode(pickle.dumps([name, value], -1))
+            sig = base64.b64encode(hmac.new(tob(secret), encoded,
+                                            digestmod=digestmod).digest())
+            value = touni(tob('!') + sig + tob('?') + encoded)
         elif not isinstance(value, basestring):
-            raise TypeError('Secret key missing for non-string Cookie.')
+            raise TypeError('Secret key required for non-string cookies.')
+
+        # Cookie size plus options must not exceed 4kb.
+        if len(name) + len(value) > 3800:
+            raise ValueError('Content does not fit into a cookie.')
 
-        if len(value) > 4096: raise ValueError('Cookie value to long.')
         self._cookies[name] = value
 
         for key, value in options.items():
-            if key == 'max_age':
+            if key in ('max_age', 'maxage'): # 'maxage' variant added in 0.13
+                key = 'max-age'
                 if isinstance(value, timedelta):
                     value = value.seconds + value.days * 24 * 3600
             if key == 'expires':
-                if isinstance(value, (datedate, datetime)):
-                    value = value.timetuple()
-                elif isinstance(value, (int, float)):
-                    value = time.gmtime(value)
-                value = time.strftime("%a, %d %b %Y %H:%M:%S GMT", value)
-            self._cookies[name][key.replace('_', '-')] = value
+                value = http_date(value)
+            if key in ('same_site', 'samesite'): # 'samesite' variant added in 0.13
+                key, value = 'samesite', (value or "none").lower()
+                if value not in ('lax', 'strict', 'none'):
+                    raise CookieError("Invalid value for SameSite")
+            if key in ('secure', 'httponly') and not value:
+                continue
+            self._cookies[name][key] = value
 
     def delete_cookie(self, key, **kwargs):
-        ''' Delete a cookie. Be sure to use the same `domain` and `path`
-            settings as used to create the cookie. '''
+        """ Delete a cookie. Be sure to use the same `domain` and `path`
+            settings as used to create the cookie. """
         kwargs['max_age'] = -1
         kwargs['expires'] = 0
         self.set_cookie(key, '', **kwargs)
@@ -1670,40 +1907,46 @@ class BaseResponse(object):
         return out
 
 
-def local_property(name=None):
-    if name: depr('local_property() is deprecated and will be removed.') #0.12
+def _local_property():
     ls = threading.local()
-    def fget(self):
-        try: return ls.var
+
+    def fget(_):
+        try:
+            return ls.var
         except AttributeError:
             raise RuntimeError("Request context not initialized.")
-    def fset(self, value): ls.var = value
-    def fdel(self): del ls.var
+
+    def fset(_, value):
+        ls.var = value
+
+    def fdel(_):
+        del ls.var
+
     return property(fget, fset, fdel, 'Thread-local property')
 
 
 class LocalRequest(BaseRequest):
-    ''' A thread-local subclass of :class:`BaseRequest` with a different
+    """ A thread-local subclass of :class:`BaseRequest` with a different
         set of attributes for each thread. There is usually only one global
         instance of this class (:data:`request`). If accessed during a
         request/response cycle, this instance always refers to the *current*
-        request (even on a multithreaded server). '''
+        request (even on a multithreaded server). """
     bind = BaseRequest.__init__
-    environ = local_property()
+    environ = _local_property()
 
 
 class LocalResponse(BaseResponse):
-    ''' A thread-local subclass of :class:`BaseResponse` with a different
+    """ A thread-local subclass of :class:`BaseResponse` with a different
         set of attributes for each thread. There is usually only one global
         instance of this class (:data:`response`). Its attributes are used
         to build the HTTP response at the end of the request/response cycle.
-    '''
+    """
     bind = BaseResponse.__init__
-    _status_line = local_property()
-    _status_code = local_property()
-    _cookies     = local_property()
-    _headers     = local_property()
-    body         = local_property()
+    _status_line = _local_property()
+    _status_code = _local_property()
+    _cookies = _local_property()
+    _headers = _local_property()
+    body = _local_property()
 
 
 Request = BaseRequest
@@ -1711,56 +1954,82 @@ Response = BaseResponse
 
 
 class HTTPResponse(Response, BottleException):
+    """ A subclass of :class:`Response` that can be raised or returned from request
+        handlers to short-curcuit request processing and override changes made to the
+        global :data:`request` object. This bypasses error handlers, even if the status
+        code indicates an error. Return or raise :class:`HTTPError` to trigger error
+        handlers.
+    """
+
     def __init__(self, body='', status=None, headers=None, **more_headers):
         super(HTTPResponse, self).__init__(body, status, headers, **more_headers)
 
-    def apply(self, response):
-        response._status_code = self._status_code
-        response._status_line = self._status_line
-        response._headers = self._headers
-        response._cookies = self._cookies
-        response.body = self.body
+    def apply(self, other):
+        """ Copy the state of this response to a different :class:`Response` object. """
+        other._status_code = self._status_code
+        other._status_line = self._status_line
+        other._headers = self._headers
+        other._cookies = self._cookies
+        other.body = self.body
 
 
 class HTTPError(HTTPResponse):
+    """ A subclass of :class:`HTTPResponse` that triggers error handlers. """
+
     default_status = 500
-    def __init__(self, status=None, body=None, exception=None, traceback=None,
-                 **options):
+
+    def __init__(self,
+                 status=None,
+                 body=None,
+                 exception=None,
+                 traceback=None, **more_headers):
         self.exception = exception
         self.traceback = traceback
-        super(HTTPError, self).__init__(body, status, **options)
-
-
-
-
+        super(HTTPError, self).__init__(body, status, **more_headers)
 
 ###############################################################################
 # Plugins ######################################################################
 ###############################################################################
 
-class PluginError(BottleException): pass
+
+class PluginError(BottleException):
+    pass
 
 
 class JSONPlugin(object):
     name = 'json'
-    api  = 2
+    api = 2
 
     def __init__(self, json_dumps=json_dumps):
         self.json_dumps = json_dumps
 
+    def setup(self, app):
+        app.config._define('json.enable', default=True, validate=bool,
+                          help="Enable or disable automatic dict->json filter.")
+        app.config._define('json.ascii', default=False, validate=bool,
+                          help="Use only 7-bit ASCII characters in output.")
+        app.config._define('json.indent', default=True, validate=bool,
+                          help="Add whitespace to make json more readable.")
+        app.config._define('json.dump_func', default=None,
+                          help="If defined, use this function to transform"
+                               " dict into json. The other options no longer"
+                               " apply.")
+
     def apply(self, callback, route):
         dumps = self.json_dumps
-        if not dumps: return callback
+        if not self.json_dumps: return callback
+
+        @functools.wraps(callback)
         def wrapper(*a, **ka):
             try:
                 rv = callback(*a, **ka)
-            except HTTPError:
-                rv = _e()
+            except HTTPResponse as resp:
+                rv = resp
 
             if isinstance(rv, dict):
                 #Attempt to serialize, raises exception on failure
                 json_response = dumps(rv)
-                #Set content type only if serialization succesful
+                #Set content type only if serialization successful
                 response.content_type = 'application/json'
                 return json_response
             elif isinstance(rv, HTTPResponse) and isinstance(rv.body, dict):
@@ -1772,12 +2041,15 @@ class JSONPlugin(object):
 
 
 class TemplatePlugin(object):
-    ''' This plugin applies the :func:`view` decorator to all routes with a
+    """ This plugin applies the :func:`view` decorator to all routes with a
         `template` config parameter. If the parameter is a tuple, the second
         element must be a dict with additional options (e.g. `template_engine`)
-        or default variables for the template. '''
+        or default variables for the template. """
     name = 'template'
-    api  = 2
+    api = 2
+
+    def setup(self, app):
+        app.tpl = self
 
     def apply(self, callback, route):
         conf = route.config.get('template')
@@ -1792,20 +2064,35 @@ class TemplatePlugin(object):
 #: Not a plugin, but part of the plugin API. TODO: Find a better place.
 class _ImportRedirect(object):
     def __init__(self, name, impmask):
-        ''' Create a virtual package that redirects imports (see PEP 302). '''
+        """ Create a virtual package that redirects imports (see PEP 302). """
         self.name = name
         self.impmask = impmask
         self.module = sys.modules.setdefault(name, new_module(name))
-        self.module.__dict__.update({'__file__': __file__, '__path__': [],
-                                    '__all__': [], '__loader__': self})
+        self.module.__dict__.update({
+            '__file__': __file__,
+            '__path__': [],
+            '__all__': [],
+            '__loader__': self
+        })
         sys.meta_path.append(self)
 
+    def find_spec(self, fullname, path, target=None):
+        if '.' not in fullname: return
+        if fullname.rsplit('.', 1)[0] != self.name: return
+        from importlib.util import spec_from_loader
+        return spec_from_loader(fullname, self)
+
     def find_module(self, fullname, path=None):
         if '.' not in fullname: return
-        packname = fullname.rsplit('.', 1)[0]
-        if packname != self.name: return
+        if fullname.rsplit('.', 1)[0] != self.name: return
         return self
 
+    def create_module(self, spec):
+        return self.load_module(spec.name)
+
+    def exec_module(self, module):
+        pass # This probably breaks importlib.reload() :/
+
     def load_module(self, fullname):
         if fullname in sys.modules: return sys.modules[fullname]
         modname = fullname.rsplit('.', 1)[1]
@@ -1816,11 +2103,6 @@ class _ImportRedirect(object):
         module.__loader__ = self
         return module
 
-
-
-
-
-
 ###############################################################################
 # Common Utilities #############################################################
 ###############################################################################
@@ -1835,38 +2117,68 @@ class MultiDict(DictMixin):
     def __init__(self, *a, **k):
         self.dict = dict((k, [v]) for (k, v) in dict(*a, **k).items())
 
-    def __len__(self): return len(self.dict)
-    def __iter__(self): return iter(self.dict)
-    def __contains__(self, key): return key in self.dict
-    def __delitem__(self, key): del self.dict[key]
-    def __getitem__(self, key): return self.dict[key][-1]
-    def __setitem__(self, key, value): self.append(key, value)
-    def keys(self): return self.dict.keys()
+    def __len__(self):
+        return len(self.dict)
+
+    def __iter__(self):
+        return iter(self.dict)
+
+    def __contains__(self, key):
+        return key in self.dict
+
+    def __delitem__(self, key):
+        del self.dict[key]
+
+    def __getitem__(self, key):
+        return self.dict[key][-1]
+
+    def __setitem__(self, key, value):
+        self.append(key, value)
+
+    def keys(self):
+        return self.dict.keys()
 
     if py3k:
-        def values(self): return (v[-1] for v in self.dict.values())
-        def items(self): return ((k, v[-1]) for k, v in self.dict.items())
+
+        def values(self):
+            return (v[-1] for v in self.dict.values())
+
+        def items(self):
+            return ((k, v[-1]) for k, v in self.dict.items())
+
         def allitems(self):
             return ((k, v) for k, vl in self.dict.items() for v in vl)
+
         iterkeys = keys
         itervalues = values
         iteritems = items
         iterallitems = allitems
 
     else:
-        def values(self): return [v[-1] for v in self.dict.values()]
-        def items(self): return [(k, v[-1]) for k, v in self.dict.items()]
-        def iterkeys(self): return self.dict.iterkeys()
-        def itervalues(self): return (v[-1] for v in self.dict.itervalues())
+
+        def values(self):
+            return [v[-1] for v in self.dict.values()]
+
+        def items(self):
+            return [(k, v[-1]) for k, v in self.dict.items()]
+
+        def iterkeys(self):
+            return self.dict.iterkeys()
+
+        def itervalues(self):
+            return (v[-1] for v in self.dict.itervalues())
+
         def iteritems(self):
             return ((k, v[-1]) for k, v in self.dict.iteritems())
+
         def iterallitems(self):
             return ((k, v) for k, vl in self.dict.iteritems() for v in vl)
+
         def allitems(self):
             return [(k, v) for k, vl in self.dict.iteritems() for v in vl]
 
     def get(self, key, default=None, index=-1, type=None):
-        ''' Return the most recent value for a key.
+        """ Return the most recent value for a key.
 
             :param default: The default value to be returned if the key is not
                    present or the type conversion fails.
@@ -1874,7 +2186,7 @@ class MultiDict(DictMixin):
             :param type: If defined, this callable is used to cast the value
                     into a specific type. Exception are suppressed and result in
                     the default value to be returned.
-        '''
+        """
         try:
             val = self.dict[key][index]
             return type(val) if type else val
@@ -1883,15 +2195,15 @@ class MultiDict(DictMixin):
         return default
 
     def append(self, key, value):
-        ''' Add a new value to the list of values for this key. '''
+        """ Add a new value to the list of values for this key. """
         self.dict.setdefault(key, []).append(value)
 
     def replace(self, key, value):
-        ''' Replace the list of values with a single value. '''
+        """ Replace the list of values with a single value. """
         self.dict[key] = [value]
 
     def getall(self, key):
-        ''' Return a (possibly empty) list of values for a key. '''
+        """ Return a (possibly empty) list of values for a key. """
         return self.dict.get(key) or []
 
     #: Aliases for WTForms to mimic other multi-dict APIs (Django)
@@ -1900,12 +2212,12 @@ class MultiDict(DictMixin):
 
 
 class FormsDict(MultiDict):
-    ''' This :class:`MultiDict` subclass is used to store request form data.
+    """ This :class:`MultiDict` subclass is used to store request form data.
         Additionally to the normal dict-like item access methods (which return
         unmodified data as native strings), this container also supports
         attribute-like access to its values. Attributes are automatically de-
         or recoded to match :attr:`input_encoding` (default: 'utf8'). Missing
-        attributes default to an empty string. '''
+        attributes default to an empty string. """
 
     #: Encoding used for attribute values.
     input_encoding = 'utf8'
@@ -1914,17 +2226,17 @@ class FormsDict(MultiDict):
     recode_unicode = True
 
     def _fix(self, s, encoding=None):
-        if isinstance(s, unicode) and self.recode_unicode: # Python 3 WSGI
+        if isinstance(s, unicode) and self.recode_unicode:  # Python 3 WSGI
             return s.encode('latin1').decode(encoding or self.input_encoding)
-        elif isinstance(s, bytes): # Python 2 WSGI
+        elif isinstance(s, bytes):  # Python 2 WSGI
             return s.decode(encoding or self.input_encoding)
         else:
             return s
 
     def decode(self, encoding=None):
-        ''' Returns a copy with all keys and values de- or recoded to match
+        """ Returns a copy with all keys and values de- or recoded to match
             :attr:`input_encoding`. Some libraries (e.g. WTForms) want a
-            unicode dictionary. '''
+            unicode dictionary. """
         copy = FormsDict()
         enc = copy.input_encoding = encoding or self.input_encoding
         copy.recode_unicode = False
@@ -1933,7 +2245,7 @@ class FormsDict(MultiDict):
         return copy
 
     def getunicode(self, name, default=None, encoding=None):
-        ''' Return the value as a unicode string, or the default. '''
+        """ Return the value as a unicode string, or the default. """
         try:
             return self._fix(self[name], encoding)
         except (UnicodeError, KeyError):
@@ -1953,15 +2265,30 @@ class HeaderDict(MultiDict):
         self.dict = {}
         if a or ka: self.update(*a, **ka)
 
-    def __contains__(self, key): return _hkey(key) in self.dict
-    def __delitem__(self, key): del self.dict[_hkey(key)]
-    def __getitem__(self, key): return self.dict[_hkey(key)][-1]
-    def __setitem__(self, key, value): self.dict[_hkey(key)] = [_hval(value)]
-    def append(self, key, value): self.dict.setdefault(_hkey(key), []).append(_hval(value))
-    def replace(self, key, value): self.dict[_hkey(key)] = [_hval(value)]
-    def getall(self, key): return self.dict.get(_hkey(key)) or []
+    def __contains__(self, key):
+        return _hkey(key) in self.dict
+
+    def __delitem__(self, key):
+        del self.dict[_hkey(key)]
+
+    def __getitem__(self, key):
+        return self.dict[_hkey(key)][-1]
+
+    def __setitem__(self, key, value):
+        self.dict[_hkey(key)] = [_hval(value)]
+
+    def append(self, key, value):
+        self.dict.setdefault(_hkey(key), []).append(_hval(value))
+
+    def replace(self, key, value):
+        self.dict[_hkey(key)] = [_hval(value)]
+
+    def getall(self, key):
+        return self.dict.get(_hkey(key)) or []
+
     def get(self, key, default=None, index=-1):
         return MultiDict.get(self, _hkey(key), default, index)
+
     def filter(self, names):
         for name in (_hkey(n) for n in names):
             if name in self.dict:
@@ -1969,7 +2296,7 @@ class HeaderDict(MultiDict):
 
 
 class WSGIHeaderDict(DictMixin):
-    ''' This dict-like class wraps a WSGI environ dict and provides convenient
+    """ This dict-like class wraps a WSGI environ dict and provides convenient
         access to HTTP_* fields. Keys and values are native strings
         (2.x bytes or 3.x unicode) and keys are case-insensitive. If the WSGI
         environment contains non-native string values, these are de- or encoded
@@ -1978,7 +2305,7 @@ class WSGIHeaderDict(DictMixin):
         The API will remain stable even on changes to the relevant PEPs.
         Currently PEP 333, 444 and 3333 are supported. (PEP 444 is the only one
         that uses non-native strings.)
-    '''
+    """
     #: List of keys that do not have a ``HTTP_`` prefix.
     cgikeys = ('CONTENT_TYPE', 'CONTENT_LENGTH')
 
@@ -1986,18 +2313,24 @@ class WSGIHeaderDict(DictMixin):
         self.environ = environ
 
     def _ekey(self, key):
-        ''' Translate header field name to CGI/WSGI environ key. '''
-        key = key.replace('-','_').upper()
+        """ Translate header field name to CGI/WSGI environ key. """
+        key = key.replace('-', '_').upper()
         if key in self.cgikeys:
             return key
         return 'HTTP_' + key
 
     def raw(self, key, default=None):
-        ''' Return the header value as is (may be bytes or unicode). '''
+        """ Return the header value as is (may be bytes or unicode). """
         return self.environ.get(self._ekey(key), default)
 
     def __getitem__(self, key):
-        return tonat(self.environ[self._ekey(key)], 'latin1')
+        val = self.environ[self._ekey(key)]
+        if py3k:
+            if isinstance(val, unicode):
+                val = val.encode('latin1').decode('utf8')
+            else:
+                val = val.decode('utf8')
+        return val
 
     def __setitem__(self, key, value):
         raise TypeError("%s is read-only." % self.__class__)
@@ -2008,150 +2341,125 @@ class WSGIHeaderDict(DictMixin):
     def __iter__(self):
         for key in self.environ:
             if key[:5] == 'HTTP_':
-                yield key[5:].replace('_', '-').title()
+                yield _hkey(key[5:])
             elif key in self.cgikeys:
-                yield key.replace('_', '-').title()
+                yield _hkey(key)
 
-    def keys(self): return [x for x in self]
-    def __len__(self): return len(self.keys())
-    def __contains__(self, key): return self._ekey(key) in self.environ
+    def keys(self):
+        return [x for x in self]
 
+    def __len__(self):
+        return len(self.keys())
 
+    def __contains__(self, key):
+        return self._ekey(key) in self.environ
+
+_UNSET = object()
 
 class ConfigDict(dict):
-    ''' A dict-like configuration storage with additional support for
-        namespaces, validators, meta-data, on_change listeners and more.
+    """ A dict-like configuration storage with additional support for
+        namespaces, validators, meta-data and overlays.
 
-        This storage is optimized for fast read access. Retrieving a key
-        or using non-altering dict methods (e.g. `dict.get()`) has no overhead
-        compared to a native dict.
-    '''
-    __slots__ = ('_meta', '_on_change')
+        This dict-like class is heavily optimized for read access.
+        Read-only methods and item access should be as fast as a native dict.
+    """
 
-    class Namespace(DictMixin):
+    __slots__ = ('_meta', '_change_listener', '_overlays', '_virtual_keys', '_source', '__weakref__')
 
-        def __init__(self, config, namespace):
-            self._config = config
-            self._prefix = namespace
-
-        def __getitem__(self, key):
-            depr('Accessing namespaces as dicts is discouraged. '
-                 'Only use flat item access: '
-                 'cfg["names"]["pace"]["key"] -> cfg["name.space.key"]') #0.12
-            return self._config[self._prefix + '.' + key]
-
-        def __setitem__(self, key, value):
-            self._config[self._prefix + '.' + key] = value
-
-        def __delitem__(self, key):
-            del self._config[self._prefix + '.' + key]
-
-        def __iter__(self):
-            ns_prefix = self._prefix + '.'
-            for key in self._config:
-                ns, dot, name = key.rpartition('.')
-                if ns == self._prefix and name:
-                    yield name
-
-        def keys(self): return [x for x in self]
-        def __len__(self): return len(self.keys())
-        def __contains__(self, key): return self._prefix + '.' + key in self._config
-        def __repr__(self): return '<Config.Namespace %s.*>' % self._prefix
-        def __str__(self): return '<Config.Namespace %s.*>' % self._prefix
-
-        # Deprecated ConfigDict features
-        def __getattr__(self, key):
-            depr('Attribute access is deprecated.') #0.12
-            if key not in self and key[0].isupper():
-                self[key] = ConfigDict.Namespace(self._config, self._prefix + '.' + key)
-            if key not in self and key.startswith('__'):
-                raise AttributeError(key)
-            return self.get(key)
-
-        def __setattr__(self, key, value):
-            if key in ('_config', '_prefix'):
-                self.__dict__[key] = value
-                return
-            depr('Attribute assignment is deprecated.') #0.12
-            if hasattr(DictMixin, key):
-                raise AttributeError('Read-only attribute.')
-            if key in self and self[key] and isinstance(self[key], self.__class__):
-                raise AttributeError('Non-empty namespace attribute.')
-            self[key] = value
+    def __init__(self):
+        self._meta = {}
+        self._change_listener = []
+        #: Weak references of overlays that need to be kept in sync.
+        self._overlays = []
+        #: Config that is the source for this overlay.
+        self._source = None
+        #: Keys of values copied from the source (values we do not own)
+        self._virtual_keys = set()
+
+    def load_module(self, name, squash=True):
+        """Load values from a Python module.
+
+           Import a python module by name and add all upper-case module-level
+           variables to this config dict.
+
+           :param name: Module name to import and load.
+           :param squash: If true (default), nested dicts are assumed to
+              represent namespaces and flattened (see :meth:`load_dict`).
+        """
+        config_obj = load(name)
+        obj = {key: getattr(config_obj, key)
+               for key in dir(config_obj) if key.isupper()}
 
-        def __delattr__(self, key):
-            if key in self:
-                val = self.pop(key)
-                if isinstance(val, self.__class__):
-                    prefix = key + '.'
-                    for key in self:
-                        if key.startswith(prefix):
-                            del self[prefix+key]
-
-        def __call__(self, *a, **ka):
-            depr('Calling ConfDict is deprecated. Use the update() method.') #0.12
-            self.update(*a, **ka)
-            return self
+        if squash:
+            self.load_dict(obj)
+        else:
+            self.update(obj)
+        return self
 
-    def __init__(self, *a, **ka):
-        self._meta = {}
-        self._on_change = lambda name, value: None
-        if a or ka:
-            depr('Constructor does no longer accept parameters.') #0.12
-            self.update(*a, **ka)
-
-    def load_config(self, filename):
-        ''' Load values from an *.ini style config file.
-
-            If the config file contains sections, their names are used as
-            namespaces for the values within. The two special sections
-            ``DEFAULT`` and ``bottle`` refer to the root namespace (no prefix).
-        '''
-        conf = ConfigParser()
+    def load_config(self, filename, **options):
+        """ Load values from ``*.ini`` style config files using configparser.
+
+            INI style sections (e.g. ``[section]``) are used as namespace for
+            all keys within that section. Both section and key names may contain
+            dots as namespace separators and are converted to lower-case.
+
+            The special sections ``[bottle]`` and ``[ROOT]`` refer to the root
+            namespace and the ``[DEFAULT]`` section defines default values for all
+            other sections.
+
+            :param filename: The path of a config file, or a list of paths.
+            :param options: All keyword parameters are passed to the underlying
+                :class:`python:configparser.ConfigParser` constructor call.
+
+        """
+        options.setdefault('allow_no_value', True)
+        if py3k:
+            options.setdefault('interpolation',
+                               configparser.ExtendedInterpolation())
+        conf = configparser.ConfigParser(**options)
         conf.read(filename)
         for section in conf.sections():
-            for key, value in conf.items(section):
-                if section not in ('DEFAULT', 'bottle'):
+            for key in conf.options(section):
+                value = conf.get(section, key)
+                if section not in ('bottle', 'ROOT'):
                     key = section + '.' + key
-                self[key] = value
+                self[key.lower()] = value
         return self
 
-    def load_dict(self, source, namespace='', make_namespaces=False):
-        ''' Import values from a dictionary structure. Nesting can be used to
+    def load_dict(self, source, namespace=''):
+        """ Load values from a dictionary structure. Nesting can be used to
             represent namespaces.
 
-            >>> ConfigDict().load_dict({'name': {'space': {'key': 'value'}}})
-            {'name.space.key': 'value'}
-        '''
-        stack = [(namespace, source)]
-        while stack:
-            prefix, source = stack.pop()
-            if not isinstance(source, dict):
-                raise TypeError('Source is not a dict (r)' % type(key))
-            for key, value in source.items():
-                if not isinstance(key, basestring):
-                    raise TypeError('Key is not a string (%r)' % type(key))
-                full_key = prefix + '.' + key if prefix else key
+            >>> c = ConfigDict()
+            >>> c.load_dict({'some': {'namespace': {'key': 'value'} } })
+            {'some.namespace.key': 'value'}
+        """
+        for key, value in source.items():
+            if isinstance(key, basestring):
+                nskey = (namespace + '.' + key).strip('.')
                 if isinstance(value, dict):
-                    stack.append((full_key, value))
-                    if make_namespaces:
-                        self[full_key] = self.Namespace(self, full_key)
+                    self.load_dict(value, namespace=nskey)
                 else:
-                    self[full_key] = value
+                    self[nskey] = value
+            else:
+                raise TypeError('Key has type %r (not a string)' % type(key))
         return self
 
     def update(self, *a, **ka):
-        ''' If the first parameter is a string, all keys are prefixed with this
+        """ If the first parameter is a string, all keys are prefixed with this
             namespace. Apart from that it works just as the usual dict.update().
-            Example: ``update('some.namespace', key='value')`` '''
+
+            >>> c = ConfigDict()
+            >>> c.update('some.namespace', key='value')
+        """
         prefix = ''
         if a and isinstance(a[0], basestring):
             prefix = a[0].strip('.') + '.'
             a = a[1:]
         for key, value in dict(*a, **ka).items():
-            self[prefix+key] = value
+            self[prefix + key] = value
 
-    def setdefault(self, key, value):
+    def setdefault(self, key, value=None):
         if key not in self:
             self[key] = value
         return self[key]
@@ -2160,66 +2468,132 @@ class ConfigDict(dict):
         if not isinstance(key, basestring):
             raise TypeError('Key has type %r (not a string)' % type(key))
 
+        self._virtual_keys.discard(key)
+
         value = self.meta_get(key, 'filter', lambda x: x)(value)
         if key in self and self[key] is value:
             return
+
         self._on_change(key, value)
         dict.__setitem__(self, key, value)
 
+        for overlay in self._iter_overlays():
+            overlay._set_virtual(key, value)
+
     def __delitem__(self, key):
+        if key not in self:
+            raise KeyError(key)
+        if key in self._virtual_keys:
+            raise KeyError("Virtual keys cannot be deleted: %s" % key)
+
+        if self._source and key in self._source:
+            # Not virtual, but present in source -> Restore virtual value
+            dict.__delitem__(self, key)
+            self._set_virtual(key, self._source[key])
+        else:  # not virtual, not present in source. This is OUR value
+            self._on_change(key, None)
+            dict.__delitem__(self, key)
+            for overlay in self._iter_overlays():
+                overlay._delete_virtual(key)
+
+    def _set_virtual(self, key, value):
+        """ Recursively set or update virtual keys. """
+        if key in self and key not in self._virtual_keys:
+            return  # Do nothing for non-virtual keys.
+
+        self._virtual_keys.add(key)
+        if key in self and self[key] is not value:
+            self._on_change(key, value)
+        dict.__setitem__(self, key, value)
+        for overlay in self._iter_overlays():
+            overlay._set_virtual(key, value)
+
+    def _delete_virtual(self, key):
+        """ Recursively delete virtual entry. """
+        if key not in self._virtual_keys:
+            return  # Do nothing for non-virtual keys.
+
+        if key in self:
+            self._on_change(key, None)
         dict.__delitem__(self, key)
+        self._virtual_keys.discard(key)
+        for overlay in self._iter_overlays():
+            overlay._delete_virtual(key)
+
+    def _on_change(self, key, value):
+        for cb in self._change_listener:
+            if cb(self, key, value):
+                return True
 
-    def clear(self):
-        for key in self:
-            del self[key]
+    def _add_change_listener(self, func):
+        self._change_listener.append(func)
+        return func
 
     def meta_get(self, key, metafield, default=None):
-        ''' Return the value of a meta field for a key. '''
+        """ Return the value of a meta field for a key. """
         return self._meta.get(key, {}).get(metafield, default)
 
     def meta_set(self, key, metafield, value):
-        ''' Set the meta field for a key to a new value. This triggers the
-            on-change handler for existing keys. '''
+        """ Set the meta field for a key to a new value.
+        
+            Meta-fields are shared between all members of an overlay tree.
+        """
         self._meta.setdefault(key, {})[metafield] = value
-        if key in self:
-            self[key] = self[key]
 
     def meta_list(self, key):
-        ''' Return an iterable of meta field names defined for a key. '''
+        """ Return an iterable of meta field names defined for a key. """
         return self._meta.get(key, {}).keys()
 
-    # Deprecated ConfigDict features
-    def __getattr__(self, key):
-        depr('Attribute access is deprecated.') #0.12
-        if key not in self and key[0].isupper():
-            self[key] = self.Namespace(self, key)
-        if key not in self and key.startswith('__'):
-            raise AttributeError(key)
-        return self.get(key)
-
-    def __setattr__(self, key, value):
-        if key in self.__slots__:
-            return dict.__setattr__(self, key, value)
-        depr('Attribute assignment is deprecated.') #0.12
-        if hasattr(dict, key):
-            raise AttributeError('Read-only attribute.')
-        if key in self and self[key] and isinstance(self[key], self.Namespace):
-            raise AttributeError('Non-empty namespace attribute.')
-        self[key] = value
+    def _define(self, key, default=_UNSET, help=_UNSET, validate=_UNSET):
+        """ (Unstable) Shortcut for plugins to define own config parameters. """
+        if default is not _UNSET:
+            self.setdefault(key, default)
+        if help is not _UNSET:
+            self.meta_set(key, 'help', help)
+        if validate is not _UNSET:
+            self.meta_set(key, 'validate', validate)
+
+    def _iter_overlays(self):
+        for ref in self._overlays:
+            overlay = ref()
+            if overlay is not None:
+                yield overlay
+
+    def _make_overlay(self):
+        """ (Unstable) Create a new overlay that acts like a chained map: Values
+            missing in the overlay are copied from the source map. Both maps
+            share the same meta entries.
+
+            Entries that were copied from the source are called 'virtual'. You
+            can not delete virtual keys, but overwrite them, which turns them
+            into non-virtual entries. Setting keys on an overlay never affects
+            its source, but may affect any number of child overlays.
+
+            Other than collections.ChainMap or most other implementations, this
+            approach does not resolve missing keys on demand, but instead
+            actively copies all values from the source to the overlay and keeps
+            track of virtual and non-virtual keys internally. This removes any
+            lookup-overhead. Read-access is as fast as a build-in dict for both
+            virtual and non-virtual keys.
+
+            Changes are propagated recursively and depth-first. A failing
+            on-change handler in an overlay stops the propagation of virtual
+            values and may result in an partly updated tree. Take extra care
+            here and make sure that on-change handlers never fail.
+
+            Used by Route.config
+        """
+        # Cleanup dead references
+        self._overlays[:] = [ref for ref in self._overlays if ref() is not None]
+
+        overlay = ConfigDict()
+        overlay._meta = self._meta
+        overlay._source = self
+        self._overlays.append(weakref.ref(overlay))
+        for key in self:
+            overlay._set_virtual(key, self[key])
+        return overlay
 
-    def __delattr__(self, key):
-        if key in self:
-            val = self.pop(key)
-            if isinstance(val, self.Namespace):
-                prefix = key + '.'
-                for key in self:
-                    if key.startswith(prefix):
-                        del self[prefix+key]
-
-    def __call__(self, *a, **ka):
-        depr('Calling ConfDict is deprecated. Use the update() method.') #0.12
-        self.update(*a, **ka)
-        return self
 
 
 
@@ -2228,7 +2602,7 @@ class AppStack(list):
 
     def __call__(self):
         """ Return the current default application. """
-        return self[-1]
+        return self.default
 
     def push(self, value=None):
         """ Add a new :class:`Bottle` instance to the stack """
@@ -2236,26 +2610,33 @@ class AppStack(list):
             value = Bottle()
         self.append(value)
         return value
+    new_app = push
+
+    @property
+    def default(self):
+        try:
+            return self[-1]
+        except IndexError:
+            return self.push()
 
 
 class WSGIFileWrapper(object):
-
-    def __init__(self, fp, buffer_size=1024*64):
+    def __init__(self, fp, buffer_size=1024 * 64):
         self.fp, self.buffer_size = fp, buffer_size
-        for attr in ('fileno', 'close', 'read', 'readlines', 'tell', 'seek'):
+        for attr in 'fileno', 'close', 'read', 'readlines', 'tell', 'seek':
             if hasattr(fp, attr): setattr(self, attr, getattr(fp, attr))
 
     def __iter__(self):
         buff, read = self.buffer_size, self.read
-        while True:
-            part = read(buff)
-            if not part: return
+        part = read(buff)
+        while part:
             yield part
+            part = read(buff)
 
 
 class _closeiter(object):
-    ''' This only exists to be able to attach a .close method to iterators that
-        do not support attribute assignment (most of itertools). '''
+    """ This only exists to be able to attach a .close method to iterators that
+        do not support attribute assignment (most of itertools). """
 
     def __init__(self, iterator, close=None):
         self.iterator = iterator
@@ -2270,17 +2651,17 @@ class _closeiter(object):
 
 
 class ResourceManager(object):
-    ''' This class manages a list of search paths and helps to find and open
+    """ This class manages a list of search paths and helps to find and open
         application-bound resources (files).
 
         :param base: default value for :meth:`add_path` calls.
         :param opener: callable used to open resources.
         :param cachemode: controls which lookups are cached. One of 'all',
                          'found' or 'none'.
-    '''
+    """
 
     def __init__(self, base='./', opener=open, cachemode='all'):
-        self.opener = open
+        self.opener = opener
         self.base = base
         self.cachemode = cachemode
 
@@ -2290,7 +2671,7 @@ class ResourceManager(object):
         self.cache = {}
 
     def add_path(self, path, base=None, index=None, create=False):
-        ''' Add a new path to the list of search paths. Return False if the
+        """ Add a new path to the list of search paths. Return False if the
             path does not exist.
 
             :param path: The new search path. Relative paths are turned into
@@ -2305,7 +2686,7 @@ class ResourceManager(object):
             along with a python module or package::
 
                 res.add_path('./resources/', __file__)
-        '''
+        """
         base = os.path.abspath(os.path.dirname(base or self.base))
         path = os.path.abspath(os.path.join(base, os.path.dirname(path)))
         path += os.sep
@@ -2321,7 +2702,7 @@ class ResourceManager(object):
         return os.path.exists(path)
 
     def __iter__(self):
-        ''' Iterate over all existing files in all registered paths. '''
+        """ Iterate over all existing files in all registered paths. """
         search = self.path[:]
         while search:
             path = search.pop()
@@ -2332,11 +2713,11 @@ class ResourceManager(object):
                 else: yield full
 
     def lookup(self, name):
-        ''' Search for a resource and return an absolute file path, or `None`.
+        """ Search for a resource and return an absolute file path, or `None`.
 
             The :attr:`path` list is searched in order. The first match is
-            returend. Symlinks are followed. The result is cached to speed up
-            future lookups. '''
+            returned. Symlinks are followed. The result is cached to speed up
+            future lookups. """
         if name not in self.cache or DEBUG:
             for path in self.path:
                 fpath = os.path.join(path, name)
@@ -2349,16 +2730,15 @@ class ResourceManager(object):
         return self.cache[name]
 
     def open(self, name, mode='r', *args, **kwargs):
-        ''' Find a resource and return a file object, or raise IOError. '''
+        """ Find a resource and return a file object, or raise IOError. """
         fname = self.lookup(name)
         if not fname: raise IOError("Resource %r not found." % name)
         return self.opener(fname, mode=mode, *args, **kwargs)
 
 
 class FileUpload(object):
-
     def __init__(self, fileobj, name, filename, headers=None):
-        ''' Wrapper for file uploads. '''
+        """ Wrapper for a single file uploaded via ``multipart/form-data``. """
         #: Open file(-like) object (BytesIO buffer or temporary file)
         self.file = fileobj
         #: Name of the upload form field
@@ -2372,29 +2752,30 @@ class FileUpload(object):
     content_length = HeaderProperty('Content-Length', reader=int, default=-1)
 
     def get_header(self, name, default=None):
-        """ Return the value of a header within the mulripart part. """
+        """ Return the value of a header within the multipart part. """
         return self.headers.get(name, default)
 
     @cached_property
     def filename(self):
-        ''' Name of the file on the client file system, but normalized to ensure
+        """ Name of the file on the client file system, but normalized to ensure
             file system compatibility. An empty filename is returned as 'empty'.
 
             Only ASCII letters, digits, dashes, underscores and dots are
             allowed in the final filename. Accents are removed, if possible.
             Whitespace is replaced by a single dash. Leading or tailing dots
             or dashes are removed. The filename is limited to 255 characters.
-        '''
+        """
         fname = self.raw_filename
         if not isinstance(fname, unicode):
             fname = fname.decode('utf8', 'ignore')
-        fname = normalize('NFKD', fname).encode('ASCII', 'ignore').decode('ASCII')
+        fname = normalize('NFKD', fname)
+        fname = fname.encode('ASCII', 'ignore').decode('ASCII')
         fname = os.path.basename(fname.replace('\\', os.path.sep))
         fname = re.sub(r'[^a-zA-Z0-9-_.\s]', '', fname).strip()
         fname = re.sub(r'[-\s]+', '-', fname).strip('.-')
         return fname[:255] or 'empty'
 
-    def _copy_file(self, fp, chunk_size=2**16):
+    def _copy_file(self, fp, chunk_size=2 ** 16):
         read, write, offset = self.file.read, fp.write, self.file.tell()
         while 1:
             buf = read(chunk_size)
@@ -2402,16 +2783,16 @@ class FileUpload(object):
             write(buf)
         self.file.seek(offset)
 
-    def save(self, destination, overwrite=False, chunk_size=2**16):
-        ''' Save file to disk or copy its content to an open file(-like) object.
+    def save(self, destination, overwrite=False, chunk_size=2 ** 16):
+        """ Save file to disk or copy its content to an open file(-like) object.
             If *destination* is a directory, :attr:`filename` is added to the
             path. Existing files are not overwritten by default (IOError).
 
             :param destination: File path, directory or file(-like) object.
             :param overwrite: If True, replace existing files. (default: False)
             :param chunk_size: Bytes to read at a time. (default: 64kb)
-        '''
-        if isinstance(destination, basestring): # Except file-likes here
+        """
+        if isinstance(destination, basestring):  # Except file-likes here
             if os.path.isdir(destination):
                 destination = os.path.join(destination, self.filename)
             if not overwrite and os.path.exists(destination):
@@ -2421,11 +2802,6 @@ class FileUpload(object):
         else:
             self._copy_file(destination, chunk_size)
 
-
-
-
-
-
 ###############################################################################
 # Application Helper ###########################################################
 ###############################################################################
@@ -2448,39 +2824,58 @@ def redirect(url, code=None):
     raise res
 
 
-def _file_iter_range(fp, offset, bytes, maxread=1024*1024):
-    ''' Yield chunks from a range in a file. No chunk is bigger than maxread.'''
+def _rangeiter(fp, offset, limit, bufsize=1024 * 1024):
+    """ Yield chunks from a range in a file. """
     fp.seek(offset)
-    while bytes > 0:
-        part = fp.read(min(bytes, maxread))
-        if not part: break
-        bytes -= len(part)
+    while limit > 0:
+        part = fp.read(min(limit, bufsize))
+        if not part:
+            break
+        limit -= len(part)
         yield part
 
 
-def static_file(filename, root, mimetype='auto', download=False, charset='UTF-8'):
-    """ Open a file in a safe way and return :exc:`HTTPResponse` with status
-        code 200, 305, 403 or 404. The ``Content-Type``, ``Content-Encoding``,
-        ``Content-Length`` and ``Last-Modified`` headers are set if possible.
-        Special support for ``If-Modified-Since``, ``Range`` and ``HEAD``
-        requests.
+def static_file(filename, root,
+                mimetype=True,
+                download=False,
+                charset='UTF-8',
+                etag=None,
+                headers=None):
+    """ Open a file in a safe way and return an instance of :exc:`HTTPResponse`
+        that can be sent back to the client.
 
-        :param filename: Name or path of the file to send.
+        :param filename: Name or path of the file to send, relative to ``root``.
         :param root: Root path for file lookups. Should be an absolute directory
             path.
-        :param mimetype: Defines the content-type header (default: guess from
+        :param mimetype: Provide the content-type header (default: guess from
             file extension)
         :param download: If True, ask the browser to open a `Save as...` dialog
             instead of opening the file with the associated program. You can
             specify a custom filename as a string. If not specified, the
             original filename is used (default: False).
-        :param charset: The charset to use for files with a ``text/*``
-            mime-type. (default: UTF-8)
+        :param charset: The charset for files with a ``text/*`` mime-type.
+            (default: UTF-8)
+        :param etag: Provide a pre-computed ETag header. If set to ``False``,
+            ETag handling is disabled. (default: auto-generate ETag header)
+        :param headers: Additional headers dict to add to the response.
+
+        While checking user input is always a good idea, this function provides
+        additional protection against malicious ``filename`` parameters from
+        breaking out of the ``root`` directory and leaking sensitive information
+        to an attacker.
+
+        Read-protected files or files outside of the ``root`` directory are
+        answered with ``403 Access Denied``. Missing files result in a
+        ``404 Not Found`` response. Conditional requests (``If-Modified-Since``,
+        ``If-None-Match``) are answered with ``304 Not Modified`` whenever
+        possible. ``HEAD`` and ``Range`` requests (used by download managers to
+        check or continue partial downloads) are also handled automatically.
     """
 
-    root = os.path.abspath(root) + os.sep
+    root = os.path.join(os.path.abspath(root), '')
     filename = os.path.abspath(os.path.join(root, filename.strip('/\\')))
-    headers = dict()
+    headers = headers.copy() if headers else {}
+    getenv = request.environ.get
 
     if not filename.startswith(root):
         return HTTPError(403, "Access denied.")
@@ -2489,51 +2884,66 @@ def static_file(filename, root, mimetype
     if not os.access(filename, os.R_OK):
         return HTTPError(403, "You do not have permission to access this file.")
 
-    if mimetype == 'auto':
-        mimetype, encoding = mimetypes.guess_type(filename)
-        if encoding: headers['Content-Encoding'] = encoding
+    if mimetype is True:
+        name = download if isinstance(download, str) else filename
+        mimetype, encoding = mimetypes.guess_type(name)
+        if encoding == 'gzip':
+            mimetype = 'application/gzip'
+        elif encoding: # e.g. bzip2 -> application/x-bzip2
+            mimetype = 'application/x-' + encoding
+
+    if charset and mimetype and 'charset=' not in mimetype \
+        and (mimetype[:5] == 'text/' or mimetype == 'application/javascript'):
+        mimetype += '; charset=%s' % charset
 
     if mimetype:
-        if mimetype[:5] == 'text/' and charset and 'charset' not in mimetype:
-            mimetype += '; charset=%s' % charset
         headers['Content-Type'] = mimetype
 
+    if download is True:
+        download = os.path.basename(filename)
+
     if download:
-        download = os.path.basename(filename if download == True else download)
+        download = download.replace('"','')
         headers['Content-Disposition'] = 'attachment; filename="%s"' % download
 
     stats = os.stat(filename)
     headers['Content-Length'] = clen = stats.st_size
-    lm = time.strftime("%a, %d %b %Y %H:%M:%S GMT", time.gmtime(stats.st_mtime))
-    headers['Last-Modified'] = lm
+    headers['Last-Modified'] = email.utils.formatdate(stats.st_mtime, usegmt=True)
+    headers['Date'] = email.utils.formatdate(time.time(), usegmt=True)
+
+    if etag is None:
+        etag = '%d:%d:%d:%d:%s' % (stats.st_dev, stats.st_ino, stats.st_mtime,
+                                   clen, filename)
+        etag = hashlib.sha1(tob(etag)).hexdigest()
+
+    if etag:
+        headers['ETag'] = etag
+        check = getenv('HTTP_IF_NONE_MATCH')
+        if check and check == etag:
+            return HTTPResponse(status=304, **headers)
 
-    ims = request.environ.get('HTTP_IF_MODIFIED_SINCE')
+    ims = getenv('HTTP_IF_MODIFIED_SINCE')
     if ims:
         ims = parse_date(ims.split(";")[0].strip())
-    if ims is not None and ims >= int(stats.st_mtime):
-        headers['Date'] = time.strftime("%a, %d %b %Y %H:%M:%S GMT", time.gmtime())
-        return HTTPResponse(status=304, **headers)
+        if ims is not None and ims >= int(stats.st_mtime):
+            return HTTPResponse(status=304, **headers)
 
     body = '' if request.method == 'HEAD' else open(filename, 'rb')
 
     headers["Accept-Ranges"] = "bytes"
-    ranges = request.environ.get('HTTP_RANGE')
-    if 'HTTP_RANGE' in request.environ:
-        ranges = list(parse_range_header(request.environ['HTTP_RANGE'], clen))
+    range_header = getenv('HTTP_RANGE')
+    if range_header:
+        ranges = list(parse_range_header(range_header, clen))
         if not ranges:
             return HTTPError(416, "Requested Range Not Satisfiable")
         offset, end = ranges[0]
-        headers["Content-Range"] = "bytes %d-%d/%d" % (offset, end-1, clen)
-        headers["Content-Length"] = str(end-offset)
-        if body: body = _file_iter_range(body, offset, end-offset)
+        rlen = end - offset
+        headers["Content-Range"] = "bytes %d-%d/%d" % (offset, end - 1, clen)
+        headers["Content-Length"] = str(rlen)
+        if body: body = _closeiter(_rangeiter(body, offset, rlen), body.close)
         return HTTPResponse(body, status=206, **headers)
     return HTTPResponse(body, **headers)
 
-
-
-
-
-
 ###############################################################################
 # HTTP Utilities and MISC (TODO) ###############################################
 ###############################################################################
@@ -2546,51 +2956,98 @@ def debug(mode=True):
     if mode: warnings.simplefilter('default')
     DEBUG = bool(mode)
 
+
 def http_date(value):
-    if isinstance(value, (datedate, datetime)):
+    if isinstance(value, basestring):
+        return value
+    if isinstance(value, datetime):
+        # aware datetime.datetime is converted to UTC time
+        # naive datetime.datetime is treated as UTC time
         value = value.utctimetuple()
-    elif isinstance(value, (int, float)):
-        value = time.gmtime(value)
-    if not isinstance(value, basestring):
-        value = time.strftime("%a, %d %b %Y %H:%M:%S GMT", value)
-    return value
+    elif isinstance(value, datedate):
+        # datetime.date is naive, and is treated as UTC time
+        value = value.timetuple()
+    if not isinstance(value, (int, float)):
+        # convert struct_time in UTC to UNIX timestamp
+        value = calendar.timegm(value)
+    return email.utils.formatdate(value, usegmt=True)
+
 
 def parse_date(ims):
     """ Parse rfc1123, rfc850 and asctime timestamps and return UTC epoch. """
     try:
         ts = email.utils.parsedate_tz(ims)
-        return time.mktime(ts[:8] + (0,)) - (ts[9] or 0) - time.timezone
+        return calendar.timegm(ts[:8] + (0, )) - (ts[9] or 0)
     except (TypeError, ValueError, IndexError, OverflowError):
         return None
 
+
 def parse_auth(header):
     """ Parse rfc2617 HTTP authentication header string (basic) and return (user,pass) tuple or None"""
     try:
         method, data = header.split(None, 1)
         if method.lower() == 'basic':
-            user, pwd = touni(base64.b64decode(tob(data))).split(':',1)
+            user, pwd = touni(base64.b64decode(tob(data))).split(':', 1)
             return user, pwd
     except (KeyError, ValueError):
         return None
 
+
 def parse_range_header(header, maxlen=0):
-    ''' Yield (start, end) ranges parsed from a HTTP Range header. Skip
-        unsatisfiable ranges. The end index is non-inclusive.'''
+    """ Yield (start, end) ranges parsed from a HTTP Range header. Skip
+        unsatisfiable ranges. The end index is non-inclusive."""
     if not header or header[:6] != 'bytes=': return
     ranges = [r.split('-', 1) for r in header[6:].split(',') if '-' in r]
     for start, end in ranges:
         try:
             if not start:  # bytes=-100    -> last 100 bytes
-                start, end = max(0, maxlen-int(end)), maxlen
+                start, end = max(0, maxlen - int(end)), maxlen
             elif not end:  # bytes=100-    -> all but the first 99 bytes
                 start, end = int(start), maxlen
-            else:          # bytes=100-200 -> bytes 100-200 (inclusive)
-                start, end = int(start), min(int(end)+1, maxlen)
+            else:  # bytes=100-200 -> bytes 100-200 (inclusive)
+                start, end = int(start), min(int(end) + 1, maxlen)
             if 0 <= start < end <= maxlen:
                 yield start, end
         except ValueError:
             pass
 
+
+#: Header tokenizer used by _parse_http_header()
+_hsplit = re.compile('(?:(?:"((?:[^"\\\\]|\\\\.)*)")|([^;,=]+))([;,=]?)').findall
+
+def _parse_http_header(h):
+    """ Parses a typical multi-valued and parametrised HTTP header (e.g. Accept headers) and returns a list of values
+        and parameters. For non-standard or broken input, this implementation may return partial results.
+    :param h: A header string (e.g. ``text/html,text/plain;q=0.9,*/*;q=0.8``)
+    :return: List of (value, params) tuples. The second element is a (possibly empty) dict.
+    """
+    values = []
+    if '"' not in h:  # INFO: Fast path without regexp (~2x faster)
+        for value in h.split(','):
+            parts = value.split(';')
+            values.append((parts[0].strip(), {}))
+            for attr in parts[1:]:
+                name, value = attr.split('=', 1)
+                values[-1][1][name.strip().lower()] = value.strip()
+    else:
+        lop, key, attrs = ',', None, {}
+        for quoted, plain, tok in _hsplit(h):
+            value = plain.strip() if plain else quoted.replace('\\"', '"')
+            if lop == ',':
+                attrs = {}
+                values.append((value, attrs))
+            elif lop == ';':
+                if tok == '=':
+                    key = value
+                else:
+                    attrs[value.strip().lower()] = ''
+            elif lop == '=' and key:
+                attrs[key.strip().lower()] = value
+                key = None
+            lop = tok
+    return values
+
+
 def _parse_qsl(qs):
     r = []
     for pair in qs.split('&'):
@@ -2602,44 +3059,55 @@ def _parse_qsl(qs):
         r.append((key, value))
     return r
 
+
 def _lscmp(a, b):
-    ''' Compares two strings in a cryptographically safe way:
-        Runtime is not affected by length of common prefix. '''
-    return not sum(0 if x==y else 1 for x, y in zip(a, b)) and len(a) == len(b)
+    """ Compares two strings in a cryptographically safe way:
+        Runtime is not affected by length of common prefix. """
+    return not sum(0 if x == y else 1
+                   for x, y in zip(a, b)) and len(a) == len(b)
 
 
-def cookie_encode(data, key):
-    ''' Encode and sign a pickle-able object. Return a (byte) string '''
+def cookie_encode(data, key, digestmod=None):
+    """ Encode and sign a pickle-able object. Return a (byte) string """
+    depr(0, 13, "cookie_encode() will be removed soon.",
+                "Do not use this API directly.")
+    digestmod = digestmod or hashlib.sha256
     msg = base64.b64encode(pickle.dumps(data, -1))
-    sig = base64.b64encode(hmac.new(tob(key), msg, digestmod=hashlib.md5).digest())
+    sig = base64.b64encode(hmac.new(tob(key), msg, digestmod=digestmod).digest())
     return tob('!') + sig + tob('?') + msg
 
 
-def cookie_decode(data, key):
-    ''' Verify and decode an encoded string. Return an object or None.'''
+def cookie_decode(data, key, digestmod=None):
+    """ Verify and decode an encoded string. Return an object or None."""
+    depr(0, 13, "cookie_decode() will be removed soon.",
+                "Do not use this API directly.")
     data = tob(data)
     if cookie_is_encoded(data):
         sig, msg = data.split(tob('?'), 1)
-        if _lscmp(sig[1:], base64.b64encode(hmac.new(tob(key), msg, digestmod=hashlib.md5).digest())):
+        digestmod = digestmod or hashlib.sha256
+        hashed = hmac.new(tob(key), msg, digestmod=digestmod).digest()
+        if _lscmp(sig[1:], base64.b64encode(hashed)):
             return pickle.loads(base64.b64decode(msg))
     return None
 
 
 def cookie_is_encoded(data):
-    ''' Return True if the argument looks like a encoded cookie.'''
+    """ Return True if the argument looks like a encoded cookie."""
+    depr(0, 13, "cookie_is_encoded() will be removed soon.",
+                "Do not use this API directly.")
     return bool(data.startswith(tob('!')) and tob('?') in data)
 
 
 def html_escape(string):
-    ''' Escape HTML special characters ``&<>`` and quotes ``'"``. '''
-    return string.replace('&','&amp;').replace('<','&lt;').replace('>','&gt;')\
-                 .replace('"','&quot;').replace("'",'&#039;')
+    """ Escape HTML special characters ``&<>`` and quotes ``'"``. """
+    return string.replace('&', '&amp;').replace('<', '&lt;').replace('>', '&gt;')\
+                 .replace('"', '&quot;').replace("'", '&#039;')
 
 
 def html_quote(string):
-    ''' Escape and quote a string to be used as an HTTP attribute.'''
-    return '"%s"' % html_escape(string).replace('\n','&#10;')\
-                    .replace('\r','&#13;').replace('\t','&#9;')
+    """ Escape and quote a string to be used as an HTTP attribute."""
+    return '"%s"' % html_escape(string).replace('\n', '&#10;')\
+                    .replace('\r', '&#13;').replace('\t', '&#9;')
 
 
 def yieldroutes(func):
@@ -2652,7 +3120,7 @@ def yieldroutes(func):
         c(x, y=5)   -> '/c/<x>' and '/c/<x>/<y>'
         d(x=5, y=6) -> '/d' and '/d/<x>' and '/d/<x>/<y>'
     """
-    path = '/' + func.__name__.replace('__','/').lstrip('/')
+    path = '/' + func.__name__.replace('__', '/').lstrip('/')
     spec = getargspec(func)
     argc = len(spec[0]) - len(spec[3] or [])
     path += ('/<%s>' * argc) % tuple(spec[0][:argc])
@@ -2663,24 +3131,24 @@ def yieldroutes(func):
 
 
 def path_shift(script_name, path_info, shift=1):
-    ''' Shift path fragments from PATH_INFO to SCRIPT_NAME and vice versa.
+    """ Shift path fragments from PATH_INFO to SCRIPT_NAME and vice versa.
 
         :return: The modified paths.
         :param script_name: The SCRIPT_NAME path.
         :param script_name: The PATH_INFO path.
         :param shift: The number of path fragments to shift. May be negative to
           change the shift direction. (default: 1)
-    '''
+    """
     if shift == 0: return script_name, path_info
     pathlist = path_info.strip('/').split('/')
     scriptlist = script_name.strip('/').split('/')
     if pathlist and pathlist[0] == '': pathlist = []
     if scriptlist and scriptlist[0] == '': scriptlist = []
-    if shift > 0 and shift <= len(pathlist):
+    if 0 < shift <= len(pathlist):
         moved = pathlist[:shift]
         scriptlist = scriptlist + moved
         pathlist = pathlist[shift:]
-    elif shift < 0 and shift >= -len(scriptlist):
+    elif 0 > shift >= -len(scriptlist):
         moved = scriptlist[shift:]
         pathlist = moved + pathlist
         scriptlist = scriptlist[:shift]
@@ -2694,9 +3162,11 @@ def path_shift(script_name, path_info, s
 
 
 def auth_basic(check, realm="private", text="Access denied"):
-    ''' Callback decorator to require HTTP auth (basic).
-        TODO: Add route(check_auth=...) parameter. '''
+    """ Callback decorator to require HTTP auth (basic).
+        TODO: Add route(check_auth=...) parameter. """
+
     def decorator(func):
+
         @functools.wraps(func)
         def wrapper(*a, **ka):
             user, password = request.auth or (None, None)
@@ -2705,25 +3175,31 @@ def auth_basic(check, realm="private", t
                 err.add_header('WWW-Authenticate', 'Basic realm="%s"' % realm)
                 return err
             return func(*a, **ka)
+
         return wrapper
-    return decorator
 
+    return decorator
 
 # Shortcuts for common Bottle methods.
 # They all refer to the current default application.
 
+
 def make_default_app_wrapper(name):
-    ''' Return a callable that relays calls to the current default app. '''
+    """ Return a callable that relays calls to the current default app. """
+
     @functools.wraps(getattr(Bottle, name))
     def wrapper(*a, **ka):
         return getattr(app(), name)(*a, **ka)
+
     return wrapper
 
+
 route     = make_default_app_wrapper('route')
 get       = make_default_app_wrapper('get')
 post      = make_default_app_wrapper('post')
 put       = make_default_app_wrapper('put')
 delete    = make_default_app_wrapper('delete')
+patch     = make_default_app_wrapper('patch')
 error     = make_default_app_wrapper('error')
 mount     = make_default_app_wrapper('mount')
 hook      = make_default_app_wrapper('hook')
@@ -2732,78 +3208,337 @@ uninstall = make_default_app_wrapper('un
 url       = make_default_app_wrapper('get_url')
 
 
+###############################################################################
+# Multipart Handling ###########################################################
+###############################################################################
+# cgi.FieldStorage was deprecated in Python 3.11 and removed in 3.13
+# This implementation is based on https://github.com/defnull/multipart/
 
 
+class MultipartError(HTTPError):
+    def __init__(self, msg):
+        HTTPError.__init__(self, 400, "MultipartError: " + msg)
+
+
+class _MultipartParser(object):
+    def __init__(
+        self,
+        stream,
+        boundary,
+        content_length=-1,
+        disk_limit=2 ** 30,
+        mem_limit=2 ** 20,
+        memfile_limit=2 ** 18,
+        buffer_size=2 ** 16,
+        charset="latin1",
+    ):
+        self.stream = stream
+        self.boundary = boundary
+        self.content_length = content_length
+        self.disk_limit = disk_limit
+        self.memfile_limit = memfile_limit
+        self.mem_limit = min(mem_limit, self.disk_limit)
+        self.buffer_size = min(buffer_size, self.mem_limit)
+        self.charset = charset
+
+        if not boundary:
+            raise MultipartError("No boundary.")
+
+        if self.buffer_size - 6 < len(boundary):  # "--boundary--\r\n"
+            raise MultipartError("Boundary does not fit into buffer_size.")
+
+    def _lineiter(self):
+        """ Iterate over a binary file-like object (crlf terminated) line by
+            line. Each line is returned as a (line, crlf) tuple. Lines larger
+            than buffer_size are split into chunks where all but the last chunk
+            has an empty string instead of crlf. Maximum chunk size is twice the
+            buffer size.
+        """
 
+        read = self.stream.read
+        maxread, maxbuf = self.content_length, self.buffer_size
+        partial = b""  # Contains the last (partial) line
 
+        while True:
+            chunk = read(maxbuf if maxread < 0 else min(maxbuf, maxread))
+            maxread -= len(chunk)
+            if not chunk:
+                if partial:
+                    yield partial, b''
+                break
+
+            if partial:
+                chunk = partial + chunk
+
+            scanpos = 0
+            while True:
+                i = chunk.find(b'\r\n', scanpos)
+                if i >= 0:
+                    yield chunk[scanpos:i], b'\r\n'
+                    scanpos = i + 2
+                else: # CRLF not found
+                    partial = chunk[scanpos:] if scanpos else chunk
+                    break
+
+            if len(partial) > maxbuf:
+                yield partial[:-1], b""
+                partial = partial[-1:]
+
+    def parse(self):
+        """ Return a MultiPart iterator. Can only be called once. """
+
+        lines, line = self._lineiter(), ""
+        separator = b"--" + tob(self.boundary)
+        terminator = separator + b"--"
+        mem_used, disk_used = 0, 0  # Track used resources to prevent DoS
+        is_tail = False  # True if the last line was incomplete (cutted)
+
+        # Consume first boundary. Ignore any preamble, as required by RFC
+        # 2046, section 5.1.1.
+        for line, nl in lines:
+            if line in (separator, terminator):
+                break
+        else:
+            raise MultipartError("Stream does not contain boundary")
+
+        # First line is termainating boundary -> empty multipart stream
+        if line == terminator:
+            for _ in lines:
+                raise MultipartError("Found data after empty multipart stream")
+            return
+
+        part_options = {
+            "buffer_size": self.buffer_size,
+            "memfile_limit": self.memfile_limit,
+            "charset": self.charset,
+        }
+        part = _MultipartPart(**part_options)
+
+        for line, nl in lines:
+            if not is_tail and (line == separator or line == terminator):
+                part.finish()
+                if part.is_buffered():
+                    mem_used += part.size
+                else:
+                    disk_used += part.size
+                yield part
+                if line == terminator:
+                    break
+                part = _MultipartPart(**part_options)
+            else:
+                is_tail = not nl  # The next line continues this one
+                try:
+                    part.feed(line, nl)
+                    if part.is_buffered():
+                        if part.size + mem_used > self.mem_limit:
+                            raise MultipartError("Memory limit reached.")
+                    elif part.size + disk_used > self.disk_limit:
+                        raise MultipartError("Disk limit reached.")
+                except MultipartError:
+                    part.close()
+                    raise
+        else:
+            part.close()
+
+        if line != terminator:
+            raise MultipartError("Unexpected end of multipart stream.")
+
+
+class _MultipartPart(object):
+    def __init__(self, buffer_size=2 ** 16, memfile_limit=2 ** 18, charset="latin1"):
+        self.headerlist = []
+        self.headers = None
+        self.file = False
+        self.size = 0
+        self._buf = b""
+        self.disposition = None
+        self.name = None
+        self.filename = None
+        self.content_type = None
+        self.charset = charset
+        self.memfile_limit = memfile_limit
+        self.buffer_size = buffer_size
+
+    def feed(self, line, nl=""):
+        if self.file:
+            return self.write_body(line, nl)
+        return self.write_header(line, nl)
+
+    def write_header(self, line, nl):
+        line = line.decode(self.charset)
+
+        if not nl:
+            raise MultipartError("Unexpected end of line in header.")
+
+        if not line.strip():  # blank line -> end of header segment
+            self.finish_header()
+        elif line[0] in " \t" and self.headerlist:
+            name, value = self.headerlist.pop()
+            self.headerlist.append((name, value + line.strip()))
+        else:
+            if ":" not in line:
+                raise MultipartError("Syntax error in header: No colon.")
+
+            name, value = line.split(":", 1)
+            self.headerlist.append((name.strip(), value.strip()))
+
+    def write_body(self, line, nl):
+        if not line and not nl:
+            return  # This does not even flush the buffer
+
+        self.size += len(line) + len(self._buf)
+        self.file.write(self._buf + line)
+        self._buf = nl
+
+        if self.content_length > 0 and self.size > self.content_length:
+            raise MultipartError("Size of body exceeds Content-Length header.")
+
+        if self.size > self.memfile_limit and isinstance(self.file, BytesIO):
+            self.file, old = NamedTemporaryFile(mode="w+b"), self.file
+            old.seek(0)
+
+            copied, maxcopy, chunksize = 0, self.size, self.buffer_size
+            read, write = old.read, self.file.write
+            while copied < maxcopy:
+                chunk = read(min(chunksize, maxcopy - copied))
+                write(chunk)
+                copied += len(chunk)
+
+    def finish_header(self):
+        self.file = BytesIO()
+        self.headers = HeaderDict(self.headerlist)
+        content_disposition = self.headers.get("Content-Disposition")
+        content_type = self.headers.get("Content-Type")
+
+        if not content_disposition:
+            raise MultipartError("Content-Disposition header is missing.")
+
+        self.disposition, self.options = _parse_http_header(content_disposition)[0]
+        self.name = self.options.get("name")
+        if "filename" in self.options:
+            self.filename = self.options.get("filename")
+            if self.filename[1:3] == ":\\" or self.filename[:2] == "\\\\":
+                self.filename = self.filename.split("\\")[-1] # ie6 bug
+
+        self.content_type, options = _parse_http_header(content_type)[0] if content_type else (None, {})
+        self.charset = options.get("charset") or self.charset
+
+        self.content_length = int(self.headers.get("Content-Length", "-1"))
+
+    def finish(self):
+        if not self.file:
+            raise MultipartError("Incomplete part: Header section not closed.")
+        self.file.seek(0)
+
+    def is_buffered(self):
+        """ Return true if the data is fully buffered in memory."""
+        return isinstance(self.file, BytesIO)
+
+    @property
+    def value(self):
+        """ Data decoded with the specified charset """
+
+        return self.raw.decode(self.charset)
+
+    @property
+    def raw(self):
+        """ Data without decoding """
+        pos = self.file.tell()
+        self.file.seek(0)
+
+        try:
+            return self.file.read()
+        finally:
+            self.file.seek(pos)
+
+    def close(self):
+        if self.file:
+            self.file.close()
+            self.file = False
 
 ###############################################################################
 # Server Adapter ###############################################################
 ###############################################################################
 
+# Before you edit or add a server adapter, please read:
+# - https://github.com/bottlepy/bottle/pull/647#issuecomment-60152870
+# - https://github.com/bottlepy/bottle/pull/865#issuecomment-242795341
 
 class ServerAdapter(object):
     quiet = False
+
     def __init__(self, host='127.0.0.1', port=8080, **options):
         self.options = options
         self.host = host
         self.port = int(port)
 
-    def run(self, handler): # pragma: no cover
+    def run(self, handler):  # pragma: no cover
         pass
 
     def __repr__(self):
-        args = ', '.join(['%s=%s'%(k,repr(v)) for k, v in self.options.items()])
+        args = ', '.join('%s=%s' % (k, repr(v))
+                          for k, v in self.options.items())
         return "%s(%s)" % (self.__class__.__name__, args)
 
 
 class CGIServer(ServerAdapter):
     quiet = True
-    def run(self, handler): # pragma: no cover
+
+    def run(self, handler):  # pragma: no cover
         from wsgiref.handlers import CGIHandler
+
         def fixed_environ(environ, start_response):
             environ.setdefault('PATH_INFO', '')
             return handler(environ, start_response)
+
         CGIHandler().run(fixed_environ)
 
 
 class FlupFCGIServer(ServerAdapter):
-    def run(self, handler): # pragma: no cover
+    def run(self, handler):  # pragma: no cover
         import flup.server.fcgi
         self.options.setdefault('bindAddress', (self.host, self.port))
         flup.server.fcgi.WSGIServer(handler, **self.options).run()
 
 
 class WSGIRefServer(ServerAdapter):
-    def run(self, app): # pragma: no cover
-        from wsgiref.simple_server import WSGIRequestHandler, WSGIServer
+    def run(self, app):  # pragma: no cover
         from wsgiref.simple_server import make_server
+        from wsgiref.simple_server import WSGIRequestHandler, WSGIServer
         import socket
 
         class FixedHandler(WSGIRequestHandler):
-            def address_string(self): # Prevent reverse DNS lookups please.
+            def address_string(self):  # Prevent reverse DNS lookups please.
                 return self.client_address[0]
+
             def log_request(*args, **kw):
                 if not self.quiet:
                     return WSGIRequestHandler.log_request(*args, **kw)
 
         handler_cls = self.options.get('handler_class', FixedHandler)
-        server_cls  = self.options.get('server_class', WSGIServer)
+        server_cls = self.options.get('server_class', WSGIServer)
 
-        if ':' in self.host: # Fix wsgiref for IPv6 addresses.
+        if ':' in self.host:  # Fix wsgiref for IPv6 addresses.
             if getattr(server_cls, 'address_family') == socket.AF_INET:
+
                 class server_cls(server_cls):
                     address_family = socket.AF_INET6
 
-        srv = make_server(self.host, self.port, app, server_cls, handler_cls)
-        srv.serve_forever()
+        self.srv = make_server(self.host, self.port, app, server_cls,
+                               handler_cls)
+        self.port = self.srv.server_port  # update port actual port (0 means random)
+        try:
+            self.srv.serve_forever()
+        except KeyboardInterrupt:
+            self.srv.server_close()  # Prevent ResourceWarning: unclosed socket
+            raise
 
 
 class CherryPyServer(ServerAdapter):
-    def run(self, handler): # pragma: no cover
-        depr("The wsgi server part of cherrypy was split into a new "
-             "project called 'cheroot'. Use the 'cheroot' server "
-             "adapter instead of cherrypy.")
+    def run(self, handler):  # pragma: no cover
+        depr(0, 13, "The wsgi server part of cherrypy was split into a new "
+                    "project called 'cheroot'.", "Use the 'cheroot' server "
+                    "adapter instead of cherrypy.")
         from cherrypy import wsgiserver # This will fail for CherryPy >= 9
 
         self.options['bind_addr'] = (self.host, self.port)
@@ -2850,16 +3585,17 @@ class CherootServer(ServerAdapter):
 class WaitressServer(ServerAdapter):
     def run(self, handler):
         from waitress import serve
-        serve(handler, host=self.host, port=self.port)
+        serve(handler, host=self.host, port=self.port, _quiet=self.quiet, **self.options)
 
 
 class PasteServer(ServerAdapter):
-    def run(self, handler): # pragma: no cover
+    def run(self, handler):  # pragma: no cover
         from paste import httpserver
         from paste.translogger import TransLogger
         handler = TransLogger(handler, setup_console_handler=(not self.quiet))
-        httpserver.serve(handler, host=self.host, port=str(self.port),
-                         **self.options)
+        httpserver.serve(handler,
+                         host=self.host,
+                         port=str(self.port), **self.options)
 
 
 class MeinheldServer(ServerAdapter):
@@ -2870,8 +3606,10 @@ class MeinheldServer(ServerAdapter):
 
 
 class FapwsServer(ServerAdapter):
-    """ Extremely fast webserver using libev. See http://www.fapws.org/ """
-    def run(self, handler): # pragma: no cover
+    """ Extremely fast webserver using libev. See https://github.com/william-os4y/fapws3 """
+
+    def run(self, handler):  # pragma: no cover
+        depr(0, 13, "fapws3 is not maintained and support will be dropped.")
         import fapws._evwsgi as evwsgi
         from fapws import base, config
         port = self.port
@@ -2881,30 +3619,36 @@ class FapwsServer(ServerAdapter):
         evwsgi.start(self.host, port)
         # fapws3 never releases the GIL. Complain upstream. I tried. No luck.
         if 'BOTTLE_CHILD' in os.environ and not self.quiet:
-            _stderr("WARNING: Auto-reloading does not work with Fapws3.\n")
-            _stderr("         (Fapws3 breaks python thread support)\n")
+            _stderr("WARNING: Auto-reloading does not work with Fapws3.")
+            _stderr("         (Fapws3 breaks python thread support)")
         evwsgi.set_base_module(base)
+
         def app(environ, start_response):
             environ['wsgi.multiprocess'] = False
             return handler(environ, start_response)
+
         evwsgi.wsgi_cb(('', app))
         evwsgi.run()
 
 
 class TornadoServer(ServerAdapter):
     """ The super hyped asynchronous server by facebook. Untested. """
-    def run(self, handler): # pragma: no cover
+
+    def run(self, handler):  # pragma: no cover
         import tornado.wsgi, tornado.httpserver, tornado.ioloop
         container = tornado.wsgi.WSGIContainer(handler)
         server = tornado.httpserver.HTTPServer(container)
-        server.listen(port=self.port,address=self.host)
+        server.listen(port=self.port, address=self.host)
         tornado.ioloop.IOLoop.instance().start()
 
 
 class AppEngineServer(ServerAdapter):
     """ Adapter for Google App Engine. """
     quiet = True
+
     def run(self, handler):
+        depr(0, 13, "AppEngineServer no longer required",
+             "Configure your application directly in your app.yaml")
         from google.appengine.ext.webapp import util
         # A main() function in the handler script enables 'App Caching'.
         # Lets makes sure it is there. This _really_ improves performance.
@@ -2916,6 +3660,7 @@ class AppEngineServer(ServerAdapter):
 
 class TwistedServer(ServerAdapter):
     """ Untested. """
+
     def run(self, handler):
         from twisted.web import server, wsgi
         from twisted.python.threadpool import ThreadPool
@@ -2925,12 +3670,15 @@ class TwistedServer(ServerAdapter):
         reactor.addSystemEventTrigger('after', 'shutdown', thread_pool.stop)
         factory = server.Site(wsgi.WSGIResource(reactor, thread_pool, handler))
         reactor.listenTCP(self.port, factory, interface=self.host)
-        reactor.run()
+        if not reactor.running:
+            reactor.run()
 
 
 class DieselServer(ServerAdapter):
     """ Untested. """
+
     def run(self, handler):
+        depr(0, 13, "Diesel is not tested or supported and will be removed.")
         from diesel.protocols.wsgi import WSGIApplication
         app = WSGIApplication(handler, port=self.port)
         app.run()
@@ -2939,17 +3687,14 @@ class DieselServer(ServerAdapter):
 class GeventServer(ServerAdapter):
     """ Untested. Options:
 
-        * `fast` (default: False) uses libevent's http server, but has some
-          issues: No streaming, no pipelining, no SSL.
         * See gevent.wsgi.WSGIServer() documentation for more options.
     """
+
     def run(self, handler):
         from gevent import pywsgi, local
         if not isinstance(threading.local(), local.local):
             msg = "Bottle requires gevent.monkey.patch_all() (before import)"
             raise RuntimeError(msg)
-        if self.options.pop('fast', None):
-            depr('The "fast" option has been deprecated and removed by Gevent.')
         if self.quiet:
             self.options['log'] = None
         address = (self.host, self.port)
@@ -2960,24 +3705,23 @@ class GeventServer(ServerAdapter):
         server.serve_forever()
 
 
-class GeventSocketIOServer(ServerAdapter):
-    def run(self,handler):
-        from socketio import server
-        address = (self.host, self.port)
-        server.SocketIOServer(address, handler, **self.options).serve_forever()
-
-
 class GunicornServer(ServerAdapter):
     """ Untested. See http://gunicorn.org/configure.html for options. """
+
     def run(self, handler):
-        from gunicorn.app.base import Application
+        from gunicorn.app.base import BaseApplication
+
+        if self.host.startswith("unix:"):
+            config = {'bind': self.host}
+        else:
+            config = {'bind': "%s:%d" % (self.host, self.port)}
 
-        config = {'bind': "%s:%d" % (self.host, int(self.port))}
         config.update(self.options)
 
-        class GunicornApplication(Application):
-            def init(self, parser, opts, args):
-                return config
+        class GunicornApplication(BaseApplication):
+            def load_config(self):
+                for key, value in config.items():
+                    self.cfg.set(key, value)
 
             def load(self):
                 return handler
@@ -2986,31 +3730,77 @@ class GunicornServer(ServerAdapter):
 
 
 class EventletServer(ServerAdapter):
-    """ Untested """
+    """ Untested. Options:
+
+        * `backlog` adjust the eventlet backlog parameter which is the maximum
+          number of queued connections. Should be at least 1; the maximum
+          value is system-dependent.
+        * `family`: (default is 2) socket family, optional. See socket
+          documentation for available families.
+    """
+
     def run(self, handler):
-        from eventlet import wsgi, listen
+        from eventlet import wsgi, listen, patcher
+        if not patcher.is_monkey_patched(os):
+            msg = "Bottle requires eventlet.monkey_patch() (before import)"
+            raise RuntimeError(msg)
+        socket_args = {}
+        for arg in ('backlog', 'family'):
+            try:
+                socket_args[arg] = self.options.pop(arg)
+            except KeyError:
+                pass
+        address = (self.host, self.port)
         try:
-            wsgi.server(listen((self.host, self.port)), handler,
+            wsgi.server(listen(address, **socket_args), handler,
                         log_output=(not self.quiet))
         except TypeError:
             # Fallback, if we have old version of eventlet
-            wsgi.server(listen((self.host, self.port)), handler)
-
-
-class RocketServer(ServerAdapter):
-    """ Untested. """
-    def run(self, handler):
-        from rocket import Rocket
-        server = Rocket((self.host, self.port), 'wsgi', { 'wsgi_app' : handler })
-        server.start()
+            wsgi.server(listen(address), handler)
 
 
 class BjoernServer(ServerAdapter):
     """ Fast server written in C: https://github.com/jonashaag/bjoern """
+
     def run(self, handler):
         from bjoern import run
-        run(handler, self.host, self.port)
+        run(handler, self.host, self.port, reuse_port=True)
+
+class AsyncioServerAdapter(ServerAdapter):
+    """ Extend ServerAdapter for adding custom event loop """
+    def get_event_loop(self):
+        pass
+
+class AiohttpServer(AsyncioServerAdapter):
+    """ Asynchronous HTTP client/server framework for asyncio
+        https://pypi.python.org/pypi/aiohttp/
+        https://pypi.org/project/aiohttp-wsgi/
+    """
 
+    def get_event_loop(self):
+        import asyncio
+        return asyncio.new_event_loop()
+
+    def run(self, handler):
+        import asyncio
+        from aiohttp_wsgi.wsgi import serve
+        self.loop = self.get_event_loop()
+        asyncio.set_event_loop(self.loop)
+
+        if 'BOTTLE_CHILD' in os.environ:
+            import signal
+            signal.signal(signal.SIGINT, lambda s, f: self.loop.stop())
+
+        serve(handler, host=self.host, port=self.port)
+
+
+class AiohttpUVLoopServer(AiohttpServer):
+    """uvloop
+       https://github.com/MagicStack/uvloop
+    """
+    def get_event_loop(self):
+        import uvloop
+        return uvloop.new_event_loop()
 
 class AutoServer(ServerAdapter):
     """ Untested. """
@@ -3024,6 +3814,7 @@ class AutoServer(ServerAdapter):
             except ImportError:
                 pass
 
+
 server_names = {
     'cgi': CGIServer,
     'flup': FlupFCGIServer,
@@ -3041,17 +3832,12 @@ server_names = {
     'gunicorn': GunicornServer,
     'eventlet': EventletServer,
     'gevent': GeventServer,
-    'geventSocketIO':GeventSocketIOServer,
-    'rocket': RocketServer,
-    'bjoern' : BjoernServer,
+    'bjoern': BjoernServer,
+    'aiohttp': AiohttpServer,
+    'uvloop': AiohttpUVLoopServer,
     'auto': AutoServer,
 }
 
-
-
-
-
-
 ###############################################################################
 # Application Control ##########################################################
 ###############################################################################
@@ -3081,19 +3867,30 @@ def load_app(target):
     """ Load a bottle application from a module and make sure that the import
         does not affect the current default application, but returns a separate
         application object. See :func:`load` for the target parameter. """
-    global NORUN; NORUN, nr_old = True, NORUN
+    global NORUN
+    NORUN, nr_old = True, NORUN
+    tmp = default_app.push()  # Create a new "default application"
     try:
-        tmp = default_app.push() # Create a new "default application"
-        rv = load(target) # Import the target module
+        rv = load(target)  # Import the target module
         return rv if callable(rv) else tmp
     finally:
-        default_app.remove(tmp) # Remove the temporary added default application
+        default_app.remove(tmp)  # Remove the temporary added default application
         NORUN = nr_old
 
+
 _debug = debug
-def run(app=None, server='wsgiref', host='127.0.0.1', port=8080,
-        interval=1, reloader=False, quiet=False, plugins=None,
-        debug=None, **kargs):
+
+
+def run(app=None,
+        server='wsgiref',
+        host='127.0.0.1',
+        port=8080,
+        interval=1,
+        reloader=False,
+        quiet=False,
+        plugins=None,
+        debug=None,
+        config=None, **kargs):
     """ Start a server instance. This method blocks until the server terminates.
 
         :param app: WSGI application or target string supported by
@@ -3112,22 +3909,27 @@ def run(app=None, server='wsgiref', host
      """
     if NORUN: return
     if reloader and not os.environ.get('BOTTLE_CHILD'):
+        import subprocess
+        fd, lockfile = tempfile.mkstemp(prefix='bottle.', suffix='.lock')
+        environ = os.environ.copy()
+        environ['BOTTLE_CHILD'] = 'true'
+        environ['BOTTLE_LOCKFILE'] = lockfile
+        args = [sys.executable] + sys.argv
+        # If a package was loaded with `python -m`, then `sys.argv` needs to be
+        # restored to the original value, or imports might break. See #1336
+        if getattr(sys.modules.get('__main__'), '__package__', None):
+            args[1:1] = ["-m", sys.modules['__main__'].__package__]
+
         try:
-            lockfile = None
-            fd, lockfile = tempfile.mkstemp(prefix='bottle.', suffix='.lock')
-            os.close(fd) # We only need this file to exist. We never write to it
+            os.close(fd)  # We never write to this file
             while os.path.exists(lockfile):
-                args = [sys.executable] + sys.argv
-                environ = os.environ.copy()
-                environ['BOTTLE_CHILD'] = 'true'
-                environ['BOTTLE_LOCKFILE'] = lockfile
                 p = subprocess.Popen(args, env=environ)
-                while p.poll() is None: # Busy wait...
-                    os.utime(lockfile, None) # I am alive!
+                while p.poll() is None:
+                    os.utime(lockfile, None)  # Tell child we are still alive
                     time.sleep(interval)
-                if p.poll() != 3:
-                    if os.path.exists(lockfile): os.unlink(lockfile)
-                    sys.exit(p.poll())
+                if p.returncode == 3:  # Child wants to be restarted
+                    continue
+                sys.exit(p.returncode)
         except KeyboardInterrupt:
             pass
         finally:
@@ -3144,8 +3946,13 @@ def run(app=None, server='wsgiref', host
             raise ValueError("Application is not callable: %r" % app)
 
         for plugin in plugins or []:
+            if isinstance(plugin, basestring):
+                plugin = load(plugin)
             app.install(plugin)
 
+        if config:
+            app.config.update(config)
+
         if server in server_names:
             server = server_names.get(server)
         if isinstance(server, basestring):
@@ -3157,9 +3964,14 @@ def run(app=None, server='wsgiref', host
 
         server.quiet = server.quiet or quiet
         if not server.quiet:
-            _stderr("Bottle v%s server starting up (using %s)...\n" % (__version__, repr(server)))
-            _stderr("Listening on http://%s:%d/\n" % (server.host, server.port))
-            _stderr("Hit Ctrl-C to quit.\n\n")
+            _stderr("Bottle v%s server starting up (using %s)..." %
+                    (__version__, repr(server)))
+            if server.host.startswith("unix:"):
+                _stderr("Listening on %s" % server.host)
+            else:
+                _stderr("Listening on http://%s:%d/" %
+                        (server.host, server.port))
+            _stderr("Hit Ctrl-C to quit.\n")
 
         if reloader:
             lockfile = os.environ.get('BOTTLE_LOCKFILE')
@@ -3182,20 +3994,20 @@ def run(app=None, server='wsgiref', host
         sys.exit(3)
 
 
-
 class FileCheckerThread(threading.Thread):
-    ''' Interrupt main-thread as soon as a changed module file is detected,
-        the lockfile gets deleted or gets to old. '''
+    """ Interrupt main-thread as soon as a changed module file is detected,
+        the lockfile gets deleted or gets too old. """
 
     def __init__(self, lockfile, interval):
         threading.Thread.__init__(self)
+        self.daemon = True
         self.lockfile, self.interval = lockfile, interval
         #: Is one of 'reload', 'error' or 'exit'
         self.status = None
 
     def run(self):
         exists = os.path.exists
-        mtime = lambda path: os.stat(path).st_mtime
+        mtime = lambda p: os.stat(p).st_mtime
         files = dict()
 
         for module in list(sys.modules.values()):
@@ -3218,32 +4030,31 @@ class FileCheckerThread(threading.Thread
     def __enter__(self):
         self.start()
 
-    def __exit__(self, exc_type, exc_val, exc_tb):
-        if not self.status: self.status = 'exit' # silent exit
+    def __exit__(self, exc_type, *_):
+        if not self.status: self.status = 'exit'  # silent exit
         self.join()
         return exc_type is not None and issubclass(exc_type, KeyboardInterrupt)
 
-
-
-
-
 ###############################################################################
 # Template Adapters ############################################################
 ###############################################################################
 
 
-class TemplateError(HTTPError):
-    def __init__(self, message):
-        HTTPError.__init__(self, 500, message)
+class TemplateError(BottleException):
+    pass
 
 
 class BaseTemplate(object):
     """ Base class and minimal API for template adapters """
-    extensions = ['tpl','html','thtml','stpl']
-    settings = {} #used in prepare()
-    defaults = {} #used in render()
-
-    def __init__(self, source=None, name=None, lookup=[], encoding='utf8', **settings):
+    extensions = ['tpl', 'html', 'thtml', 'stpl']
+    settings = {}  #used in prepare()
+    defaults = {}  #used in render()
+
+    def __init__(self,
+                 source=None,
+                 name=None,
+                 lookup=None,
+                 encoding='utf8', **settings):
         """ Create a new template.
         If the source parameter (str or buffer) is missing, the name argument
         is used to guess a template filename. Subclasses can assume that
@@ -3257,10 +4068,10 @@ class BaseTemplate(object):
         self.name = name
         self.source = source.read() if hasattr(source, 'read') else source
         self.filename = source.filename if hasattr(source, 'filename') else None
-        self.lookup = [os.path.abspath(x) for x in lookup]
+        self.lookup = [os.path.abspath(x) for x in lookup] if lookup else []
         self.encoding = encoding
-        self.settings = self.settings.copy() # Copy from class variable
-        self.settings.update(settings) # Apply
+        self.settings = self.settings.copy()  # Copy from class variable
+        self.settings.update(settings)  # Apply
         if not self.source and self.name:
             self.filename = self.search(self.name, self.lookup)
             if not self.filename:
@@ -3270,16 +4081,15 @@ class BaseTemplate(object):
         self.prepare(**self.settings)
 
     @classmethod
-    def search(cls, name, lookup=[]):
+    def search(cls, name, lookup=None):
         """ Search name in all directories specified in lookup.
         First without, then with common extensions. Return first hit. """
         if not lookup:
-            depr('The template lookup path list should not be empty.') #0.12
-            lookup = ['.']
+            raise depr(0, 12, "Empty template lookup path.", "Configure a template lookup path.")
 
-        if os.path.isabs(name) and os.path.isfile(name):
-            depr('Absolute template path names are deprecated.') #0.12
-            return os.path.abspath(name)
+        if os.path.isabs(name):
+            raise depr(0, 12, "Use of absolute path for template name.",
+                       "Refer to templates with names or paths relative to the lookup path.")
 
         for spath in lookup:
             spath = os.path.abspath(spath) + os.sep
@@ -3292,9 +4102,9 @@ class BaseTemplate(object):
 
     @classmethod
     def global_config(cls, key, *args):
-        ''' This reads or sets the global settings stored in class.settings. '''
+        """ This reads or sets the global settings stored in class.settings. """
         if args:
-            cls.settings = cls.settings.copy() # Make settings local to class
+            cls.settings = cls.settings.copy()  # Make settings local to class
             cls.settings[key] = args[0]
         else:
             return cls.settings[key]
@@ -3320,16 +4130,19 @@ class MakoTemplate(BaseTemplate):
     def prepare(self, **options):
         from mako.template import Template
         from mako.lookup import TemplateLookup
-        options.update({'input_encoding':self.encoding})
+        options.update({'input_encoding': self.encoding})
         options.setdefault('format_exceptions', bool(DEBUG))
         lookup = TemplateLookup(directories=self.lookup, **options)
         if self.source:
             self.tpl = Template(self.source, lookup=lookup, **options)
         else:
-            self.tpl = Template(uri=self.name, filename=self.filename, lookup=lookup, **options)
+            self.tpl = Template(uri=self.name,
+                                filename=self.filename,
+                                lookup=lookup, **options)
 
     def render(self, *args, **kwargs):
-        for dictarg in args: kwargs.update(dictarg)
+        for dictarg in args:
+            kwargs.update(dictarg)
         _defaults = self.defaults.copy()
         _defaults.update(kwargs)
         return self.tpl.render(**_defaults)
@@ -3347,7 +4160,8 @@ class CheetahTemplate(BaseTemplate):
             self.tpl = Template(file=self.filename, **options)
 
     def render(self, *args, **kwargs):
-        for dictarg in args: kwargs.update(dictarg)
+        for dictarg in args:
+            kwargs.update(dictarg)
         self.context.vars.update(self.defaults)
         self.context.vars.update(kwargs)
         out = str(self.tpl)
@@ -3358,9 +4172,6 @@ class CheetahTemplate(BaseTemplate):
 class Jinja2Template(BaseTemplate):
     def prepare(self, filters=None, tests=None, globals={}, **kwargs):
         from jinja2 import Environment, FunctionLoader
-        if 'prefix' in kwargs: # TODO: to be removed after a while
-            raise RuntimeError('The keyword argument `prefix` has been removed. '
-                'Use the full jinja2 environment name line_statement_prefix instead.')
         self.env = Environment(loader=FunctionLoader(self.loader), **kwargs)
         if filters: self.env.filters.update(filters)
         if tests: self.env.tests.update(tests)
@@ -3368,24 +4179,30 @@ class Jinja2Template(BaseTemplate):
         if self.source:
             self.tpl = self.env.from_string(self.source)
         else:
-            self.tpl = self.env.get_template(self.filename)
+            self.tpl = self.env.get_template(self.name)
 
     def render(self, *args, **kwargs):
-        for dictarg in args: kwargs.update(dictarg)
+        for dictarg in args:
+            kwargs.update(dictarg)
         _defaults = self.defaults.copy()
         _defaults.update(kwargs)
         return self.tpl.render(**_defaults)
 
     def loader(self, name):
-        fname = self.search(name, self.lookup)
+        if name == self.filename:
+            fname = name
+        else:
+            fname = self.search(name, self.lookup)
         if not fname: return
         with open(fname, "rb") as f:
-            return f.read().decode(self.encoding)
+            return (f.read().decode(self.encoding), fname, lambda: False)
 
 
 class SimpleTemplate(BaseTemplate):
-
-    def prepare(self, escape_func=html_escape, noescape=False, syntax=None, **ka):
+    def prepare(self,
+                escape_func=html_escape,
+                noescape=False,
+                syntax=None, **ka):
         self.cache = {}
         enc = self.encoding
         self._str = lambda x: touni(x, enc)
@@ -3407,87 +4224,114 @@ class SimpleTemplate(BaseTemplate):
         try:
             source, encoding = touni(source), 'utf8'
         except UnicodeError:
-            depr('Template encodings other than utf8 are no longer supported.') #0.11
-            source, encoding = touni(source, 'latin1'), 'latin1'
+            raise depr(0, 11, 'Unsupported template encodings.', 'Use utf-8 for templates.')
         parser = StplParser(source, encoding=encoding, syntax=self.syntax)
         code = parser.translate()
         self.encoding = parser.encoding
         return code
 
     def _rebase(self, _env, _name=None, **kwargs):
-        if _name is None:
-            depr('Rebase function called without arguments.'
-                 ' You were probably looking for {{base}}?', True) #0.12
         _env['_rebase'] = (_name, kwargs)
 
     def _include(self, _env, _name=None, **kwargs):
-        if _name is None:
-            depr('Rebase function called without arguments.'
-                 ' You were probably looking for {{base}}?', True) #0.12
         env = _env.copy()
         env.update(kwargs)
         if _name not in self.cache:
-            self.cache[_name] = self.__class__(name=_name, lookup=self.lookup)
+            self.cache[_name] = self.__class__(name=_name, lookup=self.lookup, syntax=self.syntax)
         return self.cache[_name].execute(env['_stdout'], env)
 
     def execute(self, _stdout, kwargs):
         env = self.defaults.copy()
         env.update(kwargs)
-        env.update({'_stdout': _stdout, '_printlist': _stdout.extend,
+        env.update({
+            '_stdout': _stdout,
+            '_printlist': _stdout.extend,
             'include': functools.partial(self._include, env),
-            'rebase': functools.partial(self._rebase, env), '_rebase': None,
-            '_str': self._str, '_escape': self._escape, 'get': env.get,
-            'setdefault': env.setdefault, 'defined': env.__contains__ })
-        eval(self.co, env)
+            'rebase': functools.partial(self._rebase, env),
+            '_rebase': None,
+            '_str': self._str,
+            '_escape': self._escape,
+            'get': env.get,
+            'setdefault': env.setdefault,
+            'defined': env.__contains__
+        })
+        exec(self.co, env)
         if env.get('_rebase'):
             subtpl, rargs = env.pop('_rebase')
-            rargs['base'] = ''.join(_stdout) #copy stdout
-            del _stdout[:] # clear stdout
+            rargs['base'] = ''.join(_stdout)  #copy stdout
+            del _stdout[:]  # clear stdout
             return self._include(env, subtpl, **rargs)
         return env
 
     def render(self, *args, **kwargs):
         """ Render the template using keyword arguments as local variables. """
-        env = {}; stdout = []
-        for dictarg in args: env.update(dictarg)
+        env = {}
+        stdout = []
+        for dictarg in args:
+            env.update(dictarg)
         env.update(kwargs)
         self.execute(stdout, env)
         return ''.join(stdout)
 
 
-class StplSyntaxError(TemplateError): pass
+class StplSyntaxError(TemplateError):
+    pass
 
 
 class StplParser(object):
-    ''' Parser for stpl templates. '''
-    _re_cache = {} #: Cache for compiled re patterns
+    """ Parser for stpl templates. """
+    _re_cache = {}  #: Cache for compiled re patterns
+
     # This huge pile of voodoo magic splits python code into 8 different tokens.
-    # 1: All kinds of python strings (trust me, it works)
-    _re_tok = '([urbURB]?(?:\'\'(?!\')|""(?!")|\'{6}|"{6}' \
-               '|\'(?:[^\\\\\']|\\\\.)+?\'|"(?:[^\\\\"]|\\\\.)+?"' \
-               '|\'{3}(?:[^\\\\]|\\\\.|\\n)+?\'{3}' \
-               '|"{3}(?:[^\\\\]|\\\\.|\\n)+?"{3}))'
-    _re_inl = _re_tok.replace('|\\n','') # We re-use this string pattern later
-    # 2: Comments (until end of line, but not the newline itself)
-    _re_tok += '|(#.*)'
-    # 3,4: Open and close grouping tokens
-    _re_tok += '|([\\[\\{\\(])'
-    _re_tok += '|([\\]\\}\\)])'
-    # 5,6: Keywords that start or continue a python block (only start of line)
-    _re_tok += '|^([ \\t]*(?:if|for|while|with|try|def|class)\\b)' \
-               '|^([ \\t]*(?:elif|else|except|finally)\\b)'
-    # 7: Our special 'end' keyword (but only if it stands alone)
-    _re_tok += '|((?:^|;)[ \\t]*end[ \\t]*(?=(?:%(block_close)s[ \\t]*)?\\r?$|;|#))'
-    # 8: A customizable end-of-code-block template token (only end of line)
-    _re_tok += '|(%(block_close)s[ \\t]*(?=\\r?$))'
-    # 9: And finally, a single newline. The 10th token is 'everything else'
-    _re_tok += '|(\\r?\\n)'
+    # We use the verbose (?x) regex mode to make this more manageable
+
+    _re_tok = r'''(
+        [urbURB]*
+        (?:  ''(?!')
+            |""(?!")
+            |'{6}
+            |"{6}
+            |'(?:[^\\']|\\.)+?'
+            |"(?:[^\\"]|\\.)+?"
+            |'{3}(?:[^\\]|\\.|\n)+?'{3}
+            |"{3}(?:[^\\]|\\.|\n)+?"{3}
+        )
+    )'''
+
+    _re_inl = _re_tok.replace(r'|\n', '')  # We re-use this string pattern later
+
+    _re_tok += r'''
+        # 2: Comments (until end of line, but not the newline itself)
+        |(\#.*)
+
+        # 3: Open and close (4) grouping tokens
+        |([\[\{\(])
+        |([\]\}\)])
+
+        # 5,6: Keywords that start or continue a python block (only start of line)
+        |^([\ \t]*(?:if|for|while|with|try|def|class)\b)
+        |^([\ \t]*(?:elif|else|except|finally)\b)
+
+        # 7: Our special 'end' keyword (but only if it stands alone)
+        |((?:^|;)[\ \t]*end[\ \t]*(?=(?:%(block_close)s[\ \t]*)?\r?$|;|\#))
+
+        # 8: A customizable end-of-code-block template token (only end of line)
+        |(%(block_close)s[\ \t]*(?=\r?$))
+
+        # 9: And finally, a single newline. The 10th token is 'everything else'
+        |(\r?\n)
+    '''
 
     # Match the start tokens of code areas in a template
-    _re_split = '(?m)^[ \t]*(\\\\?)((%(line_start)s)|(%(block_start)s))(%%?)'
+    _re_split = r'''(?m)^[ \t]*(\\?)((%(line_start)s)|(%(block_start)s))'''
     # Match inline statements (may contain python strings)
-    _re_inl = '(?m)%%(inline_start)s((?:%s|[^\'"\n]*?)+)%%(inline_end)s' % _re_inl
-    _re_tok = '(?m)' + _re_tok
+    _re_inl = r'''%%(inline_start)s((?:%s|[^'"\n])*?)%%(inline_end)s''' % _re_inl
+
+    # add the flag in front of the regexp to avoid Deprecation warning (see Issue #949)
+    # verbose and dot-matches-newline mode
+    _re_tok = '(?mx)' + _re_tok
+    _re_inl = '(?mx)' + _re_inl
+
 
     default_syntax = '<% %> % {{ }}'
 
@@ -3500,18 +4344,18 @@ class StplParser(object):
         self.paren_depth = 0
 
     def get_syntax(self):
-        ''' Tokens as a space separated string (default: <% %> % {{ }}) '''
+        """ Tokens as a space separated string (default: <% %> % {{ }}) """
         return self._syntax
 
     def set_syntax(self, syntax):
         self._syntax = syntax
         self._tokens = syntax.split()
-        if not syntax in self._re_cache:
+        if syntax not in self._re_cache:
             names = 'block_start block_close line_start inline_start inline_end'
             etokens = map(re.escape, self._tokens)
             pattern_vars = dict(zip(names.split(), etokens))
             patterns = (self._re_split, self._re_tok, self._re_inl)
-            patterns = [re.compile(p%pattern_vars) for p in patterns]
+            patterns = [re.compile(p % pattern_vars) for p in patterns]
             self._re_cache[syntax] = patterns
         self.re_split, self.re_tok, self.re_inl = self._re_cache[syntax]
 
@@ -3520,50 +4364,48 @@ class StplParser(object):
     def translate(self):
         if self.offset: raise RuntimeError('Parser is a one time instance.')
         while True:
-            m = self.re_split.search(self.source[self.offset:])
+            m = self.re_split.search(self.source, pos=self.offset)
             if m:
-                text = self.source[self.offset:self.offset+m.start()]
+                text = self.source[self.offset:m.start()]
                 self.text_buffer.append(text)
-                self.offset += m.end()
-                if m.group(1): # New escape syntax
-                    line, sep, _ = self.source[self.offset:].partition('\n')
-                    self.text_buffer.append(m.group(2)+m.group(5)+line+sep)
-                    self.offset += len(line+sep)+1
-                    continue
-                elif m.group(5): # Old escape syntax
-                    depr('Escape code lines with a backslash.') #0.12
+                self.offset = m.end()
+                if m.group(1):  # Escape syntax
                     line, sep, _ = self.source[self.offset:].partition('\n')
-                    self.text_buffer.append(m.group(2)+line+sep)
-                    self.offset += len(line+sep)+1
+                    self.text_buffer.append(self.source[m.start():m.start(1)] +
+                                            m.group(2) + line + sep)
+                    self.offset += len(line + sep)
                     continue
                 self.flush_text()
-                self.read_code(multiline=bool(m.group(4)))
-            else: break
+                self.offset += self.read_code(self.source[self.offset:],
+                                              multiline=bool(m.group(4)))
+            else:
+                break
         self.text_buffer.append(self.source[self.offset:])
         self.flush_text()
         return ''.join(self.code_buffer)
 
-    def read_code(self, multiline):
+    def read_code(self, pysource, multiline):
         code_line, comment = '', ''
+        offset = 0
         while True:
-            m = self.re_tok.search(self.source[self.offset:])
+            m = self.re_tok.search(pysource, pos=offset)
             if not m:
-                code_line += self.source[self.offset:]
-                self.offset = len(self.source)
+                code_line += pysource[offset:]
+                offset = len(pysource)
                 self.write_code(code_line.strip(), comment)
-                return
-            code_line += self.source[self.offset:self.offset+m.start()]
-            self.offset += m.end()
+                break
+            code_line += pysource[offset:m.start()]
+            offset = m.end()
             _str, _com, _po, _pc, _blk1, _blk2, _end, _cend, _nl = m.groups()
-            if (code_line or self.paren_depth > 0) and (_blk1 or _blk2): # a if b else c
+            if self.paren_depth > 0 and (_blk1 or _blk2):  # a if b else c
                 code_line += _blk1 or _blk2
                 continue
-            if _str:    # Python string
+            if _str:  # Python string
                 code_line += _str
             elif _com:  # Python comment (up to EOL)
                 comment = _com
                 if multiline and _com.strip().endswith(self._tokens[1]):
-                    multiline = False # Allow end-of-block in comments
+                    multiline = False  # Allow end-of-block in comments
             elif _po:  # open parenthesis
                 self.paren_depth += 1
                 code_line += _po
@@ -3573,28 +4415,33 @@ class StplParser(object):
                     # easier to leave that to python - just check counts
                     self.paren_depth -= 1
                 code_line += _pc
-            elif _blk1: # Start-block keyword (if/for/while/def/try/...)
-                code_line, self.indent_mod = _blk1, -1
+            elif _blk1:  # Start-block keyword (if/for/while/def/try/...)
+                code_line = _blk1
                 self.indent += 1
-            elif _blk2: # Continue-block keyword (else/elif/except/...)
-                code_line, self.indent_mod = _blk2, -1
-            elif _end:  # The non-standard 'end'-keyword (ends a block)
-                self.indent -= 1
-            elif _cend: # The end-code-block template token (usually '%>')
+                self.indent_mod -= 1
+            elif _blk2:  # Continue-block keyword (else/elif/except/...)
+                code_line = _blk2
+                self.indent_mod -= 1
+            elif _cend:  # The end-code-block template token (usually '%>')
                 if multiline: multiline = False
                 else: code_line += _cend
-            else: # \n
+            elif _end:
+                self.indent -= 1
+                self.indent_mod += 1
+            else:  # \n
                 self.write_code(code_line.strip(), comment)
                 self.lineno += 1
                 code_line, comment, self.indent_mod = '', '', 0
                 if not multiline:
                     break
 
+        return offset
+
     def flush_text(self):
         text = ''.join(self.text_buffer)
         del self.text_buffer[:]
         if not text: return
-        parts, pos, nl = [], 0, '\\\n'+'  '*self.indent
+        parts, pos, nl = [], 0, '\\\n' + '  ' * self.indent
         for m in self.re_inl.finditer(text):
             prefix, pos = text[pos:m.start()], m.end()
             if prefix:
@@ -3608,45 +4455,30 @@ class StplParser(object):
             elif lines[-1].endswith('\\\\\r\n'): lines[-1] = lines[-1][:-4]
             parts.append(nl.join(map(repr, lines)))
         code = '_printlist((%s,))' % ', '.join(parts)
-        self.lineno += code.count('\n')+1
+        self.lineno += code.count('\n') + 1
         self.write_code(code)
 
-    def process_inline(self, chunk):
+    @staticmethod
+    def process_inline(chunk):
         if chunk[0] == '!': return '_str(%s)' % chunk[1:]
         return '_escape(%s)' % chunk
 
     def write_code(self, line, comment=''):
-        line, comment = self.fix_backward_compatibility(line, comment)
-        code  = '  ' * (self.indent+self.indent_mod)
+        code = '  ' * (self.indent + self.indent_mod)
         code += line.lstrip() + comment + '\n'
         self.code_buffer.append(code)
 
-    def fix_backward_compatibility(self, line, comment):
-        parts = line.strip().split(None, 2)
-        if parts and parts[0] in ('include', 'rebase'):
-            depr('The include and rebase keywords are functions now.') #0.12
-            if len(parts) == 1:   return "_printlist([base])", comment
-            elif len(parts) == 2: return "_=%s(%r)" % tuple(parts), comment
-            else:                 return "_=%s(%r, %s)" % tuple(parts), comment
-        if self.lineno <= 2 and not line.strip() and 'coding' in comment:
-            m = re.match(r"#.*coding[:=]\s*([-\w.]+)", comment)
-            if m:
-                depr('PEP263 encoding strings in templates are deprecated.') #0.12
-                enc = m.group(1)
-                self.source = self.source.encode(self.encoding).decode(enc)
-                self.encoding = enc
-                return line, comment.replace('coding','coding*')
-        return line, comment
-
 
 def template(*args, **kwargs):
-    '''
+    """
     Get a rendered template as a string iterator.
     You can use a name, a filename or a template string as first parameter.
     Template rendering arguments can be passed as dictionaries
     or directly (as keyword arguments).
-    '''
+    """
     tpl = args[0] if args else None
+    for dictarg in args[1:]:
+        kwargs.update(dictarg)
     adapter = kwargs.pop('template_adapter', SimpleTemplate)
     lookup = kwargs.pop('template_lookup', TEMPLATE_PATH)
     tplid = (id(lookup), tpl)
@@ -3661,16 +4493,17 @@ def template(*args, **kwargs):
             TEMPLATES[tplid] = adapter(name=tpl, lookup=lookup, **settings)
     if not TEMPLATES[tplid]:
         abort(500, 'Template (%s) not found' % tpl)
-    for dictarg in args[1:]: kwargs.update(dictarg)
     return TEMPLATES[tplid].render(kwargs)
 
+
 mako_template = functools.partial(template, template_adapter=MakoTemplate)
-cheetah_template = functools.partial(template, template_adapter=CheetahTemplate)
+cheetah_template = functools.partial(template,
+                                     template_adapter=CheetahTemplate)
 jinja2_template = functools.partial(template, template_adapter=Jinja2Template)
 
 
 def view(tpl_name, **defaults):
-    ''' Decorator: renders a template for a handler.
+    """ Decorator: renders a template for a handler.
         The handler can control its behavior like that:
 
           - return a dict of template vars to fill out the template
@@ -3678,8 +4511,10 @@ def view(tpl_name, **defaults):
             process the template, but return the handler result as is.
             This includes returning a HTTPResponse(dict) to get,
             for instance, JSON with autojson or other castfilters.
-    '''
+    """
+
     def decorator(func):
+
         @functools.wraps(func)
         def wrapper(*args, **kwargs):
             result = func(*args, **kwargs)
@@ -3690,48 +4525,46 @@ def view(tpl_name, **defaults):
             elif result is None:
                 return template(tpl_name, **defaults)
             return result
+
         return wrapper
+
     return decorator
 
+
 mako_view = functools.partial(view, template_adapter=MakoTemplate)
 cheetah_view = functools.partial(view, template_adapter=CheetahTemplate)
 jinja2_view = functools.partial(view, template_adapter=Jinja2Template)
 
-
-
-
-
-
 ###############################################################################
 # Constants and Globals ########################################################
 ###############################################################################
 
-
 TEMPLATE_PATH = ['./', './views/']
 TEMPLATES = {}
 DEBUG = False
-NORUN = False # If set, run() does nothing. Used by load_app()
+NORUN = False  # If set, run() does nothing. Used by load_app()
 
 #: A dict to map HTTP status codes (e.g. 404) to phrases (e.g. 'Not Found')
-HTTP_CODES = httplib.responses
-HTTP_CODES[418] = "I'm a teapot" # RFC 2324
-HTTP_CODES[422] = "Unprocessable Entity" # RFC 4918
+HTTP_CODES = httplib.responses.copy()
+HTTP_CODES[418] = "I'm a teapot"  # RFC 2324
 HTTP_CODES[428] = "Precondition Required"
 HTTP_CODES[429] = "Too Many Requests"
 HTTP_CODES[431] = "Request Header Fields Too Large"
+HTTP_CODES[451] = "Unavailable For Legal Reasons" # RFC 7725
 HTTP_CODES[511] = "Network Authentication Required"
-_HTTP_STATUS_LINES = dict((k, '%d %s'%(k,v)) for (k,v) in HTTP_CODES.items())
+_HTTP_STATUS_LINES = dict((k, '%d %s' % (k, v))
+                          for (k, v) in HTTP_CODES.items())
 
 #: The default template used for error pages. Override with @error()
 ERROR_PAGE_TEMPLATE = """
 %%try:
-    %%from %s import DEBUG, HTTP_CODES, request, touni
+    %%from %s import DEBUG, request
     <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
     <html>
         <head>
             <title>Error: {{e.status}}</title>
             <style type="text/css">
-              html {background-color: #eee; font-family: sans;}
+              html {background-color: #eee; font-family: sans-serif;}
               body {background-color: #fff; border: 1px solid #ddd;
                     padding: 15px; margin: 15px;}
               pre {background-color: #eee; border: 1px solid #ddd; padding: 5px;}
@@ -3744,7 +4577,12 @@ ERROR_PAGE_TEMPLATE = """
             <pre>{{e.body}}</pre>
             %%if DEBUG and e.exception:
               <h2>Exception:</h2>
-              <pre>{{repr(e.exception)}}</pre>
+              %%try:
+                %%exc = repr(e.exception)
+              %%except:
+                %%exc = '<unprintable %%s object>' %% type(e.exception).__name__
+              %%end
+              <pre>{{exc}}</pre>
             %%end
             %%if DEBUG and e.traceback:
               <h2>Traceback:</h2>
@@ -3760,7 +4598,7 @@ ERROR_PAGE_TEMPLATE = """
 
 #: A thread-safe instance of :class:`LocalRequest`. If accessed from within a
 #: request callback, this instance always refers to the *current* request
-#: (even on a multithreaded server).
+#: (even on a multi-threaded server).
 request = LocalRequest()
 
 #: A thread-safe instance of :class:`LocalResponse`. It is used to change the
@@ -3770,37 +4608,73 @@ response = LocalResponse()
 #: A thread-safe namespace. Not used by Bottle.
 local = threading.local()
 
-# Initialize app stack (create first empty Bottle app)
+# Initialize app stack (create first empty Bottle app now deferred until needed)
 # BC: 0.6.4 and needed for run()
-app = default_app = AppStack()
-app.push()
+apps = app = default_app = AppStack()
 
 #: A virtual package that redirects import statements.
 #: Example: ``import bottle.ext.sqlite`` actually imports `bottle_sqlite`.
-ext = _ImportRedirect('bottle.ext' if __name__ == '__main__' else __name__+".ext", 'bottle_%s').module
+ext = _ImportRedirect('bottle.ext' if __name__ == '__main__' else
+                      __name__ + ".ext", 'bottle_%s').module
 
-if __name__ == '__main__':
-    opt, args, parser = _cmd_options, _cmd_args, _cmd_parser
-    if opt.version:
-        _stdout('Bottle %s\n'%__version__)
-        sys.exit(0)
-    if not args:
+
+def _main(argv):  # pragma: no coverage
+    args, parser = _cli_parse(argv)
+
+    def _cli_error(cli_msg):
         parser.print_help()
-        _stderr('\nError: No application specified.\n')
+        _stderr('\nError: %s\n' % cli_msg)
         sys.exit(1)
 
+    if args.version:
+        print('Bottle %s' % __version__)
+        sys.exit(0)
+    if not args.app:
+        _cli_error("No application entry point specified.")
+
     sys.path.insert(0, '.')
     sys.modules.setdefault('bottle', sys.modules['__main__'])
 
-    host, port = (opt.bind or 'localhost'), 8080
+    host, port = (args.bind or 'localhost'), 8080
     if ':' in host and host.rfind(']') < host.rfind(':'):
         host, port = host.rsplit(':', 1)
     host = host.strip('[]')
 
-    run(args[0], host=host, port=int(port), server=opt.server,
-        reloader=opt.reload, plugins=opt.plugin, debug=opt.debug)
+    config = ConfigDict()
+
+    for cfile in args.conf or []:
+        try:
+            if cfile.endswith('.json'):
+                with open(cfile, 'rb') as fp:
+                    config.load_dict(json_loads(fp.read()))
+            else:
+                config.load_config(cfile)
+        except configparser.Error as parse_error:
+            _cli_error(parse_error)
+        except IOError:
+            _cli_error("Unable to read config file %r" % cfile)
+        except (UnicodeError, TypeError, ValueError) as error:
+            _cli_error("Unable to parse config file %r: %s" % (cfile, error))
+
+    for cval in args.param or []:
+        if '=' in cval:
+            config.update((cval.split('=', 1),))
+        else:
+            config[cval] = True
+
+    run(args.app,
+        host=host,
+        port=int(port),
+        server=args.server,
+        reloader=args.reload,
+        plugins=args.plugin,
+        debug=args.debug,
+        config=config)
 
 
+def main():
+    _main(sys.argv)
 
 
-# THE END
+if __name__ == '__main__':  # pragma: no coverage
+    main()
diff -pruN 2.0.2-1/build/cmake/GenerateUninstaller.cmake 2.1.0-1/build/cmake/GenerateUninstaller.cmake
--- 2.0.2-1/build/cmake/GenerateUninstaller.cmake	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/build/cmake/GenerateUninstaller.cmake	2025-08-14 18:37:23.000000000 +0000
@@ -1,4 +1,10 @@
-cmake_policy(VERSION 3.15)
+# This script may be executed in script mode by the uninstall target.
+cmake_policy(VERSION 3.15...4.0)
+
+# Avoid CMake Issue 26678: https://gitlab.kitware.com/cmake/cmake/-/issues/26678
+if("${CMAKE_VERSION}" VERSION_GREATER_EQUAL "3.27")
+    cmake_policy(SET CMP0147 OLD)
+endif()
 
 if(NOT CMAKE_SCRIPT_MODE_FILE)
     # We are being included from within a project, so we should generate the install rules
@@ -52,7 +58,6 @@ if(NOT CMAKE_SCRIPT_MODE_FILE)
     return()
 endif()
 
-# We get here if running in script mode (e.g. at CMake install-time)
 if(NOT DEFINED CMAKE_INSTALL_MANIFEST_FILES)
     message(FATAL_ERROR "This file is only for use with CMake's install(CODE/SCRIPT) command")
 endif()
@@ -115,53 +120,6 @@ limitations under the License.]])
 string(STRIP header "${header}")
 string(REPLACE "\n" ";" header_lines "${header}")
 
-# Prefix for the Batch script:
-set(bat_preamble [[
-call :init
-
-:print
-<nul set /p_=%~1
-exit /b
-
-:rmfile
-set f=%__prefix%\%~1
-call :print "Remove file %f% "
-if EXIST "%f%" (
-    del /Q /F "%f%" || exit /b %errorlevel%
-    call :print " - ok"
-) else (
-    call :print " - skipped: not present"
-)
-echo(
-exit /b
-
-:rmdir
-set f=%__prefix%\%~1
-call :print "Remove directory: %f% "
-if EXIST "%f%" (
-    rmdir /Q "%f%" 2>nul
-    if ERRORLEVEL 0 (
-        call :print "- ok"
-    ) else (
-        call :print "- skipped (non-empty?)"
-    )
-) else (
-    call :print " - skipped: not present"
-)
-echo(
-exit /b
-
-:init
-setlocal EnableDelayedExpansion
-setlocal EnableExtensions
-if /i "%~dp0" NEQ "%TEMP%\" (
-    set tmpfile=%TEMP%\mongoc-%~nx0
-    copy "%~f0" "!tmpfile!" >nul
-    call "!tmpfile!" & del "!tmpfile!"
-    exit /b
-)
-]])
-
 # Prefix for the shell script:
 set(sh_preamble [[
 set -eu
@@ -185,13 +143,10 @@ __rmdir() {
     printf "Remove directory %s: " "$abs"
     if test -d "$abs"
     then
-        list=$(ls --almost-all "$abs")
+        list="$(find "$abs" -mindepth 1)"
         if test "$list" = ""
         then
-            rmdir -- "$abs"
-            echo "ok"
-        else
-            echo "skipped: not empty"
+            rmdir -- "$abs" 2>/dev/null && echo "ok" || echo "skipped: not empty"
         fi
     else
         echo "skipped: not present"
@@ -223,15 +178,9 @@ if(UNINSTALL_IS_WIN32)
         ""
         "${header_lines}"
         ""
-        "${bat_preamble}"
-        "if \"%DESTDIR%\"==\"\" ("
-        "  set __prefix=${install_prefix}"
-        ") else ("
-        "  set __prefix=!DESTDIR!\\${relative_prefix}"
-        ")"
-        "")
-    set(__rmfile "call :rmfile")
-    set(__rmdir "call :rmdir")
+        "if \"%DESTDIR%\"==\"\" (set __prefix=${install_prefix}) else (set __prefix=!DESTDIR!\\${relative_prefix})"
+        ""
+        "(GOTO) 2>nul & (")
 else()
     # Comment the header:
     list(TRANSFORM header_lines PREPEND "# " REGEX "^.+$")
@@ -245,8 +194,6 @@ else()
         "${sh_preamble}"
         "__prefix=\${DESTDIR:-}${install_prefix}"
         "")
-    set(__rmfile "__rmfile")
-    set(__rmdir "__rmdir")
 endif()
 
 # Add the first lines to the file:
@@ -256,13 +203,37 @@ append_line("${init}")
 # Generate a "remove a file" command
 function(add_rmfile filename)
     file(TO_NATIVE_PATH "${filename}" native)
-    append_line("${__rmfile} '${native}'")
+    if(WIN32)
+      set(file "%__prefix%\\${native}")
+      set(rmfile_lines
+        "  <nul set /p \"=Remove file: ${file} \""
+        "  if EXIST \"${file}\" ("
+        "    del /Q /F \"${file}\" && echo - ok"
+        "  ) ELSE echo - skipped: not present"
+        ") && (")
+      string(REPLACE ";" "\n" rmfile "${rmfile_lines}")
+      append_line("${rmfile}")
+    else()
+      append_line("__rmfile '${native}'")
+    endif()
 endfunction()
 
 # Generate a "remove a directory" command
 function(add_rmdir dirname)
     file(TO_NATIVE_PATH "${dirname}" native)
-    append_line("${__rmdir} '${native}'")
+    if(WIN32)
+      set(dir "%__prefix%\\${native}")
+      set(rmdir_lines
+        "  <nul set /p \"=Remove directory: ${dir} \""
+        "  if EXIST \"${dir}\" ("
+        "    rmdir /Q \"${dir}\" 2>nul && echo - ok || echo - skipped ^(non-empty?^)"
+        "  ) ELSE echo - skipped: not present"
+        ") && (")
+      string(REPLACE ";" "\n" rmdir "${rmdir_lines}")
+      append_line("${rmdir}")
+    else()
+      append_line("__rmdir '${native}'")
+    endif()
 endfunction()
 
 set(script_self "${install_prefix}/${UNINSTALL_SCRIPT_SELF}")
@@ -296,4 +267,10 @@ foreach(dir IN LISTS dirs_to_remove)
     add_rmdir("${relpath}")
 endforeach()
 
+# Allow the batch script delete itself without error.
+if(WIN32)
+    append_line("  ver>nul")
+    append_line(")")
+endif()
+
 message(STATUS "Generated uninstaller: ${UNINSTALL_WRITE_FILE}")
diff -pruN 2.0.2-1/build/cmake/VerifyHeaders.cmake 2.1.0-1/build/cmake/VerifyHeaders.cmake
--- 2.0.2-1/build/cmake/VerifyHeaders.cmake	1970-01-01 00:00:00.000000000 +0000
+++ 2.1.0-1/build/cmake/VerifyHeaders.cmake	2025-08-14 18:37:23.000000000 +0000
@@ -0,0 +1,116 @@
+include_guard(DIRECTORY)
+
+#[==[
+Add header verification targets for given headers:
+
+    mongo_verify_headers(
+        <tag>
+        [USES_LIBRARIES [<library> ...]]
+        [HEADERS [<glob> ...]]
+        [EXCLUDE_REGEX [<pattern> ...]]
+    )
+
+Here `<tag>` is an arbitrary string that is used to qualify the internal target
+created for the verification. The `<glob>` expressions are used to automatically
+collect sources files (relative to the current source directory). All files
+collected by `<glob>` must live within the current source directory.
+
+After collecting sources according to the `<glob>` patterns, sources are
+excluded if the filepath contains any substring that matches any regular
+expression in the `<pattern>` list. Each `<pattern>` is tested against the
+relative path to the header file that was found by `<glob>`, and not the
+absolute path to the file.
+
+The header verification targets are compiled according to the usage requirements
+from all `<library>` arguments.
+]==]
+function(mongo_verify_headers tag)
+    list(APPEND CMAKE_MESSAGE_CONTEXT "${CMAKE_CURRENT_FUNCTION}(${tag})")
+    cmake_parse_arguments(
+        PARSE_ARGV 1 arg
+        ""  # No flags
+        ""  # No args
+        "HEADERS;EXCLUDE_REGEX;USE_LIBRARIES"  # List args
+    )
+    if(arg_UNPARSED_ARGUMENTS)
+        message(FATAL_ERROR "Unknown arguments: ${arg_UNPARSED_ARGUMENTS}")
+    endif()
+
+    # Collect headers according to our patterns
+    set(headers_to_verify)
+    foreach(pattern IN LISTS arg_HEADERS)
+        # Use a recursive glob from the current source dir:
+        file(GLOB_RECURSE more
+            # Make the paths relative to the calling dir to prevent parent paths
+            # from interfering with the exclusion regex logic below
+            RELATIVE "${CMAKE_CURRENT_SOURCE_DIR}"
+            # We need to re-run configuration if any files are added/removed
+            CONFIGURE_DEPENDS
+            "${pattern}"
+            )
+        # Warn if this pattern didn't match anything. It is probably a mistake
+        # in the caller's argument list.
+        if(NOT more)
+            message(WARNING "Globbing pattern “${pattern}” did not match any files")
+        endif()
+        list(APPEND headers_to_verify ${more})
+    endforeach()
+
+    # Exclude anything that matches any exclusion regex
+    foreach(pattern IN LISTS arg_EXCLUDE_REGEX)
+        list(FILTER headers_to_verify EXCLUDE REGEX "${pattern}")
+    endforeach()
+
+    # Drop duplicates since globs may grab a file more than once
+    list(REMOVE_DUPLICATES headers_to_verify)
+    list(SORT headers_to_verify)
+    foreach(file IN LISTS headers_to_verify)
+        message(DEBUG "Verify header file: ${file}")
+    endforeach()
+
+    # We create two targets: One for C and one for C++
+    # C target
+    set(c_target ${tag}-verify-headers-c)
+    message(DEBUG "Defining header verification target “${c_target}” (C)")
+    # Create object libraries. They will only have one empty compiled source file.
+    # The source file language will tell CMake how to verify the associated header files.
+    add_library(${c_target} OBJECT "${CMAKE_CURRENT_FUNCTION_LIST_DIR}/empty.c")
+    # Define the file set
+    target_sources(${c_target} PUBLIC FILE_SET HEADERS)
+    # Conditionally do the same thing for C++
+    if(CMAKE_CXX_COMPILER)
+        # C++ is available. define it
+        set(cxx_target ${tag}-verify-headers-cxx)
+        message(DEBUG "Defining header verification targets “${cxx_target}” (C++)")
+        add_library(${cxx_target} OBJECT "${CMAKE_CURRENT_FUNCTION_LIST_DIR}/empty.cpp")
+        target_sources(${cxx_target} PUBLIC FILE_SET HEADERS)
+    else()
+        message(AUTHOR_WARNING "No C++ compiler is available, so the header-check C++ targets won't be defined")
+        unset(cxx_target)
+    endif()
+    # Populate the properties and file sets.
+    set_target_properties(${c_target} ${cxx_target} PROPERTIES
+        # The main header file set:
+        HEADER_SET "${headers_to_verify}"
+        # Enable header verification:
+        VERIFY_INTERFACE_HEADER_SETS TRUE
+        # Add the usage requirements that propagate to the generated compilation rules:
+        INTERFACE_LINK_LIBRARIES "${arg_USE_LIBRARIES}"
+        )
+endfunction()
+
+#[[
+Variable set to TRUE if-and-only-if CMake supports header verification.
+]]
+set(MONGO_CAN_VERIFY_HEADERS FALSE)
+if(CMAKE_VERSION VERSION_GREATER_EQUAL "3.24")
+    set(MONGO_CAN_VERIFY_HEADERS TRUE)
+endif()
+
+# Try to enable C++, but don't require it. This will be used to conditionally
+# define the C++ header-check tests
+include(CheckLanguage)
+check_language(CXX)
+if(CMAKE_CXX_COMPILER)
+    enable_language(CXX)
+endif()
diff -pruN 2.0.2-1/build/cmake/empty.c 2.1.0-1/build/cmake/empty.c
--- 2.0.2-1/build/cmake/empty.c	1970-01-01 00:00:00.000000000 +0000
+++ 2.1.0-1/build/cmake/empty.c	2025-08-14 18:37:23.000000000 +0000
@@ -0,0 +1,3 @@
+/* This is an empty placeholder file used for miscellaneous build system tasks
+ */
+#include <stddef.h>
diff -pruN 2.0.2-1/build/cmake/empty.cpp 2.1.0-1/build/cmake/empty.cpp
--- 2.0.2-1/build/cmake/empty.cpp	1970-01-01 00:00:00.000000000 +0000
+++ 2.1.0-1/build/cmake/empty.cpp	2025-08-14 18:37:23.000000000 +0000
@@ -0,0 +1,2 @@
+// This is an empty placeholder file used for miscellaneous build system tasks
+#include <cstddef>
diff -pruN 2.0.2-1/build/sphinx/mongoc_common.py 2.1.0-1/build/sphinx/mongoc_common.py
--- 2.0.2-1/build/sphinx/mongoc_common.py	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/build/sphinx/mongoc_common.py	2025-08-14 18:37:23.000000000 +0000
@@ -8,6 +8,7 @@ from docutils.nodes import Node, documen
 
 from sphinx.application import Sphinx
 from sphinx.application import logger as sphinx_log
+
 try:
     from sphinx.builders.dirhtml import DirectoryHTMLBuilder
 except ImportError:
@@ -16,7 +17,8 @@ except ImportError:
 from sphinx.config import Config
 from docutils.parsers.rst import Directive
 
-needs_sphinx = "1.7" # Do not require newer sphinx. EPEL packages build man pages with Sphinx 1.7.6. Refer: CDRIVER-4767
+# Do not require newer sphinx. EPEL packages build man pages with Sphinx 1.7.6. Refer: CDRIVER-4767
+needs_sphinx = "1.7"
 author = "MongoDB, Inc"
 
 # -- Options for HTML output ----------------------------------------------
@@ -38,7 +40,8 @@ def _file_man_page_name(fpath: Path) ->
             continue
         return mat[1]
 
-def _collect_man (app: Sphinx):
+
+def _collect_man(app: Sphinx):
     # Note: 'app' is partially-formed, as this is called from the Sphinx.__init__
     docdir = Path(app.srcdir)
     # Find everything:
@@ -61,6 +64,7 @@ def _collect_man (app: Sphinx):
         assert docname, filepath
         man_pages.append((docname, man_name, "", [author], 3))
 
+
 # -- Options for manual page output ---------------------------------------
 
 # NOTE: This starts empty, but we populate it in `setup` in _collect_man() (see above)
@@ -146,7 +150,7 @@ def generate_html_redirs(app: Sphinx, pa
         return
     if page == "index" or page.endswith(".index"):
         return
-    path = app.project.doc2path(page, absolute=True)
+    path = app.project.doc2path(page, True)
     out_index_html = Path(builder.get_outfilename(page))
     slug = out_index_html.parent.name
     redirect_file = out_index_html.parent.parent / f"{slug}.html"
@@ -158,13 +162,17 @@ def generate_html_redirs(app: Sphinx, pa
         f"redirect-for-{page}",
         {"target": page, "writing-redirect": 1},
         str(Path(__file__).parent.resolve() / "redirect.t.html"),
-        str(redirect_file),
+        # Note: In Sphinx 8.2, this argument changed from `str` to `Path`, but
+        # continues to work with `str`. A future version might need this changed
+        # to pass a `Path`, but we can keep `str` for now.
+        outfilename=str(redirect_file),  # type: ignore
     )
     # Restore prior state:
     builder.script_files[:] = prev_scripts
     builder.css_files[:] = prev_css
     sphinx_log.debug("Wrote redirect: %r -> %r", path, page)
 
+
 def mongoc_common_setup(app: Sphinx):
     _collect_man(app)
     app.connect("html-page-context", generate_html_redirs)
diff -pruN 2.0.2-1/debian/changelog 2.1.0-1/debian/changelog
--- 2.0.2-1/debian/changelog	2025-06-17 21:04:34.000000000 +0000
+++ 2.1.0-1/debian/changelog	2025-08-14 18:53:54.000000000 +0000
@@ -1,3 +1,10 @@
+mongo-c-driver (2.1.0-1) unstable; urgency=medium
+
+  * New upstream release
+  * libmongoc-dev.install: include the static library
+
+ -- Roberto C. Sanchez <roberto@connexer.com>  Thu, 14 Aug 2025 14:53:54 -0400
+
 mongo-c-driver (2.0.2-1) experimental; urgency=medium
 
   * New upstream release
diff -pruN 2.0.2-1/debian/libmongoc-dev.install 2.1.0-1/debian/libmongoc-dev.install
--- 2.0.2-1/debian/libmongoc-dev.install	2025-06-17 21:04:34.000000000 +0000
+++ 2.1.0-1/debian/libmongoc-dev.install	2025-08-14 18:53:54.000000000 +0000
@@ -1,4 +1,5 @@
 usr/include/mongoc*
+usr/lib/*/libmongoc*.a
 usr/lib/*/libmongoc*.so
 usr/lib/*/pkgconfig/mongoc*
 usr/lib/*/cmake/mongoc*
diff -pruN 2.0.2-1/docs/dev/Makefile 2.1.0-1/docs/dev/Makefile
--- 2.0.2-1/docs/dev/Makefile	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/docs/dev/Makefile	2025-08-14 18:37:23.000000000 +0000
@@ -7,26 +7,16 @@ default: html
 THIS_FILE := $(realpath $(lastword $(MAKEFILE_LIST)))
 THIS_DIR := $(shell dirname $(THIS_FILE))
 MONGOC_DIR := $(shell dirname $(shell dirname $(THIS_DIR)))
-TOOLS_DIR := $(MONGOC_DIR)/tools
-
-
-POETRY := bash $(TOOLS_DIR)/poetry.sh -C $(MONGOC_DIR)
 
 BUILD_DIR := $(MONGOC_DIR)/_build
-_poetry_stamp := $(BUILD_DIR)/.poetry-install.stamp
-poetry-install: $(_poetry_stamp)
-$(_poetry_stamp): $(MONGOC_DIR)/poetry.lock $(MONGOC_DIR)/pyproject.toml
-	$(POETRY) install --with=dev,docs
-	mkdir -p $(BUILD_DIR)
-	touch $@
 
 SPHINX_JOBS ?= auto
 SPHINX_ARGS := -W -n -j "$(SPHINX_JOBS)" -a -b dirhtml
 
 DOCS_SRC := $(THIS_DIR)
 DOCS_OUT := $(BUILD_DIR)/docs/dev/html
-html: poetry-install
-	$(POETRY) run sphinx-build $(SPHINX_ARGS) $(DOCS_SRC) $(DOCS_OUT)
+html:
+	uv run --frozen sphinx-build $(SPHINX_ARGS) $(DOCS_SRC) $(DOCS_OUT)
 
-serve: poetry-install
-	$(POETRY) run sphinx-autobuild $(SPHINX_ARGS) $(DOCS_SRC) $(DOCS_OUT)
+serve:
+	uv run --frozen --with sphinx-autobuild sphinx-autobuild $(SPHINX_ARGS) $(DOCS_SRC) $(DOCS_OUT)
diff -pruN 2.0.2-1/docs/dev/debian.rst 2.1.0-1/docs/dev/debian.rst
--- 2.0.2-1/docs/dev/debian.rst	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/docs/dev/debian.rst	2025-08-14 18:37:23.000000000 +0000
@@ -31,15 +31,15 @@ To publish a new release Debian package,
 
 .. code-block:: console
 
-   $ git merge --no-commit --no-ff 1.xx.y       # may result in conflicts
+   $ git merge --no-commit --no-ff 2.x.y        # may result in conflicts
    $ git checkout HEAD -- debian                # ensures debian/ dir is preserved
    $ git add .                                  # prepare to resolve conflicts
-   $ git checkout --no-overlay 1.xx.y -- . ':!debian'   # resolve conflicts
+   $ git checkout --no-overlay 2.x.y -- . ':!debian'   # resolve conflicts
    $ git add .
    $ git commit
 
 3. Verify that there are no extraneous differences from the release tag,
-   ``git diff 1.xx.y..HEAD --stat -- . ':!debian'``; the command should produce
+   ``git diff 2.x.y..HEAD --stat -- . ':!debian'``; the command should produce
    no output, and if any output is shown then that indicates differences in
    files outside the ``debian/`` directory.
 4. If there were any files outside the ``debian/`` directory listed in the last
diff -pruN 2.0.2-1/docs/dev/earthly.rst 2.1.0-1/docs/dev/earthly.rst
--- 2.0.2-1/docs/dev/earthly.rst	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/docs/dev/earthly.rst	2025-08-14 18:37:23.000000000 +0000
@@ -149,8 +149,8 @@ enumerated using ``earthly ls`` or ``ear
 .. earthly-target:: +sign-file
 
    Signs a file using Garasign. Use of this target requires authenticating
-   against the MongoDB Artifactory installation! (Refer to:
-   `earthly.artifactory-auth`)
+   against the DevProd-provided Amazon ECR instance! (Refer to:
+   `earthly.amazon-ecr`)
 
    .. earthly-artifact:: +sign-file/signature.asc
 
@@ -175,23 +175,36 @@ enumerated using ``earthly ls`` or ``ear
 
       .. seealso:: `earthly.secrets`
 
-   .. _earthly.artifactory-auth:
+   .. _earthly.amazon-ecr:
 
-   Authenticating with Artifactory
-   ===============================
+   Authenticating with Amazon ECR
+   ==============================
 
    In order to run `+sign-file` or any target that depends upon it, the
    container engine client\ [#oci]_ will need to be authenticated with the
-   MongoDB Artifactory instance.
+   DevProd-provided Amazon ECR instance using AWS CLI v2::
 
-   Authenticating can be done using the container engine's command-line
-   interface. For example, with Podman::
+      # Forward the short-term AWS credentials to the container engine client.
+      $ aws ecr get-login-password --profile <profile> | podman login --username AWS --password-stdin 901841024863.dkr.ecr.us-east-1.amazonaws.com
 
-      $ podman login "artifactory.corp.mongodb.com"
+   Configure the AWS profile using ``aws configure sso`` or modifying the
+   ``$HOME/.aws/config`` file such that:
 
-   Which will prompt you for a username and password if you are not already
-   authenticated with the host.\ [#creds]_ If you are already authenticated, this
-   command will have no effect.
+   - The SSO start URL is ``https://d-9067613a84.awsapps.com/start#/``.
+   - The SSO and client region are ``us-east-1``.
+   - The SSO registration scope is ``sso:account:access`` (default).
+   - The SSO account ID is ``901841024863`` (aka ``devprod-platforms-ecr``).
+   - The SSO role name is ``ECRScopedAccess`` (default).
+
+   To refresh short-term credentials when they have expired, run
+   ``aws sso login --profile <profile>`` followed by the same
+   ``aws ecr get-login-password ... | podman login ...`` command described
+   above.
+
+   .. seealso:: `"DevProd Platforms Container Registry"
+      <https://docs.devprod.prod.corp.mongodb.com/devprod-platforms-ecr>`_ and
+      `"Configuring IAM Identity Center authentication with the AWS CLI"
+      <https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sso.html>`_.
 
 .. earthly-target:: +sbom-generate
 
@@ -284,6 +297,21 @@ enumerated using ``earthly ls`` or ``ear
       See: `SNYK_TOKEN`
 
 
+.. program:: +verify-headers
+.. earthly-target:: +verify-headers
+
+   This runs `CMake's header verification`__ on the library sources, to ensure
+   that the public API headers can be ``#include``\ 'd directly in a C++
+   compiler.
+
+   __ https://cmake.org/cmake/help/latest/prop_tgt/VERIFY_INTERFACE_HEADER_SETS.html
+
+   This target does not produce any output artifacts. This only checks that our
+   public API headers are valid. This checks against a variety of environments
+   to test that we are including the necessary standard library headers in our
+   public API headers.
+
+
 .. _earthly.secrets:
 
 Setting Earthly Secrets
diff -pruN 2.0.2-1/docs/dev/releasing.rst 2.1.0-1/docs/dev/releasing.rst
--- 2.0.2-1/docs/dev/releasing.rst	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/docs/dev/releasing.rst	2025-08-14 18:37:23.000000000 +0000
@@ -17,6 +17,8 @@ MongoDB C driver library. The release in
 .. _evg-release: https://spruce.mongodb.com/commits/mongo-c-driver-latest-release
 .. _evg-release-settings: https://spruce.mongodb.com/project/mongo-c-driver-latest-release/settings/general
 .. _snyk: https://app.snyk.io
+.. _dbx-c-cxx-releases-github: https://github.com/orgs/mongodb/teams/dbx-c-cxx-releases/
+.. _dbx-c-cxx-releases-mana: https://mana.corp.mongodb.com/resources/68029673d39aa9f7de6399f9
 
 .. rubric:: Checklist Form
 
@@ -250,6 +252,20 @@ __ https://github.com/settings/tokens
       (Selecting this permission may also enable the *Metadata* permission; this is
       normal.)
 
+Join the Release Team
+#####################
+
+The release process may require creating new branches, new tags, and directly
+pushing to development branches. These operations are normally restricted by
+branch protection rules.
+
+When assigned the responsibility of performing a release, submit a request to a
+repository administrator to be temporarily added to the
+`releases team <dbx-c-cxx-releases-github_>`_ on GitHub for the duration of the
+release process. The team member must be added via
+`MANA <dbx-c-cxx-releases-mana_>`_ (the GitHub team should normally be empty,
+meaning there should not be any member with the "Maintainer" role to add new
+users via GitHub).
 
 Do the Release
 ##############
@@ -380,7 +396,7 @@ Specifically, it is generated using the
 running :any:`+signed-release`, one will need to set up some environment that is
 required for it to succeed:
 
-1. :ref:`Authenticate with Artifactory <earthly.artifactory-auth>`
+1. :ref:`Authenticate with the DevProd-provided Amazon ECR instance <earthly.amazon-ecr>`
 2. Set the Earthly secrets required for the :any:`+sign-file` target.
 3. Download an augmented SBOM from a recent execution of the ``sbom`` task in
    an Evergreen patch or commit build and save it to ``etc/augmented-sbom.json``.
@@ -486,6 +502,13 @@ changes back into the ``master`` branch.
 __ https://github.com/mongodb/mongo-c-driver/pulls
 
 
+Leave the Release Team
+**********************
+
+Remove yourself from the `releases team <dbx-c-cxx-releases-github_>`_ on GitHub
+via `MANA <dbx-c-cxx-releases-mana_>`_.
+
+
 .. _releasing.jira:
 
 Close the Jira Release Ticket and Finish the Jira Release
diff -pruN 2.0.2-1/etc/prior_version.txt 2.1.0-1/etc/prior_version.txt
--- 2.0.2-1/etc/prior_version.txt	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/etc/prior_version.txt	2025-08-14 18:37:23.000000000 +0000
@@ -1 +1 @@
-2.0.1
\ No newline at end of file
+2.0.0
diff -pruN 2.0.2-1/poetry.lock 2.1.0-1/poetry.lock
--- 2.0.2-1/poetry.lock	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/poetry.lock	1970-01-01 00:00:00.000000000 +0000
@@ -1,922 +0,0 @@
-# This file is automatically @generated by Poetry 1.8.2 and should not be changed by hand.
-
-[[package]]
-name = "alabaster"
-version = "0.7.13"
-description = "A configurable sidebar-enabled Sphinx theme"
-optional = false
-python-versions = ">=3.6"
-files = [
-    {file = "alabaster-0.7.13-py3-none-any.whl", hash = "sha256:1ee19aca801bbabb5ba3f5f258e4422dfa86f82f3e9cefb0859b283cdd7f62a3"},
-    {file = "alabaster-0.7.13.tar.gz", hash = "sha256:a27a4a084d5e690e16e01e03ad2b2e552c61a65469419b907243193de1a84ae2"},
-]
-
-[[package]]
-name = "babel"
-version = "2.16.0"
-description = "Internationalization utilities"
-optional = false
-python-versions = ">=3.8"
-files = [
-    {file = "babel-2.16.0-py3-none-any.whl", hash = "sha256:368b5b98b37c06b7daf6696391c3240c938b37767d4584413e8438c5c435fa8b"},
-    {file = "babel-2.16.0.tar.gz", hash = "sha256:d1f3554ca26605fe173f3de0c65f750f5a42f924499bf134de6423582298e316"},
-]
-
-[package.dependencies]
-pytz = {version = ">=2015.7", markers = "python_version < \"3.9\""}
-
-[package.extras]
-dev = ["freezegun (>=1.0,<2.0)", "pytest (>=6.0)", "pytest-cov"]
-
-[[package]]
-name = "beautifulsoup4"
-version = "4.12.3"
-description = "Screen-scraping library"
-optional = false
-python-versions = ">=3.6.0"
-files = [
-    {file = "beautifulsoup4-4.12.3-py3-none-any.whl", hash = "sha256:b80878c9f40111313e55da8ba20bdba06d8fa3969fc68304167741bbf9e082ed"},
-    {file = "beautifulsoup4-4.12.3.tar.gz", hash = "sha256:74e3d1928edc070d21748185c46e3fb33490f22f52a3addee9aee0f4f7781051"},
-]
-
-[package.dependencies]
-soupsieve = ">1.2"
-
-[package.extras]
-cchardet = ["cchardet"]
-chardet = ["chardet"]
-charset-normalizer = ["charset-normalizer"]
-html5lib = ["html5lib"]
-lxml = ["lxml"]
-
-[[package]]
-name = "certifi"
-version = "2024.8.30"
-description = "Python package for providing Mozilla's CA Bundle."
-optional = false
-python-versions = ">=3.6"
-files = [
-    {file = "certifi-2024.8.30-py3-none-any.whl", hash = "sha256:922820b53db7a7257ffbda3f597266d435245903d80737e34f8a45ff3e3230d8"},
-    {file = "certifi-2024.8.30.tar.gz", hash = "sha256:bec941d2aa8195e248a60b31ff9f0558284cf01a52591ceda73ea9afffd69fd9"},
-]
-
-[[package]]
-name = "charset-normalizer"
-version = "3.4.0"
-description = "The Real First Universal Charset Detector. Open, modern and actively maintained alternative to Chardet."
-optional = false
-python-versions = ">=3.7.0"
-files = [
-    {file = "charset_normalizer-3.4.0-cp310-cp310-macosx_10_9_universal2.whl", hash = "sha256:4f9fc98dad6c2eaa32fc3af1417d95b5e3d08aff968df0cd320066def971f9a6"},
-    {file = "charset_normalizer-3.4.0-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:0de7b687289d3c1b3e8660d0741874abe7888100efe14bd0f9fd7141bcbda92b"},
-    {file = "charset_normalizer-3.4.0-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:5ed2e36c3e9b4f21dd9422f6893dec0abf2cca553af509b10cd630f878d3eb99"},
-    {file = "charset_normalizer-3.4.0-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:40d3ff7fc90b98c637bda91c89d51264a3dcf210cade3a2c6f838c7268d7a4ca"},
-    {file = "charset_normalizer-3.4.0-cp310-cp310-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:1110e22af8ca26b90bd6364fe4c763329b0ebf1ee213ba32b68c73de5752323d"},
-    {file = "charset_normalizer-3.4.0-cp310-cp310-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:86f4e8cca779080f66ff4f191a685ced73d2f72d50216f7112185dc02b90b9b7"},
-    {file = "charset_normalizer-3.4.0-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:7f683ddc7eedd742e2889d2bfb96d69573fde1d92fcb811979cdb7165bb9c7d3"},
-    {file = "charset_normalizer-3.4.0-cp310-cp310-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:27623ba66c183eca01bf9ff833875b459cad267aeeb044477fedac35e19ba907"},
-    {file = "charset_normalizer-3.4.0-cp310-cp310-musllinux_1_2_aarch64.whl", hash = "sha256:f606a1881d2663630ea5b8ce2efe2111740df4b687bd78b34a8131baa007f79b"},
-    {file = "charset_normalizer-3.4.0-cp310-cp310-musllinux_1_2_i686.whl", hash = "sha256:0b309d1747110feb25d7ed6b01afdec269c647d382c857ef4663bbe6ad95a912"},
-    {file = "charset_normalizer-3.4.0-cp310-cp310-musllinux_1_2_ppc64le.whl", hash = "sha256:136815f06a3ae311fae551c3df1f998a1ebd01ddd424aa5603a4336997629e95"},
-    {file = "charset_normalizer-3.4.0-cp310-cp310-musllinux_1_2_s390x.whl", hash = "sha256:14215b71a762336254351b00ec720a8e85cada43b987da5a042e4ce3e82bd68e"},
-    {file = "charset_normalizer-3.4.0-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:79983512b108e4a164b9c8d34de3992f76d48cadc9554c9e60b43f308988aabe"},
-    {file = "charset_normalizer-3.4.0-cp310-cp310-win32.whl", hash = "sha256:c94057af19bc953643a33581844649a7fdab902624d2eb739738a30e2b3e60fc"},
-    {file = "charset_normalizer-3.4.0-cp310-cp310-win_amd64.whl", hash = "sha256:55f56e2ebd4e3bc50442fbc0888c9d8c94e4e06a933804e2af3e89e2f9c1c749"},
-    {file = "charset_normalizer-3.4.0-cp311-cp311-macosx_10_9_universal2.whl", hash = "sha256:0d99dd8ff461990f12d6e42c7347fd9ab2532fb70e9621ba520f9e8637161d7c"},
-    {file = "charset_normalizer-3.4.0-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:c57516e58fd17d03ebe67e181a4e4e2ccab1168f8c2976c6a334d4f819fe5944"},
-    {file = "charset_normalizer-3.4.0-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:6dba5d19c4dfab08e58d5b36304b3f92f3bd5d42c1a3fa37b5ba5cdf6dfcbcee"},
-    {file = "charset_normalizer-3.4.0-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:bf4475b82be41b07cc5e5ff94810e6a01f276e37c2d55571e3fe175e467a1a1c"},
-    {file = "charset_normalizer-3.4.0-cp311-cp311-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:ce031db0408e487fd2775d745ce30a7cd2923667cf3b69d48d219f1d8f5ddeb6"},
-    {file = "charset_normalizer-3.4.0-cp311-cp311-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:8ff4e7cdfdb1ab5698e675ca622e72d58a6fa2a8aa58195de0c0061288e6e3ea"},
-    {file = "charset_normalizer-3.4.0-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:3710a9751938947e6327ea9f3ea6332a09bf0ba0c09cae9cb1f250bd1f1549bc"},
-    {file = "charset_normalizer-3.4.0-cp311-cp311-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:82357d85de703176b5587dbe6ade8ff67f9f69a41c0733cf2425378b49954de5"},
-    {file = "charset_normalizer-3.4.0-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:47334db71978b23ebcf3c0f9f5ee98b8d65992b65c9c4f2d34c2eaf5bcaf0594"},
-    {file = "charset_normalizer-3.4.0-cp311-cp311-musllinux_1_2_i686.whl", hash = "sha256:8ce7fd6767a1cc5a92a639b391891bf1c268b03ec7e021c7d6d902285259685c"},
-    {file = "charset_normalizer-3.4.0-cp311-cp311-musllinux_1_2_ppc64le.whl", hash = "sha256:f1a2f519ae173b5b6a2c9d5fa3116ce16e48b3462c8b96dfdded11055e3d6365"},
-    {file = "charset_normalizer-3.4.0-cp311-cp311-musllinux_1_2_s390x.whl", hash = "sha256:63bc5c4ae26e4bc6be6469943b8253c0fd4e4186c43ad46e713ea61a0ba49129"},
-    {file = "charset_normalizer-3.4.0-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:bcb4f8ea87d03bc51ad04add8ceaf9b0f085ac045ab4d74e73bbc2dc033f0236"},
-    {file = "charset_normalizer-3.4.0-cp311-cp311-win32.whl", hash = "sha256:9ae4ef0b3f6b41bad6366fb0ea4fc1d7ed051528e113a60fa2a65a9abb5b1d99"},
-    {file = "charset_normalizer-3.4.0-cp311-cp311-win_amd64.whl", hash = "sha256:cee4373f4d3ad28f1ab6290684d8e2ebdb9e7a1b74fdc39e4c211995f77bec27"},
-    {file = "charset_normalizer-3.4.0-cp312-cp312-macosx_10_13_universal2.whl", hash = "sha256:0713f3adb9d03d49d365b70b84775d0a0d18e4ab08d12bc46baa6132ba78aaf6"},
-    {file = "charset_normalizer-3.4.0-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:de7376c29d95d6719048c194a9cf1a1b0393fbe8488a22008610b0361d834ecf"},
-    {file = "charset_normalizer-3.4.0-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:4a51b48f42d9358460b78725283f04bddaf44a9358197b889657deba38f329db"},
-    {file = "charset_normalizer-3.4.0-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:b295729485b06c1a0683af02a9e42d2caa9db04a373dc38a6a58cdd1e8abddf1"},
-    {file = "charset_normalizer-3.4.0-cp312-cp312-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:ee803480535c44e7f5ad00788526da7d85525cfefaf8acf8ab9a310000be4b03"},
-    {file = "charset_normalizer-3.4.0-cp312-cp312-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:3d59d125ffbd6d552765510e3f31ed75ebac2c7470c7274195b9161a32350284"},
-    {file = "charset_normalizer-3.4.0-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:8cda06946eac330cbe6598f77bb54e690b4ca93f593dee1568ad22b04f347c15"},
-    {file = "charset_normalizer-3.4.0-cp312-cp312-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:07afec21bbbbf8a5cc3651aa96b980afe2526e7f048fdfb7f1014d84acc8b6d8"},
-    {file = "charset_normalizer-3.4.0-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:6b40e8d38afe634559e398cc32b1472f376a4099c75fe6299ae607e404c033b2"},
-    {file = "charset_normalizer-3.4.0-cp312-cp312-musllinux_1_2_i686.whl", hash = "sha256:b8dcd239c743aa2f9c22ce674a145e0a25cb1566c495928440a181ca1ccf6719"},
-    {file = "charset_normalizer-3.4.0-cp312-cp312-musllinux_1_2_ppc64le.whl", hash = "sha256:84450ba661fb96e9fd67629b93d2941c871ca86fc38d835d19d4225ff946a631"},
-    {file = "charset_normalizer-3.4.0-cp312-cp312-musllinux_1_2_s390x.whl", hash = "sha256:44aeb140295a2f0659e113b31cfe92c9061622cadbc9e2a2f7b8ef6b1e29ef4b"},
-    {file = "charset_normalizer-3.4.0-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:1db4e7fefefd0f548d73e2e2e041f9df5c59e178b4c72fbac4cc6f535cfb1565"},
-    {file = "charset_normalizer-3.4.0-cp312-cp312-win32.whl", hash = "sha256:5726cf76c982532c1863fb64d8c6dd0e4c90b6ece9feb06c9f202417a31f7dd7"},
-    {file = "charset_normalizer-3.4.0-cp312-cp312-win_amd64.whl", hash = "sha256:b197e7094f232959f8f20541ead1d9862ac5ebea1d58e9849c1bf979255dfac9"},
-    {file = "charset_normalizer-3.4.0-cp313-cp313-macosx_10_13_universal2.whl", hash = "sha256:dd4eda173a9fcccb5f2e2bd2a9f423d180194b1bf17cf59e3269899235b2a114"},
-    {file = "charset_normalizer-3.4.0-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:e9e3c4c9e1ed40ea53acf11e2a386383c3304212c965773704e4603d589343ed"},
-    {file = "charset_normalizer-3.4.0-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:92a7e36b000bf022ef3dbb9c46bfe2d52c047d5e3f3343f43204263c5addc250"},
-    {file = "charset_normalizer-3.4.0-cp313-cp313-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:54b6a92d009cbe2fb11054ba694bc9e284dad30a26757b1e372a1fdddaf21920"},
-    {file = "charset_normalizer-3.4.0-cp313-cp313-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:1ffd9493de4c922f2a38c2bf62b831dcec90ac673ed1ca182fe11b4d8e9f2a64"},
-    {file = "charset_normalizer-3.4.0-cp313-cp313-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:35c404d74c2926d0287fbd63ed5d27eb911eb9e4a3bb2c6d294f3cfd4a9e0c23"},
-    {file = "charset_normalizer-3.4.0-cp313-cp313-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:4796efc4faf6b53a18e3d46343535caed491776a22af773f366534056c4e1fbc"},
-    {file = "charset_normalizer-3.4.0-cp313-cp313-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:e7fdd52961feb4c96507aa649550ec2a0d527c086d284749b2f582f2d40a2e0d"},
-    {file = "charset_normalizer-3.4.0-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:92db3c28b5b2a273346bebb24857fda45601aef6ae1c011c0a997106581e8a88"},
-    {file = "charset_normalizer-3.4.0-cp313-cp313-musllinux_1_2_i686.whl", hash = "sha256:ab973df98fc99ab39080bfb0eb3a925181454d7c3ac8a1e695fddfae696d9e90"},
-    {file = "charset_normalizer-3.4.0-cp313-cp313-musllinux_1_2_ppc64le.whl", hash = "sha256:4b67fdab07fdd3c10bb21edab3cbfe8cf5696f453afce75d815d9d7223fbe88b"},
-    {file = "charset_normalizer-3.4.0-cp313-cp313-musllinux_1_2_s390x.whl", hash = "sha256:aa41e526a5d4a9dfcfbab0716c7e8a1b215abd3f3df5a45cf18a12721d31cb5d"},
-    {file = "charset_normalizer-3.4.0-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:ffc519621dce0c767e96b9c53f09c5d215578e10b02c285809f76509a3931482"},
-    {file = "charset_normalizer-3.4.0-cp313-cp313-win32.whl", hash = "sha256:f19c1585933c82098c2a520f8ec1227f20e339e33aca8fa6f956f6691b784e67"},
-    {file = "charset_normalizer-3.4.0-cp313-cp313-win_amd64.whl", hash = "sha256:707b82d19e65c9bd28b81dde95249b07bf9f5b90ebe1ef17d9b57473f8a64b7b"},
-    {file = "charset_normalizer-3.4.0-cp37-cp37m-macosx_10_9_x86_64.whl", hash = "sha256:dbe03226baf438ac4fda9e2d0715022fd579cb641c4cf639fa40d53b2fe6f3e2"},
-    {file = "charset_normalizer-3.4.0-cp37-cp37m-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:dd9a8bd8900e65504a305bf8ae6fa9fbc66de94178c420791d0293702fce2df7"},
-    {file = "charset_normalizer-3.4.0-cp37-cp37m-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:b8831399554b92b72af5932cdbbd4ddc55c55f631bb13ff8fe4e6536a06c5c51"},
-    {file = "charset_normalizer-3.4.0-cp37-cp37m-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:a14969b8691f7998e74663b77b4c36c0337cb1df552da83d5c9004a93afdb574"},
-    {file = "charset_normalizer-3.4.0-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:dcaf7c1524c0542ee2fc82cc8ec337f7a9f7edee2532421ab200d2b920fc97cf"},
-    {file = "charset_normalizer-3.4.0-cp37-cp37m-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:425c5f215d0eecee9a56cdb703203dda90423247421bf0d67125add85d0c4455"},
-    {file = "charset_normalizer-3.4.0-cp37-cp37m-musllinux_1_2_aarch64.whl", hash = "sha256:d5b054862739d276e09928de37c79ddeec42a6e1bfc55863be96a36ba22926f6"},
-    {file = "charset_normalizer-3.4.0-cp37-cp37m-musllinux_1_2_i686.whl", hash = "sha256:f3e73a4255342d4eb26ef6df01e3962e73aa29baa3124a8e824c5d3364a65748"},
-    {file = "charset_normalizer-3.4.0-cp37-cp37m-musllinux_1_2_ppc64le.whl", hash = "sha256:2f6c34da58ea9c1a9515621f4d9ac379871a8f21168ba1b5e09d74250de5ad62"},
-    {file = "charset_normalizer-3.4.0-cp37-cp37m-musllinux_1_2_s390x.whl", hash = "sha256:f09cb5a7bbe1ecae6e87901a2eb23e0256bb524a79ccc53eb0b7629fbe7677c4"},
-    {file = "charset_normalizer-3.4.0-cp37-cp37m-musllinux_1_2_x86_64.whl", hash = "sha256:0099d79bdfcf5c1f0c2c72f91516702ebf8b0b8ddd8905f97a8aecf49712c621"},
-    {file = "charset_normalizer-3.4.0-cp37-cp37m-win32.whl", hash = "sha256:9c98230f5042f4945f957d006edccc2af1e03ed5e37ce7c373f00a5a4daa6149"},
-    {file = "charset_normalizer-3.4.0-cp37-cp37m-win_amd64.whl", hash = "sha256:62f60aebecfc7f4b82e3f639a7d1433a20ec32824db2199a11ad4f5e146ef5ee"},
-    {file = "charset_normalizer-3.4.0-cp38-cp38-macosx_10_9_universal2.whl", hash = "sha256:af73657b7a68211996527dbfeffbb0864e043d270580c5aef06dc4b659a4b578"},
-    {file = "charset_normalizer-3.4.0-cp38-cp38-macosx_10_9_x86_64.whl", hash = "sha256:cab5d0b79d987c67f3b9e9c53f54a61360422a5a0bc075f43cab5621d530c3b6"},
-    {file = "charset_normalizer-3.4.0-cp38-cp38-macosx_11_0_arm64.whl", hash = "sha256:9289fd5dddcf57bab41d044f1756550f9e7cf0c8e373b8cdf0ce8773dc4bd417"},
-    {file = "charset_normalizer-3.4.0-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:6b493a043635eb376e50eedf7818f2f322eabbaa974e948bd8bdd29eb7ef2a51"},
-    {file = "charset_normalizer-3.4.0-cp38-cp38-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:9fa2566ca27d67c86569e8c85297aaf413ffab85a8960500f12ea34ff98e4c41"},
-    {file = "charset_normalizer-3.4.0-cp38-cp38-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:a8e538f46104c815be19c975572d74afb53f29650ea2025bbfaef359d2de2f7f"},
-    {file = "charset_normalizer-3.4.0-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:6fd30dc99682dc2c603c2b315bded2799019cea829f8bf57dc6b61efde6611c8"},
-    {file = "charset_normalizer-3.4.0-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:2006769bd1640bdf4d5641c69a3d63b71b81445473cac5ded39740a226fa88ab"},
-    {file = "charset_normalizer-3.4.0-cp38-cp38-musllinux_1_2_aarch64.whl", hash = "sha256:dc15e99b2d8a656f8e666854404f1ba54765871104e50c8e9813af8a7db07f12"},
-    {file = "charset_normalizer-3.4.0-cp38-cp38-musllinux_1_2_i686.whl", hash = "sha256:ab2e5bef076f5a235c3774b4f4028a680432cded7cad37bba0fd90d64b187d19"},
-    {file = "charset_normalizer-3.4.0-cp38-cp38-musllinux_1_2_ppc64le.whl", hash = "sha256:4ec9dd88a5b71abfc74e9df5ebe7921c35cbb3b641181a531ca65cdb5e8e4dea"},
-    {file = "charset_normalizer-3.4.0-cp38-cp38-musllinux_1_2_s390x.whl", hash = "sha256:43193c5cda5d612f247172016c4bb71251c784d7a4d9314677186a838ad34858"},
-    {file = "charset_normalizer-3.4.0-cp38-cp38-musllinux_1_2_x86_64.whl", hash = "sha256:aa693779a8b50cd97570e5a0f343538a8dbd3e496fa5dcb87e29406ad0299654"},
-    {file = "charset_normalizer-3.4.0-cp38-cp38-win32.whl", hash = "sha256:7706f5850360ac01d80c89bcef1640683cc12ed87f42579dab6c5d3ed6888613"},
-    {file = "charset_normalizer-3.4.0-cp38-cp38-win_amd64.whl", hash = "sha256:c3e446d253bd88f6377260d07c895816ebf33ffffd56c1c792b13bff9c3e1ade"},
-    {file = "charset_normalizer-3.4.0-cp39-cp39-macosx_10_9_universal2.whl", hash = "sha256:980b4f289d1d90ca5efcf07958d3eb38ed9c0b7676bf2831a54d4f66f9c27dfa"},
-    {file = "charset_normalizer-3.4.0-cp39-cp39-macosx_10_9_x86_64.whl", hash = "sha256:f28f891ccd15c514a0981f3b9db9aa23d62fe1a99997512b0491d2ed323d229a"},
-    {file = "charset_normalizer-3.4.0-cp39-cp39-macosx_11_0_arm64.whl", hash = "sha256:a8aacce6e2e1edcb6ac625fb0f8c3a9570ccc7bfba1f63419b3769ccf6a00ed0"},
-    {file = "charset_normalizer-3.4.0-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:bd7af3717683bea4c87acd8c0d3d5b44d56120b26fd3f8a692bdd2d5260c620a"},
-    {file = "charset_normalizer-3.4.0-cp39-cp39-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:5ff2ed8194587faf56555927b3aa10e6fb69d931e33953943bc4f837dfee2242"},
-    {file = "charset_normalizer-3.4.0-cp39-cp39-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:e91f541a85298cf35433bf66f3fab2a4a2cff05c127eeca4af174f6d497f0d4b"},
-    {file = "charset_normalizer-3.4.0-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:309a7de0a0ff3040acaebb35ec45d18db4b28232f21998851cfa709eeff49d62"},
-    {file = "charset_normalizer-3.4.0-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:285e96d9d53422efc0d7a17c60e59f37fbf3dfa942073f666db4ac71e8d726d0"},
-    {file = "charset_normalizer-3.4.0-cp39-cp39-musllinux_1_2_aarch64.whl", hash = "sha256:5d447056e2ca60382d460a604b6302d8db69476fd2015c81e7c35417cfabe4cd"},
-    {file = "charset_normalizer-3.4.0-cp39-cp39-musllinux_1_2_i686.whl", hash = "sha256:20587d20f557fe189b7947d8e7ec5afa110ccf72a3128d61a2a387c3313f46be"},
-    {file = "charset_normalizer-3.4.0-cp39-cp39-musllinux_1_2_ppc64le.whl", hash = "sha256:130272c698667a982a5d0e626851ceff662565379baf0ff2cc58067b81d4f11d"},
-    {file = "charset_normalizer-3.4.0-cp39-cp39-musllinux_1_2_s390x.whl", hash = "sha256:ab22fbd9765e6954bc0bcff24c25ff71dcbfdb185fcdaca49e81bac68fe724d3"},
-    {file = "charset_normalizer-3.4.0-cp39-cp39-musllinux_1_2_x86_64.whl", hash = "sha256:7782afc9b6b42200f7362858f9e73b1f8316afb276d316336c0ec3bd73312742"},
-    {file = "charset_normalizer-3.4.0-cp39-cp39-win32.whl", hash = "sha256:2de62e8801ddfff069cd5c504ce3bc9672b23266597d4e4f50eda28846c322f2"},
-    {file = "charset_normalizer-3.4.0-cp39-cp39-win_amd64.whl", hash = "sha256:95c3c157765b031331dd4db3c775e58deaee050a3042fcad72cbc4189d7c8dca"},
-    {file = "charset_normalizer-3.4.0-py3-none-any.whl", hash = "sha256:fe9f97feb71aa9896b81973a7bbada8c49501dc73e58a10fcef6663af95e5079"},
-    {file = "charset_normalizer-3.4.0.tar.gz", hash = "sha256:223217c3d4f82c3ac5e29032b3f1c2eb0fb591b72161f86d93f5719079dae93e"},
-]
-
-[[package]]
-name = "clang-format"
-version = "17.0.6"
-description = "Clang-Format is an LLVM-based code formatting tool"
-optional = false
-python-versions = "*"
-files = [
-    {file = "clang-format-17.0.6.tar.gz", hash = "sha256:50f082840d2e013160355ed63add4502884344371dda5af12ec0abe68cbc5a36"},
-    {file = "clang_format-17.0.6-py2.py3-none-macosx_10_9_x86_64.whl", hash = "sha256:2c7364a50c4fdb8ce9acc4e0c21627e52f4eebee98ff2d8a19b6d4302d0be23b"},
-    {file = "clang_format-17.0.6-py2.py3-none-macosx_11_0_arm64.whl", hash = "sha256:195014a589fde9e2bec447ee1f2efd31f8c9f773b10aa66b510beae6997e6bc5"},
-    {file = "clang_format-17.0.6-py2.py3-none-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:5cda40badfb01818ece739509d9cde678fc02660180cc1a55156782ef203704d"},
-    {file = "clang_format-17.0.6-py2.py3-none-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:879e831c58a25a9b7527155032a6dc4758716ded69590911468a37629acb13d1"},
-    {file = "clang_format-17.0.6-py2.py3-none-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:393f896db6155d6b8401ebae40df1f9a8cdf15d494d13fb775657c9ec609b586"},
-    {file = "clang_format-17.0.6-py2.py3-none-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:ccb6f5ce90f24ed0bb314d041a8edcc94d1279c1469669d5855be004d9d6caff"},
-    {file = "clang_format-17.0.6-py2.py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:2a1323ca5322e0dead521223155fe2ae1ba81d50abab8e20aaac28f6a94f23b9"},
-    {file = "clang_format-17.0.6-py2.py3-none-musllinux_1_1_aarch64.whl", hash = "sha256:5476f8fba40e4330a4704681386d78751ced0ecbd050bd0687817cca01d4e167"},
-    {file = "clang_format-17.0.6-py2.py3-none-musllinux_1_1_i686.whl", hash = "sha256:a0f744b056cb1595efdb7d2b83a7d73370e506e17fcaa68cd884c2ed029ae0fd"},
-    {file = "clang_format-17.0.6-py2.py3-none-musllinux_1_1_ppc64le.whl", hash = "sha256:2ddc8b6237520d26d78489e3bb876243d87c3629eb3cd40e1df0c8c6e355d949"},
-    {file = "clang_format-17.0.6-py2.py3-none-musllinux_1_1_s390x.whl", hash = "sha256:afc29c4413b5f2f885347f4bdbb7fe81f595faeceafa640c9e67a2d9aa2c7134"},
-    {file = "clang_format-17.0.6-py2.py3-none-musllinux_1_1_x86_64.whl", hash = "sha256:33c4f1975a6a0a76e5b85165c510c46ae1155f82477a5730e29799e43d78c83a"},
-    {file = "clang_format-17.0.6-py2.py3-none-win32.whl", hash = "sha256:edd55b840fa6edcdafb1651c3c24c6ea8d911e73be30373e7e8e5741cb585464"},
-    {file = "clang_format-17.0.6-py2.py3-none-win_amd64.whl", hash = "sha256:9407f0f4cb5a26b96af38bb2261f1c4015127f4d87ce46a61bb3a3c2a3d4f3cc"},
-]
-
-[[package]]
-name = "colorama"
-version = "0.4.6"
-description = "Cross-platform colored terminal text."
-optional = false
-python-versions = "!=3.0.*,!=3.1.*,!=3.2.*,!=3.3.*,!=3.4.*,!=3.5.*,!=3.6.*,>=2.7"
-files = [
-    {file = "colorama-0.4.6-py2.py3-none-any.whl", hash = "sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6"},
-    {file = "colorama-0.4.6.tar.gz", hash = "sha256:08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44"},
-]
-
-[[package]]
-name = "croniter"
-version = "1.4.1"
-description = "croniter provides iteration for datetime object with cron like format"
-optional = false
-python-versions = ">=2.6, !=3.0.*, !=3.1.*, !=3.2.*, !=3.3.*"
-files = [
-    {file = "croniter-1.4.1-py2.py3-none-any.whl", hash = "sha256:9595da48af37ea06ec3a9f899738f1b2c1c13da3c38cea606ef7cd03ea421128"},
-    {file = "croniter-1.4.1.tar.gz", hash = "sha256:1a6df60eacec3b7a0aa52a8f2ef251ae3dd2a7c7c8b9874e73e791636d55a361"},
-]
-
-[package.dependencies]
-python-dateutil = "*"
-
-[[package]]
-name = "docutils"
-version = "0.20.1"
-description = "Docutils -- Python Documentation Utilities"
-optional = false
-python-versions = ">=3.7"
-files = [
-    {file = "docutils-0.20.1-py3-none-any.whl", hash = "sha256:96f387a2c5562db4476f09f13bbab2192e764cac08ebbf3a34a95d9b1e4a59d6"},
-    {file = "docutils-0.20.1.tar.gz", hash = "sha256:f08a4e276c3a1583a86dce3e34aba3fe04d02bba2dd51ed16106244e8a923e3b"},
-]
-
-[[package]]
-name = "furo"
-version = "2023.9.10"
-description = "A clean customisable Sphinx documentation theme."
-optional = false
-python-versions = ">=3.8"
-files = [
-    {file = "furo-2023.9.10-py3-none-any.whl", hash = "sha256:513092538537dc5c596691da06e3c370714ec99bc438680edc1debffb73e5bfc"},
-    {file = "furo-2023.9.10.tar.gz", hash = "sha256:5707530a476d2a63b8cad83b4f961f3739a69f4b058bcf38a03a39fa537195b2"},
-]
-
-[package.dependencies]
-beautifulsoup4 = "*"
-pygments = ">=2.7"
-sphinx = ">=6.0,<8.0"
-sphinx-basic-ng = "*"
-
-[[package]]
-name = "idna"
-version = "3.10"
-description = "Internationalized Domain Names in Applications (IDNA)"
-optional = false
-python-versions = ">=3.6"
-files = [
-    {file = "idna-3.10-py3-none-any.whl", hash = "sha256:946d195a0d259cbba61165e88e65941f16e9b36ea6ddb97f00452bae8b1287d3"},
-    {file = "idna-3.10.tar.gz", hash = "sha256:12f65c9b470abda6dc35cf8e63cc574b1c52b11df2c86030af0ac09b01b13ea9"},
-]
-
-[package.extras]
-all = ["flake8 (>=7.1.1)", "mypy (>=1.11.2)", "pytest (>=8.3.2)", "ruff (>=0.6.2)"]
-
-[[package]]
-name = "imagesize"
-version = "1.4.1"
-description = "Getting image size from png/jpeg/jpeg2000/gif file"
-optional = false
-python-versions = ">=2.7, !=3.0.*, !=3.1.*, !=3.2.*, !=3.3.*"
-files = [
-    {file = "imagesize-1.4.1-py2.py3-none-any.whl", hash = "sha256:0d8d18d08f840c19d0ee7ca1fd82490fdc3729b7ac93f49870406ddde8ef8d8b"},
-    {file = "imagesize-1.4.1.tar.gz", hash = "sha256:69150444affb9cb0d5cc5a92b3676f0b2fb7cd9ae39e947a5e11a36b4497cd4a"},
-]
-
-[[package]]
-name = "importlib-metadata"
-version = "8.5.0"
-description = "Read metadata from Python packages"
-optional = false
-python-versions = ">=3.8"
-files = [
-    {file = "importlib_metadata-8.5.0-py3-none-any.whl", hash = "sha256:45e54197d28b7a7f1559e60b95e7c567032b602131fbd588f1497f47880aa68b"},
-    {file = "importlib_metadata-8.5.0.tar.gz", hash = "sha256:71522656f0abace1d072b9e5481a48f07c138e00f079c38c8f883823f9c26bd7"},
-]
-
-[package.dependencies]
-zipp = ">=3.20"
-
-[package.extras]
-check = ["pytest-checkdocs (>=2.4)", "pytest-ruff (>=0.2.1)"]
-cover = ["pytest-cov"]
-doc = ["furo", "jaraco.packaging (>=9.3)", "jaraco.tidelift (>=1.4)", "rst.linker (>=1.9)", "sphinx (>=3.5)", "sphinx-lint"]
-enabler = ["pytest-enabler (>=2.2)"]
-perf = ["ipython"]
-test = ["flufl.flake8", "importlib-resources (>=1.3)", "jaraco.test (>=5.4)", "packaging", "pyfakefs", "pytest (>=6,!=8.1.*)", "pytest-perf (>=0.9.2)"]
-type = ["pytest-mypy"]
-
-[[package]]
-name = "jinja2"
-version = "3.1.4"
-description = "A very fast and expressive template engine."
-optional = false
-python-versions = ">=3.7"
-files = [
-    {file = "jinja2-3.1.4-py3-none-any.whl", hash = "sha256:bc5dd2abb727a5319567b7a813e6a2e7318c39f4f487cfe6c89c6f9c7d25197d"},
-    {file = "jinja2-3.1.4.tar.gz", hash = "sha256:4a3aee7acbbe7303aede8e9648d13b8bf88a429282aa6122a993f0ac800cb369"},
-]
-
-[package.dependencies]
-MarkupSafe = ">=2.0"
-
-[package.extras]
-i18n = ["Babel (>=2.7)"]
-
-[[package]]
-name = "livereload"
-version = "2.7.0"
-description = "Python LiveReload is an awesome tool for web developers"
-optional = false
-python-versions = ">=3.7"
-files = [
-    {file = "livereload-2.7.0-py3-none-any.whl", hash = "sha256:19bee55aff51d5ade6ede0dc709189a0f904d3b906d3ea71641ed548acff3246"},
-    {file = "livereload-2.7.0.tar.gz", hash = "sha256:f4ba199ef93248902841e298670eebfe1aa9e148e19b343bc57dbf1b74de0513"},
-]
-
-[package.dependencies]
-tornado = "*"
-
-[[package]]
-name = "markupsafe"
-version = "2.1.5"
-description = "Safely add untrusted strings to HTML/XML markup."
-optional = false
-python-versions = ">=3.7"
-files = [
-    {file = "MarkupSafe-2.1.5-cp310-cp310-macosx_10_9_universal2.whl", hash = "sha256:a17a92de5231666cfbe003f0e4b9b3a7ae3afb1ec2845aadc2bacc93ff85febc"},
-    {file = "MarkupSafe-2.1.5-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:72b6be590cc35924b02c78ef34b467da4ba07e4e0f0454a2c5907f473fc50ce5"},
-    {file = "MarkupSafe-2.1.5-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:e61659ba32cf2cf1481e575d0462554625196a1f2fc06a1c777d3f48e8865d46"},
-    {file = "MarkupSafe-2.1.5-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:2174c595a0d73a3080ca3257b40096db99799265e1c27cc5a610743acd86d62f"},
-    {file = "MarkupSafe-2.1.5-cp310-cp310-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:ae2ad8ae6ebee9d2d94b17fb62763125f3f374c25618198f40cbb8b525411900"},
-    {file = "MarkupSafe-2.1.5-cp310-cp310-musllinux_1_1_aarch64.whl", hash = "sha256:075202fa5b72c86ad32dc7d0b56024ebdbcf2048c0ba09f1cde31bfdd57bcfff"},
-    {file = "MarkupSafe-2.1.5-cp310-cp310-musllinux_1_1_i686.whl", hash = "sha256:598e3276b64aff0e7b3451b72e94fa3c238d452e7ddcd893c3ab324717456bad"},
-    {file = "MarkupSafe-2.1.5-cp310-cp310-musllinux_1_1_x86_64.whl", hash = "sha256:fce659a462a1be54d2ffcacea5e3ba2d74daa74f30f5f143fe0c58636e355fdd"},
-    {file = "MarkupSafe-2.1.5-cp310-cp310-win32.whl", hash = "sha256:d9fad5155d72433c921b782e58892377c44bd6252b5af2f67f16b194987338a4"},
-    {file = "MarkupSafe-2.1.5-cp310-cp310-win_amd64.whl", hash = "sha256:bf50cd79a75d181c9181df03572cdce0fbb75cc353bc350712073108cba98de5"},
-    {file = "MarkupSafe-2.1.5-cp311-cp311-macosx_10_9_universal2.whl", hash = "sha256:629ddd2ca402ae6dbedfceeba9c46d5f7b2a61d9749597d4307f943ef198fc1f"},
-    {file = "MarkupSafe-2.1.5-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:5b7b716f97b52c5a14bffdf688f971b2d5ef4029127f1ad7a513973cfd818df2"},
-    {file = "MarkupSafe-2.1.5-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:6ec585f69cec0aa07d945b20805be741395e28ac1627333b1c5b0105962ffced"},
-    {file = "MarkupSafe-2.1.5-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:b91c037585eba9095565a3556f611e3cbfaa42ca1e865f7b8015fe5c7336d5a5"},
-    {file = "MarkupSafe-2.1.5-cp311-cp311-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:7502934a33b54030eaf1194c21c692a534196063db72176b0c4028e140f8f32c"},
-    {file = "MarkupSafe-2.1.5-cp311-cp311-musllinux_1_1_aarch64.whl", hash = "sha256:0e397ac966fdf721b2c528cf028494e86172b4feba51d65f81ffd65c63798f3f"},
-    {file = "MarkupSafe-2.1.5-cp311-cp311-musllinux_1_1_i686.whl", hash = "sha256:c061bb86a71b42465156a3ee7bd58c8c2ceacdbeb95d05a99893e08b8467359a"},
-    {file = "MarkupSafe-2.1.5-cp311-cp311-musllinux_1_1_x86_64.whl", hash = "sha256:3a57fdd7ce31c7ff06cdfbf31dafa96cc533c21e443d57f5b1ecc6cdc668ec7f"},
-    {file = "MarkupSafe-2.1.5-cp311-cp311-win32.whl", hash = "sha256:397081c1a0bfb5124355710fe79478cdbeb39626492b15d399526ae53422b906"},
-    {file = "MarkupSafe-2.1.5-cp311-cp311-win_amd64.whl", hash = "sha256:2b7c57a4dfc4f16f7142221afe5ba4e093e09e728ca65c51f5620c9aaeb9a617"},
-    {file = "MarkupSafe-2.1.5-cp312-cp312-macosx_10_9_universal2.whl", hash = "sha256:8dec4936e9c3100156f8a2dc89c4b88d5c435175ff03413b443469c7c8c5f4d1"},
-    {file = "MarkupSafe-2.1.5-cp312-cp312-macosx_10_9_x86_64.whl", hash = "sha256:3c6b973f22eb18a789b1460b4b91bf04ae3f0c4234a0a6aa6b0a92f6f7b951d4"},
-    {file = "MarkupSafe-2.1.5-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:ac07bad82163452a6884fe8fa0963fb98c2346ba78d779ec06bd7a6262132aee"},
-    {file = "MarkupSafe-2.1.5-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:f5dfb42c4604dddc8e4305050aa6deb084540643ed5804d7455b5df8fe16f5e5"},
-    {file = "MarkupSafe-2.1.5-cp312-cp312-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:ea3d8a3d18833cf4304cd2fc9cbb1efe188ca9b5efef2bdac7adc20594a0e46b"},
-    {file = "MarkupSafe-2.1.5-cp312-cp312-musllinux_1_1_aarch64.whl", hash = "sha256:d050b3361367a06d752db6ead6e7edeb0009be66bc3bae0ee9d97fb326badc2a"},
-    {file = "MarkupSafe-2.1.5-cp312-cp312-musllinux_1_1_i686.whl", hash = "sha256:bec0a414d016ac1a18862a519e54b2fd0fc8bbfd6890376898a6c0891dd82e9f"},
-    {file = "MarkupSafe-2.1.5-cp312-cp312-musllinux_1_1_x86_64.whl", hash = "sha256:58c98fee265677f63a4385256a6d7683ab1832f3ddd1e66fe948d5880c21a169"},
-    {file = "MarkupSafe-2.1.5-cp312-cp312-win32.whl", hash = "sha256:8590b4ae07a35970728874632fed7bd57b26b0102df2d2b233b6d9d82f6c62ad"},
-    {file = "MarkupSafe-2.1.5-cp312-cp312-win_amd64.whl", hash = "sha256:823b65d8706e32ad2df51ed89496147a42a2a6e01c13cfb6ffb8b1e92bc910bb"},
-    {file = "MarkupSafe-2.1.5-cp37-cp37m-macosx_10_9_x86_64.whl", hash = "sha256:c8b29db45f8fe46ad280a7294f5c3ec36dbac9491f2d1c17345be8e69cc5928f"},
-    {file = "MarkupSafe-2.1.5-cp37-cp37m-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:ec6a563cff360b50eed26f13adc43e61bc0c04d94b8be985e6fb24b81f6dcfdf"},
-    {file = "MarkupSafe-2.1.5-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:a549b9c31bec33820e885335b451286e2969a2d9e24879f83fe904a5ce59d70a"},
-    {file = "MarkupSafe-2.1.5-cp37-cp37m-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:4f11aa001c540f62c6166c7726f71f7573b52c68c31f014c25cc7901deea0b52"},
-    {file = "MarkupSafe-2.1.5-cp37-cp37m-musllinux_1_1_aarch64.whl", hash = "sha256:7b2e5a267c855eea6b4283940daa6e88a285f5f2a67f2220203786dfa59b37e9"},
-    {file = "MarkupSafe-2.1.5-cp37-cp37m-musllinux_1_1_i686.whl", hash = "sha256:2d2d793e36e230fd32babe143b04cec8a8b3eb8a3122d2aceb4a371e6b09b8df"},
-    {file = "MarkupSafe-2.1.5-cp37-cp37m-musllinux_1_1_x86_64.whl", hash = "sha256:ce409136744f6521e39fd8e2a24c53fa18ad67aa5bc7c2cf83645cce5b5c4e50"},
-    {file = "MarkupSafe-2.1.5-cp37-cp37m-win32.whl", hash = "sha256:4096e9de5c6fdf43fb4f04c26fb114f61ef0bf2e5604b6ee3019d51b69e8c371"},
-    {file = "MarkupSafe-2.1.5-cp37-cp37m-win_amd64.whl", hash = "sha256:4275d846e41ecefa46e2015117a9f491e57a71ddd59bbead77e904dc02b1bed2"},
-    {file = "MarkupSafe-2.1.5-cp38-cp38-macosx_10_9_universal2.whl", hash = "sha256:656f7526c69fac7f600bd1f400991cc282b417d17539a1b228617081106feb4a"},
-    {file = "MarkupSafe-2.1.5-cp38-cp38-macosx_10_9_x86_64.whl", hash = "sha256:97cafb1f3cbcd3fd2b6fbfb99ae11cdb14deea0736fc2b0952ee177f2b813a46"},
-    {file = "MarkupSafe-2.1.5-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:1f3fbcb7ef1f16e48246f704ab79d79da8a46891e2da03f8783a5b6fa41a9532"},
-    {file = "MarkupSafe-2.1.5-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:fa9db3f79de01457b03d4f01b34cf91bc0048eb2c3846ff26f66687c2f6d16ab"},
-    {file = "MarkupSafe-2.1.5-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:ffee1f21e5ef0d712f9033568f8344d5da8cc2869dbd08d87c84656e6a2d2f68"},
-    {file = "MarkupSafe-2.1.5-cp38-cp38-musllinux_1_1_aarch64.whl", hash = "sha256:5dedb4db619ba5a2787a94d877bc8ffc0566f92a01c0ef214865e54ecc9ee5e0"},
-    {file = "MarkupSafe-2.1.5-cp38-cp38-musllinux_1_1_i686.whl", hash = "sha256:30b600cf0a7ac9234b2638fbc0fb6158ba5bdcdf46aeb631ead21248b9affbc4"},
-    {file = "MarkupSafe-2.1.5-cp38-cp38-musllinux_1_1_x86_64.whl", hash = "sha256:8dd717634f5a044f860435c1d8c16a270ddf0ef8588d4887037c5028b859b0c3"},
-    {file = "MarkupSafe-2.1.5-cp38-cp38-win32.whl", hash = "sha256:daa4ee5a243f0f20d528d939d06670a298dd39b1ad5f8a72a4275124a7819eff"},
-    {file = "MarkupSafe-2.1.5-cp38-cp38-win_amd64.whl", hash = "sha256:619bc166c4f2de5caa5a633b8b7326fbe98e0ccbfacabd87268a2b15ff73a029"},
-    {file = "MarkupSafe-2.1.5-cp39-cp39-macosx_10_9_universal2.whl", hash = "sha256:7a68b554d356a91cce1236aa7682dc01df0edba8d043fd1ce607c49dd3c1edcf"},
-    {file = "MarkupSafe-2.1.5-cp39-cp39-macosx_10_9_x86_64.whl", hash = "sha256:db0b55e0f3cc0be60c1f19efdde9a637c32740486004f20d1cff53c3c0ece4d2"},
-    {file = "MarkupSafe-2.1.5-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:3e53af139f8579a6d5f7b76549125f0d94d7e630761a2111bc431fd820e163b8"},
-    {file = "MarkupSafe-2.1.5-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:17b950fccb810b3293638215058e432159d2b71005c74371d784862b7e4683f3"},
-    {file = "MarkupSafe-2.1.5-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:4c31f53cdae6ecfa91a77820e8b151dba54ab528ba65dfd235c80b086d68a465"},
-    {file = "MarkupSafe-2.1.5-cp39-cp39-musllinux_1_1_aarch64.whl", hash = "sha256:bff1b4290a66b490a2f4719358c0cdcd9bafb6b8f061e45c7a2460866bf50c2e"},
-    {file = "MarkupSafe-2.1.5-cp39-cp39-musllinux_1_1_i686.whl", hash = "sha256:bc1667f8b83f48511b94671e0e441401371dfd0f0a795c7daa4a3cd1dde55bea"},
-    {file = "MarkupSafe-2.1.5-cp39-cp39-musllinux_1_1_x86_64.whl", hash = "sha256:5049256f536511ee3f7e1b3f87d1d1209d327e818e6ae1365e8653d7e3abb6a6"},
-    {file = "MarkupSafe-2.1.5-cp39-cp39-win32.whl", hash = "sha256:00e046b6dd71aa03a41079792f8473dc494d564611a8f89bbbd7cb93295ebdcf"},
-    {file = "MarkupSafe-2.1.5-cp39-cp39-win_amd64.whl", hash = "sha256:fa173ec60341d6bb97a89f5ea19c85c5643c1e7dedebc22f5181eb73573142c5"},
-    {file = "MarkupSafe-2.1.5.tar.gz", hash = "sha256:d283d37a890ba4c1ae73ffadf8046435c76e7bc2247bbb63c00bd1a709c6544b"},
-]
-
-[[package]]
-name = "packaging"
-version = "24.1"
-description = "Core utilities for Python packages"
-optional = false
-python-versions = ">=3.8"
-files = [
-    {file = "packaging-24.1-py3-none-any.whl", hash = "sha256:5b8f2217dbdbd2f7f384c41c628544e6d52f2d0f53c6d0c3ea61aa5d1d7ff124"},
-    {file = "packaging-24.1.tar.gz", hash = "sha256:026ed72c8ed3fcce5bf8950572258698927fd1dbda10a5e981cdf0ac37f4f002"},
-]
-
-[[package]]
-name = "pydantic"
-version = "1.10.18"
-description = "Data validation and settings management using python type hints"
-optional = false
-python-versions = ">=3.7"
-files = [
-    {file = "pydantic-1.10.18-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:e405ffcc1254d76bb0e760db101ee8916b620893e6edfbfee563b3c6f7a67c02"},
-    {file = "pydantic-1.10.18-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:e306e280ebebc65040034bff1a0a81fd86b2f4f05daac0131f29541cafd80b80"},
-    {file = "pydantic-1.10.18-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:11d9d9b87b50338b1b7de4ebf34fd29fdb0d219dc07ade29effc74d3d2609c62"},
-    {file = "pydantic-1.10.18-cp310-cp310-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:b661ce52c7b5e5f600c0c3c5839e71918346af2ef20062705ae76b5c16914cab"},
-    {file = "pydantic-1.10.18-cp310-cp310-musllinux_1_1_i686.whl", hash = "sha256:c20f682defc9ef81cd7eaa485879ab29a86a0ba58acf669a78ed868e72bb89e0"},
-    {file = "pydantic-1.10.18-cp310-cp310-musllinux_1_1_x86_64.whl", hash = "sha256:c5ae6b7c8483b1e0bf59e5f1843e4fd8fd405e11df7de217ee65b98eb5462861"},
-    {file = "pydantic-1.10.18-cp310-cp310-win_amd64.whl", hash = "sha256:74fe19dda960b193b0eb82c1f4d2c8e5e26918d9cda858cbf3f41dd28549cb70"},
-    {file = "pydantic-1.10.18-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:72fa46abace0a7743cc697dbb830a41ee84c9db8456e8d77a46d79b537efd7ec"},
-    {file = "pydantic-1.10.18-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:ef0fe7ad7cbdb5f372463d42e6ed4ca9c443a52ce544472d8842a0576d830da5"},
-    {file = "pydantic-1.10.18-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:a00e63104346145389b8e8f500bc6a241e729feaf0559b88b8aa513dd2065481"},
-    {file = "pydantic-1.10.18-cp311-cp311-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:ae6fa2008e1443c46b7b3a5eb03800121868d5ab6bc7cda20b5df3e133cde8b3"},
-    {file = "pydantic-1.10.18-cp311-cp311-musllinux_1_1_i686.whl", hash = "sha256:9f463abafdc92635da4b38807f5b9972276be7c8c5121989768549fceb8d2588"},
-    {file = "pydantic-1.10.18-cp311-cp311-musllinux_1_1_x86_64.whl", hash = "sha256:3445426da503c7e40baccefb2b2989a0c5ce6b163679dd75f55493b460f05a8f"},
-    {file = "pydantic-1.10.18-cp311-cp311-win_amd64.whl", hash = "sha256:467a14ee2183bc9c902579bb2f04c3d3dac00eff52e252850509a562255b2a33"},
-    {file = "pydantic-1.10.18-cp312-cp312-macosx_10_9_x86_64.whl", hash = "sha256:efbc8a7f9cb5fe26122acba1852d8dcd1e125e723727c59dcd244da7bdaa54f2"},
-    {file = "pydantic-1.10.18-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:24a4a159d0f7a8e26bf6463b0d3d60871d6a52eac5bb6a07a7df85c806f4c048"},
-    {file = "pydantic-1.10.18-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:b74be007703547dc52e3c37344d130a7bfacca7df112a9e5ceeb840a9ce195c7"},
-    {file = "pydantic-1.10.18-cp312-cp312-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:fcb20d4cb355195c75000a49bb4a31d75e4295200df620f454bbc6bdf60ca890"},
-    {file = "pydantic-1.10.18-cp312-cp312-musllinux_1_1_i686.whl", hash = "sha256:46f379b8cb8a3585e3f61bf9ae7d606c70d133943f339d38b76e041ec234953f"},
-    {file = "pydantic-1.10.18-cp312-cp312-musllinux_1_1_x86_64.whl", hash = "sha256:cbfbca662ed3729204090c4d09ee4beeecc1a7ecba5a159a94b5a4eb24e3759a"},
-    {file = "pydantic-1.10.18-cp312-cp312-win_amd64.whl", hash = "sha256:c6d0a9f9eccaf7f438671a64acf654ef0d045466e63f9f68a579e2383b63f357"},
-    {file = "pydantic-1.10.18-cp37-cp37m-macosx_10_9_x86_64.whl", hash = "sha256:3d5492dbf953d7d849751917e3b2433fb26010d977aa7a0765c37425a4026ff1"},
-    {file = "pydantic-1.10.18-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:fe734914977eed33033b70bfc097e1baaffb589517863955430bf2e0846ac30f"},
-    {file = "pydantic-1.10.18-cp37-cp37m-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:15fdbe568beaca9aacfccd5ceadfb5f1a235087a127e8af5e48df9d8a45ae85c"},
-    {file = "pydantic-1.10.18-cp37-cp37m-musllinux_1_1_i686.whl", hash = "sha256:c3e742f62198c9eb9201781fbebe64533a3bbf6a76a91b8d438d62b813079dbc"},
-    {file = "pydantic-1.10.18-cp37-cp37m-musllinux_1_1_x86_64.whl", hash = "sha256:19a3bd00b9dafc2cd7250d94d5b578edf7a0bd7daf102617153ff9a8fa37871c"},
-    {file = "pydantic-1.10.18-cp37-cp37m-win_amd64.whl", hash = "sha256:2ce3fcf75b2bae99aa31bd4968de0474ebe8c8258a0110903478bd83dfee4e3b"},
-    {file = "pydantic-1.10.18-cp38-cp38-macosx_10_9_x86_64.whl", hash = "sha256:335a32d72c51a313b33fa3a9b0fe283503272ef6467910338e123f90925f0f03"},
-    {file = "pydantic-1.10.18-cp38-cp38-macosx_11_0_arm64.whl", hash = "sha256:34a3613c7edb8c6fa578e58e9abe3c0f5e7430e0fc34a65a415a1683b9c32d9a"},
-    {file = "pydantic-1.10.18-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:e9ee4e6ca1d9616797fa2e9c0bfb8815912c7d67aca96f77428e316741082a1b"},
-    {file = "pydantic-1.10.18-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:23e8ec1ce4e57b4f441fc91e3c12adba023fedd06868445a5b5f1d48f0ab3682"},
-    {file = "pydantic-1.10.18-cp38-cp38-musllinux_1_1_i686.whl", hash = "sha256:44ae8a3e35a54d2e8fa88ed65e1b08967a9ef8c320819a969bfa09ce5528fafe"},
-    {file = "pydantic-1.10.18-cp38-cp38-musllinux_1_1_x86_64.whl", hash = "sha256:d5389eb3b48a72da28c6e061a247ab224381435256eb541e175798483368fdd3"},
-    {file = "pydantic-1.10.18-cp38-cp38-win_amd64.whl", hash = "sha256:069b9c9fc645474d5ea3653788b544a9e0ccd3dca3ad8c900c4c6eac844b4620"},
-    {file = "pydantic-1.10.18-cp39-cp39-macosx_10_9_x86_64.whl", hash = "sha256:80b982d42515632eb51f60fa1d217dfe0729f008e81a82d1544cc392e0a50ddf"},
-    {file = "pydantic-1.10.18-cp39-cp39-macosx_11_0_arm64.whl", hash = "sha256:aad8771ec8dbf9139b01b56f66386537c6fe4e76c8f7a47c10261b69ad25c2c9"},
-    {file = "pydantic-1.10.18-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:941a2eb0a1509bd7f31e355912eb33b698eb0051730b2eaf9e70e2e1589cae1d"},
-    {file = "pydantic-1.10.18-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:65f7361a09b07915a98efd17fdec23103307a54db2000bb92095457ca758d485"},
-    {file = "pydantic-1.10.18-cp39-cp39-musllinux_1_1_i686.whl", hash = "sha256:6951f3f47cb5ca4da536ab161ac0163cab31417d20c54c6de5ddcab8bc813c3f"},
-    {file = "pydantic-1.10.18-cp39-cp39-musllinux_1_1_x86_64.whl", hash = "sha256:7a4c5eec138a9b52c67f664c7d51d4c7234c5ad65dd8aacd919fb47445a62c86"},
-    {file = "pydantic-1.10.18-cp39-cp39-win_amd64.whl", hash = "sha256:49e26c51ca854286bffc22b69787a8d4063a62bf7d83dc21d44d2ff426108518"},
-    {file = "pydantic-1.10.18-py3-none-any.whl", hash = "sha256:06a189b81ffc52746ec9c8c007f16e5167c8b0a696e1a726369327e3db7b2a82"},
-    {file = "pydantic-1.10.18.tar.gz", hash = "sha256:baebdff1907d1d96a139c25136a9bb7d17e118f133a76a2ef3b845e831e3403a"},
-]
-
-[package.dependencies]
-typing-extensions = ">=4.2.0"
-
-[package.extras]
-dotenv = ["python-dotenv (>=0.10.4)"]
-email = ["email-validator (>=1.0.3)"]
-
-[[package]]
-name = "pygments"
-version = "2.18.0"
-description = "Pygments is a syntax highlighting package written in Python."
-optional = false
-python-versions = ">=3.8"
-files = [
-    {file = "pygments-2.18.0-py3-none-any.whl", hash = "sha256:b8e6aca0523f3ab76fee51799c488e38782ac06eafcf95e7ba832985c8e7b13a"},
-    {file = "pygments-2.18.0.tar.gz", hash = "sha256:786ff802f32e91311bff3889f6e9a86e81505fe99f2735bb6d60ae0c5004f199"},
-]
-
-[package.extras]
-windows-terminal = ["colorama (>=0.4.6)"]
-
-[[package]]
-name = "python-dateutil"
-version = "2.9.0.post0"
-description = "Extensions to the standard Python datetime module"
-optional = false
-python-versions = "!=3.0.*,!=3.1.*,!=3.2.*,>=2.7"
-files = [
-    {file = "python-dateutil-2.9.0.post0.tar.gz", hash = "sha256:37dd54208da7e1cd875388217d5e00ebd4179249f90fb72437e91a35459a0ad3"},
-    {file = "python_dateutil-2.9.0.post0-py2.py3-none-any.whl", hash = "sha256:a8b2bc7bffae282281c8140a97d3aa9c14da0b136dfe83f850eea9a5f7470427"},
-]
-
-[package.dependencies]
-six = ">=1.5"
-
-[[package]]
-name = "pytz"
-version = "2024.2"
-description = "World timezone definitions, modern and historical"
-optional = false
-python-versions = "*"
-files = [
-    {file = "pytz-2024.2-py2.py3-none-any.whl", hash = "sha256:31c7c1817eb7fae7ca4b8c7ee50c72f93aa2dd863de768e1ef4245d426aa0725"},
-    {file = "pytz-2024.2.tar.gz", hash = "sha256:2aa355083c50a0f93fa581709deac0c9ad65cca8a9e9beac660adcbd493c798a"},
-]
-
-[[package]]
-name = "pyyaml"
-version = "6.0.2"
-description = "YAML parser and emitter for Python"
-optional = false
-python-versions = ">=3.8"
-files = [
-    {file = "PyYAML-6.0.2-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:0a9a2848a5b7feac301353437eb7d5957887edbf81d56e903999a75a3d743086"},
-    {file = "PyYAML-6.0.2-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:29717114e51c84ddfba879543fb232a6ed60086602313ca38cce623c1d62cfbf"},
-    {file = "PyYAML-6.0.2-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:8824b5a04a04a047e72eea5cec3bc266db09e35de6bdfe34c9436ac5ee27d237"},
-    {file = "PyYAML-6.0.2-cp310-cp310-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:7c36280e6fb8385e520936c3cb3b8042851904eba0e58d277dca80a5cfed590b"},
-    {file = "PyYAML-6.0.2-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:ec031d5d2feb36d1d1a24380e4db6d43695f3748343d99434e6f5f9156aaa2ed"},
-    {file = "PyYAML-6.0.2-cp310-cp310-musllinux_1_1_aarch64.whl", hash = "sha256:936d68689298c36b53b29f23c6dbb74de12b4ac12ca6cfe0e047bedceea56180"},
-    {file = "PyYAML-6.0.2-cp310-cp310-musllinux_1_1_x86_64.whl", hash = "sha256:23502f431948090f597378482b4812b0caae32c22213aecf3b55325e049a6c68"},
-    {file = "PyYAML-6.0.2-cp310-cp310-win32.whl", hash = "sha256:2e99c6826ffa974fe6e27cdb5ed0021786b03fc98e5ee3c5bfe1fd5015f42b99"},
-    {file = "PyYAML-6.0.2-cp310-cp310-win_amd64.whl", hash = "sha256:a4d3091415f010369ae4ed1fc6b79def9416358877534caf6a0fdd2146c87a3e"},
-    {file = "PyYAML-6.0.2-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:cc1c1159b3d456576af7a3e4d1ba7e6924cb39de8f67111c735f6fc832082774"},
-    {file = "PyYAML-6.0.2-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:1e2120ef853f59c7419231f3bf4e7021f1b936f6ebd222406c3b60212205d2ee"},
-    {file = "PyYAML-6.0.2-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:5d225db5a45f21e78dd9358e58a98702a0302f2659a3c6cd320564b75b86f47c"},
-    {file = "PyYAML-6.0.2-cp311-cp311-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:5ac9328ec4831237bec75defaf839f7d4564be1e6b25ac710bd1a96321cc8317"},
-    {file = "PyYAML-6.0.2-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:3ad2a3decf9aaba3d29c8f537ac4b243e36bef957511b4766cb0057d32b0be85"},
-    {file = "PyYAML-6.0.2-cp311-cp311-musllinux_1_1_aarch64.whl", hash = "sha256:ff3824dc5261f50c9b0dfb3be22b4567a6f938ccce4587b38952d85fd9e9afe4"},
-    {file = "PyYAML-6.0.2-cp311-cp311-musllinux_1_1_x86_64.whl", hash = "sha256:797b4f722ffa07cc8d62053e4cff1486fa6dc094105d13fea7b1de7d8bf71c9e"},
-    {file = "PyYAML-6.0.2-cp311-cp311-win32.whl", hash = "sha256:11d8f3dd2b9c1207dcaf2ee0bbbfd5991f571186ec9cc78427ba5bd32afae4b5"},
-    {file = "PyYAML-6.0.2-cp311-cp311-win_amd64.whl", hash = "sha256:e10ce637b18caea04431ce14fabcf5c64a1c61ec9c56b071a4b7ca131ca52d44"},
-    {file = "PyYAML-6.0.2-cp312-cp312-macosx_10_9_x86_64.whl", hash = "sha256:c70c95198c015b85feafc136515252a261a84561b7b1d51e3384e0655ddf25ab"},
-    {file = "PyYAML-6.0.2-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:ce826d6ef20b1bc864f0a68340c8b3287705cae2f8b4b1d932177dcc76721725"},
-    {file = "PyYAML-6.0.2-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:1f71ea527786de97d1a0cc0eacd1defc0985dcf6b3f17bb77dcfc8c34bec4dc5"},
-    {file = "PyYAML-6.0.2-cp312-cp312-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:9b22676e8097e9e22e36d6b7bda33190d0d400f345f23d4065d48f4ca7ae0425"},
-    {file = "PyYAML-6.0.2-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:80bab7bfc629882493af4aa31a4cfa43a4c57c83813253626916b8c7ada83476"},
-    {file = "PyYAML-6.0.2-cp312-cp312-musllinux_1_1_aarch64.whl", hash = "sha256:0833f8694549e586547b576dcfaba4a6b55b9e96098b36cdc7ebefe667dfed48"},
-    {file = "PyYAML-6.0.2-cp312-cp312-musllinux_1_1_x86_64.whl", hash = "sha256:8b9c7197f7cb2738065c481a0461e50ad02f18c78cd75775628afb4d7137fb3b"},
-    {file = "PyYAML-6.0.2-cp312-cp312-win32.whl", hash = "sha256:ef6107725bd54b262d6dedcc2af448a266975032bc85ef0172c5f059da6325b4"},
-    {file = "PyYAML-6.0.2-cp312-cp312-win_amd64.whl", hash = "sha256:7e7401d0de89a9a855c839bc697c079a4af81cf878373abd7dc625847d25cbd8"},
-    {file = "PyYAML-6.0.2-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:efdca5630322a10774e8e98e1af481aad470dd62c3170801852d752aa7a783ba"},
-    {file = "PyYAML-6.0.2-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:50187695423ffe49e2deacb8cd10510bc361faac997de9efef88badc3bb9e2d1"},
-    {file = "PyYAML-6.0.2-cp313-cp313-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:0ffe8360bab4910ef1b9e87fb812d8bc0a308b0d0eef8c8f44e0254ab3b07133"},
-    {file = "PyYAML-6.0.2-cp313-cp313-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:17e311b6c678207928d649faa7cb0d7b4c26a0ba73d41e99c4fff6b6c3276484"},
-    {file = "PyYAML-6.0.2-cp313-cp313-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:70b189594dbe54f75ab3a1acec5f1e3faa7e8cf2f1e08d9b561cb41b845f69d5"},
-    {file = "PyYAML-6.0.2-cp313-cp313-musllinux_1_1_aarch64.whl", hash = "sha256:41e4e3953a79407c794916fa277a82531dd93aad34e29c2a514c2c0c5fe971cc"},
-    {file = "PyYAML-6.0.2-cp313-cp313-musllinux_1_1_x86_64.whl", hash = "sha256:68ccc6023a3400877818152ad9a1033e3db8625d899c72eacb5a668902e4d652"},
-    {file = "PyYAML-6.0.2-cp313-cp313-win32.whl", hash = "sha256:bc2fa7c6b47d6bc618dd7fb02ef6fdedb1090ec036abab80d4681424b84c1183"},
-    {file = "PyYAML-6.0.2-cp313-cp313-win_amd64.whl", hash = "sha256:8388ee1976c416731879ac16da0aff3f63b286ffdd57cdeb95f3f2e085687563"},
-    {file = "PyYAML-6.0.2-cp38-cp38-macosx_10_9_x86_64.whl", hash = "sha256:24471b829b3bf607e04e88d79542a9d48bb037c2267d7927a874e6c205ca7e9a"},
-    {file = "PyYAML-6.0.2-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:d7fded462629cfa4b685c5416b949ebad6cec74af5e2d42905d41e257e0869f5"},
-    {file = "PyYAML-6.0.2-cp38-cp38-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:d84a1718ee396f54f3a086ea0a66d8e552b2ab2017ef8b420e92edbc841c352d"},
-    {file = "PyYAML-6.0.2-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:9056c1ecd25795207ad294bcf39f2db3d845767be0ea6e6a34d856f006006083"},
-    {file = "PyYAML-6.0.2-cp38-cp38-musllinux_1_1_x86_64.whl", hash = "sha256:82d09873e40955485746739bcb8b4586983670466c23382c19cffecbf1fd8706"},
-    {file = "PyYAML-6.0.2-cp38-cp38-win32.whl", hash = "sha256:43fa96a3ca0d6b1812e01ced1044a003533c47f6ee8aca31724f78e93ccc089a"},
-    {file = "PyYAML-6.0.2-cp38-cp38-win_amd64.whl", hash = "sha256:01179a4a8559ab5de078078f37e5c1a30d76bb88519906844fd7bdea1b7729ff"},
-    {file = "PyYAML-6.0.2-cp39-cp39-macosx_10_9_x86_64.whl", hash = "sha256:688ba32a1cffef67fd2e9398a2efebaea461578b0923624778664cc1c914db5d"},
-    {file = "PyYAML-6.0.2-cp39-cp39-macosx_11_0_arm64.whl", hash = "sha256:a8786accb172bd8afb8be14490a16625cbc387036876ab6ba70912730faf8e1f"},
-    {file = "PyYAML-6.0.2-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:d8e03406cac8513435335dbab54c0d385e4a49e4945d2909a581c83647ca0290"},
-    {file = "PyYAML-6.0.2-cp39-cp39-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:f753120cb8181e736c57ef7636e83f31b9c0d1722c516f7e86cf15b7aa57ff12"},
-    {file = "PyYAML-6.0.2-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:3b1fdb9dc17f5a7677423d508ab4f243a726dea51fa5e70992e59a7411c89d19"},
-    {file = "PyYAML-6.0.2-cp39-cp39-musllinux_1_1_aarch64.whl", hash = "sha256:0b69e4ce7a131fe56b7e4d770c67429700908fc0752af059838b1cfb41960e4e"},
-    {file = "PyYAML-6.0.2-cp39-cp39-musllinux_1_1_x86_64.whl", hash = "sha256:a9f8c2e67970f13b16084e04f134610fd1d374bf477b17ec1599185cf611d725"},
-    {file = "PyYAML-6.0.2-cp39-cp39-win32.whl", hash = "sha256:6395c297d42274772abc367baaa79683958044e5d3835486c16da75d2a694631"},
-    {file = "PyYAML-6.0.2-cp39-cp39-win_amd64.whl", hash = "sha256:39693e1f8320ae4f43943590b49779ffb98acb81f788220ea932a6b6c51004d8"},
-    {file = "pyyaml-6.0.2.tar.gz", hash = "sha256:d584d9ec91ad65861cc08d42e834324ef890a082e591037abe114850ff7bbc3e"},
-]
-
-[[package]]
-name = "requests"
-version = "2.32.3"
-description = "Python HTTP for Humans."
-optional = false
-python-versions = ">=3.8"
-files = [
-    {file = "requests-2.32.3-py3-none-any.whl", hash = "sha256:70761cfe03c773ceb22aa2f671b4757976145175cdfca038c02654d061d6dcc6"},
-    {file = "requests-2.32.3.tar.gz", hash = "sha256:55365417734eb18255590a9ff9eb97e9e1da868d4ccd6402399eaf68af20a760"},
-]
-
-[package.dependencies]
-certifi = ">=2017.4.17"
-charset-normalizer = ">=2,<4"
-idna = ">=2.5,<4"
-urllib3 = ">=1.21.1,<3"
-
-[package.extras]
-socks = ["PySocks (>=1.5.6,!=1.5.7)"]
-use-chardet-on-py3 = ["chardet (>=3.0.2,<6)"]
-
-[[package]]
-name = "shrub-py"
-version = "3.3.0"
-description = "Library for creating evergreen configurations"
-optional = false
-python-versions = ">3.7.0"
-files = [
-    {file = "shrub_py-3.3.0-py3-none-any.whl", hash = "sha256:e7e663ebceeb088cdf4ebdce8df9e0581501f5cf7e5b3ea4295b8e76706dfb74"},
-    {file = "shrub_py-3.3.0.tar.gz", hash = "sha256:974526ef9f058159b565d7302f84a5749b88e1512c68d4f5bc7650ab6fe663c4"},
-]
-
-[package.dependencies]
-croniter = ">=1.4.1,<2.0.0"
-pydantic = ">=1.8,<3.0"
-PyYaml = ">=5.1,<7.0"
-typing-extensions = ">=4,<5"
-
-[[package]]
-name = "six"
-version = "1.16.0"
-description = "Python 2 and 3 compatibility utilities"
-optional = false
-python-versions = ">=2.7, !=3.0.*, !=3.1.*, !=3.2.*"
-files = [
-    {file = "six-1.16.0-py2.py3-none-any.whl", hash = "sha256:8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254"},
-    {file = "six-1.16.0.tar.gz", hash = "sha256:1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926"},
-]
-
-[[package]]
-name = "snowballstemmer"
-version = "2.2.0"
-description = "This package provides 29 stemmers for 28 languages generated from Snowball algorithms."
-optional = false
-python-versions = "*"
-files = [
-    {file = "snowballstemmer-2.2.0-py2.py3-none-any.whl", hash = "sha256:c8e1716e83cc398ae16824e5572ae04e0d9fc2c6b985fb0f900f5f0c96ecba1a"},
-    {file = "snowballstemmer-2.2.0.tar.gz", hash = "sha256:09b16deb8547d3412ad7b590689584cd0fe25ec8db3be37788be3810cbf19cb1"},
-]
-
-[[package]]
-name = "soupsieve"
-version = "2.6"
-description = "A modern CSS selector implementation for Beautiful Soup."
-optional = false
-python-versions = ">=3.8"
-files = [
-    {file = "soupsieve-2.6-py3-none-any.whl", hash = "sha256:e72c4ff06e4fb6e4b5a9f0f55fe6e81514581fca1515028625d0f299c602ccc9"},
-    {file = "soupsieve-2.6.tar.gz", hash = "sha256:e2e68417777af359ec65daac1057404a3c8a5455bb8abc36f1a9866ab1a51abb"},
-]
-
-[[package]]
-name = "sphinx"
-version = "7.1.2"
-description = "Python documentation generator"
-optional = false
-python-versions = ">=3.8"
-files = [
-    {file = "sphinx-7.1.2-py3-none-any.whl", hash = "sha256:d170a81825b2fcacb6dfd5a0d7f578a053e45d3f2b153fecc948c37344eb4cbe"},
-    {file = "sphinx-7.1.2.tar.gz", hash = "sha256:780f4d32f1d7d1126576e0e5ecc19dc32ab76cd24e950228dcf7b1f6d3d9e22f"},
-]
-
-[package.dependencies]
-alabaster = ">=0.7,<0.8"
-babel = ">=2.9"
-colorama = {version = ">=0.4.5", markers = "sys_platform == \"win32\""}
-docutils = ">=0.18.1,<0.21"
-imagesize = ">=1.3"
-importlib-metadata = {version = ">=4.8", markers = "python_version < \"3.10\""}
-Jinja2 = ">=3.0"
-packaging = ">=21.0"
-Pygments = ">=2.13"
-requests = ">=2.25.0"
-snowballstemmer = ">=2.0"
-sphinxcontrib-applehelp = "*"
-sphinxcontrib-devhelp = "*"
-sphinxcontrib-htmlhelp = ">=2.0.0"
-sphinxcontrib-jsmath = "*"
-sphinxcontrib-qthelp = "*"
-sphinxcontrib-serializinghtml = ">=1.1.5"
-
-[package.extras]
-docs = ["sphinxcontrib-websupport"]
-lint = ["docutils-stubs", "flake8 (>=3.5.0)", "flake8-simplify", "isort", "mypy (>=0.990)", "ruff", "sphinx-lint", "types-requests"]
-test = ["cython", "filelock", "html5lib", "pytest (>=4.6)"]
-
-[[package]]
-name = "sphinx-autobuild"
-version = "2021.3.14"
-description = "Rebuild Sphinx documentation on changes, with live-reload in the browser."
-optional = false
-python-versions = ">=3.6"
-files = [
-    {file = "sphinx-autobuild-2021.3.14.tar.gz", hash = "sha256:de1ca3b66e271d2b5b5140c35034c89e47f263f2cd5db302c9217065f7443f05"},
-    {file = "sphinx_autobuild-2021.3.14-py3-none-any.whl", hash = "sha256:8fe8cbfdb75db04475232f05187c776f46f6e9e04cacf1e49ce81bdac649ccac"},
-]
-
-[package.dependencies]
-colorama = "*"
-livereload = "*"
-sphinx = "*"
-
-[package.extras]
-test = ["pytest", "pytest-cov"]
-
-[[package]]
-name = "sphinx-basic-ng"
-version = "1.0.0b2"
-description = "A modern skeleton for Sphinx themes."
-optional = false
-python-versions = ">=3.7"
-files = [
-    {file = "sphinx_basic_ng-1.0.0b2-py3-none-any.whl", hash = "sha256:eb09aedbabfb650607e9b4b68c9d240b90b1e1be221d6ad71d61c52e29f7932b"},
-    {file = "sphinx_basic_ng-1.0.0b2.tar.gz", hash = "sha256:9ec55a47c90c8c002b5960c57492ec3021f5193cb26cebc2dc4ea226848651c9"},
-]
-
-[package.dependencies]
-sphinx = ">=4.0"
-
-[package.extras]
-docs = ["furo", "ipython", "myst-parser", "sphinx-copybutton", "sphinx-inline-tabs"]
-
-[[package]]
-name = "sphinx-design"
-version = "0.5.0"
-description = "A sphinx extension for designing beautiful, view size responsive web components."
-optional = false
-python-versions = ">=3.8"
-files = [
-    {file = "sphinx_design-0.5.0-py3-none-any.whl", hash = "sha256:1af1267b4cea2eedd6724614f19dcc88fe2e15aff65d06b2f6252cee9c4f4c1e"},
-    {file = "sphinx_design-0.5.0.tar.gz", hash = "sha256:e8e513acea6f92d15c6de3b34e954458f245b8e761b45b63950f65373352ab00"},
-]
-
-[package.dependencies]
-sphinx = ">=5,<8"
-
-[package.extras]
-code-style = ["pre-commit (>=3,<4)"]
-rtd = ["myst-parser (>=1,<3)"]
-testing = ["myst-parser (>=1,<3)", "pytest (>=7.1,<8.0)", "pytest-cov", "pytest-regressions"]
-theme-furo = ["furo (>=2023.7.0,<2023.8.0)"]
-theme-pydata = ["pydata-sphinx-theme (>=0.13.0,<0.14.0)"]
-theme-rtd = ["sphinx-rtd-theme (>=1.0,<2.0)"]
-theme-sbt = ["sphinx-book-theme (>=1.0,<2.0)"]
-
-[[package]]
-name = "sphinxcontrib-applehelp"
-version = "1.0.4"
-description = "sphinxcontrib-applehelp is a Sphinx extension which outputs Apple help books"
-optional = false
-python-versions = ">=3.8"
-files = [
-    {file = "sphinxcontrib-applehelp-1.0.4.tar.gz", hash = "sha256:828f867945bbe39817c210a1abfd1bc4895c8b73fcaade56d45357a348a07d7e"},
-    {file = "sphinxcontrib_applehelp-1.0.4-py3-none-any.whl", hash = "sha256:29d341f67fb0f6f586b23ad80e072c8e6ad0b48417db2bde114a4c9746feb228"},
-]
-
-[package.extras]
-lint = ["docutils-stubs", "flake8", "mypy"]
-test = ["pytest"]
-
-[[package]]
-name = "sphinxcontrib-devhelp"
-version = "1.0.2"
-description = "sphinxcontrib-devhelp is a sphinx extension which outputs Devhelp document."
-optional = false
-python-versions = ">=3.5"
-files = [
-    {file = "sphinxcontrib-devhelp-1.0.2.tar.gz", hash = "sha256:ff7f1afa7b9642e7060379360a67e9c41e8f3121f2ce9164266f61b9f4b338e4"},
-    {file = "sphinxcontrib_devhelp-1.0.2-py2.py3-none-any.whl", hash = "sha256:8165223f9a335cc1af7ffe1ed31d2871f325254c0423bc0c4c7cd1c1e4734a2e"},
-]
-
-[package.extras]
-lint = ["docutils-stubs", "flake8", "mypy"]
-test = ["pytest"]
-
-[[package]]
-name = "sphinxcontrib-htmlhelp"
-version = "2.0.1"
-description = "sphinxcontrib-htmlhelp is a sphinx extension which renders HTML help files"
-optional = false
-python-versions = ">=3.8"
-files = [
-    {file = "sphinxcontrib-htmlhelp-2.0.1.tar.gz", hash = "sha256:0cbdd302815330058422b98a113195c9249825d681e18f11e8b1f78a2f11efff"},
-    {file = "sphinxcontrib_htmlhelp-2.0.1-py3-none-any.whl", hash = "sha256:c38cb46dccf316c79de6e5515e1770414b797162b23cd3d06e67020e1d2a6903"},
-]
-
-[package.extras]
-lint = ["docutils-stubs", "flake8", "mypy"]
-test = ["html5lib", "pytest"]
-
-[[package]]
-name = "sphinxcontrib-jsmath"
-version = "1.0.1"
-description = "A sphinx extension which renders display math in HTML via JavaScript"
-optional = false
-python-versions = ">=3.5"
-files = [
-    {file = "sphinxcontrib-jsmath-1.0.1.tar.gz", hash = "sha256:a9925e4a4587247ed2191a22df5f6970656cb8ca2bd6284309578f2153e0c4b8"},
-    {file = "sphinxcontrib_jsmath-1.0.1-py2.py3-none-any.whl", hash = "sha256:2ec2eaebfb78f3f2078e73666b1415417a116cc848b72e5172e596c871103178"},
-]
-
-[package.extras]
-test = ["flake8", "mypy", "pytest"]
-
-[[package]]
-name = "sphinxcontrib-qthelp"
-version = "1.0.3"
-description = "sphinxcontrib-qthelp is a sphinx extension which outputs QtHelp document."
-optional = false
-python-versions = ">=3.5"
-files = [
-    {file = "sphinxcontrib-qthelp-1.0.3.tar.gz", hash = "sha256:4c33767ee058b70dba89a6fc5c1892c0d57a54be67ddd3e7875a18d14cba5a72"},
-    {file = "sphinxcontrib_qthelp-1.0.3-py2.py3-none-any.whl", hash = "sha256:bd9fc24bcb748a8d51fd4ecaade681350aa63009a347a8c14e637895444dfab6"},
-]
-
-[package.extras]
-lint = ["docutils-stubs", "flake8", "mypy"]
-test = ["pytest"]
-
-[[package]]
-name = "sphinxcontrib-serializinghtml"
-version = "1.1.5"
-description = "sphinxcontrib-serializinghtml is a sphinx extension which outputs \"serialized\" HTML files (json and pickle)."
-optional = false
-python-versions = ">=3.5"
-files = [
-    {file = "sphinxcontrib-serializinghtml-1.1.5.tar.gz", hash = "sha256:aa5f6de5dfdf809ef505c4895e51ef5c9eac17d0f287933eb49ec495280b6952"},
-    {file = "sphinxcontrib_serializinghtml-1.1.5-py2.py3-none-any.whl", hash = "sha256:352a9a00ae864471d3a7ead8d7d79f5fc0b57e8b3f95e9867eb9eb28999b92fd"},
-]
-
-[package.extras]
-lint = ["docutils-stubs", "flake8", "mypy"]
-test = ["pytest"]
-
-[[package]]
-name = "tornado"
-version = "6.4.1"
-description = "Tornado is a Python web framework and asynchronous networking library, originally developed at FriendFeed."
-optional = false
-python-versions = ">=3.8"
-files = [
-    {file = "tornado-6.4.1-cp38-abi3-macosx_10_9_universal2.whl", hash = "sha256:163b0aafc8e23d8cdc3c9dfb24c5368af84a81e3364745ccb4427669bf84aec8"},
-    {file = "tornado-6.4.1-cp38-abi3-macosx_10_9_x86_64.whl", hash = "sha256:6d5ce3437e18a2b66fbadb183c1d3364fb03f2be71299e7d10dbeeb69f4b2a14"},
-    {file = "tornado-6.4.1-cp38-abi3-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:e2e20b9113cd7293f164dc46fffb13535266e713cdb87bd2d15ddb336e96cfc4"},
-    {file = "tornado-6.4.1-cp38-abi3-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:8ae50a504a740365267b2a8d1a90c9fbc86b780a39170feca9bcc1787ff80842"},
-    {file = "tornado-6.4.1-cp38-abi3-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:613bf4ddf5c7a95509218b149b555621497a6cc0d46ac341b30bd9ec19eac7f3"},
-    {file = "tornado-6.4.1-cp38-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:25486eb223babe3eed4b8aecbac33b37e3dd6d776bc730ca14e1bf93888b979f"},
-    {file = "tornado-6.4.1-cp38-abi3-musllinux_1_2_i686.whl", hash = "sha256:454db8a7ecfcf2ff6042dde58404164d969b6f5d58b926da15e6b23817950fc4"},
-    {file = "tornado-6.4.1-cp38-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:a02a08cc7a9314b006f653ce40483b9b3c12cda222d6a46d4ac63bb6c9057698"},
-    {file = "tornado-6.4.1-cp38-abi3-win32.whl", hash = "sha256:d9a566c40b89757c9aa8e6f032bcdb8ca8795d7c1a9762910c722b1635c9de4d"},
-    {file = "tornado-6.4.1-cp38-abi3-win_amd64.whl", hash = "sha256:b24b8982ed444378d7f21d563f4180a2de31ced9d8d84443907a0a64da2072e7"},
-    {file = "tornado-6.4.1.tar.gz", hash = "sha256:92d3ab53183d8c50f8204a51e6f91d18a15d5ef261e84d452800d4ff6fc504e9"},
-]
-
-[[package]]
-name = "types-docutils"
-version = "0.20.0.20240406"
-description = "Typing stubs for docutils"
-optional = false
-python-versions = ">=3.8"
-files = [
-    {file = "types-docutils-0.20.0.20240406.tar.gz", hash = "sha256:e8ec4a5a125d06d8632bbaac8a11fbea18a1edfa94df9c5129dc45980915b84b"},
-    {file = "types_docutils-0.20.0.20240406-py3-none-any.whl", hash = "sha256:f1966b05087c0e1227c399281ecc796cb67d0afc23398d7c5c95b3355de14113"},
-]
-
-[[package]]
-name = "typing-extensions"
-version = "4.12.2"
-description = "Backported and Experimental Type Hints for Python 3.8+"
-optional = false
-python-versions = ">=3.8"
-files = [
-    {file = "typing_extensions-4.12.2-py3-none-any.whl", hash = "sha256:04e5ca0351e0f3f85c6853954072df659d0d13fac324d0072316b67d7794700d"},
-    {file = "typing_extensions-4.12.2.tar.gz", hash = "sha256:1a7ead55c7e559dd4dee8856e3a88b41225abfe1ce8df57b7c13915fe121ffb8"},
-]
-
-[[package]]
-name = "urllib3"
-version = "2.2.3"
-description = "HTTP library with thread-safe connection pooling, file post, and more."
-optional = false
-python-versions = ">=3.8"
-files = [
-    {file = "urllib3-2.2.3-py3-none-any.whl", hash = "sha256:ca899ca043dcb1bafa3e262d73aa25c465bfb49e0bd9dd5d59f1d0acba2f8fac"},
-    {file = "urllib3-2.2.3.tar.gz", hash = "sha256:e7d814a81dad81e6caf2ec9fdedb284ecc9c73076b62654547cc64ccdcae26e9"},
-]
-
-[package.extras]
-brotli = ["brotli (>=1.0.9)", "brotlicffi (>=0.8.0)"]
-h2 = ["h2 (>=4,<5)"]
-socks = ["pysocks (>=1.5.6,!=1.5.7,<2.0)"]
-zstd = ["zstandard (>=0.18.0)"]
-
-[[package]]
-name = "yamlordereddictloader"
-version = "0.4.2"
-description = "YAML loader and dumper for PyYAML allowing to keep keys order."
-optional = false
-python-versions = "*"
-files = [
-    {file = "yamlordereddictloader-0.4.2-py3-none-any.whl", hash = "sha256:dc048adb67026786cd24119bd71241f35bc8b0fd37d24b415c37bbc8049f9cd7"},
-    {file = "yamlordereddictloader-0.4.2.tar.gz", hash = "sha256:36af2f6210fcff5da4fc4c12e1d815f973dceb41044e795e1f06115d634bca13"},
-]
-
-[package.dependencies]
-pyyaml = "*"
-
-[[package]]
-name = "zipp"
-version = "3.20.2"
-description = "Backport of pathlib-compatible object wrapper for zip files"
-optional = false
-python-versions = ">=3.8"
-files = [
-    {file = "zipp-3.20.2-py3-none-any.whl", hash = "sha256:a817ac80d6cf4b23bf7f2828b7cabf326f15a001bea8b1f9b49631780ba28350"},
-    {file = "zipp-3.20.2.tar.gz", hash = "sha256:bc9eb26f4506fda01b81bcde0ca78103b6e62f991b381fec825435c836edbc29"},
-]
-
-[package.extras]
-check = ["pytest-checkdocs (>=2.4)", "pytest-ruff (>=0.2.1)"]
-cover = ["pytest-cov"]
-doc = ["furo", "jaraco.packaging (>=9.3)", "jaraco.tidelift (>=1.4)", "rst.linker (>=1.9)", "sphinx (>=3.5)", "sphinx-lint"]
-enabler = ["pytest-enabler (>=2.2)"]
-test = ["big-O", "importlib-resources", "jaraco.functools", "jaraco.itertools", "jaraco.test", "more-itertools", "pytest (>=6,!=8.1.*)", "pytest-ignore-flaky"]
-type = ["pytest-mypy"]
-
-[metadata]
-lock-version = "2.0"
-python-versions = "^3.8"
-content-hash = "9daee065d0bcde46d8092d5d63f67c7dd15289ca70eedf959d203da902285060"
diff -pruN 2.0.2-1/pyproject.toml 2.1.0-1/pyproject.toml
--- 2.0.2-1/pyproject.toml	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/pyproject.toml	2025-08-14 18:37:23.000000000 +0000
@@ -1,42 +1,47 @@
-[tool.poetry]
+[project]
 name = "mongo-c-driver"
-version = "0.0.0"
-description = "A Python project for mongo-c-driver codebase development"
-authors = []
-packages = [
-    { include = "config_generator", from = ".evergreen/" }
+version = "0.1.0"
+description = "For development only."
+requires-python = ">=3.10"
+dependencies = []
+
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[dependency-groups]
+dev = [
+    { include-group = "docs" },
+    { include-group = "evg" },
+    { include-group = "format" },
 ]
 
-[tool.poetry.dependencies]
-python = "^3.8"
-clang-format = "^17.0.6"
-
-[tool.poetry.scripts]
-"mc-evg-generate" = "config_generator.generate:main"
-
-[tool.poetry.group.docs]
-optional = true
-
-[tool.poetry.group.docs.dependencies]
-sphinx = "^7.1.1"
-furo = "^2023.5.20"
-sphinx-design = "^0.5.0"
-
-[tool.poetry.group.dev]
-optional = true
-
-[tool.poetry.group.dev.dependencies]
-clang-format = "^17"
-sphinx-autobuild = "^2021.3.14"
-shrub-py = "^3.3.0"
-yamlordereddictloader = "^0.4.0"
-types-docutils = "^0.20.0.1"
-
-# XXX: These dependencies are only to force certain versions of transitive requirements,
-# but are not required otherwise.
-[tool.poetry.group.ext.dependencies]
-pydantic = "^1"
+format = [
+    # tools/format.py
+    "clang-format~=20.1.0",
+]
 
-[build-system]
-requires = ["poetry-core"]
-build-backend = "poetry.core.masonry.api"
+docs = [
+    # .evergreen/scripts/build-docs.sh
+    "furo>=2023.5.20",
+    "sphinx-design>=0.5.0",
+    "sphinx>=7.1.1,<9.0",
+]
+
+evg = [
+    # .evergreen/config_generator
+    "packaging>=14.0",
+    "pydantic>=2.8",
+    "shrub-py>=3.7",
+
+    # .evergreen/legacy_config_generator/evergreen_config_generator/__init__.py
+    "yamlloader>=1.5",
+]
+
+[project.scripts]
+mc-evg-generate = "config_generator.generate:main"
+
+[tool.hatch.build.targets.wheel]
+packages = [
+    ".evergreen/config_generator",
+]
diff -pruN 2.0.2-1/src/CMakeLists.txt 2.1.0-1/src/CMakeLists.txt
--- 2.0.2-1/src/CMakeLists.txt	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/CMakeLists.txt	2025-08-14 18:37:23.000000000 +0000
@@ -36,6 +36,7 @@ target_compile_options(public-header-war
   $<$<C_COMPILER_ID:AppleClang,Clang,GNU>:-Wno-declaration-after-statement>
   $<$<C_COMPILER_ID:AppleClang,Clang,GNU>:-Wno-disabled-macro-expansion>
   $<$<C_COMPILER_ID:AppleClang,Clang>:-Wno-c++98-compat-pedantic>
+  $<$<C_COMPILER_ID:AppleClang,Clang>:-Wno-pre-c11-compat>
   $<$<C_COMPILER_ID:AppleClang,Clang>:-Wno-pre-c2x-compat>
   $<$<C_COMPILER_ID:AppleClang,Clang>:-Wno-unsafe-buffer-usage>
   $<$<C_COMPILER_ID:AppleClang,Clang>:-Wno-padded>
diff -pruN 2.0.2-1/src/common/src/common-b64.c 2.1.0-1/src/common/src/common-b64.c
--- 2.0.2-1/src/common/src/common-b64.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/common/src/common-b64.c	2025-08-14 18:37:23.000000000 +0000
@@ -40,8 +40,12 @@
  * IF IBM IS APPRISED OF THE POSSIBILITY OF SUCH DAMAGES.
  */
 
-#include <bson/bson.h>
 #include <common-b64-private.h>
+#include <common-thread-private.h>
+
+#include <bson/bson.h>
+
+#include <mlib/config.h>
 #include <mlib/loop.h>
 
 #define Assert(Cond) \
@@ -259,22 +263,7 @@ static const uint8_t mongoc_b64rmap_spac
 static const uint8_t mongoc_b64rmap_invalid = 0xff;
 
 /* initializing the reverse map isn't thread safe, do it in pthread_once */
-#if defined(BSON_OS_UNIX)
-#include <pthread.h>
-#define mongoc_common_once_t pthread_once_t
-#define mongoc_common_once pthread_once
-#define MONGOC_COMMON_ONCE_FUN(n) void n (void)
-#define MONGOC_COMMON_ONCE_RETURN return
-#define MONGOC_COMMON_ONCE_INIT PTHREAD_ONCE_INIT
-#else
-#define mongoc_common_once_t INIT_ONCE
-#define MONGOC_COMMON_ONCE_INIT INIT_ONCE_STATIC_INIT
-#define mongoc_common_once(o, c) InitOnceExecuteOnce (o, c, NULL, NULL)
-#define MONGOC_COMMON_ONCE_FUN(n) BOOL CALLBACK n (PINIT_ONCE _ignored_a, PVOID _ignored_b, PVOID *_ignored_c)
-#define MONGOC_COMMON_ONCE_RETURN return true
-#endif
-
-static MONGOC_COMMON_ONCE_FUN (bson_b64_initialize_rmap)
+static BSON_ONCE_FUN (bson_b64_initialize_rmap)
 {
    /* Null: end of string, stop parsing */
    mongoc_b64rmap[0] = mongoc_b64rmap_end;
@@ -296,7 +285,7 @@ static MONGOC_COMMON_ONCE_FUN (bson_b64_
    for (uint8_t i = 0; Base64[i] != '\0'; ++i)
       mongoc_b64rmap[(uint8_t) Base64[i]] = i;
 
-   MONGOC_COMMON_ONCE_RETURN;
+   BSON_ONCE_RETURN;
 }
 
 static int
@@ -511,9 +500,9 @@ mongoc_b64_pton_len (char const *src)
 int
 mcommon_b64_pton (char const *src, uint8_t *target, size_t targsize)
 {
-   static mongoc_common_once_t once = MONGOC_COMMON_ONCE_INIT;
+   static bson_once_t once = BSON_ONCE_INIT;
 
-   mongoc_common_once (&once, bson_b64_initialize_rmap);
+   bson_once (&once, bson_b64_initialize_rmap);
 
    if (!src) {
       return -1;
diff -pruN 2.0.2-1/src/common/src/common-bson-dsl-private.h 2.1.0-1/src/common/src/common-bson-dsl-private.h
--- 2.0.2-1/src/common/src/common-bson-dsl-private.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/common/src/common-bson-dsl-private.h	2025-08-14 18:37:23.000000000 +0000
@@ -14,6 +14,7 @@
  */
 
 #include <bson/bson.h>
+
 #include <mlib/cmp.h>
 
 enum {
@@ -36,17 +37,18 @@ enum {
 BSON_IF_GNU_LIKE (_Pragma ("GCC diagnostic ignored \"-Wshadow\""))
 #endif
 
-#define _bsonDSL_disableWarnings()                                        \
-   if (1) {                                                               \
-      BSON_IF_GNU_LIKE (_Pragma ("GCC diagnostic push");)                 \
-      BSON_IF_GNU_LIKE (_Pragma ("GCC diagnostic ignored \"-Wshadow\"");) \
-   } else                                                                 \
+#define _bsonDSL_disableWarnings()           \
+   if (1) {                                  \
+      mlib_diagnostic_push ();               \
+      mlib_gnu_warning_disable ("-Wshadow"); \
+      mlib_msvc_warning (disable : 4456);    \
+   } else                                    \
       ((void) 0)
 
-#define _bsonDSL_restoreWarnings()                       \
-   if (1) {                                              \
-      BSON_IF_GNU_LIKE (_Pragma ("GCC diagnostic pop");) \
-   } else                                                \
+#define _bsonDSL_restoreWarnings() \
+   if (1) {                        \
+      mlib_diagnostic_pop ();      \
+   } else                          \
       ((void) 0)
 
 /**
@@ -58,9 +60,12 @@ BSON_IF_GNU_LIKE (_Pragma ("GCC diagnost
    _bsonDSL_begin ("bsonParse(%s)", _bsonDSL_str (Document)); \
    _bsonDSL_disableWarnings ();                               \
    bsonParseError = NULL;                                     \
-   BSON_MAYBE_UNUSED bool _bvHalt = false;                    \
-   BSON_MAYBE_UNUSED const bool _bvContinue = false;          \
-   BSON_MAYBE_UNUSED const bool _bvBreak = false;             \
+   bool _bvHalt = false;                                      \
+   const bool _bvContinue = false;                            \
+   const bool _bvBreak = false;                               \
+   (void) _bvHalt;                                            \
+   (void) _bvContinue;                                        \
+   (void) _bvBreak;                                           \
    _bsonDSL_eval (_bsonParse ((Document), __VA_ARGS__));      \
    _bsonDSL_restoreWarnings ();                               \
    _bsonDSL_end
@@ -71,7 +76,8 @@ BSON_IF_GNU_LIKE (_Pragma ("GCC diagnost
 #define bsonVisitEach(Document, ...)                              \
    _bsonDSL_begin ("bsonVisitEach(%s)", _bsonDSL_str (Document)); \
    _bsonDSL_disableWarnings ();                                   \
-   BSON_MAYBE_UNUSED bool _bvHalt = false;                        \
+   bool _bvHalt = false;                                          \
+   (void) _bvHalt;                                                \
    _bsonDSL_eval (_bsonVisitEach ((Document), __VA_ARGS__));      \
    _bsonDSL_restoreWarnings ();                                   \
    _bsonDSL_end
@@ -516,7 +522,8 @@ BSON_IF_GNU_LIKE (_Pragma ("GCC diagnost
 
 #define _bsonVisitOperation_case(...)                  \
    _bsonDSL_begin ("case:%s", "");                     \
-   BSON_MAYBE_UNUSED bool _bvCaseMatched = false;      \
+   bool _bvCaseMatched = false;                        \
+   (void) _bvCaseMatched;                              \
    _bsonDSL_mapMacro (_bsonVisitCase, ~, __VA_ARGS__); \
    _bsonDSL_end
 
@@ -544,8 +551,10 @@ BSON_IF_GNU_LIKE (_Pragma ("GCC diagnost
       if (!bson_iter_init (&_bvCtx.iter, &(Doc))) {                                       \
          bsonParseError = "Invalid BSON data [a]";                                        \
       }                                                                                   \
-      BSON_MAYBE_UNUSED bool _bvBreak = false;                                            \
-      BSON_MAYBE_UNUSED bool _bvContinue = false;                                         \
+      bool _bvBreak = false;                                                              \
+      bool _bvContinue = false;                                                           \
+      (void) _bvBreak;                                                                    \
+      (void) _bvContinue;                                                                 \
       while (bson_iter_next (&_bvCtx.iter) && !_bvHalt && !bsonParseError && !_bvBreak) { \
          _bvContinue = false;                                                             \
          _bsonVisit_applyOps (__VA_ARGS__);                                               \
@@ -622,19 +631,23 @@ BSON_IF_GNU_LIKE (_Pragma ("GCC diagnost
       }                                                  \
    } while (0);
 
-#define _bsonParse(Doc, ...)                                                                        \
-   do {                                                                                             \
-      BSON_MAYBE_UNUSED const bson_t *_bpDoc = &(Doc);                                              \
-      /* Keep track of which elements have been visited based on their index*/                      \
-      uint64_t _bpVisitBits_static[4] = {0};                                                        \
-      BSON_MAYBE_UNUSED uint64_t *_bpVisitBits = _bpVisitBits_static;                               \
-      BSON_MAYBE_UNUSED size_t _bpNumVisitBitInts = sizeof _bpVisitBits_static / sizeof (uint64_t); \
-      BSON_MAYBE_UNUSED bool _bpFoundElement = false;                                               \
-      _bsonParse_applyOps (__VA_ARGS__);                                                            \
-      /* We may have allocated for visit bits */                                                    \
-      if (_bpVisitBits != _bpVisitBits_static) {                                                    \
-         bson_free (_bpVisitBits);                                                                  \
-      }                                                                                             \
+#define _bsonParse(Doc, ...)                                                      \
+   do {                                                                           \
+      /* Keep track of which elements have been visited based on their index*/    \
+      uint64_t _bpVisitBits_static[4] = {0};                                      \
+      const bson_t *_bpDoc = &(Doc);                                              \
+      uint64_t *_bpVisitBits = _bpVisitBits_static;                               \
+      size_t _bpNumVisitBitInts = sizeof _bpVisitBits_static / sizeof (uint64_t); \
+      bool _bpFoundElement = false;                                               \
+      (void) _bpDoc;                                                              \
+      (void) _bpVisitBits;                                                        \
+      (void) _bpNumVisitBitInts;                                                  \
+      (void) _bpFoundElement;                                                     \
+      _bsonParse_applyOps (__VA_ARGS__);                                          \
+      /* We may have allocated for visit bits */                                  \
+      if (_bpVisitBits != _bpVisitBits_static) {                                  \
+         bson_free (_bpVisitBits);                                                \
+      }                                                                           \
    } while (0)
 
 #define _bsonParse_applyOps(...) _bsonDSL_mapMacro (_bsonParse_applyOp, ~, __VA_ARGS__)
diff -pruN 2.0.2-1/src/common/src/common-json.c 2.1.0-1/src/common/src/common-json.c
--- 2.0.2-1/src/common/src/common-json.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/common/src/common-json.c	2025-08-14 18:37:23.000000000 +0000
@@ -15,11 +15,13 @@
  */
 
 
-#include <string.h>
-#include <bson/bson.h>
+#include <common-json-private.h>
 #include <common-string-private.h>
 #include <common-utf8-private.h>
-#include <common-json-private.h>
+
+#include <bson/bson.h>
+
+#include <string.h>
 
 
 typedef struct {
diff -pruN 2.0.2-1/src/common/src/common-md5.c 2.1.0-1/src/common/src/common-md5.c
--- 2.0.2-1/src/common/src/common-md5.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/common/src/common-md5.c	2025-08-14 18:37:23.000000000 +0000
@@ -56,10 +56,10 @@
  * specified in libbson.
  */
 
-#include <string.h>
-
 #include <common-md5-private.h>
 
+#include <string.h>
+
 #undef BYTE_ORDER /* 1 = big-endian, -1 = little-endian, 0 = unknown */
 #if BSON_BYTE_ORDER == BSON_BIG_ENDIAN
 #define BYTE_ORDER 1
diff -pruN 2.0.2-1/src/common/src/common-string-private.h 2.1.0-1/src/common/src/common-string-private.h
--- 2.0.2-1/src/common/src/common-string-private.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/common/src/common-string-private.h	2025-08-14 18:37:23.000000000 +0000
@@ -20,7 +20,9 @@
 #define MONGO_C_DRIVER_COMMON_STRING_PRIVATE_H
 
 #include <bson/bson.h>
+
 #include <mlib/cmp.h>
+
 #include <string.h>
 
 
@@ -483,7 +485,7 @@ mcommon_string_append_overflow (mcommon_
  */
 bool
 mcommon_string_append_selected_chars (mcommon_string_append_t *append,
-                                      const char *template,
+                                      const char *template_,
                                       const char *selector,
                                       size_t selector_len);
 
diff -pruN 2.0.2-1/src/common/src/common-string.c 2.1.0-1/src/common/src/common-string.c
--- 2.0.2-1/src/common/src/common-string.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/common/src/common-string.c	2025-08-14 18:37:23.000000000 +0000
@@ -14,10 +14,11 @@
  * limitations under the License.
  */
 
-#include <common-string-private.h>
+#include <common-b64-private.h>
 #include <common-bits-private.h>
+#include <common-string-private.h>
 #include <common-utf8-private.h>
-#include <common-b64-private.h>
+
 #include <mlib/cmp.h>
 
 
diff -pruN 2.0.2-1/src/common/src/common-thread-private.h 2.1.0-1/src/common/src/common-thread-private.h
--- 2.0.2-1/src/common/src/common-thread-private.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/common/src/common-thread-private.h	2025-08-14 18:37:23.000000000 +0000
@@ -15,17 +15,17 @@
  */
 
 #include <common-prelude.h>
-#include <common-config.h>
+
 #include <common-macros-private.h>
 
+#include <common-config.h>
+
 #ifndef MONGO_C_DRIVER_COMMON_THREAD_PRIVATE_H
 #define MONGO_C_DRIVER_COMMON_THREAD_PRIVATE_H
 
-#define BSON_INSIDE
-#include <bson/bson-compat.h>
-#include <bson/bson-config.h>
-#include <bson/bson-macros.h>
-#undef BSON_INSIDE
+#include <bson/compat.h>
+#include <bson/config.h>
+#include <bson/macros.h>
 
 BSON_BEGIN_DECLS
 
@@ -79,6 +79,8 @@ BSON_BEGIN_DECLS
    } while (0)
 
 #else
+#include <mlib/config.h>
+
 typedef struct {
    pthread_t lock_owner;
    pthread_mutex_t wrapped_mutex;
@@ -113,7 +115,9 @@ typedef struct {
 
 #else
 #include <process.h>
-#define BSON_ONCE_FUN(n) BOOL CALLBACK n (PINIT_ONCE _ignored_a, PVOID _ignored_b, PVOID *_ignored_c)
+#define BSON_ONCE_FUN(n)                                                                             \
+   BOOL CALLBACK MLIB_PRAGMA_IF_MSVC (warning (push)) MLIB_PRAGMA_IF_MSVC (warning (disable : 4100)) \
+      n (PINIT_ONCE _ignored_a, PVOID _ignored_b, PVOID *_ignored_c) MLIB_PRAGMA_IF_MSVC (warning (pop))
 #define BSON_ONCE_INIT INIT_ONCE_STATIC_INIT
 #define BSON_ONCE_RETURN return true
 #define bson_mutex_destroy DeleteCriticalSection
diff -pruN 2.0.2-1/src/common/src/mlib/ckdint.h 2.1.0-1/src/common/src/mlib/ckdint.h
--- 2.0.2-1/src/common/src/mlib/ckdint.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/common/src/mlib/ckdint.h	2025-08-14 18:37:23.000000000 +0000
@@ -5,9 +5,6 @@
  *
  * This file implements the C23 checked-integer-arithmetic functions as macros.
  *
- * The implementation is nearly perfect: The macros necessarily evaluate the
- * operand expressions more than once, so callers should be aware of this caveat.
- *
  * The function-like macros are defined:
  *
  * - `mlib_add(Dst, L, R)` / `mlib_add(Dst, A)`
@@ -159,7 +156,7 @@ mlib_extern_c_begin ();
  * @param T A type specifier for a target integral type for the cast.
  * @param Operand The integral value to be converted.
  *
- * If the cast would result in the operand value chaning, the program will be
+ * If the cast would result in the operand value changing, the program will be
  * terminated with a diagnostic.
  */
 #define mlib_assert_narrow(T, Operand) \
@@ -193,19 +190,17 @@ mlib_extern_c_begin ();
 // clang-format off
 // Generates an 0b11111 bit pattern for appropriate size:
 #define _mlibMaxofUnsigned(V) \
-   (sizeof(V) == sizeof(uintmax_t) \
-      ? UINTMAX_MAX /* No funny bit math, just return the max of the max int */ \
-      /* Generate an 0b11111... bit pattern */ \
-      : (UINTMAX_C(1) << ( \
-         /* Guard against an over-shift if V is uintmax_t: */ \
-           (sizeof(V) < sizeof(uintmax_t)) \
-         * (sizeof(V) * CHAR_BIT)) \
-         ) - 1)
+   /* NOLINTNEXTLINE(bugprone-sizeof-expression) */ \
+   mlib_bits(mlib_bitsizeof((V)), 0)
 
 // Generates an 0b01111 bit pattern for the two's complement max value:
-#define _mlibMaxofSigned(V) (_mlibMaxofUnsigned (V) >> 1ull)
+#define _mlibMaxofSigned(V) \
+   /* NOLINTNEXTLINE(bugprone-sizeof-expression) */ \
+   mlib_bits(mlib_bitsizeof(V) - 1u, 0)
 // Generates an 0b10000... bit pattern for the two's complement min value:
-#define _mlibMinofSigned(V) ((0 & (V)) - (UINTMAX_C (1) << ((sizeof (V) * CHAR_BIT) - 1)))
+#define _mlibMinofSigned(V) \
+   /* NOLINTNEXTLINE(bugprone-sizeof-expression) */ \
+   (0 - mlib_bits(1, mlib_bitsizeof(V) - 1u))
 // For completeness:
 #define _mlibMinofUnsigned(V) 0
 // Yields true iff the operand expression has a signed type, but requires that
@@ -268,7 +263,7 @@ static inline bool (mlib_add) (uintmax_t
    // Perform regular wrapping arithmetic on the unsigned value. The bit pattern
    // is equivalent if there is two's complement signed arithmetic.
    const uintmax_t sum = *dst = a + b;
-   const uintmax_t signbit = (UINTMAX_C (1) << ((sizeof (intmax_t) * CHAR_BIT) - 1));
+   const uintmax_t signbit = mlib_bits (1, mlib_bitsizeof (uintmax_t) - 1u);
    // Now we check whether that overflowed according to the sign configuration.
    // We use some bit fiddling magic that treat the signbit as a boolean for
    // "is this number negative?" or "is this number “large” (i.e. bigger than signed-max)?"
@@ -280,9 +275,9 @@ static inline bool (mlib_add) (uintmax_t
             // Expanded:
             // Test whether the product sign is unequal to both input signs
             // X ^ Y yields a negative value if the signs are unequal
-            const bool a_signflipped = (intmax_t) (sum ^ a) < 0;
-            const bool b_signflipped = (intmax_t) (sum ^ b) < 0;
-            return a_signflipped && b_signflipped;
+            //     const bool a_signflipped = (intmax_t) (sum ^ a) < 0;
+            //     const bool b_signflipped = (intmax_t) (sum ^ b) < 0;
+            //     return a_signflipped && b_signflipped;
          } else { // S = S + U
             // Flip the sign bit of a, test whether that sum overflows
             a ^= signbit;
@@ -303,49 +298,48 @@ static inline bool (mlib_add) (uintmax_t
          if (b_signed) { // U = S + S
             return signbit & (((sum | a) & b) | ((sum & a) & ~b));
             // Expanded:
-            const bool a_is_negative = (intmax_t) a < 0;
-            const bool b_is_negative = (intmax_t) b < 0;
-            const bool sum_is_large = sum > INTMAX_MAX;
-            if (b_is_negative) {
-               if (a_is_negative) {
-                  // The sum must be negative, and therefore cannot be stored in an unsigned
-                  return true;
-               } else if (sum_is_large) {
-                  // We added a negative value B to a positive value A, but the sum
-                  // ended up larger than the max signed value, so we wrapped
-                  return true;
-               }
-            } else if (a_is_negative) {
-               if (sum_is_large) {
-                  // Same as above case with sum_is_large
-                  return true;
-               }
-            }
-            return false;
+            //     const bool a_is_negative = (intmax_t) a < 0;
+            //     const bool b_is_negative = (intmax_t) b < 0;
+            //     const bool sum_is_large = sum > INTMAX_MAX;
+            //     if (b_is_negative) {
+            //        if (a_is_negative) {
+            //           // The sum must be negative, and therefore cannot be stored in an unsigned
+            //           return true;
+            //        } else if (sum_is_large) {
+            //           // We added a negative value B to a positive value A, but the sum
+            //           // ended up larger than the max signed value, so we wrapped
+            //           return true;
+            //        }
+            //     } else if (a_is_negative) {
+            //        if (sum_is_large) {
+            //           // Same as above case with sum_is_large
+            //           return true;
+            //        }
+            //     }
+            //     return false;
          } else { // U = S + U
             return signbit & (sum ^ a ^ signbit) & (sum ^ b);
             // Expanded:
-            const bool sum_is_large = sum > INTMAX_MAX;
-            const bool b_is_large = b > INTMAX_MAX;
-            const bool a_is_negative = (intmax_t) a < 0;
-
-            if (!a_is_negative && b_is_large) {
-               // We are adding a non-negative value to a large number, so the
-               // sum must also be large
-               if (!sum_is_large) {
-                  // We ended up with a smaller value, meaning that we must have wrapped
-                  return true;
-               }
-            }
-            if (a_is_negative && !b_is_large) {
-               // We subtracted a non-negative value from a non-large number, so
-               // the result should not be large
-               if (sum_is_large) {
-                  // We ended up with a large value, so we must have wrapped
-                  return true;
-               }
-            }
-            return false;
+            //     const bool sum_is_large = sum > INTMAX_MAX;
+            //     const bool b_is_large = b > INTMAX_MAX;
+            //     const bool a_is_negative = (intmax_t) a < 0;
+            //     if (!a_is_negative && b_is_large) {
+            //        // We are adding a non-negative value to a large number, so the
+            //        // sum must also be large
+            //        if (!sum_is_large) {
+            //           // We ended up with a smaller value, meaning that we must have wrapped
+            //           return true;
+            //        }
+            //     }
+            //     if (a_is_negative && !b_is_large) {
+            //        // We subtracted a non-negative value from a non-large number, so
+            //        // the result should not be large
+            //        if (sum_is_large) {
+            //           // We ended up with a large value, so we must have wrapped
+            //           return true;
+            //        }
+            //     }
+            //     return false;
          }
       } else {
          if (b_signed) { // U = U + S  --- (See [U = S + U] for an explanation)
@@ -363,7 +357,7 @@ static inline bool (mlib_sub) (uintmax_t
 {
    // Perform the subtraction using regular wrapping arithmetic
    const uintmax_t diff = *dst = a - b;
-   const uintmax_t signbit = (UINTMAX_C (1) << ((sizeof (intmax_t) * CHAR_BIT) - 1));
+   const uintmax_t signbit = mlib_bits (1, mlib_bitsizeof (uintmax_t) - 1u);
    // Test whether the operation overflowed for the given sign configuration
    // (See mlib_add for more details on why we do this bit fiddling)
    if (dst_signed) {
@@ -372,18 +366,18 @@ static inline bool (mlib_sub) (uintmax_t
          if (b_signed) { // S = S - S
             return signbit & (a ^ b) & (diff ^ a);
             // Explain:
-            const bool a_is_negative = (intmax_t) a < 0;
-            const bool b_is_negative = (intmax_t) b < 0;
-            if (a_is_negative != b_is_negative) {
-               // Given: Pos - Neg = Pos
-               //      ∧ Neg - Pos = Neg
-               // We expect that the difference preserves the sign of the minuend
-               if (diff_is_negative != a_is_negative) {
-                  return true;
-               }
-            }
-            // Otherwise, `Pos - Pos` and `Neg - Neg` cannot possibly overflow
-            return false;
+            //     const bool a_is_negative = (intmax_t) a < 0;
+            //     const bool b_is_negative = (intmax_t) b < 0;
+            //     if (a_is_negative != b_is_negative) {
+            //        // Given: Pos - Neg = Pos
+            //        //      ∧ Neg - Pos = Neg
+            //        // We expect that the difference preserves the sign of the minuend
+            //        if (diff_is_negative != a_is_negative) {
+            //           return true;
+            //        }
+            //     }
+            //     // Otherwise, `Pos - Pos` and `Neg - Neg` cannot possibly overflow
+            //     return false;
          } else { // S = S - U
             // The diff overflows if the sign-bit-flipped minuend is smaller than the subtrahend
             return (a ^ signbit) < b;
@@ -402,29 +396,29 @@ static inline bool (mlib_sub) (uintmax_t
          if (b_signed) { // U = S - S
             return signbit & (((diff & a) & b) | ((diff | a) & ~b));
             // Expanded:
-            const bool a_is_negative = (intmax_t) a < 0;
-            const bool b_is_negative = (intmax_t) b < 0;
-            const bool diff_is_large = diff > INTMAX_MAX;
-            if (!b_is_negative) {
-               if (a_is_negative) {
-                  // We subtracted a non-negative from a negative value, so the difference
-                  // must be negative and cannot be stored as unsigned
-                  return true;
-               }
-               if (diff_is_large) {
-                  // We subtracted a positive value from a signed value, so we must not
-                  // end up with a large value
-                  return true;
-               }
-            }
-            if (a_is_negative) {
-               if (diff_is_large) {
-                  // A is negative, and there is no possible value that we can subtract
-                  // from it to obtain this large integer, so we must have overflowed
-                  return true;
-               }
-            }
-            return false;
+            //     const bool a_is_negative = (intmax_t) a < 0;
+            //     const bool b_is_negative = (intmax_t) b < 0;
+            //     const bool diff_is_large = diff > INTMAX_MAX;
+            //     if (!b_is_negative) {
+            //        if (a_is_negative) {
+            //           // We subtracted a non-negative from a negative value, so the difference
+            //           // must be negative and cannot be stored as unsigned
+            //           return true;
+            //        }
+            //        if (diff_is_large) {
+            //           // We subtracted a positive value from a signed value, so we must not
+            //           // end up with a large value
+            //           return true;
+            //        }
+            //     }
+            //     if (a_is_negative) {
+            //        if (diff_is_large) {
+            //           // A is negative, and there is no possible value that we can subtract
+            //           // from it to obtain this large integer, so we must have overflowed
+            //           return true;
+            //        }
+            //     }
+            //     return false;
          } else { //
             return (b > a) || (signbit & a);
          }
@@ -432,26 +426,26 @@ static inline bool (mlib_sub) (uintmax_t
          if (b_signed) { // U = U - S
             return signbit & (a ^ b ^ signbit) & (diff ^ a);
             // Explain:
-            const bool a_is_large = a > INTMAX_MAX;
-            const bool b_is_negative = (intmax_t) b < 0;
-            const bool diff_is_large = diff > INTMAX_MAX;
-            if (a_is_large && b_is_negative) {
-               // The difference between a large value and a negative
-               // value must also be a large value
-               if (!diff_is_large) {
-                  // We expected another large value to appear.
-                  return true;
-               }
-            }
-            if (!a_is_large && !b_is_negative) {
-               // The difference between a non-large positive value and a non-negative value
-               // must not be a large value
-               if (diff_is_large) {
-                  // We did not expect a large difference
-                  return true;
-               }
-            }
-            return false;
+            //     const bool a_is_large = a > INTMAX_MAX;
+            //     const bool b_is_negative = (intmax_t) b < 0;
+            //     const bool diff_is_large = diff > INTMAX_MAX;
+            //     if (a_is_large && b_is_negative) {
+            //        // The difference between a large value and a negative
+            //        // value must also be a large value
+            //        if (!diff_is_large) {
+            //           // We expected another large value to appear.
+            //           return true;
+            //        }
+            //     }
+            //     if (!a_is_large && !b_is_negative) {
+            //        // The difference between a non-large positive value and a non-negative value
+            //        // must not be a large value
+            //        if (diff_is_large) {
+            //           // We did not expect a large difference
+            //           return true;
+            //        }
+            //     }
+            //     return false;
          } else {
             return a < b;
          }
@@ -464,7 +458,7 @@ static inline bool (mlib_mul) (uintmax_t
    mlib_noexcept
 {
    // Multiplication is a lot more subtle
-   const uintmax_t signbit = (UINTMAX_C (1) << ((sizeof (intmax_t) * CHAR_BIT) - 1));
+   const uintmax_t signbit = mlib_bits (1, mlib_bitsizeof (uintmax_t) - 1u);
    if (dst_signed) {
       if (a_signed) {
          if (b_signed) {
@@ -580,7 +574,7 @@ _mlib_ckdint (void *dst,
 {
    // Perform the arithmetic on uintmax_t, for wrapping behavior
    uintmax_t tmp;
-   bool ovr = fn (&tmp, minval < 0, a.is_signed, a.i.u, b.is_signed, b.i.u);
+   bool ovr = fn (&tmp, minval < 0, a.is_signed, a.bits.as_unsigned, b.is_signed, b.bits.as_unsigned);
    // Endian-adjusting for writing the result
    const char *copy_from = (const char *) &tmp;
    if (!mlib_is_little_endian ()) {
@@ -655,7 +649,7 @@ _mlib_checked_cast (intmax_t min_,
                   here.lineno,
                   here.func,
                   expr,
-                  (long long) val.i.s,
+                  (long long) val.bits.as_signed,
                   typename_);
       } else {
          fprintf (stderr,
@@ -664,16 +658,16 @@ _mlib_checked_cast (intmax_t min_,
                   here.lineno,
                   here.func,
                   expr,
-                  (unsigned long long) val.i.u,
+                  (unsigned long long) val.bits.as_unsigned,
                   typename_);
       }
       fflush (stderr);
       abort ();
    }
    if (val.is_signed) {
-      return (uintmax_t) val.i.s;
+      return (uintmax_t) val.bits.as_signed;
    }
-   return val.i.u;
+   return val.bits.as_unsigned;
 }
 
 mlib_extern_c_end ();
diff -pruN 2.0.2-1/src/common/src/mlib/ckdint.test.cpp 2.1.0-1/src/common/src/mlib/ckdint.test.cpp
--- 2.0.2-1/src/common/src/mlib/ckdint.test.cpp	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/common/src/mlib/ckdint.test.cpp	2025-08-14 18:37:23.000000000 +0000
@@ -1,9 +1,10 @@
-#include <mlib/test.h>
 #include <mlib/ckdint.h>
 
+#include <mlib/test.h>
+
 #include <cstdlib>
-#include <limits>
 #include <initializer_list>
+#include <limits>
 
 #define have_ckdint_builtins() 0
 // Check for the stdckdint builtins, but don't use Clang, as it has bugs on some platforms.
diff -pruN 2.0.2-1/src/common/src/mlib/cmp.h 2.1.0-1/src/common/src/mlib/cmp.h
--- 2.0.2-1/src/common/src/mlib/cmp.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/common/src/mlib/cmp.h	2025-08-14 18:37:23.000000000 +0000
@@ -46,9 +46,6 @@ enum mlib_cmp_result {
 /**
  * @brief Compare two integral values safely.
  *
- * NOTE: This macro may evaluate the operand expressions more than once! Do not
- * use expressions that are expensive or have side effects!
- *
  * This function can be called with two arguments or with three:
  *
  * - `mlib_cmp(a, b)` Returns a value of type `mlib_cmp_result`
@@ -80,32 +77,32 @@ mlib_always_inline static enum mlib_cmp_
    if (x.is_signed) {
       if (y.is_signed) {
          // Both signed
-         if (x.i.s < y.i.s) {
+         if (x.bits.as_signed < y.bits.as_signed) {
             return mlib_less;
-         } else if (x.i.s > y.i.s) {
+         } else if (x.bits.as_signed > y.bits.as_signed) {
             return mlib_greater;
          }
       } else {
          // X signed, Y unsigned
-         if (x.i.s < 0 || (uintmax_t) x.i.s < y.i.u) {
+         if (x.bits.as_signed < 0 || (uintmax_t) x.bits.as_signed < y.bits.as_unsigned) {
             return mlib_less;
-         } else if ((uintmax_t) x.i.s > y.i.u) {
+         } else if ((uintmax_t) x.bits.as_signed > y.bits.as_unsigned) {
             return mlib_greater;
          }
       }
    } else {
       if (!y.is_signed) {
          // Both unsigned
-         if (x.i.u < y.i.u) {
+         if (x.bits.as_unsigned < y.bits.as_unsigned) {
             return mlib_less;
-         } else if (x.i.u > y.i.u) {
+         } else if (x.bits.as_unsigned > y.bits.as_unsigned) {
             return mlib_greater;
          }
       } else {
          // X unsigned, Y signed
-         if (y.i.s < 0 || x.i.u > (uintmax_t) y.i.s) {
+         if (y.bits.as_signed < 0 || x.bits.as_unsigned > (uintmax_t) y.bits.as_signed) {
             return mlib_greater;
-         } else if (x.i.u < (uintmax_t) y.i.s) {
+         } else if (x.bits.as_unsigned < (uintmax_t) y.bits.as_signed) {
             return mlib_less;
          }
       }
@@ -126,9 +123,9 @@ mlib_always_inline static enum mlib_cmp_
 static inline bool (mlib_in_range) (intmax_t min_, uintmax_t max_, struct mlib_upsized_integer val) mlib_noexcept
 {
    if (val.is_signed) {
-      return mlib_cmp (val.i.s, >=, min_) && mlib_cmp (val.i.s, <=, max_);
+      return mlib_cmp (val.bits.as_signed, >=, min_) && mlib_cmp (val.bits.as_signed, <=, max_);
    } else {
-      return mlib_cmp (val.i.u, >=, min_) && mlib_cmp (val.i.u, <=, max_);
+      return mlib_cmp (val.bits.as_unsigned, >=, min_) && mlib_cmp (val.bits.as_unsigned, <=, max_);
    }
 }
 
diff -pruN 2.0.2-1/src/common/src/mlib/config.h 2.1.0-1/src/common/src/mlib/config.h
--- 2.0.2-1/src/common/src/mlib/config.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/common/src/mlib/config.h	2025-08-14 18:37:23.000000000 +0000
@@ -245,29 +245,35 @@
 #define mlib_pragma(...) _Pragma (#__VA_ARGS__) mlib_static_assert (1, "")
 #endif
 
+#define MLIB_PRAGMA_IF_CLANG(...) MLIB_IF_CLANG (_Pragma (#__VA_ARGS__))
+#define MLIB_PRAGMA_IF_GCC(...) MLIB_IF_GCC (_Pragma (#__VA_ARGS__))
+#define MLIB_PRAGMA_IF_GNU_LIKE(...) MLIB_IF_GNU_LIKE (_Pragma (#__VA_ARGS__))
+#define MLIB_PRAGMA_IF_UNIX_LIKE(...) MLIB_IF_UNIX_LIKE (_Pragma (#__VA_ARGS__))
+#define MLIB_PRAGMA_IF_MSVC(...) MLIB_IF_MSVC (__pragma (__VA_ARGS__))
+
 #define MLIB_FUNC MLIB_IF_GNU_LIKE (__func__) MLIB_IF_MSVC (__FUNCTION__)
 
 #define mlib_diagnostic_push()                           \
    MLIB_IF_GNU_LIKE (mlib_pragma (GCC diagnostic push);) \
    MLIB_IF_MSVC (mlib_pragma (warning (push));)          \
-   mlib_static_assert (true, "")
+   mlib_static_assert (1, "")
 
 #define mlib_diagnostic_pop()                           \
    MLIB_IF_GNU_LIKE (mlib_pragma (GCC diagnostic pop);) \
    MLIB_IF_MSVC (mlib_pragma (warning (pop));)          \
-   mlib_static_assert (true, "")
+   mlib_static_assert (1, "")
 
 #define mlib_gcc_warning_disable(Warning)                      \
    MLIB_IF_GCC (mlib_pragma (GCC diagnostic ignored Warning);) \
-   mlib_static_assert (true, "")
+   mlib_static_assert (1, "")
 
 #define mlib_gnu_warning_disable(Warning)                           \
    MLIB_IF_GNU_LIKE (mlib_pragma (GCC diagnostic ignored Warning);) \
-   mlib_static_assert (true, "")
+   mlib_static_assert (1, "")
 
 #define mlib_msvc_warning(...)                         \
    MLIB_IF_MSVC (mlib_pragma (warning (__VA_ARGS__));) \
-   mlib_static_assert (true, "")
+   mlib_static_assert (1, "")
 
 /**
  * @brief Attribute macro that forces the function to be inlined at all call sites.
@@ -350,4 +356,16 @@
  */
 #define mlib_typeof(...) MLIB_IF_ELSE (mlib_have_typeof ()) (__typeof__) (__mlib_typeof_is_not_supported) (__VA_ARGS__)
 
+/**
+ * @brief Disable warnings for constant conditional expressions.
+ */
+#define mlib_disable_constant_conditional_expression_warnings() mlib_msvc_warning (disable : 4127)
+
+/**
+ * @brief Disable warnings for potentially unused parameters.
+ */
+#define mlib_disable_unused_parameter_warnings()                       \
+   MLIB_IF_GNU_LIKE (mlib_gnu_warning_disable ("-Wunused-parameter");) \
+   MLIB_IF_MSVC (mlib_msvc_warning (disable : 4100);) mlib_static_assert (1, "")
+
 #endif // MLIB_CONFIG_H_INCLUDED
diff -pruN 2.0.2-1/src/common/src/mlib/intencode.h 2.1.0-1/src/common/src/mlib/intencode.h
--- 2.0.2-1/src/common/src/mlib/intencode.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/common/src/mlib/intencode.h	2025-08-14 18:37:23.000000000 +0000
@@ -21,8 +21,11 @@
 
 #include <mlib/config.h>
 #include <mlib/loop.h>
+#include <mlib/str.h>
 
+#include <errno.h>
 #include <stdint.h>
+#include <stdlib.h>
 #include <string.h>
 
 /**
@@ -165,3 +168,183 @@ mlib_write_f64le (void *out, double d)
    memcpy (&bits, &d, sizeof d);
    return mlib_write_u64le (out, bits);
 }
+
+/**
+ * @brief Decode a 64-bit natural number
+ *
+ * @param in The input string to be decoded. Does not support a sign or base prefix!
+ * @param base The base to be decoded. Must not be zero!
+ * @param out Pointer that receives the decoded value
+ * @return int A result code for the operation.
+ *
+ * See `mlib_i64_parse` for more details.
+ */
+static inline int
+mlib_nat64_parse (mstr_view in, unsigned base, uint64_t *out)
+{
+   if (in.len == 0) {
+      // Empty string is not valid
+      return EINVAL;
+   }
+
+   // Accummulate into this value:
+   uint64_t value = 0;
+   // Whether any operation in the parse overflowed the integer value
+   bool did_overflow = false;
+   // Loop until we have consumed the full string, or encounter an invalid digit
+   while (in.len) {
+      // Shift place value for another digit
+      did_overflow = mlib_mul (&value, base) || did_overflow;
+      // Case-fold for alpha digits
+      int32_t digit = mlib_latin_tolower (in.data[0]);
+      unsigned digit_value = 0;
+      // Only standard digits
+      if (digit >= '0' && digit <= '9') {
+         // Normal digit
+         digit_value = (unsigned) (digit - '0');
+      } else if (digit >= 'a' && digit <= 'z') {
+         // Letter digits
+         digit_value = (unsigned) (digit - 'a') + 10;
+      } else {
+         // Not a valid alnum digit
+         return EINVAL;
+      }
+      if (digit_value >= base) {
+         // The digit value is out-of-range for our chosen base
+         return EINVAL;
+      }
+      // Accumulate the new digit value
+      did_overflow = mlib_add (&value, digit_value) || did_overflow;
+      // Jump to the next digit in the string
+      in = mstr_substr (in, 1);
+   }
+
+   if (did_overflow) {
+      return ERANGE;
+   }
+
+   (void) (out && (*out = value));
+   return 0;
+}
+
+/**
+ * @brief Parse a string as a 64-bit signed integer
+ *
+ * @param in The string of digits to be parsed.
+ * @param base Optional: The base to use for parsing. Use "0" to infer the base.
+ * @param out Optional storage for an int64 value to be updated with the result
+ * @return int Returns an errno value for the parse
+ *
+ * - A value of `0` indicates that the parse was successful.
+ * - A value of `EINVAL` indicates that the input string is not a valid
+ *   representation of an integer.
+ * - A value of `ERANGE` indicates that the input string is a valid integer,
+ *   but the actual encoded value cannot be represented in an `int64_t`
+ * - If the parse fails (returns non-zero), then the value at `*out` will remain
+ *   unmodified.
+ *
+ * This differs from `strtoll` in that it requires that the entire string be
+ * parsed as a valid integer. If parsing stops early, then the result will indicate
+ * an error of EINVAL.
+ */
+static inline int
+mlib_i64_parse (mstr_view in, unsigned base, int64_t *out)
+{
+   if (in.len == 0) {
+      // Empty string is not a valid integer
+      return EINVAL;
+   }
+   // Parse the possible sign prefix
+   int sign = 1;
+   // Check for a "+"
+   if (in.data[0] == '+') {
+      // Just a plus. Drop it and do nothing with it.
+      in = mstr_substr (in, 1);
+   }
+   // Check for a negative prefix
+   else if (in.data[0] == '-') {
+      // Negative sign. We'll negate the value later.
+      in = mstr_substr (in, 1);
+      sign = -1;
+   }
+
+   // Infer the base value, if we have one
+   if (base == 0) {
+      if (in.len && in.data[0] == '0') {
+         if (in.len > 1) {
+            if (mlib_latin_tolower (in.data[1]) == 'x') {
+               // Hexadecimal
+               base = 16;
+               in = mstr_substr (in, 2);
+            } else if (mlib_latin_tolower (in.data[1]) == 'o') {
+               // Octal
+               base = 8;
+               in = mstr_substr (in, 2);
+            } else if (mlib_latin_tolower (in.data[1]) == 'b') {
+               // Binary
+               base = 2;
+               in = mstr_substr (in, 2);
+            }
+         }
+         if (base == 0) {
+            // Other: Octal with a single "0" prefix. Don't trim this, because
+            // it may be a literal "0"
+            base = 8;
+         }
+      } else {
+         // No '0' prefix. Treat it as decimal
+         base = 10;
+      }
+   }
+
+   // Try to parse the natural number now that we have removed all prefixes and
+   // have a non-zero base.
+   uint64_t nat;
+   int rc = mlib_nat64_parse (in, base, &nat);
+   if (rc) {
+      return rc;
+   }
+
+   // Try to narrow from the u64 to i64 and apply the sign. This must be done as
+   // one operation because of the pathological case of parsing INT64_MIN
+   int64_t i64 = 0;
+   if (mlib_mul (&i64, nat, sign)) {
+      return ERANGE;
+   }
+
+   (void) (out && (*out = i64));
+   return 0;
+}
+
+#define mlib_i64_parse(...) MLIB_ARGC_PICK (_mlib_i64_parse, __VA_ARGS__)
+#define _mlib_i64_parse_argc_2(S, Ptr) _mlib_i64_parse_argc_3 ((S), 0, (Ptr))
+#define _mlib_i64_parse_argc_3(S, Base, Ptr) mlib_i64_parse (mstr_view_from ((S)), Base, Ptr)
+
+/**
+ * @brief Parse a 32-bit integer from a string.
+ *
+ * See `mlib_i64_parse` for more details.
+ */
+static inline int
+mlib_i32_parse (mstr_view in, unsigned base, int32_t *out)
+{
+   int64_t tmp;
+   int ec = mlib_i64_parse (in, base, &tmp);
+   if (ec) {
+      // Failed to parse the int64 value.
+      return ec;
+   }
+   // Attempt to narrow to a 32-bit value
+   int32_t i32 = 0;
+   if (mlib_narrow (&i32, tmp)) {
+      // Value is out-of-range
+      return ERANGE;
+   }
+   // Success
+   (void) (out && (*out = i32));
+   return 0;
+}
+
+#define mlib_i32_parse(...) MLIB_ARGC_PICK (_mlib_i32_parse, __VA_ARGS__)
+#define _mlib_i32_parse_argc_2(S, Ptr) _mlib_i32_parse_argc_3 ((S), 0, (Ptr))
+#define _mlib_i32_parse_argc_3(S, Base, Ptr) mlib_i32_parse (mstr_view_from ((S)), Base, Ptr)
diff -pruN 2.0.2-1/src/common/src/mlib/intutil.h 2.1.0-1/src/common/src/mlib/intutil.h
--- 2.0.2-1/src/common/src/mlib/intutil.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/common/src/mlib/intutil.h	2025-08-14 18:37:23.000000000 +0000
@@ -20,9 +20,11 @@
 #ifndef MLIB_INTUTIL_H_INCLUDED
 #define MLIB_INTUTIL_H_INCLUDED
 
+#include <mlib/config.h>
+
 #include <limits.h>
-#include <stdint.h>
 #include <stdbool.h>
+#include <stdint.h>
 
 /**
  * @brief Given an integral type, evaluates to `true` if that type is signed,
@@ -30,15 +32,50 @@
  */
 #define mlib_is_signed(T) (!((T) (-1) > 0))
 
+/**
+ * @brief Like `sizeof`, but returns the number of bits in the object representation
+ */
+#define mlib_bitsizeof(T) ((sizeof (T)) * ((size_t) CHAR_BIT))
+
 // clang-format off
 /**
+ * @brief Generate a mask of contiguous bits.
+ *
+ * @param NumOnes The non-negative number of contiguous 1 bits
+ * @param NumZeros The non-negative number of contiguous 0 bits to set in the low position
+ *
+ * The generated mask is of the form:
+ *
+ *             NumZeros
+ *                 │
+ *                ┌┴─┐
+ *                │  │
+ *     `0..0 1..1 0..0`
+ *           │  │
+ *           └┬─┘
+ *            │
+ *        NumOnes
+ *
+ * Explain the arithmetic below:
+ *
+ * 1. `ones = 0b1111...` : All high bits
+ * 2. `tmp  = ones >> (NumOnes - num_bits_of(ones))` : Truncate to the number of 1s we want
+ * 3. `res  = tmp  << NumZeros` : Add the 0s in the low position
+ */
+#define mlib_bits(NumOnes, NumZeros) ( \
+   ((NumOnes) \
+      ? (~UINTMAX_C(0) >> ((mlib_bitsizeof(uintmax_t) - (uintmax_t)(NumOnes)))) \
+      : 0) \
+   << ((uintmax_t)(NumZeros)))
+
+/**
  * @brief Given an integral type, yield an integral constant value representing
  * the maximal value of that type.
  */
 #define mlib_maxof(T) \
    ((T) (mlib_is_signed (T) \
-        ? ((T) ((((T) 1 << (sizeof (T) * CHAR_BIT - 2)) - 1) * 2 + 1)) \
-        : ((T) ~(T) 0)))
+        ? ((T) mlib_bits(mlib_bitsizeof(T) - 1u, 0)) \
+        : ((T) mlib_bits(mlib_bitsizeof(T),      0))))
 
 /**
  * @brief Given an integral type, yield an integral constant value for the
@@ -47,7 +84,7 @@
 #define mlib_minof(T) \
    ((T) (!mlib_is_signed (T) \
         ? (T) 0 \
-        : (T) (-((((T) 1 << (sizeof (T) * CHAR_BIT - 2)) - 1) * 2 + 1) - 1)))
+        : (T) mlib_bits(1, mlib_bitsizeof(T) - 1u)))
 // clang-format on
 
 /**
@@ -58,11 +95,11 @@
 typedef struct mlib_upsized_integer {
    union {
       // The signed value of the integer
-      intmax_t s;
+      intmax_t as_signed;
       // The unsigned value of the integer
-      uintmax_t u;
-   } i;
-   // Whether the upscaled integer is stored in the signed field or the unsigned field
+      uintmax_t as_unsigned;
+   } bits;
+   // Whether the upscaled integer bits should be treated as a two's complement signed integer
    bool is_signed;
 } mlib_upsized_integer;
 
@@ -78,16 +115,31 @@ typedef struct mlib_upsized_integer {
  * an i64 losslessly.
  *
  * If the integer to upcast is the same size as `intmax_t`, we need to decide whether to store
- * it as unsigned. The expression `(0 & Value) - 1 < 0` will be `true` iff the operand is signed,
+ * it as unsigned. The expression `(_mlibGetOne(Value)) - 2 < 1` will be `true` iff the operand is signed,
  * otherwise false. If the operand is signed, we can safely cast to `intmax_t` (it probably already
- * is of that type), otherwise, we can to `uintmax_t` and the returned `mlib_upsized_integer` will
- * indicate that the stored value is unsigned.
+ * is of that type), otherwise, we cast to `uintmax_t` and the returned `mlib_upsized_integer` will
+ * indicate that the stored value is unsigned. The expression `1 - 2 < 1` is chosen
+ * to avoid `-Wtype-limits` warnings from some compilers about unsigned comparison.
  */
 #define mlib_upsize_integer(Value) \
+   mlib_upsize_integer((uintmax_t)(intmax_t)((Value)), _mlibShouldTreatBitsAsSigned(Value))
+#define _mlibShouldTreatBitsAsSigned(Value) \
    /* NOLINTNEXTLINE(bugprone-sizeof-expression) */ \
-   ((sizeof ((Value)) < sizeof (intmax_t) || ((0 & (Value)) - 1) < 0) \
-      ? mlib_init(mlib_upsized_integer) {{(intmax_t) (Value)}, true} \
-      : mlib_init(mlib_upsized_integer) {{(intmax_t) (uintmax_t) (Value)}})
+   (sizeof ((Value)) < sizeof (intmax_t) || (_mlibGetOne(Value) - 2) < _mlibGetOne(Value))
+// Yield a 1 value of similar-ish type to the given expression. The ternary
+// forces an integer promotion of literal 1 match the type of `V`, while leaving
+// `V` unevaluated. Note that this will also promote `V` to be at least `(unsigned) int`,
+// so the 1 value is only "similar" to `V`, and may be of a larger type
+#define _mlibGetOne(V) (1 ? 1 : (V))
+// Function impl for upsize_integer
+static inline mlib_upsized_integer
+(mlib_upsize_integer) (uintmax_t bits, bool treat_as_signed)
+{
+   mlib_upsized_integer ret;
+   ret.bits.as_unsigned = bits;
+   ret.is_signed = treat_as_signed;
+   return ret;
+}
 // clang-format on
 
 #endif // MLIB_INTUTIL_H_INCLUDED
diff -pruN 2.0.2-1/src/common/src/mlib/str.h 2.1.0-1/src/common/src/mlib/str.h
--- 2.0.2-1/src/common/src/mlib/str.h	1970-01-01 00:00:00.000000000 +0000
+++ 2.1.0-1/src/common/src/mlib/str.h	2025-08-14 18:37:23.000000000 +0000
@@ -0,0 +1,569 @@
+/**
+ * @file mlib/str.h
+ * @brief String handling utilities
+ * @date 2025-04-30
+ *
+ * This file provides utilities for handling *sized* strings. That is, strings
+ * that carry their size, and do not rely on null termination. These APIs also
+ * do a lot more bounds checking than is found in `<string.h>`.
+ *
+ * @copyright Copyright 2009-present MongoDB, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#ifndef MLIB_STR_H_INCLUDED
+#define MLIB_STR_H_INCLUDED
+
+#include <mlib/ckdint.h>
+#include <mlib/cmp.h>
+#include <mlib/config.h>
+#include <mlib/intutil.h>
+#include <mlib/loop.h>
+#include <mlib/test.h>
+
+#include <stdbool.h>
+#include <stddef.h>
+
+/**
+ * @brief A simple non-owning string-view type.
+ *
+ * The viewed string can be treated as an array of `char`. It's pointed-to data
+ * must not be freed or manipulated.
+ *
+ * @note The viewed string is NOT guaranteed to be null-terminated. It WILL
+ * be null-terminated if: Directly created from a string literal, a C string, or
+ * a null-terminated `mstr_view`.
+ * @note The viewed string MAY contain nul (zero-value) characters, so using them
+ * with C string APIs could truncate unexpectedly.
+ * @note The view itself may be "null" if the `data` member of the string view
+ * is a null pointer. A zero-initialized `mstr_view` is null.
+ */
+typedef struct mstr_view {
+   /**
+    * @brief Pointer to the string data viewed by this object.
+    *
+    * - This pointer may be null, in which case the string view itself is "null".
+    * - If `len > 1`, then this points to a contiguous array of `char` of length
+    *   `len`.
+    * - If `len == 1`, then this *may* point to a single `char` object.
+    * - The pointed-to string might not be a null-terminated C string. Accessing
+    *   the `char` value at `data[len]` is undefined behavior.
+    */
+   const char *data;
+   /**
+    * @brief The length of the viewed string pointed-to by `data`
+    *
+    * If `data` points to a single `char` object, then this must be `1`. If
+    * `data` is a null pointer, then this value should be zero.
+    */
+   size_t len;
+} mstr_view;
+
+/**
+ * @brief Expand to the two printf format arguments required to format an mstr object
+ *
+ * You should use the format specifier `%.*s' for all mstr strings.
+ *
+ * This is just a convenience shorthand.
+ */
+#define MSTR_FMT(S) (int) mstr_view_from (S).len, mstr_view_from (S).data
+
+/**
+ * @brief Create an `mstr_view` that views the given array of `char`
+ *
+ * @param data Pointer to the beginning of the string, or pointer to a single
+ * `char`, or a null pointer
+ * @param len Length of the new string-view. If `data` points to a single `char`,
+ * this must be `0` or `1`. If `data` is a null pointer, this should be `0`.
+ *
+ * @note This is defined as a macro that expands to a compound literal to prevent
+ * proliferation of redundant function calls in debug builds.
+ */
+#define mstr_view_data(DataPointer, Length) (mlib_init (mstr_view){(DataPointer), (Length)})
+
+#if 1 // See "!! NOTE" below
+
+/**
+ * @brief Coerce a string-like object to an `mstr_view` of that string
+ *
+ * This macro requires that the object have `.data` and `.len` members.
+ *
+ * @note This macro will double-evaluate its argument.
+ */
+#define mstr_view_from(X) mstr_view_data ((X).data, (X).len)
+
+/**
+ * ! NOTE: The disabled snippet below is kept for posterity as a drop-in replacment
+ * ! for mstr_view_from with support for _Generic.
+ *
+ * When we can increase the compiler requirements to support _Generic, the following
+ * macro definition alone makes almost every function in this file significantly
+ * more concise to use, as it allows us to pass a C string to any API that
+ * expects an `mstr_view`, enabling code like this:
+ *
+ * ```
+ * mstr s = get_string();
+ * if (mstr_cmp(s, ==, "magicKeyword")) {
+ *    Do something...
+ * }
+ * ```
+ *
+ * This also allows us to avoid the double-evaluation problem presented by
+ * `mstr_view_from` being defined as above.
+ *
+ * Without _Generic, we require all C strings to be wrapped with `mstr_cstring`,
+ * which isn't especially onerous, but it is annoying. Additionally, the below
+ * `_Generic` macro can be extended to support more complex string-like types.
+ *
+ * For reference, support for _Generic requires the following compilers:
+ *
+ * - MSVC 19.28.0+ (VS 2019, 16.8.1)
+ * - GCC 4.9+
+ * - Clang 3.0+
+ */
+
+#else
+
+/**
+ * @brief Coerce an object to an `mstr_view`
+ *
+ * The object requires a `data` and `len` member
+ */
+#define mstr_view_from(X) \
+   _Generic ((X), mstr_view: _mstr_view_trivial_copy, char *: mstr_cstring, const char *: mstr_cstring) ((X))
+// Just copy an mstr_view by-value
+static inline mstr_view
+_mstr_view_trivial_copy (mstr_view s)
+{
+   return s;
+}
+
+#endif
+
+
+/**
+ * @brief Create an `mstr_view` referring to the given null-terminated C string
+ *
+ * @param s Pointer to a C string. The length of the returned string is infered using `strlen`
+ *
+ * This should not defined as a macro, because defining it as a macro would require
+ * double-evaluating for the call to `strlen`.
+ */
+static inline mstr_view
+mstr_cstring (const char *s)
+{
+   const size_t l = strlen (s);
+   return mstr_view_data (s, l);
+}
+
+/**
+ * @brief Compare two strings lexicographically by each code unit
+ *
+ * If called with two arguments behaves the same as `strcmp`. If called with
+ * three arguments, the center argument should be an infix operator to perform
+ * the semantic comparison.
+ */
+static inline enum mlib_cmp_result
+mstr_cmp (mstr_view a, mstr_view b)
+{
+   size_t l = a.len;
+   if (b.len < l) {
+      l = b.len;
+   }
+   // Use `memcmp`, not `strncmp`: We want to respect nul characters
+   int r = memcmp (a.data, b.data, l);
+   if (r) {
+      // Not equal: Compare with zero to normalize to the cmp_result value
+      return mlib_cmp (r, 0);
+   }
+   // Same prefixes, the ordering is now based on their length (longer string > shorter string)
+   return mlib_cmp (a.len, b.len);
+}
+
+#define mstr_cmp(...) MLIB_ARGC_PICK (_mstr_cmp, __VA_ARGS__)
+#define _mstr_cmp_argc_2(A, B) mstr_cmp (mstr_view_from (A), mstr_view_from (B))
+#define _mstr_cmp_argc_3(A, Op, B) (_mstr_cmp_argc_2 (A, B) Op 0)
+
+/**
+ * @brief If the given codepoint is a Basic Latin (ASCII) uppercase character,
+ * return the lowercase character. Other codepoint values are returned unchanged.
+ *
+ * This is safer than `tolower`, because it doesn't respect locale and has no
+ * undefined behavior.
+ */
+static inline int32_t
+mlib_latin_tolower (int32_t a)
+{
+   if (a >= 0x41 /* "A" */ && a <= 0x5a /* "Z" */) {
+      a += 0x20; // Adjust from "A" -> "a"
+   }
+   return a;
+}
+
+/**
+ * @brief Compare two individual codepoint values, with case-insensitivity in
+ * the Basic Latin range.
+ */
+static inline enum mlib_cmp_result
+mlib_latin_charcasecmp (int32_t a, int32_t b)
+{
+   return mlib_cmp (mlib_latin_tolower (a), mlib_latin_tolower (b));
+}
+
+/**
+ * @brief Compare two strings lexicographically, case-insensitive in the Basic
+ * Latin range.
+ *
+ * If called with two arguments, behaves the same as `strcasecmp`. If called with
+ * three arguments, the center argument should be an infix operator to perform
+ * the semantic comparison.
+ */
+static inline enum mlib_cmp_result
+mstr_latin_casecmp (mstr_view a, mstr_view b)
+{
+   size_t l = a.len;
+   if (b.len < l) {
+      l = b.len;
+   }
+   mlib_foreach_urange (i, l) {
+      // We don't need to do any UTF-8 decoding, because our case insensitivity
+      // only activates for 1-byte encoded codepoints, and all other valid UTF-8
+      // sequences will collate equivalently with byte-wise comparison to a UTF-32
+      // encoding.
+      enum mlib_cmp_result r = mlib_latin_charcasecmp (a.data[i], b.data[i]);
+      if (r) {
+         // Not equivalent at this code unit. Return this as the overall string ordering.
+         return r;
+      }
+   }
+   // Same prefixes, the ordering is now based on their length (longer string > shorter string)
+   return mlib_cmp (a.len, b.len);
+}
+
+#define mstr_latin_casecmp(...) MLIB_ARGC_PICK (_mstr_latin_casecmp, __VA_ARGS__)
+#define _mstr_latin_casecmp_argc_2(A, B) mstr_latin_casecmp (mstr_view_from (A), mstr_view_from (B))
+#define _mstr_latin_casecmp_argc_3(A, Op, B) (_mstr_latin_casecmp_argc_2 (A, B) Op 0)
+
+/**
+ * @brief Adjust a possibly negative index position to wrap around for a string
+ *
+ * @param s The string to be respected for index wrapping
+ * @param pos The maybe-negative index to be adjusted
+ * @param clamp_to_length If `true` and given a non-negative value, if that
+ * value is greater than the string length, this function will return the string
+ * length instead.
+ * @return size_t The new zero-based non-negative index
+ *
+ * If `pos` is negative, then it represents indexing from the end of the string,
+ * where `-1` refers to the last character in the string, `-2` the penultimate,
+ * etc. If the absolute value is greater than the length of the string, the
+ * program will be terminated.
+ */
+static inline size_t
+_mstr_adjust_index (mstr_view s, mlib_upsized_integer pos, bool clamp_to_length)
+{
+   if (clamp_to_length && (mlib_cmp) (pos, mlib_upsize_integer (s.len), 0) == mlib_greater) {
+      // We want to clamp to the length, and the given value is greater than the string length.
+      return s.len;
+   }
+   if (pos.is_signed && pos.bits.as_signed < 0) {
+      // This will add the negative value to the length of the string. If such
+      // an operation would result a negative value, this will terminate the
+      // program.
+      return mlib_assert_add (size_t, s.len, pos.bits.as_signed);
+   }
+   // No special behavior, just assert that the given position is in-bounds for the string
+   mlib_check (
+      pos.bits.as_unsigned <= s.len, because, "the string position index must not be larger than the string length");
+   return pos.bits.as_unsigned;
+}
+
+/**
+ * @brief Create a new `mstr_view` that views a substring within another string
+ *
+ * @param s The original string view to be inspected
+ * @param pos The number of `char` to skip in `s`, or a negative value to
+ * pos from the end of the string.
+ * @param len The length of the new string view (optional, default SIZE_MAX)
+ *
+ * The length of the string view is clamped to the characters available in `s`,
+ * so passing a too-large value for `len` is well-defined. Passing a too-large
+ * value for `pos` will abort the program.
+ *
+ * Callable as:
+ *
+ * - `mstr_substr(s, pos)`
+ * - `mstr_substr(s, pos, len)`
+ */
+static inline mstr_view
+mstr_substr (mstr_view s, mlib_upsized_integer pos_, size_t len)
+{
+   const size_t pos = _mstr_adjust_index (s, pos_, false);
+   // Number of characters in the string after we remove the prefix
+   const size_t remain = s.len - pos;
+   // Clamp the new length to the size that is actually available.
+   if (len > remain) {
+      len = remain;
+   }
+   return mstr_view_data (s.data + pos, len);
+}
+
+#define mstr_substr(...) MLIB_ARGC_PICK (_mstr_substr, __VA_ARGS__)
+#define _mstr_substr_argc_2(Str, Start) _mstr_substr_argc_3 (Str, Start, SIZE_MAX)
+#define _mstr_substr_argc_3(Str, Start, Stop) mstr_substr (mstr_view_from (Str), mlib_upsize_integer (Start), Stop)
+
+/**
+ * @brief Obtain a slice of the given string view, where the two arguments are zero-based indices into the string
+ *
+ * @param s The string to be sliced
+ * @param start The zero-based index of the new string start
+ * @param end The zero-based index of the first character to exclude from the new string
+ *
+ * @note Unlike `substr`, the second argument is required, and must specify the index at which the
+ * string will end, rather than the length of the string.
+ */
+static inline mstr_view
+mstr_slice (const mstr_view s, const mlib_upsized_integer start_, const mlib_upsized_integer end_)
+{
+   const size_t start_pos = _mstr_adjust_index (s, start_, false);
+   const size_t end_pos = _mstr_adjust_index (s, end_, true);
+   mlib_check (end_pos >= start_pos, because, "Slice positions must end after the start position");
+   const size_t sz = (size_t) (end_pos - start_pos);
+   return mstr_substr (s, start_pos, sz);
+}
+#define mstr_slice(S, StartPos, EndPos) \
+   mstr_slice (mstr_view_from (S), mlib_upsize_integer ((StartPos)), mlib_upsize_integer ((EndPos)))
+
+/**
+ * @brief Find the first occurrence of `needle` within `hay`, returning the zero-based index
+ * if found, and `SIZE_MAX` if it is not found.
+ *
+ * @param hay The string which is being scanned
+ * @param needle The substring that we are searching to find
+ * @param pos The start position of the search (optional, default zero)
+ * @param len The number of characters to search in `hay` (optional, default SIZE_MAX)
+ * @return size_t If found, the zero-based index of the first occurrence within
+ *    the string. If not found, returns `SIZE_MAX`.
+ *
+ * The `len` is clamped to the available string length.
+ *
+ * Callable as:
+ *
+ * - `mstr_find(hay, needle)`
+ * - `mstr_find(hay, needle, pos)`
+ * - `mstr_find(hay, needle, pos, len)`
+ */
+static inline size_t
+mstr_find (mstr_view hay, mstr_view const needle, mlib_upsized_integer const pos_, size_t const len)
+{
+   const size_t pos = _mstr_adjust_index (hay, pos_, false);
+   // Trim the hay according to our search window:
+   hay = mstr_substr (hay, pos, len);
+
+   // Larger needle can never exist within the smaller string:
+   if (hay.len < needle.len) {
+      return SIZE_MAX;
+   }
+
+   // Set the index at which we can stop searching early. This will never
+   // overflow, because we guard against hay.len > needle.len
+   size_t stop_idx = hay.len - needle.len;
+   // Use "<=", because we do want to include the final search position
+   for (size_t offset = 0; offset <= stop_idx; ++offset) {
+      if (memcmp (hay.data + offset, needle.data, needle.len) == 0) {
+         // Return the found position. Adjust by the start pos since we may
+         // have trimmed the search window
+         return offset + pos;
+      }
+   }
+
+   // Nothing was found. Return SIZE_MAX to indicate the not-found
+   return SIZE_MAX;
+}
+
+#define mstr_find(...) MLIB_ARGC_PICK (_mstr_find, __VA_ARGS__)
+#define _mstr_find_argc_2(Hay, Needle) _mstr_find_argc_3 (Hay, Needle, 0)
+#define _mstr_find_argc_3(Hay, Needle, Start) _mstr_find_argc_4 (Hay, Needle, Start, SIZE_MAX)
+#define _mstr_find_argc_4(Hay, Needle, Start, Stop) \
+   mstr_find (mstr_view_from (Hay), mstr_view_from (Needle), mlib_upsize_integer (Start), Stop)
+
+/**
+ * @brief Find the zero-based index of the first `char` in `hay` that also occurs in `needles`
+ *
+ * This is different from `find()` because it considers each char in `needles` as an individual
+ * one-character string to be search for in `hay`.
+ *
+ * @param hay The string to be searched
+ * @param needles A string containing a set of characters which are searched for in `hay`
+ * @param pos The index at which to begin searching (optional, default is zero)
+ * @param len The number of characters in `hay` to consider before stopping (optional, default is SIZE_MAX)
+ * @return size_t If a needle is found, returns the zero-based index of that first needle.
+ * Otherwise, returns SIZE_MAX.
+ *
+ * Callable as:
+ *
+ * - `mstr_find_first_of(hay, needles)`
+ * - `mstr_find_first_of(hay, needles, pos)`
+ * - `mstr_find_first_of(hay, needles, pos, len)`
+ */
+static inline size_t
+mstr_find_first_of (mstr_view hay, mstr_view const needles, mlib_upsized_integer const pos_, size_t const len)
+{
+   const size_t pos = _mstr_adjust_index (hay, pos_, false);
+   // Trim to fit the search window
+   hay = mstr_substr (hay, pos, len);
+   // We search by incrementing an index
+   mlib_foreach_urange (idx, hay.len) {
+      // Grab a substring of the single char at the current search index
+      mstr_view one = mstr_substr (hay, idx, 1);
+      // Test if the single char occurs anywhere in the needle set
+      if (mstr_find (needles, one) != SIZE_MAX) {
+         // We found the first index in `hay` where one of the needles occurs. Adjust
+         // by `pos` since we may have trimmed
+         return idx + pos;
+      }
+   }
+   return SIZE_MAX;
+}
+
+#define mstr_find_first_of(...) MLIB_ARGC_PICK (_mstr_find_first_of, __VA_ARGS__)
+#define _mstr_find_first_of_argc_2(Hay, Needle) _mstr_find_first_of_argc_3 (Hay, Needle, 0)
+#define _mstr_find_first_of_argc_3(Hay, Needle, Pos) _mstr_find_first_of_argc_4 (Hay, Needle, Pos, SIZE_MAX)
+#define _mstr_find_first_of_argc_4(Hay, Needle, Pos, Len) \
+   mstr_find_first_of (Hay, Needle, mlib_upsize_integer (Pos), Len)
+
+/**
+ * @brief Split a single string view into two strings at the given position
+ *
+ * @param s The string to be split
+ * @param pos The position at which the prefix string is ended
+ * @param drop [optional] The number of characters to drop between the prefix and suffix
+ * @param prefix [out] Updated to point to the part of the string before the split
+ * @param suffix [out] Updated to point to the part of the string after the split
+ *
+ * `pos` and `drop` are clamped to the size of the input string.
+ *
+ * Callable as:
+ *
+ * - `mstr_split_at(s, pos,       prefix, suffix)`
+ * - `mstr_split_at(s, pos, drop, prefix, suffix)`
+ *
+ * If either `prefix` or `suffix` is a null pointer, then they will be ignored
+ */
+static inline void
+mstr_split_at (mstr_view s, mlib_upsized_integer pos_, size_t drop, mstr_view *prefix, mstr_view *suffix)
+{
+   const size_t pos = _mstr_adjust_index (s, pos_, true /* clamp to the string size */);
+   // Save the prefix string
+   if (prefix) {
+      *prefix = mstr_substr (s, 0, pos);
+   }
+   // Save the suffix string
+   if (suffix) {
+      // The number of characters that remain after the prefix is removed
+      const size_t remain = s.len - pos;
+      // Clamp the number of chars to drop to not overrun the input string
+      if (remain < drop) {
+         drop = remain;
+      }
+      // The start position of the new string
+      const size_t next_start = pos + drop;
+      *suffix = mstr_substr (s, next_start, SIZE_MAX);
+   }
+}
+
+#define mstr_split_at(...) MLIB_ARGC_PICK (_mstr_split_at, __VA_ARGS__)
+#define _mstr_split_at_argc_4(Str, Pos, Prefix, Suffix) _mstr_split_at_argc_5 (Str, Pos, 0, Prefix, Suffix)
+#define _mstr_split_at_argc_5(Str, Pos, Drop, Prefix, Suffix) \
+   mstr_split_at (mstr_view_from (Str), mlib_upsize_integer (Pos), Drop, Prefix, Suffix)
+
+/**
+ * @brief Split a string in two around the first occurrence of some infix string.
+ *
+ * @param s The string to be split in twain
+ * @param infix The infix string to be searched for
+ * @param prefix The part of the string that precedes the infix (nullable)
+ * @param suffix The part of the string that follows the infix (nullable)
+ * @return true If the infix was found
+ * @return false Otherwise
+ *
+ * @note If `infix` does not occur in `s`, then `*prefix` will be set equal to `s`,
+ * and `*suffix` will be made an empty string, as if the infix occurred at the end
+ * of the string.
+ */
+static inline bool
+mstr_split_around (mstr_view s, mstr_view infix, mstr_view *prefix, mstr_view *suffix)
+{
+   // Find the position of the infix. If it is not found, returns SIZE_MAX
+   const size_t pos = mstr_find (s, infix);
+   // Split at the infix, dropping as many characters as are in the infix. If
+   // the `pos` is SIZE_MAX, then this call will clamp to the end of the string.
+   mstr_split_at (s, pos, infix.len, prefix, suffix);
+   // Return `true` if we found the infix, indicated by a not-SIZE_MAX `pos`
+   return pos != SIZE_MAX;
+}
+
+#define mstr_split_around(Str, Infix, PrefixPtr, SuffixPtr) \
+   mstr_split_around (mstr_view_from ((Str)), mstr_view_from ((Infix)), (PrefixPtr), (SuffixPtr))
+
+/**
+ * @brief Test whether the given string starts with the given prefix
+ *
+ * @param str The string to be tested
+ * @param prefix The prefix to be searched for
+ * @return true if-and-only-if `str` starts with `prefix`
+ * @return false Otherwise
+ */
+static inline bool
+mstr_starts_with (mstr_view str, mstr_view prefix)
+{
+   // Trim to match the length of the prefix we want
+   str = mstr_substr (str, 0, prefix.len);
+   // Check if the trimmed string is the same as the prefix
+   return mstr_cmp (str, ==, prefix);
+}
+#define mstr_starts_with(Str, Prefix) mstr_starts_with (mstr_view_from (Str), mstr_view_from (Prefix))
+
+/**
+ * @brief Test whether a substring occurs at any point within the given string
+ *
+ * @param str The string to be inspected
+ * @param needle The substring to be searched for
+ * @return true If-and-only-if `str` contains `needle` at any position
+ * @return false Otherise
+ */
+static inline bool
+mstr_contains (mstr_view str, mstr_view needle)
+{
+   return mstr_find (str, needle) != SIZE_MAX;
+}
+#define mstr_contains(Str, Needle) mstr_contains (mstr_view_from (Str), mstr_view_from (Needle))
+
+/**
+ * @brief Test whether a given string contains any of the characters in some other string
+ *
+ * @param str The string to be inspected
+ * @param needle A string to be treated as a set of one-byte characters to search for
+ * @return true If-and-only-if `str` contains `needle` at any position
+ * @return false Otherise
+ *
+ * @note This function does not currently support multi-byte codepoints
+ */
+static inline bool
+mstr_contains_any_of (mstr_view str, mstr_view needle)
+{
+   return mstr_find_first_of (str, needle) != SIZE_MAX;
+}
+#define mstr_contains_any_of(Str, Needle) mstr_contains_any_of (mstr_view_from (Str), mstr_view_from (Needle))
+
+#endif // MLIB_STR_H_INCLUDED
diff -pruN 2.0.2-1/src/common/src/mlib/test.h 2.1.0-1/src/common/src/mlib/test.h
--- 2.0.2-1/src/common/src/mlib/test.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/common/src/mlib/test.h	2025-08-14 18:37:23.000000000 +0000
@@ -20,13 +20,13 @@
 #pragma once
 
 #include <mlib/cmp.h>
-#include <mlib/intutil.h>
 #include <mlib/config.h>
+#include <mlib/intutil.h>
 
+#include <inttypes.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
-#include <inttypes.h>
 
 /**
  * @brief Place this macro at the head of a (compound) statement to assert that
@@ -145,6 +145,9 @@ typedef struct mlib_source_location {
 #define _mlibCheckCondition_neq(A, B) \
    _mlibCheckIntCmp (                 \
       mlib_equal, false, "!=", mlib_upsize_integer (A), mlib_upsize_integer (B), #A, #B, mlib_this_source_location ())
+// Simple assertion with an explanatory string
+#define _mlibCheckCondition_because(Cond, Msg) \
+   _mlibCheckConditionBecause (Cond, #Cond, Msg, mlib_this_source_location ())
 
 /// Check evaluator when given a single boolean
 static inline void
@@ -157,6 +160,17 @@ _mlibCheckConditionSimple (bool c, const
    }
 }
 
+static inline void
+_mlibCheckConditionBecause (bool cond, const char *expr, const char *reason, mlib_source_location here)
+{
+   if (!cond) {
+      fprintf (
+         stderr, "%s:%d: in [%s]: Check condition ⟨%s⟩ failed (%s)\n", here.file, here.lineno, here.func, expr, reason);
+      fflush (stderr);
+      abort ();
+   }
+}
+
 // Implement integer comparison checks
 static inline void
 _mlibCheckIntCmp (enum mlib_cmp_result cres, // The cmp result to check
@@ -179,16 +193,16 @@ _mlibCheckIntCmp (enum mlib_cmp_result c
                right_expr);
       fprintf (stderr, "    ");
       if (left.is_signed) {
-         fprintf (stderr, "%lld", (long long) left.i.s);
+         fprintf (stderr, "%lld", (long long) left.bits.as_signed);
       } else {
-         fprintf (stderr, "%llu", (unsigned long long) left.i.u);
+         fprintf (stderr, "%llu", (unsigned long long) left.bits.as_unsigned);
       }
       fprintf (stderr, " ⟨%s⟩\n", left_expr);
       fprintf (stderr, "    ");
       if (right.is_signed) {
-         fprintf (stderr, "%lld", (long long) right.i.s);
+         fprintf (stderr, "%lld", (long long) right.bits.as_signed);
       } else {
-         fprintf (stderr, "%llu", (unsigned long long) right.i.u);
+         fprintf (stderr, "%llu", (unsigned long long) right.bits.as_unsigned);
       }
       fprintf (stderr, " ⟨%s⟩\n", right_expr);
       fflush (stderr);
diff -pruN 2.0.2-1/src/common/tests/test-common-atomic.c 2.1.0-1/src/common/tests/test-common-atomic.c
--- 2.0.2-1/src/common/tests/test-common-atomic.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/common/tests/test-common-atomic.c	2025-08-14 18:37:23.000000000 +0000
@@ -15,10 +15,11 @@
  */
 
 
-#include <bson/bson.h>
 #include <common-atomic-private.h>
 
-#include "TestSuite.h"
+#include <bson/bson.h>
+
+#include <TestSuite.h>
 
 #define ATOMIC(Kind, Operation) BSON_CONCAT4 (mcommon_atomic_, Kind, _, Operation)
 
diff -pruN 2.0.2-1/src/common/tests/test-common-oid.c 2.1.0-1/src/common/tests/test-common-oid.c
--- 2.0.2-1/src/common/tests/test-common-oid.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/common/tests/test-common-oid.c	2025-08-14 18:37:23.000000000 +0000
@@ -14,10 +14,10 @@
  * limitations under the License.
  */
 
-#include "TestSuite.h"
-
 #include <common-oid-private.h>
 
+#include <TestSuite.h>
+
 static void
 test_mcommon_oid_zero (void)
 {
diff -pruN 2.0.2-1/src/common/tests/test-mlib.c 2.1.0-1/src/common/tests/test-mlib.c
--- 2.0.2-1/src/common/tests/test-mlib.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/common/tests/test-mlib.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,12 +1,13 @@
-#include "TestSuite.h"
-
-#include <mlib/intutil.h>
+#include <mlib/ckdint.h>
+#include <mlib/cmp.h>
 #include <mlib/config.h>
 #include <mlib/intencode.h>
+#include <mlib/intutil.h>
 #include <mlib/loop.h>
-#include <mlib/cmp.h>
+#include <mlib/str.h>
 #include <mlib/test.h>
-#include <mlib/ckdint.h>
+
+#include <TestSuite.h>
 
 #include <stddef.h>
 
@@ -44,6 +45,22 @@ _test_checks (void)
    mlib_assert_aborts () {
       mlib_check (1, neq, 1);
    }
+   // "because" string
+   mlib_check (true, because, "just true");
+   mlib_assert_aborts () {
+      mlib_check (false, because, "this will fail");
+   }
+}
+
+static void
+_test_bits (void)
+{
+   mlib_check (mlib_bits (0, 0), eq, 0);           // 0b000
+   mlib_check (mlib_bits (1, 0), eq, 1);           // 0b001
+   mlib_check (mlib_bits (2, 0), eq, 3);           // 0b011
+   mlib_check (mlib_bits (1, 1), eq, 2);           // 0b010
+   mlib_check (mlib_bits (5, 3), eq, 248);         // 0b11111000
+   mlib_check (mlib_bits (64, 0), eq, UINT64_MAX); // 0b111...
 }
 
 static void
@@ -89,23 +106,23 @@ _test_upsize (void)
 {
    struct mlib_upsized_integer up;
    up = mlib_upsize_integer (31);
-   ASSERT (up.is_signed);
-   ASSERT (up.i.s == 31);
+   mlib_check (up.is_signed);
+   mlib_check (up.bits.as_signed == 31);
 
    // Casting from the max unsigned integer generates an unsigned upsized integer:
    up = mlib_upsize_integer ((uintmax_t) 1729);
-   ASSERT (!up.is_signed);
-   ASSERT (up.i.u == 1729);
+   mlib_check (!up.is_signed);
+   mlib_check (up.bits.as_unsigned == 1729);
 
    // Max signed integer makes a signed upsized integer:
    up = mlib_upsize_integer ((intmax_t) 1729);
-   ASSERT (up.is_signed);
-   ASSERT (up.i.s == 1729);
+   mlib_check (up.is_signed);
+   mlib_check (up.bits.as_signed == 1729);
 
    // From a literal:
    up = mlib_upsize_integer (UINTMAX_MAX);
-   ASSERT (!up.is_signed);
-   ASSERT (up.i.u == UINTMAX_MAX);
+   mlib_check (!up.is_signed);
+   mlib_check (up.bits.as_unsigned == UINTMAX_MAX);
 }
 
 static void
@@ -308,10 +325,24 @@ _test_cmp (void)
    // Unintuitive result due to integer promotion:
    mlib_diagnostic_push ();
    mlib_gnu_warning_disable ("-Wsign-compare");
-   ASSERT (-27 > 20u);
+   mlib_disable_constant_conditional_expression_warnings ();
+   mlib_msvc_warning (disable : 4308);
+   ASSERT (-27 > 20u); // Deliberate signed -> unsigned implicit conversion check.
    mlib_diagnostic_pop ();
    // mlib_cmp produces the correct answer:
    ASSERT (mlib_cmp (-27, <, 20u));
+
+   // CDRIVER-6043: until VS 2019 (MSVC 19.20), compound literals seem to "escape" the expression or scope they are
+   // meant to be in. This includes the compound literals used by the conditional operator in mlib_upsize_integer.
+#if !defined(_MSC_VER) || _MSC_VER >= 1920
+   {
+      // Check that we do not double-evaluate the operand expression.
+      intmax_t a = 4;
+      mlib_check (mlib_cmp (++a, ==, 5));
+      // We only increment once:
+      mlib_check (a, eq, 5);
+   }
+#endif
 }
 
 static void
@@ -435,6 +466,76 @@ _test_int_encoding (void)
 }
 
 static void
+_test_int_parse (void)
+{
+   const int64_t bogus_value = 2424242424242424242;
+   struct case_ {
+      const char *in;
+      int64_t value;
+      int ec;
+   } cases[] = {
+      // Basics:
+      {"0", 0},
+      {"1", 1},
+      {"+1", 1},
+      {"-1", -1},
+      // Differences from strtoll
+      // We require at least one digit immediately
+      {"a1", bogus_value, EINVAL},
+      {"", bogus_value, EINVAL},
+      // No space skipping
+      {" 1", bogus_value, EINVAL},
+      {" +42", bogus_value, EINVAL},
+      // No trailing characters
+      {"123a", bogus_value, EINVAL},
+      // strtoll: Set ERANGE if the value is too large
+      {"123456789123456789123", bogus_value, ERANGE},
+      // Difference: We generate EINVAL if its not an integer, even if strtoll says ERANGE
+      {"123456789123456789123abc", bogus_value, EINVAL},
+      // Truncated prefix
+      {"+", bogus_value, EINVAL},
+      {"+0x", bogus_value, EINVAL},
+      {"0x", bogus_value, EINVAL},
+      {"-0b", bogus_value, EINVAL},
+      {"0xff", 0xff},
+      {"0xfr", bogus_value, EINVAL},
+      {"0x0", 0},
+      {"0o755", 0755},
+      {"0755", 0755},
+      // Boundary cases:
+      {"9223372036854775807", INT64_MAX},
+      {"-9223372036854775808", INT64_MIN},
+   };
+   mlib_foreach_arr (struct case_, test, cases) {
+      int64_t value = bogus_value;
+      int ec = mlib_i64_parse (mstr_cstring (test->in), &value);
+      mlib_check (value, eq, test->value);
+      mlib_check (ec, eq, test->ec);
+   }
+
+   {
+      // Parsing stops after the three digits when we slice the string
+      int64_t value;
+      int ec = mlib_i64_parse (mstr_view_data ("123abc", 3), &value);
+      mlib_check (ec, eq, 0);
+      mlib_check (value, eq, 123);
+   }
+
+   {
+      // Does not try to parse after the "0x" when we slice
+      int ec = mlib_i64_parse (mstr_view_data ("0x123", 2), NULL);
+      mlib_check (ec, eq, EINVAL);
+   }
+
+   {
+      // Does not try to read past the "+" into stack memory
+      char plus = '+';
+      int ec = mlib_i64_parse (mstr_view_data (&plus, 1), NULL);
+      mlib_check (ec, eq, EINVAL);
+   }
+}
+
+static void
 _test_foreach (void)
 {
    int n_loops = 0;
@@ -447,7 +548,7 @@ _test_foreach (void)
       ++n_loops;
       (void) i;
       ASSERT (n_loops <= 10);
-   };
+   }
    ASSERT (n_loops == 10);
 
    n_loops = 0;
@@ -644,19 +745,164 @@ _test_ckdint_partial (void)
    }
 }
 
+static void
+_test_str_view (void)
+{
+   mstr_view sv = mstr_cstring ("Hello, world!");
+   mlib_check (sv.data, str_eq, "Hello, world!");
+
+   mlib_check (mstr_cmp (sv, ==, mstr_cstring ("Hello, world!")));
+   mlib_check (mstr_cmp (sv, >, mstr_cstring ("Hello")));
+   // Longer strings are greater than shorter strings
+   mlib_check (mstr_cmp (sv, <, mstr_cstring ("ZZZZZ")));
+   // str_view_from duplicates a string view:
+   mlib_check (mstr_cmp (sv, ==, mstr_view_from (sv)));
+
+   // Substring
+   {
+      sv = mstr_cstring ("foobar");
+      // Implicit length includes everything:
+      mlib_check (mstr_cmp (mstr_substr (sv, 2), ==, mstr_cstring ("obar")));
+      // Explicit length trims:
+      mlib_check (mstr_cmp (mstr_substr (sv, 2, 1), ==, mstr_cstring ("o")));
+      // Substring over the whole length:
+      mlib_check (mstr_cmp (mstr_substr (sv, sv.len), ==, mstr_cstring ("")));
+   }
+
+   // Substring from end
+   {
+      sv = mstr_cstring ("foobar");
+      mlib_check (mstr_cmp (mstr_substr (sv, -3), ==, mstr_cstring ("bar")));
+      mlib_check (mstr_cmp (mstr_substr (sv, -6), ==, mstr_cstring ("foobar")));
+   }
+
+   // Searching forward:
+   {
+      sv = mstr_cstring ("foobar");
+      mlib_check (mstr_find (sv, mstr_cstring ("foo")), eq, 0);
+      mlib_check (mstr_find (sv, mstr_cstring ("o")), eq, 1);
+      mlib_check (mstr_find (sv, mstr_cstring ("foof")), eq, SIZE_MAX);
+      mlib_check (mstr_find (sv, mstr_cstring ("bar")), eq, 3);
+      mlib_check (mstr_find (sv, mstr_cstring ("barf")), eq, SIZE_MAX);
+      // Start at index 3
+      mlib_check (mstr_find (sv, mstr_cstring ("bar"), 3), eq, 3);
+      // Starting beyond the ocurrence will fail:
+      mlib_check (mstr_find (sv, mstr_cstring ("b"), 4), eq, SIZE_MAX);
+      // Empty string is found immediately:
+      mlib_check (mstr_find (sv, mstr_cstring ("")), eq, 0);
+   }
+
+   {
+      // Searching for certain chars
+      mstr_view digits = mstr_cstring ("1234567890");
+      // The needle chars never occur, so returns SIZE_MAX
+      mlib_check (mstr_find_first_of (mstr_cstring ("foobar"), digits), eq, SIZE_MAX);
+      // `1` at the fourth pos
+      mlib_check (mstr_find_first_of (mstr_cstring ("foo1barbaz4"), digits), eq, 3);
+      // `1` at the fourth pos, with a trimmed window:
+      mlib_check (mstr_find_first_of (mstr_cstring ("foo1barbaz4"), digits, 3), eq, 3);
+      // `4` is found, since we drop the `1` from the window:
+      mlib_check (mstr_find_first_of (mstr_cstring ("foo1barbaz4"), digits, 4), eq, 10);
+      // Empty needles string is never found in any string
+      mlib_check (mstr_find_first_of (mstr_cstring ("foo bar baz"), mstr_cstring ("")), eq, SIZE_MAX);
+      // Find at the end of the string
+      mlib_check (mstr_find_first_of (mstr_cstring ("foo bar baz"), mstr_cstring ("z")), eq, 10);
+   }
+
+   // Splitting
+   {
+      sv = mstr_cstring ("foo bar baz");
+      mstr_view a, b;
+      // Trim at index 3, drop one char:
+      mstr_split_at (sv, 3, 1, &a, &b);
+      mlib_check (mstr_cmp (a, ==, mstr_cstring ("foo")));
+      mlib_check (mstr_cmp (b, ==, mstr_cstring ("bar baz")));
+      // Trim at index 3, default drop=0:
+      mstr_split_at (sv, 3, &a, &b);
+      mlib_check (mstr_cmp (a, ==, mstr_cstring ("foo")));
+      mlib_check (mstr_cmp (b, ==, mstr_cstring (" bar baz")));
+      // Trim past-the-end
+      mstr_split_at (sv, 5000, &a, &b);
+      mlib_check (mstr_cmp (a, ==, mstr_cstring ("foo bar baz")));
+      mlib_check (mstr_cmp (b, ==, mstr_cstring ("")));
+      // Drop too many:
+      mstr_split_at (sv, 0, 5000, &a, &b);
+      mlib_check (mstr_cmp (a, ==, mstr_cstring ("")));
+      mlib_check (mstr_cmp (b, ==, mstr_cstring ("")));
+      // Past-the-end and also drop
+      mstr_split_at (sv, 4000, 42, &a, &b);
+      mlib_check (mstr_cmp (a, ==, mstr_cstring ("foo bar baz")));
+      mlib_check (mstr_cmp (b, ==, mstr_cstring ("")));
+
+      // Split using a negative index
+      mstr_split_at (sv, -4, 1, &a, &b);
+      mlib_check (mstr_cmp (a, ==, mstr_cstring ("foo bar")));
+      mlib_check (mstr_cmp (b, ==, mstr_cstring ("baz")));
+   }
+
+   // Splitting around an infix
+   {
+      sv = mstr_cstring ("foo bar baz");
+      mstr_view a, b;
+      // Split around the first space
+      const mstr_view space = mstr_cstring (" ");
+      mlib_check (mstr_split_around (sv, space, &a, &b));
+      mlib_check (mstr_cmp (a, ==, mstr_cstring ("foo")));
+      mlib_check (mstr_cmp (b, ==, mstr_cstring ("bar baz")));
+      // Split again
+      mlib_check (mstr_split_around (b, space, &a, &b));
+      mlib_check (mstr_cmp (a, ==, mstr_cstring ("bar")));
+      mlib_check (mstr_cmp (b, ==, mstr_cstring ("baz")));
+      // Split again. This won't find a space, but will still do something
+      mlib_check (!mstr_split_around (b, space, &a, &b));
+      mlib_check (mstr_cmp (a, ==, mstr_cstring ("baz")));
+      mlib_check (mstr_cmp (b, ==, mstr_cstring ("")));
+      // Splitting on the final empty string does nothing
+      mlib_check (!mstr_split_around (b, space, &a, &b));
+      mlib_check (mstr_cmp (a, ==, mstr_cstring ("")));
+      mlib_check (mstr_cmp (b, ==, mstr_cstring ("")));
+   }
+
+   // Case folding
+   {
+      mlib_check (mlib_latin_tolower ('a'), eq, 'a');
+      mlib_check (mlib_latin_tolower ('z'), eq, 'z');
+      mlib_check (mlib_latin_tolower ('A'), eq, 'a');
+      mlib_check (mlib_latin_tolower ('Z'), eq, 'z');
+      // Other chars are unchanged:
+      mlib_check (mlib_latin_tolower ('7'), eq, '7');
+      mlib_check (mlib_latin_tolower ('?'), eq, '?');
+   }
+
+   // Case-insensitive compare
+   {
+      mlib_check (mstr_latin_casecmp (mstr_cstring ("foo"), ==, mstr_cstring ("foo")));
+      mlib_check (mstr_latin_casecmp (mstr_cstring ("foo"), !=, mstr_cstring ("bar")));
+      mlib_check (mstr_latin_casecmp (mstr_cstring ("Foo"), ==, mstr_cstring ("foo")));
+      mlib_check (mstr_latin_casecmp (mstr_cstring ("Foo"), >, mstr_cstring ("bar")));
+      // "Food" < "foo" when case-sensitive ('F' < 'f'):
+      mlib_check (mstr_cmp (mstr_cstring ("Food"), <, mstr_cstring ("foo")));
+      // But "Food" > "foo" when case-insensitive:
+      mlib_check (mstr_latin_casecmp (mstr_cstring ("Food"), >, mstr_cstring ("foo")));
+   }
+}
+
 void
 test_mlib_install (TestSuite *suite)
 {
    TestSuite_Add (suite, "/mlib/checks", _test_checks);
+   TestSuite_Add (suite, "/mlib/intutil/bits", _test_bits);
    TestSuite_Add (suite, "/mlib/intutil/minmax", _test_minmax);
    TestSuite_Add (suite, "/mlib/intutil/upsize", _test_upsize);
    TestSuite_Add (suite, "/mlib/cmp", _test_cmp);
    TestSuite_Add (suite, "/mlib/in-range", _test_in_range);
    TestSuite_Add (suite, "/mlib/assert-aborts", _test_assert_aborts);
    TestSuite_Add (suite, "/mlib/int-encoding", _test_int_encoding);
+   TestSuite_Add (suite, "/mlib/int-parse", _test_int_parse);
    TestSuite_Add (suite, "/mlib/foreach", _test_foreach);
    TestSuite_Add (suite, "/mlib/check-cast", _test_cast);
    TestSuite_Add (suite, "/mlib/ckdint-partial", _test_ckdint_partial);
+   TestSuite_Add (suite, "/mlib/str_view", _test_str_view);
 }
 
 mlib_diagnostic_pop ();
diff -pruN 2.0.2-1/src/libbson/.gitignore 2.1.0-1/src/libbson/.gitignore
--- 2.0.2-1/src/libbson/.gitignore	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libbson/.gitignore	2025-08-14 18:37:23.000000000 +0000
@@ -7,7 +7,6 @@ ChangeLog
 CMakeFiles
 CMakeCache.txt
 compile
-config.*
 !config.yml
 configure
 depcomp
diff -pruN 2.0.2-1/src/libbson/CMakeLists.txt 2.1.0-1/src/libbson/CMakeLists.txt
--- 2.0.2-1/src/libbson/CMakeLists.txt	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libbson/CMakeLists.txt	2025-08-14 18:37:23.000000000 +0000
@@ -11,7 +11,7 @@
 #                                     888
 #                                     888
 
-cmake_minimum_required (VERSION 3.15)
+cmake_minimum_required (VERSION 3.15...4.0)
 
 project (libbson
    LANGUAGES C
@@ -69,7 +69,7 @@ mongo_bool_setting(
 
 # Configure-time platform checks. These start as regular CMake booleans, but are
 # converted to 0/1 values (with mongo_bool01) so that they can be inserted into
-# bson-config.h as preprocessor values. We cannot use #cmakedefine01, as we need
+# bson/config.h as preprocessor values. We cannot use #cmakedefine01, as we need
 # to keep compatibility with an external Autotools-generated library configuration
 
 include (CheckFunctionExists)
@@ -116,13 +116,13 @@ else ()
 endif ()
 
 configure_file (
-   "${PROJECT_SOURCE_DIR}/src/bson/bson-config.h.in"
-   "${PROJECT_BINARY_DIR}/src/bson/bson-config.h"
+   "${PROJECT_SOURCE_DIR}/src/bson/config.h.in"
+   "${PROJECT_BINARY_DIR}/src/bson/config.h"
 )
 
 configure_file (
-   "${PROJECT_SOURCE_DIR}/src/bson/bson-version.h.in"
-   "${PROJECT_BINARY_DIR}/src/bson/bson-version.h"
+   "${PROJECT_SOURCE_DIR}/src/bson/version.h.in"
+   "${PROJECT_BINARY_DIR}/src/bson/version.h"
 )
 
 # 8888888b.            .d888 d8b          d8b 888    d8b
@@ -173,6 +173,24 @@ if(ENABLE_STATIC)
       # User wants static libs to use PIC code.
       set_property(TARGET bson_static PROPERTY POSITION_INDEPENDENT_CODE TRUE)
    endif()
+
+   if(MONGO_CAN_VERIFY_HEADERS AND ENABLE_TESTS)
+      mongo_verify_headers(
+         bson
+         USE_LIBRARIES bson::static
+         HEADERS
+            # Grab all headers
+            "src/*.h"
+         EXCLUDE_REGEX
+            # No -private headers
+            "-private\\.h"
+            # Ignore all headers that start with "bson-", as they have not
+            # been sanitized for direct inclusion.
+            "bson/bson-.*\\.h"
+            # Don't check jsonsl.h either
+            "jsonsl\\.h"
+         )
+   endif()
 endif()
 
 if(ENABLE_SHARED)
diff -pruN 2.0.2-1/src/libbson/NEWS 2.1.0-1/src/libbson/NEWS
--- 2.0.2-1/src/libbson/NEWS	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libbson/NEWS	2025-08-14 18:37:23.000000000 +0000
@@ -1,3 +1,27 @@
+libbson 2.1.0
+=============
+
+## Fixes
+
+* The uninstall script for Windows is fixed so it no longer "succeeds" with a non-zero `%ERRORLABEL%` value.
+* The uninstall script for non-Windows environments now calls `find "$dir" -maxdepth 1` instead of `ls --almost-all "$dir"` when detecting non-empty directories to fix macOS compatibility.
+
+## Changed
+
+* The CMake project now sets a CMake policy max version of `4.0` (previously unset).
+
+## Removed
+
+* Support for Debian 9 and Debian 10.
+
+Thanks to everyone who contributed to the development of this release.
+
+  * Kevin Albertson
+  * Ezra Chung
+  * Colby Pike
+  * Roberto C. Sánchez
+  * Micah Scott
+
 libbson 2.0.2
 =============
 
@@ -12,12 +36,25 @@ Fixes:
     object.
   * A document nesting limit is now enforced during validation.
 
+libbson 1.30.5
+==============
+
+Fixes:
+
+* Various fixes have been applied to the `bson_validate` family of functions,
+  with some minor behavioral changes.
+  * Previously accepted invalid UTF-8 will be rejected when `BSON_VALIDATE_UTF8`
+    is specified.
+  * The scope document in a deprecated "code with scope" element is now
+    validated with a fixed set of rules and is treated as an opaque JavaScript
+    object.
+  * A document nesting limit is now enforced during validation.
+
 Thanks to everyone who contributed to the development of this release.
 
   * Kevin Albertson
   * Colby Pike
 
-
 libbson 2.0.1
 =============
 
@@ -29,6 +66,38 @@ Thanks to everyone who contributed to th
 
   * Kevin Albertson
 
+libbson 1.30.4
+==============
+
+No changes since 1.30.3. Version incremented to match the libmongoc version.
+
+
+libbson 1.30.3
+==============
+
+Fixes:
+
+  * Fix CMake configure error on macOS with CMake 4.
+
+New Features:
+
+* In anticipation of the 2.0 release of mongo-c-driver, new CMake packages and
+  imported targets have been defined (for both `bson` and `mongoc`). To import
+  `bson` with the new names, call `find_package` for the `bson` package. The new
+  imported targets are named `bson::static`, `bson::shared`, and `bson::bson`
+  (which points to either the static or the shared library, depending on an
+  import-time configuration option).
+
+  The new package and target names will remain unchanged when upgrading to the
+  2.0 release, allowing consumers to support both major versions without
+  modifying their CMake project. The current imported target names will be
+  removed from the 2.0 release, and should not be used for
+  forward-compatibility.
+
+Thanks to everyone who contributed to the development of this release.
+
+  * Kevin Albertson
+  * Colby Pike
 
 
 libbson 2.0.0
@@ -38,11 +107,11 @@ libbson 2.0.0
 
 * `BSON_ERROR_BUFFER_SIZE` is reduced from `504` to `503` to reserve the final byte for internal use.
     * The data layout of `bson_error_t` remains otherwise unchanged: the size is still 512 bytes and the offset of the `.code`, `.domain`, and `.message` data members remain unchanged.
-* The pkg-config files `libbson-1.0`, have been renamed to `bson2`, and `bson2-static`, respectively.
+* The pkg-config files `libbson-1.0` and `libbson-static-1.0` have been renamed to `bson2`, and `bson2-static`, respectively.
 
 ### CMake Packages and Imported Targets
 
-The `bson-1.0` CMake package have been removed. Instead, use or `bson`, and
+The `bson-1.0` CMake package has been removed. Instead, use or `bson`, and
 specify a version or version range to be imported:
 
 ```cmake
diff -pruN 2.0.2-1/src/libbson/doc/bson_error_clear.rst 2.1.0-1/src/libbson/doc/bson_error_clear.rst
--- 2.0.2-1/src/libbson/doc/bson_error_clear.rst	1970-01-01 00:00:00.000000000 +0000
+++ 2.1.0-1/src/libbson/doc/bson_error_clear.rst	2025-08-14 18:37:23.000000000 +0000
@@ -0,0 +1,24 @@
+:man_page: bson_error_clear
+
+bson_error_clear()
+==================
+
+Synopsis
+--------
+
+.. code-block:: c
+
+  void
+  bson_error_clear (bson_error_t *error);
+
+Parameters
+----------
+
+* ``error``: A pointer to storage for a :symbol:`bson_error_t`, or NULL.
+
+Description
+-----------
+
+If given a non-null pointer to a :symbol:`bson_error_t`, this function will
+clear any error value that is stored in the pointed-to object. If given a null
+pointer, this function has no effect.
diff -pruN 2.0.2-1/src/libbson/doc/bson_error_reset.rst 2.1.0-1/src/libbson/doc/bson_error_reset.rst
--- 2.0.2-1/src/libbson/doc/bson_error_reset.rst	1970-01-01 00:00:00.000000000 +0000
+++ 2.1.0-1/src/libbson/doc/bson_error_reset.rst	2025-08-14 18:37:23.000000000 +0000
@@ -0,0 +1,29 @@
+:man_page: bson_error_reset
+
+bson_error_reset()
+==================
+
+Synopsis
+--------
+
+.. code-block:: c
+
+  #define bson_error_reset(ErrorPointer)
+
+Parameters
+----------
+
+* ``ErrorPointer``: An l-value expression of type ``bson_error_t*``. May be a
+  null pointer.
+
+Description
+-----------
+
+This function-like macro modifies a pointer to :symbol:`bson_error_t` to be
+non-null, and clears any contained value using :symbol:`bson_error_clear`.
+
+If the given pointer object is null, then the pointer is updated to point to a
+local anonymous :symbol:`bson_error_t` object. After the evaluation of this
+macro, it is gauranteed that the given pointer is non-null.
+
+.. important:: This function-like macro is not valid in C++!
diff -pruN 2.0.2-1/src/libbson/doc/bson_error_t.rst 2.1.0-1/src/libbson/doc/bson_error_t.rst
--- 2.0.2-1/src/libbson/doc/bson_error_t.rst	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libbson/doc/bson_error_t.rst	2025-08-14 18:37:23.000000000 +0000
@@ -36,6 +36,8 @@ See `Handling Errors <errors_>`_.
 
     bson_set_error
     bson_strerror_r
+    bson_error_clear
+    bson_error_reset
 
 Example
 -------
diff -pruN 2.0.2-1/src/libbson/doc/bson_validate_flags_t.rst 2.1.0-1/src/libbson/doc/bson_validate_flags_t.rst
--- 2.0.2-1/src/libbson/doc/bson_validate_flags_t.rst	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libbson/doc/bson_validate_flags_t.rst	2025-08-14 18:37:23.000000000 +0000
@@ -37,7 +37,7 @@ Each defined flag aside from ``BSON_VALI
 
 * ``BSON_VALIDATE_NONE`` Minimum level of validation; in ``libbson``, validates element headers.
 * ``BSON_VALIDATE_UTF8`` All keys and string values are checked for invalid UTF-8.
-* ``BSON_VALIDATE_UTF8_ALLOW_NULL`` String values are allowed to have embedded NULL bytes.
+* ``BSON_VALIDATE_UTF8_ALLOW_NULL`` String values are allowed to have embedded NULL bytes. This has no effect unless ``BSON_VALIDATE_UTF8`` is also passed.
 * ``BSON_VALIDATE_DOLLAR_KEYS`` Prohibit keys that start with ``$`` outside of a "DBRef" subdocument.
 * ``BSON_VALIDATE_DOT_KEYS`` Prohibit keys that contain ``.`` anywhere in the string.
 * ``BSON_VALIDATE_EMPTY_KEYS`` Prohibit zero-length keys.
diff -pruN 2.0.2-1/src/libbson/examples/bcon-speed.c 2.1.0-1/src/libbson/examples/bcon-speed.c
--- 2.0.2-1/src/libbson/examples/bcon-speed.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libbson/examples/bcon-speed.c	2025-08-14 18:37:23.000000000 +0000
@@ -16,6 +16,7 @@
 
 
 #include <bson/bson.h>
+
 #include <stdio.h>
 #include <stdlib.h>
 
diff -pruN 2.0.2-1/src/libbson/examples/bson-metrics.c 2.1.0-1/src/libbson/examples/bson-metrics.c
--- 2.0.2-1/src/libbson/examples/bson-metrics.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libbson/examples/bson-metrics.c	2025-08-14 18:37:23.000000000 +0000
@@ -20,8 +20,9 @@
  */
 
 #include <bson/bson.h>
-#include <stdio.h>
+
 #include <math.h>
+#include <stdio.h>
 
 #define MAX_RECURSION 100
 
diff -pruN 2.0.2-1/src/libbson/examples/bson-streaming-reader.c 2.1.0-1/src/libbson/examples/bson-streaming-reader.c
--- 2.0.2-1/src/libbson/examples/bson-streaming-reader.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libbson/examples/bson-streaming-reader.c	2025-08-14 18:37:23.000000000 +0000
@@ -15,6 +15,7 @@
  */
 
 #include <bson/bson.h>
+
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
@@ -22,11 +23,11 @@
 #include <winsock2.h>
 #include <ws2tcpip.h>
 #else
-#include <unistd.h>
 #include <netdb.h>
 #include <netinet/in.h>
 #include <sys/socket.h>
 #include <sys/types.h>
+#include <unistd.h>
 #endif
 
 
diff -pruN 2.0.2-1/src/libbson/examples/bson-to-json.c 2.1.0-1/src/libbson/examples/bson-to-json.c
--- 2.0.2-1/src/libbson/examples/bson-to-json.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libbson/examples/bson-to-json.c	2025-08-14 18:37:23.000000000 +0000
@@ -22,6 +22,7 @@
 
 
 #include <bson/bson.h>
+
 #include <stdio.h>
 
 #ifndef STDIN_FILENO
diff -pruN 2.0.2-1/src/libbson/examples/bson-validate.c 2.1.0-1/src/libbson/examples/bson-validate.c
--- 2.0.2-1/src/libbson/examples/bson-validate.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libbson/examples/bson-validate.c	2025-08-14 18:37:23.000000000 +0000
@@ -29,6 +29,7 @@
 
 
 #include <bson/bson.h>
+
 #include <stdio.h>
 #include <stdlib.h>
 
diff -pruN 2.0.2-1/src/libbson/examples/cmake/find_package/CMakeLists.txt 2.1.0-1/src/libbson/examples/cmake/find_package/CMakeLists.txt
--- 2.0.2-1/src/libbson/examples/cmake/find_package/CMakeLists.txt	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libbson/examples/cmake/find_package/CMakeLists.txt	2025-08-14 18:37:23.000000000 +0000
@@ -15,7 +15,7 @@
 # Demonstrates how to use the CMake 'find_package' mechanism to locate
 # and build against libbson.
 
-cmake_minimum_required (VERSION 3.0)
+cmake_minimum_required (VERSION 3.15...4.0)
 
 project (hello_bson LANGUAGES C)
 
diff -pruN 2.0.2-1/src/libbson/examples/cmake/find_package_static/CMakeLists.txt 2.1.0-1/src/libbson/examples/cmake/find_package_static/CMakeLists.txt
--- 2.0.2-1/src/libbson/examples/cmake/find_package_static/CMakeLists.txt	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libbson/examples/cmake/find_package_static/CMakeLists.txt	2025-08-14 18:37:23.000000000 +0000
@@ -15,7 +15,7 @@
 # Demonstrates how to use the CMake 'find_package' mechanism to locate
 # and build against libbson.
 
-cmake_minimum_required (VERSION 2.8)
+cmake_minimum_required (VERSION 3.15...4.0)
 
 project (hello_bson LANGUAGES C)
 
diff -pruN 2.0.2-1/src/libbson/examples/creating.c 2.1.0-1/src/libbson/examples/creating.c
--- 2.0.2-1/src/libbson/examples/creating.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libbson/examples/creating.c	2025-08-14 18:37:23.000000000 +0000
@@ -13,9 +13,10 @@
  * limitations under the License.
  */
 
-#include <stdio.h>
 #include <bson/bson.h>
 
+#include <stdio.h>
+
 int
 main (void)
 {
diff -pruN 2.0.2-1/src/libbson/examples/extended-json.c 2.1.0-1/src/libbson/examples/extended-json.c
--- 2.0.2-1/src/libbson/examples/extended-json.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libbson/examples/extended-json.c	2025-08-14 18:37:23.000000000 +0000
@@ -17,6 +17,7 @@
 // extended-json.c shows examples of producing Extended JSON.
 
 #include <bson/bson.h>
+
 #include <stdio.h>
 
 int
diff -pruN 2.0.2-1/src/libbson/examples/hello_bson.c 2.1.0-1/src/libbson/examples/hello_bson.c
--- 2.0.2-1/src/libbson/examples/hello_bson.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libbson/examples/hello_bson.c	2025-08-14 18:37:23.000000000 +0000
@@ -14,9 +14,10 @@
  */
 
 /* -- sphinx-include-start -- */
-#include <stdio.h>
 #include <bson/bson.h>
 
+#include <stdio.h>
+
 int
 main (int argc, const char **argv)
 {
diff -pruN 2.0.2-1/src/libbson/examples/json-to-bson.c 2.1.0-1/src/libbson/examples/json-to-bson.c
--- 2.0.2-1/src/libbson/examples/json-to-bson.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libbson/examples/json-to-bson.c	2025-08-14 18:37:23.000000000 +0000
@@ -22,8 +22,9 @@
 
 
 #include <bson/bson.h>
-#include <stdlib.h>
+
 #include <stdio.h>
+#include <stdlib.h>
 
 
 #ifndef STDIN_FILENO
diff -pruN 2.0.2-1/src/libbson/fuzz/init-from-json.c 2.1.0-1/src/libbson/fuzz/init-from-json.c
--- 2.0.2-1/src/libbson/fuzz/init-from-json.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libbson/fuzz/init-from-json.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,8 +1,9 @@
-#include <stdlib.h>
-#include <stdio.h>
-#include <stdint.h>
 #include <bson/bson.h>
 
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+
 int
 LLVMFuzzerTestOneInput (const uint8_t *data, size_t size)
 {
diff -pruN 2.0.2-1/src/libbson/fuzz/validate-repro.cpp 2.1.0-1/src/libbson/fuzz/validate-repro.cpp
--- 2.0.2-1/src/libbson/fuzz/validate-repro.cpp	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libbson/fuzz/validate-repro.cpp	2025-08-14 18:37:23.000000000 +0000
@@ -1,10 +1,10 @@
+#include "./validate.hpp"
+
 #include <cstdio>
 #include <cstring>
 #include <fstream>
 #include <sstream>
 
-#include "validate.hpp"
-
 int
 main (int argc, char **argv)
 {
diff -pruN 2.0.2-1/src/libbson/fuzz/validate.cpp 2.1.0-1/src/libbson/fuzz/validate.cpp
--- 2.0.2-1/src/libbson/fuzz/validate.cpp	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libbson/fuzz/validate.cpp	2025-08-14 18:37:23.000000000 +0000
@@ -1,6 +1,6 @@
-#include <stdint.h>
+#include "./validate.hpp"
 
-#include "validate.hpp"
+#include <stdint.h>
 
 extern "C" int
 LLVMFuzzerTestOneInput (const uint8_t *data, size_t size)
diff -pruN 2.0.2-1/src/libbson/libbson.rc.in 2.1.0-1/src/libbson/libbson.rc.in
--- 2.0.2-1/src/libbson/libbson.rc.in	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libbson/libbson.rc.in	2025-08-14 18:37:23.000000000 +0000
@@ -2,7 +2,7 @@
 // Refer: https://learn.microsoft.com/en-us/windows/win32/menurc/versioninfo-resource
 #include <winver.h> // Defines VS_VERSION_INFO
 
-#include <bson/bson-version.h> // Defines BSON_MAJOR_VERSION and other version macros.
+#include <bson/version.h> // Defines BSON_MAJOR_VERSION and other version macros.
 
 #define BSON_OUTPUT_BASENAME "@BSON_OUTPUT_BASENAME@"
 
diff -pruN 2.0.2-1/src/libbson/src/bson/.gitignore 2.1.0-1/src/libbson/src/bson/.gitignore
--- 2.0.2-1/src/libbson/src/bson/.gitignore	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libbson/src/bson/.gitignore	2025-08-14 18:37:23.000000000 +0000
@@ -1,4 +1,2 @@
-bson-config.h
 bson-stdint.h
-bson-version.h
 .dirstamp
diff -pruN 2.0.2-1/src/libbson/src/bson/bcon.c 2.1.0-1/src/libbson/src/bson/bcon.c
--- 2.0.2-1/src/libbson/src/bson/bcon.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libbson/src/bson/bcon.c	1970-01-01 00:00:00.000000000 +0000
@@ -1,994 +0,0 @@
-/*
- * @file bcon.c
- * @brief BCON (BSON C Object Notation) Implementation
- */
-
-/*    Copyright 2009-present MongoDB, Inc.
- *
- *    Licensed under the Apache License, Version 2.0 (the "License");
- *    you may not use this file except in compliance with the License.
- *    You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- *    Unless required by applicable law or agreed to in writing, software
- *    distributed under the License is distributed on an "AS IS" BASIS,
- *    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- *    See the License for the specific language governing permissions and
- *    limitations under the License.
- */
-
-
-#include <stdio.h>
-
-#include <bson/bcon.h>
-#include <bson/bson-config.h>
-
-/* These stack manipulation macros are used to manage append recursion in
- * bcon_append_ctx_va().  They take care of some awkward dereference rules (the
- * real bson object isn't in the stack, but accessed by pointer) and add in run
- * time asserts to make sure we don't blow the stack in either direction */
-
-#define STACK_ELE(_delta, _name) (ctx->stack[(_delta) + ctx->n]._name)
-
-#define STACK_BSON(_delta) (((_delta) + ctx->n) == 0 ? bson : &STACK_ELE (_delta, bson))
-
-#define STACK_ITER(_delta) (((_delta) + ctx->n) == 0 ? &root_iter : &STACK_ELE (_delta, iter))
-
-#define STACK_BSON_PARENT STACK_BSON (-1)
-#define STACK_BSON_CHILD STACK_BSON (0)
-
-#define STACK_ITER_CHILD STACK_ITER (0)
-
-#define STACK_I STACK_ELE (0, i)
-#define STACK_IS_ARRAY STACK_ELE (0, is_array)
-
-#define STACK_PUSH_ARRAY(statement)                \
-   do {                                            \
-      BSON_ASSERT (ctx->n < (BCON_STACK_MAX - 1)); \
-      ctx->n++;                                    \
-      STACK_I = 0;                                 \
-      STACK_IS_ARRAY = 1;                          \
-      statement;                                   \
-   } while (0)
-
-#define STACK_PUSH_DOC(statement)                  \
-   do {                                            \
-      BSON_ASSERT (ctx->n < (BCON_STACK_MAX - 1)); \
-      ctx->n++;                                    \
-      STACK_IS_ARRAY = 0;                          \
-      statement;                                   \
-   } while (0)
-
-#define STACK_POP_ARRAY(statement)  \
-   do {                             \
-      BSON_ASSERT (STACK_IS_ARRAY); \
-      BSON_ASSERT (ctx->n != 0);    \
-      statement;                    \
-      ctx->n--;                     \
-   } while (0)
-
-#define STACK_POP_DOC(statement)     \
-   do {                              \
-      BSON_ASSERT (!STACK_IS_ARRAY); \
-      BSON_ASSERT (ctx->n != 0);     \
-      statement;                     \
-      ctx->n--;                      \
-   } while (0)
-
-/* This is a landing pad union for all of the types we can process with bcon.
- * We need actual storage for this to capture the return value of va_arg, which
- * takes multiple calls to get everything we need for some complex types */
-typedef union bcon_append {
-   char *UTF8;
-   double DOUBLE;
-   bson_t *DOCUMENT;
-   bson_t *ARRAY;
-   bson_t *BCON;
-
-   struct {
-      bson_subtype_t subtype;
-      uint8_t *binary;
-      uint32_t length;
-   } BIN;
-
-   bson_oid_t *OID;
-   bool BOOL;
-   int64_t DATE_TIME;
-
-   struct {
-      char *regex;
-      char *flags;
-   } REGEX;
-
-   struct {
-      char *collection;
-      bson_oid_t *oid;
-   } DBPOINTER;
-
-   const char *CODE;
-
-   char *SYMBOL;
-
-   struct {
-      const char *js;
-      bson_t *scope;
-   } CODEWSCOPE;
-
-   int32_t INT32;
-
-   struct {
-      uint32_t timestamp;
-      uint32_t increment;
-   } TIMESTAMP;
-
-   int64_t INT64;
-   bson_decimal128_t *DECIMAL128;
-   const bson_iter_t *ITER;
-} bcon_append_t;
-
-/* same as bcon_append_t.  Some extra symbols and varying types that handle the
- * differences between bson_append and bson_iter */
-typedef union bcon_extract {
-   bson_type_t TYPE;
-   bson_iter_t *ITER;
-   const char *key;
-   const char **UTF8;
-   double *DOUBLE;
-   bson_t *DOCUMENT;
-   bson_t *ARRAY;
-
-   struct {
-      bson_subtype_t *subtype;
-      const uint8_t **binary;
-      uint32_t *length;
-   } BIN;
-
-   const bson_oid_t **OID;
-   bool *BOOL;
-   int64_t *DATE_TIME;
-
-   struct {
-      const char **regex;
-      const char **flags;
-   } REGEX;
-
-   struct {
-      const char **collection;
-      const bson_oid_t **oid;
-   } DBPOINTER;
-
-   const char **CODE;
-
-   const char **SYMBOL;
-
-   struct {
-      const char **js;
-      bson_t *scope;
-   } CODEWSCOPE;
-
-   int32_t *INT32;
-
-   struct {
-      uint32_t *timestamp;
-      uint32_t *increment;
-   } TIMESTAMP;
-
-   int64_t *INT64;
-   bson_decimal128_t *DECIMAL128;
-} bcon_extract_t;
-
-static const char *gBconMagic = "BCON_MAGIC";
-static const char *gBconeMagic = "BCONE_MAGIC";
-
-const char *
-bson_bcon_magic (void)
-{
-   return gBconMagic;
-}
-
-
-const char *
-bson_bcone_magic (void)
-{
-   return gBconeMagic;
-}
-
-static void
-_noop (void)
-{
-}
-
-/* appends val to the passed bson object.  Meant to be a super simple dispatch
- * table */
-static void
-_bcon_append_single (bson_t *bson, bcon_type_t type, const char *key, bcon_append_t *val)
-{
-   switch ((int) type) {
-   case BCON_TYPE_UTF8:
-      BSON_ASSERT (bson_append_utf8 (bson, key, -1, val->UTF8, -1));
-      break;
-   case BCON_TYPE_DOUBLE:
-      BSON_ASSERT (bson_append_double (bson, key, -1, val->DOUBLE));
-      break;
-   case BCON_TYPE_BIN: {
-      BSON_ASSERT (bson_append_binary (bson, key, -1, val->BIN.subtype, val->BIN.binary, val->BIN.length));
-      break;
-   }
-   case BCON_TYPE_UNDEFINED:
-      BSON_ASSERT (bson_append_undefined (bson, key, -1));
-      break;
-   case BCON_TYPE_OID:
-      BSON_ASSERT (bson_append_oid (bson, key, -1, val->OID));
-      break;
-   case BCON_TYPE_BOOL:
-      BSON_ASSERT (bson_append_bool (bson, key, -1, (bool) val->BOOL));
-      break;
-   case BCON_TYPE_DATE_TIME:
-      BSON_ASSERT (bson_append_date_time (bson, key, -1, val->DATE_TIME));
-      break;
-   case BCON_TYPE_NULL:
-      BSON_ASSERT (bson_append_null (bson, key, -1));
-      break;
-   case BCON_TYPE_REGEX: {
-      BSON_ASSERT (bson_append_regex (bson, key, -1, val->REGEX.regex, val->REGEX.flags));
-      break;
-   }
-   case BCON_TYPE_DBPOINTER: {
-      BSON_ASSERT (bson_append_dbpointer (bson, key, -1, val->DBPOINTER.collection, val->DBPOINTER.oid));
-      break;
-   }
-   case BCON_TYPE_CODE:
-      BSON_ASSERT (bson_append_code (bson, key, -1, val->CODE));
-      break;
-   case BCON_TYPE_SYMBOL:
-      BSON_ASSERT (bson_append_symbol (bson, key, -1, val->SYMBOL, -1));
-      break;
-   case BCON_TYPE_CODEWSCOPE:
-      BSON_ASSERT (bson_append_code_with_scope (bson, key, -1, val->CODEWSCOPE.js, val->CODEWSCOPE.scope));
-      break;
-   case BCON_TYPE_INT32:
-      BSON_ASSERT (bson_append_int32 (bson, key, -1, val->INT32));
-      break;
-   case BCON_TYPE_TIMESTAMP: {
-      BSON_ASSERT (bson_append_timestamp (bson, key, -1, val->TIMESTAMP.timestamp, val->TIMESTAMP.increment));
-      break;
-   }
-   case BCON_TYPE_INT64:
-      BSON_ASSERT (bson_append_int64 (bson, key, -1, val->INT64));
-      break;
-   case BCON_TYPE_DECIMAL128:
-      BSON_ASSERT (bson_append_decimal128 (bson, key, -1, val->DECIMAL128));
-      break;
-   case BCON_TYPE_MAXKEY:
-      BSON_ASSERT (bson_append_maxkey (bson, key, -1));
-      break;
-   case BCON_TYPE_MINKEY:
-      BSON_ASSERT (bson_append_minkey (bson, key, -1));
-      break;
-   case BCON_TYPE_ARRAY: {
-      BSON_ASSERT (bson_append_array (bson, key, -1, val->ARRAY));
-      break;
-   }
-   case BCON_TYPE_DOCUMENT: {
-      BSON_ASSERT (bson_append_document (bson, key, -1, val->DOCUMENT));
-      break;
-   }
-   case BCON_TYPE_ITER:
-      BSON_ASSERT (bson_append_iter (bson, key, -1, val->ITER));
-      break;
-   default:
-      BSON_ASSERT (0);
-      break;
-   }
-}
-
-#define CHECK_TYPE(_type)                     \
-   do {                                       \
-      if (bson_iter_type (iter) != (_type)) { \
-         return false;                        \
-      }                                       \
-   } while (0)
-
-/* extracts the value under the iterator and writes it to val.  returns false
- * if the iterator type doesn't match the token type.
- *
- * There are two magic tokens:
- *
- * BCONE_SKIP -
- *    Let's us verify that a key has a type, without caring about its value.
- *    This allows for wider declarative BSON verification
- *
- * BCONE_ITER -
- *    Returns the underlying iterator.  This could allow for more complicated,
- *    procedural verification (if a parameter could have multiple types).
- * */
-static bool
-_bcon_extract_single (const bson_iter_t *iter, bcon_type_t type, bcon_extract_t *val)
-{
-   switch ((int) type) {
-   case BCON_TYPE_UTF8:
-      CHECK_TYPE (BSON_TYPE_UTF8);
-      *val->UTF8 = bson_iter_utf8 (iter, NULL);
-      break;
-   case BCON_TYPE_DOUBLE:
-      CHECK_TYPE (BSON_TYPE_DOUBLE);
-      *val->DOUBLE = bson_iter_double (iter);
-      break;
-   case BCON_TYPE_BIN:
-      CHECK_TYPE (BSON_TYPE_BINARY);
-      bson_iter_binary (iter, val->BIN.subtype, val->BIN.length, val->BIN.binary);
-      break;
-   case BCON_TYPE_UNDEFINED:
-      CHECK_TYPE (BSON_TYPE_UNDEFINED);
-      break;
-   case BCON_TYPE_OID:
-      CHECK_TYPE (BSON_TYPE_OID);
-      *val->OID = bson_iter_oid (iter);
-      break;
-   case BCON_TYPE_BOOL:
-      CHECK_TYPE (BSON_TYPE_BOOL);
-      *val->BOOL = bson_iter_bool (iter);
-      break;
-   case BCON_TYPE_DATE_TIME:
-      CHECK_TYPE (BSON_TYPE_DATE_TIME);
-      *val->DATE_TIME = bson_iter_date_time (iter);
-      break;
-   case BCON_TYPE_NULL:
-      CHECK_TYPE (BSON_TYPE_NULL);
-      break;
-   case BCON_TYPE_REGEX:
-      CHECK_TYPE (BSON_TYPE_REGEX);
-      *val->REGEX.regex = bson_iter_regex (iter, val->REGEX.flags);
-
-      break;
-   case BCON_TYPE_DBPOINTER:
-      CHECK_TYPE (BSON_TYPE_DBPOINTER);
-      bson_iter_dbpointer (iter, NULL, val->DBPOINTER.collection, val->DBPOINTER.oid);
-      break;
-   case BCON_TYPE_CODE:
-      CHECK_TYPE (BSON_TYPE_CODE);
-      *val->CODE = bson_iter_code (iter, NULL);
-      break;
-   case BCON_TYPE_SYMBOL:
-      CHECK_TYPE (BSON_TYPE_SYMBOL);
-      *val->SYMBOL = bson_iter_symbol (iter, NULL);
-      break;
-   case BCON_TYPE_CODEWSCOPE: {
-      const uint8_t *buf;
-      uint32_t len;
-
-      CHECK_TYPE (BSON_TYPE_CODEWSCOPE);
-
-      *val->CODEWSCOPE.js = bson_iter_codewscope (iter, NULL, &len, &buf);
-
-      BSON_ASSERT (bson_init_static (val->CODEWSCOPE.scope, buf, len));
-      break;
-   }
-   case BCON_TYPE_INT32:
-      CHECK_TYPE (BSON_TYPE_INT32);
-      *val->INT32 = bson_iter_int32 (iter);
-      break;
-   case BCON_TYPE_TIMESTAMP:
-      CHECK_TYPE (BSON_TYPE_TIMESTAMP);
-      bson_iter_timestamp (iter, val->TIMESTAMP.timestamp, val->TIMESTAMP.increment);
-      break;
-   case BCON_TYPE_INT64:
-      CHECK_TYPE (BSON_TYPE_INT64);
-      *val->INT64 = bson_iter_int64 (iter);
-      break;
-   case BCON_TYPE_DECIMAL128:
-      CHECK_TYPE (BSON_TYPE_DECIMAL128);
-      BSON_ASSERT (bson_iter_decimal128 (iter, val->DECIMAL128));
-      break;
-   case BCON_TYPE_MAXKEY:
-      CHECK_TYPE (BSON_TYPE_MAXKEY);
-      break;
-   case BCON_TYPE_MINKEY:
-      CHECK_TYPE (BSON_TYPE_MINKEY);
-      break;
-   case BCON_TYPE_ARRAY: {
-      const uint8_t *buf;
-      uint32_t len;
-
-      CHECK_TYPE (BSON_TYPE_ARRAY);
-
-      bson_iter_array (iter, &len, &buf);
-
-      BSON_ASSERT (bson_init_static (val->ARRAY, buf, len));
-      break;
-   }
-   case BCON_TYPE_DOCUMENT: {
-      const uint8_t *buf;
-      uint32_t len;
-
-      CHECK_TYPE (BSON_TYPE_DOCUMENT);
-
-      bson_iter_document (iter, &len, &buf);
-
-      BSON_ASSERT (bson_init_static (val->DOCUMENT, buf, len));
-      break;
-   }
-   case BCON_TYPE_SKIP:
-      CHECK_TYPE (val->TYPE);
-      break;
-   case BCON_TYPE_ITER:
-      memcpy (val->ITER, iter, sizeof *iter);
-      break;
-   default:
-      BSON_ASSERT (0);
-      break;
-   }
-
-   return true;
-}
-
-/* Consumes ap, storing output values into u and returning the type of the
- * captured token.
- *
- * The basic workflow goes like this:
- *
- * 1. Look at the current arg.  It will be a char *
- *    a. If it's a NULL, we're done processing.
- *    b. If it's BCON_MAGIC (a symbol with storage in this module)
- *       I. The next token is the type
- *       II. The type specifies how many args to eat and their types
- *    c. Otherwise it's either recursion related or a raw string
- *       I. If the first byte is '{', '}', '[', or ']' pass back an
- *          appropriate recursion token
- *       II. If not, just call it a UTF8 token and pass that back
- */
-static bcon_type_t
-_bcon_append_tokenize (va_list *ap, bcon_append_t *u)
-{
-   char *mark;
-   bcon_type_t type;
-
-   mark = va_arg (*ap, char *);
-
-   BSON_ASSERT (mark != BCONE_MAGIC);
-
-   if (mark == NULL) {
-      type = BCON_TYPE_END;
-   } else if (mark == BCON_MAGIC) {
-      type = va_arg (*ap, bcon_type_t);
-
-      switch ((int) type) {
-      case BCON_TYPE_UTF8:
-         u->UTF8 = va_arg (*ap, char *);
-         break;
-      case BCON_TYPE_DOUBLE:
-         u->DOUBLE = va_arg (*ap, double);
-         break;
-      case BCON_TYPE_DOCUMENT:
-         u->DOCUMENT = va_arg (*ap, bson_t *);
-         break;
-      case BCON_TYPE_ARRAY:
-         u->ARRAY = va_arg (*ap, bson_t *);
-         break;
-      case BCON_TYPE_BIN:
-         u->BIN.subtype = va_arg (*ap, bson_subtype_t);
-         u->BIN.binary = va_arg (*ap, uint8_t *);
-         u->BIN.length = va_arg (*ap, uint32_t);
-         break;
-      case BCON_TYPE_UNDEFINED:
-         break;
-      case BCON_TYPE_OID:
-         u->OID = va_arg (*ap, bson_oid_t *);
-         break;
-      case BCON_TYPE_BOOL:
-         u->BOOL = va_arg (*ap, int);
-         break;
-      case BCON_TYPE_DATE_TIME:
-         u->DATE_TIME = va_arg (*ap, int64_t);
-         break;
-      case BCON_TYPE_NULL:
-         break;
-      case BCON_TYPE_REGEX:
-         u->REGEX.regex = va_arg (*ap, char *);
-         u->REGEX.flags = va_arg (*ap, char *);
-         break;
-      case BCON_TYPE_DBPOINTER:
-         u->DBPOINTER.collection = va_arg (*ap, char *);
-         u->DBPOINTER.oid = va_arg (*ap, bson_oid_t *);
-         break;
-      case BCON_TYPE_CODE:
-         u->CODE = va_arg (*ap, char *);
-         break;
-      case BCON_TYPE_SYMBOL:
-         u->SYMBOL = va_arg (*ap, char *);
-         break;
-      case BCON_TYPE_CODEWSCOPE:
-         u->CODEWSCOPE.js = va_arg (*ap, char *);
-         u->CODEWSCOPE.scope = va_arg (*ap, bson_t *);
-         break;
-      case BCON_TYPE_INT32:
-         u->INT32 = va_arg (*ap, int32_t);
-         break;
-      case BCON_TYPE_TIMESTAMP:
-         u->TIMESTAMP.timestamp = va_arg (*ap, uint32_t);
-         u->TIMESTAMP.increment = va_arg (*ap, uint32_t);
-         break;
-      case BCON_TYPE_INT64:
-         u->INT64 = va_arg (*ap, int64_t);
-         break;
-      case BCON_TYPE_DECIMAL128:
-         u->DECIMAL128 = va_arg (*ap, bson_decimal128_t *);
-         break;
-      case BCON_TYPE_MAXKEY:
-         break;
-      case BCON_TYPE_MINKEY:
-         break;
-      case BCON_TYPE_BCON:
-         u->BCON = va_arg (*ap, bson_t *);
-         break;
-      case BCON_TYPE_ITER:
-         u->ITER = va_arg (*ap, const bson_iter_t *);
-         break;
-      default:
-         BSON_ASSERT (0);
-         break;
-      }
-   } else {
-      switch (mark[0]) {
-      case '{':
-         type = BCON_TYPE_DOC_START;
-         break;
-      case '}':
-         type = BCON_TYPE_DOC_END;
-         break;
-      case '[':
-         type = BCON_TYPE_ARRAY_START;
-         break;
-      case ']':
-         type = BCON_TYPE_ARRAY_END;
-         break;
-
-      default:
-         type = BCON_TYPE_UTF8;
-         u->UTF8 = mark;
-         break;
-      }
-   }
-
-   return type;
-}
-
-
-/* Consumes ap, storing output values into u and returning the type of the
- * captured token.
- *
- * The basic workflow goes like this:
- *
- * 1. Look at the current arg.  It will be a char *
- *    a. If it's a NULL, we're done processing.
- *    b. If it's BCONE_MAGIC (a symbol with storage in this module)
- *       I. The next token is the type
- *       II. The type specifies how many args to eat and their types
- *    c. Otherwise it's either recursion related or a raw string
- *       I. If the first byte is '{', '}', '[', or ']' pass back an
- *          appropriate recursion token
- *       II. If not, just call it a UTF8 token and pass that back
- */
-static bcon_type_t
-_bcon_extract_tokenize (va_list *ap, bcon_extract_t *u)
-{
-   char *mark;
-   bcon_type_t type;
-
-   mark = va_arg (*ap, char *);
-
-   BSON_ASSERT (mark != BCON_MAGIC);
-
-   if (mark == NULL) {
-      type = BCON_TYPE_END;
-   } else if (mark == BCONE_MAGIC) {
-      type = va_arg (*ap, bcon_type_t);
-
-      switch ((int) type) {
-      case BCON_TYPE_UTF8:
-         u->UTF8 = va_arg (*ap, const char **);
-         break;
-      case BCON_TYPE_DOUBLE:
-         u->DOUBLE = va_arg (*ap, double *);
-         break;
-      case BCON_TYPE_DOCUMENT:
-         u->DOCUMENT = va_arg (*ap, bson_t *);
-         break;
-      case BCON_TYPE_ARRAY:
-         u->ARRAY = va_arg (*ap, bson_t *);
-         break;
-      case BCON_TYPE_BIN:
-         u->BIN.subtype = va_arg (*ap, bson_subtype_t *);
-         u->BIN.binary = va_arg (*ap, const uint8_t **);
-         u->BIN.length = va_arg (*ap, uint32_t *);
-         break;
-      case BCON_TYPE_UNDEFINED:
-         break;
-      case BCON_TYPE_OID:
-         u->OID = va_arg (*ap, const bson_oid_t **);
-         break;
-      case BCON_TYPE_BOOL:
-         u->BOOL = va_arg (*ap, bool *);
-         break;
-      case BCON_TYPE_DATE_TIME:
-         u->DATE_TIME = va_arg (*ap, int64_t *);
-         break;
-      case BCON_TYPE_NULL:
-         break;
-      case BCON_TYPE_REGEX:
-         u->REGEX.regex = va_arg (*ap, const char **);
-         u->REGEX.flags = va_arg (*ap, const char **);
-         break;
-      case BCON_TYPE_DBPOINTER:
-         u->DBPOINTER.collection = va_arg (*ap, const char **);
-         u->DBPOINTER.oid = va_arg (*ap, const bson_oid_t **);
-         break;
-      case BCON_TYPE_CODE:
-         u->CODE = va_arg (*ap, const char **);
-         break;
-      case BCON_TYPE_SYMBOL:
-         u->SYMBOL = va_arg (*ap, const char **);
-         break;
-      case BCON_TYPE_CODEWSCOPE:
-         u->CODEWSCOPE.js = va_arg (*ap, const char **);
-         u->CODEWSCOPE.scope = va_arg (*ap, bson_t *);
-         break;
-      case BCON_TYPE_INT32:
-         u->INT32 = va_arg (*ap, int32_t *);
-         break;
-      case BCON_TYPE_TIMESTAMP:
-         u->TIMESTAMP.timestamp = va_arg (*ap, uint32_t *);
-         u->TIMESTAMP.increment = va_arg (*ap, uint32_t *);
-         break;
-      case BCON_TYPE_INT64:
-         u->INT64 = va_arg (*ap, int64_t *);
-         break;
-      case BCON_TYPE_DECIMAL128:
-         u->DECIMAL128 = va_arg (*ap, bson_decimal128_t *);
-         break;
-      case BCON_TYPE_MAXKEY:
-         break;
-      case BCON_TYPE_MINKEY:
-         break;
-      case BCON_TYPE_SKIP:
-         u->TYPE = va_arg (*ap, bson_type_t);
-         break;
-      case BCON_TYPE_ITER:
-         u->ITER = va_arg (*ap, bson_iter_t *);
-         break;
-      default:
-         BSON_ASSERT (0);
-         break;
-      }
-   } else {
-      switch (mark[0]) {
-      case '{':
-         type = BCON_TYPE_DOC_START;
-         break;
-      case '}':
-         type = BCON_TYPE_DOC_END;
-         break;
-      case '[':
-         type = BCON_TYPE_ARRAY_START;
-         break;
-      case ']':
-         type = BCON_TYPE_ARRAY_END;
-         break;
-
-      default:
-         type = BCON_TYPE_RAW;
-         u->key = mark;
-         break;
-      }
-   }
-
-   return type;
-}
-
-
-/* This trivial utility function is useful for concatenating a bson object onto
- * the end of another, ignoring the keys from the source bson object and
- * continuing to use and increment the keys from the source.  It's only useful
- * when called from bcon_append_ctx_va */
-static void
-_bson_concat_array (bson_t *dest, const bson_t *src, bcon_append_ctx_t *ctx)
-{
-   bson_iter_t iter;
-   const char *key;
-   char i_str[16];
-   bool r;
-
-   r = bson_iter_init (&iter, src);
-
-   if (!r) {
-      fprintf (stderr, "Invalid BSON document, possible memory coruption.\n");
-      return;
-   }
-
-   STACK_I--;
-
-   while (bson_iter_next (&iter)) {
-      bson_uint32_to_string (STACK_I, &key, i_str, sizeof i_str);
-      STACK_I++;
-
-      BSON_ASSERT (bson_append_iter (dest, key, -1, &iter));
-   }
-}
-
-
-/* Append_ctx_va consumes the va_list until NULL is found, appending into bson
- * as tokens are found.  It can receive or return an in-progress bson object
- * via the ctx param.  It can also operate on the middle of a va_list, and so
- * can be wrapped inside of another varargs function.
- *
- * Note that passing in a va_list that isn't perferectly formatted for BCON
- * ingestion will almost certainly result in undefined behavior
- *
- * The workflow relies on the passed ctx object, which holds a stack of bson
- * objects, along with metadata (if the emedded layer is an array, and which
- * element it is on if so).  We iterate, generating tokens from the va_list,
- * until we reach an END token.  If any errors occur, we just blow up (the
- * var_args stuff is already incredibly fragile to mistakes, and we have no way
- * of introspecting, so just don't screw it up).
- *
- * There are also a few STACK_* macros in here which manipulate ctx that are
- * defined up top.
- * */
-void
-bcon_append_ctx_va (bson_t *bson, bcon_append_ctx_t *ctx, va_list *ap)
-{
-   bcon_type_t type;
-   const char *key;
-   char i_str[16];
-
-   bcon_append_t u = {0};
-
-   while (1) {
-      if (STACK_IS_ARRAY) {
-         bson_uint32_to_string (STACK_I, &key, i_str, sizeof i_str);
-         STACK_I++;
-      } else {
-         type = _bcon_append_tokenize (ap, &u);
-
-         if (type == BCON_TYPE_END) {
-            return;
-         }
-
-         if (type == BCON_TYPE_DOC_END) {
-            STACK_POP_DOC (bson_append_document_end (STACK_BSON_PARENT, STACK_BSON_CHILD));
-            continue;
-         }
-
-         if (type == BCON_TYPE_BCON) {
-            bson_concat (STACK_BSON_CHILD, u.BCON);
-            continue;
-         }
-
-         BSON_ASSERT (type == BCON_TYPE_UTF8);
-
-         key = u.UTF8;
-      }
-
-      type = _bcon_append_tokenize (ap, &u);
-      BSON_ASSERT (type != BCON_TYPE_END);
-
-      switch ((int) type) {
-      case BCON_TYPE_BCON:
-         BSON_ASSERT (STACK_IS_ARRAY);
-         _bson_concat_array (STACK_BSON_CHILD, u.BCON, ctx);
-
-         break;
-      case BCON_TYPE_DOC_START:
-         STACK_PUSH_DOC (bson_append_document_begin (STACK_BSON_PARENT, key, -1, STACK_BSON_CHILD));
-         break;
-      case BCON_TYPE_DOC_END:
-         STACK_POP_DOC (bson_append_document_end (STACK_BSON_PARENT, STACK_BSON_CHILD));
-         break;
-      case BCON_TYPE_ARRAY_START:
-         STACK_PUSH_ARRAY (bson_append_array_begin (STACK_BSON_PARENT, key, -1, STACK_BSON_CHILD));
-         break;
-      case BCON_TYPE_ARRAY_END:
-         STACK_POP_ARRAY (bson_append_array_end (STACK_BSON_PARENT, STACK_BSON_CHILD));
-         break;
-      default:
-         _bcon_append_single (STACK_BSON_CHILD, type, key, &u);
-
-         break;
-      }
-   }
-}
-
-
-/* extract_ctx_va consumes the va_list until NULL is found, extracting values
- * as tokens are found.  It can receive or return an in-progress bson object
- * via the ctx param.  It can also operate on the middle of a va_list, and so
- * can be wrapped inside of another varargs function.
- *
- * Note that passing in a va_list that isn't perferectly formatted for BCON
- * ingestion will almost certainly result in undefined behavior
- *
- * The workflow relies on the passed ctx object, which holds a stack of iterator
- * objects, along with metadata (if the emedded layer is an array, and which
- * element it is on if so).  We iterate, generating tokens from the va_list,
- * until we reach an END token.  If any errors occur, we just blow up (the
- * var_args stuff is already incredibly fragile to mistakes, and we have no way
- * of introspecting, so just don't screw it up).
- *
- * There are also a few STACK_* macros in here which manipulate ctx that are
- * defined up top.
- *
- * The function returns true if all tokens could be successfully matched, false
- * otherwise.
- * */
-bool
-bcon_extract_ctx_va (bson_t *bson, bcon_extract_ctx_t *ctx, va_list *ap)
-{
-   bcon_type_t type;
-   const char *key;
-   bson_iter_t root_iter;
-   bson_iter_t current_iter;
-   char i_str[16];
-
-   bcon_extract_t u = {0};
-
-   BSON_ASSERT (bson_iter_init (&root_iter, bson));
-
-   while (1) {
-      if (STACK_IS_ARRAY) {
-         bson_uint32_to_string (STACK_I, &key, i_str, sizeof i_str);
-         STACK_I++;
-      } else {
-         type = _bcon_extract_tokenize (ap, &u);
-
-         if (type == BCON_TYPE_END) {
-            return true;
-         }
-
-         if (type == BCON_TYPE_DOC_END) {
-            STACK_POP_DOC (_noop ());
-            continue;
-         }
-
-         BSON_ASSERT (type == BCON_TYPE_RAW);
-
-         key = u.key;
-      }
-
-      type = _bcon_extract_tokenize (ap, &u);
-      BSON_ASSERT (type != BCON_TYPE_END);
-
-      if (type == BCON_TYPE_DOC_END) {
-         STACK_POP_DOC (_noop ());
-      } else if (type == BCON_TYPE_ARRAY_END) {
-         STACK_POP_ARRAY (_noop ());
-      } else {
-         memcpy (&current_iter, STACK_ITER_CHILD, sizeof current_iter);
-
-         if (!bson_iter_find (&current_iter, key)) {
-            return false;
-         }
-
-         switch ((int) type) {
-         case BCON_TYPE_DOC_START:
-
-            if (bson_iter_type (&current_iter) != BSON_TYPE_DOCUMENT) {
-               return false;
-            }
-
-            STACK_PUSH_DOC (bson_iter_recurse (&current_iter, STACK_ITER_CHILD));
-            break;
-         case BCON_TYPE_ARRAY_START:
-
-            if (bson_iter_type (&current_iter) != BSON_TYPE_ARRAY) {
-               return false;
-            }
-
-            STACK_PUSH_ARRAY (bson_iter_recurse (&current_iter, STACK_ITER_CHILD));
-            break;
-         default:
-
-            if (!_bcon_extract_single (&current_iter, type, &u)) {
-               return false;
-            }
-
-            break;
-         }
-      }
-   }
-}
-
-void
-bcon_extract_ctx_init (bcon_extract_ctx_t *ctx)
-{
-   ctx->n = 0;
-   ctx->stack[0].is_array = false;
-}
-
-bool
-bcon_extract (bson_t *bson, ...)
-{
-   va_list ap;
-   bcon_extract_ctx_t ctx;
-   bool r;
-
-   bcon_extract_ctx_init (&ctx);
-
-   va_start (ap, bson);
-
-   r = bcon_extract_ctx_va (bson, &ctx, &ap);
-
-   va_end (ap);
-
-   return r;
-}
-
-
-void
-bcon_append (bson_t *bson, ...)
-{
-   va_list ap;
-   bcon_append_ctx_t ctx;
-
-   bcon_append_ctx_init (&ctx);
-
-   va_start (ap, bson);
-
-   bcon_append_ctx_va (bson, &ctx, &ap);
-
-   va_end (ap);
-}
-
-
-void
-bcon_append_ctx (bson_t *bson, bcon_append_ctx_t *ctx, ...)
-{
-   va_list ap;
-
-   va_start (ap, ctx);
-
-   bcon_append_ctx_va (bson, ctx, &ap);
-
-   va_end (ap);
-}
-
-
-void
-bcon_extract_ctx (bson_t *bson, bcon_extract_ctx_t *ctx, ...)
-{
-   va_list ap;
-
-   va_start (ap, ctx);
-
-   bcon_extract_ctx_va (bson, ctx, &ap);
-
-   va_end (ap);
-}
-
-void
-bcon_append_ctx_init (bcon_append_ctx_t *ctx)
-{
-   ctx->n = 0;
-   ctx->stack[0].is_array = 0;
-}
-
-
-bson_t *
-bcon_new (void *unused, ...)
-{
-   va_list ap;
-   bcon_append_ctx_t ctx;
-   bson_t *bson;
-
-   bcon_append_ctx_init (&ctx);
-
-   bson = bson_new ();
-
-   va_start (ap, unused);
-
-   bcon_append_ctx_va (bson, &ctx, &ap);
-
-   va_end (ap);
-
-   return bson;
-}
diff -pruN 2.0.2-1/src/libbson/src/bson/bcon.h 2.1.0-1/src/libbson/src/bson/bcon.h
--- 2.0.2-1/src/libbson/src/bson/bcon.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libbson/src/bson/bcon.h	1970-01-01 00:00:00.000000000 +0000
@@ -1,245 +0,0 @@
-/*
- * @file bcon.h
- * @brief BCON (BSON C Object Notation) Declarations
- */
-
-#include <bson/bson-prelude.h>
-
-/*    Copyright 2009-present MongoDB, Inc.
- *
- *    Licensed under the Apache License, Version 2.0 (the "License");
- *    you may not use this file except in compliance with the License.
- *    You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- *    Unless required by applicable law or agreed to in writing, software
- *    distributed under the License is distributed on an "AS IS" BASIS,
- *    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- *    See the License for the specific language governing permissions and
- *    limitations under the License.
- */
-
-#ifndef BCON_H_
-#define BCON_H_
-
-#include <bson/bson.h>
-
-
-BSON_BEGIN_DECLS
-
-
-#define BCON_STACK_MAX 100
-
-#define BCON_ENSURE_DECLARE(fun, type)                 \
-   static BSON_INLINE type bcon_ensure_##fun (type _t) \
-   {                                                   \
-      return _t;                                       \
-   }
-
-#define BCON_ENSURE(fun, val) bcon_ensure_##fun (val)
-
-#define BCON_ENSURE_STORAGE(fun, val) bcon_ensure_##fun (&(val))
-
-BCON_ENSURE_DECLARE (const_char_ptr, const char *)
-BCON_ENSURE_DECLARE (const_char_ptr_ptr, const char **)
-BCON_ENSURE_DECLARE (double, double)
-BCON_ENSURE_DECLARE (double_ptr, double *)
-BCON_ENSURE_DECLARE (const_bson_ptr, const bson_t *)
-BCON_ENSURE_DECLARE (bson_ptr, bson_t *)
-BCON_ENSURE_DECLARE (subtype, bson_subtype_t)
-BCON_ENSURE_DECLARE (subtype_ptr, bson_subtype_t *)
-BCON_ENSURE_DECLARE (const_uint8_ptr, const uint8_t *)
-BCON_ENSURE_DECLARE (const_uint8_ptr_ptr, const uint8_t **)
-BCON_ENSURE_DECLARE (uint32, uint32_t)
-BCON_ENSURE_DECLARE (uint32_ptr, uint32_t *)
-BCON_ENSURE_DECLARE (const_oid_ptr, const bson_oid_t *)
-BCON_ENSURE_DECLARE (const_oid_ptr_ptr, const bson_oid_t **)
-BCON_ENSURE_DECLARE (int32, int32_t)
-BCON_ENSURE_DECLARE (int32_ptr, int32_t *)
-BCON_ENSURE_DECLARE (int64, int64_t)
-BCON_ENSURE_DECLARE (int64_ptr, int64_t *)
-BCON_ENSURE_DECLARE (const_decimal128_ptr, const bson_decimal128_t *)
-BCON_ENSURE_DECLARE (bool, bool)
-BCON_ENSURE_DECLARE (bool_ptr, bool *)
-BCON_ENSURE_DECLARE (bson_type, bson_type_t)
-BCON_ENSURE_DECLARE (bson_iter_ptr, bson_iter_t *)
-BCON_ENSURE_DECLARE (const_bson_iter_ptr, const bson_iter_t *)
-
-#define BCON_UTF8(_val) BCON_MAGIC, BCON_TYPE_UTF8, BCON_ENSURE (const_char_ptr, (_val))
-#define BCON_DOUBLE(_val) BCON_MAGIC, BCON_TYPE_DOUBLE, BCON_ENSURE (double, (_val))
-#define BCON_DOCUMENT(_val) BCON_MAGIC, BCON_TYPE_DOCUMENT, BCON_ENSURE (const_bson_ptr, (_val))
-#define BCON_ARRAY(_val) BCON_MAGIC, BCON_TYPE_ARRAY, BCON_ENSURE (const_bson_ptr, (_val))
-#define BCON_BIN(_subtype, _binary, _length)                                                               \
-   BCON_MAGIC, BCON_TYPE_BIN, BCON_ENSURE (subtype, (_subtype)), BCON_ENSURE (const_uint8_ptr, (_binary)), \
-      BCON_ENSURE (uint32, (_length))
-#define BCON_UNDEFINED BCON_MAGIC, BCON_TYPE_UNDEFINED
-#define BCON_OID(_val) BCON_MAGIC, BCON_TYPE_OID, BCON_ENSURE (const_oid_ptr, (_val))
-#define BCON_BOOL(_val) BCON_MAGIC, BCON_TYPE_BOOL, BCON_ENSURE (bool, (_val))
-#define BCON_DATE_TIME(_val) BCON_MAGIC, BCON_TYPE_DATE_TIME, BCON_ENSURE (int64, (_val))
-#define BCON_NULL BCON_MAGIC, BCON_TYPE_NULL
-#define BCON_REGEX(_regex, _flags) \
-   BCON_MAGIC, BCON_TYPE_REGEX, BCON_ENSURE (const_char_ptr, (_regex)), BCON_ENSURE (const_char_ptr, (_flags))
-#define BCON_DBPOINTER(_collection, _oid) \
-   BCON_MAGIC, BCON_TYPE_DBPOINTER, BCON_ENSURE (const_char_ptr, (_collection)), BCON_ENSURE (const_oid_ptr, (_oid))
-#define BCON_CODE(_val) BCON_MAGIC, BCON_TYPE_CODE, BCON_ENSURE (const_char_ptr, (_val))
-#define BCON_SYMBOL(_val) BCON_MAGIC, BCON_TYPE_SYMBOL, BCON_ENSURE (const_char_ptr, (_val))
-#define BCON_CODEWSCOPE(_js, _scope) \
-   BCON_MAGIC, BCON_TYPE_CODEWSCOPE, BCON_ENSURE (const_char_ptr, (_js)), BCON_ENSURE (const_bson_ptr, (_scope))
-#define BCON_INT32(_val) BCON_MAGIC, BCON_TYPE_INT32, BCON_ENSURE (int32, (_val))
-#define BCON_TIMESTAMP(_timestamp, _increment) \
-   BCON_MAGIC, BCON_TYPE_TIMESTAMP, BCON_ENSURE (int32, (_timestamp)), BCON_ENSURE (int32, (_increment))
-#define BCON_INT64(_val) BCON_MAGIC, BCON_TYPE_INT64, BCON_ENSURE (int64, (_val))
-#define BCON_DECIMAL128(_val) BCON_MAGIC, BCON_TYPE_DECIMAL128, BCON_ENSURE (const_decimal128_ptr, (_val))
-#define BCON_MAXKEY BCON_MAGIC, BCON_TYPE_MAXKEY
-#define BCON_MINKEY BCON_MAGIC, BCON_TYPE_MINKEY
-#define BCON(_val) BCON_MAGIC, BCON_TYPE_BCON, BCON_ENSURE (const_bson_ptr, (_val))
-#define BCON_ITER(_val) BCON_MAGIC, BCON_TYPE_ITER, BCON_ENSURE (const_bson_iter_ptr, (_val))
-
-#define BCONE_UTF8(_val) BCONE_MAGIC, BCON_TYPE_UTF8, BCON_ENSURE_STORAGE (const_char_ptr_ptr, (_val))
-#define BCONE_DOUBLE(_val) BCONE_MAGIC, BCON_TYPE_DOUBLE, BCON_ENSURE_STORAGE (double_ptr, (_val))
-#define BCONE_DOCUMENT(_val) BCONE_MAGIC, BCON_TYPE_DOCUMENT, BCON_ENSURE_STORAGE (bson_ptr, (_val))
-#define BCONE_ARRAY(_val) BCONE_MAGIC, BCON_TYPE_ARRAY, BCON_ENSURE_STORAGE (bson_ptr, (_val))
-#define BCONE_BIN(subtype, binary, length)                                   \
-   BCONE_MAGIC, BCON_TYPE_BIN, BCON_ENSURE_STORAGE (subtype_ptr, (subtype)), \
-      BCON_ENSURE_STORAGE (const_uint8_ptr_ptr, (binary)), BCON_ENSURE_STORAGE (uint32_ptr, (length))
-#define BCONE_UNDEFINED BCONE_MAGIC, BCON_TYPE_UNDEFINED
-#define BCONE_OID(_val) BCONE_MAGIC, BCON_TYPE_OID, BCON_ENSURE_STORAGE (const_oid_ptr_ptr, (_val))
-#define BCONE_BOOL(_val) BCONE_MAGIC, BCON_TYPE_BOOL, BCON_ENSURE_STORAGE (bool_ptr, (_val))
-#define BCONE_DATE_TIME(_val) BCONE_MAGIC, BCON_TYPE_DATE_TIME, BCON_ENSURE_STORAGE (int64_ptr, (_val))
-#define BCONE_NULL BCONE_MAGIC, BCON_TYPE_NULL
-#define BCONE_REGEX(_regex, _flags)                                                  \
-   BCONE_MAGIC, BCON_TYPE_REGEX, BCON_ENSURE_STORAGE (const_char_ptr_ptr, (_regex)), \
-      BCON_ENSURE_STORAGE (const_char_ptr_ptr, (_flags))
-#define BCONE_DBPOINTER(_collection, _oid)                                                    \
-   BCONE_MAGIC, BCON_TYPE_DBPOINTER, BCON_ENSURE_STORAGE (const_char_ptr_ptr, (_collection)), \
-      BCON_ENSURE_STORAGE (const_oid_ptr_ptr, (_oid))
-#define BCONE_CODE(_val) BCONE_MAGIC, BCON_TYPE_CODE, BCON_ENSURE_STORAGE (const_char_ptr_ptr, (_val))
-#define BCONE_SYMBOL(_val) BCONE_MAGIC, BCON_TYPE_SYMBOL, BCON_ENSURE_STORAGE (const_char_ptr_ptr, (_val))
-#define BCONE_CODEWSCOPE(_js, _scope)                                                  \
-   BCONE_MAGIC, BCON_TYPE_CODEWSCOPE, BCON_ENSURE_STORAGE (const_char_ptr_ptr, (_js)), \
-      BCON_ENSURE_STORAGE (bson_ptr, (_scope))
-#define BCONE_INT32(_val) BCONE_MAGIC, BCON_TYPE_INT32, BCON_ENSURE_STORAGE (int32_ptr, (_val))
-#define BCONE_TIMESTAMP(_timestamp, _increment)                                     \
-   BCONE_MAGIC, BCON_TYPE_TIMESTAMP, BCON_ENSURE_STORAGE (int32_ptr, (_timestamp)), \
-      BCON_ENSURE_STORAGE (int32_ptr, (_increment))
-#define BCONE_INT64(_val) BCONE_MAGIC, BCON_TYPE_INT64, BCON_ENSURE_STORAGE (int64_ptr, (_val))
-#define BCONE_DECIMAL128(_val) BCONE_MAGIC, BCON_TYPE_DECIMAL128, BCON_ENSURE_STORAGE (const_decimal128_ptr, (_val))
-#define BCONE_MAXKEY BCONE_MAGIC, BCON_TYPE_MAXKEY
-#define BCONE_MINKEY BCONE_MAGIC, BCON_TYPE_MINKEY
-#define BCONE_SKIP(_val) BCONE_MAGIC, BCON_TYPE_SKIP, BCON_ENSURE (bson_type, (_val))
-#define BCONE_ITER(_val) BCONE_MAGIC, BCON_TYPE_ITER, BCON_ENSURE_STORAGE (bson_iter_ptr, (_val))
-
-#define BCON_MAGIC bson_bcon_magic ()
-#define BCONE_MAGIC bson_bcone_magic ()
-
-typedef enum {
-   BCON_TYPE_UTF8,
-   BCON_TYPE_DOUBLE,
-   BCON_TYPE_DOCUMENT,
-   BCON_TYPE_ARRAY,
-   BCON_TYPE_BIN,
-   BCON_TYPE_UNDEFINED,
-   BCON_TYPE_OID,
-   BCON_TYPE_BOOL,
-   BCON_TYPE_DATE_TIME,
-   BCON_TYPE_NULL,
-   BCON_TYPE_REGEX,
-   BCON_TYPE_DBPOINTER,
-   BCON_TYPE_CODE,
-   BCON_TYPE_SYMBOL,
-   BCON_TYPE_CODEWSCOPE,
-   BCON_TYPE_INT32,
-   BCON_TYPE_TIMESTAMP,
-   BCON_TYPE_INT64,
-   BCON_TYPE_DECIMAL128,
-   BCON_TYPE_MAXKEY,
-   BCON_TYPE_MINKEY,
-   BCON_TYPE_BCON,
-   BCON_TYPE_ARRAY_START,
-   BCON_TYPE_ARRAY_END,
-   BCON_TYPE_DOC_START,
-   BCON_TYPE_DOC_END,
-   BCON_TYPE_END,
-   BCON_TYPE_RAW,
-   BCON_TYPE_SKIP,
-   BCON_TYPE_ITER,
-   BCON_TYPE_ERROR,
-} bcon_type_t;
-
-typedef struct bcon_append_ctx_frame {
-   int i;
-   bool is_array;
-   bson_t bson;
-} bcon_append_ctx_frame_t;
-
-typedef struct bcon_extract_ctx_frame {
-   int i;
-   bool is_array;
-   bson_iter_t iter;
-} bcon_extract_ctx_frame_t;
-
-typedef struct _bcon_append_ctx_t {
-   bcon_append_ctx_frame_t stack[BCON_STACK_MAX];
-   int n;
-} bcon_append_ctx_t;
-
-typedef struct _bcon_extract_ctx_t {
-   bcon_extract_ctx_frame_t stack[BCON_STACK_MAX];
-   int n;
-} bcon_extract_ctx_t;
-
-BSON_EXPORT (void)
-bcon_append (bson_t *bson, ...) BSON_GNUC_NULL_TERMINATED;
-BSON_EXPORT (void)
-bcon_append_ctx (bson_t *bson, bcon_append_ctx_t *ctx, ...) BSON_GNUC_NULL_TERMINATED;
-BSON_EXPORT (void)
-bcon_append_ctx_va (bson_t *bson, bcon_append_ctx_t *ctx, va_list *va);
-BSON_EXPORT (void)
-bcon_append_ctx_init (bcon_append_ctx_t *ctx);
-
-BSON_EXPORT (void)
-bcon_extract_ctx_init (bcon_extract_ctx_t *ctx);
-
-BSON_EXPORT (void)
-bcon_extract_ctx (bson_t *bson, bcon_extract_ctx_t *ctx, ...) BSON_GNUC_NULL_TERMINATED;
-
-BSON_EXPORT (bool)
-bcon_extract_ctx_va (bson_t *bson, bcon_extract_ctx_t *ctx, va_list *ap);
-
-BSON_EXPORT (bool)
-bcon_extract (bson_t *bson, ...) BSON_GNUC_NULL_TERMINATED;
-
-BSON_EXPORT (bool)
-bcon_extract_va (bson_t *bson, bcon_extract_ctx_t *ctx, ...) BSON_GNUC_NULL_TERMINATED;
-
-BSON_EXPORT (bson_t *)
-bcon_new (void *unused, ...) BSON_GNUC_NULL_TERMINATED;
-
-/**
- * The bcon_..() functions are all declared with __attribute__((sentinel)).
- *
- * From GCC manual for "sentinel": "A valid NULL in this context is defined as
- * zero with any pointer type. If your system defines the NULL macro with an
- * integer type then you need to add an explicit cast."
- * Case in point: GCC on Solaris (at least)
- */
-#define BCON_APPEND(_bson, ...) bcon_append ((_bson), __VA_ARGS__, (void *) NULL)
-#define BCON_APPEND_CTX(_bson, _ctx, ...) bcon_append_ctx ((_bson), (_ctx), __VA_ARGS__, (void *) NULL)
-
-#define BCON_EXTRACT(_bson, ...) bcon_extract ((_bson), __VA_ARGS__, (void *) NULL)
-
-#define BCON_EXTRACT_CTX(_bson, _ctx, ...) bcon_extract ((_bson), (_ctx), __VA_ARGS__, (void *) NULL)
-
-#define BCON_NEW(...) bcon_new (NULL, __VA_ARGS__, (void *) NULL)
-
-BSON_EXPORT (const char *)
-bson_bcon_magic (void) BSON_GNUC_PURE;
-BSON_EXPORT (const char *)
-bson_bcone_magic (void) BSON_GNUC_PURE;
-
-
-BSON_END_DECLS
-
-
-#endif
diff -pruN 2.0.2-1/src/libbson/src/bson/bson-bcon.c 2.1.0-1/src/libbson/src/bson/bson-bcon.c
--- 2.0.2-1/src/libbson/src/bson/bson-bcon.c	1970-01-01 00:00:00.000000000 +0000
+++ 2.1.0-1/src/libbson/src/bson/bson-bcon.c	2025-08-14 18:37:23.000000000 +0000
@@ -0,0 +1,995 @@
+/*
+ * @file bcon.c
+ * @brief BCON (BSON C Object Notation) Implementation
+ */
+
+/*    Copyright 2009-present MongoDB, Inc.
+ *
+ *    Licensed under the Apache License, Version 2.0 (the "License");
+ *    you may not use this file except in compliance with the License.
+ *    You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *    Unless required by applicable law or agreed to in writing, software
+ *    distributed under the License is distributed on an "AS IS" BASIS,
+ *    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *    See the License for the specific language governing permissions and
+ *    limitations under the License.
+ */
+
+
+#include <bson/bson-bcon.h>
+
+#include <bson/config.h>
+
+#include <stdio.h>
+
+/* These stack manipulation macros are used to manage append recursion in
+ * bcon_append_ctx_va().  They take care of some awkward dereference rules (the
+ * real bson object isn't in the stack, but accessed by pointer) and add in run
+ * time asserts to make sure we don't blow the stack in either direction */
+
+#define STACK_ELE(_delta, _name) (ctx->stack[(_delta) + ctx->n]._name)
+
+#define STACK_BSON(_delta) (((_delta) + ctx->n) == 0 ? bson : &STACK_ELE (_delta, bson))
+
+#define STACK_ITER(_delta) (((_delta) + ctx->n) == 0 ? &root_iter : &STACK_ELE (_delta, iter))
+
+#define STACK_BSON_PARENT STACK_BSON (-1)
+#define STACK_BSON_CHILD STACK_BSON (0)
+
+#define STACK_ITER_CHILD STACK_ITER (0)
+
+#define STACK_I STACK_ELE (0, i)
+#define STACK_IS_ARRAY STACK_ELE (0, is_array)
+
+#define STACK_PUSH_ARRAY(statement)                \
+   do {                                            \
+      BSON_ASSERT (ctx->n < (BCON_STACK_MAX - 1)); \
+      ctx->n++;                                    \
+      STACK_I = 0;                                 \
+      STACK_IS_ARRAY = 1;                          \
+      statement;                                   \
+   } while (0)
+
+#define STACK_PUSH_DOC(statement)                  \
+   do {                                            \
+      BSON_ASSERT (ctx->n < (BCON_STACK_MAX - 1)); \
+      ctx->n++;                                    \
+      STACK_IS_ARRAY = 0;                          \
+      statement;                                   \
+   } while (0)
+
+#define STACK_POP_ARRAY(statement)  \
+   do {                             \
+      BSON_ASSERT (STACK_IS_ARRAY); \
+      BSON_ASSERT (ctx->n != 0);    \
+      statement;                    \
+      ctx->n--;                     \
+   } while (0)
+
+#define STACK_POP_DOC(statement)     \
+   do {                              \
+      BSON_ASSERT (!STACK_IS_ARRAY); \
+      BSON_ASSERT (ctx->n != 0);     \
+      statement;                     \
+      ctx->n--;                      \
+   } while (0)
+
+/* This is a landing pad union for all of the types we can process with bcon.
+ * We need actual storage for this to capture the return value of va_arg, which
+ * takes multiple calls to get everything we need for some complex types */
+typedef union bcon_append {
+   char *UTF8;
+   double DOUBLE;
+   bson_t *DOCUMENT;
+   bson_t *ARRAY;
+   bson_t *BCON;
+
+   struct {
+      bson_subtype_t subtype;
+      uint8_t *binary;
+      uint32_t length;
+   } BIN;
+
+   bson_oid_t *OID;
+   bool BOOL;
+   int64_t DATE_TIME;
+
+   struct {
+      char *regex;
+      char *flags;
+   } REGEX;
+
+   struct {
+      char *collection;
+      bson_oid_t *oid;
+   } DBPOINTER;
+
+   const char *CODE;
+
+   char *SYMBOL;
+
+   struct {
+      const char *js;
+      bson_t *scope;
+   } CODEWSCOPE;
+
+   int32_t INT32;
+
+   struct {
+      uint32_t timestamp;
+      uint32_t increment;
+   } TIMESTAMP;
+
+   int64_t INT64;
+   bson_decimal128_t *DECIMAL128;
+   const bson_iter_t *ITER;
+} bcon_append_t;
+
+/* same as bcon_append_t.  Some extra symbols and varying types that handle the
+ * differences between bson_append and bson_iter */
+typedef union bcon_extract {
+   bson_type_t TYPE;
+   bson_iter_t *ITER;
+   const char *key;
+   const char **UTF8;
+   double *DOUBLE;
+   bson_t *DOCUMENT;
+   bson_t *ARRAY;
+
+   struct {
+      bson_subtype_t *subtype;
+      const uint8_t **binary;
+      uint32_t *length;
+   } BIN;
+
+   const bson_oid_t **OID;
+   bool *BOOL;
+   int64_t *DATE_TIME;
+
+   struct {
+      const char **regex;
+      const char **flags;
+   } REGEX;
+
+   struct {
+      const char **collection;
+      const bson_oid_t **oid;
+   } DBPOINTER;
+
+   const char **CODE;
+
+   const char **SYMBOL;
+
+   struct {
+      const char **js;
+      bson_t *scope;
+   } CODEWSCOPE;
+
+   int32_t *INT32;
+
+   struct {
+      uint32_t *timestamp;
+      uint32_t *increment;
+   } TIMESTAMP;
+
+   int64_t *INT64;
+   bson_decimal128_t *DECIMAL128;
+} bcon_extract_t;
+
+static const char *gBconMagic = "BCON_MAGIC";
+static const char *gBconeMagic = "BCONE_MAGIC";
+
+const char *
+bson_bcon_magic (void)
+{
+   return gBconMagic;
+}
+
+
+const char *
+bson_bcone_magic (void)
+{
+   return gBconeMagic;
+}
+
+static void
+_noop (void)
+{
+}
+
+/* appends val to the passed bson object.  Meant to be a super simple dispatch
+ * table */
+static void
+_bcon_append_single (bson_t *bson, bcon_type_t type, const char *key, bcon_append_t *val)
+{
+   switch ((int) type) {
+   case BCON_TYPE_UTF8:
+      BSON_ASSERT (bson_append_utf8 (bson, key, -1, val->UTF8, -1));
+      break;
+   case BCON_TYPE_DOUBLE:
+      BSON_ASSERT (bson_append_double (bson, key, -1, val->DOUBLE));
+      break;
+   case BCON_TYPE_BIN: {
+      BSON_ASSERT (bson_append_binary (bson, key, -1, val->BIN.subtype, val->BIN.binary, val->BIN.length));
+      break;
+   }
+   case BCON_TYPE_UNDEFINED:
+      BSON_ASSERT (bson_append_undefined (bson, key, -1));
+      break;
+   case BCON_TYPE_OID:
+      BSON_ASSERT (bson_append_oid (bson, key, -1, val->OID));
+      break;
+   case BCON_TYPE_BOOL:
+      BSON_ASSERT (bson_append_bool (bson, key, -1, (bool) val->BOOL));
+      break;
+   case BCON_TYPE_DATE_TIME:
+      BSON_ASSERT (bson_append_date_time (bson, key, -1, val->DATE_TIME));
+      break;
+   case BCON_TYPE_NULL:
+      BSON_ASSERT (bson_append_null (bson, key, -1));
+      break;
+   case BCON_TYPE_REGEX: {
+      BSON_ASSERT (bson_append_regex (bson, key, -1, val->REGEX.regex, val->REGEX.flags));
+      break;
+   }
+   case BCON_TYPE_DBPOINTER: {
+      BSON_ASSERT (bson_append_dbpointer (bson, key, -1, val->DBPOINTER.collection, val->DBPOINTER.oid));
+      break;
+   }
+   case BCON_TYPE_CODE:
+      BSON_ASSERT (bson_append_code (bson, key, -1, val->CODE));
+      break;
+   case BCON_TYPE_SYMBOL:
+      BSON_ASSERT (bson_append_symbol (bson, key, -1, val->SYMBOL, -1));
+      break;
+   case BCON_TYPE_CODEWSCOPE:
+      BSON_ASSERT (bson_append_code_with_scope (bson, key, -1, val->CODEWSCOPE.js, val->CODEWSCOPE.scope));
+      break;
+   case BCON_TYPE_INT32:
+      BSON_ASSERT (bson_append_int32 (bson, key, -1, val->INT32));
+      break;
+   case BCON_TYPE_TIMESTAMP: {
+      BSON_ASSERT (bson_append_timestamp (bson, key, -1, val->TIMESTAMP.timestamp, val->TIMESTAMP.increment));
+      break;
+   }
+   case BCON_TYPE_INT64:
+      BSON_ASSERT (bson_append_int64 (bson, key, -1, val->INT64));
+      break;
+   case BCON_TYPE_DECIMAL128:
+      BSON_ASSERT (bson_append_decimal128 (bson, key, -1, val->DECIMAL128));
+      break;
+   case BCON_TYPE_MAXKEY:
+      BSON_ASSERT (bson_append_maxkey (bson, key, -1));
+      break;
+   case BCON_TYPE_MINKEY:
+      BSON_ASSERT (bson_append_minkey (bson, key, -1));
+      break;
+   case BCON_TYPE_ARRAY: {
+      BSON_ASSERT (bson_append_array (bson, key, -1, val->ARRAY));
+      break;
+   }
+   case BCON_TYPE_DOCUMENT: {
+      BSON_ASSERT (bson_append_document (bson, key, -1, val->DOCUMENT));
+      break;
+   }
+   case BCON_TYPE_ITER:
+      BSON_ASSERT (bson_append_iter (bson, key, -1, val->ITER));
+      break;
+   default:
+      BSON_ASSERT (0);
+      break;
+   }
+}
+
+#define CHECK_TYPE(_type)                     \
+   do {                                       \
+      if (bson_iter_type (iter) != (_type)) { \
+         return false;                        \
+      }                                       \
+   } while (0)
+
+/* extracts the value under the iterator and writes it to val.  returns false
+ * if the iterator type doesn't match the token type.
+ *
+ * There are two magic tokens:
+ *
+ * BCONE_SKIP -
+ *    Let's us verify that a key has a type, without caring about its value.
+ *    This allows for wider declarative BSON verification
+ *
+ * BCONE_ITER -
+ *    Returns the underlying iterator.  This could allow for more complicated,
+ *    procedural verification (if a parameter could have multiple types).
+ * */
+static bool
+_bcon_extract_single (const bson_iter_t *iter, bcon_type_t type, bcon_extract_t *val)
+{
+   switch ((int) type) {
+   case BCON_TYPE_UTF8:
+      CHECK_TYPE (BSON_TYPE_UTF8);
+      *val->UTF8 = bson_iter_utf8 (iter, NULL);
+      break;
+   case BCON_TYPE_DOUBLE:
+      CHECK_TYPE (BSON_TYPE_DOUBLE);
+      *val->DOUBLE = bson_iter_double (iter);
+      break;
+   case BCON_TYPE_BIN:
+      CHECK_TYPE (BSON_TYPE_BINARY);
+      bson_iter_binary (iter, val->BIN.subtype, val->BIN.length, val->BIN.binary);
+      break;
+   case BCON_TYPE_UNDEFINED:
+      CHECK_TYPE (BSON_TYPE_UNDEFINED);
+      break;
+   case BCON_TYPE_OID:
+      CHECK_TYPE (BSON_TYPE_OID);
+      *val->OID = bson_iter_oid (iter);
+      break;
+   case BCON_TYPE_BOOL:
+      CHECK_TYPE (BSON_TYPE_BOOL);
+      *val->BOOL = bson_iter_bool (iter);
+      break;
+   case BCON_TYPE_DATE_TIME:
+      CHECK_TYPE (BSON_TYPE_DATE_TIME);
+      *val->DATE_TIME = bson_iter_date_time (iter);
+      break;
+   case BCON_TYPE_NULL:
+      CHECK_TYPE (BSON_TYPE_NULL);
+      break;
+   case BCON_TYPE_REGEX:
+      CHECK_TYPE (BSON_TYPE_REGEX);
+      *val->REGEX.regex = bson_iter_regex (iter, val->REGEX.flags);
+
+      break;
+   case BCON_TYPE_DBPOINTER:
+      CHECK_TYPE (BSON_TYPE_DBPOINTER);
+      bson_iter_dbpointer (iter, NULL, val->DBPOINTER.collection, val->DBPOINTER.oid);
+      break;
+   case BCON_TYPE_CODE:
+      CHECK_TYPE (BSON_TYPE_CODE);
+      *val->CODE = bson_iter_code (iter, NULL);
+      break;
+   case BCON_TYPE_SYMBOL:
+      CHECK_TYPE (BSON_TYPE_SYMBOL);
+      *val->SYMBOL = bson_iter_symbol (iter, NULL);
+      break;
+   case BCON_TYPE_CODEWSCOPE: {
+      const uint8_t *buf;
+      uint32_t len;
+
+      CHECK_TYPE (BSON_TYPE_CODEWSCOPE);
+
+      *val->CODEWSCOPE.js = bson_iter_codewscope (iter, NULL, &len, &buf);
+
+      BSON_ASSERT (bson_init_static (val->CODEWSCOPE.scope, buf, len));
+      break;
+   }
+   case BCON_TYPE_INT32:
+      CHECK_TYPE (BSON_TYPE_INT32);
+      *val->INT32 = bson_iter_int32 (iter);
+      break;
+   case BCON_TYPE_TIMESTAMP:
+      CHECK_TYPE (BSON_TYPE_TIMESTAMP);
+      bson_iter_timestamp (iter, val->TIMESTAMP.timestamp, val->TIMESTAMP.increment);
+      break;
+   case BCON_TYPE_INT64:
+      CHECK_TYPE (BSON_TYPE_INT64);
+      *val->INT64 = bson_iter_int64 (iter);
+      break;
+   case BCON_TYPE_DECIMAL128:
+      CHECK_TYPE (BSON_TYPE_DECIMAL128);
+      BSON_ASSERT (bson_iter_decimal128 (iter, val->DECIMAL128));
+      break;
+   case BCON_TYPE_MAXKEY:
+      CHECK_TYPE (BSON_TYPE_MAXKEY);
+      break;
+   case BCON_TYPE_MINKEY:
+      CHECK_TYPE (BSON_TYPE_MINKEY);
+      break;
+   case BCON_TYPE_ARRAY: {
+      const uint8_t *buf;
+      uint32_t len;
+
+      CHECK_TYPE (BSON_TYPE_ARRAY);
+
+      bson_iter_array (iter, &len, &buf);
+
+      BSON_ASSERT (bson_init_static (val->ARRAY, buf, len));
+      break;
+   }
+   case BCON_TYPE_DOCUMENT: {
+      const uint8_t *buf;
+      uint32_t len;
+
+      CHECK_TYPE (BSON_TYPE_DOCUMENT);
+
+      bson_iter_document (iter, &len, &buf);
+
+      BSON_ASSERT (bson_init_static (val->DOCUMENT, buf, len));
+      break;
+   }
+   case BCON_TYPE_SKIP:
+      CHECK_TYPE (val->TYPE);
+      break;
+   case BCON_TYPE_ITER:
+      memcpy (val->ITER, iter, sizeof *iter);
+      break;
+   default:
+      BSON_ASSERT (0);
+      break;
+   }
+
+   return true;
+}
+
+/* Consumes ap, storing output values into u and returning the type of the
+ * captured token.
+ *
+ * The basic workflow goes like this:
+ *
+ * 1. Look at the current arg.  It will be a char *
+ *    a. If it's a NULL, we're done processing.
+ *    b. If it's BCON_MAGIC (a symbol with storage in this module)
+ *       I. The next token is the type
+ *       II. The type specifies how many args to eat and their types
+ *    c. Otherwise it's either recursion related or a raw string
+ *       I. If the first byte is '{', '}', '[', or ']' pass back an
+ *          appropriate recursion token
+ *       II. If not, just call it a UTF8 token and pass that back
+ */
+static bcon_type_t
+_bcon_append_tokenize (va_list *ap, bcon_append_t *u)
+{
+   char *mark;
+   bcon_type_t type;
+
+   mark = va_arg (*ap, char *);
+
+   BSON_ASSERT (mark != BCONE_MAGIC);
+
+   if (mark == NULL) {
+      type = BCON_TYPE_END;
+   } else if (mark == BCON_MAGIC) {
+      type = va_arg (*ap, bcon_type_t);
+
+      switch ((int) type) {
+      case BCON_TYPE_UTF8:
+         u->UTF8 = va_arg (*ap, char *);
+         break;
+      case BCON_TYPE_DOUBLE:
+         u->DOUBLE = va_arg (*ap, double);
+         break;
+      case BCON_TYPE_DOCUMENT:
+         u->DOCUMENT = va_arg (*ap, bson_t *);
+         break;
+      case BCON_TYPE_ARRAY:
+         u->ARRAY = va_arg (*ap, bson_t *);
+         break;
+      case BCON_TYPE_BIN:
+         u->BIN.subtype = va_arg (*ap, bson_subtype_t);
+         u->BIN.binary = va_arg (*ap, uint8_t *);
+         u->BIN.length = va_arg (*ap, uint32_t);
+         break;
+      case BCON_TYPE_UNDEFINED:
+         break;
+      case BCON_TYPE_OID:
+         u->OID = va_arg (*ap, bson_oid_t *);
+         break;
+      case BCON_TYPE_BOOL:
+         u->BOOL = va_arg (*ap, int);
+         break;
+      case BCON_TYPE_DATE_TIME:
+         u->DATE_TIME = va_arg (*ap, int64_t);
+         break;
+      case BCON_TYPE_NULL:
+         break;
+      case BCON_TYPE_REGEX:
+         u->REGEX.regex = va_arg (*ap, char *);
+         u->REGEX.flags = va_arg (*ap, char *);
+         break;
+      case BCON_TYPE_DBPOINTER:
+         u->DBPOINTER.collection = va_arg (*ap, char *);
+         u->DBPOINTER.oid = va_arg (*ap, bson_oid_t *);
+         break;
+      case BCON_TYPE_CODE:
+         u->CODE = va_arg (*ap, char *);
+         break;
+      case BCON_TYPE_SYMBOL:
+         u->SYMBOL = va_arg (*ap, char *);
+         break;
+      case BCON_TYPE_CODEWSCOPE:
+         u->CODEWSCOPE.js = va_arg (*ap, char *);
+         u->CODEWSCOPE.scope = va_arg (*ap, bson_t *);
+         break;
+      case BCON_TYPE_INT32:
+         u->INT32 = va_arg (*ap, int32_t);
+         break;
+      case BCON_TYPE_TIMESTAMP:
+         u->TIMESTAMP.timestamp = va_arg (*ap, uint32_t);
+         u->TIMESTAMP.increment = va_arg (*ap, uint32_t);
+         break;
+      case BCON_TYPE_INT64:
+         u->INT64 = va_arg (*ap, int64_t);
+         break;
+      case BCON_TYPE_DECIMAL128:
+         u->DECIMAL128 = va_arg (*ap, bson_decimal128_t *);
+         break;
+      case BCON_TYPE_MAXKEY:
+         break;
+      case BCON_TYPE_MINKEY:
+         break;
+      case BCON_TYPE_BCON:
+         u->BCON = va_arg (*ap, bson_t *);
+         break;
+      case BCON_TYPE_ITER:
+         u->ITER = va_arg (*ap, const bson_iter_t *);
+         break;
+      default:
+         BSON_ASSERT (0);
+         break;
+      }
+   } else {
+      switch (mark[0]) {
+      case '{':
+         type = BCON_TYPE_DOC_START;
+         break;
+      case '}':
+         type = BCON_TYPE_DOC_END;
+         break;
+      case '[':
+         type = BCON_TYPE_ARRAY_START;
+         break;
+      case ']':
+         type = BCON_TYPE_ARRAY_END;
+         break;
+
+      default:
+         type = BCON_TYPE_UTF8;
+         u->UTF8 = mark;
+         break;
+      }
+   }
+
+   return type;
+}
+
+
+/* Consumes ap, storing output values into u and returning the type of the
+ * captured token.
+ *
+ * The basic workflow goes like this:
+ *
+ * 1. Look at the current arg.  It will be a char *
+ *    a. If it's a NULL, we're done processing.
+ *    b. If it's BCONE_MAGIC (a symbol with storage in this module)
+ *       I. The next token is the type
+ *       II. The type specifies how many args to eat and their types
+ *    c. Otherwise it's either recursion related or a raw string
+ *       I. If the first byte is '{', '}', '[', or ']' pass back an
+ *          appropriate recursion token
+ *       II. If not, just call it a UTF8 token and pass that back
+ */
+static bcon_type_t
+_bcon_extract_tokenize (va_list *ap, bcon_extract_t *u)
+{
+   char *mark;
+   bcon_type_t type;
+
+   mark = va_arg (*ap, char *);
+
+   BSON_ASSERT (mark != BCON_MAGIC);
+
+   if (mark == NULL) {
+      type = BCON_TYPE_END;
+   } else if (mark == BCONE_MAGIC) {
+      type = va_arg (*ap, bcon_type_t);
+
+      switch ((int) type) {
+      case BCON_TYPE_UTF8:
+         u->UTF8 = va_arg (*ap, const char **);
+         break;
+      case BCON_TYPE_DOUBLE:
+         u->DOUBLE = va_arg (*ap, double *);
+         break;
+      case BCON_TYPE_DOCUMENT:
+         u->DOCUMENT = va_arg (*ap, bson_t *);
+         break;
+      case BCON_TYPE_ARRAY:
+         u->ARRAY = va_arg (*ap, bson_t *);
+         break;
+      case BCON_TYPE_BIN:
+         u->BIN.subtype = va_arg (*ap, bson_subtype_t *);
+         u->BIN.binary = va_arg (*ap, const uint8_t **);
+         u->BIN.length = va_arg (*ap, uint32_t *);
+         break;
+      case BCON_TYPE_UNDEFINED:
+         break;
+      case BCON_TYPE_OID:
+         u->OID = va_arg (*ap, const bson_oid_t **);
+         break;
+      case BCON_TYPE_BOOL:
+         u->BOOL = va_arg (*ap, bool *);
+         break;
+      case BCON_TYPE_DATE_TIME:
+         u->DATE_TIME = va_arg (*ap, int64_t *);
+         break;
+      case BCON_TYPE_NULL:
+         break;
+      case BCON_TYPE_REGEX:
+         u->REGEX.regex = va_arg (*ap, const char **);
+         u->REGEX.flags = va_arg (*ap, const char **);
+         break;
+      case BCON_TYPE_DBPOINTER:
+         u->DBPOINTER.collection = va_arg (*ap, const char **);
+         u->DBPOINTER.oid = va_arg (*ap, const bson_oid_t **);
+         break;
+      case BCON_TYPE_CODE:
+         u->CODE = va_arg (*ap, const char **);
+         break;
+      case BCON_TYPE_SYMBOL:
+         u->SYMBOL = va_arg (*ap, const char **);
+         break;
+      case BCON_TYPE_CODEWSCOPE:
+         u->CODEWSCOPE.js = va_arg (*ap, const char **);
+         u->CODEWSCOPE.scope = va_arg (*ap, bson_t *);
+         break;
+      case BCON_TYPE_INT32:
+         u->INT32 = va_arg (*ap, int32_t *);
+         break;
+      case BCON_TYPE_TIMESTAMP:
+         u->TIMESTAMP.timestamp = va_arg (*ap, uint32_t *);
+         u->TIMESTAMP.increment = va_arg (*ap, uint32_t *);
+         break;
+      case BCON_TYPE_INT64:
+         u->INT64 = va_arg (*ap, int64_t *);
+         break;
+      case BCON_TYPE_DECIMAL128:
+         u->DECIMAL128 = va_arg (*ap, bson_decimal128_t *);
+         break;
+      case BCON_TYPE_MAXKEY:
+         break;
+      case BCON_TYPE_MINKEY:
+         break;
+      case BCON_TYPE_SKIP:
+         u->TYPE = va_arg (*ap, bson_type_t);
+         break;
+      case BCON_TYPE_ITER:
+         u->ITER = va_arg (*ap, bson_iter_t *);
+         break;
+      default:
+         BSON_ASSERT (0);
+         break;
+      }
+   } else {
+      switch (mark[0]) {
+      case '{':
+         type = BCON_TYPE_DOC_START;
+         break;
+      case '}':
+         type = BCON_TYPE_DOC_END;
+         break;
+      case '[':
+         type = BCON_TYPE_ARRAY_START;
+         break;
+      case ']':
+         type = BCON_TYPE_ARRAY_END;
+         break;
+
+      default:
+         type = BCON_TYPE_RAW;
+         u->key = mark;
+         break;
+      }
+   }
+
+   return type;
+}
+
+
+/* This trivial utility function is useful for concatenating a bson object onto
+ * the end of another, ignoring the keys from the source bson object and
+ * continuing to use and increment the keys from the source.  It's only useful
+ * when called from bcon_append_ctx_va */
+static void
+_bson_concat_array (bson_t *dest, const bson_t *src, bcon_append_ctx_t *ctx)
+{
+   bson_iter_t iter;
+   const char *key;
+   char i_str[16];
+   bool r;
+
+   r = bson_iter_init (&iter, src);
+
+   if (!r) {
+      fprintf (stderr, "Invalid BSON document, possible memory coruption.\n");
+      return;
+   }
+
+   STACK_I--;
+
+   while (bson_iter_next (&iter)) {
+      bson_uint32_to_string (STACK_I, &key, i_str, sizeof i_str);
+      STACK_I++;
+
+      BSON_ASSERT (bson_append_iter (dest, key, -1, &iter));
+   }
+}
+
+
+/* Append_ctx_va consumes the va_list until NULL is found, appending into bson
+ * as tokens are found.  It can receive or return an in-progress bson object
+ * via the ctx param.  It can also operate on the middle of a va_list, and so
+ * can be wrapped inside of another varargs function.
+ *
+ * Note that passing in a va_list that isn't perferectly formatted for BCON
+ * ingestion will almost certainly result in undefined behavior
+ *
+ * The workflow relies on the passed ctx object, which holds a stack of bson
+ * objects, along with metadata (if the emedded layer is an array, and which
+ * element it is on if so).  We iterate, generating tokens from the va_list,
+ * until we reach an END token.  If any errors occur, we just blow up (the
+ * var_args stuff is already incredibly fragile to mistakes, and we have no way
+ * of introspecting, so just don't screw it up).
+ *
+ * There are also a few STACK_* macros in here which manipulate ctx that are
+ * defined up top.
+ * */
+void
+bcon_append_ctx_va (bson_t *bson, bcon_append_ctx_t *ctx, va_list *ap)
+{
+   bcon_type_t type;
+   const char *key;
+   char i_str[16];
+
+   bcon_append_t u = {0};
+
+   while (1) {
+      if (STACK_IS_ARRAY) {
+         bson_uint32_to_string (STACK_I, &key, i_str, sizeof i_str);
+         STACK_I++;
+      } else {
+         type = _bcon_append_tokenize (ap, &u);
+
+         if (type == BCON_TYPE_END) {
+            return;
+         }
+
+         if (type == BCON_TYPE_DOC_END) {
+            STACK_POP_DOC (bson_append_document_end (STACK_BSON_PARENT, STACK_BSON_CHILD));
+            continue;
+         }
+
+         if (type == BCON_TYPE_BCON) {
+            bson_concat (STACK_BSON_CHILD, u.BCON);
+            continue;
+         }
+
+         BSON_ASSERT (type == BCON_TYPE_UTF8);
+
+         key = u.UTF8;
+      }
+
+      type = _bcon_append_tokenize (ap, &u);
+      BSON_ASSERT (type != BCON_TYPE_END);
+
+      switch ((int) type) {
+      case BCON_TYPE_BCON:
+         BSON_ASSERT (STACK_IS_ARRAY);
+         _bson_concat_array (STACK_BSON_CHILD, u.BCON, ctx);
+
+         break;
+      case BCON_TYPE_DOC_START:
+         STACK_PUSH_DOC (bson_append_document_begin (STACK_BSON_PARENT, key, -1, STACK_BSON_CHILD));
+         break;
+      case BCON_TYPE_DOC_END:
+         STACK_POP_DOC (bson_append_document_end (STACK_BSON_PARENT, STACK_BSON_CHILD));
+         break;
+      case BCON_TYPE_ARRAY_START:
+         STACK_PUSH_ARRAY (bson_append_array_begin (STACK_BSON_PARENT, key, -1, STACK_BSON_CHILD));
+         break;
+      case BCON_TYPE_ARRAY_END:
+         STACK_POP_ARRAY (bson_append_array_end (STACK_BSON_PARENT, STACK_BSON_CHILD));
+         break;
+      default:
+         _bcon_append_single (STACK_BSON_CHILD, type, key, &u);
+
+         break;
+      }
+   }
+}
+
+
+/* extract_ctx_va consumes the va_list until NULL is found, extracting values
+ * as tokens are found.  It can receive or return an in-progress bson object
+ * via the ctx param.  It can also operate on the middle of a va_list, and so
+ * can be wrapped inside of another varargs function.
+ *
+ * Note that passing in a va_list that isn't perferectly formatted for BCON
+ * ingestion will almost certainly result in undefined behavior
+ *
+ * The workflow relies on the passed ctx object, which holds a stack of iterator
+ * objects, along with metadata (if the emedded layer is an array, and which
+ * element it is on if so).  We iterate, generating tokens from the va_list,
+ * until we reach an END token.  If any errors occur, we just blow up (the
+ * var_args stuff is already incredibly fragile to mistakes, and we have no way
+ * of introspecting, so just don't screw it up).
+ *
+ * There are also a few STACK_* macros in here which manipulate ctx that are
+ * defined up top.
+ *
+ * The function returns true if all tokens could be successfully matched, false
+ * otherwise.
+ * */
+bool
+bcon_extract_ctx_va (bson_t *bson, bcon_extract_ctx_t *ctx, va_list *ap)
+{
+   bcon_type_t type;
+   const char *key;
+   bson_iter_t root_iter;
+   bson_iter_t current_iter;
+   char i_str[16];
+
+   bcon_extract_t u = {0};
+
+   BSON_ASSERT (bson_iter_init (&root_iter, bson));
+
+   while (1) {
+      if (STACK_IS_ARRAY) {
+         bson_uint32_to_string (STACK_I, &key, i_str, sizeof i_str);
+         STACK_I++;
+      } else {
+         type = _bcon_extract_tokenize (ap, &u);
+
+         if (type == BCON_TYPE_END) {
+            return true;
+         }
+
+         if (type == BCON_TYPE_DOC_END) {
+            STACK_POP_DOC (_noop ());
+            continue;
+         }
+
+         BSON_ASSERT (type == BCON_TYPE_RAW);
+
+         key = u.key;
+      }
+
+      type = _bcon_extract_tokenize (ap, &u);
+      BSON_ASSERT (type != BCON_TYPE_END);
+
+      if (type == BCON_TYPE_DOC_END) {
+         STACK_POP_DOC (_noop ());
+      } else if (type == BCON_TYPE_ARRAY_END) {
+         STACK_POP_ARRAY (_noop ());
+      } else {
+         memcpy (&current_iter, STACK_ITER_CHILD, sizeof current_iter);
+
+         if (!bson_iter_find (&current_iter, key)) {
+            return false;
+         }
+
+         switch ((int) type) {
+         case BCON_TYPE_DOC_START:
+
+            if (bson_iter_type (&current_iter) != BSON_TYPE_DOCUMENT) {
+               return false;
+            }
+
+            STACK_PUSH_DOC (bson_iter_recurse (&current_iter, STACK_ITER_CHILD));
+            break;
+         case BCON_TYPE_ARRAY_START:
+
+            if (bson_iter_type (&current_iter) != BSON_TYPE_ARRAY) {
+               return false;
+            }
+
+            STACK_PUSH_ARRAY (bson_iter_recurse (&current_iter, STACK_ITER_CHILD));
+            break;
+         default:
+
+            if (!_bcon_extract_single (&current_iter, type, &u)) {
+               return false;
+            }
+
+            break;
+         }
+      }
+   }
+}
+
+void
+bcon_extract_ctx_init (bcon_extract_ctx_t *ctx)
+{
+   ctx->n = 0;
+   ctx->stack[0].is_array = false;
+}
+
+bool
+bcon_extract (bson_t *bson, ...)
+{
+   va_list ap;
+   bcon_extract_ctx_t ctx;
+   bool r;
+
+   bcon_extract_ctx_init (&ctx);
+
+   va_start (ap, bson);
+
+   r = bcon_extract_ctx_va (bson, &ctx, &ap);
+
+   va_end (ap);
+
+   return r;
+}
+
+
+void
+bcon_append (bson_t *bson, ...)
+{
+   va_list ap;
+   bcon_append_ctx_t ctx;
+
+   bcon_append_ctx_init (&ctx);
+
+   va_start (ap, bson);
+
+   bcon_append_ctx_va (bson, &ctx, &ap);
+
+   va_end (ap);
+}
+
+
+void
+bcon_append_ctx (bson_t *bson, bcon_append_ctx_t *ctx, ...)
+{
+   va_list ap;
+
+   va_start (ap, ctx);
+
+   bcon_append_ctx_va (bson, ctx, &ap);
+
+   va_end (ap);
+}
+
+
+void
+bcon_extract_ctx (bson_t *bson, bcon_extract_ctx_t *ctx, ...)
+{
+   va_list ap;
+
+   va_start (ap, ctx);
+
+   bcon_extract_ctx_va (bson, ctx, &ap);
+
+   va_end (ap);
+}
+
+void
+bcon_append_ctx_init (bcon_append_ctx_t *ctx)
+{
+   ctx->n = 0;
+   ctx->stack[0].is_array = 0;
+}
+
+
+bson_t *
+bcon_new (void *unused, ...)
+{
+   va_list ap;
+   bcon_append_ctx_t ctx;
+   bson_t *bson;
+
+   bcon_append_ctx_init (&ctx);
+
+   bson = bson_new ();
+
+   va_start (ap, unused);
+
+   bcon_append_ctx_va (bson, &ctx, &ap);
+
+   va_end (ap);
+
+   return bson;
+}
diff -pruN 2.0.2-1/src/libbson/src/bson/bson-bcon.h 2.1.0-1/src/libbson/src/bson/bson-bcon.h
--- 2.0.2-1/src/libbson/src/bson/bson-bcon.h	1970-01-01 00:00:00.000000000 +0000
+++ 2.1.0-1/src/libbson/src/bson/bson-bcon.h	2025-08-14 18:37:23.000000000 +0000
@@ -0,0 +1,249 @@
+/*
+ * @file bcon.h
+ * @brief BCON (BSON C Object Notation) Declarations
+ */
+
+#include <bson/bson-prelude.h>
+
+/*    Copyright 2009-present MongoDB, Inc.
+ *
+ *    Licensed under the Apache License, Version 2.0 (the "License");
+ *    you may not use this file except in compliance with the License.
+ *    You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *    Unless required by applicable law or agreed to in writing, software
+ *    distributed under the License is distributed on an "AS IS" BASIS,
+ *    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *    See the License for the specific language governing permissions and
+ *    limitations under the License.
+ */
+
+#ifndef BCON_H_
+#define BCON_H_
+
+// Include specific headers first, because bson.h tries to include this header itself:
+#include <bson/bson-types.h>
+#include <bson/macros.h>
+// For other APIs, not properly grouped, but needed:
+#include <bson/bson.h>
+
+
+BSON_BEGIN_DECLS
+
+
+#define BCON_STACK_MAX 100
+
+#define BCON_ENSURE_DECLARE(fun, type)                 \
+   static BSON_INLINE type bcon_ensure_##fun (type _t) \
+   {                                                   \
+      return _t;                                       \
+   }
+
+#define BCON_ENSURE(fun, val) bcon_ensure_##fun (val)
+
+#define BCON_ENSURE_STORAGE(fun, val) bcon_ensure_##fun (&(val))
+
+BCON_ENSURE_DECLARE (const_char_ptr, const char *)
+BCON_ENSURE_DECLARE (const_char_ptr_ptr, const char **)
+BCON_ENSURE_DECLARE (double, double)
+BCON_ENSURE_DECLARE (double_ptr, double *)
+BCON_ENSURE_DECLARE (const_bson_ptr, const bson_t *)
+BCON_ENSURE_DECLARE (bson_ptr, bson_t *)
+BCON_ENSURE_DECLARE (subtype, bson_subtype_t)
+BCON_ENSURE_DECLARE (subtype_ptr, bson_subtype_t *)
+BCON_ENSURE_DECLARE (const_uint8_ptr, const uint8_t *)
+BCON_ENSURE_DECLARE (const_uint8_ptr_ptr, const uint8_t **)
+BCON_ENSURE_DECLARE (uint32, uint32_t)
+BCON_ENSURE_DECLARE (uint32_ptr, uint32_t *)
+BCON_ENSURE_DECLARE (const_oid_ptr, const bson_oid_t *)
+BCON_ENSURE_DECLARE (const_oid_ptr_ptr, const bson_oid_t **)
+BCON_ENSURE_DECLARE (int32, int32_t)
+BCON_ENSURE_DECLARE (int32_ptr, int32_t *)
+BCON_ENSURE_DECLARE (int64, int64_t)
+BCON_ENSURE_DECLARE (int64_ptr, int64_t *)
+BCON_ENSURE_DECLARE (const_decimal128_ptr, const bson_decimal128_t *)
+BCON_ENSURE_DECLARE (bool, bool)
+BCON_ENSURE_DECLARE (bool_ptr, bool *)
+BCON_ENSURE_DECLARE (bson_type, bson_type_t)
+BCON_ENSURE_DECLARE (bson_iter_ptr, bson_iter_t *)
+BCON_ENSURE_DECLARE (const_bson_iter_ptr, const bson_iter_t *)
+
+#define BCON_UTF8(_val) BCON_MAGIC, BCON_TYPE_UTF8, BCON_ENSURE (const_char_ptr, (_val))
+#define BCON_DOUBLE(_val) BCON_MAGIC, BCON_TYPE_DOUBLE, BCON_ENSURE (double, (_val))
+#define BCON_DOCUMENT(_val) BCON_MAGIC, BCON_TYPE_DOCUMENT, BCON_ENSURE (const_bson_ptr, (_val))
+#define BCON_ARRAY(_val) BCON_MAGIC, BCON_TYPE_ARRAY, BCON_ENSURE (const_bson_ptr, (_val))
+#define BCON_BIN(_subtype, _binary, _length)                                                               \
+   BCON_MAGIC, BCON_TYPE_BIN, BCON_ENSURE (subtype, (_subtype)), BCON_ENSURE (const_uint8_ptr, (_binary)), \
+      BCON_ENSURE (uint32, (_length))
+#define BCON_UNDEFINED BCON_MAGIC, BCON_TYPE_UNDEFINED
+#define BCON_OID(_val) BCON_MAGIC, BCON_TYPE_OID, BCON_ENSURE (const_oid_ptr, (_val))
+#define BCON_BOOL(_val) BCON_MAGIC, BCON_TYPE_BOOL, BCON_ENSURE (bool, (_val))
+#define BCON_DATE_TIME(_val) BCON_MAGIC, BCON_TYPE_DATE_TIME, BCON_ENSURE (int64, (_val))
+#define BCON_NULL BCON_MAGIC, BCON_TYPE_NULL
+#define BCON_REGEX(_regex, _flags) \
+   BCON_MAGIC, BCON_TYPE_REGEX, BCON_ENSURE (const_char_ptr, (_regex)), BCON_ENSURE (const_char_ptr, (_flags))
+#define BCON_DBPOINTER(_collection, _oid) \
+   BCON_MAGIC, BCON_TYPE_DBPOINTER, BCON_ENSURE (const_char_ptr, (_collection)), BCON_ENSURE (const_oid_ptr, (_oid))
+#define BCON_CODE(_val) BCON_MAGIC, BCON_TYPE_CODE, BCON_ENSURE (const_char_ptr, (_val))
+#define BCON_SYMBOL(_val) BCON_MAGIC, BCON_TYPE_SYMBOL, BCON_ENSURE (const_char_ptr, (_val))
+#define BCON_CODEWSCOPE(_js, _scope) \
+   BCON_MAGIC, BCON_TYPE_CODEWSCOPE, BCON_ENSURE (const_char_ptr, (_js)), BCON_ENSURE (const_bson_ptr, (_scope))
+#define BCON_INT32(_val) BCON_MAGIC, BCON_TYPE_INT32, BCON_ENSURE (int32, (_val))
+#define BCON_TIMESTAMP(_timestamp, _increment) \
+   BCON_MAGIC, BCON_TYPE_TIMESTAMP, BCON_ENSURE (int32, (_timestamp)), BCON_ENSURE (int32, (_increment))
+#define BCON_INT64(_val) BCON_MAGIC, BCON_TYPE_INT64, BCON_ENSURE (int64, (_val))
+#define BCON_DECIMAL128(_val) BCON_MAGIC, BCON_TYPE_DECIMAL128, BCON_ENSURE (const_decimal128_ptr, (_val))
+#define BCON_MAXKEY BCON_MAGIC, BCON_TYPE_MAXKEY
+#define BCON_MINKEY BCON_MAGIC, BCON_TYPE_MINKEY
+#define BCON(_val) BCON_MAGIC, BCON_TYPE_BCON, BCON_ENSURE (const_bson_ptr, (_val))
+#define BCON_ITER(_val) BCON_MAGIC, BCON_TYPE_ITER, BCON_ENSURE (const_bson_iter_ptr, (_val))
+
+#define BCONE_UTF8(_val) BCONE_MAGIC, BCON_TYPE_UTF8, BCON_ENSURE_STORAGE (const_char_ptr_ptr, (_val))
+#define BCONE_DOUBLE(_val) BCONE_MAGIC, BCON_TYPE_DOUBLE, BCON_ENSURE_STORAGE (double_ptr, (_val))
+#define BCONE_DOCUMENT(_val) BCONE_MAGIC, BCON_TYPE_DOCUMENT, BCON_ENSURE_STORAGE (bson_ptr, (_val))
+#define BCONE_ARRAY(_val) BCONE_MAGIC, BCON_TYPE_ARRAY, BCON_ENSURE_STORAGE (bson_ptr, (_val))
+#define BCONE_BIN(subtype, binary, length)                                   \
+   BCONE_MAGIC, BCON_TYPE_BIN, BCON_ENSURE_STORAGE (subtype_ptr, (subtype)), \
+      BCON_ENSURE_STORAGE (const_uint8_ptr_ptr, (binary)), BCON_ENSURE_STORAGE (uint32_ptr, (length))
+#define BCONE_UNDEFINED BCONE_MAGIC, BCON_TYPE_UNDEFINED
+#define BCONE_OID(_val) BCONE_MAGIC, BCON_TYPE_OID, BCON_ENSURE_STORAGE (const_oid_ptr_ptr, (_val))
+#define BCONE_BOOL(_val) BCONE_MAGIC, BCON_TYPE_BOOL, BCON_ENSURE_STORAGE (bool_ptr, (_val))
+#define BCONE_DATE_TIME(_val) BCONE_MAGIC, BCON_TYPE_DATE_TIME, BCON_ENSURE_STORAGE (int64_ptr, (_val))
+#define BCONE_NULL BCONE_MAGIC, BCON_TYPE_NULL
+#define BCONE_REGEX(_regex, _flags)                                                  \
+   BCONE_MAGIC, BCON_TYPE_REGEX, BCON_ENSURE_STORAGE (const_char_ptr_ptr, (_regex)), \
+      BCON_ENSURE_STORAGE (const_char_ptr_ptr, (_flags))
+#define BCONE_DBPOINTER(_collection, _oid)                                                    \
+   BCONE_MAGIC, BCON_TYPE_DBPOINTER, BCON_ENSURE_STORAGE (const_char_ptr_ptr, (_collection)), \
+      BCON_ENSURE_STORAGE (const_oid_ptr_ptr, (_oid))
+#define BCONE_CODE(_val) BCONE_MAGIC, BCON_TYPE_CODE, BCON_ENSURE_STORAGE (const_char_ptr_ptr, (_val))
+#define BCONE_SYMBOL(_val) BCONE_MAGIC, BCON_TYPE_SYMBOL, BCON_ENSURE_STORAGE (const_char_ptr_ptr, (_val))
+#define BCONE_CODEWSCOPE(_js, _scope)                                                  \
+   BCONE_MAGIC, BCON_TYPE_CODEWSCOPE, BCON_ENSURE_STORAGE (const_char_ptr_ptr, (_js)), \
+      BCON_ENSURE_STORAGE (bson_ptr, (_scope))
+#define BCONE_INT32(_val) BCONE_MAGIC, BCON_TYPE_INT32, BCON_ENSURE_STORAGE (int32_ptr, (_val))
+#define BCONE_TIMESTAMP(_timestamp, _increment)                                     \
+   BCONE_MAGIC, BCON_TYPE_TIMESTAMP, BCON_ENSURE_STORAGE (int32_ptr, (_timestamp)), \
+      BCON_ENSURE_STORAGE (int32_ptr, (_increment))
+#define BCONE_INT64(_val) BCONE_MAGIC, BCON_TYPE_INT64, BCON_ENSURE_STORAGE (int64_ptr, (_val))
+#define BCONE_DECIMAL128(_val) BCONE_MAGIC, BCON_TYPE_DECIMAL128, BCON_ENSURE_STORAGE (const_decimal128_ptr, (_val))
+#define BCONE_MAXKEY BCONE_MAGIC, BCON_TYPE_MAXKEY
+#define BCONE_MINKEY BCONE_MAGIC, BCON_TYPE_MINKEY
+#define BCONE_SKIP(_val) BCONE_MAGIC, BCON_TYPE_SKIP, BCON_ENSURE (bson_type, (_val))
+#define BCONE_ITER(_val) BCONE_MAGIC, BCON_TYPE_ITER, BCON_ENSURE_STORAGE (bson_iter_ptr, (_val))
+
+#define BCON_MAGIC bson_bcon_magic ()
+#define BCONE_MAGIC bson_bcone_magic ()
+
+typedef enum {
+   BCON_TYPE_UTF8,
+   BCON_TYPE_DOUBLE,
+   BCON_TYPE_DOCUMENT,
+   BCON_TYPE_ARRAY,
+   BCON_TYPE_BIN,
+   BCON_TYPE_UNDEFINED,
+   BCON_TYPE_OID,
+   BCON_TYPE_BOOL,
+   BCON_TYPE_DATE_TIME,
+   BCON_TYPE_NULL,
+   BCON_TYPE_REGEX,
+   BCON_TYPE_DBPOINTER,
+   BCON_TYPE_CODE,
+   BCON_TYPE_SYMBOL,
+   BCON_TYPE_CODEWSCOPE,
+   BCON_TYPE_INT32,
+   BCON_TYPE_TIMESTAMP,
+   BCON_TYPE_INT64,
+   BCON_TYPE_DECIMAL128,
+   BCON_TYPE_MAXKEY,
+   BCON_TYPE_MINKEY,
+   BCON_TYPE_BCON,
+   BCON_TYPE_ARRAY_START,
+   BCON_TYPE_ARRAY_END,
+   BCON_TYPE_DOC_START,
+   BCON_TYPE_DOC_END,
+   BCON_TYPE_END,
+   BCON_TYPE_RAW,
+   BCON_TYPE_SKIP,
+   BCON_TYPE_ITER,
+   BCON_TYPE_ERROR,
+} bcon_type_t;
+
+typedef struct bcon_append_ctx_frame {
+   int i;
+   bool is_array;
+   bson_t bson;
+} bcon_append_ctx_frame_t;
+
+typedef struct bcon_extract_ctx_frame {
+   int i;
+   bool is_array;
+   bson_iter_t iter;
+} bcon_extract_ctx_frame_t;
+
+typedef struct _bcon_append_ctx_t {
+   bcon_append_ctx_frame_t stack[BCON_STACK_MAX];
+   int n;
+} bcon_append_ctx_t;
+
+typedef struct _bcon_extract_ctx_t {
+   bcon_extract_ctx_frame_t stack[BCON_STACK_MAX];
+   int n;
+} bcon_extract_ctx_t;
+
+BSON_EXPORT (void)
+bcon_append (bson_t *bson, ...) BSON_GNUC_NULL_TERMINATED;
+BSON_EXPORT (void)
+bcon_append_ctx (bson_t *bson, bcon_append_ctx_t *ctx, ...) BSON_GNUC_NULL_TERMINATED;
+BSON_EXPORT (void)
+bcon_append_ctx_va (bson_t *bson, bcon_append_ctx_t *ctx, va_list *va);
+BSON_EXPORT (void)
+bcon_append_ctx_init (bcon_append_ctx_t *ctx);
+
+BSON_EXPORT (void)
+bcon_extract_ctx_init (bcon_extract_ctx_t *ctx);
+
+BSON_EXPORT (void)
+bcon_extract_ctx (bson_t *bson, bcon_extract_ctx_t *ctx, ...) BSON_GNUC_NULL_TERMINATED;
+
+BSON_EXPORT (bool)
+bcon_extract_ctx_va (bson_t *bson, bcon_extract_ctx_t *ctx, va_list *ap);
+
+BSON_EXPORT (bool)
+bcon_extract (bson_t *bson, ...) BSON_GNUC_NULL_TERMINATED;
+
+BSON_EXPORT (bool)
+bcon_extract_va (bson_t *bson, bcon_extract_ctx_t *ctx, ...) BSON_GNUC_NULL_TERMINATED;
+
+BSON_EXPORT (bson_t *)
+bcon_new (void *unused, ...) BSON_GNUC_NULL_TERMINATED;
+
+/**
+ * The bcon_..() functions are all declared with __attribute__((sentinel)).
+ *
+ * From GCC manual for "sentinel": "A valid NULL in this context is defined as
+ * zero with any pointer type. If your system defines the NULL macro with an
+ * integer type then you need to add an explicit cast."
+ * Case in point: GCC on Solaris (at least)
+ */
+#define BCON_APPEND(_bson, ...) bcon_append ((_bson), __VA_ARGS__, (void *) NULL)
+#define BCON_APPEND_CTX(_bson, _ctx, ...) bcon_append_ctx ((_bson), (_ctx), __VA_ARGS__, (void *) NULL)
+
+#define BCON_EXTRACT(_bson, ...) bcon_extract ((_bson), __VA_ARGS__, (void *) NULL)
+
+#define BCON_EXTRACT_CTX(_bson, _ctx, ...) bcon_extract ((_bson), (_ctx), __VA_ARGS__, (void *) NULL)
+
+#define BCON_NEW(...) bcon_new (NULL, __VA_ARGS__, (void *) NULL)
+
+BSON_EXPORT (const char *)
+bson_bcon_magic (void) BSON_GNUC_PURE;
+BSON_EXPORT (const char *)
+bson_bcone_magic (void) BSON_GNUC_PURE;
+
+
+BSON_END_DECLS
+
+
+#endif
diff -pruN 2.0.2-1/src/libbson/src/bson/bson-clock.c 2.1.0-1/src/libbson/src/bson/bson-clock.c
--- 2.0.2-1/src/libbson/src/bson/bson-clock.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libbson/src/bson/bson-clock.c	2025-08-14 18:37:23.000000000 +0000
@@ -14,13 +14,14 @@
  * limitations under the License.
  */
 
-#include <bson/bson-config.h>
-#include <bson/bson-compat.h>
+#include <bson/compat.h>
+#include <bson/config.h>
 
 
 #if defined(BSON_HAVE_CLOCK_GETTIME)
-#include <time.h>
 #include <sys/time.h>
+
+#include <time.h>
 #endif
 
 #include <bson/bson-clock.h>
diff -pruN 2.0.2-1/src/libbson/src/bson/bson-clock.h 2.1.0-1/src/libbson/src/bson/bson-clock.h
--- 2.0.2-1/src/libbson/src/bson/bson-clock.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libbson/src/bson/bson-clock.h	2025-08-14 18:37:23.000000000 +0000
@@ -21,9 +21,9 @@
 #define BSON_CLOCK_H
 
 
-#include <bson/bson-compat.h>
-#include <bson/bson-macros.h>
 #include <bson/bson-types.h>
+#include <bson/compat.h>
+#include <bson/macros.h>
 
 
 BSON_BEGIN_DECLS
diff -pruN 2.0.2-1/src/libbson/src/bson/bson-compat.h 2.1.0-1/src/libbson/src/bson/bson-compat.h
--- 2.0.2-1/src/libbson/src/bson/bson-compat.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libbson/src/bson/bson-compat.h	1970-01-01 00:00:00.000000000 +0000
@@ -1,214 +0,0 @@
-/*
- * Copyright 2009-present MongoDB, Inc.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#include <bson/bson-prelude.h>
-
-
-#ifndef BSON_COMPAT_H
-#define BSON_COMPAT_H
-
-
-#if defined(__MINGW32__)
-#if defined(__USE_MINGW_ANSI_STDIO)
-#if __USE_MINGW_ANSI_STDIO < 1
-#error "__USE_MINGW_ANSI_STDIO > 0 is required for correct PRI* macros"
-#endif
-#else
-#define __USE_MINGW_ANSI_STDIO 1
-#endif
-#endif
-
-#include <bson/bson-config.h>
-#include <bson/bson-macros.h>
-
-
-#ifdef BSON_OS_WIN32
-#if defined(_WIN32_WINNT) && (_WIN32_WINNT < 0x0601)
-#undef _WIN32_WINNT
-#endif
-#ifndef _WIN32_WINNT
-#define _WIN32_WINNT 0x0601
-#endif
-#ifndef NOMINMAX
-#define NOMINMAX
-#endif
-#include <winsock2.h>
-#ifndef WIN32_LEAN_AND_MEAN
-#define WIN32_LEAN_AND_MEAN
-#include <windows.h>
-#undef WIN32_LEAN_AND_MEAN
-#else
-#include <windows.h>
-#endif
-#include <direct.h>
-#include <io.h>
-#endif
-
-
-#ifdef BSON_OS_UNIX
-#include <unistd.h>
-#include <sys/time.h>
-#endif
-
-
-#include <bson/bson-macros.h>
-
-
-#include <errno.h>
-#include <ctype.h>
-#include <limits.h>
-#include <fcntl.h>
-#include <sys/stat.h>
-#include <stdarg.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <time.h>
-#include <stdint.h>
-
-
-BSON_BEGIN_DECLS
-
-#if !defined(_MSC_VER) || (_MSC_VER >= 1800)
-#include <inttypes.h>
-#endif
-#ifdef _MSC_VER
-#ifndef __cplusplus
-/* benign redefinition of type */
-#pragma warning(disable : 4142)
-#ifndef _SSIZE_T_DEFINED
-#define _SSIZE_T_DEFINED
-typedef SSIZE_T ssize_t;
-#endif
-#ifndef _SIZE_T_DEFINED
-#define _SIZE_T_DEFINED
-typedef SIZE_T size_t;
-#endif
-#pragma warning(default : 4142)
-#else
-/*
- * MSVC++ does not include ssize_t, just size_t.
- * So we need to synthesize that as well.
- */
-#pragma warning(disable : 4142)
-#ifndef _SSIZE_T_DEFINED
-#define _SSIZE_T_DEFINED
-typedef SSIZE_T ssize_t;
-#endif
-#pragma warning(default : 4142)
-#endif
-#ifndef PRIi32
-#define PRIi32 "d"
-#endif
-#ifndef PRId32
-#define PRId32 "d"
-#endif
-#ifndef PRIu32
-#define PRIu32 "u"
-#endif
-#ifndef PRIi64
-#define PRIi64 "I64i"
-#endif
-#ifndef PRId64
-#define PRId64 "I64i"
-#endif
-#ifndef PRIu64
-#define PRIu64 "I64u"
-#endif
-#endif
-
-/* Derive the maximum representable value of signed integer type T using the
- * formula 2^(N - 1) - 1 where N is the number of bits in type T. This assumes
- * T is represented using two's complement. */
-#define BSON_NUMERIC_LIMITS_MAX_SIGNED(T) ((T) ((((size_t) 0x01u) << (sizeof (T) * (size_t) CHAR_BIT - 1u)) - 1u))
-
-/* Derive the minimum representable value of signed integer type T as one less
- * than the negation of its maximum representable value. This assumes T is
- * represented using two's complement. */
-#define BSON_NUMERIC_LIMITS_MIN_SIGNED(T, max) ((T) ((-(max)) - 1))
-
-/* Derive the maximum representable value of unsigned integer type T by flipping
- * all its bits to 1. */
-#define BSON_NUMERIC_LIMITS_MAX_UNSIGNED(T) ((T) (~((T) 0)))
-
-#ifndef SSIZE_MAX
-#define SSIZE_MAX BSON_NUMERIC_LIMITS_MAX_SIGNED (ssize_t)
-#endif
-
-#ifndef SSIZE_MIN
-#define SSIZE_MIN BSON_NUMERIC_LIMITS_MIN_SIGNED (ssize_t, SSIZE_MAX)
-#endif
-
-#if defined(__MINGW32__) && !defined(INIT_ONCE_STATIC_INIT)
-#define INIT_ONCE_STATIC_INIT RTL_RUN_ONCE_INIT
-typedef RTL_RUN_ONCE INIT_ONCE;
-#endif
-
-#ifdef BSON_HAVE_STDBOOL_H
-#include <stdbool.h>
-#elif !defined(__bool_true_false_are_defined)
-#ifndef __cplusplus
-typedef signed char bool;
-#define false 0
-#define true 1
-#endif
-#define __bool_true_false_are_defined 1
-#endif
-
-
-#if !defined(va_copy) && defined(__va_copy)
-#define va_copy(dst, src) __va_copy (dst, src)
-#endif
-
-
-#if !defined(va_copy)
-#define va_copy(dst, src) ((dst) = (src))
-#endif
-
-
-#ifdef _MSC_VER
-/** Expands the arguments if compiling with MSVC, otherwise empty */
-#define BSON_IF_MSVC(...) __VA_ARGS__
-/** Expands the arguments if compiling with GCC or Clang, otherwise empty */
-#define BSON_IF_GNU_LIKE(...)
-#elif defined(__GNUC__) || defined(__clang__)
-/** Expands the arguments if compiling with MSVC, otherwise empty */
-#define BSON_IF_MSVC(...)
-/** Expands the arguments if compiling with GCC or Clang, otherwise empty */
-#define BSON_IF_GNU_LIKE(...) __VA_ARGS__
-#else
-/** Unsupported compiler. **/
-#define BSON_IF_MSVC(...)
-#define BSON_IF_GNU_LIKE(...)
-#endif
-
-#ifdef BSON_OS_WIN32
-/** Expands the arguments if compiling for Windows, otherwise empty */
-#define BSON_IF_WINDOWS(...) __VA_ARGS__
-/** Expands the arguments if compiling for POSIX, otherwise empty */
-#define BSON_IF_POSIX(...)
-#elif defined(BSON_OS_UNIX)
-/** Expands the arguments if compiling for Windows, otherwise empty */
-#define BSON_IF_WINDOWS(...)
-/** Expands the arguments if compiling for POSIX, otherwise empty */
-#define BSON_IF_POSIX(...) __VA_ARGS__
-#endif
-
-
-BSON_END_DECLS
-
-
-#endif /* BSON_COMPAT_H */
diff -pruN 2.0.2-1/src/libbson/src/bson/bson-config.h.in 2.1.0-1/src/libbson/src/bson/bson-config.h.in
--- 2.0.2-1/src/libbson/src/bson/bson-config.h.in	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libbson/src/bson/bson-config.h.in	1970-01-01 00:00:00.000000000 +0000
@@ -1,126 +0,0 @@
-/*
- * Copyright 2009-present MongoDB, Inc.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#if !defined(BSON_INSIDE) && !defined(BSON_COMPILATION)
-#error "Only <bson/bson.h> can be included directly."
-#endif
-
-#ifndef BSON_CONFIG_H
-#define BSON_CONFIG_H
-
-/*
- * Define to 1234 for Little Endian, 4321 for Big Endian.
- */
-#define BSON_BYTE_ORDER @BSON_BYTE_ORDER@
-
-
-/*
- * Define to 1 if you have stdbool.h
- */
-#define BSON_HAVE_STDBOOL_H @BSON_HAVE_STDBOOL_H@
-#if BSON_HAVE_STDBOOL_H != 1
-# undef BSON_HAVE_STDBOOL_H
-#endif
-
-
-/*
- * Define to 1 for POSIX-like systems, 2 for Windows.
- */
-#define BSON_OS @BSON_OS@
-
-
-/*
- * Define to 1 if you have clock_gettime() available.
- */
-#define BSON_HAVE_CLOCK_GETTIME @BSON_HAVE_CLOCK_GETTIME@
-#if BSON_HAVE_CLOCK_GETTIME != 1
-# undef BSON_HAVE_CLOCK_GETTIME
-#endif
-
-
-/*
- * Define to 1 if you have strings.h available on your platform.
- */
-#define BSON_HAVE_STRINGS_H @BSON_HAVE_STRINGS_H@
-#if BSON_HAVE_STRINGS_H != 1
-# undef BSON_HAVE_STRINGS_H
-#endif
-
-
-/*
- * Define to 1 if you have strnlen available on your platform.
- */
-#define BSON_HAVE_STRNLEN @BSON_HAVE_STRNLEN@
-#if BSON_HAVE_STRNLEN != 1
-# undef BSON_HAVE_STRNLEN
-#endif
-
-
-/*
- * Define to 1 if you have snprintf available on your platform.
- */
-#define BSON_HAVE_SNPRINTF @BSON_HAVE_SNPRINTF@
-#if BSON_HAVE_SNPRINTF != 1
-# undef BSON_HAVE_SNPRINTF
-#endif
-
-
-/*
- * Define to 1 if you have gmtime_r available on your platform.
- */
-#define BSON_HAVE_GMTIME_R @BSON_HAVE_GMTIME_R@
-#if BSON_HAVE_GMTIME_R != 1
-# undef BSON_HAVE_GMTIME_R
-#endif
-
-
-/*
- * Define to 1 if you have struct timespec available on your platform.
- */
-#define BSON_HAVE_TIMESPEC @BSON_HAVE_TIMESPEC@
-#if BSON_HAVE_TIMESPEC != 1
-# undef BSON_HAVE_TIMESPEC
-#endif
-
-
-
-/*
- * Define to 1 if you have rand_r available on your platform.
- */
-#define BSON_HAVE_RAND_R @BSON_HAVE_RAND_R@
-#if BSON_HAVE_RAND_R != 1
-# undef BSON_HAVE_RAND_R
-#endif
-
-
-/*
- * Define to 1 if you have strlcpy available on your platform.
- */
-#define BSON_HAVE_STRLCPY @BSON_HAVE_STRLCPY@
-#if BSON_HAVE_STRLCPY != 1
-# undef BSON_HAVE_STRLCPY
-#endif
-
-
-/*
- * Define to 1 if you have aligned_alloc available on your platform.
- */
-#define BSON_HAVE_ALIGNED_ALLOC @BSON_HAVE_ALIGNED_ALLOC@
-#if BSON_HAVE_ALIGNED_ALLOC != 1
-# undef BSON_HAVE_ALIGNED_ALLOC
-#endif
-
-#endif /* BSON_CONFIG_H */
diff -pruN 2.0.2-1/src/libbson/src/bson/bson-context-private.h 2.1.0-1/src/libbson/src/bson/bson-context-private.h
--- 2.0.2-1/src/libbson/src/bson/bson-context-private.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libbson/src/bson/bson-context-private.h	2025-08-14 18:37:23.000000000 +0000
@@ -21,9 +21,10 @@
 #define BSON_CONTEXT_PRIVATE_H
 
 
-#include <bson/bson-context.h>
 #include <common-thread-private.h>
 
+#include <bson/bson-context.h>
+
 
 BSON_BEGIN_DECLS
 
diff -pruN 2.0.2-1/src/libbson/src/bson/bson-context.c 2.1.0-1/src/libbson/src/bson/bson-context.c
--- 2.0.2-1/src/libbson/src/bson/bson-context.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libbson/src/bson/bson-context.c	2025-08-14 18:37:23.000000000 +0000
@@ -14,8 +14,18 @@
  * limitations under the License.
  */
 
+#include <bson/bson-context.h>
+
+#include <bson/bson-context-private.h>
+#include <common-atomic-private.h>
+#include <common-thread-private.h>
+
+#include <bson/bson-clock.h>
+#include <bson/bson-context.h>
+#include <bson/compat.h>
+#include <bson/memory.h>
+
 #include <mlib/intencode.h>
-#include <bson/bson-compat.h>
 
 #include <limits.h>
 #include <stdarg.h>
@@ -23,13 +33,6 @@
 #include <string.h>
 #include <time.h>
 
-#include <common-atomic-private.h>
-#include <bson/bson-clock.h>
-#include <bson/bson-context.h>
-#include <bson/bson-context-private.h>
-#include <bson/bson-memory.h>
-#include <common-thread-private.h>
-
 
 #ifndef HOST_NAME_MAX
 #define HOST_NAME_MAX 256
@@ -323,7 +326,6 @@ bson_context_destroy (bson_context_t *co
    bson_free (context);
 }
 
-
 static BSON_ONCE_FUN (_bson_context_init_default)
 {
    _bson_context_init (&gContextDefault, BSON_CONTEXT_DISABLE_PID_CACHE);
diff -pruN 2.0.2-1/src/libbson/src/bson/bson-context.h 2.1.0-1/src/libbson/src/bson/bson-context.h
--- 2.0.2-1/src/libbson/src/bson/bson-context.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libbson/src/bson/bson-context.h	2025-08-14 18:37:23.000000000 +0000
@@ -21,8 +21,8 @@
 #define BSON_CONTEXT_H
 
 
-#include <bson/bson-macros.h>
 #include <bson/bson-types.h>
+#include <bson/macros.h>
 
 
 BSON_BEGIN_DECLS
diff -pruN 2.0.2-1/src/libbson/src/bson/bson-decimal128.c 2.1.0-1/src/libbson/src/bson/bson-decimal128.c
--- 2.0.2-1/src/libbson/src/bson/bson-decimal128.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libbson/src/bson/bson-decimal128.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,4 +1,3 @@
-
 /*
  * Copyright 2009-present MongoDB, Inc.
  *
@@ -15,17 +14,20 @@
  * limitations under the License.
  */
 
-#include <stdlib.h>
-#include <string.h>
-#include <ctype.h>
-
 #include <bson/bson-decimal128.h>
-#include <bson/bson-types.h>
-#include <bson/bson-macros.h>
+
 #include <common-string-private.h>
+
+#include <bson/bson-types.h>
+#include <bson/macros.h>
+
 #include <mlib/cmp.h>
 #include <mlib/loop.h>
 
+#include <ctype.h>
+#include <stdlib.h>
+#include <string.h>
+
 
 #define BSON_DECIMAL128_EXPONENT_MAX 6111
 #define BSON_DECIMAL128_EXPONENT_MIN -6176
diff -pruN 2.0.2-1/src/libbson/src/bson/bson-decimal128.h 2.1.0-1/src/libbson/src/bson/bson-decimal128.h
--- 2.0.2-1/src/libbson/src/bson/bson-decimal128.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libbson/src/bson/bson-decimal128.h	2025-08-14 18:37:23.000000000 +0000
@@ -21,11 +21,11 @@
 #define BSON_DECIMAL128_H
 
 
-#include <string.h>
-
-#include <bson/bson-macros.h>
-#include <bson/bson-config.h>
 #include <bson/bson-types.h>
+#include <bson/config.h>
+#include <bson/macros.h>
+
+#include <string.h>
 
 
 /**
diff -pruN 2.0.2-1/src/libbson/src/bson/bson-endian.h 2.1.0-1/src/libbson/src/bson/bson-endian.h
--- 2.0.2-1/src/libbson/src/bson/bson-endian.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libbson/src/bson/bson-endian.h	2025-08-14 18:37:23.000000000 +0000
@@ -20,9 +20,9 @@
 #ifndef BSON_ENDIAN_H
 #define BSON_ENDIAN_H
 
-#include <bson/bson-config.h>
-#include <bson/bson-macros.h>
-#include <bson/bson-compat.h>
+#include <bson/compat.h>
+#include <bson/config.h>
+#include <bson/macros.h>
 
 
 BSON_BEGIN_DECLS
diff -pruN 2.0.2-1/src/libbson/src/bson/bson-error-private.h 2.1.0-1/src/libbson/src/bson/bson-error-private.h
--- 2.0.2-1/src/libbson/src/bson/bson-error-private.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libbson/src/bson/bson-error-private.h	2025-08-14 18:37:23.000000000 +0000
@@ -19,8 +19,8 @@
 #ifndef BSON_ERROR_PRIVATE_H
 #define BSON_ERROR_PRIVATE_H
 
-#include <bson/bson-error.h>
-#include <bson/bson-macros.h>
+#include <bson/error.h>
+#include <bson/macros.h>
 
 
 #define BSON_ERROR_CATEGORY 1
diff -pruN 2.0.2-1/src/libbson/src/bson/bson-error.c 2.1.0-1/src/libbson/src/bson/bson-error.c
--- 2.0.2-1/src/libbson/src/bson/bson-error.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libbson/src/bson/bson-error.c	1970-01-01 00:00:00.000000000 +0000
@@ -1,183 +0,0 @@
-/*
- * Copyright 2009-present MongoDB, Inc.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-
-#include <stdio.h>
-#include <stdarg.h>
-
-#include <bson/bson-compat.h>
-#include <bson/bson-config.h>
-#include <bson/bson-error-private.h>
-#include <bson/bson-memory.h>
-#include <common-string-private.h>
-#include <bson/bson-types.h>
-
-// See `bson_strerror_r()` definition below.
-#if !defined(_WIN32) && !defined(__APPLE__)
-#include <locale.h> // uselocale()
-#endif
-
-
-/*
- *--------------------------------------------------------------------------
- *
- * bson_set_error --
- *
- *       Initializes @error using the parameters specified.
- *
- *       @domain is an application specific error domain which should
- *       describe which module initiated the error. Think of this as the
- *       exception type.
- *
- *       @code is the @domain specific error code.
- *
- *       @format is used to generate the format string. It uses vsnprintf()
- *       internally so the format should match what you would use there.
- *
- * Parameters:
- *       @error: A #bson_error_t.
- *       @domain: The error domain.
- *       @code: The error code.
- *       @format: A printf style format string.
- *
- * Returns:
- *       None.
- *
- * Side effects:
- *       @error is initialized.
- *
- *--------------------------------------------------------------------------
- */
-
-void
-bson_set_error (bson_error_t *error, /* OUT */
-                uint32_t domain,     /* IN */
-                uint32_t code,       /* IN */
-                const char *format,  /* IN */
-                ...)                 /* IN */
-{
-   va_list args;
-
-   if (error) {
-      error->domain = domain;
-      error->code = code;
-      bson_set_error_category (error, BSON_ERROR_CATEGORY);
-
-      va_start (args, format);
-      bson_vsnprintf (error->message, sizeof error->message, format, args);
-      va_end (args);
-   }
-}
-
-
-/*
- *--------------------------------------------------------------------------
- *
- * bson_strerror_r --
- *
- *       This is a reentrant safe macro for strerror.
- *
- *       The resulting string may be stored in @buf.
- *
- * Returns:
- *       A pointer to a static string or @buf.
- *
- * Side effects:
- *       None.
- *
- *--------------------------------------------------------------------------
- */
-
-char *
-bson_strerror_r (int err_code,                    /* IN */
-                 char *buf BSON_MAYBE_UNUSED,     /* IN */
-                 size_t buflen BSON_MAYBE_UNUSED) /* IN */
-{
-   static const char *unknown_msg = "Unknown error";
-   char *ret = NULL;
-
-#if defined(_WIN32)
-   // Windows does not provide `strerror_l` or `strerror_r`, but it does
-   // unconditionally provide `strerror_s`.
-   if (strerror_s (buf, buflen, err_code) == 0) {
-      ret = buf;
-   }
-#elif defined(_AIX)
-   // AIX does not provide strerror_l, and its strerror_r isn't glibc's.
-   // But it does provide a glibc compatible one called __linux_strerror_r
-   ret = __linux_strerror_r (err_code, buf, buflen);
-#elif defined(__APPLE__)
-   // Apple does not provide `strerror_l`, but it does unconditionally provide
-   // the XSI-compliant `strerror_r`, but only when compiling with Apple Clang.
-   // GNU extensions may still be a problem if we are being compiled with GCC on
-   // Apple. Avoid the compatibility headaches with GNU extensions and the musl
-   // library by assuming the implementation will not cause UB when reading the
-   // error message string even when `strerror_r` fails, as encouraged (but not
-   // required) by the POSIX spec (see:
-   // https://pubs.opengroup.org/onlinepubs/9699919799/functions/strerror.html#tag_16_574_08).
-   (void) strerror_r (err_code, buf, buflen);
-   ret = buf;
-#elif defined(_XOPEN_SOURCE) && _XOPEN_SOURCE >= 700
-   // The behavior (of `strerror_l`) is undefined if the locale argument to
-   // `strerror_l()` is the special locale object LC_GLOBAL_LOCALE or is not a
-   // valid locale object handle.
-   locale_t locale = uselocale ((locale_t) 0);
-   // No need to test for error (it can only be [EINVAL]).
-   if (locale == LC_GLOBAL_LOCALE) {
-      // Only use our own locale if a thread-local locale was not already set.
-      // This is just to satisfy `strerror_l`. We do NOT want to unconditionally
-      // set a thread-local locale.
-      locale = newlocale (LC_MESSAGES_MASK, "C", (locale_t) 0);
-   }
-   BSON_ASSERT (locale != LC_GLOBAL_LOCALE);
-
-   // Avoid `strerror_r` compatibility headaches with GNU extensions and the
-   // musl library by using `strerror_l` instead. Furthermore, `strerror_r` is
-   // scheduled to be marked as obsolete in favor of `strerror_l` in the
-   // upcoming POSIX Issue 8 (see:
-   // https://www.austingroupbugs.net/view.php?id=655).
-   //
-   // POSIX Spec: since strerror_l() is required to return a string for some
-   // errors, an application wishing to check for all error situations should
-   // set errno to 0, then call strerror_l(), then check errno.
-   if (locale != (locale_t) 0) {
-      errno = 0;
-      ret = strerror_l (err_code, locale);
-
-      if (errno != 0) {
-         ret = NULL;
-      }
-
-      freelocale (locale);
-   } else {
-      // Could not obtain a valid `locale_t` object to satisfy `strerror_l`.
-      // Fallback to `bson_strncpy` below.
-   }
-#elif defined(_GNU_SOURCE)
-   // Unlikely, but continue supporting use of GNU extension in cases where the
-   // C Driver is being built without _XOPEN_SOURCE=700.
-   ret = strerror_r (err_code, buf, buflen);
-#else
-#error "Unable to find a supported strerror_r candidate"
-#endif
-
-   if (!ret) {
-      bson_strncpy (buf, unknown_msg, buflen);
-      ret = buf;
-   }
-
-   return ret;
-}
diff -pruN 2.0.2-1/src/libbson/src/bson/bson-error.h 2.1.0-1/src/libbson/src/bson/bson-error.h
--- 2.0.2-1/src/libbson/src/bson/bson-error.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libbson/src/bson/bson-error.h	1970-01-01 00:00:00.000000000 +0000
@@ -1,47 +0,0 @@
-/*
- * Copyright 2009-present MongoDB, Inc.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#include <bson/bson-prelude.h>
-
-
-#ifndef BSON_ERROR_H
-#define BSON_ERROR_H
-
-
-#include <bson/bson-compat.h>
-#include <bson/bson-macros.h>
-#include <bson/bson-types.h>
-
-
-BSON_BEGIN_DECLS
-
-
-#define BSON_ERROR_JSON 1
-#define BSON_ERROR_READER 2
-#define BSON_ERROR_INVALID 3
-#define BSON_ERROR_VECTOR 4
-
-
-BSON_EXPORT (void)
-bson_set_error (bson_error_t *error, uint32_t domain, uint32_t code, const char *format, ...) BSON_GNUC_PRINTF (4, 5);
-BSON_EXPORT (char *)
-bson_strerror_r (int err_code, char *buf, size_t buflen);
-
-
-BSON_END_DECLS
-
-
-#endif /* BSON_ERROR_H */
diff -pruN 2.0.2-1/src/libbson/src/bson/bson-iso8601-private.h 2.1.0-1/src/libbson/src/bson/bson-iso8601-private.h
--- 2.0.2-1/src/libbson/src/bson/bson-iso8601-private.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libbson/src/bson/bson-iso8601-private.h	2025-08-14 18:37:23.000000000 +0000
@@ -21,10 +21,11 @@
 #define BSON_ISO8601_PRIVATE_H
 
 
-#include <bson/bson-compat.h>
-#include <bson/bson-macros.h>
 #include <common-string-private.h>
 
+#include <bson/compat.h>
+#include <bson/macros.h>
+
 
 BSON_BEGIN_DECLS
 
diff -pruN 2.0.2-1/src/libbson/src/bson/bson-iso8601.c 2.1.0-1/src/libbson/src/bson/bson-iso8601.c
--- 2.0.2-1/src/libbson/src/bson/bson-iso8601.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libbson/src/bson/bson-iso8601.c	2025-08-14 18:37:23.000000000 +0000
@@ -15,13 +15,14 @@
  */
 
 
-#include <bson/bson-compat.h>
-#include <bson/bson-macros.h>
-#include <bson/bson-error.h>
 #include <bson/bson-iso8601-private.h>
-#include <bson/bson-json.h>
 #include <bson/bson-timegm-private.h>
 
+#include <bson/bson-json.h>
+#include <bson/compat.h>
+#include <bson/error.h>
+#include <bson/macros.h>
+
 
 static bool
 get_tok (const char *terminals, const char **ptr, int32_t *remaining, const char **out, int32_t *out_len)
diff -pruN 2.0.2-1/src/libbson/src/bson/bson-iter.c 2.1.0-1/src/libbson/src/bson/bson-iter.c
--- 2.0.2-1/src/libbson/src/bson/bson-iter.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libbson/src/bson/bson-iter.c	2025-08-14 18:37:23.000000000 +0000
@@ -15,12 +15,14 @@
  */
 
 
-#include <mlib/intencode.h>
-#include <mlib/cmp.h>
 #include <bson/bson-iter.h>
-#include <bson/bson-config.h>
+
 #include <bson/bson-decimal128.h>
 #include <bson/bson-types.h>
+#include <bson/config.h>
+
+#include <mlib/cmp.h>
+#include <mlib/intencode.h>
 
 #define ITER_TYPE(i) ((bson_type_t) * ((i)->raw + (i)->type))
 
@@ -64,7 +66,7 @@ bson_iter_init (bson_iter_t *iter,  /* O
    iter->d4 = 0;
    iter->next_off = 4;
    iter->err_off = 0;
-   iter->value = (bson_value_t){0};
+   iter->value = (bson_value_t) {0};
 
    return true;
 }
diff -pruN 2.0.2-1/src/libbson/src/bson/bson-iter.h 2.1.0-1/src/libbson/src/bson/bson-iter.h
--- 2.0.2-1/src/libbson/src/bson/bson-iter.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libbson/src/bson/bson-iter.h	2025-08-14 18:37:23.000000000 +0000
@@ -21,10 +21,10 @@
 #define BSON_ITER_H
 
 
-#include <bson/bson.h>
 #include <bson/bson-endian.h>
-#include <bson/bson-macros.h>
 #include <bson/bson-types.h>
+#include <bson/bson.h>
+#include <bson/macros.h>
 
 
 BSON_BEGIN_DECLS
diff -pruN 2.0.2-1/src/libbson/src/bson/bson-json.c 2.1.0-1/src/libbson/src/bson/bson-json.c
--- 2.0.2-1/src/libbson/src/bson/bson-json.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libbson/src/bson/bson-json.c	2025-08-14 18:37:23.000000000 +0000
@@ -15,22 +15,27 @@
  */
 
 
-#include <errno.h>
-#include <fcntl.h>
-#include <sys/types.h>
-#include <math.h>
+#include <bson/bson-json.h>
 
-#include <bson/bson.h>
-#include <bson/bson-config.h>
 #include <bson/bson-error-private.h>
-#include <bson/bson-json.h>
-#include <bson/bson-json-private.h>
 #include <bson/bson-iso8601-private.h>
+#include <bson/bson-json-private.h>
+#include <common-b64-private.h>
+
+#include <bson/bson.h>
+#include <bson/config.h>
 
 #include <mlib/cmp.h>
-#include <common-b64-private.h>
+#include <mlib/config.h>
+
 #include <jsonsl/jsonsl.h>
 
+#include <fcntl.h>
+#include <sys/types.h>
+
+#include <errno.h>
+#include <math.h>
+
 #ifdef _WIN32
 #include <io.h>
 #include <share.h>
@@ -270,22 +275,25 @@ _noop (void)
 #define STACK_IS_DBPOINTER (STACK_FRAME_TYPE == BSON_JSON_FRAME_DBPOINTER)
 #define FRAME_TYPE_HAS_BSON(_type) ((_type) == BSON_JSON_FRAME_SCOPE || (_type) == BSON_JSON_FRAME_DBPOINTER)
 #define STACK_HAS_BSON FRAME_TYPE_HAS_BSON (STACK_FRAME_TYPE)
-#define STACK_PUSH(frame_type)                       \
-   do {                                              \
-      if (bson->n >= (STACK_MAX - 1)) {              \
-         return;                                     \
-      }                                              \
-      bson->n++;                                     \
-      if (STACK_HAS_BSON) {                          \
-         if (FRAME_TYPE_HAS_BSON (frame_type)) {     \
-            bson_reinit (STACK_BSON_CHILD);          \
-         } else {                                    \
-            bson_destroy (STACK_BSON_CHILD);         \
-         }                                           \
-      } else if (FRAME_TYPE_HAS_BSON (frame_type)) { \
-         bson_init (STACK_BSON_CHILD);               \
-      }                                              \
-      STACK_FRAME_TYPE = frame_type;                 \
+#define STACK_PUSH(frame_type)                                  \
+   do {                                                         \
+      if (bson->n >= (STACK_MAX - 1)) {                         \
+         return;                                                \
+      }                                                         \
+      bson->n++;                                                \
+      mlib_diagnostic_push ();                                  \
+      mlib_disable_constant_conditional_expression_warnings (); \
+      if (STACK_HAS_BSON) {                                     \
+         if (FRAME_TYPE_HAS_BSON (frame_type)) {                \
+            bson_reinit (STACK_BSON_CHILD);                     \
+         } else {                                               \
+            bson_destroy (STACK_BSON_CHILD);                    \
+         }                                                      \
+      } else if (FRAME_TYPE_HAS_BSON (frame_type)) {            \
+         bson_init (STACK_BSON_CHILD);                          \
+      }                                                         \
+      mlib_diagnostic_pop ();                                   \
+      STACK_FRAME_TYPE = frame_type;                            \
    } while (0)
 #define STACK_PUSH_ARRAY(statement)       \
    do {                                   \
@@ -343,13 +351,17 @@ _noop (void)
       bson->code_data.in_scope = false; \
    } while (0)
 #define STACK_POP_DBPOINTER STACK_POP_DOC (_noop ())
-#define BASIC_CB_PREAMBLE                         \
-   const char *key;                               \
-   size_t len;                                    \
-   bson_json_reader_bson_t *bson = &reader->bson; \
-   _bson_json_read_fixup_key (bson);              \
-   key = bson->key;                               \
-   len = bson->key_buf.len;                       \
+#define BASIC_CB_PREAMBLE                                                                                            \
+   const char *key;                                                                                                  \
+   size_t len;                                                                                                       \
+   bson_json_reader_bson_t *bson = &reader->bson;                                                                    \
+   _bson_json_read_fixup_key (bson);                                                                                 \
+   key = bson->key;                                                                                                  \
+   len = bson->key_buf.len;                                                                                          \
+   if (len > INT_MAX) {                                                                                              \
+      _bson_json_read_set_error (reader, "Failed to read JSON. key size %zu is too large. Max is %d", len, INT_MAX); \
+      return;                                                                                                        \
+   }                                                                                                                 \
    (void) 0
 #define BASIC_CB_BAIL_IF_NOT_NORMAL(_type)                                                                   \
    if (bson->read_state != BSON_JSON_REGULAR) {                                                              \
@@ -392,7 +404,7 @@ bson_json_opts_new (bson_json_mode_t mod
    bson_json_opts_t *opts;
 
    opts = (bson_json_opts_t *) bson_malloc (sizeof *opts);
-   *opts = (bson_json_opts_t){
+   *opts = (bson_json_opts_t) {
       .mode = mode,
       .max_len = max_len,
       .is_outermost_array = false,
@@ -620,7 +632,7 @@ _bson_json_read_integer (bson_json_reade
       BASIC_CB_BAIL_IF_NOT_NORMAL ("integer");
 
       if (val <= INT32_MAX || (sign == -1 && val <= (uint64_t) INT32_MAX + 1)) {
-         bson_append_int32 (STACK_BSON_CHILD, key, (int) len, (int) (val * sign));
+         bson_append_int32 (STACK_BSON_CHILD, key, (int) len, (int32_t) ((int64_t) val * sign));
       } else if (sign == -1) {
 #if defined(_WIN32) && !defined(__MINGW32__)
          // Unary negation of unsigned integer is deliberate.
diff -pruN 2.0.2-1/src/libbson/src/bson/bson-keys.c 2.1.0-1/src/libbson/src/bson/bson-keys.c
--- 2.0.2-1/src/libbson/src/bson/bson-keys.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libbson/src/bson/bson-keys.c	2025-08-14 18:37:23.000000000 +0000
@@ -15,12 +15,14 @@
  */
 
 
-#include <stdio.h>
-
 #include <bson/bson-keys.h>
+
 #include <common-string-private.h>
+
 #include <mlib/cmp.h>
 
+#include <stdio.h>
+
 
 static const char *gUint32Strs[] = {
    "0",   "1",   "2",   "3",   "4",   "5",   "6",   "7",   "8",   "9",   "10",  "11",  "12",  "13",  "14",  "15",
diff -pruN 2.0.2-1/src/libbson/src/bson/bson-keys.h 2.1.0-1/src/libbson/src/bson/bson-keys.h
--- 2.0.2-1/src/libbson/src/bson/bson-keys.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libbson/src/bson/bson-keys.h	2025-08-14 18:37:23.000000000 +0000
@@ -21,8 +21,8 @@
 #define BSON_KEYS_H
 
 
-#include <bson/bson-macros.h>
 #include <bson/bson-types.h>
+#include <bson/macros.h>
 
 
 BSON_BEGIN_DECLS
diff -pruN 2.0.2-1/src/libbson/src/bson/bson-macros.h 2.1.0-1/src/libbson/src/bson/bson-macros.h
--- 2.0.2-1/src/libbson/src/bson/bson-macros.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libbson/src/bson/bson-macros.h	1970-01-01 00:00:00.000000000 +0000
@@ -1,421 +0,0 @@
-/*
- * Copyright 2009-present MongoDB, Inc.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#include <bson/bson-prelude.h>
-
-
-#ifndef BSON_MACROS_H
-#define BSON_MACROS_H
-
-
-#include <stdio.h>
-#include <stdlib.h>
-
-#ifdef __cplusplus
-#include <algorithm>
-#endif
-
-#include <bson/bson-config.h>
-
-
-#if BSON_OS == 1
-#define BSON_OS_UNIX
-#elif BSON_OS == 2
-#define BSON_OS_WIN32
-#else
-#error "Unknown operating system."
-#endif
-
-
-#ifdef __cplusplus
-#define BSON_BEGIN_DECLS extern "C" {
-#define BSON_END_DECLS }
-#else
-#define BSON_BEGIN_DECLS
-#define BSON_END_DECLS
-#endif
-
-
-#if defined(__GNUC__)
-#define BSON_GNUC_CHECK_VERSION(major, minor) \
-   ((__GNUC__ > (major)) || ((__GNUC__ == (major)) && (__GNUC_MINOR__ >= (minor))))
-#else
-#define BSON_GNUC_CHECK_VERSION(major, minor) 0
-#endif
-
-
-#if defined(__GNUC__)
-#define BSON_GNUC_IS_VERSION(major, minor) ((__GNUC__ == (major)) && (__GNUC_MINOR__ == (minor)))
-#else
-#define BSON_GNUC_IS_VERSION(major, minor) 0
-#endif
-
-
-/* Decorate public functions:
- * - if BSON_STATIC, we're compiling a static libbson or a program
- *   that uses libbson as a static library. Don't decorate functions.
- * - else if BSON_COMPILATION, we're compiling a shared libbson, mark
- *   public functions for export from the shared lib
- * - else, we're compiling a program that uses libbson as a shared library,
- *   mark public functions as DLL imports for Microsoft Visual C
- */
-
-#ifdef _MSC_VER
-/*
- * Microsoft Visual C
- */
-#ifdef BSON_STATIC
-#define BSON_API
-#elif defined(BSON_COMPILATION)
-#define BSON_API __declspec (dllexport)
-#else
-#define BSON_API __declspec (dllimport)
-#endif
-#define BSON_CALL __cdecl
-
-#elif defined(__GNUC__)
-/*
- * GCC
- */
-#ifdef BSON_STATIC
-#define BSON_API
-#elif defined(BSON_COMPILATION)
-#define BSON_API __attribute__ ((visibility ("default")))
-#else
-#define BSON_API
-#endif
-#define BSON_CALL
-
-#else
-/*
- * Other compilers
- */
-#define BSON_API
-#define BSON_CALL
-
-#endif
-
-#define BSON_EXPORT(type) BSON_API type BSON_CALL
-
-
-#ifdef MIN
-#define BSON_MIN MIN
-#elif defined(__cplusplus)
-#define BSON_MIN(a, b) ((std::min) (a, b))
-#elif defined(_MSC_VER)
-#define BSON_MIN(a, b) ((a) < (b) ? (a) : (b))
-#else
-#define BSON_MIN(a, b) (((a) < (b)) ? (a) : (b))
-#endif
-
-
-#ifdef MAX
-#define BSON_MAX MAX
-#elif defined(__cplusplus)
-#define BSON_MAX(a, b) ((std::max) (a, b))
-#elif defined(_MSC_VER)
-#define BSON_MAX(a, b) ((a) > (b) ? (a) : (b))
-#else
-#define BSON_MAX(a, b) (((a) > (b)) ? (a) : (b))
-#endif
-
-
-#ifdef ABS
-#define BSON_ABS ABS
-#else
-#define BSON_ABS(a) (((a) < 0) ? ((a) * -1) : (a))
-#endif
-
-#if defined(__cplusplus) && (__cplusplus >= 201103L || defined(_MSVC_LANG))
-#define BSON_ALIGNOF(expr) alignof (expr)
-#elif defined(__STDC_VERSION__) && __STDC_VERSION__ >= 201112L
-#define BSON_ALIGNOF(expr) _Alignof (expr)
-#else
-#if defined(_MSC_VER)
-#define BSON_ALIGNOF(expr) __alignof (expr)
-#else
-#define BSON_ALIGNOF(expr) __alignof__ (expr)
-#endif
-#endif // __STDC_VERSION__ >= 201112L
-
-#ifdef _MSC_VER
-// __declspec (align (_N)) only permits integer literals as _N.
-#ifdef _WIN64
-#define BSON_ALIGN_OF_PTR 8
-#else
-#define BSON_ALIGN_OF_PTR 4
-#endif
-#else
-#define BSON_ALIGN_OF_PTR (BSON_ALIGNOF (void *))
-#endif
-
-#if defined(_MSC_VER)
-#define BSON_ALIGNED_BEGIN(_N) __declspec (align (BSON_ALIGN_OF_PTR))
-#define BSON_ALIGNED_END(_N)
-#else
-#define BSON_ALIGNED_BEGIN(_N)
-#define BSON_ALIGNED_END(_N) __attribute__ ((aligned ((_N) > BSON_ALIGN_OF_PTR ? BSON_ALIGN_OF_PTR : (_N))))
-#endif
-
-
-#define bson_str_empty(s) (!s[0])
-#define bson_str_empty0(s) (!s || !s[0])
-
-
-#if defined(_MSC_VER)
-#define BSON_FUNC __FUNCTION__
-#else
-#define BSON_FUNC __func__
-#endif
-
-
-#if defined(_MSC_VER)
-#define BSON_INLINE __inline
-#else
-#define BSON_INLINE __inline__
-#endif
-
-
-#if defined(__STDC_VERSION__) && __STDC_VERSION__ >= 202311L
-#define BSON_NORETURN [[noreturn]]
-#elif defined(__STDC_VERSION__) && __STDC_VERSION__ >= 201112L
-#define BSON_NORETURN _Noreturn
-#elif defined(__GNUC__) && 2 < __GNUC__ + (8 <= __GNUC_MINOR__)
-#define BSON_NORETURN __attribute__ ((__noreturn__))
-#else
-#define BSON_NORETURN
-#endif
-
-
-#if defined(__GNUC__)
-#define BSON_RESTRICT __restrict__
-#elif defined(_MSC_VER)
-#define BSON_RESTRICT __restrict
-#elif !defined(__cplusplus)
-// C99 (not C++)
-#define BSON_RESTRICT restrict
-#else
-#define BSON_RESTRICT
-#endif
-
-
-BSON_NORETURN static BSON_INLINE void
-_bson_assert_failed_on_line (const char *file, int line, const char *func, const char *test)
-{
-   fprintf (stderr, "%s:%d %s(): assertion failed: %s\n", file, line, func, test);
-   abort ();
-}
-
-BSON_NORETURN static BSON_INLINE void
-_bson_assert_failed_on_param (const char *param, const char *func)
-{
-   fprintf (stderr, "The parameter: %s, in function %s, cannot be NULL\n", param, func);
-   abort ();
-}
-
-#define BSON_ASSERT(test)                                                            \
-   do {                                                                              \
-      if (!(BSON_LIKELY (test))) {                                                   \
-         _bson_assert_failed_on_line (__FILE__, (int) (__LINE__), BSON_FUNC, #test); \
-      }                                                                              \
-   } while (0)
-
-/**
- * @brief Assert the expression `Assertion`, and evaluates to `Value` on
- * success.
- */
-#define BSON_ASSERT_INLINE(Assertion, Value)                                                                           \
-   ((void) ((Assertion) ? (0) : (_bson_assert_failed_on_line (__FILE__, (int) (__LINE__), BSON_FUNC, #Assertion), 0)), \
-    Value)
-
-/**
- * @brief Assert that the given pointer is non-NULL, while also evaluating to
- * that pointer.
- *
- * Can be used to inline assertions with a pointer dereference:
- *
- * ```
- * foo* f = get_foo();
- * bar* b = BSON_ASSERT_PTR_INLINE(f)->bar_value;
- * ```
- */
-#define BSON_ASSERT_PTR_INLINE(Pointer) BSON_ASSERT_INLINE ((Pointer) != NULL, (Pointer))
-
-/* Used for asserting parameters to provide a more precise error message */
-#define BSON_ASSERT_PARAM(param)                           \
-   do {                                                    \
-      if ((BSON_UNLIKELY (param == NULL))) {               \
-         _bson_assert_failed_on_param (#param, BSON_FUNC); \
-      }                                                    \
-   } while (0)
-
-// `BSON_OPTIONAL_PARAM` is a documentation-only macro to document X may be NULL.
-// Useful in combination with `BSON_ASSERT_PARAM` to document and assert pointer parameters.
-#define BSON_OPTIONAL_PARAM(param) (void) 0
-
-/* obsolete macros, preserved for compatibility */
-#define BSON_STATIC_ASSERT(s) BSON_STATIC_ASSERT_ (s, __LINE__)
-#define BSON_STATIC_ASSERT_JOIN(a, b) BSON_STATIC_ASSERT_JOIN2 (a, b)
-#define BSON_STATIC_ASSERT_JOIN2(a, b) a##b
-#define BSON_STATIC_ASSERT_(s, l) typedef char BSON_STATIC_ASSERT_JOIN (static_assert_test_, __LINE__)[(s) ? 1 : -1]
-
-/* modern macros */
-#define BSON_STATIC_ASSERT2(_name, _s) BSON_STATIC_ASSERT2_ (_s, __LINE__, _name)
-#define BSON_STATIC_ASSERT_JOIN3(_a, _b, _name) BSON_STATIC_ASSERT_JOIN4 (_a, _b, _name)
-#define BSON_STATIC_ASSERT_JOIN4(_a, _b, _name) _a##_b##_name
-#define BSON_STATIC_ASSERT2_(_s, _l, _name) \
-   typedef char BSON_STATIC_ASSERT_JOIN3 (static_assert_test_, __LINE__, _name)[(_s) ? 1 : -1]
-
-
-#if defined(__GNUC__)
-#define BSON_GNUC_PURE __attribute__ ((pure))
-#define BSON_GNUC_WARN_UNUSED_RESULT __attribute__ ((warn_unused_result))
-#else
-#define BSON_GNUC_PURE
-#define BSON_GNUC_WARN_UNUSED_RESULT
-#endif
-
-
-#if BSON_GNUC_CHECK_VERSION(4, 0) && !defined(_WIN32)
-#define BSON_GNUC_NULL_TERMINATED __attribute__ ((sentinel))
-#define BSON_GNUC_INTERNAL __attribute__ ((visibility ("hidden")))
-#else
-#define BSON_GNUC_NULL_TERMINATED
-#define BSON_GNUC_INTERNAL
-#endif
-
-
-#if defined(__GNUC__)
-#define BSON_LIKELY(x) __builtin_expect (!!(x), 1)
-#define BSON_UNLIKELY(x) __builtin_expect (!!(x), 0)
-#else
-#define BSON_LIKELY(v) v
-#define BSON_UNLIKELY(v) v
-#endif
-
-
-#if defined(__clang__)
-#define BSON_GNUC_PRINTF(f, v) __attribute__ ((format (printf, f, v)))
-#elif BSON_GNUC_CHECK_VERSION(4, 4)
-#define BSON_GNUC_PRINTF(f, v) __attribute__ ((format (gnu_printf, f, v)))
-#else
-#define BSON_GNUC_PRINTF(f, v)
-#endif
-
-
-#if defined(__LP64__) || defined(_LP64)
-#define BSON_WORD_SIZE 64
-#else
-#define BSON_WORD_SIZE 32
-#endif
-
-
-#ifdef _MSC_VER
-#define BSON_ENSURE_ARRAY_PARAM_SIZE(_n)
-#define BSON_TYPEOF decltype
-#else
-#define BSON_ENSURE_ARRAY_PARAM_SIZE(_n) static (_n)
-#define BSON_TYPEOF typeof
-#endif
-
-/**
- * @brief Statically annotate an entity as deprecated, including the given deprecation message
- *
- * @param Message The message to be included in a deprecation warning. This
- * should be a string literal.
- */
-#define BSON_DEPRECATED(Message) _bsonDeprecatedImpl (Message)
-
-// Pick the appropriate implementation of a deprecation attribute
-#if defined(_MSC_VER)
-// For MSVC, emit __declspec(deprecated(Msg))
-#define _bsonDeprecatedImpl(Msg) __declspec (deprecated (Msg))
-#elif defined(__GNUC__) && (defined(__clang__) || BSON_GNUC_CHECK_VERSION(4, 5))
-// For new enough Clang and GCC, emit __attribute__((__deprecated__(Msg)))
-#define _bsonDeprecatedImpl(Msg) __attribute__ ((__deprecated__ (Msg)))
-#elif defined(__GNUC__)
-// For older GCC, emit deprecation attribute without the message
-#define _bsonDeprecatedImpl(Msg) __attribute__ ((__deprecated__))
-#else
-// For other compilers, emit nothing
-#define _bsonDeprecatedImpl(Msg)
-#endif
-
-#define BSON_DEPRECATED_FOR(F) BSON_DEPRECATED ("This API is deprecated. Use " #F " instead.")
-
-#define BSON_GNUC_DEPRECATED BSON_DEPRECATED ("This API is deprecated")
-#define BSON_GNUC_DEPRECATED_FOR(F) BSON_DEPRECATED_FOR (F)
-
-#define BSON_CONCAT_IMPL(a, ...) a##__VA_ARGS__
-#define BSON_CONCAT(a, ...) BSON_CONCAT_IMPL (a, __VA_ARGS__)
-#define BSON_CONCAT3(a, b, c) BSON_CONCAT (a, BSON_CONCAT (b, c))
-#define BSON_CONCAT4(a, b, c, d) BSON_CONCAT (BSON_CONCAT (a, b), BSON_CONCAT (c, d))
-
-
-/**
- * @brief String-ify the given argument
- */
-#define BSON_STR(...) #__VA_ARGS__
-
-/**
- * @brief Mark the attached declared entity as "possibly-unused."
- *
- * Does nothing on MSVC.
- */
-#if defined(__GNUC__) || defined(__clang__)
-#define BSON_MAYBE_UNUSED __attribute__ ((unused))
-#else
-#define BSON_MAYBE_UNUSED /* Nothing for other compilers */
-#endif
-
-/**
- * @brief Mark a point in the code as unreachable. If the point is reached, the
- * program will abort with an error message.
- *
- * @param What A string to include in the error message if this point is ever
- * executed.
- */
-#define BSON_UNREACHABLE(What)                                                                                     \
-   do {                                                                                                            \
-      fprintf (stderr, "%s:%d %s(): Unreachable code reached: %s\n", __FILE__, (int) (__LINE__), BSON_FUNC, What); \
-      abort ();                                                                                                    \
-   } while (0)
-
-/**
- * @brief Silence warnings for deliberately unused variables or parameters.
- *
- * @param expr An unused variable or parameter.
- *
- */
-#define BSON_UNUSED(expr) \
-   do {                   \
-      (void) (expr);      \
-   } while (0)
-
-// Disable the -Wunsafe-buffer-usage warning.
-#define BSON_DISABLE_UNSAFE_BUFFER_USAGE_WARNING_BEGIN
-#define BSON_DISABLE_UNSAFE_BUFFER_USAGE_WARNING_END
-#if defined(__clang__)
-#if __has_warning("-Wunsafe-buffer-usage")
-#undef BSON_DISABLE_UNSAFE_BUFFER_USAGE_WARNING_BEGIN
-#undef BSON_DISABLE_UNSAFE_BUFFER_USAGE_WARNING_END
-#define BSON_DISABLE_UNSAFE_BUFFER_USAGE_WARNING_BEGIN \
-   _Pragma ("clang diagnostic push") _Pragma ("clang diagnostic ignored \"-Wunsafe-buffer-usage\"")
-#define BSON_DISABLE_UNSAFE_BUFFER_USAGE_WARNING_END _Pragma ("clang diagnostic pop")
-#endif // __has_warning("-Wunsafe-buffer-usage")
-#endif // defined(__clang__)
-
-#endif /* BSON_MACROS_H */
diff -pruN 2.0.2-1/src/libbson/src/bson/bson-memory.c 2.1.0-1/src/libbson/src/bson/bson-memory.c
--- 2.0.2-1/src/libbson/src/bson/bson-memory.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libbson/src/bson/bson-memory.c	1970-01-01 00:00:00.000000000 +0000
@@ -1,434 +0,0 @@
-/*
- * Copyright 2009-present MongoDB, Inc.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-
-#include <stdlib.h>
-#include <string.h>
-#include <stdio.h>
-#include <errno.h>
-
-#include <bson/bson-config.h>
-#include <bson/bson-memory.h>
-
-#include <common-macros-private.h>
-
-
-// Ensure size of exported structs are stable.
-BSON_STATIC_ASSERT2 (bson_mem_vtable_t, sizeof (bson_mem_vtable_t) == sizeof (void *) * 8u);
-
-
-// For compatibility with C standards prior to C11.
-static void *
-_aligned_alloc_impl (size_t alignment, size_t num_bytes)
-#if defined(BSON_HAVE_ALIGNED_ALLOC)
-{
-   MC_DISABLE_IMPLICIT_WARNING_BEGIN
-   return aligned_alloc (alignment, num_bytes);
-   MC_DISABLE_IMPLICIT_WARNING_END
-}
-#elif defined(_POSIX_C_SOURCE) && _POSIX_C_SOURCE >= 200112L
-{
-   void *mem = NULL;
-
-   // Workaround for https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66425.
-   BSON_MAYBE_UNUSED int ret = posix_memalign (&mem, alignment, num_bytes);
-
-   return mem;
-}
-#else
-{
-   // Fallback to simple malloc even if it does not satisfy alignment
-   // requirements. Note: Visual C++ _aligned_malloc requires using
-   // _aligned_free instead of free and modifies errno on failure, both of which
-   // breaks symmetry with C11 aligned_alloc, so it is deliberately not used.
-   BSON_UNUSED (alignment);
-   return malloc (num_bytes);
-}
-#endif
-
-
-static bson_mem_vtable_t gMemVtable = {.malloc = malloc,
-                                       .calloc = calloc,
-                                       .realloc = realloc,
-                                       .free = free,
-                                       .aligned_alloc = _aligned_alloc_impl,
-                                       .padding = {0}};
-
-
-/*
- *--------------------------------------------------------------------------
- *
- * bson_malloc --
- *
- *       Allocates @num_bytes of memory and returns a pointer to it.  If
- *       malloc failed to allocate the memory, abort() is called.
- *
- *       Libbson does not try to handle OOM conditions as it is beyond the
- *       scope of this library to handle so appropriately.
- *
- * Parameters:
- *       @num_bytes: The number of bytes to allocate.
- *
- * Returns:
- *       A pointer if successful; otherwise abort() is called and this
- *       function will never return.
- *
- * Side effects:
- *       None.
- *
- *--------------------------------------------------------------------------
- */
-
-void *
-bson_malloc (size_t num_bytes) /* IN */
-{
-   void *mem = NULL;
-
-   if (BSON_LIKELY (num_bytes)) {
-      if (BSON_UNLIKELY (!(mem = gMemVtable.malloc (num_bytes)))) {
-         fprintf (stderr, "Failure to allocate memory in bson_malloc(). errno: %d.\n", errno);
-         abort ();
-      }
-   }
-
-   return mem;
-}
-
-
-/*
- *--------------------------------------------------------------------------
- *
- * bson_malloc0 --
- *
- *       Like bson_malloc() except the memory is zeroed first. This is
- *       similar to calloc() except that abort() is called in case of
- *       failure to allocate memory.
- *
- * Parameters:
- *       @num_bytes: The number of bytes to allocate.
- *
- * Returns:
- *       A pointer if successful; otherwise abort() is called and this
- *       function will never return.
- *
- * Side effects:
- *       None.
- *
- *--------------------------------------------------------------------------
- */
-
-void *
-bson_malloc0 (size_t num_bytes) /* IN */
-{
-   void *mem = NULL;
-
-   if (BSON_LIKELY (num_bytes)) {
-      if (BSON_UNLIKELY (!(mem = gMemVtable.calloc (1, num_bytes)))) {
-         fprintf (stderr, "Failure to allocate memory in bson_malloc0(). errno: %d.\n", errno);
-         abort ();
-      }
-   }
-
-   return mem;
-}
-
-
-/*
- *--------------------------------------------------------------------------
- *
- * bson_aligned_alloc --
- *
- *       Allocates @num_bytes of memory with an alignment of @alignment and
- *       returns a pointer to it.  If malloc failed to allocate the memory,
- *       abort() is called.
- *
- *       Libbson does not try to handle OOM conditions as it is beyond the
- *       scope of this library to handle so appropriately.
- *
- * Parameters:
- *       @alignment: The alignment of the allocated bytes of memory.
- *       @num_bytes: The number of bytes to allocate.
- *
- * Returns:
- *       A pointer if successful; otherwise abort() is called and this
- *       function will never return.
- *
- * Side effects:
- *       None.
- *
- *--------------------------------------------------------------------------
- */
-
-void *
-bson_aligned_alloc (size_t alignment /* IN */, size_t num_bytes /* IN */)
-{
-   void *mem = NULL;
-
-   if (BSON_LIKELY (num_bytes)) {
-      if (BSON_UNLIKELY (!(mem = gMemVtable.aligned_alloc (alignment, num_bytes)))) {
-         fprintf (stderr, "Failure to allocate memory in bson_aligned_alloc()\n");
-         abort ();
-      }
-   }
-
-   return mem;
-}
-
-
-/*
- *--------------------------------------------------------------------------
- *
- * bson_aligned_alloc0 --
- *
- *       Like bson_aligned_alloc() except the memory is zeroed after allocation
- *       for convenience.
- *
- * Parameters:
- *       @alignment: The alignment of the allocated bytes of memory.
- *       @num_bytes: The number of bytes to allocate.
- *
- * Returns:
- *       A pointer if successful; otherwise abort() is called and this
- *       function will never return.
- *
- * Side effects:
- *       None.
- *
- *--------------------------------------------------------------------------
- */
-
-void *
-bson_aligned_alloc0 (size_t alignment /* IN */, size_t num_bytes /* IN */)
-{
-   void *mem = NULL;
-
-   if (BSON_LIKELY (num_bytes)) {
-      if (BSON_UNLIKELY (!(mem = gMemVtable.aligned_alloc (alignment, num_bytes)))) {
-         fprintf (stderr, "Failure to allocate memory in bson_aligned_alloc0()\n");
-         abort ();
-      }
-      memset (mem, 0, num_bytes);
-   }
-
-   return mem;
-}
-
-
-/*
- *--------------------------------------------------------------------------
- *
- * bson_realloc --
- *
- *       This function behaves similar to realloc() except that if there is
- *       a failure abort() is called.
- *
- * Parameters:
- *       @mem: The memory to realloc, or NULL.
- *       @num_bytes: The size of the new allocation or 0 to free.
- *
- * Returns:
- *       The new allocation if successful; otherwise abort() is called and
- *       this function never returns.
- *
- * Side effects:
- *       None.
- *
- *--------------------------------------------------------------------------
- */
-
-void *
-bson_realloc (void *mem,        /* IN */
-              size_t num_bytes) /* IN */
-{
-   /*
-    * Not all platforms are guaranteed to free() the memory if a call to
-    * realloc() with a size of zero occurs. Windows, Linux, and FreeBSD do,
-    * however, OS X does not.
-    */
-   if (BSON_UNLIKELY (num_bytes == 0)) {
-      gMemVtable.free (mem);
-      return NULL;
-   }
-
-   mem = gMemVtable.realloc (mem, num_bytes);
-
-   if (BSON_UNLIKELY (!mem)) {
-      fprintf (stderr, "Failure to re-allocate memory in bson_realloc(). errno: %d.\n", errno);
-      abort ();
-   }
-
-   return mem;
-}
-
-
-/*
- *--------------------------------------------------------------------------
- *
- * bson_realloc_ctx --
- *
- *       This wraps bson_realloc and provides a compatible api for similar
- *       functions with a context
- *
- * Parameters:
- *       @mem: The memory to realloc, or NULL.
- *       @num_bytes: The size of the new allocation or 0 to free.
- *       @ctx: Ignored
- *
- * Returns:
- *       The new allocation if successful; otherwise abort() is called and
- *       this function never returns.
- *
- * Side effects:
- *       None.
- *
- *--------------------------------------------------------------------------
- */
-
-
-void *
-bson_realloc_ctx (void *mem,        /* IN */
-                  size_t num_bytes, /* IN */
-                  void *ctx)        /* IN */
-{
-   BSON_UNUSED (ctx);
-
-   return bson_realloc (mem, num_bytes);
-}
-
-
-/*
- *--------------------------------------------------------------------------
- *
- * bson_free --
- *
- *       Frees @mem using the underlying allocator.
- *
- *       Currently, this only calls free() directly, but that is subject to
- *       change.
- *
- * Parameters:
- *       @mem: An allocation to free.
- *
- * Returns:
- *       None.
- *
- * Side effects:
- *       None.
- *
- *--------------------------------------------------------------------------
- */
-
-void
-bson_free (void *mem) /* IN */
-{
-   gMemVtable.free (mem);
-}
-
-
-/*
- *--------------------------------------------------------------------------
- *
- * bson_zero_free --
- *
- *       Frees @mem using the underlying allocator. @size bytes of @mem will
- *       be zeroed before freeing the memory. This is useful in scenarios
- *       where @mem contains passwords or other sensitive information.
- *
- * Parameters:
- *       @mem: An allocation to free.
- *       @size: The number of bytes in @mem.
- *
- * Returns:
- *       None.
- *
- * Side effects:
- *       None.
- *
- *--------------------------------------------------------------------------
- */
-
-void
-bson_zero_free (void *mem,   /* IN */
-                size_t size) /* IN */
-{
-   if (BSON_LIKELY (mem)) {
-      memset (mem, 0, size);
-      gMemVtable.free (mem);
-   }
-}
-
-
-static void *
-_aligned_alloc_as_malloc (size_t alignment, size_t num_bytes)
-{
-   BSON_UNUSED (alignment);
-
-   return gMemVtable.malloc (num_bytes);
-}
-
-
-/*
- *--------------------------------------------------------------------------
- *
- * bson_mem_set_vtable --
- *
- *       This function will change our allocation vtable.
- *
- *       It is imperative that this is called at the beginning of the
- *       process before any memory has been allocated by the default
- *       allocator.
- *
- * Returns:
- *       None.
- *
- * Side effects:
- *       None.
- *
- *--------------------------------------------------------------------------
- */
-
-void
-bson_mem_set_vtable (const bson_mem_vtable_t *vtable)
-{
-   BSON_ASSERT (vtable);
-
-   if (!vtable->malloc || !vtable->calloc || !vtable->realloc || !vtable->free) {
-      fprintf (stderr,
-               "Failure to install BSON vtable, "
-               "missing functions.\n");
-      return;
-   }
-
-   gMemVtable = *vtable;
-
-   // Backwards compatibility with code prior to addition of aligned_alloc.
-   if (!gMemVtable.aligned_alloc) {
-      gMemVtable.aligned_alloc = _aligned_alloc_as_malloc;
-   }
-}
-
-void
-bson_mem_restore_vtable (void)
-{
-   bson_mem_vtable_t vtable = {.malloc = malloc,
-                               .calloc = calloc,
-                               .realloc = realloc,
-                               .free = free,
-                               .aligned_alloc = _aligned_alloc_impl,
-                               .padding = {0}};
-
-   bson_mem_set_vtable (&vtable);
-}
diff -pruN 2.0.2-1/src/libbson/src/bson/bson-memory.h 2.1.0-1/src/libbson/src/bson/bson-memory.h
--- 2.0.2-1/src/libbson/src/bson/bson-memory.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libbson/src/bson/bson-memory.h	1970-01-01 00:00:00.000000000 +0000
@@ -1,73 +0,0 @@
-/*
- * Copyright 2009-present MongoDB, Inc.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#include <bson/bson-prelude.h>
-
-
-#ifndef BSON_MEMORY_H
-#define BSON_MEMORY_H
-
-
-#include <bson/bson-macros.h>
-#include <bson/bson-types.h>
-
-
-BSON_BEGIN_DECLS
-
-
-typedef void *(BSON_CALL *bson_realloc_func) (void *mem, size_t num_bytes, void *ctx);
-
-
-typedef struct _bson_mem_vtable_t {
-   void *(BSON_CALL *malloc) (size_t num_bytes);
-   void *(BSON_CALL *calloc) (size_t n_members, size_t num_bytes);
-   void *(BSON_CALL *realloc) (void *mem, size_t num_bytes);
-   void (BSON_CALL *free) (void *mem);
-   void *(BSON_CALL *aligned_alloc) (size_t alignment, size_t num_bytes);
-   void *padding[3];
-} bson_mem_vtable_t;
-
-
-BSON_EXPORT (void)
-bson_mem_set_vtable (const bson_mem_vtable_t *vtable);
-BSON_EXPORT (void)
-bson_mem_restore_vtable (void);
-BSON_EXPORT (void *)
-bson_malloc (size_t num_bytes);
-BSON_EXPORT (void *)
-bson_malloc0 (size_t num_bytes);
-BSON_EXPORT (void *)
-bson_aligned_alloc (size_t alignment, size_t num_bytes);
-BSON_EXPORT (void *)
-bson_aligned_alloc0 (size_t alignment, size_t num_bytes);
-BSON_EXPORT (void *)
-bson_realloc (void *mem, size_t num_bytes);
-BSON_EXPORT (void *)
-bson_realloc_ctx (void *mem, size_t num_bytes, void *ctx);
-BSON_EXPORT (void)
-bson_free (void *mem);
-BSON_EXPORT (void)
-bson_zero_free (void *mem, size_t size);
-
-
-#define BSON_ALIGNED_ALLOC(T) ((T *) (bson_aligned_alloc (BSON_ALIGNOF (T), sizeof (T))))
-#define BSON_ALIGNED_ALLOC0(T) ((T *) (bson_aligned_alloc0 (BSON_ALIGNOF (T), sizeof (T))))
-
-
-BSON_END_DECLS
-
-
-#endif /* BSON_MEMORY_H */
diff -pruN 2.0.2-1/src/libbson/src/bson/bson-oid.c 2.1.0-1/src/libbson/src/bson/bson-oid.c
--- 2.0.2-1/src/libbson/src/bson/bson-oid.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libbson/src/bson/bson-oid.c	2025-08-14 18:37:23.000000000 +0000
@@ -14,18 +14,20 @@
  * limitations under the License.
  */
 
-#include <bson/bson-compat.h>
+#include <bson/bson-oid.h>
+
+#include <bson/bson-context-private.h>
+
+#include <bson/bson-endian.h>
+#include <bson/bson-string.h>
+#include <bson/compat.h>
 
 #include <limits.h>
 #include <stdarg.h>
 #include <stdbool.h>
+#include <stdint.h>
 #include <stdlib.h>
 #include <string.h>
-#include <stdint.h>
-
-#include <bson/bson-context-private.h>
-#include <bson/bson-oid.h>
-#include <common-string-private.h>
 
 
 /*
diff -pruN 2.0.2-1/src/libbson/src/bson/bson-oid.h 2.1.0-1/src/libbson/src/bson/bson-oid.h
--- 2.0.2-1/src/libbson/src/bson/bson-oid.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libbson/src/bson/bson-oid.h	2025-08-14 18:37:23.000000000 +0000
@@ -21,12 +21,12 @@
 #define BSON_OID_H
 
 
-#include <time.h>
-
 #include <bson/bson-context.h>
-#include <bson/bson-macros.h>
-#include <bson/bson-types.h>
 #include <bson/bson-endian.h>
+#include <bson/bson-types.h>
+#include <bson/macros.h>
+
+#include <time.h>
 
 
 BSON_BEGIN_DECLS
diff -pruN 2.0.2-1/src/libbson/src/bson/bson-private.h 2.1.0-1/src/libbson/src/bson/bson-private.h
--- 2.0.2-1/src/libbson/src/bson/bson-private.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libbson/src/bson/bson-private.h	2025-08-14 18:37:23.000000000 +0000
@@ -21,9 +21,9 @@
 #define BSON_PRIVATE_H
 
 
-#include <bson/bson-macros.h>
-#include <bson/bson-memory.h>
 #include <bson/bson-types.h>
+#include <bson/macros.h>
+#include <bson/memory.h>
 
 
 BSON_BEGIN_DECLS
diff -pruN 2.0.2-1/src/libbson/src/bson/bson-reader.c 2.1.0-1/src/libbson/src/bson/bson-reader.c
--- 2.0.2-1/src/libbson/src/bson/bson-reader.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libbson/src/bson/bson-reader.c	2025-08-14 18:37:23.000000000 +0000
@@ -14,22 +14,25 @@
  * limitations under the License.
  */
 
-#include <mlib/intencode.h>
 #include <bson/bson.h>
 
-#include <errno.h>
+#include <mlib/intencode.h>
+
 #include <fcntl.h>
+
+#include <errno.h>
 #ifdef BSON_OS_WIN32
 #include <io.h>
 #include <share.h>
 #endif
-#include <stdlib.h>
-#include <string.h>
+#include <bson/bson-reader.h>
+#include <bson/memory.h>
+
 #include <sys/stat.h>
 #include <sys/types.h>
 
-#include <bson/bson-reader.h>
-#include <bson/bson-memory.h>
+#include <stdlib.h>
+#include <string.h>
 
 
 typedef enum {
diff -pruN 2.0.2-1/src/libbson/src/bson/bson-reader.h 2.1.0-1/src/libbson/src/bson/bson-reader.h
--- 2.0.2-1/src/libbson/src/bson/bson-reader.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libbson/src/bson/bson-reader.h	2025-08-14 18:37:23.000000000 +0000
@@ -21,9 +21,9 @@
 #define BSON_READER_H
 
 
-#include <bson/bson-compat.h>
 #include <bson/bson-oid.h>
 #include <bson/bson-types.h>
+#include <bson/compat.h>
 
 
 BSON_BEGIN_DECLS
diff -pruN 2.0.2-1/src/libbson/src/bson/bson-string.c 2.1.0-1/src/libbson/src/bson/bson-string.c
--- 2.0.2-1/src/libbson/src/bson/bson-string.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libbson/src/bson/bson-string.c	2025-08-14 18:37:23.000000000 +0000
@@ -15,16 +15,18 @@
  */
 
 
-#include <limits.h>
-#include <stdarg.h>
-
-#include <bson/bson-compat.h>
-#include <bson/bson-config.h>
-#include <mlib/cmp.h>
-#include <common-string-private.h>
 #include <common-bits-private.h>
-#include <bson/bson-memory.h>
+#include <common-string-private.h>
+
 #include <bson/bson-utf8.h>
+#include <bson/compat.h>
+#include <bson/config.h>
+#include <bson/memory.h>
+
+#include <mlib/cmp.h>
+
+#include <limits.h>
+#include <stdarg.h>
 
 #ifdef BSON_HAVE_STRINGS_H
 #include <strings.h>
diff -pruN 2.0.2-1/src/libbson/src/bson/bson-string.h 2.1.0-1/src/libbson/src/bson/bson-string.h
--- 2.0.2-1/src/libbson/src/bson/bson-string.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libbson/src/bson/bson-string.h	2025-08-14 18:37:23.000000000 +0000
@@ -21,10 +21,10 @@
 #define BSON_STRING_H
 
 
-#include <stdarg.h>
-
-#include <bson/bson-macros.h>
 #include <bson/bson-types.h>
+#include <bson/macros.h>
+
+#include <stdarg.h>
 
 
 BSON_BEGIN_DECLS
diff -pruN 2.0.2-1/src/libbson/src/bson/bson-timegm-private.h 2.1.0-1/src/libbson/src/bson/bson-timegm-private.h
--- 2.0.2-1/src/libbson/src/bson/bson-timegm-private.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libbson/src/bson/bson-timegm-private.h	2025-08-14 18:37:23.000000000 +0000
@@ -21,8 +21,8 @@
 #define BSON_TIMEGM_PRIVATE_H
 
 
-#include <bson/bson-compat.h>
-#include <bson/bson-macros.h>
+#include <bson/compat.h>
+#include <bson/macros.h>
 
 
 BSON_BEGIN_DECLS
diff -pruN 2.0.2-1/src/libbson/src/bson/bson-timegm.c 2.1.0-1/src/libbson/src/bson/bson-timegm.c
--- 2.0.2-1/src/libbson/src/bson/bson-timegm.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libbson/src/bson/bson-timegm.c	2025-08-14 18:37:23.000000000 +0000
@@ -10,13 +10,14 @@
 ** and struct tm by A. Jesse Jiryu Davis for MongoDB, Inc.
 */
 
-#include <bson/bson-compat.h>
-#include <bson/bson-macros.h>
 #include <bson/bson-timegm-private.h>
 
+#include <bson/compat.h>
+#include <bson/macros.h>
+
 #include <errno.h>
-#include <string.h>
 #include <stdint.h> /* for INT64_MAX and INT64_MIN */
+#include <string.h>
 
 #if 2 < __GNUC__ + (96 <= __GNUC_MINOR__)
 #define ATTRIBUTE_PURE __attribute__ ((__pure__))
diff -pruN 2.0.2-1/src/libbson/src/bson/bson-types.h 2.1.0-1/src/libbson/src/bson/bson-types.h
--- 2.0.2-1/src/libbson/src/bson/bson-types.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libbson/src/bson/bson-types.h	2025-08-14 18:37:23.000000000 +0000
@@ -20,14 +20,16 @@
 #ifndef BSON_TYPES_H
 #define BSON_TYPES_H
 
+#include <bson/bson-endian.h>
+#include <bson/bson_t.h>
+#include <bson/compat.h>
+#include <bson/config.h>
+#include <bson/error.h>
+#include <bson/macros.h>
 
-#include <stdlib.h>
 #include <sys/types.h>
 
-#include <bson/bson-macros.h>
-#include <bson/bson-config.h>
-#include <bson/bson-compat.h>
-#include <bson/bson-endian.h>
+#include <stdlib.h>
 
 BSON_BEGIN_DECLS
 
@@ -104,51 +106,6 @@ typedef struct _bson_json_opts_t bson_js
 
 
 /**
- * bson_t:
- *
- * This structure manages a buffer whose contents are a properly formatted
- * BSON document. You may perform various transforms on the BSON documents.
- * Additionally, it can be iterated over using bson_iter_t.
- *
- * See bson_iter_init() for iterating the contents of a bson_t.
- *
- * When building a bson_t structure using the various append functions,
- * memory allocations may occur. That is performed using power of two
- * allocations and realloc().
- *
- * See http://bsonspec.org for the BSON document spec.
- *
- * This structure is meant to fit in two sequential 64-byte cachelines.
- */
-BSON_ALIGNED_BEGIN (BSON_ALIGN_OF_PTR) typedef struct _bson_t {
-   uint32_t flags;       /* Internal flags for the bson_t. */
-   uint32_t len;         /* Length of BSON data. */
-   uint8_t padding[120]; /* Padding for stack allocation. */
-} bson_t BSON_ALIGNED_END (BSON_ALIGN_OF_PTR);
-
-/**
- * BSON_INITIALIZER:
- *
- * This macro can be used to initialize a #bson_t structure on the stack
- * without calling bson_init().
- *
- * |[
- * bson_t b = BSON_INITIALIZER;
- * ]|
- */
-#define BSON_INITIALIZER \
-   {                     \
-      3, 5,              \
-      {                  \
-         5               \
-      }                  \
-   }
-
-
-BSON_STATIC_ASSERT2 (bson_t, sizeof (bson_t) == 128);
-
-
-/**
  * bson_oid_t:
  *
  * This structure contains the binary form of a BSON Object Id as specified
@@ -475,19 +432,6 @@ typedef struct {
    void *padding[7];
 } bson_visitor_t;
 
-#define BSON_ERROR_BUFFER_SIZE 503
-
-BSON_ALIGNED_BEGIN (BSON_ALIGN_OF_PTR) // Aligned for backwards-compatibility.
-typedef struct _bson_error_t {
-   uint32_t domain;
-   uint32_t code;
-   char message[BSON_ERROR_BUFFER_SIZE];
-   uint8_t reserved; // For internal use only!
-} bson_error_t BSON_ALIGNED_END (BSON_ALIGN_OF_PTR);
-
-
-BSON_STATIC_ASSERT2 (error_t, sizeof (bson_error_t) == 512);
-
 
 /**
  * bson_next_power_of_two:
diff -pruN 2.0.2-1/src/libbson/src/bson/bson-utf8.c 2.1.0-1/src/libbson/src/bson/bson-utf8.c
--- 2.0.2-1/src/libbson/src/bson/bson-utf8.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libbson/src/bson/bson-utf8.c	2025-08-14 18:37:23.000000000 +0000
@@ -15,15 +15,18 @@
  */
 
 
-#include <string.h>
+#include <bson/bson-utf8.h>
 
-#include <bson/bson-memory.h>
-#include <mlib/cmp.h>
 #include <common-json-private.h>
 #include <common-macros-private.h>
 #include <common-string-private.h>
 #include <common-utf8-private.h>
-#include <bson/bson-utf8.h>
+
+#include <bson/memory.h>
+
+#include <mlib/cmp.h>
+
+#include <string.h>
 
 
 /*
diff -pruN 2.0.2-1/src/libbson/src/bson/bson-utf8.h 2.1.0-1/src/libbson/src/bson/bson-utf8.h
--- 2.0.2-1/src/libbson/src/bson/bson-utf8.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libbson/src/bson/bson-utf8.h	2025-08-14 18:37:23.000000000 +0000
@@ -21,8 +21,8 @@
 #define BSON_UTF8_H
 
 
-#include <bson/bson-macros.h>
 #include <bson/bson-types.h>
+#include <bson/macros.h>
 
 
 BSON_BEGIN_DECLS
diff -pruN 2.0.2-1/src/libbson/src/bson/bson-value.c 2.1.0-1/src/libbson/src/bson/bson-value.c
--- 2.0.2-1/src/libbson/src/bson/bson-value.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libbson/src/bson/bson-value.c	2025-08-14 18:37:23.000000000 +0000
@@ -15,10 +15,13 @@
  */
 
 
-#include <bson/bson-memory.h>
-#include <common-string-private.h>
 #include <bson/bson-value.h>
+
+#include <common-string-private.h>
+
 #include <bson/bson-oid.h>
+#include <bson/memory.h>
+
 #include <mlib/cmp.h>
 
 
diff -pruN 2.0.2-1/src/libbson/src/bson/bson-value.h 2.1.0-1/src/libbson/src/bson/bson-value.h
--- 2.0.2-1/src/libbson/src/bson/bson-value.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libbson/src/bson/bson-value.h	2025-08-14 18:37:23.000000000 +0000
@@ -21,8 +21,8 @@
 #define BSON_VALUE_H
 
 
-#include <bson/bson-macros.h>
 #include <bson/bson-types.h>
+#include <bson/macros.h>
 
 
 BSON_BEGIN_DECLS
diff -pruN 2.0.2-1/src/libbson/src/bson/bson-vector-private.h 2.1.0-1/src/libbson/src/bson/bson-vector-private.h
--- 2.0.2-1/src/libbson/src/bson/bson-vector-private.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libbson/src/bson/bson-vector-private.h	2025-08-14 18:37:23.000000000 +0000
@@ -19,8 +19,8 @@
 #ifndef BSON_VECTOR_PRIVATE_H
 #define BSON_VECTOR_PRIVATE_H
 
-#include <bson/bson-macros.h>
-#include <bson/bson-compat.h>
+#include <bson/compat.h>
+#include <bson/macros.h>
 
 BSON_BEGIN_DECLS
 
diff -pruN 2.0.2-1/src/libbson/src/bson/bson-vector.c 2.1.0-1/src/libbson/src/bson/bson-vector.c
--- 2.0.2-1/src/libbson/src/bson/bson-vector.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libbson/src/bson/bson-vector.c	2025-08-14 18:37:23.000000000 +0000
@@ -15,9 +15,12 @@
  */
 
 
-#include <bson/bson.h>
 #include <bson/bson-vector-private.h>
 
+#include <bson/bson.h>
+
+#include <mlib/config.h>
+
 
 static BSON_INLINE bool
 bson_vector_binary_header_impl_init (bson_vector_binary_header_impl_t *header_out,
@@ -81,7 +84,7 @@ bson_vector_int8_view_init (bson_vector_
    if (bson_vector_binary_header_impl_init (&header, binary_data, binary_data_len) &&
        bson_vector_int8_validate (header)) {
       if (view_out) {
-         *view_out = (bson_vector_int8_view_t){
+         *view_out = (bson_vector_int8_view_t) {
             .binary.data = binary_data, .binary.data_len = binary_data_len, .binary.header_copy = header};
       }
       return true;
@@ -101,7 +104,7 @@ bson_vector_int8_const_view_init (bson_v
    if (bson_vector_binary_header_impl_init (&header, binary_data, binary_data_len) &&
        bson_vector_int8_validate (header)) {
       if (view_out) {
-         *view_out = (bson_vector_int8_const_view_t){
+         *view_out = (bson_vector_int8_const_view_t) {
             .binary.data = binary_data, .binary.data_len = binary_data_len, .binary.header_copy = header};
       }
       return true;
@@ -119,7 +122,7 @@ bson_vector_float32_view_init (bson_vect
    if (bson_vector_binary_header_impl_init (&header, binary_data, binary_data_len) &&
        bson_vector_float32_validate (header, binary_data_len)) {
       if (view_out) {
-         *view_out = (bson_vector_float32_view_t){
+         *view_out = (bson_vector_float32_view_t) {
             .binary.data = binary_data, .binary.data_len = binary_data_len, .binary.header_copy = header};
       }
       return true;
@@ -139,7 +142,7 @@ bson_vector_float32_const_view_init (bso
    if (bson_vector_binary_header_impl_init (&header, binary_data, binary_data_len) &&
        bson_vector_float32_validate (header, binary_data_len)) {
       if (view_out) {
-         *view_out = (bson_vector_float32_const_view_t){
+         *view_out = (bson_vector_float32_const_view_t) {
             .binary.data = binary_data, .binary.data_len = binary_data_len, .binary.header_copy = header};
       }
       return true;
@@ -159,7 +162,7 @@ bson_vector_packed_bit_view_init (bson_v
    if (bson_vector_binary_header_impl_init (&header, binary_data, binary_data_len) &&
        bson_vector_packed_bit_validate (header, binary_data, binary_data_len)) {
       if (view_out) {
-         *view_out = (bson_vector_packed_bit_view_t){
+         *view_out = (bson_vector_packed_bit_view_t) {
             .binary.data = binary_data, .binary.data_len = binary_data_len, .binary.header_copy = header};
       }
       return true;
@@ -179,7 +182,7 @@ bson_vector_packed_bit_const_view_init (
    if (bson_vector_binary_header_impl_init (&header, binary_data, binary_data_len) &&
        bson_vector_packed_bit_validate (header, binary_data, binary_data_len)) {
       if (view_out) {
-         *view_out = (bson_vector_packed_bit_const_view_t){
+         *view_out = (bson_vector_packed_bit_const_view_t) {
             .binary.data = binary_data, .binary.data_len = binary_data_len, .binary.header_copy = header};
       }
       return true;
@@ -304,7 +307,7 @@ bson_append_vector_int8_uninit (
          .bytes[1] = bson_vector_header_byte_1 (0)};
       memcpy (binary, header.bytes, BSON_VECTOR_HEADER_LEN);
       *view_out =
-         (bson_vector_int8_view_t){.binary.data = binary, .binary.data_len = length, .binary.header_copy = header};
+         (bson_vector_int8_view_t) {.binary.data = binary, .binary.data_len = length, .binary.header_copy = header};
       return true;
    } else {
       return false;
@@ -329,7 +332,7 @@ bson_append_vector_float32_uninit (
          .bytes[1] = bson_vector_header_byte_1 (0)};
       memcpy (binary, header.bytes, BSON_VECTOR_HEADER_LEN);
       *view_out =
-         (bson_vector_float32_view_t){.binary.data = binary, .binary.data_len = length, .binary.header_copy = header};
+         (bson_vector_float32_view_t) {.binary.data = binary, .binary.data_len = length, .binary.header_copy = header};
       return true;
    } else {
       return false;
@@ -349,7 +352,11 @@ bson_append_vector_packed_bit_uninit (
    }
    uint8_t *binary;
    if (bson_append_binary_uninit (bson, key, key_length, BSON_SUBTYPE_VECTOR, &binary, length)) {
+      mlib_diagnostic_push ();
+      mlib_msvc_warning (disable : 4146);
       size_t padding = (size_t) 7 & -element_count;
+      mlib_diagnostic_pop ();
+
       bson_vector_binary_header_impl_t header = {
          .bytes[0] = bson_vector_header_byte_0 (BSON_VECTOR_ELEMENT_UNSIGNED_INT, BSON_VECTOR_ELEMENT_1_BIT),
          .bytes[1] = bson_vector_header_byte_1 (padding)};
@@ -359,7 +366,7 @@ bson_append_vector_packed_bit_uninit (
          // No reason to read-modify-write here, it's better to write the whole byte.
          binary[length - 1u] = 0u;
       }
-      *view_out = (bson_vector_packed_bit_view_t){
+      *view_out = (bson_vector_packed_bit_view_t) {
          .binary.data = binary, .binary.data_len = length, .binary.header_copy = header};
       return true;
    } else {
diff -pruN 2.0.2-1/src/libbson/src/bson/bson-vector.h 2.1.0-1/src/libbson/src/bson/bson-vector.h
--- 2.0.2-1/src/libbson/src/bson/bson-vector.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libbson/src/bson/bson-vector.h	2025-08-14 18:37:23.000000000 +0000
@@ -19,9 +19,9 @@
 #ifndef BSON_VECTOR_H
 #define BSON_VECTOR_H
 
-#include <bson/bson-macros.h>
-#include <bson/bson-compat.h>
 #include <bson/bson-endian.h>
+#include <bson/compat.h>
+#include <bson/macros.h>
 
 BSON_BEGIN_DECLS
 
diff -pruN 2.0.2-1/src/libbson/src/bson/bson-version-functions.c 2.1.0-1/src/libbson/src/bson/bson-version-functions.c
--- 2.0.2-1/src/libbson/src/bson/bson-version-functions.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libbson/src/bson/bson-version-functions.c	2025-08-14 18:37:23.000000000 +0000
@@ -14,10 +14,9 @@
  * limitations under the License.
  */
 
-
-#include <bson/bson-version.h>
 #include <bson/bson-version-functions.h>
 
+#include <bson/version.h>
 
 /**
  * bson_get_major_version:
@@ -30,7 +29,6 @@ bson_get_major_version (void)
    return BSON_MAJOR_VERSION;
 }
 
-
 /**
  * bson_get_minor_version:
  *
diff -pruN 2.0.2-1/src/libbson/src/bson/bson-version.h.in 2.1.0-1/src/libbson/src/bson/bson-version.h.in
--- 2.0.2-1/src/libbson/src/bson/bson-version.h.in	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libbson/src/bson/bson-version.h.in	1970-01-01 00:00:00.000000000 +0000
@@ -1,102 +0,0 @@
-/*
- * Copyright 2009-present MongoDB, Inc.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-
-#if !defined(BSON_INSIDE) && !defined(BSON_COMPILATION)
-#error "Only <bson/bson.h> can be included directly."
-#endif
-
-// clang-format off
-
-#ifndef BSON_VERSION_H
-#define BSON_VERSION_H
-
-
-/**
- * BSON_MAJOR_VERSION:
- *
- * BSON major version component (e.g. 1 if %BSON_VERSION is 1.2.3)
- */
-#define BSON_MAJOR_VERSION (@libbson_VERSION_MAJOR@)
-
-
-/**
- * BSON_MINOR_VERSION:
- *
- * BSON minor version component (e.g. 2 if %BSON_VERSION is 1.2.3)
- */
-#define BSON_MINOR_VERSION (@libbson_VERSION_MINOR@)
-
-
-/**
- * BSON_MICRO_VERSION:
- *
- * BSON micro version component (e.g. 3 if %BSON_VERSION is 1.2.3)
- */
-#define BSON_MICRO_VERSION (@libbson_VERSION_PATCH@)
-
-
-/**
- * BSON_PRERELEASE_VERSION:
- *
- * BSON prerelease version component (e.g. pre if %BSON_VERSION is 1.2.3-pre)
- */
-#define BSON_PRERELEASE_VERSION (@libbson_VERSION_PRERELEASE@)
-
-/**
- * BSON_VERSION:
- *
- * BSON version.
- */
-#define BSON_VERSION (@libbson_VERSION_FULL@)
-
-
-/**
- * BSON_VERSION_S:
- *
- * BSON version, encoded as a string, useful for printing and
- * concatenation.
- */
-#define BSON_VERSION_S "@libbson_VERSION_FULL@"
-
-
-/**
- * BSON_VERSION_HEX:
- *
- * BSON version, encoded as an hexadecimal number, useful for
- * integer comparisons.
- */
-#define BSON_VERSION_HEX (BSON_MAJOR_VERSION << 24 | \
-                          BSON_MINOR_VERSION << 16 | \
-                          BSON_MICRO_VERSION << 8)
-
-
-/**
- * BSON_CHECK_VERSION:
- * @major: required major version
- * @minor: required minor version
- * @micro: required micro version
- *
- * Compile-time version checking. Evaluates to %TRUE if the version
- * of BSON is greater than or equal to the required one.
- */
-#define BSON_CHECK_VERSION(major,minor,micro)   \
-        (BSON_MAJOR_VERSION > (major) || \
-         (BSON_MAJOR_VERSION == (major) && BSON_MINOR_VERSION > (minor)) || \
-         (BSON_MAJOR_VERSION == (major) && BSON_MINOR_VERSION == (minor) && \
-          BSON_MICRO_VERSION >= (micro)))
-
-#endif /* BSON_VERSION_H */
diff -pruN 2.0.2-1/src/libbson/src/bson/bson-writer.c 2.1.0-1/src/libbson/src/bson/bson-writer.c
--- 2.0.2-1/src/libbson/src/bson/bson-writer.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libbson/src/bson/bson-writer.c	2025-08-14 18:37:23.000000000 +0000
@@ -15,9 +15,10 @@
  */
 
 
-#include <bson/bson-private.h>
 #include <bson/bson-writer.h>
 
+#include <bson/bson-private.h>
+
 
 struct _bson_writer_t {
    bool ready;
diff -pruN 2.0.2-1/src/libbson/src/bson/bson-writer.h 2.1.0-1/src/libbson/src/bson/bson-writer.h
--- 2.0.2-1/src/libbson/src/bson/bson-writer.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libbson/src/bson/bson-writer.h	2025-08-14 18:37:23.000000000 +0000
@@ -16,17 +16,16 @@
 
 #include <bson/bson-prelude.h>
 
-
 #ifndef BSON_WRITER_H
 #define BSON_WRITER_H
 
+#include <bson/bson_t.h>
+#include <bson/memory.h>
 
-#include <bson/bson.h>
-
+#include <stdbool.h>
 
 BSON_BEGIN_DECLS
 
-
 /**
  * bson_writer_t:
  *
@@ -40,7 +39,6 @@ BSON_BEGIN_DECLS
  */
 typedef struct _bson_writer_t bson_writer_t;
 
-
 BSON_EXPORT (bson_writer_t *)
 bson_writer_new (uint8_t **buf, size_t *buflen, size_t offset, bson_realloc_func realloc_func, void *realloc_func_ctx);
 BSON_EXPORT (void)
@@ -54,8 +52,6 @@ bson_writer_end (bson_writer_t *writer);
 BSON_EXPORT (void)
 bson_writer_rollback (bson_writer_t *writer);
 
-
 BSON_END_DECLS
 
-
 #endif /* BSON_WRITER_H */
diff -pruN 2.0.2-1/src/libbson/src/bson/bson.c 2.1.0-1/src/libbson/src/bson/bson.c
--- 2.0.2-1/src/libbson/src/bson/bson.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libbson/src/bson/bson.c	2025-08-14 18:37:23.000000000 +0000
@@ -15,25 +15,29 @@
  */
 
 
-#include <bson/validate-private.h>
-#include <mlib/intencode.h>
 #include <bson/bson.h>
-#include <bson/bson-config.h>
-#include <bson/bson-private.h>
+
+#include <bson/bson-iso8601-private.h>
 #include <bson/bson-json-private.h>
-#include <common-string-private.h>
+#include <bson/bson-private.h>
+#include <bson/validate-private.h>
 #include <common-json-private.h>
 #include <common-macros-private.h>
-#include <bson/bson-iso8601-private.h>
+#include <common-string-private.h>
+
+#include <bson/config.h>
+
+#include <mlib/config.h>
+#include <mlib/intencode.h>
 
-#include <string.h>
 #include <math.h>
+#include <string.h>
 
 
 /*
  * Globals.
  */
-static const uint8_t gZero;
+static const uint8_t gZero = 0;
 
 /*
  *--------------------------------------------------------------------------
@@ -291,10 +295,13 @@ BSON_STATIC_ASSERT2 (max_alloc_grow_fits
 // Add a bytes+length pair only if `_length > 0`.
 // Append failure if `n_bytes` will exceed BSON max size.
 #define BSON_APPEND_BYTES_ADD_ARGUMENT(_list, _bytes, _length)        \
+   mlib_diagnostic_push ();                                           \
+   mlib_disable_constant_conditional_expression_warnings ();          \
    if (BSON_UNLIKELY ((_length) > BSON_MAX_SIZE - (_list).n_bytes)) { \
+      mlib_diagnostic_pop ();                                         \
       goto append_failure;                                            \
    } else if ((_length) > 0) {                                        \
-      *(_list).current++ = (_bson_append_bytes_arg){                  \
+      *(_list).current++ = (_bson_append_bytes_arg) {                 \
          .bytes = (const uint8_t *) (_bytes),                         \
          .length = (_length),                                         \
       };                                                              \
diff -pruN 2.0.2-1/src/libbson/src/bson/bson.h 2.1.0-1/src/libbson/src/bson/bson.h
--- 2.0.2-1/src/libbson/src/bson/bson.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libbson/src/bson/bson.h	2025-08-14 18:37:23.000000000 +0000
@@ -20,21 +20,13 @@
 
 #define BSON_INSIDE
 
-#include <bson/bson-compat.h>
-
-#include <string.h>
-#include <time.h>
-
-#include <bson/bson-macros.h>
-#include <bson/bson-config.h>
-#include <bson/bson-context.h>
+#include <bson/bson-bcon.h>
 #include <bson/bson-clock.h>
+#include <bson/bson-context.h>
 #include <bson/bson-decimal128.h>
-#include <bson/bson-error.h>
 #include <bson/bson-iter.h>
 #include <bson/bson-json.h>
 #include <bson/bson-keys.h>
-#include <bson/bson-memory.h>
 #include <bson/bson-oid.h>
 #include <bson/bson-reader.h>
 #include <bson/bson-string.h>
@@ -42,10 +34,16 @@
 #include <bson/bson-utf8.h>
 #include <bson/bson-value.h>
 #include <bson/bson-vector.h>
-#include <bson/bson-version.h>
 #include <bson/bson-version-functions.h>
 #include <bson/bson-writer.h>
-#include <bson/bcon.h>
+#include <bson/compat.h>
+#include <bson/config.h>
+#include <bson/macros.h>
+#include <bson/memory.h>
+#include <bson/version.h>
+
+#include <string.h>
+#include <time.h>
 
 #undef BSON_INSIDE
 
@@ -161,8 +159,7 @@ BSON_BEGIN_DECLS
  *
  * Returns: A newly allocated bson_t that should be freed with bson_destroy().
  */
-BSON_EXPORT (bson_t *)
-bson_new (void);
+BSON_EXPORT (bson_t *) bson_new (void);
 
 
 BSON_EXPORT (bson_t *)
diff -pruN 2.0.2-1/src/libbson/src/bson/bson_t.h 2.1.0-1/src/libbson/src/bson/bson_t.h
--- 2.0.2-1/src/libbson/src/bson/bson_t.h	1970-01-01 00:00:00.000000000 +0000
+++ 2.1.0-1/src/libbson/src/bson/bson_t.h	2025-08-14 18:37:23.000000000 +0000
@@ -0,0 +1,61 @@
+/*
+ * Copyright 2009-present MongoDB, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef BSON_BSON_T_H_INCLUDED
+#define BSON_BSON_T_H_INCLUDED
+
+#include <bson/macros.h>
+
+#include <stdint.h>
+
+/**
+ * bson_t:
+ *
+ * This structure manages a buffer whose contents are a properly formatted
+ * BSON document. You may perform various transforms on the BSON documents.
+ * Additionally, it can be iterated over using bson_iter_t.
+ *
+ * See bson_iter_init() for iterating the contents of a bson_t.
+ *
+ * When building a bson_t structure using the various append functions,
+ * memory allocations may occur. That is performed using power of two
+ * allocations and realloc().
+ *
+ * See http://bsonspec.org for the BSON document spec.
+ *
+ * This structure is meant to fit in two sequential 64-byte cachelines.
+ */
+BSON_ALIGNED_BEGIN (BSON_ALIGN_OF_PTR) typedef struct _bson_t {
+   uint32_t flags;       /* Internal flags for the bson_t. */
+   uint32_t len;         /* Length of BSON data. */
+   uint8_t padding[120]; /* Padding for stack allocation. */
+} bson_t BSON_ALIGNED_END (BSON_ALIGN_OF_PTR);
+
+/**
+ * BSON_INITIALIZER:
+ *
+ * This macro can be used to initialize a #bson_t structure on the stack
+ * without calling bson_init().
+ *
+ * |[
+ * bson_t b = BSON_INITIALIZER;
+ * ]|
+ */
+#define BSON_INITIALIZER {3, 5, {5}}
+
+BSON_STATIC_ASSERT2 (bson_t, sizeof (bson_t) == 128);
+
+#endif // BSON_BSON_T_H_INCLUDED
diff -pruN 2.0.2-1/src/libbson/src/bson/compat.h 2.1.0-1/src/libbson/src/bson/compat.h
--- 2.0.2-1/src/libbson/src/bson/compat.h	1970-01-01 00:00:00.000000000 +0000
+++ 2.1.0-1/src/libbson/src/bson/compat.h	2025-08-14 18:37:23.000000000 +0000
@@ -0,0 +1,201 @@
+/*
+ * Copyright 2009-present MongoDB, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef BSON_COMPAT_H
+#define BSON_COMPAT_H
+
+
+#if defined(__MINGW32__)
+#if defined(__USE_MINGW_ANSI_STDIO)
+#if __USE_MINGW_ANSI_STDIO < 1
+#error "__USE_MINGW_ANSI_STDIO > 0 is required for correct PRI* macros"
+#endif
+#else
+#define __USE_MINGW_ANSI_STDIO 1
+#endif
+#endif
+
+#include <bson/config.h>
+#include <bson/macros.h>
+
+
+#ifdef BSON_OS_WIN32
+#if defined(_WIN32_WINNT) && (_WIN32_WINNT < 0x0601)
+#undef _WIN32_WINNT
+#endif
+#ifndef _WIN32_WINNT
+#define _WIN32_WINNT 0x0601
+#endif
+#ifndef NOMINMAX
+#define NOMINMAX
+#endif
+#include <winsock2.h>
+#ifndef WIN32_LEAN_AND_MEAN
+#define WIN32_LEAN_AND_MEAN
+#include <windows.h>
+#undef WIN32_LEAN_AND_MEAN
+#else
+#include <windows.h>
+#endif
+#include <direct.h>
+#include <io.h>
+#endif
+
+
+#ifdef BSON_OS_UNIX
+#include <sys/time.h>
+#include <unistd.h>
+#endif
+
+
+#include <bson/macros.h>
+
+#include <fcntl.h>
+#include <sys/stat.h>
+
+#include <ctype.h>
+#include <errno.h>
+#include <limits.h>
+#include <stdarg.h>
+#include <stdbool.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <time.h>
+
+
+BSON_BEGIN_DECLS
+
+#if !defined(_MSC_VER) || (_MSC_VER >= 1800)
+#include <inttypes.h>
+#endif
+#ifdef _MSC_VER
+#ifndef __cplusplus
+/* benign redefinition of type */
+#pragma warning(disable : 4142)
+#ifndef _SSIZE_T_DEFINED
+#define _SSIZE_T_DEFINED
+typedef SSIZE_T ssize_t;
+#endif
+#ifndef _SIZE_T_DEFINED
+#define _SIZE_T_DEFINED
+typedef SIZE_T size_t;
+#endif
+#pragma warning(default : 4142)
+#else
+/*
+ * MSVC++ does not include ssize_t, just size_t.
+ * So we need to synthesize that as well.
+ */
+#pragma warning(disable : 4142)
+#ifndef _SSIZE_T_DEFINED
+#define _SSIZE_T_DEFINED
+typedef SSIZE_T ssize_t;
+#endif
+#pragma warning(default : 4142)
+#endif
+#ifndef PRIi32
+#define PRIi32 "d"
+#endif
+#ifndef PRId32
+#define PRId32 "d"
+#endif
+#ifndef PRIu32
+#define PRIu32 "u"
+#endif
+#ifndef PRIi64
+#define PRIi64 "I64i"
+#endif
+#ifndef PRId64
+#define PRId64 "I64i"
+#endif
+#ifndef PRIu64
+#define PRIu64 "I64u"
+#endif
+#endif
+
+/* Derive the maximum representable value of signed integer type T using the
+ * formula 2^(N - 1) - 1 where N is the number of bits in type T. This assumes
+ * T is represented using two's complement. */
+#define BSON_NUMERIC_LIMITS_MAX_SIGNED(T) ((T) ((((size_t) 0x01u) << (sizeof (T) * (size_t) CHAR_BIT - 1u)) - 1u))
+
+/* Derive the minimum representable value of signed integer type T as one less
+ * than the negation of its maximum representable value. This assumes T is
+ * represented using two's complement. */
+#define BSON_NUMERIC_LIMITS_MIN_SIGNED(T, max) ((T) ((-(max)) - 1))
+
+/* Derive the maximum representable value of unsigned integer type T by flipping
+ * all its bits to 1. */
+#define BSON_NUMERIC_LIMITS_MAX_UNSIGNED(T) ((T) (~((T) 0)))
+
+#ifndef SSIZE_MAX
+#define SSIZE_MAX BSON_NUMERIC_LIMITS_MAX_SIGNED (ssize_t)
+#endif
+
+#ifndef SSIZE_MIN
+#define SSIZE_MIN BSON_NUMERIC_LIMITS_MIN_SIGNED (ssize_t, SSIZE_MAX)
+#endif
+
+#if defined(__MINGW32__) && !defined(INIT_ONCE_STATIC_INIT)
+#define INIT_ONCE_STATIC_INIT RTL_RUN_ONCE_INIT
+typedef RTL_RUN_ONCE INIT_ONCE;
+#endif
+
+
+#if !defined(va_copy) && defined(__va_copy)
+#define va_copy(dst, src) __va_copy (dst, src)
+#endif
+
+
+#if !defined(va_copy)
+#define va_copy(dst, src) ((dst) = (src))
+#endif
+
+
+#ifdef _MSC_VER
+/** Expands the arguments if compiling with MSVC, otherwise empty */
+#define BSON_IF_MSVC(...) __VA_ARGS__
+/** Expands the arguments if compiling with GCC or Clang, otherwise empty */
+#define BSON_IF_GNU_LIKE(...)
+#elif defined(__GNUC__) || defined(__clang__)
+/** Expands the arguments if compiling with MSVC, otherwise empty */
+#define BSON_IF_MSVC(...)
+/** Expands the arguments if compiling with GCC or Clang, otherwise empty */
+#define BSON_IF_GNU_LIKE(...) __VA_ARGS__
+#else
+/** Unsupported compiler. **/
+#define BSON_IF_MSVC(...)
+#define BSON_IF_GNU_LIKE(...)
+#endif
+
+#ifdef BSON_OS_WIN32
+/** Expands the arguments if compiling for Windows, otherwise empty */
+#define BSON_IF_WINDOWS(...) __VA_ARGS__
+/** Expands the arguments if compiling for POSIX, otherwise empty */
+#define BSON_IF_POSIX(...)
+#elif defined(BSON_OS_UNIX)
+/** Expands the arguments if compiling for Windows, otherwise empty */
+#define BSON_IF_WINDOWS(...)
+/** Expands the arguments if compiling for POSIX, otherwise empty */
+#define BSON_IF_POSIX(...) __VA_ARGS__
+#endif
+
+
+BSON_END_DECLS
+
+
+#endif /* BSON_COMPAT_H */
diff -pruN 2.0.2-1/src/libbson/src/bson/config.h.in 2.1.0-1/src/libbson/src/bson/config.h.in
--- 2.0.2-1/src/libbson/src/bson/config.h.in	1970-01-01 00:00:00.000000000 +0000
+++ 2.1.0-1/src/libbson/src/bson/config.h.in	2025-08-14 18:37:23.000000000 +0000
@@ -0,0 +1,122 @@
+/*
+ * Copyright 2009-present MongoDB, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef BSON_CONFIG_H
+#define BSON_CONFIG_H
+
+/*
+ * Define to 1234 for Little Endian, 4321 for Big Endian.
+ */
+#define BSON_BYTE_ORDER @BSON_BYTE_ORDER@
+
+
+/*
+ * Define to 1 if you have stdbool.h
+ */
+#define BSON_HAVE_STDBOOL_H @BSON_HAVE_STDBOOL_H@
+#if BSON_HAVE_STDBOOL_H != 1
+# undef BSON_HAVE_STDBOOL_H
+#endif
+
+
+/*
+ * Define to 1 for POSIX-like systems, 2 for Windows.
+ */
+#define BSON_OS @BSON_OS@
+
+
+/*
+ * Define to 1 if you have clock_gettime() available.
+ */
+#define BSON_HAVE_CLOCK_GETTIME @BSON_HAVE_CLOCK_GETTIME@
+#if BSON_HAVE_CLOCK_GETTIME != 1
+# undef BSON_HAVE_CLOCK_GETTIME
+#endif
+
+
+/*
+ * Define to 1 if you have strings.h available on your platform.
+ */
+#define BSON_HAVE_STRINGS_H @BSON_HAVE_STRINGS_H@
+#if BSON_HAVE_STRINGS_H != 1
+# undef BSON_HAVE_STRINGS_H
+#endif
+
+
+/*
+ * Define to 1 if you have strnlen available on your platform.
+ */
+#define BSON_HAVE_STRNLEN @BSON_HAVE_STRNLEN@
+#if BSON_HAVE_STRNLEN != 1
+# undef BSON_HAVE_STRNLEN
+#endif
+
+
+/*
+ * Define to 1 if you have snprintf available on your platform.
+ */
+#define BSON_HAVE_SNPRINTF @BSON_HAVE_SNPRINTF@
+#if BSON_HAVE_SNPRINTF != 1
+# undef BSON_HAVE_SNPRINTF
+#endif
+
+
+/*
+ * Define to 1 if you have gmtime_r available on your platform.
+ */
+#define BSON_HAVE_GMTIME_R @BSON_HAVE_GMTIME_R@
+#if BSON_HAVE_GMTIME_R != 1
+# undef BSON_HAVE_GMTIME_R
+#endif
+
+
+/*
+ * Define to 1 if you have struct timespec available on your platform.
+ */
+#define BSON_HAVE_TIMESPEC @BSON_HAVE_TIMESPEC@
+#if BSON_HAVE_TIMESPEC != 1
+# undef BSON_HAVE_TIMESPEC
+#endif
+
+
+
+/*
+ * Define to 1 if you have rand_r available on your platform.
+ */
+#define BSON_HAVE_RAND_R @BSON_HAVE_RAND_R@
+#if BSON_HAVE_RAND_R != 1
+# undef BSON_HAVE_RAND_R
+#endif
+
+
+/*
+ * Define to 1 if you have strlcpy available on your platform.
+ */
+#define BSON_HAVE_STRLCPY @BSON_HAVE_STRLCPY@
+#if BSON_HAVE_STRLCPY != 1
+# undef BSON_HAVE_STRLCPY
+#endif
+
+
+/*
+ * Define to 1 if you have aligned_alloc available on your platform.
+ */
+#define BSON_HAVE_ALIGNED_ALLOC @BSON_HAVE_ALIGNED_ALLOC@
+#if BSON_HAVE_ALIGNED_ALLOC != 1
+# undef BSON_HAVE_ALIGNED_ALLOC
+#endif
+
+#endif /* BSON_CONFIG_H */
diff -pruN 2.0.2-1/src/libbson/src/bson/error.c 2.1.0-1/src/libbson/src/bson/error.c
--- 2.0.2-1/src/libbson/src/bson/error.c	1970-01-01 00:00:00.000000000 +0000
+++ 2.1.0-1/src/libbson/src/bson/error.c	2025-08-14 18:37:23.000000000 +0000
@@ -0,0 +1,186 @@
+/*
+ * Copyright 2009-present MongoDB, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+#include <bson/bson-error-private.h>
+#include <common-string-private.h>
+
+#include <bson/bson-types.h>
+#include <bson/compat.h>
+#include <bson/config.h>
+#include <bson/memory.h>
+
+#include <stdarg.h>
+#include <stdio.h>
+
+// See `bson_strerror_r()` definition below.
+#if !defined(_WIN32) && !defined(__APPLE__)
+#include <locale.h> // uselocale()
+#endif
+
+
+/*
+ *--------------------------------------------------------------------------
+ *
+ * bson_set_error --
+ *
+ *       Initializes @error using the parameters specified.
+ *
+ *       @domain is an application specific error domain which should
+ *       describe which module initiated the error. Think of this as the
+ *       exception type.
+ *
+ *       @code is the @domain specific error code.
+ *
+ *       @format is used to generate the format string. It uses vsnprintf()
+ *       internally so the format should match what you would use there.
+ *
+ * Parameters:
+ *       @error: A #bson_error_t.
+ *       @domain: The error domain.
+ *       @code: The error code.
+ *       @format: A printf style format string.
+ *
+ * Returns:
+ *       None.
+ *
+ * Side effects:
+ *       @error is initialized.
+ *
+ *--------------------------------------------------------------------------
+ */
+
+void
+bson_set_error (bson_error_t *error, /* OUT */
+                uint32_t domain,     /* IN */
+                uint32_t code,       /* IN */
+                const char *format,  /* IN */
+                ...)                 /* IN */
+{
+   va_list args;
+
+   if (error) {
+      error->domain = domain;
+      error->code = code;
+      bson_set_error_category (error, BSON_ERROR_CATEGORY);
+
+      va_start (args, format);
+      char buffer[sizeof error->message];
+      bson_vsnprintf (buffer, sizeof error->message, format, args);
+      memcpy (error->message, buffer, sizeof buffer);
+      va_end (args);
+   }
+}
+
+
+/*
+ *--------------------------------------------------------------------------
+ *
+ * bson_strerror_r --
+ *
+ *       This is a reentrant safe macro for strerror.
+ *
+ *       The resulting string may be stored in @buf.
+ *
+ * Returns:
+ *       A pointer to a static string or @buf.
+ *
+ * Side effects:
+ *       None.
+ *
+ *--------------------------------------------------------------------------
+ */
+
+char *
+bson_strerror_r (int err_code,                    /* IN */
+                 char *buf BSON_MAYBE_UNUSED,     /* IN */
+                 size_t buflen BSON_MAYBE_UNUSED) /* IN */
+{
+   static const char *unknown_msg = "Unknown error";
+   char *ret = NULL;
+
+#if defined(_WIN32)
+   // Windows does not provide `strerror_l` or `strerror_r`, but it does
+   // unconditionally provide `strerror_s`.
+   if (strerror_s (buf, buflen, err_code) == 0) {
+      ret = buf;
+   }
+#elif defined(_AIX)
+   // AIX does not provide strerror_l, and its strerror_r isn't glibc's.
+   // But it does provide a glibc compatible one called __linux_strerror_r
+   ret = __linux_strerror_r (err_code, buf, buflen);
+#elif defined(__APPLE__)
+   // Apple does not provide `strerror_l`, but it does unconditionally provide
+   // the XSI-compliant `strerror_r`, but only when compiling with Apple Clang.
+   // GNU extensions may still be a problem if we are being compiled with GCC on
+   // Apple. Avoid the compatibility headaches with GNU extensions and the musl
+   // library by assuming the implementation will not cause UB when reading the
+   // error message string even when `strerror_r` fails, as encouraged (but not
+   // required) by the POSIX spec (see:
+   // https://pubs.opengroup.org/onlinepubs/9699919799/functions/strerror.html#tag_16_574_08).
+   (void) strerror_r (err_code, buf, buflen);
+   ret = buf;
+#elif defined(_XOPEN_SOURCE) && _XOPEN_SOURCE >= 700
+   // The behavior (of `strerror_l`) is undefined if the locale argument to
+   // `strerror_l()` is the special locale object LC_GLOBAL_LOCALE or is not a
+   // valid locale object handle.
+   locale_t locale = uselocale ((locale_t) 0);
+   // No need to test for error (it can only be [EINVAL]).
+   if (locale == LC_GLOBAL_LOCALE) {
+      // Only use our own locale if a thread-local locale was not already set.
+      // This is just to satisfy `strerror_l`. We do NOT want to unconditionally
+      // set a thread-local locale.
+      locale = newlocale (LC_MESSAGES_MASK, "C", (locale_t) 0);
+   }
+   BSON_ASSERT (locale != LC_GLOBAL_LOCALE);
+
+   // Avoid `strerror_r` compatibility headaches with GNU extensions and the
+   // musl library by using `strerror_l` instead. Furthermore, `strerror_r` is
+   // scheduled to be marked as obsolete in favor of `strerror_l` in the
+   // upcoming POSIX Issue 8 (see:
+   // https://www.austingroupbugs.net/view.php?id=655).
+   //
+   // POSIX Spec: since strerror_l() is required to return a string for some
+   // errors, an application wishing to check for all error situations should
+   // set errno to 0, then call strerror_l(), then check errno.
+   if (locale != (locale_t) 0) {
+      errno = 0;
+      ret = strerror_l (err_code, locale);
+
+      if (errno != 0) {
+         ret = NULL;
+      }
+
+      freelocale (locale);
+   } else {
+      // Could not obtain a valid `locale_t` object to satisfy `strerror_l`.
+      // Fallback to `bson_strncpy` below.
+   }
+#elif defined(_GNU_SOURCE)
+   // Unlikely, but continue supporting use of GNU extension in cases where the
+   // C Driver is being built without _XOPEN_SOURCE=700.
+   ret = strerror_r (err_code, buf, buflen);
+#else
+#error "Unable to find a supported strerror_r candidate"
+#endif
+
+   if (!ret) {
+      bson_strncpy (buf, unknown_msg, buflen);
+      ret = buf;
+   }
+
+   return ret;
+}
diff -pruN 2.0.2-1/src/libbson/src/bson/error.h 2.1.0-1/src/libbson/src/bson/error.h
--- 2.0.2-1/src/libbson/src/bson/error.h	1970-01-01 00:00:00.000000000 +0000
+++ 2.1.0-1/src/libbson/src/bson/error.h	2025-08-14 18:37:23.000000000 +0000
@@ -0,0 +1,94 @@
+/*
+ * Copyright 2009-present MongoDB, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef BSON_ERROR_T_INCLUDED
+#define BSON_ERROR_T_INCLUDED
+
+#include <bson/macros.h>
+
+#include <stdint.h>
+
+BSON_BEGIN_DECLS
+
+#define BSON_ERROR_BUFFER_SIZE 503
+
+BSON_ALIGNED_BEGIN (BSON_ALIGN_OF_PTR) // Aligned for backwards-compatibility.
+typedef struct _bson_error_t {
+   uint32_t domain;
+   uint32_t code;
+   char message[BSON_ERROR_BUFFER_SIZE];
+   uint8_t reserved; // For internal use only!
+} bson_error_t BSON_ALIGNED_END (BSON_ALIGN_OF_PTR);
+
+
+BSON_STATIC_ASSERT2 (error_t, sizeof (bson_error_t) == 512);
+
+#define BSON_ERROR_JSON 1
+#define BSON_ERROR_READER 2
+#define BSON_ERROR_INVALID 3
+#define BSON_ERROR_VECTOR 4
+
+BSON_EXPORT (void)
+bson_set_error (bson_error_t *error, uint32_t domain, uint32_t code, const char *format, ...) BSON_GNUC_PRINTF (4, 5);
+
+BSON_EXPORT (char *)
+bson_strerror_r (int err_code, char *buf, size_t buflen);
+
+/**
+ * @brief Reset the content of a bson_error_t to indicate no error.
+ *
+ * @param error Pointer to an error to be overwritten. If null, this function
+ * has no effect.
+ *
+ * This is static-inline because it is trivially optimizable as a (conditional)
+ * `memset`.
+ */
+static inline void
+bson_error_clear (bson_error_t *error)
+{
+   if (!error) {
+      return;
+   }
+   // Statically initialized to a zero struct:
+   static bson_error_t zero_error;
+   // Replace the caller's value:
+   *error = zero_error;
+}
+
+/**
+ * @brief Given a `bson_error_t` pointer l-value, ensure that it is non-null, and clear any
+ * error value that it might hold.
+ *
+ * @param ErrorPointer An l-value expression of type `bson_error_t*`.
+ *
+ * If the passed pointer is null, then it will be updated to point to an anonymous
+ * `bson_error_t` object that lives in the caller's scope.
+ *
+ * @note This macro is not valid in C++ because it relies on C99 compound literal semantics
+ */
+#define bson_error_reset(ErrorPointer) bson_error_reset (&(ErrorPointer), &(bson_error_t) {0})
+static inline void (bson_error_reset) (bson_error_t **error, bson_error_t *localptr)
+{
+   if (*error == NULL) {
+      *error = localptr;
+   }
+   bson_error_clear (*error);
+}
+
+BSON_END_DECLS
+
+
+#endif // BSON_ERROR_T_INCLUDED
diff -pruN 2.0.2-1/src/libbson/src/bson/macros.h 2.1.0-1/src/libbson/src/bson/macros.h
--- 2.0.2-1/src/libbson/src/bson/macros.h	1970-01-01 00:00:00.000000000 +0000
+++ 2.1.0-1/src/libbson/src/bson/macros.h	2025-08-14 18:37:23.000000000 +0000
@@ -0,0 +1,417 @@
+/*
+ * Copyright 2009-present MongoDB, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef BSON_MACROS_H
+#define BSON_MACROS_H
+
+#include <bson/config.h>
+
+#include <stdio.h>
+#include <stdlib.h>
+
+#ifdef __cplusplus
+#include <algorithm>
+#endif
+
+
+#if BSON_OS == 1
+#define BSON_OS_UNIX
+#elif BSON_OS == 2
+#define BSON_OS_WIN32
+#else
+#error "Unknown operating system."
+#endif
+
+
+#ifdef __cplusplus
+#define BSON_BEGIN_DECLS extern "C" {
+#define BSON_END_DECLS }
+#else
+#define BSON_BEGIN_DECLS
+#define BSON_END_DECLS
+#endif
+
+
+#if defined(__GNUC__)
+#define BSON_GNUC_CHECK_VERSION(major, minor) \
+   ((__GNUC__ > (major)) || ((__GNUC__ == (major)) && (__GNUC_MINOR__ >= (minor))))
+#else
+#define BSON_GNUC_CHECK_VERSION(major, minor) 0
+#endif
+
+
+#if defined(__GNUC__)
+#define BSON_GNUC_IS_VERSION(major, minor) ((__GNUC__ == (major)) && (__GNUC_MINOR__ == (minor)))
+#else
+#define BSON_GNUC_IS_VERSION(major, minor) 0
+#endif
+
+
+/* Decorate public functions:
+ * - if BSON_STATIC, we're compiling a static libbson or a program
+ *   that uses libbson as a static library. Don't decorate functions.
+ * - else if BSON_COMPILATION, we're compiling a shared libbson, mark
+ *   public functions for export from the shared lib
+ * - else, we're compiling a program that uses libbson as a shared library,
+ *   mark public functions as DLL imports for Microsoft Visual C
+ */
+
+#ifdef _MSC_VER
+/*
+ * Microsoft Visual C
+ */
+#ifdef BSON_STATIC
+#define BSON_API
+#elif defined(BSON_COMPILATION)
+#define BSON_API __declspec (dllexport)
+#else
+#define BSON_API __declspec (dllimport)
+#endif
+#define BSON_CALL __cdecl
+
+#elif defined(__GNUC__)
+/*
+ * GCC
+ */
+#ifdef BSON_STATIC
+#define BSON_API
+#elif defined(BSON_COMPILATION)
+#define BSON_API __attribute__ ((visibility ("default")))
+#else
+#define BSON_API
+#endif
+#define BSON_CALL
+
+#else
+/*
+ * Other compilers
+ */
+#define BSON_API
+#define BSON_CALL
+
+#endif
+
+#define BSON_EXPORT(type) BSON_API type BSON_CALL
+
+
+#ifdef MIN
+#define BSON_MIN MIN
+#elif defined(__cplusplus)
+#define BSON_MIN(a, b) ((std::min) (a, b))
+#elif defined(_MSC_VER)
+#define BSON_MIN(a, b) ((a) < (b) ? (a) : (b))
+#else
+#define BSON_MIN(a, b) (((a) < (b)) ? (a) : (b))
+#endif
+
+
+#ifdef MAX
+#define BSON_MAX MAX
+#elif defined(__cplusplus)
+#define BSON_MAX(a, b) ((std::max) (a, b))
+#elif defined(_MSC_VER)
+#define BSON_MAX(a, b) ((a) > (b) ? (a) : (b))
+#else
+#define BSON_MAX(a, b) (((a) > (b)) ? (a) : (b))
+#endif
+
+
+#ifdef ABS
+#define BSON_ABS ABS
+#else
+#define BSON_ABS(a) (((a) < 0) ? ((a) * -1) : (a))
+#endif
+
+#if defined(__cplusplus) && (__cplusplus >= 201103L || defined(_MSVC_LANG))
+#define BSON_ALIGNOF(expr) alignof (expr)
+#elif defined(__STDC_VERSION__) && __STDC_VERSION__ >= 201112L
+#define BSON_ALIGNOF(expr) _Alignof (expr)
+#else
+#if defined(_MSC_VER)
+#define BSON_ALIGNOF(expr) __alignof (expr)
+#else
+#define BSON_ALIGNOF(expr) __alignof__ (expr)
+#endif
+#endif // __STDC_VERSION__ >= 201112L
+
+#ifdef _MSC_VER
+// __declspec (align (_N)) only permits integer literals as _N.
+#ifdef _WIN64
+#define BSON_ALIGN_OF_PTR 8
+#else
+#define BSON_ALIGN_OF_PTR 4
+#endif
+#else
+#define BSON_ALIGN_OF_PTR (BSON_ALIGNOF (void *))
+#endif
+
+#if defined(_MSC_VER)
+#define BSON_ALIGNED_BEGIN(_N) __declspec (align (BSON_ALIGN_OF_PTR))
+#define BSON_ALIGNED_END(_N)
+#else
+#define BSON_ALIGNED_BEGIN(_N)
+#define BSON_ALIGNED_END(_N) __attribute__ ((aligned ((_N) > BSON_ALIGN_OF_PTR ? BSON_ALIGN_OF_PTR : (_N))))
+#endif
+
+
+#define bson_str_empty(s) (!s[0])
+#define bson_str_empty0(s) (!s || !s[0])
+
+
+#if defined(_MSC_VER)
+#define BSON_FUNC __FUNCTION__
+#else
+#define BSON_FUNC __func__
+#endif
+
+
+#if defined(_MSC_VER)
+#define BSON_INLINE __inline
+#else
+#define BSON_INLINE __inline__
+#endif
+
+
+#if defined(__STDC_VERSION__) && __STDC_VERSION__ >= 202311L
+#define BSON_NORETURN [[noreturn]]
+#elif defined(__STDC_VERSION__) && __STDC_VERSION__ >= 201112L
+#define BSON_NORETURN _Noreturn
+#elif defined(__GNUC__) && 2 < __GNUC__ + (8 <= __GNUC_MINOR__)
+#define BSON_NORETURN __attribute__ ((__noreturn__))
+#else
+#define BSON_NORETURN
+#endif
+
+
+#if defined(__GNUC__)
+#define BSON_RESTRICT __restrict__
+#elif defined(_MSC_VER)
+#define BSON_RESTRICT __restrict
+#elif !defined(__cplusplus)
+// C99 (not C++)
+#define BSON_RESTRICT restrict
+#else
+#define BSON_RESTRICT
+#endif
+
+
+BSON_NORETURN static BSON_INLINE void
+_bson_assert_failed_on_line (const char *file, int line, const char *func, const char *test)
+{
+   fprintf (stderr, "%s:%d %s(): assertion failed: %s\n", file, line, func, test);
+   abort ();
+}
+
+BSON_NORETURN static BSON_INLINE void
+_bson_assert_failed_on_param (const char *param, const char *func)
+{
+   fprintf (stderr, "The parameter: %s, in function %s, cannot be NULL\n", param, func);
+   abort ();
+}
+
+#define BSON_ASSERT(test)                                                            \
+   do {                                                                              \
+      if (!(BSON_LIKELY (test))) {                                                   \
+         _bson_assert_failed_on_line (__FILE__, (int) (__LINE__), BSON_FUNC, #test); \
+      }                                                                              \
+   } while (0)
+
+/**
+ * @brief Assert the expression `Assertion`, and evaluates to `Value` on
+ * success.
+ */
+#define BSON_ASSERT_INLINE(Assertion, Value)                                                                           \
+   ((void) ((Assertion) ? (0) : (_bson_assert_failed_on_line (__FILE__, (int) (__LINE__), BSON_FUNC, #Assertion), 0)), \
+    Value)
+
+/**
+ * @brief Assert that the given pointer is non-NULL, while also evaluating to
+ * that pointer.
+ *
+ * Can be used to inline assertions with a pointer dereference:
+ *
+ * ```
+ * foo* f = get_foo();
+ * bar* b = BSON_ASSERT_PTR_INLINE(f)->bar_value;
+ * ```
+ */
+#define BSON_ASSERT_PTR_INLINE(Pointer) BSON_ASSERT_INLINE ((Pointer) != NULL, (Pointer))
+
+/* Used for asserting parameters to provide a more precise error message */
+#define BSON_ASSERT_PARAM(param)                           \
+   do {                                                    \
+      if ((BSON_UNLIKELY (param == NULL))) {               \
+         _bson_assert_failed_on_param (#param, BSON_FUNC); \
+      }                                                    \
+   } while (0)
+
+// `BSON_OPTIONAL_PARAM` is a documentation-only macro to document X may be NULL.
+// Useful in combination with `BSON_ASSERT_PARAM` to document and assert pointer parameters.
+#define BSON_OPTIONAL_PARAM(param) ((void) param)
+
+/* obsolete macros, preserved for compatibility */
+#define BSON_STATIC_ASSERT(s) BSON_STATIC_ASSERT_ (s, __LINE__)
+#define BSON_STATIC_ASSERT_JOIN(a, b) BSON_STATIC_ASSERT_JOIN2 (a, b)
+#define BSON_STATIC_ASSERT_JOIN2(a, b) a##b
+#define BSON_STATIC_ASSERT_(s, l) typedef char BSON_STATIC_ASSERT_JOIN (static_assert_test_, __LINE__)[(s) ? 1 : -1]
+
+/* modern macros */
+#define BSON_STATIC_ASSERT2(_name, _s) BSON_STATIC_ASSERT2_ (_s, __LINE__, _name)
+#define BSON_STATIC_ASSERT_JOIN3(_a, _b, _name) BSON_STATIC_ASSERT_JOIN4 (_a, _b, _name)
+#define BSON_STATIC_ASSERT_JOIN4(_a, _b, _name) _a##_b##_name
+#define BSON_STATIC_ASSERT2_(_s, _l, _name) \
+   typedef char BSON_STATIC_ASSERT_JOIN3 (static_assert_test_, __LINE__, _name)[(_s) ? 1 : -1]
+
+
+#if defined(__GNUC__)
+#define BSON_GNUC_PURE __attribute__ ((pure))
+#define BSON_GNUC_WARN_UNUSED_RESULT __attribute__ ((warn_unused_result))
+#else
+#define BSON_GNUC_PURE
+#define BSON_GNUC_WARN_UNUSED_RESULT
+#endif
+
+
+#if BSON_GNUC_CHECK_VERSION(4, 0) && !defined(_WIN32)
+#define BSON_GNUC_NULL_TERMINATED __attribute__ ((sentinel))
+#define BSON_GNUC_INTERNAL __attribute__ ((visibility ("hidden")))
+#else
+#define BSON_GNUC_NULL_TERMINATED
+#define BSON_GNUC_INTERNAL
+#endif
+
+
+#if defined(__GNUC__)
+#define BSON_LIKELY(x) __builtin_expect (!!(x), 1)
+#define BSON_UNLIKELY(x) __builtin_expect (!!(x), 0)
+#else
+#define BSON_LIKELY(v) v
+#define BSON_UNLIKELY(v) v
+#endif
+
+
+#if defined(__clang__)
+#define BSON_GNUC_PRINTF(f, v) __attribute__ ((format (printf, f, v)))
+#elif BSON_GNUC_CHECK_VERSION(4, 4)
+#define BSON_GNUC_PRINTF(f, v) __attribute__ ((format (gnu_printf, f, v)))
+#else
+#define BSON_GNUC_PRINTF(f, v)
+#endif
+
+
+#if defined(__LP64__) || defined(_LP64)
+#define BSON_WORD_SIZE 64
+#else
+#define BSON_WORD_SIZE 32
+#endif
+
+
+#ifdef _MSC_VER
+#define BSON_ENSURE_ARRAY_PARAM_SIZE(_n)
+#define BSON_TYPEOF decltype
+#else
+#define BSON_ENSURE_ARRAY_PARAM_SIZE(_n) static (_n)
+#define BSON_TYPEOF typeof
+#endif
+
+/**
+ * @brief Statically annotate an entity as deprecated, including the given deprecation message
+ *
+ * @param Message The message to be included in a deprecation warning. This
+ * should be a string literal.
+ */
+#define BSON_DEPRECATED(Message) _bsonDeprecatedImpl (Message)
+
+// Pick the appropriate implementation of a deprecation attribute
+#if defined(_MSC_VER)
+// For MSVC, emit __declspec(deprecated(Msg))
+#define _bsonDeprecatedImpl(Msg) __declspec (deprecated (Msg))
+#elif defined(__GNUC__) && (defined(__clang__) || BSON_GNUC_CHECK_VERSION(4, 5))
+// For new enough Clang and GCC, emit __attribute__((__deprecated__(Msg)))
+#define _bsonDeprecatedImpl(Msg) __attribute__ ((__deprecated__ (Msg)))
+#elif defined(__GNUC__)
+// For older GCC, emit deprecation attribute without the message
+#define _bsonDeprecatedImpl(Msg) __attribute__ ((__deprecated__))
+#else
+// For other compilers, emit nothing
+#define _bsonDeprecatedImpl(Msg)
+#endif
+
+#define BSON_DEPRECATED_FOR(F) BSON_DEPRECATED ("This API is deprecated. Use " #F " instead.")
+
+#define BSON_GNUC_DEPRECATED BSON_DEPRECATED ("This API is deprecated")
+#define BSON_GNUC_DEPRECATED_FOR(F) BSON_DEPRECATED_FOR (F)
+
+#define BSON_CONCAT_IMPL(a, ...) a##__VA_ARGS__
+#define BSON_CONCAT(a, ...) BSON_CONCAT_IMPL (a, __VA_ARGS__)
+#define BSON_CONCAT3(a, b, c) BSON_CONCAT (a, BSON_CONCAT (b, c))
+#define BSON_CONCAT4(a, b, c, d) BSON_CONCAT (BSON_CONCAT (a, b), BSON_CONCAT (c, d))
+
+
+/**
+ * @brief String-ify the given argument
+ */
+#define BSON_STR(...) #__VA_ARGS__
+
+/**
+ * @brief Mark the attached declared entity as "possibly-unused."
+ *
+ * Does nothing on MSVC.
+ */
+#if defined(__GNUC__) || defined(__clang__)
+#define BSON_MAYBE_UNUSED __attribute__ ((unused))
+#else
+#define BSON_MAYBE_UNUSED /* Nothing for other compilers */
+#endif
+
+/**
+ * @brief Mark a point in the code as unreachable. If the point is reached, the
+ * program will abort with an error message.
+ *
+ * @param What A string to include in the error message if this point is ever
+ * executed.
+ */
+#define BSON_UNREACHABLE(What)                                                                                     \
+   do {                                                                                                            \
+      fprintf (stderr, "%s:%d %s(): Unreachable code reached: %s\n", __FILE__, (int) (__LINE__), BSON_FUNC, What); \
+      abort ();                                                                                                    \
+   } while (0)
+
+/**
+ * @brief Silence warnings for deliberately unused variables or parameters.
+ *
+ * @param expr An unused variable or parameter.
+ *
+ */
+#define BSON_UNUSED(expr) \
+   do {                   \
+      (void) (expr);      \
+   } while (0)
+
+// Disable the -Wunsafe-buffer-usage warning.
+#define BSON_DISABLE_UNSAFE_BUFFER_USAGE_WARNING_BEGIN
+#define BSON_DISABLE_UNSAFE_BUFFER_USAGE_WARNING_END
+#if defined(__clang__)
+#if __has_warning("-Wunsafe-buffer-usage")
+#undef BSON_DISABLE_UNSAFE_BUFFER_USAGE_WARNING_BEGIN
+#undef BSON_DISABLE_UNSAFE_BUFFER_USAGE_WARNING_END
+#define BSON_DISABLE_UNSAFE_BUFFER_USAGE_WARNING_BEGIN \
+   _Pragma ("clang diagnostic push") _Pragma ("clang diagnostic ignored \"-Wunsafe-buffer-usage\"")
+#define BSON_DISABLE_UNSAFE_BUFFER_USAGE_WARNING_END _Pragma ("clang diagnostic pop")
+#endif // __has_warning("-Wunsafe-buffer-usage")
+#endif // defined(__clang__)
+
+#endif /* BSON_MACROS_H */
diff -pruN 2.0.2-1/src/libbson/src/bson/memory.c 2.1.0-1/src/libbson/src/bson/memory.c
--- 2.0.2-1/src/libbson/src/bson/memory.c	1970-01-01 00:00:00.000000000 +0000
+++ 2.1.0-1/src/libbson/src/bson/memory.c	2025-08-14 18:37:23.000000000 +0000
@@ -0,0 +1,438 @@
+/*
+ * Copyright 2009-present MongoDB, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+#include <bson/memory.h>
+
+#include <common-macros-private.h>
+
+#include <bson/config.h>
+
+#include <mlib/config.h>
+
+#include <errno.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+// Ensure size of exported structs are stable.
+BSON_STATIC_ASSERT2 (bson_mem_vtable_t, sizeof (bson_mem_vtable_t) == sizeof (void *) * 8u);
+
+
+// For compatibility with C standards prior to C11.
+static void *
+_aligned_alloc_impl (size_t alignment, size_t num_bytes)
+#if defined(BSON_HAVE_ALIGNED_ALLOC)
+{
+   MC_DISABLE_IMPLICIT_WARNING_BEGIN
+   return aligned_alloc (alignment, num_bytes);
+   MC_DISABLE_IMPLICIT_WARNING_END
+}
+#elif defined(_POSIX_C_SOURCE) && _POSIX_C_SOURCE >= 200112L
+{
+   void *mem = NULL;
+
+   // Workaround for https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66425.
+   BSON_MAYBE_UNUSED int ret = posix_memalign (&mem, alignment, num_bytes);
+
+   return mem;
+}
+#else
+{
+   // Fallback to simple malloc even if it does not satisfy alignment
+   // requirements. Note: Visual C++ _aligned_malloc requires using
+   // _aligned_free instead of free and modifies errno on failure, both of which
+   // breaks symmetry with C11 aligned_alloc, so it is deliberately not used.
+   BSON_UNUSED (alignment);
+   return malloc (num_bytes);
+}
+#endif
+
+mlib_diagnostic_push ();
+mlib_msvc_warning (disable : 4232);
+static bson_mem_vtable_t gMemVtable = {.malloc = malloc,
+                                       .calloc = calloc,
+                                       .realloc = realloc,
+                                       .free = free,
+                                       .aligned_alloc = _aligned_alloc_impl,
+                                       .padding = {0}};
+mlib_diagnostic_pop ();
+
+
+/*
+ *--------------------------------------------------------------------------
+ *
+ * bson_malloc --
+ *
+ *       Allocates @num_bytes of memory and returns a pointer to it.  If
+ *       malloc failed to allocate the memory, abort() is called.
+ *
+ *       Libbson does not try to handle OOM conditions as it is beyond the
+ *       scope of this library to handle so appropriately.
+ *
+ * Parameters:
+ *       @num_bytes: The number of bytes to allocate.
+ *
+ * Returns:
+ *       A pointer if successful; otherwise abort() is called and this
+ *       function will never return.
+ *
+ * Side effects:
+ *       None.
+ *
+ *--------------------------------------------------------------------------
+ */
+
+void *
+bson_malloc (size_t num_bytes) /* IN */
+{
+   void *mem = NULL;
+
+   if (BSON_LIKELY (num_bytes)) {
+      if (BSON_UNLIKELY (!(mem = gMemVtable.malloc (num_bytes)))) {
+         fprintf (stderr, "Failure to allocate memory in bson_malloc(). errno: %d.\n", errno);
+         abort ();
+      }
+   }
+
+   return mem;
+}
+
+
+/*
+ *--------------------------------------------------------------------------
+ *
+ * bson_malloc0 --
+ *
+ *       Like bson_malloc() except the memory is zeroed first. This is
+ *       similar to calloc() except that abort() is called in case of
+ *       failure to allocate memory.
+ *
+ * Parameters:
+ *       @num_bytes: The number of bytes to allocate.
+ *
+ * Returns:
+ *       A pointer if successful; otherwise abort() is called and this
+ *       function will never return.
+ *
+ * Side effects:
+ *       None.
+ *
+ *--------------------------------------------------------------------------
+ */
+
+void *
+bson_malloc0 (size_t num_bytes) /* IN */
+{
+   void *mem = NULL;
+
+   if (BSON_LIKELY (num_bytes)) {
+      if (BSON_UNLIKELY (!(mem = gMemVtable.calloc (1, num_bytes)))) {
+         fprintf (stderr, "Failure to allocate memory in bson_malloc0(). errno: %d.\n", errno);
+         abort ();
+      }
+   }
+
+   return mem;
+}
+
+
+/*
+ *--------------------------------------------------------------------------
+ *
+ * bson_aligned_alloc --
+ *
+ *       Allocates @num_bytes of memory with an alignment of @alignment and
+ *       returns a pointer to it.  If malloc failed to allocate the memory,
+ *       abort() is called.
+ *
+ *       Libbson does not try to handle OOM conditions as it is beyond the
+ *       scope of this library to handle so appropriately.
+ *
+ * Parameters:
+ *       @alignment: The alignment of the allocated bytes of memory.
+ *       @num_bytes: The number of bytes to allocate.
+ *
+ * Returns:
+ *       A pointer if successful; otherwise abort() is called and this
+ *       function will never return.
+ *
+ * Side effects:
+ *       None.
+ *
+ *--------------------------------------------------------------------------
+ */
+
+void *
+bson_aligned_alloc (size_t alignment /* IN */, size_t num_bytes /* IN */)
+{
+   void *mem = NULL;
+
+   if (BSON_LIKELY (num_bytes)) {
+      if (BSON_UNLIKELY (!(mem = gMemVtable.aligned_alloc (alignment, num_bytes)))) {
+         fprintf (stderr, "Failure to allocate memory in bson_aligned_alloc()\n");
+         abort ();
+      }
+   }
+
+   return mem;
+}
+
+
+/*
+ *--------------------------------------------------------------------------
+ *
+ * bson_aligned_alloc0 --
+ *
+ *       Like bson_aligned_alloc() except the memory is zeroed after allocation
+ *       for convenience.
+ *
+ * Parameters:
+ *       @alignment: The alignment of the allocated bytes of memory.
+ *       @num_bytes: The number of bytes to allocate.
+ *
+ * Returns:
+ *       A pointer if successful; otherwise abort() is called and this
+ *       function will never return.
+ *
+ * Side effects:
+ *       None.
+ *
+ *--------------------------------------------------------------------------
+ */
+
+void *
+bson_aligned_alloc0 (size_t alignment /* IN */, size_t num_bytes /* IN */)
+{
+   void *mem = NULL;
+
+   if (BSON_LIKELY (num_bytes)) {
+      if (BSON_UNLIKELY (!(mem = gMemVtable.aligned_alloc (alignment, num_bytes)))) {
+         fprintf (stderr, "Failure to allocate memory in bson_aligned_alloc0()\n");
+         abort ();
+      }
+      memset (mem, 0, num_bytes);
+   }
+
+   return mem;
+}
+
+
+/*
+ *--------------------------------------------------------------------------
+ *
+ * bson_realloc --
+ *
+ *       This function behaves similar to realloc() except that if there is
+ *       a failure abort() is called.
+ *
+ * Parameters:
+ *       @mem: The memory to realloc, or NULL.
+ *       @num_bytes: The size of the new allocation or 0 to free.
+ *
+ * Returns:
+ *       The new allocation if successful; otherwise abort() is called and
+ *       this function never returns.
+ *
+ * Side effects:
+ *       None.
+ *
+ *--------------------------------------------------------------------------
+ */
+
+void *
+bson_realloc (void *mem,        /* IN */
+              size_t num_bytes) /* IN */
+{
+   /*
+    * Not all platforms are guaranteed to free() the memory if a call to
+    * realloc() with a size of zero occurs. Windows, Linux, and FreeBSD do,
+    * however, OS X does not.
+    */
+   if (BSON_UNLIKELY (num_bytes == 0)) {
+      gMemVtable.free (mem);
+      return NULL;
+   }
+
+   mem = gMemVtable.realloc (mem, num_bytes);
+
+   if (BSON_UNLIKELY (!mem)) {
+      fprintf (stderr, "Failure to re-allocate memory in bson_realloc(). errno: %d.\n", errno);
+      abort ();
+   }
+
+   return mem;
+}
+
+
+/*
+ *--------------------------------------------------------------------------
+ *
+ * bson_realloc_ctx --
+ *
+ *       This wraps bson_realloc and provides a compatible api for similar
+ *       functions with a context
+ *
+ * Parameters:
+ *       @mem: The memory to realloc, or NULL.
+ *       @num_bytes: The size of the new allocation or 0 to free.
+ *       @ctx: Ignored
+ *
+ * Returns:
+ *       The new allocation if successful; otherwise abort() is called and
+ *       this function never returns.
+ *
+ * Side effects:
+ *       None.
+ *
+ *--------------------------------------------------------------------------
+ */
+
+
+void *
+bson_realloc_ctx (void *mem,        /* IN */
+                  size_t num_bytes, /* IN */
+                  void *ctx)        /* IN */
+{
+   BSON_UNUSED (ctx);
+
+   return bson_realloc (mem, num_bytes);
+}
+
+
+/*
+ *--------------------------------------------------------------------------
+ *
+ * bson_free --
+ *
+ *       Frees @mem using the underlying allocator.
+ *
+ *       Currently, this only calls free() directly, but that is subject to
+ *       change.
+ *
+ * Parameters:
+ *       @mem: An allocation to free.
+ *
+ * Returns:
+ *       None.
+ *
+ * Side effects:
+ *       None.
+ *
+ *--------------------------------------------------------------------------
+ */
+
+void
+bson_free (void *mem) /* IN */
+{
+   gMemVtable.free (mem);
+}
+
+
+/*
+ *--------------------------------------------------------------------------
+ *
+ * bson_zero_free --
+ *
+ *       Frees @mem using the underlying allocator. @size bytes of @mem will
+ *       be zeroed before freeing the memory. This is useful in scenarios
+ *       where @mem contains passwords or other sensitive information.
+ *
+ * Parameters:
+ *       @mem: An allocation to free.
+ *       @size: The number of bytes in @mem.
+ *
+ * Returns:
+ *       None.
+ *
+ * Side effects:
+ *       None.
+ *
+ *--------------------------------------------------------------------------
+ */
+
+void
+bson_zero_free (void *mem,   /* IN */
+                size_t size) /* IN */
+{
+   if (BSON_LIKELY (mem)) {
+      memset (mem, 0, size);
+      gMemVtable.free (mem);
+   }
+}
+
+
+static void *
+_aligned_alloc_as_malloc (size_t alignment, size_t num_bytes)
+{
+   BSON_UNUSED (alignment);
+
+   return gMemVtable.malloc (num_bytes);
+}
+
+
+/*
+ *--------------------------------------------------------------------------
+ *
+ * bson_mem_set_vtable --
+ *
+ *       This function will change our allocation vtable.
+ *
+ *       It is imperative that this is called at the beginning of the
+ *       process before any memory has been allocated by the default
+ *       allocator.
+ *
+ * Returns:
+ *       None.
+ *
+ * Side effects:
+ *       None.
+ *
+ *--------------------------------------------------------------------------
+ */
+
+void
+bson_mem_set_vtable (const bson_mem_vtable_t *vtable)
+{
+   BSON_ASSERT (vtable);
+
+   if (!vtable->malloc || !vtable->calloc || !vtable->realloc || !vtable->free) {
+      fprintf (stderr,
+               "Failure to install BSON vtable, "
+               "missing functions.\n");
+      return;
+   }
+
+   gMemVtable = *vtable;
+
+   // Backwards compatibility with code prior to addition of aligned_alloc.
+   if (!gMemVtable.aligned_alloc) {
+      gMemVtable.aligned_alloc = _aligned_alloc_as_malloc;
+   }
+}
+
+void
+bson_mem_restore_vtable (void)
+{
+   bson_mem_vtable_t vtable = {.malloc = malloc,
+                               .calloc = calloc,
+                               .realloc = realloc,
+                               .free = free,
+                               .aligned_alloc = _aligned_alloc_impl,
+                               .padding = {0}};
+
+   bson_mem_set_vtable (&vtable);
+}
diff -pruN 2.0.2-1/src/libbson/src/bson/memory.h 2.1.0-1/src/libbson/src/bson/memory.h
--- 2.0.2-1/src/libbson/src/bson/memory.h	1970-01-01 00:00:00.000000000 +0000
+++ 2.1.0-1/src/libbson/src/bson/memory.h	2025-08-14 18:37:23.000000000 +0000
@@ -0,0 +1,65 @@
+/*
+ * Copyright 2009-present MongoDB, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef BSON_MEMORY_H_INCLUDED
+#define BSON_MEMORY_H_INCLUDED
+
+#include <bson/macros.h>
+
+
+BSON_BEGIN_DECLS
+
+
+typedef void *(BSON_CALL *bson_realloc_func) (void *mem, size_t num_bytes, void *ctx);
+
+typedef struct _bson_mem_vtable_t {
+   void *(BSON_CALL *malloc) (size_t num_bytes);
+   void *(BSON_CALL *calloc) (size_t n_members, size_t num_bytes);
+   void *(BSON_CALL *realloc) (void *mem, size_t num_bytes);
+   void (BSON_CALL *free) (void *mem);
+   void *(BSON_CALL *aligned_alloc) (size_t alignment, size_t num_bytes);
+   void *padding[3];
+} bson_mem_vtable_t;
+
+
+BSON_EXPORT (void)
+bson_mem_set_vtable (const bson_mem_vtable_t *vtable);
+BSON_EXPORT (void)
+bson_mem_restore_vtable (void);
+BSON_EXPORT (void *)
+bson_malloc (size_t num_bytes);
+BSON_EXPORT (void *)
+bson_malloc0 (size_t num_bytes);
+BSON_EXPORT (void *)
+bson_aligned_alloc (size_t alignment, size_t num_bytes);
+BSON_EXPORT (void *)
+bson_aligned_alloc0 (size_t alignment, size_t num_bytes);
+BSON_EXPORT (void *)
+bson_realloc (void *mem, size_t num_bytes);
+BSON_EXPORT (void *)
+bson_realloc_ctx (void *mem, size_t num_bytes, void *ctx);
+BSON_EXPORT (void)
+bson_free (void *mem);
+BSON_EXPORT (void)
+bson_zero_free (void *mem, size_t size);
+
+
+#define BSON_ALIGNED_ALLOC(T) ((T *) (bson_aligned_alloc (BSON_ALIGNOF (T), sizeof (T))))
+#define BSON_ALIGNED_ALLOC0(T) ((T *) (bson_aligned_alloc0 (BSON_ALIGNOF (T), sizeof (T))))
+
+BSON_END_DECLS
+
+#endif // BSON_MEMORY_H_INCLUDED
diff -pruN 2.0.2-1/src/libbson/src/bson/validate.c 2.1.0-1/src/libbson/src/bson/validate.c
--- 2.0.2-1/src/libbson/src/bson/validate.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libbson/src/bson/validate.c	2025-08-14 18:37:23.000000000 +0000
@@ -28,9 +28,11 @@
  */
 
 #include <bson/validate-private.h>
+
+#include <bson/bson.h>
+
 #include <mlib/intencode.h>
 #include <mlib/test.h>
-#include <bson/bson.h>
 
 #include <stdbool.h>
 #include <string.h>
@@ -544,7 +546,7 @@ _bson_validate_impl_v2 (const bson_t *bs
    BSON_ASSERT_PARAM (error);
 
    // Clear the error
-   *error = (bson_error_t){0};
+   *error = (bson_error_t) {0};
 
    // Initialize validation parameters
    validation_params const params = {
diff -pruN 2.0.2-1/src/libbson/src/bson/version.h.in 2.1.0-1/src/libbson/src/bson/version.h.in
--- 2.0.2-1/src/libbson/src/bson/version.h.in	1970-01-01 00:00:00.000000000 +0000
+++ 2.1.0-1/src/libbson/src/bson/version.h.in	2025-08-14 18:37:23.000000000 +0000
@@ -0,0 +1,97 @@
+/*
+ * Copyright 2009-present MongoDB, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+// clang-format off
+
+#ifndef BSON_VERSION_H
+#define BSON_VERSION_H
+
+
+/**
+ * BSON_MAJOR_VERSION:
+ *
+ * BSON major version component (e.g. 1 if %BSON_VERSION is 1.2.3)
+ */
+#define BSON_MAJOR_VERSION (@libbson_VERSION_MAJOR@)
+
+
+/**
+ * BSON_MINOR_VERSION:
+ *
+ * BSON minor version component (e.g. 2 if %BSON_VERSION is 1.2.3)
+ */
+#define BSON_MINOR_VERSION (@libbson_VERSION_MINOR@)
+
+
+/**
+ * BSON_MICRO_VERSION:
+ *
+ * BSON micro version component (e.g. 3 if %BSON_VERSION is 1.2.3)
+ */
+#define BSON_MICRO_VERSION (@libbson_VERSION_PATCH@)
+
+
+/**
+ * BSON_PRERELEASE_VERSION:
+ *
+ * BSON prerelease version component (e.g. pre if %BSON_VERSION is 1.2.3-pre)
+ */
+#define BSON_PRERELEASE_VERSION (@libbson_VERSION_PRERELEASE@)
+
+/**
+ * BSON_VERSION:
+ *
+ * BSON version.
+ */
+#define BSON_VERSION (@libbson_VERSION_FULL@)
+
+
+/**
+ * BSON_VERSION_S:
+ *
+ * BSON version, encoded as a string, useful for printing and
+ * concatenation.
+ */
+#define BSON_VERSION_S "@libbson_VERSION_FULL@"
+
+
+/**
+ * BSON_VERSION_HEX:
+ *
+ * BSON version, encoded as an hexadecimal number, useful for
+ * integer comparisons.
+ */
+#define BSON_VERSION_HEX (BSON_MAJOR_VERSION << 24 | \
+                          BSON_MINOR_VERSION << 16 | \
+                          BSON_MICRO_VERSION << 8)
+
+
+/**
+ * BSON_CHECK_VERSION:
+ * @major: required major version
+ * @minor: required minor version
+ * @micro: required micro version
+ *
+ * Compile-time version checking. Evaluates to %TRUE if the version
+ * of BSON is greater than or equal to the required one.
+ */
+#define BSON_CHECK_VERSION(major,minor,micro)   \
+        (BSON_MAJOR_VERSION > (major) || \
+         (BSON_MAJOR_VERSION == (major) && BSON_MINOR_VERSION > (minor)) || \
+         (BSON_MAJOR_VERSION == (major) && BSON_MINOR_VERSION == (minor) && \
+          BSON_MICRO_VERSION >= (micro)))
+
+#endif /* BSON_VERSION_H */
diff -pruN 2.0.2-1/src/libbson/src/jsonsl/jsonsl.c 2.1.0-1/src/libbson/src/jsonsl/jsonsl.c
--- 2.0.2-1/src/libbson/src/jsonsl/jsonsl.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libbson/src/jsonsl/jsonsl.c	2025-08-14 18:37:23.000000000 +0000
@@ -4,7 +4,7 @@
  */
 
 #include <jsonsl/jsonsl.h>
-#include <bson/bson-memory.h>
+#include <bson/memory.h>
 
 #include <limits.h>
 #include <ctype.h>
@@ -144,34 +144,44 @@ jsonsl_feed(jsonsl_t jsn, const jsonsl_c
 {
 
 #define INVOKE_ERROR(eb) \
-    if (jsn->error_callback(jsn, JSONSL_ERROR_##eb, state, (char*)c)) { \
-        goto GT_AGAIN; \
-    } \
-    return;
+    if (1) { \
+        if (jsn->error_callback(jsn, JSONSL_ERROR_##eb, state, (char*)c)) { \
+            goto GT_AGAIN; \
+        } \
+        return; \
+    } else ((void)0)
 
 #define STACK_PUSH \
-    if (jsn->level >= (levels_max-1)) { \
-        jsn->error_callback(jsn, JSONSL_ERROR_LEVELS_EXCEEDED, state, (char*)c); \
-        return; \
-    } \
-    state = jsn->stack + (++jsn->level); \
-    state->ignore_callback = jsn->stack[jsn->level-1].ignore_callback; \
-    state->pos_begin = jsn->pos;
+    if (1) { \
+        if (jsn->level >= (levels_max-1)) { \
+            jsn->error_callback(jsn, JSONSL_ERROR_LEVELS_EXCEEDED, state, (char*)c); \
+            return; \
+        } \
+        state = jsn->stack + (++jsn->level); \
+        state->ignore_callback = jsn->stack[jsn->level-1].ignore_callback; \
+        state->pos_begin = jsn->pos; \
+    } else ((void)0)
 
 #define CALLBACK_AND_POP_NOPOS(T) \
+    if (1) { \
         state->pos_cur = jsn->pos; \
         DO_CALLBACK(T, POP); \
         state->nescapes = 0; \
-        state = jsn->stack + (--jsn->level);
+        state = jsn->stack + (--jsn->level); \
+    } else ((void)0)
 
 #define CALLBACK_AND_POP(T) \
+    if (1) { \
         CALLBACK_AND_POP_NOPOS(T); \
-        state->pos_cur = jsn->pos;
+        state->pos_cur = jsn->pos; \
+    } else ((void)0)
 
 #define SPECIAL_POP \
-    CALLBACK_AND_POP(SPECIAL); \
-    jsn->expecting = 0; \
-    jsn->tok_last = 0; \
+    if (1) { \
+        CALLBACK_AND_POP(SPECIAL); \
+        jsn->expecting = 0; \
+        jsn->tok_last = 0; \
+    } else ((void)0)
 
 #define CUR_CHAR (*(jsonsl_uchar_t*)c)
 
@@ -186,7 +196,7 @@ jsonsl_feed(jsonsl_t jsn, const jsonsl_c
             jsn->action_callback(jsn, JSONSL_ACTION_##action, state, (jsonsl_char_t*)c); \
         } \
         if (jsn->stopfl) { return; } \
-    }
+    } else ((void)0)
 
     /**
      * Verifies that we are able to insert the (non-string) item into a hash.
@@ -194,19 +204,19 @@ jsonsl_feed(jsonsl_t jsn, const jsonsl_c
 #define ENSURE_HVAL \
     if (state->nelem % 2 == 0 && state->type == JSONSL_T_OBJECT) { \
         INVOKE_ERROR(HKEY_EXPECTED); \
-    }
+    } else ((void)0)
 
 #define VERIFY_SPECIAL(lit, lit_len) \
-        if ((jsn->pos - state->pos_begin) > lit_len \
-                || CUR_CHAR != (lit)[jsn->pos - state->pos_begin]) { \
-            INVOKE_ERROR(SPECIAL_EXPECTED); \
-        }
+    if ((jsn->pos - state->pos_begin) > lit_len \
+            || CUR_CHAR != (lit)[jsn->pos - state->pos_begin]) { \
+        INVOKE_ERROR(SPECIAL_EXPECTED); \
+    } else ((void)0)
 
 #define VERIFY_SPECIAL_CI(lit, lit_len) \
-        if ((jsn->pos - state->pos_begin) > lit_len \
-                || tolower(CUR_CHAR) != (lit)[jsn->pos - state->pos_begin]) { \
-            INVOKE_ERROR(SPECIAL_EXPECTED); \
-        }
+    if ((jsn->pos - state->pos_begin) > lit_len \
+            || tolower(CUR_CHAR) != (lit)[jsn->pos - state->pos_begin]) { \
+        INVOKE_ERROR(SPECIAL_EXPECTED); \
+    } else ((void)0)
 
 #define STATE_SPECIAL_LENGTH \
     (state)->nescapes
@@ -663,7 +673,7 @@ const char* jsonsl_strerror(jsonsl_error
 #define X(t) \
     if (err == JSONSL_ERROR_##t) \
         return #t;
-    JSONSL_XERR;
+    JSONSL_XERR
 #undef X
     return "<UNKNOWN_ERROR>";
 }
@@ -787,7 +797,7 @@ jsonsl_jpr_new(const char *path, jsonsl_
     size_t origlen;
     jsonsl_error_t errstacked;
 
-#define JPR_BAIL(err) *errp = err; goto GT_ERROR;
+#define JPR_BAIL(err) if (1) { *errp = err; goto GT_ERROR; } else ((void)0)
 
     if (errp == NULL) {
         errp = &errstacked;
@@ -1042,9 +1052,9 @@ void jsonsl_jpr_match_state_init(jsonsl_
     if (njprs == 0) {
         return;
     }
-    jsn->jprs = (jsonsl_jpr_t *)malloc(sizeof(jsonsl_jpr_t) * njprs);
+    jsn->jprs = (jsonsl_jpr_t *) bson_malloc (sizeof (jsonsl_jpr_t) * njprs);
     jsn->jpr_count = njprs;
-    jsn->jpr_root = (size_t*)calloc(1, sizeof(size_t) * njprs * jsn->levels_max);
+    jsn->jpr_root = (size_t *) bson_malloc0 (sizeof (size_t) * njprs * jsn->levels_max);
     memcpy(jsn->jprs, jprs, sizeof(jsonsl_jpr_t) * njprs);
     /* Set the initial jump table values */
 
@@ -1060,8 +1070,8 @@ void jsonsl_jpr_match_state_cleanup(json
         return;
     }
 
-    free(jsn->jpr_root);
-    free(jsn->jprs);
+    bson_free(jsn->jpr_root);
+    bson_free(jsn->jprs);
     jsn->jprs = NULL;
     jsn->jpr_root = NULL;
     jsn->jpr_count = 0;
@@ -1157,7 +1167,7 @@ const char *jsonsl_strmatchtype(jsonsl_j
 static char *
 jsonsl__writeutf8(uint32_t pt, char *out)
 {
-    #define ADD_OUTPUT(c) *out = (char)(c); out++;
+    #define ADD_OUTPUT(c) if (1) { *out = (char)(c); out++; } else ((void)0)
 
     if (pt < 0x80) {
         ADD_OUTPUT(pt);
@@ -1204,9 +1214,11 @@ jsonsl__get_uescape_16(const char *s)
     int cur;
 
     #define GET_DIGIT(off) \
-        cur = jsonsl__digit2int(s[off]); \
-        if (cur == -1) { return -1; } \
-        ret |= (cur << (12 - (off * 4)));
+        if (1) { \
+            cur = jsonsl__digit2int(s[off]); \
+            if (cur == -1) { return -1; } \
+            ret |= (cur << (12 - (off * 4))); \
+        } else ((void)0)
 
     GET_DIGIT(0);
     GET_DIGIT(1);
@@ -1238,11 +1250,13 @@ size_t jsonsl_util_unescape_ex(const cha
     *oflags = 0;
 
     #define UNESCAPE_BAIL(e,offset) \
-        *err = JSONSL_ERROR_##e; \
-        if (errat) { \
-            *errat = (const char*)(c+ (ptrdiff_t)(offset)); \
-        } \
-        return 0;
+        if (1) { \
+            *err = JSONSL_ERROR_##e; \
+            if (errat) { \
+                *errat = (const char*)(c+ (ptrdiff_t)(offset)); \
+            } \
+            return 0; \
+        } else ((void)0)
 
     for (; len; len--, c++, out++) {
         int uescval;
@@ -1255,7 +1269,7 @@ size_t jsonsl_util_unescape_ex(const cha
             UNESCAPE_BAIL(ESCAPE_INVALID, 0);
         }
         if (!is_allowed_escape(c[1])) {
-            UNESCAPE_BAIL(ESCAPE_INVALID, 1)
+            UNESCAPE_BAIL(ESCAPE_INVALID, 1);
         }
         if ((toEscape && toEscape[(unsigned char)c[1] & 0x7f] == 0 &&
                 c[1] != '\\' && c[1] != '"')) {
diff -pruN 2.0.2-1/src/libbson/src/jsonsl/jsonsl.h 2.1.0-1/src/libbson/src/jsonsl/jsonsl.h
--- 2.0.2-1/src/libbson/src/jsonsl/jsonsl.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libbson/src/jsonsl/jsonsl.h	2025-08-14 18:37:23.000000000 +0000
@@ -9,11 +9,14 @@
  * See included LICENSE file for license details.
  */
 
-#include <bson/bson-prelude.h>
-
 #ifndef JSONSL_H_
 #define JSONSL_H_
 
+#include <bson/config.h>
+#include <bson/compat.h>
+
+#include <mlib/config.h>
+
 #include <stdio.h>
 #include <stdlib.h>
 #include <stddef.h>
@@ -548,12 +551,21 @@ struct jsonsl_st {
     size_t *jpr_root;
     /*@}*/
 
+#if defined(_MSC_VER)
+#pragma warning (push)
+#pragma warning (disable : 4200)
+#endif // defined(_MSC_VER)
+
     /**
      * This is the stack. Its upper bound is levels_max, or the
      * nlevels argument passed to jsonsl_new. If you modify this structure,
      * make sure that this member is last.
      */
     struct jsonsl_state_st stack[];
+
+#if defined(_MSC_VER)
+#pragma warning (pop)
+#endif // defined(_MSC_VER)
 };
 
 
diff -pruN 2.0.2-1/src/libbson/tests/corpus-test.c 2.1.0-1/src/libbson/tests/corpus-test.c
--- 2.0.2-1/src/libbson/tests/corpus-test.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libbson/tests/corpus-test.c	2025-08-14 18:37:23.000000000 +0000
@@ -14,12 +14,10 @@
  * limitations under the License.
  */
 
+#include "./corpus-test.h"
 
 #include <bson/bson.h>
 
-#include "corpus-test.h"
-
-
 #ifdef _MSC_VER
 #define SSCANF sscanf_s
 #else
@@ -57,7 +55,6 @@ corpus_test_unhexlify (bson_iter_t *iter
    return data;
 }
 
-
 void
 corpus_test (bson_t *scenario,
              test_bson_valid_cb valid,
diff -pruN 2.0.2-1/src/libbson/tests/corpus-test.h 2.1.0-1/src/libbson/tests/corpus-test.h
--- 2.0.2-1/src/libbson/tests/corpus-test.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libbson/tests/corpus-test.h	2025-08-14 18:37:23.000000000 +0000
@@ -17,10 +17,10 @@
 #ifndef CORPUS_TEST_H
 #define CORPUS_TEST_H
 
-#include "TestSuite.h"
-
 #include <bson/bson.h>
 
+#include <TestSuite.h>
+
 /*
 See:
 github.com/mongodb/specifications/blob/master/source/bson-corpus/bson-corpus.rst
diff -pruN 2.0.2-1/src/libbson/tests/json/bson_binary_vector/packed_bit.json 2.1.0-1/src/libbson/tests/json/bson_binary_vector/packed_bit.json
--- 2.0.2-1/src/libbson/tests/json/bson_binary_vector/packed_bit.json	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libbson/tests/json/bson_binary_vector/packed_bit.json	2025-08-14 18:37:23.000000000 +0000
@@ -21,17 +21,17 @@
       "canonical_bson": "1600000005766563746F7200040000000910007F0700"
     },
     {
-      "description": "Empty Vector PACKED_BIT",
+      "description": "PACKED_BIT with padding",
       "valid": true,
-      "vector": [],
+      "vector": [127, 8],
       "dtype_hex": "0x10",
       "dtype_alias": "PACKED_BIT",
-      "padding": 0,
-      "canonical_bson": "1400000005766563746F72000200000009100000"
+      "padding": 3,
+      "canonical_bson": "1600000005766563746F7200040000000910037F0800"
     },
     {
-      "description": "PACKED_BIT with padding",
-      "valid": true,
+      "description": "PACKED_BIT with inconsistent padding",
+      "valid": false,
       "vector": [127, 7],
       "dtype_hex": "0x10",
       "dtype_alias": "PACKED_BIT",
@@ -39,6 +39,15 @@
       "canonical_bson": "1600000005766563746F7200040000000910037F0700"
     },
     {
+      "description": "Empty Vector PACKED_BIT",
+      "valid": true,
+      "vector": [],
+      "dtype_hex": "0x10",
+      "dtype_alias": "PACKED_BIT",
+      "padding": 0,
+      "canonical_bson": "1400000005766563746F72000200000009100000"
+    },
+    {
       "description": "Overflow Vector PACKED_BIT",
       "valid": false,
       "vector": [256],
diff -pruN 2.0.2-1/src/libbson/tests/test-b64.c 2.1.0-1/src/libbson/tests/test-b64.c
--- 2.0.2-1/src/libbson/tests/test-b64.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libbson/tests/test-b64.c	2025-08-14 18:37:23.000000000 +0000
@@ -14,12 +14,14 @@
  * limitations under the License.
  */
 
+#include <common-b64-private.h>
+
 #include <bson/bson.h>
 
-#include "TestSuite.h"
-#include <common-b64-private.h>
 #include <mlib/cmp.h>
 
+#include <TestSuite.h>
+
 static void
 _test_encode_helper (char *input, size_t input_len, char *expected_output, int expected_output_len)
 {
diff -pruN 2.0.2-1/src/libbson/tests/test-bcon-basic.c 2.1.0-1/src/libbson/tests/test-bcon-basic.c
--- 2.0.2-1/src/libbson/tests/test-bcon-basic.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libbson/tests/test-bcon-basic.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,6 +1,6 @@
-#include "TestSuite.h"
+#include <bson/bson-bcon.h>
 
-#include <bson/bcon.h>
+#include <TestSuite.h>
 
 static void
 test_utf8 (void)
diff -pruN 2.0.2-1/src/libbson/tests/test-bcon-extract.c 2.1.0-1/src/libbson/tests/test-bcon-extract.c
--- 2.0.2-1/src/libbson/tests/test-bcon-extract.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libbson/tests/test-bcon-extract.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,6 +1,6 @@
-#include <bson/bcon.h>
+#include <bson/bson-bcon.h>
 
-#include "TestSuite.h"
+#include <TestSuite.h>
 
 static void
 test_utf8 (void)
diff -pruN 2.0.2-1/src/libbson/tests/test-bson-corpus.c 2.1.0-1/src/libbson/tests/test-bson-corpus.c
--- 2.0.2-1/src/libbson/tests/test-bson-corpus.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libbson/tests/test-bson-corpus.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,14 +1,15 @@
-#include <bson/bson.h>
-#include "TestSuite.h"
-#include "json-test.h"
-#include "corpus-test.h"
+#include "./corpus-test.h"
+
 #include <common-string-private.h>
 
-#include <inttypes.h>
+#include <bson/bson.h>
 
+#include <TestSuite.h>
+#include <json-test.h>
 
-#define IS_NAN(dec) (dec).high == 0x7c00000000000000ull
+#include <inttypes.h>
 
+#define IS_NAN(dec) (dec).high == 0x7c00000000000000ull
 
 typedef struct {
    const char *scenario;
@@ -31,14 +32,12 @@ skipped_corpus_test_t SKIPPED_CORPUS_TES
    {"String", "three-byte UTF-8 (\xe2\x98\x86)"},          /* \u2606 */
    {0}};
 
-
 skipped_corpus_test_t VS2013_SKIPPED_CORPUS_TESTS[] = {
    /* VS 2013 and older is imprecise stackoverflow.com/questions/32232331 */
    {"Double type", "1.23456789012345677E+18"},
    {"Double type", "-1.23456789012345677E+18"},
    {0}};
 
-
 static void
 compare_data (const uint8_t *a, uint32_t a_len, const uint8_t *b, uint32_t b_len)
 {
@@ -67,7 +66,6 @@ compare_data (const uint8_t *a, uint32_t
    }
 }
 
-
 static bool
 is_test_skipped (const char *scenario, const char *description)
 {
@@ -91,7 +89,6 @@ is_test_skipped (const char *scenario, c
    return false;
 }
 
-
 /*
 See:
 github.com/mongodb/specifications/blob/master/source/bson-corpus/bson-corpus.rst
@@ -189,7 +186,6 @@ test_bson_corpus_valid (test_bson_valid_
    bson_destroy (&cB);
 }
 
-
 /*
 See:
 github.com/mongodb/specifications/blob/master/source/bson-corpus/bson-corpus.rst
@@ -216,7 +212,6 @@ test_bson_corpus_decode_error (test_bson
            !bson_as_canonical_extended_json (&invalid_bson, NULL));
 }
 
-
 /*
 See:
 github.com/mongodb/specifications/blob/master/source/bson-corpus/bson-corpus.rst
@@ -272,7 +267,6 @@ test_bson_corpus_parse_error (test_bson_
    }
 }
 
-
 static void
 test_bson_corpus_cb (void *scenario)
 {
diff -pruN 2.0.2-1/src/libbson/tests/test-bson-error.c 2.1.0-1/src/libbson/tests/test-bson-error.c
--- 2.0.2-1/src/libbson/tests/test-bson-error.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libbson/tests/test-bson-error.c	2025-08-14 18:37:23.000000000 +0000
@@ -16,7 +16,9 @@
 
 #include <bson/bson.h>
 
-#include "TestSuite.h"
+#include <mlib/test.h>
+
+#include <TestSuite.h>
 
 
 static void
@@ -32,6 +34,36 @@ test_bson_error_basic (void)
 }
 
 static void
+test_bson_error_clear (void)
+{
+   bson_error_t err;
+   err.code = 42;
+   err.domain = 1729;
+   bson_error_clear (&err);
+   mlib_check (err.code, eq, 0);
+   mlib_check (err.domain, eq, 0);
+
+   // Valid no-op:
+   bson_error_clear (NULL);
+}
+
+static void
+test_bson_error_reset (void)
+{
+   bson_error_t err;
+   bson_error_t *eptr = &err;
+   err.code = 42;
+   bson_error_reset (eptr);
+   mlib_check (eptr, ptr_eq, &err);
+   mlib_check (err.code, eq, 0);
+
+   eptr = NULL;
+   bson_error_reset (eptr);
+   mlib_check (eptr != NULL, because, "bson_error_reset sets null pointers to non-null");
+   mlib_check (eptr->code, eq, 0);
+}
+
+static void
 test_bson_strerror_r (void)
 {
    FILE *f = fopen ("file-that-does-not-exist", "r");
@@ -50,5 +82,7 @@ void
 test_bson_error_install (TestSuite *suite)
 {
    TestSuite_Add (suite, "/bson/error/basic", test_bson_error_basic);
+   TestSuite_Add (suite, "/bson/error/clear", test_bson_error_clear);
+   TestSuite_Add (suite, "/bson/error/reset", test_bson_error_reset);
    TestSuite_Add (suite, "/bson/strerror_r", test_bson_strerror_r);
 }
diff -pruN 2.0.2-1/src/libbson/tests/test-bson-vector.c 2.1.0-1/src/libbson/tests/test-bson-vector.c
--- 2.0.2-1/src/libbson/tests/test-bson-vector.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libbson/tests/test-bson-vector.c	2025-08-14 18:37:23.000000000 +0000
@@ -16,11 +16,11 @@
 
 
 #include <bson/bson.h>
+#include <bsonutil/bson-parser.h>
 
-#include "bsonutil/bson-parser.h"
-#include "TestSuite.h"
-#include "test-conveniences.h"
-#include "json-test.h"
+#include <TestSuite.h>
+#include <json-test.h>
+#include <test-conveniences.h>
 
 #ifdef _MSC_VER
 #define SSCANF sscanf_s
@@ -123,6 +123,20 @@ append_vector_packed_bit_from_packed_arr
          ASSERT (bson_iter_next (&copy_iter));
          uint8_t packed_byte = (uint8_t) bson_iter_as_int64 (&copy_iter);
          ASSERT (bson_vector_packed_bit_view_write_packed (view, &packed_byte, 1, i));
+
+         // Read back the packed byte, interpret any masking as a conversion failure.
+         uint8_t packed_byte_check;
+         ASSERT (bson_vector_packed_bit_view_read_packed (view, &packed_byte_check, 1, i));
+         if (packed_byte != packed_byte_check) {
+            bson_set_error (error,
+                            TEST_ERROR_DOMAIN,
+                            TEST_ERROR_CODE,
+                            "byte at index %zu with value 0x%02X included write to masked bits (reads as 0x%02X)",
+                            i,
+                            packed_byte,
+                            packed_byte_check);
+            return false;
+         }
       }
       return true;
    } else {
@@ -159,17 +173,6 @@ test_bson_vector_json_case (vector_json_
    bson_error_t vector_from_array_error;
    bool vector_from_array_ok;
 
-   // (Spec test improvement TODO) Patch test cases that have unused bits set to '1' when '0' is required.
-   if (0 == strcmp ("PACKED_BIT with padding", test_case->test_description)) {
-      bson_iter_t iter;
-      ASSERT (bson_iter_init_find (&iter, &expected_bson, test_case->scenario_test_key));
-      uint32_t binary_len;
-      uint8_t *binary;
-      bson_iter_overwrite_binary (&iter, BSON_SUBTYPE_VECTOR, &binary_len, &binary);
-      ASSERT (binary_len > BSON_VECTOR_HEADER_LEN);
-      binary[binary_len - 1] &= (uint8_t) 0xFF << bson_vector_padding_from_header_byte_1 (binary[1]);
-   }
-
    // Try a format conversion from array to the indicated vector format.
    // The spec calls the first header byte "dtype" (combining the element type and element size fields)
    if (0 == strcmp ("0x03", test_case->test_dtype_hex_str)) {
@@ -336,14 +339,6 @@ test_bson_vector_json_case (vector_json_
                test_error ("test-vector array element %d has unexpected type, should be int.", (int) byte_count);
             }
 
-            // (Spec test improvement TODO) Packed writes can't set unused bits to '1' in libbson, but the spec
-            // tests allow padding bits to take on undefined values. Modify the expected values to keep padding bits
-            // zeroed.
-            if (0 == strcmp ("PACKED_BIT with padding", test_case->test_description) &&
-                byte_count == bson_vector_packed_bit_const_view_length_bytes (actual_view) - 1u) {
-               expected_byte &= ((int64_t) 0xFF << *test_case->test_padding) & 0xFF;
-            }
-
             // Note, the zero initializer is only needed due to a false positive -Wmaybe-uninitialized warning in
             // uncommon configurations where the compiler does not have visibility into memcpy().
             uint8_t actual_byte = 0;
@@ -1193,7 +1188,7 @@ test_bson_vector_example_float32_const_v
    // setup: construct a sample document
    bson_t doc = BSON_INITIALIZER;
    {
-      static const float values[] = {5.0f, -1e10f, INFINITY, NAN, -1.0f};
+      const float values[] = {5.0f, -1e10f, INFINITY, NAN, -1.0f}; // C2099 "initializer is not a constant"
       bson_vector_float32_view_t view;
       ASSERT (BSON_APPEND_VECTOR_FLOAT32_UNINIT (&doc, "vector", sizeof values / sizeof values[0], &view));
       ASSERT (bson_vector_float32_view_write (view, values, sizeof values / sizeof values[0], 0));
diff -pruN 2.0.2-1/src/libbson/tests/test-bson-version.c 2.1.0-1/src/libbson/tests/test-bson-version.c
--- 2.0.2-1/src/libbson/tests/test-bson-version.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libbson/tests/test-bson-version.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,6 +1,6 @@
 #include <bson/bson.h>
 
-#include "TestSuite.h"
+#include <TestSuite.h>
 
 static void
 test_bson_version (void)
diff -pruN 2.0.2-1/src/libbson/tests/test-bson.c 2.1.0-1/src/libbson/tests/test-bson.c
--- 2.0.2-1/src/libbson/tests/test-bson.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libbson/tests/test-bson.c	2025-08-14 18:37:23.000000000 +0000
@@ -15,21 +15,23 @@
  */
 
 
-#include <bson/bson.h>
-#include <bson/bcon.h>
 #include <bson/bson-private.h>
 #include <bson/validate-private.h>
-#include <fcntl.h>
-#include <time.h>
-
 #include <common-bson-dsl-private.h>
 
-#include "TestSuite.h"
-#include "test-conveniences.h"
+#include <bson/bson-bcon.h>
+#include <bson/bson.h>
 
 #include <mlib/ckdint.h>
-#include <mlib/test.h>
 #include <mlib/intencode.h>
+#include <mlib/test.h>
+
+#include <TestSuite.h>
+#include <test-conveniences.h>
+
+#include <fcntl.h>
+
+#include <time.h>
 
 /* CDRIVER-2460 ensure the unused old BSON_ASSERT_STATIC macro still compiles */
 BSON_STATIC_ASSERT (1 == 1);
@@ -1950,8 +1952,8 @@ test_bson_regex_lengths (void)
       &new, "0_________1_________2_________3___4", -1, "0_________1_________2_________3_________4_________5___4", "i");
 
    ASSERT (new.len == 121);
-   ASSERT (new.flags &BSON_FLAG_STATIC);
-   ASSERT (!(new.flags &BSON_FLAG_INLINE));
+   ASSERT (new.flags & BSON_FLAG_STATIC);
+   ASSERT (!(new.flags & BSON_FLAG_INLINE));
 
    bson_destroy (&new);
 }
@@ -2292,6 +2294,8 @@ test_bson_dsl_visit (void)
    bson_free (path);
 }
 
+mlib_diagnostic_push ();
+mlib_msvc_warning (disable : 4702); // do (abort())
 static void
 test_bson_dsl_predicate (void)
 {
@@ -2324,12 +2328,12 @@ test_bson_dsl_predicate (void)
       require (key ("string"), //
                require (type (utf8)),
                require (strEqual ("hello")),
-               require (not(strEqual ("goodbye"))),
+               require (not (strEqual ("goodbye"))),
                require (iStrEqual ("HELLO")),
-               require (not(iStrEqual ("GOODBYE")))),
+               require (not (iStrEqual ("GOODBYE")))),
       require (key ("doc"),
                require (type (doc)),
-               require (not(empty)),
+               require (not (empty)),
                visitEach (require (key ("hello")), require (type (null)))),
       require (key ("null"), require (type (null))),
       require (key ("empty_string"), require (type (utf8))),
@@ -2353,6 +2357,7 @@ test_bson_dsl_predicate (void)
       visitOthers (if (key ("unhandled"), then (do (saw_other = true)), else (do (abort ())))));
    BSON_ASSERT (saw_other);
 }
+mlib_diagnostic_pop ();
 
 static void
 do_assert_bson_equal (const bson_t *actual, const bson_t *expected, const char *file, int line)
@@ -2775,9 +2780,9 @@ test_bson_array_builder (void)
          bson_t b;
          bson_array_builder_t *bab = bson_array_builder_new ();
          {
-            bson_t *b = TMP_BSON_FROM_JSON ({"A" : 1});
+            bson_t *bb = TMP_BSON_FROM_JSON ({"A" : 1});
             bson_iter_t iter;
-            ASSERT (bson_iter_init_find (&iter, b, "A"));
+            ASSERT (bson_iter_init_find (&iter, bb, "A"));
             ASSERT (bson_array_builder_append_iter (bab, &iter));
          }
          ASSERT (bson_array_builder_build (bab, &b));
diff -pruN 2.0.2-1/src/libbson/tests/test-clock.c 2.1.0-1/src/libbson/tests/test-clock.c
--- 2.0.2-1/src/libbson/tests/test-clock.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libbson/tests/test-clock.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,6 +1,6 @@
 #include <bson/bson.h>
 
-#include "TestSuite.h"
+#include <TestSuite.h>
 
 
 static void
diff -pruN 2.0.2-1/src/libbson/tests/test-decimal128.c 2.1.0-1/src/libbson/tests/test-decimal128.c
--- 2.0.2-1/src/libbson/tests/test-decimal128.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libbson/tests/test-decimal128.c	2025-08-14 18:37:23.000000000 +0000
@@ -16,7 +16,7 @@
 
 #include <bson/bson.h>
 
-#include "TestSuite.h"
+#include <TestSuite.h>
 
 
 /*
diff -pruN 2.0.2-1/src/libbson/tests/test-endian.c 2.1.0-1/src/libbson/tests/test-endian.c
--- 2.0.2-1/src/libbson/tests/test-endian.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libbson/tests/test-endian.c	2025-08-14 18:37:23.000000000 +0000
@@ -17,7 +17,7 @@
 
 #include <bson/bson.h>
 
-#include "TestSuite.h"
+#include <TestSuite.h>
 
 
 static void
diff -pruN 2.0.2-1/src/libbson/tests/test-iso8601.c 2.1.0-1/src/libbson/tests/test-iso8601.c
--- 2.0.2-1/src/libbson/tests/test-iso8601.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libbson/tests/test-iso8601.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,10 +1,12 @@
+#include <bson/bson-iso8601-private.h>
+#include <common-json-private.h>
+#include <common-string-private.h>
+
 #include <bson/bson.h>
 
-#include <bson/bson-iso8601-private.h>
-#include "TestSuite.h"
 #include <mlib/cmp.h>
-#include <common-string-private.h>
-#include <common-json-private.h>
+
+#include <TestSuite.h>
 
 static const bool is_time_t_small = (sizeof (time_t) == sizeof (int32_t));
 
diff -pruN 2.0.2-1/src/libbson/tests/test-iter.c 2.1.0-1/src/libbson/tests/test-iter.c
--- 2.0.2-1/src/libbson/tests/test-iter.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libbson/tests/test-iter.c	2025-08-14 18:37:23.000000000 +0000
@@ -17,9 +17,10 @@
 
 #include <bson/bson.h>
 
-#include "TestSuite.h"
 #include <mlib/intencode.h>
 
+#include <TestSuite.h>
+
 #define FUZZ_N_PASSES 100000
 
 static bson_t *
diff -pruN 2.0.2-1/src/libbson/tests/test-json.c 2.1.0-1/src/libbson/tests/test-json.c
--- 2.0.2-1/src/libbson/tests/test-json.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libbson/tests/test-json.c	2025-08-14 18:37:23.000000000 +0000
@@ -3,16 +3,19 @@
 #define _CRT_RAND_S
 #endif
 
+#include <bson/bson-iso8601-private.h>
+#include <bson/bson-json-private.h>
+#include <common-json-private.h>
+#include <common-string-private.h>
+
 #include <bson/bson.h>
-#include <math.h>
 
-#include "TestSuite.h"
-#include "test-conveniences.h"
-#include <common-string-private.h>
 #include <mlib/cmp.h>
-#include <common-json-private.h>
-#include <bson/bson-iso8601-private.h>
-#include <bson/bson-json-private.h>
+
+#include <TestSuite.h>
+#include <test-conveniences.h>
+
+#include <math.h>
 
 static ssize_t
 test_bson_json_read_cb_helper (void *string, uint8_t *buf, size_t len)
diff -pruN 2.0.2-1/src/libbson/tests/test-oid.c 2.1.0-1/src/libbson/tests/test-oid.c
--- 2.0.2-1/src/libbson/tests/test-oid.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libbson/tests/test-oid.c	2025-08-14 18:37:23.000000000 +0000
@@ -17,8 +17,8 @@
 
 #include <bson/bson.h>
 #define BSON_INSIDE
-#include <bson/bson-iso8601-private.h>
 #include <bson/bson-context-private.h>
+#include <bson/bson-iso8601-private.h>
 #include <common-thread-private.h>
 #undef BSON_INSIDE
 
@@ -26,11 +26,14 @@
 #include <strings.h>
 #endif
 
-#include <limits.h>
-
-#include "TestSuite.h"
-#include <common-macros-private.h> // BEGIN_IGNORE_DEPRECATIONS
 #include <common-json-private.h>
+#include <common-macros-private.h> // BEGIN_IGNORE_DEPRECATIONS
+
+#include <mlib/config.h>
+
+#include <TestSuite.h>
+
+#include <limits.h>
 
 #define N_THREADS 4
 
@@ -237,7 +240,10 @@ test_bson_oid_get_time_t (void)
 
    /* if time_t is a signed int32, then a negative value may be interpreted
     * as a negative date when printing. */
+   mlib_diagnostic_push ();
+   mlib_disable_constant_conditional_expression_warnings ();
    if (sizeof (time_t) == 8) {
+      mlib_diagnostic_pop ();
       bson_oid_init_from_string (&oid, "7FFFFFFF0000000000000000");
       str = get_time_as_string (&oid);
       ASSERT_CMPSTR (str, "2038-01-19T03:14:07Z");
diff -pruN 2.0.2-1/src/libbson/tests/test-reader.c 2.1.0-1/src/libbson/tests/test-reader.c
--- 2.0.2-1/src/libbson/tests/test-reader.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libbson/tests/test-reader.c	2025-08-14 18:37:23.000000000 +0000
@@ -16,9 +16,10 @@
 
 
 #include <bson/bson.h>
-#include <fcntl.h>
 
-#include "TestSuite.h"
+#include <TestSuite.h>
+
+#include <fcntl.h>
 
 
 static void
diff -pruN 2.0.2-1/src/libbson/tests/test-string.c 2.1.0-1/src/libbson/tests/test-string.c
--- 2.0.2-1/src/libbson/tests/test-string.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libbson/tests/test-string.c	2025-08-14 18:37:23.000000000 +0000
@@ -15,12 +15,13 @@
  */
 
 
-#include <bson/bson.h>
-#include <common-string-private.h>
 #include <common-bits-private.h>
+#include <common-string-private.h>
+
+#include <bson/bson.h>
 
-#include "TestSuite.h"
-#include "test-libmongoc.h"
+#include <TestSuite.h>
+#include <test-libmongoc.h>
 
 static void
 test_bson_strdup_printf (void)
diff -pruN 2.0.2-1/src/libbson/tests/test-utf8.c 2.1.0-1/src/libbson/tests/test-utf8.c
--- 2.0.2-1/src/libbson/tests/test-utf8.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libbson/tests/test-utf8.c	2025-08-14 18:37:23.000000000 +0000
@@ -16,7 +16,7 @@
 
 #include <bson/bson.h>
 
-#include "TestSuite.h"
+#include <TestSuite.h>
 
 
 static void
diff -pruN 2.0.2-1/src/libbson/tests/test-value.c 2.1.0-1/src/libbson/tests/test-value.c
--- 2.0.2-1/src/libbson/tests/test-value.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libbson/tests/test-value.c	2025-08-14 18:37:23.000000000 +0000
@@ -15,11 +15,11 @@
  */
 
 
-#include <bson/bcon.h>
+#include <bson/bson-bcon.h>
 #include <bson/bson.h>
 
-#include "TestSuite.h"
-#include "test-libmongoc.h" // skip_if_no_large_allocations
+#include <TestSuite.h>
+#include <test-libmongoc.h> // skip_if_no_large_allocations
 
 
 static void
diff -pruN 2.0.2-1/src/libbson/tests/test-writer.c 2.1.0-1/src/libbson/tests/test-writer.c
--- 2.0.2-1/src/libbson/tests/test-writer.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libbson/tests/test-writer.c	2025-08-14 18:37:23.000000000 +0000
@@ -17,7 +17,7 @@
 
 #include <bson/bson.h>
 
-#include "TestSuite.h"
+#include <TestSuite.h>
 
 
 static void *
diff -pruN 2.0.2-1/src/libmongoc/CMakeLists.txt 2.1.0-1/src/libmongoc/CMakeLists.txt
--- 2.0.2-1/src/libmongoc/CMakeLists.txt	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/CMakeLists.txt	2025-08-14 18:37:23.000000000 +0000
@@ -1,4 +1,4 @@
-cmake_minimum_required (VERSION 3.15)
+cmake_minimum_required (VERSION 3.15...4.0)
 
 project (libmongoc
    LANGUAGES C
@@ -204,7 +204,7 @@ endfunction()
 # Per-backend link libs/options:
 set(SecureTransport/LINK_LIBRARIES "-framework CoreFoundation" "-framework Security")
 set(SecureTransport/pkg_config_LIBS -framework Corefoundation -framework Security)
-set(SecureChannel/LINK_LIBRARIES secur32.lib crypt32.lib Bcrypt.lib)
+set(SecureChannel/LINK_LIBRARIES secur32.lib crypt32.lib Bcrypt.lib ncrypt.lib)
 set(SecureChannel/pkg_config_LIBS ${SecureChannel/LINK_LIBRARIES})
 set(OpenSSL/LINK_LIBRARIES OpenSSL::SSL OpenSSL::Crypto $<$<PLATFORM_ID:Windows>:crypt32.lib>)
 set(OpenSSL/pkg_config_LIBS -lssl -lcrypto $<$<PLATFORM_ID:Windows>:crypt32.lib>)
@@ -597,6 +597,8 @@ set (MONGOC_SOURCES
    ${PROJECT_SOURCE_DIR}/src/mongoc/mongoc-log-and-monitor-private.c
    ${PROJECT_SOURCE_DIR}/src/mongoc/mongoc-memcmp.c
    ${PROJECT_SOURCE_DIR}/src/mongoc/mongoc-cmd.c
+   ${PROJECT_SOURCE_DIR}/src/mongoc/mongoc-oidc-callback.c
+   ${PROJECT_SOURCE_DIR}/src/mongoc/mongoc-oidc-env.c
    ${PROJECT_SOURCE_DIR}/src/mongoc/mongoc-opcode.c
    ${PROJECT_SOURCE_DIR}/src/mongoc/mongoc-optional.c
    ${PROJECT_SOURCE_DIR}/src/mongoc/mongoc-opts-helpers.c
@@ -717,6 +719,7 @@ set (HEADERS
    ${PROJECT_SOURCE_DIR}/src/mongoc/mongoc-iovec.h
    ${PROJECT_SOURCE_DIR}/src/mongoc/mongoc-log.h
    ${PROJECT_SOURCE_DIR}/src/mongoc/mongoc-macros.h
+   ${PROJECT_SOURCE_DIR}/src/mongoc/mongoc-oidc-callback.h
    ${PROJECT_SOURCE_DIR}/src/mongoc/mongoc-opcode.h
    ${PROJECT_SOURCE_DIR}/src/mongoc/mongoc-optional.h
    ${PROJECT_SOURCE_DIR}/src/mongoc/mongoc-prelude.h
@@ -968,6 +971,23 @@ if (MONGOC_ENABLE_STATIC_BUILD)
    if(MONGOC_ENABLE_STATIC_INSTALL)
       mongo_generate_pkg_config (mongoc_static FILENAME mongoc${PROJECT_VERSION_MAJOR}-static.pc INSTALL)
    endif()
+
+   if(MONGO_CAN_VERIFY_HEADERS AND ENABLE_TESTS)
+      mongo_verify_headers(
+         mongoc
+         USE_LIBRARIES mongoc::static
+         HEADERS "src/*.h"
+         EXCLUDE_REGEX
+            # Ignore all headers that start with "mongoc-", as they have not
+            # been sanitized for direct inclusion.
+            "mongoc/mongoc-.*\\.h"
+            # Other private headers that aren't for public consumption:
+            "/mcd-"
+            "service-gcp\\.h"
+            "uthash\\.h"
+            "utlist\\.h"
+         )
+   endif()
 endif ()
 
 
@@ -1058,6 +1078,7 @@ set (test-libmongoc-sources
    ${PROJECT_SOURCE_DIR}/tests/test-mongoc-max-staleness.c
    ${PROJECT_SOURCE_DIR}/tests/test-mongoc-mongohouse.c
    ${PROJECT_SOURCE_DIR}/tests/test-mongoc-mongos-pinning.c
+   ${PROJECT_SOURCE_DIR}/tests/test-mongoc-oidc-callback.c
    ${PROJECT_SOURCE_DIR}/tests/test-mongoc-opts.c
    ${PROJECT_SOURCE_DIR}/tests/test-mongoc-primary-stepdown.c
    ${PROJECT_SOURCE_DIR}/tests/test-mongoc-queue.c
@@ -1071,6 +1092,7 @@ set (test-libmongoc-sources
    ${PROJECT_SOURCE_DIR}/tests/test-mongoc-scram.c
    ${PROJECT_SOURCE_DIR}/tests/test-mongoc-sdam-monitoring.c
    ${PROJECT_SOURCE_DIR}/tests/test-mongoc-sdam.c
+   ${PROJECT_SOURCE_DIR}/tests/test-mongoc-secure-channel.c
    ${PROJECT_SOURCE_DIR}/tests/test-mongoc-server-description.c
    ${PROJECT_SOURCE_DIR}/tests/test-mongoc-server-selection-errors.c
    ${PROJECT_SOURCE_DIR}/tests/test-mongoc-server-selection.c
@@ -1188,9 +1210,6 @@ if (ENABLE_TESTS)
    mongoc_add_test (test-libmongoc ${PROJECT_SOURCE_DIR}/tests/test-libmongoc-main.c)
    target_link_libraries (test-libmongoc PUBLIC test-libmongoc-lib)
 
-   mongoc_add_test (test-atlas-executor ${PROJECT_SOURCE_DIR}/tests/test-atlas-executor.c)
-   target_link_libraries (test-atlas-executor PUBLIC test-libmongoc-lib)
-
    mongoc_add_test (test-mongoc-gssapi ${PROJECT_SOURCE_DIR}/tests/test-mongoc-gssapi.c)
    mongoc_add_test (test-mongoc-cache ${PROJECT_SOURCE_DIR}/tests/test-mongoc-cache.c)
    mongoc_add_test (test-azurekms ${PROJECT_SOURCE_DIR}/tests/test-azurekms.c)
diff -pruN 2.0.2-1/src/libmongoc/doc/api.rst 2.1.0-1/src/libmongoc/doc/api.rst
--- 2.0.2-1/src/libmongoc/doc/api.rst	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/doc/api.rst	2025-08-14 18:37:23.000000000 +0000
@@ -39,6 +39,10 @@ API Reference
    mongoc_host_list_t
    mongoc_insert_flags_t
    mongoc_iovec_t
+   mongoc_oidc_callback_fn_t
+   mongoc_oidc_callback_params_t
+   mongoc_oidc_callback_t
+   mongoc_oidc_credential_t
    mongoc_optional_t
    mongoc_query_flags_t
    mongoc_rand
Binary files 2.0.2-1/src/libmongoc/doc/includes/libbson.inv and 2.1.0-1/src/libmongoc/doc/includes/libbson.inv differ
diff -pruN 2.0.2-1/src/libmongoc/doc/mongoc_oidc_callback_destroy.rst 2.1.0-1/src/libmongoc/doc/mongoc_oidc_callback_destroy.rst
--- 2.0.2-1/src/libmongoc/doc/mongoc_oidc_callback_destroy.rst	1970-01-01 00:00:00.000000000 +0000
+++ 2.1.0-1/src/libmongoc/doc/mongoc_oidc_callback_destroy.rst	2025-08-14 18:37:23.000000000 +0000
@@ -0,0 +1,27 @@
+:man_page: mongoc_oidc_callback_destroy
+
+mongoc_oidc_callback_destroy()
+==============================
+
+Synopsis
+--------
+
+.. code-block:: c
+
+  void
+  mongoc_oidc_callback_destroy (mongoc_oidc_callback_t *callback)
+
+Release all resources associated with the given :symbol:`mongoc_oidc_callback_t` object.
+
+.. warning::
+
+    The lifetime of the object pointed to by ``user_data`` is managed the user, not by :symbol:`mongoc_oidc_callback_t`!
+
+Parameters
+----------
+
+* ``callback``: a :symbol:`mongoc_oidc_callback_t` or ``NULL``.
+
+.. seealso::
+
+  - :symbol:`mongoc_oidc_callback_t`
diff -pruN 2.0.2-1/src/libmongoc/doc/mongoc_oidc_callback_fn_t.rst 2.1.0-1/src/libmongoc/doc/mongoc_oidc_callback_fn_t.rst
--- 2.0.2-1/src/libmongoc/doc/mongoc_oidc_callback_fn_t.rst	1970-01-01 00:00:00.000000000 +0000
+++ 2.1.0-1/src/libmongoc/doc/mongoc_oidc_callback_fn_t.rst	2025-08-14 18:37:23.000000000 +0000
@@ -0,0 +1,35 @@
+:man_page: mongoc_oidc_callback_fn_t
+
+mongoc_oidc_callback_fn_t
+=========================
+
+Synopsis
+--------
+
+.. code-block:: c
+
+  typedef mongoc_oidc_credential_t *(*mongoc_oidc_callback_fn_t) (mongoc_oidc_callback_params_t *params);
+
+The type of the function pointer stored by :symbol:`mongoc_oidc_callback_t`.
+
+Parameters
+----------
+
+* ``params``: A :symbol:`mongoc_oidc_callback_params_t` object representing in/out parameters of a :symbol:`mongoc_oidc_callback_t`.
+
+Returns
+-------
+
+A :symbol:`mongoc_oidc_credential_t` object created with :symbol:`mongoc_oidc_credential_new()`, or ``NULL`` to indicate an error or timeout.
+
+* The function MUST return a :symbol:`mongoc_oidc_credential_t` object to indicate success.
+* The function MUST return ``NULL`` to indicate an error.
+* The function MUST call :symbol:`mongoc_oidc_callback_params_cancel_with_timeout()` before returning ``NULL`` to indicate a timeout instead of an error.
+
+The ``cancel_with_timeout`` out parameter is ignored if the return value is not ``NULL``.
+
+.. seealso::
+
+  - :symbol:`mongoc_oidc_callback_t`
+  - :symbol:`mongoc_oidc_callback_params_t`
+  - :symbol:`mongoc_oidc_credential_t`
diff -pruN 2.0.2-1/src/libmongoc/doc/mongoc_oidc_callback_get_fn.rst 2.1.0-1/src/libmongoc/doc/mongoc_oidc_callback_get_fn.rst
--- 2.0.2-1/src/libmongoc/doc/mongoc_oidc_callback_get_fn.rst	1970-01-01 00:00:00.000000000 +0000
+++ 2.1.0-1/src/libmongoc/doc/mongoc_oidc_callback_get_fn.rst	2025-08-14 18:37:23.000000000 +0000
@@ -0,0 +1,29 @@
+:man_page: mongoc_oidc_callback_get_fn
+
+mongoc_oidc_callback_get_fn()
+=============================
+
+Synopsis
+--------
+
+.. code-block:: c
+
+  mongoc_oidc_callback_fn_t
+  mongoc_oidc_callback_get_fn (const mongoc_oidc_callback_t *callback);
+
+Return the stored pointer to the callback function.
+
+Parameters
+----------
+
+* ``callback``: a :symbol:`mongoc_oidc_callback_t`.
+
+Returns
+-------
+
+A :symbol:`mongoc_oidc_callback_fn_t`.
+
+.. seealso::
+
+  - :symbol:`mongoc_oidc_callback_t`
+  - :symbol:`mongoc_oidc_callback_fn_t`
diff -pruN 2.0.2-1/src/libmongoc/doc/mongoc_oidc_callback_get_user_data.rst 2.1.0-1/src/libmongoc/doc/mongoc_oidc_callback_get_user_data.rst
--- 2.0.2-1/src/libmongoc/doc/mongoc_oidc_callback_get_user_data.rst	1970-01-01 00:00:00.000000000 +0000
+++ 2.1.0-1/src/libmongoc/doc/mongoc_oidc_callback_get_user_data.rst	2025-08-14 18:37:23.000000000 +0000
@@ -0,0 +1,29 @@
+:man_page: mongoc_oidc_callback_get_user_data
+
+mongoc_oidc_callback_get_user_data()
+====================================
+
+Synopsis
+--------
+
+.. code-block:: c
+
+  void *
+  mongoc_oidc_callback_get_user_data (const mongoc_oidc_callback_t *callback);
+
+Return the stored pointer to user data.
+
+Parameters
+----------
+
+* ``callback``: a :symbol:`mongoc_oidc_callback_t`.
+
+Returns
+-------
+
+A pointer to user data or ``NULL``.
+
+.. seealso::
+
+  - :symbol:`mongoc_oidc_callback_t`
+  - :symbol:`mongoc_oidc_callback_set_user_data()`
diff -pruN 2.0.2-1/src/libmongoc/doc/mongoc_oidc_callback_new.rst 2.1.0-1/src/libmongoc/doc/mongoc_oidc_callback_new.rst
--- 2.0.2-1/src/libmongoc/doc/mongoc_oidc_callback_new.rst	1970-01-01 00:00:00.000000000 +0000
+++ 2.1.0-1/src/libmongoc/doc/mongoc_oidc_callback_new.rst	2025-08-14 18:37:23.000000000 +0000
@@ -0,0 +1,31 @@
+:man_page: mongoc_oidc_callback_new
+
+mongoc_oidc_callback_new()
+==========================
+
+Synopsis
+--------
+
+.. code-block:: c
+
+  mongoc_oidc_callback_t *
+  mongoc_oidc_callback_new (mongoc_oidc_callback_fn_t fn)
+
+Create a new :symbol:`mongoc_oidc_callback_t` object which stores the provided OIDC callback function.
+
+Equivalent to calling :symbol:`mongoc_oidc_callback_new_with_user_data()` with ``user_data`` set to ``NULL``.
+
+Parameters
+----------
+
+* ``fn``: a :symbol:`mongoc_oidc_callback_fn_t`. Must not be ``NULL``.
+
+Returns
+-------
+
+A new :symbol:`mongoc_oidc_callback_t` that must be freed with :symbol:`mongoc_oidc_callback_destroy()`, or ``NULL`` when an invalid argument was given.
+
+.. seealso::
+
+  - :symbol:`mongoc_oidc_callback_t`
+  - :symbol:`mongoc_oidc_callback_new_with_user_data`
diff -pruN 2.0.2-1/src/libmongoc/doc/mongoc_oidc_callback_new_with_user_data.rst 2.1.0-1/src/libmongoc/doc/mongoc_oidc_callback_new_with_user_data.rst
--- 2.0.2-1/src/libmongoc/doc/mongoc_oidc_callback_new_with_user_data.rst	1970-01-01 00:00:00.000000000 +0000
+++ 2.1.0-1/src/libmongoc/doc/mongoc_oidc_callback_new_with_user_data.rst	2025-08-14 18:37:23.000000000 +0000
@@ -0,0 +1,34 @@
+:man_page: mongoc_oidc_callback_new_with_user_data
+
+mongoc_oidc_callback_new_with_user_data()
+=========================================
+
+Synopsis
+--------
+
+.. code-block:: c
+
+  mongoc_oidc_callback_t *
+  mongoc_oidc_callback_new_with_user_data (mongoc_oidc_callback_fn_t fn, void *user_data)
+
+Create a new :symbol:`mongoc_oidc_callback_t` object which stores the provided OIDC callback function and pointer to user data.
+
+.. warning::
+
+    The lifetime of the object pointed to by ``user_data`` is managed the user, not by :symbol:`mongoc_oidc_callback_t`!
+
+Parameters
+----------
+
+* ``fn``: a :symbol:`mongoc_oidc_callback_fn_t`. Must not be ``NULL``.
+* ``user_data``: a pointer to user data or ``NULL``.
+
+Returns
+-------
+
+A new :symbol:`mongoc_oidc_callback_t` that must be freed with :symbol:`mongoc_oidc_callback_destroy()`, or ``NULL`` when an invalid argument was given.
+
+.. seealso::
+
+  - :symbol:`mongoc_oidc_callback_t`
+  - :symbol:`mongoc_oidc_callback_new`
diff -pruN 2.0.2-1/src/libmongoc/doc/mongoc_oidc_callback_params_cancel_with_timeout.rst 2.1.0-1/src/libmongoc/doc/mongoc_oidc_callback_params_cancel_with_timeout.rst
--- 2.0.2-1/src/libmongoc/doc/mongoc_oidc_callback_params_cancel_with_timeout.rst	1970-01-01 00:00:00.000000000 +0000
+++ 2.1.0-1/src/libmongoc/doc/mongoc_oidc_callback_params_cancel_with_timeout.rst	2025-08-14 18:37:23.000000000 +0000
@@ -0,0 +1,33 @@
+:man_page: mongoc_oidc_callback_params_cancel_with_timeout
+
+mongoc_oidc_callback_params_cancel_with_timeout()
+=================================================
+
+Synopsis
+--------
+
+.. code-block:: c
+
+  mongoc_oidc_credential_t *
+  mongoc_oidc_callback_params_cancel_with_timeout (mongoc_oidc_callback_params_t *params);
+
+Set the out parameter indicating cancellation of the callback function due to a timeout instead of an error.
+
+.. note::
+
+  If the callback function returns a not-null value, the value of this out parameter is ignored.
+
+Parameters
+----------
+
+* ``params``: a :symbol:`mongoc_oidc_callback_params_t`.
+
+Returns
+-------
+
+``NULL``.
+
+.. seealso::
+
+  - :symbol:`mongoc_oidc_callback_params_t`
+  - :symbol:`mongoc_oidc_callback_t`
diff -pruN 2.0.2-1/src/libmongoc/doc/mongoc_oidc_callback_params_get_timeout.rst 2.1.0-1/src/libmongoc/doc/mongoc_oidc_callback_params_get_timeout.rst
--- 2.0.2-1/src/libmongoc/doc/mongoc_oidc_callback_params_get_timeout.rst	1970-01-01 00:00:00.000000000 +0000
+++ 2.1.0-1/src/libmongoc/doc/mongoc_oidc_callback_params_get_timeout.rst	2025-08-14 18:37:23.000000000 +0000
@@ -0,0 +1,36 @@
+:man_page: mongoc_oidc_callback_params_get_timeout
+
+mongoc_oidc_callback_params_get_timeout()
+=========================================
+
+Synopsis
+--------
+
+.. code-block:: c
+
+  const int64_t *
+  mongoc_oidc_callback_params_get_timeout (const mongoc_oidc_callback_params_t *params);
+
+Return a value comparable with :symbol:`bson_get_monotonic_time()` to determine when a timeout must occur.
+
+A ``NULL`` (unset) return value means "infinite" timeout.
+
+Parameters
+----------
+
+* ``params``: a :symbol:`mongoc_oidc_callback_params_t`.
+
+Returns
+-------
+
+A value comparable with :symbol:`bson_get_monotonic_time()`, or ``NULL``.
+
+Lifecycle
+---------
+
+The pointed-to ``int64_t`` is only valid for the duration of the invocation of the OIDC callback function.
+
+.. seealso::
+
+  - :symbol:`mongoc_oidc_callback_params_t`
+  - :symbol:`mongoc_oidc_callback_t`
diff -pruN 2.0.2-1/src/libmongoc/doc/mongoc_oidc_callback_params_get_user_data.rst 2.1.0-1/src/libmongoc/doc/mongoc_oidc_callback_params_get_user_data.rst
--- 2.0.2-1/src/libmongoc/doc/mongoc_oidc_callback_params_get_user_data.rst	1970-01-01 00:00:00.000000000 +0000
+++ 2.1.0-1/src/libmongoc/doc/mongoc_oidc_callback_params_get_user_data.rst	2025-08-14 18:37:23.000000000 +0000
@@ -0,0 +1,35 @@
+:man_page: mongoc_oidc_callback_params_get_user_data
+
+mongoc_oidc_callback_params_get_user_data()
+===========================================
+
+Synopsis
+--------
+
+.. code-block:: c
+
+  void *
+  mongoc_oidc_callback_params_get_user_data (const mongoc_oidc_callback_params_t *params);
+
+Return the pointer to user data which was stored by an associated :symbol:`mongoc_oidc_callback_t` object.
+
+Parameters
+----------
+
+* ``params``: a :symbol:`mongoc_oidc_callback_params_t`.
+
+Returns
+-------
+
+A pointer to user data or ``NULL``.
+
+Lifecycle
+---------
+
+The lifetime of the object pointed to by ``user_data`` is managed the user.
+
+.. seealso::
+
+  - :symbol:`mongoc_oidc_callback_params_t`
+  - :symbol:`mongoc_oidc_callback_t`
+  - :symbol:`mongoc_oidc_callback_set_user_data()`
diff -pruN 2.0.2-1/src/libmongoc/doc/mongoc_oidc_callback_params_get_username.rst 2.1.0-1/src/libmongoc/doc/mongoc_oidc_callback_params_get_username.rst
--- 2.0.2-1/src/libmongoc/doc/mongoc_oidc_callback_params_get_username.rst	1970-01-01 00:00:00.000000000 +0000
+++ 2.1.0-1/src/libmongoc/doc/mongoc_oidc_callback_params_get_username.rst	2025-08-14 18:37:23.000000000 +0000
@@ -0,0 +1,35 @@
+:man_page: mongoc_oidc_callback_params_get_username
+
+mongoc_oidc_callback_params_get_username()
+==========================================
+
+Synopsis
+--------
+
+.. code-block:: c
+
+  const char *
+  mongoc_oidc_callback_params_get_username (const mongoc_oidc_callback_params_t *params);
+
+Return the username component of the URI of an associated :symbol:`mongoc_client_t` or :symbol:`mongoc_client_pool_t` object.
+
+Parameters
+----------
+
+* ``params``: a :symbol:`mongoc_oidc_callback_params_t`.
+
+Returns
+-------
+
+A string which must not be modified or freed, or ``NULL``.
+
+Lifecycle
+---------
+
+The string is only valid for the duration of the invocation of the OIDC callback function.
+
+.. seealso::
+
+  - :symbol:`mongoc_oidc_callback_params_t`
+  - :symbol:`mongoc_oidc_callback_t`
+  - :symbol:`mongoc_uri_t`
diff -pruN 2.0.2-1/src/libmongoc/doc/mongoc_oidc_callback_params_get_version.rst 2.1.0-1/src/libmongoc/doc/mongoc_oidc_callback_params_get_version.rst
--- 2.0.2-1/src/libmongoc/doc/mongoc_oidc_callback_params_get_version.rst	1970-01-01 00:00:00.000000000 +0000
+++ 2.1.0-1/src/libmongoc/doc/mongoc_oidc_callback_params_get_version.rst	2025-08-14 18:37:23.000000000 +0000
@@ -0,0 +1,29 @@
+:man_page: mongoc_oidc_callback_params_get_version
+
+mongoc_oidc_callback_params_get_version()
+=========================================
+
+Synopsis
+--------
+
+.. code-block:: c
+
+  int32_t
+  mongoc_oidc_callback_params_get_version (const mongoc_oidc_callback_params_t *params);
+
+Return the OIDC callback API version number.
+
+Parameters
+----------
+
+* ``params``: a :symbol:`mongoc_oidc_callback_params_t`.
+
+Returns
+-------
+
+A positive integer.
+
+.. seealso::
+
+  - :symbol:`mongoc_oidc_callback_params_t`
+  - :symbol:`mongoc_oidc_callback_t`
diff -pruN 2.0.2-1/src/libmongoc/doc/mongoc_oidc_callback_params_t.rst 2.1.0-1/src/libmongoc/doc/mongoc_oidc_callback_params_t.rst
--- 2.0.2-1/src/libmongoc/doc/mongoc_oidc_callback_params_t.rst	1970-01-01 00:00:00.000000000 +0000
+++ 2.1.0-1/src/libmongoc/doc/mongoc_oidc_callback_params_t.rst	2025-08-14 18:37:23.000000000 +0000
@@ -0,0 +1,215 @@
+:man_page: mongoc_oidc_callback_params_t
+
+mongoc_oidc_callback_params_t
+=============================
+
+Synopsis
+--------
+
+.. code-block:: c
+
+  typedef struct _mongoc_oidc_callback_params_t mongoc_oidc_callback_params_t;
+
+Represents the in/out parameters of a :symbol:`mongoc_oidc_callback_t`.
+
+The parameters will be passed to the :symbol:`mongoc_oidc_callback_fn_t` stored in an :symbol:`mongoc_oidc_callback_t` object when it is invoked by an :symbol:`mongoc_client_t` or :symbol:`mongoc_client_pool_t` object.
+
+.. only:: html
+
+  Functions
+  ---------
+
+  .. toctree::
+    :titlesonly:
+    :maxdepth: 1
+
+    mongoc_oidc_callback_params_get_version
+    mongoc_oidc_callback_params_get_user_data
+    mongoc_oidc_callback_params_get_timeout
+    mongoc_oidc_callback_params_get_username
+    mongoc_oidc_callback_params_cancel_with_timeout
+
+Parameters
+----------
+
+The list of currently supported parameters are:
+
+.. list-table::
+    :widths: auto
+
+    * - Parameter
+      - Versions
+      - Description
+    * - ``version``
+      - 1
+      - The current OIDC callback API version number.
+    * - ``user_data``
+      - 1
+      - A pointer to data provided by the user.
+    * - ``timeout``
+      - 1
+      - The timestamp after which the callback function must report a timeout.
+    * - ``username``
+      - 1
+      - The username specified by the URI of the associated client object.
+    * - ``cancel_with_timeout``
+      - 1
+      - An out parameter indicating cancellation of the callback function due to a timeout instead of an error.
+
+The "Version" column indicates the OIDC callback API versions for which the parameter is applicable.
+
+Version
+```````
+
+The ``version`` parameter is used to communicate backward compatible changes to the OIDC callback API (i.e. the addition of a new parameter).
+
+This parameter may be used to detect when existing usage of :symbol:`mongoc_oidc_callback_t` or a relevant callback function may need to be reviewed.
+
+For example, users may add the following check to their callback function:
+
+.. code-block:: c
+
+    mongoc_oidc_credential_t *
+    example_callback_fn (mongoc_oidc_callback_params_t *params)
+    {
+       // A runtime message that new features are available in the OIDC Callback API.
+       if (mongoc_oidc_callback_params_get_version (params) > 1) {
+          printf ("OIDC Callback API has been updated to a new version!");
+       }
+
+       // ...
+    }
+
+User Data
+`````````
+
+The ``user_data`` parameter may be used to pass additional arguments to the callback function or to return additional values out of the callback function.
+
+This parameter must be set in advance via :symbol:`mongoc_oidc_callback_set_user_data()` before the :symbol:`mongoc_oidc_callback_t` object is associated with a :symbol:`mongoc_client_t` or :symbol:`mongoc_client_pool_t` object.
+
+.. warning::
+
+    The lifetime of the object pointed to by ``user_data`` is managed the user, not by :symbol:`mongoc_oidc_callback_t`!
+
+.. code-block:: c
+
+    typedef struct {
+       int counter;
+       const char *error_message;
+    } user_data_t;
+
+    mongoc_oidc_credential_t *
+    example_callback_fn (mongoc_oidc_callback_params_t *params)
+    {
+       user_data_t *user_data = (user_data_t *) mongoc_oidc_callback_params_get_user_data (params);
+
+       user_data->counter += 1;
+
+       // ...
+
+       if (/* ... */) {
+          user_data->error_message = "OIDC callback failed due to ...";
+          return NULL;
+       }
+
+       // ...
+    }
+
+    void
+    example (void)
+    {
+       mongoc_client_t *client = /* ... */;
+       bson_error_t error;
+
+       {
+          user_data_t *user_data = malloc (sizeof (*user_data));
+          *user_data = (user_data_t){.counter = 0, .error_message = NULL};
+          mongoc_oidc_callback_t *callback = mongoc_oidc_callback_new_with_user_data (&example_callback_fn, (void *) user_data);
+          mongoc_client_set_oidc_callback (client, callback);
+          mongoc_oidc_callback_destroy (callback);
+       }
+
+       // ... client operations ...
+
+       {
+          const mongoc_oidc_callback_t *callback = mongoc_client_get_oidc_callback (client);
+          user_data_t *user_data = (user_data_t *) mongoc_oidc_callback_get_user_data (callback);
+
+          if (error.code != 0) {
+             printf ("client error message: %s\n", error.message);
+          }
+
+          if (user_data->error_message) {
+             printf ("custom error message: %s\n", user_data->error_message);
+          }
+
+          printf ("The callback function was invoked %d times!", user_data->counter);
+
+          free (user_data);
+       }
+
+       mongoc_client_destroy (client);
+    }
+
+Timeout
+```````
+
+The ``timeout`` parameter is used to determine when the callback function should report cancellation due to a timeout.
+
+When :symbol:`bson_get_monotonic_time()` is greater than ``timeout``, the callback function must invoke :symbol:`mongoc_oidc_callback_params_cancel_with_timeout()` and return ``NULL``.
+
+Username
+````````
+
+The ``username`` parameter is the value of the username component of the URI of the associated :symbol:`mongoc_client_t` or :symbol:`mongoc_client_pool_t` object from which the callback function is invoked.
+
+Cancel With Timeout
+```````````````````
+
+The ``cancel_with_timeout`` out parameter indicates cancellation of the callback function due to a timeout instead of an error.
+
+.. important::
+
+    The callback function MUST return ``NULL``, otherwise the invocation will be interpreted as a success even when ``cancel_with_timeout`` is set.
+
+.. code-block:: c
+
+    mongoc_oidc_credential_t *
+    example_callback_fn (mongoc_oidc_callback_params_t *params) {
+       const int64_t *timeout = mongoc_oidc_callback_params_get_timeout (params);
+
+       // NULL means "infinite" timeout.
+       if (timeout && bson_get_monotonic_time () > *timeout) {
+          return mongoc_oidc_callback_params_cancel_with_timeout (params);
+       }
+
+       // ...
+    }
+
+Error Handling
+``````````````
+
+A ``NULL`` return value (without setting ``cancel_with_timeout``) indicates failure to provide an access token due to an error.
+
+.. important::
+
+    The callback function MUST return ``NULL``, otherwise the invocation will be interpreted as a success.
+
+.. code-block:: c
+
+    mongoc_oidc_credential_t *
+    example_callback_fn (mongoc_oidc_callback_params_t *params) {
+       // ...
+
+       if (/* ... */) {
+          // The OIDC callback function could not provide an access token due to an error.
+          return NULL;
+       }
+
+       // ...
+    }
+
+.. seealso::
+
+  - :symbol:`mongoc_oidc_callback_t`
+  - :symbol:`mongoc_oidc_callback_fn_t`
diff -pruN 2.0.2-1/src/libmongoc/doc/mongoc_oidc_callback_set_user_data.rst 2.1.0-1/src/libmongoc/doc/mongoc_oidc_callback_set_user_data.rst
--- 2.0.2-1/src/libmongoc/doc/mongoc_oidc_callback_set_user_data.rst	1970-01-01 00:00:00.000000000 +0000
+++ 2.1.0-1/src/libmongoc/doc/mongoc_oidc_callback_set_user_data.rst	2025-08-14 18:37:23.000000000 +0000
@@ -0,0 +1,29 @@
+:man_page: mongoc_oidc_callback_set_user_data
+
+mongoc_oidc_callback_set_user_data()
+====================================
+
+Synopsis
+--------
+
+.. code-block:: c
+
+  void
+  mongoc_oidc_callback_set_user_data (mongoc_oidc_callback_t *callback, void *user_data);
+
+Store the provided pointer to user data.
+
+.. warning::
+
+    The lifetime of the object pointed to by ``user_data`` is managed the user, not by :symbol:`mongoc_oidc_callback_t`!
+
+Parameters
+----------
+
+* ``callback``: a :symbol:`mongoc_oidc_callback_t`.
+* ``user_data``: a pointer to user data or ``NULL``.
+
+.. seealso::
+
+  - :symbol:`mongoc_oidc_callback_t`
+  - :symbol:`mongoc_oidc_callback_get_user_data()`
diff -pruN 2.0.2-1/src/libmongoc/doc/mongoc_oidc_callback_t.rst 2.1.0-1/src/libmongoc/doc/mongoc_oidc_callback_t.rst
--- 2.0.2-1/src/libmongoc/doc/mongoc_oidc_callback_t.rst	1970-01-01 00:00:00.000000000 +0000
+++ 2.1.0-1/src/libmongoc/doc/mongoc_oidc_callback_t.rst	2025-08-14 18:37:23.000000000 +0000
@@ -0,0 +1,150 @@
+:man_page: mongoc_oidc_callback_t
+
+mongoc_oidc_callback_t
+======================
+
+Synopsis
+--------
+
+.. code-block:: c
+
+  typedef struct _mongoc_oidc_callback_t mongoc_oidc_callback_t;
+
+:symbol:`mongoc_oidc_callback_t` represents a user-defined callback function :symbol:`mongoc_oidc_callback_fn_t` that returns an OIDC access token.
+
+The callback may be used to integrate with OIDC providers that are not supported by the built-in provider integrations (:ref:`Authentication Mechanism Properties <authentication_mechanism_properties>`).
+
+.. only:: html
+
+  Functions
+  ---------
+
+  .. toctree::
+    :titlesonly:
+    :maxdepth: 1
+
+    mongoc_oidc_callback_new
+    mongoc_oidc_callback_new_with_user_data
+    mongoc_oidc_callback_destroy
+    mongoc_oidc_callback_get_fn
+    mongoc_oidc_callback_get_user_data
+    mongoc_oidc_callback_set_user_data
+
+Lifecycle
+---------
+
+The function and optional user data stored by :symbol:`mongoc_oidc_callback_t` must outlive any associated client or client pool object which may invoke the stored callback function.
+
+Thread Safety
+-------------
+
+The callback function stored by a :symbol:`mongoc_oidc_callback_t` object will be invoked by at most one thread at a time for an associated :symbol:`mongoc_client_t` or :symbol:`mongoc_client_pool_t` object:
+
+.. code-block:: c
+
+    static mongoc_oidc_credential_t *
+    single_thread_only (mongoc_oidc_callback_params_t *params)
+    {
+       // This function does not need to support invocation by more than thread at a time.
+
+       // ...
+    }
+
+    void
+    with_single_client (void)
+    {
+       mongoc_client_t *client = /* ... */;
+
+       {
+          mongoc_oidc_callback_t *callback = mongoc_oidc_callback_new (&single_thread_only);
+          mongoc_client_set_oidc_callback (client, callback);
+          mongoc_oidc_callback_destroy (callback);
+       }
+
+       // ... client operations ...
+
+       mongoc_client_destroy (client);
+    }
+
+    void
+    with_single_pool (void)
+    {
+       mongoc_client_pool_t *pool = /* ... */;
+
+       {
+          mongoc_oidc_callback_t *callback = mongoc_oidc_callback_new (&single_thread_only);
+          mongoc_client_pool_set_oidc_callback (pool, callback);
+          mongoc_oidc_callback_destroy (callback);
+       }
+
+       // ... client pool operations ...
+
+       mongoc_client_pool_destroy (pool);
+    }
+
+If the callback is associated with more than one :symbol:`mongoc_client_t` object (in multiple threads), or with more than one :symbol:`mongoc_client_pool_t` object (even in a single thread), the callback function MUST support invocation by more than one thread at a time:
+
+.. code-block:: c
+
+    static mongoc_oidc_credential_t *
+    many_threads_possible (mongoc_oidc_callback_params_t *params)
+    {
+       // This function MUST support invocation by more than one thread at a time.
+
+       // ...
+    }
+
+    void
+    with_many_clients (void)
+    {
+       mongoc_client_t *client_a = /* ... */;
+       mongoc_client_t *client_b = /* ... */;
+
+       {
+          mongoc_oidc_callback_t *callback = mongoc_oidc_callback_new (&many_threads_possible);
+          mongoc_client_set_oidc_callback (client_a, callback);
+          mongoc_client_set_oidc_callback (client_b, callback);
+          mongoc_oidc_callback_destroy (callback);
+       }
+
+       pthread_t thread_a;
+       pthread_t thread_b;
+
+       if (pthread_create (&thread_a, NULL, /* thread_a_fn */, client_a) != 0) { /* ... */ }
+       if (pthread_create (&thread_b, NULL, /* thread_b_fn */, client_b) != 0) { /* ... */ }
+
+       // ... client operations using multiple threads ...
+
+       if (pthread_join (&thread_a, NULL) != 0) { /* ... */ }
+       if (pthread_join (&thread_b, NULL) != 0) { /* ... */ }
+
+       mongoc_client_destroy (client_a);
+       mongoc_client_destroy (client_b);
+    }
+
+    void
+    with_many_pools (void)
+    {
+       mongoc_client_pool_t *pool_a = /* ... */;
+       mongoc_client_pool_t *pool_b = /* ... */;
+
+       {
+          mongoc_oidc_callback_t *callback = mongoc_oidc_callback_new (&many_threads_possible);
+          mongoc_client_pool_set_oidc_callback (pool_a, callback);
+          mongoc_client_pool_set_oidc_callback (pool_b, callback);
+          mongoc_oidc_callback_destroy (callback);
+       }
+
+       // ... client operations using multiple client pools ...
+
+       mongoc_client_pool_destroy (pool_a);
+       mongoc_client_pool_destroy (pool_b);
+    }
+
+.. seealso::
+
+  - :symbol:`mongoc_client_t`
+  - :symbol:`mongoc_client_pool_t`
+  - :symbol:`mongoc_oidc_callback_fn_t`
+  - :symbol:`mongoc_oidc_callback_params_t`
+  - :symbol:`mongoc_oidc_credential_t`
diff -pruN 2.0.2-1/src/libmongoc/doc/mongoc_oidc_credential_destroy.rst 2.1.0-1/src/libmongoc/doc/mongoc_oidc_credential_destroy.rst
--- 2.0.2-1/src/libmongoc/doc/mongoc_oidc_credential_destroy.rst	1970-01-01 00:00:00.000000000 +0000
+++ 2.1.0-1/src/libmongoc/doc/mongoc_oidc_credential_destroy.rst	2025-08-14 18:37:23.000000000 +0000
@@ -0,0 +1,23 @@
+:man_page: mongoc_oidc_credential_destroy
+
+mongoc_oidc_credential_destroy()
+================================
+
+Synopsis
+--------
+
+.. code-block:: c
+
+  void
+  mongoc_oidc_credential_destroy (mongoc_oidc_credential_t *credential)
+
+Release all resources associated with the given :symbol:`mongoc_oidc_credential_t` object.
+
+Parameters
+----------
+
+* ``credential``: a :symbol:`mongoc_oidc_credential_t` or ``NULL``.
+
+.. seealso::
+
+  - :symbol:`mongoc_oidc_credential_t`
diff -pruN 2.0.2-1/src/libmongoc/doc/mongoc_oidc_credential_get_access_token.rst 2.1.0-1/src/libmongoc/doc/mongoc_oidc_credential_get_access_token.rst
--- 2.0.2-1/src/libmongoc/doc/mongoc_oidc_credential_get_access_token.rst	1970-01-01 00:00:00.000000000 +0000
+++ 2.1.0-1/src/libmongoc/doc/mongoc_oidc_credential_get_access_token.rst	2025-08-14 18:37:23.000000000 +0000
@@ -0,0 +1,36 @@
+:man_page: mongoc_oidc_credential_get_access_token
+
+mongoc_oidc_credential_get_access_token()
+=========================================
+
+Synopsis
+--------
+
+.. code-block:: c
+
+  const char *
+  mongoc_oidc_credential_get_access_token (const mongoc_oidc_credential_t *cred);
+
+Return the access token stored in the :symbol:`mongoc_oidc_credential_t` object.
+
+Parameters
+----------
+
+* ``cred``: a :symbol:`mongoc_oidc_credential_t`.
+
+Returns
+-------
+
+A string which must not be modified or freed.
+
+Lifecycle
+---------
+
+The string is only valid for the lifetime of the :symbol:`mongoc_oidc_credential_t` object.
+
+.. seealso::
+
+  - :symbol:`mongoc_oidc_credential_t`
+  - :symbol:`mongoc_oidc_callback_fn_t`
+  - :symbol:`mongoc_oidc_credential_new`
+  - :symbol:`mongoc_oidc_credential_new_with_expires_in`
diff -pruN 2.0.2-1/src/libmongoc/doc/mongoc_oidc_credential_get_expires_in.rst 2.1.0-1/src/libmongoc/doc/mongoc_oidc_credential_get_expires_in.rst
--- 2.0.2-1/src/libmongoc/doc/mongoc_oidc_credential_get_expires_in.rst	1970-01-01 00:00:00.000000000 +0000
+++ 2.1.0-1/src/libmongoc/doc/mongoc_oidc_credential_get_expires_in.rst	2025-08-14 18:37:23.000000000 +0000
@@ -0,0 +1,39 @@
+:man_page: mongoc_oidc_credential_get_expires_in
+
+mongoc_oidc_credential_get_expires_in()
+=======================================
+
+Synopsis
+--------
+
+.. code-block:: c
+
+  const int64_t *
+  mongoc_oidc_credential_get_expires_in (const mongoc_oidc_credential_t *cred);
+
+Return the optional expiry duration (in milliseconds) for the access token stored in :symbol:`mongoc_oidc_credential_t`.
+
+.. important::
+
+    An unset value is interpreted as an infinite expiry duration.
+
+Parameters
+----------
+
+* ``cred``: a :symbol:`mongoc_oidc_credential_t`.
+
+Returns
+-------
+
+The expiry duration (in milliseconds), or ``NULL`` when unset.
+
+Lifecycle
+---------
+
+The pointed-to ``int64_t`` is only valid for the lifetime of the :symbol:`mongoc_oidc_credential_t` object.
+
+.. seealso::
+
+  - :symbol:`mongoc_oidc_credential_t`
+  - :symbol:`mongoc_oidc_credential_new_with_expires_in`
+  - :symbol:`mongoc_oidc_callback_fn_t`
diff -pruN 2.0.2-1/src/libmongoc/doc/mongoc_oidc_credential_new.rst 2.1.0-1/src/libmongoc/doc/mongoc_oidc_credential_new.rst
--- 2.0.2-1/src/libmongoc/doc/mongoc_oidc_credential_new.rst	1970-01-01 00:00:00.000000000 +0000
+++ 2.1.0-1/src/libmongoc/doc/mongoc_oidc_credential_new.rst	2025-08-14 18:37:23.000000000 +0000
@@ -0,0 +1,34 @@
+:man_page: mongoc_oidc_credential_new
+
+mongoc_oidc_credential_new()
+============================
+
+Synopsis
+--------
+
+.. code-block:: c
+
+  mongoc_oidc_credential_t *
+  mongoc_oidc_credential_new (const char *access_token)
+
+Create a new :symbol:`mongoc_oidc_credential_t` object which stores a copy of the provided OIDC access token with an infinite expiry duration.
+
+To set a finite expiry duration, use :symbol:`mongoc_oidc_credential_new_with_expires_in()`.
+
+.. warning::
+
+    ``access_token`` is NOT directly validated by the driver.
+
+Parameters
+----------
+
+* ``access_token``: an OIDC access token. Must not be ``NULL``.
+
+Returns
+-------
+
+A new :symbol:`mongoc_oidc_credential_t` that must be freed with :symbol:`mongoc_oidc_credential_destroy()`, or ``NULL`` when an invalid argument was given.
+
+.. seealso::
+
+  - :symbol:`mongoc_oidc_credential_t`
diff -pruN 2.0.2-1/src/libmongoc/doc/mongoc_oidc_credential_new_with_expires_in.rst 2.1.0-1/src/libmongoc/doc/mongoc_oidc_credential_new_with_expires_in.rst
--- 2.0.2-1/src/libmongoc/doc/mongoc_oidc_credential_new_with_expires_in.rst	1970-01-01 00:00:00.000000000 +0000
+++ 2.1.0-1/src/libmongoc/doc/mongoc_oidc_credential_new_with_expires_in.rst	2025-08-14 18:37:23.000000000 +0000
@@ -0,0 +1,37 @@
+:man_page: mongoc_oidc_credential_new_with_expires_in
+
+mongoc_oidc_credential_new_with_expires_in()
+============================================
+
+Synopsis
+--------
+
+.. code-block:: c
+
+  mongoc_oidc_credential_t *
+  mongoc_oidc_credential_new_with_expires_in (const char *access_token, int64_t expires_in)
+
+Create a new :symbol:`mongoc_oidc_credential_t` object which stores a copy of the provided OIDC access token and its expiry duration (in milliseconds).
+
+The expiry duration will be evaluated relative to the value returned by :symbol:`bson_get_monotonic_time()` immediately after the callback function has returned.
+
+To set an infinite expiry duration, use :symbol:`mongoc_oidc_credential_new()`.
+
+.. warning::
+
+    ``access_token`` is NOT directly validated by the driver.
+
+Parameters
+----------
+
+* ``access_token``: an OIDC access token. Must not be ``NULL``.
+* ``expires_in``: a non-negative integer.
+
+Returns
+-------
+
+A new :symbol:`mongoc_oidc_credential_t` that must be freed with :symbol:`mongoc_oidc_credential_destroy()`, or ``NULL`` when an invalid argument was given.
+
+.. seealso::
+
+  - :symbol:`mongoc_oidc_credential_t`
diff -pruN 2.0.2-1/src/libmongoc/doc/mongoc_oidc_credential_t.rst 2.1.0-1/src/libmongoc/doc/mongoc_oidc_credential_t.rst
--- 2.0.2-1/src/libmongoc/doc/mongoc_oidc_credential_t.rst	1970-01-01 00:00:00.000000000 +0000
+++ 2.1.0-1/src/libmongoc/doc/mongoc_oidc_credential_t.rst	2025-08-14 18:37:23.000000000 +0000
@@ -0,0 +1,73 @@
+:man_page: mongoc_oidc_credential_t
+
+mongoc_oidc_credential_t
+========================
+
+Synopsis
+--------
+
+.. code-block:: c
+
+  typedef struct _mongoc_oidc_credential_t mongoc_oidc_credential_t;
+
+Represents the return value of a :symbol:`mongoc_oidc_callback_fn_t`.
+
+The value will be returned by the :symbol:`mongoc_oidc_callback_fn_t` stored in an :symbol:`mongoc_oidc_callback_t` object when it is invoked by an associated :symbol:`mongoc_client_t` or :symbol:`mongoc_client_pool_t` object.
+
+.. only:: html
+
+  Functions
+  ---------
+
+  .. toctree::
+    :titlesonly:
+    :maxdepth: 1
+
+    mongoc_oidc_credential_new
+    mongoc_oidc_credential_new_with_expires_in
+    mongoc_oidc_credential_destroy
+    mongoc_oidc_credential_get_access_token
+    mongoc_oidc_credential_get_expires_in
+
+Return Values
+-------------
+
+The list of currently supported return values are:
+
+.. list-table::
+    :widths: auto
+
+    * - Value
+      - Versions
+      - Description
+    * - ``access_token``
+      - 1
+      - The OIDC access token.
+    * - ``expires_in``
+      - 1
+      - An optional expiration duration (in milliseconds).
+
+The "Version" column indicates the OIDC callback API versions for which the parameter is applicable.
+
+Access Token
+````````````
+
+An OIDC access token (a signed JWT token).
+
+.. warning::
+
+    ``access_token`` is NOT directly validated by the driver.
+
+Expiry Duration
+```````````````
+
+An optional expiry duration (in milliseconds) for the access token.
+
+.. important::
+
+    An unset value is interpreted as an infinite expiry duration.
+
+.. seealso::
+
+  - :symbol:`mongoc_oidc_callback_t`
+  - :symbol:`mongoc_oidc_callback_fn_t`
diff -pruN 2.0.2-1/src/libmongoc/doc/mongoc_stream_buffered_new.rst 2.1.0-1/src/libmongoc/doc/mongoc_stream_buffered_new.rst
--- 2.0.2-1/src/libmongoc/doc/mongoc_stream_buffered_new.rst	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/doc/mongoc_stream_buffered_new.rst	2025-08-14 18:37:23.000000000 +0000
@@ -9,8 +9,7 @@ Synopsis
 .. code-block:: c
 
   mongoc_stream_t *
-  mongoc_stream_buffered_new (mongoc_stream_t *base_stream,
-                          size_t buffer_size);
+  mongoc_stream_buffered_new (mongoc_stream_t *base_stream, size_t buffer_size);
 
 Parameters
 ----------
@@ -22,6 +21,10 @@ This function shall create a new :symbol
 
 ``buffer_size`` will be used as the initial buffer size. It may grow past this size.
 
+.. warning::
+  
+  The internal buffer does not reduce in size once grown. Receiving a large message may result in a large allocation that persists until the returned :symbol:`mongoc_stream_t` is freed with :symbol:`mongoc_stream_destroy()`.
+
 Returns
 -------
 
diff -pruN 2.0.2-1/src/libmongoc/doc/mongoc_uri_set_compressors.rst 2.1.0-1/src/libmongoc/doc/mongoc_uri_set_compressors.rst
--- 2.0.2-1/src/libmongoc/doc/mongoc_uri_set_compressors.rst	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/doc/mongoc_uri_set_compressors.rst	2025-08-14 18:37:23.000000000 +0000
@@ -15,7 +15,9 @@ Parameters
 ----------
 
 * ``uri``: A :symbol:`mongoc_uri_t`.
-* ``compressors``: A string consisting of one or more comma (,) separated compressors (e.g. "snappy,zlib") or ``NULL``. Passing ``NULL`` clears any existing compressors set on ``uri``.
+* ``compressors``: A string consisting of one or more comma (,) separated
+  compressors names (e.g. "snappy,zlib") or ``NULL``. Passing ``NULL`` or an
+  empty string clears any existing compressors set on ``uri``.
 
 Description
 -----------
diff -pruN 2.0.2-1/src/libmongoc/examples/aggregation/aggregation1.c 2.1.0-1/src/libmongoc/examples/aggregation/aggregation1.c
--- 2.0.2-1/src/libmongoc/examples/aggregation/aggregation1.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/examples/aggregation/aggregation1.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,4 +1,5 @@
 #include <mongoc/mongoc.h>
+
 #include <stdio.h>
 
 static void
diff -pruN 2.0.2-1/src/libmongoc/examples/basic_aggregation/basic-aggregation.c 2.1.0-1/src/libmongoc/examples/basic_aggregation/basic-aggregation.c
--- 2.0.2-1/src/libmongoc/examples/basic_aggregation/basic-aggregation.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/examples/basic_aggregation/basic-aggregation.c	2025-08-14 18:37:23.000000000 +0000
@@ -14,18 +14,15 @@
  * limitations under the License.
  */
 
+#include "../doc-common-insert.c"
+#include "./constants.c"
+#include "./distinct.c"
+#include "./map-reduce-advanced.c"
+#include "./map-reduce-basic.c"
 
 #include <mongoc/mongoc.h>
-#include <stdio.h>
-
-
-#include "constants.c"
-
-#include "../doc-common-insert.c"
-#include "distinct.c"
-#include "map-reduce-basic.c"
-#include "map-reduce-advanced.c"
 
+#include <stdio.h>
 
 int
 main (int argc, char *argv[])
diff -pruN 2.0.2-1/src/libmongoc/examples/bulk/bulk-collation.c 2.1.0-1/src/libmongoc/examples/bulk/bulk-collation.c
--- 2.0.2-1/src/libmongoc/examples/bulk/bulk-collation.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/examples/bulk/bulk-collation.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,4 +1,5 @@
 #include <mongoc/mongoc.h>
+
 #include <stdio.h>
 
 static void
diff -pruN 2.0.2-1/src/libmongoc/examples/bulk/bulk1.c 2.1.0-1/src/libmongoc/examples/bulk/bulk1.c
--- 2.0.2-1/src/libmongoc/examples/bulk/bulk1.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/examples/bulk/bulk1.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,5 +1,6 @@
-#include <assert.h>
 #include <mongoc/mongoc.h>
+
+#include <assert.h>
 #include <stdio.h>
 
 static void
diff -pruN 2.0.2-1/src/libmongoc/examples/bulk/bulk2.c 2.1.0-1/src/libmongoc/examples/bulk/bulk2.c
--- 2.0.2-1/src/libmongoc/examples/bulk/bulk2.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/examples/bulk/bulk2.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,5 +1,6 @@
-#include <assert.h>
 #include <mongoc/mongoc.h>
+
+#include <assert.h>
 #include <stdio.h>
 
 static void
diff -pruN 2.0.2-1/src/libmongoc/examples/bulk/bulk3.c 2.1.0-1/src/libmongoc/examples/bulk/bulk3.c
--- 2.0.2-1/src/libmongoc/examples/bulk/bulk3.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/examples/bulk/bulk3.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,5 +1,6 @@
-#include <assert.h>
 #include <mongoc/mongoc.h>
+
+#include <assert.h>
 #include <stdio.h>
 
 static void
diff -pruN 2.0.2-1/src/libmongoc/examples/bulk/bulk4.c 2.1.0-1/src/libmongoc/examples/bulk/bulk4.c
--- 2.0.2-1/src/libmongoc/examples/bulk/bulk4.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/examples/bulk/bulk4.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,5 +1,6 @@
-#include <assert.h>
 #include <mongoc/mongoc.h>
+
+#include <assert.h>
 #include <stdio.h>
 
 static void
diff -pruN 2.0.2-1/src/libmongoc/examples/bulk/bulk5.c 2.1.0-1/src/libmongoc/examples/bulk/bulk5.c
--- 2.0.2-1/src/libmongoc/examples/bulk/bulk5.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/examples/bulk/bulk5.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,5 +1,6 @@
-#include <assert.h>
 #include <mongoc/mongoc.h>
+
+#include <assert.h>
 #include <stdio.h>
 
 static void
diff -pruN 2.0.2-1/src/libmongoc/examples/bulk/bulk6.c 2.1.0-1/src/libmongoc/examples/bulk/bulk6.c
--- 2.0.2-1/src/libmongoc/examples/bulk/bulk6.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/examples/bulk/bulk6.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,4 +1,5 @@
 #include <mongoc/mongoc.h>
+
 #include <stdio.h>
 
 static void
diff -pruN 2.0.2-1/src/libmongoc/examples/client-side-encryption-auto-decryption.c 2.1.0-1/src/libmongoc/examples/client-side-encryption-auto-decryption.c
--- 2.0.2-1/src/libmongoc/examples/client-side-encryption-auto-decryption.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/examples/client-side-encryption-auto-decryption.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,9 +1,10 @@
+#include "./client-side-encryption-helpers.h"
+
 #include <mongoc/mongoc.h>
+
 #include <stdio.h>
 #include <stdlib.h>
 
-#include "client-side-encryption-helpers.h"
-
 /* This example demonstrates how to set up automatic decryption without
  * automatic encryption using the community version of MongoDB */
 int
diff -pruN 2.0.2-1/src/libmongoc/examples/client-side-encryption-doc-snippets.c 2.1.0-1/src/libmongoc/examples/client-side-encryption-doc-snippets.c
--- 2.0.2-1/src/libmongoc/examples/client-side-encryption-doc-snippets.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/examples/client-side-encryption-doc-snippets.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,4 +1,5 @@
 #include <mongoc/mongoc.h>
+
 #include <stdio.h>
 #include <stdlib.h>
 
diff -pruN 2.0.2-1/src/libmongoc/examples/client-side-encryption-explicit.c 2.1.0-1/src/libmongoc/examples/client-side-encryption-explicit.c
--- 2.0.2-1/src/libmongoc/examples/client-side-encryption-explicit.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/examples/client-side-encryption-explicit.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,9 +1,10 @@
+#include "./client-side-encryption-helpers.h"
+
 #include <mongoc/mongoc.h>
+
 #include <stdio.h>
 #include <stdlib.h>
 
-#include "client-side-encryption-helpers.h"
-
 /* This example demonstrates how to use explicit encryption and decryption using
  * the community version of MongoDB */
 int
diff -pruN 2.0.2-1/src/libmongoc/examples/client-side-encryption-helpers.c 2.1.0-1/src/libmongoc/examples/client-side-encryption-helpers.c
--- 2.0.2-1/src/libmongoc/examples/client-side-encryption-helpers.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/examples/client-side-encryption-helpers.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,4 +1,4 @@
-#include "client-side-encryption-helpers.h"
+#include "./client-side-encryption-helpers.h"
 
 uint8_t *
 hex_to_bin (const char *hex, uint32_t *len)
diff -pruN 2.0.2-1/src/libmongoc/examples/client-side-encryption-schema-map.c 2.1.0-1/src/libmongoc/examples/client-side-encryption-schema-map.c
--- 2.0.2-1/src/libmongoc/examples/client-side-encryption-schema-map.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/examples/client-side-encryption-schema-map.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,9 +1,10 @@
+#include "./client-side-encryption-helpers.h"
+
 #include <mongoc/mongoc.h>
+
 #include <stdio.h>
 #include <stdlib.h>
 
-#include "client-side-encryption-helpers.h"
-
 /* Helper method to create a new data key in the key vault, a schema to use that
  * key, and writes the schema to a file for later use. */
 static bool
diff -pruN 2.0.2-1/src/libmongoc/examples/client-side-encryption-server-schema.c 2.1.0-1/src/libmongoc/examples/client-side-encryption-server-schema.c
--- 2.0.2-1/src/libmongoc/examples/client-side-encryption-server-schema.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/examples/client-side-encryption-server-schema.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,9 +1,10 @@
+#include "./client-side-encryption-helpers.h"
+
 #include <mongoc/mongoc.h>
+
 #include <stdio.h>
 #include <stdlib.h>
 
-#include "client-side-encryption-helpers.h"
-
 /* Helper method to create and return a JSON schema to use for encryption.
 The caller will use the returned schema for server-side encryption validation.
 */
diff -pruN 2.0.2-1/src/libmongoc/examples/cmake/find_package/CMakeLists.txt 2.1.0-1/src/libmongoc/examples/cmake/find_package/CMakeLists.txt
--- 2.0.2-1/src/libmongoc/examples/cmake/find_package/CMakeLists.txt	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/examples/cmake/find_package/CMakeLists.txt	2025-08-14 18:37:23.000000000 +0000
@@ -15,7 +15,7 @@
 # Demonstrates how to use the CMake 'find_package' mechanism to locate
 # and build against libmongoc.
 
-cmake_minimum_required (VERSION 3.0)
+cmake_minimum_required (VERSION 3.15...4.0)
 
 project (hello_mongoc LANGUAGES C)
 
diff -pruN 2.0.2-1/src/libmongoc/examples/cmake/find_package_static/CMakeLists.txt 2.1.0-1/src/libmongoc/examples/cmake/find_package_static/CMakeLists.txt
--- 2.0.2-1/src/libmongoc/examples/cmake/find_package_static/CMakeLists.txt	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/examples/cmake/find_package_static/CMakeLists.txt	2025-08-14 18:37:23.000000000 +0000
@@ -15,7 +15,7 @@
 # Demonstrates how to use the CMake 'find_package' mechanism to locate
 # and build against libmongoc.
 
-cmake_minimum_required (VERSION 3.0)
+cmake_minimum_required (VERSION 3.15...4.0)
 
 project (hello_mongoc LANGUAGES C)
 
diff -pruN 2.0.2-1/src/libmongoc/examples/cmake/vcpkg/CMakeLists.txt 2.1.0-1/src/libmongoc/examples/cmake/vcpkg/CMakeLists.txt
--- 2.0.2-1/src/libmongoc/examples/cmake/vcpkg/CMakeLists.txt	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/examples/cmake/vcpkg/CMakeLists.txt	2025-08-14 18:37:23.000000000 +0000
@@ -1,4 +1,4 @@
-cmake_minimum_required(VERSION 3.15)
+cmake_minimum_required (VERSION 3.15...4.0)
 project(vcpkg-example-project)
 
 find_package(mongoc CONFIG REQUIRED)
diff -pruN 2.0.2-1/src/libmongoc/examples/common_operations/common-operations.c 2.1.0-1/src/libmongoc/examples/common_operations/common-operations.c
--- 2.0.2-1/src/libmongoc/examples/common_operations/common-operations.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/examples/common_operations/common-operations.c	2025-08-14 18:37:23.000000000 +0000
@@ -14,16 +14,14 @@
  * limitations under the License.
  */
 
-
 #include <mongoc/mongoc.h>
-#include <stdio.h>
 
+#include <stdio.h>
 
 const char *COLLECTION_NAME = "things";
 
 #include "../doc-common-insert.c"
-#include "explain.c"
-
+#include "./explain.c"
 
 int
 main (int argc, char *argv[])
diff -pruN 2.0.2-1/src/libmongoc/examples/doc-common-insert.c 2.1.0-1/src/libmongoc/examples/doc-common-insert.c
--- 2.0.2-1/src/libmongoc/examples/doc-common-insert.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/examples/doc-common-insert.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,3 +1,7 @@
+#include <mongoc/mongoc.h>
+
+#include <stdbool.h>
+
 /* Don't try to compile this file on its own. It's meant to be #included
    by example code */
 
diff -pruN 2.0.2-1/src/libmongoc/examples/example-client.c 2.1.0-1/src/libmongoc/examples/example-client.c
--- 2.0.2-1/src/libmongoc/examples/example-client.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/examples/example-client.c	2025-08-14 18:37:23.000000000 +0000
@@ -4,6 +4,7 @@
 /* ./example-client [CONNECTION_STRING [COLLECTION_NAME]] */
 
 #include <mongoc/mongoc.h>
+
 #include <stdio.h>
 #include <stdlib.h>
 
diff -pruN 2.0.2-1/src/libmongoc/examples/example-collection-command.c 2.1.0-1/src/libmongoc/examples/example-collection-command.c
--- 2.0.2-1/src/libmongoc/examples/example-collection-command.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/examples/example-collection-command.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,6 +1,8 @@
 // BEGIN:mongoc_collection_command_simple
-#include <bson/bson.h>
 #include <mongoc/mongoc.h>
+
+#include <bson/bson.h>
+
 #include <stdio.h>
 
 static void
diff -pruN 2.0.2-1/src/libmongoc/examples/example-command-monitoring.c 2.1.0-1/src/libmongoc/examples/example-command-monitoring.c
--- 2.0.2-1/src/libmongoc/examples/example-command-monitoring.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/examples/example-command-monitoring.c	2025-08-14 18:37:23.000000000 +0000
@@ -4,6 +4,7 @@
 /* ./example-command-monitoring [CONNECTION_STRING] */
 
 #include <mongoc/mongoc.h>
+
 #include <stdio.h>
 
 
diff -pruN 2.0.2-1/src/libmongoc/examples/example-command-with-opts.c 2.1.0-1/src/libmongoc/examples/example-command-with-opts.c
--- 2.0.2-1/src/libmongoc/examples/example-command-with-opts.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/examples/example-command-with-opts.c	2025-08-14 18:37:23.000000000 +0000
@@ -25,6 +25,7 @@ distinct: { "values" : [ 1, 2 ], "ok" :
 */
 
 #include <mongoc/mongoc.h>
+
 #include <stdio.h>
 #include <stdlib.h>
 
diff -pruN 2.0.2-1/src/libmongoc/examples/example-gridfs-bucket.c 2.1.0-1/src/libmongoc/examples/example-gridfs-bucket.c
--- 2.0.2-1/src/libmongoc/examples/example-gridfs-bucket.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/examples/example-gridfs-bucket.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,8 +1,8 @@
+#include <mongoc/mongoc.h>
+
 #include <stdio.h>
 #include <stdlib.h>
 
-#include <mongoc/mongoc.h>
-
 int
 main (int argc, char *argv[])
 {
diff -pruN 2.0.2-1/src/libmongoc/examples/example-gridfs.c 2.1.0-1/src/libmongoc/examples/example-gridfs.c
--- 2.0.2-1/src/libmongoc/examples/example-gridfs.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/examples/example-gridfs.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,8 +1,10 @@
-#include <assert.h>
 #include <mongoc/mongoc.h>
+
+#include <fcntl.h>
+
+#include <assert.h>
 #include <stdio.h>
 #include <stdlib.h>
-#include <fcntl.h>
 
 int
 main (int argc, char *argv[])
diff -pruN 2.0.2-1/src/libmongoc/examples/example-manage-collection-indexes.c 2.1.0-1/src/libmongoc/examples/example-manage-collection-indexes.c
--- 2.0.2-1/src/libmongoc/examples/example-manage-collection-indexes.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/examples/example-manage-collection-indexes.c	2025-08-14 18:37:23.000000000 +0000
@@ -2,6 +2,7 @@
 // the `test.test` collection.
 
 #include <mongoc/mongoc.h>
+
 #include <stdlib.h> // abort
 
 #define HANDLE_ERROR(...)                                                 \
diff -pruN 2.0.2-1/src/libmongoc/examples/example-manage-search-indexes.c 2.1.0-1/src/libmongoc/examples/example-manage-search-indexes.c
--- 2.0.2-1/src/libmongoc/examples/example-manage-search-indexes.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/examples/example-manage-search-indexes.c	2025-08-14 18:37:23.000000000 +0000
@@ -3,6 +3,7 @@
 // Example is expected to be run against a MongoDB Atlas cluster.
 
 #include <mongoc/mongoc.h>
+
 #include <stdlib.h> // abort
 
 #define HANDLE_ERROR(...)            \
diff -pruN 2.0.2-1/src/libmongoc/examples/example-pool.c 2.1.0-1/src/libmongoc/examples/example-pool.c
--- 2.0.2-1/src/libmongoc/examples/example-pool.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/examples/example-pool.c	2025-08-14 18:37:23.000000000 +0000
@@ -4,7 +4,9 @@
 /* ./example-pool [CONNECTION_STRING] */
 
 #include <mongoc/mongoc.h>
+
 #include <pthread.h>
+
 #include <stdio.h>
 
 static pthread_mutex_t mutex;
diff -pruN 2.0.2-1/src/libmongoc/examples/example-scram.c 2.1.0-1/src/libmongoc/examples/example-scram.c
--- 2.0.2-1/src/libmongoc/examples/example-scram.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/examples/example-scram.c	2025-08-14 18:37:23.000000000 +0000
@@ -3,6 +3,7 @@
 /* ./example-scram */
 
 #include <mongoc/mongoc.h>
+
 #include <stdio.h>
 #include <stdlib.h>
 
diff -pruN 2.0.2-1/src/libmongoc/examples/example-sdam-monitoring.c 2.1.0-1/src/libmongoc/examples/example-sdam-monitoring.c
--- 2.0.2-1/src/libmongoc/examples/example-sdam-monitoring.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/examples/example-sdam-monitoring.c	2025-08-14 18:37:23.000000000 +0000
@@ -4,6 +4,7 @@
 /* ./example-sdam-monitoring [CONNECTION_STRING] */
 
 #include <mongoc/mongoc.h>
+
 #include <stdio.h>
 
 
diff -pruN 2.0.2-1/src/libmongoc/examples/example-session.c 2.1.0-1/src/libmongoc/examples/example-session.c
--- 2.0.2-1/src/libmongoc/examples/example-session.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/examples/example-session.c	2025-08-14 18:37:23.000000000 +0000
@@ -3,9 +3,10 @@
 
 /* ./example-session [CONNECTION_STRING] */
 
-#include <stdio.h>
 #include <mongoc/mongoc.h>
 
+#include <stdio.h>
+
 
 int
 main (int argc, char *argv[])
diff -pruN 2.0.2-1/src/libmongoc/examples/example-structured-log.c 2.1.0-1/src/libmongoc/examples/example-structured-log.c
--- 2.0.2-1/src/libmongoc/examples/example-structured-log.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/examples/example-structured-log.c	2025-08-14 18:37:23.000000000 +0000
@@ -2,7 +2,9 @@
  *     $(pkg-config --cflags --libs libmongoc-1.0) */
 
 #include <mongoc/mongoc.h>
+
 #include <pthread.h>
+
 #include <stdio.h>
 #include <stdlib.h>
 
diff -pruN 2.0.2-1/src/libmongoc/examples/example-transaction.c 2.1.0-1/src/libmongoc/examples/example-transaction.c
--- 2.0.2-1/src/libmongoc/examples/example-transaction.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/examples/example-transaction.c	2025-08-14 18:37:23.000000000 +0000
@@ -3,9 +3,10 @@
 
 /* ./example-transaction [CONNECTION_STRING] */
 
-#include <stdio.h>
 #include <mongoc/mongoc.h>
 
+#include <stdio.h>
+
 
 int
 main (int argc, char *argv[])
diff -pruN 2.0.2-1/src/libmongoc/examples/example-with-transaction-cb.c 2.1.0-1/src/libmongoc/examples/example-with-transaction-cb.c
--- 2.0.2-1/src/libmongoc/examples/example-with-transaction-cb.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/examples/example-with-transaction-cb.c	2025-08-14 18:37:23.000000000 +0000
@@ -4,6 +4,7 @@
 /* ./example-with-transaction-cb [CONNECTION_STRING] */
 
 #include <mongoc/mongoc.h>
+
 #include <stdio.h>
 #include <stdlib.h>
 
diff -pruN 2.0.2-1/src/libmongoc/examples/find-and-modify.c 2.1.0-1/src/libmongoc/examples/find-and-modify.c
--- 2.0.2-1/src/libmongoc/examples/find-and-modify.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/examples/find-and-modify.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,4 +1,5 @@
 #include <mongoc/mongoc.h>
+
 #include <stdio.h>
 
 
diff -pruN 2.0.2-1/src/libmongoc/examples/find_and_modify_with_opts/fam.c 2.1.0-1/src/libmongoc/examples/find_and_modify_with_opts/fam.c
--- 2.0.2-1/src/libmongoc/examples/find_and_modify_with_opts/fam.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/examples/find_and_modify_with_opts/fam.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,4 +1,3 @@
-
 #include <mongoc/mongoc.h>
 
 /* EXAMPLE_FAM_BYPASS_BEGIN */
diff -pruN 2.0.2-1/src/libmongoc/examples/mongoc-dump.c 2.1.0-1/src/libmongoc/examples/mongoc-dump.c
--- 2.0.2-1/src/libmongoc/examples/mongoc-dump.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/examples/mongoc-dump.c	2025-08-14 18:37:23.000000000 +0000
@@ -15,9 +15,11 @@
  */
 
 
+#include <mongoc/mongoc.h>
+
 #include <bson/bson.h>
+
 #include <fcntl.h>
-#include <mongoc/mongoc.h>
 
 
 static bool
@@ -26,6 +28,7 @@ mongoc_dump_mkdir_p (const char *path, i
    int r;
 
 #ifdef _WIN32
+   (void) mode;
    r = _mkdir (path);
 #else
    r = mkdir (path, mode);
diff -pruN 2.0.2-1/src/libmongoc/examples/mongoc-ping.c 2.1.0-1/src/libmongoc/examples/mongoc-ping.c
--- 2.0.2-1/src/libmongoc/examples/mongoc-ping.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/examples/mongoc-ping.c	2025-08-14 18:37:23.000000000 +0000
@@ -16,6 +16,7 @@
 
 
 #include <mongoc/mongoc.h>
+
 #include <stdio.h>
 
 
diff -pruN 2.0.2-1/src/libmongoc/examples/mongoc-tail.c 2.1.0-1/src/libmongoc/examples/mongoc-tail.c
--- 2.0.2-1/src/libmongoc/examples/mongoc-tail.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/examples/mongoc-tail.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,5 +1,7 @@
-#include <bson/bson.h>
 #include <mongoc/mongoc.h>
+
+#include <bson/bson.h>
+
 #include <stdio.h>
 #include <stdlib.h>
 
diff -pruN 2.0.2-1/src/libmongoc/examples/tutorial/executing.c 2.1.0-1/src/libmongoc/examples/tutorial/executing.c
--- 2.0.2-1/src/libmongoc/examples/tutorial/executing.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/examples/tutorial/executing.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,5 +1,7 @@
-#include <bson/bson.h>
 #include <mongoc/mongoc.h>
+
+#include <bson/bson.h>
+
 #include <stdio.h>
 
 int
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mcd-azure.c 2.1.0-1/src/libmongoc/src/mongoc/mcd-azure.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mcd-azure.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mcd-azure.c	2025-08-14 18:37:23.000000000 +0000
@@ -18,6 +18,7 @@
 
 #include <mongoc/mongoc-error-private.h>
 #include <mongoc/mongoc-util-private.h>
+
 #include <mlib/cmp.h>
 
 #define AZURE_API_VERSION "2018-02-01"
@@ -80,7 +81,7 @@ mcd_azure_access_token_try_init_from_jso
    }
 
    // Zero the output
-   *out = (mcd_azure_access_token){0};
+   *out = (mcd_azure_access_token) {0};
 
    // Parse the JSON data
    bson_t bson;
@@ -112,7 +113,7 @@ mcd_azure_access_token_try_init_from_jso
                          json);
    } else {
       // Set the output, duplicate each string
-      *out = (mcd_azure_access_token){
+      *out = (mcd_azure_access_token) {
          .access_token = bson_strdup (access_token),
          .resource = bson_strdup (resource),
          .token_type = bson_strdup (token_type),
@@ -165,7 +166,7 @@ mcd_azure_access_token_from_imds (mcd_az
    bool okay = false;
 
    // Clear the output
-   *out = (mcd_azure_access_token){0};
+   *out = (mcd_azure_access_token) {0};
 
    mongoc_http_response_t resp;
    _mongoc_http_response_init (&resp);
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mcd-azure.h 2.1.0-1/src/libmongoc/src/mongoc/mcd-azure.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mcd-azure.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mcd-azure.h	2025-08-14 18:37:23.000000000 +0000
@@ -19,11 +19,10 @@
 
 #include <mongoc/mongoc-prelude.h>
 
-#include <mongoc/mongoc.h>
-
 #include <mongoc/mongoc-http-private.h>
 
 #include <mongoc/mcd-time.h>
+#include <mongoc/mongoc.h>
 
 /**
  * @brief An Azure OAuth2 access token obtained from the Azure API
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mcd-integer.h 2.1.0-1/src/libmongoc/src/mongoc/mcd-integer.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mcd-integer.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mcd-integer.h	2025-08-14 18:37:23.000000000 +0000
@@ -21,8 +21,8 @@
 
 #include <bson/bson.h>
 
-#include <stdint.h>
 #include <stdbool.h>
+#include <stdint.h>
 
 /// Return 'true' iff (left * right) would overflow with int64
 static BSON_INLINE bool
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mcd-nsinfo.c 2.1.0-1/src/libmongoc/src/mongoc/mcd-nsinfo.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mcd-nsinfo.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mcd-nsinfo.c	2025-08-14 18:37:23.000000000 +0000
@@ -18,8 +18,11 @@
 
 #include <mongoc/mongoc-buffer-private.h>
 #include <mongoc/mongoc-error-private.h>
+
 #include <mongoc/uthash.h>
 
+#include <mlib/config.h>
+
 typedef struct {
    char *ns; // Hash key.
    int32_t index;
@@ -58,6 +61,8 @@ mcd_nsinfo_destroy (mcd_nsinfo_t *self)
    bson_free (self);
 }
 
+mlib_diagnostic_push ();
+mlib_msvc_warning (disable : 4702); // HASH_ADD_KEYPTR
 int32_t
 mcd_nsinfo_append (mcd_nsinfo_t *self, const char *ns, bson_error_t *error)
 {
@@ -78,8 +83,12 @@ mcd_nsinfo_append (mcd_nsinfo_t *self, c
 
    // Add to hash table.
    ns_to_index_t *entry = bson_malloc (sizeof (*entry));
-   *entry = (ns_to_index_t){.index = ns_index, .ns = bson_strdup (ns), .hh = {0}};
+   *entry = (ns_to_index_t) {.index = ns_index, .ns = bson_strdup (ns), .hh = {0}};
+
+   mlib_diagnostic_push ();
+   mlib_disable_constant_conditional_expression_warnings ();
    HASH_ADD_KEYPTR (hh, self->n2i, entry->ns, strlen (entry->ns), entry);
+   mlib_diagnostic_pop ();
 
    // Append to buffer.
    bson_t mcd_nsinfo_bson = BSON_INITIALIZER;
@@ -88,6 +97,7 @@ mcd_nsinfo_append (mcd_nsinfo_t *self, c
    bson_destroy (&mcd_nsinfo_bson);
    return ns_index;
 }
+mlib_diagnostic_pop ();
 
 int32_t
 mcd_nsinfo_find (const mcd_nsinfo_t *self, const char *ns)
@@ -96,7 +106,12 @@ mcd_nsinfo_find (const mcd_nsinfo_t *sel
    BSON_ASSERT_PARAM (ns);
 
    ns_to_index_t *found;
+
+   mlib_diagnostic_push ();
+   mlib_disable_constant_conditional_expression_warnings ();
    HASH_FIND_STR (self->n2i, ns, found);
+   mlib_diagnostic_pop ();
+
    if (found == NULL) {
       return -1;
    }
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mcd-rpc.c 2.1.0-1/src/libmongoc/src/mongoc/mcd-rpc.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mcd-rpc.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mcd-rpc.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,12 +1,14 @@
-#include <mlib/intencode.h>
 #include <mongoc/mcd-rpc.h>
 
+#include <mlib/intencode.h>
+
 // Header-only dependency. Does NOT require linking with libmongoc.
 #define MONGOC_INSIDE
 #include <mongoc/mongoc-iovec.h>
 #undef MONGOC_INSIDE
 
 #include <bson/bson.h>
+
 #include <mlib/cmp.h>
 
 
@@ -201,7 +203,7 @@ union _mcd_rpc_message {
       return true;                                                                          \
    }
 
-MONGOC_RPC_CONSUME (uint8_t, uint8_t, (uint8_t))
+MONGOC_RPC_CONSUME (uint8_t, uint8_t, (uint8_t) )
 MONGOC_RPC_CONSUME (int32_t, uint32_t, BSON_UINT32_FROM_LE)
 MONGOC_RPC_CONSUME (uint32_t, uint32_t, BSON_UINT32_FROM_LE)
 MONGOC_RPC_CONSUME (int64_t, uint64_t, BSON_UINT64_FROM_LE)
@@ -811,7 +813,7 @@ mcd_rpc_message_from_data (const void *d
    mcd_rpc_message *rpc = bson_malloc (sizeof (mcd_rpc_message));
    mcd_rpc_message *ret = NULL;
 
-   *rpc = (mcd_rpc_message){.msg_header = {0}};
+   *rpc = (mcd_rpc_message) {.msg_header = {0}};
 
    if (!mcd_rpc_message_from_data_in_place (rpc, data, length, data_end)) {
       goto fail;
@@ -991,13 +993,13 @@ _append_iovec (mongoc_iovec_t *iovecs, s
       return _append_iovec (iovecs,                                                                        \
                             capacity,                                                                      \
                             count,                                                                         \
-                            (mongoc_iovec_t){                                                              \
+                            (mongoc_iovec_t) {                                                             \
                                .iov_base = (void *) value,                                                 \
                                .iov_len = sizeof (type),                                                   \
                             });                                                                            \
    }
 
-MONGOC_RPC_APPEND_IOVEC (uint8_t, uint8_t, (uint8_t))
+MONGOC_RPC_APPEND_IOVEC (uint8_t, uint8_t, (uint8_t) )
 MONGOC_RPC_APPEND_IOVEC (int32_t, uint32_t, BSON_UINT32_TO_LE)
 MONGOC_RPC_APPEND_IOVEC (uint32_t, uint32_t, BSON_UINT32_TO_LE)
 MONGOC_RPC_APPEND_IOVEC (int64_t, uint64_t, BSON_UINT64_TO_LE)
@@ -1008,7 +1010,7 @@ _append_iovec_data (mongoc_iovec_t *iove
    return _append_iovec (iovecs,
                          capacity,
                          count,
-                         (mongoc_iovec_t){
+                         (mongoc_iovec_t) {
                             .iov_base = (void *) data,
                             .iov_len = length,
                          });
@@ -1022,7 +1024,7 @@ _append_iovec_reserved_zero (mongoc_iove
    return _append_iovec (iovecs,
                          capacity,
                          count,
-                         (mongoc_iovec_t){
+                         (mongoc_iovec_t) {
                             .iov_base = (void *) &zero,
                             .iov_len = sizeof (zero),
                          });
@@ -1543,7 +1545,7 @@ mcd_rpc_message *
 mcd_rpc_message_new (void)
 {
    mcd_rpc_message *const rpc = bson_malloc (sizeof (mcd_rpc_message));
-   *rpc = (mcd_rpc_message){.msg_header = {0}};
+   *rpc = (mcd_rpc_message) {.msg_header = {0}};
    return rpc;
 }
 
@@ -1639,7 +1641,7 @@ mcd_rpc_message_reset (mcd_rpc_message *
 
    _mcd_rpc_message_free_owners (rpc);
 
-   *rpc = (mcd_rpc_message){.msg_header = {0}};
+   *rpc = (mcd_rpc_message) {.msg_header = {0}};
 }
 
 void
@@ -2419,8 +2421,8 @@ int32_t
 mcd_rpc_op_delete_get_flags (const mcd_rpc_message *rpc)
 {
    ASSERT_MCD_RPC_ACCESSOR_PRECONDITIONS;
-   return rpc->op_delete.flags;
    BSON_ASSERT (rpc->msg_header.op_code == MONGOC_OP_CODE_DELETE);
+   return rpc->op_delete.flags;
 }
 
 const void *
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mcd-time.h 2.1.0-1/src/libmongoc/src/mongoc/mcd-time.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mcd-time.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mcd-time.h	2025-08-14 18:37:23.000000000 +0000
@@ -37,9 +37,9 @@ typedef struct mcd_time_point {
 } mcd_time_point;
 
 /// The latest representable future point-in-time
-#define MCD_TIME_POINT_MAX ((mcd_time_point){._rep = INT64_MAX})
+#define MCD_TIME_POINT_MAX ((mcd_time_point) {._rep = INT64_MAX})
 /// The oldest representable past point-in-time
-#define MCD_TIME_POINT_MIN ((mcd_time_point){._rep = INT64_MIN})
+#define MCD_TIME_POINT_MIN ((mcd_time_point) {._rep = INT64_MIN})
 
 /**
  * @brief Represents a (possibly negative) duration of time.
@@ -56,11 +56,11 @@ typedef struct mcd_duration {
 } mcd_duration;
 
 /// The maximum representable duration
-#define MCD_DURATION_MAX ((mcd_duration){._rep = INT64_MAX})
+#define MCD_DURATION_MAX ((mcd_duration) {._rep = INT64_MAX})
 /// The minimal representable (negative) duration
-#define MCD_DURATION_MIN ((mcd_duration){._rep = INT64_MIN})
+#define MCD_DURATION_MIN ((mcd_duration) {._rep = INT64_MIN})
 /// A duration representing zero amount of time
-#define MCD_DURATION_ZERO ((mcd_duration){._rep = 0})
+#define MCD_DURATION_ZERO ((mcd_duration) {._rep = 0})
 
 /**
  * @brief Obtain the current time point. This is only an abstract
@@ -71,7 +71,7 @@ static BSON_INLINE mcd_time_point
 mcd_now (void)
 {
    // Create a time point representing the current time.
-   return (mcd_time_point){._rep = bson_get_monotonic_time ()};
+   return (mcd_time_point) {._rep = bson_get_monotonic_time ()};
 }
 
 /**
@@ -88,7 +88,7 @@ mcd_microseconds (int64_t s)
 {
    // 'mcd_duration' is encoded in a number of microseconds, so we don't need to
    // do bounds checking here.
-   return (mcd_duration){._rep = s};
+   return (mcd_duration) {._rep = s};
 }
 
 /**
@@ -305,7 +305,7 @@ typedef struct mcd_timer {
 static BSON_INLINE mcd_timer
 mcd_timer_expire_at (mcd_time_point time)
 {
-   return (mcd_timer){time};
+   return (mcd_timer) {time};
 }
 
 /**
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-aggregate-private.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-aggregate-private.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-aggregate-private.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-aggregate-private.h	2025-08-14 18:37:23.000000000 +0000
@@ -19,14 +19,14 @@
 #ifndef MONGOC_AGGREGATE_PRIVATE_H
 #define MONGOC_AGGREGATE_PRIVATE_H
 
-#include <bson/bson.h>
-
 #include <mongoc/mongoc-client.h>
 #include <mongoc/mongoc-flags.h>
 #include <mongoc/mongoc-read-concern.h>
 #include <mongoc/mongoc-read-prefs.h>
 #include <mongoc/mongoc-write-concern.h>
 
+#include <bson/bson.h>
+
 
 BSON_BEGIN_DECLS
 
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-aggregate.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-aggregate.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-aggregate.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-aggregate.c	2025-08-14 18:37:23.000000000 +0000
@@ -15,6 +15,7 @@
  */
 
 
+#include <common-bson-dsl-private.h>
 #include <mongoc/mongoc-aggregate-private.h>
 #include <mongoc/mongoc-client-private.h>
 #include <mongoc/mongoc-cursor-private.h>
@@ -24,8 +25,6 @@
 #include <mongoc/mongoc-trace-private.h>
 #include <mongoc/mongoc-util-private.h>
 
-#include <common-bson-dsl-private.h>
-
 /*--------------------------------------------------------------------------
  *
  * _has_write_key --
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-apm-private.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-apm-private.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-apm-private.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-apm-private.h	2025-08-14 18:37:23.000000000 +0000
@@ -19,9 +19,10 @@
 #ifndef MONGOC_APM_PRIVATE_H
 #define MONGOC_APM_PRIVATE_H
 
-#include <bson/bson.h>
 #include <mongoc/mongoc-apm.h>
 
+#include <bson/bson.h>
+
 BSON_BEGIN_DECLS
 
 /* forward decl */
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-apm.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-apm.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-apm.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-apm.c	2025-08-14 18:37:23.000000000 +0000
@@ -14,11 +14,11 @@
  * limitations under the License.
  */
 
-#include <mongoc/mongoc-util-private.h>
+#include <common-oid-private.h>
 #include <mongoc/mongoc-apm-private.h>
 #include <mongoc/mongoc-cmd-private.h>
 #include <mongoc/mongoc-handshake-private.h>
-#include <common-oid-private.h>
+#include <mongoc/mongoc-util-private.h>
 
 /*
  * An Application Performance Management (APM) implementation, complying with
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-apm.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-apm.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-apm.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-apm.h	2025-08-14 18:37:23.000000000 +0000
@@ -19,13 +19,13 @@
 #ifndef MONGOC_APM_H
 #define MONGOC_APM_H
 
-#include <bson/bson.h>
-
-#include <mongoc/mongoc-macros.h>
 #include <mongoc/mongoc-host-list.h>
+#include <mongoc/mongoc-macros.h>
 #include <mongoc/mongoc-server-description.h>
 #include <mongoc/mongoc-topology-description.h>
 
+#include <bson/bson.h>
+
 BSON_BEGIN_DECLS
 
 /*
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-async-cmd-private.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-async-cmd-private.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-async-cmd-private.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-async-cmd-private.h	2025-08-14 18:37:23.000000000 +0000
@@ -19,16 +19,17 @@
 #ifndef MONGOC_ASYNC_CMD_PRIVATE_H
 #define MONGOC_ASYNC_CMD_PRIVATE_H
 
-#include <bson/bson.h>
-
-#include <mongoc/mcd-rpc.h>
-#include <mongoc/mongoc-client.h>
-#include <mongoc/mongoc-async-private.h>
 #include <mongoc/mongoc-array-private.h>
+#include <mongoc/mongoc-async-private.h>
 #include <mongoc/mongoc-buffer-private.h>
 #include <mongoc/mongoc-cmd-private.h>
+
+#include <mongoc/mcd-rpc.h>
+#include <mongoc/mongoc-client.h>
 #include <mongoc/mongoc-stream.h>
 
+#include <bson/bson.h>
+
 BSON_BEGIN_DECLS
 
 typedef enum {
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-async-cmd.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-async-cmd.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-async-cmd.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-async-cmd.c	2025-08-14 18:37:23.000000000 +0000
@@ -15,21 +15,23 @@
  */
 
 
-#include <mlib/intencode.h>
-#include <bson/bson.h>
-
-#include <mongoc/mongoc-client.h>
 #include <mongoc/mongoc-async-cmd-private.h>
 #include <mongoc/mongoc-async-private.h>
 #include <mongoc/mongoc-cluster-private.h>
 #include <mongoc/mongoc-error-private.h>
-#include <mongoc/mongoc-opcode.h>
 #include <mongoc/mongoc-rpc-private.h>
-#include <mongoc/mongoc-stream-private.h>
 #include <mongoc/mongoc-server-description-private.h>
+#include <mongoc/mongoc-stream-private.h>
 #include <mongoc/mongoc-topology-scanner-private.h>
+
+#include <mongoc/mongoc-client.h>
+#include <mongoc/mongoc-opcode.h>
 #include <mongoc/utlist.h>
 
+#include <bson/bson.h>
+
+#include <mlib/intencode.h>
+
 #ifdef MONGOC_ENABLE_SSL
 #include <mongoc/mongoc-stream-tls.h>
 #endif
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-async-private.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-async-private.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-async-private.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-async-private.h	2025-08-14 18:37:23.000000000 +0000
@@ -19,9 +19,10 @@
 #ifndef MONGOC_ASYNC_PRIVATE_H
 #define MONGOC_ASYNC_PRIVATE_H
 
-#include <bson/bson.h>
 #include <mongoc/mongoc-stream.h>
 
+#include <bson/bson.h>
+
 BSON_BEGIN_DECLS
 
 struct _mongoc_async_cmd;
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-async.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-async.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-async.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-async.c	2025-08-14 18:37:23.000000000 +0000
@@ -15,16 +15,17 @@
  */
 
 
-#include <bson/bson.h>
-
-#include <mongoc/mongoc-async-private.h>
 #include <mongoc/mongoc-async-cmd-private.h>
-#include <mongoc/utlist.h>
-#include <mongoc/mongoc.h>
+#include <mongoc/mongoc-async-private.h>
 #include <mongoc/mongoc-error-private.h>
 #include <mongoc/mongoc-socket-private.h>
 #include <mongoc/mongoc-util-private.h>
 
+#include <mongoc/mongoc.h>
+#include <mongoc/utlist.h>
+
+#include <bson/bson.h>
+
 
 mongoc_async_t *
 mongoc_async_new (void)
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-buffer-private.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-buffer-private.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-buffer-private.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-buffer-private.h	2025-08-14 18:37:23.000000000 +0000
@@ -19,10 +19,10 @@
 #ifndef MONGOC_BUFFER_PRIVATE_H
 #define MONGOC_BUFFER_PRIVATE_H
 
-#include <bson/bson.h>
-
 #include <mongoc/mongoc-stream.h>
 
+#include <bson/bson.h>
+
 
 BSON_BEGIN_DECLS
 
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-buffer.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-buffer.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-buffer.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-buffer.c	2025-08-14 18:37:23.000000000 +0000
@@ -15,11 +15,12 @@
  */
 
 
-#include <bson/bson.h>
-
-#include <mongoc/mongoc-error-private.h>
 #include <mongoc/mongoc-buffer-private.h>
+#include <mongoc/mongoc-error-private.h>
 #include <mongoc/mongoc-trace-private.h>
+
+#include <bson/bson.h>
+
 #include <mlib/cmp.h>
 
 #include <stdarg.h>
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-bulk-operation-private.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-bulk-operation-private.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-bulk-operation-private.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-bulk-operation-private.h	2025-08-14 18:37:23.000000000 +0000
@@ -20,9 +20,10 @@
 #define MONGOC_BULK_OPERATION_PRIVATE_H
 
 #include <mongoc/mongoc-array-private.h>
-#include <mongoc/mongoc-client.h>
 #include <mongoc/mongoc-write-command-private.h>
 
+#include <mongoc/mongoc-client.h>
+
 
 BSON_BEGIN_DECLS
 
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-bulk-operation.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-bulk-operation.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-bulk-operation.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-bulk-operation.c	2025-08-14 18:37:23.000000000 +0000
@@ -16,14 +16,15 @@
 
 
 #include <mongoc/mongoc-bulk-operation.h>
+
 #include <mongoc/mongoc-bulk-operation-private.h>
 #include <mongoc/mongoc-client-private.h>
 #include <mongoc/mongoc-error-private.h>
+#include <mongoc/mongoc-opts-private.h>
 #include <mongoc/mongoc-trace-private.h>
-#include <mongoc/mongoc-write-concern-private.h>
 #include <mongoc/mongoc-util-private.h>
-#include <mongoc/mongoc-opts-private.h>
 #include <mongoc/mongoc-write-command-private.h>
+#include <mongoc/mongoc-write-concern-private.h>
 
 
 /*
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-bulk-operation.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-bulk-operation.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-bulk-operation.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-bulk-operation.h	2025-08-14 18:37:23.000000000 +0000
@@ -21,16 +21,13 @@
 #define MONGOC_BULK_OPERATION_H
 
 
-#include <bson/bson.h>
-
 #include <mongoc/mongoc-macros.h>
 #include <mongoc/mongoc-write-concern.h>
 
+#include <bson/bson.h>
+
 /* ordered, bypass_document_validation, has_collation, multi */
-#define MONGOC_BULK_WRITE_FLAGS_INIT \
-   {                                 \
-      true, false, 0                 \
-   }
+#define MONGOC_BULK_WRITE_FLAGS_INIT {true, false, 0}
 
 BSON_BEGIN_DECLS
 
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-bulkwrite.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-bulkwrite.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-bulkwrite.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-bulkwrite.c	2025-08-14 18:37:23.000000000 +0000
@@ -14,12 +14,9 @@
  * limitations under the License.
  */
 
-#include <mlib/intencode.h>
 #include <mongoc/mongoc-bulkwrite.h>
 
-#include <bson/bson.h>
 #include <common-macros-private.h> // MC_ENABLE_CONVERSION_WARNING_BEGIN
-#include <mongoc/mcd-nsinfo.h>
 #include <mongoc/mongoc-array-private.h>
 #include <mongoc/mongoc-buffer-private.h>
 #include <mongoc/mongoc-client-private.h>
@@ -27,8 +24,14 @@
 #include <mongoc/mongoc-error-private.h>
 #include <mongoc/mongoc-server-stream-private.h>
 #include <mongoc/mongoc-util-private.h> // _mongoc_iter_document_as_bson
+
+#include <mongoc/mcd-nsinfo.h>
 #include <mongoc/mongoc-optional.h>
+
+#include <bson/bson.h>
+
 #include <mlib/cmp.h>
+#include <mlib/intencode.h>
 
 MC_ENABLE_CONVERSION_WARNING_BEGIN
 
@@ -60,7 +63,7 @@ set_bson_value_opt (bson_value_t *dst, c
 {
    BSON_ASSERT_PARAM (dst);
    bson_value_destroy (dst);
-   *dst = (bson_value_t){0};
+   *dst = (bson_value_t) {0};
    if (src) {
       bson_value_copy (src, dst);
    }
@@ -236,7 +239,7 @@ bool
 mongoc_bulkwrite_append_insertone (mongoc_bulkwrite_t *self,
                                    const char *ns,
                                    const bson_t *document,
-                                   BSON_MAYBE_UNUSED const mongoc_bulkwrite_insertoneopts_t *opts, // may be NULL
+                                   const mongoc_bulkwrite_insertoneopts_t *opts, // may be NULL
                                    bson_error_t *error)
 {
    BSON_ASSERT_PARAM (self);
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-change-stream-private.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-change-stream-private.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-change-stream-private.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-change-stream-private.h	2025-08-14 18:37:23.000000000 +0000
@@ -19,12 +19,13 @@
 #ifndef MONGOC_CHANGE_STREAM_PRIVATE_H
 #define MONGOC_CHANGE_STREAM_PRIVATE_H
 
+#include <mongoc/mongoc-opts-helpers-private.h>
+#include <mongoc/mongoc-opts-private.h>
+
 #include <mongoc/mongoc-change-stream.h>
 #include <mongoc/mongoc-client-session.h>
 #include <mongoc/mongoc-collection.h>
 #include <mongoc/mongoc-cursor.h>
-#include <mongoc/mongoc-opts-private.h>
-#include <mongoc/mongoc-opts-helpers-private.h>
 
 typedef enum {
    MONGOC_CHANGE_STREAM_COLLECTION,
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-change-stream.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-change-stream.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-change-stream.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-change-stream.c	2025-08-14 18:37:23.000000000 +0000
@@ -14,16 +14,17 @@
  * limitations under the License.
  */
 
-#include <bson/bson.h>
-#include <mongoc/mongoc-cluster-private.h>
 #include <mongoc/mongoc-change-stream-private.h>
-#include <mongoc/mongoc-collection-private.h>
 #include <mongoc/mongoc-client-private.h>
 #include <mongoc/mongoc-client-session-private.h>
+#include <mongoc/mongoc-cluster-private.h>
+#include <mongoc/mongoc-collection-private.h>
 #include <mongoc/mongoc-cursor-private.h>
 #include <mongoc/mongoc-database-private.h>
 #include <mongoc/mongoc-error-private.h>
 
+#include <bson/bson.h>
+
 #define CHANGE_STREAM_ERR(_str) \
    _mongoc_set_error (&stream->err, MONGOC_ERROR_CURSOR, MONGOC_ERROR_BSON, "Could not set " _str)
 
@@ -140,7 +141,7 @@ _make_command (mongoc_change_stream_t *s
             /* The driver MUST set resumeAfter to the cached resumeToken */
             BSON_APPEND_DOCUMENT (&change_stream_doc, "resumeAfter", &stream->resume_token);
          }
-      } else if (!_mongoc_timestamp_empty (&stream->operation_time) && stream->max_wire_version >= WIRE_VERSION_4_0) {
+      } else if (!_mongoc_timestamp_empty (&stream->operation_time)) {
          /* Else if there is no cached resumeToken and the ChangeStream
             has a saved operation time and the max wire version is >= 7,
             the driver MUST set startAtOperationTime */
@@ -330,8 +331,7 @@ _make_cursor (mongoc_change_stream_t *st
 
    /* Change stream spec: startAtOperationTime */
    if (bson_empty (&stream->opts.resumeAfter) && bson_empty (&stream->opts.startAfter) &&
-       _mongoc_timestamp_empty (&stream->operation_time) && stream->max_wire_version >= WIRE_VERSION_4_0 &&
-       bson_empty (&stream->resume_token) &&
+       _mongoc_timestamp_empty (&stream->operation_time) && bson_empty (&stream->resume_token) &&
        bson_iter_init_find (&iter, _mongoc_cursor_change_stream_get_reply (stream->cursor), "operationTime") &&
        BSON_ITER_HOLDS_TIMESTAMP (&iter)) {
       _mongoc_timestamp_set_from_bson (&stream->operation_time, &iter);
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-change-stream.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-change-stream.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-change-stream.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-change-stream.h	2025-08-14 18:37:23.000000000 +0000
@@ -19,10 +19,10 @@
 #ifndef MONGOC_CHANGE_STREAM_H
 #define MONGOC_CHANGE_STREAM_H
 
-#include <bson/bson.h>
-
 #include <mongoc/mongoc-macros.h>
 
+#include <bson/bson.h>
+
 BSON_BEGIN_DECLS
 
 typedef struct _mongoc_change_stream_t mongoc_change_stream_t;
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-client-pool-private.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-client-pool-private.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-client-pool-private.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-client-pool-private.h	2025-08-14 18:37:23.000000000 +0000
@@ -19,11 +19,12 @@
 #ifndef MONGOC_CLIENT_POOL_PRIVATE_H
 #define MONGOC_CLIENT_POOL_PRIVATE_H
 
-#include <bson/bson.h>
+#include <mongoc/mongoc-topology-private.h>
 
 #include <mongoc/mongoc-client-pool.h>
 #include <mongoc/mongoc-topology-description.h>
-#include <mongoc/mongoc-topology-private.h>
+
+#include <bson/bson.h>
 
 BSON_BEGIN_DECLS
 
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-client-pool.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-client-pool.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-client-pool.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-client-pool.c	2025-08-14 18:37:23.000000000 +0000
@@ -15,22 +15,24 @@
  */
 
 
-#include <mongoc/mongoc.h>
+#include <mongoc/mongoc-client-pool.h>
+
 #include <mongoc/mongoc-apm-private.h>
 #include <mongoc/mongoc-array-private.h>
-#include <mongoc/mongoc-counters-private.h>
 #include <mongoc/mongoc-client-pool-private.h>
-#include <mongoc/mongoc-client-pool.h>
 #include <mongoc/mongoc-client-private.h>
 #include <mongoc/mongoc-client-side-encryption-private.h>
+#include <mongoc/mongoc-counters-private.h>
 #include <mongoc/mongoc-error-private.h>
 #include <mongoc/mongoc-log-and-monitor-private.h>
 #include <mongoc/mongoc-queue-private.h>
 #include <mongoc/mongoc-thread-private.h>
-#include <mongoc/mongoc-topology-private.h>
 #include <mongoc/mongoc-topology-background-monitoring-private.h>
+#include <mongoc/mongoc-topology-private.h>
 #include <mongoc/mongoc-trace-private.h>
 
+#include <mongoc/mongoc.h>
+
 #ifdef MONGOC_ENABLE_SSL
 #include <mongoc/mongoc-ssl-private.h>
 #endif
@@ -39,6 +41,10 @@
 #include <mongoc/mongoc-openssl-private.h>
 #endif
 
+#if defined(MONGOC_ENABLE_SSL_SECURE_CHANNEL)
+#include <mongoc/mongoc-stream-tls-secure-channel-private.h>
+#endif
+
 struct _mongoc_client_pool_t {
    bson_mutex_t mutex;
    mongoc_cond_t cond;
@@ -83,6 +89,13 @@ mongoc_client_pool_set_ssl_opts (mongoc_
 #if defined(MONGOC_ENABLE_SSL_OPENSSL) && OPENSSL_VERSION_NUMBER >= 0x10100000L
       SSL_CTX_free (pool->topology->scanner->openssl_ctx);
       pool->topology->scanner->openssl_ctx = _mongoc_openssl_ctx_new (&pool->ssl_opts);
+#elif defined(MONGOC_ENABLE_SSL_SECURE_CHANNEL)
+      // Access to secure_channel_cred_ptr does not need the thread-safe `mongoc_atomic_*` functions.
+      // secure_channel_cred_ptr is not expected to be modified by multiple threads.
+      // mongoc_client_pool_set_ssl_opts documentation prohibits calling after threads start.
+      mongoc_shared_ptr_reset (&pool->topology->scanner->secure_channel_cred_ptr,
+                               mongoc_secure_channel_cred_new (&pool->ssl_opts),
+                               mongoc_secure_channel_cred_deleter);
 #endif
    }
 
@@ -122,6 +135,11 @@ mongoc_client_pool_new (const mongoc_uri
 }
 
 
+// Defined in mongoc-init.c.
+extern bool
+mongoc_get_init_called (void);
+
+
 mongoc_client_pool_t *
 mongoc_client_pool_new_with_error (const mongoc_uri_t *uri, bson_error_t *error)
 {
@@ -136,7 +154,6 @@ mongoc_client_pool_new_with_error (const
 
    BSON_ASSERT (uri);
 
-   extern bool mongoc_get_init_called (void);
    if (!mongoc_get_init_called ()) {
       _mongoc_set_error (error,
                          MONGOC_ERROR_CLIENT,
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-client-pool.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-client-pool.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-client-pool.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-client-pool.h	2025-08-14 18:37:23.000000000 +0000
@@ -19,12 +19,12 @@
 #ifndef MONGOC_CLIENT_POOL_H
 #define MONGOC_CLIENT_POOL_H
 
-#include <bson/bson.h>
-
-#include <mongoc/mongoc-macros.h>
 #include <mongoc/mongoc-apm.h>
 #include <mongoc/mongoc-client.h>
 #include <mongoc/mongoc-config.h>
+#include <mongoc/mongoc-macros.h>
+
+#include <bson/bson.h>
 #ifdef MONGOC_ENABLE_SSL
 #include <mongoc/mongoc-ssl.h>
 #endif
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-client-private.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-client-private.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-client-private.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-client-private.h	2025-08-14 18:37:23.000000000 +0000
@@ -19,30 +19,31 @@
 #ifndef MONGOC_CLIENT_PRIVATE_H
 #define MONGOC_CLIENT_PRIVATE_H
 
-#include <bson/bson.h>
-
 #include <mongoc/mongoc-apm-private.h>
 #include <mongoc/mongoc-buffer-private.h>
-#include <mongoc/mongoc-client.h>
 #include <mongoc/mongoc-cluster-private.h>
+#include <mongoc/mongoc-rpc-private.h>
+
+#include <mongoc/mongoc-client.h>
 #include <mongoc/mongoc-config.h>
 #include <mongoc/mongoc-host-list.h>
-#include <mongoc/mongoc-read-prefs.h>
-#include <mongoc/mongoc-rpc-private.h>
 #include <mongoc/mongoc-opcode.h>
+#include <mongoc/mongoc-read-prefs.h>
+
+#include <bson/bson.h>
 #ifdef MONGOC_ENABLE_SSL
 #include <mongoc/mongoc-ssl.h>
 #endif
 
-#include <mongoc/mongoc-stream.h>
+#include <mongoc/mongoc-crypt-private.h>
+#include <mongoc/mongoc-shared-private.h>
 #include <mongoc/mongoc-topology-private.h>
+
+#include <mongoc/mongoc-stream.h>
 #include <mongoc/mongoc-write-concern.h>
-#include <mongoc/mongoc-crypt-private.h>
 
 BSON_BEGIN_DECLS
 
-/* version corresponding to server 4.0 release */
-#define WIRE_VERSION_4_0 7
 /* first version to support hint for "update" command */
 #define WIRE_VERSION_UPDATE_HINT 8
 /* version corresponding to server 4.2 release */
@@ -83,7 +84,7 @@ BSON_BEGIN_DECLS
 /* Range of wire protocol versions this driver supports. Bumping
  * WIRE_VERSION_MAX must be accompanied by an update to
  * `_mongoc_wire_version_to_server_version`. */
-#define WIRE_VERSION_MIN WIRE_VERSION_4_0 /* a.k.a. minWireVersion */
+#define WIRE_VERSION_MIN WIRE_VERSION_4_2 /* a.k.a. minWireVersion */
 #define WIRE_VERSION_MAX WIRE_VERSION_8_0 /* a.k.a. maxWireVersion */
 
 struct _mongoc_collection_t;
@@ -168,7 +169,6 @@ void
 _mongoc_client_kill_cursor (mongoc_client_t *client,
                             uint32_t server_id,
                             int64_t cursor_id,
-                            int64_t operation_id,
                             const char *db,
                             const char *collection,
                             mongoc_client_session_t *cs);
@@ -209,12 +209,12 @@ mongoc_stream_t *
 mongoc_client_connect_tcp (int32_t connecttimeoutms, const mongoc_host_list_t *host, bson_error_t *error);
 
 mongoc_stream_t *
-mongoc_client_connect (bool buffered,
-                       bool use_ssl,
+mongoc_client_connect (bool use_ssl,
                        void *ssl_opts_void,
                        const mongoc_uri_t *uri,
                        const mongoc_host_list_t *host,
                        void *openssl_ctx_void,
+                       mongoc_shared_ptr secure_channel_cred_ptr,
                        bson_error_t *error);
 
 
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-client-session-private.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-client-session-private.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-client-session-private.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-client-session-private.h	2025-08-14 18:37:23.000000000 +0000
@@ -19,9 +19,10 @@
 #ifndef MONGOC_CLIENT_SESSION_PRIVATE_H
 #define MONGOC_CLIENT_SESSION_PRIVATE_H
 
-#include <bson/bson.h>
 #include <mongoc/mongoc-client-session.h>
 
+#include <bson/bson.h>
+
 /* error labels: see Transactions Spec */
 #define TRANSIENT_TXN_ERR "TransientTransactionError"
 #define UNKNOWN_COMMIT_RESULT "UnknownTransactionCommitResult"
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-client-session.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-client-session.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-client-session.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-client-session.c	2025-08-14 18:37:23.000000000 +0000
@@ -15,17 +15,16 @@
  */
 
 
+#include <common-bson-dsl-private.h>
+#include <mongoc/mongoc-client-private.h>
 #include <mongoc/mongoc-client-session-private.h>
 #include <mongoc/mongoc-cluster-private.h>
-#include <mongoc/mongoc-trace-private.h>
-#include <mongoc/mongoc-client-private.h>
+#include <mongoc/mongoc-error-private.h>
 #include <mongoc/mongoc-rand-private.h>
-#include <mongoc/mongoc-util-private.h>
 #include <mongoc/mongoc-read-concern-private.h>
 #include <mongoc/mongoc-read-prefs-private.h>
-#include <mongoc/mongoc-error-private.h>
-
-#include <common-bson-dsl-private.h>
+#include <mongoc/mongoc-trace-private.h>
+#include <mongoc/mongoc-util-private.h>
 
 #define WITH_TXN_TIMEOUT_MS (120 * 1000)
 
@@ -241,7 +240,7 @@ retry:
        * actually apply the error label due to reply being NULL */
       _mongoc_client_session_unpin (session);
       if (reply) {
-         bsonBuildAppend (*reply, insert (reply_local, not(key ("errorLabels"))));
+         bsonBuildAppend (*reply, insert (reply_local, not (key ("errorLabels"))));
          _mongoc_error_copy_labels_and_upsert (&reply_local, reply, UNKNOWN_COMMIT_RESULT);
       }
    } else if (reply) {
@@ -886,7 +885,9 @@ _max_time_ms_failure (bson_t *reply)
       return true;
    }
 
-   bson_iter_init (&iter, reply);
+   if (!bson_iter_init (&iter, reply)) {
+      return false;
+   }
    if (bson_iter_find_descendant (&iter, "writeConcernError.codeName", &descendant) &&
        BSON_ITER_HOLDS_UTF8 (&descendant) && 0 == strcmp (bson_iter_utf8 (&descendant, NULL), MAX_TIME_MS_EXPIRED)) {
       return true;
@@ -1052,17 +1053,6 @@ mongoc_client_session_start_transaction
       ret = false;
       GOTO (done);
    }
-
-   if (server_stream->sd->max_wire_version < 7 ||
-       (server_stream->sd->max_wire_version < 8 && server_stream->sd->type == MONGOC_SERVER_MONGOS)) {
-      _mongoc_set_error (error,
-                         MONGOC_ERROR_TRANSACTION,
-                         MONGOC_ERROR_TRANSACTION_INVALID_STATE,
-                         "Multi-document transactions are not supported by this "
-                         "server version");
-      ret = false;
-      GOTO (done);
-   }
 
    /* use "switch" so that static checkers ensure we handle all states */
    switch (session->txn.state) {
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-client-session.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-client-session.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-client-session.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-client-session.h	2025-08-14 18:37:23.000000000 +0000
@@ -19,8 +19,9 @@
 #ifndef MONGOC_CLIENT_SESSION_H
 #define MONGOC_CLIENT_SESSION_H
 
-#include <bson/bson.h>
 #include <mongoc/mongoc-macros.h>
+
+#include <bson/bson.h>
 /* mongoc_client_session_t, mongoc_transaction_opt_t, and
    mongoc_session_opt_t are typedef'ed here */
 #include <mongoc/mongoc-client.h>
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-client-side-encryption-private.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-client-side-encryption-private.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-client-side-encryption-private.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-client-side-encryption-private.h	2025-08-14 18:37:23.000000000 +0000
@@ -19,11 +19,13 @@
 #ifndef MONGOC_CLIENT_SIDE_ENCRYPTION_PRIVATE_H
 #define MONGOC_CLIENT_SIDE_ENCRYPTION_PRIVATE_H
 
-#include <mongoc/mongoc-client.h>
-#include <mongoc/mongoc-client-pool.h>
-#include <mongoc/mongoc-client-side-encryption.h>
 #include <mongoc/mongoc-cmd-private.h>
 #include <mongoc/mongoc-topology-private.h>
+
+#include <mongoc/mongoc-client-pool.h>
+#include <mongoc/mongoc-client-side-encryption.h>
+#include <mongoc/mongoc-client.h>
+
 #include <bson/bson.h>
 
 /* cse is an abbreviation for "Client Side Encryption" */
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-client-side-encryption.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-client-side-encryption.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-client-side-encryption.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-client-side-encryption.c	2025-08-14 18:37:23.000000000 +0000
@@ -16,23 +16,24 @@
 
 #ifndef _WIN32
 #include <sys/wait.h>
+
 #include <signal.h>
 #endif
 
+#include <common-atomic-private.h>
 #include <common-bson-dsl-private.h>
-
-#include <mongoc/mongoc.h>
+#include <common-string-private.h>
 #include <mongoc/mongoc-client-private.h>
 #include <mongoc/mongoc-client-side-encryption-private.h>
+#include <mongoc/mongoc-database-private.h>
 #include <mongoc/mongoc-error-private.h>
 #include <mongoc/mongoc-host-list-private.h>
 #include <mongoc/mongoc-stream-private.h>
 #include <mongoc/mongoc-topology-private.h>
 #include <mongoc/mongoc-trace-private.h>
-#include <mongoc/mongoc-database-private.h>
 #include <mongoc/mongoc-util-private.h>
-#include <common-string-private.h>
-#include <common-atomic-private.h>
+
+#include <mongoc/mongoc.h>
 
 /*--------------------------------------------------------------------------
  * Auto Encryption options.
@@ -2872,7 +2873,7 @@ mongoc_client_encryption_create_encrypte
    bsonVisitEach (in_encryptedFields,
                   case (
                      // We only care about the "fields" array
-                     when (not(key ("fields")), appendTo (new_encryptedFields)),
+                     when (not (key ("fields")), appendTo (new_encryptedFields)),
                      // Automaticall fill in the "keyId" no each field:
                      else (storeDocRef (fields_ref), do ({
                               bson_t new_fields = BSON_INITIALIZER;
@@ -2895,7 +2896,7 @@ mongoc_client_encryption_create_encrypte
    // We've successfully filled out all null keyIds. Now create the collection
    // with our new options:
    bsonBuild (*opt_out_options,
-              insert (*in_options, not(key ("encryptedFields"))),
+              insert (*in_options, not (key ("encryptedFields"))),
               kv ("encryptedFields", bson (new_encryptedFields)));
    if (bsonBuildError) {
       // Error while building the new options.
@@ -2934,7 +2935,7 @@ _init_1_encryptedField (
    BSON_OPTIONAL_PARAM (error);
    bsonVisitEach (*in_field,
                   // If it is not a "keyId":null element, just copy it to the output.
-                  if (not(keyWithType ("keyId", null)), then (appendTo (*out_field), continue)),
+                  if (not (keyWithType ("keyId", null)), then (appendTo (*out_field), continue)),
                   // Otherwise:
                   do ({
                      // Set up factory context
@@ -2970,7 +2971,7 @@ _init_encryptedFields (
    bsonVisitEach (
       *in_fields,
       // Each field must be a document element
-      if (not(type (doc)), then (error ("Each 'encryptedFields' element must be a document"))),
+      if (not (type (doc)), then (error ("Each 'encryptedFields' element must be a document"))),
       // Append a new element with the same name as the field:
       storeDocRef (cur_field),
       append (*out_fields,
@@ -3000,7 +3001,7 @@ _mongoc_encryptedFields_fill_auto_datake
    BSON_ASSERT_PARAM (factory);
 
    if (error) {
-      *error = (bson_error_t){0};
+      *error = (bson_error_t) {0};
    }
    bson_init (out_fields);
 
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-client-side-encryption.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-client-side-encryption.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-client-side-encryption.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-client-side-encryption.h	2025-08-14 18:37:23.000000000 +0000
@@ -19,6 +19,8 @@
 #ifndef MONGOC_CLIENT_SIDE_ENCRYPTION_H
 #define MONGOC_CLIENT_SIDE_ENCRYPTION_H
 
+#include <mongoc/mongoc-macros.h>
+
 #include <bson/bson.h>
 
 /* Forward declare */
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-client.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-client.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-client.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-client.c	2025-08-14 18:37:23.000000000 +0000
@@ -14,55 +14,59 @@
  * limitations under the License.
  */
 
-#include <bson/bson.h>
 #include <mongoc/mongoc-config.h>
+
+#include <bson/bson.h>
 #ifdef MONGOC_HAVE_DNSAPI
 /* for DnsQuery_UTF8 */
-#include <Windows.h>
 #include <WinDNS.h>
+#include <Windows.h>
 #include <ws2tcpip.h>
 #else
 #if defined(MONGOC_HAVE_RES_NSEARCH) || defined(MONGOC_HAVE_RES_SEARCH)
+#include <arpa/nameser.h>
 #include <netdb.h>
 #include <netinet/in.h>
 #include <netinet/tcp.h>
-#include <arpa/nameser.h>
 #include <resolv.h>
 #endif
 #endif
 
+#include <mongoc/mongoc-change-stream-private.h>
 #include <mongoc/mongoc-client-private.h>
+#include <mongoc/mongoc-client-session-private.h>
 #include <mongoc/mongoc-client-side-encryption-private.h>
 #include <mongoc/mongoc-collection-private.h>
 #include <mongoc/mongoc-counters-private.h>
+#include <mongoc/mongoc-cursor-private.h>
 #include <mongoc/mongoc-database-private.h>
-#include <mongoc/mongoc-gridfs-private.h>
 #include <mongoc/mongoc-error-private.h>
-#include <mongoc/mongoc-log.h>
+#include <mongoc/mongoc-gridfs-private.h>
+#include <mongoc/mongoc-host-list-private.h>
 #include <mongoc/mongoc-queue-private.h>
-#include <mongoc/mongoc-socket.h>
-#include <mongoc/mongoc-stream-buffered.h>
-#include <mongoc/mongoc-stream-socket.h>
+#include <mongoc/mongoc-read-concern-private.h>
+#include <mongoc/mongoc-read-prefs-private.h>
+#include <mongoc/mongoc-set-private.h>
+#include <mongoc/mongoc-structured-log-private.h>
 #include <mongoc/mongoc-thread-private.h>
 #include <mongoc/mongoc-trace-private.h>
 #include <mongoc/mongoc-uri-private.h>
 #include <mongoc/mongoc-util-private.h>
-#include <mongoc/mongoc-set-private.h>
-#include <mongoc/mongoc-log.h>
 #include <mongoc/mongoc-write-concern-private.h>
-#include <mongoc/mongoc-read-concern-private.h>
-#include <mongoc/mongoc-host-list-private.h>
-#include <mongoc/mongoc-read-prefs-private.h>
-#include <mongoc/mongoc-change-stream-private.h>
-#include <mongoc/mongoc-client-session-private.h>
-#include <mongoc/mongoc-cursor-private.h>
-#include <mongoc/mongoc-structured-log-private.h>
+
+#include <mongoc/mongoc-log.h>
+#include <mongoc/mongoc-socket.h>
+#include <mongoc/mongoc-stream-buffered.h>
+#include <mongoc/mongoc-stream-socket.h>
+
+#include <mlib/str.h>
 
 #ifdef MONGOC_ENABLE_SSL
-#include <mongoc/mongoc-stream-tls.h>
-#include <mongoc/mongoc-ssl-private.h>
 #include <mongoc/mongoc-cmd-private.h>
 #include <mongoc/mongoc-opts-private.h>
+#include <mongoc/mongoc-ssl-private.h>
+
+#include <mongoc/mongoc-stream-tls.h>
 #endif
 
 #if defined(MONGOC_ENABLE_SSL_OPENSSL) && OPENSSL_VERSION_NUMBER >= 0x10100000L
@@ -70,7 +74,13 @@
 #include <mongoc/mongoc-stream-tls-private.h>
 #endif
 
+#if defined(MONGOC_ENABLE_SSL_SECURE_CHANNEL)
+#include <mongoc/mongoc-stream-tls-private.h>
+#include <mongoc/mongoc-stream-tls-secure-channel-private.h>
+#endif
+
 #include <common-string-private.h>
+
 #include <mlib/cmp.h>
 
 #include <inttypes.h>
@@ -108,13 +118,16 @@ typedef bool (*mongoc_rr_callback_t) (co
 static bool
 srv_callback (const char *hostname, PDNS_RECORD pdns, mongoc_rr_data_t *rr_data, bson_error_t *error)
 {
+   BSON_UNUSED (hostname);
+
    mongoc_host_list_t new_host;
 
    if (rr_data && rr_data->hosts) {
       _mongoc_host_list_remove_host (&(rr_data->hosts), pdns->Data.SRV.pNameTarget, pdns->Data.SRV.wPort);
    }
 
-   if (!_mongoc_host_list_from_hostport_with_err (&new_host, pdns->Data.SRV.pNameTarget, pdns->Data.SRV.wPort, error)) {
+   if (!_mongoc_host_list_from_hostport_with_err (
+          &new_host, mstr_cstring (pdns->Data.SRV.pNameTarget), pdns->Data.SRV.wPort, error)) {
       return false;
    }
    _mongoc_host_list_upsert (&rr_data->hosts, &new_host);
@@ -126,6 +139,9 @@ srv_callback (const char *hostname, PDNS
 static bool
 txt_callback (const char *hostname, PDNS_RECORD pdns, mongoc_rr_data_t *rr_data, bson_error_t *error)
 {
+   BSON_UNUSED (hostname);
+   BSON_UNUSED (error);
+
    DWORD i;
 
    mcommon_string_append_t txt;
@@ -306,7 +322,7 @@ srv_callback (const char *hostname, ns_m
       DNS_ERROR ("Invalid record in SRV answer for \"%s\": \"%s\"", hostname, _mongoc_hstrerror (h_errno));
    }
 
-   if (!_mongoc_host_list_from_hostport_with_err (&new_host, name, port, error)) {
+   if (!_mongoc_host_list_from_hostport_with_err (&new_host, mstr_cstring (name), port, error)) {
       GOTO (done);
    }
    _mongoc_host_list_upsert (&rr_data->hosts, &new_host);
@@ -559,6 +575,11 @@ _mongoc_client_get_rr (const char *hostn
    BSON_ASSERT (rr_data);
 
 #if MONGOC_ENABLE_SRV == 0
+   BSON_UNUSED (hostname);
+   BSON_UNUSED (rr_type);
+   BSON_UNUSED (rr_data);
+   BSON_UNUSED (initial_buffer_size);
+   BSON_UNUSED (prefer_tcp);
    // Disabled
    _mongoc_set_error (error,
                       MONGOC_ERROR_STREAM,
@@ -566,6 +587,8 @@ _mongoc_client_get_rr (const char *hostn
                       "libresolv unavailable, cannot use mongodb+srv URI");
    return false;
 #elif defined(MONGOC_HAVE_DNSAPI)
+   BSON_UNUSED (hostname);
+   BSON_UNUSED (initial_buffer_size);
    return _mongoc_get_rr_dnsapi (hostname, rr_type, rr_data, prefer_tcp, error);
 #elif (defined(MONGOC_HAVE_RES_NSEARCH) || defined(MONGOC_HAVE_RES_SEARCH))
    return _mongoc_get_rr_search (hostname, rr_type, rr_data, initial_buffer_size, prefer_tcp, error);
@@ -693,6 +716,7 @@ mongoc_client_connect_unix (const mongoc
 {
 #ifdef _WIN32
    ENTRY;
+   BSON_UNUSED (host);
    _mongoc_set_error (
       error, MONGOC_ERROR_STREAM, MONGOC_ERROR_STREAM_CONNECT, "UNIX domain sockets not supported on win32.");
    RETURN (NULL);
@@ -737,12 +761,12 @@ mongoc_client_connect_unix (const mongoc
 }
 
 mongoc_stream_t *
-mongoc_client_connect (bool buffered,
-                       bool use_ssl,
+mongoc_client_connect (bool use_ssl,
                        void *ssl_opts_void,
                        const mongoc_uri_t *uri,
                        const mongoc_host_list_t *host,
                        void *openssl_ctx_void,
+                       mongoc_shared_ptr secure_channel_cred_ptr,
                        bson_error_t *error)
 {
    mongoc_stream_t *base_stream = NULL;
@@ -751,6 +775,9 @@ mongoc_client_connect (bool buffered,
    BSON_ASSERT (uri);
    BSON_ASSERT (host);
 
+   BSON_UNUSED (openssl_ctx_void);
+   BSON_UNUSED (secure_channel_cred_ptr);
+
 #ifndef MONGOC_ENABLE_SSL
    if (ssl_opts_void || mongoc_uri_get_tls (uri)) {
       _mongoc_set_error (error,
@@ -799,6 +826,9 @@ mongoc_client_connect (bool buffered,
          // Use shared OpenSSL context.
          base_stream = mongoc_stream_tls_new_with_hostname_and_openssl_context (
             base_stream, host->host, ssl_opts, true, (SSL_CTX *) openssl_ctx_void);
+#elif defined(MONGOC_ENABLE_SSL_SECURE_CHANNEL)
+         // Use shared Secure Channel credentials.
+         base_stream = mongoc_stream_tls_new_with_secure_channel_cred (base_stream, ssl_opts, secure_channel_cred_ptr);
 #else
          base_stream = mongoc_stream_tls_new_with_hostname (base_stream, host->host, ssl_opts, true);
 #endif
@@ -820,9 +850,6 @@ mongoc_client_connect (bool buffered,
    if (!base_stream) {
       return NULL;
    }
-   if (buffered) {
-      return mongoc_stream_buffered_new (base_stream, 1024);
-   }
    return base_stream;
 }
 
@@ -866,9 +893,12 @@ mongoc_client_default_stream_initiator (
 
 #if defined(MONGOC_ENABLE_SSL_OPENSSL) && OPENSSL_VERSION_NUMBER >= 0x10100000L
    SSL_CTX *ssl_ctx = client->topology->scanner->openssl_ctx;
-   return mongoc_client_connect (true, use_ssl, ssl_opts_void, uri, host, (void *) ssl_ctx, error);
+   return mongoc_client_connect (use_ssl, ssl_opts_void, uri, host, (void *) ssl_ctx, MONGOC_SHARED_PTR_NULL, error);
+#elif defined(MONGOC_ENABLE_SSL_SECURE_CHANNEL)
+   return mongoc_client_connect (
+      use_ssl, ssl_opts_void, uri, host, NULL, client->topology->scanner->secure_channel_cred_ptr, error);
 #else
-   return mongoc_client_connect (true, use_ssl, ssl_opts_void, uri, host, NULL, error);
+   return mongoc_client_connect (use_ssl, ssl_opts_void, uri, host, NULL, MONGOC_SHARED_PTR_NULL, error);
 #endif
 }
 
@@ -1013,6 +1043,12 @@ _mongoc_client_set_ssl_opts_for_single_o
       SSL_CTX_free (client->topology->scanner->openssl_ctx);
       client->topology->scanner->openssl_ctx = _mongoc_openssl_ctx_new (&client->ssl_opts);
 #endif
+
+#if defined(MONGOC_ENABLE_SSL_SECURE_CHANNEL)
+      mongoc_shared_ptr_reset (&client->topology->scanner->secure_channel_cred_ptr,
+                               mongoc_secure_channel_cred_new (&client->ssl_opts),
+                               mongoc_secure_channel_cred_deleter);
+#endif
    }
 }
 #endif // MONGOC_ENABLE_SSL
@@ -1031,6 +1067,9 @@ mongoc_client_new_from_uri (const mongoc
    return client;
 }
 
+// Defined in mongoc-init.c.
+extern bool
+mongoc_get_init_called (void);
 
 mongoc_client_t *
 mongoc_client_new_from_uri_with_error (const mongoc_uri_t *uri, bson_error_t *error)
@@ -1043,7 +1082,6 @@ mongoc_client_new_from_uri_with_error (c
 
    BSON_ASSERT (uri);
 
-   extern bool mongoc_get_init_called (void);
    if (!mongoc_get_init_called ()) {
       _mongoc_set_error (error,
                          MONGOC_ERROR_CLIENT,
@@ -2101,7 +2139,6 @@ void
 _mongoc_client_kill_cursor (mongoc_client_t *client,
                             uint32_t server_id,
                             int64_t cursor_id,
-                            int64_t operation_id,
                             const char *db,
                             const char *collection,
                             mongoc_client_session_t *cs)
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-client.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-client.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-client.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-client.h	2025-08-14 18:37:23.000000000 +0000
@@ -19,8 +19,6 @@
 #ifndef MONGOC_CLIENT_H
 #define MONGOC_CLIENT_H
 
-#include <bson/bson.h>
-
 #include <mongoc/mongoc-apm.h>
 #include <mongoc/mongoc-client-side-encryption.h>
 #include <mongoc/mongoc-collection.h>
@@ -31,15 +29,17 @@
 #include <mongoc/mongoc-macros.h>
 #include <mongoc/mongoc-read-prefs.h>
 #include <mongoc/mongoc-server-api.h>
+
+#include <bson/bson.h>
 #ifdef MONGOC_ENABLE_SSL
 #include <mongoc/mongoc-ssl.h>
 #endif
+#include <mongoc/mongoc-read-concern.h>
+#include <mongoc/mongoc-server-description.h>
 #include <mongoc/mongoc-stream.h>
 #include <mongoc/mongoc-structured-log.h>
 #include <mongoc/mongoc-uri.h>
 #include <mongoc/mongoc-write-concern.h>
-#include <mongoc/mongoc-read-concern.h>
-#include <mongoc/mongoc-server-description.h>
 
 BSON_BEGIN_DECLS
 
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-cluster-aws-private.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-cluster-aws-private.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-cluster-aws-private.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-cluster-aws-private.h	2025-08-14 18:37:23.000000000 +0000
@@ -19,10 +19,12 @@
 #ifndef MONGOC_CLUSTER_AWS_PRIVATE_H
 #define MONGOC_CLUSTER_AWS_PRIVATE_H
 
-#include <bson/bson.h>
-#include <mongoc/mcd-time.h>
-#include <mongoc/mongoc-cluster-private.h>
 #include <common-thread-private.h> // bson_mutex_t
+#include <mongoc/mongoc-cluster-private.h>
+
+#include <mongoc/mcd-time.h>
+
+#include <bson/bson.h>
 
 bool
 _mongoc_cluster_auth_node_aws (mongoc_cluster_t *cluster,
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-cluster-aws.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-cluster-aws.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-cluster-aws.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-cluster-aws.c	2025-08-14 18:37:23.000000000 +0000
@@ -17,20 +17,20 @@
 /* All interaction with kms_message is limited to this file. */
 
 #include <common-b64-private.h>
-#include <mongoc/mcd-time.h>
-#include <mongoc/mongoc-cluster-aws-private.h>
+#include <common-string-private.h>
 #include <mongoc/mongoc-client-private.h>
+#include <mongoc/mongoc-cluster-aws-private.h>
 #include <mongoc/mongoc-error-private.h>
 #include <mongoc/mongoc-host-list-private.h>
+#include <mongoc/mongoc-http-private.h>
 #include <mongoc/mongoc-rand-private.h>
+#include <mongoc/mongoc-ssl-private.h>
 #include <mongoc/mongoc-stream-private.h>
 #include <mongoc/mongoc-trace-private.h>
 #include <mongoc/mongoc-uri-private.h>
 #include <mongoc/mongoc-util-private.h>
-#include <mongoc/mongoc-http-private.h>
-#include <mongoc/mongoc-rand-private.h>
-#include <mongoc/mongoc-ssl-private.h>
-#include <common-string-private.h>
+
+#include <mongoc/mcd-time.h>
 
 #undef MONGOC_LOG_DOMAIN
 #define MONGOC_LOG_DOMAIN "aws_auth"
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-cluster-cyrus-private.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-cluster-cyrus-private.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-cluster-cyrus-private.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-cluster-cyrus-private.h	2025-08-14 18:37:23.000000000 +0000
@@ -19,8 +19,10 @@
 #ifndef MONGOC_CLUSTER_CYRUS_PRIVATE_H
 #define MONGOC_CLUSTER_CYRUS_PRIVATE_H
 
-#include <mongoc/mongoc-config.h>
 #include <mongoc/mongoc-cluster-private.h>
+
+#include <mongoc/mongoc-config.h>
+
 #include <bson/bson.h>
 
 bool
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-cluster-cyrus.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-cluster-cyrus.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-cluster-cyrus.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-cluster-cyrus.c	2025-08-14 18:37:23.000000000 +0000
@@ -18,8 +18,8 @@
 
 #ifdef MONGOC_ENABLE_SASL_CYRUS
 #include <mongoc/mongoc-client-private.h>
-#include <mongoc/mongoc-cyrus-private.h>
 #include <mongoc/mongoc-cluster-cyrus-private.h>
+#include <mongoc/mongoc-cyrus-private.h>
 #include <mongoc/mongoc-error-private.h>
 #include <mongoc/mongoc-trace-private.h>
 
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-cluster-private.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-cluster-private.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-cluster-private.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-cluster-private.h	2025-08-14 18:37:23.000000000 +0000
@@ -19,26 +19,27 @@
 #ifndef MONGOC_CLUSTER_PRIVATE_H
 #define MONGOC_CLUSTER_PRIVATE_H
 
-#include <bson/bson.h>
-
-#include <mongoc/mcd-rpc.h>
 #include <mongoc/mongoc-array-private.h>
 #include <mongoc/mongoc-buffer-private.h>
-#include <mongoc/mongoc-config.h>
-#include <mongoc/mongoc-client.h>
+#include <mongoc/mongoc-cmd-private.h>
+#include <mongoc/mongoc-crypto-private.h>
+#include <mongoc/mongoc-deprioritized-servers-private.h>
 #include <mongoc/mongoc-list-private.h>
-#include <mongoc/mongoc-opcode.h>
 #include <mongoc/mongoc-rpc-private.h>
+#include <mongoc/mongoc-scram-private.h>
 #include <mongoc/mongoc-server-stream-private.h>
 #include <mongoc/mongoc-set-private.h>
-#include <mongoc/mongoc-stream.h>
-#include <mongoc/mongoc-topology-private.h>
 #include <mongoc/mongoc-topology-description-private.h>
+#include <mongoc/mongoc-topology-private.h>
+
+#include <mongoc/mcd-rpc.h>
+#include <mongoc/mongoc-client.h>
+#include <mongoc/mongoc-config.h>
+#include <mongoc/mongoc-opcode.h>
+#include <mongoc/mongoc-stream.h>
 #include <mongoc/mongoc-write-concern.h>
-#include <mongoc/mongoc-scram-private.h>
-#include <mongoc/mongoc-cmd-private.h>
-#include <mongoc/mongoc-crypto-private.h>
-#include <mongoc/mongoc-deprioritized-servers-private.h>
+
+#include <bson/bson.h>
 
 BSON_BEGIN_DECLS
 
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-cluster-sasl-private.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-cluster-sasl-private.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-cluster-sasl-private.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-cluster-sasl-private.h	2025-08-14 18:37:23.000000000 +0000
@@ -19,8 +19,10 @@
 #ifndef MONGOC_CLUSTER_SASL_PRIVATE_H
 #define MONGOC_CLUSTER_SASL_PRIVATE_H
 
-#include <mongoc/mongoc-config.h>
 #include <mongoc/mongoc-cluster-private.h>
+
+#include <mongoc/mongoc-config.h>
+
 #include <bson/bson.h>
 
 bool
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-cluster-sasl.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-cluster-sasl.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-cluster-sasl.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-cluster-sasl.c	2025-08-14 18:37:23.000000000 +0000
@@ -15,17 +15,18 @@
  */
 
 /* for size_t */
-#include <bson/bson.h>
-#include <mongoc/mongoc-config.h>
-
 #include <mongoc/mongoc-cluster-private.h>
-#include <mongoc/mongoc-log.h>
-#include <mongoc/mongoc-trace-private.h>
-#include <mongoc/mongoc-stream-private.h>
-#include <mongoc/mongoc-stream-socket.h>
 #include <mongoc/mongoc-error-private.h>
+#include <mongoc/mongoc-stream-private.h>
+#include <mongoc/mongoc-trace-private.h>
 #include <mongoc/mongoc-util-private.h>
 
+#include <mongoc/mongoc-config.h>
+#include <mongoc/mongoc-log.h>
+#include <mongoc/mongoc-stream-socket.h>
+
+#include <bson/bson.h>
+
 #ifdef MONGOC_ENABLE_SASL
 
 #ifdef MONGOC_ENABLE_SASL_CYRUS
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-cluster-sspi-private.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-cluster-sspi-private.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-cluster-sspi-private.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-cluster-sspi-private.h	2025-08-14 18:37:23.000000000 +0000
@@ -19,8 +19,10 @@
 #ifndef MONGOC_CLUSTER_SSPI_PRIVATE_H
 #define MONGOC_CLUSTER_SSPI_PRIVATE_H
 
-#include <mongoc/mongoc-config.h>
 #include <mongoc/mongoc-cluster-private.h>
+
+#include <mongoc/mongoc-config.h>
+
 #include <bson/bson.h>
 
 bool
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-cluster-sspi.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-cluster-sspi.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-cluster-sspi.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-cluster-sspi.c	2025-08-14 18:37:23.000000000 +0000
@@ -18,11 +18,11 @@
 
 #ifdef MONGOC_ENABLE_SASL_SSPI
 #include <mongoc/mongoc-client-private.h>
-#include <mongoc/mongoc-cluster-sspi-private.h>
 #include <mongoc/mongoc-cluster-sasl-private.h>
+#include <mongoc/mongoc-cluster-sspi-private.h>
+#include <mongoc/mongoc-error-private.h>
 #include <mongoc/mongoc-sasl-private.h>
 #include <mongoc/mongoc-sspi-private.h>
-#include <mongoc/mongoc-error-private.h>
 #include <mongoc/mongoc-util-private.h>
 
 
@@ -129,7 +129,7 @@ _mongoc_cluster_auth_node_sspi (mongoc_c
    uint32_t buflen;
    bson_t reply;
    const char *tmpstr;
-   int conv_id;
+   int conv_id = 0;
    bson_t cmd;
    int res = MONGOC_SSPI_AUTH_GSS_CONTINUE;
    int step;
@@ -174,6 +174,8 @@ _mongoc_cluster_auth_node_sspi (mongoc_c
       if (step == 0) {
          _mongoc_cluster_build_sasl_start (&cmd, "GSSAPI", state->response, (uint32_t) strlen (state->response));
       } else {
+         // `conv_id` is set during step 0 below by invoking `_mongoc_cluster_get_conversation_id` and guarded by `step
+         // > 0`.
          if (state->response) {
             _mongoc_cluster_build_sasl_continue (&cmd, conv_id, state->response, (uint32_t) strlen (state->response));
          } else {
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-cluster.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-cluster.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-cluster.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-cluster.c	2025-08-14 18:37:23.000000000 +0000
@@ -15,52 +15,54 @@
  */
 
 
-#include <mlib/intencode.h>
-#include <mongoc/mongoc-config.h>
-
-#include <string.h>
-
-#include <mongoc/mcd-rpc.h>
-#include <mongoc/mongoc-cluster-private.h>
 #include <mongoc/mongoc-client-private.h>
 #include <mongoc/mongoc-client-side-encryption-private.h>
+#include <mongoc/mongoc-cluster-private.h>
+#include <mongoc/mongoc-cluster-sasl-private.h>
 #include <mongoc/mongoc-counters-private.h>
-#include <mongoc/mongoc-config.h>
 #include <mongoc/mongoc-flags-private.h>
 #include <mongoc/mongoc-host-list-private.h>
+
+#include <mongoc/mcd-rpc.h>
+#include <mongoc/mongoc-config.h>
 #include <mongoc/mongoc-log.h>
-#include <mongoc/mongoc-cluster-sasl-private.h>
+
+#include <mlib/intencode.h>
+
+#include <string.h>
 #ifdef MONGOC_ENABLE_SSL
-#include <mongoc/mongoc-ssl.h>
 #include <mongoc/mongoc-ssl-private.h>
+
+#include <mongoc/mongoc-ssl.h>
 #include <mongoc/mongoc-stream-tls.h>
 #endif
 #include <common-b64-private.h>
+#include <common-bson-dsl-private.h>
+#include <common-oid-private.h>
+#include <mongoc/mongoc-cluster-aws-private.h>
+#include <mongoc/mongoc-cmd-private.h>
+#include <mongoc/mongoc-compression-private.h>
+#include <mongoc/mongoc-error-private.h>
+#include <mongoc/mongoc-handshake-private.h>
+#include <mongoc/mongoc-rpc-private.h>
 #include <mongoc/mongoc-scram-private.h>
 #include <mongoc/mongoc-set-private.h>
-#include <mongoc/mongoc-socket.h>
 #include <mongoc/mongoc-stream-private.h>
-#include <mongoc/mongoc-stream-socket.h>
-#include <mongoc/mongoc-stream-tls.h>
+#include <mongoc/mongoc-structured-log-private.h>
 #include <mongoc/mongoc-thread-private.h>
-#include <mongoc/mongoc-topology-private.h>
 #include <mongoc/mongoc-topology-background-monitoring-private.h>
+#include <mongoc/mongoc-topology-private.h>
 #include <mongoc/mongoc-trace-private.h>
+#include <mongoc/mongoc-uri-private.h>
 #include <mongoc/mongoc-util-private.h>
 #include <mongoc/mongoc-write-concern-private.h>
-#include <mongoc/mongoc-uri-private.h>
-#include <mongoc/mongoc-rpc-private.h>
-#include <mongoc/mongoc-compression-private.h>
-#include <mongoc/mongoc-cmd-private.h>
+
+#include <mongoc/mongoc-socket.h>
+#include <mongoc/mongoc-stream-socket.h>
+#include <mongoc/mongoc-stream-tls.h>
 #include <mongoc/utlist.h>
-#include <mongoc/mongoc-handshake-private.h>
-#include <mongoc/mongoc-cluster-aws-private.h>
-#include <mongoc/mongoc-error-private.h>
-#include <mongoc/mongoc-structured-log-private.h>
 
-#include <common-bson-dsl-private.h>
 #include <mlib/cmp.h>
-#include <common-oid-private.h>
 
 #include <inttypes.h>
 
@@ -104,7 +106,6 @@ _handle_not_primary_error (mongoc_cluste
                                           MONGOC_SDAM_APP_ERROR_COMMAND,
                                           reply,
                                           NULL,
-                                          server_stream->sd->max_wire_version,
                                           server_stream->sd->generation,
                                           &server_stream->sd->service_id)) {
       mongoc_cluster_disconnect_node (cluster, server_id);
@@ -136,7 +137,6 @@ _handle_network_error (mongoc_cluster_t
                                       type,
                                       NULL,
                                       why,
-                                      server_stream->sd->max_wire_version,
                                       server_stream->sd->generation,
                                       &server_stream->sd->service_id);
    /* Always disconnect the current connection on network error. */
@@ -495,7 +495,6 @@ mongoc_cluster_run_command_monitored (mo
    int64_t started = bson_get_monotonic_time ();
    const mongoc_server_stream_t *server_stream;
    bson_t reply_local;
-   bson_error_t error_local;
    bson_iter_t iter;
    bson_t encrypted = BSON_INITIALIZER;
    bson_t decrypted = BSON_INITIALIZER;
@@ -510,9 +509,7 @@ mongoc_cluster_run_command_monitored (mo
    if (!reply) {
       reply = &reply_local;
    }
-   if (!error) {
-      error = &error_local;
-   }
+   bson_error_reset (error);
 
    if (_mongoc_cse_is_enabled (cluster->client)) {
       bson_destroy (&encrypted);
@@ -1639,7 +1636,7 @@ _mongoc_cluster_auth_node (mongoc_cluste
 
    if (!ret) {
       mongoc_counter_auth_failure_inc ();
-      MONGOC_DEBUG ("Authentication failed: %s", error->message);
+      MONGOC_ERROR ("Authentication failed: %s", error->message);
    } else {
       mongoc_counter_auth_success_inc ();
       TRACE ("%s", "Authentication succeeded");
@@ -2361,7 +2358,7 @@ mongoc_cluster_init (mongoc_cluster_t *c
 
    _mongoc_array_init (&cluster->iov, sizeof (mongoc_iovec_t));
 
-   cluster->operation_id = rand ();
+   cluster->operation_id = _mongoc_simple_rand_uint64_t ();
 
    EXIT;
 }
@@ -3356,9 +3353,6 @@ mcd_rpc_message_compress (mcd_rpc_messag
 
    const int32_t original_message_length = mcd_rpc_header_get_message_length (rpc);
 
-   // msgHeader consists of four int32 fields.
-   const int32_t message_header_length = 4u * sizeof (int32_t);
-
    // compressedMessage does not include msgHeader fields.
    BSON_ASSERT (original_message_length >= message_header_length);
    const size_t uncompressed_size = (size_t) (original_message_length - message_header_length);
@@ -3444,9 +3438,6 @@ mcd_rpc_message_decompress (mcd_rpc_mess
 
    BSON_ASSERT (mcd_rpc_header_get_op_code (rpc) == MONGOC_OP_CODE_COMPRESSED);
 
-   // msgHeader consists of four int32 fields.
-   const size_t message_header_length = 4u * sizeof (int32_t);
-
    const int32_t uncompressed_size_raw = mcd_rpc_op_compressed_get_uncompressed_size (rpc);
 
    // Malformed message: invalid uncompressedSize.
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-cmd-private.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-cmd-private.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-cmd-private.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-cmd-private.h	2025-08-14 18:37:23.000000000 +0000
@@ -27,13 +27,14 @@
 #ifndef MONGOC_CMD_PRIVATE_H
 #define MONGOC_CMD_PRIVATE_H
 
-#include <bson/bson.h>
-
-#include <mongoc/mongoc-server-api.h>
+#include <mongoc/mongoc-opts-private.h>
 #include <mongoc/mongoc-server-stream-private.h>
+
 #include <mongoc/mongoc-read-prefs.h>
+#include <mongoc/mongoc-server-api.h>
 #include <mongoc/mongoc.h>
-#include <mongoc/mongoc-opts-private.h>
+
+#include <bson/bson.h>
 
 BSON_BEGIN_DECLS
 
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-cmd.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-cmd.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-cmd.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-cmd.c	2025-08-14 18:37:23.000000000 +0000
@@ -15,15 +15,16 @@
  */
 
 
-#include <mlib/intencode.h>
-#include <mongoc/mongoc-cmd-private.h>
-#include <mongoc/mongoc-read-prefs-private.h>
-#include <mongoc/mongoc-trace-private.h>
 #include <mongoc/mongoc-client-private.h>
+#include <mongoc/mongoc-cmd-private.h>
 #include <mongoc/mongoc-error-private.h>
 #include <mongoc/mongoc-read-concern-private.h>
+#include <mongoc/mongoc-read-prefs-private.h>
 #include <mongoc/mongoc-server-api-private.h>
+#include <mongoc/mongoc-trace-private.h>
 #include <mongoc/mongoc-write-concern-private.h>
+
+#include <mlib/intencode.h>
 /* For strcasecmp on Windows */
 #include <mongoc/mongoc-util-private.h>
 
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-collection-private.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-collection-private.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-collection-private.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-collection-private.h	2025-08-14 18:37:23.000000000 +0000
@@ -19,10 +19,10 @@
 #ifndef MONGOC_COLLECTION_PRIVATE_H
 #define MONGOC_COLLECTION_PRIVATE_H
 
-#include <bson/bson.h>
-
 #include <mongoc/mongoc-client.h>
 
+#include <bson/bson.h>
+
 BSON_BEGIN_DECLS
 
 
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-collection.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-collection.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-collection.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-collection.c	2025-08-14 18:37:23.000000000 +0000
@@ -15,34 +15,35 @@
  */
 
 
-#include <stdio.h>
+#include <mongoc/mongoc-collection.h>
 
-#include <bson/bson.h>
+#include <common-bson-dsl-private.h>
+#include <common-macros-private.h> // BEGIN_IGNORE_DEPRECATIONS
+#include <common-string-private.h>
 #include <mongoc/mongoc-aggregate-private.h>
-#include <mongoc/mongoc-bulk-operation.h>
 #include <mongoc/mongoc-bulk-operation-private.h>
 #include <mongoc/mongoc-change-stream-private.h>
 #include <mongoc/mongoc-client-private.h>
-#include <mongoc/mongoc-find-and-modify-private.h>
-#include <mongoc/mongoc-find-and-modify.h>
-#include <mongoc/mongoc-collection.h>
 #include <mongoc/mongoc-collection-private.h>
 #include <mongoc/mongoc-cursor-private.h>
-#include <mongoc/mongoc-log.h>
-#include <mongoc/mongoc-trace-private.h>
+#include <mongoc/mongoc-database-private.h>
+#include <mongoc/mongoc-error-private.h>
+#include <mongoc/mongoc-find-and-modify-private.h>
+#include <mongoc/mongoc-opts-private.h>
 #include <mongoc/mongoc-read-concern-private.h>
-#include <mongoc/mongoc-write-concern-private.h>
 #include <mongoc/mongoc-read-prefs-private.h>
+#include <mongoc/mongoc-trace-private.h>
 #include <mongoc/mongoc-util-private.h>
 #include <mongoc/mongoc-write-command-private.h>
-#include <mongoc/mongoc-opts-private.h>
-#include <mongoc/mongoc-write-command-private.h>
-#include <mongoc/mongoc-error-private.h>
-#include <mongoc/mongoc-database-private.h>
-#include <common-macros-private.h> // BEGIN_IGNORE_DEPRECATIONS
+#include <mongoc/mongoc-write-concern-private.h>
 
-#include <common-bson-dsl-private.h>
-#include <common-string-private.h>
+#include <mongoc/mongoc-bulk-operation.h>
+#include <mongoc/mongoc-find-and-modify.h>
+#include <mongoc/mongoc-log.h>
+
+#include <bson/bson.h>
+
+#include <stdio.h>
 
 #undef MONGOC_LOG_DOMAIN
 #define MONGOC_LOG_DOMAIN "collection"
@@ -621,7 +622,7 @@ mongoc_collection_count_documents (mongo
    _make_aggregate_for_count (coll, filter, &cd_opts, &aggregate_cmd);
    bson_init (&aggregate_opts);
    if (opts) {
-      bsonBuildAppend (aggregate_opts, insert (*opts, not(key ("skip", "limit"))));
+      bsonBuildAppend (aggregate_opts, insert (*opts, not (key ("skip", "limit"))));
    }
 
    ret =
@@ -727,13 +728,7 @@ drop_with_opts_with_encryptedFields (mon
    mongoc_collection_t *ecocCollection = NULL;
    bool ok = false;
    const char *name = mongoc_collection_get_name (collection);
-   bson_error_t local_error = {0};
-
-   if (!error) {
-      /* If no error is passed, use a local error. Error codes are checked
-       * when collections are dropped. */
-      error = &local_error;
-   }
+   bson_error_reset (error);
 
    /* Drop ESC collection. */
    escName = _mongoc_get_encryptedField_state_collection (encryptedFields, name, "esc", error);
@@ -823,7 +818,7 @@ mongoc_collection_drop_with_opts (mongoc
 
    // We've found the encryptedFields, so we need to do something different
    // to drop this collection:
-   bsonBuildAppend (opts_without_encryptedFields, if (opts, then (insert (*opts, not(key ("encryptedFields"))))));
+   bsonBuildAppend (opts_without_encryptedFields, if (opts, then (insert (*opts, not (key ("encryptedFields"))))));
    if (bsonBuildError) {
       _mongoc_set_error (
          error, MONGOC_ERROR_BSON, MONGOC_ERROR_BSON_INVALID, "Error while updating drop options: %s", bsonBuildError);
@@ -942,8 +937,12 @@ _mongoc_collection_index_keys_equal (con
    bson_iter_t iter_expected;
    bson_iter_t iter_actual;
 
-   bson_iter_init (&iter_expected, expected);
-   bson_iter_init (&iter_actual, actual);
+   if (!bson_iter_init (&iter_expected, expected)) {
+      return false;
+   }
+   if (!bson_iter_init (&iter_actual, actual)) {
+      return false;
+   }
 
    while (bson_iter_next (&iter_expected)) {
       /* If the key document has fewer items than expected, indexes are unequal
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-collection.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-collection.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-collection.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-collection.h	2025-08-14 18:37:23.000000000 +0000
@@ -19,17 +19,17 @@
 #ifndef MONGOC_COLLECTION_H
 #define MONGOC_COLLECTION_H
 
-#include <bson/bson.h>
-
-#include <mongoc/mongoc-change-stream.h>
-#include <mongoc/mongoc-macros.h>
 #include <mongoc/mongoc-bulk-operation.h>
-#include <mongoc/mongoc-flags.h>
+#include <mongoc/mongoc-change-stream.h>
 #include <mongoc/mongoc-cursor.h>
-#include <mongoc/mongoc-read-prefs.h>
+#include <mongoc/mongoc-find-and-modify.h>
+#include <mongoc/mongoc-flags.h>
+#include <mongoc/mongoc-macros.h>
 #include <mongoc/mongoc-read-concern.h>
+#include <mongoc/mongoc-read-prefs.h>
 #include <mongoc/mongoc-write-concern.h>
-#include <mongoc/mongoc-find-and-modify.h>
+
+#include <bson/bson.h>
 
 BSON_BEGIN_DECLS
 
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-compression-private.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-compression-private.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-compression-private.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-compression-private.h	2025-08-14 18:37:23.000000000 +0000
@@ -22,6 +22,8 @@
 
 #include <bson/bson.h>
 
+#include <mlib/str.h>
+
 /* Compressor IDs */
 #define MONGOC_COMPRESSOR_NOOP_ID 0
 #define MONGOC_COMPRESSOR_NOOP_STR "noop"
@@ -43,7 +45,7 @@ size_t
 mongoc_compressor_max_compressed_length (int32_t compressor_id, size_t size);
 
 bool
-mongoc_compressor_supported (const char *compressor);
+mongoc_compressor_supported (mstr_view compressor);
 
 const char *
 mongoc_compressor_id_to_name (int32_t compressor_id);
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-compression.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-compression.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-compression.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-compression.c	2025-08-14 18:37:23.000000000 +0000
@@ -15,11 +15,12 @@
  */
 
 
-#include <mongoc/mongoc-config.h>
-
 #include <mongoc/mongoc-compression-private.h>
 #include <mongoc/mongoc-trace-private.h>
 #include <mongoc/mongoc-util-private.h>
+
+#include <mongoc/mongoc-config.h>
+
 #include <mlib/cmp.h>
 
 #ifdef MONGOC_ENABLE_COMPRESSION
@@ -62,30 +63,33 @@ mongoc_compressor_max_compressed_length
 }
 
 bool
-mongoc_compressor_supported (const char *compressor)
+mongoc_compressor_supported (mstr_view compressor)
 {
+   bool have_snappy = false, have_zlib = false, have_zstd = false;
 #ifdef MONGOC_ENABLE_COMPRESSION_SNAPPY
-   if (!strcasecmp (compressor, MONGOC_COMPRESSOR_SNAPPY_STR)) {
-      return true;
-   }
+   have_snappy = true;
 #endif
-
 #ifdef MONGOC_ENABLE_COMPRESSION_ZLIB
-   if (!strcasecmp (compressor, MONGOC_COMPRESSOR_ZLIB_STR)) {
-      return true;
-   }
+   have_zlib = true;
 #endif
-
 #ifdef MONGOC_ENABLE_COMPRESSION_ZSTD
-   if (!strcasecmp (compressor, MONGOC_COMPRESSOR_ZSTD_STR)) {
-      return true;
-   }
+   have_zstd = true;
 #endif
 
-   if (!strcasecmp (compressor, MONGOC_COMPRESSOR_NOOP_STR)) {
-      return true;
+   if (mstr_latin_casecmp (compressor, ==, mstr_cstring ("snappy"))) {
+      return have_snappy;
+   }
+   if (mstr_latin_casecmp (compressor, ==, mstr_cstring ("zlib"))) {
+      return have_zlib;
+   }
+   if (mstr_latin_casecmp (compressor, ==, mstr_cstring ("zstd"))) {
+      return have_zstd;
+   }
+   if (mstr_latin_casecmp (compressor, ==, mstr_cstring ("noop"))) {
+      return true; // We always have "noop"
    }
 
+   // Any other compressor name is unrecognized
    return false;
 }
 
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-counters-private.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-counters-private.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-counters-private.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-counters-private.h	2025-08-14 18:37:23.000000000 +0000
@@ -19,19 +19,20 @@
 #ifndef MONGOC_COUNTERS_PRIVATE_H
 #define MONGOC_COUNTERS_PRIVATE_H
 
-#include <bson/bson.h>
 #include <common-atomic-private.h>
 
 #include <mongoc/mongoc.h>
 
+#include <bson/bson.h>
+
 #ifdef __linux__
 #include <sched.h>
 #include <sys/sysinfo.h>
 #elif defined(__FreeBSD__) || defined(__NetBSD__) || defined(__DragonFly__) || defined(__OpenBSD__)
 #include <sched.h>
-#include <sys/types.h>
-#include <sys/sysctl.h>
 #include <sys/param.h>
+#include <sys/sysctl.h>
+#include <sys/types.h>
 #elif defined(__hpux__)
 #include <sys/pstat.h>
 #endif
@@ -192,21 +193,22 @@ enum {
 
 #else
 /* when counters are disabled, these functions are no-ops */
-#define COUNTER(ident, Category, Name, Description)                                     \
-   static BSON_INLINE void mongoc_counter_##ident##_add (BSON_MAYBE_UNUSED int64_t val) \
-   {                                                                                    \
-   }                                                                                    \
-   static BSON_INLINE void mongoc_counter_##ident##_inc (void)                          \
-   {                                                                                    \
-   }                                                                                    \
-   static BSON_INLINE void mongoc_counter_##ident##_dec (void)                          \
-   {                                                                                    \
-   }                                                                                    \
-   static BSON_INLINE void mongoc_counter_##ident##_reset (void)                        \
-   {                                                                                    \
-   }                                                                                    \
-   static BSON_INLINE void mongoc_counter_##ident##_count (void)                        \
-   {                                                                                    \
+#define COUNTER(ident, Category, Name, Description)                   \
+   static BSON_INLINE void mongoc_counter_##ident##_add (int64_t val) \
+   {                                                                  \
+      (void) val;                                                     \
+   }                                                                  \
+   static BSON_INLINE void mongoc_counter_##ident##_inc (void)        \
+   {                                                                  \
+   }                                                                  \
+   static BSON_INLINE void mongoc_counter_##ident##_dec (void)        \
+   {                                                                  \
+   }                                                                  \
+   static BSON_INLINE void mongoc_counter_##ident##_reset (void)      \
+   {                                                                  \
+   }                                                                  \
+   static BSON_INLINE void mongoc_counter_##ident##_count (void)      \
+   {                                                                  \
    }
 #include <mongoc/mongoc-counters.defs>
 #undef COUNTER
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-counters.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-counters.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-counters.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-counters.c	2025-08-14 18:37:23.000000000 +0000
@@ -15,10 +15,12 @@
  */
 
 
-#include <mlib/cmp.h>
 #include <bson/bson.h>
 
+#include <mlib/cmp.h>
+
 #include <fcntl.h>
+
 #include <stdlib.h>
 #include <string.h>
 
@@ -32,9 +34,10 @@
 #include <windows.h>
 #endif
 
+#include <common-atomic-private.h>
 #include <mongoc/mongoc-counters-private.h>
+
 #include <mongoc/mongoc-log.h>
-#include <common-atomic-private.h>
 
 
 #pragma pack(1)
@@ -116,6 +119,7 @@ mongoc_counters_calc_size (void)
    if (mlib_cmp (size, >, pg_sz)) {
       return size;
    } else {
+      BSON_ASSERT (pg_sz > 0);
       return (size_t) pg_sz;
    }
 #else
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-crypt-private.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-crypt-private.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-crypt-private.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-crypt-private.h	2025-08-14 18:37:23.000000000 +0000
@@ -19,9 +19,9 @@
 #ifndef MONGOC_CRYPT_PRIVATE_H
 #define MONGOC_CRYPT_PRIVATE_H
 
-#include <mongoc/mongoc-config.h>
 #include <mongoc/mongoc-util-private.h>
 
+#include <mongoc/mongoc-config.h>
 #include <mongoc/mongoc.h>
 
 typedef struct mc_kms_credentials_callback {
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-crypt.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-crypt.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-crypt.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-crypt.c	2025-08-14 18:37:23.000000000 +0000
@@ -20,23 +20,25 @@
 
 #ifdef MONGOC_ENABLE_CLIENT_SIDE_ENCRYPTION
 
-#include <mongocrypt/mongocrypt.h>
-
+#include <common-string-private.h>
 #include <mongoc/mongoc-client-private.h>
+#include <mongoc/mongoc-cluster-aws-private.h>
 #include <mongoc/mongoc-collection-private.h>
 #include <mongoc/mongoc-error-private.h>
 #include <mongoc/mongoc-host-list-private.h>
-#include <mongoc/mongoc-stream-private.h>
+#include <mongoc/mongoc-http-private.h>
 #include <mongoc/mongoc-ssl-private.h>
-#include <mongoc/mongoc-cluster-aws-private.h>
+#include <mongoc/mongoc-stream-private.h>
 #include <mongoc/mongoc-util-private.h>
-#include <mongoc/mongoc-http-private.h>
+
 #include <mongoc/mcd-azure.h>
 #include <mongoc/mcd-time.h>
 #include <mongoc/service-gcp.h>
-#include <common-string-private.h>
+
 #include <mlib/cmp.h>
 
+#include <mongocrypt/mongocrypt.h>
+
 // `mcd_mapof_kmsid_to_tlsopts` maps a KMS ID (e.g. `aws` or `aws:myname`) to a
 // `mongoc_ssl_opt_t`. The acryonym TLS is preferred over SSL for
 // consistency with the CSE and URI specifications.
@@ -739,7 +741,7 @@ static bool
 _check_azure_kms_auto (const bson_t *kmsprov, bson_error_t *error)
 {
    if (error) {
-      *error = (bson_error_t){0};
+      *error = (bson_error_t) {0};
    }
 
    bson_iter_t iter;
@@ -877,7 +879,7 @@ static bool
 _check_gcp_kms_auto (const bson_t *kmsprov, bson_error_t *error)
 {
    if (error) {
-      *error = (bson_error_t){0};
+      *error = (bson_error_t) {0};
    }
 
    bson_iter_t iter;
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-crypto-cng-private.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-crypto-cng-private.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-crypto-cng-private.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-crypto-cng-private.h	2025-08-14 18:37:23.000000000 +0000
@@ -16,15 +16,21 @@
 
 #include <mongoc/mongoc-prelude.h>
 
+#include <mongoc/mongoc-crypto-private.h>
+
+#include <bson/bson.h>
+
+#include <inttypes.h>
+#include <stdbool.h>
+#include <stddef.h>
+
 #ifdef MONGOC_ENABLE_CRYPTO_CNG
 
 #ifndef MONGOC_CRYPTO_CNG_PRIVATE_H
 #define MONGOC_CRYPTO_CNG_PRIVATE_H
 
-
 #include <mongoc/mongoc-config.h>
 
-
 BSON_BEGIN_DECLS
 
 void
@@ -43,7 +49,6 @@ mongoc_crypto_cng_pbkdf2_hmac_sha1 (mong
                                     size_t output_len,
                                     unsigned char *output);
 
-
 void
 mongoc_crypto_cng_hmac_sha1 (mongoc_crypto_t *crypto,
                              const void *key,
@@ -82,7 +87,6 @@ mongoc_crypto_cng_sha256 (mongoc_crypto_
                           const size_t input_len,
                           unsigned char *hash_out);
 
-
 BSON_END_DECLS
 
 #endif /* MONGOC_CRYPTO_CNG_PRIVATE_H */
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-crypto-cng.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-crypto-cng.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-crypto-cng.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-crypto-cng.c	2025-08-14 18:37:23.000000000 +0000
@@ -16,16 +16,20 @@
 #include <mongoc/mongoc-config.h>
 
 #ifdef MONGOC_ENABLE_CRYPTO_CNG
-#include <mongoc/mongoc-scram-private.h>
-#include <mongoc/mongoc-crypto-private.h>
 #include <mongoc/mongoc-crypto-cng-private.h>
-#include <mongoc/mongoc-log.h>
+#include <mongoc/mongoc-crypto-private.h>
+#include <mongoc/mongoc-scram-private.h>
 #include <mongoc/mongoc-thread-private.h>
+
+#include <mongoc/mongoc-log.h>
+
 #include <mlib/cmp.h>
 
+#include <bcrypt.h>
+
 #include <windows.h>
+
 #include <stdio.h>
-#include <bcrypt.h>
 #include <string.h>
 
 #define NT_SUCCESS(Status) (((NTSTATUS) (Status)) >= 0)
@@ -265,6 +269,7 @@ mongoc_crypto_cng_pbkdf2_hmac_sha1 (mong
                                     unsigned char *output)
 {
 #if defined(MONGOC_HAVE_BCRYPT_PBKDF2)
+   BSON_UNUSED (crypto);
    return _bcrypt_derive_key_pbkdf2 (
       _sha1_hmac_algo, password, password_len, salt, salt_len, iterations, output_len, output);
 #else
@@ -281,6 +286,8 @@ mongoc_crypto_cng_hmac_sha1 (mongoc_cryp
                              int data_len,
                              unsigned char *hmac_out)
 {
+   BSON_UNUSED (crypto);
+
    if (!_sha1_hmac_algo) {
       return;
    }
@@ -294,6 +301,8 @@ mongoc_crypto_cng_sha1 (mongoc_crypto_t
                         const size_t input_len,
                         unsigned char *hash_out)
 {
+   BSON_UNUSED (crypto);
+
    bool res;
 
    if (!_sha1_hash_algo) {
@@ -333,6 +342,8 @@ mongoc_crypto_cng_hmac_sha256 (mongoc_cr
                                int data_len,
                                unsigned char *hmac_out)
 {
+   BSON_UNUSED (crypto);
+
    if (!_sha256_hmac_algo) {
       return;
    }
@@ -346,6 +357,8 @@ mongoc_crypto_cng_sha256 (mongoc_crypto_
                           const size_t input_len,
                           unsigned char *hash_out)
 {
+   BSON_UNUSED (crypto);
+
    bool res;
 
    if (!_sha256_hash_algo) {
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-crypto-common-crypto.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-crypto-common-crypto.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-crypto-common-crypto.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-crypto-common-crypto.c	2025-08-14 18:37:23.000000000 +0000
@@ -13,15 +13,17 @@
  * limitations under the License.
  */
 
-#include <mongoc/mongoc-config.h>
 #include <mongoc/mongoc-crypto-private.h>
 
+#include <mongoc/mongoc-config.h>
+
 #ifdef MONGOC_ENABLE_CRYPTO_COMMON_CRYPTO
 #include <mongoc/mongoc-crypto-common-crypto-private.h>
-#include <CommonCrypto/CommonHMAC.h>
+
+#include <CommonCrypto/CommonCryptoError.h>
 #include <CommonCrypto/CommonDigest.h>
+#include <CommonCrypto/CommonHMAC.h>
 #include <CommonCrypto/CommonKeyDerivation.h>
-#include <CommonCrypto/CommonCryptoError.h>
 
 // Ensure lossless conversion between `uint32_t` and `uint` below.
 BSON_STATIC_ASSERT2 (sizeof_uint_uint32_t, sizeof (uint) == sizeof (uint32_t));
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-crypto-openssl-private.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-crypto-openssl-private.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-crypto-openssl-private.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-crypto-openssl-private.h	2025-08-14 18:37:23.000000000 +0000
@@ -17,6 +17,7 @@
 #include <mongoc/mongoc-prelude.h>
 
 #include <mongoc/mongoc-config.h>
+
 #include <bson/bson.h>
 
 #ifdef MONGOC_ENABLE_CRYPTO_LIBCRYPTO
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-crypto-openssl.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-crypto-openssl.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-crypto-openssl.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-crypto-openssl.c	2025-08-14 18:37:23.000000000 +0000
@@ -15,17 +15,20 @@
  */
 
 #include <mongoc/mongoc-config.h>
+
 #include <bson/bson.h>
 
 #ifdef MONGOC_ENABLE_CRYPTO_LIBCRYPTO
 #include <mongoc/mongoc-crypto-openssl-private.h>
 #include <mongoc/mongoc-crypto-private.h>
+
 #include <mongoc/mongoc-log.h>
+
 #include <mlib/cmp.h>
 
-#include <openssl/sha.h>
 #include <openssl/evp.h>
 #include <openssl/hmac.h>
+#include <openssl/sha.h>
 
 bool
 mongoc_crypto_openssl_pbkdf2_hmac_sha1 (mongoc_crypto_t *crypto,
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-crypto-private.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-crypto-private.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-crypto-private.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-crypto-private.h	2025-08-14 18:37:23.000000000 +0000
@@ -17,6 +17,7 @@
 #include <mongoc/mongoc-prelude.h>
 
 #include <mongoc/mongoc-config.h>
+
 #include <bson/bson.h>
 
 #ifdef MONGOC_ENABLE_CRYPTO
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-crypto.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-crypto.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-crypto.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-crypto.c	2025-08-14 18:37:23.000000000 +0000
@@ -17,9 +17,11 @@
 
 #ifdef MONGOC_ENABLE_CRYPTO
 
-#include <bson/bson.h>
-#include <mongoc/mongoc-log.h>
 #include <mongoc/mongoc-crypto-private.h>
+
+#include <mongoc/mongoc-log.h>
+
+#include <bson/bson.h>
 #if defined(MONGOC_ENABLE_CRYPTO_LIBCRYPTO)
 #include <mongoc/mongoc-crypto-openssl-private.h>
 #elif defined(MONGOC_ENABLE_CRYPTO_COMMON_CRYPTO)
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-cursor-array.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-cursor-array.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-cursor-array.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-cursor-array.c	2025-08-14 18:37:23.000000000 +0000
@@ -13,9 +13,10 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-#include <mongoc/mongoc.h>
-#include <mongoc/mongoc-cursor-private.h>
 #include <mongoc/mongoc-client-private.h>
+#include <mongoc/mongoc-cursor-private.h>
+
+#include <mongoc/mongoc.h>
 
 typedef struct _data_array_t {
    bson_t cmd;
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-cursor-change-stream.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-cursor-change-stream.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-cursor-change-stream.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-cursor-change-stream.c	2025-08-14 18:37:23.000000000 +0000
@@ -13,11 +13,12 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-#include <mongoc/mongoc.h>
-#include <mongoc/mongoc-cursor-private.h>
 #include <mongoc/mongoc-client-private.h>
+#include <mongoc/mongoc-cursor-private.h>
 #include <mongoc/mongoc-error-private.h>
 
+#include <mongoc/mongoc.h>
+
 typedef struct _data_change_stream_t {
    mongoc_cursor_response_t response;
    bson_t post_batch_resume_token;
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-cursor-cmd-deprecated.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-cursor-cmd-deprecated.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-cursor-cmd-deprecated.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-cursor-cmd-deprecated.c	2025-08-14 18:37:23.000000000 +0000
@@ -13,9 +13,10 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-#include <mongoc/mongoc.h>
-#include <mongoc/mongoc-cursor-private.h>
 #include <mongoc/mongoc-client-private.h>
+#include <mongoc/mongoc-cursor-private.h>
+
+#include <mongoc/mongoc.h>
 
 /* This cursor is returned by the deprecated functions mongoc_client_command,
  * mongoc_database_command, and mongoc_collection_command. It runs the command
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-cursor-cmd.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-cursor-cmd.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-cursor-cmd.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-cursor-cmd.c	2025-08-14 18:37:23.000000000 +0000
@@ -13,11 +13,12 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-#include <mongoc/mongoc.h>
-#include <mongoc/mongoc-cursor-private.h>
 #include <mongoc/mongoc-client-private.h>
+#include <mongoc/mongoc-cursor-private.h>
 #include <mongoc/mongoc-error-private.h>
 
+#include <mongoc/mongoc.h>
+
 typedef enum { NONE, CMD_RESPONSE, OP_GETMORE_RESPONSE } reading_from_t;
 typedef enum { UNKNOWN, GETMORE_CMD, OP_GETMORE } getmore_type_t;
 typedef struct _data_cmd_t {
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-cursor-find-cmd.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-cursor-find-cmd.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-cursor-find-cmd.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-cursor-find-cmd.c	2025-08-14 18:37:23.000000000 +0000
@@ -13,9 +13,10 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-#include <mongoc/mongoc.h>
-#include <mongoc/mongoc-cursor-private.h>
 #include <mongoc/mongoc-client-private.h>
+#include <mongoc/mongoc-cursor-private.h>
+
+#include <mongoc/mongoc.h>
 
 typedef struct _data_find_cmd_t {
    mongoc_cursor_response_t response;
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-cursor-find-opquery.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-cursor-find-opquery.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-cursor-find-opquery.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-cursor-find-opquery.c	2025-08-14 18:37:23.000000000 +0000
@@ -13,9 +13,10 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-#include <mongoc/mongoc.h>
-#include <mongoc/mongoc-rpc-private.h>
 #include <mongoc/mongoc-cursor-private.h>
+#include <mongoc/mongoc-rpc-private.h>
+
+#include <mongoc/mongoc.h>
 
 typedef struct _data_find_opquery_t {
    mongoc_cursor_response_legacy_t response_legacy;
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-cursor-find.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-cursor-find.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-cursor-find.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-cursor-find.c	2025-08-14 18:37:23.000000000 +0000
@@ -14,9 +14,10 @@
  * limitations under the License.
  */
 
-#include <mongoc/mongoc.h>
-#include <mongoc/mongoc-cursor-private.h>
 #include <mongoc/mongoc-client-private.h>
+#include <mongoc/mongoc-cursor-private.h>
+
+#include <mongoc/mongoc.h>
 
 typedef struct _data_find_t {
    bson_t filter;
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-cursor-legacy.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-cursor-legacy.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-cursor-legacy.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-cursor-legacy.c	2025-08-14 18:37:23.000000000 +0000
@@ -20,21 +20,21 @@
  * - receiving OP_REPLY documents in a stream (instead of batch)
  */
 
-#include <mongoc/mongoc-cursor.h>
-#include <mongoc/mongoc-cursor-private.h>
+#include <common-bson-dsl-private.h>
 #include <mongoc/mongoc-client-private.h>
 #include <mongoc/mongoc-counters-private.h>
+#include <mongoc/mongoc-cursor-private.h>
 #include <mongoc/mongoc-error-private.h>
-#include <mongoc/mongoc-log.h>
-#include <mongoc/mongoc-trace-private.h>
 #include <mongoc/mongoc-read-concern-private.h>
-#include <mongoc/mongoc-util-private.h>
-#include <mongoc/mongoc-write-concern-private.h>
 #include <mongoc/mongoc-read-prefs-private.h>
 #include <mongoc/mongoc-rpc-private.h>
 #include <mongoc/mongoc-structured-log-private.h>
+#include <mongoc/mongoc-trace-private.h>
+#include <mongoc/mongoc-util-private.h>
+#include <mongoc/mongoc-write-concern-private.h>
 
-#include <common-bson-dsl-private.h>
+#include <mongoc/mongoc-cursor.h>
+#include <mongoc/mongoc-log.h>
 
 static bool
 _mongoc_cursor_monitor_legacy_get_more (mongoc_cursor_t *cursor, mongoc_server_stream_t *server_stream)
@@ -109,7 +109,7 @@ _mongoc_cursor_monitor_legacy_query (mon
    /* simulate a MongoDB 3.2+ "find" command */
    _mongoc_cursor_prepare_find_command (cursor, filter, &doc);
 
-   bsonBuildAppend (cursor->opts, insert (doc, not(key ("serverId", "maxAwaitTimeMS", "sessionId"))));
+   bsonBuildAppend (cursor->opts, insert (doc, not (key ("serverId", "maxAwaitTimeMS", "sessionId"))));
 
    r = _mongoc_cursor_monitor_command (cursor, server_stream, &doc, "find");
 
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-cursor-private.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-cursor-private.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-cursor-private.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-cursor-private.h	2025-08-14 18:37:23.000000000 +0000
@@ -19,13 +19,14 @@
 #ifndef MONGOC_CURSOR_PRIVATE_H
 #define MONGOC_CURSOR_PRIVATE_H
 
-#include <bson/bson.h>
-
-#include <mongoc/mongoc-client.h>
 #include <mongoc/mongoc-buffer-private.h>
+#include <mongoc/mongoc-cluster-private.h>
 #include <mongoc/mongoc-rpc-private.h>
 #include <mongoc/mongoc-server-stream-private.h>
-#include <mongoc/mongoc-cluster-private.h>
+
+#include <mongoc/mongoc-client.h>
+
+#include <bson/bson.h>
 
 
 BSON_BEGIN_DECLS
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-cursor.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-cursor.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-cursor.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-cursor.c	2025-08-14 18:37:23.000000000 +0000
@@ -16,21 +16,23 @@
 
 
 #include <mongoc/mongoc-cursor.h>
-#include <mongoc/mongoc-cursor-private.h>
+
+#include <common-bson-dsl-private.h>
+#include <mongoc/mongoc-aggregate-private.h>
 #include <mongoc/mongoc-client-private.h>
 #include <mongoc/mongoc-client-session-private.h>
 #include <mongoc/mongoc-counters-private.h>
+#include <mongoc/mongoc-cursor-private.h>
 #include <mongoc/mongoc-error-private.h>
-#include <mongoc/mongoc-log.h>
-#include <mongoc/mongoc-trace-private.h>
 #include <mongoc/mongoc-read-concern-private.h>
-#include <mongoc/mongoc-util-private.h>
-#include <mongoc/mongoc-write-concern-private.h>
 #include <mongoc/mongoc-read-prefs-private.h>
-#include <mongoc/mongoc-aggregate-private.h>
 #include <mongoc/mongoc-structured-log-private.h>
+#include <mongoc/mongoc-trace-private.h>
+#include <mongoc/mongoc-util-private.h>
+#include <mongoc/mongoc-write-concern-private.h>
+
+#include <mongoc/mongoc-log.h>
 
-#include <common-bson-dsl-private.h>
 #include <mlib/cmp.h>
 
 #undef MONGOC_LOG_DOMAIN
@@ -330,9 +332,9 @@ _mongoc_cursor_new_with_opts (mongoc_cli
       // Selectively copy the options:
       bsonBuildAppend (cursor->opts,
                        insert (*opts,
-                               not(key ("serverId", "sessionId"),
-                                   // Drop bypassDocumentValidation if it isn't true:
-                                   allOf (key ("bypassDocumentValidation"), isFalse))));
+                               not (key ("serverId", "sessionId"),
+                                    // Drop bypassDocumentValidation if it isn't true:
+                                    allOf (key ("bypassDocumentValidation"), isFalse))));
    }
 
    if (_mongoc_client_session_in_txn (cursor->client_session)) {
@@ -587,7 +589,6 @@ mongoc_cursor_destroy (mongoc_cursor_t *
          _mongoc_client_kill_cursor (cursor->client,
                                      cursor->server_id,
                                      cursor->cursor_id,
-                                     cursor->operation_id,
                                      db,
                                      cursor->ns + cursor->dblen + 1,
                                      cursor->client_session);
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-cursor.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-cursor.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-cursor.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-cursor.h	2025-08-14 18:37:23.000000000 +0000
@@ -19,10 +19,10 @@
 #ifndef MONGOC_CURSOR_H
 #define MONGOC_CURSOR_H
 
-#include <bson/bson.h>
-
-#include <mongoc/mongoc-macros.h>
 #include <mongoc/mongoc-host-list.h>
+#include <mongoc/mongoc-macros.h>
+
+#include <bson/bson.h>
 
 
 BSON_BEGIN_DECLS
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-cyrus-private.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-cyrus-private.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-cyrus-private.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-cyrus-private.h	2025-08-14 18:37:23.000000000 +0000
@@ -19,10 +19,13 @@
 #ifndef MONGOC_CYRUS_PRIVATE_H
 #define MONGOC_CYRUS_PRIVATE_H
 
-#include <mongoc/mongoc-uri.h>
 #include <mongoc/mongoc-cluster-private.h>
 #include <mongoc/mongoc-sasl-private.h>
+
+#include <mongoc/mongoc-uri.h>
+
 #include <bson/bson.h>
+
 #include <sasl/sasl.h>
 
 
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-cyrus.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-cyrus.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-cyrus.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-cyrus.c	2025-08-14 18:37:23.000000000 +0000
@@ -18,16 +18,18 @@
 
 #ifdef MONGOC_ENABLE_SASL_CYRUS
 
-#include <string.h>
-
-#include <mongoc/mongoc-error.h>
-#include <mongoc/mongoc-cyrus-private.h>
-#include <mongoc/mongoc-util-private.h>
-#include <mongoc/mongoc-trace-private.h>
 #include <common-b64-private.h>
 #include <common-string-private.h>
+#include <mongoc/mongoc-cyrus-private.h>
+#include <mongoc/mongoc-trace-private.h>
+#include <mongoc/mongoc-util-private.h>
+
+#include <mongoc/mongoc-error.h>
+
 #include <mlib/cmp.h>
 
+#include <string.h>
+
 #undef MONGOC_LOG_DOMAIN
 #define MONGOC_LOG_DOMAIN "CYRUS-SASL"
 
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-database-private.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-database-private.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-database-private.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-database-private.h	2025-08-14 18:37:23.000000000 +0000
@@ -19,13 +19,13 @@
 #ifndef MONGOC_DATABASE_PRIVATE_H
 #define MONGOC_DATABASE_PRIVATE_H
 
-#include <bson/bson.h>
-
 #include <mongoc/mongoc-client.h>
-#include <mongoc/mongoc-read-prefs.h>
 #include <mongoc/mongoc-read-concern.h>
+#include <mongoc/mongoc-read-prefs.h>
 #include <mongoc/mongoc-write-concern.h>
 
+#include <bson/bson.h>
+
 BSON_BEGIN_DECLS
 
 
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-database.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-database.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-database.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-database.c	2025-08-14 18:37:23.000000000 +0000
@@ -15,22 +15,23 @@
  */
 
 
+#include <mongoc/mongoc-database.h>
+
+#include <common-bson-dsl-private.h>
 #include <mongoc/mongoc-aggregate-private.h>
+#include <mongoc/mongoc-change-stream-private.h>
 #include <mongoc/mongoc-client-private.h>
-#include <mongoc/mongoc-collection.h>
 #include <mongoc/mongoc-collection-private.h>
-#include <mongoc/mongoc-cursor.h>
 #include <mongoc/mongoc-cursor-private.h>
-#include <mongoc/mongoc-database.h>
 #include <mongoc/mongoc-database-private.h>
 #include <mongoc/mongoc-error-private.h>
-#include <mongoc/mongoc-log.h>
 #include <mongoc/mongoc-trace-private.h>
 #include <mongoc/mongoc-util-private.h>
 #include <mongoc/mongoc-write-concern-private.h>
-#include <mongoc/mongoc-change-stream-private.h>
 
-#include <common-bson-dsl-private.h>
+#include <mongoc/mongoc-collection.h>
+#include <mongoc/mongoc-cursor.h>
+#include <mongoc/mongoc-log.h>
 
 #undef MONGOC_LOG_DOMAIN
 #define MONGOC_LOG_DOMAIN "database"
@@ -1135,7 +1136,7 @@ _mongoc_get_collection_encryptedFields (
       bool found = false;
       bsonParse (*opts,
                  find (key ("encryptedFields"),
-                       if (not(type (doc)), then (error ("'encryptedFields' should be a document"))),
+                       if (not (type (doc)), then (error ("'encryptedFields' should be a document"))),
                        // Update encryptedFields to be a reference to the subdocument:
                        storeDocRef (*encryptedFields),
                        do (found = true)));
@@ -1193,7 +1194,7 @@ mongoc_database_create_collection (mongo
 
    if (!bson_empty (&encryptedFields)) {
       // Clone 'opts' without the encryptedFields element
-      bsonBuildDecl (opts_without_encryptedFields, if (opts, then (insert (*opts, not(key ("encryptedFields"))))));
+      bsonBuildDecl (opts_without_encryptedFields, if (opts, then (insert (*opts, not (key ("encryptedFields"))))));
 
       mongoc_collection_t *ret = create_collection_with_encryptedFields (
          database, name, &opts_without_encryptedFields, &encryptedFields, error);
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-database.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-database.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-database.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-database.h	2025-08-14 18:37:23.000000000 +0000
@@ -19,17 +19,17 @@
 #ifndef MONGOC_DATABASE_H
 #define MONGOC_DATABASE_H
 
-#include <bson/bson.h>
-
-#include <mongoc/mongoc-macros.h>
 #include <mongoc/mongoc-change-stream.h>
 #include <mongoc/mongoc-collection.h>
 #include <mongoc/mongoc-cursor.h>
 #include <mongoc/mongoc-flags.h>
-#include <mongoc/mongoc-read-prefs.h>
+#include <mongoc/mongoc-macros.h>
 #include <mongoc/mongoc-read-concern.h>
+#include <mongoc/mongoc-read-prefs.h>
 #include <mongoc/mongoc-write-concern.h>
 
+#include <bson/bson.h>
+
 BSON_BEGIN_DECLS
 
 
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-deprioritized-servers-private.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-deprioritized-servers-private.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-deprioritized-servers-private.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-deprioritized-servers-private.h	2025-08-14 18:37:23.000000000 +0000
@@ -19,10 +19,10 @@
 #ifndef MONGOC_DEPRIORITIZED_SERVERS_PRIVATE_H
 #define MONGOC_DEPRIORITIZED_SERVERS_PRIVATE_H
 
-#include <bson/bson.h>
-
 #include <mongoc/mongoc-server-description.h>
 
+#include <bson/bson.h>
+
 #include <stdbool.h>
 
 BSON_BEGIN_DECLS
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-deprioritized-servers.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-deprioritized-servers.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-deprioritized-servers.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-deprioritized-servers.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,5 +1,4 @@
 #include <mongoc/mongoc-deprioritized-servers-private.h>
-
 #include <mongoc/mongoc-set-private.h>
 
 // Dedicated non-zero value to avoid confusing "key is present with a NULL item"
@@ -16,7 +15,7 @@ mongoc_deprioritized_servers_new (void)
 {
    mongoc_deprioritized_servers_t *const ret = bson_malloc (sizeof (*ret));
 
-   *ret = (mongoc_deprioritized_servers_t){
+   *ret = (mongoc_deprioritized_servers_t) {
       .ids = mongoc_set_new (1u, NULL, NULL),
    };
 
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-errno-private.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-errno-private.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-errno-private.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-errno-private.h	2025-08-14 18:37:23.000000000 +0000
@@ -20,10 +20,11 @@
 #define MONGOC_ERRNO_PRIVATE_H
 
 #include <bson/bson.h>
+
 #include <errno.h>
 #ifdef _WIN32
-#include <winsock2.h>
 #include <winerror.h>
+#include <winsock2.h>
 #endif
 
 
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-error-private.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-error-private.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-error-private.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-error-private.h	2025-08-14 18:37:23.000000000 +0000
@@ -19,12 +19,12 @@
 #ifndef MONGOC_ERROR_PRIVATE_H
 #define MONGOC_ERROR_PRIVATE_H
 
-#include "mongoc-error.h"
+#include <mongoc/mongoc-error.h>
+#include <mongoc/mongoc-server-description.h>
 
 #include <bson/bson.h>
-#include <stddef.h>
 
-#include <mongoc/mongoc-server-description.h>
+#include <stddef.h>
 
 BSON_BEGIN_DECLS
 
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-error.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-error.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-error.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-error.c	2025-08-14 18:37:23.000000000 +0000
@@ -14,14 +14,15 @@
  * limitations under the License.
  */
 
-#include <bson/bson.h>
-
 #include <mongoc/mongoc-error.h>
+
+#include <mongoc/mongoc-client-private.h>
 #include <mongoc/mongoc-error-private.h>
 #include <mongoc/mongoc-rpc-private.h>
-#include <mongoc/mongoc-client-private.h>
 #include <mongoc/mongoc-server-description-private.h>
 
+#include <bson/bson.h>
+
 bool
 mongoc_error_has_label (const bson_t *reply, const char *label)
 {
@@ -349,7 +350,11 @@ _mongoc_set_error (bson_error_t *error,
 
       va_list args;
       va_start (args, format);
-      bson_vsnprintf (error->message, sizeof error->message, format, args);
+      // Format into a temporary buf before copying into the error, as the existing
+      // error message may be an input to our formatting string
+      char buffer[sizeof (error->message)] = {0};
+      bson_vsnprintf (buffer, sizeof error->message, format, args);
+      memcpy (&error->message, buffer, sizeof buffer);
       va_end (args);
    }
 }
@@ -365,7 +370,9 @@ _mongoc_set_error_with_category (
 
       va_list args;
       va_start (args, format);
-      bson_vsnprintf (error->message, sizeof error->message, format, args);
+      char buffer[sizeof (error->message)] = {0};
+      bson_vsnprintf (buffer, sizeof error->message, format, args);
+      memcpy (&error->message, buffer, sizeof buffer);
       va_end (args);
    }
 }
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-error.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-error.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-error.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-error.h	2025-08-14 18:37:23.000000000 +0000
@@ -19,10 +19,10 @@
 #ifndef MONGOC_ERRORS_H
 #define MONGOC_ERRORS_H
 
-#include <bson/bson.h>
-
 #include <mongoc/mongoc-macros.h>
 
+#include <bson/bson.h>
+
 #define MONGOC_ERROR_API_VERSION_LEGACY 1
 #define MONGOC_ERROR_API_VERSION_2 2
 
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-find-and-modify-private.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-find-and-modify-private.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-find-and-modify-private.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-find-and-modify-private.h	2025-08-14 18:37:23.000000000 +0000
@@ -19,9 +19,10 @@
 #ifndef MONGOC_FIND_AND_MODIFY_PRIVATE_H
 #define MONGOC_FIND_AND_MODIFY_PRIVATE_H
 
-#include <bson/bson.h>
 #include <mongoc/mongoc-write-command-private.h>
 
+#include <bson/bson.h>
+
 BSON_BEGIN_DECLS
 
 struct _mongoc_find_and_modify_opts_t {
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-find-and-modify.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-find-and-modify.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-find-and-modify.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-find-and-modify.c	2025-08-14 18:37:23.000000000 +0000
@@ -15,11 +15,13 @@
  */
 
 
-#include <mongoc/mongoc-write-concern.h>
-#include <mongoc/mongoc-write-concern-private.h>
 #include <mongoc/mongoc-find-and-modify.h>
+
 #include <mongoc/mongoc-find-and-modify-private.h>
 #include <mongoc/mongoc-util-private.h>
+#include <mongoc/mongoc-write-concern-private.h>
+
+#include <mongoc/mongoc-write-concern.h>
 
 
 /**
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-find-and-modify.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-find-and-modify.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-find-and-modify.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-find-and-modify.h	2025-08-14 18:37:23.000000000 +0000
@@ -19,10 +19,10 @@
 #ifndef MONGOC_FIND_AND_MODIFY_H
 #define MONGOC_FIND_AND_MODIFY_H
 
-#include <bson/bson.h>
-
 #include <mongoc/mongoc-macros.h>
 
+#include <bson/bson.h>
+
 BSON_BEGIN_DECLS
 
 typedef enum {
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-gridfs-bucket-file-private.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-gridfs-bucket-file-private.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-gridfs-bucket-file-private.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-gridfs-bucket-file-private.h	2025-08-14 18:37:23.000000000 +0000
@@ -18,10 +18,11 @@
 #ifndef MONGOC_GRIDFS_BUCKET_FILE_PRIVATE_H
 #define MONGOC_GRIDFS_BUCKET_FILE_PRIVATE_H
 
-#include <bson/bson.h>
 #include <mongoc/mongoc-collection.h>
-#include <mongoc/mongoc-stream.h>
 #include <mongoc/mongoc-gridfs-bucket.h>
+#include <mongoc/mongoc-stream.h>
+
+#include <bson/bson.h>
 
 BSON_BEGIN_DECLS
 
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-gridfs-bucket-file.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-gridfs-bucket-file.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-gridfs-bucket-file.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-gridfs-bucket-file.c	2025-08-14 18:37:23.000000000 +0000
@@ -14,15 +14,17 @@
  * limitations under the License.
  */
 
-#include <mongoc/mongoc.h>
+#include <mongoc/mongoc-collection-private.h>
 #include <mongoc/mongoc-error-private.h>
 #include <mongoc/mongoc-gridfs-bucket-file-private.h>
 #include <mongoc/mongoc-gridfs-bucket-private.h>
-#include <mongoc/mongoc-trace-private.h>
 #include <mongoc/mongoc-stream-gridfs-download-private.h>
 #include <mongoc/mongoc-stream-gridfs-upload-private.h>
-#include <mongoc/mongoc-collection-private.h>
+#include <mongoc/mongoc-trace-private.h>
 #include <mongoc/mongoc-util-private.h>
+
+#include <mongoc/mongoc.h>
+
 #include <mlib/cmp.h>
 
 #include <inttypes.h>
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-gridfs-bucket.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-gridfs-bucket.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-gridfs-bucket.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-gridfs-bucket.c	2025-08-14 18:37:23.000000000 +0000
@@ -14,13 +14,11 @@
  * limitations under the License.
  */
 
-#include <bson/bson.h>
-#include <mongoc/mongoc.h>
 #include <mongoc/mongoc-cursor-private.h>
 #include <mongoc/mongoc-database-private.h>
 #include <mongoc/mongoc-error-private.h>
-#include <mongoc/mongoc-gridfs-bucket-private.h>
 #include <mongoc/mongoc-gridfs-bucket-file-private.h>
+#include <mongoc/mongoc-gridfs-bucket-private.h>
 #include <mongoc/mongoc-opts-private.h>
 #include <mongoc/mongoc-read-concern-private.h>
 #include <mongoc/mongoc-stream-gridfs-download-private.h>
@@ -28,6 +26,10 @@
 #include <mongoc/mongoc-stream-private.h>
 #include <mongoc/mongoc-write-concern-private.h>
 
+#include <mongoc/mongoc.h>
+
+#include <bson/bson.h>
+
 /*--------------------------------------------------------------------------
  *
  * _mongoc_gridfs_find_file_with_id --
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-gridfs-bucket.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-gridfs-bucket.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-gridfs-bucket.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-gridfs-bucket.h	2025-08-14 18:37:23.000000000 +0000
@@ -19,11 +19,12 @@
 #ifndef MONGOC_GRIDFS_BUCKET_H
 #define MONGOC_GRIDFS_BUCKET_H
 
-#include <bson/bson.h>
 #include <mongoc/mongoc-collection.h>
 #include <mongoc/mongoc-database.h>
 #include <mongoc/mongoc-stream.h>
 
+#include <bson/bson.h>
+
 BSON_BEGIN_DECLS
 
 typedef struct _mongoc_gridfs_bucket_t mongoc_gridfs_bucket_t;
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-gridfs-file-list-private.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-gridfs-file-list-private.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-gridfs-file-list-private.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-gridfs-file-list-private.h	2025-08-14 18:37:23.000000000 +0000
@@ -19,11 +19,11 @@
 #ifndef MONGOC_GRIDFS_FILE_LIST_PRIVATE_H
 #define MONGOC_GRIDFS_FILE_LIST_PRIVATE_H
 
-#include <bson/bson.h>
-
-#include <mongoc/mongoc-gridfs.h>
-#include <mongoc/mongoc-gridfs-file.h>
 #include <mongoc/mongoc-cursor.h>
+#include <mongoc/mongoc-gridfs-file.h>
+#include <mongoc/mongoc-gridfs.h>
+
+#include <bson/bson.h>
 
 
 BSON_BEGIN_DECLS
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-gridfs-file-list.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-gridfs-file-list.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-gridfs-file-list.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-gridfs-file-list.c	2025-08-14 18:37:23.000000000 +0000
@@ -15,19 +15,21 @@
  */
 
 
-#include <limits.h>
+#include <mongoc/mongoc-gridfs-file-list.h>
 
-#include <mongoc/mongoc-cursor.h>
-#include <mongoc/mongoc-cursor-private.h>
 #include <mongoc/mongoc-collection-private.h>
-#include <mongoc/mongoc-gridfs.h>
-#include <mongoc/mongoc-gridfs-private.h>
-#include <mongoc/mongoc-gridfs-file.h>
-#include <mongoc/mongoc-gridfs-file-private.h>
-#include <mongoc/mongoc-gridfs-file-list.h>
+#include <mongoc/mongoc-cursor-private.h>
 #include <mongoc/mongoc-gridfs-file-list-private.h>
+#include <mongoc/mongoc-gridfs-file-private.h>
+#include <mongoc/mongoc-gridfs-private.h>
 #include <mongoc/mongoc-trace-private.h>
 
+#include <mongoc/mongoc-cursor.h>
+#include <mongoc/mongoc-gridfs-file.h>
+#include <mongoc/mongoc-gridfs.h>
+
+#include <limits.h>
+
 
 mongoc_gridfs_file_list_t *
 _mongoc_gridfs_file_list_new (mongoc_gridfs_t *gridfs, const bson_t *query, uint32_t limit)
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-gridfs-file-list.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-gridfs-file-list.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-gridfs-file-list.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-gridfs-file-list.h	2025-08-14 18:37:23.000000000 +0000
@@ -19,10 +19,10 @@
 #ifndef MONGOC_GRIDFS_FILE_LIST_H
 #define MONGOC_GRIDFS_FILE_LIST_H
 
-#include <bson/bson.h>
-
-#include <mongoc/mongoc-macros.h>
 #include <mongoc/mongoc-gridfs-file.h>
+#include <mongoc/mongoc-macros.h>
+
+#include <bson/bson.h>
 
 
 BSON_BEGIN_DECLS
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-gridfs-file-page-private.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-gridfs-file-page-private.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-gridfs-file-page-private.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-gridfs-file-page-private.h	2025-08-14 18:37:23.000000000 +0000
@@ -19,14 +19,13 @@
 #ifndef MONGOC_GRIDFS_FILE_PAGE_PRIVATE_H
 #define MONGOC_GRIDFS_FILE_PAGE_PRIVATE_H
 
-#include <bson/bson.h>
-
+#include <mongoc/mongoc-gridfs-file-page.h>
 #include <mongoc/mongoc-gridfs-file.h>
 
+#include <bson/bson.h>
 
 BSON_BEGIN_DECLS
 
-
 struct _mongoc_gridfs_file_page_t {
    const uint8_t *read_buf;
    uint8_t *buf;
@@ -35,7 +34,6 @@ struct _mongoc_gridfs_file_page_t {
    uint32_t offset;
 };
 
-
 mongoc_gridfs_file_page_t *
 _mongoc_gridfs_file_page_new (const uint8_t *data, uint32_t len, uint32_t chunk_size);
 void
@@ -57,8 +55,6 @@ _mongoc_gridfs_file_page_get_len (mongoc
 bool
 _mongoc_gridfs_file_page_is_dirty (mongoc_gridfs_file_page_t *page);
 
-
 BSON_END_DECLS
 
-
 #endif /* MONGOC_GRIDFS_FILE_PAGE_PRIVATE_H */
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-gridfs-file-page.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-gridfs-file-page.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-gridfs-file-page.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-gridfs-file-page.c	2025-08-14 18:37:23.000000000 +0000
@@ -19,8 +19,8 @@
 #define MONGOC_LOG_DOMAIN "gridfs_file_page"
 
 #include <mongoc/mongoc-gridfs-file-page.h>
-#include <mongoc/mongoc-gridfs-file-page-private.h>
 
+#include <mongoc/mongoc-gridfs-file-page-private.h>
 #include <mongoc/mongoc-trace-private.h>
 
 
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-gridfs-file-page.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-gridfs-file-page.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-gridfs-file-page.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-gridfs-file-page.h	2025-08-14 18:37:23.000000000 +0000
@@ -19,11 +19,11 @@
 #ifndef MONGOC_GRIDFS_FILE_PAGE_H
 #define MONGOC_GRIDFS_FILE_PAGE_H
 
-#include <bson/bson.h>
-
-#include <mongoc/mongoc-stream.h>
-#include <mongoc/mongoc-gridfs-file.h>
 #include <mongoc/mongoc-gridfs-file-list.h>
+#include <mongoc/mongoc-gridfs-file.h>
+#include <mongoc/mongoc-stream.h>
+
+#include <bson/bson.h>
 
 
 BSON_BEGIN_DECLS
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-gridfs-file-private.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-gridfs-file-private.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-gridfs-file-private.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-gridfs-file-private.h	2025-08-14 18:37:23.000000000 +0000
@@ -19,12 +19,12 @@
 #ifndef MONGOC_GRIDFS_FILE_PRIVATE_H
 #define MONGOC_GRIDFS_FILE_PRIVATE_H
 
-#include <bson/bson.h>
-
-#include <mongoc/mongoc-gridfs.h>
-#include <mongoc/mongoc-gridfs-file.h>
-#include <mongoc/mongoc-gridfs-file-page.h>
 #include <mongoc/mongoc-cursor.h>
+#include <mongoc/mongoc-gridfs-file-page.h>
+#include <mongoc/mongoc-gridfs-file.h>
+#include <mongoc/mongoc-gridfs.h>
+
+#include <bson/bson.h>
 
 
 BSON_BEGIN_DECLS
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-gridfs-file.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-gridfs-file.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-gridfs-file.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-gridfs-file.c	2025-08-14 18:37:23.000000000 +0000
@@ -18,25 +18,28 @@
 #undef MONGOC_LOG_DOMAIN
 #define MONGOC_LOG_DOMAIN "gridfs_file"
 
-#include <limits.h>
-#include <time.h>
-#include <errno.h>
+#include <mongoc/mongoc-gridfs-file.h>
 
-#include <mongoc/mongoc-cursor.h>
 #include <mongoc/mongoc-cursor-private.h>
-#include <mongoc/mongoc-collection.h>
-#include <mongoc/mongoc-gridfs.h>
-#include <mongoc/mongoc-gridfs-private.h>
-#include <mongoc/mongoc-gridfs-file.h>
-#include <mongoc/mongoc-gridfs-file-private.h>
-#include <mongoc/mongoc-gridfs-file-page.h>
+#include <mongoc/mongoc-error-private.h>
 #include <mongoc/mongoc-gridfs-file-page-private.h>
-#include <mongoc/mongoc-iovec.h>
+#include <mongoc/mongoc-gridfs-file-private.h>
+#include <mongoc/mongoc-gridfs-private.h>
 #include <mongoc/mongoc-trace-private.h>
 #include <mongoc/mongoc-util-private.h>
-#include <mongoc/mongoc-error-private.h>
+
+#include <mongoc/mongoc-collection.h>
+#include <mongoc/mongoc-cursor.h>
+#include <mongoc/mongoc-gridfs-file-page.h>
+#include <mongoc/mongoc-gridfs.h>
+#include <mongoc/mongoc-iovec.h>
+
 #include <mlib/cmp.h>
 
+#include <errno.h>
+#include <limits.h>
+#include <time.h>
+
 static bool
 _mongoc_gridfs_file_refresh_page (mongoc_gridfs_file_t *file);
 
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-gridfs-file.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-gridfs-file.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-gridfs-file.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-gridfs-file.h	2025-08-14 18:37:23.000000000 +0000
@@ -19,13 +19,12 @@
 #ifndef MONGOC_GRIDFS_FILE_H
 #define MONGOC_GRIDFS_FILE_H
 
-#include <bson/bson.h>
-
 #include <mongoc/mongoc-macros.h>
 #include <mongoc/mongoc-socket.h>
 
-BSON_BEGIN_DECLS
+#include <bson/bson.h>
 
+BSON_BEGIN_DECLS
 
 #define MONGOC_GRIDFS_FILE_STR_HEADER(name)                    \
    MONGOC_EXPORT (const char *)                                \
@@ -33,18 +32,15 @@ BSON_BEGIN_DECLS
    MONGOC_EXPORT (void)                                        \
    mongoc_gridfs_file_set_##name (mongoc_gridfs_file_t *file, const char *str);
 
-
 #define MONGOC_GRIDFS_FILE_BSON_HEADER(name)                   \
    MONGOC_EXPORT (const bson_t *)                              \
    mongoc_gridfs_file_get_##name (mongoc_gridfs_file_t *file); \
    MONGOC_EXPORT (void)                                        \
    mongoc_gridfs_file_set_##name (mongoc_gridfs_file_t *file, const bson_t *bson);
 
-
 typedef struct _mongoc_gridfs_file_t mongoc_gridfs_file_t;
 typedef struct _mongoc_gridfs_file_opt_t mongoc_gridfs_file_opt_t;
 
-
 struct _mongoc_gridfs_file_opt_t {
    const char *md5;
    const char *filename;
@@ -54,14 +50,12 @@ struct _mongoc_gridfs_file_opt_t {
    uint32_t chunk_size;
 };
 
-
 MONGOC_GRIDFS_FILE_STR_HEADER (md5)
 MONGOC_GRIDFS_FILE_STR_HEADER (filename)
 MONGOC_GRIDFS_FILE_STR_HEADER (content_type)
 MONGOC_GRIDFS_FILE_BSON_HEADER (aliases)
 MONGOC_GRIDFS_FILE_BSON_HEADER (metadata)
 
-
 MONGOC_EXPORT (const bson_value_t *)
 mongoc_gridfs_file_get_id (mongoc_gridfs_file_t *file);
 
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-gridfs-private.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-gridfs-private.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-gridfs-private.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-gridfs-private.h	2025-08-14 18:37:23.000000000 +0000
@@ -19,11 +19,11 @@
 #ifndef MONGOC_GRIDFS_PRIVATE_H
 #define MONGOC_GRIDFS_PRIVATE_H
 
-#include <bson/bson.h>
-
+#include <mongoc/mongoc-client.h>
 #include <mongoc/mongoc-read-prefs.h>
 #include <mongoc/mongoc-write-concern.h>
-#include <mongoc/mongoc-client.h>
+
+#include <bson/bson.h>
 
 
 BSON_BEGIN_DECLS
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-gridfs.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-gridfs.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-gridfs.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-gridfs.c	2025-08-14 18:37:23.000000000 +0000
@@ -18,22 +18,24 @@
 #undef MONGOC_LOG_DOMAIN
 #define MONGOC_LOG_DOMAIN "gridfs"
 
-#include <mongoc/mongoc-bulk-operation.h>
+#include <mongoc/mongoc-gridfs.h>
+
 #include <mongoc/mongoc-client-private.h>
-#include <mongoc/mongoc-collection.h>
 #include <mongoc/mongoc-collection-private.h>
+#include <mongoc/mongoc-cursor-private.h>
 #include <mongoc/mongoc-error-private.h>
-#include <mongoc/mongoc-gridfs.h>
-#include <mongoc/mongoc-gridfs-private.h>
-#include <mongoc/mongoc-gridfs-file.h>
-#include <mongoc/mongoc-gridfs-file-private.h>
-#include <mongoc/mongoc-gridfs-file-list.h>
 #include <mongoc/mongoc-gridfs-file-list-private.h>
-#include <mongoc/mongoc-client.h>
+#include <mongoc/mongoc-gridfs-file-private.h>
+#include <mongoc/mongoc-gridfs-private.h>
 #include <mongoc/mongoc-trace-private.h>
-#include <mongoc/mongoc-cursor-private.h>
 #include <mongoc/mongoc-util-private.h>
 
+#include <mongoc/mongoc-bulk-operation.h>
+#include <mongoc/mongoc-client.h>
+#include <mongoc/mongoc-collection.h>
+#include <mongoc/mongoc-gridfs-file-list.h>
+#include <mongoc/mongoc-gridfs-file.h>
+
 #define MONGOC_GRIDFS_STREAM_CHUNK 4096
 
 
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-gridfs.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-gridfs.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-gridfs.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-gridfs.h	2025-08-14 18:37:23.000000000 +0000
@@ -19,13 +19,13 @@
 #ifndef MONGOC_GRIDFS_H
 #define MONGOC_GRIDFS_H
 
-#include <bson/bson.h>
-
-#include <mongoc/mongoc-macros.h>
-#include <mongoc/mongoc-stream.h>
-#include <mongoc/mongoc-gridfs-file.h>
 #include <mongoc/mongoc-collection.h>
 #include <mongoc/mongoc-gridfs-file-list.h>
+#include <mongoc/mongoc-gridfs-file.h>
+#include <mongoc/mongoc-macros.h>
+#include <mongoc/mongoc-stream.h>
+
+#include <bson/bson.h>
 
 
 BSON_BEGIN_DECLS
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-handshake-compiler-private.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-handshake-compiler-private.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-handshake-compiler-private.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-handshake-compiler-private.h	2025-08-14 18:37:23.000000000 +0000
@@ -18,9 +18,10 @@
 #ifndef MONGOC_HANDSHAKE_COMPILER_PRIVATE_H
 #define MONGOC_HANDSHAKE_COMPILER_PRIVATE_H
 
-#include <mongoc/mongoc-config.h>
 #include <mongoc/mongoc-util-private.h>
 
+#include <mongoc/mongoc-config.h>
+
 /*
  * Thanks to:
  * http://nadeausoftware.com/articles/2012/10/c_c_tip_how_detect_compiler_name_and_version_using_compiler_predefined_macros
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-handshake-private.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-handshake-private.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-handshake-private.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-handshake-private.h	2025-08-14 18:37:23.000000000 +0000
@@ -113,6 +113,9 @@ typedef struct _mongoc_handshake_t {
    char *compiler_info;
    char *flags;
 
+   bool docker;
+   bool kubernetes;
+
    mongoc_handshake_env_t env;
    optional_int32 env_timeout_sec;
    optional_int32 env_memory_mb;
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-handshake.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-handshake.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-handshake.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-handshake.c	2025-08-14 18:37:23.000000000 +0000
@@ -18,28 +18,31 @@
 
 #ifdef _POSIX_VERSION
 #include <sys/utsname.h>
+#include <unistd.h>
 #endif
 
 #ifdef _WIN32
 #include <windows.h>
 #endif
 
-#include <mongoc/mongoc-linux-distro-scanner-private.h>
-#include <mongoc/mongoc-handshake.h>
+#include <common-bson-dsl-private.h>
+#include <common-string-private.h>
+#include <mongoc/mongoc-client-private.h>
+#include <mongoc/mongoc-error-private.h>
 #include <mongoc/mongoc-handshake-compiler-private.h>
 #include <mongoc/mongoc-handshake-os-private.h>
 #include <mongoc/mongoc-handshake-private.h>
+#include <mongoc/mongoc-linux-distro-scanner-private.h>
+#include <mongoc/mongoc-util-private.h>
+
 #include <mongoc/mongoc-client.h>
-#include <mongoc/mongoc-client-private.h>
 #include <mongoc/mongoc-error.h>
-#include <mongoc/mongoc-error-private.h>
+#include <mongoc/mongoc-handshake.h>
 #include <mongoc/mongoc-log.h>
 #include <mongoc/mongoc-version.h>
-#include <mongoc/mongoc-util-private.h>
 
-#include <common-bson-dsl-private.h>
-#include <common-string-private.h>
 #include <mlib/cmp.h>
+#include <mlib/config.h>
 
 /*
  * Global handshake data instance. Initialized at startup from mongoc_init
@@ -178,9 +181,12 @@ _mongoc_handshake_get_config_hex_string
    _set_bit (bf, byte_count, MONGOC_MD_FLAG_ENABLE_SHM_COUNTERS);
 #endif
 
+   mlib_diagnostic_push ();
+   mlib_disable_constant_conditional_expression_warnings ();
    if (MONGOC_TRACE_ENABLED) {
       _set_bit (bf, byte_count, MONGOC_MD_FLAG_TRACE);
    }
+   mlib_diagnostic_pop ();
 
 #ifdef MONGOC_ENABLE_CLIENT_SIDE_ENCRYPTION
    _set_bit (bf, byte_count, MONGOC_MD_FLAG_ENABLE_CLIENT_SIDE_ENCRYPTION);
@@ -190,9 +196,12 @@ _mongoc_handshake_get_config_hex_string
    _set_bit (bf, byte_count, MONGOC_MD_FLAG_ENABLE_MONGODB_AWS_AUTH);
 #endif
 
+   mlib_diagnostic_push ();
+   mlib_disable_constant_conditional_expression_warnings ();
    if (MONGOC_SRV_ENABLED) {
       _set_bit (bf, byte_count, MONGOC_MD_FLAG_ENABLE_SRV);
    }
+   mlib_diagnostic_pop ();
 
    mcommon_string_append_t append;
    mcommon_string_set_append (mcommon_string_new_with_capacity ("0x", 2, 2 + byte_count * 2), &append);
@@ -275,9 +284,10 @@ _get_os_name (void)
       return bson_strndup (system_info.sysname, HANDSHAKE_OS_NAME_MAX);
    }
 
-#endif
-
    return NULL;
+#else
+   return NULL;
+#endif
 }
 
 static char *
@@ -348,15 +358,6 @@ _get_system_info (mongoc_handshake_t *ha
 }
 
 static void
-_free_system_info (mongoc_handshake_t *handshake)
-{
-   bson_free (handshake->os_type);
-   bson_free (handshake->os_name);
-   bson_free (handshake->os_version);
-   bson_free (handshake->os_architecture);
-}
-
-static void
 _get_driver_info (mongoc_handshake_t *handshake)
 {
    handshake->driver_name = bson_strndup ("mongoc", HANDSHAKE_DRIVER_NAME_MAX);
@@ -364,22 +365,25 @@ _get_driver_info (mongoc_handshake_t *ha
 }
 
 static void
-_free_driver_info (mongoc_handshake_t *handshake)
-{
-   bson_free (handshake->driver_name);
-   bson_free (handshake->driver_version);
-}
-
-static void
 _set_platform_string (mongoc_handshake_t *handshake)
 {
    handshake->platform = bson_strdup ("");
 }
 
 static void
-_free_env_info (mongoc_handshake_t *handshake)
+_get_container_info (mongoc_handshake_t *handshake)
 {
-   bson_free (handshake->env_region);
+   char *kubernetes_env = _mongoc_getenv ("KUBERNETES_SERVICE_HOST");
+   handshake->kubernetes = kubernetes_env;
+
+   handshake->docker = false;
+#ifdef _WIN32
+   handshake->docker = (_access_s ("C:\\.dockerenv", 0) == 0);
+#else
+   handshake->docker = (access ("/.dockerenv", F_OK) == 0);
+#endif
+
+   bson_free (kubernetes_env);
 }
 
 static void
@@ -505,14 +509,6 @@ _set_flags (mongoc_handshake_t *handshak
    handshake->flags = mcommon_string_from_append_destroy_with_steal (&append);
 }
 
-static void
-_free_platform_string (mongoc_handshake_t *handshake)
-{
-   bson_free (handshake->platform);
-   bson_free (handshake->compiler_info);
-   bson_free (handshake->flags);
-}
-
 void
 _mongoc_handshake_init (void)
 {
@@ -520,6 +516,7 @@ _mongoc_handshake_init (void)
    _get_driver_info (_mongoc_handshake_get ());
    _set_platform_string (_mongoc_handshake_get ());
    _get_env_info (_mongoc_handshake_get ());
+   _get_container_info (_mongoc_handshake_get ());
    _set_compiler_info (_mongoc_handshake_get ());
    _set_flags (_mongoc_handshake_get ());
 
@@ -531,11 +528,17 @@ void
 _mongoc_handshake_cleanup (void)
 {
    mongoc_handshake_t *h = _mongoc_handshake_get ();
-   _free_system_info (h);
-   _free_driver_info (h);
-   _free_platform_string (h);
-   _free_env_info (h);
-   *h = (mongoc_handshake_t){0};
+   bson_free (h->os_type);
+   bson_free (h->os_name);
+   bson_free (h->os_version);
+   bson_free (h->os_architecture);
+   bson_free (h->driver_name);
+   bson_free (h->driver_version);
+   bson_free (h->platform);
+   bson_free (h->compiler_info);
+   bson_free (h->flags);
+   bson_free (h->env_region);
+   *h = (mongoc_handshake_t) {0};
 
    bson_mutex_destroy (&gHandshakeLock);
 }
@@ -692,7 +695,11 @@ _mongoc_handshake_build_doc_with_applica
                     doc (kv ("name", cstr (env_name)),
                          if (md->env_timeout_sec.set, then (kv ("timeout_sec", int32 (md->env_timeout_sec.value)))),
                          if (md->env_memory_mb.set, then (kv ("memory_mb", int32 (md->env_memory_mb.value)))),
-                         if (md->env_region, then (kv ("region", cstr (md->env_region)))))))));
+                         if (md->env_region, then (kv ("region", cstr (md->env_region)))))))),
+      if (md->kubernetes || md->docker,
+          then (kv ("container",
+                    doc (if (md->docker, then (kv ("runtime", cstr ("docker")))),
+                         if (md->kubernetes, then (kv ("orchestrator", cstr ("kubernetes")))))))));
 
    if (md->platform) {
       _append_platform_field (doc, md->platform, false);
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-handshake.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-handshake.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-handshake.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-handshake.h	2025-08-14 18:37:23.000000000 +0000
@@ -20,10 +20,10 @@
 #ifndef MONGOC_HANDSHAKE_H
 #define MONGOC_HANDSHAKE_H
 
-#include <bson/bson.h>
-
 #include <mongoc/mongoc-macros.h>
 
+#include <bson/bson.h>
+
 BSON_BEGIN_DECLS
 
 #define MONGOC_HANDSHAKE_APPNAME_MAX 128
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-host-list-private.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-host-list-private.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-host-list-private.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-host-list-private.h	2025-08-14 18:37:23.000000000 +0000
@@ -21,6 +21,8 @@
 
 #include <mongoc/mongoc-host-list.h>
 
+#include <mlib/str.h>
+
 
 BSON_BEGIN_DECLS
 
@@ -38,7 +40,7 @@ _mongoc_host_list_from_string_with_err (
 
 bool
 _mongoc_host_list_from_hostport_with_err (mongoc_host_list_t *host_list,
-                                          const char *host,
+                                          mstr_view host,
                                           uint16_t port,
                                           bson_error_t *error);
 
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-host-list.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-host-list.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-host-list.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-host-list.c	2025-08-14 18:37:23.000000000 +0000
@@ -14,13 +14,15 @@
  * limitations under the License.
  */
 
-#include <inttypes.h> // PRIu16
-
-#include <mongoc/mongoc-host-list-private.h>
 #include <mongoc/mongoc-error-private.h>
+#include <mongoc/mongoc-host-list-private.h>
+
+#include <inttypes.h> // PRIu16
 /* strcasecmp on windows */
 #include <mongoc/mongoc-util-private.h>
+
 #include <mongoc/utlist.h>
+
 #include <mlib/cmp.h>
 
 static mongoc_host_list_t *
@@ -77,7 +79,6 @@ _mongoc_host_list_upsert (mongoc_host_li
    link->next = next_link;
 }
 
-
 /* Duplicates a host list.
  */
 mongoc_host_list_t *
@@ -138,7 +139,6 @@ _mongoc_host_list_contains_one (mongoc_h
    return NULL != _mongoc_host_list_find_host_and_port (host_list, host->host_and_port);
 }
 
-
 /*
  *--------------------------------------------------------------------------
  *
@@ -181,113 +181,120 @@ _mongoc_host_list_from_string (mongoc_ho
    return true;
 }
 
-bool
-_mongoc_host_list_from_string_with_err (mongoc_host_list_t *link_, const char *address, bson_error_t *error)
+static inline bool
+_parse_host_ipv6 (mongoc_host_list_t *link, mstr_view addr, bson_error_t *error)
 {
-   char *close_bracket;
-   char *sport;
-   uint16_t port;
-   char *host;
-   bool ret;
-   bool ipv6 = false;
-
-   close_bracket = strchr (address, ']');
-
-   /* if this is an ipv6 address. */
-   if (close_bracket) {
-      /* if present, the port should immediately follow after ] */
-      sport = strchr (close_bracket, ':');
-      if (sport > close_bracket + 1) {
+   bson_error_reset (error);
+   _mongoc_set_error (error, 0, 0, "Invalid IPv6 literal address '%.*s'", MSTR_FMT (addr));
+   // Find the opening bracket (must be the first char)
+   const size_t open_square_pos = mstr_find (addr, mstr_cstring ("["), 0, 1);
+   if (open_square_pos != 0) {
+      _mongoc_set_error (error,
+                         MONGOC_ERROR_COMMAND,
+                         MONGOC_ERROR_COMMAND_INVALID_ARG,
+                         "%s: Must start with a bracket '['",
+                         error->message);
+      return false;
+   }
+   // Find the closing bracket
+   const size_t close_square_pos = mstr_find (addr, mstr_cstring ("]"));
+   if (close_square_pos == SIZE_MAX) {
+      // Closing bracket is missing
+      _mongoc_set_error (error,
+                         MONGOC_ERROR_COMMAND,
+                         MONGOC_ERROR_COMMAND_INVALID_ARG,
+                         "%s: Mising closing bracket ']'",
+                         error->message);
+      return false;
+   }
+   // Find the port delimiter, if present. It must be the next character
+   const size_t port_delim_pos = mstr_find (addr, mstr_cstring (":"), close_square_pos + 1, 1);
+
+   if (port_delim_pos == SIZE_MAX) {
+      // There is no port specifier, or it is misplaced, so the closing bracket
+      // should be the final character:
+      if (close_square_pos != addr.len - 1) {
          _mongoc_set_error (error,
                             MONGOC_ERROR_COMMAND,
                             MONGOC_ERROR_COMMAND_INVALID_ARG,
-                            "If present, port should immediately follow the \"]\""
-                            "in an IPv6 address");
+                            "%s: Invalid trailing content following closing bracket ']'",
+                            error->message);
          return false;
       }
+   }
 
-      /* otherwise ] should be the last char. */
-      if (!sport && *(close_bracket + 1) != '\0') {
+   uint16_t port = MONGOC_DEFAULT_PORT;
+   if (port_delim_pos != SIZE_MAX) {
+      bson_error_t err2;
+      const mstr_view port_str = mstr_substr (addr, port_delim_pos + 1);
+      if (!_mongoc_parse_port (port_str, &port, &err2)) {
          _mongoc_set_error (error,
                             MONGOC_ERROR_COMMAND,
                             MONGOC_ERROR_COMMAND_INVALID_ARG,
-                            "If port is not supplied, \"[\" should be the last"
-                            "character");
+                            "%s: Invalid port '%.*s': %s",
+                            error->message,
+                            MSTR_FMT (port_str),
+                            err2.message);
          return false;
       }
-
-      if (*address != '[') {
-         _mongoc_set_error (
-            error, MONGOC_ERROR_COMMAND, MONGOC_ERROR_COMMAND_INVALID_ARG, "Missing matching bracket \"[\"");
-         return false;
-      }
-
-      ipv6 = true;
-   }
-   /* otherwise, just find the first : */
-   else {
-      sport = strchr (address, ':');
    }
 
-   /* like "example.com:27019" or "[fe80::1]:27019", but not "[fe80::1]" */
-   if (sport) {
-      if (sport == address) {
-         /* bad address like ":27017" */
+   return _mongoc_host_list_from_hostport_with_err (
+      link, mstr_slice (addr, open_square_pos + 1, close_square_pos), port, error);
+}
+
+static inline bool
+_parse_host (mongoc_host_list_t *link, mstr_view spec, bson_error_t *error)
+{
+   if (mstr_contains (spec, mstr_cstring ("]"))) {
+      // There is a "]" bracket, so this is probably an IPv6 literal, which is
+      // more strict
+      return _parse_host_ipv6 (link, spec, error);
+   }
+   // Parsing anything else is simpler.
+   uint16_t port = MONGOC_DEFAULT_PORT;
+   // Try to split around the port delimiter:
+   mstr_view hostname, port_str;
+   if (mstr_split_around (spec, mstr_cstring (":"), &hostname, &port_str)) {
+      // We have a ":" delimiter. Try to parse it as a port number:
+      bson_error_t e2;
+      if (!_mongoc_parse_port (port_str, &port, &e2)) {
+         // Invalid port number
          _mongoc_set_error (error,
                             MONGOC_ERROR_COMMAND,
                             MONGOC_ERROR_COMMAND_INVALID_ARG,
-                            "Bad address, \":\" should not be first character");
-         return false;
-      }
-
-      if (!mongoc_parse_port (&port, sport + 1)) {
-         _mongoc_set_error (error, MONGOC_ERROR_COMMAND, MONGOC_ERROR_COMMAND_INVALID_ARG, "Port could not be parsed");
+                            "Invalid host specifier '%.*s': Invalid port string '%.*s': %s",
+                            MSTR_FMT (spec),
+                            MSTR_FMT (port_str),
+                            e2.message);
          return false;
       }
-
-      /* if this is an ipv6 address, strip the [ and ] */
-      if (ipv6) {
-         host = bson_strndup (address + 1, close_bracket - address - 1);
-      } else {
-         host = bson_strndup (address, sport - address);
-      }
-   } else {
-      /* if this is an ipv6 address, strip the [ and ] */
-      if (ipv6) {
-         host = bson_strndup (address + 1, close_bracket - address - 1);
-      } else {
-         host = bson_strdup (address);
-      }
-      port = MONGOC_DEFAULT_PORT;
    }
 
-   ret = _mongoc_host_list_from_hostport_with_err (link_, host, port, error);
-
-   bson_free (host);
+   return _mongoc_host_list_from_hostport_with_err (link, hostname, port, error);
+}
 
-   return ret;
+bool
+_mongoc_host_list_from_string_with_err (mongoc_host_list_t *link_, const char *address, bson_error_t *error)
+{
+   return _parse_host (link_, mstr_cstring (address), error);
 }
 
 bool
-_mongoc_host_list_from_hostport_with_err (mongoc_host_list_t *link_,
-                                          const char *host,
-                                          uint16_t port,
-                                          bson_error_t *error)
+_mongoc_host_list_from_hostport_with_err (mongoc_host_list_t *link_, mstr_view host, uint16_t port, bson_error_t *error)
 {
-   BSON_ASSERT (host);
    BSON_ASSERT (link_);
-   size_t host_len = strlen (host);
-   *link_ = (mongoc_host_list_t){
+   *link_ = (mongoc_host_list_t) {
       .next = NULL,
       .port = port,
    };
 
-   if (host_len == 0) {
+   if (host.len == 0) {
       _mongoc_set_error (error, MONGOC_ERROR_STREAM, MONGOC_ERROR_STREAM_NAME_RESOLUTION, "Empty hostname in URI");
       return false;
    }
 
-   if (host_len > BSON_HOST_NAME_MAX) {
+   if (host.len > BSON_HOST_NAME_MAX) {
       _mongoc_set_error (error,
                          MONGOC_ERROR_STREAM,
                          MONGOC_ERROR_STREAM_NAME_RESOLUTION,
@@ -296,15 +303,15 @@ _mongoc_host_list_from_hostport_with_err
       return false;
    }
 
-   bson_strncpy (link_->host, host, host_len + 1);
+   bson_strncpy (link_->host, host.data, host.len + 1);
 
    /* like "fe80::1" or "::1" */
-   if (strchr (host, ':')) {
+   if (mstr_contains (host, mstr_cstring (":"))) {
       link_->family = AF_INET6;
 
       // Check that IPv6 literal is two less than the max to account for `[` and
       // `]` added below.
-      if (host_len > BSON_HOST_NAME_MAX - 2) {
+      if (host.len > BSON_HOST_NAME_MAX - 2) {
          _mongoc_set_error (error,
                             MONGOC_ERROR_STREAM,
                             MONGOC_ERROR_STREAM_NAME_RESOLUTION,
@@ -319,9 +326,9 @@ _mongoc_host_list_from_hostport_with_err
       BSON_ASSERT (mlib_in_range (size_t, req));
       // Use `<`, not `<=` to account for NULL byte.
       BSON_ASSERT ((size_t) req < sizeof link_->host_and_port);
-   } else if (strchr (host, '/') && strstr (host, ".sock")) {
+   } else if (mstr_contains (host, mstr_cstring ("/")) && mstr_contains (host, mstr_cstring (".sock"))) {
       link_->family = AF_UNIX;
-      bson_strncpy (link_->host_and_port, link_->host, host_len + 1);
+      bson_strncpy (link_->host_and_port, link_->host, host.len + 1);
    } else {
       /* This is either an IPv4 or hostname. */
       link_->family = AF_UNSPEC;
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-http-private.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-http-private.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-http-private.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-http-private.h	2025-08-14 18:37:23.000000000 +0000
@@ -14,12 +14,13 @@
  * limitations under the License.
  */
 
-#include <mongoc/mongoc.h>
-#include <mongoc/mongoc-ssl.h>
-
 #include <mongoc/mongoc-prelude.h>
+
 #include <common-string-private.h>
 
+#include <mongoc/mongoc-ssl.h>
+#include <mongoc/mongoc.h>
+
 #ifndef MONGOC_HTTP_PRIVATE_H
 #define MONGOC_HTTP_PRIVATE_H
 
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-http.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-http.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-http.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-http.c	2025-08-14 18:37:23.000000000 +0000
@@ -14,16 +14,17 @@
  * limitations under the License.
  */
 
-#include <mongoc/mongoc-http-private.h>
-
+#include <common-string-private.h>
+#include <mongoc/mongoc-buffer-private.h>
 #include <mongoc/mongoc-client-private.h>
-#include <mongoc/mongoc-host-list-private.h>
 #include <mongoc/mongoc-error-private.h>
-#include <mongoc/mongoc-stream-tls.h>
+#include <mongoc/mongoc-host-list-private.h>
+#include <mongoc/mongoc-http-private.h>
 #include <mongoc/mongoc-stream-private.h>
-#include <mongoc/mongoc-buffer-private.h>
+
 #include <mongoc/mcd-time.h>
-#include <common-string-private.h>
+#include <mongoc/mongoc-stream-tls.h>
+
 #include <mlib/cmp.h>
 
 void
@@ -121,7 +122,7 @@ _mongoc_http_send (const mongoc_http_req
    memset (res, 0, sizeof (*res));
    _mongoc_buffer_init (&http_response_buf, NULL, 0, NULL, NULL);
 
-   if (!_mongoc_host_list_from_hostport_with_err (&host_list, req->host, (uint16_t) req->port, error)) {
+   if (!_mongoc_host_list_from_hostport_with_err (&host_list, mstr_cstring (req->host), (uint16_t) req->port, error)) {
       goto fail;
    }
 
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-init.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-init.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-init.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-init.c	2025-08-14 18:37:23.000000000 +0000
@@ -15,24 +15,26 @@
  */
 
 
-#include <bson/bson.h>
-
-#include <mongoc/mongoc-config.h>
-#include <mongoc/mongoc-counters-private.h>
 #include <mongoc/mongoc-init.h>
 
+#include <mongoc/mongoc-cluster-aws-private.h>
+#include <mongoc/mongoc-counters-private.h>
 #include <mongoc/mongoc-handshake-private.h>
 
-#include <mongoc/mongoc-cluster-aws-private.h>
+#include <mongoc/mongoc-config.h>
+
+#include <bson/bson.h>
+
+#include <mlib/config.h>
 
 #ifdef MONGOC_ENABLE_SSL_OPENSSL
 #include <mongoc/mongoc-openssl-private.h>
 #endif
-#include <mongoc/mongoc-thread-private.h>
 #include <common-b64-private.h>
+#include <mongoc/mongoc-thread-private.h>
 #if defined(MONGOC_ENABLE_CRYPTO_CNG)
-#include <mongoc/mongoc-crypto-private.h>
 #include <mongoc/mongoc-crypto-cng-private.h>
+#include <mongoc/mongoc-crypto-private.h>
 #endif
 
 #ifdef MONGOC_ENABLE_MONGODB_AWS_AUTH
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-init.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-init.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-init.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-init.h	2025-08-14 18:37:23.000000000 +0000
@@ -19,10 +19,10 @@
 #ifndef MONGOC_INIT_H
 #define MONGOC_INIT_H
 
-#include <bson/bson.h>
-
 #include <mongoc/mongoc-macros.h>
 
+#include <bson/bson.h>
+
 BSON_BEGIN_DECLS
 
 
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-interrupt.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-interrupt.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-interrupt.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-interrupt.c	2025-08-14 18:37:23.000000000 +0000
@@ -14,13 +14,14 @@
  * limitations under the License.
  */
 
+#include <common-thread-private.h>
 #include <mongoc/mongoc-errno-private.h>
 #include <mongoc/mongoc-interrupt-private.h>
-#include <mongoc/mongoc-log.h>
 #include <mongoc/mongoc-socket-private.h>
-#include <mongoc/mongoc-stream-socket.h>
 #include <mongoc/mongoc-trace-private.h>
-#include <common-thread-private.h>
+
+#include <mongoc/mongoc-log.h>
+#include <mongoc/mongoc-stream-socket.h>
 
 /* The interrupt stream is implemented in two ways.
  * On POSIX, this uses the self-pipe trick.
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-linux-distro-scanner.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-linux-distro-scanner.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-linux-distro-scanner.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-linux-distro-scanner.c	2025-08-14 18:37:23.000000000 +0000
@@ -18,17 +18,19 @@
 
 #ifdef MONGOC_OS_IS_LINUX
 
-#include <stdio.h>
-#include <sys/utsname.h>
-
-#include <mongoc/mongoc-error.h>
-#include <mongoc/mongoc-linux-distro-scanner-private.h>
-#include <mongoc/mongoc-log.h>
 #include <mongoc/mongoc-handshake-private.h>
+#include <mongoc/mongoc-linux-distro-scanner-private.h>
 #include <mongoc/mongoc-trace-private.h>
 #include <mongoc/mongoc-util-private.h>
+
+#include <mongoc/mongoc-error.h>
+#include <mongoc/mongoc-log.h>
 #include <mongoc/mongoc-version.h>
 
+#include <sys/utsname.h>
+
+#include <stdio.h>
+
 #define LINE_BUFFER_SIZE 1024
 
 /*
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-log-and-monitor-private.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-log-and-monitor-private.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-log-and-monitor-private.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-log-and-monitor-private.c	2025-08-14 18:37:23.000000000 +0000
@@ -16,8 +16,9 @@
 
 
 #include <mongoc/mongoc-log-and-monitor-private.h>
-#include <mongoc/mongoc-structured-log-private.h>
+
 #include <common-atomic-private.h>
+#include <mongoc/mongoc-structured-log-private.h>
 
 
 /**
@@ -81,7 +82,7 @@ mongoc_log_and_monitor_instance_set_apm_
                                                    void *context)
 {
    BSON_ASSERT_PARAM (instance);
-   instance->apm_callbacks = callbacks ? *callbacks : (mongoc_apm_callbacks_t){0};
+   instance->apm_callbacks = callbacks ? *callbacks : (mongoc_apm_callbacks_t) {0};
    instance->apm_context = context;
 }
 
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-log-and-monitor-private.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-log-and-monitor-private.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-log-and-monitor-private.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-log-and-monitor-private.h	2025-08-14 18:37:23.000000000 +0000
@@ -19,8 +19,8 @@
 #ifndef MONGOC_LOG_AND_MONITOR_PRIVATE_H
 #define MONGOC_LOG_AND_MONITOR_PRIVATE_H
 
-#include <mongoc/mongoc-thread-private.h>
 #include <mongoc/mongoc-apm-private.h>
+#include <mongoc/mongoc-thread-private.h>
 
 struct mongoc_structured_log_instance_t;
 struct mongoc_structured_log_opts_t;
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-log-private.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-log-private.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-log-private.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-log-private.h	2025-08-14 18:37:23.000000000 +0000
@@ -20,6 +20,7 @@
 #define MONGOC_LOG_PRIVATE_H
 
 #include <mongoc/mongoc-iovec.h>
+#include <mongoc/mongoc-log.h>
 
 /* just for testing */
 void
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-log.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-log.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-log.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-log.c	2025-08-14 18:37:23.000000000 +0000
@@ -20,8 +20,8 @@
 #elif defined(_WIN32)
 #include <process.h>
 #elif defined(__APPLE__)
-#include <pthread.h>
 #include <AvailabilityMacros.h>
+#include <pthread.h>
 #elif defined(__FreeBSD__)
 #include <sys/thr.h>
 #elif defined(__NetBSD__)
@@ -29,13 +29,16 @@
 #else
 #include <unistd.h>
 #endif
-#include <stdarg.h>
-#include <time.h>
-
-#include <mongoc/mongoc-log.h>
+#include <common-string-private.h>
 #include <mongoc/mongoc-log-private.h>
 #include <mongoc/mongoc-thread-private.h>
-#include <common-string-private.h>
+
+#include <mongoc/mongoc-log.h>
+
+#include <mlib/config.h>
+
+#include <stdarg.h>
+#include <time.h>
 
 
 static bson_once_t once = BSON_ONCE_INIT;
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-log.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-log.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-log.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-log.h	2025-08-14 18:37:23.000000000 +0000
@@ -19,10 +19,10 @@
 #ifndef MONGOC_LOG_H
 #define MONGOC_LOG_H
 
-#include <bson/bson.h>
-
 #include <mongoc/mongoc-macros.h>
 
+#include <bson/bson.h>
+
 BSON_BEGIN_DECLS
 
 
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-memcmp-private.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-memcmp-private.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-memcmp-private.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-memcmp-private.h	2025-08-14 18:37:23.000000000 +0000
@@ -19,10 +19,10 @@
 #ifndef MONGOC_MEMCMP_PRIVATE_H
 #define MONGOC_MEMCMP_PRIVATE_H
 
-#include <bson/bson.h>
-
 #include <mongoc/mongoc-config.h>
 
+#include <bson/bson.h>
+
 /* WARNING: mongoc_memcmp() must be used to verify if two secret keys
  * are equal, in constant time.
  * It returns 0 if the keys are equal, and -1 if they differ.
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-ocsp-cache.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-ocsp-cache.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-ocsp-cache.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-ocsp-cache.c	2025-08-14 18:37:23.000000000 +0000
@@ -18,10 +18,14 @@
 #include <mongoc/mongoc-ocsp-cache-private.h>
 #ifdef MONGOC_ENABLE_OCSP_OPENSSL
 
-#include <mongoc/utlist.h>
+#include <common-thread-private.h>
 #include <mongoc/mongoc-trace-private.h>
+
+#include <mongoc/utlist.h>
+
 #include <bson/bson.h>
-#include <common-thread-private.h>
+
+#include <mlib/config.h>
 
 typedef struct _cache_entry_list_t {
    struct _cache_entry_list_t *next;
@@ -43,8 +47,9 @@ static int
 cache_cmp (cache_entry_list_t *out, OCSP_CERTID *id)
 {
    ENTRY;
-   if (!out || !out->id || !id)
+   if (!out || !out->id || !id) {
       RETURN (1);
+   }
    RETURN (OCSP_id_cmp (out->id, id));
 }
 
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-oidc-callback-private.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-oidc-callback-private.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-oidc-callback-private.h	1970-01-01 00:00:00.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-oidc-callback-private.h	2025-08-14 18:37:23.000000000 +0000
@@ -0,0 +1,60 @@
+/*
+ * Copyright 2009-present MongoDB, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <mongoc/mongoc-prelude.h>
+
+#ifndef MONGOC_OIDC_CALLBACK_PRIVATE_H
+#define MONGOC_OIDC_CALLBACK_PRIVATE_H
+
+#include <mongoc/mongoc-oidc-callback.h>
+
+//
+
+#include <stdint.h>
+
+// Authentication spec: the version number is used to communicate callback API changes that are not breaking but that
+// users may want to know about and review their implementation. Drivers MUST pass 1 for the initial callback API
+// version number and increment the version number anytime the API changes.
+#define MONGOC_PRIVATE_OIDC_CALLBACK_API_VERSION 1
+
+mongoc_oidc_callback_params_t *
+mongoc_oidc_callback_params_new (void);
+
+void
+mongoc_oidc_callback_params_destroy (mongoc_oidc_callback_params_t *params);
+
+void
+mongoc_oidc_callback_params_set_version (mongoc_oidc_callback_params_t *params, int32_t version);
+
+void
+mongoc_oidc_callback_params_set_user_data (mongoc_oidc_callback_params_t *params, void *user_data);
+
+void
+mongoc_oidc_callback_params_set_timeout (mongoc_oidc_callback_params_t *params, int64_t timeout);
+
+void
+mongoc_oidc_callback_params_unset_timeout (mongoc_oidc_callback_params_t *params);
+
+void
+mongoc_oidc_callback_params_set_username (mongoc_oidc_callback_params_t *params, const char *username);
+
+bool
+mongoc_oidc_callback_params_get_cancelled_with_timeout (const mongoc_oidc_callback_params_t *params);
+
+void
+mongoc_oidc_callback_params_set_cancelled_with_timeout (mongoc_oidc_callback_params_t *params, bool value);
+
+#endif // MONGOC_OIDC_CALLBACK_PRIVATE_H
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-oidc-callback.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-oidc-callback.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-oidc-callback.c	1970-01-01 00:00:00.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-oidc-callback.c	2025-08-14 18:37:23.000000000 +0000
@@ -0,0 +1,258 @@
+/*
+ * Copyright 2009-present MongoDB, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <mongoc/mongoc-oidc-callback-private.h>
+
+//
+
+#include <bson/bson.h>
+
+struct _mongoc_oidc_callback_t {
+   mongoc_oidc_callback_fn_t fn;
+   void *user_data;
+};
+
+struct _mongoc_oidc_callback_params_t {
+   void *user_data;
+   char *username;
+   int64_t timeout; // Guarded by timeout_is_set.
+   int32_t version;
+   bool cancelled_with_timeout;
+   bool timeout_is_set;
+};
+
+struct _mongoc_oidc_credential_t {
+   char *access_token;
+   int64_t expires_in; // Guarded by expires_in_set.
+   bool expires_in_set;
+};
+
+mongoc_oidc_callback_t *
+mongoc_oidc_callback_new (mongoc_oidc_callback_fn_t fn)
+{
+   if (!fn) {
+      return NULL;
+   }
+
+   mongoc_oidc_callback_t *const ret = bson_malloc (sizeof (*ret));
+   *ret = (mongoc_oidc_callback_t) {.fn = fn};
+   return ret;
+}
+
+mongoc_oidc_callback_t *
+mongoc_oidc_callback_new_with_user_data (mongoc_oidc_callback_fn_t fn, void *user_data)
+{
+   if (!fn) {
+      return NULL;
+   }
+
+   mongoc_oidc_callback_t *const ret = bson_malloc (sizeof (*ret));
+   *ret = (mongoc_oidc_callback_t) {.fn = fn, .user_data = user_data};
+   return ret;
+}
+
+void
+mongoc_oidc_callback_destroy (mongoc_oidc_callback_t *callback)
+{
+   if (callback) {
+      bson_free (callback);
+   }
+}
+
+mongoc_oidc_callback_fn_t
+mongoc_oidc_callback_get_fn (const mongoc_oidc_callback_t *callback)
+{
+   BSON_ASSERT_PARAM (callback);
+   return callback->fn;
+}
+
+void *
+mongoc_oidc_callback_get_user_data (const mongoc_oidc_callback_t *callback)
+{
+   BSON_ASSERT_PARAM (callback);
+   return callback->user_data;
+}
+
+void
+mongoc_oidc_callback_set_user_data (mongoc_oidc_callback_t *callback, void *user_data)
+{
+   BSON_ASSERT_PARAM (callback);
+   callback->user_data = user_data;
+}
+
+mongoc_oidc_callback_params_t *
+mongoc_oidc_callback_params_new (void)
+{
+   mongoc_oidc_callback_params_t *const ret = bson_malloc (sizeof (*ret));
+   *ret = (mongoc_oidc_callback_params_t) {
+      .version = MONGOC_PRIVATE_OIDC_CALLBACK_API_VERSION,
+   };
+   return ret;
+}
+
+void
+mongoc_oidc_callback_params_destroy (mongoc_oidc_callback_params_t *params)
+{
+   if (params) {
+      bson_free (params->username);
+      bson_free (params);
+   }
+}
+
+int32_t
+mongoc_oidc_callback_params_get_version (const mongoc_oidc_callback_params_t *params)
+{
+   BSON_ASSERT_PARAM (params);
+   return params->version;
+}
+
+void
+mongoc_oidc_callback_params_set_version (mongoc_oidc_callback_params_t *params, int32_t version)
+{
+   BSON_ASSERT_PARAM (params);
+   params->version = version;
+}
+
+void *
+mongoc_oidc_callback_params_get_user_data (const mongoc_oidc_callback_params_t *params)
+{
+   BSON_ASSERT_PARAM (params);
+   return params->user_data;
+}
+
+void
+mongoc_oidc_callback_params_set_user_data (mongoc_oidc_callback_params_t *params, void *user_data)
+{
+   BSON_ASSERT_PARAM (params);
+   params->user_data = user_data;
+}
+
+const int64_t *
+mongoc_oidc_callback_params_get_timeout (const mongoc_oidc_callback_params_t *params)
+{
+   BSON_ASSERT_PARAM (params);
+   return params->timeout_is_set ? &params->timeout : NULL;
+}
+
+void
+mongoc_oidc_callback_params_set_timeout (mongoc_oidc_callback_params_t *params, int64_t timeout)
+{
+   BSON_ASSERT_PARAM (params);
+   params->timeout = timeout;
+   params->timeout_is_set = true;
+}
+
+void
+mongoc_oidc_callback_params_unset_timeout (mongoc_oidc_callback_params_t *params)
+{
+   BSON_ASSERT_PARAM (params);
+   params->timeout_is_set = false;
+}
+
+const char *
+mongoc_oidc_callback_params_get_username (const mongoc_oidc_callback_params_t *params)
+{
+   BSON_ASSERT_PARAM (params);
+   return params->username;
+}
+
+void
+mongoc_oidc_callback_params_set_username (mongoc_oidc_callback_params_t *params, const char *username)
+{
+   BSON_ASSERT_PARAM (params);
+   bson_free (params->username);
+   params->username = bson_strdup (username);
+}
+
+mongoc_oidc_credential_t *
+mongoc_oidc_callback_params_cancel_with_timeout (mongoc_oidc_callback_params_t *params)
+{
+   BSON_ASSERT_PARAM (params);
+   params->cancelled_with_timeout = true;
+   return NULL;
+}
+
+bool
+mongoc_oidc_callback_params_get_cancelled_with_timeout (const mongoc_oidc_callback_params_t *params)
+{
+   BSON_ASSERT_PARAM (params);
+   return params->cancelled_with_timeout;
+}
+
+void
+mongoc_oidc_callback_params_set_cancelled_with_timeout (mongoc_oidc_callback_params_t *params, bool value)
+{
+   BSON_ASSERT_PARAM (params);
+   params->cancelled_with_timeout = value;
+}
+
+mongoc_oidc_credential_t *
+mongoc_oidc_credential_new (const char *access_token)
+{
+   if (!access_token) {
+      return NULL;
+   }
+
+   mongoc_oidc_credential_t *const ret = bson_malloc (sizeof (*ret));
+   *ret = (mongoc_oidc_credential_t) {
+      .access_token = bson_strdup (access_token),
+      .expires_in_set = false, // Infinite.
+   };
+   return ret;
+}
+
+mongoc_oidc_credential_t *
+mongoc_oidc_credential_new_with_expires_in (const char *access_token, int64_t expires_in)
+{
+   if (!access_token) {
+      return NULL;
+   }
+
+   if (expires_in < 0) {
+      return NULL;
+   }
+
+   mongoc_oidc_credential_t *const ret = bson_malloc (sizeof (*ret));
+   *ret = (mongoc_oidc_credential_t) {
+      .access_token = bson_strdup (access_token),
+      .expires_in_set = true,
+      .expires_in = expires_in,
+   };
+   return ret;
+}
+
+void
+mongoc_oidc_credential_destroy (mongoc_oidc_credential_t *cred)
+{
+   if (cred) {
+      bson_free (cred->access_token);
+      bson_free (cred);
+   }
+}
+
+const char *
+mongoc_oidc_credential_get_access_token (const mongoc_oidc_credential_t *cred)
+{
+   BSON_ASSERT_PARAM (cred);
+   return cred->access_token;
+}
+
+const int64_t *
+mongoc_oidc_credential_get_expires_in (const mongoc_oidc_credential_t *cred)
+{
+   BSON_ASSERT_PARAM (cred);
+   return cred->expires_in_set ? &cred->expires_in : NULL;
+}
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-oidc-callback.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-oidc-callback.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-oidc-callback.h	1970-01-01 00:00:00.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-oidc-callback.h	2025-08-14 18:37:23.000000000 +0000
@@ -0,0 +1,86 @@
+/*
+ * Copyright 2009-present MongoDB, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <mongoc/mongoc-prelude.h>
+
+#ifndef MONGOC_OIDC_CALLBACK_H
+#define MONGOC_OIDC_CALLBACK_H
+
+#include <mongoc/mongoc-macros.h>
+
+#include <bson/bson.h>
+
+#include <stdint.h>
+
+BSON_BEGIN_DECLS
+
+typedef struct _mongoc_oidc_callback_t mongoc_oidc_callback_t;
+typedef struct _mongoc_oidc_callback_params_t mongoc_oidc_callback_params_t;
+typedef struct _mongoc_oidc_credential_t mongoc_oidc_credential_t;
+
+typedef mongoc_oidc_credential_t *(MONGOC_CALL *mongoc_oidc_callback_fn_t) (mongoc_oidc_callback_params_t *params);
+
+MONGOC_EXPORT (mongoc_oidc_callback_t *)
+mongoc_oidc_callback_new (mongoc_oidc_callback_fn_t fn);
+
+MONGOC_EXPORT (mongoc_oidc_callback_t *)
+mongoc_oidc_callback_new_with_user_data (mongoc_oidc_callback_fn_t fn, void *user_data);
+
+MONGOC_EXPORT (void)
+mongoc_oidc_callback_destroy (mongoc_oidc_callback_t *callback);
+
+MONGOC_EXPORT (mongoc_oidc_callback_fn_t)
+mongoc_oidc_callback_get_fn (const mongoc_oidc_callback_t *callback);
+
+MONGOC_EXPORT (void *)
+mongoc_oidc_callback_get_user_data (const mongoc_oidc_callback_t *callback);
+
+MONGOC_EXPORT (void)
+mongoc_oidc_callback_set_user_data (mongoc_oidc_callback_t *callback, void *user_data);
+
+MONGOC_EXPORT (int32_t)
+mongoc_oidc_callback_params_get_version (const mongoc_oidc_callback_params_t *params);
+
+MONGOC_EXPORT (void *)
+mongoc_oidc_callback_params_get_user_data (const mongoc_oidc_callback_params_t *params);
+
+MONGOC_EXPORT (const int64_t *)
+mongoc_oidc_callback_params_get_timeout (const mongoc_oidc_callback_params_t *params);
+
+MONGOC_EXPORT (const char *)
+mongoc_oidc_callback_params_get_username (const mongoc_oidc_callback_params_t *params);
+
+MONGOC_EXPORT (mongoc_oidc_credential_t *)
+mongoc_oidc_callback_params_cancel_with_timeout (mongoc_oidc_callback_params_t *params);
+
+MONGOC_EXPORT (mongoc_oidc_credential_t *)
+mongoc_oidc_credential_new (const char *access_token);
+
+MONGOC_EXPORT (mongoc_oidc_credential_t *)
+mongoc_oidc_credential_new_with_expires_in (const char *access_token, int64_t expires_in);
+
+MONGOC_EXPORT (void)
+mongoc_oidc_credential_destroy (mongoc_oidc_credential_t *cred);
+
+MONGOC_EXPORT (const char *)
+mongoc_oidc_credential_get_access_token (const mongoc_oidc_credential_t *cred);
+
+MONGOC_EXPORT (const int64_t *)
+mongoc_oidc_credential_get_expires_in (const mongoc_oidc_credential_t *cred);
+
+BSON_END_DECLS
+
+#endif // MONGOC_OIDC_CALLBACK_H
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-oidc-env-private.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-oidc-env-private.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-oidc-env-private.h	1970-01-01 00:00:00.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-oidc-env-private.h	2025-08-14 18:37:23.000000000 +0000
@@ -0,0 +1,53 @@
+/*
+ * Copyright 2009-present MongoDB, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <mongoc/mongoc-prelude.h>
+
+#ifndef MONGOC_OIDC_ENV_PRIVATE_H
+#define MONGOC_OIDC_ENV_PRIVATE_H
+
+#include <mongoc/mongoc-macros.h>
+#include <mongoc/mongoc-oidc-callback.h>
+
+BSON_BEGIN_DECLS
+
+typedef struct _mongoc_oidc_env_t mongoc_oidc_env_t;
+typedef struct _mongoc_oidc_env_callback_t mongoc_oidc_env_callback_t;
+
+const mongoc_oidc_env_t *
+mongoc_oidc_env_find (const char *name);
+
+const char *
+mongoc_oidc_env_name (const mongoc_oidc_env_t *env);
+
+bool
+mongoc_oidc_env_supports_username (const mongoc_oidc_env_t *env);
+
+bool
+mongoc_oidc_env_requires_token_resource (const mongoc_oidc_env_t *env);
+
+mongoc_oidc_env_callback_t *
+mongoc_oidc_env_callback_new (const mongoc_oidc_env_t *env, const char *token_resource);
+
+void
+mongoc_oidc_env_callback_destroy (mongoc_oidc_env_callback_t *env_callback);
+
+const mongoc_oidc_callback_t *
+mongoc_oidc_env_callback_inner (const mongoc_oidc_env_callback_t *env_callback);
+
+BSON_END_DECLS
+
+#endif // MONGOC_OIDC_ENV_PRIVATE_H
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-oidc-env.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-oidc-env.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-oidc-env.c	1970-01-01 00:00:00.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-oidc-env.c	2025-08-14 18:37:23.000000000 +0000
@@ -0,0 +1,139 @@
+/*
+ * Copyright 2009-present MongoDB, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <mongoc/mongoc-oidc-env-private.h>
+
+#include <mongoc/mongoc-oidc-callback.h>
+
+struct _mongoc_oidc_env_t {
+   const char *name;
+   mongoc_oidc_callback_fn_t callback_fn;
+   bool supports_username;
+   bool requires_token_resource;
+};
+
+struct _mongoc_oidc_env_callback_t {
+   mongoc_oidc_callback_t *inner; // Contains non-owning user_data pointer back to this mongoc_oidc_env_callback_t
+   char *token_resource;
+};
+
+static mongoc_oidc_credential_t *
+mongoc_oidc_env_fn_test (mongoc_oidc_callback_params_t *params)
+{
+   BSON_UNUSED (params);
+   // TODO (CDRIVER-4489)
+   return NULL;
+}
+
+static mongoc_oidc_credential_t *
+mongoc_oidc_env_fn_azure (mongoc_oidc_callback_params_t *params)
+{
+   BSON_UNUSED (params);
+   // TODO (CDRIVER-4489)
+   return NULL;
+}
+
+static mongoc_oidc_credential_t *
+mongoc_oidc_env_fn_gcp (mongoc_oidc_callback_params_t *params)
+{
+   BSON_UNUSED (params);
+   // TODO (CDRIVER-4489)
+   return NULL;
+}
+
+static mongoc_oidc_credential_t *
+mongoc_oidc_env_fn_k8s (mongoc_oidc_callback_params_t *params)
+{
+   BSON_UNUSED (params);
+   // TODO (CDRIVER-4489)
+   return NULL;
+}
+
+const mongoc_oidc_env_t *
+mongoc_oidc_env_find (const char *name)
+{
+   static const mongoc_oidc_env_t oidc_env_table[] = {
+      {.name = "test", .callback_fn = mongoc_oidc_env_fn_test},
+      {.name = "azure",
+       .supports_username = true,
+       .requires_token_resource = true,
+       .callback_fn = mongoc_oidc_env_fn_azure},
+      {.name = "gcp", .requires_token_resource = true, .callback_fn = mongoc_oidc_env_fn_gcp},
+      {.name = "k8s", .callback_fn = mongoc_oidc_env_fn_k8s},
+      {0}};
+
+   if (name) {
+      for (const mongoc_oidc_env_t *row = oidc_env_table; row->name; ++row) {
+         if (!strcmp (name, row->name)) {
+            return row;
+         }
+      }
+   }
+   return NULL;
+}
+
+const char *
+mongoc_oidc_env_name (const mongoc_oidc_env_t *env)
+{
+   BSON_ASSERT_PARAM (env);
+   return env->name;
+}
+
+bool
+mongoc_oidc_env_supports_username (const mongoc_oidc_env_t *env)
+{
+   BSON_ASSERT_PARAM (env);
+   return env->supports_username;
+}
+
+bool
+mongoc_oidc_env_requires_token_resource (const mongoc_oidc_env_t *env)
+{
+   BSON_ASSERT_PARAM (env);
+   return env->requires_token_resource;
+}
+
+mongoc_oidc_env_callback_t *
+mongoc_oidc_env_callback_new (const mongoc_oidc_env_t *env, const char *token_resource)
+{
+   BSON_ASSERT_PARAM (env);
+   BSON_OPTIONAL_PARAM (token_resource);
+   mongoc_oidc_env_callback_t *env_callback = bson_malloc (sizeof *env_callback);
+   // Note that the callback's user_data points back to this containing mongoc_oidc_env_callback_t.
+   // We expect that the inner callback can only be destroyed via mongoc_oidc_env_callback_destroy.
+   *env_callback =
+      (mongoc_oidc_env_callback_t) {.inner = mongoc_oidc_callback_new_with_user_data (env->callback_fn, env_callback),
+                                    .token_resource = bson_strdup (token_resource)};
+   return env_callback;
+}
+
+void
+mongoc_oidc_env_callback_destroy (mongoc_oidc_env_callback_t *env_callback)
+{
+   if (env_callback) {
+      BSON_ASSERT (mongoc_oidc_callback_get_user_data (env_callback->inner) == (void *) env_callback);
+      mongoc_oidc_callback_destroy (env_callback->inner);
+      bson_free (env_callback->token_resource);
+      bson_free (env_callback);
+   }
+}
+
+const mongoc_oidc_callback_t *
+mongoc_oidc_env_callback_inner (const mongoc_oidc_env_callback_t *env_callback)
+{
+   BSON_ASSERT_PARAM (env_callback);
+   return env_callback->inner;
+}
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-openssl-private.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-openssl-private.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-openssl-private.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-openssl-private.h	2025-08-14 18:37:23.000000000 +0000
@@ -19,13 +19,15 @@
 #ifndef MONGOC_OPENSSL_PRIVATE_H
 #define MONGOC_OPENSSL_PRIVATE_H
 
+#include <mongoc/mongoc-stream-tls-openssl-private.h>
+
+#include <mongoc/mongoc-ssl.h>
+
 #include <bson/bson.h>
+
 #include <openssl/bio.h>
-#include <openssl/ssl.h>
 #include <openssl/err.h>
-
-#include <mongoc/mongoc-ssl.h>
-#include <mongoc/mongoc-stream-tls-openssl-private.h>
+#include <openssl/ssl.h>
 
 #if (OPENSSL_VERSION_NUMBER >= 0x10001000L) && !defined(OPENSSL_NO_OCSP) && !defined(LIBRESSL_VERSION_NUMBER)
 #define MONGOC_ENABLE_OCSP_OPENSSL
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-openssl.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-openssl.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-openssl.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-openssl.c	2025-08-14 18:37:23.000000000 +0000
@@ -18,29 +18,32 @@
 
 #ifdef MONGOC_ENABLE_SSL_OPENSSL
 
-#include <bson/bson.h>
-#include <limits.h>
-#include <openssl/bio.h>
-#include <openssl/ssl.h>
-#include <openssl/err.h>
-#include <openssl/ocsp.h>
-#include <openssl/x509v3.h>
-#include <openssl/crypto.h>
-
-#include <string.h>
-
 #include <mongoc/mongoc-error-private.h>
 #include <mongoc/mongoc-http-private.h>
-#include <mongoc/mongoc-init.h>
 #include <mongoc/mongoc-openssl-private.h>
-#include <mongoc/mongoc-socket.h>
-#include <mongoc/mongoc-ssl.h>
 #include <mongoc/mongoc-stream-tls-openssl-private.h>
 #include <mongoc/mongoc-thread-private.h>
 #include <mongoc/mongoc-trace-private.h>
 #include <mongoc/mongoc-util-private.h>
+
+#include <mongoc/mongoc-init.h>
+#include <mongoc/mongoc-socket.h>
+#include <mongoc/mongoc-ssl.h>
+
+#include <bson/bson.h>
+
 #include <mlib/cmp.h>
 
+#include <openssl/bio.h>
+#include <openssl/crypto.h>
+#include <openssl/err.h>
+#include <openssl/ocsp.h>
+#include <openssl/ssl.h>
+#include <openssl/x509v3.h>
+
+#include <limits.h>
+#include <string.h>
+
 #ifdef MONGOC_ENABLE_OCSP_OPENSSL
 #include <mongoc/mongoc-ocsp-cache-private.h>
 #endif
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-optional.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-optional.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-optional.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-optional.h	2025-08-14 18:37:23.000000000 +0000
@@ -19,10 +19,10 @@
 #ifndef MONGOC_OPTIONAL_H
 #define MONGOC_OPTIONAL_H
 
-#include <bson/bson.h>
-
 #include <mongoc/mongoc-macros.h>
 
+#include <bson/bson.h>
+
 BSON_BEGIN_DECLS
 
 typedef struct {
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-opts-helpers-private.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-opts-helpers-private.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-opts-helpers-private.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-opts-helpers-private.h	2025-08-14 18:37:23.000000000 +0000
@@ -16,11 +16,12 @@
 
 #include <mongoc/mongoc-prelude.h>
 
-#include <bson/bson.h>
 #include <mongoc/mongoc-client-session-private.h>
 #include <mongoc/mongoc-collection-private.h>
 #include <mongoc/mongoc-write-command-private.h>
 
+#include <bson/bson.h>
+
 #ifndef LIBMONGOC_MONGOC_OPTS_HELPERS_H
 #define LIBMONGOC_MONGOC_OPTS_HELPERS_H
 
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-opts-helpers.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-opts-helpers.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-opts-helpers.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-opts-helpers.c	2025-08-14 18:37:23.000000000 +0000
@@ -14,12 +14,13 @@
  * limitations under the License.
  */
 
-#include <mongoc/mongoc-opts-helpers-private.h>
 #include <mongoc/mongoc-client-session-private.h>
 #include <mongoc/mongoc-error-private.h>
-#include <mongoc/mongoc-write-concern-private.h>
-#include <mongoc/mongoc-util-private.h>
+#include <mongoc/mongoc-opts-helpers-private.h>
 #include <mongoc/mongoc-read-concern-private.h>
+#include <mongoc/mongoc-util-private.h>
+#include <mongoc/mongoc-write-concern-private.h>
+
 #include <mlib/cmp.h>
 
 #define BSON_ERR(...)                                                                       \
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-opts-private.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-opts-private.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-opts-private.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-opts-private.h	2025-08-14 18:37:23.000000000 +0000
@@ -19,12 +19,13 @@
 #ifndef MONGOC_OPTS_H
 #define MONGOC_OPTS_H
 
-#include <bson/bson.h>
-
-#include <mongoc/mongoc-client-session.h>
 #include <mongoc/mongoc-bulk-operation-private.h>
 #include <mongoc/mongoc-opts-helpers-private.h>
 
+#include <mongoc/mongoc-client-session.h>
+
+#include <bson/bson.h>
+
 /**************************************************
  *
  * Generated by build/generate-opts.py.
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-opts.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-opts.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-opts.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-opts.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,8 +1,8 @@
+#include <mongoc/mongoc-client-private.h>
+#include <mongoc/mongoc-error-private.h>
 #include <mongoc/mongoc-opts-helpers-private.h>
 #include <mongoc/mongoc-opts-private.h>
-#include <mongoc/mongoc-error-private.h>
 #include <mongoc/mongoc-util-private.h>
-#include <mongoc/mongoc-client-private.h>
 
 /**************************************************
  *
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-queue-private.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-queue-private.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-queue-private.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-queue-private.h	2025-08-14 18:37:23.000000000 +0000
@@ -19,18 +19,15 @@
 #ifndef MONGOC_QUEUE_PRIVATE_H
 #define MONGOC_QUEUE_PRIVATE_H
 
-#include <bson/bson.h>
-
 #include <mongoc/mongoc-list-private.h>
 
+#include <bson/bson.h>
+
 
 BSON_BEGIN_DECLS
 
 
-#define MONGOC_QUEUE_INITIALIZER \
-   {                             \
-      NULL, NULL                 \
-   }
+#define MONGOC_QUEUE_INITIALIZER {NULL, NULL}
 
 
 typedef struct _mongoc_queue_t mongoc_queue_t;
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-queue.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-queue.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-queue.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-queue.c	2025-08-14 18:37:23.000000000 +0000
@@ -15,10 +15,10 @@
  */
 
 
-#include <string.h>
-
 #include <mongoc/mongoc-queue-private.h>
 
+#include <string.h>
+
 
 void
 _mongoc_queue_init (mongoc_queue_t *queue)
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-rand-cng.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-rand-cng.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-rand-cng.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-rand-cng.c	2025-08-14 18:37:23.000000000 +0000
@@ -18,14 +18,16 @@
 
 #ifdef MONGOC_ENABLE_SSL_SECURE_CHANNEL
 
-#include <mongoc/mongoc-rand.h>
 #include <mongoc/mongoc-rand-private.h>
 
+#include <mongoc/mongoc-rand.h>
 #include <mongoc/mongoc.h>
 
+#include <bcrypt.h>
+
 #include <windows.h>
+
 #include <stdio.h>
-#include <bcrypt.h>
 
 #define NT_SUCCESS(Status) (((NTSTATUS) (Status)) >= 0)
 #define STATUS_UNSUCCESSFUL ((NTSTATUS) 0xC0000001L)
@@ -56,12 +58,17 @@ _mongoc_rand_bytes (uint8_t *buf, int nu
 void
 mongoc_rand_seed (const void *buf, int num)
 {
+   BSON_UNUSED (buf);
+   BSON_UNUSED (num);
    /* N/A - OS Does not need entropy seed */
 }
 
 void
 mongoc_rand_add (const void *buf, int num, double entropy)
 {
+   BSON_UNUSED (buf);
+   BSON_UNUSED (num);
+   BSON_UNUSED (entropy);
    /* N/A - OS Does not need entropy seed */
 }
 
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-rand-common-crypto.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-rand-common-crypto.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-rand-common-crypto.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-rand-common-crypto.c	2025-08-14 18:37:23.000000000 +0000
@@ -18,10 +18,11 @@
 
 #ifdef MONGOC_ENABLE_CRYPTO_COMMON_CRYPTO
 
-#include <mongoc/mongoc-rand.h>
 #include <mongoc/mongoc-rand-private.h>
 
+#include <mongoc/mongoc-rand.h>
 #include <mongoc/mongoc.h>
+
 #include <Security/Security.h>
 /* rumour has it this wasn't in standard Security.h in ~10.8 */
 #include <Security/SecRandom.h>
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-rand-openssl.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-rand-openssl.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-rand-openssl.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-rand-openssl.c	2025-08-14 18:37:23.000000000 +0000
@@ -18,9 +18,9 @@
 
 #ifdef MONGOC_ENABLE_CRYPTO_LIBCRYPTO
 
-#include <mongoc/mongoc-rand.h>
 #include <mongoc/mongoc-rand-private.h>
 
+#include <mongoc/mongoc-rand.h>
 #include <mongoc/mongoc.h>
 
 #include <openssl/opensslv.h>
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-rand.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-rand.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-rand.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-rand.h	2025-08-14 18:37:23.000000000 +0000
@@ -21,10 +21,10 @@
 #define MONGOC_RAND_H
 
 
-#include <bson/bson.h>
-
 #include <mongoc/mongoc-macros.h>
 
+#include <bson/bson.h>
+
 BSON_BEGIN_DECLS
 
 MONGOC_EXPORT (void)
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-read-concern-private.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-read-concern-private.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-read-concern-private.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-read-concern-private.h	2025-08-14 18:37:23.000000000 +0000
@@ -19,9 +19,10 @@
 #ifndef MONGOC_READ_CONCERN_PRIVATE_H
 #define MONGOC_READ_CONCERN_PRIVATE_H
 
-#include <bson/bson.h>
 #include <mongoc/mongoc-read-concern.h>
 
+#include <bson/bson.h>
+
 
 BSON_BEGIN_DECLS
 
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-read-concern.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-read-concern.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-read-concern.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-read-concern.c	2025-08-14 18:37:23.000000000 +0000
@@ -15,11 +15,13 @@
  */
 
 
-#include <mongoc/mongoc-error-private.h>
-#include <mongoc/mongoc-log.h>
 #include <mongoc/mongoc-read-concern.h>
+
+#include <mongoc/mongoc-error-private.h>
 #include <mongoc/mongoc-read-concern-private.h>
 
+#include <mongoc/mongoc-log.h>
+
 
 static void
 _mongoc_read_concern_freeze (mongoc_read_concern_t *read_concern);
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-read-concern.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-read-concern.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-read-concern.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-read-concern.h	2025-08-14 18:37:23.000000000 +0000
@@ -19,10 +19,10 @@
 #ifndef MONGOC_READ_CONCERN_H
 #define MONGOC_READ_CONCERN_H
 
-#include <bson/bson.h>
-
 #include <mongoc/mongoc-macros.h>
 
+#include <bson/bson.h>
+
 BSON_BEGIN_DECLS
 
 
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-read-prefs-private.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-read-prefs-private.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-read-prefs-private.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-read-prefs-private.h	2025-08-14 18:37:23.000000000 +0000
@@ -19,11 +19,12 @@
 #ifndef MONGOC_READ_PREFS_PRIVATE_H
 #define MONGOC_READ_PREFS_PRIVATE_H
 
-#include <bson/bson.h>
-
 #include <mongoc/mongoc-cluster-private.h>
+
 #include <mongoc/mongoc-read-prefs.h>
 
+#include <bson/bson.h>
+
 
 BSON_BEGIN_DECLS
 
@@ -42,10 +43,7 @@ typedef struct _mongoc_assemble_query_re
 } mongoc_assemble_query_result_t;
 
 
-#define ASSEMBLE_QUERY_RESULT_INIT   \
-   {                                 \
-      NULL, false, MONGOC_QUERY_NONE \
-   }
+#define ASSEMBLE_QUERY_RESULT_INIT {NULL, false, MONGOC_QUERY_NONE}
 
 const char *
 _mongoc_read_mode_as_str (mongoc_read_mode_t mode);
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-read-prefs.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-read-prefs.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-read-prefs.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-read-prefs.c	2025-08-14 18:37:23.000000000 +0000
@@ -15,11 +15,12 @@
  */
 
 
-#include <mlib/config.h>
 #include <mongoc/mongoc-error-private.h>
 #include <mongoc/mongoc-read-prefs-private.h>
 #include <mongoc/mongoc-trace-private.h>
+
 #include <mlib/cmp.h>
+#include <mlib/config.h>
 
 
 mongoc_read_prefs_t *
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-read-prefs.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-read-prefs.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-read-prefs.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-read-prefs.h	2025-08-14 18:37:23.000000000 +0000
@@ -19,10 +19,10 @@
 #ifndef MONGOC_READ_PREFS_H
 #define MONGOC_READ_PREFS_H
 
-#include <bson/bson.h>
-
-#include <mongoc/mongoc-macros.h>
 #include <mongoc/mongoc-config.h>
+#include <mongoc/mongoc-macros.h>
+
+#include <bson/bson.h>
 
 BSON_BEGIN_DECLS
 
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-rpc.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-rpc.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-rpc.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-rpc.c	2025-08-14 18:37:23.000000000 +0000
@@ -15,10 +15,9 @@
  */
 
 
-#include <mongoc/mongoc-rpc-private.h>
-
 #include <mongoc/mongoc-counters-private.h>
 #include <mongoc/mongoc-error-private.h>
+#include <mongoc/mongoc-rpc-private.h>
 #include <mongoc/mongoc-trace-private.h>
 
 
@@ -35,7 +34,7 @@ mcd_rpc_message_get_body (const mcd_rpc_
          case 0: { // Body.
             const uint8_t *const body = mcd_rpc_op_msg_section_get_body (rpc, index);
 
-            const int32_t body_len = bson_iter_int32_unsafe (&(bson_iter_t){.raw = body});
+            const int32_t body_len = bson_iter_int32_unsafe (&(bson_iter_t) {.raw = body});
 
             return bson_init_static (reply, body, (size_t) body_len);
          }
@@ -59,7 +58,7 @@ mcd_rpc_message_get_body (const mcd_rpc_
       // Assume the first document in OP_REPLY is the body.
       const uint8_t *const body = mcd_rpc_op_reply_get_documents (rpc);
 
-      return bson_init_static (reply, body, (size_t) bson_iter_int32_unsafe (&(bson_iter_t){.raw = body}));
+      return bson_init_static (reply, body, (size_t) bson_iter_int32_unsafe (&(bson_iter_t) {.raw = body}));
    }
 
    default:
@@ -328,14 +327,14 @@ mcd_rpc_message_egress (const mcd_rpc_me
    // `mcd_rpc_message_to_iovecs`, which converts the opCode field to
    // little endian.
    int32_t op_code = mcd_rpc_header_get_op_code (rpc);
-   op_code = bson_iter_int32_unsafe (&(bson_iter_t){.raw = (const uint8_t *) &op_code});
+   op_code = bson_iter_int32_unsafe (&(bson_iter_t) {.raw = (const uint8_t *) &op_code});
 
    if (op_code == MONGOC_OP_CODE_COMPRESSED) {
       mongoc_counter_op_egress_compressed_inc ();
       mongoc_counter_op_egress_total_inc ();
 
       op_code = mcd_rpc_op_compressed_get_original_opcode (rpc);
-      op_code = bson_iter_int32_unsafe (&(bson_iter_t){.raw = (const uint8_t *) &op_code});
+      op_code = bson_iter_int32_unsafe (&(bson_iter_t) {.raw = (const uint8_t *) &op_code});
    }
 
    switch (op_code) {
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-sasl-private.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-sasl-private.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-sasl-private.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-sasl-private.h	2025-08-14 18:37:23.000000000 +0000
@@ -19,11 +19,13 @@
 #ifndef MONGOC_SASL_PRIVATE_H
 #define MONGOC_SASL_PRIVATE_H
 
-#include <bson/bson.h>
-#include <mongoc/mongoc-uri.h>
 #include <mongoc/mongoc-stream-private.h>
-#include <mongoc/mongoc-stream.h>
+
 #include <mongoc/mongoc-stream-socket.h>
+#include <mongoc/mongoc-stream.h>
+#include <mongoc/mongoc-uri.h>
+
+#include <bson/bson.h>
 
 BSON_BEGIN_DECLS
 
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-sasl.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-sasl.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-sasl.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-sasl.c	2025-08-14 18:37:23.000000000 +0000
@@ -17,11 +17,10 @@
 #include <mongoc/mongoc-config.h>
 
 #ifdef MONGOC_ENABLE_SASL
+#include <mongoc/mongoc-change-stream-private.h>
 #include <mongoc/mongoc-sasl-private.h>
-#include <mongoc/mongoc-util-private.h>
-
 #include <mongoc/mongoc-trace-private.h>
-#include <mongoc/mongoc-change-stream-private.h>
+#include <mongoc/mongoc-util-private.h>
 
 #undef MONGOC_LOG_DOMAIN
 #define MONGOC_LOG_DOMAIN "SASL"
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-scram-private.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-scram-private.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-scram-private.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-scram-private.h	2025-08-14 18:37:23.000000000 +0000
@@ -21,9 +21,10 @@
 #define MONGOC_SCRAM_PRIVATE_H
 
 
-#include <bson/bson.h>
 #include <mongoc/mongoc-crypto-private.h>
 
+#include <bson/bson.h>
+
 
 BSON_BEGIN_DECLS
 
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-scram.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-scram.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-scram.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-scram.c	2025-08-14 18:37:23.000000000 +0000
@@ -17,23 +17,23 @@
 
 #ifdef MONGOC_ENABLE_CRYPTO
 
-#include <string.h>
-
+#include <common-b64-private.h>
+#include <common-thread-private.h>
+#include <mongoc/mongoc-crypto-private.h>
 #include <mongoc/mongoc-error-private.h>
-#include <mongoc/mongoc-scram-private.h>
+#include <mongoc/mongoc-memcmp-private.h>
 #include <mongoc/mongoc-rand-private.h>
-#include <mongoc/mongoc-util-private.h>
+#include <mongoc/mongoc-scram-private.h>
 #include <mongoc/mongoc-trace-private.h>
+#include <mongoc/mongoc-util-private.h>
 
-#include <mongoc/mongoc-crypto-private.h>
-#include <common-b64-private.h>
-
-#include <mongoc/mongoc-memcmp-private.h>
-#include <common-thread-private.h>
-#include <utf8proc.h>
 #include <mlib/cmp.h>
 #include <mlib/loop.h>
 
+#include <utf8proc.h>
+
+#include <string.h>
+
 typedef struct _mongoc_scram_cache_entry_t {
    /* book keeping */
    bool taken;
@@ -565,6 +565,7 @@ _mongoc_scram_step2 (mongoc_scram_t *scr
        * MD5( UTF8( username + ':mongo:' + plain_text_password )))" */
       tmp = bson_strdup_printf ("%s:mongo:%s", scram->user, scram->pass);
       hashed_password = _mongoc_hex_md5 (tmp);
+      BSON_ASSERT (hashed_password);
       bson_zero_free (tmp, strlen (tmp));
    } else if (scram->crypto.algorithm == MONGOC_CRYPTO_ALGORITHM_SHA_256) {
       /* Auth spec for SCRAM-SHA-256: "Passwords MUST be prepared with SASLprep,
@@ -743,9 +744,7 @@ _mongoc_scram_step2 (mongoc_scram_t *scr
    }
 
    /* Save the presecrets for caching */
-   if (hashed_password) {
-      bson_strncpy (scram->hashed_password, hashed_password, sizeof (scram->hashed_password));
-   }
+   bson_strncpy (scram->hashed_password, hashed_password, sizeof (scram->hashed_password));
 
    scram->iterations = iterations;
    memcpy (scram->decoded_salt, decoded_salt, sizeof (scram->decoded_salt));
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-secure-channel-private.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-secure-channel-private.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-secure-channel-private.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-secure-channel-private.h	2025-08-14 18:37:23.000000000 +0000
@@ -19,24 +19,25 @@
 #ifndef MONGOC_SECURE_CHANNEL_PRIVATE_H
 #define MONGOC_SECURE_CHANNEL_PRIVATE_H
 
-#include <bson/bson.h>
+#include <mongoc/mongoc-stream-tls-secure-channel-private.h>
 
 #include <mongoc/mongoc-ssl.h>
 #include <mongoc/mongoc-stream-tls.h>
-#include <mongoc/mongoc-stream-tls-secure-channel-private.h>
+
+#include <bson/bson.h>
 
 #define SECURITY_WIN32
-#include <security.h>
-#include <schnlsp.h>
 #include <schannel.h>
+#include <schnlsp.h>
+#include <security.h>
 
 BSON_BEGIN_DECLS
 
 bool
-mongoc_secure_channel_setup_ca (mongoc_ssl_opt_t *opt);
+mongoc_secure_channel_setup_ca (const mongoc_ssl_opt_t *opt);
 
 bool
-mongoc_secure_channel_setup_crl (mongoc_ssl_opt_t *opt);
+mongoc_secure_channel_setup_crl (const mongoc_ssl_opt_t *opt);
 
 // mongoc_secure_channel_load_crl is used in tests.
 PCCRL_CONTEXT
@@ -49,7 +50,7 @@ ssize_t
 mongoc_secure_channel_write (mongoc_stream_tls_t *tls, const void *data, size_t data_length);
 
 PCCERT_CONTEXT
-mongoc_secure_channel_setup_certificate (mongoc_ssl_opt_t *opt);
+mongoc_secure_channel_setup_certificate (const mongoc_ssl_opt_t *opt);
 
 
 /* it may require 16k + some overhead to hold one decryptable block of data - do
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-secure-channel.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-secure-channel.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-secure-channel.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-secure-channel.c	2025-08-14 18:37:23.000000000 +0000
@@ -18,28 +18,45 @@
 
 #ifdef MONGOC_ENABLE_SSL_SECURE_CHANNEL
 
-#include <bson/bson.h>
+#include <common-string-private.h>
+#include <mongoc/mongoc-crypto-private.h> // mongoc_crypto_hash
+#include <mongoc/mongoc-errno-private.h>
+#include <mongoc/mongoc-error-private.h>
+#include <mongoc/mongoc-secure-channel-private.h>
+#include <mongoc/mongoc-stream-tls-private.h>
+#include <mongoc/mongoc-stream-tls-secure-channel-private.h>
+#include <mongoc/mongoc-trace-private.h>
+#include <mongoc/mongoc-util-private.h> // bin_to_hex
 
 #include <mongoc/mongoc-log.h>
-#include <mongoc/mongoc-trace-private.h>
 #include <mongoc/mongoc-ssl.h>
 #include <mongoc/mongoc-stream-tls.h>
-#include <mongoc/mongoc-stream-tls-private.h>
-#include <mongoc/mongoc-secure-channel-private.h>
-#include <mongoc/mongoc-stream-tls-secure-channel-private.h>
-#include <mongoc/mongoc-errno-private.h>
-#include <mongoc/mongoc-error-private.h>
-#include <common-string-private.h>
-#include <mlib/cmp.h>
 
+#include <bson/bson.h>
+
+#include <mlib/cmp.h>
 
 #undef MONGOC_LOG_DOMAIN
 #define MONGOC_LOG_DOMAIN "stream-secure-channel"
 
-/* mingw doesn't define this */
+#ifdef __MINGW32__
+// Define macros omitted from mingw headers:
 #ifndef SECBUFFER_ALERT
 #define SECBUFFER_ALERT 17
 #endif
+#ifndef NCRYPTBUFFER_VERSION
+#define NCRYPTBUFFER_VERSION 0
+#endif
+#ifndef NCRYPT_PKCS8_PRIVATE_KEY_BLOB
+#define NCRYPT_PKCS8_PRIVATE_KEY_BLOB L"PKCS8_PRIVATEKEY"
+#endif
+#ifndef NCRYPT_SILENT_FLAG
+#define NCRYPT_SILENT_FLAG 0x00000040
+#endif
+#ifndef MS_KEY_STORAGE_PROVIDER
+#define MS_KEY_STORAGE_PROVIDER L"Microsoft Software Key Storage Provider"
+#endif
+#endif // #ifdef __MINGW32__
 
 // `decode_pem_base64` decodes a base-64 PEM blob with headers.
 // Returns NULL on error.
@@ -205,6 +222,76 @@ decode_object (const char *structType,
    return out;
 }
 
+// `utf8_to_wide` converts a UTF-8 string into a wide string using the Windows API MultiByteToWideChar.
+// Returns a NULL-terminated wide character string on success. Returns NULL on error.
+static WCHAR *
+utf8_to_wide (const char *utf8)
+{
+   // Get necessary character count (not bytes!) of result:
+   int required_wide_chars = MultiByteToWideChar (CP_UTF8, 0, utf8, -1 /* NULL terminated */, NULL, 0);
+   if (required_wide_chars == 0) {
+      return NULL;
+   }
+
+   // Since -1 was passed as the input length, the returned character count includes space for the null character.
+   WCHAR *wide_chars = bson_malloc (sizeof (WCHAR) * required_wide_chars);
+   if (0 == MultiByteToWideChar (CP_UTF8, 0, utf8, -1 /* NULL terminated */, wide_chars, required_wide_chars)) {
+      bson_free (wide_chars);
+      return NULL;
+   }
+
+   return wide_chars;
+}
+
+// `generate_key_name` generates a deterministic name for a key of the form: "libmongoc-<SHA256 fingerprint>-<suffix>".
+// Returns NULL on error.
+static LPWSTR
+generate_key_name (LPBYTE data, DWORD len, const char *suffix)
+{
+   bool ok = false;
+   char *hash_hex = NULL;
+   char *key_name = NULL;
+   LPWSTR key_name_wide = NULL;
+
+   BSON_ASSERT_PARAM (data);
+   BSON_ASSERT_PARAM (suffix);
+
+   // Compute a hash of the certificate:
+   {
+      unsigned char hash[32];
+      mongoc_crypto_t crypto;
+      mongoc_crypto_init (&crypto, MONGOC_CRYPTO_ALGORITHM_SHA_256);
+      if (!mongoc_crypto_hash (&crypto, (const unsigned char *) data, mlib_assert_narrow (size_t, len), hash)) {
+         goto fail;
+      }
+      // Use uppercase hex to match form of `openssl x509` command:
+      hash_hex = bin_to_hex ((const uint8_t *) hash, sizeof (hash));
+      if (!hash_hex) {
+         goto fail;
+      }
+   }
+
+   // Convert to a wide string:
+   {
+      key_name = bson_strdup_printf ("libmongoc-%s-%s", hash_hex, suffix);
+      key_name_wide = utf8_to_wide (key_name);
+      if (!key_name_wide) {
+         goto fail;
+      }
+   }
+
+   ok = true;
+fail:
+   bson_free (key_name);
+   bson_free (hash_hex);
+   if (!ok) {
+      bson_free (key_name_wide);
+      key_name_wide = NULL;
+   }
+
+   return key_name_wide;
+}
+
 PCCERT_CONTEXT
 mongoc_secure_channel_setup_certificate_from_file (const char *filename)
 {
@@ -212,7 +299,7 @@ mongoc_secure_channel_setup_certificate_
    bool ret = false;
    bool success;
    size_t pem_length;
-   HCRYPTPROV provider;
+   HCRYPTPROV provider = 0u;
    DWORD encoded_cert_len;
    LPBYTE encoded_cert = NULL;
    const char *pem_public;
@@ -224,6 +311,10 @@ mongoc_secure_channel_setup_certificate_
    DWORD blob_private_rsa_len = 0;
    DWORD encoded_private_len = 0;
    LPBYTE encoded_private = NULL;
+   NCRYPT_PROV_HANDLE cng_provider = 0u;
+   LPWSTR key_name = NULL;
+
+   BSON_ASSERT_PARAM (filename);
 
    pem = read_file_and_null_terminate (filename, &pem_length);
    if (!pem) {
@@ -256,7 +347,10 @@ mongoc_secure_channel_setup_certificate_
       goto fail;
    }
 
+   // Import private key as a persisted (not ephemeral) key.
+   // Ephemeral keys do not appear to support modern signatures. See CDRIVER-5998.
    if (NULL != (pem_private = strstr (pem, "-----BEGIN RSA PRIVATE KEY-----"))) {
+      // Import PKCS#1 as a persisted CAPI key. Windows CNG API does not appear to support PKCS#1.
       encoded_private = decode_pem_base64 (pem_private, &encoded_private_len, "private key", filename);
       if (!encoded_private) {
          goto fail;
@@ -267,89 +361,160 @@ mongoc_secure_channel_setup_certificate_
       if (!blob_private_rsa) {
          goto fail;
       }
+
+      // Import persisted key with a deterministic name of the form "libmongoc-<SHA256 fingerprint>-pkcs1":
+      key_name = generate_key_name (encoded_cert, encoded_cert_len, "pkcs1");
+      if (!key_name) {
+         MONGOC_ERROR ("Failed to generate key name");
+         goto fail;
+      }
+
+      bool exists = false;
+      success = CryptAcquireContextW (&provider,                       /* phProv */
+                                      key_name,                        /* pszContainer */
+                                      MS_ENHANCED_PROV_W,              /* pszProvider */
+                                      PROV_RSA_FULL,                   /* dwProvType */
+                                      CRYPT_NEWKEYSET | CRYPT_SILENT); /* dwFlags */
+      if (!success) {
+         DWORD last_error = GetLastError ();
+         exists = last_error == (DWORD) NTE_EXISTS;
+         if (!exists) {
+            // Unexpected error:
+            char *msg = mongoc_winerr_to_string (last_error);
+            MONGOC_ERROR ("CryptAcquireContext failed: %s", msg);
+            bson_free (msg);
+            goto fail;
+         }
+      }
+
+      if (!exists) {
+         // Import CAPI key:
+         HCRYPTKEY hKey;
+         success = CryptImportKey (provider,             /* hProv */
+                                   blob_private_rsa,     /* pbData */
+                                   blob_private_rsa_len, /* dwDataLen */
+                                   0,                    /* hPubKey */
+                                   0,                    /* dwFlags */
+                                   &hKey);               /* phKey, OUT */
+         if (!success) {
+            char *msg = mongoc_winerr_to_string (GetLastError ());
+            MONGOC_ERROR ("CryptImportKey for private key failed: %s", msg);
+            bson_free (msg);
+            goto fail;
+         }
+         CryptDestroyKey (hKey);
+      }
+
+      CRYPT_KEY_PROV_INFO keyProvInfo = {0};
+      keyProvInfo.pwszContainerName = key_name;
+      keyProvInfo.pwszProvName = MS_ENHANCED_PROV_W,
+      keyProvInfo.dwFlags |= CERT_SET_KEY_PROV_HANDLE_PROP_ID | CERT_SET_KEY_CONTEXT_PROP_ID | CRYPT_SILENT;
+      keyProvInfo.dwProvType = PROV_RSA_FULL;
+      keyProvInfo.dwKeySpec = AT_KEYEXCHANGE;
+      success = CertSetCertificateContextProperty (cert,                         /* pCertContext */
+                                                   CERT_KEY_PROV_INFO_PROP_ID,   /* dwPropId */
+                                                   0,                            /* dwFlags */
+                                                   (const void *) &keyProvInfo); /* pvData */
+      if (!success) {
+         char *msg = mongoc_winerr_to_string (GetLastError ());
+         MONGOC_ERROR ("Can't associate private key with public key: %s", msg);
+         bson_free (msg);
+         goto fail;
+      }
    } else if (NULL != (pem_private = strstr (pem, "-----BEGIN PRIVATE KEY-----"))) {
+      // Import PKCS#8 as a persisted CNG key.
       encoded_private = decode_pem_base64 (pem_private, &encoded_private_len, "private key", filename);
       if (!encoded_private) {
          goto fail;
       }
 
-      blob_private = decode_object (
-         PKCS_PRIVATE_KEY_INFO, encoded_private, encoded_private_len, &blob_private_len, "private key", filename);
-      if (!blob_private) {
+      // Open the software key storage provider:
+      SECURITY_STATUS status = NCryptOpenStorageProvider (&cng_provider, MS_KEY_STORAGE_PROVIDER, 0);
+      if (status != SEC_E_OK) {
+         char *msg = mongoc_winerr_to_string (GetLastError ());
+         MONGOC_ERROR ("Can't open key storage provider: %s", msg);
+         bson_free (msg);
          goto fail;
       }
 
-      // Have PrivateKey. Get RSA key from it.
-      CRYPT_PRIVATE_KEY_INFO *privateKeyInfo = (CRYPT_PRIVATE_KEY_INFO *) blob_private;
-      if (strcmp (privateKeyInfo->Algorithm.pszObjId, szOID_RSA_RSA) != 0) {
-         MONGOC_ERROR ("Non-RSA private keys are not supported");
+      // Supply a key name to persist the key:
+      NCryptBuffer buffer;
+      NCryptBufferDesc bufferDesc;
+
+      // Import persisted key with a deterministic name of the form "libmongoc-<SHA256 fingerprint>-pkcs8":
+      key_name = generate_key_name (encoded_cert, encoded_cert_len, "pkcs8");
+      if (!key_name) {
+         MONGOC_ERROR ("Failed to generate key name");
          goto fail;
       }
 
-      blob_private_rsa = decode_object (PKCS_RSA_PRIVATE_KEY,
-                                        privateKeyInfo->PrivateKey.pbData,
-                                        privateKeyInfo->PrivateKey.cbData,
-                                        &blob_private_rsa_len,
-                                        "private key",
-                                        filename);
-      if (!blob_private_rsa) {
-         goto fail;
+      buffer.cbBuffer = (ULONG) (wcslen (key_name) + 1) * sizeof (WCHAR);
+      buffer.BufferType = NCRYPTBUFFER_PKCS_KEY_NAME;
+      buffer.pvBuffer = key_name;
+
+      bufferDesc.ulVersion = NCRYPTBUFFER_VERSION;
+      bufferDesc.cBuffers = 1;
+      bufferDesc.pBuffers = &buffer;
+
+      // Import the private key blob as a persisted CNG key:
+      {
+         NCRYPT_KEY_HANDLE hKey = 0;
+         status = NCryptImportKey (cng_provider,
+                                   0,
+                                   NCRYPT_PKCS8_PRIVATE_KEY_BLOB,
+                                   &bufferDesc,
+                                   &hKey,
+                                   encoded_private,
+                                   encoded_private_len,
+                                   NCRYPT_SILENT_FLAG);
+         if (hKey) {
+            NCryptFreeObject (hKey);
+         }
+
+         // Ignore `NTE_EXISTS` error since key may have already been imported:
+         if (status != SEC_E_OK && status != NTE_EXISTS) {
+            char *msg = mongoc_winerr_to_string ((DWORD) status);
+            MONGOC_ERROR ("Failed to import key: %s", msg);
+            bson_free (msg);
+            goto fail;
+         }
+      }
+
+      // Attach key to certificate:
+      {
+         CRYPT_KEY_PROV_INFO keyProvInfo = {0};
+         keyProvInfo.pwszContainerName = key_name;
+         keyProvInfo.pwszProvName = MS_KEY_STORAGE_PROVIDER,
+         keyProvInfo.dwFlags |= CERT_SET_KEY_PROV_HANDLE_PROP_ID | CERT_SET_KEY_CONTEXT_PROP_ID | CRYPT_SILENT;
+         keyProvInfo.dwProvType = 0 /* CNG */;
+         keyProvInfo.dwKeySpec = AT_KEYEXCHANGE;
+         if (!CertSetCertificateContextProperty (cert, CERT_KEY_PROV_INFO_PROP_ID, 0, &keyProvInfo)) {
+            char *msg = mongoc_winerr_to_string (GetLastError ());
+            MONGOC_ERROR ("Failed to attach key to certificate: %s", msg);
+            bson_free (msg);
+            goto fail;
+         }
       }
    } else {
       MONGOC_ERROR ("Can't find private key in '%s'", filename);
       goto fail;
    }
 
-   /* https://msdn.microsoft.com/en-us/library/windows/desktop/aa379886%28v=vs.85%29.aspx
-    */
-   success = CryptAcquireContext (&provider,            /* phProv */
-                                  NULL,                 /* pszContainer */
-                                  MS_ENHANCED_PROV,     /* pszProvider */
-                                  PROV_RSA_FULL,        /* dwProvType */
-                                  CRYPT_VERIFYCONTEXT); /* dwFlags */
-   if (!success) {
-      char *msg = mongoc_winerr_to_string (GetLastError ());
-      MONGOC_ERROR ("CryptAcquireContext failed: %s", msg);
-      bson_free (msg);
-      goto fail;
-   }
-
-   HCRYPTKEY hKey;
-   /* https://msdn.microsoft.com/en-us/library/windows/desktop/aa380207%28v=vs.85%29.aspx
-    */
-   success = CryptImportKey (provider,             /* hProv */
-                             blob_private_rsa,     /* pbData */
-                             blob_private_rsa_len, /* dwDataLen */
-                             0,                    /* hPubKey */
-                             0,                    /* dwFlags */
-                             &hKey);               /* phKey, OUT */
-   if (!success) {
-      char *msg = mongoc_winerr_to_string (GetLastError ());
-      MONGOC_ERROR ("CryptImportKey for private key failed: %s", msg);
-      bson_free (msg);
-      CryptReleaseContext (provider, 0);
-      goto fail;
-   }
-   CryptDestroyKey (hKey);
-
-   /* https://msdn.microsoft.com/en-us/library/windows/desktop/aa376573%28v=vs.85%29.aspx
-    */
-   // The CERT_KEY_PROV_HANDLE_PROP_ID property takes ownership of `provider`.
-   success = CertSetCertificateContextProperty (cert,                         /* pCertContext */
-                                                CERT_KEY_PROV_HANDLE_PROP_ID, /* dwPropId */
-                                                0,                            /* dwFlags */
-                                                (const void *) provider);     /* pvData */
-   if (!success) {
-      char *msg = mongoc_winerr_to_string (GetLastError ());
-      MONGOC_ERROR ("Can't associate private key with public key: %s", msg);
-      bson_free (msg);
-      goto fail;
-   }
 
    TRACE ("%s", "Successfully loaded client certificate");
    ret = true;
 
 fail:
+   bson_free (key_name);
+
+   if (cng_provider) {
+      NCryptFreeObject (cng_provider);
+   }
+
+   if (provider) {
+      CryptReleaseContext (provider, 0);
+   }
+
    if (pem) {
       SecureZeroMemory (pem, pem_length);
       bson_free (pem);
@@ -379,14 +544,14 @@ fail:
 }
 
 PCCERT_CONTEXT
-mongoc_secure_channel_setup_certificate (mongoc_ssl_opt_t *opt)
+mongoc_secure_channel_setup_certificate (const mongoc_ssl_opt_t *opt)
 {
    return mongoc_secure_channel_setup_certificate_from_file (opt->pem_file);
 }
 
 
 bool
-mongoc_secure_channel_setup_ca (mongoc_ssl_opt_t *opt)
+mongoc_secure_channel_setup_ca (const mongoc_ssl_opt_t *opt)
 {
    bool ok = false;
    char *pem = NULL;
@@ -496,7 +661,7 @@ fail:
 }
 
 bool
-mongoc_secure_channel_setup_crl (mongoc_ssl_opt_t *opt)
+mongoc_secure_channel_setup_crl (const mongoc_ssl_opt_t *opt)
 {
    HCERTSTORE cert_store = NULL;
    bool ok = false;
@@ -671,18 +836,18 @@ mongoc_secure_channel_handshake_step_1 (
    secure_channel->ctxt = (mongoc_secure_channel_ctxt *) bson_malloc0 (sizeof (mongoc_secure_channel_ctxt));
 
    /* https://msdn.microsoft.com/en-us/library/windows/desktop/aa375924.aspx */
-   sspi_status = InitializeSecurityContext (&secure_channel->cred->cred_handle, /* phCredential */
-                                            NULL,                               /* phContext */
-                                            hostname,                           /* pszTargetName */
-                                            secure_channel->req_flags,          /* fContextReq */
-                                            0,                                  /* Reserved1, must be 0 */
-                                            0,                                  /* TargetDataRep, unused */
-                                            NULL,                               /* pInput */
-                                            0,                                  /* Reserved2, must be 0 */
-                                            &secure_channel->ctxt->ctxt_handle, /* phNewContext OUT param */
-                                            &outbuf_desc,                       /* pOutput OUT param */
-                                            &secure_channel->ret_flags,         /* pfContextAttr OUT param */
-                                            &secure_channel->ctxt->time_stamp   /* ptsExpiry OUT param */
+   sspi_status = InitializeSecurityContext (&secure_channel->cred_handle->cred_handle, /* phCredential */
+                                            NULL,                                      /* phContext */
+                                            hostname,                                  /* pszTargetName */
+                                            secure_channel->req_flags,                 /* fContextReq */
+                                            0,                                         /* Reserved1, must be 0 */
+                                            0,                                         /* TargetDataRep, unused */
+                                            NULL,                                      /* pInput */
+                                            0,                                         /* Reserved2, must be 0 */
+                                            &secure_channel->ctxt->ctxt_handle,        /* phNewContext OUT param */
+                                            &outbuf_desc,                              /* pOutput OUT param */
+                                            &secure_channel->ret_flags,                /* pfContextAttr OUT param */
+                                            &secure_channel->ctxt->time_stamp          /* ptsExpiry OUT param */
    );
    if (sspi_status != SEC_I_CONTINUE_NEEDED) {
       // Cast signed SECURITY_STATUS to unsigned DWORD. FormatMessage expects DWORD.
@@ -739,7 +904,7 @@ mongoc_secure_channel_handshake_step_2 (
 
    TRACE ("%s", "SSL/TLS connection with endpoint (step 2/3)");
 
-   if (!secure_channel->cred || !secure_channel->ctxt) {
+   if (!secure_channel->cred_handle || !secure_channel->ctxt) {
       MONGOC_LOG_AND_SET_ERROR (
          error, MONGOC_ERROR_STREAM, MONGOC_ERROR_STREAM_SOCKET, "required TLS credentials or context not provided");
 
@@ -809,7 +974,7 @@ mongoc_secure_channel_handshake_step_2 (
 
       /* https://msdn.microsoft.com/en-us/library/windows/desktop/aa375924.aspx
        */
-      sspi_status = InitializeSecurityContext (&secure_channel->cred->cred_handle,
+      sspi_status = InitializeSecurityContext (&secure_channel->cred_handle->cred_handle,
                                                &secure_channel->ctxt->ctxt_handle,
                                                hostname,
                                                secure_channel->req_flags,
@@ -989,7 +1154,7 @@ mongoc_secure_channel_handshake_step_3 (
 
    TRACE ("SSL/TLS connection with %s (step 3/3)", hostname);
 
-   if (!secure_channel->cred) {
+   if (!secure_channel->cred_handle) {
       MONGOC_LOG_AND_SET_ERROR (
          error, MONGOC_ERROR_STREAM, MONGOC_ERROR_STREAM_SOCKET, "required TLS credentials not provided");
       return false;
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-secure-transport-private.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-secure-transport-private.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-secure-transport-private.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-secure-transport-private.h	2025-08-14 18:37:23.000000000 +0000
@@ -19,10 +19,12 @@
 #ifndef MONGOC_SECURE_TRANSPORT_PRIVATE_H
 #define MONGOC_SECURE_TRANSPORT_PRIVATE_H
 
-#include <bson/bson.h>
+#include <mongoc/mongoc-stream-tls-secure-transport-private.h>
 
 #include <mongoc/mongoc-ssl.h>
-#include <mongoc/mongoc-stream-tls-secure-transport-private.h>
+
+#include <bson/bson.h>
+
 #include <Security/Security.h>
 
 
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-secure-transport.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-secure-transport.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-secure-transport.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-secure-transport.c	2025-08-14 18:37:23.000000000 +0000
@@ -18,26 +18,25 @@
 
 #ifdef MONGOC_ENABLE_SSL_SECURE_TRANSPORT
 
-#include <bson/bson.h>
+#include <common-macros-private.h>
+#include <common-string-private.h>
+#include <mongoc/mongoc-secure-transport-private.h>
+#include <mongoc/mongoc-stream-tls-private.h>
+#include <mongoc/mongoc-stream-tls-secure-transport-private.h>
+#include <mongoc/mongoc-trace-private.h>
 
 #include <mongoc/mongoc-log.h>
-#include <mongoc/mongoc-trace-private.h>
 #include <mongoc/mongoc-ssl.h>
 #include <mongoc/mongoc-stream-tls.h>
-#include <mongoc/mongoc-stream-tls-private.h>
-#include <mongoc/mongoc-secure-transport-private.h>
-#include <mongoc/mongoc-stream-tls-secure-transport-private.h>
+
+#include <bson/bson.h>
+
+#include <CommonCrypto/CommonDigest.h>
 
 #include <CoreFoundation/CoreFoundation.h>
-#include <Security/Security.h>
 #include <Security/SecKey.h>
 #include <Security/SecureTransport.h>
-#include <CommonCrypto/CommonDigest.h>
 #include <Security/Security.h>
-#include <Security/SecureTransport.h>
-#include <CoreFoundation/CoreFoundation.h>
-#include <common-macros-private.h>
-#include <common-string-private.h>
 
 // CDRIVER-2722: Secure Transport is deprecated on MacOS.
 BEGIN_IGNORE_DEPRECATIONS
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-server-api.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-server-api.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-server-api.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-server-api.c	2025-08-14 18:37:23.000000000 +0000
@@ -15,9 +15,10 @@
  */
 
 
-#include <mongoc/mongoc-config.h>
 #include <mongoc/mongoc-server-api-private.h>
 
+#include <mongoc/mongoc-config.h>
+
 const char *
 mongoc_server_api_version_to_string (mongoc_server_api_version_t version)
 {
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-server-api.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-server-api.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-server-api.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-server-api.h	2025-08-14 18:37:23.000000000 +0000
@@ -19,10 +19,10 @@
 #ifndef MONGOC_SERVER_API_H
 #define MONGOC_SERVER_API_H
 
-#include <bson/bson.h>
-
-#include <mongoc/mongoc-optional.h>
 #include <mongoc/mongoc-macros.h>
+#include <mongoc/mongoc-optional.h>
+
+#include <bson/bson.h>
 
 BSON_BEGIN_DECLS
 
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-server-description-private.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-server-description-private.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-server-description-private.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-server-description-private.h	2025-08-14 18:37:23.000000000 +0000
@@ -19,10 +19,11 @@
 #ifndef MONGOC_SERVER_DESCRIPTION_PRIVATE_H
 #define MONGOC_SERVER_DESCRIPTION_PRIVATE_H
 
-#include <mongoc/mongoc-server-description.h>
 #include <mongoc/mongoc-generation-map-private.h>
 #include <mongoc/mongoc-log-and-monitor-private.h>
 
+#include <mongoc/mongoc-server-description.h>
+
 
 #define MONGOC_DEFAULT_WIRE_VERSION 0
 #define MONGOC_DEFAULT_WRITE_BATCH_SIZE 1000
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-server-description.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-server-description.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-server-description.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-server-description.c	2025-08-14 18:37:23.000000000 +0000
@@ -14,21 +14,23 @@
  * limitations under the License.
  */
 
-#include <mongoc/mongoc-config.h>
+#include <common-atomic-private.h>
+#include <common-bson-dsl-private.h>
+#include <common-oid-private.h>
+#include <mongoc/mongoc-compression-private.h>
 #include <mongoc/mongoc-error-private.h>
-#include <mongoc/mongoc-host-list.h>
 #include <mongoc/mongoc-host-list-private.h>
-#include <mongoc/mongoc-read-prefs.h>
 #include <mongoc/mongoc-read-prefs-private.h>
 #include <mongoc/mongoc-server-description-private.h>
 #include <mongoc/mongoc-trace-private.h>
-#include <mongoc/mongoc-uri.h>
 #include <mongoc/mongoc-util-private.h>
-#include <mongoc/mongoc-compression-private.h>
 
-#include <common-bson-dsl-private.h>
-#include <common-atomic-private.h>
-#include <common-oid-private.h>
+#include <mongoc/mongoc-config.h>
+#include <mongoc/mongoc-host-list.h>
+#include <mongoc/mongoc-read-prefs.h>
+#include <mongoc/mongoc-uri.h>
+
+#include <mlib/config.h>
 
 #include <stdio.h>
 
@@ -527,7 +529,7 @@ mongoc_server_description_handle_hello (
    }
 
    bson_destroy (&sd->last_hello_response);
-   bsonBuild (sd->last_hello_response, insert (*hello_response, not(key ("speculativeAuthenticate"))));
+   bsonBuild (sd->last_hello_response, insert (*hello_response, not (key ("speculativeAuthenticate"))));
    sd->has_hello_response = true;
 
    /* Only reinitialize the topology version if we have a hello response.
@@ -556,28 +558,34 @@ mongoc_server_description_handle_hello (
          }
       } else if (strcmp ("isWritablePrimary", bson_iter_key (&iter)) == 0 ||
                  strcmp (HANDSHAKE_RESPONSE_LEGACY_HELLO, bson_iter_key (&iter)) == 0) {
-         if (!BSON_ITER_HOLDS_BOOL (&iter))
+         if (!BSON_ITER_HOLDS_BOOL (&iter)) {
             GOTO (typefailure);
+         }
          is_primary = bson_iter_bool (&iter);
       } else if (strcmp ("helloOk", bson_iter_key (&iter)) == 0) {
-         if (!BSON_ITER_HOLDS_BOOL (&iter))
+         if (!BSON_ITER_HOLDS_BOOL (&iter)) {
             GOTO (typefailure);
+         }
          sd->hello_ok = bson_iter_bool (&iter);
       } else if (strcmp ("me", bson_iter_key (&iter)) == 0) {
-         if (!BSON_ITER_HOLDS_UTF8 (&iter))
+         if (!BSON_ITER_HOLDS_UTF8 (&iter)) {
             GOTO (typefailure);
+         }
          sd->me = bson_iter_utf8 (&iter, NULL);
       } else if (strcmp ("maxMessageSizeBytes", bson_iter_key (&iter)) == 0) {
-         if (!BSON_ITER_HOLDS_INT32 (&iter))
+         if (!BSON_ITER_HOLDS_INT32 (&iter)) {
             GOTO (typefailure);
+         }
          sd->max_msg_size = bson_iter_int32 (&iter);
       } else if (strcmp ("maxBsonObjectSize", bson_iter_key (&iter)) == 0) {
-         if (!BSON_ITER_HOLDS_INT32 (&iter))
+         if (!BSON_ITER_HOLDS_INT32 (&iter)) {
             GOTO (typefailure);
+         }
          sd->max_bson_obj_size = bson_iter_int32 (&iter);
       } else if (strcmp ("maxWriteBatchSize", bson_iter_key (&iter)) == 0) {
-         if (!BSON_ITER_HOLDS_INT32 (&iter))
+         if (!BSON_ITER_HOLDS_INT32 (&iter)) {
             GOTO (typefailure);
+         }
          sd->max_write_batch_size = bson_iter_int32 (&iter);
       } else if (strcmp ("logicalSessionTimeoutMinutes", bson_iter_key (&iter)) == 0) {
          if (BSON_ITER_HOLDS_NUMBER (&iter)) {
@@ -589,68 +597,81 @@ mongoc_server_description_handle_hello (
             GOTO (typefailure);
          }
       } else if (strcmp ("minWireVersion", bson_iter_key (&iter)) == 0) {
-         if (!BSON_ITER_HOLDS_INT32 (&iter))
+         if (!BSON_ITER_HOLDS_INT32 (&iter)) {
             GOTO (typefailure);
+         }
          sd->min_wire_version = bson_iter_int32 (&iter);
       } else if (strcmp ("maxWireVersion", bson_iter_key (&iter)) == 0) {
-         if (!BSON_ITER_HOLDS_INT32 (&iter))
+         if (!BSON_ITER_HOLDS_INT32 (&iter)) {
             GOTO (typefailure);
+         }
          sd->max_wire_version = bson_iter_int32 (&iter);
       } else if (strcmp ("msg", bson_iter_key (&iter)) == 0) {
          const char *msg;
-         if (!BSON_ITER_HOLDS_UTF8 (&iter))
+         if (!BSON_ITER_HOLDS_UTF8 (&iter)) {
             GOTO (typefailure);
+         }
          msg = bson_iter_utf8 (&iter, NULL);
          if (msg && 0 == strcmp (msg, "isdbgrid")) {
             is_shard = true;
          }
       } else if (strcmp ("setName", bson_iter_key (&iter)) == 0) {
-         if (!BSON_ITER_HOLDS_UTF8 (&iter))
+         if (!BSON_ITER_HOLDS_UTF8 (&iter)) {
             GOTO (typefailure);
+         }
          sd->set_name = bson_iter_utf8 (&iter, NULL);
       } else if (strcmp ("setVersion", bson_iter_key (&iter)) == 0) {
          mongoc_server_description_set_set_version (sd, bson_iter_as_int64 (&iter));
       } else if (strcmp ("electionId", bson_iter_key (&iter)) == 0) {
-         if (!BSON_ITER_HOLDS_OID (&iter))
+         if (!BSON_ITER_HOLDS_OID (&iter)) {
             GOTO (typefailure);
+         }
          mongoc_server_description_set_election_id (sd, bson_iter_oid (&iter));
       } else if (strcmp ("secondary", bson_iter_key (&iter)) == 0) {
-         if (!BSON_ITER_HOLDS_BOOL (&iter))
+         if (!BSON_ITER_HOLDS_BOOL (&iter)) {
             GOTO (typefailure);
+         }
          is_secondary = bson_iter_bool (&iter);
       } else if (strcmp ("hosts", bson_iter_key (&iter)) == 0) {
-         if (!BSON_ITER_HOLDS_ARRAY (&iter))
+         if (!BSON_ITER_HOLDS_ARRAY (&iter)) {
             GOTO (typefailure);
+         }
          bson_iter_array (&iter, &len, &bytes);
          bson_destroy (&sd->hosts);
          BSON_ASSERT (bson_init_static (&sd->hosts, bytes, len));
       } else if (strcmp ("passives", bson_iter_key (&iter)) == 0) {
-         if (!BSON_ITER_HOLDS_ARRAY (&iter))
+         if (!BSON_ITER_HOLDS_ARRAY (&iter)) {
             GOTO (typefailure);
+         }
          bson_iter_array (&iter, &len, &bytes);
          bson_destroy (&sd->passives);
          BSON_ASSERT (bson_init_static (&sd->passives, bytes, len));
       } else if (strcmp ("arbiters", bson_iter_key (&iter)) == 0) {
-         if (!BSON_ITER_HOLDS_ARRAY (&iter))
+         if (!BSON_ITER_HOLDS_ARRAY (&iter)) {
             GOTO (typefailure);
+         }
          bson_iter_array (&iter, &len, &bytes);
          bson_destroy (&sd->arbiters);
          BSON_ASSERT (bson_init_static (&sd->arbiters, bytes, len));
       } else if (strcmp ("primary", bson_iter_key (&iter)) == 0) {
-         if (!BSON_ITER_HOLDS_UTF8 (&iter))
+         if (!BSON_ITER_HOLDS_UTF8 (&iter)) {
             GOTO (typefailure);
+         }
          sd->current_primary = bson_iter_utf8 (&iter, NULL);
       } else if (strcmp ("arbiterOnly", bson_iter_key (&iter)) == 0) {
-         if (!BSON_ITER_HOLDS_BOOL (&iter))
+         if (!BSON_ITER_HOLDS_BOOL (&iter)) {
             GOTO (typefailure);
+         }
          is_arbiter = bson_iter_bool (&iter);
       } else if (strcmp ("isreplicaset", bson_iter_key (&iter)) == 0) {
-         if (!BSON_ITER_HOLDS_BOOL (&iter))
+         if (!BSON_ITER_HOLDS_BOOL (&iter)) {
             GOTO (typefailure);
+         }
          is_replicaset = bson_iter_bool (&iter);
       } else if (strcmp ("tags", bson_iter_key (&iter)) == 0) {
-         if (!BSON_ITER_HOLDS_DOCUMENT (&iter))
+         if (!BSON_ITER_HOLDS_DOCUMENT (&iter)) {
             GOTO (typefailure);
+         }
          bson_iter_document (&iter, &len, &bytes);
          bson_destroy (&sd->tags);
          BSON_ASSERT (bson_init_static (&sd->tags, bytes, len));
@@ -664,8 +685,9 @@ mongoc_server_description_handle_hello (
 
          sd->last_write_date_ms = bson_iter_date_time (&child);
       } else if (strcmp ("compression", bson_iter_key (&iter)) == 0) {
-         if (!BSON_ITER_HOLDS_ARRAY (&iter))
+         if (!BSON_ITER_HOLDS_ARRAY (&iter)) {
             GOTO (typefailure);
+         }
          bson_iter_array (&iter, &len, &bytes);
          bson_destroy (&sd->compressors);
          BSON_ASSERT (bson_init_static (&sd->compressors, bytes, len));
@@ -681,12 +703,14 @@ mongoc_server_description_handle_hello (
          mongoc_server_description_set_topology_version (sd, &incoming_topology_version);
          bson_destroy (&incoming_topology_version);
       } else if (strcmp ("serviceId", bson_iter_key (&iter)) == 0) {
-         if (!BSON_ITER_HOLDS_OID (&iter))
+         if (!BSON_ITER_HOLDS_OID (&iter)) {
             GOTO (typefailure);
+         }
          bson_oid_copy_unsafe (bson_iter_oid (&iter), &sd->service_id);
       } else if (strcmp ("connectionId", bson_iter_key (&iter)) == 0) {
-         if (!BSON_ITER_HOLDS_NUMBER (&iter))
+         if (!BSON_ITER_HOLDS_NUMBER (&iter)) {
             GOTO (typefailure);
+         }
          sd->server_connection_id = bson_iter_as_int64 (&iter);
       }
    }
@@ -770,7 +794,7 @@ mongoc_server_description_new_copy (cons
          const uint8_t *data = bson_get_data (&copy->last_hello_response) + offset;                                  \
          uint32_t len = description->FIELD.len;                                                                      \
          MONGOC_DEBUG_ASSERT (offset + len <= copy->last_hello_response.len);                                        \
-         bson_init_static (&copy->FIELD, data, len);                                                                 \
+         BSON_ASSERT (bson_init_static (&copy->FIELD, data, len));                                                   \
       } else {                                                                                                       \
          bson_init (&copy->FIELD);                                                                                   \
       }                                                                                                              \
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-server-description.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-server-description.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-server-description.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-server-description.h	2025-08-14 18:37:23.000000000 +0000
@@ -19,11 +19,11 @@
 #ifndef MONGOC_SERVER_DESCRIPTION_H
 #define MONGOC_SERVER_DESCRIPTION_H
 
-#include <bson/bson.h>
-
+#include <mongoc/mongoc-host-list.h>
 #include <mongoc/mongoc-macros.h>
 #include <mongoc/mongoc-read-prefs.h>
-#include <mongoc/mongoc-host-list.h>
+
+#include <bson/bson.h>
 
 BSON_BEGIN_DECLS
 
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-server-monitor-private.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-server-monitor-private.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-server-monitor-private.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-server-monitor-private.h	2025-08-14 18:37:23.000000000 +0000
@@ -19,10 +19,11 @@
 #ifndef MONGOC_SERVER_MONITOR_PRIVATE_H
 #define MONGOC_SERVER_MONITOR_PRIVATE_H
 
-#include <mongoc/mongoc.h>
 #include <mongoc/mongoc-server-description-private.h>
 #include <mongoc/mongoc-topology-private.h>
 
+#include <mongoc/mongoc.h>
+
 /* For background monitoring of a single server. */
 typedef enum {
    MONGOC_SERVER_MONITORING_AUTO = 0,
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-server-monitor.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-server-monitor.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-server-monitor.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-server-monitor.c	2025-08-14 18:37:23.000000000 +0000
@@ -14,21 +14,23 @@
  * limitations under the License.
  */
 
-#include <mlib/intencode.h>
+#include <common-atomic-private.h>
 #include <common-thread-private.h>
-#include <mongoc/mongoc-server-monitor-private.h>
-
-#include <mongoc/mcd-rpc.h>
 #include <mongoc/mongoc-client-private.h>
 #include <mongoc/mongoc-error-private.h>
 #include <mongoc/mongoc-handshake-private.h>
+#include <mongoc/mongoc-server-monitor-private.h>
 #include <mongoc/mongoc-ssl-private.h>
 #include <mongoc/mongoc-stream-private.h>
+#include <mongoc/mongoc-structured-log-private.h>
 #include <mongoc/mongoc-topology-background-monitoring-private.h>
 #include <mongoc/mongoc-topology-private.h>
 #include <mongoc/mongoc-trace-private.h>
-#include <mongoc/mongoc-structured-log-private.h>
-#include <common-atomic-private.h>
+
+#include <mongoc/mcd-rpc.h>
+
+#include <mlib/config.h>
+#include <mlib/intencode.h>
 
 #include <inttypes.h>
 
@@ -116,11 +118,15 @@ static BSON_GNUC_PRINTF (3, 4) void _ser
 }
 
 #define MONITOR_LOG(sm, ...)                                            \
-   do {                                                                 \
+   if (1) {                                                             \
+      mlib_diagnostic_push ();                                          \
+      mlib_disable_constant_conditional_expression_warnings ();         \
       if (MONGOC_TRACE_ENABLED) {                                       \
          _server_monitor_log (sm, MONGOC_LOG_LEVEL_TRACE, __VA_ARGS__); \
       }                                                                 \
-   } while (0)
+      mlib_diagnostic_pop ();                                           \
+   } else                                                               \
+      ((void) 0)
 
 /* TODO CDRIVER-3710 use MONGOC_LOG_LEVEL_ERROR */
 #define MONITOR_LOG_ERROR(sm, ...) _server_monitor_log (sm, MONGOC_LOG_LEVEL_DEBUG, __VA_ARGS__)
@@ -928,6 +934,7 @@ _server_monitor_setup_connection (mongoc
    } else {
       void *ssl_opts_void = NULL;
       void *openssl_ctx_void = NULL;
+      mongoc_shared_ptr secure_channel_cred_ptr = MONGOC_SHARED_PTR_NULL;
 
 #ifdef MONGOC_ENABLE_SSL
       ssl_opts_void = server_monitor->ssl_opts;
@@ -937,12 +944,16 @@ _server_monitor_setup_connection (mongoc
       openssl_ctx_void = server_monitor->topology->scanner->openssl_ctx;
 #endif
 
-      server_monitor->stream = mongoc_client_connect (false,
-                                                      ssl_opts_void != NULL,
+#if defined(MONGOC_ENABLE_SSL_SECURE_CHANNEL)
+      secure_channel_cred_ptr = server_monitor->topology->scanner->secure_channel_cred_ptr;
+#endif
+
+      server_monitor->stream = mongoc_client_connect (ssl_opts_void != NULL,
                                                       ssl_opts_void,
                                                       server_monitor->uri,
                                                       &server_monitor->description->host,
                                                       openssl_ctx_void,
+                                                      secure_channel_cred_ptr,
                                                       error);
    }
 
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-server-stream-private.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-server-stream-private.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-server-stream-private.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-server-stream-private.h	2025-08-14 18:37:23.000000000 +0000
@@ -19,14 +19,14 @@
 #ifndef MONGOC_SERVER_STREAM_H
 #define MONGOC_SERVER_STREAM_H
 
+#include <mongoc/mongoc-server-description-private.h>
+#include <mongoc/mongoc-topology-description-private.h>
+
 #include <mongoc/mongoc-config.h>
+#include <mongoc/mongoc-stream.h>
 
 #include <bson/bson.h>
 
-#include <mongoc/mongoc-topology-description-private.h>
-#include <mongoc/mongoc-server-description-private.h>
-#include <mongoc/mongoc-stream.h>
-
 BSON_BEGIN_DECLS
 
 typedef struct _mongoc_server_stream_t {
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-set.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-set.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-set.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-set.c	2025-08-14 18:37:23.000000000 +0000
@@ -15,9 +15,10 @@
  */
 
 
+#include <mongoc/mongoc-set-private.h>
+
 #include <bson/bson.h>
 
-#include <mongoc/mongoc-set-private.h>
 #include <mlib/cmp.h>
 
 mongoc_set_t *
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-shared-private.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-shared-private.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-shared-private.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-shared-private.h	2025-08-14 18:37:23.000000000 +0000
@@ -61,7 +61,7 @@ typedef struct mongoc_shared_ptr {
  * @brief A "null" pointer constant for a mongoc_shared_ptr.
  */
 #define MONGOC_SHARED_PTR_NULL \
-   ((mongoc_shared_ptr){       \
+   ((mongoc_shared_ptr) {      \
       .ptr = NULL,             \
       ._aux = NULL,            \
    })
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-shared.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-shared.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-shared.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-shared.c	2025-08-14 18:37:23.000000000 +0000
@@ -14,11 +14,13 @@
  * limitations under the License.
  */
 
+#include <common-atomic-private.h>
+#include <common-thread-private.h>
 #include <mongoc/mongoc-shared-private.h>
 
-#include <common-thread-private.h>
 #include <bson/bson.h>
-#include <common-atomic-private.h>
+
+#include <mlib/config.h>
 
 typedef struct _mongoc_shared_ptr_aux {
    int refcount;
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-sleep.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-sleep.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-sleep.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-sleep.h	2025-08-14 18:37:23.000000000 +0000
@@ -3,10 +3,11 @@
 #ifndef MONGOC_SLEEP_H
 #define MONGOC_SLEEP_H
 
-#include <bson/bson.h>
-
+#include <mongoc/mongoc-client.h>
 #include <mongoc/mongoc-macros.h>
 
+#include <bson/bson.h>
+
 BSON_BEGIN_DECLS
 
 /**
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-socket.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-socket.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-socket.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-socket.c	2025-08-14 18:37:23.000000000 +0000
@@ -15,22 +15,22 @@
  */
 
 
-#include <errno.h>
-#include <string.h>
-
 #include <mongoc/mongoc-counters-private.h>
 #include <mongoc/mongoc-errno-private.h>
 #include <mongoc/mongoc-socket-private.h>
-#include <mongoc/mongoc-host-list.h>
-#include <mongoc/mongoc-socket-private.h>
 #include <mongoc/mongoc-trace-private.h>
+
+#include <mongoc/mongoc-host-list.h>
+
 #ifdef _WIN32
 #include <Mstcpip.h>
 #include <process.h>
 #endif
 #include <mlib/cmp.h>
 
+#include <errno.h>
 #include <inttypes.h>
+#include <string.h>
 
 #undef MONGOC_LOG_DOMAIN
 #define MONGOC_LOG_DOMAIN "socket"
@@ -1207,6 +1207,7 @@ _mongoc_socket_try_sendv_slow (mongoc_so
          RETURN (ret ? ret : -1);
       }
 
+      BSON_ASSERT (mlib_cmp (wrote, <=, SSIZE_MAX - ret));
       ret += wrote;
 
       if (mlib_cmp (wrote, !=, iov[i].iov_len)) {
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-socket.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-socket.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-socket.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-socket.h	2025-08-14 18:37:23.000000000 +0000
@@ -19,21 +19,22 @@
 #ifndef MONGOC_SOCKET_H
 #define MONGOC_SOCKET_H
 
-#include <bson/bson.h>
-#include <mongoc/mongoc-macros.h>
 #include <mongoc/mongoc-config.h>
+#include <mongoc/mongoc-macros.h>
+
+#include <bson/bson.h>
 
 #ifdef _WIN32
 #include <winsock2.h>
 #include <ws2tcpip.h>
 #else
 #include <arpa/inet.h>
-#include <poll.h>
 #include <netdb.h>
 #include <netinet/in.h>
 #include <netinet/tcp.h>
-#include <sys/types.h>
+#include <poll.h>
 #include <sys/socket.h>
+#include <sys/types.h>
 #include <sys/uio.h>
 #include <sys/un.h>
 #endif
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-ssl-private.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-ssl-private.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-ssl-private.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-ssl-private.h	2025-08-14 18:37:23.000000000 +0000
@@ -19,10 +19,13 @@
 #ifndef MONGOC_SSL_PRIVATE_H
 #define MONGOC_SSL_PRIVATE_H
 
-#include <bson/bson.h>
 #include <common-string-private.h>
 #include <mongoc/mongoc-uri-private.h>
 
+#include <mongoc/mongoc-ssl.h>
+
+#include <bson/bson.h>
+
 
 BSON_BEGIN_DECLS
 
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-ssl.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-ssl.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-ssl.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-ssl.c	2025-08-14 18:37:23.000000000 +0000
@@ -18,13 +18,15 @@
 
 #ifdef MONGOC_ENABLE_SSL
 
-#include <bson/bson.h>
-#include <mongoc/mongoc-ssl.h>
+#include <common-string-private.h>
 #include <mongoc/mongoc-ssl-private.h>
+#include <mongoc/mongoc-util-private.h>
+
 #include <mongoc/mongoc-log.h>
+#include <mongoc/mongoc-ssl.h>
 #include <mongoc/mongoc-uri.h>
-#include <mongoc/mongoc-util-private.h>
-#include <common-string-private.h>
+
+#include <bson/bson.h>
 
 #if defined(MONGOC_ENABLE_SSL_OPENSSL)
 #include <mongoc/mongoc-openssl-private.h>
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-ssl.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-ssl.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-ssl.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-ssl.h	2025-08-14 18:37:23.000000000 +0000
@@ -19,10 +19,10 @@
 #ifndef MONGOC_SSL_H
 #define MONGOC_SSL_H
 
-#include <bson/bson.h>
-
 #include <mongoc/mongoc-macros.h>
 
+#include <bson/bson.h>
+
 BSON_BEGIN_DECLS
 
 
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-sspi-private.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-sspi-private.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-sspi-private.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-sspi-private.h	2025-08-14 18:37:23.000000000 +0000
@@ -19,9 +19,10 @@
 #ifndef MONGOC_SSPI_PRIVATE_H
 #define MONGOC_SSPI_PRIVATE_H
 
-#include <bson/bson.h>
 #include <mongoc/mongoc-sasl-private.h>
 
+#include <bson/bson.h>
+
 
 BSON_BEGIN_DECLS
 
@@ -29,8 +30,9 @@ BSON_BEGIN_DECLS
 #define SECURITY_WIN32 1 /* Required for SSPI */
 
 #include <Windows.h>
-#include <limits.h>
 #include <sspi.h>
+
+#include <limits.h>
 #include <string.h>
 
 #define MONGOC_SSPI_AUTH_GSS_ERROR -1
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-sspi.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-sspi.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-sspi.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-sspi.c	2025-08-14 18:37:23.000000000 +0000
@@ -26,8 +26,8 @@
 #endif
 
 #include <mongoc/mongoc-error-private.h>
-#include <mongoc/mongoc-util-private.h>
 #include <mongoc/mongoc-sspi-private.h>
+#include <mongoc/mongoc-util-private.h>
 
 void
 _mongoc_sspi_destroy_sspi_client_state (mongoc_sspi_client_state_t *state)
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-stream-buffered.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-stream-buffered.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-stream-buffered.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-stream-buffered.c	2025-08-14 18:37:23.000000000 +0000
@@ -15,15 +15,17 @@
  */
 
 
-#include <errno.h>
+#include <mongoc/mongoc-stream-buffered.h>
 
 #include <mongoc/mongoc-buffer-private.h>
 #include <mongoc/mongoc-counters-private.h>
-#include <mongoc/mongoc-log.h>
-#include <mongoc/mongoc-stream-buffered.h>
 #include <mongoc/mongoc-stream-private.h>
 #include <mongoc/mongoc-trace-private.h>
 
+#include <mongoc/mongoc-log.h>
+
+#include <errno.h>
+
 
 #undef MONGOC_LOG_DOMAIN
 #define MONGOC_LOG_DOMAIN "stream"
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-stream-buffered.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-stream-buffered.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-stream-buffered.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-stream-buffered.h	2025-08-14 18:37:23.000000000 +0000
@@ -19,11 +19,11 @@
 #ifndef MONGOC_STREAM_BUFFERED_H
 #define MONGOC_STREAM_BUFFERED_H
 
-#include <bson/bson.h>
-
 #include <mongoc/mongoc-macros.h>
 #include <mongoc/mongoc-stream.h>
 
+#include <bson/bson.h>
+
 
 BSON_BEGIN_DECLS
 
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-stream-file.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-stream-file.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-stream-file.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-stream-file.c	2025-08-14 18:37:23.000000000 +0000
@@ -20,10 +20,12 @@
 #include <share.h>
 #endif
 
+#include <mongoc/mongoc-counters-private.h>
 #include <mongoc/mongoc-stream-private.h>
-#include <mongoc/mongoc-stream-file.h>
 #include <mongoc/mongoc-trace-private.h>
-#include <mongoc/mongoc-counters-private.h>
+
+#include <mongoc/mongoc-stream-file.h>
+
 #include <mlib/cmp.h>
 
 /*
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-stream-gridfs-download-private.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-stream-gridfs-download-private.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-stream-gridfs-download-private.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-stream-gridfs-download-private.h	2025-08-14 18:37:23.000000000 +0000
@@ -19,9 +19,10 @@
 #ifndef MONGOC_STREAM_GRIDFS_DOWNLOAD_PRIVATE_H
 #define MONGOC_STREAM_GRIDFS_DOWNLOAD_PRIVATE_H
 
-#include <mongoc/mongoc-stream.h>
 #include <mongoc/mongoc-gridfs-bucket-file-private.h>
 
+#include <mongoc/mongoc-stream.h>
+
 typedef struct {
    mongoc_stream_t stream;
    mongoc_gridfs_bucket_file_t *file;
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-stream-gridfs-download.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-stream-gridfs-download.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-stream-gridfs-download.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-stream-gridfs-download.c	2025-08-14 18:37:23.000000000 +0000
@@ -14,11 +14,11 @@
  * limitations under the License.
  */
 
-#include <mongoc/mongoc-stream-gridfs-download-private.h>
-#include <mongoc/mongoc-gridfs-bucket-file-private.h>
 #include <mongoc/mongoc-counters-private.h>
-#include <mongoc/mongoc-trace-private.h>
+#include <mongoc/mongoc-gridfs-bucket-file-private.h>
+#include <mongoc/mongoc-stream-gridfs-download-private.h>
 #include <mongoc/mongoc-stream-private.h>
+#include <mongoc/mongoc-trace-private.h>
 
 #undef MONGOC_LOG_DOMAIN
 #define MONGOC_LOG_DOMAIN "stream-gridfs-download"
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-stream-gridfs-upload-private.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-stream-gridfs-upload-private.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-stream-gridfs-upload-private.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-stream-gridfs-upload-private.h	2025-08-14 18:37:23.000000000 +0000
@@ -20,6 +20,7 @@
 #define MONGOC_STREAM_GRIDFS_UPLOAD_PRIVATE_H
 
 #include <mongoc/mongoc-gridfs-bucket-file-private.h>
+
 #include <mongoc/mongoc-stream.h>
 
 typedef struct {
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-stream-gridfs-upload.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-stream-gridfs-upload.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-stream-gridfs-upload.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-stream-gridfs-upload.c	2025-08-14 18:37:23.000000000 +0000
@@ -16,9 +16,9 @@
 
 #include <mongoc/mongoc-counters-private.h>
 #include <mongoc/mongoc-gridfs-bucket-file-private.h>
-#include <mongoc/mongoc-trace-private.h>
 #include <mongoc/mongoc-stream-gridfs-upload-private.h>
 #include <mongoc/mongoc-stream-private.h>
+#include <mongoc/mongoc-trace-private.h>
 
 #undef MONGOC_LOG_DOMAIN
 #define MONGOC_LOG_DOMAIN "stream-gridfs-upload"
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-stream-gridfs.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-stream-gridfs.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-stream-gridfs.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-stream-gridfs.c	2025-08-14 18:37:23.000000000 +0000
@@ -15,15 +15,17 @@
  */
 
 
-#include <limits.h>
+#include <mongoc/mongoc-stream-gridfs.h>
 
 #include <mongoc/mongoc-counters-private.h>
-#include <mongoc/mongoc-stream.h>
-#include <mongoc/mongoc-stream-private.h>
-#include <mongoc/mongoc-gridfs-file.h>
 #include <mongoc/mongoc-gridfs-file-private.h>
+#include <mongoc/mongoc-stream-private.h>
 #include <mongoc/mongoc-trace-private.h>
-#include <mongoc/mongoc-stream-gridfs.h>
+
+#include <mongoc/mongoc-gridfs-file.h>
+#include <mongoc/mongoc-stream.h>
+
+#include <limits.h>
 
 
 #undef MONGOC_LOG_DOMAIN
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-stream-gridfs.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-stream-gridfs.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-stream-gridfs.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-stream-gridfs.h	2025-08-14 18:37:23.000000000 +0000
@@ -19,12 +19,12 @@
 #ifndef MONGOC_STREAM_GRIDFS_H
 #define MONGOC_STREAM_GRIDFS_H
 
-#include <bson/bson.h>
-
-#include <mongoc/mongoc-macros.h>
 #include <mongoc/mongoc-gridfs.h>
+#include <mongoc/mongoc-macros.h>
 #include <mongoc/mongoc-stream.h>
 
+#include <bson/bson.h>
+
 
 BSON_BEGIN_DECLS
 
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-stream-socket.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-stream-socket.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-stream-socket.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-stream-socket.c	2025-08-14 18:37:23.000000000 +0000
@@ -15,12 +15,13 @@
  */
 
 
-#include <mongoc/mongoc-stream-private.h>
 #include <mongoc/mongoc-stream-socket.h>
-#include <mongoc/mongoc-trace-private.h>
-#include <mongoc/mongoc-socket-private.h>
-#include <mongoc/mongoc-errno-private.h>
+
 #include <mongoc/mongoc-counters-private.h>
+#include <mongoc/mongoc-errno-private.h>
+#include <mongoc/mongoc-socket-private.h>
+#include <mongoc/mongoc-stream-private.h>
+#include <mongoc/mongoc-trace-private.h>
 
 #undef MONGOC_LOG_DOMAIN
 #define MONGOC_LOG_DOMAIN "stream"
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-stream-tls-openssl-bio-private.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-stream-tls-openssl-bio-private.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-stream-tls-openssl-bio-private.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-stream-tls-openssl-bio-private.h	2025-08-14 18:37:23.000000000 +0000
@@ -23,8 +23,8 @@
 #include <bson/bson.h>
 
 #include <openssl/bio.h>
-#include <openssl/ssl.h>
 #include <openssl/err.h>
+#include <openssl/ssl.h>
 
 BSON_BEGIN_DECLS
 
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-stream-tls-openssl-bio.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-stream-tls-openssl-bio.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-stream-tls-openssl-bio.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-stream-tls-openssl-bio.c	2025-08-14 18:37:23.000000000 +0000
@@ -18,23 +18,25 @@
 
 #ifdef MONGOC_ENABLE_SSL_OPENSSL
 
-#include <bson/bson.h>
-
-#include <errno.h>
-#include <string.h>
-
 #include <mongoc/mongoc-counters-private.h>
 #include <mongoc/mongoc-errno-private.h>
-#include <mongoc/mongoc-stream-tls.h>
+#include <mongoc/mongoc-openssl-private.h>
 #include <mongoc/mongoc-stream-private.h>
-#include <mongoc/mongoc-stream-tls-private.h>
 #include <mongoc/mongoc-stream-tls-openssl-bio-private.h>
 #include <mongoc/mongoc-stream-tls-openssl-private.h>
-#include <mongoc/mongoc-openssl-private.h>
+#include <mongoc/mongoc-stream-tls-private.h>
 #include <mongoc/mongoc-trace-private.h>
+
 #include <mongoc/mongoc-log.h>
+#include <mongoc/mongoc-stream-tls.h>
+
+#include <bson/bson.h>
+
 #include <mlib/cmp.h>
 
+#include <errno.h>
+#include <string.h>
+
 
 #undef MONGOC_LOG_DOMAIN
 #define MONGOC_LOG_DOMAIN "stream-tls-openssl-bio"
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-stream-tls-openssl-private.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-stream-tls-openssl-private.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-stream-tls-openssl-private.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-stream-tls-openssl-private.h	2025-08-14 18:37:23.000000000 +0000
@@ -20,10 +20,11 @@
 #define MONGOC_STREAM_TLS_OPENSSL_PRIVATE_H
 
 #ifdef MONGOC_ENABLE_SSL_OPENSSL
+#include <mongoc/mongoc-stream-tls.h>
+
 #include <bson/bson.h>
-#include <openssl/ssl.h>
 
-#include <mongoc/mongoc-stream-tls.h>
+#include <openssl/ssl.h>
 
 BSON_BEGIN_DECLS
 
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-stream-tls-openssl.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-stream-tls-openssl.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-stream-tls-openssl.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-stream-tls-openssl.c	2025-08-14 18:37:23.000000000 +0000
@@ -18,33 +18,34 @@
 
 #ifdef MONGOC_ENABLE_SSL_OPENSSL
 
-#include <bson/bson.h>
-
-#include <errno.h>
-#include <string.h>
-#include <openssl/bio.h>
-#include <openssl/ssl.h>
-#include <openssl/err.h>
-#include <openssl/x509v3.h>
-
+#include <common-macros-private.h>
 #include <mongoc/mongoc-counters-private.h>
 #include <mongoc/mongoc-errno-private.h>
-#include <mongoc/mongoc-ssl.h>
+#include <mongoc/mongoc-error-private.h>
+#include <mongoc/mongoc-openssl-private.h>
 #include <mongoc/mongoc-ssl-private.h>
-#include <mongoc/mongoc-stream-tls.h>
 #include <mongoc/mongoc-stream-private.h>
-#include <mongoc/mongoc-stream-tls-private.h>
 #include <mongoc/mongoc-stream-tls-openssl-bio-private.h>
 #include <mongoc/mongoc-stream-tls-openssl-private.h>
-#include <mongoc/mongoc-openssl-private.h>
+#include <mongoc/mongoc-stream-tls-private.h>
 #include <mongoc/mongoc-trace-private.h>
+
 #include <mongoc/mongoc-log.h>
-#include <mongoc/mongoc-error-private.h>
+#include <mongoc/mongoc-ssl.h>
+#include <mongoc/mongoc-stream-tls.h>
+
+#include <bson/bson.h>
 
-#include <common-macros-private.h>
 #include <mlib/cmp.h>
 
+#include <openssl/bio.h>
+#include <openssl/err.h>
+#include <openssl/ssl.h>
+#include <openssl/x509v3.h>
+
+#include <errno.h>
 #include <inttypes.h>
+#include <string.h>
 
 
 #undef MONGOC_LOG_DOMAIN
@@ -828,6 +829,9 @@ create_stream_with_ctx (
 mongoc_stream_t *
 mongoc_stream_tls_openssl_new (mongoc_stream_t *base_stream, const char *host, mongoc_ssl_opt_t *opt, int client)
 {
+   BSON_ASSERT_PARAM (base_stream);
+   BSON_ASSERT_PARAM (opt);
+
    SSL_CTX *ssl_ctx = _mongoc_openssl_ctx_new (opt);
 
    if (!ssl_ctx) {
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-stream-tls-openssl.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-stream-tls-openssl.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-stream-tls-openssl.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-stream-tls-openssl.h	2025-08-14 18:37:23.000000000 +0000
@@ -20,10 +20,10 @@
 #define MONGOC_STREAM_TLS_OPENSSL_H
 
 #ifdef MONGOC_ENABLE_SSL_OPENSSL
-#include <bson/bson.h>
-
 #include <mongoc/mongoc-macros.h>
 
+#include <bson/bson.h>
+
 BSON_BEGIN_DECLS
 
 MONGOC_EXPORT (mongoc_stream_t *)
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-stream-tls-private.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-stream-tls-private.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-stream-tls-private.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-stream-tls-private.h	2025-08-14 18:37:23.000000000 +0000
@@ -19,15 +19,17 @@
 #ifndef MONGOC_STREAM_TLS_PRIVATE_H
 #define MONGOC_STREAM_TLS_PRIVATE_H
 
-#include <bson/bson.h>
-
 #include <mongoc/mongoc-ssl.h>
 #include <mongoc/mongoc-stream.h>
 
+#include <bson/bson.h>
+
 #ifdef MONGOC_ENABLE_SSL_OPENSSL
 #include <openssl/ssl.h>
 #endif
 
+#include <mongoc/mongoc-shared-private.h>
+
 BSON_BEGIN_DECLS
 
 /**
@@ -53,7 +55,12 @@ mongoc_stream_tls_new_with_hostname_and_
                                                          mongoc_ssl_opt_t *opt,
                                                          int client,
                                                          SSL_CTX *ssl_ctx) BSON_GNUC_WARN_UNUSED_RESULT;
-#endif
+#elif defined(MONGOC_ENABLE_SSL_SECURE_CHANNEL)
+mongoc_stream_t *
+mongoc_stream_tls_new_with_secure_channel_cred (mongoc_stream_t *base_stream,
+                                                mongoc_ssl_opt_t *opt,
+                                                mongoc_shared_ptr secure_channel_cred_ptr) BSON_GNUC_WARN_UNUSED_RESULT;
+#endif // MONGOC_ENABLE_SSL_SECURE_CHANNEL
 
 BSON_END_DECLS
 
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-stream-tls-secure-channel-private.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-stream-tls-secure-channel-private.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-stream-tls-secure-channel-private.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-stream-tls-secure-channel-private.h	2025-08-14 18:37:23.000000000 +0000
@@ -20,10 +20,13 @@
 #define MONGOC_STREAM_TLS_SECURE_CHANNEL_PRIVATE_H
 
 #ifdef MONGOC_ENABLE_SSL_SECURE_CHANNEL
+#include <mongoc/mongoc-shared-private.h>
+
 #include <bson/bson.h>
 
 /* Its mandatory to indicate to Windows who is compiling the code */
 #define SECURITY_WIN32
+#include <schannel.h>
 #include <security.h>
 
 
@@ -44,7 +47,12 @@ typedef enum {
 typedef struct {
    CredHandle cred_handle;
    TimeStamp time_stamp;
+} mongoc_secure_channel_cred_handle;
+
+// `mongoc_secure_channel_cred` may be shared on multiple connections.
+typedef struct _mongoc_secure_channel_cred {
    PCCERT_CONTEXT cert; /* Owning. Optional client cert. */
+   SCHANNEL_CRED cred;  // TODO: switch to SCH_CREDENTIALS to support TLS v1.3
 } mongoc_secure_channel_cred;
 
 typedef struct {
@@ -59,7 +67,8 @@ typedef struct {
  */
 typedef struct {
    ssl_connect_state connecting_state;
-   mongoc_secure_channel_cred *cred;
+   mongoc_shared_ptr cred_ptr; // Manages a mongoc_secure_channel_cred.
+   mongoc_secure_channel_cred_handle *cred_handle;
    mongoc_secure_channel_ctxt *ctxt;
    SecPkgContext_StreamSizes stream_sizes;
    size_t encdata_length, decdata_length;
@@ -72,6 +81,20 @@ typedef struct {
    bool recv_connection_closed; /* true if connection closed, regardless how */
 } mongoc_stream_tls_secure_channel_t;
 
+struct _mongoc_ssl_opt_t; // Forward declare. Defined in mongoc-ssl.h.
+struct _mongoc_stream_t;  // Forward declare. Defined in mongoc-stream.h.
+
+mongoc_secure_channel_cred *
+mongoc_secure_channel_cred_new (const struct _mongoc_ssl_opt_t *opt);
+
+// mongoc_secure_channel_cred_deleter is useful as a deleter for mongoc_shared_t.
+void
+mongoc_secure_channel_cred_deleter (void *cred_void);
+
+struct _mongoc_stream_t *
+mongoc_stream_tls_secure_channel_new_with_creds (struct _mongoc_stream_t *base_stream,
+                                                 const struct _mongoc_ssl_opt_t *opt,
+                                                 mongoc_shared_ptr cred_ptr /* optional */);
 
 BSON_END_DECLS
 
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-stream-tls-secure-channel.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-stream-tls-secure-channel.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-stream-tls-secure-channel.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-stream-tls-secure-channel.c	2025-08-14 18:37:23.000000000 +0000
@@ -53,29 +53,30 @@
 
 #ifdef MONGOC_ENABLE_SSL_SECURE_CHANNEL
 
-#include <bson/bson.h>
-
-#include <mongoc/mongoc-trace-private.h>
-#include <mongoc/mongoc-log.h>
-#include <mongoc/mongoc-stream-tls.h>
-#include <mongoc/mongoc-stream-tls-private.h>
+#include <mongoc/mongoc-counters-private.h>
+#include <mongoc/mongoc-errno-private.h>
+#include <mongoc/mongoc-error-private.h>
+#include <mongoc/mongoc-secure-channel-private.h>
+#include <mongoc/mongoc-ssl-private.h>
 #include <mongoc/mongoc-stream-private.h>
+#include <mongoc/mongoc-stream-tls-private.h>
 #include <mongoc/mongoc-stream-tls-secure-channel-private.h>
-#include <mongoc/mongoc-secure-channel-private.h>
+#include <mongoc/mongoc-trace-private.h>
+
+#include <mongoc/mongoc-log.h>
 #include <mongoc/mongoc-ssl.h>
-#include <mongoc/mongoc-ssl-private.h>
-#include <mongoc/mongoc-error-private.h>
-#include <mongoc/mongoc-counters-private.h>
-#include <mongoc/mongoc-errno-private.h>
+#include <mongoc/mongoc-stream-tls.h>
+
+#include <bson/bson.h>
 
 #undef MONGOC_LOG_DOMAIN
 #define MONGOC_LOG_DOMAIN "stream-tls-secure-channel"
 
 
 #define SECURITY_WIN32
-#include <security.h>
-#include <schnlsp.h>
 #include <schannel.h>
+#include <schnlsp.h>
+#include <security.h>
 
 /* mingw doesn't define these */
 #ifndef SP_PROT_TLS1_1_CLIENT
@@ -103,7 +104,7 @@ _mongoc_stream_tls_secure_channel_destro
 
    TRACE ("%s", "shutting down SSL/TLS connection");
 
-   if (secure_channel->cred && secure_channel->ctxt) {
+   if (secure_channel->cred_handle && secure_channel->ctxt) {
       SecBufferDesc BuffDesc;
       SecBuffer Buffer;
       SECURITY_STATUS sspi_status;
@@ -124,7 +125,7 @@ _mongoc_stream_tls_secure_channel_destro
       _mongoc_secure_channel_init_sec_buffer (&outbuf, SECBUFFER_EMPTY, NULL, 0);
       _mongoc_secure_channel_init_sec_buffer_desc (&outbuf_desc, &outbuf, 1);
 
-      sspi_status = InitializeSecurityContext (&secure_channel->cred->cred_handle,
+      sspi_status = InitializeSecurityContext (&secure_channel->cred_handle->cred_handle,
                                                &secure_channel->ctxt->ctxt_handle,
                                                /*tls->hostname*/ NULL,
                                                secure_channel->req_flags,
@@ -157,15 +158,16 @@ _mongoc_stream_tls_secure_channel_destro
    }
 
    /* free SSPI Schannel API credential handle */
-   if (secure_channel->cred) {
+   if (secure_channel->cred_handle) {
       /* decrement the reference counter of the credential/session handle */
       /* if the handle was not cached and the refcount is zero */
       TRACE ("%s", "clear credential handle");
-      FreeCredentialsHandle (&secure_channel->cred->cred_handle);
-      CertFreeCertificateContext (secure_channel->cred->cert);
-      bson_free (secure_channel->cred);
+      FreeCredentialsHandle (&secure_channel->cred_handle->cred_handle);
+      bson_free (secure_channel->cred_handle);
    }
 
+   mongoc_shared_ptr_reset_null (&secure_channel->cred_ptr);
+
    /* free internal buffer for received encrypted data */
    if (secure_channel->encdata_buffer != NULL) {
       bson_free (secure_channel->encdata_buffer);
@@ -335,7 +337,6 @@ _mongoc_stream_tls_secure_channel_writev
    size_t bytes;
 
    char *to_write = NULL;
-   size_t to_write_len;
 
    BSON_ASSERT (iov);
    BSON_ASSERT (iovcnt);
@@ -355,6 +356,9 @@ _mongoc_stream_tls_secure_channel_writev
          BSON_ASSERT (buf_end >= buf_tail);
          const size_t buf_remaining = (size_t) (buf_end - buf_tail);
 
+         // Set below and guarded by `to_write`.
+         size_t to_write_len = 0u;
+
          if (buf_head != buf_tail || ((i + 1u < iovcnt) && (buf_remaining > (iov[i].iov_len - iov_pos)))) {
             /* If we have either of:
              *   - buffered bytes already
@@ -838,18 +842,94 @@ _mongoc_stream_tls_secure_channel_should
    RETURN (mongoc_stream_should_retry (tls->base_stream));
 }
 
+mongoc_secure_channel_cred *
+mongoc_secure_channel_cred_new (const mongoc_ssl_opt_t *opt)
+{
+   BSON_ASSERT_PARAM (opt);
+   mongoc_secure_channel_cred *cred = bson_malloc0 (sizeof (mongoc_secure_channel_cred));
+
+   cred->cred.dwVersion = SCHANNEL_CRED_VERSION;
+
+/* SCHANNEL_CRED:
+ * SCH_USE_STRONG_CRYPTO is not available in VS2010
+ *   https://msdn.microsoft.com/en-us/library/windows/desktop/aa379810.aspx */
+#ifdef SCH_USE_STRONG_CRYPTO
+   cred->cred.dwFlags = SCH_USE_STRONG_CRYPTO;
+#endif
+
+   /* By default, enable soft failing.
+    * A certificate with no revocation check is a soft failure. */
+   cred->cred.dwFlags |= SCH_CRED_IGNORE_NO_REVOCATION_CHECK;
+   /* An offline OCSP responder / CRL distribution list is a soft failure. */
+   cred->cred.dwFlags |= SCH_CRED_IGNORE_REVOCATION_OFFLINE;
+   if (opt->weak_cert_validation) {
+      cred->cred.dwFlags |= SCH_CRED_MANUAL_CRED_VALIDATION;
+      TRACE ("%s", "disabled server certificate checks");
+   } else {
+      cred->cred.dwFlags |= SCH_CRED_AUTO_CRED_VALIDATION;
+      if (!_mongoc_ssl_opts_disable_certificate_revocation_check (opt)) {
+         cred->cred.dwFlags |= SCH_CRED_REVOCATION_CHECK_CHAIN;
+         TRACE ("%s", "enabled server certificate revocation checks");
+      }
+      TRACE ("%s", "enabled server certificate checks");
+   }
+
+   if (opt->allow_invalid_hostname) {
+      cred->cred.dwFlags |= SCH_CRED_NO_SERVERNAME_CHECK;
+   }
+
+   if (opt->ca_file) {
+      mongoc_secure_channel_setup_ca (opt);
+   }
+
+   if (opt->crl_file) {
+      mongoc_secure_channel_setup_crl (opt);
+   }
+
+   if (opt->pem_file) {
+      cred->cert = mongoc_secure_channel_setup_certificate (opt);
+
+      if (cred->cert) {
+         cred->cred.cCreds = 1;
+         cred->cred.paCred = &cred->cert;
+      }
+   }
+
+   cred->cred.grbitEnabledProtocols = SP_PROT_TLS1_1_CLIENT | SP_PROT_TLS1_2_CLIENT;
+   return cred;
+}
+
+void
+mongoc_secure_channel_cred_deleter (void *cred_void)
+{
+   mongoc_secure_channel_cred *cred = cred_void;
+   if (!cred) {
+      return;
+   }
+   CertFreeCertificateContext (cred->cert);
+   bson_free (cred);
+}
+
 mongoc_stream_t *
 mongoc_stream_tls_secure_channel_new (mongoc_stream_t *base_stream, const char *host, mongoc_ssl_opt_t *opt, int client)
 {
+   BSON_UNUSED (host);
+   BSON_UNUSED (client);
+   return mongoc_stream_tls_secure_channel_new_with_creds (base_stream, opt, MONGOC_SHARED_PTR_NULL);
+}
+
+mongoc_stream_t *
+mongoc_stream_tls_secure_channel_new_with_creds (mongoc_stream_t *base_stream,
+                                                 const mongoc_ssl_opt_t *opt,
+                                                 mongoc_shared_ptr cred_ptr)
+{
    SECURITY_STATUS sspi_status = SEC_E_OK;
-   SCHANNEL_CRED schannel_cred;
    mongoc_stream_tls_t *tls;
    mongoc_stream_tls_secure_channel_t *secure_channel;
-   PCCERT_CONTEXT cert = NULL;
 
    ENTRY;
-   BSON_ASSERT (base_stream);
-   BSON_ASSERT (opt);
+   BSON_ASSERT_PARAM (base_stream);
+   BSON_ASSERT_PARAM (opt);
 
 
    secure_channel = (mongoc_stream_tls_secure_channel_t *) bson_malloc0 (sizeof *secure_channel);
@@ -881,62 +961,18 @@ mongoc_stream_tls_secure_channel_new (mo
    TRACE ("%s", "SSL/TLS connection with endpoint AcquireCredentialsHandle");
 
    /* setup Schannel API options */
-   memset (&schannel_cred, 0, sizeof (schannel_cred));
-   schannel_cred.dwVersion = SCHANNEL_CRED_VERSION;
-
-/* SCHANNEL_CRED:
- * SCH_USE_STRONG_CRYPTO is not available in VS2010
- *   https://msdn.microsoft.com/en-us/library/windows/desktop/aa379810.aspx */
-#ifdef SCH_USE_STRONG_CRYPTO
-   schannel_cred.dwFlags = SCH_USE_STRONG_CRYPTO;
-#endif
-
-   /* By default, enable soft failing.
-    * A certificate with no revocation check is a soft failure. */
-   schannel_cred.dwFlags |= SCH_CRED_IGNORE_NO_REVOCATION_CHECK;
-   /* An offline OCSP responder / CRL distribution list is a soft failure. */
-   schannel_cred.dwFlags |= SCH_CRED_IGNORE_REVOCATION_OFFLINE;
-   if (opt->weak_cert_validation) {
-      schannel_cred.dwFlags |= SCH_CRED_MANUAL_CRED_VALIDATION;
-      TRACE ("%s", "disabled server certificate checks");
+   if (mongoc_shared_ptr_is_null (cred_ptr)) {
+      // Shared credentials were not passed. Create credentials for this stream:
+      mongoc_shared_ptr_reset (
+         &secure_channel->cred_ptr, mongoc_secure_channel_cred_new (opt), mongoc_secure_channel_cred_deleter);
    } else {
-      schannel_cred.dwFlags |= SCH_CRED_AUTO_CRED_VALIDATION;
-      if (!_mongoc_ssl_opts_disable_certificate_revocation_check (opt)) {
-         schannel_cred.dwFlags |= SCH_CRED_REVOCATION_CHECK_CHAIN;
-         TRACE ("%s", "enabled server certificate revocation checks");
-      }
-      TRACE ("%s", "enabled server certificate checks");
+      mongoc_shared_ptr_assign (&secure_channel->cred_ptr, cred_ptr); // Increase reference count.
    }
 
-   if (opt->allow_invalid_hostname) {
-      schannel_cred.dwFlags |= SCH_CRED_NO_SERVERNAME_CHECK;
-   }
+   mongoc_secure_channel_cred *cred = secure_channel->cred_ptr.ptr;
 
-   if (opt->ca_file) {
-      mongoc_secure_channel_setup_ca (opt);
-   }
-
-   if (opt->crl_file) {
-      mongoc_secure_channel_setup_crl (opt);
-   }
-
-   if (opt->pem_file) {
-      cert = mongoc_secure_channel_setup_certificate (opt);
-
-      if (cert) {
-         schannel_cred.cCreds = 1;
-         schannel_cred.paCred = &cert;
-      }
-   }
-
-
-   schannel_cred.grbitEnabledProtocols = SP_PROT_TLS1_1_CLIENT | SP_PROT_TLS1_2_CLIENT;
-
-   secure_channel->cred = (mongoc_secure_channel_cred *) bson_malloc0 (sizeof (mongoc_secure_channel_cred));
-   if (cert) {
-      // Store client cert to free later.
-      secure_channel->cred->cert = cert;
-   }
+   secure_channel->cred_handle =
+      (mongoc_secure_channel_cred_handle *) bson_malloc0 (sizeof (mongoc_secure_channel_cred_handle));
 
    /* Example:
     *   https://msdn.microsoft.com/en-us/library/windows/desktop/aa375454%28v=vs.85%29.aspx
@@ -947,17 +983,20 @@ mongoc_stream_tls_secure_channel_new (mo
                                            UNISP_NAME,           /* security package */
                                            SECPKG_CRED_OUTBOUND, /* we are preparing outbound connection */
                                            NULL,                 /*  Optional logon */
-                                           &schannel_cred,       /* TLS "configuration", "auth data" */
+                                           &cred->cred,          /* TLS "configuration", "auth data" */
                                            NULL,                 /* unused */
                                            NULL,                 /* unused */
-                                           &secure_channel->cred->cred_handle, /* credential OUT param */
-                                           &secure_channel->cred->time_stamp); /* certificate expiration time */
+                                           &secure_channel->cred_handle->cred_handle, /* credential OUT param */
+                                           &secure_channel->cred_handle->time_stamp); /* certificate expiration time */
 
    if (sspi_status != SEC_E_OK) {
       // Cast signed SECURITY_STATUS to unsigned DWORD. FormatMessage expects DWORD.
       char *msg = mongoc_winerr_to_string ((DWORD) sspi_status);
       MONGOC_ERROR ("Failed to initialize security context: %s", msg);
       bson_free (msg);
+      // Detach the base stream so caller can free.
+      tls->base_stream = NULL;
+      mongoc_stream_destroy ((mongoc_stream_t *) tls);
       RETURN (NULL);
    }
 
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-stream-tls-secure-channel.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-stream-tls-secure-channel.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-stream-tls-secure-channel.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-stream-tls-secure-channel.h	2025-08-14 18:37:23.000000000 +0000
@@ -20,10 +20,10 @@
 #define MONGOC_STREAM_TLS_SECURE_CHANNEL_H
 
 #ifdef MONGOC_ENABLE_SSL_SECURE_CHANNEL
-#include <bson/bson.h>
-
 #include <mongoc/mongoc-macros.h>
 
+#include <bson/bson.h>
+
 BSON_BEGIN_DECLS
 
 MONGOC_EXPORT (mongoc_stream_t *)
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-stream-tls-secure-transport-private.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-stream-tls-secure-transport-private.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-stream-tls-secure-transport-private.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-stream-tls-secure-transport-private.h	2025-08-14 18:37:23.000000000 +0000
@@ -20,12 +20,12 @@
 #define MONGOC_STREAM_TLS_SECURE_TRANSPORT_PRIVATE_H
 
 #ifdef MONGOC_ENABLE_SSL_SECURE_TRANSPORT
+#include <common-macros-private.h>
+
 #include <bson/bson.h>
 
 #include <Security/Security.h>
 
-#include <common-macros-private.h>
-
 BSON_BEGIN_DECLS
 
 // CDRIVER-2722: Secure Transport is deprecated on MacOS.
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-stream-tls-secure-transport.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-stream-tls-secure-transport.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-stream-tls-secure-transport.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-stream-tls-secure-transport.c	2025-08-14 18:37:23.000000000 +0000
@@ -18,26 +18,26 @@
 
 #ifdef MONGOC_ENABLE_SSL_SECURE_TRANSPORT
 
-#include <Security/Security.h>
-#include <Security/SecureTransport.h>
-#include <CoreFoundation/CoreFoundation.h>
-
-
-#include <bson/bson.h>
-
-#include <mongoc/mongoc-trace-private.h>
-#include <mongoc/mongoc-log.h>
+#include <common-macros-private.h>
+#include <common-string-private.h>
+#include <mongoc/mongoc-counters-private.h>
+#include <mongoc/mongoc-error-private.h>
 #include <mongoc/mongoc-secure-transport-private.h>
-#include <mongoc/mongoc-ssl.h>
 #include <mongoc/mongoc-ssl-private.h>
-#include <mongoc/mongoc-error-private.h>
-#include <mongoc/mongoc-counters-private.h>
-#include <mongoc/mongoc-stream-tls.h>
-#include <mongoc/mongoc-stream-tls-private.h>
 #include <mongoc/mongoc-stream-private.h>
+#include <mongoc/mongoc-stream-tls-private.h>
 #include <mongoc/mongoc-stream-tls-secure-transport-private.h>
-#include <common-macros-private.h>
-#include <common-string-private.h>
+#include <mongoc/mongoc-trace-private.h>
+
+#include <mongoc/mongoc-log.h>
+#include <mongoc/mongoc-ssl.h>
+#include <mongoc/mongoc-stream-tls.h>
+
+#include <bson/bson.h>
+
+#include <CoreFoundation/CoreFoundation.h>
+#include <Security/SecureTransport.h>
+#include <Security/Security.h>
 
 #undef MONGOC_LOG_DOMAIN
 #define MONGOC_LOG_DOMAIN "stream-tls-secure_transport"
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-stream-tls-secure-transport.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-stream-tls-secure-transport.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-stream-tls-secure-transport.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-stream-tls-secure-transport.h	2025-08-14 18:37:23.000000000 +0000
@@ -20,10 +20,10 @@
 #define MONGOC_STREAM_TLS_SECURE_TRANSPORT_H
 
 #ifdef MONGOC_ENABLE_SSL_SECURE_TRANSPORT
-#include <bson/bson.h>
-
 #include <mongoc/mongoc-macros.h>
 
+#include <bson/bson.h>
+
 BSON_BEGIN_DECLS
 
 MONGOC_EXPORT (mongoc_stream_t *)
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-stream-tls.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-stream-tls.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-stream-tls.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-stream-tls.c	2025-08-14 18:37:23.000000000 +0000
@@ -18,28 +18,34 @@
 
 #ifdef MONGOC_ENABLE_SSL
 
-#include <errno.h>
-#include <string.h>
-#include <bson/bson.h>
+#include <mongoc/mongoc-error-private.h>
+#include <mongoc/mongoc-stream-private.h>
+#include <mongoc/mongoc-stream-tls-private.h>
+#include <mongoc/mongoc-trace-private.h>
 
 #include <mongoc/mongoc-log.h>
-#include <mongoc/mongoc-trace-private.h>
-#include <mongoc/mongoc-error-private.h>
 
-#include <mongoc/mongoc-stream-tls-private.h>
-#include <mongoc/mongoc-stream-private.h>
+#include <bson/bson.h>
+
+#include <errno.h>
+#include <string.h>
 #if defined(MONGOC_ENABLE_SSL_OPENSSL)
-#include <mongoc/mongoc-stream-tls-openssl.h>
 #include <mongoc/mongoc-openssl-private.h>
+
+#include <mongoc/mongoc-stream-tls-openssl.h>
 #elif defined(MONGOC_ENABLE_SSL_SECURE_TRANSPORT)
 #include <mongoc/mongoc-secure-transport-private.h>
+
 #include <mongoc/mongoc-stream-tls-secure-transport.h>
 #elif defined(MONGOC_ENABLE_SSL_SECURE_CHANNEL)
 #include <mongoc/mongoc-secure-channel-private.h>
+
 #include <mongoc/mongoc-stream-tls-secure-channel.h>
 #endif
-#include <mongoc/mongoc-stream-tls.h>
 #include <common-macros-private.h> // BEGIN_IGNORE_DEPRECATIONS
+
+#include <mongoc/mongoc-stream-tls.h>
+
 #include <mlib/cmp.h>
 
 #undef MONGOC_LOG_DOMAIN
@@ -121,37 +127,22 @@ mongoc_stream_tls_handshake_block (mongo
    return false;
 }
 
-
-/*
- *--------------------------------------------------------------------------
- *
- * mongoc_stream_tls_new_with_hostname --
- *
- *       Creates a new mongoc_stream_tls_t to communicate with a remote
- *       server using a TLS stream.
- *
- *       @host the hostname we are connected to and to verify the
- *       server certificate against
- *
- *       @base_stream should be a stream that will become owned by the
- *       resulting tls stream. It will be used for raw I/O.
- *
- *       @trust_store_dir should be a path to the SSL cert db to use for
- *       verifying trust of the remote server.
- *
- * Returns:
- *       NULL on failure, otherwise a mongoc_stream_t.
- *
- * Side effects:
- *       None.
- *
- *--------------------------------------------------------------------------
- */
-
+// mongoc_stream_tls_new_with_hostname creates a TLS stream.
+//
+// base_stream: underlying data stream. Ownership is transferred to the returned stream on success.
+// host: hostname used to verify the the server certificate.
+// opt: TLS options.
+// client: indicates a client or server stream. Secure Channel implementation does not support server streams.
+//
+// Side effect: May set opt->allow_invalid_hostname to true.
+//
+// Returns a new stream on success. Returns `NULL` on failure.
 mongoc_stream_t *
 mongoc_stream_tls_new_with_hostname (mongoc_stream_t *base_stream, const char *host, mongoc_ssl_opt_t *opt, int client)
 {
-   BSON_ASSERT (base_stream);
+   BSON_ASSERT_PARAM (base_stream);
+   BSON_OPTIONAL_PARAM (host);
+   BSON_ASSERT_PARAM (opt);
 
    /* !client is only used for testing,
     * when the streams are pretending to be the server */
@@ -178,37 +169,27 @@ mongoc_stream_tls_new_with_hostname (mon
 }
 
 #if defined(MONGOC_ENABLE_SSL_OPENSSL) && OPENSSL_VERSION_NUMBER >= 0x10100000L
-/*
- *--------------------------------------------------------------------------
- *
- * mongoc_stream_tls_new_with_hostname_and_openssl_context --
- *
- *       Creates a new mongoc_stream_tls_t to communicate with a remote
- *       server using a TLS stream, using an existing OpenSSL context.
- *
- *       @ssl_ctx is the global OpenSSL context for the mongoc_client_t
- *       associated with this function call.
- *
- *       @host the hostname we are connected to and to verify the
- *       server certificate against
- *
- *       @base_stream should be a stream that will become owned by the
- *       resulting tls stream. It will be used for raw I/O.
- *
- * Returns:
- *       NULL on failure, otherwise a mongoc_stream_t.
- *
- * Side effects:
- *       None.
- *
- *--------------------------------------------------------------------------
- */
-
+// Create an OpenSSL TLS stream with a shared context.
+//
+// This is an internal extension to mongoc_stream_tls_new_with_hostname.
+//
+// base_stream: underlying data stream. Ownership is transferred to the returned stream on success.
+// host: hostname used to verify the the server certificate.
+// opt: TLS options.
+// client: indicates a client or server stream.
+// ssl_ctx: shared context.
+//
+// Side effect: May set opt->allow_invalid_hostname to true for compatibility with mongoc_stream_tls_new_with_hostname.
+//
+// Returns a new stream on success. Returns `NULL` on failure.
 mongoc_stream_t *
 mongoc_stream_tls_new_with_hostname_and_openssl_context (
    mongoc_stream_t *base_stream, const char *host, mongoc_ssl_opt_t *opt, int client, SSL_CTX *ssl_ctx)
 {
-   BSON_ASSERT (base_stream);
+   BSON_ASSERT_PARAM (base_stream);
+   BSON_OPTIONAL_PARAM (host);
+   BSON_ASSERT_PARAM (opt);
+   BSON_OPTIONAL_PARAM (ssl_ctx);
 
    /* !client is only used for testing,
     * when the streams are pretending to be the server */
@@ -227,4 +208,32 @@ mongoc_stream_tls_new_with_hostname_and_
 }
 #endif
 
+#if defined(MONGOC_ENABLE_SSL_SECURE_CHANNEL)
+// Create a Secure Channel TLS stream with shared credentials.
+//
+// This is an internal extension to mongoc_stream_tls_new_with_hostname.
+//
+// base_stream: underlying data stream. Ownership is transferred to the returned stream on success.
+// opt: TLS options.
+// secure_channel_cred_ptr: optional shared credentials. May be MONGOC_SHARED_PTR_NULL.
+//
+// Side effect: May set opt->allow_invalid_hostname to true for compatibility with mongoc_stream_tls_new_with_hostname.
+//
+// Returns a new stream on success. Returns `NULL` on failure.
+mongoc_stream_t *
+mongoc_stream_tls_new_with_secure_channel_cred (mongoc_stream_t *base_stream,
+                                                mongoc_ssl_opt_t *opt,
+                                                mongoc_shared_ptr secure_channel_cred_ptr)
+{
+   BSON_ASSERT_PARAM (base_stream);
+   BSON_ASSERT_PARAM (opt);
+
+   if (opt->weak_cert_validation) {
+      // For compatibility with `mongoc_stream_tls_new_with_hostname`, modify `opt` directly:
+      opt->allow_invalid_hostname = true;
+   }
+   return mongoc_stream_tls_secure_channel_new_with_creds (base_stream, opt, secure_channel_cred_ptr);
+}
+#endif // MONGOC_ENABLE_SSL_SECURE_CHANNEL
+
 #endif
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-stream-tls.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-stream-tls.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-stream-tls.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-stream-tls.h	2025-08-14 18:37:23.000000000 +0000
@@ -19,12 +19,12 @@
 #ifndef MONGOC_STREAM_TLS_H
 #define MONGOC_STREAM_TLS_H
 
-#include <bson/bson.h>
-
 #include <mongoc/mongoc-macros.h>
 #include <mongoc/mongoc-ssl.h>
 #include <mongoc/mongoc-stream.h>
 
+#include <bson/bson.h>
+
 
 BSON_BEGIN_DECLS
 
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-stream.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-stream.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-stream.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-stream.c	2025-08-14 18:37:23.000000000 +0000
@@ -15,20 +15,23 @@
  */
 
 
-#include <bson/bson.h>
+#include <mongoc/mongoc-stream.h>
 
 #include <mongoc/mongoc-array-private.h>
 #include <mongoc/mongoc-buffer-private.h>
-#include <mongoc/mongoc-error-private.h>
 #include <mongoc/mongoc-errno-private.h>
-#include <mongoc/mongoc-flags.h>
-#include <mongoc/mongoc-log.h>
-#include <mongoc/mongoc-opcode.h>
+#include <mongoc/mongoc-error-private.h>
 #include <mongoc/mongoc-rpc-private.h>
-#include <mongoc/mongoc-stream.h>
 #include <mongoc/mongoc-stream-private.h>
 #include <mongoc/mongoc-trace-private.h>
 #include <mongoc/mongoc-util-private.h>
+
+#include <mongoc/mongoc-flags.h>
+#include <mongoc/mongoc-log.h>
+#include <mongoc/mongoc-opcode.h>
+
+#include <bson/bson.h>
+
 #include <mlib/cmp.h>
 
 
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-stream.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-stream.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-stream.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-stream.h	2025-08-14 18:37:23.000000000 +0000
@@ -19,8 +19,8 @@
 #ifndef MONGOC_STREAM_H
 #define MONGOC_STREAM_H
 
-#include <mongoc/mongoc-macros.h>
 #include <mongoc/mongoc-iovec.h>
+#include <mongoc/mongoc-macros.h>
 #include <mongoc/mongoc-socket.h>
 
 
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-structured-log-private.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-structured-log-private.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-structured-log-private.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-structured-log-private.h	2025-08-14 18:37:23.000000000 +0000
@@ -19,14 +19,16 @@
 #ifndef MONGOC_STRUCTURED_LOG_PRIVATE_H
 #define MONGOC_STRUCTURED_LOG_PRIVATE_H
 
-#include <bson/bson.h>
 #include <common-bson-dsl-private.h>
 #include <mongoc/mongoc-cmd-private.h>
 #include <mongoc/mongoc-error-private.h>
-#include <mongoc/mongoc-server-description-private.h>
 #include <mongoc/mongoc-read-prefs-private.h>
+#include <mongoc/mongoc-server-description-private.h>
+
 #include <mongoc/mongoc-structured-log.h>
 
+#include <bson/bson.h>
+
 BSON_BEGIN_DECLS
 
 typedef struct mongoc_structured_log_instance_t mongoc_structured_log_instance_t;
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-structured-log.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-structured-log.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-structured-log.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-structured-log.c	2025-08-14 18:37:23.000000000 +0000
@@ -14,18 +14,20 @@
  * limitations under the License.
  */
 
-#include <mlib/intencode.h>
+#include <mongoc/mongoc-structured-log.h>
+
 #include <common-atomic-private.h>
+#include <common-json-private.h>
 #include <common-oid-private.h>
 #include <common-string-private.h>
-#include <common-json-private.h>
 #include <common-thread-private.h>
 #include <mongoc/mongoc-apm-private.h>
 #include <mongoc/mongoc-error-private.h>
 #include <mongoc/mongoc-structured-log-private.h>
 #include <mongoc/mongoc-topology-private.h>
-#include <mongoc/mongoc-structured-log.h>
 #include <mongoc/mongoc-util-private.h>
+
+#include <mlib/intencode.h>
 #include <mlib/loop.h>
 
 #define STRUCTURED_LOG_COMPONENT_TABLE_SIZE (1 + (size_t) MONGOC_STRUCTURED_LOG_COMPONENT_CONNECTION)
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-structured-log.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-structured-log.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-structured-log.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-structured-log.h	2025-08-14 18:37:23.000000000 +0000
@@ -19,10 +19,10 @@
 #ifndef MONGOC_STRUCTURED_LOG_H
 #define MONGOC_STRUCTURED_LOG_H
 
-#include <bson/bson.h>
-
 #include <mongoc/mongoc-macros.h>
 
+#include <bson/bson.h>
+
 BSON_BEGIN_DECLS
 
 typedef enum {
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-thread-private.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-thread-private.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-thread-private.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-thread-private.h	2025-08-14 18:37:23.000000000 +0000
@@ -19,12 +19,13 @@
 #ifndef MONGOC_THREAD_PRIVATE_H
 #define MONGOC_THREAD_PRIVATE_H
 
-#include <bson/bson.h>
-
 #include <common-thread-private.h>
+
 #include <mongoc/mongoc-config.h>
 #include <mongoc/mongoc-log.h>
 
+#include <bson/bson.h>
+
 #if defined(BSON_OS_UNIX)
 #define mongoc_cond_t pthread_cond_t
 #define mongoc_cond_broadcast pthread_cond_broadcast
@@ -94,6 +95,7 @@ mongo_cond_ret_is_timedout (int ret)
 static BSON_INLINE int
 mongoc_cond_destroy (mongoc_cond_t *_ignored)
 {
+   (void) _ignored;
    return 0;
 }
 #endif
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-timeout-private.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-timeout-private.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-timeout-private.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-timeout-private.h	2025-08-14 18:37:23.000000000 +0000
@@ -19,8 +19,8 @@
 #ifndef MONGOC_TIMEOUT_PRIVATE_H
 #define MONGOC_TIMEOUT_PRIVATE_H
 
-#include <stdint.h>
 #include <stdbool.h>
+#include <stdint.h>
 
 typedef struct _mongoc_timeout_t mongoc_timeout_t;
 
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-timeout.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-timeout.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-timeout.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-timeout.c	2025-08-14 18:37:23.000000000 +0000
@@ -15,6 +15,7 @@
  */
 
 #include <mongoc/mongoc-timeout-private.h>
+
 #include <mongoc/mongoc.h>
 
 struct _mongoc_timeout_t {
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-topology-background-monitoring-private.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-topology-background-monitoring-private.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-topology-background-monitoring-private.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-topology-background-monitoring-private.h	2025-08-14 18:37:23.000000000 +0000
@@ -1,4 +1,3 @@
-
 /*
  * Copyright 2009-present MongoDB, Inc.
  *
@@ -20,9 +19,10 @@
 #ifndef MONGOC_TOPOLOGY_BACKGROUND_MONITORING_PRIVATE_H
 #define MONGOC_TOPOLOGY_BACKGROUND_MONITORING_PRIVATE_H
 
-#include <mongoc/mongoc.h>
 #include <mongoc/mongoc-topology-private.h>
 
+#include <mongoc/mongoc.h>
+
 /* Methods of mongoc_topology_t for managing background monitoring. */
 
 void
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-topology-background-monitoring.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-topology-background-monitoring.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-topology-background-monitoring.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-topology-background-monitoring.c	2025-08-14 18:37:23.000000000 +0000
@@ -14,20 +14,19 @@
  * limitations under the License.
  */
 
-#include <mongoc/mongoc-topology-background-monitoring-private.h>
-
 #include <mongoc/mongoc-client-private.h>
 #include <mongoc/mongoc-log-private.h>
 #include <mongoc/mongoc-server-monitor-private.h>
+#include <mongoc/mongoc-topology-background-monitoring-private.h>
 #ifdef MONGOC_ENABLE_SSL
 #include <mongoc/mongoc-ssl-private.h>
 #endif
+#include <common-atomic-private.h>
 #include <mongoc/mongoc-stream-private.h>
 #include <mongoc/mongoc-topology-description-apm-private.h>
 #include <mongoc/mongoc-topology-private.h>
 #include <mongoc/mongoc-trace-private.h>
 #include <mongoc/mongoc-util-private.h>
-#include <common-atomic-private.h>
 
 #undef MONGOC_LOG_DOMAIN
 #define MONGOC_LOG_DOMAIN "monitor"
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-topology-description-apm-private.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-topology-description-apm-private.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-topology-description-apm-private.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-topology-description-apm-private.h	2025-08-14 18:37:23.000000000 +0000
@@ -19,9 +19,10 @@
 #ifndef MONGOC_TOPOLOGY_DESCRIPTION_APM_PRIVATE_H
 #define MONGOC_TOPOLOGY_DESCRIPTION_APM_PRIVATE_H
 
-#include <bson/bson.h>
-#include <mongoc/mongoc-topology-description-private.h>
 #include <mongoc/mongoc-log-and-monitor-private.h>
+#include <mongoc/mongoc-topology-description-private.h>
+
+#include <bson/bson.h>
 
 /* Application Performance Monitoring for topology events, complies with the
  * SDAM Monitoring Spec:
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-topology-description-apm.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-topology-description-apm.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-topology-description-apm.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-topology-description-apm.c	2025-08-14 18:37:23.000000000 +0000
@@ -14,9 +14,9 @@
  * limitations under the License.
  */
 
-#include <mongoc/mongoc-topology-description-apm-private.h>
 #include <mongoc/mongoc-server-description-private.h>
 #include <mongoc/mongoc-structured-log-private.h>
+#include <mongoc/mongoc-topology-description-apm-private.h>
 
 /* Application Performance Monitoring for topology events, complies with the
  * SDAM Monitoring Spec:
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-topology-description-private.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-topology-description-private.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-topology-description-private.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-topology-description-private.h	2025-08-14 18:37:23.000000000 +0000
@@ -19,14 +19,15 @@
 #ifndef MONGOC_TOPOLOGY_DESCRIPTION_PRIVATE_H
 #define MONGOC_TOPOLOGY_DESCRIPTION_PRIVATE_H
 
-#include <mongoc/mongoc-set-private.h>
-#include <mongoc/mongoc-server-description.h>
-#include <mongoc/mongoc-server-description-private.h>
-#include <mongoc/mongoc-array-private.h>
-#include <mongoc/mongoc-topology-description.h>
 #include <mongoc/mongoc-apm-private.h>
+#include <mongoc/mongoc-array-private.h>
 #include <mongoc/mongoc-deprioritized-servers-private.h>
 #include <mongoc/mongoc-log-and-monitor-private.h>
+#include <mongoc/mongoc-server-description-private.h>
+#include <mongoc/mongoc-set-private.h>
+
+#include <mongoc/mongoc-server-description.h>
+#include <mongoc/mongoc-topology-description.h>
 
 
 typedef enum {
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-topology-description.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-topology-description.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-topology-description.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-topology-description.c	2025-08-14 18:37:23.000000000 +0000
@@ -16,16 +16,17 @@
 
 #include <common-oid-private.h>
 #include <mongoc/mongoc-array-private.h>
+#include <mongoc/mongoc-client-private.h>
 #include <mongoc/mongoc-error-private.h>
+#include <mongoc/mongoc-host-list-private.h>
+#include <mongoc/mongoc-read-prefs-private.h>
 #include <mongoc/mongoc-server-description-private.h>
+#include <mongoc/mongoc-set-private.h>
+#include <mongoc/mongoc-thread-private.h>
 #include <mongoc/mongoc-topology-description-apm-private.h>
 #include <mongoc/mongoc-trace-private.h>
 #include <mongoc/mongoc-util-private.h>
-#include <mongoc/mongoc-read-prefs-private.h>
-#include <mongoc/mongoc-set-private.h>
-#include <mongoc/mongoc-client-private.h>
-#include <mongoc/mongoc-thread-private.h>
-#include <mongoc/mongoc-host-list-private.h>
+
 #include <mongoc/utlist.h>
 
 
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-topology-description.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-topology-description.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-topology-description.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-topology-description.h	2025-08-14 18:37:23.000000000 +0000
@@ -19,11 +19,11 @@
 #ifndef MONGOC_TOPOLOGY_DESCRIPTION_H
 #define MONGOC_TOPOLOGY_DESCRIPTION_H
 
-#include <bson/bson.h>
-
 #include <mongoc/mongoc-macros.h>
 #include <mongoc/mongoc-read-prefs.h>
 
+#include <bson/bson.h>
+
 
 BSON_BEGIN_DECLS
 
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-topology-private.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-topology-private.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-topology-private.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-topology-private.h	2025-08-14 18:37:23.000000000 +0000
@@ -19,20 +19,21 @@
 #ifndef MONGOC_TOPOLOGY_PRIVATE_H
 #define MONGOC_TOPOLOGY_PRIVATE_H
 
-#include <mongoc/mongoc-config.h>
+#include <common-atomic-private.h>
+#include <mongoc/mongoc-client-session-private.h>
+#include <mongoc/mongoc-crypt-private.h>
 #include <mongoc/mongoc-error-private.h>
-#include <mongoc/mongoc-topology-scanner-private.h>
-#include <mongoc/mongoc-server-description-private.h>
-#include <mongoc/mongoc-topology-description-private.h>
 #include <mongoc/mongoc-log-and-monitor-private.h>
+#include <mongoc/mongoc-server-description-private.h>
+#include <mongoc/mongoc-shared-private.h>
 #include <mongoc/mongoc-thread-private.h>
-#include <mongoc/mongoc-uri.h>
-#include <mongoc/mongoc-client-session-private.h>
-#include <mongoc/mongoc-crypt-private.h>
+#include <mongoc/mongoc-topology-description-private.h>
+#include <mongoc/mongoc-topology-scanner-private.h>
 #include <mongoc/mongoc-ts-pool-private.h>
-#include <mongoc/mongoc-shared-private.h>
+
+#include <mongoc/mongoc-config.h>
 #include <mongoc/mongoc-sleep.h>
-#include <common-atomic-private.h>
+#include <mongoc/mongoc-uri.h>
 
 #define MONGOC_TOPOLOGY_MIN_HEARTBEAT_FREQUENCY_MS 500
 #define MONGOC_TOPOLOGY_SOCKET_CHECK_INTERVAL_MS 5000
@@ -107,7 +108,7 @@ typedef union mc_shared_tpld {
 } mc_shared_tpld;
 
 /** A null-pointer initializer for an `mc_shared_tpld` */
-#define MC_SHARED_TPLD_NULL ((mc_shared_tpld){._sptr_ = MONGOC_SHARED_PTR_NULL})
+#define MC_SHARED_TPLD_NULL ((mc_shared_tpld) {._sptr_ = MONGOC_SHARED_PTR_NULL})
 
 typedef struct _mongoc_topology_t {
    /**
@@ -417,7 +418,6 @@ typedef enum {
  * @param reply If checking for a command error, the server reply. Otherwise
  * NULL
  * @param why An error that will be attached to the server description
- * @param max_wire_version
  * @param generation The generation of the server description the caller was
  * using.
  * @param service_id A service ID for a load-balanced deployment. If not
@@ -434,7 +434,6 @@ _mongoc_topology_handle_app_error (mongo
                                    _mongoc_sdam_app_error_type_t type,
                                    const bson_t *reply,
                                    const bson_error_t *why,
-                                   uint32_t max_wire_version,
                                    uint32_t generation,
                                    const bson_oid_t *service_id);
 
@@ -500,7 +499,7 @@ _mongoc_topology_get_connection_pool_gen
 static BSON_INLINE mc_shared_tpld
 mc_tpld_take_ref (const mongoc_topology_t *tpl)
 {
-   return (mc_shared_tpld){._sptr_ = mongoc_atomic_shared_ptr_load (&tpl->_shared_descr_._sptr_)};
+   return (mc_shared_tpld) {._sptr_ = mongoc_atomic_shared_ptr_load (&tpl->_shared_descr_._sptr_)};
 }
 
 /**
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-topology-scanner-private.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-topology-scanner-private.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-topology-scanner-private.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-topology-scanner-private.h	2025-08-14 18:37:23.000000000 +0000
@@ -25,16 +25,18 @@
 #ifdef MONGOC_ENABLE_SSL_OPENSSL
 #include <openssl/ssl.h>
 #endif
-#include <mongoc/mongoc-async-private.h>
+#include <common-thread-private.h>
+#include <mongoc/mongoc-apm-private.h>
 #include <mongoc/mongoc-async-cmd-private.h>
+#include <mongoc/mongoc-async-private.h>
+#include <mongoc/mongoc-crypto-private.h>
 #include <mongoc/mongoc-handshake-private.h>
-#include <mongoc/mongoc-host-list.h>
-#include <mongoc/mongoc-apm-private.h>
 #include <mongoc/mongoc-scram-private.h>
-#include <mongoc/mongoc-ssl.h>
-#include <mongoc/mongoc-crypto-private.h>
 #include <mongoc/mongoc-server-description-private.h>
-#include <common-thread-private.h>
+#include <mongoc/mongoc-shared-private.h>
+
+#include <mongoc/mongoc-host-list.h>
+#include <mongoc/mongoc-ssl.h>
 
 BSON_BEGIN_DECLS
 
@@ -133,6 +135,8 @@ typedef struct mongoc_topology_scanner {
 
 #if defined(MONGOC_ENABLE_SSL_OPENSSL) && OPENSSL_VERSION_NUMBER >= 0x10100000L
    SSL_CTX *openssl_ctx;
+#elif defined(MONGOC_ENABLE_SSL_SECURE_CHANNEL)
+   mongoc_shared_ptr secure_channel_cred_ptr; // Manages a mongoc_secure_channel_cred.
 #endif
 
    int64_t dns_cache_timeout_ms;
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-topology-scanner.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-topology-scanner.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-topology-scanner.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-topology-scanner.c	2025-08-14 18:37:23.000000000 +0000
@@ -14,39 +14,47 @@
  * limitations under the License.
  */
 
-#include <bson/bson.h>
-
-#include <mongoc/mongoc-config.h>
 #include <mongoc/mongoc-error-private.h>
-#include <mongoc/mongoc-trace-private.h>
-#include <mongoc/mongoc-topology-scanner-private.h>
+#include <mongoc/mongoc-handshake-private.h>
 #include <mongoc/mongoc-stream-private.h>
-#include <mongoc/mongoc-stream-socket.h>
+#include <mongoc/mongoc-topology-scanner-private.h>
+#include <mongoc/mongoc-trace-private.h>
 
+#include <mongoc/mongoc-config.h>
 #include <mongoc/mongoc-handshake.h>
-#include <mongoc/mongoc-handshake-private.h>
+#include <mongoc/mongoc-stream-socket.h>
+
+#include <bson/bson.h>
 
 #ifdef MONGOC_ENABLE_SSL
 #include <mongoc/mongoc-stream-tls.h>
 #endif
 
 #if defined(MONGOC_ENABLE_SSL_OPENSSL) && OPENSSL_VERSION_NUMBER >= 0x10100000L
+#include <mongoc/mongoc-stream-tls-private.h>
+
 #include <openssl/ssl.h>
+#endif
+
+#if defined(MONGOC_ENABLE_SSL_SECURE_CHANNEL)
 #include <mongoc/mongoc-stream-tls-private.h>
+#include <mongoc/mongoc-stream-tls-secure-channel-private.h>
 #endif
 
+#include <common-atomic-private.h>
+#include <common-string-private.h>
+#include <mongoc/mongoc-client-private.h>
+#include <mongoc/mongoc-cluster-private.h>
 #include <mongoc/mongoc-counters-private.h>
-#include <mongoc/utlist.h>
-#include <mongoc/mongoc-topology-private.h>
 #include <mongoc/mongoc-host-list-private.h>
+#include <mongoc/mongoc-structured-log-private.h>
+#include <mongoc/mongoc-topology-private.h>
 #include <mongoc/mongoc-uri-private.h>
-#include <mongoc/mongoc-cluster-private.h>
-#include <mongoc/mongoc-client-private.h>
 #include <mongoc/mongoc-util-private.h>
-#include <mongoc/mongoc-structured-log-private.h>
-#include <common-string-private.h>
+
+#include <mongoc/utlist.h>
+
 #include <mlib/cmp.h>
-#include <common-atomic-private.h>
 
 #include <inttypes.h>
 
@@ -429,6 +437,9 @@ mongoc_topology_scanner_new (const mongo
    /* may be overridden for testing. */
    ts->dns_cache_timeout_ms = DNS_CACHE_TIMEOUT_MS;
    bson_mutex_init (&ts->handshake_cmd_mtx);
+#if defined(MONGOC_ENABLE_SSL_SECURE_CHANNEL)
+   ts->secure_channel_cred_ptr = MONGOC_SHARED_PTR_NULL;
+#endif
 
    _init_hello (ts);
 
@@ -475,6 +486,10 @@ mongoc_topology_scanner_destroy (mongoc_
    ts->openssl_ctx = NULL;
 #endif
 
+#if defined(MONGOC_ENABLE_SSL_SECURE_CHANNEL)
+   mongoc_shared_ptr_reset_null (&ts->secure_channel_cred_ptr);
+#endif
+
    /* This field can be set by a mongoc_client */
    bson_free ((char *) ts->appname);
 
@@ -800,6 +815,9 @@ _mongoc_topology_scanner_node_setup_stre
 #if defined(MONGOC_ENABLE_SSL_OPENSSL) && OPENSSL_VERSION_NUMBER >= 0x10100000L
       tls_stream = mongoc_stream_tls_new_with_hostname_and_openssl_context (
          stream, node->host.host, node->ts->ssl_opts, 1, node->ts->openssl_ctx);
+#elif defined(MONGOC_ENABLE_SSL_SECURE_CHANNEL)
+      tls_stream =
+         mongoc_stream_tls_new_with_secure_channel_cred (stream, node->ts->ssl_opts, node->ts->secure_channel_cred_ptr);
 #else
       tls_stream = mongoc_stream_tls_new_with_hostname (stream, node->host.host, node->ts->ssl_opts, 1);
 #endif
@@ -915,6 +933,7 @@ mongoc_topology_scanner_node_connect_uni
 {
 #ifdef _WIN32
    ENTRY;
+   BSON_UNUSED (node);
    _mongoc_set_error (
       error, MONGOC_ERROR_STREAM, MONGOC_ERROR_STREAM_CONNECT, "UNIX domain sockets not supported on win32.");
    RETURN (false);
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-topology.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-topology.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-topology.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-topology.c	2025-08-14 18:37:23.000000000 +0000
@@ -14,31 +14,30 @@
  * limitations under the License.
  */
 
-#include <mongoc/mongoc-config.h>
-
-#include <mongoc/mongoc-handshake.h>
-#include <mongoc/mongoc-handshake-private.h>
-
-#include <mongoc/mongoc-host-list-private.h>
-#include <mongoc/mongoc-log.h>
-#include <mongoc/mongoc-topology-private.h>
-#include <mongoc/mongoc-topology-description-apm-private.h>
+#include <common-oid-private.h>
+#include <common-string-private.h>
 #include <mongoc/mongoc-client-private.h>
 #include <mongoc/mongoc-cmd-private.h>
-#include <mongoc/mongoc-uri-private.h>
-#include <mongoc/mongoc-util-private.h>
-#include <mongoc/mongoc-trace-private.h>
 #include <mongoc/mongoc-error-private.h>
-#include <mongoc/mongoc-topology-background-monitoring-private.h>
+#include <mongoc/mongoc-handshake-private.h>
+#include <mongoc/mongoc-host-list-private.h>
 #include <mongoc/mongoc-read-prefs-private.h>
 #include <mongoc/mongoc-structured-log-private.h>
+#include <mongoc/mongoc-topology-background-monitoring-private.h>
+#include <mongoc/mongoc-topology-description-apm-private.h>
+#include <mongoc/mongoc-topology-private.h>
+#include <mongoc/mongoc-trace-private.h>
+#include <mongoc/mongoc-uri-private.h>
+#include <mongoc/mongoc-util-private.h>
 
+#include <mongoc/mongoc-config.h>
+#include <mongoc/mongoc-handshake.h>
+#include <mongoc/mongoc-log.h>
 #include <mongoc/utlist.h>
 
-#include <stdint.h>
-#include <common-string-private.h>
 #include <mlib/cmp.h>
-#include <common-oid-private.h>
+
+#include <stdint.h>
 
 static void
 _topology_collect_errors (const mongoc_topology_description_t *topology, bson_error_t *error_out);
@@ -520,8 +519,8 @@ mongoc_topology_new (const mongoc_uri_t
 
       /* Use rr_data to update the topology's URI. */
       if (rr_data.txt_record_opts &&
-          !mongoc_uri_parse_options (
-             topology->uri, rr_data.txt_record_opts, true /* from_dns */, &topology->scanner->error)) {
+          !_mongoc_uri_apply_query_string (
+             topology->uri, mstr_cstring (rr_data.txt_record_opts), true /* from_dns */, &topology->scanner->error)) {
          GOTO (srv_fail);
       }
 
@@ -1746,7 +1745,6 @@ _handle_sdam_app_error_command (mongoc_t
                                 uint32_t generation,
                                 const bson_oid_t *service_id,
                                 const mongoc_server_description_t *sd,
-                                uint32_t max_wire_version,
                                 const bson_t *reply)
 {
    bson_error_t cmd_error;
@@ -1779,7 +1777,7 @@ _handle_sdam_app_error_command (mongoc_t
       return false;
    }
 
-   should_clear_pool = (max_wire_version <= WIRE_VERSION_4_0 || _mongoc_error_is_shutdown (&cmd_error));
+   should_clear_pool = _mongoc_error_is_shutdown (&cmd_error);
 
    tdmod = mc_tpld_modify_begin (topology);
 
@@ -1861,7 +1859,6 @@ _mongoc_topology_handle_app_error (mongo
                                    _mongoc_sdam_app_error_type_t type,
                                    const bson_t *reply,
                                    const bson_error_t *why,
-                                   uint32_t max_wire_version,
                                    uint32_t generation,
                                    const bson_oid_t *service_id)
 {
@@ -1897,8 +1894,7 @@ _mongoc_topology_handle_app_error (mongo
 
    /* Do something with the error */
    if (type == MONGOC_SDAM_APP_ERROR_COMMAND) {
-      cleared_pool = _handle_sdam_app_error_command (
-         topology, td.ptr, server_id, generation, service_id, sd, max_wire_version, reply);
+      cleared_pool = _handle_sdam_app_error_command (topology, td.ptr, server_id, generation, service_id, sd, reply);
    } else {
       /* Invalidate the server that saw the error. */
       mc_tpld_modification tdmod = mc_tpld_modify_begin (topology);
@@ -1995,7 +1991,7 @@ mc_tpld_modify_begin (mongoc_topology_t
    prev_td = mc_tpld_take_ref (tpl);
    new_td = mongoc_topology_description_new_copy (prev_td.ptr);
    mc_tpld_drop_ref (&prev_td);
-   return (mc_tpld_modification){
+   return (mc_tpld_modification) {
       .new_td = new_td,
       .topology = tpl,
    };
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-trace-private.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-trace-private.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-trace-private.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-trace-private.h	2025-08-14 18:37:23.000000000 +0000
@@ -21,12 +21,16 @@
 #define MONGOC_TRACE_PRIVATE_H
 
 
-#include <bson/bson.h>
-#include <ctype.h>
-
-#include <mongoc/mongoc-log.h>
 #include <mongoc/mongoc-log-private.h>
+
 #include <mongoc/mongoc-config.h>
+#include <mongoc/mongoc-log.h>
+
+#include <bson/bson.h>
+
+#include <mlib/config.h>
+
+#include <ctype.h>
 
 
 BSON_BEGIN_DECLS
@@ -34,47 +38,72 @@ BSON_BEGIN_DECLS
 // `gLogTrace` determines if tracing is enabled at runtime.
 extern bool gLogTrace;
 
-#define TRACE(msg, ...)                        \
-   do {                                        \
-      if (MONGOC_TRACE_ENABLED && gLogTrace) { \
-         mongoc_log (MONGOC_LOG_LEVEL_TRACE,   \
-                     MONGOC_LOG_DOMAIN,        \
-                     "TRACE: %s():%d " msg,    \
-                     BSON_FUNC,                \
-                     (int) (__LINE__),         \
-                     __VA_ARGS__);             \
-      }                                        \
-   } while (0)
+#define TRACE(msg, ...)                                         \
+   if (1) {                                                     \
+      mlib_diagnostic_push ();                                  \
+      mlib_disable_constant_conditional_expression_warnings (); \
+      if (MONGOC_TRACE_ENABLED && gLogTrace) {                  \
+         mongoc_log (MONGOC_LOG_LEVEL_TRACE,                    \
+                     MONGOC_LOG_DOMAIN,                         \
+                     "TRACE: %s():%d " msg,                     \
+                     BSON_FUNC,                                 \
+                     (int) (__LINE__),                          \
+                     __VA_ARGS__);                              \
+      }                                                         \
+      mlib_diagnostic_pop ();                                   \
+   } else                                                       \
+      ((void) 0)
+
 #define ENTRY                                                                                                   \
-   do {                                                                                                         \
+   if (1) {                                                                                                     \
+      mlib_diagnostic_push ();                                                                                  \
+      mlib_disable_constant_conditional_expression_warnings ();                                                 \
       if (MONGOC_TRACE_ENABLED && gLogTrace) {                                                                  \
          mongoc_log (MONGOC_LOG_LEVEL_TRACE, MONGOC_LOG_DOMAIN, "ENTRY: %s():%d", BSON_FUNC, (int) (__LINE__)); \
       }                                                                                                         \
-   } while (0)
+      mlib_diagnostic_pop ();                                                                                   \
+   } else                                                                                                       \
+      ((void) 0)
+
 #define EXIT                                                                                                    \
    do {                                                                                                         \
+      mlib_diagnostic_push ();                                                                                  \
+      mlib_disable_constant_conditional_expression_warnings ();                                                 \
       if (MONGOC_TRACE_ENABLED && gLogTrace) {                                                                  \
          mongoc_log (MONGOC_LOG_LEVEL_TRACE, MONGOC_LOG_DOMAIN, " EXIT: %s():%d", BSON_FUNC, (int) (__LINE__)); \
       }                                                                                                         \
+      mlib_diagnostic_pop ();                                                                                   \
       return;                                                                                                   \
-   } while (0)
+   } while (0) // do-while instead of if-else to avoid false-positive -Wreturn-type warnings with GCC 11.
+
 #define RETURN(ret)                                                                                             \
    do {                                                                                                         \
+      mlib_diagnostic_push ();                                                                                  \
+      mlib_disable_constant_conditional_expression_warnings ();                                                 \
       if (MONGOC_TRACE_ENABLED && gLogTrace) {                                                                  \
          mongoc_log (MONGOC_LOG_LEVEL_TRACE, MONGOC_LOG_DOMAIN, " EXIT: %s():%d", BSON_FUNC, (int) (__LINE__)); \
       }                                                                                                         \
+      mlib_diagnostic_pop ();                                                                                   \
       return ret;                                                                                               \
-   } while (0)
+   } while (0) // do-while instead of if-else to avoid false-positive -Wreturn-type warnings with GCC 11.
+
 #define GOTO(label)                                                                                               \
-   do {                                                                                                           \
+   if (1) {                                                                                                       \
+      mlib_diagnostic_push ();                                                                                    \
+      mlib_disable_constant_conditional_expression_warnings ();                                                   \
       if (MONGOC_TRACE_ENABLED && gLogTrace) {                                                                    \
          mongoc_log (                                                                                             \
             MONGOC_LOG_LEVEL_TRACE, MONGOC_LOG_DOMAIN, " GOTO: %s():%d %s", BSON_FUNC, (int) (__LINE__), #label); \
       }                                                                                                           \
+      mlib_diagnostic_pop ();                                                                                     \
       goto label;                                                                                                 \
-   } while (0)
+   } else                                                                                                         \
+      ((void) 0)
+
 #define DUMP_BSON(_bson)                                               \
-   do {                                                                \
+   if (1) {                                                            \
+      mlib_diagnostic_push ();                                         \
+      mlib_disable_constant_conditional_expression_warnings ();        \
       if (MONGOC_TRACE_ENABLED && gLogTrace) {                         \
          char *_bson_str;                                              \
          if (_bson) {                                                  \
@@ -91,9 +120,14 @@ extern bool gLogTrace;
                      _bson_str);                                       \
          bson_free (_bson_str);                                        \
       }                                                                \
-   } while (0)
+      mlib_diagnostic_pop ();                                          \
+   } else                                                              \
+      ((void) 0)
+
 #define DUMP_IOVEC(_n, _iov, _iovcnt)                               \
-   do {                                                             \
+   if (1) {                                                         \
+      mlib_diagnostic_push ();                                      \
+      mlib_disable_constant_conditional_expression_warnings ();     \
       if (MONGOC_TRACE_ENABLED && gLogTrace) {                      \
          mongoc_log (MONGOC_LOG_LEVEL_TRACE,                        \
                      MONGOC_LOG_DOMAIN,                             \
@@ -105,7 +139,9 @@ extern bool gLogTrace;
                      (int) _iovcnt);                                \
          mongoc_log_trace_iovec (MONGOC_LOG_DOMAIN, _iov, _iovcnt); \
       }                                                             \
-   } while (0)
+      mlib_diagnostic_pop ();                                       \
+   } else                                                           \
+      ((void) 0)
 
 
 BSON_END_DECLS
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-ts-pool.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-ts-pool.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-ts-pool.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-ts-pool.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,8 +1,10 @@
-#include <mongoc/mongoc-ts-pool-private.h>
+#include <common-atomic-private.h>
 #include <common-thread-private.h>
+#include <mongoc/mongoc-ts-pool-private.h>
 
 #include <bson/bson.h>
-#include <common-atomic-private.h>
+
+#include <mlib/config.h>
 
 /**
  * Toggle this to enable/disable checks that all items are returned to the pool
@@ -28,7 +30,17 @@ static const bool audit_pool_enabled = f
 typedef struct pool_node {
    struct pool_node *next;
    mongoc_ts_pool *owner_pool;
+
+#if defined(_MSC_VER)
+#pragma warning(push)
+#pragma warning(disable : 4200)
+#endif
+
    unsigned char data[];
+
+#if defined(_MSC_VER)
+#pragma warning(pop)
+#endif
 } pool_node;
 
 // Flexible member array member should not contribute to sizeof result.
@@ -141,16 +153,7 @@ _new_item (mongoc_ts_pool *pool, bson_er
    node->owner_pool = pool;
    if (pool->params.constructor) {
       /* To construct, we need to know if that constructor fails */
-      bson_error_t my_error;
-      if (!error) {
-         /* Caller doesn't care about the error, but we care in case the
-          * constructor might fail */
-         error = &my_error;
-      }
-      /* Clear the error */
-      error->code = 0;
-      error->domain = 0;
-      error->message[0] = 0;
+      bson_error_reset (error);
       /* Construct the object */
       pool->params.constructor (_pool_node_get_data (node), pool->params.userdata, error);
       if (error->code != 0) {
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-uri-private.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-uri-private.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-uri-private.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-uri-private.h	2025-08-14 18:37:23.000000000 +0000
@@ -19,9 +19,12 @@
 #ifndef MONGOC_URI_PRIVATE_H
 #define MONGOC_URI_PRIVATE_H
 
-#include <mongoc/mongoc-uri.h>
-#include <mongoc/mongoc-scram-private.h>
 #include <mongoc/mongoc-crypto-private.h>
+#include <mongoc/mongoc-scram-private.h>
+
+#include <mongoc/mongoc-uri.h>
+
+#include <mlib/str.h>
 
 
 BSON_BEGIN_DECLS
@@ -34,10 +37,19 @@ mongoc_uri_upsert_host (mongoc_uri_t *ur
 void
 mongoc_uri_remove_host (mongoc_uri_t *uri, const char *host, uint16_t port);
 
+/**
+ * @brief Update the settings on a URI based on a URI query string
+ *
+ * @param uri The URI to be updated
+ * @param options A string of key-value pairs, separated by "&", URI %-encoded.
+ * This should not include the leading "?"
+ * @param from_dns Whether this string comes from a DNS query
+ * @return true Upon success. The internal settings of the URI object have been updated
+ * @return false Otherwise. The internal settings of the URI object are unspecified.
+ */
 bool
-mongoc_uri_parse_host (mongoc_uri_t *uri, const char *str);
-bool
-mongoc_uri_parse_options (mongoc_uri_t *uri, const char *str, bool from_dns, bson_error_t *error);
+_mongoc_uri_apply_query_string (mongoc_uri_t *uri, mstr_view options, bool from_dns, bson_error_t *error);
+
 int32_t
 mongoc_uri_get_local_threshold_option (const mongoc_uri_t *uri);
 
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-uri.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-uri.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-uri.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-uri.c	2025-08-14 18:37:23.000000000 +0000
@@ -15,32 +15,36 @@
  */
 
 
+#include <sys/types.h>
+
 #include <ctype.h>
+#include <math.h>
 #include <stdlib.h>
 #include <string.h>
-#include <sys/types.h>
-#include <math.h>
 
 /* strcasecmp on windows */
+#include <common-bson-dsl-private.h>
+#include <common-string-private.h>
+#include <mongoc/mongoc-compression-private.h>
+#include <mongoc/mongoc-error-private.h>
+#include <mongoc/mongoc-handshake-private.h>
+#include <mongoc/mongoc-host-list-private.h>
+#include <mongoc/mongoc-oidc-env-private.h>
+#include <mongoc/mongoc-read-concern-private.h>
+#include <mongoc/mongoc-topology-private.h>
+#include <mongoc/mongoc-trace-private.h>
+#include <mongoc/mongoc-uri-private.h>
 #include <mongoc/mongoc-util-private.h>
+#include <mongoc/mongoc-write-concern-private.h>
 
 #include <mongoc/mongoc-config.h>
-#include <mongoc/mongoc-error-private.h>
 #include <mongoc/mongoc-host-list.h>
-#include <mongoc/mongoc-host-list-private.h>
 #include <mongoc/mongoc-log.h>
-#include <mongoc/mongoc-handshake-private.h>
 #include <mongoc/mongoc-socket.h>
-#include <mongoc/mongoc-topology-private.h>
-#include <mongoc/mongoc-uri-private.h>
-#include <mongoc/mongoc-read-concern-private.h>
-#include <mongoc/mongoc-write-concern-private.h>
-#include <mongoc/mongoc-compression-private.h>
 #include <mongoc/utlist.h>
-#include <mongoc/mongoc-trace-private.h>
 
-#include <common-bson-dsl-private.h>
-#include <common-string-private.h>
+#include <mlib/intencode.h>
+#include <mlib/str.h>
 
 struct _mongoc_uri_t {
    char *str;
@@ -59,6 +63,13 @@ struct _mongoc_uri_t {
    mongoc_write_concern_t *write_concern;
 };
 
+// Common strings we need to look for
+static const mstr_view COLON = {":", 1};
+static const mstr_view COMMA = {",", 1};
+static const mstr_view QUESTION = {"?", 1};
+static const mstr_view SLASH = {"/", 1};
+static const mstr_view AT = {"@", 1};
+
 #define MONGOC_URI_ERROR(error, format, ...) \
    _mongoc_set_error (error, MONGOC_ERROR_COMMAND, MONGOC_ERROR_COMMAND_INVALID_ARG, format, __VA_ARGS__)
 
@@ -75,17 +86,6 @@ _mongoc_uri_set_option_as_int32_with_err
 static bool
 _mongoc_uri_set_option_as_int64_with_error (mongoc_uri_t *uri, const char *option, int64_t value, bson_error_t *error);
 
-static void
-mongoc_uri_do_unescape (char **str)
-{
-   char *tmp;
-
-   if ((tmp = *str)) {
-      *str = mongoc_uri_unescape (tmp);
-      bson_free (tmp);
-   }
-}
-
 
 #define VALIDATE_SRV_ERR()                                                   \
    do {                                                                      \
@@ -193,7 +193,7 @@ mongoc_uri_upsert_host (mongoc_uri_t *ur
    mongoc_host_list_t temp;
 
    memset (&temp, 0, sizeof (mongoc_host_list_t));
-   if (!_mongoc_host_list_from_hostport_with_err (&temp, host, port, error)) {
+   if (!_mongoc_host_list_from_hostport_with_err (&temp, mstr_cstring (host), port, error)) {
       return false;
    }
 
@@ -206,134 +206,118 @@ mongoc_uri_remove_host (mongoc_uri_t *ur
    _mongoc_host_list_remove_host (&(uri->hosts), host, port);
 }
 
-/*
- *--------------------------------------------------------------------------
- *
- * scan_to_unichar --
- *
- *       Scans 'str' until either a character matching 'match' is found,
- *       until one of the characters in 'terminators' is encountered, or
- *       until we reach the end of 'str'.
- *
- *       NOTE: 'terminators' may not include multibyte UTF-8 characters.
- *
- * Returns:
- *       If 'match' is found, returns a copy of the section of 'str' before
- *       that character.  Otherwise, returns NULL.
- *
- * Side Effects:
- *       If 'match' is found, sets 'end' to begin at the matching character
- *       in 'str'.
+
+/**
+ * @brief %-decode a %-encoded string
  *
- *--------------------------------------------------------------------------
+ * @param sv The string to be decoded
+ * @return char* A pointer to a new C string, which must be freed with `bson_free`,
+ * or a null pointer in case of error
  */
-
 static char *
-scan_to_unichar (const char *str, bson_unichar_t match, const char *terminators, const char **end)
+_strdup_pct_decode (mstr_view const sv, bson_error_t *error)
 {
-   bson_unichar_t c;
-   const char *iter;
-
-   for (iter = str; iter && *iter && (c = bson_utf8_get_char (iter)); iter = bson_utf8_next_char (iter)) {
-      if (c == match) {
-         *end = iter;
-         return bson_strndup (str, iter - str);
-      } else if (c == '\\') {
-         iter = bson_utf8_next_char (iter);
-         if (!bson_utf8_get_char (iter)) {
-            break;
-         }
-      } else {
-         const char *term_iter;
-         for (term_iter = terminators; *term_iter; term_iter++) {
-            if (mlib_cmp (c, ==, *term_iter)) {
-               return NULL;
-            }
-         }
-      }
+   // Compute how many bytes we want to store
+   size_t bufsize = 0;
+   // Must use safe arithmetic because a pathological sv with `len == SIZE_MAX` is possible
+   bool add_okay = !mlib_add (&bufsize, sv.len, 1);
+   // Prepare the output region. We can allocate the whole thing up-front, because
+   // we know the decode result will be *at most* as long as `sv`, since %-encoding
+   // can only ever grow the plaintext string
+   char *const buf = add_okay ? bson_malloc0 (bufsize) : NULL;
+   // alloc or arithmetic failure
+   if (!buf) {
+      MONGOC_URI_ERROR (error, "%s", "Failed to allocate memory for the %%-decoding");
+      return NULL;
    }
 
-   return NULL;
-}
-
-
-static bool
-mongoc_uri_parse_scheme (mongoc_uri_t *uri, const char *str, const char **end)
-{
-   if (!strncmp (str, "mongodb+srv://", 14)) {
-      uri->is_srv = true;
-      *end = str + 14;
-      return true;
-   }
+   // char-wise output
+   char *out = buf;
+   // Consume the input as we go
+   mstr_view remain = sv;
+   while (remain.len) {
+      if (remain.data[0] != '%') {
+         // Not a % char, just append it
+         *out++ = remain.data[0];
+         remain = mstr_substr (remain, 1);
+         continue;
+      }
+      // %-sequence
+      if (remain.len < 3) {
+         MONGOC_URI_ERROR (
+            error, "At offset %zu: Truncated %%-sequence \"%.*s\"", (sv.len - remain.len), MSTR_FMT (remain));
+         bson_free (buf);
+         return NULL;
+      }
+      // Grab the next two chars
+      mstr_view pair = mstr_substr (remain, 1, 2);
+      uint64_t v;
+      if (mlib_nat64_parse (pair, 16, &v)) {
+         MONGOC_URI_ERROR (error, "At offset %zu: Invalid %%-sequence \"%.3s\"", (sv.len - remain.len), remain.data);
+         bson_free (buf);
+         return NULL;
+      }
 
-   if (!strncmp (str, "mongodb://", 10)) {
-      uri->is_srv = false;
-      *end = str + 10;
-      return true;
+      // Append the decoded byte value
+      *out++ = (char) v;
+      // Drop the "%xy" sequence
+      remain = mstr_substr (remain, 3);
    }
 
-   return false;
-}
-
-
-static bool
-mongoc_uri_has_unescaped_chars (const char *str, const char *chars)
-{
-   const char *c;
-   const char *tmp;
-   char *s;
-
-   for (c = chars; *c; c++) {
-      s = scan_to_unichar (str, (bson_unichar_t) *c, "", &tmp);
-      if (s) {
-         bson_free (s);
-         return true;
-      }
+   // Check whether the decoded result is valid UTF-8
+   size_t len = (size_t) (out - buf);
+   if (!bson_utf8_validate (buf, len, false)) {
+      MONGOC_URI_ERROR (
+         error, "%s", "Invalid %%-encoded string: The decoded result is not valid UTF-8 or contains null characters");
+      bson_free (buf);
+      return NULL;
    }
 
-   return false;
+   return buf;
 }
 
 
-/* "str" is non-NULL, the part of URI between "mongodb://" and first "@" */
+/**
+ * @brief Parse the userinfo segment from a URI string
+ *
+ * @param uri The URI to be updated
+ * @param userpass The userinfo segment from the original URI string
+ * @return true If the operation succeeds
+ * @return false Otherwise
+ */
 static bool
-mongoc_uri_parse_userpass (mongoc_uri_t *uri, const char *str, bson_error_t *error)
+_uri_parse_userinfo (mongoc_uri_t *uri, mstr_view userpass, bson_error_t *error)
 {
-   const char *prohibited = "@:/";
-   const char *end_user;
-
-   BSON_ASSERT (str);
+   bson_error_reset (error);
    BSON_ASSERT (uri);
 
-   if ((uri->username = scan_to_unichar (str, ':', "", &end_user))) {
-      uri->password = bson_strdup (end_user + 1);
-   } else {
-      uri->username = bson_strdup (str);
-      uri->password = NULL;
-   }
+   // Split the user/pass around the colon:
+   mstr_view username, password;
+   const bool has_password = mstr_split_around (userpass, COLON, &username, &password);
 
-   if (mongoc_uri_has_unescaped_chars (uri->username, prohibited)) {
-      MONGOC_URI_ERROR (error, "Username \"%s\" must not have unescaped chars. %s", uri->username, escape_instructions);
+   // Check if the username has invalid unescaped characters
+   const mstr_view PROHIBITED_CHARS = mstr_cstring ("@:/");
+   if (mstr_find_first_of (username, PROHIBITED_CHARS) != SIZE_MAX) {
+      MONGOC_URI_ERROR (error, "Username must not have unescaped chars. %s", escape_instructions);
+      return false;
+   }
+   if (mstr_find_first_of (password, PROHIBITED_CHARS) != SIZE_MAX) {
+      MONGOC_URI_ERROR (error, "Password must not have unescaped chars. %s", escape_instructions);
       return false;
    }
 
-   mongoc_uri_do_unescape (&uri->username);
+   // Store the username and password on the URI
+   uri->username = _strdup_pct_decode (username, error);
    if (!uri->username) {
-      MONGOC_URI_ERROR (error, "Incorrect URI escapes in username. %s", escape_instructions);
+      MONGOC_URI_ERROR (error, "%s", "Invalid %-encoding in username in URI string");
       return false;
    }
 
    /* Providing password at all is optional */
-   if (uri->password) {
-      if (mongoc_uri_has_unescaped_chars (uri->password, prohibited)) {
-         MONGOC_URI_ERROR (
-            error, "Password \"%s\" must not have unescaped chars. %s", uri->password, escape_instructions);
-         return false;
-      }
-
-      mongoc_uri_do_unescape (&uri->password);
+   if (has_password) {
+      uri->password = _strdup_pct_decode (password, error);
       if (!uri->password) {
-         MONGOC_URI_ERROR (error, "%s", "Incorrect URI escapes in password");
+         MONGOC_URI_ERROR (error, "%s", "Invalid %-encoding in password in URI string");
          return false;
       }
    }
@@ -341,55 +325,64 @@ mongoc_uri_parse_userpass (mongoc_uri_t
    return true;
 }
 
-bool
-mongoc_uri_parse_host (mongoc_uri_t *uri, const char *host_and_port_in)
+/**
+ * @brief Parse a single host specifier for a URI
+ *
+ * @param uri The URI object to be updated
+ * @param hostport A host specifier, with an optional port
+ * @return true If the operation succeeds
+ * @return false Otherwise
+ */
+static bool
+_parse_one_host (mongoc_uri_t *uri, mstr_view hostport, bson_error_t *error)
 {
-   char *host_and_port = bson_strdup (host_and_port_in);
-   bson_error_t err = {0};
-   bool r;
-
-   /* unescape host. It doesn't hurt including port. */
-   if (mongoc_uri_has_unescaped_chars (host_and_port, "/")) {
+   bson_error_reset (error);
+   // Don't allow an unescaped "/" in the host string.
+   if (mstr_find (hostport, SLASH) != SIZE_MAX) {
+      // They were probably trying to do a unix socket. Those slashes must be escaped
       MONGOC_WARNING ("Unix Domain Sockets must be escaped (e.g. / = %%2F)");
-      bson_free (host_and_port);
       return false;
    }
 
-   mongoc_uri_do_unescape (&host_and_port);
+   /* unescape host. It doesn't hurt including port. */
+   char *host_and_port = _strdup_pct_decode (hostport, error);
    if (!host_and_port) {
       /* invalid */
-      bson_free (host_and_port);
+      MONGOC_URI_ERROR (error, "Invalid host specifier \"%.*s\": %s", MSTR_FMT (hostport), error->message);
       return false;
    }
 
-   r = mongoc_uri_upsert_host_and_port (uri, host_and_port, &err);
-
-   if (!r) {
-      MONGOC_ERROR ("%s", err.message);
-      bson_free (host_and_port);
-      return false;
+   const bool okay = mongoc_uri_upsert_host_and_port (uri, host_and_port, error);
+   if (!okay) {
+      MONGOC_URI_ERROR (error, "Invalid host specifier \"%s\": %s", host_and_port, error->message);
    }
 
    bson_free (host_and_port);
-   return true;
+   return okay;
 }
 
 
+/**
+ * @brief Parse the single SRV host specifier for a URI
+ *
+ * @param uri The URI to be updated
+ * @param str The host string for the URI. Should specify a single SRV name
+ * @return true If the operation succeeds
+ * @return false Otherwise
+ */
 static bool
-mongoc_uri_parse_srv (mongoc_uri_t *uri, const char *str, bson_error_t *error)
+_parse_srv_hostname (mongoc_uri_t *uri, mstr_view str, bson_error_t *error)
 {
-   if (*str == '\0') {
+   bson_error_reset (error);
+   if (str.len == 0) {
       MONGOC_URI_ERROR (error, "%s", "Missing service name in SRV URI");
       return false;
    }
 
    {
-      char *service = bson_strdup (str);
-
-      mongoc_uri_do_unescape (&service);
-
+      char *service = _strdup_pct_decode (str, error);
       if (!service || !valid_hostname (service) || count_dots (service) < 2) {
-         MONGOC_URI_ERROR (error, "%s", "Invalid service name in URI");
+         MONGOC_URI_ERROR (error, "Invalid SRV service name \"%.*s\" in URI: %s", MSTR_FMT (str), error->message);
          bson_free (service);
          return false;
       }
@@ -413,100 +406,83 @@ mongoc_uri_parse_srv (mongoc_uri_t *uri,
 }
 
 
-/* "hosts" is non-NULL, the part between "mongodb://" or "@" and last "/" */
+/**
+ * @brief Parse the comma-separate list of host+port specifiers and store them in `uri`
+ *
+ * @param uri The URI object to be updated
+ * @param hosts A non-empty comma-separated list of host specifiers
+ * @param error An error object to be updated in case of failure
+ * @return true If the operation succeeds and at least one host was added to `uri`
+ * @return false Otherise. `error` will be updated.
+ */
 static bool
-mongoc_uri_parse_hosts (mongoc_uri_t *uri, const char *hosts)
+_parse_hosts_csv (mongoc_uri_t *uri, mstr_view const hosts, bson_error_t *error)
 {
-   const char *next;
-   const char *end_hostport;
-   char *s;
-   BSON_ASSERT (hosts);
-   /*
-    * Parsing the series of hosts is a lot more complicated than you might
-    * imagine. This is due to some characters being both separators as well as
-    * valid characters within the "hostname". In particularly, we can have file
-    * paths to specify paths to UNIX domain sockets. We impose the restriction
-    * that they must be suffixed with ".sock" to simplify the parsing.
-    *
-    * You can separate hosts and file system paths to UNIX domain sockets with
-    * ",".
-    */
-   s = scan_to_unichar (hosts, '?', "", &end_hostport);
-   if (s) {
-      MONGOC_WARNING ("%s", "A '/' is required between the host list and any options.");
-      goto error;
-   }
-   next = hosts;
-   do {
-      /* makes a copy of the section of the string */
-      s = scan_to_unichar (next, ',', "", &end_hostport);
-      if (s) {
-         next = (char *) end_hostport + 1;
-      } else {
-         s = bson_strdup (next);
-         next = NULL;
-      }
-      if (!mongoc_uri_parse_host (uri, s)) {
-         goto error;
+   bson_error_reset (error);
+   // Check if there is a question mark in the given hostinfo string. This indicates that
+   // the user omitted a required "/" before the query component
+   if (mstr_find (hosts, QUESTION) != SIZE_MAX) {
+      MONGOC_URI_ERROR (error, "%s", "A '/' is required between the host list and any options.");
+      return false;
+   }
+   // We require at least one host in the host list in order to be a valid host CSV
+   if (!hosts.len) {
+      MONGOC_URI_ERROR (error, "%s", "Host list of URI string cannot be empty");
+      return false;
+   }
+
+   // Split around commas
+   for (mstr_view remain = hosts; remain.len;) {
+      mstr_view host;
+      mstr_split_around (remain, COMMA, &host, &remain);
+      if (!_parse_one_host (uri, host, error)) {
+         return false;
       }
-      bson_free (s);
-   } while (next);
+   }
+
    return true;
-error:
-   bson_free (s);
-   return false;
 }
 
-/* -----------------------------------------------------------------------------
- *
- * mongoc_uri_parse_database --
+/**
+ * @brief Handle the URI path component
  *
- *        Parse the database after @str. @str is expected to point after the
- *        host list to the character immediately after the / in the uri string.
- *        If no database is specified in the uri, e.g. the uri has a form like:
- *        mongodb://localhost/?option=X then uri->database remains NULL after
- *        parsing.
- *
- * Return:
- *        True if the parsed database is valid. An empty database is considered
- *        valid.
- * -----------------------------------------------------------------------------
- */
-static bool
-mongoc_uri_parse_database (mongoc_uri_t *uri, const char *str, const char **end)
-{
-   const char *end_database;
-   const char *c;
-   char *invalid_c;
-   const char *tmp;
-
-   if ((uri->database = scan_to_unichar (str, '?', "", &end_database))) {
-      if (strcmp (uri->database, "") == 0) {
-         /* no database is found, don't store the empty string. */
-         bson_free (uri->database);
-         uri->database = NULL;
-         /* but it is valid to have an empty database. */
-         return true;
-      }
-      *end = end_database;
-   } else if (*str) {
-      uri->database = bson_strdup (str);
-      *end = str + strlen (str);
+ * @param uri The URI object to be updated
+ * @param path The path component of the original URI string. May be empty if
+ * there was no path in the input string, but should start with the leading
+ * slash if it is non-empty.
+ * @return true If the operation succeeds
+ * @return false Otherwise
+ *
+ * We use the URI path to specify the database to be associated with the URI.
+ * We only expect a single path element. If the path is just a slash "/", then
+ * that is the same as omitting the path entirely.
+ */
+static bool
+_parse_path (mongoc_uri_t *uri, mstr_view path, bson_error_t *error)
+{
+   bson_error_reset (error);
+   // Drop the leading slash, if present. If the URI has no path, then `path`
+   // will already be an empty string.
+   const mstr_view relative = path.len ? mstr_substr (path, 1) : path;
+
+   if (!relative.len) {
+      // Empty/absent path is no database
+      uri->database = NULL;
+      return true;
    }
 
-   mongoc_uri_do_unescape (&uri->database);
+   // %-decode the path as the database name
+   uri->database = _strdup_pct_decode (relative, error);
    if (!uri->database) {
-      /* invalid */
+      // %-decode failure
+      MONGOC_URI_ERROR (error, "Invalid database specifier \"%.*s\": %s", MSTR_FMT (relative), error->message);
       return false;
    }
 
-   /* invalid characters in database name */
-   for (c = "/\\. \"$"; *c; c++) {
-      invalid_c = scan_to_unichar (uri->database, (bson_unichar_t) *c, "", &tmp);
-      if (invalid_c) {
-         bson_free (invalid_c);
-         return false;
-      }
+   // Check if the database name contains and invalid characters after the %-decode
+   if (mstr_contains_any_of (mstr_cstring (uri->database), mstr_cstring ("/\\. \"$"))) {
+      MONGOC_URI_ERROR (error, "Invalid database specifier \"%s\": Contains disallowed characters", uri->database);
+      return false;
    }
 
    return true;
@@ -514,48 +490,20 @@ mongoc_uri_parse_database (mongoc_uri_t
 
 
 static bool
-mongoc_uri_parse_auth_mechanism_properties (mongoc_uri_t *uri, const char *str)
+_parse_and_set_auth_mechanism_properties (mongoc_uri_t *uri, const char *str)
 {
-   const char *end_scan;
-
    bson_t properties = BSON_INITIALIZER;
 
-   // Key-value pairs are delimited by ','.
-   for (char *kvp; (kvp = scan_to_unichar (str, ',', "", &end_scan)); bson_free (kvp)) {
-      str = end_scan + 1;
-
-      char *const key = scan_to_unichar (kvp, ':', "", &end_scan);
-
-      // Found delimiter: split into key and value.
-      if (key) {
-         char *const value = bson_strdup (end_scan + 1);
-         BSON_APPEND_UTF8 (&properties, key, value);
-         bson_free (key);
-         bson_free (value);
-      }
-
-      // No delimiter: entire string is the key. Use empty string as value.
-      else {
-         BSON_APPEND_UTF8 (&properties, kvp, "");
-      }
-   }
-
-   // Last (or only) pair.
-   if (*str != '\0') {
-      char *const key = scan_to_unichar (str, ':', "", &end_scan);
-
-      // Found delimiter: split into key and value.
-      if (key) {
-         char *const value = bson_strdup (end_scan + 1);
-         BSON_APPEND_UTF8 (&properties, key, value);
-         bson_free (key);
-         bson_free (value);
-      }
-
-      // No delimiter: entire string is the key. Use empty string as value.
-      else {
-         BSON_APPEND_UTF8 (&properties, str, "");
-      }
+   mstr_view remain = mstr_cstring (str);
+   while (remain.len) {
+      // Get the entry until the next comma
+      mstr_view entry;
+      mstr_split_around (remain, COMMA, &entry, &remain);
+      // Split around the colon. If no colon, makes an empty value.
+      mstr_view key, value;
+      mstr_split_around (entry, COLON, &key, &value);
+      // Accumulate properties
+      bson_append_utf8 (&properties, key.data, (int) key.len, value.data, (int) value.len);
    }
 
    /* append our auth properties to our credentials */
@@ -629,108 +577,110 @@ mongoc_uri_check_srv_service_name (mongo
 }
 
 static bool
-mongoc_uri_parse_tags (mongoc_uri_t *uri, /* IN */
-                       const char *str)   /* IN */
+_apply_read_prefs_tags (mongoc_uri_t *uri, /* IN */
+                        const char *str)   /* IN */
 {
-   const char *end_keyval;
-   const char *end_key;
-   bson_t b;
-   char *keyval;
-   char *key;
-
-   bson_init (&b);
-
-again:
-   if ((keyval = scan_to_unichar (str, ',', "", &end_keyval))) {
-      if (!(key = scan_to_unichar (keyval, ':', "", &end_key))) {
-         bson_free (keyval);
+   bson_t b = BSON_INITIALIZER;
+   bool okay = false;
+
+   for (mstr_view remain = mstr_cstring (str); remain.len;) {
+      mstr_view entry;
+      mstr_split_around (remain, COMMA, &entry, &remain);
+      mstr_view key, value;
+      if (!mstr_split_around (entry, COLON, &key, &value)) {
+         // The entry does not have a colon. This is invalid for tags
+         MONGOC_WARNING ("Unsupported value for \"" MONGOC_URI_READPREFERENCETAGS "\": \"%s\"", str);
          goto fail;
       }
-
-      bson_append_utf8 (&b, key, -1, end_key + 1, -1);
-      bson_free (key);
-      bson_free (keyval);
-      str = end_keyval + 1;
-      goto again;
-   } else if ((key = scan_to_unichar (str, ':', "", &end_key))) {
-      bson_append_utf8 (&b, key, -1, end_key + 1, -1);
-      bson_free (key);
-   } else if (strlen (str)) {
-      /* we're not finished but we couldn't parse the string */
-      goto fail;
+      bson_append_utf8 (&b, key.data, (int) key.len, value.data, (int) value.len);
    }
 
    mongoc_read_prefs_add_tag (uri->read_prefs, &b);
-   bson_destroy (&b);
-
-   return true;
+   okay = true;
 
 fail:
-   MONGOC_WARNING ("Unsupported value for \"" MONGOC_URI_READPREFERENCETAGS "\": \"%s\"", str);
    bson_destroy (&b);
-   return false;
+   return okay;
 }
 
-
-/*
- *--------------------------------------------------------------------------
- *
- * mongoc_uri_bson_append_or_replace_key --
+/**
+ * @brief Remove a BSON element with the given key, case-insensitive
  *
- *
- *       Appends 'option' to the end of 'options' if not already set.
- *
- *       Since we cannot grow utf8 strings inline, we have to allocate a
- *       temporary bson variable and splice in the new value if the key
- *       is already set.
- *
- *       NOTE: This function keeps the order of the BSON keys.
- *
- *       NOTE: 'option' is case*in*sensitive.
- *
- *
- *--------------------------------------------------------------------------
+ * @param doc The document to be updated
+ * @param key The key to be removed
  */
-
 static void
-mongoc_uri_bson_append_or_replace_key (bson_t *options, const char *option, const char *value)
+_bson_erase_icase (bson_t *doc, mstr_view key)
 {
    bson_iter_t iter;
-   bool found = false;
-
-   if (bson_iter_init (&iter, options)) {
-      bson_t tmp = BSON_INITIALIZER;
-
-      while (bson_iter_next (&iter)) {
-         const bson_value_t *bvalue;
-
-         if (!strcasecmp (bson_iter_key (&iter), option)) {
-            bson_append_utf8 (&tmp, option, -1, value, -1);
-            found = true;
-            continue;
-         }
+   if (!bson_iter_init (&iter, doc)) {
+      return;
+   }
 
-         bvalue = bson_iter_value (&iter);
+   bson_t tmp = BSON_INITIALIZER;
+   while (bson_iter_next (&iter)) {
+      if (mstr_latin_casecmp (mstr_cstring (bson_iter_key (&iter)), !=, key)) {
+         const bson_value_t *const bvalue = bson_iter_value (&iter);
          BSON_APPEND_VALUE (&tmp, bson_iter_key (&iter), bvalue);
       }
+   }
 
-      if (!found) {
-         bson_append_utf8 (&tmp, option, -1, value, -1);
-      }
+   bson_destroy (doc);
+   bson_copy_to (&tmp, doc);
+   bson_destroy (&tmp);
+}
 
-      bson_destroy (options);
-      bson_copy_to (&tmp, options);
-      bson_destroy (&tmp);
+/**
+ * @brief Update a BSON document with a UTF-8 value, replacing it if it already
+ * exists
+ *
+ * @param options The doc to be updated
+ * @param key The case-insensitive string of the to be added/updated
+ * @param value The UTF-8 string that will be inserted or removed
+ *
+ * @note This will case-normalize the key string to lowercase before inserting it.
+ */
+static void
+_bson_upsert_utf8_icase (bson_t *options, mstr_view key, const char *value)
+{
+   _bson_erase_icase (options, key);
+
+   // Lowercase the key, preventing the need for all callers to do this normalization
+   // themselves.
+   char *lower = bson_strndup (key.data, key.len);
+   mongoc_lowercase_inplace (lower);
+   bson_append_utf8 (options, lower, -1, value, -1);
+   bson_free (lower);
+}
+
+/**
+ * @brief Initialize an iterator to point to the named element, case-insensitive
+ *
+ * @param iter Storage for an iterator to be updated
+ * @param doc The document to be searched
+ * @param key The key to find, case-insensitive
+ * @return true If the element was found, and `*iter` is updated
+ * @return false Otherwise
+ */
+static inline bool
+_bson_init_iter_find_icase (bson_iter_t *iter, bson_t const *doc, mstr_view key)
+{
+   if (!bson_iter_init (iter, doc)) {
+      return false;
    }
+   while (bson_iter_next (iter)) {
+      if (mstr_latin_casecmp (mstr_cstring (bson_iter_key (iter)), ==, key)) {
+         return true;
+      }
+   }
+   return false;
 }
 
-
 bool
 mongoc_uri_has_option (const mongoc_uri_t *uri, const char *key)
 {
    bson_iter_t iter;
-
-   return bson_iter_init_find_case (&iter, &uri->options, key);
+   return _bson_init_iter_find_icase (&iter, &uri->options, mstr_cstring (key));
 }
 
 bool
@@ -807,118 +757,94 @@ mongoc_uri_canonicalize_option (const ch
    }
 }
 
+/**
+ * @brief Test whether the given URI parameter is allowed to be specified in
+ * a DNS record.
+ *
+ * @param key The parameter key string, case-insensitive
+ * @return true If the option is valid in a DNS record
+ * @return false Otherwise
+ */
 static bool
-_mongoc_uri_parse_int64 (const char *key, const char *value, int64_t *result)
-{
-   char *endptr;
-   int64_t i;
-
-   errno = 0;
-   i = bson_ascii_strtoll (value, &endptr, 10);
-   if (errno || endptr < value + strlen (value)) {
-      MONGOC_WARNING ("Invalid %s: cannot parse integer\n", key);
-      return false;
-   }
-
-   *result = i;
-   return true;
-}
-
-
-static bool
-mongoc_uri_parse_int32 (const char *key, const char *value, int32_t *result)
-{
-   int64_t i;
-
-   if (!_mongoc_uri_parse_int64 (key, value, &i)) {
-      /* _mongoc_uri_parse_int64 emits a warning if it could not parse the
-       * given value, so we don't have to add one here.
-       */
-      return false;
-   }
-
-   if (i > INT32_MAX || i < INT32_MIN) {
-      MONGOC_WARNING ("Invalid %s: cannot fit in int32\n", key);
-      return false;
-   }
-
-   *result = (int32_t) i;
-   return true;
-}
-
-
-static bool
-dns_option_allowed (const char *lkey)
+dns_option_allowed (mstr_view key)
 {
    /* Initial DNS Seedlist Discovery Spec: "A Client MUST only support the
     * authSource, replicaSet, and loadBalanced options through a TXT record, and
     * MUST raise an error if any other option is encountered."
     */
-   return !strcmp (lkey, MONGOC_URI_AUTHSOURCE) || !strcmp (lkey, MONGOC_URI_REPLICASET) ||
-          !strcmp (lkey, MONGOC_URI_LOADBALANCED);
+   return mstr_latin_casecmp (key, ==, mstr_cstring (MONGOC_URI_AUTHSOURCE)) ||
+          mstr_latin_casecmp (key, ==, mstr_cstring (MONGOC_URI_LOADBALANCED)) ||
+          mstr_latin_casecmp (key, ==, mstr_cstring (MONGOC_URI_REPLICASET));
 }
 
-
-/* Decompose a key=val pair and place them into a document.
- * Includes case-folding for key portion.
+/**
+ * @brief Apply a single query parameter to a URI from a string
+ *
+ * @param uri The object to be updated.
+ * @param options The URI options data that will also be updated.
+ * @param str The percent-encoded query string element to be decoded.
+ * @param from_dns Whether this query string comes from a DNS result
+ * @retval true Upon success
+ * @retval false Otherwise, and sets `*error`
  */
 static bool
-mongoc_uri_split_option (mongoc_uri_t *uri, bson_t *options, const char *str, bool from_dns, bson_error_t *error)
+_handle_pct_uri_query_param (mongoc_uri_t *uri, bson_t *options, mstr_view str, bool from_dns, bson_error_t *error)
 {
-   bson_iter_t iter;
-   const char *end_key;
-   char *key = NULL;
-   char *lkey = NULL;
+   bson_error_reset (error);
+   // The argument value, with percent-encoding removed
    char *value = NULL;
-   const char *opt;
-   char *opt_end;
-   size_t opt_len;
+   // Whether the operation succeeded
    bool ret = false;
 
-   if (!(key = scan_to_unichar (str, '=', "", &end_key))) {
-      MONGOC_URI_ERROR (error, "URI option \"%s\" contains no \"=\" sign", str);
-      goto CLEANUP;
+   mstr_view key, val_pct;
+   if (!mstr_split_around (str, mstr_cstring ("="), &key, &val_pct)) {
+      MONGOC_URI_ERROR (error, "URI option \"%.*s\" contains no \"=\" sign", MSTR_FMT (str));
+      goto done;
    }
 
-   value = bson_strdup (end_key + 1);
-   mongoc_uri_do_unescape (&value);
-   if (!value) {
-      /* do_unescape detected invalid UTF-8 and freed value */
-      MONGOC_URI_ERROR (error, "Value for URI option \"%s\" contains invalid UTF-8", key);
-      goto CLEANUP;
-   }
-
-   lkey = bson_strdup (key);
-   mongoc_lowercase (key, lkey);
-
    /* Initial DNS Seedlist Discovery Spec: "A Client MUST only support the
     * authSource, replicaSet, and loadBalanced options through a TXT record, and
     * MUST raise an error if any other option is encountered."*/
-   if (from_dns && !dns_option_allowed (lkey)) {
-      MONGOC_URI_ERROR (error, "URI option \"%s\" prohibited in TXT record", key);
-      goto CLEANUP;
+   if (from_dns && !dns_option_allowed (key)) {
+      MONGOC_URI_ERROR (error, "URI option \"%.*s\" prohibited in TXT records", MSTR_FMT (key));
+      goto done;
    }
 
-   /* Special case: READPREFERENCETAGS is a composing option.
+   value = _strdup_pct_decode (val_pct, error);
+   if (!value) {
+      /* do_unescape detected invalid UTF-8 and freed value */
+      MONGOC_URI_ERROR (error, "Value for URI option \"%.*s\" contains is invalid: %s", MSTR_FMT (key), error->message);
+      goto done;
+   }
+
+   /* Special case: readPreferenceTags is a composing option.
     * Multiple instances should append, not overwrite.
     * Encode them directly to the options field,
     * bypassing canonicalization and duplicate checks.
     */
-   if (!strcmp (lkey, MONGOC_URI_READPREFERENCETAGS)) {
-      if (!mongoc_uri_parse_tags (uri, value)) {
-         MONGOC_URI_ERROR (error, "Unsupported value for \"%s\": \"%s\"", key, value);
-         goto CLEANUP;
+   if (mstr_latin_casecmp (key, ==, mstr_cstring (MONGOC_URI_READPREFERENCETAGS))) {
+      if (!_apply_read_prefs_tags (uri, value)) {
+         MONGOC_URI_ERROR (error, "Unsupported value for \"%.*s\": \"%s\"", MSTR_FMT (key), value);
+         goto done;
+      } else {
+         ret = true;
+         goto done;
       }
-   } else if (bson_iter_init_find (&iter, &uri->raw, lkey) || bson_iter_init_find (&iter, options, lkey)) {
+   }
+
+   // Handle case where the option has already been specified
+   bson_iter_t iter;
+   if (_bson_init_iter_find_icase (&iter, &uri->raw, key) || _bson_init_iter_find_icase (&iter, options, key)) {
       /* Special case, MONGOC_URI_W == "any non-int" is not overridden
        * by later values.
        */
-      if (!strcmp (lkey, MONGOC_URI_W) && (opt = bson_iter_utf8_unsafe (&iter, &opt_len))) {
-         strtol (opt, &opt_end, 10);
-         if (*opt_end != '\0') {
-            ret = true;
-            goto CLEANUP;
-         }
+      size_t opt_len;
+      if (mstr_latin_casecmp (key, ==, mstr_cstring (MONGOC_URI_W)) &&
+          mlib_i64_parse (mstr_cstring (bson_iter_utf8_unsafe (&iter, &opt_len)), NULL)) {
+         // Value is a "w", and is not a valid integer, but we already have a valid "w"
+         // value, so don't overwrite it
+         ret = true;
+         goto done;
       }
 
       /* Initial DNS Seedlist Discovery Spec: "Client MUST use options
@@ -926,32 +852,34 @@ mongoc_uri_split_option (mongoc_uri_t *u
        * through TXT records." So, do NOT override existing options with TXT
        * options. */
       if (from_dns) {
-         if (0 == strcmp (lkey, MONGOC_URI_AUTHSOURCE)) {
+         if (mstr_latin_casecmp (key, ==, mstr_cstring (MONGOC_URI_AUTHSOURCE))) {
             // Treat `authSource` as a special case. A server may support authentication with multiple mechanisms.
             // MONGODB-X509 requires authSource=$external. SCRAM-SHA-256 requires authSource=admin.
             // Only log a trace message since this may be expected.
-            TRACE ("Ignoring URI option \"%s\" from TXT record \"%s\". Option is already present in URI", key, str);
+            TRACE ("Ignoring URI option \"%.*s\" from TXT record \"%.*s\". Option is already present in URI",
+                   MSTR_FMT (key),
+                   MSTR_FMT (str));
          } else {
-            MONGOC_WARNING (
-               "Ignoring URI option \"%s\" from TXT record \"%s\". Option is already present in URI", key, str);
+            MONGOC_WARNING ("Ignoring URI option \"%.*s\" from TXT record \"%.*s\". Option is already present in URI",
+                            MSTR_FMT (key),
+                            MSTR_FMT (str));
          }
          ret = true;
-         goto CLEANUP;
+         goto done;
       }
-      MONGOC_WARNING ("Overwriting previously provided value for '%s'", key);
+      MONGOC_WARNING ("Overwriting previously provided value for '%.*s'", MSTR_FMT (key));
    }
 
-   if (!(strcmp (lkey, MONGOC_URI_REPLICASET)) && *value == '\0') {
-      MONGOC_URI_ERROR (error, "Value for URI option \"%s\" cannot be empty string", lkey);
-      goto CLEANUP;
+   // Reject replicaSet=""
+   if (mstr_latin_casecmp (key, ==, mstr_cstring (MONGOC_URI_REPLICASET)) && strlen (value) == 0) {
+      MONGOC_URI_ERROR (error, "Value for URI option \"%.*s\" cannot be empty string", MSTR_FMT (key));
+      goto done;
    }
 
-   mongoc_uri_bson_append_or_replace_key (options, lkey, value);
+   _bson_upsert_utf8_icase (options, key, value);
    ret = true;
 
-CLEANUP:
-   bson_free (key);
-   bson_free (lkey);
+done:
    bson_free (value);
 
    return ret;
@@ -976,13 +904,16 @@ mongoc_uri_options_validate_names (const
    /* Scan `a` looking for deprecated names
     * where the canonical name was also used in `a`,
     * or was used in `b`. */
-   bson_iter_init (&key_iter, a);
+   if (!bson_iter_init (&key_iter, a)) {
+      return false;
+   }
+
    while (bson_iter_next (&key_iter)) {
       key = bson_iter_key (&key_iter);
       value = bson_iter_utf8_unsafe (&key_iter, &value_len);
       canon = mongoc_uri_canonicalize_option (key);
 
-      if (key == canon) {
+      if (mstr_latin_casecmp (mstr_cstring (key), ==, mstr_cstring (canon))) {
          /* Canonical form, no point checking `b`. */
          continue;
       }
@@ -990,7 +921,7 @@ mongoc_uri_options_validate_names (const
       /* Check for a conflict in `a`. */
       if (bson_iter_init_find (&canon_iter, a, canon)) {
          cval = bson_iter_utf8_unsafe (&canon_iter, &cval_len);
-         if ((value_len != cval_len) || strcmp (value, cval)) {
+         if (mstr_cmp (mstr_cstring (cval), !=, mstr_cstring (value))) {
             goto HANDLE_CONFLICT;
          }
       }
@@ -998,7 +929,7 @@ mongoc_uri_options_validate_names (const
       /* Check for a conflict in `b`. */
       if (bson_iter_init_find (&canon_iter, b, canon)) {
          cval = bson_iter_utf8_unsafe (&canon_iter, &cval_len);
-         if ((value_len != cval_len) || strcmp (value, cval)) {
+         if (mstr_cmp (mstr_cstring (cval), !=, mstr_cstring (value))) {
             goto HANDLE_CONFLICT;
          }
       }
@@ -1032,33 +963,35 @@ static bool
 mongoc_uri_apply_options (mongoc_uri_t *uri, const bson_t *options, bool from_dns, bson_error_t *error)
 {
    bson_iter_t iter;
-   int32_t v_int;
-   int64_t v_int64;
    const char *key = NULL;
    const char *canon = NULL;
    const char *value = NULL;
    size_t value_len;
    bool bval;
 
-   bson_iter_init (&iter, options);
+   if (!bson_iter_init (&iter, options)) {
+      return false;
+   }
+
    while (bson_iter_next (&iter)) {
       key = bson_iter_key (&iter);
       canon = mongoc_uri_canonicalize_option (key);
       value = bson_iter_utf8_unsafe (&iter, &value_len);
 
       /* Keep a record of how the option was originally presented. */
-      mongoc_uri_bson_append_or_replace_key (&uri->raw, key, value);
+      _bson_upsert_utf8_icase (&uri->raw, mstr_cstring (key), value);
 
       /* This check precedes mongoc_uri_option_is_int32 as all 64-bit values are
        * also recognised as 32-bit ints.
        */
       if (mongoc_uri_option_is_int64 (key)) {
          if (0 < strlen (value)) {
-            if (!_mongoc_uri_parse_int64 (key, value, &v_int64)) {
+            int64_t i64 = 42424242;
+            if (mlib_i64_parse (mstr_cstring (value), &i64)) {
                goto UNSUPPORTED_VALUE;
             }
 
-            if (!_mongoc_uri_set_option_as_int64_with_error (uri, canon, v_int64, error)) {
+            if (!_mongoc_uri_set_option_as_int64_with_error (uri, canon, i64, error)) {
                return false;
             }
          } else {
@@ -1066,26 +999,27 @@ mongoc_uri_apply_options (mongoc_uri_t *
          }
       } else if (mongoc_uri_option_is_int32 (key)) {
          if (0 < strlen (value)) {
-            if (!mongoc_uri_parse_int32 (key, value, &v_int)) {
+            int32_t i32 = 42424242;
+            if (mlib_i32_parse (mstr_cstring (value), &i32)) {
                goto UNSUPPORTED_VALUE;
             }
 
-            if (!_mongoc_uri_set_option_as_int32_with_error (uri, canon, v_int, error)) {
+            if (!_mongoc_uri_set_option_as_int32_with_error (uri, canon, i32, error)) {
                return false;
             }
          } else {
             MONGOC_WARNING ("Empty value provided for \"%s\"", key);
          }
       } else if (!strcmp (key, MONGOC_URI_W)) {
-         if (*value == '-' || isdigit (*value)) {
-            v_int = (int) strtol (value, NULL, 10);
-            _mongoc_uri_set_option_as_int32 (uri, MONGOC_URI_W, v_int);
+         int32_t i32 = 42424242;
+         if (!mlib_i32_parse (mstr_cstring (value), 10, &i32)) {
+            // A valid integer 'w' value.
+            _mongoc_uri_set_option_as_int32 (uri, MONGOC_URI_W, i32);
          } else if (0 == strcasecmp (value, "majority")) {
-            mongoc_uri_bson_append_or_replace_key (&uri->options, MONGOC_URI_W, "majority");
+            _bson_upsert_utf8_icase (&uri->options, mstr_cstring (MONGOC_URI_W), "majority");
          } else if (*value) {
-            mongoc_uri_bson_append_or_replace_key (&uri->options, MONGOC_URI_W, value);
+            _bson_upsert_utf8_icase (&uri->options, mstr_cstring (MONGOC_URI_W), value);
          }
-
       } else if (mongoc_uri_option_is_bool (key)) {
          if (0 < strlen (value)) {
             if (0 == strcasecmp (value, "true")) {
@@ -1131,7 +1065,7 @@ mongoc_uri_apply_options (mongoc_uri_t *
          if (bson_has_field (&uri->credentials, key)) {
             HANDLE_DUPE ();
          }
-         mongoc_uri_bson_append_or_replace_key (&uri->credentials, canon, value);
+         _bson_upsert_utf8_icase (&uri->credentials, mstr_cstring (canon), value);
 
       } else if (!strcmp (key, MONGOC_URI_READCONCERNLEVEL)) {
          if (!mongoc_read_concern_is_default (uri->read_concern)) {
@@ -1150,7 +1084,7 @@ mongoc_uri_apply_options (mongoc_uri_t *
             MONGOC_WARNING (MONGOC_URI_GSSAPISERVICENAME " is deprecated, use " MONGOC_URI_AUTHMECHANISMPROPERTIES
                                                          " with SERVICE_NAME instead");
 
-            if (!mongoc_uri_parse_auth_mechanism_properties (uri, tmp)) {
+            if (!_parse_and_set_auth_mechanism_properties (uri, tmp)) {
                bson_free (tmp);
                goto UNSUPPORTED_VALUE;
             }
@@ -1161,13 +1095,13 @@ mongoc_uri_apply_options (mongoc_uri_t *
          if (!mongoc_uri_check_srv_service_name (uri, value)) {
             goto UNSUPPORTED_VALUE;
          }
-         mongoc_uri_bson_append_or_replace_key (&uri->options, canon, value);
+         _bson_upsert_utf8_icase (&uri->options, mstr_cstring (canon), value);
 
       } else if (!strcmp (key, MONGOC_URI_AUTHMECHANISMPROPERTIES)) {
          if (bson_has_field (&uri->credentials, key)) {
             HANDLE_DUPE ();
          }
-         if (!mongoc_uri_parse_auth_mechanism_properties (uri, value)) {
+         if (!_parse_and_set_auth_mechanism_properties (uri, value)) {
             goto UNSUPPORTED_VALUE;
          }
 
@@ -1191,7 +1125,7 @@ mongoc_uri_apply_options (mongoc_uri_t *
          }
 
       } else if (mongoc_uri_option_is_utf8 (key)) {
-         mongoc_uri_bson_append_or_replace_key (&uri->options, canon, value);
+         _bson_upsert_utf8_icase (&uri->options, mstr_cstring (canon), value);
 
       } else {
          /*
@@ -1220,26 +1154,16 @@ UNSUPPORTED_VALUE:
  * to their appropriate type and stored in uri->options.
  */
 bool
-mongoc_uri_parse_options (mongoc_uri_t *uri, const char *str, bool from_dns, bson_error_t *error)
+_mongoc_uri_apply_query_string (mongoc_uri_t *uri, mstr_view remain, bool from_dns, bson_error_t *error)
 {
-   bson_t options;
-   const char *end_option;
-   char *option;
-
-   bson_init (&options);
-   while ((option = scan_to_unichar (str, '&', "", &end_option))) {
-      if (!mongoc_uri_split_option (uri, &options, option, from_dns, error)) {
-         bson_free (option);
+   bson_t options = BSON_INITIALIZER;
+   for (; remain.len;) {
+      mstr_view entry;
+      mstr_split_around (remain, mstr_cstring ("&"), &entry, &remain);
+      if (!_handle_pct_uri_query_param (uri, &options, entry, from_dns, error)) {
          bson_destroy (&options);
          return false;
       }
-      bson_free (option);
-      str = end_option + 1;
-   }
-
-   if (*str && !mongoc_uri_split_option (uri, &options, str, from_dns, error)) {
-      bson_destroy (&options);
-      return false;
    }
 
    /* Walk both sides of this map to handle each ordering:
@@ -1359,6 +1283,7 @@ _finalize_auth_username (const char *use
    return true;
 }
 
+// source MUST be "$external"
 static bool
 _finalize_auth_source_external (const char *source, const char *mechanism, bson_error_t *error)
 {
@@ -1377,6 +1302,34 @@ _finalize_auth_source_external (const ch
    return true;
 }
 
+// source MUST be "$external" and defaults to "$external".
+static bool
+_finalize_auth_source_default_external (mongoc_uri_t *uri,
+                                        const char *source,
+                                        const char *mechanism,
+                                        bson_error_t *error)
+{
+   BSON_ASSERT_PARAM (uri);
+   BSON_OPTIONAL_PARAM (source);
+   BSON_ASSERT_PARAM (mechanism);
+   BSON_OPTIONAL_PARAM (error);
+
+   if (!source) {
+      bsonBuildAppend (uri->credentials, kv (MONGOC_URI_AUTHSOURCE, cstr ("$external")));
+      if (bsonBuildError) {
+         MONGOC_URI_ERROR (error,
+                           "unexpected URI credentials BSON error when attempting to default '%s' "
+                           "authentication source to '$external': %s",
+                           mechanism,
+                           bsonBuildError);
+         return false;
+      }
+      return true;
+   } else {
+      return _finalize_auth_source_external (source, mechanism, error);
+   }
+}
+
 static bool
 _finalize_auth_password (const char *password,
                          const char *mechanism,
@@ -1517,6 +1470,25 @@ _finalize_auth_aws_mechanism_properties
 }
 
 static bool
+_finalize_auth_oidc_mechanism_properties (const bson_t *mechanism_properties, bson_error_t *error)
+{
+   BSON_OPTIONAL_PARAM (mechanism_properties);
+   BSON_ASSERT_PARAM (error);
+
+   static const supported_mechanism_properties supported_properties[] = {
+      {"ENVIRONMENT", BSON_TYPE_UTF8},
+      {"TOKEN_RESOURCE", BSON_TYPE_UTF8},
+      {0},
+   };
+
+   if (mechanism_properties) {
+      return _supported_mechanism_properties_check (supported_properties, mechanism_properties, "MONGODB-OIDC", error);
+   }
+
+   return true;
+}
+
+static bool
 mongoc_uri_finalize_auth (mongoc_uri_t *uri, bson_error_t *error)
 {
    BSON_ASSERT_PARAM (uri);
@@ -1618,16 +1590,7 @@ mongoc_uri_finalize_auth (mongoc_uri_t *
       }
 
       // Authentication spec: source: MUST be "$external" and defaults to "$external".
-      if (!source) {
-         bsonBuildAppend (uri->credentials, kv (MONGOC_URI_AUTHSOURCE, cstr ("$external")));
-         if (bsonBuildError) {
-            MONGOC_URI_ERROR (error,
-                              "unexpected URI credentials BSON error when attempting to default 'MONGODB-X509' "
-                              "authentication source to '$external': %s",
-                              bsonBuildError);
-            goto fail;
-         }
-      } else if (!_finalize_auth_source_external (source, mechanism, error)) {
+      if (!_finalize_auth_source_default_external (uri, source, mechanism, error)) {
          goto fail;
       }
 
@@ -1642,16 +1605,7 @@ mongoc_uri_finalize_auth (mongoc_uri_t *
       }
 
       // Authentication spec: source: MUST be "$external" and defaults to "$external".
-      if (!source) {
-         bsonBuildAppend (uri->credentials, kv (MONGOC_URI_AUTHSOURCE, cstr ("$external")));
-         if (bsonBuildError) {
-            MONGOC_URI_ERROR (error,
-                              "unexpected URI credentials BSON error when attempting to default 'GSSAPI' "
-                              "authentication mechanism source to '$external': %s",
-                              bsonBuildError);
-            goto fail;
-         }
-      } else if (!_finalize_auth_source_external (source, mechanism, error)) {
+      if (!_finalize_auth_source_default_external (uri, source, mechanism, error)) {
          goto fail;
       }
 
@@ -1712,16 +1666,7 @@ mongoc_uri_finalize_auth (mongoc_uri_t *
       }
 
       // Authentication spec: source: MUST be "$external" and defaults to "$external".
-      if (!source) {
-         bsonBuildAppend (uri->credentials, kv (MONGOC_URI_AUTHSOURCE, cstr ("$external")));
-         if (bsonBuildError) {
-            MONGOC_URI_ERROR (error,
-                              "unexpected URI credentials BSON error when attempting to default 'MONGODB-AWS' "
-                              "authentication mechanism source to '$external': %s",
-                              bsonBuildError);
-            goto fail;
-         }
-      } else if (!_finalize_auth_source_external (source, mechanism, error)) {
+      if (!_finalize_auth_source_default_external (uri, source, mechanism, error)) {
          goto fail;
       }
 
@@ -1746,6 +1691,83 @@ mongoc_uri_finalize_auth (mongoc_uri_t *
       // Defer remaining validation of `MongoCredential` fields to Authentication Handshake.
    }
 
+   // MONGODB-OIDC
+   else if (strcasecmp (mechanism, "MONGODB-OIDC") == 0) {
+      // Authentication spec: username: MAY be specified (with callback/environment defined meaning).
+      if (!_finalize_auth_username (username, mechanism, _mongoc_uri_finalize_allowed, error)) {
+         goto fail;
+      }
+
+      // Authentication spec: source: MUST be "$external" and defaults to "$external".
+      if (!_finalize_auth_source_default_external (uri, source, mechanism, error)) {
+         goto fail;
+      }
+
+      // Authentication spec: password: MUST NOT be specified.
+      if (!_finalize_auth_password (password, mechanism, _mongoc_uri_finalize_prohibited, error)) {
+         goto fail;
+      }
+
+      // mechanism_properties are allowed for MONGODB-OIDC.
+      if (!_finalize_auth_oidc_mechanism_properties (mechanism_properties, error)) {
+         goto fail;
+      }
+
+      // The environment is optional, but if specified it must appear valid.
+      if (mechanism_properties && bson_iter_init_find_case (&iter, mechanism_properties, "ENVIRONMENT")) {
+         if (!BSON_ITER_HOLDS_UTF8 (&iter)) {
+            MONGOC_URI_ERROR (error, "'%s' authentication has non-string %s property", mechanism, "ENVIRONMENT");
+            goto fail;
+         }
+
+         const mongoc_oidc_env_t *env = mongoc_oidc_env_find (bson_iter_utf8 (&iter, NULL));
+         if (!env) {
+            MONGOC_URI_ERROR (error,
+                              "'%s' authentication has unrecognized %s property '%s'",
+                              mechanism,
+                              "ENVIRONMENT",
+                              bson_iter_utf8 (&iter, NULL));
+            goto fail;
+         }
+
+         if (username && !mongoc_oidc_env_supports_username (env)) {
+            MONGOC_URI_ERROR (error,
+                              "'%s' authentication with %s environment does not accept a %s",
+                              mechanism,
+                              mongoc_oidc_env_name (env),
+                              "username");
+            goto fail;
+         }
+
+         if (bson_iter_init_find_case (&iter, mechanism_properties, "TOKEN_RESOURCE")) {
+            if (!BSON_ITER_HOLDS_UTF8 (&iter)) {
+               MONGOC_URI_ERROR (error, "'%s' authentication has non-string %s property", mechanism, "TOKEN_RESOURCE");
+               goto fail;
+            }
+
+            if (!mongoc_oidc_env_requires_token_resource (env)) {
+               MONGOC_URI_ERROR (error,
+                                 "'%s' authentication with %s environment does not accept a %s",
+                                 mechanism,
+                                 mongoc_oidc_env_name (env),
+                                 "TOKEN_RESOURCE");
+               goto fail;
+            }
+         } else {
+            if (mongoc_oidc_env_requires_token_resource (env)) {
+               MONGOC_URI_ERROR (error,
+                                 "'%s' authentication with %s environment requires a %s",
+                                 mechanism,
+                                 mongoc_oidc_env_name (env),
+                                 "TOKEN_RESOURCE");
+               goto fail;
+            }
+         }
+      }
+
+      // Defer remaining validation of `MongoCredential` fields to Authentication Handshake.
+   }
+
    // Invalid or unsupported authentication mechanism.
    else {
       MONGOC_URI_ERROR (
@@ -1793,168 +1815,199 @@ mongoc_uri_finalize_directconnection (mo
    return true;
 }
 
+/**
+ * @brief Parse the authority component of the URI string. This is the part following
+ * "://" until the path or query
+ *
+ * @param uri The URI to be updated
+ * @param authority The full authority string to be parsed
+ */
 static bool
-mongoc_uri_parse_before_slash (mongoc_uri_t *uri, const char *before_slash, bson_error_t *error)
+_parse_authority (mongoc_uri_t *uri, const mstr_view authority, bson_error_t *error)
 {
-   char *userpass;
-   const char *hosts;
-
-   userpass = scan_to_unichar (before_slash, '@', "", &hosts);
-   if (userpass) {
-      if (!mongoc_uri_parse_userpass (uri, userpass, error)) {
-         goto error;
-      }
-
-      hosts++; /* advance past "@" */
-      if (*hosts == '@') {
-         /* special case: "mongodb://alice@@localhost" */
-         MONGOC_URI_ERROR (error, "Invalid username or password. %s", escape_instructions);
-         goto error;
+   // Split around "@" if there is a userinfo
+   mstr_view userinfo, hostinfo;
+   if (mstr_split_around (authority, AT, &userinfo, &hostinfo)) {
+      // We have userinfo. Parse that first
+      if (!_uri_parse_userinfo (uri, userinfo, error)) {
+         // Fail to parse userinfo. Fail the full authority.
+         return false;
       }
+      // `hostinfo` now contains the authority part following the first "@"
    } else {
-      hosts = before_slash;
+      // No userinfo. The hostinfo is the entire string
+      hostinfo = authority;
+   }
+
+   // Don't allow the host list to start with "@"
+   if (mstr_starts_with (hostinfo, AT)) {
+      /* special case: "mongodb://alice@@localhost" */
+      MONGOC_URI_ERROR (error, "Invalid username or password. %s", escape_instructions);
+      return false;
    }
 
    if (uri->is_srv) {
-      if (!mongoc_uri_parse_srv (uri, hosts, error)) {
-         goto error;
+      // Parse as an SRV URI
+      if (!_parse_srv_hostname (uri, hostinfo, error)) {
+         return false;
       }
    } else {
-      if (!mongoc_uri_parse_hosts (uri, hosts)) {
-         MONGOC_URI_ERROR (error, "%s", "Invalid host string in URI");
-         goto error;
+      // Parse a comma-separated host list
+      if (!_parse_hosts_csv (uri, hostinfo, error)) {
+         return false;
       }
    }
 
-   bson_free (userpass);
    return true;
-
-error:
-   bson_free (userpass);
-   return false;
 }
 
-
+/**
+ * @brief The elements of a decomposed URI string
+ *
+ * This isn't strictly conformant to any WWW spec, because our URI strings are weird,
+ * but the URI components correspond to the same elements in a normal URL or URI
+ *
+ * Note: We do not include a URI fragment in our string parsing.
+ */
+typedef struct {
+   /// The scheme of the URI, which precedes the "://" substring
+   mstr_view scheme;
+   /// The authority element, which includes the userinfo and the host specifier(s)
+   mstr_view authority;
+   /// The userinfo for the URI. If the URI has no userinfo, this is null
+   mstr_view userinfo;
+   /// The host specifier in the URI
+   mstr_view hosts;
+   /// The path string, including the leading "/"
+   mstr_view path;
+   /// The query string, including the leading "?"
+   mstr_view query;
+} uri_parts;
+
+/**
+ * @brief Decompose a URI string into its constituent components
+ *
+ * @param components Pointer to struct that receives each URI component
+ * @param uri The URI string that is being inspected
+ * @return true If the decomposition was successful
+ * @return false Otherwise
+ *
+ * This does not allocate any memory or update an data related to `mongoc_uri_t`,
+ * it is purely a parsing operation. The string views attached to `*components`
+ * are views within the `uri` string.
+ *
+ * This function does not handle percent-encoding of elements.
+ */
 static bool
-mongoc_uri_parse (mongoc_uri_t *uri, const char *str, bson_error_t *error)
+_decompose_uri_string (uri_parts *parts, mstr_view const uri, bson_error_t *error)
 {
-   BSON_ASSERT_PARAM (uri);
-   BSON_ASSERT_PARAM (str);
+   BSON_ASSERT_PARAM (parts);
 
-   const size_t str_len = strlen (str);
+   // Clear out
+   *parts = (uri_parts) {{0}};
 
-   if (!bson_utf8_validate (str, str_len, false /* allow_null */)) {
+   // Check that the URI string is valid UTF-8, otherwise we'll refuse to parse it
+   if (!bson_utf8_validate (uri.data, uri.len, false /* allow_null */)) {
       MONGOC_URI_ERROR (error, "%s", "Invalid UTF-8 in URI");
       return false;
    }
 
-   // Save for later.
-   const char *const str_end = str + str_len;
+   // Trim down the string as we read from left to right
+   mstr_view remain = uri;
 
-   // Parse and remove scheme and its delimiter.
-   // e.g. "mongodb://user:pass@host1:27017,host2:27018/database?key1=value1&key2=value2"
-   //       ~~~~~~~~~~
-   if (!mongoc_uri_parse_scheme (uri, str, &str)) {
-      MONGOC_URI_ERROR (error, "%s", "Invalid URI Schema, expecting 'mongodb://' or 'mongodb+srv://'");
+   // * remain = "foo://bar@baz:1234/path?query"
+   // Grab the scheme, which is the part preceding "://"
+   if (!mstr_split_around (remain, mstr_cstring ("://"), &parts->scheme, &remain)) {
+      MONGOC_URI_ERROR (error, "%s", "Invalid URI, no scheme part specified");
       return false;
    }
-   // str -> "user:pass@host1:27017,host2:27018/database?key1=value1&key2=value2"
 
-   // From this point forward, use this cursor to find the split between "userhosts" and "dbopts".
-   const char *cursor = str;
-
-   // Remove userinfo and its delimiter.
-   // e.g. "user:pass@host1:27017,host2:27018/database?key1=value1&key2=value2"
-   //       ~~~~~~~~~~
-   {
-      const char *tmp;
-
-      // Only ':' is permitted among RFC-3986 gen-delims (":/?#[]@") in userinfo.
-      // However, continue supporting these characters for backward compatibility, as permitted by the Connection String
-      // spec: for backwards-compatibility reasons, drivers MAY allow reserved characters other than "@" and ":" to be
-      // present in user information without percent-encoding.
-      char *userinfo = scan_to_unichar (cursor, '@', "", &tmp);
-
-      if (userinfo) {
-         cursor = tmp + 1; // Consume userinfo delimiter.
-         bson_free (userinfo);
-      }
-   }
-   // cursor -> "host1:27017,host2:27018/database?key1=value1&key2=value2"
-
-   // Find either the optional auth database delimiter or the query delimiter.
-   // e.g. "host1:27017,host2:27018/database?key1=value1&key2=value2"
-   //                              ^
-   // e.g. "host1:27017,host2:27018?key1=value1&key2=value2"
-   //                              ^
+   // * remain = "bar@baz:1234/path?query"
+   // Only ':' is permitted among RFC-3986 gen-delims (":/?#[]@") in userinfo.
+   // However, continue supporting these characters for backward compatibility, as permitted by the Connection
+   // String spec: for backwards-compatibility reasons, drivers MAY allow reserved characters other than "@" and
+   // ":" to be present in user information without percent-encoding.
+   // To handle this, we will start scanning for the authority terminator beginning
+   // after a possible "@" symbol in the URI. If no "@" is present, we don't need to
+   // do anything different.
    {
-      const char *tmp;
-
-      // Only ':', '[', and ']' are permitted among RFC-3986 gen-delims (":/?#[]@") in hostinfo.
-      const char *const terminators = "/?#@";
+      size_t userinfo_end_pos = mstr_find (remain, AT);
+      if (userinfo_end_pos == SIZE_MAX) {
+         // There is no userinfo, so we don't need to do anything special
+         userinfo_end_pos = 0;
+      }
+      // Find the position of the first character that terminates the authority element
+      const size_t term_pos = mstr_find_first_of (remain, mstr_cstring ("/?"), userinfo_end_pos);
+      mstr_split_at (remain, term_pos, &parts->authority, &remain);
+
+      // Now we should split the authority between the userinfo and the hosts
+      {
+         const size_t at_pos = mstr_find (parts->authority, AT);
+         if (at_pos != SIZE_MAX) {
+            // We have a userinfo component
+            mstr_split_at (parts->authority, at_pos, 1, &parts->userinfo, &parts->hosts);
+         } else {
+            // We have no userinfo, so the authority string is just the host list
+            parts->hosts = parts->authority;
+         }
+      }
+   }
 
-      char *hostinfo;
+   // * remain = "/path?query" (Each following component is optional, but this is the proper order)
+   const size_t path_end_pos = mstr_find_first_of (remain, mstr_cstring ("?"));
+   mstr_split_at (remain, path_end_pos, &parts->path, &remain);
+   // * remain = "?query"
+   parts->query = remain;
+   return true;
+}
 
-      // Optional auth delimiter is present.
-      if ((hostinfo = scan_to_unichar (cursor, '/', terminators, &tmp))) {
-         cursor = tmp; // Include the delimiter.
-         bson_free (hostinfo);
-      }
+/**
+ * @brief Parse the given URI C string into the URI structure
+ *
+ * @param uri Pointer to an initialized empty URI object to be updated
+ * @param str Pointer to a C string for the URI string itself
+ * @return true If the parse operation is successful, and `*uri` is updated
+ * @return false Otherwise, and `*uri` contents are unspecified
+ */
+static bool
+mongoc_uri_parse (mongoc_uri_t *uri, const char *str, bson_error_t *error)
+{
+   BSON_ASSERT_PARAM (uri);
+   BSON_ASSERT_PARAM (str);
 
-      // Query delimiter is present.
-      else if ((hostinfo = scan_to_unichar (cursor, '?', terminators, &tmp))) {
-         cursor = tmp; // Include the delimiter.
-         bson_free (hostinfo);
-      }
+   // Split the URI into its parts
+   mstr_view remain = mstr_cstring (str);
+   uri_parts parts;
+   if (!_decompose_uri_string (&parts, remain, error)) {
+      return false;
+   }
 
-      // Neither delimiter is present. Entire rest of string is part of hostinfo.
-      else {
-         cursor = str_end; // Jump to end of string.
-         BSON_ASSERT (*cursor == '\0');
-      }
+   // Detect whether we are a "mongodb" or "mongodb+srv" URI
+   if (mstr_cmp (parts.scheme, ==, mstr_cstring ("mongodb"))) {
+      uri->is_srv = false;
+   } else if (mstr_cmp (parts.scheme, ==, mstr_cstring ("mongodb+srv"))) {
+      uri->is_srv = true;
+   } else {
+      MONGOC_URI_ERROR (error,
+                        "Invalid URI scheme \"%.*s://\". Expected one of \"mongodb://\" or \"mongodb+srv://\"",
+                        MSTR_FMT (parts.scheme));
+      return false;
    }
-   // cursor -> "/database?key1=value1&key2=value2"
 
-   // Parse "userhosts". e.g. "user:pass@host1:27017,host2:27018"
-   {
-      char *const userhosts = bson_strndup (str, (size_t) (cursor - str));
-      const bool ret = mongoc_uri_parse_before_slash (uri, userhosts, error);
-      bson_free (userhosts);
-      if (!ret) {
-         return false;
-      }
+   // Handle the authority, including the userinfo and host specifier(s)
+   if (!_parse_authority (uri, parts.authority, error)) {
+      return false;
    }
 
-   // Parse "dbopts". e.g. "/database?key1=value1&key2=value2"
-   if (*cursor != '\0') {
-      BSON_ASSERT (*cursor == '/' || *cursor == '?');
-
-      // Parse the auth database.
-      if (*cursor == '/') {
-         ++cursor; // Consume the delimiter.
-
-         // No auth database may be present even if the delimiter is present.
-         // e.g. "mongodb://localhost:27017/"
-         if (*cursor != '\0') {
-            if (!mongoc_uri_parse_database (uri, cursor, &cursor)) {
-               MONGOC_URI_ERROR (error, "%s", "Invalid database name in URI");
-               return false;
-            }
-         }
-      }
+   // If we have a path, parse that as the auth database
+   if (!_parse_path (uri, parts.path, error)) {
+      return false;
+   }
 
-      // Parse the query options.
-      if (*cursor == '?') {
-         ++cursor; // Consume the delimiter.
-
-         // No options may be present even if the delimiter is present.
-         // e.g. "mongodb://localhost:27017?"
-         if (*cursor != '\0') {
-            if (!mongoc_uri_parse_options (uri, cursor, false /* from DNS */, error)) {
-               return false;
-            }
-         }
-      }
+   // If we have a query, parse that as the URI settings
+   if (parts.query.len &&
+       !_mongoc_uri_apply_query_string (uri, mstr_substr (parts.query, 1), false /* from DNS */, error)) {
+      return false;
    }
 
    return mongoc_uri_finalize (uri, error);
@@ -2020,7 +2073,7 @@ mongoc_uri_set_auth_mechanism (mongoc_ur
       return false;
    }
 
-   mongoc_uri_bson_append_or_replace_key (&uri->credentials, MONGOC_URI_AUTHMECHANISM, value);
+   _bson_upsert_utf8_icase (&uri->credentials, mstr_cstring (MONGOC_URI_AUTHMECHANISM), value);
 
    return true;
 }
@@ -2059,7 +2112,7 @@ mongoc_uri_set_mechanism_properties (mon
    bsonBuildAppend (tmp,
                     // Copy the existing credentials, dropping the existing properties if
                     // present
-                    insert (uri->credentials, not(key (MONGOC_URI_AUTHMECHANISMPROPERTIES))),
+                    insert (uri->credentials, not (key (MONGOC_URI_AUTHMECHANISMPROPERTIES))),
                     // Append the new properties
                     kv (MONGOC_URI_AUTHMECHANISMPROPERTIES, bson (*properties)));
    bson_reinit (&uri->credentials);
@@ -2449,7 +2502,7 @@ mongoc_uri_set_auth_source (mongoc_uri_t
       return false;
    }
 
-   mongoc_uri_bson_append_or_replace_key (&uri->credentials, MONGOC_URI_AUTHSOURCE, value);
+   _bson_upsert_utf8_icase (&uri->credentials, mstr_cstring (MONGOC_URI_AUTHSOURCE), value);
 
    return true;
 }
@@ -2477,7 +2530,7 @@ mongoc_uri_set_appname (mongoc_uri_t *ur
       return false;
    }
 
-   mongoc_uri_bson_append_or_replace_key (&uri->options, MONGOC_URI_APPNAME, value);
+   _bson_upsert_utf8_icase (&uri->options, mstr_cstring (MONGOC_URI_APPNAME), value);
 
    return true;
 }
@@ -2485,29 +2538,25 @@ mongoc_uri_set_appname (mongoc_uri_t *ur
 bool
 mongoc_uri_set_compressors (mongoc_uri_t *uri, const char *value)
 {
-   const char *end_compressor;
-   char *entry;
+   bson_reinit (&uri->compressors);
 
-   bson_destroy (&uri->compressors);
-   bson_init (&uri->compressors);
+   if (!value) {
+      // Just clear the compressors
+      return true;
+   }
 
-   if (value && !bson_utf8_validate (value, strlen (value), false)) {
+   if (!bson_utf8_validate (value, strlen (value), false)) {
+      // Invalid UTF-8 in the string
       return false;
    }
-   while ((entry = scan_to_unichar (value, ',', "", &end_compressor))) {
+
+   for (mstr_view remain = mstr_cstring (value); remain.len;) {
+      mstr_view entry;
+      mstr_split_around (remain, COMMA, &entry, &remain);
       if (mongoc_compressor_supported (entry)) {
-         mongoc_uri_bson_append_or_replace_key (&uri->compressors, entry, "yes");
+         _bson_upsert_utf8_icase (&uri->compressors, entry, "yes");
       } else {
-         MONGOC_WARNING ("Unsupported compressor: '%s'", entry);
-      }
-      value = end_compressor + 1;
-      bson_free (entry);
-   }
-   if (value) {
-      if (mongoc_compressor_supported (value)) {
-         mongoc_uri_bson_append_or_replace_key (&uri->compressors, value, "yes");
-      } else {
-         MONGOC_WARNING ("Unsupported compressor: '%s'", value);
+         MONGOC_WARNING ("Unsupported compressor: '%.*s'", MSTR_FMT (entry));
       }
    }
 
@@ -2660,68 +2709,12 @@ mongoc_uri_get_string (const mongoc_uri_
 char *
 mongoc_uri_unescape (const char *escaped_string)
 {
-   bson_unichar_t c;
-   unsigned int hex = 0;
-   const char *ptr;
-   const char *end;
-   size_t len;
-   bool unescape_occurred = false;
-
-   BSON_ASSERT (escaped_string);
-
-   len = strlen (escaped_string);
-
-   /*
-    * Double check that this is a UTF-8 valid string. Bail out if necessary.
-    */
-   if (!bson_utf8_validate (escaped_string, len, false)) {
-      MONGOC_WARNING ("%s(): escaped_string contains invalid UTF-8", BSON_FUNC);
-      return NULL;
-   }
-
-   ptr = escaped_string;
-   end = ptr + len;
-
-   mcommon_string_append_t append;
-   mcommon_string_new_with_capacity_as_append (&append, len);
-
-   for (; *ptr; ptr = bson_utf8_next_char (ptr)) {
-      c = bson_utf8_get_char (ptr);
-      switch (c) {
-      case '%':
-         if (((end - ptr) < 2) || !isxdigit (ptr[1]) || !isxdigit (ptr[2]) ||
-#ifdef _MSC_VER
-             (1 != sscanf_s (&ptr[1], "%02x", &hex))
-#else
-             (1 != sscanf (&ptr[1], "%02x", &hex))
-#endif
-             || 0 == hex) {
-            mcommon_string_from_append_destroy (&append);
-            MONGOC_WARNING ("Invalid %% escape sequence");
-            return NULL;
-         }
-
-         // This isn't guaranteed to be valid UTF-8, we check again below
-         char byte = (char) hex;
-         mcommon_string_append_bytes (&append, &byte, 1);
-         ptr += 2;
-         unescape_occurred = true;
-         break;
-      default:
-         mcommon_string_append_unichar (&append, c);
-         break;
-      }
-   }
-
-   /* Check that after unescaping, it is still valid UTF-8 */
-   if (unescape_occurred &&
-       !bson_utf8_validate (mcommon_str_from_append (&append), mcommon_strlen_from_append (&append), false)) {
-      MONGOC_WARNING ("Invalid %% escape sequence: unescaped string contains invalid UTF-8");
-      mcommon_string_from_append_destroy (&append);
-      return NULL;
+   bson_error_t error;
+   char *r = _strdup_pct_decode (mstr_cstring (escaped_string), &error);
+   if (!r) {
+      MONGOC_WARNING ("%s(): Invalid %% escape sequence: %s", BSON_FUNC, error.message);
    }
-
-   return mcommon_string_from_append_destroy_with_steal (&append);
+   return r;
 }
 
 
@@ -2831,7 +2824,7 @@ mongoc_uri_set_server_monitoring_mode (m
       return false;
    }
 
-   mongoc_uri_bson_append_or_replace_key (&uri->options, MONGOC_URI_SERVERMONITORINGMODE, value);
+   _bson_upsert_utf8_icase (&uri->options, mstr_cstring (MONGOC_URI_SERVERMONITORINGMODE), value);
    return true;
 }
 
@@ -3355,7 +3348,6 @@ mongoc_uri_set_option_as_utf8 (mongoc_ur
 {
    const char *option;
    size_t len;
-   char *option_lowercase = NULL;
 
    option = mongoc_uri_canonicalize_option (option_orig);
    BSON_ASSERT (option);
@@ -3374,9 +3366,7 @@ mongoc_uri_set_option_as_utf8 (mongoc_ur
    } else if (!bson_strcasecmp (option, MONGOC_URI_SERVERMONITORINGMODE)) {
       return mongoc_uri_set_server_monitoring_mode (uri, value);
    } else {
-      option_lowercase = lowercase_str_new (option);
-      mongoc_uri_bson_append_or_replace_key (&uri->options, option_lowercase, value);
-      bson_free (option_lowercase);
+      _bson_upsert_utf8_icase (&uri->options, mstr_cstring (option), value);
    }
 
    return true;
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-uri.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-uri.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-uri.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-uri.h	2025-08-14 18:37:23.000000000 +0000
@@ -19,14 +19,14 @@
 #ifndef MONGOC_URI_H
 #define MONGOC_URI_H
 
-#include <bson/bson.h>
-
-#include <mongoc/mongoc-macros.h>
+#include <mongoc/mongoc-config.h>
 #include <mongoc/mongoc-host-list.h>
-#include <mongoc/mongoc-read-prefs.h>
+#include <mongoc/mongoc-macros.h>
 #include <mongoc/mongoc-read-concern.h>
+#include <mongoc/mongoc-read-prefs.h>
 #include <mongoc/mongoc-write-concern.h>
-#include <mongoc/mongoc-config.h>
+
+#include <bson/bson.h>
 
 
 #ifndef MONGOC_DEFAULT_PORT
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-util-private.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-util-private.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-util-private.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-util-private.h	2025-08-14 18:37:23.000000000 +0000
@@ -19,9 +19,12 @@
 #ifndef MONGOC_UTIL_PRIVATE_H
 #define MONGOC_UTIL_PRIVATE_H
 
-#include <bson/bson.h>
 #include <mongoc/mongoc.h>
 
+#include <bson/bson.h>
+
+#include <mlib/str.h>
+
 #ifdef BSON_HAVE_STRINGS_H
 #include <strings.h>
 #endif
@@ -100,8 +103,19 @@ mongoc_ends_with (const char *str, const
 void
 mongoc_lowercase (const char *src, char *buf /* OUT */);
 
+void
+mongoc_lowercase_inplace (char *src);
+
+/**
+ * @brief Parse a network port number
+ *
+ * @param spelling The decimal spelling of the port number
+ * @param out The port number to be updated
+ * @return true If the parse is successful
+ * @return false Otherwise
+ */
 bool
-mongoc_parse_port (uint16_t *port, const char *str);
+_mongoc_parse_port (mstr_view spelling, uint16_t *out, bson_error_t *error);
 
 void
 _mongoc_bson_array_add_label (bson_t *bson, const char *label);
@@ -232,11 +246,13 @@ _mongoc_rand_size_t (size_t min, size_t
 bool
 _mongoc_iter_document_as_bson (const bson_iter_t *iter, bson_t *bson, bson_error_t *error);
 
+// `hex_to_bin` parses `hex` into bytes. `hex` can be either upper or lowercase. Returns NULL on error.
 uint8_t *
-hex_to_bin (const char *hex, uint32_t *len);
+hex_to_bin (const char *hex, size_t *bin_len);
 
+// `bin_to_hex` returns uppercase hex for `bin`. Returns NULL on error.
 char *
-bin_to_hex (const uint8_t *bin, uint32_t len);
+bin_to_hex (const uint8_t *bin, size_t bin_len);
 
 typedef struct {
    bool set;
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-util.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-util.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-util.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-util.c	2025-08-14 18:37:23.000000000 +0000
@@ -18,23 +18,26 @@
 #define _CRT_RAND_S
 #endif
 
-#include <string.h>
-
-#include <bson/bson.h>
-
 #include <common-md5-private.h>
 #include <common-thread-private.h>
+#include <mongoc/mongoc-client-private.h> // WIRE_VERSION_* macros.
+#include <mongoc/mongoc-client-session-private.h>
 #include <mongoc/mongoc-error-private.h>
 #include <mongoc/mongoc-rand-private.h>
+#include <mongoc/mongoc-trace-private.h>
 #include <mongoc/mongoc-util-private.h>
+
 #include <mongoc/mongoc-client.h>
-#include <mongoc/mongoc-client-private.h> // WIRE_VERSION_* macros.
-#include <mongoc/mongoc-client-session-private.h>
-#include <mongoc/mongoc-trace-private.h>
 #include <mongoc/mongoc-sleep.h>
+
+#include <bson/bson.h>
+
 #include <mlib/cmp.h>
+#include <mlib/intencode.h>
 #include <mlib/loop.h>
 
+#include <string.h>
+
 /**
  * ! NOTE
  *
@@ -54,6 +57,8 @@ _mongoc_rand_simple (unsigned int *seed)
 {
 #ifdef _WIN32
    /* ignore the seed */
+   BSON_UNUSED (seed);
+
    unsigned int ret = 0;
    errno_t err;
 
@@ -290,7 +295,7 @@ _mongoc_wire_version_to_server_version (
       return "3.4";
    case 6:
       return "3.6";
-   case WIRE_VERSION_4_0:
+   case 7:
       return "4.0";
    case WIRE_VERSION_4_2:
       return "4.2";
@@ -531,23 +536,53 @@ mongoc_lowercase (const char *src, char
    }
 }
 
+void
+mongoc_lowercase_inplace (char *src)
+{
+   for (; *src; ++src) {
+      /* UTF8 non-ascii characters have a 1 at the leftmost bit. If this is the
+       * case, just leave as-is */
+      if ((*src & (0x1 << 7)) == 0) {
+         *src = (char) tolower (*src);
+      }
+   }
+}
+
 bool
-mongoc_parse_port (uint16_t *port, const char *str)
+_mongoc_parse_port (mstr_view spelling, uint16_t *out, bson_error_t *error)
 {
-   unsigned long ul_port;
+   bson_error_reset (error);
+   // Parse a strict natural number
+   uint64_t u = 0;
+   int ec = mlib_nat64_parse (spelling, 10, &u);
+
+   if (!ec && u == 0) {
+      // Successful parse, but the value is zero
+      bson_set_error (error, MONGOC_ERROR_COMMAND, MONGOC_ERROR_COMMAND_INVALID_ARG, "Port number cannot be zero");
+      return false;
+   }
 
-   ul_port = strtoul (str, NULL, 10);
+   if (ec == EINVAL) {
+      // The given string is just not a valid integer
+      bson_set_error (
+         error, MONGOC_ERROR_COMMAND, MONGOC_ERROR_COMMAND_INVALID_ARG, "Port string is not a valid integer");
+      return false;
+   }
 
-   if (ul_port == 0 || ul_port > UINT16_MAX) {
-      /* Parse error or port number out of range. mongod prohibits port 0. */
+   if (ec == ERANGE || mlib_narrow (out, u)) {
+      // The value is out-of range for u64, or out-of range for u16
+      bson_set_error (error,
+                      MONGOC_ERROR_COMMAND,
+                      MONGOC_ERROR_COMMAND_INVALID_ARG,
+                      "Port number is out-of-range for a 16-bit integer");
       return false;
    }
 
-   *port = (uint16_t) ul_port;
+   // No other errors are possible from nat64_parse
+   mlib_check (ec, eq, 0);
    return true;
 }
 
-
 /*--------------------------------------------------------------------------
  *
  * _mongoc_bson_array_add_label --
@@ -819,44 +854,51 @@ _mongoc_crypto_rand_size_t (void)
 
 #endif /* defined(MONGOC_ENABLE_CRYPTO) */
 
-static BSON_ONCE_FUN (_mongoc_simple_rand_init)
+#define _mongoc_thread_local BSON_IF_GNU_LIKE (__thread) BSON_IF_MSVC (__declspec (thread))
+
+// Use a thread-local random seed for calls to `rand_r`:
+static _mongoc_thread_local unsigned int _mongoc_simple_rand_seed = 0;
+static _mongoc_thread_local bool _mongoc_simple_rand_seed_initialized = false;
+
+static void
+_mongoc_simple_rand_init (void)
 {
+   if (_mongoc_simple_rand_seed_initialized) {
+      return;
+   }
+   _mongoc_simple_rand_seed_initialized = true;
    struct timeval tv;
-   unsigned int seed = 0;
 
    bson_gettimeofday (&tv);
 
-   seed ^= (unsigned int) tv.tv_sec;
-   seed ^= (unsigned int) tv.tv_usec;
-
-   srand (seed);
-
-   BSON_ONCE_RETURN;
+   _mongoc_simple_rand_seed ^= (unsigned int) tv.tv_sec;
+   _mongoc_simple_rand_seed ^= (unsigned int) tv.tv_usec;
 }
 
-static bson_once_t _mongoc_simple_rand_init_once = BSON_ONCE_INIT;
-
 uint32_t
 _mongoc_simple_rand_uint32_t (void)
 {
-   bson_once (&_mongoc_simple_rand_init_once, _mongoc_simple_rand_init);
+   _mongoc_simple_rand_init ();
 
    /* Ensure *all* bits are random, as RAND_MAX is only required to be at least
     * 32767 (2^15). */
-   return (((uint32_t) rand () & 0x7FFFu) << 0u) | (((uint32_t) rand () & 0x7FFFu) << 15u) |
-          (((uint32_t) rand () & 0x0003u) << 30u);
+   return (((uint32_t) _mongoc_rand_simple (&_mongoc_simple_rand_seed) & 0x7FFFu) << 0u) |
+          (((uint32_t) _mongoc_rand_simple (&_mongoc_simple_rand_seed) & 0x7FFFu) << 15u) |
+          (((uint32_t) _mongoc_rand_simple (&_mongoc_simple_rand_seed) & 0x0003u) << 30u);
 }
 
 uint64_t
 _mongoc_simple_rand_uint64_t (void)
 {
-   bson_once (&_mongoc_simple_rand_init_once, _mongoc_simple_rand_init);
+   _mongoc_simple_rand_init ();
 
    /* Ensure *all* bits are random, as RAND_MAX is only required to be at least
     * 32767 (2^15). */
-   return (((uint64_t) rand () & 0x7FFFu) << 0u) | (((uint64_t) rand () & 0x7FFFu) << 15u) |
-          (((uint64_t) rand () & 0x7FFFu) << 30u) | (((uint64_t) rand () & 0x7FFFu) << 45u) |
-          (((uint64_t) rand () & 0x0003u) << 60u);
+   return (((uint64_t) _mongoc_rand_simple (&_mongoc_simple_rand_seed) & 0x7FFFu) << 0u) |
+          (((uint64_t) _mongoc_rand_simple (&_mongoc_simple_rand_seed) & 0x7FFFu) << 15u) |
+          (((uint64_t) _mongoc_rand_simple (&_mongoc_simple_rand_seed) & 0x7FFFu) << 30u) |
+          (((uint64_t) _mongoc_rand_simple (&_mongoc_simple_rand_seed) & 0x7FFFu) << 45u) |
+          (((uint64_t) _mongoc_rand_simple (&_mongoc_simple_rand_seed) & 0x0003u) << 60u);
 }
 
 uint32_t
@@ -950,8 +992,11 @@ _mongoc_iter_document_as_bson (const bso
 }
 
 uint8_t *
-hex_to_bin (const char *hex, uint32_t *len)
+hex_to_bin (const char *hex, size_t *bin_len)
 {
+   BSON_ASSERT_PARAM (hex);
+   BSON_ASSERT_PARAM (bin_len);
+
    uint8_t *out;
 
    const size_t hex_len = strlen (hex);
@@ -959,33 +1004,39 @@ hex_to_bin (const char *hex, uint32_t *l
       return NULL;
    }
 
-   BSON_ASSERT (mlib_in_range (uint32_t, hex_len / 2u));
+   *bin_len = hex_len / 2u;
+   out = bson_malloc0 (*bin_len);
 
-   *len = (uint32_t) (hex_len / 2u);
-   out = bson_malloc0 (*len);
+   for (size_t i = 0; i < hex_len; i += 2u) {
+      uint64_t byte_value;
 
-   for (uint32_t i = 0; i < hex_len; i += 2u) {
-      uint32_t hex_char;
-
-      if (1 != sscanf (hex + i, "%2x", &hex_char)) {
+      if (mlib_nat64_parse (mstr_view_data (hex + i, 2), 16, &byte_value)) {
          bson_free (out);
          return NULL;
       }
 
-      BSON_ASSERT (mlib_in_range (uint8_t, hex_char));
-      out[i / 2u] = (uint8_t) hex_char;
+      BSON_ASSERT (mlib_in_range (uint8_t, byte_value));
+      out[i / 2u] = (uint8_t) byte_value;
    }
    return out;
 }
 
 char *
-bin_to_hex (const uint8_t *bin, uint32_t len)
+bin_to_hex (const uint8_t *bin, size_t bin_len)
 {
-   char *out = bson_malloc0 (2u * len + 1u);
+   BSON_ASSERT_PARAM (bin);
+   size_t hex_len = bin_len;
+
+   if (mlib_mul (&hex_len, 2u) || mlib_add (&hex_len, 1u)) {
+      // Overflow
+      return NULL;
+   }
+
+   char *out = bson_malloc0 (hex_len);
 
-   for (uint32_t i = 0u; i < len; i++) {
+   for (size_t i = 0u; i < bin_len; i++) {
+      int req = bson_snprintf (out + (2u * i), 3, "%02X", bin[i]);
       // Expect no truncation.
-      int req = bson_snprintf (out + (2u * i), 3, "%02x", bin[i]);
       BSON_ASSERT (req < 3);
    }
 
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-version-functions.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-version-functions.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-version-functions.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-version-functions.c	2025-08-14 18:37:23.000000000 +0000
@@ -15,9 +15,10 @@
  */
 
 
-#include <mongoc/mongoc-version.h>
 #include <mongoc/mongoc-version-functions.h>
 
+#include <mongoc/mongoc-version.h>
+
 /**
  * mongoc_get_major_version:
  *
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-version-functions.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-version-functions.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-version-functions.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-version-functions.h	2025-08-14 18:37:23.000000000 +0000
@@ -20,10 +20,10 @@
 #ifndef MONGOC_VERSION_FUNCTIONS_H
 #define MONGOC_VERSION_FUNCTIONS_H
 
-#include <bson/bson.h> /* for "bool" */
-
 #include <mongoc/mongoc-macros.h>
 
+#include <bson/bson.h> /* for "bool" */
+
 BSON_BEGIN_DECLS
 
 MONGOC_EXPORT (int)
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-write-command-private.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-write-command-private.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-write-command-private.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-write-command-private.h	2025-08-14 18:37:23.000000000 +0000
@@ -19,13 +19,14 @@
 #ifndef MONGOC_WRITE_COMMAND_PRIVATE_H
 #define MONGOC_WRITE_COMMAND_PRIVATE_H
 
-#include <bson/bson.h>
+#include <mongoc/mongoc-buffer-private.h>
+#include <mongoc/mongoc-server-stream-private.h>
 
 #include <mongoc/mongoc-client.h>
 #include <mongoc/mongoc-error.h>
 #include <mongoc/mongoc-write-concern.h>
-#include <mongoc/mongoc-server-stream-private.h>
-#include <mongoc/mongoc-buffer-private.h>
+
+#include <bson/bson.h>
 
 
 BSON_BEGIN_DECLS
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-write-command.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-write-command.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-write-command.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-write-command.c	2025-08-14 18:37:23.000000000 +0000
@@ -14,20 +14,21 @@
  * limitations under the License.
  */
 
-#include <bson/bson.h>
-
+#include <common-string-private.h>
 #include <mongoc/mongoc-client-private.h>
 #include <mongoc/mongoc-client-session-private.h>
 #include <mongoc/mongoc-client-side-encryption-private.h>
 #include <mongoc/mongoc-error-private.h>
+#include <mongoc/mongoc-opts-private.h>
 #include <mongoc/mongoc-trace-private.h>
+#include <mongoc/mongoc-util-private.h>
 #include <mongoc/mongoc-write-command-private.h>
 #include <mongoc/mongoc-write-concern-private.h>
-#include <mongoc/mongoc-util-private.h>
-#include <mongoc/mongoc-opts-private.h>
-#include <common-string-private.h>
-#include <mlib/intencode.h>
+
+#include <bson/bson.h>
+
 #include <mlib/cmp.h>
+#include <mlib/intencode.h>
 
 #include <inttypes.h>
 
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-write-concern.c 2.1.0-1/src/libmongoc/src/mongoc/mongoc-write-concern.c
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-write-concern.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-write-concern.c	2025-08-14 18:37:23.000000000 +0000
@@ -14,19 +14,20 @@
  * limitations under the License.
  */
 
+#include <mongoc/mongoc-write-concern.h>
 
+#include <common-macros-private.h> // BEGIN_IGNORE_DEPRECATIONS
 #include <mongoc/mongoc-error-private.h>
-#include <mongoc/mongoc-log.h>
 #include <mongoc/mongoc-util-private.h>
-#include <mongoc/mongoc-write-concern.h>
 #include <mongoc/mongoc-write-concern-private.h>
-#include <common-macros-private.h> // BEGIN_IGNORE_DEPRECATIONS
+
+#include <mongoc/mongoc-log.h>
+#include <mongoc/mongoc-write-concern.h>
 
 
 static void
 _mongoc_write_concern_freeze (mongoc_write_concern_t *write_concern);
 
-
 /**
  * mongoc_write_concern_new:
  *
@@ -50,7 +51,6 @@ mongoc_write_concern_new (void)
    return write_concern;
 }
 
-
 mongoc_write_concern_t *
 mongoc_write_concern_copy (const mongoc_write_concern_t *write_concern)
 {
@@ -69,7 +69,6 @@ mongoc_write_concern_copy (const mongoc_
    return ret;
 }
 
-
 /**
  * mongoc_write_concern_destroy:
  * @write_concern: A mongoc_write_concern_t.
@@ -86,7 +85,6 @@ mongoc_write_concern_destroy (mongoc_wri
    }
 }
 
-
 bool
 mongoc_write_concern_get_journal (const mongoc_write_concern_t *write_concern)
 {
@@ -94,7 +92,6 @@ mongoc_write_concern_get_journal (const
    return (write_concern->journal == true);
 }
 
-
 bool
 mongoc_write_concern_journal_is_set (const mongoc_write_concern_t *write_concern)
 {
@@ -102,7 +99,6 @@ mongoc_write_concern_journal_is_set (con
    return (write_concern->journal != MONGOC_WRITE_CONCERN_JOURNAL_DEFAULT);
 }
 
-
 /**
  * mongoc_write_concern_set_journal:
  * @write_concern: A mongoc_write_concern_t.
@@ -121,7 +117,6 @@ mongoc_write_concern_set_journal (mongoc
    write_concern->frozen = false;
 }
 
-
 int32_t
 mongoc_write_concern_get_w (const mongoc_write_concern_t *write_concern)
 {
@@ -129,7 +124,6 @@ mongoc_write_concern_get_w (const mongoc
    return write_concern->w;
 }
 
-
 /**
  * mongoc_write_concern_set_w:
  * @w: The number of nodes for write or MONGOC_WRITE_CONCERN_W_MAJORITY
@@ -154,14 +148,12 @@ mongoc_write_concern_set_w (mongoc_write
    write_concern->frozen = false;
 }
 
-
 int32_t
 mongoc_write_concern_get_wtimeout (const mongoc_write_concern_t *write_concern)
 {
    return (int32_t) mongoc_write_concern_get_wtimeout_int64 (write_concern);
 }
 
-
 int64_t
 mongoc_write_concern_get_wtimeout_int64 (const mongoc_write_concern_t *write_concern)
 {
@@ -169,14 +161,12 @@ mongoc_write_concern_get_wtimeout_int64
    return write_concern->wtimeout;
 }
 
-
 void
 mongoc_write_concern_set_wtimeout (mongoc_write_concern_t *write_concern, int32_t wtimeout_msec)
 {
    mongoc_write_concern_set_wtimeout_int64 (write_concern, (int64_t) wtimeout_msec);
 }
 
-
 void
 mongoc_write_concern_set_wtimeout_int64 (mongoc_write_concern_t *write_concern, int64_t wtimeout_msec)
 {
@@ -191,7 +181,6 @@ mongoc_write_concern_set_wtimeout_int64
    write_concern->frozen = false;
 }
 
-
 bool
 mongoc_write_concern_get_wmajority (const mongoc_write_concern_t *write_concern)
 {
@@ -199,7 +188,6 @@ mongoc_write_concern_get_wmajority (cons
    return (write_concern->w == MONGOC_WRITE_CONCERN_W_MAJORITY);
 }
 
-
 /**
  * mongoc_write_concern_set_wmajority:
  * @write_concern: A mongoc_write_concern_t.
@@ -226,7 +214,6 @@ mongoc_write_concern_set_wmajority (mong
    }
 }
 
-
 const char *
 mongoc_write_concern_get_wtag (const mongoc_write_concern_t *write_concern)
 {
@@ -239,7 +226,6 @@ mongoc_write_concern_get_wtag (const mon
    return NULL;
 }
 
-
 void
 mongoc_write_concern_set_wtag (mongoc_write_concern_t *write_concern, const char *wtag)
 {
@@ -284,7 +270,6 @@ mongoc_write_concern_is_default (const m
    return !write_concern || write_concern->is_default;
 }
 
-
 /**
  * mongoc_write_concern_freeze:
  * @write_concern: A mongoc_write_concern_t.
@@ -327,7 +312,6 @@ _mongoc_write_concern_freeze (mongoc_wri
    }
 }
 
-
 /**
  * mongoc_write_concern_is_acknowledged:
  * @concern: (in): A mongoc_write_concern_t.
@@ -347,7 +331,6 @@ mongoc_write_concern_is_acknowledged (co
    return true;
 }
 
-
 /**
  * mongoc_write_concern_is_valid:
  * @write_concern: (in): A mongoc_write_concern_t.
@@ -377,7 +360,6 @@ mongoc_write_concern_is_valid (const mon
    return true;
 }
 
-
 static bool
 _mongoc_write_concern_validate (const mongoc_write_concern_t *write_concern, bson_error_t *error)
 {
@@ -388,7 +370,6 @@ _mongoc_write_concern_validate (const mo
    return true;
 }
 
-
 /**
  * _mongoc_parse_wc_err:
  * @doc: (in): A bson document.
@@ -421,7 +402,6 @@ _mongoc_parse_wc_err (const bson_t *doc,
    return false;
 }
 
-
 /**
  * mongoc_write_concern_append:
  * @write_concern: (in): A mongoc_write_concern_t.
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc-write-concern.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc-write-concern.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc-write-concern.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc-write-concern.h	2025-08-14 18:37:23.000000000 +0000
@@ -19,10 +19,10 @@
 #ifndef MONGOC_WRITE_CONCERN_H
 #define MONGOC_WRITE_CONCERN_H
 
-#include <bson/bson.h>
-
 #include <mongoc/mongoc-macros.h>
 
+#include <bson/bson.h>
+
 BSON_BEGIN_DECLS
 
 
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/mongoc.h 2.1.0-1/src/libmongoc/src/mongoc/mongoc.h
--- 2.0.2-1/src/libmongoc/src/mongoc/mongoc.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/mongoc.h	2025-08-14 18:37:23.000000000 +0000
@@ -22,47 +22,47 @@
 #include <bson/bson.h>
 
 #define MONGOC_INSIDE
-#include <mongoc/mongoc-macros.h>
 #include <mongoc/mongoc-apm.h>
 #include <mongoc/mongoc-bulk-operation.h>
 #include <mongoc/mongoc-bulkwrite.h>
 #include <mongoc/mongoc-change-stream.h>
-#include <mongoc/mongoc-client.h>
 #include <mongoc/mongoc-client-pool.h>
+#include <mongoc/mongoc-client-session.h>
 #include <mongoc/mongoc-client-side-encryption.h>
+#include <mongoc/mongoc-client.h>
 #include <mongoc/mongoc-collection.h>
 #include <mongoc/mongoc-config.h>
 #include <mongoc/mongoc-cursor.h>
 #include <mongoc/mongoc-database.h>
 #include <mongoc/mongoc-error.h>
 #include <mongoc/mongoc-flags.h>
-#include <mongoc/mongoc-gridfs.h>
 #include <mongoc/mongoc-gridfs-bucket.h>
-#include <mongoc/mongoc-gridfs-file.h>
 #include <mongoc/mongoc-gridfs-file-list.h>
 #include <mongoc/mongoc-gridfs-file-page.h>
+#include <mongoc/mongoc-gridfs-file.h>
+#include <mongoc/mongoc-gridfs.h>
+#include <mongoc/mongoc-handshake.h>
 #include <mongoc/mongoc-host-list.h>
 #include <mongoc/mongoc-init.h>
-#include <mongoc/mongoc-handshake.h>
-#include <mongoc/mongoc-opcode.h>
 #include <mongoc/mongoc-log.h>
+#include <mongoc/mongoc-macros.h>
+#include <mongoc/mongoc-opcode.h>
 #include <mongoc/mongoc-sleep.h>
 #include <mongoc/mongoc-socket.h>
-#include <mongoc/mongoc-client-session.h>
-#include <mongoc/mongoc-stream.h>
 #include <mongoc/mongoc-stream-buffered.h>
 #include <mongoc/mongoc-stream-file.h>
 #include <mongoc/mongoc-stream-gridfs.h>
 #include <mongoc/mongoc-stream-socket.h>
+#include <mongoc/mongoc-stream.h>
 #include <mongoc/mongoc-structured-log.h>
 #include <mongoc/mongoc-uri.h>
-#include <mongoc/mongoc-write-concern.h>
-#include <mongoc/mongoc-version.h>
 #include <mongoc/mongoc-version-functions.h>
+#include <mongoc/mongoc-version.h>
+#include <mongoc/mongoc-write-concern.h>
 #ifdef MONGOC_ENABLE_SSL
 #include <mongoc/mongoc-rand.h>
-#include <mongoc/mongoc-stream-tls.h>
 #include <mongoc/mongoc-ssl.h>
+#include <mongoc/mongoc-stream-tls.h>
 #endif
 #undef MONGOC_INSIDE
 
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/service-gcp.c 2.1.0-1/src/libmongoc/src/mongoc/service-gcp.c
--- 2.0.2-1/src/libmongoc/src/mongoc/service-gcp.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/service-gcp.c	2025-08-14 18:37:23.000000000 +0000
@@ -56,7 +56,7 @@ gcp_request_destroy (gcp_request *req)
    bson_free (req->_owned_headers);
    bson_free (req->_owned_host);
    bson_free (req->_owned_path);
-   *req = (gcp_request){
+   *req = (gcp_request) {
       .req = {0},
       ._owned_path = NULL,
       ._owned_host = NULL,
@@ -81,7 +81,7 @@ gcp_access_token_try_parse_from_json (gc
    bool okay = false;
 
    // Zero the output
-   *out = (gcp_service_account_token){0};
+   *out = (gcp_service_account_token) {0};
 
    // Parse the JSON data
    bson_t bson;
@@ -108,7 +108,7 @@ gcp_access_token_try_parse_from_json (gc
       goto done;
    }
 
-   *out = (gcp_service_account_token){
+   *out = (gcp_service_account_token) {
       .access_token = bson_strdup (access_token),
       .token_type = bson_strdup (token_type),
    };
@@ -130,7 +130,7 @@ gcp_access_token_from_gcp_server (gcp_se
    bool okay = false;
 
    // Clear the output
-   *out = (gcp_service_account_token){0};
+   *out = (gcp_service_account_token) {0};
 
    mongoc_http_response_t resp;
    _mongoc_http_response_init (&resp);
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/service-gcp.h 2.1.0-1/src/libmongoc/src/mongoc/service-gcp.h
--- 2.0.2-1/src/libmongoc/src/mongoc/service-gcp.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/service-gcp.h	2025-08-14 18:37:23.000000000 +0000
@@ -19,10 +19,10 @@
 
 #include <mongoc/mongoc-prelude.h>
 
-#include <mongoc/mongoc.h>
-
 #include <mongoc/mongoc-http-private.h>
 
+#include <mongoc/mongoc.h>
+
 /**
  * @brief A GCP access token obtained from the GCP metadata server
  */
diff -pruN 2.0.2-1/src/libmongoc/src/mongoc/uthash.h 2.1.0-1/src/libmongoc/src/mongoc/uthash.h
--- 2.0.2-1/src/libmongoc/src/mongoc/uthash.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/src/mongoc/uthash.h	2025-08-14 18:37:23.000000000 +0000
@@ -18,6 +18,7 @@
 #define MONGOC_UTHASH_H
 
 #include <mongoc/mongoc-prelude.h>
+
 #include <bson/bson.h>
 
 #define uthash_malloc(sz) bson_malloc (sz)
diff -pruN 2.0.2-1/src/libmongoc/tests/TestSuite.c 2.1.0-1/src/libmongoc/tests/TestSuite.c
--- 2.0.2-1/src/libmongoc/tests/TestSuite.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/TestSuite.c	2025-08-14 18:37:23.000000000 +0000
@@ -14,36 +14,43 @@
  * limitations under the License.
  */
 
-#include <bson/bson.h>
+#include <mongoc/mongoc-thread-private.h>
+#include <mongoc/mongoc-util-private.h>
+
 #include <mongoc/mongoc.h>
 
+#include <bson/bson.h>
+
 #include <fcntl.h>
-#include <stdarg.h>
 
-#include <mongoc/mongoc-thread-private.h>
 
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <signal.h>
-#include <mongoc/mongoc-util-private.h>
 #if !defined(_WIN32)
+#include <sys/time.h>
 #include <sys/types.h>
-#include <inttypes.h>
 #include <sys/utsname.h>
 #include <sys/wait.h>
 #include <unistd.h>
-#include <sys/time.h>
+
+#include <inttypes.h>
 
 #else
 #include <windows.h>
 #endif
 
-#include "test-conveniences.h"
-#include "test-libmongoc.h"
-#include "TestSuite.h"
-#include <common-string-private.h>
 #include <common-json-private.h>
+#include <common-string-private.h>
+
+#include <mlib/config.h>
+
+#include <TestSuite.h>
+#include <test-conveniences.h>
+#include <test-libmongoc.h>
+
+#include <signal.h>
+#include <stdarg.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
 
 #define SKIP_LINE_BUFFER_SIZE 1024
 
@@ -104,7 +111,6 @@ TestSuite_SeedRand (TestSuite *suite, /*
 #endif
 }
 
-
 static BSON_ONCE_FUN (_test_suite_ensure_mutex_once)
 {
    bson_mutex_init (&gTestMutex);
@@ -112,7 +118,6 @@ static BSON_ONCE_FUN (_test_suite_ensure
    BSON_ONCE_RETURN;
 }
 
-
 void
 TestSuite_Init (TestSuite *suite, const char *name, int argc, char **argv)
 {
@@ -136,9 +141,12 @@ TestSuite_Init (TestSuite *suite, const
       } else if ((0 == strcmp ("-f", argv[i])) || (0 == strcmp ("--no-fork", argv[i]))) {
          suite->flags |= TEST_NOFORK;
       } else if ((0 == strcmp ("-t", argv[i])) || (0 == strcmp ("--trace", argv[i]))) {
+         mlib_diagnostic_push ();
+         mlib_disable_constant_conditional_expression_warnings ();
          if (!MONGOC_TRACE_ENABLED) {
             test_error ("-t requires mongoc compiled with -DENABLE_TRACING=ON.");
          }
+         mlib_diagnostic_pop ();
          suite->flags |= TEST_TRACE;
       } else if (0 == strcmp ("-F", argv[i])) {
          if (argc - 1 == i) {
@@ -333,7 +341,7 @@ _TestSuite_AddMockServerTest (TestSuite
    Test *test;
    va_list ap;
    TestFnCtx *ctx = bson_malloc (sizeof (TestFnCtx));
-   *ctx = (TestFnCtx){.test_fn = func, .dtor = NULL};
+   *ctx = (TestFnCtx) {.test_fn = func, .dtor = NULL};
 
    va_start (ap, func);
    test = _V_TestSuite_AddFull (suite, name, TestSuite_AddHelper, _TestSuite_TestFnCtxDtor, ctx, ap);
@@ -1228,7 +1236,7 @@ test_bulkwriteexception_str (const mongo
 int32_t
 get_current_connection_count (const char *host_and_port)
 {
-   char *uri_str = bson_strdup_printf ("mongodb://%s\n", host_and_port);
+   char *uri_str = bson_strdup_printf ("mongodb://%s", host_and_port);
    char *uri_str_with_auth = test_framework_add_user_password_from_env (uri_str);
    mongoc_client_t *client = mongoc_client_new (uri_str_with_auth);
    test_framework_set_ssl_opts (client);
diff -pruN 2.0.2-1/src/libmongoc/tests/TestSuite.h 2.1.0-1/src/libmongoc/tests/TestSuite.h
--- 2.0.2-1/src/libmongoc/tests/TestSuite.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/TestSuite.h	2025-08-14 18:37:23.000000000 +0000
@@ -19,17 +19,17 @@
 #define TEST_SUITE_H
 
 
-#include <bson/bson.h>
-#include <stdio.h>
-#include <math.h>
-#include <stdlib.h>
-#include <inttypes.h>
-
 #include <common-string-private.h>
-
 #include <mongoc/mongoc-array-private.h>
 #include <mongoc/mongoc-util-private.h>
 
+#include <bson/bson.h>
+
+#include <inttypes.h>
+#include <math.h>
+#include <stdio.h>
+#include <stdlib.h>
+
 
 #ifdef __cplusplus
 extern "C" {
@@ -62,8 +62,9 @@ extern "C" {
 
 
 #ifdef BSON_OS_WIN32
-#include <stdarg.h>
 #include <share.h>
+
+#include <stdarg.h>
 static __inline int
 bson_open (const char *filename, int flags, ...)
 {
diff -pruN 2.0.2-1/src/libmongoc/tests/benchmark-tls-pooled.c 2.1.0-1/src/libmongoc/tests/benchmark-tls-pooled.c
--- 2.0.2-1/src/libmongoc/tests/benchmark-tls-pooled.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/benchmark-tls-pooled.c	2025-08-14 18:37:23.000000000 +0000
@@ -8,9 +8,11 @@
  */
 
 #include <mongoc/mongoc.h>
+
 #include <mlib/loop.h>
 
 #include <pthread.h>
+
 #include <stdio.h>
 
 
diff -pruN 2.0.2-1/src/libmongoc/tests/bsonutil/bson-match.c 2.1.0-1/src/libmongoc/tests/bsonutil/bson-match.c
--- 2.0.2-1/src/libmongoc/tests/bsonutil/bson-match.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/bsonutil/bson-match.c	2025-08-14 18:37:23.000000000 +0000
@@ -14,14 +14,18 @@
  * limitations under the License.
  */
 
-#include "bsonutil/bson-match.h"
+#include <bsonutil/bson-match.h>
+
 #include <mongoc/mongoc-util-private.h> // hex_to_bin
-#include "test-conveniences.h"
-#include "TestSuite.h"
-#include "unified/util.h"
+
 #include <mongoc/utlist.h>
+
 #include <mlib/loop.h>
 
+#include <TestSuite.h>
+#include <test-conveniences.h>
+#include <unified/util.h>
+
 typedef struct _special_functor_t {
    special_fn fn;
    void *user_data;
@@ -225,9 +229,10 @@ special_matches_hex_bytes (const bson_ma
 {
    bool ret = false;
    uint8_t *expected_bytes;
-   uint32_t expected_bytes_len;
+   size_t expected_bytes_len;
    const uint8_t *actual_bytes;
-   uint32_t actual_bytes_len;
+   size_t actual_bytes_len;
+   uint32_t actual_bytes_len_u32;
    char *expected_bytes_string = NULL;
    char *actual_bytes_string = NULL;
    bson_iter_t iter;
@@ -254,12 +259,13 @@ special_matches_hex_bytes (const bson_ma
    }
 
    expected_bytes = hex_to_bin (bson_iter_utf8 (&iter, NULL), &expected_bytes_len);
-   actual_bytes = bson_val_to_binary (actual, &actual_bytes_len);
+   actual_bytes = bson_val_to_binary (actual, &actual_bytes_len_u32);
+   actual_bytes_len = actual_bytes_len_u32;
    expected_bytes_string = bin_to_hex (expected_bytes, expected_bytes_len);
    actual_bytes_string = bin_to_hex (actual_bytes, actual_bytes_len);
 
    if (expected_bytes_len != actual_bytes_len) {
-      MATCH_ERR ("expected %" PRIu32 " (%s) but got %" PRIu32 " (%s) bytes",
+      MATCH_ERR ("expected %zu (%s) but got %zu (%s) bytes",
                  expected_bytes_len,
                  expected_bytes_string,
                  actual_bytes_len,
diff -pruN 2.0.2-1/src/libmongoc/tests/bsonutil/bson-match.h 2.1.0-1/src/libmongoc/tests/bsonutil/bson-match.h
--- 2.0.2-1/src/libmongoc/tests/bsonutil/bson-match.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/bsonutil/bson-match.h	2025-08-14 18:37:23.000000000 +0000
@@ -17,7 +17,7 @@
 #ifndef BSONUTIL_BSON_MATCH_H
 #define BSONUTIL_BSON_MATCH_H
 
-#include "bsonutil/bson-val.h"
+#include <bsonutil/bson-val.h>
 
 /* Matches bson values in accordance with the unified test format's "Evaluating
  * Matches" rules. */
diff -pruN 2.0.2-1/src/libmongoc/tests/bsonutil/bson-parser.c 2.1.0-1/src/libmongoc/tests/bsonutil/bson-parser.c
--- 2.0.2-1/src/libmongoc/tests/bsonutil/bson-parser.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/bsonutil/bson-parser.c	2025-08-14 18:37:23.000000000 +0000
@@ -14,13 +14,16 @@
  * limitations under the License.
  */
 
-#include "bsonutil/bson-parser.h"
+#include <bsonutil/bson-parser.h>
 
-#include "unified/util.h"
-#include "test-conveniences.h"
-#include "TestSuite.h"
 #include <mongoc/utlist.h>
 
+#include <mlib/config.h>
+
+#include <TestSuite.h>
+#include <test-conveniences.h>
+#include <unified/util.h>
+
 typedef enum {
    BSON_PARSER_UTF8,
    BSON_PARSER_INT,
@@ -200,7 +203,10 @@ bson_to_read_prefs (bson_t *bson, bson_e
    }
 
    if (hedge) {
+      mlib_diagnostic_push ();
+      mlib_disable_deprecation_warnings ();
       mongoc_read_prefs_set_hedge (out, hedge);
+      mlib_diagnostic_pop ();
    }
 
 done:
diff -pruN 2.0.2-1/src/libmongoc/tests/bsonutil/bson-parser.h 2.1.0-1/src/libmongoc/tests/bsonutil/bson-parser.h
--- 2.0.2-1/src/libmongoc/tests/bsonutil/bson-parser.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/bsonutil/bson-parser.h	2025-08-14 18:37:23.000000000 +0000
@@ -18,8 +18,9 @@
 #define BSONUTIL_BSON_PARSER_H
 
 #include <mongoc/mongoc.h>
+
 #include <bson/bson.h>
-#include "bsonutil/bson-val.h"
+#include <bsonutil/bson-val.h>
 
 /* bson_parser_t is a very simplified parser to parse BSON fields into C values.
  * Example usage:
diff -pruN 2.0.2-1/src/libmongoc/tests/bsonutil/bson-val.c 2.1.0-1/src/libmongoc/tests/bsonutil/bson-val.c
--- 2.0.2-1/src/libmongoc/tests/bsonutil/bson-val.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/bsonutil/bson-val.c	2025-08-14 18:37:23.000000000 +0000
@@ -14,10 +14,11 @@
  * limitations under the License.
  */
 
-#include "bsonutil/bson-val.h"
-#include "test-conveniences.h"
-#include "TestSuite.h"
-#include "unified/util.h"
+#include <bsonutil/bson-val.h>
+
+#include <TestSuite.h>
+#include <test-conveniences.h>
+#include <unified/util.h>
 
 struct _bson_val_t {
    bson_value_t value;
diff -pruN 2.0.2-1/src/libmongoc/tests/cmake-import/CMakeLists.txt 2.1.0-1/src/libmongoc/tests/cmake-import/CMakeLists.txt
--- 2.0.2-1/src/libmongoc/tests/cmake-import/CMakeLists.txt	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/cmake-import/CMakeLists.txt	2025-08-14 18:37:23.000000000 +0000
@@ -1,4 +1,4 @@
-cmake_minimum_required(VERSION 3.15)
+cmake_minimum_required (VERSION 3.15...4.0)
 project(ImportTestProject)
 
 include(CTest)
diff -pruN 2.0.2-1/src/libmongoc/tests/cmake-import/use-bson.c 2.1.0-1/src/libmongoc/tests/cmake-import/use-bson.c
--- 2.0.2-1/src/libmongoc/tests/cmake-import/use-bson.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/cmake-import/use-bson.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,4 +1,5 @@
 #include <bson/bson.h>
+
 #include <stdio.h>
 
 #ifndef EXPECT_BSON_VERSION
diff -pruN 2.0.2-1/src/libmongoc/tests/cmake-import/use-mongoc.c 2.1.0-1/src/libmongoc/tests/cmake-import/use-mongoc.c
--- 2.0.2-1/src/libmongoc/tests/cmake-import/use-mongoc.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/cmake-import/use-mongoc.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,4 +1,5 @@
 #include <mongoc/mongoc.h>
+
 #include <stdio.h>
 
 #ifndef EXPECT_MONGOC_VERSION
diff -pruN 2.0.2-1/src/libmongoc/tests/debug-stream.c 2.1.0-1/src/libmongoc/tests/debug-stream.c
--- 2.0.2-1/src/libmongoc/tests/debug-stream.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/debug-stream.c	2025-08-14 18:37:23.000000000 +0000
@@ -14,10 +14,11 @@
  * limitations under the License.
  */
 
-#include <mongoc/mongoc.h>
 #include <mongoc/mongoc-client-private.h>
 
-#include "test-libmongoc.h"
+#include <mongoc/mongoc.h>
+
+#include <test-libmongoc.h>
 
 
 #define MONGOC_STREAM_DEBUG 7
diff -pruN 2.0.2-1/src/libmongoc/tests/json/auth/connection-string.json 2.1.0-1/src/libmongoc/tests/json/auth/connection-string.json
--- 2.0.2-1/src/libmongoc/tests/json/auth/connection-string.json	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/json/auth/connection-string.json	2025-08-14 18:37:23.000000000 +0000
@@ -626,6 +626,26 @@
       "uri": "mongodb://user:pass@localhost/?authMechanism=MONGODB-OIDC&authMechanismProperties=ENVIRONMENT:gcp",
       "valid": false,
       "credential": null
+    },
+    {
+      "description": "should recognise the mechanism with k8s provider (MONGODB-OIDC)",
+      "uri": "mongodb://localhost/?authMechanism=MONGODB-OIDC&authMechanismProperties=ENVIRONMENT:k8s",
+      "valid": true,
+      "credential": {
+        "username": null,
+        "password": null,
+        "source": "$external",
+        "mechanism": "MONGODB-OIDC",
+        "mechanism_properties": {
+          "ENVIRONMENT": "k8s"
+        }
+      }
+    },
+    {
+      "description": "should throw an error for a username and password with k8s provider (MONGODB-OIDC)",
+      "uri": "mongodb://user:pass@localhost/?authMechanism=MONGODB-OIDC&authMechanismProperties=ENVIRONMENT:k8s",
+      "valid": false,
+      "credential": null
     }
   ]
 }
diff -pruN 2.0.2-1/src/libmongoc/tests/json/change_streams/unified/change-streams-clusterTime.json 2.1.0-1/src/libmongoc/tests/json/change_streams/unified/change-streams-clusterTime.json
--- 2.0.2-1/src/libmongoc/tests/json/change_streams/unified/change-streams-clusterTime.json	1970-01-01 00:00:00.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/json/change_streams/unified/change-streams-clusterTime.json	2025-08-14 18:37:23.000000000 +0000
@@ -0,0 +1,81 @@
+{
+  "description": "change-streams-clusterTime",
+  "schemaVersion": "1.4",
+  "createEntities": [
+    {
+      "client": {
+        "id": "client0",
+        "useMultipleMongoses": false
+      }
+    },
+    {
+      "database": {
+        "id": "database0",
+        "client": "client0",
+        "databaseName": "database0"
+      }
+    },
+    {
+      "collection": {
+        "id": "collection0",
+        "database": "database0",
+        "collectionName": "collection0"
+      }
+    }
+  ],
+  "runOnRequirements": [
+    {
+      "minServerVersion": "4.0.0",
+      "topologies": [
+        "replicaset",
+        "load-balanced",
+        "sharded"
+      ],
+      "serverless": "forbid"
+    }
+  ],
+  "initialData": [
+    {
+      "collectionName": "collection0",
+      "databaseName": "database0",
+      "documents": []
+    }
+  ],
+  "tests": [
+    {
+      "description": "clusterTime is present",
+      "operations": [
+        {
+          "name": "createChangeStream",
+          "object": "collection0",
+          "arguments": {
+            "pipeline": []
+          },
+          "saveResultAsEntity": "changeStream0"
+        },
+        {
+          "name": "insertOne",
+          "object": "collection0",
+          "arguments": {
+            "document": {
+              "_id": 1
+            }
+          }
+        },
+        {
+          "name": "iterateUntilDocumentOrError",
+          "object": "changeStream0",
+          "expectResult": {
+            "ns": {
+              "db": "database0",
+              "coll": "collection0"
+            },
+            "clusterTime": {
+              "$$exists": true
+            }
+          }
+        }
+      ]
+    }
+  ]
+}
diff -pruN 2.0.2-1/src/libmongoc/tests/json/change_streams/unified/change-streams-disambiguatedPaths.json 2.1.0-1/src/libmongoc/tests/json/change_streams/unified/change-streams-disambiguatedPaths.json
--- 2.0.2-1/src/libmongoc/tests/json/change_streams/unified/change-streams-disambiguatedPaths.json	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/json/change_streams/unified/change-streams-disambiguatedPaths.json	2025-08-14 18:37:23.000000000 +0000
@@ -1,252 +1,187 @@
 {
-    "description": "disambiguatedPaths",
-    "schemaVersion": "1.3",
-    "createEntities": [
-      {
-        "client": {
-          "id": "client0",
-          "useMultipleMongoses": false
-        }
-      },
-      {
-        "database": {
-          "id": "database0",
-          "client": "client0",
-          "databaseName": "database0"
-        }
-      },
-      {
-        "collection": {
-          "id": "collection0",
-          "database": "database0",
-          "collectionName": "collection0"
-        }
+  "description": "disambiguatedPaths",
+  "schemaVersion": "1.4",
+  "createEntities": [
+    {
+      "client": {
+        "id": "client0",
+        "useMultipleMongoses": false
       }
-    ],
-    "runOnRequirements": [
-      {
-        "minServerVersion": "6.1.0",
-        "topologies": [
-          "replicaset",
-          "sharded-replicaset",
-          "load-balanced",
-          "sharded"
-        ]
+    },
+    {
+      "database": {
+        "id": "database0",
+        "client": "client0",
+        "databaseName": "database0"
       }
-    ],
-    "initialData": [
-      {
-        "collectionName": "collection0",
-        "databaseName": "database0",
-        "documents": []
+    },
+    {
+      "collection": {
+        "id": "collection0",
+        "database": "database0",
+        "collectionName": "collection0"
       }
-    ],
-    "tests": [
-      {
-        "description": "disambiguatedPaths is not present when showExpandedEvents is false/unset",
-        "operations": [
-          {
-            "name": "insertOne",
-            "object": "collection0",
-            "arguments": {
-              "document": {
-                "_id": 1,
-                "a": {
-                  "1": 1
-                }
+    }
+  ],
+  "runOnRequirements": [
+    {
+      "minServerVersion": "6.1.0",
+      "topologies": [
+        "replicaset",
+        "load-balanced",
+        "sharded"
+      ],
+      "serverless": "forbid"
+    }
+  ],
+  "initialData": [
+    {
+      "collectionName": "collection0",
+      "databaseName": "database0",
+      "documents": []
+    }
+  ],
+  "tests": [
+    {
+      "description": "disambiguatedPaths is present on updateDescription when an ambiguous path is present",
+      "operations": [
+        {
+          "name": "insertOne",
+          "object": "collection0",
+          "arguments": {
+            "document": {
+              "_id": 1,
+              "a": {
+                "1": 1
               }
             }
-          },
-          {
-            "name": "createChangeStream",
-            "object": "collection0",
-            "arguments": {
-              "pipeline": []
+          }
+        },
+        {
+          "name": "createChangeStream",
+          "object": "collection0",
+          "arguments": {
+            "pipeline": [],
+            "showExpandedEvents": true
+          },
+          "saveResultAsEntity": "changeStream0"
+        },
+        {
+          "name": "updateOne",
+          "object": "collection0",
+          "arguments": {
+            "filter": {
+              "_id": 1
             },
-            "saveResultAsEntity": "changeStream0"
-          },
-          {
-            "name": "updateOne",
-            "object": "collection0",
-            "arguments": {
-              "filter": {
-                "_id": 1
-              },
-              "update": {
-                "$set": {
-                  "a.1": 2
-                }
+            "update": {
+              "$set": {
+                "a.1": 2
               }
             }
-          },
-          {
-            "name": "iterateUntilDocumentOrError",
-            "object": "changeStream0",
-            "expectResult": {
-              "operationType": "update",
-              "ns": {
-                "db": "database0",
-                "coll": "collection0"
-              },
-              "updateDescription": {
-                "updatedFields": {
-                  "$$exists": true
-                },
-                "removedFields": {
-                  "$$exists": true
-                },
-                "truncatedArrays": {
-                  "$$exists": true
-                },
-                "disambiguatedPaths": {
-                  "$$exists": false
-                }
+          }
+        },
+        {
+          "name": "iterateUntilDocumentOrError",
+          "object": "changeStream0",
+          "expectResult": {
+            "operationType": "update",
+            "ns": {
+              "db": "database0",
+              "coll": "collection0"
+            },
+            "updateDescription": {
+              "updatedFields": {
+                "$$exists": true
+              },
+              "removedFields": {
+                "$$exists": true
+              },
+              "truncatedArrays": {
+                "$$exists": true
+              },
+              "disambiguatedPaths": {
+                "a.1": [
+                  "a",
+                  "1"
+                ]
               }
             }
           }
-        ]
-      },
-      {
-        "description": "disambiguatedPaths is present on updateDescription when an ambiguous path is present",
-        "operations": [
-          {
-            "name": "insertOne",
-            "object": "collection0",
-            "arguments": {
-              "document": {
-                "_id": 1,
-                "a": {
+        }
+      ]
+    },
+    {
+      "description": "disambiguatedPaths returns array indices as integers",
+      "operations": [
+        {
+          "name": "insertOne",
+          "object": "collection0",
+          "arguments": {
+            "document": {
+              "_id": 1,
+              "a": [
+                {
                   "1": 1
                 }
-              }
+              ]
             }
-          },
-          {
-            "name": "createChangeStream",
-            "object": "collection0",
-            "arguments": {
-              "pipeline": [],
-              "showExpandedEvents": true
+          }
+        },
+        {
+          "name": "createChangeStream",
+          "object": "collection0",
+          "arguments": {
+            "pipeline": [],
+            "showExpandedEvents": true
+          },
+          "saveResultAsEntity": "changeStream0"
+        },
+        {
+          "name": "updateOne",
+          "object": "collection0",
+          "arguments": {
+            "filter": {
+              "_id": 1
             },
-            "saveResultAsEntity": "changeStream0"
-          },
-          {
-            "name": "updateOne",
-            "object": "collection0",
-            "arguments": {
-              "filter": {
-                "_id": 1
-              },
-              "update": {
-                "$set": {
-                  "a.1": 2
-                }
-              }
-            }
-          },
-          {
-            "name": "iterateUntilDocumentOrError",
-            "object": "changeStream0",
-            "expectResult": {
-              "operationType": "update",
-              "ns": {
-                "db": "database0",
-                "coll": "collection0"
-              },
-              "updateDescription": {
-                "updatedFields": {
-                  "$$exists": true
-                },
-                "removedFields": {
-                  "$$exists": true
-                },
-                "truncatedArrays": {
-                  "$$exists": true
-                },
-                "disambiguatedPaths": {
-                  "a.1": [
-                    "a",
-                    "1"
-                  ]
-                }
+            "update": {
+              "$set": {
+                "a.0.1": 2
               }
             }
           }
-        ]
-      },
-      {
-        "description": "disambiguatedPaths returns array indices as integers",
-        "operations": [
-          {
-            "name": "insertOne",
-            "object": "collection0",
-            "arguments": {
-              "document": {
-                "_id": 1,
-                "a": [
+        },
+        {
+          "name": "iterateUntilDocumentOrError",
+          "object": "changeStream0",
+          "expectResult": {
+            "operationType": "update",
+            "ns": {
+              "db": "database0",
+              "coll": "collection0"
+            },
+            "updateDescription": {
+              "updatedFields": {
+                "$$exists": true
+              },
+              "removedFields": {
+                "$$exists": true
+              },
+              "truncatedArrays": {
+                "$$exists": true
+              },
+              "disambiguatedPaths": {
+                "a.0.1": [
+                  "a",
                   {
-                    "1": 1
-                  }
+                    "$$type": "int"
+                  },
+                  "1"
                 ]
               }
             }
-          },
-          {
-            "name": "createChangeStream",
-            "object": "collection0",
-            "arguments": {
-              "pipeline": [],
-              "showExpandedEvents": true
-            },
-            "saveResultAsEntity": "changeStream0"
-          },
-          {
-            "name": "updateOne",
-            "object": "collection0",
-            "arguments": {
-              "filter": {
-                "_id": 1
-              },
-              "update": {
-                "$set": {
-                  "a.0.1": 2
-                }
-              }
-            }
-          },
-          {
-            "name": "iterateUntilDocumentOrError",
-            "object": "changeStream0",
-            "expectResult": {
-              "operationType": "update",
-              "ns": {
-                "db": "database0",
-                "coll": "collection0"
-              },
-              "updateDescription": {
-                "updatedFields": {
-                  "$$exists": true
-                },
-                "removedFields": {
-                  "$$exists": true
-                },
-                "truncatedArrays": {
-                  "$$exists": true
-                },
-                "disambiguatedPaths": {
-                  "a.0.1": [
-                    "a",
-                    {
-                      "$$type": "int"
-                    },
-                    "1"
-                  ]
-                }
-              }
-            }
           }
-        ]
-      }
-    ]
-  }
-  
\ No newline at end of file
+        }
+      ]
+    }
+  ]
+}
diff -pruN 2.0.2-1/src/libmongoc/tests/json/change_streams/unified/change-streams-errors.json 2.1.0-1/src/libmongoc/tests/json/change_streams/unified/change-streams-errors.json
--- 2.0.2-1/src/libmongoc/tests/json/change_streams/unified/change-streams-errors.json	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/json/change_streams/unified/change-streams-errors.json	2025-08-14 18:37:23.000000000 +0000
@@ -145,7 +145,7 @@
           "minServerVersion": "4.1.11",
           "topologies": [
             "replicaset",
-            "sharded-replicaset",
+            "sharded",
             "load-balanced"
           ]
         }
@@ -190,7 +190,7 @@
           "minServerVersion": "4.2",
           "topologies": [
             "replicaset",
-            "sharded-replicaset",
+            "sharded",
             "load-balanced"
           ]
         }
diff -pruN 2.0.2-1/src/libmongoc/tests/json/change_streams/unified/change-streams-nsType.json 2.1.0-1/src/libmongoc/tests/json/change_streams/unified/change-streams-nsType.json
--- 2.0.2-1/src/libmongoc/tests/json/change_streams/unified/change-streams-nsType.json	1970-01-01 00:00:00.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/json/change_streams/unified/change-streams-nsType.json	2025-08-14 18:37:23.000000000 +0000
@@ -0,0 +1,145 @@
+{
+  "description": "change-streams-nsType",
+  "schemaVersion": "1.7",
+  "runOnRequirements": [
+    {
+      "minServerVersion": "8.1.0",
+      "topologies": [
+        "replicaset",
+        "sharded"
+      ],
+      "serverless": "forbid"
+    }
+  ],
+  "createEntities": [
+    {
+      "client": {
+        "id": "client0",
+        "useMultipleMongoses": false
+      }
+    },
+    {
+      "database": {
+        "id": "database0",
+        "client": "client0",
+        "databaseName": "database0"
+      }
+    }
+  ],
+  "tests": [
+    {
+      "description": "nsType is present when creating collections",
+      "operations": [
+        {
+          "name": "dropCollection",
+          "object": "database0",
+          "arguments": {
+            "collection": "foo"
+          }
+        },
+        {
+          "name": "createChangeStream",
+          "object": "database0",
+          "arguments": {
+            "pipeline": [],
+            "showExpandedEvents": true
+          },
+          "saveResultAsEntity": "changeStream0"
+        },
+        {
+          "name": "createCollection",
+          "object": "database0",
+          "arguments": {
+            "collection": "foo"
+          }
+        },
+        {
+          "name": "iterateUntilDocumentOrError",
+          "object": "changeStream0",
+          "expectResult": {
+            "operationType": "create",
+            "nsType": "collection"
+          }
+        }
+      ]
+    },
+    {
+      "description": "nsType is present when creating timeseries",
+      "operations": [
+        {
+          "name": "dropCollection",
+          "object": "database0",
+          "arguments": {
+            "collection": "foo"
+          }
+        },
+        {
+          "name": "createChangeStream",
+          "object": "database0",
+          "arguments": {
+            "pipeline": [],
+            "showExpandedEvents": true
+          },
+          "saveResultAsEntity": "changeStream0"
+        },
+        {
+          "name": "createCollection",
+          "object": "database0",
+          "arguments": {
+            "collection": "foo",
+            "timeseries": {
+              "timeField": "time",
+              "metaField": "meta",
+              "granularity": "minutes"
+            }
+          }
+        },
+        {
+          "name": "iterateUntilDocumentOrError",
+          "object": "changeStream0",
+          "expectResult": {
+            "operationType": "create",
+            "nsType": "timeseries"
+          }
+        }
+      ]
+    },
+    {
+      "description": "nsType is present when creating views",
+      "operations": [
+        {
+          "name": "dropCollection",
+          "object": "database0",
+          "arguments": {
+            "collection": "foo"
+          }
+        },
+        {
+          "name": "createChangeStream",
+          "object": "database0",
+          "arguments": {
+            "pipeline": [],
+            "showExpandedEvents": true
+          },
+          "saveResultAsEntity": "changeStream0"
+        },
+        {
+          "name": "createCollection",
+          "object": "database0",
+          "arguments": {
+            "collection": "foo",
+            "viewOn": "testName"
+          }
+        },
+        {
+          "name": "iterateUntilDocumentOrError",
+          "object": "changeStream0",
+          "expectResult": {
+            "operationType": "create",
+            "nsType": "view"
+          }
+        }
+      ]
+    }
+  ]
+}
diff -pruN 2.0.2-1/src/libmongoc/tests/json/change_streams/unified/change-streams-pre_and_post_images.json 2.1.0-1/src/libmongoc/tests/json/change_streams/unified/change-streams-pre_and_post_images.json
--- 2.0.2-1/src/libmongoc/tests/json/change_streams/unified/change-streams-pre_and_post_images.json	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/json/change_streams/unified/change-streams-pre_and_post_images.json	2025-08-14 18:37:23.000000000 +0000
@@ -6,7 +6,7 @@
       "minServerVersion": "6.0.0",
       "topologies": [
         "replicaset",
-        "sharded-replicaset",
+        "sharded",
         "load-balanced"
       ],
       "serverless": "forbid"
diff -pruN 2.0.2-1/src/libmongoc/tests/json/change_streams/unified/change-streams-resume-allowlist.json 2.1.0-1/src/libmongoc/tests/json/change_streams/unified/change-streams-resume-allowlist.json
--- 2.0.2-1/src/libmongoc/tests/json/change_streams/unified/change-streams-resume-allowlist.json	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/json/change_streams/unified/change-streams-resume-allowlist.json	2025-08-14 18:37:23.000000000 +0000
@@ -6,7 +6,7 @@
       "minServerVersion": "3.6",
       "topologies": [
         "replicaset",
-        "sharded-replicaset",
+        "sharded",
         "load-balanced"
       ],
       "serverless": "forbid"
diff -pruN 2.0.2-1/src/libmongoc/tests/json/change_streams/unified/change-streams-resume-errorLabels.json 2.1.0-1/src/libmongoc/tests/json/change_streams/unified/change-streams-resume-errorLabels.json
--- 2.0.2-1/src/libmongoc/tests/json/change_streams/unified/change-streams-resume-errorLabels.json	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/json/change_streams/unified/change-streams-resume-errorLabels.json	2025-08-14 18:37:23.000000000 +0000
@@ -6,7 +6,7 @@
       "minServerVersion": "4.3.1",
       "topologies": [
         "replicaset",
-        "sharded-replicaset",
+        "sharded",
         "load-balanced"
       ],
       "serverless": "forbid"
diff -pruN 2.0.2-1/src/libmongoc/tests/json/change_streams/unified/change-streams-showExpandedEvents.json 2.1.0-1/src/libmongoc/tests/json/change_streams/unified/change-streams-showExpandedEvents.json
--- 2.0.2-1/src/libmongoc/tests/json/change_streams/unified/change-streams-showExpandedEvents.json	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/json/change_streams/unified/change-streams-showExpandedEvents.json	2025-08-14 18:37:23.000000000 +0000
@@ -6,7 +6,6 @@
       "minServerVersion": "6.0.0",
       "topologies": [
         "replicaset",
-        "sharded-replicaset",
         "sharded"
       ],
       "serverless": "forbid"
@@ -463,7 +462,6 @@
       "runOnRequirements": [
         {
           "topologies": [
-            "sharded-replicaset",
             "sharded"
           ]
         }
diff -pruN 2.0.2-1/src/libmongoc/tests/json/change_streams/unified/change-streams.json 2.1.0-1/src/libmongoc/tests/json/change_streams/unified/change-streams.json
--- 2.0.2-1/src/libmongoc/tests/json/change_streams/unified/change-streams.json	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/json/change_streams/unified/change-streams.json	2025-08-14 18:37:23.000000000 +0000
@@ -181,7 +181,12 @@
                   "field": "array",
                   "newSize": 2
                 }
-              ]
+              ],
+              "disambiguatedPaths": {
+                "$$unsetOrMatches": {
+                  "$$exists": true
+                }
+              }
             }
           }
         }
@@ -1408,6 +1413,11 @@
                 "$$unsetOrMatches": {
                   "$$exists": true
                 }
+              },
+              "disambiguatedPaths": {
+                "$$unsetOrMatches": {
+                  "$$exists": true
+                }
               }
             }
           }
@@ -1792,4 +1802,4 @@
       ]
     }
   ]
-}
\ No newline at end of file
+}
diff -pruN 2.0.2-1/src/libmongoc/tests/json/client_side_encryption/legacy/fle2v2-BypassQueryAnalysis.json 2.1.0-1/src/libmongoc/tests/json/client_side_encryption/legacy/fle2v2-BypassQueryAnalysis.json
--- 2.0.2-1/src/libmongoc/tests/json/client_side_encryption/legacy/fle2v2-BypassQueryAnalysis.json	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/json/client_side_encryption/legacy/fle2v2-BypassQueryAnalysis.json	1970-01-01 00:00:00.000000000 +0000
@@ -1,262 +0,0 @@
-{
-  "runOn": [
-    {
-      "minServerVersion": "7.0.0",
-      "serverless": "forbid",
-      "topology": [
-        "replicaset",
-        "sharded",
-        "load-balanced"
-      ]
-    }
-  ],
-  "database_name": "default",
-  "collection_name": "default",
-  "data": [],
-  "encrypted_fields": {
-    "fields": [
-      {
-        "keyId": {
-          "$binary": {
-            "base64": "EjRWeBI0mHYSNBI0VniQEg==",
-            "subType": "04"
-          }
-        },
-        "path": "encryptedIndexed",
-        "bsonType": "string",
-        "queries": {
-          "queryType": "equality",
-          "contention": {
-            "$numberLong": "0"
-          }
-        }
-      },
-      {
-        "keyId": {
-          "$binary": {
-            "base64": "q83vqxI0mHYSNBI0VniQEg==",
-            "subType": "04"
-          }
-        },
-        "path": "encryptedUnindexed",
-        "bsonType": "string"
-      }
-    ]
-  },
-  "key_vault_data": [
-    {
-      "_id": {
-        "$binary": {
-          "base64": "EjRWeBI0mHYSNBI0VniQEg==",
-          "subType": "04"
-        }
-      },
-      "keyMaterial": {
-        "$binary": {
-          "base64": "sHe0kz57YW7v8g9VP9sf/+K1ex4JqKc5rf/URX3n3p8XdZ6+15uXPaSayC6adWbNxkFskuMCOifDoTT+rkqMtFkDclOy884RuGGtUysq3X7zkAWYTKi8QAfKkajvVbZl2y23UqgVasdQu3OVBQCrH/xY00nNAs/52e958nVjBuzQkSb1T8pKJAyjZsHJ60+FtnfafDZSTAIBJYn7UWBCwQ==",
-          "subType": "00"
-        }
-      },
-      "creationDate": {
-        "$date": {
-          "$numberLong": "1648914851981"
-        }
-      },
-      "updateDate": {
-        "$date": {
-          "$numberLong": "1648914851981"
-        }
-      },
-      "status": {
-        "$numberInt": "0"
-      },
-      "masterKey": {
-        "provider": "local"
-      }
-    }
-  ],
-  "tests": [
-    {
-      "description": "BypassQueryAnalysis decrypts",
-      "clientOptions": {
-        "autoEncryptOpts": {
-          "kmsProviders": {
-            "local": {
-              "key": {
-                "$binary": {
-                  "base64": "Mng0NCt4ZHVUYUJCa1kxNkVyNUR1QURhZ2h2UzR2d2RrZzh0cFBwM3R6NmdWMDFBMUN3YkQ5aXRRMkhGRGdQV09wOGVNYUMxT2k3NjZKelhaQmRCZGJkTXVyZG9uSjFk",
-                  "subType": "00"
-                }
-              }
-            }
-          },
-          "bypassQueryAnalysis": true
-        }
-      },
-      "operations": [
-        {
-          "name": "insertOne",
-          "arguments": {
-            "document": {
-              "_id": 1,
-              "encryptedIndexed": {
-                "$binary": {
-                  "base64": "C18BAAAFZAAgAAAAANnt+eLTkv4GdDPl8IAfJOvTzArOgFJQ2S/DcLza4W0DBXMAIAAAAAD2u+omZme3P2gBPehMQyQHQ153tPN1+z7bksYA9jKTpAVwADAAAAAAUnCOQqIvmR65YKyYnsiVfVrg9hwUVO3RhhKExo3RWOzgaS0QdsBL5xKFS0JhZSoWBXUAEAAAAAQSNFZ4EjSYdhI0EjRWeJASEHQAAgAAAAV2AFAAAAAAEjRWeBI0mHYSNBI0VniQEpQbp/ZJpWBKeDtKLiXb0P2E9wvc0g3f373jnYQYlJquOrlPOoEy3ngsHPJuSUijvWDsrQzqYa349K7G/66qaXEFZQAgAAAAAOuac/eRLYakKX6B0vZ1r3QodOQFfjqJD+xlGiPu4/PsBWwAIAAAAACkm0o9bj6j0HuADKc0svbqO2UHj6GrlNdF6yKNxh63xRJrAAAAAAAAAAAAAA==",
-                  "subType": "06"
-                }
-              }
-            }
-          }
-        },
-        {
-          "name": "find",
-          "arguments": {
-            "filter": {
-              "_id": 1
-            }
-          },
-          "result": [
-            {
-              "_id": 1,
-              "encryptedIndexed": "123"
-            }
-          ]
-        }
-      ],
-      "expectations": [
-        {
-          "command_started_event": {
-            "command": {
-              "listCollections": 1,
-              "filter": {
-                "name": "default"
-              }
-            },
-            "command_name": "listCollections"
-          }
-        },
-        {
-          "command_started_event": {
-            "command": {
-              "insert": "default",
-              "documents": [
-                {
-                  "_id": 1,
-                  "encryptedIndexed": {
-                    "$binary": {
-                      "base64": "C18BAAAFZAAgAAAAANnt+eLTkv4GdDPl8IAfJOvTzArOgFJQ2S/DcLza4W0DBXMAIAAAAAD2u+omZme3P2gBPehMQyQHQ153tPN1+z7bksYA9jKTpAVwADAAAAAAUnCOQqIvmR65YKyYnsiVfVrg9hwUVO3RhhKExo3RWOzgaS0QdsBL5xKFS0JhZSoWBXUAEAAAAAQSNFZ4EjSYdhI0EjRWeJASEHQAAgAAAAV2AFAAAAAAEjRWeBI0mHYSNBI0VniQEpQbp/ZJpWBKeDtKLiXb0P2E9wvc0g3f373jnYQYlJquOrlPOoEy3ngsHPJuSUijvWDsrQzqYa349K7G/66qaXEFZQAgAAAAAOuac/eRLYakKX6B0vZ1r3QodOQFfjqJD+xlGiPu4/PsBWwAIAAAAACkm0o9bj6j0HuADKc0svbqO2UHj6GrlNdF6yKNxh63xRJrAAAAAAAAAAAAAA==",
-                      "subType": "06"
-                    }
-                  }
-                }
-              ],
-              "ordered": true,
-              "encryptionInformation": {
-                "type": 1,
-                "schema": {
-                  "default.default": {
-                    "escCollection": "enxcol_.default.esc",
-                    "ecocCollection": "enxcol_.default.ecoc",
-                    "fields": [
-                      {
-                        "keyId": {
-                          "$binary": {
-                            "base64": "EjRWeBI0mHYSNBI0VniQEg==",
-                            "subType": "04"
-                          }
-                        },
-                        "path": "encryptedIndexed",
-                        "bsonType": "string",
-                        "queries": {
-                          "queryType": "equality",
-                          "contention": {
-                            "$numberLong": "0"
-                          }
-                        }
-                      },
-                      {
-                        "keyId": {
-                          "$binary": {
-                            "base64": "q83vqxI0mHYSNBI0VniQEg==",
-                            "subType": "04"
-                          }
-                        },
-                        "path": "encryptedUnindexed",
-                        "bsonType": "string"
-                      }
-                    ]
-                  }
-                }
-              }
-            },
-            "command_name": "insert"
-          }
-        },
-        {
-          "command_started_event": {
-            "command": {
-              "find": "default",
-              "filter": {
-                "_id": 1
-              }
-            },
-            "command_name": "find"
-          }
-        },
-        {
-          "command_started_event": {
-            "command": {
-              "find": "datakeys",
-              "filter": {
-                "$or": [
-                  {
-                    "_id": {
-                      "$in": [
-                        {
-                          "$binary": {
-                            "base64": "EjRWeBI0mHYSNBI0VniQEg==",
-                            "subType": "04"
-                          }
-                        }
-                      ]
-                    }
-                  },
-                  {
-                    "keyAltNames": {
-                      "$in": []
-                    }
-                  }
-                ]
-              },
-              "$db": "keyvault",
-              "readConcern": {
-                "level": "majority"
-              }
-            },
-            "command_name": "find"
-          }
-        }
-      ],
-      "outcome": {
-        "collection": {
-          "data": [
-            {
-              "_id": 1,
-              "encryptedIndexed": {
-                "$$type": "binData"
-              },
-              "__safeContent__": [
-                {
-                  "$binary": {
-                    "base64": "31eCYlbQoVboc5zwC8IoyJVSkag9PxREka8dkmbXJeY=",
-                    "subType": "00"
-                  }
-                }
-              ]
-            }
-          ]
-        }
-      }
-    }
-  ]
-}
diff -pruN 2.0.2-1/src/libmongoc/tests/json/client_side_encryption/legacy/fle2v2-EncryptedFields-vs-EncryptedFieldsMap.json 2.1.0-1/src/libmongoc/tests/json/client_side_encryption/legacy/fle2v2-EncryptedFields-vs-EncryptedFieldsMap.json
--- 2.0.2-1/src/libmongoc/tests/json/client_side_encryption/legacy/fle2v2-EncryptedFields-vs-EncryptedFieldsMap.json	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/json/client_side_encryption/legacy/fle2v2-EncryptedFields-vs-EncryptedFieldsMap.json	1970-01-01 00:00:00.000000000 +0000
@@ -1,213 +0,0 @@
-{
-  "runOn": [
-    {
-      "minServerVersion": "7.0.0",
-      "serverless": "forbid",
-      "topology": [
-        "replicaset",
-        "sharded",
-        "load-balanced"
-      ]
-    }
-  ],
-  "database_name": "default",
-  "collection_name": "default",
-  "data": [],
-  "encrypted_fields": {
-    "fields": [
-      {
-        "keyId": {
-          "$binary": {
-            "base64": "EjRWeBI0mHYSNBI0VniQEg==",
-            "subType": "04"
-          }
-        },
-        "path": "encryptedIndexed",
-        "bsonType": "string",
-        "queries": {
-          "queryType": "equality",
-          "contention": {
-            "$numberLong": "0"
-          }
-        }
-      },
-      {
-        "keyId": {
-          "$binary": {
-            "base64": "q83vqxI0mHYSNBI0VniQEg==",
-            "subType": "04"
-          }
-        },
-        "path": "encryptedUnindexed",
-        "bsonType": "string"
-      }
-    ]
-  },
-  "key_vault_data": [
-    {
-      "_id": {
-        "$binary": {
-          "base64": "q83vqxI0mHYSNBI0VniQEg==",
-          "subType": "04"
-        }
-      },
-      "keyMaterial": {
-        "$binary": {
-          "base64": "HBk9BWihXExNDvTp1lUxOuxuZK2Pe2ZdVdlsxPEBkiO1bS4mG5NNDsQ7zVxJAH8BtdOYp72Ku4Y3nwc0BUpIKsvAKX4eYXtlhv5zUQxWdeNFhg9qK7qb8nqhnnLeT0f25jFSqzWJoT379hfwDeu0bebJHr35QrJ8myZdPMTEDYF08QYQ48ShRBli0S+QzBHHAQiM2iJNr4svg2WR8JSeWQ==",
-          "subType": "00"
-        }
-      },
-      "creationDate": {
-        "$date": {
-          "$numberLong": "1648914851981"
-        }
-      },
-      "updateDate": {
-        "$date": {
-          "$numberLong": "1648914851981"
-        }
-      },
-      "status": {
-        "$numberInt": "0"
-      },
-      "masterKey": {
-        "provider": "local"
-      }
-    }
-  ],
-  "tests": [
-    {
-      "description": "encryptedFieldsMap is preferred over remote encryptedFields",
-      "clientOptions": {
-        "autoEncryptOpts": {
-          "kmsProviders": {
-            "local": {
-              "key": {
-                "$binary": {
-                  "base64": "Mng0NCt4ZHVUYUJCa1kxNkVyNUR1QURhZ2h2UzR2d2RrZzh0cFBwM3R6NmdWMDFBMUN3YkQ5aXRRMkhGRGdQV09wOGVNYUMxT2k3NjZKelhaQmRCZGJkTXVyZG9uSjFk",
-                  "subType": "00"
-                }
-              }
-            }
-          },
-          "encryptedFieldsMap": {
-            "default.default": {
-              "fields": []
-            }
-          }
-        }
-      },
-      "operations": [
-        {
-          "name": "insertOne",
-          "arguments": {
-            "document": {
-              "_id": 1,
-              "encryptedUnindexed": {
-                "$binary": {
-                  "base64": "BqvN76sSNJh2EjQSNFZ4kBICTQaVZPWgXp41I7mPV1rLFTtw1tXzjcdSEyxpKKqujlko5TeizkB9hHQ009dVY1+fgIiDcefh+eQrm3CkhQ==",
-                  "subType": "06"
-                }
-              }
-            }
-          }
-        },
-        {
-          "name": "find",
-          "arguments": {
-            "filter": {
-              "_id": 1
-            }
-          },
-          "result": [
-            {
-              "_id": 1,
-              "encryptedUnindexed": "value123"
-            }
-          ]
-        }
-      ],
-      "expectations": [
-        {
-          "command_started_event": {
-            "command": {
-              "insert": "default",
-              "documents": [
-                {
-                  "_id": 1,
-                  "encryptedUnindexed": {
-                    "$binary": {
-                      "base64": "BqvN76sSNJh2EjQSNFZ4kBICTQaVZPWgXp41I7mPV1rLFTtw1tXzjcdSEyxpKKqujlko5TeizkB9hHQ009dVY1+fgIiDcefh+eQrm3CkhQ==",
-                      "subType": "06"
-                    }
-                  }
-                }
-              ],
-              "ordered": true
-            },
-            "command_name": "insert"
-          }
-        },
-        {
-          "command_started_event": {
-            "command": {
-              "find": "default",
-              "filter": {
-                "_id": 1
-              }
-            },
-            "command_name": "find"
-          }
-        },
-        {
-          "command_started_event": {
-            "command": {
-              "find": "datakeys",
-              "filter": {
-                "$or": [
-                  {
-                    "_id": {
-                      "$in": [
-                        {
-                          "$binary": {
-                            "base64": "q83vqxI0mHYSNBI0VniQEg==",
-                            "subType": "04"
-                          }
-                        }
-                      ]
-                    }
-                  },
-                  {
-                    "keyAltNames": {
-                      "$in": []
-                    }
-                  }
-                ]
-              },
-              "$db": "keyvault",
-              "readConcern": {
-                "level": "majority"
-              }
-            },
-            "command_name": "find"
-          }
-        }
-      ],
-      "outcome": {
-        "collection": {
-          "data": [
-            {
-              "_id": 1,
-              "encryptedUnindexed": {
-                "$binary": {
-                  "base64": "BqvN76sSNJh2EjQSNFZ4kBICTQaVZPWgXp41I7mPV1rLFTtw1tXzjcdSEyxpKKqujlko5TeizkB9hHQ009dVY1+fgIiDcefh+eQrm3CkhQ==",
-                  "subType": "06"
-                }
-              }
-            }
-          ]
-        }
-      }
-    }
-  ]
-}
diff -pruN 2.0.2-1/src/libmongoc/tests/json/client_side_encryption/legacy/localSchema.json 2.1.0-1/src/libmongoc/tests/json/client_side_encryption/legacy/localSchema.json
--- 2.0.2-1/src/libmongoc/tests/json/client_side_encryption/legacy/localSchema.json	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/json/client_side_encryption/legacy/localSchema.json	1970-01-01 00:00:00.000000000 +0000
@@ -1,258 +0,0 @@
-{
-  "runOn": [
-    {
-      "minServerVersion": "4.1.10"
-    }
-  ],
-  "database_name": "default",
-  "collection_name": "default",
-  "data": [],
-  "json_schema": {},
-  "key_vault_data": [
-    {
-      "status": 1,
-      "_id": {
-        "$binary": {
-          "base64": "AAAAAAAAAAAAAAAAAAAAAA==",
-          "subType": "04"
-        }
-      },
-      "masterKey": {
-        "provider": "aws",
-        "key": "arn:aws:kms:us-east-1:579766882180:key/89fcc2c4-08b0-4bd9-9f25-e30687b580d0",
-        "region": "us-east-1"
-      },
-      "updateDate": {
-        "$date": {
-          "$numberLong": "1552949630483"
-        }
-      },
-      "keyMaterial": {
-        "$binary": {
-          "base64": "AQICAHhQNmWG2CzOm1dq3kWLM+iDUZhEqnhJwH9wZVpuZ94A8gEqnsxXlR51T5EbEVezUqqKAAAAwjCBvwYJKoZIhvcNAQcGoIGxMIGuAgEAMIGoBgkqhkiG9w0BBwEwHgYJYIZIAWUDBAEuMBEEDHa4jo6yp0Z18KgbUgIBEIB74sKxWtV8/YHje5lv5THTl0HIbhSwM6EqRlmBiFFatmEWaeMk4tO4xBX65eq670I5TWPSLMzpp8ncGHMmvHqRajNBnmFtbYxN3E3/WjxmdbOOe+OXpnGJPcGsftc7cB2shRfA4lICPnE26+oVNXT6p0Lo20nY5XC7jyCO",
-          "subType": "00"
-        }
-      },
-      "creationDate": {
-        "$date": {
-          "$numberLong": "1552949630483"
-        }
-      },
-      "keyAltNames": [
-        "altname",
-        "another_altname"
-      ]
-    }
-  ],
-  "tests": [
-    {
-      "description": "A local schema should override",
-      "clientOptions": {
-        "autoEncryptOpts": {
-          "schemaMap": {
-            "default.default": {
-              "properties": {
-                "encrypted_w_altname": {
-                  "encrypt": {
-                    "keyId": "/altname",
-                    "bsonType": "string",
-                    "algorithm": "AEAD_AES_256_CBC_HMAC_SHA_512-Random"
-                  }
-                },
-                "encrypted_string": {
-                  "encrypt": {
-                    "keyId": [
-                      {
-                        "$binary": {
-                          "base64": "AAAAAAAAAAAAAAAAAAAAAA==",
-                          "subType": "04"
-                        }
-                      }
-                    ],
-                    "bsonType": "string",
-                    "algorithm": "AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic"
-                  }
-                },
-                "random": {
-                  "encrypt": {
-                    "keyId": [
-                      {
-                        "$binary": {
-                          "base64": "AAAAAAAAAAAAAAAAAAAAAA==",
-                          "subType": "04"
-                        }
-                      }
-                    ],
-                    "bsonType": "string",
-                    "algorithm": "AEAD_AES_256_CBC_HMAC_SHA_512-Random"
-                  }
-                },
-                "encrypted_string_equivalent": {
-                  "encrypt": {
-                    "keyId": [
-                      {
-                        "$binary": {
-                          "base64": "AAAAAAAAAAAAAAAAAAAAAA==",
-                          "subType": "04"
-                        }
-                      }
-                    ],
-                    "bsonType": "string",
-                    "algorithm": "AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic"
-                  }
-                }
-              },
-              "bsonType": "object"
-            }
-          },
-          "kmsProviders": {
-            "aws": {}
-          }
-        }
-      },
-      "operations": [
-        {
-          "name": "insertOne",
-          "arguments": {
-            "document": {
-              "_id": 1,
-              "encrypted_string": "string0"
-            }
-          }
-        },
-        {
-          "name": "find",
-          "arguments": {
-            "filter": {
-              "_id": 1
-            }
-          },
-          "result": [
-            {
-              "_id": 1,
-              "encrypted_string": "string0"
-            }
-          ]
-        }
-      ],
-      "expectations": [
-        {
-          "command_started_event": {
-            "command": {
-              "find": "datakeys",
-              "filter": {
-                "$or": [
-                  {
-                    "_id": {
-                      "$in": [
-                        {
-                          "$binary": {
-                            "base64": "AAAAAAAAAAAAAAAAAAAAAA==",
-                            "subType": "04"
-                          }
-                        }
-                      ]
-                    }
-                  },
-                  {
-                    "keyAltNames": {
-                      "$in": []
-                    }
-                  }
-                ]
-              },
-              "$db": "keyvault",
-              "readConcern": {
-                "level": "majority"
-              }
-            },
-            "command_name": "find"
-          }
-        },
-        {
-          "command_started_event": {
-            "command": {
-              "insert": "default",
-              "documents": [
-                {
-                  "_id": 1,
-                  "encrypted_string": {
-                    "$binary": {
-                      "base64": "AQAAAAAAAAAAAAAAAAAAAAACwj+3zkv2VM+aTfk60RqhXq6a/77WlLwu/BxXFkL7EppGsju/m8f0x5kBDD3EZTtGALGXlym5jnpZAoSIkswHoA==",
-                      "subType": "06"
-                    }
-                  }
-                }
-              ],
-              "ordered": true
-            },
-            "command_name": "insert"
-          }
-        },
-        {
-          "command_started_event": {
-            "command": {
-              "find": "default",
-              "filter": {
-                "_id": 1
-              }
-            },
-            "command_name": "find"
-          }
-        }
-      ],
-      "outcome": {
-        "collection": {
-          "data": [
-            {
-              "_id": 1,
-              "encrypted_string": {
-                "$binary": {
-                  "base64": "AQAAAAAAAAAAAAAAAAAAAAACwj+3zkv2VM+aTfk60RqhXq6a/77WlLwu/BxXFkL7EppGsju/m8f0x5kBDD3EZTtGALGXlym5jnpZAoSIkswHoA==",
-                  "subType": "06"
-                }
-              }
-            }
-          ]
-        }
-      }
-    },
-    {
-      "description": "A local schema with no encryption is an error",
-      "clientOptions": {
-        "autoEncryptOpts": {
-          "schemaMap": {
-            "default.default": {
-              "properties": {
-                "test": {
-                  "bsonType": "string"
-                }
-              },
-              "bsonType": "object",
-              "required": [
-                "test"
-              ]
-            }
-          },
-          "kmsProviders": {
-            "aws": {}
-          }
-        }
-      },
-      "operations": [
-        {
-          "name": "insertOne",
-          "arguments": {
-            "document": {
-              "_id": 1,
-              "encrypted_string": "string0"
-            }
-          },
-          "result": {
-            "errorContains": "JSON schema keyword 'required' is only allowed with a remote schema"
-          }
-        }
-      ]
-    }
-  ]
-}
diff -pruN 2.0.2-1/src/libmongoc/tests/json/client_side_encryption/legacy/maxWireVersion.json 2.1.0-1/src/libmongoc/tests/json/client_side_encryption/legacy/maxWireVersion.json
--- 2.0.2-1/src/libmongoc/tests/json/client_side_encryption/legacy/maxWireVersion.json	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/json/client_side_encryption/legacy/maxWireVersion.json	1970-01-01 00:00:00.000000000 +0000
@@ -1,74 +0,0 @@
-{
-  "runOn": [
-    {
-      "maxServerVersion": "4.0.99"
-    }
-  ],
-  "database_name": "default",
-  "collection_name": "default",
-  "data": [],
-  "key_vault_data": [
-    {
-      "status": 1,
-      "_id": {
-        "$binary": {
-          "base64": "AAAAAAAAAAAAAAAAAAAAAA==",
-          "subType": "04"
-        }
-      },
-      "masterKey": {
-        "provider": "aws",
-        "key": "arn:aws:kms:us-east-1:579766882180:key/89fcc2c4-08b0-4bd9-9f25-e30687b580d0",
-        "region": "us-east-1"
-      },
-      "updateDate": {
-        "$date": {
-          "$numberLong": "1552949630483"
-        }
-      },
-      "keyMaterial": {
-        "$binary": {
-          "base64": "AQICAHhQNmWG2CzOm1dq3kWLM+iDUZhEqnhJwH9wZVpuZ94A8gEqnsxXlR51T5EbEVezUqqKAAAAwjCBvwYJKoZIhvcNAQcGoIGxMIGuAgEAMIGoBgkqhkiG9w0BBwEwHgYJYIZIAWUDBAEuMBEEDHa4jo6yp0Z18KgbUgIBEIB74sKxWtV8/YHje5lv5THTl0HIbhSwM6EqRlmBiFFatmEWaeMk4tO4xBX65eq670I5TWPSLMzpp8ncGHMmvHqRajNBnmFtbYxN3E3/WjxmdbOOe+OXpnGJPcGsftc7cB2shRfA4lICPnE26+oVNXT6p0Lo20nY5XC7jyCO",
-          "subType": "00"
-        }
-      },
-      "creationDate": {
-        "$date": {
-          "$numberLong": "1552949630483"
-        }
-      },
-      "keyAltNames": [
-        "altname",
-        "another_altname"
-      ]
-    }
-  ],
-  "tests": [
-    {
-      "description": "operation fails with maxWireVersion < 8",
-      "clientOptions": {
-        "autoEncryptOpts": {
-          "kmsProviders": {
-            "aws": {}
-          },
-          "extraOptions": {
-            "mongocryptdBypassSpawn": true
-          }
-        }
-      },
-      "operations": [
-        {
-          "name": "insertOne",
-          "arguments": {
-            "document": {
-              "encrypted_string": "string0"
-            }
-          },
-          "result": {
-            "errorContains": "Auto-encryption requires a minimum MongoDB version of 4.2"
-          }
-        }
-      ]
-    }
-  ]
-}
diff -pruN 2.0.2-1/src/libmongoc/tests/json/client_side_encryption/unified/fle2v2-BypassQueryAnalysis.json 2.1.0-1/src/libmongoc/tests/json/client_side_encryption/unified/fle2v2-BypassQueryAnalysis.json
--- 2.0.2-1/src/libmongoc/tests/json/client_side_encryption/unified/fle2v2-BypassQueryAnalysis.json	1970-01-01 00:00:00.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/json/client_side_encryption/unified/fle2v2-BypassQueryAnalysis.json	2025-08-14 18:37:23.000000000 +0000
@@ -0,0 +1,325 @@
+{
+  "description": "fle2v2-BypassQueryAnalysis",
+  "schemaVersion": "1.23",
+  "runOnRequirements": [
+    {
+      "minServerVersion": "7.0.0",
+      "serverless": "forbid",
+      "csfle": true,
+      "topologies": [
+        "replicaset",
+        "sharded",
+        "load-balanced"
+      ]
+    }
+  ],
+  "createEntities": [
+    {
+      "client": {
+        "id": "client0",
+        "autoEncryptOpts": {
+          "keyVaultNamespace": "keyvault.datakeys",
+          "kmsProviders": {
+            "local": {
+              "key": "Mng0NCt4ZHVUYUJCa1kxNkVyNUR1QURhZ2h2UzR2d2RrZzh0cFBwM3R6NmdWMDFBMUN3YkQ5aXRRMkhGRGdQV09wOGVNYUMxT2k3NjZKelhaQmRCZGJkTXVyZG9uSjFk"
+            }
+          },
+          "bypassQueryAnalysis": true
+        },
+        "observeEvents": [
+          "commandStartedEvent"
+        ]
+      }
+    },
+    {
+      "database": {
+        "id": "encryptedDB",
+        "client": "client0",
+        "databaseName": "default"
+      }
+    },
+    {
+      "collection": {
+        "id": "encryptedColl",
+        "database": "encryptedDB",
+        "collectionName": "default"
+      }
+    },
+    {
+      "client": {
+        "id": "unencryptedClient",
+        "observeEvents": [
+          "commandStartedEvent"
+        ]
+      }
+    },
+    {
+      "database": {
+        "id": "unencryptedDB",
+        "client": "unencryptedClient",
+        "databaseName": "default"
+      }
+    },
+    {
+      "collection": {
+        "id": "unencryptedColl",
+        "database": "unencryptedDB",
+        "collectionName": "default"
+      }
+    }
+  ],
+  "initialData": [
+    {
+      "databaseName": "keyvault",
+      "collectionName": "datakeys",
+      "documents": [
+        {
+          "_id": {
+            "$binary": {
+              "base64": "EjRWeBI0mHYSNBI0VniQEg==",
+              "subType": "04"
+            }
+          },
+          "keyMaterial": {
+            "$binary": {
+              "base64": "sHe0kz57YW7v8g9VP9sf/+K1ex4JqKc5rf/URX3n3p8XdZ6+15uXPaSayC6adWbNxkFskuMCOifDoTT+rkqMtFkDclOy884RuGGtUysq3X7zkAWYTKi8QAfKkajvVbZl2y23UqgVasdQu3OVBQCrH/xY00nNAs/52e958nVjBuzQkSb1T8pKJAyjZsHJ60+FtnfafDZSTAIBJYn7UWBCwQ==",
+              "subType": "00"
+            }
+          },
+          "creationDate": {
+            "$date": {
+              "$numberLong": "1648914851981"
+            }
+          },
+          "updateDate": {
+            "$date": {
+              "$numberLong": "1648914851981"
+            }
+          },
+          "status": {
+            "$numberInt": "0"
+          },
+          "masterKey": {
+            "provider": "local"
+          }
+        }
+      ]
+    },
+    {
+      "databaseName": "default",
+      "collectionName": "default",
+      "documents": [],
+      "createOptions": {
+        "encryptedFields": {
+          "fields": [
+            {
+              "keyId": {
+                "$binary": {
+                  "base64": "EjRWeBI0mHYSNBI0VniQEg==",
+                  "subType": "04"
+                }
+              },
+              "path": "encryptedIndexed",
+              "bsonType": "string",
+              "queries": {
+                "queryType": "equality",
+                "contention": {
+                  "$numberLong": "0"
+                }
+              }
+            },
+            {
+              "keyId": {
+                "$binary": {
+                  "base64": "q83vqxI0mHYSNBI0VniQEg==",
+                  "subType": "04"
+                }
+              },
+              "path": "encryptedUnindexed",
+              "bsonType": "string"
+            }
+          ]
+        }
+      }
+    }
+  ],
+  "tests": [
+    {
+      "description": "BypassQueryAnalysis decrypts",
+      "operations": [
+        {
+          "object": "encryptedColl",
+          "name": "insertOne",
+          "arguments": {
+            "document": {
+              "_id": 1,
+              "encryptedIndexed": {
+                "$binary": {
+                  "base64": "C18BAAAFZAAgAAAAANnt+eLTkv4GdDPl8IAfJOvTzArOgFJQ2S/DcLza4W0DBXMAIAAAAAD2u+omZme3P2gBPehMQyQHQ153tPN1+z7bksYA9jKTpAVwADAAAAAAUnCOQqIvmR65YKyYnsiVfVrg9hwUVO3RhhKExo3RWOzgaS0QdsBL5xKFS0JhZSoWBXUAEAAAAAQSNFZ4EjSYdhI0EjRWeJASEHQAAgAAAAV2AFAAAAAAEjRWeBI0mHYSNBI0VniQEpQbp/ZJpWBKeDtKLiXb0P2E9wvc0g3f373jnYQYlJquOrlPOoEy3ngsHPJuSUijvWDsrQzqYa349K7G/66qaXEFZQAgAAAAAOuac/eRLYakKX6B0vZ1r3QodOQFfjqJD+xlGiPu4/PsBWwAIAAAAACkm0o9bj6j0HuADKc0svbqO2UHj6GrlNdF6yKNxh63xRJrAAAAAAAAAAAAAA==",
+                  "subType": "06"
+                }
+              }
+            }
+          }
+        },
+        {
+          "object": "encryptedColl",
+          "name": "find",
+          "arguments": {
+            "filter": {
+              "_id": 1
+            }
+          },
+          "expectResult": [
+            {
+              "_id": 1,
+              "encryptedIndexed": "123"
+            }
+          ]
+        },
+        {
+          "name": "find",
+          "object": "unencryptedColl",
+          "arguments": {
+            "filter": {}
+          },
+          "expectResult": [
+            {
+              "_id": 1,
+              "encryptedIndexed": {
+                "$$type": "binData"
+              },
+              "__safeContent__": [
+                {
+                  "$binary": {
+                    "base64": "31eCYlbQoVboc5zwC8IoyJVSkag9PxREka8dkmbXJeY=",
+                    "subType": "00"
+                  }
+                }
+              ]
+            }
+          ]
+        }
+      ],
+      "expectEvents": [
+        {
+          "client": "client0",
+          "events": [
+            {
+              "commandStartedEvent": {
+                "command": {
+                  "listCollections": 1,
+                  "filter": {
+                    "name": "default"
+                  }
+                },
+                "commandName": "listCollections"
+              }
+            },
+            {
+              "commandStartedEvent": {
+                "command": {
+                  "insert": "default",
+                  "documents": [
+                    {
+                      "_id": 1,
+                      "encryptedIndexed": {
+                        "$binary": {
+                          "base64": "C18BAAAFZAAgAAAAANnt+eLTkv4GdDPl8IAfJOvTzArOgFJQ2S/DcLza4W0DBXMAIAAAAAD2u+omZme3P2gBPehMQyQHQ153tPN1+z7bksYA9jKTpAVwADAAAAAAUnCOQqIvmR65YKyYnsiVfVrg9hwUVO3RhhKExo3RWOzgaS0QdsBL5xKFS0JhZSoWBXUAEAAAAAQSNFZ4EjSYdhI0EjRWeJASEHQAAgAAAAV2AFAAAAAAEjRWeBI0mHYSNBI0VniQEpQbp/ZJpWBKeDtKLiXb0P2E9wvc0g3f373jnYQYlJquOrlPOoEy3ngsHPJuSUijvWDsrQzqYa349K7G/66qaXEFZQAgAAAAAOuac/eRLYakKX6B0vZ1r3QodOQFfjqJD+xlGiPu4/PsBWwAIAAAAACkm0o9bj6j0HuADKc0svbqO2UHj6GrlNdF6yKNxh63xRJrAAAAAAAAAAAAAA==",
+                          "subType": "06"
+                        }
+                      }
+                    }
+                  ],
+                  "ordered": true,
+                  "encryptionInformation": {
+                    "type": 1,
+                    "schema": {
+                      "default.default": {
+                        "escCollection": "enxcol_.default.esc",
+                        "ecocCollection": "enxcol_.default.ecoc",
+                        "fields": [
+                          {
+                            "keyId": {
+                              "$binary": {
+                                "base64": "EjRWeBI0mHYSNBI0VniQEg==",
+                                "subType": "04"
+                              }
+                            },
+                            "path": "encryptedIndexed",
+                            "bsonType": "string",
+                            "queries": {
+                              "queryType": "equality",
+                              "contention": {
+                                "$numberLong": "0"
+                              }
+                            }
+                          },
+                          {
+                            "keyId": {
+                              "$binary": {
+                                "base64": "q83vqxI0mHYSNBI0VniQEg==",
+                                "subType": "04"
+                              }
+                            },
+                            "path": "encryptedUnindexed",
+                            "bsonType": "string"
+                          }
+                        ]
+                      }
+                    }
+                  }
+                },
+                "commandName": "insert"
+              }
+            },
+            {
+              "commandStartedEvent": {
+                "command": {
+                  "find": "default",
+                  "filter": {
+                    "_id": 1
+                  }
+                },
+                "commandName": "find"
+              }
+            },
+            {
+              "commandStartedEvent": {
+                "command": {
+                  "find": "datakeys",
+                  "filter": {
+                    "$or": [
+                      {
+                        "_id": {
+                          "$in": [
+                            {
+                              "$binary": {
+                                "base64": "EjRWeBI0mHYSNBI0VniQEg==",
+                                "subType": "04"
+                              }
+                            }
+                          ]
+                        }
+                      },
+                      {
+                        "keyAltNames": {
+                          "$in": []
+                        }
+                      }
+                    ]
+                  },
+                  "$db": "keyvault",
+                  "readConcern": {
+                    "level": "majority"
+                  }
+                },
+                "commandName": "find"
+              }
+            }
+          ]
+        }
+      ]
+    }
+  ]
+}
diff -pruN 2.0.2-1/src/libmongoc/tests/json/client_side_encryption/unified/fle2v2-EncryptedFields-vs-EncryptedFieldsMap.json 2.1.0-1/src/libmongoc/tests/json/client_side_encryption/unified/fle2v2-EncryptedFields-vs-EncryptedFieldsMap.json
--- 2.0.2-1/src/libmongoc/tests/json/client_side_encryption/unified/fle2v2-EncryptedFields-vs-EncryptedFieldsMap.json	1970-01-01 00:00:00.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/json/client_side_encryption/unified/fle2v2-EncryptedFields-vs-EncryptedFieldsMap.json	2025-08-14 18:37:23.000000000 +0000
@@ -0,0 +1,256 @@
+{
+  "description": "fle2v2-EncryptedFields-vs-EncryptedFieldsMap",
+  "schemaVersion": "1.23",
+  "runOnRequirements": [
+    {
+      "minServerVersion": "7.0.0",
+      "serverless": "forbid",
+      "csfle": true,
+      "topologies": [
+        "replicaset",
+        "sharded",
+        "load-balanced"
+      ]
+    }
+  ],
+  "createEntities": [
+    {
+      "client": {
+        "id": "client0",
+        "autoEncryptOpts": {
+          "keyVaultNamespace": "keyvault.datakeys",
+          "kmsProviders": {
+            "local": {
+              "key": "Mng0NCt4ZHVUYUJCa1kxNkVyNUR1QURhZ2h2UzR2d2RrZzh0cFBwM3R6NmdWMDFBMUN3YkQ5aXRRMkhGRGdQV09wOGVNYUMxT2k3NjZKelhaQmRCZGJkTXVyZG9uSjFk"
+            }
+          },
+          "encryptedFieldsMap": {
+            "default.default": {
+              "fields": []
+            }
+          }
+        },
+        "observeEvents": [
+          "commandStartedEvent"
+        ]
+      }
+    },
+    {
+      "database": {
+        "id": "encryptedDB",
+        "client": "client0",
+        "databaseName": "default"
+      }
+    },
+    {
+      "collection": {
+        "id": "encryptedColl",
+        "database": "encryptedDB",
+        "collectionName": "default"
+      }
+    }
+  ],
+  "initialData": [
+    {
+      "databaseName": "keyvault",
+      "collectionName": "datakeys",
+      "documents": [
+        {
+          "_id": {
+            "$binary": {
+              "base64": "q83vqxI0mHYSNBI0VniQEg==",
+              "subType": "04"
+            }
+          },
+          "keyMaterial": {
+            "$binary": {
+              "base64": "HBk9BWihXExNDvTp1lUxOuxuZK2Pe2ZdVdlsxPEBkiO1bS4mG5NNDsQ7zVxJAH8BtdOYp72Ku4Y3nwc0BUpIKsvAKX4eYXtlhv5zUQxWdeNFhg9qK7qb8nqhnnLeT0f25jFSqzWJoT379hfwDeu0bebJHr35QrJ8myZdPMTEDYF08QYQ48ShRBli0S+QzBHHAQiM2iJNr4svg2WR8JSeWQ==",
+              "subType": "00"
+            }
+          },
+          "creationDate": {
+            "$date": {
+              "$numberLong": "1648914851981"
+            }
+          },
+          "updateDate": {
+            "$date": {
+              "$numberLong": "1648914851981"
+            }
+          },
+          "status": {
+            "$numberInt": "0"
+          },
+          "masterKey": {
+            "provider": "local"
+          }
+        }
+      ]
+    },
+    {
+      "databaseName": "default",
+      "collectionName": "default",
+      "documents": [],
+      "createOptions": {
+        "encryptedFields": {
+          "fields": [
+            {
+              "keyId": {
+                "$binary": {
+                  "base64": "EjRWeBI0mHYSNBI0VniQEg==",
+                  "subType": "04"
+                }
+              },
+              "path": "encryptedIndexed",
+              "bsonType": "string",
+              "queries": {
+                "queryType": "equality",
+                "contention": {
+                  "$numberLong": "0"
+                }
+              }
+            },
+            {
+              "keyId": {
+                "$binary": {
+                  "base64": "q83vqxI0mHYSNBI0VniQEg==",
+                  "subType": "04"
+                }
+              },
+              "path": "encryptedUnindexed",
+              "bsonType": "string"
+            }
+          ]
+        }
+      }
+    }
+  ],
+  "tests": [
+    {
+      "description": "encryptedFieldsMap is preferred over remote encryptedFields",
+      "operations": [
+        {
+          "object": "encryptedColl",
+          "name": "insertOne",
+          "arguments": {
+            "document": {
+              "_id": 1,
+              "encryptedUnindexed": {
+                "$binary": {
+                  "base64": "BqvN76sSNJh2EjQSNFZ4kBICTQaVZPWgXp41I7mPV1rLFTtw1tXzjcdSEyxpKKqujlko5TeizkB9hHQ009dVY1+fgIiDcefh+eQrm3CkhQ==",
+                  "subType": "06"
+                }
+              }
+            }
+          }
+        },
+        {
+          "object": "encryptedColl",
+          "name": "find",
+          "arguments": {
+            "filter": {
+              "_id": 1
+            }
+          },
+          "expectResult": [
+            {
+              "_id": 1,
+              "encryptedUnindexed": "value123"
+            }
+          ]
+        }
+      ],
+      "expectEvents": [
+        {
+          "client": "client0",
+          "events": [
+            {
+              "commandStartedEvent": {
+                "databaseName": "default",
+                "commandName": "insert",
+                "command": {
+                  "insert": "default",
+                  "documents": [
+                    {
+                      "_id": 1,
+                      "encryptedUnindexed": {
+                        "$binary": {
+                          "base64": "BqvN76sSNJh2EjQSNFZ4kBICTQaVZPWgXp41I7mPV1rLFTtw1tXzjcdSEyxpKKqujlko5TeizkB9hHQ009dVY1+fgIiDcefh+eQrm3CkhQ==",
+                          "subType": "06"
+                        }
+                      }
+                    }
+                  ],
+                  "ordered": true
+                }
+              }
+            },
+            {
+              "commandStartedEvent": {
+                "databaseName": "default",
+                "commandName": "find",
+                "command": {
+                  "find": "default",
+                  "filter": {
+                    "_id": 1
+                  }
+                }
+              }
+            },
+            {
+              "commandStartedEvent": {
+                "databaseName": "keyvault",
+                "commandName": "find",
+                "command": {
+                  "find": "datakeys",
+                  "filter": {
+                    "$or": [
+                      {
+                        "_id": {
+                          "$in": [
+                            {
+                              "$binary": {
+                                "base64": "q83vqxI0mHYSNBI0VniQEg==",
+                                "subType": "04"
+                              }
+                            }
+                          ]
+                        }
+                      },
+                      {
+                        "keyAltNames": {
+                          "$in": []
+                        }
+                      }
+                    ]
+                  },
+                  "$db": "keyvault",
+                  "readConcern": {
+                    "level": "majority"
+                  }
+                }
+              }
+            }
+          ]
+        }
+      ],
+      "outcome": [
+        {
+          "collectionName": "default",
+          "databaseName": "default",
+          "documents": [
+            {
+              "_id": 1,
+              "encryptedUnindexed": {
+                "$binary": {
+                  "base64": "BqvN76sSNJh2EjQSNFZ4kBICTQaVZPWgXp41I7mPV1rLFTtw1tXzjcdSEyxpKKqujlko5TeizkB9hHQ009dVY1+fgIiDcefh+eQrm3CkhQ==",
+                  "subType": "06"
+                }
+              }
+            }
+          ]
+        }
+      ]
+    }
+  ]
+}
diff -pruN 2.0.2-1/src/libmongoc/tests/json/client_side_encryption/unified/localSchema.json 2.1.0-1/src/libmongoc/tests/json/client_side_encryption/unified/localSchema.json
--- 2.0.2-1/src/libmongoc/tests/json/client_side_encryption/unified/localSchema.json	1970-01-01 00:00:00.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/json/client_side_encryption/unified/localSchema.json	2025-08-14 18:37:23.000000000 +0000
@@ -0,0 +1,337 @@
+{
+  "description": "localSchema",
+  "schemaVersion": "1.23",
+  "runOnRequirements": [
+    {
+      "minServerVersion": "4.1.10",
+      "csfle": true
+    }
+  ],
+  "createEntities": [
+    {
+      "client": {
+        "id": "client0",
+        "autoEncryptOpts": {
+          "keyVaultNamespace": "keyvault.datakeys",
+          "schemaMap": {
+            "default.default": {
+              "properties": {
+                "encrypted_w_altname": {
+                  "encrypt": {
+                    "keyId": "/altname",
+                    "bsonType": "string",
+                    "algorithm": "AEAD_AES_256_CBC_HMAC_SHA_512-Random"
+                  }
+                },
+                "encrypted_string": {
+                  "encrypt": {
+                    "keyId": [
+                      {
+                        "$binary": {
+                          "base64": "AAAAAAAAAAAAAAAAAAAAAA==",
+                          "subType": "04"
+                        }
+                      }
+                    ],
+                    "bsonType": "string",
+                    "algorithm": "AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic"
+                  }
+                },
+                "random": {
+                  "encrypt": {
+                    "keyId": [
+                      {
+                        "$binary": {
+                          "base64": "AAAAAAAAAAAAAAAAAAAAAA==",
+                          "subType": "04"
+                        }
+                      }
+                    ],
+                    "bsonType": "string",
+                    "algorithm": "AEAD_AES_256_CBC_HMAC_SHA_512-Random"
+                  }
+                },
+                "encrypted_string_equivalent": {
+                  "encrypt": {
+                    "keyId": [
+                      {
+                        "$binary": {
+                          "base64": "AAAAAAAAAAAAAAAAAAAAAA==",
+                          "subType": "04"
+                        }
+                      }
+                    ],
+                    "bsonType": "string",
+                    "algorithm": "AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic"
+                  }
+                }
+              },
+              "bsonType": "object"
+            }
+          },
+          "kmsProviders": {
+            "aws": {
+              "accessKeyId": {
+                "$$placeholder": 1
+              },
+              "secretAccessKey": {
+                "$$placeholder": 1
+              }
+            }
+          }
+        },
+        "observeEvents": [
+          "commandStartedEvent"
+        ]
+      }
+    },
+    {
+      "client": {
+        "id": "client1",
+        "autoEncryptOpts": {
+          "keyVaultNamespace": "keyvault.datakeys",
+          "schemaMap": {
+            "default.default": {
+              "properties": {
+                "test": {
+                  "bsonType": "string"
+                }
+              },
+              "bsonType": "object",
+              "required": [
+                "test"
+              ]
+            }
+          },
+          "kmsProviders": {
+            "aws": {
+              "accessKeyId": {
+                "$$placeholder": 1
+              },
+              "secretAccessKey": {
+                "$$placeholder": 1
+              }
+            }
+          }
+        },
+        "observeEvents": [
+          "commandStartedEvent"
+        ]
+      }
+    },
+    {
+      "database": {
+        "id": "encryptedDB",
+        "client": "client0",
+        "databaseName": "default"
+      }
+    },
+    {
+      "collection": {
+        "id": "encryptedColl",
+        "database": "encryptedDB",
+        "collectionName": "default"
+      }
+    },
+    {
+      "database": {
+        "id": "encryptedDB2",
+        "client": "client1",
+        "databaseName": "default"
+      }
+    },
+    {
+      "collection": {
+        "id": "encryptedColl2",
+        "database": "encryptedDB2",
+        "collectionName": "default"
+      }
+    }
+  ],
+  "initialData": [
+    {
+      "databaseName": "keyvault",
+      "collectionName": "datakeys",
+      "documents": [
+        {
+          "status": 1,
+          "_id": {
+            "$binary": {
+              "base64": "AAAAAAAAAAAAAAAAAAAAAA==",
+              "subType": "04"
+            }
+          },
+          "masterKey": {
+            "provider": "aws",
+            "key": "arn:aws:kms:us-east-1:579766882180:key/89fcc2c4-08b0-4bd9-9f25-e30687b580d0",
+            "region": "us-east-1"
+          },
+          "updateDate": {
+            "$date": {
+              "$numberLong": "1552949630483"
+            }
+          },
+          "keyMaterial": {
+            "$binary": {
+              "base64": "AQICAHhQNmWG2CzOm1dq3kWLM+iDUZhEqnhJwH9wZVpuZ94A8gEqnsxXlR51T5EbEVezUqqKAAAAwjCBvwYJKoZIhvcNAQcGoIGxMIGuAgEAMIGoBgkqhkiG9w0BBwEwHgYJYIZIAWUDBAEuMBEEDHa4jo6yp0Z18KgbUgIBEIB74sKxWtV8/YHje5lv5THTl0HIbhSwM6EqRlmBiFFatmEWaeMk4tO4xBX65eq670I5TWPSLMzpp8ncGHMmvHqRajNBnmFtbYxN3E3/WjxmdbOOe+OXpnGJPcGsftc7cB2shRfA4lICPnE26+oVNXT6p0Lo20nY5XC7jyCO",
+              "subType": "00"
+            }
+          },
+          "creationDate": {
+            "$date": {
+              "$numberLong": "1552949630483"
+            }
+          },
+          "keyAltNames": [
+            "altname",
+            "another_altname"
+          ]
+        }
+      ]
+    },
+    {
+      "databaseName": "default",
+      "collectionName": "default",
+      "documents": []
+    }
+  ],
+  "tests": [
+    {
+      "description": "A local schema should override",
+      "operations": [
+        {
+          "object": "encryptedColl",
+          "name": "insertOne",
+          "arguments": {
+            "document": {
+              "_id": 1,
+              "encrypted_string": "string0"
+            }
+          }
+        },
+        {
+          "object": "encryptedColl",
+          "name": "find",
+          "arguments": {
+            "filter": {
+              "_id": 1
+            }
+          },
+          "expectResult": [
+            {
+              "_id": 1,
+              "encrypted_string": "string0"
+            }
+          ]
+        }
+      ],
+      "expectEvents": [
+        {
+          "client": "client0",
+          "events": [
+            {
+              "commandStartedEvent": {
+                "databaseName": "keyvault",
+                "commandName": "find",
+                "command": {
+                  "find": "datakeys",
+                  "filter": {
+                    "$or": [
+                      {
+                        "_id": {
+                          "$in": [
+                            {
+                              "$binary": {
+                                "base64": "AAAAAAAAAAAAAAAAAAAAAA==",
+                                "subType": "04"
+                              }
+                            }
+                          ]
+                        }
+                      },
+                      {
+                        "keyAltNames": {
+                          "$in": []
+                        }
+                      }
+                    ]
+                  },
+                  "readConcern": {
+                    "level": "majority"
+                  }
+                }
+              }
+            },
+            {
+              "commandStartedEvent": {
+                "commandName": "insert",
+                "command": {
+                  "insert": "default",
+                  "documents": [
+                    {
+                      "_id": 1,
+                      "encrypted_string": {
+                        "$binary": {
+                          "base64": "AQAAAAAAAAAAAAAAAAAAAAACwj+3zkv2VM+aTfk60RqhXq6a/77WlLwu/BxXFkL7EppGsju/m8f0x5kBDD3EZTtGALGXlym5jnpZAoSIkswHoA==",
+                          "subType": "06"
+                        }
+                      }
+                    }
+                  ],
+                  "ordered": true
+                }
+              }
+            },
+            {
+              "commandStartedEvent": {
+                "commandName": "find",
+                "command": {
+                  "find": "default",
+                  "filter": {
+                    "_id": 1
+                  }
+                }
+              }
+            }
+          ]
+        }
+      ],
+      "outcome": [
+        {
+          "collectionName": "default",
+          "databaseName": "default",
+          "documents": [
+            {
+              "_id": 1,
+              "encrypted_string": {
+                "$binary": {
+                  "base64": "AQAAAAAAAAAAAAAAAAAAAAACwj+3zkv2VM+aTfk60RqhXq6a/77WlLwu/BxXFkL7EppGsju/m8f0x5kBDD3EZTtGALGXlym5jnpZAoSIkswHoA==",
+                  "subType": "06"
+                }
+              }
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "description": "A local schema with no encryption is an error",
+      "operations": [
+        {
+          "object": "encryptedColl2",
+          "name": "insertOne",
+          "arguments": {
+            "document": {
+              "_id": 1,
+              "encrypted_string": "string0"
+            }
+          },
+          "expectError": {
+            "isError": true,
+            "errorContains": "JSON schema keyword 'required' is only allowed with a remote schema"
+          }
+        }
+      ]
+    }
+  ]
+}
diff -pruN 2.0.2-1/src/libmongoc/tests/json/client_side_encryption/unified/maxWireVersion.json 2.1.0-1/src/libmongoc/tests/json/client_side_encryption/unified/maxWireVersion.json
--- 2.0.2-1/src/libmongoc/tests/json/client_side_encryption/unified/maxWireVersion.json	1970-01-01 00:00:00.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/json/client_side_encryption/unified/maxWireVersion.json	2025-08-14 18:37:23.000000000 +0000
@@ -0,0 +1,101 @@
+{
+  "description": "maxWireVersion",
+  "schemaVersion": "1.23",
+  "runOnRequirements": [
+    {
+      "maxServerVersion": "4.0.99",
+      "csfle": true
+    }
+  ],
+  "createEntities": [
+    {
+      "client": {
+        "id": "client0",
+        "autoEncryptOpts": {
+          "keyVaultNamespace": "keyvault.datakeys",
+          "kmsProviders": {
+            "aws": {}
+          },
+          "extraOptions": {
+            "mongocryptdBypassSpawn": true
+          }
+        }
+      }
+    },
+    {
+      "database": {
+        "id": "database0",
+        "client": "client0",
+        "databaseName": "default"
+      }
+    },
+    {
+      "collection": {
+        "id": "collection0",
+        "database": "database0",
+        "collectionName": "default"
+      }
+    }
+  ],
+  "initialData": [
+    {
+      "databaseName": "keyvault",
+      "collectionName": "datakeys",
+      "documents": [
+        {
+          "status": 1,
+          "_id": {
+            "$binary": {
+              "base64": "AAAAAAAAAAAAAAAAAAAAAA==",
+              "subType": "04"
+            }
+          },
+          "masterKey": {
+            "provider": "aws",
+            "key": "arn:aws:kms:us-east-1:579766882180:key/89fcc2c4-08b0-4bd9-9f25-e30687b580d0",
+            "region": "us-east-1"
+          },
+          "updateDate": {
+            "$date": {
+              "$numberLong": "1552949630483"
+            }
+          },
+          "keyMaterial": {
+            "$binary": {
+              "base64": "AQICAHhQNmWG2CzOm1dq3kWLM+iDUZhEqnhJwH9wZVpuZ94A8gEqnsxXlR51T5EbEVezUqqKAAAAwjCBvwYJKoZIhvcNAQcGoIGxMIGuAgEAMIGoBgkqhkiG9w0BBwEwHgYJYIZIAWUDBAEuMBEEDHa4jo6yp0Z18KgbUgIBEIB74sKxWtV8/YHje5lv5THTl0HIbhSwM6EqRlmBiFFatmEWaeMk4tO4xBX65eq670I5TWPSLMzpp8ncGHMmvHqRajNBnmFtbYxN3E3/WjxmdbOOe+OXpnGJPcGsftc7cB2shRfA4lICPnE26+oVNXT6p0Lo20nY5XC7jyCO",
+              "subType": "00"
+            }
+          },
+          "creationDate": {
+            "$date": {
+              "$numberLong": "1552949630483"
+            }
+          },
+          "keyAltNames": [
+            "altname",
+            "another_altname"
+          ]
+        }
+      ]
+    }
+  ],
+  "tests": [
+    {
+      "description": "operation fails with maxWireVersion < 8",
+      "operations": [
+        {
+          "name": "insertOne",
+          "object": "collection0",
+          "arguments": {
+            "document": {
+              "encrypted_string": "string0"
+            }
+          },
+          "expectError": {
+            "errorContains": "Auto-encryption requires a minimum MongoDB version of 4.2"
+          }
+        }
+      ]
+    }
+  ]
+}
diff -pruN 2.0.2-1/src/libmongoc/tests/json/command-logging-and-monitoring/monitoring/unacknowledged-client-bulkWrite.json 2.1.0-1/src/libmongoc/tests/json/command-logging-and-monitoring/monitoring/unacknowledged-client-bulkWrite.json
--- 2.0.2-1/src/libmongoc/tests/json/command-logging-and-monitoring/monitoring/unacknowledged-client-bulkWrite.json	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/json/command-logging-and-monitoring/monitoring/unacknowledged-client-bulkWrite.json	2025-08-14 18:37:23.000000000 +0000
@@ -95,29 +95,34 @@
             "ordered": false
           },
           "expectResult": {
-            "insertedCount": {
-              "$$unsetOrMatches": 0
-            },
-            "upsertedCount": {
-              "$$unsetOrMatches": 0
-            },
-            "matchedCount": {
-              "$$unsetOrMatches": 0
-            },
-            "modifiedCount": {
-              "$$unsetOrMatches": 0
-            },
-            "deletedCount": {
-              "$$unsetOrMatches": 0
-            },
-            "insertResults": {
-              "$$unsetOrMatches": {}
-            },
-            "updateResults": {
-              "$$unsetOrMatches": {}
-            },
-            "deleteResults": {
-              "$$unsetOrMatches": {}
+            "$$unsetOrMatches": {
+              "acknowledged": {
+                "$$unsetOrMatches": false
+              },
+              "insertedCount": {
+                "$$unsetOrMatches": 0
+              },
+              "upsertedCount": {
+                "$$unsetOrMatches": 0
+              },
+              "matchedCount": {
+                "$$unsetOrMatches": 0
+              },
+              "modifiedCount": {
+                "$$unsetOrMatches": 0
+              },
+              "deletedCount": {
+                "$$unsetOrMatches": 0
+              },
+              "insertResults": {
+                "$$unsetOrMatches": {}
+              },
+              "updateResults": {
+                "$$unsetOrMatches": {}
+              },
+              "deleteResults": {
+                "$$unsetOrMatches": {}
+              }
             }
           }
         },
diff -pruN 2.0.2-1/src/libmongoc/tests/json/connection_uri/additional-nonspec-tests.json 2.1.0-1/src/libmongoc/tests/json/connection_uri/additional-nonspec-tests.json
--- 2.0.2-1/src/libmongoc/tests/json/connection_uri/additional-nonspec-tests.json	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/json/connection_uri/additional-nonspec-tests.json	2025-08-14 18:37:23.000000000 +0000
@@ -153,7 +153,7 @@
       "description": "Username containing percent encoded multi-byte UTF-8 is valid",
       "uri": "mongodb://%E2%D8%83",
       "valid": false,
-      "warning": true
+      "warning": false
     },
     {
       "description": "Valid connection and timeout options are parsed correctly, libmongoc version without maxIdleTimeMS",
@@ -186,4 +186,4 @@
       }
     }
   ]
-}
+}
\ No newline at end of file
diff -pruN 2.0.2-1/src/libmongoc/tests/json/unified/poc-queryable-encryption.json 2.1.0-1/src/libmongoc/tests/json/unified/poc-queryable-encryption.json
--- 2.0.2-1/src/libmongoc/tests/json/unified/poc-queryable-encryption.json	1970-01-01 00:00:00.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/json/unified/poc-queryable-encryption.json	2025-08-14 18:37:23.000000000 +0000
@@ -0,0 +1,188 @@
+{
+  "description": "poc-queryable-encryption",
+  "schemaVersion": "1.23",
+  "runOnRequirements": [
+    {
+      "minServerVersion": "7.0",
+      "csfle": true
+    }
+  ],
+  "createEntities": [
+    {
+      "client": {
+        "id": "client0",
+        "autoEncryptOpts": {
+          "keyVaultNamespace": "keyvault.datakeys",
+          "kmsProviders": {
+            "local": {
+              "key": "Mng0NCt4ZHVUYUJCa1kxNkVyNUR1QURhZ2h2UzR2d2RrZzh0cFBwM3R6NmdWMDFBMUN3YkQ5aXRRMkhGRGdQV09wOGVNYUMxT2k3NjZKelhaQmRCZGJkTXVyZG9uSjFk"
+            }
+          }
+        }
+      }
+    },
+    {
+      "database": {
+        "id": "encryptedDB",
+        "client": "client0",
+        "databaseName": "poc-queryable-encryption"
+      }
+    },
+    {
+      "collection": {
+        "id": "encryptedColl",
+        "database": "encryptedDB",
+        "collectionName": "encrypted"
+      }
+    },
+    {
+      "client": {
+        "id": "client1"
+      }
+    },
+    {
+      "database": {
+        "id": "unencryptedDB",
+        "client": "client1",
+        "databaseName": "poc-queryable-encryption"
+      }
+    },
+    {
+      "collection": {
+        "id": "unencryptedColl",
+        "database": "unencryptedDB",
+        "collectionName": "encrypted"
+      }
+    }
+  ],
+  "initialData": [
+    {
+      "databaseName": "keyvault",
+      "collectionName": "datakeys",
+      "documents": [
+        {
+          "_id": {
+            "$binary": {
+              "base64": "EjRWeBI0mHYSNBI0VniQEg==",
+              "subType": "04"
+            }
+          },
+          "keyMaterial": {
+            "$binary": {
+              "base64": "sHe0kz57YW7v8g9VP9sf/+K1ex4JqKc5rf/URX3n3p8XdZ6+15uXPaSayC6adWbNxkFskuMCOifDoTT+rkqMtFkDclOy884RuGGtUysq3X7zkAWYTKi8QAfKkajvVbZl2y23UqgVasdQu3OVBQCrH/xY00nNAs/52e958nVjBuzQkSb1T8pKJAyjZsHJ60+FtnfafDZSTAIBJYn7UWBCwQ==",
+              "subType": "00"
+            }
+          },
+          "creationDate": {
+            "$date": {
+              "$numberLong": "1641024000000"
+            }
+          },
+          "updateDate": {
+            "$date": {
+              "$numberLong": "1641024000000"
+            }
+          },
+          "status": 1,
+          "masterKey": {
+            "provider": "local"
+          }
+        }
+      ]
+    },
+    {
+      "databaseName": "poc-queryable-encryption",
+      "collectionName": "encrypted",
+      "documents": [],
+      "createOptions": {
+        "encryptedFields": {
+          "fields": [
+            {
+              "keyId": {
+                "$binary": {
+                  "base64": "EjRWeBI0mHYSNBI0VniQEg==",
+                  "subType": "04"
+                }
+              },
+              "path": "encryptedInt",
+              "bsonType": "int",
+              "queries": {
+                "queryType": "equality",
+                "contention": {
+                  "$numberLong": "0"
+                }
+              }
+            }
+          ]
+        }
+      }
+    }
+  ],
+  "tests": [
+    {
+      "description": "insert, replace, and find with queryable encryption",
+      "operations": [
+        {
+          "object": "encryptedColl",
+          "name": "insertOne",
+          "arguments": {
+            "document": {
+              "_id": 1,
+              "encryptedInt": 11
+            }
+          }
+        },
+        {
+          "object": "encryptedColl",
+          "name": "replaceOne",
+          "arguments": {
+            "filter": {
+              "encryptedInt": 11
+            },
+            "replacement": {
+              "encryptedInt": 22
+            }
+          }
+        },
+        {
+          "object": "encryptedColl",
+          "name": "find",
+          "arguments": {
+            "filter": {
+              "encryptedInt": 22
+            }
+          },
+          "expectResult": [
+            {
+              "_id": 1,
+              "encryptedInt": 22
+            }
+          ]
+        },
+        {
+          "object": "unencryptedColl",
+          "name": "find",
+          "arguments": {
+            "filter": {}
+          },
+          "expectResult": [
+            {
+              "_id": 1,
+              "encryptedInt": {
+                "$$type": "binData"
+              },
+              "__safeContent__": [
+                {
+                  "$binary": {
+                    "base64": "rhS16TJojgDDBtbluxBokvcotP1mQTGeYpNt8xd3MJQ=",
+                    "subType": "00"
+                  }
+                }
+              ]
+            }
+          ]
+        }
+      ]
+    }
+  ]
+}
diff -pruN 2.0.2-1/src/libmongoc/tests/json/unified/poc-transactions.json 2.1.0-1/src/libmongoc/tests/json/unified/poc-transactions.json
--- 2.0.2-1/src/libmongoc/tests/json/unified/poc-transactions.json	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/json/unified/poc-transactions.json	2025-08-14 18:37:23.000000000 +0000
@@ -11,7 +11,7 @@
     {
       "minServerVersion": "4.1.8",
       "topologies": [
-        "sharded-replicaset"
+        "sharded"
       ]
     }
   ],
@@ -93,7 +93,7 @@
           "minServerVersion": "4.3.4",
           "topologies": [
             "replicaset",
-            "sharded-replicaset"
+            "sharded"
           ]
         }
       ],
@@ -203,7 +203,7 @@
           "minServerVersion": "4.3.4",
           "topologies": [
             "replicaset",
-            "sharded-replicaset"
+            "sharded"
           ]
         }
       ],
diff -pruN 2.0.2-1/src/libmongoc/tests/json-test-monitoring.c 2.1.0-1/src/libmongoc/tests/json-test-monitoring.c
--- 2.0.2-1/src/libmongoc/tests/json-test-monitoring.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/json-test-monitoring.c	2025-08-14 18:37:23.000000000 +0000
@@ -16,21 +16,20 @@
 
 
 #include <mongoc/mongoc-client-private.h>
-#include <mongoc/mongoc-config.h>
 #include <mongoc/mongoc-collection-private.h>
 #include <mongoc/mongoc-host-list-private.h>
 #include <mongoc/mongoc-server-description-private.h>
 #include <mongoc/mongoc-topology-description-private.h>
 #include <mongoc/mongoc-topology-private.h>
 #include <mongoc/mongoc-util-private.h>
-#include <mongoc/mongoc-util-private.h>
 
-#include "TestSuite.h"
-#include "test-conveniences.h"
+#include <mongoc/mongoc-config.h>
 
-#include "json-test.h"
-#include "json-test-operations.h"
-#include "test-libmongoc.h"
+#include <TestSuite.h>
+#include <json-test-operations.h>
+#include <json-test.h>
+#include <test-conveniences.h>
+#include <test-libmongoc.h>
 
 #ifdef _MSC_VER
 #include <io.h>
diff -pruN 2.0.2-1/src/libmongoc/tests/json-test-monitoring.h 2.1.0-1/src/libmongoc/tests/json-test-monitoring.h
--- 2.0.2-1/src/libmongoc/tests/json-test-monitoring.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/json-test-monitoring.h	2025-08-14 18:37:23.000000000 +0000
@@ -17,13 +17,13 @@
 #ifndef JSON_TEST_MONITORING_H
 #define JSON_TEST_MONITORING_H
 
-#include "TestSuite.h"
+#include <mongoc/mongoc.h>
 
 #include <bson/bson.h>
-#include <mongoc/mongoc.h>
 
-#include "test-conveniences.h"
-#include "json-test-operations.h"
+#include <TestSuite.h>
+#include <json-test-operations.h>
+#include <test-conveniences.h>
 
 typedef void (*json_test_events_check_cb_t) (const bson_t *events);
 
diff -pruN 2.0.2-1/src/libmongoc/tests/json-test-operations.c 2.1.0-1/src/libmongoc/tests/json-test-operations.c
--- 2.0.2-1/src/libmongoc/tests/json-test-operations.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/json-test-operations.c	2025-08-14 18:37:23.000000000 +0000
@@ -15,11 +15,11 @@
  */
 
 
-#include <bson/bson.h>
+#include <json-test-operations.h>
 
+#include <common-oid-private.h>
 #include <mongoc/mongoc-change-stream-private.h>
 #include <mongoc/mongoc-collection-private.h>
-#include <mongoc/mongoc-config.h>
 #include <mongoc/mongoc-cursor-private.h>
 #include <mongoc/mongoc-host-list-private.h>
 #include <mongoc/mongoc-server-description-private.h>
@@ -27,13 +27,15 @@
 #include <mongoc/mongoc-topology-private.h>
 #include <mongoc/mongoc-uri-private.h>
 #include <mongoc/mongoc-util-private.h>
-#include <common-oid-private.h>
 
-#include "json-test-operations.h"
-#include "json-test.h"
-#include "test-conveniences.h"
-#include "test-libmongoc.h"
-#include "TestSuite.h"
+#include <mongoc/mongoc-config.h>
+
+#include <bson/bson.h>
+
+#include <TestSuite.h>
+#include <json-test.h>
+#include <test-conveniences.h>
+#include <test-libmongoc.h>
 
 #include <inttypes.h>
 
diff -pruN 2.0.2-1/src/libmongoc/tests/json-test-operations.h 2.1.0-1/src/libmongoc/tests/json-test-operations.h
--- 2.0.2-1/src/libmongoc/tests/json-test-operations.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/json-test-operations.h	2025-08-14 18:37:23.000000000 +0000
@@ -19,9 +19,13 @@
 
 struct _json_test_config_t;
 
-#include <mongoc/mongoc-thread-private.h>
 #include <common-thread-private.h>
-#include "mock_server/sync-queue.h"
+#include <mongoc/mongoc-thread-private.h>
+
+#include <mongoc/mongoc-client.h>
+#include <mongoc/mongoc-uri.h>
+
+#include <mock_server/sync-queue.h>
 
 struct _json_test_ctx_t;
 
diff -pruN 2.0.2-1/src/libmongoc/tests/json-test.c 2.1.0-1/src/libmongoc/tests/json-test.c
--- 2.0.2-1/src/libmongoc/tests/json-test.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/json-test.c	2025-08-14 18:37:23.000000000 +0000
@@ -15,20 +15,23 @@
  */
 
 
-#include <mongoc/mongoc.h>
+#include <json-test.h>
+
+#include <common-oid-private.h>
 #include <mongoc/mongoc-client-side-encryption-private.h>
 #include <mongoc/mongoc-collection-private.h>
-#include <mongoc/mongoc-util-private.h>
 #include <mongoc/mongoc-uri-private.h>
+#include <mongoc/mongoc-util-private.h>
+
 #include <mongoc/mongoc-client-side-encryption.h>
-#include <common-oid-private.h>
+#include <mongoc/mongoc.h>
+
 #include <mlib/loop.h>
 
-#include "json-test.h"
-#include "json-test-operations.h"
-#include "json-test-monitoring.h"
-#include "TestSuite.h"
-#include "test-libmongoc.h"
+#include <TestSuite.h>
+#include <json-test-monitoring.h>
+#include <json-test-operations.h>
+#include <test-libmongoc.h>
 
 #ifdef _MSC_VER
 #include <io.h>
@@ -240,7 +243,6 @@ process_sdam_test_hello_responses (bson_
 
       while (bson_iter_next (&app_error_iter)) {
          uint32_t generation = 0;
-         uint32_t max_wire_version = 0;
          const char *when_str;
          bool handshake_complete = false;
          const char *type_str;
@@ -273,7 +275,6 @@ process_sdam_test_hello_responses (bson_
 
          BSON_ASSERT (bson_iter_init_find (&app_error_field_iter, &app_error, "maxWireVersion"));
          BSON_ASSERT (BSON_ITER_HOLDS_INT32 (&app_error_field_iter));
-         max_wire_version = bson_iter_int32 (&app_error_field_iter);
 
          BSON_ASSERT (bson_iter_init_find (&app_error_field_iter, &app_error, "when"));
          BSON_ASSERT (BSON_ITER_HOLDS_UTF8 (&app_error_field_iter));
@@ -307,7 +308,7 @@ process_sdam_test_hello_responses (bson_
 
          memset (&err, 0, sizeof (bson_error_t));
          _mongoc_topology_handle_app_error (
-            topology, sd->id, handshake_complete, type, &response, &err, max_wire_version, generation, &kZeroObjectId);
+            topology, sd->id, handshake_complete, type, &response, &err, generation, &kZeroObjectId);
          mc_tpld_drop_ref (&td);
       }
    }
diff -pruN 2.0.2-1/src/libmongoc/tests/json-test.h 2.1.0-1/src/libmongoc/tests/json-test.h
--- 2.0.2-1/src/libmongoc/tests/json-test.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/json-test.h	2025-08-14 18:37:23.000000000 +0000
@@ -17,14 +17,14 @@
 #ifndef JSON_TEST_H
 #define JSON_TEST_H
 
-#include "TestSuite.h"
+#include <mongoc/mongoc.h>
 
 #include <bson/bson.h>
-#include <mongoc/mongoc.h>
 
-#include "test-conveniences.h"
-#include "json-test-monitoring.h"
-#include "json-test-operations.h"
+#include <TestSuite.h>
+#include <json-test-monitoring.h>
+#include <json-test-operations.h>
+#include <test-conveniences.h>
 
 #define MAX_NUM_TESTS 150
 
@@ -51,10 +51,7 @@ typedef struct _json_test_config_t {
 } json_test_config_t;
 
 
-#define JSON_TEST_CONFIG_INIT                                      \
-   {                                                               \
-      NULL, NULL, NULL, NULL, NULL, NULL, false, false, NULL, NULL \
-   }
+#define JSON_TEST_CONFIG_INIT {NULL, NULL, NULL, NULL, NULL, NULL, false, false, NULL, NULL}
 
 bson_t *
 get_bson_from_json_file (char *filename);
diff -pruN 2.0.2-1/src/libmongoc/tests/mock_server/future-functions.c 2.1.0-1/src/libmongoc/tests/mock_server/future-functions.c
--- 2.0.2-1/src/libmongoc/tests/mock_server/future-functions.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/mock_server/future-functions.c	2025-08-14 18:37:23.000000000 +0000
@@ -23,7 +23,7 @@
 
 #include <mongoc/mongoc-topology-private.h>
 
-#include "mock_server/future-functions.h"
+#include <mock_server/future-functions.h>
 
 
 static
diff -pruN 2.0.2-1/src/libmongoc/tests/mock_server/future-functions.h 2.1.0-1/src/libmongoc/tests/mock_server/future-functions.h
--- 2.0.2-1/src/libmongoc/tests/mock_server/future-functions.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/mock_server/future-functions.h	2025-08-14 18:37:23.000000000 +0000
@@ -1,10 +1,11 @@
 #ifndef FUTURE_FUNCTIONS_H
 #define FUTURE_FUNCTIONS_H
 
-#include "mock_server/future-value.h"
-#include "mock_server/future.h"
 #include <mongoc/mongoc-bulk-operation.h>
 
+#include <mock_server/future-value.h>
+#include <mock_server/future.h>
+
 /**************************************************
  *
  * Generated by build/generate-future-functions.py.
diff -pruN 2.0.2-1/src/libmongoc/tests/mock_server/future-value.c 2.1.0-1/src/libmongoc/tests/mock_server/future-value.c
--- 2.0.2-1/src/libmongoc/tests/mock_server/future-value.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/mock_server/future-value.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,4 +1,4 @@
-#include "mock_server/future-value.h"
+#include <mock_server/future-value.h>
 
 /**************************************************
  *
diff -pruN 2.0.2-1/src/libmongoc/tests/mock_server/future-value.h 2.1.0-1/src/libmongoc/tests/mock_server/future-value.h
--- 2.0.2-1/src/libmongoc/tests/mock_server/future-value.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/mock_server/future-value.h	2025-08-14 18:37:23.000000000 +0000
@@ -1,12 +1,11 @@
 #ifndef FUTURE_VALUE_H
 #define FUTURE_VALUE_H
 
-#include <mongoc/mongoc.h>
-
-
 #include <mongoc/mongoc-cluster-private.h>
 #include <mongoc/mongoc-topology-private.h>
 
+#include <mongoc/mongoc.h>
+
 
 /**************************************************
  *
diff -pruN 2.0.2-1/src/libmongoc/tests/mock_server/future.c 2.1.0-1/src/libmongoc/tests/mock_server/future.c
--- 2.0.2-1/src/libmongoc/tests/mock_server/future.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/mock_server/future.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,9 +1,11 @@
-#include <stdio.h>
+#include <mock_server/future.h>
+
+#include "../test-libmongoc.h"
 
 #include <mongoc/mongoc-array-private.h>
 #include <mongoc/mongoc-thread-private.h>
-#include "mock_server/future.h"
-#include "../test-libmongoc.h"
+
+#include <stdio.h>
 
 /**************************************************
  *
diff -pruN 2.0.2-1/src/libmongoc/tests/mock_server/future.h 2.1.0-1/src/libmongoc/tests/mock_server/future.h
--- 2.0.2-1/src/libmongoc/tests/mock_server/future.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/mock_server/future.h	2025-08-14 18:37:23.000000000 +0000
@@ -1,10 +1,11 @@
 #ifndef FUTURE_H
 #define FUTURE_H
 
+#include <mongoc/mongoc-thread-private.h>
+
 #include <bson/bson.h>
 
-#include "mock_server/future-value.h"
-#include <mongoc/mongoc-thread-private.h>
+#include <mock_server/future-value.h>
 
 /**************************************************
  *
diff -pruN 2.0.2-1/src/libmongoc/tests/mock_server/mock-rs.c 2.1.0-1/src/libmongoc/tests/mock_server/mock-rs.c
--- 2.0.2-1/src/libmongoc/tests/mock_server/mock-rs.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/mock_server/mock-rs.c	2025-08-14 18:37:23.000000000 +0000
@@ -14,18 +14,17 @@
  * limitations under the License.
  */
 
+#include "./mock-rs.h"
+#include "./sync-queue.h"
 
-#include <bson/bson.h>
-#include <mongoc/mongoc-util-private.h>
-
+#include <common-string-private.h>
 #include <mongoc/mongoc-client-private.h>
+#include <mongoc/mongoc-util-private.h>
 
-#include "mock-rs.h"
-#include "sync-queue.h"
-#include "test-libmongoc.h"
-#include "TestSuite.h"
-#include <common-string-private.h>
+#include <bson/bson.h>
 
+#include <TestSuite.h>
+#include <test-libmongoc.h>
 
 struct _mock_rs_t {
    bool has_primary;
diff -pruN 2.0.2-1/src/libmongoc/tests/mock_server/mock-rs.h 2.1.0-1/src/libmongoc/tests/mock_server/mock-rs.h
--- 2.0.2-1/src/libmongoc/tests/mock_server/mock-rs.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/mock_server/mock-rs.h	2025-08-14 18:37:23.000000000 +0000
@@ -17,16 +17,15 @@
 #ifndef MOCK_RS_H
 #define MOCK_RS_H
 
-#include <mongoc/mongoc.h>
+#include "./mock-server.h"
 
-#include "mock-server.h"
+#include <mongoc/mongoc.h>
 
 typedef struct _mock_rs_t mock_rs_t;
 
 mock_rs_t *
 mock_rs_with_auto_hello (int32_t max_wire_version, bool has_primary, int n_secondaries, int n_arbiters);
 
-
 void
 mock_rs_tag_secondary (mock_rs_t *rs, int server_number, const bson_t *tags);
 
diff -pruN 2.0.2-1/src/libmongoc/tests/mock_server/mock-server.c 2.1.0-1/src/libmongoc/tests/mock_server/mock-server.c
--- 2.0.2-1/src/libmongoc/tests/mock_server/mock-server.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/mock_server/mock-server.c	2025-08-14 18:37:23.000000000 +0000
@@ -15,21 +15,23 @@
  */
 
 
-#include <mongoc/mongoc-client-private.h>
-#include <mongoc/mongoc.h>
+#include "../TestSuite.h"
+#include "../test-conveniences.h"
+#include "../test-libmongoc.h"
+#include "./mock-server.h"
+#include "./sync-queue.h"
 
+#include <common-json-private.h>
+#include <common-string-private.h>
 #include <mongoc/mongoc-buffer-private.h>
+#include <mongoc/mongoc-client-private.h>
 #include <mongoc/mongoc-socket-private.h>
 #include <mongoc/mongoc-thread-private.h>
-#include <mongoc/mongoc-util-private.h>
 #include <mongoc/mongoc-trace-private.h>
-#include "sync-queue.h"
-#include "mock-server.h"
-#include "../test-conveniences.h"
-#include "../test-libmongoc.h"
-#include "../TestSuite.h"
-#include <common-string-private.h>
-#include <common-json-private.h>
+#include <mongoc/mongoc-util-private.h>
+
+#include <mongoc/mongoc.h>
+
 #include <mlib/cmp.h>
 #include <mlib/intencode.h>
 
diff -pruN 2.0.2-1/src/libmongoc/tests/mock_server/mock-server.h 2.1.0-1/src/libmongoc/tests/mock_server/mock-server.h
--- 2.0.2-1/src/libmongoc/tests/mock_server/mock-server.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/mock_server/mock-server.h	2025-08-14 18:37:23.000000000 +0000
@@ -17,10 +17,10 @@
 #ifndef MOCK_SERVER_H
 #define MOCK_SERVER_H
 
-#include <bson/bson.h>
-
 #include <mongoc/mongoc-flags-private.h>
 
+#include <bson/bson.h>
+
 // mongoc_reply_flags_t represents flags for the legacy OP_REPLY protocol:
 typedef enum {
    MONGOC_REPLY_NONE = 0,
@@ -36,7 +36,7 @@ typedef enum {
 #include <mongoc/mongoc-ssl.h>
 #endif
 
-#include "request.h"
+#include "./request.h"
 
 typedef struct _mock_server_t mock_server_t;
 typedef struct _autoresponder_handle_t autoresponder_handle_t;
diff -pruN 2.0.2-1/src/libmongoc/tests/mock_server/request.c 2.1.0-1/src/libmongoc/tests/mock_server/request.c
--- 2.0.2-1/src/libmongoc/tests/mock_server/request.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/mock_server/request.c	2025-08-14 18:37:23.000000000 +0000
@@ -14,17 +14,18 @@
  * limitations under the License.
  */
 
+#include "../TestSuite.h"
+#include "../test-conveniences.h"
+#include "./mock-server.h"
 
+#include <common-json-private.h>
+#include <common-string-private.h>
 #include <mongoc/mongoc-rpc-private.h>
+
 #include <mongoc/mongoc.h>
 
-#include <mlib/intencode.h>
-#include "mock-server.h"
-#include "../test-conveniences.h"
-#include "../TestSuite.h"
-#include <common-string-private.h>
-#include <common-json-private.h>
 #include <mlib/cmp.h>
+#include <mlib/intencode.h>
 
 static bool
 is_command_ns (const char *ns);
diff -pruN 2.0.2-1/src/libmongoc/tests/mock_server/request.h 2.1.0-1/src/libmongoc/tests/mock_server/request.h
--- 2.0.2-1/src/libmongoc/tests/mock_server/request.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/mock_server/request.h	2025-08-14 18:37:23.000000000 +0000
@@ -17,15 +17,16 @@
 #ifndef REQUEST_H
 #define REQUEST_H
 
-#include <bson/bson.h>
+#include "./sync-queue.h"
+
+#include <mongoc/mongoc-array-private.h>
 #include <mongoc/mongoc-buffer-private.h>
-#include <mongoc/mcd-rpc.h>
+#include <mongoc/mongoc-rpc-private.h>
 
+#include <mongoc/mcd-rpc.h>
 #include <mongoc/mongoc.h>
 
-#include <mongoc/mongoc-array-private.h>
-#include <mongoc/mongoc-rpc-private.h>
-#include "sync-queue.h"
+#include <bson/bson.h>
 
 struct _mock_server_t; /* forward declaration */
 
@@ -44,7 +45,6 @@ typedef struct _request_t {
    sync_queue_t *replies;
 } request_t;
 
-
 request_t *
 request_new (const mongoc_buffer_t *buffer,
              int32_t msg_len,
diff -pruN 2.0.2-1/src/libmongoc/tests/mock_server/sync-queue.c 2.1.0-1/src/libmongoc/tests/mock_server/sync-queue.c
--- 2.0.2-1/src/libmongoc/tests/mock_server/sync-queue.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/mock_server/sync-queue.c	2025-08-14 18:37:23.000000000 +0000
@@ -14,19 +14,17 @@
  * limitations under the License.
  */
 
+#include "./sync-queue.h"
+
 #include <mongoc/mongoc-array-private.h>
 #include <mongoc/mongoc-thread-private.h>
 
-#include "sync-queue.h"
-
-
 struct _sync_queue_t {
    mongoc_array_t array;
    mongoc_cond_t cond;
    bson_mutex_t mutex;
 };
 
-
 sync_queue_t *
 q_new (void)
 {
@@ -48,7 +46,6 @@ q_put (sync_queue_t *q, void *item)
    bson_mutex_unlock (&q->mutex);
 }
 
-
 /* call holding the lock */
 static void *
 _get (sync_queue_t *q)
@@ -71,7 +68,6 @@ _get (sync_queue_t *q)
    return item;
 }
 
-
 void *
 q_get (sync_queue_t *q, int64_t timeout_msec)
 {
diff -pruN 2.0.2-1/src/libmongoc/tests/mock_server/sync-queue.h 2.1.0-1/src/libmongoc/tests/mock_server/sync-queue.h
--- 2.0.2-1/src/libmongoc/tests/mock_server/sync-queue.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/mock_server/sync-queue.h	2025-08-14 18:37:23.000000000 +0000
@@ -14,6 +14,7 @@
  * limitations under the License.
  */
 
+#include <inttypes.h>
 #include <stddef.h>
 
 #ifndef SYNC_QUEUE_H
diff -pruN 2.0.2-1/src/libmongoc/tests/pkg-config-import/CMakeLists.txt 2.1.0-1/src/libmongoc/tests/pkg-config-import/CMakeLists.txt
--- 2.0.2-1/src/libmongoc/tests/pkg-config-import/CMakeLists.txt	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/pkg-config-import/CMakeLists.txt	2025-08-14 18:37:23.000000000 +0000
@@ -1,4 +1,4 @@
-cmake_minimum_required(VERSION 3.15)
+cmake_minimum_required (VERSION 3.15...4.0)
 project(pkg-config-import-test LANGUAGES C)
 
 # This is a test case that tries to build against bson/mongoc using pkg-config.
diff -pruN 2.0.2-1/src/libmongoc/tests/pkg-config-import/use-bson.c 2.1.0-1/src/libmongoc/tests/pkg-config-import/use-bson.c
--- 2.0.2-1/src/libmongoc/tests/pkg-config-import/use-bson.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/pkg-config-import/use-bson.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,4 +1,5 @@
 #include <bson/bson.h>
+
 #include <stdio.h>
 
 #ifndef EXPECT_BSON_VERSION
diff -pruN 2.0.2-1/src/libmongoc/tests/pkg-config-import/use-mongoc.c 2.1.0-1/src/libmongoc/tests/pkg-config-import/use-mongoc.c
--- 2.0.2-1/src/libmongoc/tests/pkg-config-import/use-mongoc.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/pkg-config-import/use-mongoc.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,4 +1,5 @@
 #include <mongoc/mongoc.h>
+
 #include <stdio.h>
 
 #ifndef EXPECT_MONGOC_VERSION
diff -pruN 2.0.2-1/src/libmongoc/tests/ssl-test.c 2.1.0-1/src/libmongoc/tests/ssl-test.c
--- 2.0.2-1/src/libmongoc/tests/ssl-test.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/ssl-test.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,16 +1,17 @@
+#include <mongoc/mongoc-config.h>
+
 #include <bson/bson.h>
-#include <errno.h>
 
-#include <mongoc/mongoc-config.h>
+#include <errno.h>
 #ifdef MONGOC_ENABLE_SSL_OPENSSL
-#include <openssl/ssl.h>
 #include <openssl/err.h>
+#include <openssl/ssl.h>
 #endif
 
 #include <mongoc/mongoc-stream-tls.h>
 
-#include "ssl-test.h"
-#include "TestSuite.h"
+#include <TestSuite.h>
+#include <ssl-test.h>
 
 #define TIMEOUT 10 * 1000
 
diff -pruN 2.0.2-1/src/libmongoc/tests/ssl-test.h 2.1.0-1/src/libmongoc/tests/ssl-test.h
--- 2.0.2-1/src/libmongoc/tests/ssl-test.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/ssl-test.h	2025-08-14 18:37:23.000000000 +0000
@@ -1,7 +1,7 @@
-#include <mongoc/mongoc.h>
-
 #include <mongoc/mongoc-thread-private.h>
 
+#include <mongoc/mongoc.h>
+
 typedef enum ssl_test_behavior {
    SSL_TEST_BEHAVIOR_NORMAL,
    SSL_TEST_BEHAVIOR_HANGUP_AFTER_HANDSHAKE,
diff -pruN 2.0.2-1/src/libmongoc/tests/test-atlas-executor.c 2.1.0-1/src/libmongoc/tests/test-atlas-executor.c
--- 2.0.2-1/src/libmongoc/tests/test-atlas-executor.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-atlas-executor.c	1970-01-01 00:00:00.000000000 +0000
@@ -1,95 +0,0 @@
-#include "TestSuite.h"
-
-#include "unified/operation.h"
-#include "unified/runner.h"
-
-#include "json-test.h"
-#include "test-libmongoc.h"
-
-#include <bson/bson.h>
-
-#include <assert.h>
-#include <signal.h>
-#include <stdio.h>
-
-static void
-TestSuite_Init_Atlas (TestSuite *suite, int argc, char **argv)
-{
-   ASSERT_WITH_MSG (argc > 1, "test-atlas-executor requires a workload spec!");
-
-   *suite = (TestSuite){
-      .ctest_run = NULL,
-      .failing_flaky_skips = {0},
-      .flags = TEST_NOFORK,
-      .match_patterns = {0},
-      .mock_server_log = NULL,
-      .mock_server_log_buf = NULL,
-      .name = bson_strdup ("/atlas"),
-      .outfile = NULL,
-      .prgname = bson_strdup (argv[0]),
-      .silent = false,
-      .tests = NULL,
-   };
-}
-
-// Used to ensure that repeated SIGINT are not ignored.
-void (*original_sigint_handler) (int) = NULL;
-
-static void
-sigint_handler (int sigint)
-{
-   BSON_ASSERT (sigint == SIGINT);
-   operation_loop_terminated = true;
-   signal (SIGINT, original_sigint_handler);
-}
-
-static void
-TestSuite_Run_Atlas (TestSuite *suite)
-{
-   BSON_ASSERT_PARAM (suite);
-
-   Test *const test = suite->tests;
-
-   ASSERT_WITH_MSG (test, "missing expected test in test suite");
-   ASSERT_WITH_MSG (!test->next, "expected exactly one test in test suite");
-
-   original_sigint_handler = signal (SIGINT, sigint_handler);
-
-   srand (test->seed);
-
-   test_conveniences_init ();
-   test->func (test->ctx);
-   test_conveniences_cleanup ();
-
-   capture_logs (false);
-}
-
-static void
-bson_destroy_vp (void *vp)
-{
-   bson_destroy ((bson_t *) vp);
-}
-
-int
-main (int argc, char **argv)
-{
-   ASSERT_WITH_MSG (argc > 1, "test-atlas-executor requires a workload spec!");
-
-   TestSuite suite = {0};
-   TestSuite_Init_Atlas (&suite, argc, argv);
-
-   bson_error_t error;
-   bson_t *const bson = bson_new_from_json ((const uint8_t *) argv[1], -1, &error);
-   ASSERT_OR_PRINT (bson, error);
-
-   TestSuite_AddFull (
-      &suite, "test", (TestFuncWC) &run_one_test_file, &bson_destroy_vp, bson, TestSuite_CheckLive, NULL);
-
-   mongoc_init ();
-   TestSuite_Run_Atlas (&suite);
-   mongoc_cleanup ();
-
-   TestSuite_Destroy (&suite);
-
-   return 0;
-}
diff -pruN 2.0.2-1/src/libmongoc/tests/test-awsauth.c 2.1.0-1/src/libmongoc/tests/test-awsauth.c
--- 2.0.2-1/src/libmongoc/tests/test-awsauth.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-awsauth.c	2025-08-14 18:37:23.000000000 +0000
@@ -18,11 +18,12 @@
 // It may be run in an AWS ECS task or EC2 instance.
 
 #include <common-thread-private.h>
-#include <mongoc/mongoc.h>
-#include <mongoc/mongoc-cluster-aws-private.h>
 #include <mongoc/mongoc-client-private.h>
+#include <mongoc/mongoc-cluster-aws-private.h>
 #include <mongoc/mongoc-util-private.h> // _mongoc_getenv
 
+#include <mongoc/mongoc.h>
+
 // Ensure stdout and stderr are flushed prior to possible following abort().
 #define MONGOC_STDERR_PRINTF(format, ...)    \
    if (1) {                                  \
diff -pruN 2.0.2-1/src/libmongoc/tests/test-conveniences.c 2.1.0-1/src/libmongoc/tests/test-conveniences.c
--- 2.0.2-1/src/libmongoc/tests/test-conveniences.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-conveniences.c	2025-08-14 18:37:23.000000000 +0000
@@ -15,21 +15,21 @@
  */
 
 
-#include <bson/bson.h>
+#include <mongoc/mongoc-array-private.h>
 
 #include <bson/bson-types.h>
-
-#include <mongoc/mongoc-array-private.h>
+#include <bson/bson.h>
 /* For strcasecmp on Windows */
+#include <mongoc/mongoc-client-private.h>
+#include <mongoc/mongoc-cluster-private.h>
 #include <mongoc/mongoc-util-private.h>
-#include <mongoc/mongoc-write-concern.h>
 #include <mongoc/mongoc-write-concern-private.h>
-#include <mongoc/mongoc-cluster-private.h>
-#include <mongoc/mongoc-client-private.h>
 
-#include "test-conveniences.h"
-#include "test-libmongoc.h"
-#include "TestSuite.h"
+#include <mongoc/mongoc-write-concern.h>
+
+#include <TestSuite.h>
+#include <test-conveniences.h>
+#include <test-libmongoc.h>
 
 #ifdef BSON_HAVE_STRINGS_H
 #include <strings.h>
@@ -867,7 +867,7 @@ match_bson_with_ctx (const bson_t *doc,
    bson_type_t bson_type = (bson_type_t) 0;
    bool found;
    bson_iter_t doc_iter;
-   bson_value_t doc_value;
+   bson_value_t doc_value = {0};
    match_ctx_t derived;
 
    if (bson_empty0 (pattern)) {
@@ -910,6 +910,7 @@ match_bson_with_ctx (const bson_t *doc,
          ASSERT (action == MATCH_ACTION_CONTINUE);
       }
 
+      // `doc_value` is set by `bson_value_copy` above and guarded by `found`.
       if (value->value_type == BSON_TYPE_NULL && found) {
          /* pattern has "key": null, and "key" is in doc */
          if (doc_value.value_type != BSON_TYPE_NULL) {
diff -pruN 2.0.2-1/src/libmongoc/tests/test-conveniences.h 2.1.0-1/src/libmongoc/tests/test-conveniences.h
--- 2.0.2-1/src/libmongoc/tests/test-conveniences.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-conveniences.h	2025-08-14 18:37:23.000000000 +0000
@@ -17,11 +17,12 @@
 #ifndef TEST_CONVENIENCES_H
 #define TEST_CONVENIENCES_H
 
-#include <bson/bson.h>
+#include <mongoc/mongoc-client-private.h>
+#include <mongoc/mongoc-read-prefs-private.h>
 
 #include <mongoc/mongoc.h>
-#include <mongoc/mongoc-read-prefs-private.h>
-#include <mongoc/mongoc-client-private.h>
+
+#include <bson/bson.h>
 
 /* TODO: split this header up.
  * Move bson_lookup_* functions under bsonutil.
@@ -296,6 +297,6 @@ semver_to_string (semver_t *str);
 /* An arbitrary traceable mongoc_ss_log_context_t for tests.
  * Logs the function name and file:line as the "operation". */
 #define TEST_SS_LOG_CONTEXT \
-   (&(mongoc_ss_log_context_t){.operation = tmp_str ("%s:%d: %s", __FILE__, (int) __LINE__, BSON_FUNC)})
+   (&(mongoc_ss_log_context_t) {.operation = tmp_str ("%s:%d: %s", __FILE__, (int) __LINE__, BSON_FUNC)})
 
 #endif /* TEST_CONVENIENCES_H */
diff -pruN 2.0.2-1/src/libmongoc/tests/test-gcpkms.c 2.1.0-1/src/libmongoc/tests/test-gcpkms.c
--- 2.0.2-1/src/libmongoc/tests/test-gcpkms.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-gcpkms.c	2025-08-14 18:37:23.000000000 +0000
@@ -14,12 +14,13 @@
  * limitations under the License.
  */
 
-#include <mongoc/mongoc.h>
-#include "TestSuite.h"
-#include "test-libmongoc.h"
-#include <mongoc/mongoc.h>
 #include <mongoc/mongoc-http-private.h>
+
 #include <mongoc/mongoc-uri.h>
+#include <mongoc/mongoc.h>
+
+#include <TestSuite.h>
+#include <test-libmongoc.h>
 
 
 int
diff -pruN 2.0.2-1/src/libmongoc/tests/test-happy-eyeballs.c 2.1.0-1/src/libmongoc/tests/test-happy-eyeballs.c
--- 2.0.2-1/src/libmongoc/tests/test-happy-eyeballs.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-happy-eyeballs.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,16 +1,16 @@
-#include <mongoc/mongoc.h>
-#include <mongoc/mongoc-socket-private.h>
+#include <common-oid-private.h>
+#include <mongoc/mongoc-client-private.h>
 #include <mongoc/mongoc-host-list-private.h>
-#include <mongoc/mongoc-util-private.h>
+#include <mongoc/mongoc-socket-private.h>
 #include <mongoc/mongoc-stream-private.h>
-#include <mongoc/utlist.h>
+#include <mongoc/mongoc-util-private.h>
 
-#include <mongoc/mongoc-client-private.h>
-#include "common-oid-private.h"
+#include <mongoc/mongoc.h>
+#include <mongoc/utlist.h>
 
-#include "TestSuite.h"
-#include "mock_server/mock-server.h"
-#include "test-libmongoc.h"
+#include <TestSuite.h>
+#include <mock_server/mock-server.h>
+#include <test-libmongoc.h>
 
 #define TIMEOUT 20000 /* milliseconds */
 
@@ -342,35 +342,17 @@ _testcase_run (he_testcase_t *testcase)
    _check_stream (node->stream, expected->conn_succeeds_to, "checking client's final connection");
 }
 
-#define CLIENT(client) \
-   {                   \
-      #client          \
-   }
+#define CLIENT(client) {#client}
 
-#define CLIENT_WITH_DNS_CACHE_TIMEOUT(type, timeout) \
-   {                                                 \
-      #type, timeout                                 \
-   }
+#define CLIENT_WITH_DNS_CACHE_TIMEOUT(type, timeout) {#type, timeout}
 #define HANGUP true
 #define LISTEN false
-#define SERVER(type, hangup) \
-   {                         \
-      #type, hangup          \
-   }
-#define DELAYED_SERVER(type, hangup, delay) \
-   {                                        \
-      #type, hangup, delay                  \
-   }
-#define SERVERS(...) \
-   {                 \
-      __VA_ARGS__    \
-   }
+#define SERVER(type, hangup) {#type, hangup}
+#define DELAYED_SERVER(type, hangup, delay) {#type, hangup, delay}
+#define SERVERS(...) {__VA_ARGS__}
 #define DELAY_MS(val) val
 #define DURATION_MS(min, max) (min), (max)
-#define EXPECT(type, num_acmds, duration) \
-   {                                      \
-      #type, num_acmds, duration          \
-   }
+#define EXPECT(type, num_acmds, duration) {#type, num_acmds, duration}
 #define NCMDS(n) (n)
 
 static void
diff -pruN 2.0.2-1/src/libmongoc/tests/test-libmongoc-main.c 2.1.0-1/src/libmongoc/tests/test-libmongoc-main.c
--- 2.0.2-1/src/libmongoc/tests/test-libmongoc-main.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-libmongoc-main.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,27 +1,30 @@
-#include <bson/bson.h>
+#include <common-thread-private.h>
+
 #include <mongoc/mongoc.h>
 
-#include <common-thread-private.h>
+#include <bson/bson.h>
 
-#include "test-libmongoc.h"
-#include "TestSuite.h"
-#include "test-conveniences.h"
+#include <TestSuite.h>
+#include <test-conveniences.h>
+#include <test-libmongoc.h>
 
 int
 main (int argc, char *argv[])
 {
    TestSuite suite;
-   int ret;
 
-   test_libmongoc_init (&suite, "libmongoc", argc, argv);
+   test_libmongoc_init (&suite, argc, argv);
 
    /* libbson */
 
-#define TEST_INSTALL(FuncName)                 \
-   if (1) {                                    \
-      extern void FuncName (TestSuite *suite); \
-      FuncName (&suite);                       \
-   } else                                      \
+#define TEST_INSTALL(FuncName)                  \
+   if (1) {                                     \
+      mlib_diagnostic_push ();                  \
+      mlib_msvc_warning (disable : 4210);       \
+      extern void FuncName (TestSuite * suite); \
+      mlib_diagnostic_pop ();                   \
+      FuncName (&suite);                        \
+   } else                                       \
       ((void) 0)
 
    TEST_INSTALL (test_bcon_basic_install);
@@ -158,8 +161,10 @@ main (int argc, char *argv[])
    TEST_INSTALL (test_service_gcp_install);
    TEST_INSTALL (test_mcd_nsinfo_install);
    TEST_INSTALL (test_bulkwrite_install);
+   TEST_INSTALL (test_mongoc_oidc_callback_install);
+   TEST_INSTALL (test_secure_channel_install);
 
-   ret = TestSuite_Run (&suite);
+   const int ret = TestSuite_Run (&suite);
 
    test_libmongoc_destroy (&suite);
 
diff -pruN 2.0.2-1/src/libmongoc/tests/test-libmongoc.c 2.1.0-1/src/libmongoc/tests/test-libmongoc.c
--- 2.0.2-1/src/libmongoc/tests/test-libmongoc.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-libmongoc.c	2025-08-14 18:37:23.000000000 +0000
@@ -15,23 +15,25 @@
  */
 
 
-#include <bson/bson.h>
-#include <mongoc/mongoc.h>
-#include <mongoc/mongoc-host-list-private.h>
+#include <test-libmongoc.h>
 
-#include <mongoc/mongoc-server-description.h>
+#include <common-atomic-private.h>
+#include <common-string-private.h>
+#include <mongoc/mongoc-client-private.h>
+#include <mongoc/mongoc-host-list-private.h>
+#include <mongoc/mongoc-linux-distro-scanner-private.h>
 #include <mongoc/mongoc-server-description-private.h>
 #include <mongoc/mongoc-topology-private.h>
-#include <mongoc/mongoc-client-private.h>
 #include <mongoc/mongoc-uri-private.h>
 #include <mongoc/mongoc-util-private.h>
-#include <mongoc/mongoc-linux-distro-scanner-private.h>
 
-#include "TestSuite.h"
-#include "test-conveniences.h"
-#include "test-libmongoc.h"
-#include <common-string-private.h>
-#include <common-atomic-private.h>
+#include <mongoc/mongoc-server-description.h>
+#include <mongoc/mongoc.h>
+
+#include <bson/bson.h>
+
+#include <TestSuite.h>
+#include <test-conveniences.h>
 
 #ifdef BSON_HAVE_STRINGS_H
 #include <strings.h>
@@ -1072,8 +1074,8 @@ test_framework_get_uri_str_no_auth (cons
       bson_free (compressors);
    }
 
-   // Required by test-atlas-executor. Not required by normal unified test
-   // runner, but make tests a little more resilient to transient errors.
+   // Setting this by default makes tests a little more resilient to transient errors and more consistent with other
+   // non-single-threaded Drivers which implicitly set this by default.
    add_option_to_uri_str (&uri_string, MONGOC_URI_SERVERSELECTIONTRYONCE, "false");
 
    return mcommon_string_from_append_destroy_with_steal (&uri_string);
@@ -1099,17 +1101,9 @@ test_framework_get_uri_str_no_auth (cons
 char *
 test_framework_get_uri_str (void)
 {
-   char *uri_str_no_auth;
-   char *uri_str;
-
-   if (test_framework_getenv_bool ("MONGOC_TEST_ATLAS")) {
-      // User and password is already embedded in URI.
-      return test_framework_get_uri_str_no_auth (NULL);
-   } else {
-      /* no_auth also contains compressors. */
-      uri_str_no_auth = test_framework_get_uri_str_no_auth (NULL);
-      uri_str = test_framework_add_user_password_from_env (uri_str_no_auth);
-   }
+   /* no_auth also contains compressors. */
+   char *const uri_str_no_auth = test_framework_get_uri_str_no_auth (NULL);
+   char *const uri_str = test_framework_add_user_password_from_env (uri_str_no_auth);
 
    bson_free (uri_str_no_auth);
 
@@ -1984,12 +1978,14 @@ int
 test_framework_skip_if_no_txns (void)
 {
    if (test_framework_skip_if_no_crypto () && test_framework_skip_if_no_sessions () &&
-       test_framework_skip_if_not_replset () && test_framework_skip_if_max_wire_version_less_than_7 ()) {
+       test_framework_skip_if_not_replset ()) {
+      // Have crypto, sessions, and replica set. Proceed.
       return 1;
    }
 
    if (test_framework_skip_if_no_crypto () && test_framework_skip_if_no_sessions () &&
-       test_framework_skip_if_not_mongos () && test_framework_skip_if_max_wire_version_less_than_8 ()) {
+       test_framework_skip_if_not_mongos ()) {
+      // Have crypto, sessions, and sharded cluster. Proceed.
       return 1;
    }
 
@@ -2252,8 +2248,9 @@ test_framework_skip_if_not_replset (void
       return (test_framework_max_wire_version_at_least (wv) && test_framework_is_replset ()) ? 0 : 1; \
    }
 
-WIRE_VERSION_CHECKS (7)
+/* wire version 8 begins with the 4.2 release. */
 WIRE_VERSION_CHECKS (8)
+/* wire version 9 begins with the 4.4 release. */
 WIRE_VERSION_CHECKS (9)
 /* wire versions 10, 11, 12 were internal to the 5.0 release cycle */
 WIRE_VERSION_CHECKS (13)
@@ -2550,7 +2547,7 @@ windows_exception_handler (EXCEPTION_POI
 
 
 void
-test_libmongoc_init (TestSuite *suite, BSON_MAYBE_UNUSED const char *name, int argc, char **argv)
+test_libmongoc_init (TestSuite *suite, int argc, char **argv)
 {
 #if defined(_MSC_VER) && defined(_WIN64)
    SetUnhandledExceptionFilter (windows_exception_handler);
diff -pruN 2.0.2-1/src/libmongoc/tests/test-libmongoc.h 2.1.0-1/src/libmongoc/tests/test-libmongoc.h
--- 2.0.2-1/src/libmongoc/tests/test-libmongoc.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-libmongoc.h	2025-08-14 18:37:23.000000000 +0000
@@ -14,22 +14,22 @@
  * limitations under the License.
  */
 
-
 #ifndef TEST_LIBMONGOC_H
 #define TEST_LIBMONGOC_H
 
+#include <mongoc/mongoc.h>
+
+#include <stdbool.h>
 
 struct _TestSuite;
 struct _bson_t;
 struct _server_version_t;
 
-
 void
-test_libmongoc_init (struct _TestSuite *suite, const char *name, int argc, char **argv);
+test_libmongoc_init (struct _TestSuite *suite, int argc, char **argv);
 void
 test_libmongoc_destroy (struct _TestSuite *suite);
 
-
 mongoc_database_t *
 get_test_database (mongoc_client_t *client);
 char *
@@ -195,8 +195,9 @@ test_framework_skip_if_slow_or_live (voi
    int test_framework_skip_if_rs_version_##wv (void);                 \
    int test_framework_skip_if_not_rs_version_##wv (void);
 
-WIRE_VERSION_CHECK_DECLS (7)
+/* wire version 8 begins with the 4.2 release. */
 WIRE_VERSION_CHECK_DECLS (8)
+/* wire version 9 begins with the 4.4 release. */
 WIRE_VERSION_CHECK_DECLS (9)
 /* wire versions 10, 11, 12 were internal to the 5.0 release cycle */
 WIRE_VERSION_CHECK_DECLS (13)
@@ -287,13 +288,14 @@ test_framework_skip_if_serverless (void)
 bool
 test_framework_is_loadbalanced (void);
 
-// `test_framework_skip_if_no_server_ssl` skips if test runner was not told to connect to the server with SSL.
+// `test_framework_skip_if_no_server_ssl` skips if test runner was not told to
+// connect to the server with SSL.
 int
 test_framework_skip_if_no_server_ssl (void);
 
-
 // `skip_if_no_large_allocations` skip tests requiring large allocations.
-// Large allocations were observed to fail when run with TSan, and are time consuming with ASan.
+// Large allocations were observed to fail when run with TSan, and are time
+// consuming with ASan.
 int
 skip_if_no_large_allocations (void);
 
diff -pruN 2.0.2-1/src/libmongoc/tests/test-mcd-azure-imds.c 2.1.0-1/src/libmongoc/tests/test-mcd-azure-imds.c
--- 2.0.2-1/src/libmongoc/tests/test-mcd-azure-imds.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-mcd-azure-imds.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,9 +1,9 @@
-#include <mongoc/mcd-azure.h>
-
+#include <common-string-private.h>
 #include <mongoc/mongoc-host-list-private.h>
 
-#include "TestSuite.h"
-#include <common-string-private.h>
+#include <mongoc/mcd-azure.h>
+
+#include <TestSuite.h>
 
 #define RAW_STRING(...) #__VA_ARGS__
 
@@ -22,7 +22,7 @@ _test_oauth_parse (void)
    ASSERT (!mcd_azure_access_token_try_init_from_json_str (&token, RAW_STRING ({"access_token" : null}), -1, &error));
    ASSERT_ERROR_CONTAINS (error, MONGOC_ERROR_AZURE, MONGOC_ERROR_KMS_SERVER_BAD_JSON, "");
 
-   error = (bson_error_t){0};
+   error = (bson_error_t) {0};
    ASSERT (mcd_azure_access_token_try_init_from_json_str (
       &token,
       RAW_STRING ({"access_token" : "meow", "resource" : "something", "expires_in" : "1234", "token_type" : "Bearer"}),
diff -pruN 2.0.2-1/src/libmongoc/tests/test-mcd-integer.c 2.1.0-1/src/libmongoc/tests/test-mcd-integer.c
--- 2.0.2-1/src/libmongoc/tests/test-mcd-integer.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-mcd-integer.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,6 +1,6 @@
 #include <mongoc/mcd-integer.h>
 
-#include "TestSuite.h"
+#include <TestSuite.h>
 
 static void
 _test_overflow (void)
diff -pruN 2.0.2-1/src/libmongoc/tests/test-mcd-nsinfo.c 2.1.0-1/src/libmongoc/tests/test-mcd-nsinfo.c
--- 2.0.2-1/src/libmongoc/tests/test-mcd-nsinfo.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-mcd-nsinfo.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,7 +1,7 @@
 #include <mongoc/mcd-nsinfo.h>
 
-#include "TestSuite.h"
-#include "test-conveniences.h" // ASSERT_MATCH
+#include <TestSuite.h>
+#include <test-conveniences.h> // ASSERT_MATCH
 
 static void
 test_nsinfo_works (void)
diff -pruN 2.0.2-1/src/libmongoc/tests/test-mcd-rpc.c 2.1.0-1/src/libmongoc/tests/test-mcd-rpc.c
--- 2.0.2-1/src/libmongoc/tests/test-mcd-rpc.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-mcd-rpc.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,13 +1,13 @@
 #include <mongoc/mcd-rpc.h>
-
 #include <mongoc/mongoc-iovec.h>
+
+#include <mlib/cmp.h>
 #include <mlib/intencode.h>
 
-#include "test-conveniences.h"
-#include "TestSuite.h"
+#include <TestSuite.h>
+#include <test-conveniences.h>
 
 #include <inttypes.h>
-#include <mlib/cmp.h>
 
 
 // clang-format off
diff -pruN 2.0.2-1/src/libmongoc/tests/test-mongoc-aggregate.c 2.1.0-1/src/libmongoc/tests/test-mongoc-aggregate.c
--- 2.0.2-1/src/libmongoc/tests/test-mongoc-aggregate.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-mongoc-aggregate.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,13 +1,15 @@
-#include <mongoc/mongoc.h>
 #include <mongoc/mongoc-client-private.h>
+
+#include <mongoc/mongoc.h>
+
 #include <mlib/loop.h>
 
-#include "TestSuite.h"
-#include "mock_server/mock-server.h"
-#include "mock_server/future.h"
-#include "mock_server/future-functions.h"
-#include "test-conveniences.h"
-#include "test-libmongoc.h"
+#include <TestSuite.h>
+#include <mock_server/future-functions.h>
+#include <mock_server/future.h>
+#include <mock_server/mock-server.h>
+#include <test-conveniences.h>
+#include <test-libmongoc.h>
 
 static void
 _test_query_flag (mongoc_query_flags_t flag, bson_t *opt)
diff -pruN 2.0.2-1/src/libmongoc/tests/test-mongoc-array.c 2.1.0-1/src/libmongoc/tests/test-mongoc-array.c
--- 2.0.2-1/src/libmongoc/tests/test-mongoc-array.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-mongoc-array.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,5 +1,6 @@
 #include <mongoc/mongoc-array-private.h>
-#include "TestSuite.h"
+
+#include <TestSuite.h>
 
 
 static void
diff -pruN 2.0.2-1/src/libmongoc/tests/test-mongoc-async.c 2.1.0-1/src/libmongoc/tests/test-mongoc-async.c
--- 2.0.2-1/src/libmongoc/tests/test-mongoc-async.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-mongoc-async.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,14 +1,15 @@
-#include <mongoc/mongoc.h>
-#include <mongoc/mongoc-client-private.h>
-
-#include <mongoc/mongoc-util-private.h>
-#include <mongoc/mongoc-async-private.h>
 #include <mongoc/mongoc-async-cmd-private.h>
-#include "TestSuite.h"
-#include "mock_server/mock-server.h"
-#include "mock_server/future-functions.h"
+#include <mongoc/mongoc-async-private.h>
+#include <mongoc/mongoc-client-private.h>
 #include <mongoc/mongoc-errno-private.h>
-#include "test-libmongoc.h"
+#include <mongoc/mongoc-util-private.h>
+
+#include <mongoc/mongoc.h>
+
+#include <TestSuite.h>
+#include <mock_server/future-functions.h>
+#include <mock_server/mock-server.h>
+#include <test-libmongoc.h>
 
 #define TIMEOUT 10000 /* milliseconds */
 #define NSERVERS 10
@@ -214,6 +215,8 @@ test_large_hello_helper (mongoc_async_cm
                          const bson_t *bson,
                          int64_t duration_usec)
 {
+   BSON_UNUSED (duration_usec);
+
    bson_iter_t iter;
    bson_error_t *error = &acmd->error;
 
@@ -235,6 +238,8 @@ test_large_hello_helper (mongoc_async_cm
 static void
 test_large_hello (void *ctx)
 {
+   BSON_UNUSED (ctx);
+
    mongoc_async_t *async;
    mongoc_stream_t *sock_stream;
    bson_t q = BSON_INITIALIZER;
diff -pruN 2.0.2-1/src/libmongoc/tests/test-mongoc-aws.c 2.1.0-1/src/libmongoc/tests/test-mongoc-aws.c
--- 2.0.2-1/src/libmongoc/tests/test-mongoc-aws.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-mongoc-aws.c	2025-08-14 18:37:23.000000000 +0000
@@ -13,10 +13,11 @@
  * License.
  */
 
-#include "TestSuite.h"
-#include "test-libmongoc.h"
 #include <mongoc/mongoc-cluster-aws-private.h>
 
+#include <TestSuite.h>
+#include <test-libmongoc.h>
+
 static void
 test_obtain_credentials (void *unused)
 {
diff -pruN 2.0.2-1/src/libmongoc/tests/test-mongoc-background-monitoring.c 2.1.0-1/src/libmongoc/tests/test-mongoc-background-monitoring.c
--- 2.0.2-1/src/libmongoc/tests/test-mongoc-background-monitoring.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-mongoc-background-monitoring.c	2025-08-14 18:37:23.000000000 +0000
@@ -14,8 +14,7 @@
  * limitations under the License.
  */
 
-#include "mock_server/mock-server.h"
-#include <mongoc/mongoc.h>
+#include <common-string-private.h>
 #include <mongoc/mongoc-client-pool-private.h>
 #include <mongoc/mongoc-client-private.h>
 #include <mongoc/mongoc-handshake-private.h>
@@ -23,10 +22,13 @@
 #include <mongoc/mongoc-topology-background-monitoring-private.h>
 #include <mongoc/mongoc-topology-description-private.h>
 #include <mongoc/mongoc-topology-private.h>
-#include "test-conveniences.h"
-#include "test-libmongoc.h"
-#include "TestSuite.h"
-#include <common-string-private.h>
+
+#include <mongoc/mongoc.h>
+
+#include <TestSuite.h>
+#include <mock_server/mock-server.h>
+#include <test-conveniences.h>
+#include <test-libmongoc.h>
 
 #include <inttypes.h>
 
diff -pruN 2.0.2-1/src/libmongoc/tests/test-mongoc-buffer.c 2.1.0-1/src/libmongoc/tests/test-mongoc-buffer.c
--- 2.0.2-1/src/libmongoc/tests/test-mongoc-buffer.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-mongoc-buffer.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,8 +1,10 @@
-#include <fcntl.h>
-#include <mongoc/mongoc.h>
 #include <mongoc/mongoc-buffer-private.h>
 
-#include "TestSuite.h"
+#include <mongoc/mongoc.h>
+
+#include <TestSuite.h>
+
+#include <fcntl.h>
 
 
 static void
diff -pruN 2.0.2-1/src/libmongoc/tests/test-mongoc-bulk.c 2.1.0-1/src/libmongoc/tests/test-mongoc-bulk.c
--- 2.0.2-1/src/libmongoc/tests/test-mongoc-bulk.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-mongoc-bulk.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,19 +1,20 @@
-#include <mongoc/mongoc.h>
 #include <mongoc/mongoc-bulk-operation-private.h>
 #include <mongoc/mongoc-client-private.h>
-#include <mongoc/mongoc-cursor-private.h>
 #include <mongoc/mongoc-collection-private.h>
+#include <mongoc/mongoc-cursor-private.h>
 #include <mongoc/mongoc-util-private.h>
 
-#include "TestSuite.h"
+#include <mongoc/mongoc.h>
 
-#include "test-libmongoc.h"
-#include "mock_server/future-functions.h"
-#include "mock_server/mock-server.h"
-#include "test-conveniences.h"
-#include "mock_server/mock-rs.h"
 #include <mlib/cmp.h>
 
+#include <TestSuite.h>
+#include <mock_server/future-functions.h>
+#include <mock_server/mock-rs.h>
+#include <mock_server/mock-server.h>
+#include <test-conveniences.h>
+#include <test-libmongoc.h>
+
 
 typedef void (*update_fn) (mongoc_bulk_operation_t *bulk, const bson_t *selector, const bson_t *document, bool upsert);
 
@@ -4113,9 +4114,9 @@ _test_bulk_collation (bool w, bulkop op)
    request_t *request;
    future_t *future;
    bson_t *opts;
-   const char *expect_msg;
-   const char *expect_doc;
-   bool r;
+   const char *expect_msg = NULL;
+   const char *expect_doc = NULL;
+   bool r = false;
 
    mock_server = mock_server_with_auto_hello (WIRE_VERSION_MIN);
    mock_server_run (mock_server);
@@ -4467,9 +4468,9 @@ _test_bulk_let (bulkop op)
    bson_error_t error;
    request_t *request;
    future_t *future;
-   const char *expect_msg;
-   const char *expect_doc;
-   bool r;
+   const char *expect_msg = NULL;
+   const char *expect_doc = NULL;
+   bool r = false;
 
    mock_server = mock_server_with_auto_hello (WIRE_VERSION_MIN);
    mock_server_run (mock_server);
@@ -4978,9 +4979,7 @@ test_bulk_install (TestSuite *suite)
                       test_bulk_write_multiple_errors,
                       NULL,
                       NULL,
-                      test_framework_skip_if_no_failpoint,
-                      /* Require server 4.2 for failCommand appName */
-                      test_framework_skip_if_max_wire_version_less_than_8);
+                      test_framework_skip_if_no_failpoint);
    TestSuite_AddLive (suite, "/BulkOperation/set_client_after_operation", test_bulk_write_set_client_after_operation);
    TestSuite_AddMockServerTest (suite,
                                 "/BulkOperation/set_client_updates_operation_id_when_client_changes",
diff -pruN 2.0.2-1/src/libmongoc/tests/test-mongoc-bulkwrite.c 2.1.0-1/src/libmongoc/tests/test-mongoc-bulkwrite.c
--- 2.0.2-1/src/libmongoc/tests/test-mongoc-bulkwrite.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-mongoc-bulkwrite.c	2025-08-14 18:37:23.000000000 +0000
@@ -17,11 +17,12 @@
 // This file includes tests `mongoc_bulkwrite_t` for basic usage and libmongoc-specific behavior.
 // The specification tests (prose and JSON) include more coverage of driver-agnostic behavior.
 
+#include <mongoc/mongoc-bulkwrite.h>
 #include <mongoc/mongoc.h>
-#include <test-libmongoc.h>
+
 #include <TestSuite.h>
 #include <test-conveniences.h>
-#include <mongoc/mongoc-bulkwrite.h>
+#include <test-libmongoc.h>
 
 static void
 test_bulkwrite_insert (void *unused)
diff -pruN 2.0.2-1/src/libmongoc/tests/test-mongoc-cache.c 2.1.0-1/src/libmongoc/tests/test-mongoc-cache.c
--- 2.0.2-1/src/libmongoc/tests/test-mongoc-cache.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-mongoc-cache.c	2025-08-14 18:37:23.000000000 +0000
@@ -19,9 +19,11 @@
 #if defined(__linux__)
 
 #include <mongoc/mongoc.h>
-#include <stdio.h>
+
+#include <TestSuite.h>
+
 #include <signal.h>
-#include "TestSuite.h"
+#include <stdio.h>
 
 #ifndef SIGSTOP
 #define SIGSTOP 19
@@ -68,6 +70,9 @@ ping (void)
 int
 main (int argc, char *argv[])
 {
+   (void) argc;
+   (void) argv;
+
 #if defined(__linux__)
    if (argc != 2) {
       fprintf (stderr, "usage: %s CA_FILE_PATH\n", argv[0]);
diff -pruN 2.0.2-1/src/libmongoc/tests/test-mongoc-change-stream.c 2.1.0-1/src/libmongoc/tests/test-mongoc-change-stream.c
--- 2.0.2-1/src/libmongoc/tests/test-mongoc-change-stream.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-mongoc-change-stream.c	2025-08-14 18:37:23.000000000 +0000
@@ -14,18 +14,20 @@
  * limitations under the License.
  */
 
-#include <mongoc/mongoc.h>
-#include <mongoc/mongoc-client-private.h>
-#include "mock_server/mock-server.h"
-#include "mock_server/future.h"
-#include "mock_server/future-functions.h"
 #include <mongoc/mongoc-change-stream-private.h>
+#include <mongoc/mongoc-client-private.h>
 #include <mongoc/mongoc-cursor-private.h>
-#include "test-conveniences.h"
-#include "test-libmongoc.h"
-#include "TestSuite.h"
-#include "json-test.h"
-#include "json-test-operations.h"
+
+#include <mongoc/mongoc.h>
+
+#include <TestSuite.h>
+#include <json-test-operations.h>
+#include <json-test.h>
+#include <mock_server/future-functions.h>
+#include <mock_server/future.h>
+#include <mock_server/mock-server.h>
+#include <test-conveniences.h>
+#include <test-libmongoc.h>
 
 #define DESTROY_CHANGE_STREAM(cursor_id)                                                                              \
    do {                                                                                                               \
@@ -68,16 +70,6 @@ _setup_for_resume (mongoc_change_stream_
    ASSERT_OR_PRINT (ret, error);
 }
 
-
-static int
-test_framework_skip_if_not_single_version_5 (void)
-{
-   if (!TestSuite_CheckLive ()) {
-      return 0;
-   }
-   return (!test_framework_is_replset () && !test_framework_is_mongos ()) ? 1 : 0;
-}
-
 static mongoc_collection_t *
 drop_and_get_coll (mongoc_client_t *client, const char *db_name, const char *coll_name)
 {
@@ -715,6 +707,11 @@ test_change_stream_resumable_error (void
    reply_to_request_simple (request, not_primary_err);
    request_destroy (request);
 
+   /* The "not primary" error does not cause the client to close connection. Expect a killCursors. */
+   request = mock_server_receives_msg (
+      server, MONGOC_MSG_NONE, tmp_bson ("{ 'killCursors' : 'coll', 'cursors' : [ { '$numberLong': '124' } ] }"));
+   reply_to_request_with_ok_and_destroy (request);
+
    /* Retry command */
    request = mock_server_receives_msg (server, MONGOC_MSG_NONE, watch_cmd);
    reply_to_request_simple (request, "{'cursor': {'id': 125, 'ns': 'db.coll','firstBatch': []},'ok': 1}");
@@ -724,6 +721,11 @@ test_change_stream_resumable_error (void
    reply_to_request_simple (request, not_primary_err);
    request_destroy (request);
 
+   /* The "not primary" error does not cause the client to close connection. Expect a killCursors. */
+   request = mock_server_receives_msg (
+      server, MONGOC_MSG_NONE, tmp_bson ("{ 'killCursors' : 'coll', 'cursors' : [ { '$numberLong': '125' } ] }"));
+   reply_to_request_with_ok_and_destroy (request);
+
    /* Retry command */
    request = mock_server_receives_msg (server, MONGOC_MSG_NONE, watch_cmd);
    reply_to_request_simple (request,
@@ -762,6 +764,11 @@ test_change_stream_resumable_error (void
    reply_to_request_simple (request, "{ 'code': 10107, 'errmsg': 'not primary', 'ok': 0 }");
    request_destroy (request);
 
+   /* The "not primary" error does not cause the client to close connection. Expect a killCursors. */
+   request = mock_server_receives_msg (
+      server, MONGOC_MSG_NONE, tmp_bson ("{ 'killCursors' : 'coll', 'cursors' : [ { '$numberLong': '123' } ] }"));
+   reply_to_request_with_ok_and_destroy (request);
+
    /* Retry command */
    request = mock_server_receives_msg (server, MONGOC_MSG_NONE, watch_cmd);
    reply_to_request_simple (request, "{'code': 123, 'errmsg': 'bad cmd', 'ok': 0}");
@@ -1165,91 +1172,7 @@ typedef struct {
    bson_t agg_reply;
 } resume_ctx_t;
 
-#define RESUME_INITIALIZER           \
-   {                                 \
-      false, false, BSON_INITIALIZER \
-   }
-
-static void
-_resume_at_optime_started (const mongoc_apm_command_started_t *event)
-{
-   resume_ctx_t *ctx;
-
-   ctx = (resume_ctx_t *) mongoc_apm_command_started_get_context (event);
-   if (0 != strcmp (mongoc_apm_command_started_get_command_name (event), "aggregate")) {
-      return;
-   }
-
-   if (!ctx->has_initiated) {
-      ctx->has_initiated = true;
-      return;
-   }
-
-   ctx->has_resumed = true;
-
-   /* postBatchResumeToken (MongoDB 4.0.7+) supersedes operationTime. Since
-    * test_change_stream_resume_at_optime runs for wire version 7+, decide
-    * whether to skip operationTime assertion based on the command reply. */
-   if (!bson_has_field (&ctx->agg_reply, "cursor.postBatchResumeToken")) {
-      bson_value_t replied_optime, sent_optime;
-      match_ctx_t match_ctx = {{0}};
-
-      /* it should re-use the same optime on resume. */
-      bson_lookup_value (&ctx->agg_reply, "operationTime", &replied_optime);
-      bson_lookup_value (
-         mongoc_apm_command_started_get_command (event), "pipeline.0.$changeStream.startAtOperationTime", &sent_optime);
-      BSON_ASSERT (replied_optime.value_type == BSON_TYPE_TIMESTAMP);
-      BSON_ASSERT (match_bson_value (&sent_optime, &replied_optime, &match_ctx));
-      bson_value_destroy (&sent_optime);
-      bson_value_destroy (&replied_optime);
-   }
-}
-
-static void
-_resume_at_optime_succeeded (const mongoc_apm_command_succeeded_t *event)
-{
-   resume_ctx_t *ctx;
-
-   ctx = (resume_ctx_t *) mongoc_apm_command_succeeded_get_context (event);
-   if (!strcmp (mongoc_apm_command_succeeded_get_command_name (event), "aggregate")) {
-      bson_destroy (&ctx->agg_reply);
-      bson_copy_to (mongoc_apm_command_succeeded_get_reply (event), &ctx->agg_reply);
-   }
-}
-
-/* Test that "operationTime" in aggregate reply is used on resume */
-static void
-test_change_stream_resume_at_optime (void *test_ctx)
-{
-   mongoc_client_t *client = test_framework_new_default_client ();
-   mongoc_collection_t *coll;
-   mongoc_change_stream_t *stream;
-   const bson_t *doc;
-   bson_error_t error;
-   mongoc_apm_callbacks_t *callbacks;
-   resume_ctx_t ctx = RESUME_INITIALIZER;
-
-   BSON_UNUSED (test_ctx);
-
-   callbacks = mongoc_apm_callbacks_new ();
-   mongoc_apm_set_command_started_cb (callbacks, _resume_at_optime_started);
-   mongoc_apm_set_command_succeeded_cb (callbacks, _resume_at_optime_succeeded);
-   mongoc_client_set_apm_callbacks (client, callbacks, &ctx);
-   coll = mongoc_client_get_collection (client, "db", "coll");
-   stream = mongoc_collection_watch (coll, tmp_bson ("{'pipeline': []}"), NULL);
-
-   _setup_for_resume (stream);
-   (void) mongoc_change_stream_next (stream, &doc);
-   ASSERT_OR_PRINT (!mongoc_change_stream_error_document (stream, &error, NULL), error);
-   BSON_ASSERT (ctx.has_initiated);
-   BSON_ASSERT (ctx.has_resumed);
-
-   bson_destroy (&ctx.agg_reply);
-   mongoc_change_stream_destroy (stream);
-   mongoc_collection_destroy (coll);
-   mongoc_apm_callbacks_destroy (callbacks);
-   mongoc_client_destroy (client);
-}
+#define RESUME_INITIALIZER {false, false, BSON_INITIALIZER}
 
 static void
 _resume_with_post_batch_resume_token_started (const mongoc_apm_command_started_t *event)
@@ -1393,40 +1316,6 @@ test_change_stream_client_watch (void *t
    mongoc_client_destroy (client);
 }
 
-
-static int
-_skip_if_rs_version_less_than (const char *version)
-{
-   if (!TestSuite_CheckLive ()) {
-      return 0;
-   }
-   if (!test_framework_skip_if_not_replset ()) {
-      return 0;
-   }
-   if (test_framework_get_server_version () >= test_framework_str_to_version (version)) {
-      return 1;
-   }
-   return 0;
-}
-
-static int
-_skip_if_no_client_watch (void)
-{
-   return _skip_if_rs_version_less_than ("3.8.0");
-}
-
-static int
-_skip_if_no_db_watch (void)
-{
-   return _skip_if_rs_version_less_than ("3.8.0");
-}
-
-static int
-_skip_if_no_start_at_optime (void)
-{
-   return _skip_if_rs_version_less_than ("3.8.0");
-}
-
 static void
 _test_resume (const char *opts,
               const char *expected_change_stream_opts,
@@ -1444,7 +1333,7 @@ _test_resume (const char *opts,
    char *msg;
    const bson_t *doc = NULL;
 
-   server = mock_server_with_auto_hello (WIRE_VERSION_4_0);
+   server = mock_server_with_auto_hello (WIRE_VERSION_MIN);
    mock_server_run (server);
    client = test_framework_client_new_from_uri (mock_server_get_uri (server), NULL);
    mongoc_client_set_error_api (client, MONGOC_ERROR_API_VERSION_2);
@@ -1749,77 +1638,6 @@ prose_test_11 (void *ctx)
 
 
 void
-prose_test_12 (void *ctx)
-{
-   mongoc_client_t *client;
-   mongoc_collection_t *coll;
-   mongoc_change_stream_t *stream;
-   bson_error_t error;
-   const bson_t *next_doc = NULL;
-   mongoc_write_concern_t *wc = mongoc_write_concern_new ();
-   bson_t opts = BSON_INITIALIZER;
-   const bson_t *resume_token;
-   bson_iter_t iter, child;
-   bson_t expected_token;
-   bson_t expected_doc;
-
-   BSON_UNUSED (ctx);
-
-   client = test_framework_new_default_client ();
-   ASSERT (client);
-
-   coll = drop_and_get_coll (client, "db", "coll_resume");
-   ASSERT (coll);
-
-   /* Set the batch size to 1 so we only get one document per call to next. */
-   stream = mongoc_collection_watch (coll, tmp_bson ("{}"), tmp_bson ("{'batchSize': 1}"));
-   ASSERT (stream);
-   ASSERT_OR_PRINT (!mongoc_change_stream_error_document (stream, &error, NULL), error);
-
-   mongoc_write_concern_set_wmajority (wc, 30000);
-   mongoc_write_concern_append (wc, &opts);
-   ASSERT_OR_PRINT (mongoc_collection_insert_one (coll, tmp_bson ("{'_id': 0}"), &opts, NULL, &error), error);
-
-   /* Checking that a resume token is returned */
-   ASSERT (mongoc_change_stream_next (stream, &next_doc));
-   ASSERT (next_doc);
-   resume_token = mongoc_change_stream_get_resume_token (stream);
-   ASSERT (!bson_empty0 (resume_token));
-
-   /* Need to now check that we are getting back the _id of the last inserted
-    * document when we iterate to the last document */
-   bson_copy_to (next_doc, &expected_doc);
-   _check_doc_resume_token (&expected_doc, resume_token);
-
-   ASSERT (bson_iter_init_find (&iter, next_doc, "documentKey"));
-   ASSERT (bson_iter_recurse (&iter, &child));
-   ASSERT (bson_iter_find (&child, "_id") && bson_iter_int32 (&child) == 0);
-
-   /* Must check that getResumeToken returns resumeAfter correctly when
-    * specified. */
-   bson_copy_to (resume_token, &expected_token);
-   mongoc_change_stream_destroy (stream);
-   bson_destroy (&opts);
-   bson_init (&opts);
-   BSON_APPEND_DOCUMENT (&opts, "resumeAfter", &expected_token);
-
-   stream = mongoc_collection_watch (coll, tmp_bson ("{}"), &opts);
-   ASSERT (stream);
-
-   resume_token = mongoc_change_stream_get_resume_token (stream);
-   ASSERT (bson_equal (resume_token, &expected_token));
-
-   bson_destroy (&expected_doc);
-   bson_destroy (&expected_token);
-   bson_destroy (&opts);
-   mongoc_write_concern_destroy (wc);
-   mongoc_change_stream_destroy (stream);
-   mongoc_client_destroy (client);
-   mongoc_collection_destroy (coll);
-}
-
-
-void
 prose_test_13 (void *ctx)
 {
    mongoc_client_t *client;
@@ -2257,7 +2075,7 @@ test_change_stream_install (TestSuite *s
                       test_change_stream_live_single_server,
                       NULL,
                       NULL,
-                      test_framework_skip_if_not_single_version_5);
+                      test_framework_skip_if_not_single);
 
    TestSuite_AddFull (suite,
                       "/change_stream/live/track_resume_token",
@@ -2304,7 +2122,7 @@ test_change_stream_install (TestSuite *s
                       test_change_stream_live_read_prefs,
                       NULL,
                       NULL,
-                      _skip_if_no_start_at_optime,
+                      test_framework_skip_if_not_replset,
                       test_framework_skip_if_no_failpoint);
 
    TestSuite_Add (suite, "/change_stream/server_selection_fails", test_change_stream_server_selection_fails);
@@ -2328,65 +2146,42 @@ test_change_stream_install (TestSuite *s
                       test_change_stream_start_at_operation_time,
                       NULL,
                       NULL,
-                      test_framework_skip_if_not_rs_version_7,
-                      test_framework_skip_if_no_crypto,
-                      _skip_if_no_start_at_optime);
+                      test_framework_skip_if_not_replset,
+                      test_framework_skip_if_no_crypto);
    TestSuite_AddFull (suite,
-                      "/change_stream/resume_at_optime",
-                      test_change_stream_resume_at_optime,
+                      "/change_stream/resume_with_post_batch_resume_token",
+                      test_change_stream_resume_with_post_batch_resume_token,
                       NULL,
                       NULL,
-                      test_framework_skip_if_not_rs_version_7,
+                      test_framework_skip_if_not_replset,
                       test_framework_skip_if_no_crypto,
-                      _skip_if_no_start_at_optime,
                       test_framework_skip_if_no_failpoint);
    TestSuite_AddFull (suite,
-                      "/change_stream/resume_with_post_batch_resume_token",
-                      test_change_stream_resume_with_post_batch_resume_token,
+                      "/change_stream/database",
+                      test_change_stream_database_watch,
                       NULL,
                       NULL,
-                      test_framework_skip_if_not_rs_version_7,
-                      test_framework_skip_if_no_crypto,
-                      _skip_if_no_start_at_optime,
-                      test_framework_skip_if_no_failpoint);
-   TestSuite_AddFull (
-      suite, "/change_stream/database", test_change_stream_database_watch, NULL, NULL, _skip_if_no_db_watch);
+                      test_framework_skip_if_not_replset);
    TestSuite_AddFull (
-      suite, "/change_stream/client", test_change_stream_client_watch, NULL, NULL, _skip_if_no_client_watch);
+      suite, "/change_stream/client", test_change_stream_client_watch, NULL, NULL, test_framework_skip_if_not_replset);
    TestSuite_AddMockServerTest (suite, "/change_stream/resume_with_first_doc", test_resume_cases);
    TestSuite_AddMockServerTest (suite,
                                 "/change_stream/resume_with_first_doc/post_batch_resume_token",
                                 test_resume_cases_with_post_batch_resume_token);
    TestSuite_AddFull (
-      suite, "/change_stream/error_null_doc", test_error_null_doc, NULL, NULL, _skip_if_no_client_watch);
-   TestSuite_AddFull (suite,
-                      "/change_stream/live/prose_test_11",
-                      prose_test_11,
-                      NULL,
-                      NULL,
-                      test_framework_skip_if_not_replset,
-                      test_framework_skip_if_max_wire_version_less_than_8);
-   TestSuite_AddFull (suite,
-                      "/change_stream/live/prose_test_12",
-                      prose_test_12,
-                      NULL,
-                      NULL,
-                      test_framework_skip_if_not_replset,
-                      test_framework_skip_if_max_wire_version_more_than_7);
-   TestSuite_AddFull (suite,
-                      "/change_stream/live/prose_test_13",
-                      prose_test_13,
-                      NULL,
-                      NULL,
-                      test_framework_skip_if_not_replset,
-                      _skip_if_no_start_at_optime);
+      suite, "/change_stream/error_null_doc", test_error_null_doc, NULL, NULL, test_framework_skip_if_not_replset);
+   TestSuite_AddFull (
+      suite, "/change_stream/live/prose_test_11", prose_test_11, NULL, NULL, test_framework_skip_if_not_replset);
+   // Prose test 12 is removed. C driver does not support server 4.0.7.
+   TestSuite_AddFull (
+      suite, "/change_stream/live/prose_test_13", prose_test_13, NULL, NULL, test_framework_skip_if_not_replset);
    TestSuite_AddFull (suite,
                       "/change_stream/live/prose_test_14",
                       prose_test_14,
                       NULL,
                       NULL,
                       test_framework_skip_if_mongos,
-                      test_framework_skip_if_not_rs_version_7);
+                      test_framework_skip_if_not_replset);
    TestSuite_AddMockServerTest (suite, "/change_streams/prose_test_17", prose_test_17);
    TestSuite_AddMockServerTest (suite, "/change_streams/prose_test_18", prose_test_18);
    TestSuite_AddFull (suite,
diff -pruN 2.0.2-1/src/libmongoc/tests/test-mongoc-client-pool.c 2.1.0-1/src/libmongoc/tests/test-mongoc-client-pool.c
--- 2.0.2-1/src/libmongoc/tests/test-mongoc-client-pool.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-mongoc-client-pool.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,12 +1,12 @@
-#include <mongoc/mongoc.h>
+#include <common-macros-private.h> // BEGIN_IGNORE_DEPRECATIONS
 #include <mongoc/mongoc-client-pool-private.h>
 #include <mongoc/mongoc-client-private.h>
 #include <mongoc/mongoc-util-private.h>
-#include <common-macros-private.h> // BEGIN_IGNORE_DEPRECATIONS
 
+#include <mongoc/mongoc.h>
 
-#include "TestSuite.h"
-#include "test-libmongoc.h"
+#include <TestSuite.h>
+#include <test-libmongoc.h>
 
 
 static void
diff -pruN 2.0.2-1/src/libmongoc/tests/test-mongoc-client-session.c 2.1.0-1/src/libmongoc/tests/test-mongoc-client-session.c
--- 2.0.2-1/src/libmongoc/tests/test-mongoc-client-session.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-mongoc-client-session.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,17 +1,20 @@
-#include <mongoc/mongoc-cursor-private.h>
-#include <mongoc/mongoc.h>
-#include <mongoc/mongoc-util-private.h>
+#include <common-macros-private.h> // BEGIN_IGNORE_DEPRECATIONS
 #include <mongoc/mongoc-change-stream-private.h>
 #include <mongoc/mongoc-collection-private.h>
+#include <mongoc/mongoc-cursor-private.h>
+#include <mongoc/mongoc-util-private.h>
+
+#include <mongoc/mongoc.h>
 #include <mongoc/utlist.h>
+
 #include <mlib/loop.h>
-#include "TestSuite.h"
-#include "test-conveniences.h"
-#include "test-libmongoc.h"
-#include "mock_server/mock-server.h"
-#include "mock_server/future-functions.h"
-#include "json-test.h"
-#include <common-macros-private.h> // BEGIN_IGNORE_DEPRECATIONS
+
+#include <TestSuite.h>
+#include <json-test.h>
+#include <mock_server/future-functions.h>
+#include <mock_server/mock-server.h>
+#include <test-conveniences.h>
+#include <test-libmongoc.h>
 
 #include <inttypes.h>
 
@@ -2390,7 +2393,7 @@ test_unacknowledged_explicit_cs_explicit
 #define add_session_test(_suite, _name, _test_fn, _allow_read_concern)                      \
    if (1) {                                                                                 \
       session_test_helper_t *const helper = bson_malloc (sizeof (*helper));                 \
-      *helper = (session_test_helper_t){.test_fn = (_test_fn)};                             \
+      *helper = (session_test_helper_t) {.test_fn = (_test_fn)};                            \
       TestSuite_AddFull (_suite,                                                            \
                          _name,                                                             \
                          (_allow_read_concern) ? run_session_test : run_session_test_no_rc, \
@@ -2404,7 +2407,7 @@ test_unacknowledged_explicit_cs_explicit
 #define add_session_test_wc(_suite, _name, _test_fn, _allow_read_concern, ...)              \
    if (1) {                                                                                 \
       session_test_helper_t *const helper = bson_malloc (sizeof (*helper));                 \
-      *helper = (session_test_helper_t){.test_fn = (_test_fn)};                             \
+      *helper = (session_test_helper_t) {.test_fn = (_test_fn)};                            \
       TestSuite_AddFull (_suite,                                                            \
                          _name,                                                             \
                          (_allow_read_concern) ? run_session_test : run_session_test_no_rc, \
@@ -2419,7 +2422,7 @@ test_unacknowledged_explicit_cs_explicit
 #define add_unacknowledged_test(_suite, _name, _test_fn, _explicit_cs, _inherit_wc)                    \
    if (1) {                                                                                            \
       session_test_helper_t *const helper = bson_malloc (sizeof (*helper));                            \
-      *helper = (session_test_helper_t){.test_fn = (_test_fn)};                                        \
+      *helper = (session_test_helper_t) {.test_fn = (_test_fn)};                                       \
       TestSuite_AddFull (_suite,                                                                       \
                          _name,                                                                        \
                          (_explicit_cs) ? (_inherit_wc ? test_unacknowledged_explicit_cs_inherit_wc    \
@@ -2757,7 +2760,7 @@ test_session_install (TestSuite *suite)
    add_session_test (suite, "/Session/find_indexes", test_find_indexes, true);
    {
       session_test_helper_t *const helper = bson_malloc (sizeof (*helper));
-      *helper = (session_test_helper_t){.test_fn = test_bulk_set_session};
+      *helper = (session_test_helper_t) {.test_fn = test_bulk_set_session};
       TestSuite_AddFull (suite,
                          "/Session/bulk_set_session",
                          run_session_test_bulk_operation,
@@ -2768,7 +2771,7 @@ test_session_install (TestSuite *suite)
    }
    {
       session_test_helper_t *const helper = bson_malloc (sizeof (*helper));
-      *helper = (session_test_helper_t){.test_fn = test_bulk_set_client};
+      *helper = (session_test_helper_t) {.test_fn = test_bulk_set_client};
       TestSuite_AddFull (suite,
                          "/Session/bulk_set_client",
                          run_session_test_bulk_operation,
diff -pruN 2.0.2-1/src/libmongoc/tests/test-mongoc-client-side-encryption.c 2.1.0-1/src/libmongoc/tests/test-mongoc-client-side-encryption.c
--- 2.0.2-1/src/libmongoc/tests/test-mongoc-client-side-encryption.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-mongoc-client-side-encryption.c	2025-08-14 18:37:23.000000000 +0000
@@ -14,24 +14,23 @@
  * limitations under the License.
  */
 
-#include "json-test.h"
-#include "test-libmongoc.h"
-
+#include <common-b64-private.h>
 #include <common-bson-dsl-private.h>
 
-#include <common-b64-private.h>
+#include <json-test.h>
+#include <test-libmongoc.h>
 
 /* _mongoc_host_list_from_string_with_err */
-#include <mongoc/mongoc-host-list-private.h>
 #include <mongoc/mongoc-cluster-aws-private.h>
+#include <mongoc/mongoc-host-list-private.h>
 
 /* MONGOC_SERVER_ERR_NS_NOT_FOUND */
-#include <mongoc/mongoc-error-private.h>
-
 #include <mongoc/mongoc-client-side-encryption-private.h>
+#include <mongoc/mongoc-error-private.h>
+#include <mongoc/mongoc-http-private.h>
 
 #include <mongoc/mongoc-uri.h>
-#include <mongoc/mongoc-http-private.h>
+
 #include <mlib/cmp.h>
 
 static void
@@ -1142,7 +1141,7 @@ _endpoint_setup (mongoc_client_t *keyvau
                           "'endpoint': 'doesnotexist.invalid'}}",
                           mongoc_test_gcp_email,
                           mongoc_test_gcp_privatekey));
-   bson_concat (kms_providers_invalid, tmp_bson ("{'kmip': { 'endpoint': 'doesnotexist.local:5698' }}"));
+   bson_concat (kms_providers_invalid, tmp_bson ("{'kmip': { 'endpoint': 'doesnotexist.invalid:5698' }}"));
 
    client_encryption_opts = mongoc_client_encryption_opts_new ();
    mongoc_client_encryption_opts_set_kms_providers (client_encryption_opts, kms_providers);
@@ -1284,18 +1283,13 @@ test_custom_endpoint (void *unused)
     * included.
     * Expect to fail with socket error */
    _endpoint_setup (keyvault_client, &client_encryption, &client_encryption_invalid);
-   masterkey = BCON_NEW ("region",
-                         "us-east-1",
-                         "key",
-                         "arn:aws:kms:us-east-1:579766882180:key/"
-                         "89fcc2c4-08b0-4bd9-9f25-e30687b580d0",
-                         "endpoint",
-                         "kms.us-east-1.amazonaws.com:12345");
+   masterkey = BCON_NEW ("keyId", "1", "endpoint", "localhost:12345");
    mongoc_client_encryption_datakey_opts_set_masterkey (datakey_opts, masterkey);
-   res = mongoc_client_encryption_create_datakey (client_encryption, "aws", datakey_opts, &keyid, &error);
+   res = mongoc_client_encryption_create_datakey (client_encryption, "kmip", datakey_opts, &keyid, &error);
    ASSERT_ERROR_CONTAINS (error, MONGOC_ERROR_STREAM, MONGOC_ERROR_STREAM_CONNECT, "Failed to connect");
    BSON_ASSERT (!res);
    bson_value_destroy (&keyid);
+
    bson_destroy (masterkey);
    mongoc_client_encryption_destroy (client_encryption);
    mongoc_client_encryption_destroy (client_encryption_invalid);
@@ -1447,7 +1441,7 @@ test_custom_endpoint (void *unused)
 
    /* Case 12: KMIP overriding with invalid endpoint. */
    _endpoint_setup (keyvault_client, &client_encryption, &client_encryption_invalid);
-   masterkey = BCON_NEW ("keyId", "1", "endpoint", "doesnotexist.local:5698");
+   masterkey = BCON_NEW ("keyId", "1", "endpoint", "doesnotexist.invalid:5698");
    mongoc_client_encryption_datakey_opts_set_masterkey (datakey_opts, masterkey);
    res = mongoc_client_encryption_create_datakey (client_encryption, "kmip", datakey_opts, &keyid, &error);
    ASSERT_ERROR_CONTAINS (error, MONGOC_ERROR_STREAM, MONGOC_ERROR_STREAM_NAME_RESOLUTION, "Failed to resolve");
@@ -2940,7 +2934,7 @@ test_kms_tls_options (void *unused)
    memset (&error, 0, sizeof (bson_error_t));
    dkopts = mongoc_client_encryption_datakey_opts_new ();
    mongoc_client_encryption_datakey_opts_set_masterkey (
-      dkopts, tmp_bson ("{ 'keyVaultEndpoint': 'doesnotexist.local', 'keyName': 'foo' }"));
+      dkopts, tmp_bson ("{ 'keyVaultEndpoint': 'doesnotexist.invalid', 'keyName': 'foo' }"));
    res = mongoc_client_encryption_create_datakey (client_encryption_no_client_cert, "azure", dkopts, &keyid, &error);
    ASSERT_ERROR_CONTAINS (error, MONGOC_ERROR_STREAM, MONGOC_ERROR_STREAM_SOCKET, "");
    ASSERT (!res);
@@ -2950,7 +2944,7 @@ test_kms_tls_options (void *unused)
    memset (&error, 0, sizeof (bson_error_t));
    dkopts = mongoc_client_encryption_datakey_opts_new ();
    mongoc_client_encryption_datakey_opts_set_masterkey (
-      dkopts, tmp_bson ("{ 'keyVaultEndpoint': 'doesnotexist.local', 'keyName': 'foo' }"));
+      dkopts, tmp_bson ("{ 'keyVaultEndpoint': 'doesnotexist.invalid', 'keyName': 'foo' }"));
    res = mongoc_client_encryption_create_datakey (
       client_encryption_with_names, "azure:no_client_cert", dkopts, &keyid, &error);
    ASSERT_ERROR_CONTAINS (error, MONGOC_ERROR_STREAM, MONGOC_ERROR_STREAM_SOCKET, "");
@@ -2961,7 +2955,7 @@ test_kms_tls_options (void *unused)
    memset (&error, 0, sizeof (bson_error_t));
    dkopts = mongoc_client_encryption_datakey_opts_new ();
    mongoc_client_encryption_datakey_opts_set_masterkey (
-      dkopts, tmp_bson ("{ 'keyVaultEndpoint': 'doesnotexist.local', 'keyName': 'foo' }"));
+      dkopts, tmp_bson ("{ 'keyVaultEndpoint': 'doesnotexist.invalid', 'keyName': 'foo' }"));
    res = mongoc_client_encryption_create_datakey (client_encryption_with_tls, "azure", dkopts, &keyid, &error);
    ASSERT_ERROR_CONTAINS (error, MONGOC_ERROR_CLIENT_SIDE_ENCRYPTION, mongocrypt_errno, "HTTP status=404");
    ASSERT (!res);
@@ -2971,7 +2965,7 @@ test_kms_tls_options (void *unused)
    memset (&error, 0, sizeof (bson_error_t));
    dkopts = mongoc_client_encryption_datakey_opts_new ();
    mongoc_client_encryption_datakey_opts_set_masterkey (
-      dkopts, tmp_bson ("{ 'keyVaultEndpoint': 'doesnotexist.local', 'keyName': 'foo' }"));
+      dkopts, tmp_bson ("{ 'keyVaultEndpoint': 'doesnotexist.invalid', 'keyName': 'foo' }"));
    res =
       mongoc_client_encryption_create_datakey (client_encryption_with_names, "azure:with_tls", dkopts, &keyid, &error);
    ASSERT_ERROR_CONTAINS (error, MONGOC_ERROR_CLIENT_SIDE_ENCRYPTION, mongocrypt_errno, "HTTP status=404");
@@ -2982,7 +2976,7 @@ test_kms_tls_options (void *unused)
    memset (&error, 0, sizeof (bson_error_t));
    dkopts = mongoc_client_encryption_datakey_opts_new ();
    mongoc_client_encryption_datakey_opts_set_masterkey (
-      dkopts, tmp_bson ("{ 'keyVaultEndpoint': 'doesnotexist.local', 'keyName': 'foo' }"));
+      dkopts, tmp_bson ("{ 'keyVaultEndpoint': 'doesnotexist.invalid', 'keyName': 'foo' }"));
    res = mongoc_client_encryption_create_datakey (client_encryption_expired, "azure", dkopts, &keyid, &error);
    ASSERT_EXPIRED (error);
    ASSERT (!res);
@@ -2992,7 +2986,7 @@ test_kms_tls_options (void *unused)
    memset (&error, 0, sizeof (bson_error_t));
    dkopts = mongoc_client_encryption_datakey_opts_new ();
    mongoc_client_encryption_datakey_opts_set_masterkey (
-      dkopts, tmp_bson ("{ 'keyVaultEndpoint': 'doesnotexist.local', 'keyName': 'foo' }"));
+      dkopts, tmp_bson ("{ 'keyVaultEndpoint': 'doesnotexist.invalid', 'keyName': 'foo' }"));
    res = mongoc_client_encryption_create_datakey (client_encryption_invalid_hostname, "azure", dkopts, &keyid, &error);
    ASSERT_INVALID_HOSTNAME (error);
    ASSERT (!res);
@@ -6887,7 +6881,7 @@ test_client_side_encryption_install (Tes
                       NULL,
                       NULL,
                       test_framework_skip_if_no_client_side_encryption,
-                      test_framework_skip_if_max_wire_version_less_than_8,
+                      TestSuite_CheckLive,
                       test_framework_skip_if_offline /* requires AWS */);
    TestSuite_AddFull (suite,
                       "/client_side_encryption/datakey_and_double_encryption",
@@ -6895,7 +6889,7 @@ test_client_side_encryption_install (Tes
                       NULL,
                       NULL,
                       test_framework_skip_if_no_client_side_encryption,
-                      test_framework_skip_if_max_wire_version_less_than_8,
+                      TestSuite_CheckLive,
                       test_framework_skip_if_offline /* requires AWS */);
    TestSuite_AddFull (suite,
                       "/client_side_encryption/external_key_vault",
@@ -6903,7 +6897,7 @@ test_client_side_encryption_install (Tes
                       NULL,
                       NULL,
                       test_framework_skip_if_no_client_side_encryption,
-                      test_framework_skip_if_max_wire_version_less_than_8,
+                      TestSuite_CheckLive,
                       test_framework_skip_if_no_auth /* requires auth for error check */);
    TestSuite_AddFull (suite,
                       "/client_side_encryption/bson_size_limits_and_batch_splitting",
@@ -6911,21 +6905,21 @@ test_client_side_encryption_install (Tes
                       NULL,
                       NULL,
                       test_framework_skip_if_no_client_side_encryption,
-                      test_framework_skip_if_max_wire_version_less_than_8);
+                      TestSuite_CheckLive);
    TestSuite_AddFull (suite,
                       "/client_side_encryption/views_are_prohibited",
                       test_views_are_prohibited,
                       NULL,
                       NULL,
                       test_framework_skip_if_no_client_side_encryption,
-                      test_framework_skip_if_max_wire_version_less_than_8);
+                      TestSuite_CheckLive);
    TestSuite_AddFull (suite,
                       "/client_side_encryption/corpus",
                       test_corpus,
                       NULL,
                       NULL,
                       test_framework_skip_if_no_client_side_encryption,
-                      test_framework_skip_if_max_wire_version_less_than_8,
+                      TestSuite_CheckLive,
                       test_framework_skip_if_offline /* requires AWS */);
    TestSuite_AddFull (suite,
                       "/client_side_encryption/custom_endpoint",
@@ -6933,7 +6927,7 @@ test_client_side_encryption_install (Tes
                       NULL,
                       NULL,
                       test_framework_skip_if_no_client_side_encryption,
-                      test_framework_skip_if_max_wire_version_less_than_8,
+                      TestSuite_CheckLive,
                       test_framework_skip_if_offline /* requires AWS, Azure, and GCP */);
    TestSuite_AddFull (suite,
                       "/client_side_encryption/bypass_spawning_mongocryptd/"
@@ -6942,7 +6936,7 @@ test_client_side_encryption_install (Tes
                       NULL,
                       NULL,
                       test_framework_skip_if_no_client_side_encryption,
-                      test_framework_skip_if_max_wire_version_less_than_8);
+                      TestSuite_CheckLive);
    TestSuite_AddFull (suite,
                       "/client_side_encryption/bypass_spawning_mongocryptd/"
                       "bypassAutoEncryption",
@@ -6950,7 +6944,7 @@ test_client_side_encryption_install (Tes
                       NULL,
                       NULL,
                       test_framework_skip_if_no_client_side_encryption,
-                      test_framework_skip_if_max_wire_version_less_than_8);
+                      TestSuite_CheckLive);
    TestSuite_AddFull (suite,
                       "/client_side_encryption/bypass_spawning_mongocryptd/"
                       "bypassQueryAnalysis",
@@ -6958,7 +6952,7 @@ test_client_side_encryption_install (Tes
                       NULL,
                       NULL,
                       test_framework_skip_if_no_client_side_encryption,
-                      test_framework_skip_if_max_wire_version_less_than_8);
+                      TestSuite_CheckLive);
    TestSuite_AddFull (suite,
                       "/client_side_encryption/bypass_spawning_mongocryptd/"
                       "cryptSharedLibLoaded",
@@ -6966,7 +6960,7 @@ test_client_side_encryption_install (Tes
                       NULL,
                       NULL,
                       test_framework_skip_if_no_client_side_encryption,
-                      test_framework_skip_if_max_wire_version_less_than_8,
+                      TestSuite_CheckLive,
                       _skip_if_no_crypt_shared);
    TestSuite_AddFull (suite,
                       "/client_side_encryption/kms_tls/valid",
@@ -6974,35 +6968,35 @@ test_client_side_encryption_install (Tes
                       NULL,
                       NULL,
                       test_framework_skip_if_no_client_side_encryption,
-                      test_framework_skip_if_max_wire_version_less_than_8);
+                      TestSuite_CheckLive);
    TestSuite_AddFull (suite,
                       "/client_side_encryption/kms_tls/expired",
                       test_kms_tls_cert_expired,
                       NULL,
                       NULL,
                       test_framework_skip_if_no_client_side_encryption,
-                      test_framework_skip_if_max_wire_version_less_than_8);
+                      TestSuite_CheckLive);
    TestSuite_AddFull (suite,
                       "/client_side_encryption/kms_tls/wrong_host",
                       test_kms_tls_cert_wrong_host,
                       NULL,
                       NULL,
                       test_framework_skip_if_no_client_side_encryption,
-                      test_framework_skip_if_max_wire_version_less_than_8);
+                      TestSuite_CheckLive);
    TestSuite_AddFull (suite,
                       "/client_side_encryption/unique_index_on_keyaltnames",
                       test_unique_index_on_keyaltnames,
                       NULL,
                       NULL,
                       test_framework_skip_if_no_client_side_encryption,
-                      test_framework_skip_if_max_wire_version_less_than_8);
+                      TestSuite_CheckLive);
    TestSuite_AddFull (suite,
                       "/client_side_encryption/prose_test_16/case1",
                       test_rewrap_with_separate_client_encryption,
                       NULL,
                       NULL,
                       test_framework_skip_if_no_client_side_encryption,
-                      test_framework_skip_if_max_wire_version_less_than_8,
+                      TestSuite_CheckLive,
                       test_framework_skip_if_slow);
    TestSuite_AddFull (suite,
                       "/client_side_encryption/prose_test_16/case2",
@@ -7010,7 +7004,7 @@ test_client_side_encryption_install (Tes
                       NULL,
                       NULL,
                       test_framework_skip_if_no_client_side_encryption,
-                      test_framework_skip_if_max_wire_version_less_than_8);
+                      TestSuite_CheckLive);
 
    /* Other, C driver specific, tests. */
    TestSuite_AddFull (suite,
@@ -7019,28 +7013,28 @@ test_client_side_encryption_install (Tes
                       NULL,
                       NULL,
                       test_framework_skip_if_no_client_side_encryption,
-                      test_framework_skip_if_max_wire_version_less_than_8);
+                      TestSuite_CheckLive);
    TestSuite_AddFull (suite,
                       "/client_side_encryption/multi_threaded",
                       test_multi_threaded,
                       NULL,
                       NULL,
                       test_framework_skip_if_no_client_side_encryption,
-                      test_framework_skip_if_max_wire_version_less_than_8);
+                      TestSuite_CheckLive);
    TestSuite_AddFull (suite,
                       "/client_side_encryption/malformed_explicit",
                       test_malformed_explicit,
                       NULL,
                       NULL,
                       test_framework_skip_if_no_client_side_encryption,
-                      test_framework_skip_if_max_wire_version_less_than_8);
+                      TestSuite_CheckLive);
    TestSuite_AddFull (suite,
                       "/client_side_encryption/kms_tls_options",
                       test_kms_tls_options,
                       NULL,
                       NULL,
                       test_framework_skip_if_no_client_side_encryption,
-                      test_framework_skip_if_max_wire_version_less_than_8,
+                      TestSuite_CheckLive,
                       test_framework_skip_if_offline /* requires AWS, Azure, and GCP */,
                       /* Do not run on Windows due to CDRIVER-4181. Tests use a literal IP with
                          a TLS connection. */
@@ -7120,7 +7114,7 @@ test_client_side_encryption_install (Tes
                       NULL /* dtor */,
                       NULL /* ctx */,
                       test_framework_skip_if_no_client_side_encryption,
-                      test_framework_skip_if_max_wire_version_less_than_8);
+                      TestSuite_CheckLive);
 
    TestSuite_AddFull (suite,
                       "/client_side_encryption/decryption_events/case2",
@@ -7128,7 +7122,7 @@ test_client_side_encryption_install (Tes
                       NULL /* dtor */,
                       NULL /* ctx */,
                       test_framework_skip_if_no_client_side_encryption,
-                      test_framework_skip_if_max_wire_version_less_than_8);
+                      TestSuite_CheckLive);
 
    TestSuite_AddFull (suite,
                       "/client_side_encryption/decryption_events/case3",
@@ -7136,7 +7130,7 @@ test_client_side_encryption_install (Tes
                       NULL /* dtor */,
                       NULL /* ctx */,
                       test_framework_skip_if_no_client_side_encryption,
-                      test_framework_skip_if_max_wire_version_less_than_8);
+                      TestSuite_CheckLive);
 
 
    TestSuite_AddFull (suite,
@@ -7145,7 +7139,7 @@ test_client_side_encryption_install (Tes
                       NULL /* dtor */,
                       NULL /* ctx */,
                       test_framework_skip_if_no_client_side_encryption,
-                      test_framework_skip_if_max_wire_version_less_than_8);
+                      TestSuite_CheckLive);
 
    TestSuite_AddFull (suite,
                       "/client_side_encryption/qe_docs_example",
@@ -7164,7 +7158,7 @@ test_client_side_encryption_install (Tes
                       NULL, // dtor
                       NULL, // ctx
                       test_framework_skip_if_no_client_side_encryption,
-                      test_framework_skip_if_max_wire_version_less_than_8);
+                      TestSuite_CheckLive);
 
    TestSuite_AddFull (suite,
                       "/client_side_encryption/kms/auto-aws/fail",
@@ -7172,7 +7166,7 @@ test_client_side_encryption_install (Tes
                       NULL,
                       NULL,
                       test_framework_skip_if_no_client_side_encryption,
-                      test_framework_skip_if_max_wire_version_less_than_8,
+                      TestSuite_CheckLive,
                       _not_have_aws_creds_env);
 
    TestSuite_AddFull (suite,
@@ -7181,7 +7175,7 @@ test_client_side_encryption_install (Tes
                       NULL,
                       NULL,
                       test_framework_skip_if_no_client_side_encryption,
-                      test_framework_skip_if_max_wire_version_less_than_8,
+                      TestSuite_CheckLive,
                       _have_aws_creds_env);
 
    TestSuite_AddFull (suite,
@@ -7190,7 +7184,7 @@ test_client_side_encryption_install (Tes
                       NULL,
                       NULL,
                       test_framework_skip_if_no_client_side_encryption,
-                      test_framework_skip_if_max_wire_version_less_than_8);
+                      TestSuite_CheckLive);
 
    TestSuite_AddFull (suite, "/client_side_encryption/auto_datakeys", test_auto_datakeys, NULL, NULL, NULL);
 
diff -pruN 2.0.2-1/src/libmongoc/tests/test-mongoc-client.c 2.1.0-1/src/libmongoc/tests/test-mongoc-client.c
--- 2.0.2-1/src/libmongoc/tests/test-mongoc-client.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-mongoc-client.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,32 +1,35 @@
-#include <fcntl.h>
-#include <mongoc/mongoc.h>
-
 #include <mongoc/mongoc-client-private.h>
-#include <mongoc/mongoc-cursor-private.h>
 #include <mongoc/mongoc-cluster-private.h>
+#include <mongoc/mongoc-cursor-private.h>
 #include <mongoc/mongoc-database-private.h>
 #include <mongoc/mongoc-handshake-private.h>
 #include <mongoc/mongoc-host-list-private.h>
 #include <mongoc/mongoc-read-concern-private.h>
 #include <mongoc/mongoc-set-private.h>
+
+#include <mongoc/mongoc.h>
+
+#include <fcntl.h>
 #ifdef MONGOC_ENABLE_SSL
-#include <mongoc/mongoc-ssl.h>
 #include <mongoc/mongoc-ssl-private.h>
+
+#include <mongoc/mongoc-ssl.h>
 #endif
+#include <common-macros-private.h> // BEGIN_IGNORE_DEPRECATIONS
+#include <common-oid-private.h>
 #include <mongoc/mongoc-util-private.h>
 #include <mongoc/mongoc-write-concern-private.h>
 
-#include "TestSuite.h"
-#include "test-conveniences.h"
-#include "test-libmongoc.h"
-#include "mock_server/future.h"
-#include "mock_server/future-functions.h"
-#include "mock_server/mock-server.h"
-#include "mock_server/mock-rs.h"
-#include <common-macros-private.h> // BEGIN_IGNORE_DEPRECATIONS
-#include <common-oid-private.h>
 #include <mlib/loop.h>
 
+#include <TestSuite.h>
+#include <mock_server/future-functions.h>
+#include <mock_server/future.h>
+#include <mock_server/mock-rs.h>
+#include <mock_server/mock-server.h>
+#include <test-conveniences.h>
+#include <test-libmongoc.h>
+
 
 #ifdef BSON_HAVE_STRINGS_H
 #include <strings.h>
@@ -3770,6 +3773,26 @@ test_failure_to_auth (void)
    mongoc_uri_destroy (uri);
 }
 
+// test_failure_to_auth_logs tests that auth failure logs at an error level.
+// Regression test for CDRIVER-5828.
+static void
+test_failure_to_auth_logs (void *unused)
+{
+   BSON_UNUSED (unused);
+   mongoc_uri_t *uri = test_framework_get_uri ();
+   mongoc_uri_set_username (uri, "foo");
+   mongoc_uri_set_password (uri, "bar");
+   mongoc_client_t *client = test_framework_client_new_from_uri (uri, NULL);
+   test_framework_set_ssl_opts (client);
+   capture_logs (true);
+   bool ok = mongoc_client_command_simple (
+      client, "admin", tmp_bson ("{'ping': 1}"), NULL /* read prefs */, NULL /* reply */, NULL /* error */);
+   ASSERT (!ok);
+   ASSERT_CAPTURED_LOG ("auth failure", MONGOC_LOG_LEVEL_ERROR, "Authentication failed");
+   mongoc_client_destroy (client);
+   mongoc_uri_destroy (uri);
+}
+
 static void
 test_killCursors (void)
 {
@@ -3988,6 +4011,8 @@ test_client_install (TestSuite *suite)
    TestSuite_AddMockServerTest (
       suite, "/Client/resends_handshake_on_network_error", test_mongoc_client_resends_handshake_on_network_error);
    TestSuite_Add (suite, "/Client/failure_to_auth", test_failure_to_auth);
+   TestSuite_AddFull (
+      suite, "/Client/failure_to_auth_logs", test_failure_to_auth_logs, NULL, NULL, test_framework_skip_if_no_auth);
 #if defined(MONGOC_ENABLE_SSL_OPENSSL)
    TestSuite_AddFull (suite,
                       "/Client/openssl/change_ssl_opts_before_ops",
diff -pruN 2.0.2-1/src/libmongoc/tests/test-mongoc-cluster.c 2.1.0-1/src/libmongoc/tests/test-mongoc-cluster.c
--- 2.0.2-1/src/libmongoc/tests/test-mongoc-cluster.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-mongoc-cluster.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,18 +1,18 @@
-#include <mongoc/mongoc-util-private.h>
-#include <mongoc/mongoc.h>
-
-#include <mongoc/mongoc-client-private.h>
+#include <common-oid-private.h>
 #include <mongoc/mongoc-client-pool-private.h>
+#include <mongoc/mongoc-client-private.h>
 #include <mongoc/mongoc-topology-background-monitoring-private.h>
 #include <mongoc/mongoc-uri-private.h>
-#include <common-oid-private.h>
+#include <mongoc/mongoc-util-private.h>
+
+#include <mongoc/mongoc.h>
 
-#include "mock_server/mock-server.h"
-#include "mock_server/future.h"
-#include "mock_server/future-functions.h"
-#include "TestSuite.h"
-#include "test-libmongoc.h"
-#include "test-conveniences.h"
+#include <TestSuite.h>
+#include <mock_server/future-functions.h>
+#include <mock_server/future.h>
+#include <mock_server/mock-server.h>
+#include <test-conveniences.h>
+#include <test-libmongoc.h>
 
 #include <inttypes.h>
 
diff -pruN 2.0.2-1/src/libmongoc/tests/test-mongoc-cmd.c 2.1.0-1/src/libmongoc/tests/test-mongoc-cmd.c
--- 2.0.2-1/src/libmongoc/tests/test-mongoc-cmd.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-mongoc-cmd.c	2025-08-14 18:37:23.000000000 +0000
@@ -14,17 +14,17 @@
  * limitations under the License.
  */
 
-#include <mongoc/mongoc.h>
-
 #include <mongoc/mongoc-client-private.h>
-
-#include "TestSuite.h"
-#include "test-conveniences.h"
-#include "mock_server/mock-server.h"
-#include "mock_server/future-functions.h"
-#include "test-libmongoc.h"
 #include <mongoc/mongoc-cluster-private.h>
 
+#include <mongoc/mongoc.h>
+
+#include <TestSuite.h>
+#include <mock_server/future-functions.h>
+#include <mock_server/mock-server.h>
+#include <test-conveniences.h>
+#include <test-libmongoc.h>
+
 
 /* CDRIVER-3303 - mongoc_cmd_parts_assemble sometimes fails to set options;
  * the fix was to refactor the code and this test guards against regressions
diff -pruN 2.0.2-1/src/libmongoc/tests/test-mongoc-collection-find-with-opts.c 2.1.0-1/src/libmongoc/tests/test-mongoc-collection-find-with-opts.c
--- 2.0.2-1/src/libmongoc/tests/test-mongoc-collection-find-with-opts.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-mongoc-collection-find-with-opts.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,16 +1,18 @@
-#include <mongoc/mongoc.h>
-#include <mongoc/mongoc-cursor-private.h>
 #include <mongoc/mongoc-client-private.h>
+#include <mongoc/mongoc-cursor-private.h>
+
+#include <mongoc/mongoc.h>
 
-#include "TestSuite.h"
-#include "test-conveniences.h"
-#include "mock_server/mock-server.h"
-#include "mock_server/future.h"
-#include "mock_server/future-functions.h"
-#include "test-libmongoc.h"
-#include "mock_server/mock-rs.h"
 #include <mlib/loop.h>
 
+#include <TestSuite.h>
+#include <mock_server/future-functions.h>
+#include <mock_server/future.h>
+#include <mock_server/mock-rs.h>
+#include <mock_server/mock-server.h>
+#include <test-conveniences.h>
+#include <test-libmongoc.h>
+
 
 typedef struct {
    const char *filter;
@@ -451,13 +453,14 @@ test_exhaust (void)
 
    future = future_cursor_next (cursor, &doc);
 
-   /* Find, getMore and killCursors commands spec: "The find command does not
-    * support the exhaust flag from OP_QUERY. Drivers that support exhaust MUST
-    * fallback to existing OP_QUERY wire protocol messages."
-    */
-   request = mock_server_receives_request (server);
-   reply_to_find_request (
-      request, MONGOC_QUERY_SECONDARY_OK | MONGOC_QUERY_EXHAUST, 0, 0, "db.collection", "{}", false /* is_command */);
+   // Expect find command with exhaust flag. Reply with one document.
+   {
+      const bson_t *cmd = tmp_bson (BSON_STR ({"find" : "collection", "filter" : {}}));
+      request = mock_server_receives_msg (server, MONGOC_OP_MSG_FLAG_EXHAUST_ALLOWED, cmd);
+      const bson_t *reply = tmp_bson (BSON_STR (
+         {"ok" : 1, "cursor" : {"id" : {"$numberLong" : "0"}, "ns" : "db.collection", "firstBatch" : [ {} ]}}));
+      reply_to_op_msg_request (request, MONGOC_OP_MSG_FLAG_NONE, reply);
+   }
 
    ASSERT (future_get_bool (future));
    ASSERT_OR_PRINT (!mongoc_cursor_error (cursor, &error), error);
diff -pruN 2.0.2-1/src/libmongoc/tests/test-mongoc-collection.c 2.1.0-1/src/libmongoc/tests/test-mongoc-collection.c
--- 2.0.2-1/src/libmongoc/tests/test-mongoc-collection.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-mongoc-collection.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,21 +1,22 @@
-#include <bson/bcon.h>
 #include <common-bson-dsl-private.h>
-#include <mongoc/mongoc.h>
+#include <common-macros-private.h> // BEGIN_IGNORE_DEPRECATIONS
 #include <mongoc/mongoc-client-private.h>
-#include <mongoc/mongoc-cursor-private.h>
 #include <mongoc/mongoc-collection-private.h>
-#include <mongoc/mongoc-write-concern-private.h>
+#include <mongoc/mongoc-cursor-private.h>
 #include <mongoc/mongoc-read-concern-private.h>
 #include <mongoc/mongoc-util-private.h>
+#include <mongoc/mongoc-write-concern-private.h>
 
-#include "TestSuite.h"
+#include <mongoc/mongoc.h>
 
-#include "test-libmongoc.h"
-#include "test-conveniences.h"
-#include "mock_server/future-functions.h"
-#include "mock_server/mock-server.h"
-#include "mock_server/mock-rs.h"
-#include <common-macros-private.h> // BEGIN_IGNORE_DEPRECATIONS
+#include <bson/bson-bcon.h>
+
+#include <TestSuite.h>
+#include <mock_server/future-functions.h>
+#include <mock_server/mock-rs.h>
+#include <mock_server/mock-server.h>
+#include <test-conveniences.h>
+#include <test-libmongoc.h>
 
 #include <inttypes.h>
 
@@ -4003,19 +4004,11 @@ _test_update_and_replace (bool is_replac
       ret =
          fn (coll, tmp_bson ("{'_id': 6}"), update, tmp_bson ("{'arrayFilters': [{'i.x': {'$gt': 1}}]}"), &reply, &err);
 
-      if (test_framework_max_wire_version_at_least (6)) {
-         ASSERT_OR_PRINT (ret, err);
-         ASSERT_MATCH (&reply,
-                       "{'modifiedCount': 1, 'matchedCount': 1, "
-                       "'upsertedId': {'$exists': false}}");
-         _test_docs_in_coll_matches (coll, tmp_bson ("{'_id':6}"), "{'a': [{'x':1},{'x':3}]}", 1);
-      } else {
-         BSON_ASSERT (!ret);
-         ASSERT_ERROR_CONTAINS (err,
-                                MONGOC_ERROR_COMMAND,
-                                MONGOC_ERROR_PROTOCOL_BAD_WIRE_VERSION,
-                                "The selected server does not support array filters");
-      }
+      ASSERT_OR_PRINT (ret, err);
+      ASSERT_MATCH (&reply,
+                    "{'modifiedCount': 1, 'matchedCount': 1, "
+                    "'upsertedId': {'$exists': false}}");
+      _test_docs_in_coll_matches (coll, tmp_bson ("{'_id':6}"), "{'a': [{'x':1},{'x':3}]}", 1);
 
       bson_destroy (&reply);
 
@@ -4931,12 +4924,7 @@ test_collection_install (TestSuite *suit
    TestSuite_AddLive (suite, "/Collection/regex", test_regex);
    TestSuite_AddFull (suite, "/Collection/decimal128", test_decimal128, NULL, NULL, skip_unless_server_has_decimal128);
    TestSuite_AddLive (suite, "/Collection/update", test_update);
-   TestSuite_AddFull (suite,
-                      "/Collection/update_pipeline",
-                      test_update_pipeline,
-                      NULL,
-                      NULL,
-                      test_framework_skip_if_max_wire_version_less_than_8);
+   TestSuite_AddFull (suite, "/Collection/update_pipeline", test_update_pipeline, NULL, NULL, TestSuite_CheckLive);
    TestSuite_AddLive (suite, "/Collection/update/multi", test_update_multi);
    TestSuite_AddLive (suite, "/Collection/update/upsert", test_update_upsert);
    TestSuite_AddFull (
diff -pruN 2.0.2-1/src/libmongoc/tests/test-mongoc-command-logging-and-monitoring.c 2.1.0-1/src/libmongoc/tests/test-mongoc-command-logging-and-monitoring.c
--- 2.0.2-1/src/libmongoc/tests/test-mongoc-command-logging-and-monitoring.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-mongoc-command-logging-and-monitoring.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,11 +1,13 @@
+#include <mongoc/mongoc-array-private.h>
+
 #include <mongoc/mongoc.h>
 
-#include "test-libmongoc.h"
-#include "test-conveniences.h"
-#include <mongoc/mongoc-array-private.h>
-#include "TestSuite.h"
 #include <mlib/loop.h>
 
+#include <TestSuite.h>
+#include <test-conveniences.h>
+#include <test-libmongoc.h>
+
 static void
 stored_log_handler (const mongoc_structured_log_entry_t *entry, void *user_data)
 {
diff -pruN 2.0.2-1/src/libmongoc/tests/test-mongoc-command-monitoring.c 2.1.0-1/src/libmongoc/tests/test-mongoc-command-monitoring.c
--- 2.0.2-1/src/libmongoc/tests/test-mongoc-command-monitoring.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-mongoc-command-monitoring.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,14 +1,15 @@
-#include <mongoc/mongoc.h>
 #include <mongoc/mongoc-bulk-operation-private.h>
 #include <mongoc/mongoc-collection-private.h>
 
-#include "json-test.h"
-#include "test-libmongoc.h"
-#include "mock_server/mock-server.h"
-#include "mock_server/future.h"
-#include "mock_server/future-functions.h"
-#include "json-test-operations.h"
-#include "unified/runner.h"
+#include <mongoc/mongoc.h>
+
+#include <json-test-operations.h>
+#include <json-test.h>
+#include <mock_server/future-functions.h>
+#include <mock_server/future.h>
+#include <mock_server/mock-server.h>
+#include <test-libmongoc.h>
+#include <unified/runner.h>
 
 
 const char *
diff -pruN 2.0.2-1/src/libmongoc/tests/test-mongoc-connection-uri.c 2.1.0-1/src/libmongoc/tests/test-mongoc-connection-uri.c
--- 2.0.2-1/src/libmongoc/tests/test-mongoc-connection-uri.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-mongoc-connection-uri.c	2025-08-14 18:37:23.000000000 +0000
@@ -2,15 +2,14 @@
 
 //
 
-#include <bson/bson.h>
-
+#include <common-bson-dsl-private.h>
+#include <mongoc/mongoc-read-concern-private.h>
 #include <mongoc/mongoc-util-private.h>
 
-#include <common-bson-dsl-private.h>
+#include <bson/bson.h>
 
-#include "json-test.h"
-#include "test-libmongoc.h"
-#include <mongoc/mongoc-read-concern-private.h>
+#include <json-test.h>
+#include <test-libmongoc.h>
 
 
 /*
@@ -92,7 +91,7 @@ run_uri_test (const char *uri_string,
          if (strchr (bson_iter_utf8 (&iter, NULL), '.')) {
             BSON_ASSERT (!uri);
             ASSERT_ERROR_CONTAINS (
-               error, MONGOC_ERROR_COMMAND, MONGOC_ERROR_COMMAND_INVALID_ARG, "Invalid database name in URI");
+               error, MONGOC_ERROR_COMMAND, MONGOC_ERROR_COMMAND_INVALID_ARG, "Invalid database specifier \"admin.");
             clear_captured_logs ();
             return;
          }
@@ -419,16 +418,12 @@ test_connection_uri_cb (void *scenario_v
       {.description = "replicaset, host and non-default port present",
        .reason = "libmongoc does not support proxies (CDRIVER-4187)"},
       {.description = "all options present", .reason = "libmongoc does not support proxies (CDRIVER-4187)"},
-      {.description = "(MONGODB-OIDC)",
-       .reason = "libmongoc does not-yet implement MONGODB-OIDC (CDRIVER-4489)",
-       .check_substring = true},
-      {.description = "Colon in a key value pair",
-       .reason = "libmongoc does not-yet implement MONGODB-OIDC (CDRIVER-4489)",
-       .check_substring = true},
       {.description = "Valid connection pool options are parsed correctly",
        .reason = "libmongoc does not support minPoolSize (CDRIVER-2390)"},
       {.description = "minPoolSize=0 does not error",
        .reason = "libmongoc does not support minPoolSize (CDRIVER-2390)"},
+      {.description = "should throw an exception if neither environment nor callbacks specified (MONGODB-OIDC)",
+       .reason = "libmongoc OIDC callbacks attach to MongoClient, which is not involved by this test"},
       {.description = NULL},
    };
 
diff -pruN 2.0.2-1/src/libmongoc/tests/test-mongoc-counters.c 2.1.0-1/src/libmongoc/tests/test-mongoc-counters.c
--- 2.0.2-1/src/libmongoc/tests/test-mongoc-counters.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-mongoc-counters.c	2025-08-14 18:37:23.000000000 +0000
@@ -14,15 +14,17 @@
  * limitations under the License.
  */
 
-#include <mongoc/mongoc-util-private.h>
+#include <common-atomic-private.h>
 #include <mongoc/mongoc-counters-private.h>
-#include "mock_server/mock-server.h"
-#include "test-conveniences.h"
-#include "test-libmongoc.h"
-#include "TestSuite.h"
-#include "mock_server/future-functions.h"
+#include <mongoc/mongoc-util-private.h>
+
 #include <mlib/cmp.h>
-#include <common-atomic-private.h>
+
+#include <TestSuite.h>
+#include <mock_server/future-functions.h>
+#include <mock_server/mock-server.h>
+#include <test-conveniences.h>
+#include <test-libmongoc.h>
 
 /* test statistics counters excluding OP_INSERT, OP_UPDATE, and OP_DELETE since
  * those were superseded by write commands in 2.6. */
@@ -480,7 +482,7 @@ typedef struct _rpc_op_egress_counters {
 static rpc_op_egress_counters
 rpc_op_egress_counters_current (void)
 {
-   return (rpc_op_egress_counters){
+   return (rpc_op_egress_counters) {
       .op_egress_compressed = mongoc_counter_op_egress_compressed_count (),
       .op_egress_delete = mongoc_counter_op_egress_delete_count (),
       .op_egress_getmore = mongoc_counter_op_egress_getmore_count (),
diff -pruN 2.0.2-1/src/libmongoc/tests/test-mongoc-crud.c 2.1.0-1/src/libmongoc/tests/test-mongoc-crud.c
--- 2.0.2-1/src/libmongoc/tests/test-mongoc-crud.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-mongoc-crud.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,12 +1,13 @@
+#include <mongoc/mongoc-bulkwrite.h>
 #include <mongoc/mongoc.h>
 
-#include "json-test.h"
-#include "json-test-operations.h"
-#include "test-libmongoc.h"
-#include <mongoc/mongoc-bulkwrite.h>
 #include <mlib/cmp.h>
 #include <mlib/loop.h>
 
+#include <json-test-operations.h>
+#include <json-test.h>
+#include <test-libmongoc.h>
+
 static bool
 crud_test_operation_cb (json_test_ctx_t *ctx, const bson_t *test, const bson_t *operation)
 {
@@ -1431,8 +1432,7 @@ test_crud_install (TestSuite *suite)
                       prose_test_1,
                       NULL, /* dtor */
                       NULL, /* ctx */
-                      test_framework_skip_if_no_failpoint,
-                      test_framework_skip_if_max_wire_version_less_than_7);
+                      test_framework_skip_if_no_failpoint);
 
    TestSuite_AddFull (suite,
                       "/crud/prose_test_2",
diff -pruN 2.0.2-1/src/libmongoc/tests/test-mongoc-cursor.c 2.1.0-1/src/libmongoc/tests/test-mongoc-cursor.c
--- 2.0.2-1/src/libmongoc/tests/test-mongoc-cursor.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-mongoc-cursor.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,19 +1,21 @@
-#include <mongoc/mongoc.h>
+#include <common-string-private.h>
 #include <mongoc/mongoc-client-private.h>
-
-#include "TestSuite.h"
-#include "test-libmongoc.h"
-#include "mock_server/mock-rs.h"
-#include "mock_server/future-functions.h"
-#include <mongoc/mongoc-cursor-private.h>
 #include <mongoc/mongoc-collection-private.h>
+#include <mongoc/mongoc-cursor-private.h>
 #include <mongoc/mongoc-error-private.h>
 #include <mongoc/mongoc-read-concern-private.h>
 #include <mongoc/mongoc-write-concern-private.h>
-#include "test-conveniences.h"
-#include <common-string-private.h>
+
+#include <mongoc/mongoc.h>
+
 #include <mlib/cmp.h>
 
+#include <TestSuite.h>
+#include <mock_server/future-functions.h>
+#include <mock_server/mock-rs.h>
+#include <test-conveniences.h>
+#include <test-libmongoc.h>
+
 
 typedef mongoc_cursor_t *(*make_cursor_fn) (mongoc_collection_t *);
 
@@ -416,7 +418,7 @@ _make_array_cursor (mongoc_collection_t
 #define TEST_CURSOR_FIND(prefix, fn)                                                          \
    if (1) {                                                                                   \
       make_cursor_helper_t *const helper = bson_malloc (sizeof (*helper));                    \
-      *helper = (make_cursor_helper_t){.ctor = _make_find_cursor};                            \
+      *helper = (make_cursor_helper_t) {.ctor = _make_find_cursor};                           \
       TestSuite_AddFull (suite, prefix "/find", fn, &bson_free, helper, TestSuite_CheckLive); \
    } else                                                                                     \
       ((void) 0)
@@ -424,7 +426,7 @@ _make_array_cursor (mongoc_collection_t
 #define TEST_CURSOR_CMD(prefix, fn)                                                          \
    if (1) {                                                                                  \
       make_cursor_helper_t *const helper = bson_malloc (sizeof (*helper));                   \
-      *helper = (make_cursor_helper_t){.ctor = _make_cmd_cursor};                            \
+      *helper = (make_cursor_helper_t) {.ctor = _make_cmd_cursor};                           \
       TestSuite_AddFull (suite, prefix "/cmd", fn, &bson_free, helper, TestSuite_CheckLive); \
    } else                                                                                    \
       ((void) 0)
@@ -433,7 +435,7 @@ _make_array_cursor (mongoc_collection_t
 #define TEST_CURSOR_ARRAY(prefix, fn)                                                          \
    if (1) {                                                                                    \
       make_cursor_helper_t *const helper = bson_malloc (sizeof (*helper));                     \
-      *helper = (make_cursor_helper_t){.ctor = _make_array_cursor};                            \
+      *helper = (make_cursor_helper_t) {.ctor = _make_array_cursor};                           \
       TestSuite_AddFull (suite, prefix "/array", fn, &bson_free, helper, TestSuite_CheckLive); \
    } else                                                                                      \
       ((void) 0)
@@ -441,7 +443,7 @@ _make_array_cursor (mongoc_collection_t
 #define TEST_CURSOR_AGG(prefix, fn)                                                          \
    if (1) {                                                                                  \
       make_cursor_helper_t *const helper = bson_malloc (sizeof (*helper));                   \
-      *helper = (make_cursor_helper_t){.ctor = _make_cmd_cursor_from_agg};                   \
+      *helper = (make_cursor_helper_t) {.ctor = _make_cmd_cursor_from_agg};                  \
       TestSuite_AddFull (suite, prefix "/agg", fn, &bson_free, helper, TestSuite_CheckLive); \
    } else                                                                                    \
       ((void) 0)
diff -pruN 2.0.2-1/src/libmongoc/tests/test-mongoc-cyrus.c 2.1.0-1/src/libmongoc/tests/test-mongoc-cyrus.c
--- 2.0.2-1/src/libmongoc/tests/test-mongoc-cyrus.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-mongoc-cyrus.c	2025-08-14 18:37:23.000000000 +0000
@@ -14,13 +14,14 @@
  * limitations under the License.
  */
 
-#include <mongoc/mongoc.h>
-#include <mongoc/mongoc-cyrus-private.h>
 #include <mongoc/mongoc-client-private.h>
+#include <mongoc/mongoc-cyrus-private.h>
+
+#include <mongoc/mongoc.h>
 
-#include "TestSuite.h"
-#include "test-libmongoc.h"
-#include "test-conveniences.h"
+#include <TestSuite.h>
+#include <test-conveniences.h>
+#include <test-libmongoc.h>
 
 
 static void
diff -pruN 2.0.2-1/src/libmongoc/tests/test-mongoc-database.c 2.1.0-1/src/libmongoc/tests/test-mongoc-database.c
--- 2.0.2-1/src/libmongoc/tests/test-mongoc-database.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-mongoc-database.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,18 +1,19 @@
-#include <mongoc/mongoc.h>
+#include <common-macros-private.h> // BEGIN_IGNORE_DEPRECATIONS
+#include <mongoc/mongoc-client-private.h>
 #include <mongoc/mongoc-collection-private.h>
-#include <mongoc/mongoc-write-concern-private.h>
+#include <mongoc/mongoc-cursor-private.h>
+#include <mongoc/mongoc-database-private.h>
 #include <mongoc/mongoc-read-concern-private.h>
 #include <mongoc/mongoc-util-private.h>
+#include <mongoc/mongoc-write-concern-private.h>
 
-#include "TestSuite.h"
-#include "test-libmongoc.h"
-#include <mongoc/mongoc-client-private.h>
-#include <mongoc/mongoc-cursor-private.h>
-#include <mongoc/mongoc-database-private.h>
-#include "mock_server/future-functions.h"
-#include "mock_server/mock-server.h"
-#include "test-conveniences.h"
-#include <common-macros-private.h> // BEGIN_IGNORE_DEPRECATIONS
+#include <mongoc/mongoc.h>
+
+#include <TestSuite.h>
+#include <mock_server/future-functions.h>
+#include <mock_server/mock-server.h>
+#include <test-conveniences.h>
+#include <test-libmongoc.h>
 
 
 static void
diff -pruN 2.0.2-1/src/libmongoc/tests/test-mongoc-dns.c 2.1.0-1/src/libmongoc/tests/test-mongoc-dns.c
--- 2.0.2-1/src/libmongoc/tests/test-mongoc-dns.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-mongoc-dns.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,20 +1,23 @@
-#include <mongoc/mongoc-util-private.h>
 #include <mongoc/mongoc-client-pool-private.h>
-#include <mongoc/mongoc.h>
 #include <mongoc/mongoc-host-list-private.h>
 #include <mongoc/mongoc-thread-private.h>
 #include <mongoc/mongoc-uri-private.h>
+#include <mongoc/mongoc-util-private.h>
+
+#include <mongoc/mongoc.h>
 #include <mongoc/utlist.h>
 
 #ifdef MONGOC_ENABLE_SSL
-#include <mongoc/mongoc-ssl.h>
 #include <mongoc/mongoc-ssl-private.h>
+
+#include <mongoc/mongoc-ssl.h>
 #endif
 
-#include "json-test.h"
-#include "test-libmongoc.h"
 #include <mlib/cmp.h>
 
+#include <json-test.h>
+#include <test-libmongoc.h>
+
 static void
 _assert_options_match (const bson_t *test, mongoc_uri_t *uri)
 {
diff -pruN 2.0.2-1/src/libmongoc/tests/test-mongoc-error.c 2.1.0-1/src/libmongoc/tests/test-mongoc-error.c
--- 2.0.2-1/src/libmongoc/tests/test-mongoc-error.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-mongoc-error.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,14 +1,16 @@
+#include <mongoc/mongoc-error-private.h>
+
 #include <mongoc/mongoc.h>
 
-#include "TestSuite.h"
-#include "test-conveniences.h"
-#include "test-libmongoc.h"
-#include "mock_server/future.h"
-#include "mock_server/future-functions.h"
-#include "mock_server/mock-server.h"
-#include <mongoc/mongoc-error-private.h>
 #include <mlib/loop.h>
 
+#include <TestSuite.h>
+#include <mock_server/future-functions.h>
+#include <mock_server/future.h>
+#include <mock_server/mock-server.h>
+#include <test-conveniences.h>
+#include <test-libmongoc.h>
+
 #include <inttypes.h>
 
 
diff -pruN 2.0.2-1/src/libmongoc/tests/test-mongoc-exhaust.c 2.1.0-1/src/libmongoc/tests/test-mongoc-exhaust.c
--- 2.0.2-1/src/libmongoc/tests/test-mongoc-exhaust.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-mongoc-exhaust.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,19 +1,20 @@
-#include <fcntl.h>
-#include <mongoc/mongoc.h>
-
+#include <common-macros-private.h> // BEGIN_IGNORE_DEPRECATIONS
+#include <common-oid-private.h>
 #include <mongoc/mongoc-client-private.h>
 #include <mongoc/mongoc-cursor-private.h>
 #include <mongoc/mongoc-uri-private.h>
 #include <mongoc/mongoc-util-private.h>
 
-#include "TestSuite.h"
-#include "test-conveniences.h"
-#include "test-libmongoc.h"
-#include "mock_server/future.h"
-#include "mock_server/future-functions.h"
-#include "mock_server/mock-server.h"
-#include <common-macros-private.h> // BEGIN_IGNORE_DEPRECATIONS
-#include <common-oid-private.h>
+#include <mongoc/mongoc.h>
+
+#include <TestSuite.h>
+#include <mock_server/future-functions.h>
+#include <mock_server/future.h>
+#include <mock_server/mock-server.h>
+#include <test-conveniences.h>
+#include <test-libmongoc.h>
+
+#include <fcntl.h>
 
 
 /* Server support for exhaust cursors depends on server topology and version:
@@ -31,7 +32,7 @@
 
  * Server Version      libmongoc behavior
  * ------------------  -----------------------------------
- * mongod <4.2         uses OP_QUERY.
+ * mongod <4.2         N/A. libmongoc only supports 4.2+.
  * mongod >=4.2,<5.1   uses OP_MSG.
  * mongod >=5.1        uses OP_MSG.
 
@@ -525,7 +526,8 @@ _request_error (request_t *request, exha
    if (error_type == NETWORK_ERROR) {
       reply_to_request_with_reset (request);
    } else {
-      reply_to_request (request, MONGOC_REPLY_QUERY_FAILURE, 123, 0, 0, "{'$err': 'uh oh', 'code': 4321}");
+      reply_to_op_msg_request (
+         request, MONGOC_OP_MSG_FLAG_NONE, tmp_bson (BSON_STR ({"ok" : 0, "errmsg" : "uh oh", "code" : 4321})));
    }
 }
 
@@ -584,12 +586,17 @@ _mock_test_exhaust (bool pooled, exhaust
    cursor = mongoc_collection_find_with_opts (collection, tmp_bson ("{}"), tmp_bson ("{'exhaust': true}"), NULL);
 
    future = future_cursor_next (cursor, &doc);
-   request = mock_server_receives_query (
-      server, "db.test", MONGOC_QUERY_SECONDARY_OK | MONGOC_QUERY_EXHAUST, 0, 0, "{}", NULL);
+   // Expect "find" command with exhaust flag. Reply with one document.
+   request = mock_server_receives_msg (
+      server, MONGOC_OP_MSG_FLAG_EXHAUST_ALLOWED, tmp_bson (BSON_STR ({"find" : "test", "filter" : {}})));
 
    if (error_when == SECOND_BATCH) {
       /* initial query succeeds, gets a doc and cursor id of 123 */
-      reply_to_request (request, MONGOC_REPLY_NONE, 123, 1, 1, "{'a': 1}");
+      reply_to_op_msg_request (
+         request, MONGOC_OP_MSG_FLAG_NONE, tmp_bson (BSON_STR ({
+            "ok" : 1,
+            "cursor" : {"id" : {"$numberLong" : "123"}, "ns" : "test.test", "firstBatch" : [ {"a" : 1} ]}
+         })));
       ASSERT (future_get_bool (future));
       assert_match_bson (doc, tmp_bson ("{'a': 1}"), false);
       ASSERT_CMPINT64 ((int64_t) 123, ==, mongoc_cursor_get_id (cursor));
@@ -598,6 +605,11 @@ _mock_test_exhaust (bool pooled, exhaust
 
       /* error after initial batch */
       future = future_cursor_next (cursor, &doc);
+
+      request_destroy (request);
+      // Expect "getMore" command.
+      request = mock_server_receives_msg (
+         server, MONGOC_OP_MSG_FLAG_EXHAUST_ALLOWED, tmp_bson (BSON_STR ({"getMore" : {"$numberLong" : "123"}})));
    }
 
    _request_error (request, error_type);
@@ -606,7 +618,22 @@ _mock_test_exhaust (bool pooled, exhaust
 
    future_destroy (future);
    request_destroy (request);
-   mongoc_cursor_destroy (cursor);
+   // If error occurs after the first batch, expect `mongoc_cursor_destroy` sends `killCursors` to clean up the
+   // server-side cursor.
+   if (error_when == SECOND_BATCH && error_type != NETWORK_ERROR) {
+      // If connection is still alive, driver will try to send `getMore`, but fail.
+      future = future_cursor_destroy (cursor);
+      request = mock_server_receives_msg (
+         server,
+         MONGOC_OP_MSG_FLAG_NONE,
+         tmp_bson (BSON_STR ({"killCursors" : "test", "cursors" : [ {"$numberLong" : "123"} ]})));
+      reply_to_op_msg_request (request, MONGOC_OP_MSG_FLAG_NONE, tmp_bson ("{'ok': 1}"));
+      request_destroy (request);
+      ASSERT (future_wait (future));
+      future_destroy (future);
+   } else {
+      mongoc_cursor_destroy (cursor);
+   }
    mongoc_collection_destroy (collection);
 
    if (pooled) {
diff -pruN 2.0.2-1/src/libmongoc/tests/test-mongoc-find-and-modify.c 2.1.0-1/src/libmongoc/tests/test-mongoc-find-and-modify.c
--- 2.0.2-1/src/libmongoc/tests/test-mongoc-find-and-modify.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-mongoc-find-and-modify.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,15 +1,16 @@
-#include <bson/bcon.h>
-#include <mongoc/mongoc.h>
+#include <mongoc/mongoc-client-private.h>
 #include <mongoc/mongoc-collection-private.h>
 #include <mongoc/mongoc-find-and-modify-private.h>
-#include <mongoc/mongoc-client-private.h>
 
-#include "TestSuite.h"
+#include <mongoc/mongoc.h>
+
+#include <bson/bson-bcon.h>
 
-#include "test-libmongoc.h"
-#include "test-conveniences.h"
-#include "mock_server/future-functions.h"
-#include "mock_server/mock-server.h"
+#include <TestSuite.h>
+#include <mock_server/future-functions.h>
+#include <mock_server/mock-server.h>
+#include <test-conveniences.h>
+#include <test-libmongoc.h>
 
 static void
 auto_hello (mock_server_t *server,
diff -pruN 2.0.2-1/src/libmongoc/tests/test-mongoc-generation-map.c 2.1.0-1/src/libmongoc/tests/test-mongoc-generation-map.c
--- 2.0.2-1/src/libmongoc/tests/test-mongoc-generation-map.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-mongoc-generation-map.c	2025-08-14 18:37:23.000000000 +0000
@@ -16,7 +16,7 @@
 
 #include <mongoc/mongoc-generation-map-private.h>
 
-#include "TestSuite.h"
+#include <TestSuite.h>
 
 static void
 test_generation_map_basic (void)
diff -pruN 2.0.2-1/src/libmongoc/tests/test-mongoc-gridfs-bucket.c 2.1.0-1/src/libmongoc/tests/test-mongoc-gridfs-bucket.c
--- 2.0.2-1/src/libmongoc/tests/test-mongoc-gridfs-bucket.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-mongoc-gridfs-bucket.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,12 +1,14 @@
-#include "mock_server/mock-server.h"
-#include "mock_server/future.h"
-#include "mock_server/future-functions.h"
-#include <mongoc/mongoc.h>
 #include <mongoc/mongoc-gridfs-bucket-private.h>
-#include "json-test.h"
-#include "TestSuite.h"
-#include "test-conveniences.h"
-#include "test-libmongoc.h"
+
+#include <mongoc/mongoc.h>
+
+#include <TestSuite.h>
+#include <json-test.h>
+#include <mock_server/future-functions.h>
+#include <mock_server/future.h>
+#include <mock_server/mock-server.h>
+#include <test-conveniences.h>
+#include <test-libmongoc.h>
 
 void
 test_create_bucket (void)
diff -pruN 2.0.2-1/src/libmongoc/tests/test-mongoc-gridfs-file-page.c 2.1.0-1/src/libmongoc/tests/test-mongoc-gridfs-file-page.c
--- 2.0.2-1/src/libmongoc/tests/test-mongoc-gridfs-file-page.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-mongoc-gridfs-file-page.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,7 +1,8 @@
-#include <mongoc/mongoc.h>
 #include <mongoc/mongoc-gridfs-file-page-private.h>
 
-#include "TestSuite.h"
+#include <mongoc/mongoc.h>
+
+#include <TestSuite.h>
 
 static void
 test_create (void)
diff -pruN 2.0.2-1/src/libmongoc/tests/test-mongoc-gridfs.c 2.1.0-1/src/libmongoc/tests/test-mongoc-gridfs.c
--- 2.0.2-1/src/libmongoc/tests/test-mongoc-gridfs.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-mongoc-gridfs.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,20 +1,22 @@
 #include <mongoc/mongoc.h>
 #define MONGOC_INSIDE
-#include <mongoc/mongoc-gridfs-file-private.h>
 #include <mongoc/mongoc-client-private.h>
+#include <mongoc/mongoc-gridfs-file-private.h>
 #include <mongoc/mongoc-gridfs-private.h>
 
 #undef MONGOC_INSIDE
 
-#include "test-libmongoc.h"
-#include "TestSuite.h"
-#include "test-conveniences.h"
-#include "mock_server/mock-server.h"
-#include "mock_server/future.h"
-#include "mock_server/future-functions.h"
 #include <common-string-private.h>
+
 #include <mlib/cmp.h>
 
+#include <TestSuite.h>
+#include <mock_server/future-functions.h>
+#include <mock_server/future.h>
+#include <mock_server/mock-server.h>
+#include <test-conveniences.h>
+#include <test-libmongoc.h>
+
 
 static mongoc_gridfs_t *
 get_test_gridfs (mongoc_client_t *client, const char *name, bson_error_t *error)
diff -pruN 2.0.2-1/src/libmongoc/tests/test-mongoc-gssapi.c 2.1.0-1/src/libmongoc/tests/test-mongoc-gssapi.c
--- 2.0.2-1/src/libmongoc/tests/test-mongoc-gssapi.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-mongoc-gssapi.c	2025-08-14 18:37:23.000000000 +0000
@@ -14,9 +14,10 @@
  * limitations under the License.
  */
 
-#include <mongoc/mongoc.h>
 #include <mongoc/mongoc-thread-private.h>
 
+#include <mongoc/mongoc.h>
+
 
 static const char *GSSAPI_HOST = "MONGOC_TEST_GSSAPI_HOST";
 static const char *GSSAPI_USER = "MONGOC_TEST_GSSAPI_USER";
diff -pruN 2.0.2-1/src/libmongoc/tests/test-mongoc-handshake.c 2.1.0-1/src/libmongoc/tests/test-mongoc-handshake.c
--- 2.0.2-1/src/libmongoc/tests/test-mongoc-handshake.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-mongoc-handshake.c	2025-08-14 18:37:23.000000000 +0000
@@ -14,23 +14,28 @@
  * limitations under the License.
  */
 
-#include <stdint.h>
-#include <bson/bson.h>
 #include <mongoc/mongoc.h>
+
+#include <bson/bson.h>
+
+#include <stdint.h>
 #ifdef _POSIX_VERSION
 #include <sys/utsname.h>
 #endif
 
 #include <mongoc/mongoc-client-private.h>
-#include <mongoc/mongoc-handshake.h>
 #include <mongoc/mongoc-handshake-private.h>
 
-#include "TestSuite.h"
-#include "test-libmongoc.h"
-#include "test-conveniences.h"
-#include "mock_server/future.h"
-#include "mock_server/future-functions.h"
-#include "mock_server/mock-server.h"
+#include <mongoc/mongoc-handshake.h>
+
+#include <mlib/config.h>
+
+#include <TestSuite.h>
+#include <mock_server/future-functions.h>
+#include <mock_server/future.h>
+#include <mock_server/mock-server.h>
+#include <test-conveniences.h>
+#include <test-libmongoc.h>
 
 /*
  * Call this before any test which uses mongoc_handshake_data_append, to
@@ -394,6 +399,7 @@ clear_faas_env (void)
    ASSERT (_mongoc_setenv ("AWS_LAMBDA_FUNCTION_MEMORY_SIZE", ""));
    ASSERT (_mongoc_setenv ("FUNCTIONS_WORKER_RUNTIME", ""));
    ASSERT (_mongoc_setenv ("K_SERVICE", ""));
+   ASSERT (_mongoc_setenv ("KUBERNETES_SERVICE_HOST", ""));
    ASSERT (_mongoc_setenv ("FUNCTION_MEMORY_MB", ""));
    ASSERT (_mongoc_setenv ("FUNCTION_TIMEOUT_SEC", ""));
    ASSERT (_mongoc_setenv ("FUNCTION_REGION", ""));
@@ -642,6 +648,28 @@ test_aws_not_lambda (void *test_ctx)
 }
 
 static void
+test_aws_and_container (void *test_ctx)
+{
+   BSON_UNUSED (test_ctx);
+   ASSERT (_mongoc_setenv ("AWS_EXECUTION_ENV", "AWS_Lambda_java8"));
+   ASSERT (_mongoc_setenv ("AWS_REGION", "us-east-2"));
+   ASSERT (_mongoc_setenv ("AWS_LAMBDA_FUNCTION_MEMORY_SIZE", "1024"));
+   ASSERT (_mongoc_setenv ("KUBERNETES_SERVICE_HOST", "1"));
+
+   _override_host_platform_os ();
+   bson_t *doc = _get_handshake_document (true);
+   _handshake_check_required_fields (doc);
+
+   ASSERT_CMPSTR (bson_lookup_utf8 (doc, "container.orchestrator"), "kubernetes");
+   ASSERT_CMPSTR (bson_lookup_utf8 (doc, "env.name"), "aws.lambda");
+   _handshake_check_env (doc, default_memory_mb, 0, "us-east-2");
+
+   bson_destroy (doc);
+   clear_faas_env ();
+   _reset_handshake ();
+}
+
+static void
 test_mongoc_handshake_data_append_null_args (void)
 {
    bson_iter_t md_iter;
@@ -1257,9 +1285,12 @@ test_handshake_platform_config (void)
    BSON_ASSERT (_get_bit (config_str, MONGOC_MD_FLAG_ENABLE_SHM_COUNTERS));
 #endif
 
+   mlib_diagnostic_push ();
+   mlib_disable_constant_conditional_expression_warnings ();
    if (MONGOC_TRACE_ENABLED) {
       BSON_ASSERT (_get_bit (config_str, MONGOC_MD_FLAG_TRACE));
    }
+   mlib_diagnostic_pop ();
 
    // Check that `MONGOC_MD_FLAG_ENABLE_ICU` is always unset. libicu dependency
    // was removed in CDRIVER-4680.
@@ -1391,4 +1422,10 @@ test_handshake_install (TestSuite *suite
                       NULL /* dtor */,
                       NULL /* ctx */,
                       test_framework_skip_if_no_setenv);
+   TestSuite_AddFull (suite,
+                      "/MongoDB/handshake/faas/aws_and_container",
+                      test_aws_and_container,
+                      NULL /* dtor */,
+                      NULL /* ctx */,
+                      test_framework_skip_if_no_setenv);
 }
diff -pruN 2.0.2-1/src/libmongoc/tests/test-mongoc-hedged-reads.c 2.1.0-1/src/libmongoc/tests/test-mongoc-hedged-reads.c
--- 2.0.2-1/src/libmongoc/tests/test-mongoc-hedged-reads.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-mongoc-hedged-reads.c	2025-08-14 18:37:23.000000000 +0000
@@ -14,15 +14,17 @@
  * limitations under the License.
  */
 
+#include <mongoc/mongoc-client-private.h>
+
 #include <mongoc/mongoc.h>
 
-#include <mongoc/mongoc-client-private.h>
+#include <mlib/config.h>
 
-#include "TestSuite.h"
-#include "mock_server/mock-server.h"
-#include "mock_server/future-functions.h"
-#include "test-libmongoc.h"
-#include "test-conveniences.h"
+#include <TestSuite.h>
+#include <mock_server/future-functions.h>
+#include <mock_server/mock-server.h>
+#include <test-conveniences.h>
+#include <test-libmongoc.h>
 
 
 static void
@@ -65,7 +67,12 @@ test_mongos_hedged_reads_read_pref (void
     * with readPreference mode secondaryPreferred and hedge set, readPreference
     * MUST be sent. */
    bson_append_bool (&hedge_doc, "enabled", 7, true);
+
+   mlib_diagnostic_push ();
+   mlib_disable_deprecation_warnings ();
    mongoc_read_prefs_set_hedge (prefs, &hedge_doc);
+   mlib_diagnostic_pop ();
+
    mongoc_collection_set_read_prefs (collection, prefs);
 
    future = future_collection_estimated_document_count (collection, NULL, prefs, NULL, &error);
diff -pruN 2.0.2-1/src/libmongoc/tests/test-mongoc-http.c 2.1.0-1/src/libmongoc/tests/test-mongoc-http.c
--- 2.0.2-1/src/libmongoc/tests/test-mongoc-http.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-mongoc-http.c	2025-08-14 18:37:23.000000000 +0000
@@ -14,11 +14,13 @@
  * limitations under the License.
  */
 
-#include "TestSuite.h"
-#include "test-libmongoc.h"
-#include <mongoc/mongoc.h>
 #include <mongoc/mongoc-http-private.h>
 
+#include <mongoc/mongoc.h>
+
+#include <TestSuite.h>
+#include <test-libmongoc.h>
+
 void
 test_mongoc_http_get (void *unused)
 {
diff -pruN 2.0.2-1/src/libmongoc/tests/test-mongoc-interrupt.c 2.1.0-1/src/libmongoc/tests/test-mongoc-interrupt.c
--- 2.0.2-1/src/libmongoc/tests/test-mongoc-interrupt.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-mongoc-interrupt.c	2025-08-14 18:37:23.000000000 +0000
@@ -14,14 +14,16 @@
  * limitations under the License.
  */
 
-#include "TestSuite.h"
-#include "test-libmongoc.h"
-#include "mock_server/mock-server.h"
-#include "mock_server/future.h"
-#include <mongoc/mongoc.h>
-#include <mongoc/mongoc-interrupt-private.h>
-#include <mongoc/mongoc-client-private.h>
 #include <common-thread-private.h>
+#include <mongoc/mongoc-client-private.h>
+#include <mongoc/mongoc-interrupt-private.h>
+
+#include <mongoc/mongoc.h>
+
+#include <TestSuite.h>
+#include <mock_server/future.h>
+#include <mock_server/mock-server.h>
+#include <test-libmongoc.h>
 
 static int64_t
 _time_ms (void)
diff -pruN 2.0.2-1/src/libmongoc/tests/test-mongoc-linux-distro-scanner.c 2.1.0-1/src/libmongoc/tests/test-mongoc-linux-distro-scanner.c
--- 2.0.2-1/src/libmongoc/tests/test-mongoc-linux-distro-scanner.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-mongoc-linux-distro-scanner.c	2025-08-14 18:37:23.000000000 +0000
@@ -14,14 +14,15 @@
  * limitations under the License.
  */
 
-#include <mongoc/mongoc.h>
 #include <mongoc/mongoc-client-private.h>
-#include <mongoc/mongoc-linux-distro-scanner-private.h>
 #include <mongoc/mongoc-handshake-os-private.h>
+#include <mongoc/mongoc-linux-distro-scanner-private.h>
 
-#include "TestSuite.h"
-#include "test-libmongoc.h"
-#include "test-conveniences.h"
+#include <mongoc/mongoc.h>
+
+#include <TestSuite.h>
+#include <test-conveniences.h>
+#include <test-libmongoc.h>
 
 #ifdef MONGOC_OS_IS_LINUX
 static void
@@ -216,6 +217,8 @@ test_distro_scanner_reads (void)
 void
 test_linux_distro_scanner_install (TestSuite *suite)
 {
+   BSON_UNUSED (suite);
+
 #ifdef MONGOC_OS_IS_LINUX
    TestSuite_Add (suite, "/LinuxDistroScanner/test_read_generic_release_file", test_read_generic_release_file);
    TestSuite_Add (suite, "/LinuxDistroScanner/test_read_key_value_file", test_read_key_value_file);
diff -pruN 2.0.2-1/src/libmongoc/tests/test-mongoc-list.c 2.1.0-1/src/libmongoc/tests/test-mongoc-list.c
--- 2.0.2-1/src/libmongoc/tests/test-mongoc-list.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-mongoc-list.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,7 +1,8 @@
-#include <mongoc/mongoc.h>
 #include <mongoc/mongoc-list-private.h>
 
-#include "TestSuite.h"
+#include <mongoc/mongoc.h>
+
+#include <TestSuite.h>
 
 
 static void
diff -pruN 2.0.2-1/src/libmongoc/tests/test-mongoc-loadbalanced.c 2.1.0-1/src/libmongoc/tests/test-mongoc-loadbalanced.c
--- 2.0.2-1/src/libmongoc/tests/test-mongoc-loadbalanced.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-mongoc-loadbalanced.c	2025-08-14 18:37:23.000000000 +0000
@@ -14,15 +14,16 @@
  * limitations under the License.
  */
 
-#include <mongoc/mongoc.h>
 #include <mongoc/mongoc-client-session-private.h>
-#include "test-conveniences.h"
-#include "test-libmongoc.h"
-#include "TestSuite.h"
 
-#include "mock_server/future-functions.h"
-#include "mock_server/mock-server.h"
-#include "mock_server/request.h"
+#include <mongoc/mongoc.h>
+
+#include <TestSuite.h>
+#include <mock_server/future-functions.h>
+#include <mock_server/mock-server.h>
+#include <mock_server/request.h>
+#include <test-conveniences.h>
+#include <test-libmongoc.h>
 
 typedef struct {
    int server_changed_events;
diff -pruN 2.0.2-1/src/libmongoc/tests/test-mongoc-log.c 2.1.0-1/src/libmongoc/tests/test-mongoc-log.c
--- 2.0.2-1/src/libmongoc/tests/test-mongoc-log.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-mongoc-log.c	2025-08-14 18:37:23.000000000 +0000
@@ -14,11 +14,12 @@
  * limitations under the License.
  */
 
-#include <mongoc/mongoc.h>
-
 #include <mongoc/mongoc-log-private.h>
 #include <mongoc/mongoc-trace-private.h>
-#include "TestSuite.h"
+
+#include <mongoc/mongoc.h>
+
+#include <TestSuite.h>
 
 
 struct log_state {
diff -pruN 2.0.2-1/src/libmongoc/tests/test-mongoc-long-namespace.c 2.1.0-1/src/libmongoc/tests/test-mongoc-long-namespace.c
--- 2.0.2-1/src/libmongoc/tests/test-mongoc-long-namespace.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-mongoc-long-namespace.c	2025-08-14 18:37:23.000000000 +0000
@@ -15,14 +15,16 @@
  */
 
 
-#include <mongoc/mongoc.h>
 #include <mongoc/mongoc-change-stream-private.h>
 #include <mongoc/mongoc-collection-private.h>
 #include <mongoc/mongoc-cursor-private.h>
 #include <mongoc/mongoc-database-private.h>
-#include "TestSuite.h"
-#include "test-conveniences.h"
-#include "test-libmongoc.h"
+
+#include <mongoc/mongoc.h>
+
+#include <TestSuite.h>
+#include <test-conveniences.h>
+#include <test-libmongoc.h>
 
 typedef struct {
    char *ns;
@@ -446,7 +448,7 @@ unsupported_long_db (void)
 #define add_long_namespace_test(_name, _test_fn, ...)                              \
    if (1) {                                                                        \
       run_test_helper_t *const helper = bson_malloc (sizeof (*helper));            \
-      *helper = (run_test_helper_t){.test_fn = (_test_fn)};                        \
+      *helper = (run_test_helper_t) {.test_fn = (_test_fn)};                       \
       TestSuite_AddFull (suite, _name, run_test, &bson_free, helper, __VA_ARGS__); \
    } else                                                                          \
       ((void) 0)
diff -pruN 2.0.2-1/src/libmongoc/tests/test-mongoc-max-staleness.c 2.1.0-1/src/libmongoc/tests/test-mongoc-max-staleness.c
--- 2.0.2-1/src/libmongoc/tests/test-mongoc-max-staleness.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-mongoc-max-staleness.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,14 +1,14 @@
-#include <mongoc/mongoc.h>
+#include <mongoc/mongoc-client-private.h>
 #include <mongoc/mongoc-util-private.h>
 
-#include <mongoc/mongoc-client-private.h>
+#include <mongoc/mongoc.h>
 
-#include "TestSuite.h"
-#include "json-test.h"
-#include "test-libmongoc.h"
-#include "test-conveniences.h"
-#include "mock_server/mock-server.h"
-#include "mock_server/future-functions.h"
+#include <TestSuite.h>
+#include <json-test.h>
+#include <mock_server/future-functions.h>
+#include <mock_server/mock-server.h>
+#include <test-conveniences.h>
+#include <test-libmongoc.h>
 
 
 static int64_t
@@ -84,8 +84,9 @@ test_mongoc_client_max_staleness (void)
    ASSERT (!test_framework_client_new (
       "mongodb://a/?" MONGOC_URI_READPREFERENCE "=secondary&" MONGOC_URI_MAXSTALENESSSECONDS "=10.5", NULL));
 
-   ASSERT_CAPTURED_LOG (
-      MONGOC_URI_MAXSTALENESSSECONDS "=10.5", MONGOC_LOG_LEVEL_WARNING, "Invalid " MONGOC_URI_MAXSTALENESSSECONDS);
+   ASSERT_CAPTURED_LOG (MONGOC_URI_MAXSTALENESSSECONDS "=10.5",
+                        MONGOC_LOG_LEVEL_WARNING,
+                        "Unsupported value for \"maxstalenessseconds\"");
    capture_logs (false);
 
    /* 1 is allowed, it'll be rejected once we begin server selection */
diff -pruN 2.0.2-1/src/libmongoc/tests/test-mongoc-mongohouse.c 2.1.0-1/src/libmongoc/tests/test-mongoc-mongohouse.c
--- 2.0.2-1/src/libmongoc/tests/test-mongoc-mongohouse.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-mongoc-mongohouse.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,8 +1,8 @@
 #include <mongoc/mongoc.h>
 
-#include "json-test.h"
-#include "json-test-operations.h"
-#include "test-libmongoc.h"
+#include <json-test-operations.h>
+#include <json-test.h>
+#include <test-libmongoc.h>
 
 static const char *uri_str = "mongodb://mhuser:pencil@localhost/?serverSelectionTryOnce=false";
 
diff -pruN 2.0.2-1/src/libmongoc/tests/test-mongoc-mongos-pinning.c 2.1.0-1/src/libmongoc/tests/test-mongoc-mongos-pinning.c
--- 2.0.2-1/src/libmongoc/tests/test-mongoc-mongos-pinning.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-mongoc-mongos-pinning.c	2025-08-14 18:37:23.000000000 +0000
@@ -14,13 +14,14 @@
  * limitations under the License.
  */
 
-#include <mongoc/mongoc.h>
-#include <mongoc/mongoc-uri-private.h>
 #include <mongoc/mongoc-host-list-private.h>
+#include <mongoc/mongoc-uri-private.h>
+
+#include <mongoc/mongoc.h>
 
-#include "TestSuite.h"
-#include "test-libmongoc.h"
-#include "test-conveniences.h"
+#include <TestSuite.h>
+#include <test-conveniences.h>
+#include <test-libmongoc.h>
 
 static void
 add_multiple_mongoses (mongoc_uri_t *uri)
@@ -174,7 +175,6 @@ test_mongos_pinning_install (TestSuite *
                       NULL,
                       test_framework_skip_if_no_sessions,
                       test_framework_skip_if_no_crypto,
-                      test_framework_skip_if_max_wire_version_less_than_8,
                       test_framework_skip_if_not_mongos);
 
    TestSuite_AddFull (suite,
@@ -184,6 +184,5 @@ test_mongos_pinning_install (TestSuite *
                       NULL,
                       test_framework_skip_if_no_sessions,
                       test_framework_skip_if_no_crypto,
-                      test_framework_skip_if_max_wire_version_less_than_8,
                       test_framework_skip_if_not_mongos);
 }
diff -pruN 2.0.2-1/src/libmongoc/tests/test-mongoc-ocsp-cache.c 2.1.0-1/src/libmongoc/tests/test-mongoc-ocsp-cache.c
--- 2.0.2-1/src/libmongoc/tests/test-mongoc-ocsp-cache.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-mongoc-ocsp-cache.c	2025-08-14 18:37:23.000000000 +0000
@@ -14,10 +14,10 @@
  * limitations under the License.
  */
 
-#include "TestSuite.h"
-
 #include <mongoc/mongoc-ocsp-cache-private.h>
 
+#include <TestSuite.h>
+
 #if defined(MONGOC_ENABLE_OCSP_OPENSSL) && OPENSSL_VERSION_NUMBER >= 0x10101000L
 #include <openssl/pem.h>
 
diff -pruN 2.0.2-1/src/libmongoc/tests/test-mongoc-oidc-callback.c 2.1.0-1/src/libmongoc/tests/test-mongoc-oidc-callback.c
--- 2.0.2-1/src/libmongoc/tests/test-mongoc-oidc-callback.c	1970-01-01 00:00:00.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-mongoc-oidc-callback.c	2025-08-14 18:37:23.000000000 +0000
@@ -0,0 +1,185 @@
+/*
+ * Copyright 2009-present MongoDB, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <mongoc/mongoc-oidc-callback-private.h>
+
+//
+
+#include <TestSuite.h>
+#include <test-conveniences.h>
+
+static mongoc_oidc_credential_t *
+_test_oidc_callback_fn_cb (mongoc_oidc_callback_params_t *params)
+{
+   BSON_UNUSED (params);
+   test_error ("should not be invoked");
+}
+
+static void
+test_oidc_callback_new (void)
+{
+   // Invalid arguments.
+   {
+      ASSERT (!mongoc_oidc_callback_new (NULL));
+   }
+
+   mongoc_oidc_callback_t *const callback = mongoc_oidc_callback_new (&_test_oidc_callback_fn_cb);
+   ASSERT (mongoc_oidc_callback_get_fn (callback) == &_test_oidc_callback_fn_cb);
+
+   // Initial values.
+   {
+      ASSERT (!mongoc_oidc_callback_get_user_data (callback));
+   }
+
+   // Normal values.
+   {
+      int user_data = 0;
+
+      mongoc_oidc_callback_set_user_data (callback, &user_data);
+
+      ASSERT (mongoc_oidc_callback_get_user_data (callback) == &user_data);
+   }
+
+   // "Reset" values.
+   {
+      mongoc_oidc_callback_set_user_data (callback, NULL);
+
+      ASSERT (!mongoc_oidc_callback_get_user_data (callback));
+   }
+
+   mongoc_oidc_callback_destroy (callback);
+}
+
+static void
+test_oidc_callback_params (void)
+{
+   mongoc_oidc_callback_params_t *const params = mongoc_oidc_callback_params_new ();
+
+   // Initial values.
+   ASSERT (!mongoc_oidc_callback_params_get_timeout (params));
+   ASSERT_CMPSTR (mongoc_oidc_callback_params_get_username (params), NULL);
+   ASSERT_CMPINT32 (mongoc_oidc_callback_params_get_version (params), ==, MONGOC_PRIVATE_OIDC_CALLBACK_API_VERSION);
+   ASSERT (!mongoc_oidc_callback_params_get_cancelled_with_timeout (params));
+
+   // Input parameters.
+   {
+      // Normal values.
+      {
+         mongoc_oidc_callback_params_set_timeout (params, 123);
+         {
+            char username[] = "username";
+            mongoc_oidc_callback_params_set_username (params, username);
+            username[0] = '\0'; // Ensure a copy was made.
+         }
+         mongoc_oidc_callback_params_set_version (params, 123);
+
+         const int64_t *timeout = mongoc_oidc_callback_params_get_timeout (params);
+         ASSERT (timeout);
+         ASSERT_CMPINT64 (*timeout, ==, 123);
+         ASSERT_CMPSTR (mongoc_oidc_callback_params_get_username (params), "username");
+         ASSERT_CMPINT32 (mongoc_oidc_callback_params_get_version (params), ==, 123);
+      }
+
+      // "Reset" values.
+      {
+         mongoc_oidc_callback_params_set_username (params, NULL);
+         mongoc_oidc_callback_params_unset_timeout (params);
+         mongoc_oidc_callback_params_set_version (params, MONGOC_PRIVATE_OIDC_CALLBACK_API_VERSION);
+
+         ASSERT_CMPSTR (mongoc_oidc_callback_params_get_username (params), NULL);
+         ASSERT (!mongoc_oidc_callback_params_get_timeout (params));
+         ASSERT_CMPINT32 (
+            mongoc_oidc_callback_params_get_version (params), ==, MONGOC_PRIVATE_OIDC_CALLBACK_API_VERSION);
+      }
+   }
+
+   // Out parameters.
+   {
+      // Normal values.
+      {
+         mongoc_oidc_callback_params_cancel_with_timeout (params);
+
+         ASSERT (mongoc_oidc_callback_params_get_cancelled_with_timeout (params));
+      }
+
+      // "Reset" values.
+      {
+         mongoc_oidc_callback_params_set_cancelled_with_timeout (params, false);
+
+         ASSERT (!mongoc_oidc_callback_params_get_cancelled_with_timeout (params));
+      }
+   }
+
+   // Owning resources.
+   {
+      mongoc_oidc_callback_params_set_username (params, "must be freed");
+   }
+
+   mongoc_oidc_callback_params_destroy (params);
+}
+
+static void
+test_oidc_credential (void)
+{
+   // Normal.
+   {
+      char token[] = "token";
+      mongoc_oidc_credential_t *const cred = mongoc_oidc_credential_new (token);
+      token[0] = '\0'; // Ensure a copy was made.
+
+      ASSERT_CMPSTR (mongoc_oidc_credential_get_access_token (cred), "token");
+      ASSERT (!mongoc_oidc_credential_get_expires_in (cred));
+      mongoc_oidc_credential_destroy (cred);
+   }
+
+   // Normal with expires_in.
+   {
+      char token[] = "token";
+      mongoc_oidc_credential_t *const cred = mongoc_oidc_credential_new_with_expires_in (token, 123);
+      token[0] = '\0'; // Ensure a copy was made.
+
+      ASSERT_CMPSTR (mongoc_oidc_credential_get_access_token (cred), "token");
+      const int64_t *const expires_in = mongoc_oidc_credential_get_expires_in (cred);
+      ASSERT (expires_in);
+      ASSERT_CMPINT64 (*expires_in, ==, 123);
+      mongoc_oidc_credential_destroy (cred);
+   }
+
+   // expires_in == 0 is a valid argument.
+   {
+      mongoc_oidc_credential_t *const cred = mongoc_oidc_credential_new_with_expires_in ("token", 0);
+      ASSERT_CMPSTR (mongoc_oidc_credential_get_access_token (cred), "token");
+      const int64_t *const expires_in = mongoc_oidc_credential_get_expires_in (cred);
+      ASSERT (expires_in);
+      ASSERT_CMPINT64 (*expires_in, ==, 0);
+      mongoc_oidc_credential_destroy (cred);
+   }
+
+   // Invalid arguments.
+   {
+      ASSERT (!mongoc_oidc_credential_new (NULL));
+      ASSERT (!mongoc_oidc_credential_new_with_expires_in (NULL, 123));
+      ASSERT (!mongoc_oidc_credential_new_with_expires_in ("token", -1));
+   }
+}
+
+void
+test_mongoc_oidc_callback_install (TestSuite *suite)
+{
+   TestSuite_Add (suite, "/oidc/callback/new", test_oidc_callback_new);
+   TestSuite_Add (suite, "/oidc/callback/params", test_oidc_callback_params);
+   TestSuite_Add (suite, "/oidc/callback/credential", test_oidc_credential);
+}
diff -pruN 2.0.2-1/src/libmongoc/tests/test-mongoc-opts.c 2.1.0-1/src/libmongoc/tests/test-mongoc-opts.c
--- 2.0.2-1/src/libmongoc/tests/test-mongoc-opts.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-mongoc-opts.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,15 +1,15 @@
-#include <mongoc/mongoc.h>
 #include <mongoc/mongoc-find-and-modify-private.h>
-#include <mock_server/future.h>
-#include <mock_server/future-value.h>
 
-#include "TestSuite.h"
-#include "mock_server/future.h"
-#include "mock_server/future-functions.h"
-#include "mock_server/mock-server.h"
-#include "mock_server/mock-rs.h"
-#include "test-conveniences.h"
-#include "test-libmongoc.h"
+#include <mongoc/mongoc.h>
+
+#include <TestSuite.h>
+#include <mock_server/future-functions.h>
+#include <mock_server/future-value.h>
+#include <mock_server/future.h>
+#include <mock_server/mock-rs.h>
+#include <mock_server/mock-server.h>
+#include <test-conveniences.h>
+#include <test-libmongoc.h>
 
 
 /*
@@ -71,7 +71,7 @@ typedef struct {
 } func_ctx_t;
 
 
-typedef future_t *(func_with_opts_t) (func_ctx_t *ctx, bson_t *cmd);
+typedef future_t *(func_with_opts_t) (func_ctx_t * ctx, bson_t *cmd);
 
 
 typedef struct _opt_inheritance_test_t {
@@ -786,24 +786,15 @@ test_func_inherits_opts (void *ctx)
 
 
 /* commands that send one OP_MSG section */
-#define OPT_TEST(_opt_source, _func, _opt_type)                   \
-   {                                                              \
-      OPT_SOURCE_##_opt_source, _func, #_func, OPT_##_opt_type, 1 \
-   }
+#define OPT_TEST(_opt_source, _func, _opt_type) {OPT_SOURCE_##_opt_source, _func, #_func, OPT_##_opt_type, 1}
 
 
 /* write commands commands that send two OP_MSG sections */
-#define OPT_WRITE_TEST(_func)                              \
-   {                                                       \
-      OPT_SOURCE_COLL, _func, #_func, OPT_WRITE_CONCERN, 2 \
-   }
+#define OPT_WRITE_TEST(_func) {OPT_SOURCE_COLL, _func, #_func, OPT_WRITE_CONCERN, 2}
 
 
 /* mongoc_bulk_operation_t functions */
-#define OPT_BULK_TEST(_bulk_op)                                             \
-   {                                                                        \
-      OPT_SOURCE_COLL, bulk_exec, #_bulk_op, OPT_WRITE_CONCERN, 2, _bulk_op \
-   }
+#define OPT_BULK_TEST(_bulk_op) {OPT_SOURCE_COLL, bulk_exec, #_bulk_op, OPT_WRITE_CONCERN, 2, _bulk_op}
 
 
 static opt_inheritance_test_t gInheritanceTests[] = {
diff -pruN 2.0.2-1/src/libmongoc/tests/test-mongoc-primary-stepdown.c 2.1.0-1/src/libmongoc/tests/test-mongoc-primary-stepdown.c
--- 2.0.2-1/src/libmongoc/tests/test-mongoc-primary-stepdown.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-mongoc-primary-stepdown.c	2025-08-14 18:37:23.000000000 +0000
@@ -2,16 +2,17 @@
 // `Connections Survive Primary Step Down Tests`. See:
 // https://github.com/mongodb/specifications/tree/db3114e957f7c0976a1af09882dbb46cb4a70049/source/connections-survive-step-down/tests
 
-#include <mongoc/mongoc.h>
-#include <mongoc/mongoc-read-concern-private.h>
-#include <mongoc/mongoc-util-private.h>
 #include <mongoc/mongoc-client-private.h>
+#include <mongoc/mongoc-read-concern-private.h>
 #include <mongoc/mongoc-topology-private.h>
+#include <mongoc/mongoc-util-private.h>
 
-#include "json-test.h"
-#include "TestSuite.h"
-#include "test-conveniences.h"
-#include "test-libmongoc.h"
+#include <mongoc/mongoc.h>
+
+#include <TestSuite.h>
+#include <json-test.h>
+#include <test-conveniences.h>
+#include <test-libmongoc.h>
 
 typedef struct {
    // If `use_pooled` is true, a test is run with a `mongoc_client_t` obtained
@@ -294,82 +295,6 @@ test_not_primary_keep_pool_runner (void
 }
 
 static void
-test_not_primary_reset_pool (mongoc_client_t *client)
-{
-   mongoc_database_t *db;
-   mongoc_collection_t *coll;
-   mongoc_read_prefs_t *read_prefs;
-   bson_error_t error;
-   bool res;
-   int conn_count;
-   uint32_t primary_id;
-
-   ASSERT (client);
-
-   /* Configure fail points */
-   read_prefs = mongoc_read_prefs_new (MONGOC_READ_PRIMARY);
-   db = mongoc_client_get_database (client, "admin");
-   /* Store the primary ID. After step down, the primary may be a different
-    * server. We must execute serverStatus against the same server to check
-    * connection counts. */
-   primary_id = mongoc_topology_select_server_id (client->topology,
-                                                  MONGOC_SS_WRITE,
-                                                  TEST_SS_LOG_CONTEXT,
-                                                  NULL /* read prefs */,
-                                                  NULL /* chosen read mode */,
-                                                  NULL /* deprioritized servers */,
-                                                  &error);
-   ASSERT_OR_PRINT (primary_id, error);
-   conn_count = _connection_count (client, primary_id);
-   res = mongoc_database_command_simple (db,
-                                         tmp_bson ("{'configureFailPoint': 'failCommand', "
-                                                   "'mode': {'times': 1}, "
-                                                   "'data': {'failCommands': ['insert'], 'errorCode': 10107}}"),
-                                         read_prefs,
-                                         NULL,
-                                         &error);
-   ASSERT_OR_PRINT (res, error);
-
-   /* Capture logs to swallow warnings about endSessions */
-   capture_logs (true);
-
-   coll = mongoc_client_get_collection (client, "step-down", "step-down");
-
-   /* Execute an insert, verify that it fails with 10107 */
-   res = mongoc_collection_insert_one (coll, tmp_bson ("{'test': 1}"), NULL, NULL, &error);
-   ASSERT (!res);
-   ASSERT_CMPINT (error.code, ==, 10107);
-   ASSERT_CONTAINS (error.message, "failpoint");
-
-   /* Verify that the pool has been cleared */
-   ASSERT_CMPINT ((conn_count + 1), ==, _connection_count (client, primary_id));
-
-   /* Execute an insert into the test collection and verify it succeeds */
-   res = mongoc_collection_insert_one (coll, tmp_bson ("{'test': 1}"), NULL, NULL, &error);
-   ASSERT_OR_PRINT (res, error);
-
-   mongoc_read_prefs_destroy (read_prefs);
-   mongoc_collection_destroy (coll);
-   mongoc_database_destroy (db);
-}
-
-static void
-test_not_primary_reset_pool_runner (void *ctx_void)
-{
-   int64_t max_wire_version;
-
-   test_ctx_t *ctx = ctx_void;
-
-   /* Only run if version 4.0 */
-   test_framework_get_max_wire_version (&max_wire_version);
-   if (max_wire_version != WIRE_VERSION_4_0) {
-      return;
-   }
-
-   _run_test_single_or_pooled (test_not_primary_reset_pool, ctx->use_pooled);
-}
-
-static void
 test_shutdown_reset_pool (mongoc_client_t *client)
 {
    mongoc_database_t *db;
@@ -431,11 +356,6 @@ test_shutdown_reset_pool_runner (void *c
 {
    test_ctx_t *ctx = ctx_void;
 
-   /* Only run if version >= 4.0 */
-   if (!test_framework_max_wire_version_at_least (WIRE_VERSION_4_0)) {
-      return;
-   }
-
    _run_test_single_or_pooled (test_shutdown_reset_pool, ctx->use_pooled);
 }
 
@@ -501,11 +421,6 @@ test_interrupted_shutdown_reset_pool_run
 {
    test_ctx_t *ctx = ctx_void;
 
-   /* Only run if version >= 4.0 */
-   if (!test_framework_max_wire_version_at_least (WIRE_VERSION_4_0)) {
-      return;
-   }
-
    _run_test_single_or_pooled (test_interrupted_shutdown_reset_pool, ctx->use_pooled);
 }
 
@@ -536,7 +451,6 @@ test_primary_stepdown_install (TestSuite
 
    TestPooledAndSingle ("/Stepdown/getmore", test_getmore_iteration_runner);
    TestPooledAndSingle ("/Stepdown/not_primary_keep", test_not_primary_keep_pool_runner);
-   TestPooledAndSingle ("/Stepdown/not_primary_reset", test_not_primary_reset_pool_runner);
    TestPooledAndSingle ("/Stepdown/shutdown_reset_pool", test_shutdown_reset_pool_runner);
    TestPooledAndSingle ("/Stepdown/interrupt_shutdown", test_interrupted_shutdown_reset_pool_runner);
 }
diff -pruN 2.0.2-1/src/libmongoc/tests/test-mongoc-queue.c 2.1.0-1/src/libmongoc/tests/test-mongoc-queue.c
--- 2.0.2-1/src/libmongoc/tests/test-mongoc-queue.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-mongoc-queue.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,7 +1,8 @@
-#include <mongoc/mongoc.h>
 #include <mongoc/mongoc-queue-private.h>
 
-#include "TestSuite.h"
+#include <mongoc/mongoc.h>
+
+#include <TestSuite.h>
 
 
 static void
diff -pruN 2.0.2-1/src/libmongoc/tests/test-mongoc-read-concern.c 2.1.0-1/src/libmongoc/tests/test-mongoc-read-concern.c
--- 2.0.2-1/src/libmongoc/tests/test-mongoc-read-concern.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-mongoc-read-concern.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,14 +1,15 @@
-#include <mongoc/mongoc.h>
+#include <common-macros-private.h> // BEGIN_IGNORE_DEPRECATIONS
 #include <mongoc/mongoc-read-concern-private.h>
 #include <mongoc/mongoc-util-private.h>
 
-#include "TestSuite.h"
-#include "test-conveniences.h"
-#include "test-libmongoc.h"
-#include "mock_server/future.h"
-#include "mock_server/mock-server.h"
-#include "mock_server/future-functions.h"
-#include <common-macros-private.h> // BEGIN_IGNORE_DEPRECATIONS
+#include <mongoc/mongoc.h>
+
+#include <TestSuite.h>
+#include <mock_server/future-functions.h>
+#include <mock_server/future.h>
+#include <mock_server/mock-server.h>
+#include <test-conveniences.h>
+#include <test-libmongoc.h>
 
 
 static void
diff -pruN 2.0.2-1/src/libmongoc/tests/test-mongoc-read-prefs.c 2.1.0-1/src/libmongoc/tests/test-mongoc-read-prefs.c
--- 2.0.2-1/src/libmongoc/tests/test-mongoc-read-prefs.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-mongoc-read-prefs.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,13 +1,16 @@
-#include <mongoc/mongoc.h>
 #include <mongoc/mongoc-uri-private.h>
 
-#include "TestSuite.h"
-#include "mock_server/future.h"
-#include "mock_server/future-functions.h"
-#include "mock_server/mock-server.h"
-#include "mock_server/mock-rs.h"
-#include "test-conveniences.h"
-#include "test-libmongoc.h"
+#include <mongoc/mongoc.h>
+
+#include <mlib/config.h>
+
+#include <TestSuite.h>
+#include <mock_server/future-functions.h>
+#include <mock_server/future.h>
+#include <mock_server/mock-rs.h>
+#include <mock_server/mock-server.h>
+#include <test-conveniences.h>
+#include <test-libmongoc.h>
 
 static bool
 _can_be_command (const char *query)
@@ -482,21 +485,21 @@ test_read_prefs_mongos_max_staleness (vo
    prefs = mongoc_read_prefs_new (MONGOC_READ_SECONDARY_PREFERRED);
    mongoc_read_prefs_set_max_staleness_seconds (prefs, 120);
 
-   /* exhaust cursor is required per CDRIVER-3633 so the driver downgrades the
-    * OP_QUERY find command to an OP_QUERY legacy find */
    cursor = mongoc_collection_find_with_opts (collection, tmp_bson ("{'a': 1}"), tmp_bson ("{'exhaust': true}"), prefs);
    future = future_cursor_next (cursor, &doc);
-   request = mock_server_receives_query (server,
-                                         "test.test",
-                                         MONGOC_QUERY_EXHAUST | MONGOC_QUERY_SECONDARY_OK,
-                                         0,
-                                         0,
-                                         "{'$query': {'a': 1},"
-                                         " '$readPreference': {'mode': 'secondaryPreferred',"
-                                         "                     'maxStalenessSeconds': 120}}",
-                                         "{}");
 
-   reply_to_find_request (request, MONGOC_QUERY_EXHAUST | MONGOC_QUERY_SECONDARY_OK, 0, 1, "test.test", "{}", false);
+   // Expect find command with exhaust flag and read preference. Reply with one document.
+   {
+      const bson_t *cmd = tmp_bson (BSON_STR ({
+         "find" : "test",
+         "filter" : {"a" : 1},
+         "$readPreference" : {"mode" : "secondaryPreferred", "maxStalenessSeconds" : {"$numberLong" : "120"}}
+      }));
+      request = mock_server_receives_msg (server, MONGOC_OP_MSG_FLAG_EXHAUST_ALLOWED, cmd);
+      const bson_t *reply = tmp_bson (
+         BSON_STR ({"ok" : 1, "cursor" : {"id" : {"$numberLong" : "0"}, "ns" : "test.test", "firstBatch" : [ {} ]}}));
+      reply_to_op_msg_request (request, MONGOC_OP_MSG_FLAG_NONE, reply);
+   }
 
    /* mongoc_cursor_next returned true */
    BSON_ASSERT (future_get_bool (future));
@@ -532,7 +535,10 @@ test_read_prefs_mongos_hedged_reads (voi
    prefs = mongoc_read_prefs_new (MONGOC_READ_SECONDARY_PREFERRED);
    bson_append_bool (&hedge_doc, "enabled", 7, true);
 
+   mlib_diagnostic_push ();
+   mlib_disable_deprecation_warnings ();
    mongoc_read_prefs_set_hedge (prefs, &hedge_doc);
+   mlib_diagnostic_pop ();
 
    cursor = mongoc_collection_find_with_opts (collection, tmp_bson ("{'a': 1}"), tmp_bson ("{'exhaust': true}"), prefs);
    future = future_cursor_next (cursor, &doc);
diff -pruN 2.0.2-1/src/libmongoc/tests/test-mongoc-read-write-concern.c 2.1.0-1/src/libmongoc/tests/test-mongoc-read-write-concern.c
--- 2.0.2-1/src/libmongoc/tests/test-mongoc-read-write-concern.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-mongoc-read-write-concern.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,12 +1,14 @@
+#include <mongoc/mongoc-opts-helpers-private.h>
+#include <mongoc/mongoc-read-concern-private.h>
+#include <mongoc/mongoc-util-private.h>
+#include <mongoc/mongoc-write-concern-private.h>
+
 #include <mongoc/mongoc.h>
+
 #include <bson/bson-types.h>
 
-#include <mongoc/mongoc-util-private.h>
-#include <mongoc/mongoc-write-concern-private.h>
-#include <mongoc/mongoc-read-concern-private.h>
-#include <mongoc/mongoc-opts-helpers-private.h>
-#include "json-test.h"
-#include "test-libmongoc.h"
+#include <json-test.h>
+#include <test-libmongoc.h>
 
 
 static void
diff -pruN 2.0.2-1/src/libmongoc/tests/test-mongoc-retryability-helpers.c 2.1.0-1/src/libmongoc/tests/test-mongoc-retryability-helpers.c
--- 2.0.2-1/src/libmongoc/tests/test-mongoc-retryability-helpers.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-mongoc-retryability-helpers.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,12 +1,12 @@
-#include "test-mongoc-retryability-helpers.h"
-
-#include <bson/bson-error.h>
+#include "./test-mongoc-retryability-helpers.h"
 
 #include <mongoc/mongoc-array-private.h>
 
-#include "test-conveniences.h"
-#include "test-libmongoc.h"
-#include "TestSuite.h"
+#include <bson/error.h>
+
+#include <TestSuite.h>
+#include <test-conveniences.h>
+#include <test-libmongoc.h>
 
 #include <stddef.h>
 
diff -pruN 2.0.2-1/src/libmongoc/tests/test-mongoc-retryable-reads.c 2.1.0-1/src/libmongoc/tests/test-mongoc-retryable-reads.c
--- 2.0.2-1/src/libmongoc/tests/test-mongoc-retryable-reads.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-mongoc-retryable-reads.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,14 +1,14 @@
-#include <mongoc/mongoc.h>
-
 #include <mongoc/mongoc-collection-private.h>
 
-#include "json-test.h"
-#include "test-libmongoc.h"
-#include "mock_server/mock-rs.h"
-#include "mock_server/future.h"
-#include "mock_server/future-functions.h"
-#include "json-test-operations.h"
-#include "test-mongoc-retryability-helpers.h"
+#include <mongoc/mongoc.h>
+
+#include <json-test-operations.h>
+#include <json-test.h>
+#include <mock_server/future-functions.h>
+#include <mock_server/future.h>
+#include <mock_server/mock-rs.h>
+#include <test-libmongoc.h>
+#include <test-mongoc-retryability-helpers.h>
 
 static bool
 retryable_reads_test_run_operation (json_test_ctx_t *ctx, const bson_t *test, const bson_t *operation)
@@ -563,13 +563,11 @@ void
 test_retryable_reads_install (TestSuite *suite)
 {
    test_all_spec_tests (suite);
-   /* Since we need failpoints, require wire version 7 */
    TestSuite_AddFull (suite,
                       "/retryable_reads/cmd_helpers",
                       test_cmd_helpers,
                       NULL,
                       NULL,
-                      test_framework_skip_if_max_wire_version_less_than_7,
                       test_framework_skip_if_mongos,
                       test_framework_skip_if_no_failpoint);
    TestSuite_AddFull (suite,
@@ -577,7 +575,6 @@ test_retryable_reads_install (TestSuite
                       test_retry_reads_off,
                       NULL,
                       NULL,
-                      test_framework_skip_if_max_wire_version_less_than_7,
                       test_framework_skip_if_mongos,
                       test_framework_skip_if_no_failpoint);
    TestSuite_AddFull (suite,
@@ -586,16 +583,12 @@ test_retryable_reads_install (TestSuite
                       NULL,
                       NULL,
                       test_framework_skip_if_not_mongos,
-                      test_framework_skip_if_no_failpoint,
-                      // `retryReads=true` is a 4.2+ feature.
-                      test_framework_skip_if_max_wire_version_less_than_8);
+                      test_framework_skip_if_no_failpoint);
    TestSuite_AddFull (suite,
                       "/retryable_reads/sharded/on_same_mongos",
                       test_retry_reads_sharded_on_same_mongos,
                       NULL,
                       NULL,
                       test_framework_skip_if_not_mongos,
-                      test_framework_skip_if_no_failpoint,
-                      // `retryReads=true` is a 4.2+ feature.
-                      test_framework_skip_if_max_wire_version_less_than_8);
+                      test_framework_skip_if_no_failpoint);
 }
diff -pruN 2.0.2-1/src/libmongoc/tests/test-mongoc-retryable-writes.c 2.1.0-1/src/libmongoc/tests/test-mongoc-retryable-writes.c
--- 2.0.2-1/src/libmongoc/tests/test-mongoc-retryable-writes.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-mongoc-retryable-writes.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,14 +1,14 @@
-#include <mongoc/mongoc.h>
-
 #include <mongoc/mongoc-collection-private.h>
 
-#include "json-test.h"
-#include "test-libmongoc.h"
-#include "mock_server/mock-rs.h"
-#include "mock_server/future.h"
-#include "mock_server/future-functions.h"
-#include "json-test-operations.h"
-#include "test-mongoc-retryability-helpers.h"
+#include <mongoc/mongoc.h>
+
+#include <json-test-operations.h>
+#include <json-test.h>
+#include <mock_server/future-functions.h>
+#include <mock_server/future.h>
+#include <mock_server/mock-rs.h>
+#include <test-libmongoc.h>
+#include <test-mongoc-retryability-helpers.h>
 
 
 static bool
diff -pruN 2.0.2-1/src/libmongoc/tests/test-mongoc-sample-commands.c 2.1.0-1/src/libmongoc/tests/test-mongoc-sample-commands.c
--- 2.0.2-1/src/libmongoc/tests/test-mongoc-sample-commands.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-mongoc-sample-commands.c	2025-08-14 18:37:23.000000000 +0000
@@ -30,9 +30,9 @@
 #include <mongoc/mongoc-database-private.h>
 #include <mongoc/mongoc-collection-private.h>
 
-#include "TestSuite.h"
-#include "test-libmongoc.h"
-#include "test-conveniences.h"
+#include <TestSuite.h>
+#include <test-libmongoc.h>
+#include <test-conveniences.h>
 
 
 typedef void (*sample_command_fn_t) (mongoc_database_t *db);
diff -pruN 2.0.2-1/src/libmongoc/tests/test-mongoc-scram.c 2.1.0-1/src/libmongoc/tests/test-mongoc-scram.c
--- 2.0.2-1/src/libmongoc/tests/test-mongoc-scram.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-mongoc-scram.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,14 +1,14 @@
-#include <mongoc/mongoc.h>
-#include <mock_server/mock-server.h>
-#include <mock_server/future.h>
-#include <mock_server/future-functions.h>
-
 #include <mongoc/mongoc-crypto-private.h>
 #include <mongoc/mongoc-scram-private.h>
 
-#include "TestSuite.h"
-#include "test-conveniences.h"
-#include "test-libmongoc.h"
+#include <mongoc/mongoc.h>
+
+#include <TestSuite.h>
+#include <mock_server/future-functions.h>
+#include <mock_server/future.h>
+#include <mock_server/mock-server.h>
+#include <test-conveniences.h>
+#include <test-libmongoc.h>
 
 #ifdef MONGOC_ENABLE_SSL
 static void
diff -pruN 2.0.2-1/src/libmongoc/tests/test-mongoc-sdam-monitoring.c 2.1.0-1/src/libmongoc/tests/test-mongoc-sdam-monitoring.c
--- 2.0.2-1/src/libmongoc/tests/test-mongoc-sdam-monitoring.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-mongoc-sdam-monitoring.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,16 +1,17 @@
-#include <mongoc/mongoc.h>
-#include "json-test.h"
-
 #include <mongoc/mongoc-client-private.h>
 #include <mongoc/mongoc-topology-description-apm-private.h>
 
-#include "test-libmongoc.h"
-#include "mock_server/mock-server.h"
-#include "mock_server/future.h"
-#include "mock_server/future-functions.h"
-#include "json-test-monitoring.h"
+#include <mongoc/mongoc.h>
+
 #include <mlib/cmp.h>
 
+#include <json-test-monitoring.h>
+#include <json-test.h>
+#include <mock_server/future-functions.h>
+#include <mock_server/future.h>
+#include <mock_server/mock-server.h>
+#include <test-libmongoc.h>
+
 #ifdef BSON_HAVE_STRINGS_H
 #include <strings.h>
 #endif
diff -pruN 2.0.2-1/src/libmongoc/tests/test-mongoc-sdam.c 2.1.0-1/src/libmongoc/tests/test-mongoc-sdam.c
--- 2.0.2-1/src/libmongoc/tests/test-mongoc-sdam.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-mongoc-sdam.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,15 +1,14 @@
-#include <mongoc/mongoc.h>
-
-#include <mongoc/mongoc-set-private.h>
 #include <common-oid-private.h>
-
-#include "json-test.h"
-
-#include <mongoc/mongoc-socket-private.h>
 #include <mongoc/mongoc-client-private.h>
-#include <mongoc/mongoc-topology-private.h>
+#include <mongoc/mongoc-set-private.h>
+#include <mongoc/mongoc-socket-private.h>
 #include <mongoc/mongoc-topology-description-apm-private.h>
-#include "test-libmongoc.h"
+#include <mongoc/mongoc-topology-private.h>
+
+#include <mongoc/mongoc.h>
+
+#include <json-test.h>
+#include <test-libmongoc.h>
 
 #ifdef BSON_HAVE_STRINGS_H
 #include <strings.h>
@@ -153,6 +152,19 @@ test_sdam_cb (void *test_vp)
    BSON_ASSERT_PARAM (test_vp);
    const bson_t *const test = test_vp;
 
+   static const test_skip_t skips[] = {
+      {.description = "Pre-4.2",
+       .check_substring = true,
+       .reason = "libmongoc does not support servers older than 4.2"},
+      {0} // NULL terminated.
+   };
+
+   BSON_ASSERT (bson_iter_init_find (&iter, test, "description"));
+   const char *description = bson_iter_utf8 (&iter, NULL);
+   if (test_should_be_skipped (skips, description)) {
+      return;
+   }
+
    /* parse out the uri and use it to create a client */
    BSON_ASSERT (bson_iter_init_find (&iter, test, "uri"));
    client = test_framework_client_new (bson_iter_utf8 (&iter, NULL), NULL);
diff -pruN 2.0.2-1/src/libmongoc/tests/test-mongoc-secure-channel.c 2.1.0-1/src/libmongoc/tests/test-mongoc-secure-channel.c
--- 2.0.2-1/src/libmongoc/tests/test-mongoc-secure-channel.c	1970-01-01 00:00:00.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-mongoc-secure-channel.c	2025-08-14 18:37:23.000000000 +0000
@@ -0,0 +1,304 @@
+#include "./TestSuite.h"
+#include "./test-libmongoc.h"
+
+#include <mongoc/mongoc.h>
+
+#if defined(MONGOC_ENABLE_SSL_SECURE_CHANNEL)
+#include <mongoc/mongoc-client-private.h>     // mongoc_client_connect_tcp
+#include <mongoc/mongoc-host-list-private.h>  // _mongoc_host_list_from_string_with_err
+#include <mongoc/mongoc-log-private.h>        // _mongoc_log_get_handler
+#include <mongoc/mongoc-stream-tls-private.h> // _mongoc_stream_tls_t
+#include <mongoc/mongoc-stream-tls-secure-channel-private.h>
+
+#include <mlib/test.h>
+
+#include <test-conveniences.h>
+
+static mongoc_stream_t *
+connect_with_secure_channel_cred (const mongoc_ssl_opt_t *ssl_opt, mongoc_shared_ptr cred_ptr, bson_error_t *error)
+{
+   mongoc_host_list_t host;
+   const int32_t connect_timout_ms = 10000;
+
+   *error = (bson_error_t) {0};
+
+   if (!_mongoc_host_list_from_string_with_err (&host, "localhost:27017", error)) {
+      return false;
+   }
+   mongoc_stream_t *tcp_stream = mongoc_client_connect_tcp (connect_timout_ms, &host, error);
+   if (!tcp_stream) {
+      return false;
+   }
+
+   mongoc_stream_t *tls_stream = mongoc_stream_tls_secure_channel_new_with_creds (tcp_stream, ssl_opt, cred_ptr);
+   if (!tls_stream) {
+      mongoc_stream_destroy (tcp_stream);
+      return false;
+   }
+
+   if (!mongoc_stream_tls_handshake_block (tls_stream, host.host, connect_timout_ms, error)) {
+      mongoc_stream_destroy (tls_stream);
+      return false;
+   }
+
+   return tls_stream;
+}
+
+// Test a TLS stream can be create with shared Secure Channel credentials.
+static void
+test_secure_channel_shared_creds_stream (void *unused)
+{
+   BSON_UNUSED (unused);
+
+   bson_error_t error;
+   const mongoc_ssl_opt_t ssl_opt = {.ca_file = CERT_TEST_DIR "/ca.pem", .pem_file = CERT_TEST_DIR "/client.pem"};
+   // Test with no sharing:
+   {
+      mongoc_stream_t *stream = connect_with_secure_channel_cred (&ssl_opt, MONGOC_SHARED_PTR_NULL, &error);
+      ASSERT_OR_PRINT (stream, error);
+      mongoc_stream_destroy (stream);
+   }
+
+   // Test with sharing:
+   {
+      mongoc_shared_ptr cred_ptr =
+         mongoc_shared_ptr_create (mongoc_secure_channel_cred_new (&ssl_opt), mongoc_secure_channel_cred_deleter);
+      {
+         mongoc_stream_t *stream = connect_with_secure_channel_cred (&ssl_opt, cred_ptr, &error);
+         ASSERT_OR_PRINT (stream, error);
+         // Check same credentials are stored on stream:
+         {
+            mongoc_stream_tls_t *tls_stream = (mongoc_stream_tls_t *) stream;
+            mongoc_stream_tls_secure_channel_t *schannel = tls_stream->ctx;
+            ASSERT_CMPVOID (schannel->cred_ptr.ptr, ==, cred_ptr.ptr);
+         }
+
+         ASSERT_CMPINT (mongoc_shared_ptr_use_count (cred_ptr), ==, 2);
+         mongoc_stream_destroy (stream);
+         ASSERT_CMPINT (mongoc_shared_ptr_use_count (cred_ptr), ==, 1);
+      }
+
+      // Use again:
+      {
+         mongoc_stream_t *stream = connect_with_secure_channel_cred (&ssl_opt, cred_ptr, &error);
+         ASSERT_OR_PRINT (stream, error);
+         // Check same credentials are stored on stream:
+         {
+            mongoc_stream_tls_t *tls_stream = (mongoc_stream_tls_t *) stream;
+            mongoc_stream_tls_secure_channel_t *schannel = tls_stream->ctx;
+            ASSERT_CMPVOID (schannel->cred_ptr.ptr, ==, cred_ptr.ptr);
+         }
+
+         ASSERT_CMPINT (mongoc_shared_ptr_use_count (cred_ptr), ==, 2);
+         mongoc_stream_destroy (stream);
+         ASSERT_CMPINT (mongoc_shared_ptr_use_count (cred_ptr), ==, 1);
+      }
+      mongoc_shared_ptr_reset_null (&cred_ptr);
+   }
+
+   // Test with bad SCHANNEL_CRED to exercise error path:
+   {
+      mongoc_secure_channel_cred *cred = mongoc_secure_channel_cred_new (&ssl_opt);
+      mongoc_shared_ptr cred_ptr = mongoc_shared_ptr_create (cred, mongoc_secure_channel_cred_deleter);
+      cred->cred.dwVersion = 0; // Invalid version.
+      capture_logs (true);
+      mongoc_stream_t *stream = connect_with_secure_channel_cred (&ssl_opt, cred_ptr, &error);
+      ASSERT (!stream);
+      ASSERT_CAPTURED_LOG ("schannel", MONGOC_LOG_LEVEL_ERROR, "Failed to initialize security context");
+      mongoc_shared_ptr_reset_null (&cred_ptr);
+   }
+}
+
+typedef struct {
+   size_t failures;
+   size_t failures2;
+} cert_failures;
+
+static void
+count_cert_failures (mongoc_log_level_t log_level, const char *log_domain, const char *message, void *user_data)
+{
+   BSON_UNUSED (log_level);
+   BSON_UNUSED (log_domain);
+   cert_failures *cf = user_data;
+   if (strstr (message, "Failed to open file: 'does-not-exist.pem'")) {
+      cf->failures++;
+   }
+   if (strstr (message, "Failed to open file: 'does-not-exist-2.pem'")) {
+      cf->failures2++;
+   }
+}
+
+static bool
+try_ping (mongoc_client_t *client, bson_error_t *error)
+{
+   return mongoc_client_command_simple (client, "admin", tmp_bson (BSON_STR ({"ping" : 1})), NULL, NULL, error);
+}
+
+static bool
+try_ping_with_reconnect (mongoc_client_t *client, bson_error_t *error)
+{
+   // Force a connection error with a failpoint:
+   if (!mongoc_client_command_simple (client,
+                                      "admin",
+                                      tmp_bson (BSON_STR ({
+                                         "configureFailPoint" : "failCommand",
+                                         "mode" : {"times" : 1},
+                                         "data" : {"closeConnection" : true, "failCommands" : ["ping"]}
+                                      })),
+                                      NULL,
+                                      NULL,
+                                      error)) {
+      return false;
+   }
+
+   // Expect first ping to fail:
+   if (try_ping (client, error)) {
+      bson_set_error (error, 0, 0, "unexpected: ping succeeded, but expected to fail");
+      return false;
+   }
+
+   // Ping again:
+   return try_ping (client, error);
+}
+
+static void
+test_secure_channel_shared_creds_client (void *unused)
+{
+   BSON_UNUSED (unused);
+
+   bson_error_t error;
+
+   // Save log function:
+   mongoc_log_func_t saved_log_func;
+   void *saved_log_data;
+   _mongoc_log_get_handler (&saved_log_func, &saved_log_data);
+
+   // Set log function to count failed attempts to load client cert:
+   cert_failures cf = {0};
+   mongoc_log_set_handler (count_cert_failures, &cf);
+
+   // Test client:
+   {
+      mongoc_client_t *client = test_framework_new_default_client ();
+
+      // Set client cert to a bad path:
+      {
+         mongoc_ssl_opt_t ssl_opt = *test_framework_get_ssl_opts ();
+         ssl_opt.pem_file = "does-not-exist.pem";
+         mongoc_client_set_ssl_opts (client, &ssl_opt);
+      }
+
+      // Expect insert OK. Cert fails to load, but server configured with --tlsAllowConnectionsWithoutCertificates:
+      {
+         bool ok = try_ping (client, &error);
+         ASSERT_OR_PRINT (ok, error);
+      }
+
+      // Expect exactly one attempt to load the client cert:
+      mlib_check (1, eq, cf.failures);
+      mongoc_client_destroy (client);
+   }
+
+   cf = (cert_failures) {0};
+
+   // Test pool:
+   {
+      mongoc_client_pool_t *pool = test_framework_new_default_client_pool ();
+
+      // Set client cert to a bad path:
+      {
+         mongoc_ssl_opt_t ssl_opt = *test_framework_get_ssl_opts ();
+         ssl_opt.pem_file = "does-not-exist.pem";
+         mongoc_client_pool_set_ssl_opts (pool, &ssl_opt);
+      }
+
+      mongoc_client_t *client = mongoc_client_pool_pop (pool);
+
+      // Expect insert OK. Cert fails to load, but server configured with --tlsAllowConnectionsWithoutCertificates:
+      {
+         bool ok = try_ping (client, &error);
+         ASSERT_OR_PRINT (ok, error);
+      }
+
+      mongoc_client_pool_push (pool, client);
+
+      // Expect exactly one attempt to load the client cert:
+      mlib_check (1, eq, cf.failures);
+
+      mongoc_client_pool_destroy (pool);
+   }
+
+   cf = (cert_failures) {0};
+
+   // Test client changing TLS options after connecting:
+   {
+      // Changing TLS options after connecting is prohibited on a client pool, but not on a single-threaded client.
+      // It is not a documented feature, but is tested for OpenSSL.
+      mongoc_client_t *client = test_framework_new_default_client ();
+
+      // Set client cert to a bad path:
+      {
+         mongoc_ssl_opt_t ssl_opt = *test_framework_get_ssl_opts ();
+         ssl_opt.pem_file = "does-not-exist.pem";
+         mongoc_client_set_ssl_opts (client, &ssl_opt);
+      }
+
+      // Expect insert OK. Cert fails to load, but server configured with --tlsAllowConnectionsWithoutCertificates:
+      {
+         bool ok = try_ping (client, &error);
+         ASSERT_OR_PRINT (ok, error);
+      }
+
+      // Expect exactly one attempt to load the client cert:
+      mlib_check (1, eq, cf.failures);
+      mlib_check (0, eq, cf.failures2);
+
+      // Change the client cert:
+      {
+         mongoc_ssl_opt_t ssl_opt = *test_framework_get_ssl_opts ();
+         ssl_opt.pem_file = "does-not-exist-2.pem";
+         mongoc_client_set_ssl_opts (client, &ssl_opt);
+      }
+
+      // Force a reconnect.
+      {
+         bool ok = try_ping_with_reconnect (client, &error);
+         ASSERT_OR_PRINT (ok, error);
+      }
+
+      // Expect an attempt to load the new cert:
+      mlib_check (1, eq, cf.failures); // Unchanged.
+      mlib_check (1, eq, cf.failures2);
+
+      mongoc_client_destroy (client);
+   }
+
+   // Restore log handler:
+   mongoc_log_set_handler (saved_log_func, saved_log_data);
+}
+
+void
+test_secure_channel_install (TestSuite *suite)
+{
+   TestSuite_AddFull (suite,
+                      "/secure_channel/shared_creds/stream",
+                      test_secure_channel_shared_creds_stream,
+                      NULL,
+                      NULL,
+                      test_framework_skip_if_no_server_ssl);
+
+   TestSuite_AddFull (suite,
+                      "/secure_channel/shared_creds/client",
+                      test_secure_channel_shared_creds_client,
+                      NULL,
+                      NULL,
+                      test_framework_skip_if_no_server_ssl);
+}
+
+#else  // MONGOC_ENABLE_SSL_SECURE_CHANNEL
+void
+test_secure_channel_install (TestSuite *suite)
+{
+   BSON_UNUSED (suite);
+}
+#endif // MONGOC_ENABLE_SSL_SECURE_CHANNEL
diff -pruN 2.0.2-1/src/libmongoc/tests/test-mongoc-server-description.c 2.1.0-1/src/libmongoc/tests/test-mongoc-server-description.c
--- 2.0.2-1/src/libmongoc/tests/test-mongoc-server-description.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-mongoc-server-description.c	2025-08-14 18:37:23.000000000 +0000
@@ -14,11 +14,13 @@
  * limitations under the License.
  */
 
-#include <mongoc/mongoc.h>
 #include <mongoc/mongoc-client-private.h>
 #include <mongoc/mongoc-server-description-private.h>
-#include "TestSuite.h"
-#include "test-conveniences.h"
+
+#include <mongoc/mongoc.h>
+
+#include <TestSuite.h>
+#include <test-conveniences.h>
 
 void
 reset_basic_sd (mongoc_server_description_t *sd)
diff -pruN 2.0.2-1/src/libmongoc/tests/test-mongoc-server-selection-errors.c 2.1.0-1/src/libmongoc/tests/test-mongoc-server-selection-errors.c
--- 2.0.2-1/src/libmongoc/tests/test-mongoc-server-selection-errors.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-mongoc-server-selection-errors.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,10 +1,10 @@
-#include <mongoc/mongoc.h>
-
 #include <mongoc/mongoc-client-pool-private.h>
 
-#include "TestSuite.h"
-#include "test-conveniences.h"
-#include "test-libmongoc.h"
+#include <mongoc/mongoc.h>
+
+#include <TestSuite.h>
+#include <test-conveniences.h>
+#include <test-libmongoc.h>
 
 
 static mongoc_stream_t *
diff -pruN 2.0.2-1/src/libmongoc/tests/test-mongoc-server-selection.c 2.1.0-1/src/libmongoc/tests/test-mongoc-server-selection.c
--- 2.0.2-1/src/libmongoc/tests/test-mongoc-server-selection.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-mongoc-server-selection.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,7 +1,7 @@
 #include <mongoc/mongoc.h>
 
-#include "json-test.h"
-#include "test-libmongoc.h"
+#include <json-test.h>
+#include <test-libmongoc.h>
 
 
 /*
diff -pruN 2.0.2-1/src/libmongoc/tests/test-mongoc-server-stream.c 2.1.0-1/src/libmongoc/tests/test-mongoc-server-stream.c
--- 2.0.2-1/src/libmongoc/tests/test-mongoc-server-stream.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-mongoc-server-stream.c	2025-08-14 18:37:23.000000000 +0000
@@ -14,15 +14,17 @@
  * limitations under the License.
  */
 
-#include "mock_server/mock-server.h"
-#include "mock_server/request.h"
-#include "mock_server/future.h"
-#include "mock_server/future-functions.h"
-#include <mongoc/mongoc.h>
 #include <mongoc/mongoc-client-private.h>
-#include "test-conveniences.h"
-#include "test-libmongoc.h"
-#include "TestSuite.h"
+
+#include <mongoc/mongoc.h>
+
+#include <TestSuite.h>
+#include <mock_server/future-functions.h>
+#include <mock_server/future.h>
+#include <mock_server/mock-server.h>
+#include <mock_server/request.h>
+#include <test-conveniences.h>
+#include <test-libmongoc.h>
 
 #define HELLO_SERVER_ONE                  \
    tmp_str ("{'ok': 1,"                   \
diff -pruN 2.0.2-1/src/libmongoc/tests/test-mongoc-set.c 2.1.0-1/src/libmongoc/tests/test-mongoc-set.c
--- 2.0.2-1/src/libmongoc/tests/test-mongoc-set.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-mongoc-set.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,8 +1,8 @@
-#include <mongoc/mongoc.h>
-
 #include <mongoc/mongoc-set-private.h>
 
-#include "TestSuite.h"
+#include <mongoc/mongoc.h>
+
+#include <TestSuite.h>
 
 static void
 test_set_dtor (void *item_, void *ctx_)
diff -pruN 2.0.2-1/src/libmongoc/tests/test-mongoc-shared.c 2.1.0-1/src/libmongoc/tests/test-mongoc-shared.c
--- 2.0.2-1/src/libmongoc/tests/test-mongoc-shared.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-mongoc-shared.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,7 +1,7 @@
-#include "TestSuite.h"
-
 #include <mongoc/mongoc-shared-private.h>
 
+#include <TestSuite.h>
+
 typedef struct {
    int value;
    int *store_value_on_dtor;
diff -pruN 2.0.2-1/src/libmongoc/tests/test-mongoc-socket.c 2.1.0-1/src/libmongoc/tests/test-mongoc-socket.c
--- 2.0.2-1/src/libmongoc/tests/test-mongoc-socket.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-mongoc-socket.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,14 +1,16 @@
-#include <fcntl.h>
-#include <mongoc/mongoc.h>
-#include <mongoc/mongoc-util-private.h>
-
+#include <mongoc/mongoc-errno-private.h>
 #include <mongoc/mongoc-socket-private.h>
 #include <mongoc/mongoc-thread-private.h>
-#include <mongoc/mongoc-errno-private.h>
-#include "TestSuite.h"
+#include <mongoc/mongoc-util-private.h>
+
+#include <mongoc/mongoc.h>
+
 #include <mlib/cmp.h>
 
-#include "test-libmongoc.h"
+#include <TestSuite.h>
+#include <test-libmongoc.h>
+
+#include <fcntl.h>
 
 #define TIMEOUT 10000
 #define WAIT 1000
diff -pruN 2.0.2-1/src/libmongoc/tests/test-mongoc-speculative-auth.c 2.1.0-1/src/libmongoc/tests/test-mongoc-speculative-auth.c
--- 2.0.2-1/src/libmongoc/tests/test-mongoc-speculative-auth.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-mongoc-speculative-auth.c	2025-08-14 18:37:23.000000000 +0000
@@ -20,15 +20,16 @@
 #endif
 
 #include <mongoc/mongoc-client-private.h>
-#include <mongoc/mongoc-handshake.h>
 #include <mongoc/mongoc-handshake-private.h>
 
-#include "TestSuite.h"
-#include "test-libmongoc.h"
-#include "test-conveniences.h"
-#include "mock_server/future.h"
-#include "mock_server/future-functions.h"
-#include "mock_server/mock-server.h"
+#include <mongoc/mongoc-handshake.h>
+
+#include <TestSuite.h>
+#include <mock_server/future-functions.h>
+#include <mock_server/future.h>
+#include <mock_server/mock-server.h>
+#include <test-conveniences.h>
+#include <test-libmongoc.h>
 
 typedef void (*setup_uri_options_t) (mongoc_uri_t *uri);
 typedef void (*compare_auth_command_t) (bson_t *auth_command);
diff -pruN 2.0.2-1/src/libmongoc/tests/test-mongoc-ssl.c 2.1.0-1/src/libmongoc/tests/test-mongoc-ssl.c
--- 2.0.2-1/src/libmongoc/tests/test-mongoc-ssl.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-mongoc-ssl.c	2025-08-14 18:37:23.000000000 +0000
@@ -14,11 +14,13 @@
  * limitations under the License.
  */
 
-#include "TestSuite.h"
-#include <mongoc/mongoc-config.h>
-#include "test-conveniences.h"
 #include <common-string-private.h>
 
+#include <mongoc/mongoc-config.h>
+
+#include <TestSuite.h>
+#include <test-conveniences.h>
+
 #ifdef MONGOC_ENABLE_SSL
 #include <mongoc/mongoc-ssl-private.h>
 
diff -pruN 2.0.2-1/src/libmongoc/tests/test-mongoc-stream-tls-error.c 2.1.0-1/src/libmongoc/tests/test-mongoc-stream-tls-error.c
--- 2.0.2-1/src/libmongoc/tests/test-mongoc-stream-tls-error.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-mongoc-stream-tls-error.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,16 +1,17 @@
-#include <mongoc/mongoc.h>
 #include <mongoc/mongoc-thread-private.h>
 #include <mongoc/mongoc-util-private.h>
+
 #include <mongoc/mongoc-stream-tls.h>
+#include <mongoc/mongoc.h>
 
 #ifdef MONGOC_ENABLE_SSL_OPENSSL
 #include <openssl/err.h>
 #endif
 
-#include "ssl-test.h"
-#include "test-conveniences.h"
-#include "TestSuite.h"
-#include "test-libmongoc.h"
+#include <TestSuite.h>
+#include <ssl-test.h>
+#include <test-conveniences.h>
+#include <test-libmongoc.h>
 
 #define TIMEOUT 10000 /* milliseconds */
 
diff -pruN 2.0.2-1/src/libmongoc/tests/test-mongoc-stream-tls.c 2.1.0-1/src/libmongoc/tests/test-mongoc-stream-tls.c
--- 2.0.2-1/src/libmongoc/tests/test-mongoc-stream-tls.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-mongoc-stream-tls.c	2025-08-14 18:37:23.000000000 +0000
@@ -5,10 +5,10 @@
 #include <openssl/err.h>
 #endif
 
-#include "ssl-test.h"
-#include "TestSuite.h"
-#include "test-libmongoc.h"
-#include "test-conveniences.h"
+#include <TestSuite.h>
+#include <ssl-test.h>
+#include <test-conveniences.h>
+#include <test-libmongoc.h>
 
 #if !defined(MONGOC_ENABLE_SSL_SECURE_CHANNEL)
 
@@ -413,6 +413,8 @@ test_mongoc_tls_insecure_nowarning (void
 void
 test_stream_tls_install (TestSuite *suite)
 {
+   BSON_UNUSED (suite);
+
 #if !defined(MONGOC_ENABLE_SSL_SECURE_CHANNEL)
 
    /* Disable /TLS/commonName on macOS due to CDRIVER-4256. */
diff -pruN 2.0.2-1/src/libmongoc/tests/test-mongoc-stream.c 2.1.0-1/src/libmongoc/tests/test-mongoc-stream.c
--- 2.0.2-1/src/libmongoc/tests/test-mongoc-stream.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-mongoc-stream.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,10 +1,12 @@
+#include <mongoc/mongoc-stream-private.h>
 
-#include <fcntl.h>
 #include <mongoc/mongoc.h>
-#include <mongoc/mongoc-stream-private.h>
-#include <stdlib.h>
 
-#include "TestSuite.h"
+#include <TestSuite.h>
+
+#include <fcntl.h>
+
+#include <stdlib.h>
 
 
 static void
@@ -182,7 +184,7 @@ _writev_timeout_stream_new (void)
 {
    writev_timeout_stream_t *const stream = bson_malloc (sizeof (writev_timeout_stream_t));
 
-   *stream = (writev_timeout_stream_t){
+   *stream = (writev_timeout_stream_t) {
       .vtable =
          {
             .type = 999, // For testing purposes.
diff -pruN 2.0.2-1/src/libmongoc/tests/test-mongoc-streamable-hello.c 2.1.0-1/src/libmongoc/tests/test-mongoc-streamable-hello.c
--- 2.0.2-1/src/libmongoc/tests/test-mongoc-streamable-hello.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-mongoc-streamable-hello.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,15 +1,15 @@
-#include <mongoc/mongoc.h>
-
-#include "mock_server/future.h"
-#include "mock_server/future-functions.h"
-#include "mock_server/mock-server.h"
-#include "TestSuite.h"
-#include "test-conveniences.h"
-#include "test-libmongoc.h"
-
 #include <mongoc/mongoc-client-private.h>
-#include <mongoc/mongoc-topology-private.h>
 #include <mongoc/mongoc-topology-description-private.h>
+#include <mongoc/mongoc-topology-private.h>
+
+#include <mongoc/mongoc.h>
+
+#include <TestSuite.h>
+#include <mock_server/future-functions.h>
+#include <mock_server/future.h>
+#include <mock_server/mock-server.h>
+#include <test-conveniences.h>
+#include <test-libmongoc.h>
 
 #define TV1 "{ 'processId': { '$oid': 'AABBAABBAABBAABBAABBAABB' }, 'counter': 1 }"
 #define TV2 "{ 'processId': { '$oid': 'AABBAABBAABBAABBAABBAABB' }, 'counter': 2 }"
diff -pruN 2.0.2-1/src/libmongoc/tests/test-mongoc-structured-log.c 2.1.0-1/src/libmongoc/tests/test-mongoc-structured-log.c
--- 2.0.2-1/src/libmongoc/tests/test-mongoc-structured-log.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-mongoc-structured-log.c	2025-08-14 18:37:23.000000000 +0000
@@ -14,11 +14,12 @@
  * limitations under the License.
  */
 
+#include <mongoc/mongoc-structured-log-private.h>
+
 #include <mongoc/mongoc.h>
 
-#include <mongoc/mongoc-structured-log-private.h>
-#include "test-libmongoc.h"
-#include "TestSuite.h"
+#include <TestSuite.h>
+#include <test-libmongoc.h>
 
 typedef struct log_assumption {
    mongoc_structured_log_envelope_t expected_envelope;
diff -pruN 2.0.2-1/src/libmongoc/tests/test-mongoc-thread.c 2.1.0-1/src/libmongoc/tests/test-mongoc-thread.c
--- 2.0.2-1/src/libmongoc/tests/test-mongoc-thread.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-mongoc-thread.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,7 +1,7 @@
 #include <mongoc/mongoc-thread-private.h>
 
-#include "TestSuite.h"
-#include "test-libmongoc.h"
+#include <TestSuite.h>
+#include <test-libmongoc.h>
 
 
 static void
diff -pruN 2.0.2-1/src/libmongoc/tests/test-mongoc-timeout.c 2.1.0-1/src/libmongoc/tests/test-mongoc-timeout.c
--- 2.0.2-1/src/libmongoc/tests/test-mongoc-timeout.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-mongoc-timeout.c	2025-08-14 18:37:23.000000000 +0000
@@ -14,11 +14,11 @@
  * limitations under the License.
  */
 
-#include "TestSuite.h"
-#include "test-libmongoc.h"
-
 #include <mongoc/mongoc-timeout-private.h>
 
+#include <TestSuite.h>
+#include <test-libmongoc.h>
+
 void
 _test_mongoc_timeout_new_success (int64_t expected)
 {
diff -pruN 2.0.2-1/src/libmongoc/tests/test-mongoc-topology-description.c 2.1.0-1/src/libmongoc/tests/test-mongoc-topology-description.c
--- 2.0.2-1/src/libmongoc/tests/test-mongoc-topology-description.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-mongoc-topology-description.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,12 +1,13 @@
-#include <mongoc/mongoc.h>
-#include <mongoc/mongoc-set-private.h>
+#include <common-oid-private.h>
 #include <mongoc/mongoc-client-pool-private.h>
 #include <mongoc/mongoc-client-private.h>
-#include <common-oid-private.h>
+#include <mongoc/mongoc-set-private.h>
+
+#include <mongoc/mongoc.h>
 
-#include "TestSuite.h"
-#include "test-libmongoc.h"
-#include "test-conveniences.h"
+#include <TestSuite.h>
+#include <test-conveniences.h>
+#include <test-libmongoc.h>
 
 static void
 _test_has_readable_writable_server (bool pooled)
diff -pruN 2.0.2-1/src/libmongoc/tests/test-mongoc-topology-reconcile.c 2.1.0-1/src/libmongoc/tests/test-mongoc-topology-reconcile.c
--- 2.0.2-1/src/libmongoc/tests/test-mongoc-topology-reconcile.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-mongoc-topology-reconcile.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,17 +1,17 @@
-#include <mongoc/mongoc.h>
-
-#include <mongoc/mongoc-client-private.h>
+#include <common-atomic-private.h>
 #include <mongoc/mongoc-client-pool-private.h>
+#include <mongoc/mongoc-client-private.h>
 #include <mongoc/mongoc-util-private.h>
+
+#include <mongoc/mongoc.h>
 #include <mongoc/utlist.h>
 
-#include "mock_server/future.h"
-#include "mock_server/future-functions.h"
-#include "mock_server/mock-server.h"
-#include "TestSuite.h"
-#include "test-conveniences.h"
-#include "test-libmongoc.h"
-#include <common-atomic-private.h>
+#include <TestSuite.h>
+#include <mock_server/future-functions.h>
+#include <mock_server/future.h>
+#include <mock_server/mock-server.h>
+#include <test-conveniences.h>
+#include <test-libmongoc.h>
 
 
 static mongoc_topology_scanner_node_t *
diff -pruN 2.0.2-1/src/libmongoc/tests/test-mongoc-topology-scanner.c 2.1.0-1/src/libmongoc/tests/test-mongoc-topology-scanner.c
--- 2.0.2-1/src/libmongoc/tests/test-mongoc-topology-scanner.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-mongoc-topology-scanner.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,20 +1,20 @@
-#include <mongoc/mongoc.h>
-#include <mongoc/mongoc-stream-private.h>
-#include <mongoc/mongoc-socket-private.h>
+#include <common-oid-private.h>
+#include <mongoc/mongoc-client-private.h>
 #include <mongoc/mongoc-host-list-private.h>
-#include <mongoc/utlist.h>
-
+#include <mongoc/mongoc-socket-private.h>
+#include <mongoc/mongoc-stream-private.h>
 #include <mongoc/mongoc-util-private.h>
-#include <mongoc/mongoc-client-private.h>
-#include "common-oid-private.h"
 
-#include "TestSuite.h"
-#include "mock_server/mock-server.h"
-#include "mock_server/mock-rs.h"
-#include "mock_server/future.h"
-#include "mock_server/future-functions.h"
-#include "test-conveniences.h"
-#include "test-libmongoc.h"
+#include <mongoc/mongoc.h>
+#include <mongoc/utlist.h>
+
+#include <TestSuite.h>
+#include <mock_server/future-functions.h>
+#include <mock_server/future.h>
+#include <mock_server/mock-rs.h>
+#include <mock_server/mock-server.h>
+#include <test-conveniences.h>
+#include <test-libmongoc.h>
 
 #define TIMEOUT 20000 /* milliseconds */
 #define NSERVERS 10
diff -pruN 2.0.2-1/src/libmongoc/tests/test-mongoc-topology.c 2.1.0-1/src/libmongoc/tests/test-mongoc-topology.c
--- 2.0.2-1/src/libmongoc/tests/test-mongoc-topology.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-mongoc-topology.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,19 +1,19 @@
-#include <mongoc/mongoc.h>
-#include <mongoc/mongoc-uri-private.h>
-#include <mongoc/mongoc-client-pool-private.h>
 #include <common-oid-private.h>
-
+#include <mongoc/mongoc-client-pool-private.h>
 #include <mongoc/mongoc-client-private.h>
 #include <mongoc/mongoc-server-api-private.h>
-#include <mongoc/mongoc-util-private.h>
 #include <mongoc/mongoc-topology-background-monitoring-private.h>
-#include "TestSuite.h"
+#include <mongoc/mongoc-uri-private.h>
+#include <mongoc/mongoc-util-private.h>
+
+#include <mongoc/mongoc.h>
 
-#include "test-libmongoc.h"
-#include "mock_server/mock-server.h"
-#include "mock_server/future.h"
-#include "mock_server/future-functions.h"
-#include "test-conveniences.h"
+#include <TestSuite.h>
+#include <mock_server/future-functions.h>
+#include <mock_server/future.h>
+#include <mock_server/mock-server.h>
+#include <test-conveniences.h>
+#include <test-libmongoc.h>
 
 #undef MONGOC_LOG_DOMAIN
 #define MONGOC_LOG_DOMAIN "topology-test"
diff -pruN 2.0.2-1/src/libmongoc/tests/test-mongoc-transactions.c 2.1.0-1/src/libmongoc/tests/test-mongoc-transactions.c
--- 2.0.2-1/src/libmongoc/tests/test-mongoc-transactions.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-mongoc-transactions.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,18 +1,18 @@
-#include <mongoc/mongoc.h>
-
+#include <common-macros-private.h> // BEGIN_IGNORE_DEPRECATIONS
 #include <mongoc/mongoc-collection-private.h>
-
-#include "json-test.h"
-#include "test-libmongoc.h"
-#include "mock_server/mock-rs.h"
-#include "mock_server/future.h"
-#include "mock_server/future-functions.h"
-#include "json-test-operations.h"
-#include <mongoc/mongoc-uri-private.h>
 #include <mongoc/mongoc-host-list-private.h>
 #include <mongoc/mongoc-read-concern-private.h>
+#include <mongoc/mongoc-uri-private.h>
 #include <mongoc/mongoc-write-concern-private.h>
-#include <common-macros-private.h> // BEGIN_IGNORE_DEPRECATIONS
+
+#include <mongoc/mongoc.h>
+
+#include <json-test-operations.h>
+#include <json-test.h>
+#include <mock_server/future-functions.h>
+#include <mock_server/future.h>
+#include <mock_server/mock-rs.h>
+#include <test-libmongoc.h>
 
 /* Reset server state by disabling failpoints, killing sessions, and... running
  * a distinct command. */
@@ -412,7 +412,7 @@ _test_transient_txn_err (bool hangup)
 
    server = mock_server_new ();
    mock_server_run (server);
-   rs_response_to_hello (server, WIRE_VERSION_4_0, true /* primary */, false /* tags */, server, NULL);
+   rs_response_to_hello (server, WIRE_VERSION_MIN, true /* primary */, false /* tags */, server, NULL);
 
    client = test_framework_client_new_from_uri (mock_server_get_uri (server), NULL);
    /* allow fast reconnect */
@@ -561,7 +561,7 @@ test_unknown_commit_result (void)
 
    server = mock_server_new ();
    mock_server_run (server);
-   rs_response_to_hello (server, WIRE_VERSION_4_0, true /* primary */, false /* tags */, server, NULL);
+   rs_response_to_hello (server, WIRE_VERSION_MIN, true /* primary */, false /* tags */, server, NULL);
 
    client = test_framework_client_new_from_uri (mock_server_get_uri (server), NULL);
    /* allow fast reconnect */
@@ -725,35 +725,6 @@ test_inherit_from_client (void *ctx)
    mongoc_client_destroy (client);
 }
 
-void
-test_transaction_fails_on_unsupported_version_or_sharded_cluster (void *ctx)
-{
-   bson_error_t error;
-   mongoc_client_session_t *session;
-   mongoc_client_t *client;
-   bool r;
-
-   BSON_UNUSED (ctx);
-
-   client = test_framework_new_default_client ();
-   session = mongoc_client_start_session (client, NULL, &error);
-   ASSERT_OR_PRINT (session, error);
-
-   r = mongoc_client_session_start_transaction (session, NULL, &error);
-   if (!test_framework_max_wire_version_at_least (7) ||
-       (test_framework_is_mongos () && !test_framework_max_wire_version_at_least (8))) {
-      BSON_ASSERT (!r);
-      ASSERT_CONTAINS (error.message,
-                       "Multi-document transactions are not supported by this "
-                       "server version");
-   } else {
-      ASSERT_OR_PRINT (r, error);
-   }
-
-   mongoc_client_session_destroy (session);
-   mongoc_client_destroy (client);
-}
-
 
 static void
 test_transaction_recovery_token_cleared (void *ctx)
@@ -943,7 +914,7 @@ test_get_transaction_opts (void)
 
    server = mock_server_new ();
    mock_server_run (server);
-   rs_response_to_hello (server, WIRE_VERSION_4_0, true /* primary */, false /* tags */, server, NULL);
+   rs_response_to_hello (server, WIRE_VERSION_MIN, true /* primary */, false /* tags */, server, NULL);
 
    client = test_framework_client_new_from_uri (mock_server_get_uri (server), NULL);
    BSON_ASSERT (client);
@@ -1092,21 +1063,12 @@ test_transactions_install (TestSuite *su
    TestSuite_AddFull (
       suite, "/transactions/inherit_from_client", test_inherit_from_client, NULL, NULL, test_framework_skip_if_no_txns);
    TestSuite_AddFull (suite,
-                      "/transactions/"
-                      "transaction_fails_on_unsupported_version_or_sharded_cluster",
-                      test_transaction_fails_on_unsupported_version_or_sharded_cluster,
-                      NULL,
-                      NULL,
-                      test_framework_skip_if_no_sessions,
-                      test_framework_skip_if_no_crypto);
-   TestSuite_AddFull (suite,
                       "/transactions/recovery_token_cleared",
                       test_transaction_recovery_token_cleared,
                       NULL,
                       NULL,
                       test_framework_skip_if_no_sessions,
                       test_framework_skip_if_no_crypto,
-                      test_framework_skip_if_max_wire_version_less_than_8,
                       test_framework_skip_if_not_mongos);
    TestSuite_AddFull (suite,
                       "/transactions/selected_server_pinned_to_mongos",
@@ -1114,7 +1076,6 @@ test_transactions_install (TestSuite *su
                       NULL,
                       NULL,
                       test_framework_skip_if_no_sessions,
-                      test_framework_skip_if_max_wire_version_less_than_8,
                       test_framework_skip_if_not_mongos);
    TestSuite_AddMockServerTest (
       suite, "/transactions/get_transaction_opts", test_get_transaction_opts, test_framework_skip_if_no_crypto);
diff -pruN 2.0.2-1/src/libmongoc/tests/test-mongoc-ts-pool.c 2.1.0-1/src/libmongoc/tests/test-mongoc-ts-pool.c
--- 2.0.2-1/src/libmongoc/tests/test-mongoc-ts-pool.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-mongoc-ts-pool.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,12 +1,12 @@
 #include <mongoc/mongoc-ts-pool-private.h>
 
-#include "TestSuite.h"
-#include "test-libmongoc.h"
+#include <TestSuite.h>
+#include <test-libmongoc.h>
 
 static void
 test_ts_pool_empty (void)
 {
-   mongoc_ts_pool *pool = mongoc_ts_pool_new ((mongoc_ts_pool_params){.element_size = sizeof (int)});
+   mongoc_ts_pool *pool = mongoc_ts_pool_new ((mongoc_ts_pool_params) {.element_size = sizeof (int)});
    BSON_ASSERT (mongoc_ts_pool_is_empty (pool));
    mongoc_ts_pool_free (pool);
 }
@@ -15,7 +15,7 @@ test_ts_pool_empty (void)
 static void
 test_ts_pool_simple (void)
 {
-   mongoc_ts_pool *pool = mongoc_ts_pool_new ((mongoc_ts_pool_params){.element_size = sizeof (int)});
+   mongoc_ts_pool *pool = mongoc_ts_pool_new ((mongoc_ts_pool_params) {.element_size = sizeof (int)});
    int *item;
    int *item2;
 
diff -pruN 2.0.2-1/src/libmongoc/tests/test-mongoc-uri.c 2.1.0-1/src/libmongoc/tests/test-mongoc-uri.c
--- 2.0.2-1/src/libmongoc/tests/test-mongoc-uri.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-mongoc-uri.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,18 +1,18 @@
-#include <mongoc/mongoc.h>
-#include <mongoc/mongoc-util-private.h>
-
+#include <common-string-private.h>
 #include <mongoc/mongoc-client-private.h>
+#include <mongoc/mongoc-host-list-private.h>
 #include <mongoc/mongoc-topology-private.h>
 #include <mongoc/mongoc-uri-private.h>
-#include <mongoc/mongoc-host-list-private.h>
+#include <mongoc/mongoc-util-private.h>
 
-#include "TestSuite.h"
+#include <mongoc/mongoc.h>
 
-#include "test-libmongoc.h"
-#include "test-conveniences.h"
-#include <common-string-private.h>
 #include <mlib/loop.h>
 
+#include <TestSuite.h>
+#include <test-conveniences.h>
+#include <test-libmongoc.h>
+
 static void
 test_mongoc_uri_new (void)
 {
@@ -46,6 +46,12 @@ test_mongoc_uri_new (void)
    ASSERT (!mongoc_uri_new ("mongodb://localhost::27017"));
    ASSERT (!mongoc_uri_new ("mongodb://localhost,localhost::"));
    ASSERT (!mongoc_uri_new ("mongodb://local1,local2,local3/d?k"));
+   // %-encoded chars that are invalid in the database name
+   ASSERT (!mongoc_uri_new ("mongodb://local1,local2,local3/db%2fname")); // "/"
+   ASSERT (!mongoc_uri_new ("mongodb://local1,local2,local3/db%20ame"));  // " "
+   ASSERT (!mongoc_uri_new ("mongodb://local1,local2,local3/db%5came"));  // "\"
+   ASSERT (!mongoc_uri_new ("mongodb://local1,local2,local3/db%24ame"));  // "$"
+   ASSERT (!mongoc_uri_new ("mongodb://local1,local2,local3/db%22ame"));  // '"'
    ASSERT (!mongoc_uri_new (""));
    ASSERT (!mongoc_uri_new ("mongodb://,localhost:27017"));
    ASSERT (!mongoc_uri_new ("mongodb://localhost:27017,,b"));
@@ -251,19 +257,19 @@ test_mongoc_uri_new (void)
    capture_logs (true);
    uri = mongoc_uri_new ("mongodb://u%ser:pwd@localhost:27017");
    ASSERT (!uri);
-   ASSERT_CAPTURED_LOG ("uri", MONGOC_LOG_LEVEL_WARNING, "Invalid % escape sequence");
+   ASSERT_CAPTURED_LOG ("uri", MONGOC_LOG_LEVEL_WARNING, "Invalid %-encoding in username in URI string");
    capture_logs (false);
 
    capture_logs (true);
    uri = mongoc_uri_new ("mongodb://user:p%wd@localhost:27017");
    ASSERT (!uri);
-   ASSERT_CAPTURED_LOG ("uri", MONGOC_LOG_LEVEL_WARNING, "Invalid % escape sequence");
+   ASSERT_CAPTURED_LOG ("uri", MONGOC_LOG_LEVEL_WARNING, "Invalid %-encoding in password in URI string");
    capture_logs (false);
 
    capture_logs (true);
    uri = mongoc_uri_new ("mongodb://user:pwd@local% host:27017");
    ASSERT (!uri);
-   ASSERT_CAPTURED_LOG ("uri", MONGOC_LOG_LEVEL_WARNING, "Invalid % escape sequence");
+   ASSERT_CAPTURED_LOG ("uri", MONGOC_LOG_LEVEL_WARNING, "Invalid %-sequence \"% h\"");
    capture_logs (false);
 
    uri = mongoc_uri_new ("mongodb://christian%40realm@localhost:27017/?replicaset=%20");
@@ -1400,7 +1406,7 @@ test_mongoc_uri_functions (void)
    mongoc_uri_destroy (uri);
 }
 
-#define BSON_ERROR_INIT ((bson_error_t){.code = 0u, .domain = 0u, .message = {0}, .reserved = 0u})
+#define BSON_ERROR_INIT ((bson_error_t) {.code = 0u, .domain = 0u, .message = {0}, .reserved = 0u})
 
 static void
 test_mongoc_uri_new_with_error (void)
@@ -1415,12 +1421,15 @@ test_mongoc_uri_new_with_error (void)
    mongoc_uri_destroy (uri);
 
    ASSERT (!mongoc_uri_new_with_error ("mongodb://", &error));
-   ASSERT_ERROR_CONTAINS (error, MONGOC_ERROR_COMMAND, MONGOC_ERROR_COMMAND_INVALID_ARG, "Invalid host string in URI");
+   ASSERT_ERROR_CONTAINS (
+      error, MONGOC_ERROR_COMMAND, MONGOC_ERROR_COMMAND_INVALID_ARG, "Host list of URI string cannot be empty");
 
    error = BSON_ERROR_INIT;
    ASSERT (!mongoc_uri_new_with_error ("mongo://localhost", &error));
-   ASSERT_ERROR_CONTAINS (
-      error, MONGOC_ERROR_COMMAND, MONGOC_ERROR_COMMAND_INVALID_ARG, "Invalid URI Schema, expecting 'mongodb://'");
+   ASSERT_ERROR_CONTAINS (error,
+                          MONGOC_ERROR_COMMAND,
+                          MONGOC_ERROR_COMMAND_INVALID_ARG,
+                          "Invalid URI scheme \"mongo://\". Expected one of \"mongodb://\" or \"mongodb+srv://\"");
 
    error = BSON_ERROR_INIT;
    ASSERT (!mongoc_uri_new_with_error ("mongodb://localhost/?readPreference=unknown", &error));
@@ -1449,24 +1458,22 @@ test_mongoc_uri_new_with_error (void)
 
    error = BSON_ERROR_INIT;
    ASSERT (!mongoc_uri_new_with_error ("mongodb://user%p:pass@localhost/", &error));
-   ASSERT_ERROR_CONTAINS (error,
-                          MONGOC_ERROR_COMMAND,
-                          MONGOC_ERROR_COMMAND_INVALID_ARG,
-                          "Incorrect URI escapes in username. Percent-encode "
-                          "username and password according to RFC 3986");
+   ASSERT_ERROR_CONTAINS (
+      error, MONGOC_ERROR_COMMAND, MONGOC_ERROR_COMMAND_INVALID_ARG, "Invalid %-encoding in username in URI string");
 
    error = BSON_ERROR_INIT;
    ASSERT (!mongoc_uri_new_with_error ("mongodb://l%oc, alhost/", &error));
-   ASSERT_ERROR_CONTAINS (error, MONGOC_ERROR_COMMAND, MONGOC_ERROR_COMMAND_INVALID_ARG, "Invalid host string in URI");
+   ASSERT_ERROR_CONTAINS (
+      error, MONGOC_ERROR_COMMAND, MONGOC_ERROR_COMMAND_INVALID_ARG, "Invalid host specifier \"l%oc\"");
 
    error = BSON_ERROR_INIT;
    ASSERT (!mongoc_uri_new_with_error ("mongodb:///tmp/mongodb.sock", &error));
-   ASSERT_ERROR_CONTAINS (error, MONGOC_ERROR_COMMAND, MONGOC_ERROR_COMMAND_INVALID_ARG, "Invalid host string in URI");
+   ASSERT_ERROR_CONTAINS (
+      error, MONGOC_ERROR_COMMAND, MONGOC_ERROR_COMMAND_INVALID_ARG, "Host list of URI string cannot be empty");
 
    error = BSON_ERROR_INIT;
    ASSERT (!mongoc_uri_new_with_error ("mongodb://localhost/db.na%me", &error));
-   ASSERT_ERROR_CONTAINS (
-      error, MONGOC_ERROR_COMMAND, MONGOC_ERROR_COMMAND_INVALID_ARG, "Invalid database name in URI");
+   ASSERT_ERROR_CONTAINS (error, MONGOC_ERROR_COMMAND, MONGOC_ERROR_COMMAND_INVALID_ARG, "Invalid %-sequence \"%me\"");
 
    error = BSON_ERROR_INIT;
    ASSERT (!mongoc_uri_new_with_error ("mongodb://localhost/db?journal=true&w=0", &error));
@@ -1498,15 +1505,18 @@ test_mongoc_uri_new_with_error (void)
 
    error = BSON_ERROR_INIT;
    ASSERT (!mongoc_uri_new_with_error ("mongodb+srv://%", &error));
-   ASSERT_ERROR_CONTAINS (error, MONGOC_ERROR_COMMAND, MONGOC_ERROR_COMMAND_INVALID_ARG, "Invalid service name in URI");
+   ASSERT_ERROR_CONTAINS (
+      error, MONGOC_ERROR_COMMAND, MONGOC_ERROR_COMMAND_INVALID_ARG, "Invalid SRV service name \"%\" in URI");
 
    error = BSON_ERROR_INIT;
    ASSERT (!mongoc_uri_new_with_error ("mongodb+srv://x", &error));
-   ASSERT_ERROR_CONTAINS (error, MONGOC_ERROR_COMMAND, MONGOC_ERROR_COMMAND_INVALID_ARG, "Invalid service name in URI");
+   ASSERT_ERROR_CONTAINS (
+      error, MONGOC_ERROR_COMMAND, MONGOC_ERROR_COMMAND_INVALID_ARG, "Invalid SRV service name \"x\" in URI");
 
    error = BSON_ERROR_INIT;
    ASSERT (!mongoc_uri_new_with_error ("mongodb+srv://x.y", &error));
-   ASSERT_ERROR_CONTAINS (error, MONGOC_ERROR_COMMAND, MONGOC_ERROR_COMMAND_INVALID_ARG, "Invalid service name in URI");
+   ASSERT_ERROR_CONTAINS (
+      error, MONGOC_ERROR_COMMAND, MONGOC_ERROR_COMMAND_INVALID_ARG, "Invalid SRV service name \"x.y\" in URI");
 
    error = BSON_ERROR_INIT;
    ASSERT (!mongoc_uri_new_with_error ("mongodb+srv://a.b.c,d.e.f", &error));
@@ -1597,10 +1607,7 @@ test_mongoc_host_list_from_string (void)
 
    capture_logs (true);
    ASSERT (!_mongoc_host_list_from_string (&host_list, "[::1]extra_chars:27017"));
-   ASSERT_CAPTURED_LOG ("_mongoc_host_list_from_string",
-                        MONGOC_LOG_LEVEL_ERROR,
-                        "If present, port should immediately follow the \"]\""
-                        "in an IPv6 address");
+   ASSERT_CAPTURED_LOG ("_mongoc_host_list_from_string", MONGOC_LOG_LEVEL_ERROR, "Invalid trailing content");
 
    /* normal parsing, host and port are split, host is downcased */
    ASSERT (_mongoc_host_list_from_string (&host_list, "localHOST:27019"));
@@ -1707,7 +1714,7 @@ test_mongoc_uri_compressors (void)
    capture_logs (true);
    mongoc_uri_set_compressors (uri, "");
    ASSERT_EQUAL_BSON (tmp_bson ("{}"), mongoc_uri_get_compressors (uri));
-   ASSERT_CAPTURED_LOG ("mongoc_uri_set_compressors", MONGOC_LOG_LEVEL_WARNING, "Unsupported compressor: ''");
+   ASSERT_NO_CAPTURED_LOGS ("Disable compression with empty string");
 
 
    /* Disable compression */
@@ -2232,11 +2239,11 @@ test_mongoc_uri_long_hostname (void)
 
    capture_logs (true);
    ASSERT (!mongoc_uri_new (uri_str));
-   ASSERT_CAPTURED_LOG ("mongoc_uri_new", MONGOC_LOG_LEVEL_ERROR, "too long");
+   ASSERT_CAPTURED_LOG ("mongoc_uri_new", MONGOC_LOG_LEVEL_WARNING, "too long");
 
    clear_captured_logs ();
    ASSERT (!mongoc_uri_new_for_host_port (host, 12345));
-   ASSERT_CAPTURED_LOG ("mongoc_uri_new", MONGOC_LOG_LEVEL_ERROR, "too long");
+   ASSERT_CAPTURED_LOG ("mongoc_uri_new", MONGOC_LOG_LEVEL_WARNING, "too long");
 
    bson_free (uri_str);
    bson_free (host_and_port);
@@ -2697,7 +2704,7 @@ test_mongoc_uri_srv (void)
       const char *option = _key "=" #_value;                                                         \
       char *lkey = bson_strdup (_key);                                                               \
       mongoc_lowercase (lkey, lkey);                                                                 \
-      mongoc_uri_parse_options (uri, option, true /* from dns */, &error);                           \
+      _mongoc_uri_apply_query_string (uri, mstr_cstring (option), true /* from dns */, &error);      \
       ASSERT_ERROR_CONTAINS (                                                                        \
          error, MONGOC_ERROR_COMMAND, MONGOC_ERROR_COMMAND_INVALID_ARG, "prohibited in TXT record"); \
       ASSERT (!bson_has_field (mongoc_uri_get_##_where (uri), lkey));                                \
@@ -2714,7 +2721,7 @@ test_mongoc_uri_dns_options (void)
    uri = mongoc_uri_new ("mongodb+srv://a.b.c");
    ASSERT (uri);
 
-   ASSERT (!mongoc_uri_parse_options (uri, "tls=false", true /* from dsn */, &error));
+   ASSERT (!_mongoc_uri_apply_query_string (uri, mstr_cstring ("tls=false"), true /* from dsn */, &error));
 
    ASSERT_ERROR_CONTAINS (error, MONGOC_ERROR_COMMAND, MONGOC_ERROR_COMMAND_INVALID_ARG, "prohibited in TXT record");
 
@@ -2726,8 +2733,8 @@ test_mongoc_uri_dns_options (void)
    PROHIBITED (MONGOC_URI_GSSAPISERVICENAME, malicious, utf8, credentials);
 
    /* the two options allowed in TXT records, case-insensitive */
-   ASSERT (mongoc_uri_parse_options (uri, "authsource=db", true, NULL));
-   ASSERT (mongoc_uri_parse_options (uri, "RepLIcaSET=rs", true, NULL));
+   ASSERT (_mongoc_uri_apply_query_string (uri, mstr_cstring ("authsource=db"), true, NULL));
+   ASSERT (_mongoc_uri_apply_query_string (uri, mstr_cstring ("RepLIcaSET=rs"), true, NULL));
 
    /* test that URI string overrides TXT record options */
    mongoc_uri_destroy (uri);
@@ -2736,7 +2743,7 @@ test_mongoc_uri_dns_options (void)
    // test that parsing warns if replicaSet is ignored from TXT records.
    {
       capture_logs (true);
-      ASSERT (mongoc_uri_parse_options (uri, "replicaSet=db2", true, NULL));
+      ASSERT (_mongoc_uri_apply_query_string (uri, mstr_cstring ("replicaSet=db2"), true, NULL));
       ASSERT_CAPTURED_LOG (
          "parsing replicaSet from TXT", MONGOC_LOG_LEVEL_WARNING, "Ignoring URI option \"replicaSet\"");
       capture_logs (false);
@@ -2746,7 +2753,7 @@ test_mongoc_uri_dns_options (void)
    // test that parsing does not warn if authSource is ignored from TXT records.
    {
       capture_logs (true);
-      ASSERT (mongoc_uri_parse_options (uri, "authSource=db2", true, NULL));
+      ASSERT (_mongoc_uri_apply_query_string (uri, mstr_cstring ("authSource=db2"), true, NULL));
       ASSERT_NO_CAPTURED_LOGS ("parsing authSource from TXT");
       capture_logs (false);
       ASSERT_MATCH (mongoc_uri_get_credentials (uri), "{'authsource': 'db1'}");
@@ -3122,7 +3129,7 @@ test_casing_options (void)
 
    uri = mongoc_uri_new ("mongodb://localhost:27017/");
    mongoc_uri_set_option_as_bool (uri, "TLS", true);
-   mongoc_uri_parse_options (uri, "ssl=false", false, &error);
+   _mongoc_uri_apply_query_string (uri, mstr_cstring ("ssl=false"), false, &error);
    ASSERT_ERROR_CONTAINS (error, MONGOC_ERROR_COMMAND, MONGOC_ERROR_COMMAND_INVALID_ARG, "conflicts");
 
    mongoc_uri_destroy (uri);
@@ -3176,14 +3183,12 @@ test_parses_long_ipv6 (void)
       char *uri_string = bson_strdup_printf ("mongodb://%s", host_and_port);
       capture_logs (true);
       mongoc_uri_t *uri = mongoc_uri_new_with_error (uri_string, &error);
-      // Expect error parsing IPv6 literal is logged.
-      ASSERT_CAPTURED_LOG ("parsing IPv6", MONGOC_LOG_LEVEL_ERROR, "IPv6 literal provided in URI is too long");
+      ASSERT_NO_CAPTURED_LOGS ("Invalid IPv6 address");
       capture_logs (false);
 
-      // Expect a generic parsing error is also returned.
       ASSERT (!uri);
       ASSERT_ERROR_CONTAINS (
-         error, MONGOC_ERROR_COMMAND, MONGOC_ERROR_COMMAND_INVALID_ARG, "Invalid host string in URI");
+         error, MONGOC_ERROR_COMMAND, MONGOC_ERROR_COMMAND_INVALID_ARG, "Invalid host specifier \"[");
 
       mongoc_uri_destroy (uri);
       bson_free (uri_string);
diff -pruN 2.0.2-1/src/libmongoc/tests/test-mongoc-usleep.c 2.1.0-1/src/libmongoc/tests/test-mongoc-usleep.c
--- 2.0.2-1/src/libmongoc/tests/test-mongoc-usleep.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-mongoc-usleep.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,11 +1,13 @@
-#include <mongoc/mongoc.h>
 #include <mongoc/mongoc-util-private.h>
-#include "TestSuite.h"
-#include "test-libmongoc.h"
-#include <mock_server/mock-server.h>
-#include <mock_server/future.h>
+
+#include <mongoc/mongoc.h>
+
+#include <TestSuite.h>
 #include <mock_server/future-functions.h>
+#include <mock_server/future.h>
+#include <mock_server/mock-server.h>
 #include <test-conveniences.h> // tmp_bson
+#include <test-libmongoc.h>
 
 
 static void
diff -pruN 2.0.2-1/src/libmongoc/tests/test-mongoc-util.c 2.1.0-1/src/libmongoc/tests/test-mongoc-util.c
--- 2.0.2-1/src/libmongoc/tests/test-mongoc-util.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-mongoc-util.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,8 +1,11 @@
-#include <mongoc/mongoc.h>
 #include <mongoc/mongoc-util-private.h>
 
-#include "TestSuite.h"
-#include "test-conveniences.h"
+#include <mongoc/mongoc.h>
+
+#include <mlib/config.h>
+
+#include <TestSuite.h>
+#include <test-conveniences.h>
 
 
 static void
@@ -64,12 +67,15 @@ test_lowercase_utf8 (void)
 static void
 test_wire_server_versions (void)
 {
+   mlib_diagnostic_push ();
+   mlib_disable_constant_conditional_expression_warnings ();
    /* Ensure valid inclusive range. */
    ASSERT_WITH_MSG (WIRE_VERSION_MIN <= WIRE_VERSION_MAX,
                     "WIRE_VERSION_MAX (%d) must be greater than or equal to "
                     "WIRE_VERSION_MIN (%d)",
                     WIRE_VERSION_MAX,
                     WIRE_VERSION_MIN);
+   mlib_diagnostic_pop ();
 
    /* Bumping WIRE_VERSION_MAX must be accompanied by an update to
     * `_mongoc_wire_version_to_server_version`. */
@@ -89,9 +95,8 @@ static void
 test_bin_to_hex (void)
 {
    const char *bin = "foobar";
-   const char *expect = "666f6f626172";
-
-   char *got = bin_to_hex ((const uint8_t *) bin, (uint32_t) strlen (bin));
+   const char *expect = "666F6F626172";
+   char *got = bin_to_hex ((const uint8_t *) bin, strlen (bin));
    ASSERT_CMPSTR (got, expect);
    bson_free (got);
 }
@@ -99,14 +104,30 @@ test_bin_to_hex (void)
 static void
 test_hex_to_bin (void)
 {
-   const char *hexstr = "666f6f62617200";
    const char *expect = "foobar";
+   size_t len;
 
-   uint32_t len;
-   uint8_t *got = hex_to_bin (hexstr, &len);
-   ASSERT_CMPSTR ((const char *) got, expect);
-   ASSERT_CMPUINT32 (len, ==, 7);
-   bson_free (got);
+   // Test lowercase:
+   {
+      const char *hexstr = "666f6f62617200";
+      uint8_t *got = hex_to_bin (hexstr, &len);
+      ASSERT_CMPSTR ((const char *) got, expect);
+      ASSERT_CMPSIZE_T (len, ==, 7);
+      bson_free (got);
+   }
+
+   // Test uppercase:
+   {
+      const char *hexstr = "666F6F62617200";
+      uint8_t *got = hex_to_bin (hexstr, &len);
+      ASSERT_CMPSTR ((const char *) got, expect);
+      ASSERT_CMPSIZE_T (len, ==, 7);
+      bson_free (got);
+   }
+
+   ASSERT_WITH_MSG (!hex_to_bin ("  66", &len), "whitespace is an error");
+   ASSERT_WITH_MSG (!hex_to_bin ("666", &len), "non-even number of digits is an error");
+   ASSERT_WITH_MSG (!hex_to_bin ("ZZ", &len), "non-hex digits is an error");
 }
 
 void
diff -pruN 2.0.2-1/src/libmongoc/tests/test-mongoc-version.c 2.1.0-1/src/libmongoc/tests/test-mongoc-version.c
--- 2.0.2-1/src/libmongoc/tests/test-mongoc-version.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-mongoc-version.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,6 +1,6 @@
 #include <mongoc/mongoc.h>
 
-#include "TestSuite.h"
+#include <TestSuite.h>
 
 static void
 test_mongoc_version (void)
diff -pruN 2.0.2-1/src/libmongoc/tests/test-mongoc-versioned-api.c 2.1.0-1/src/libmongoc/tests/test-mongoc-versioned-api.c
--- 2.0.2-1/src/libmongoc/tests/test-mongoc-versioned-api.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-mongoc-versioned-api.c	2025-08-14 18:37:23.000000000 +0000
@@ -14,12 +14,13 @@
  * limitations under the License.
  */
 
-#include <mongoc/mongoc.h>
 #include <mongoc/mongoc-client-private.h>
 #include <mongoc/mongoc-server-api-private.h>
-#include "test-libmongoc.h"
 
-#include "unified/runner.h"
+#include <mongoc/mongoc.h>
+
+#include <test-libmongoc.h>
+#include <unified/runner.h>
 
 static void
 _test_mongoc_server_api_copy (void)
diff -pruN 2.0.2-1/src/libmongoc/tests/test-mongoc-with-transaction.c 2.1.0-1/src/libmongoc/tests/test-mongoc-with-transaction.c
--- 2.0.2-1/src/libmongoc/tests/test-mongoc-with-transaction.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-mongoc-with-transaction.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,9 +1,10 @@
+#include <mongoc/mongoc-client-session-private.h>
+
 #include <mongoc/mongoc.h>
 
-#include "json-test.h"
-#include <mongoc/mongoc-client-session-private.h>
-#include "test-conveniences.h"
-#include "test-libmongoc.h"
+#include <json-test.h>
+#include <test-conveniences.h>
+#include <test-libmongoc.h>
 
 /* Note, the with_transaction spec tests are in test-mongoc-transactions.c,
  * since it shares the same test runner with the transactions test runner. */
diff -pruN 2.0.2-1/src/libmongoc/tests/test-mongoc-write-commands.c 2.1.0-1/src/libmongoc/tests/test-mongoc-write-commands.c
--- 2.0.2-1/src/libmongoc/tests/test-mongoc-write-commands.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-mongoc-write-commands.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,18 +1,18 @@
-#include <bson/bcon.h>
-#include <mongoc/mongoc.h>
-
 #include <mongoc/mongoc-client-private.h>
 #include <mongoc/mongoc-collection-private.h>
 #include <mongoc/mongoc-write-command-private.h>
 #include <mongoc/mongoc-write-concern-private.h>
 
-#include "TestSuite.h"
+#include <mongoc/mongoc.h>
+
+#include <bson/bson-bcon.h>
 
-#include "test-libmongoc.h"
-#include "test-conveniences.h"
-#include "mock_server/mock-server.h"
-#include "mock_server/future.h"
-#include "mock_server/future-functions.h"
+#include <TestSuite.h>
+#include <mock_server/future-functions.h>
+#include <mock_server/future.h>
+#include <mock_server/mock-server.h>
+#include <test-conveniences.h>
+#include <test-libmongoc.h>
 
 
 static void
diff -pruN 2.0.2-1/src/libmongoc/tests/test-mongoc-write-concern.c 2.1.0-1/src/libmongoc/tests/test-mongoc-write-concern.c
--- 2.0.2-1/src/libmongoc/tests/test-mongoc-write-concern.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-mongoc-write-concern.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,14 +1,15 @@
-#include <mongoc/mongoc.h>
-#include <mongoc/mongoc-write-concern-private.h>
+#include <common-macros-private.h> // BEGIN_IGNORE_DEPRECATIONS
 #include <mongoc/mongoc-util-private.h>
+#include <mongoc/mongoc-write-concern-private.h>
 
-#include "TestSuite.h"
-#include "test-conveniences.h"
-#include "test-libmongoc.h"
-#include "mock_server/mock-server.h"
-#include "mock_server/future.h"
-#include "mock_server/future-functions.h"
-#include <common-macros-private.h> // BEGIN_IGNORE_DEPRECATIONS
+#include <mongoc/mongoc.h>
+
+#include <TestSuite.h>
+#include <mock_server/future-functions.h>
+#include <mock_server/future.h>
+#include <mock_server/mock-server.h>
+#include <test-conveniences.h>
+#include <test-libmongoc.h>
 
 
 static void
diff -pruN 2.0.2-1/src/libmongoc/tests/test-mongoc-x509.c 2.1.0-1/src/libmongoc/tests/test-mongoc-x509.c
--- 2.0.2-1/src/libmongoc/tests/test-mongoc-x509.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-mongoc-x509.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,6 +1,7 @@
-#include <mongoc/mongoc.h>
 #include <mongoc/mongoc-ssl-private.h>
 
+#include <mongoc/mongoc.h>
+
 #ifdef MONGOC_ENABLE_SSL_OPENSSL
 #include <mongoc/mongoc-openssl-private.h>
 #endif
@@ -9,9 +10,9 @@
 #include <mongoc/mongoc-secure-channel-private.h>
 #endif
 
-#include "TestSuite.h"
-#include "test-libmongoc.h"
-#include "test-conveniences.h" // tmp_bson
+#include <TestSuite.h>
+#include <test-conveniences.h> // tmp_bson
+#include <test-libmongoc.h>
 
 #ifdef MONGOC_ENABLE_OCSP_OPENSSL
 /* Test parsing a DER encoded tlsfeature extension contents for the
@@ -135,6 +136,117 @@ try_insert (mongoc_client_t *client, bso
    return ok;
 }
 
+#ifdef MONGOC_ENABLE_SSL_SECURE_CHANNEL
+// Define utilities check and delete imported keys for Secure Channel:
+
+// The deterministic name for the certificate in src/libmongoc/tests/x509gen/client-pkcs8-unencrypted.pem.
+static LPCWSTR pkcs8_key_name = L"libmongoc-6659E73980D0FB4EB315CF600E0B10CCBB8C3B74FD3ED94DEAF6DC2D2B6B8317-pkcs8";
+
+static void
+delete_imported_pkcs8_key (void)
+{
+   // Open the software key storage provider:
+   NCRYPT_PROV_HANDLE hProv = 0;
+   SECURITY_STATUS status = NCryptOpenStorageProvider (&hProv, MS_KEY_STORAGE_PROVIDER, 0);
+   ASSERT_WITH_MSG (status == SEC_E_OK, "Failed to open key storage provider: %s", mongoc_winerr_to_string (status));
+
+   // Open the key handle:
+   NCRYPT_PROV_HANDLE keyHandle = 0;
+   status = NCryptOpenKey (hProv, &keyHandle, pkcs8_key_name, 0, 0);
+   ASSERT_WITH_MSG (status == SEC_E_OK, "Failed to open key: %s", mongoc_winerr_to_string (status));
+
+   // Delete key:
+   status = NCryptDeleteKey (keyHandle, 0); // Also frees handle.
+   ASSERT_WITH_MSG (status == SEC_E_OK, "Failed to delete key: %s", mongoc_winerr_to_string (status));
+
+   // NCryptDeleteKey freed handle.
+   ASSERT (NCryptFreeObject (hProv) == ERROR_SUCCESS);
+}
+
+static bool
+has_imported_pkcs8_key (void)
+{
+   // Open the software key storage provider:
+   NCRYPT_PROV_HANDLE hProv = 0;
+   SECURITY_STATUS status = NCryptOpenStorageProvider (&hProv, MS_KEY_STORAGE_PROVIDER, 0);
+   ASSERT_WITH_MSG (status == SEC_E_OK, "Failed to open key storage provider: %s", mongoc_winerr_to_string (status));
+
+   // Open the key handle:
+   NCRYPT_PROV_HANDLE keyHandle = 0;
+   status = NCryptOpenKey (hProv, &keyHandle, pkcs8_key_name, 0, 0);
+   bool found = (status == SEC_E_OK);
+   // NTE_BAD_KEYSET is expected if key is not found.
+   ASSERT_WITH_MSG (
+      status == SEC_E_OK || status == NTE_BAD_KEYSET, "Failed to open key: %s", mongoc_winerr_to_string (status));
+
+   if (keyHandle) {
+      ASSERT (NCryptFreeObject (keyHandle) == ERROR_SUCCESS);
+   }
+   ASSERT (NCryptFreeObject (hProv) == ERROR_SUCCESS);
+   return found;
+}
+
+// The deterministic name for the certificate in src/libmongoc/tests/x509gen/client.pem.
+static LPCWSTR pkcs1_key_name = L"libmongoc-6659E73980D0FB4EB315CF600E0B10CCBB8C3B74FD3ED94DEAF6DC2D2B6B8317-pkcs1";
+
+static void
+delete_imported_pkcs1_key (void)
+{
+   HCRYPTPROV provider;
+   bool success = CryptAcquireContextW (&provider,                          /* phProv */
+                                        pkcs1_key_name,                     /* pszContainer */
+                                        MS_ENHANCED_PROV_W,                 /* pszProvider */
+                                        PROV_RSA_FULL,                      /* dwProvType */
+                                        CRYPT_DELETEKEYSET | CRYPT_SILENT); /* dwFlags */
+   ASSERT_WITH_MSG (success, "Failed to delete key: %s", mongoc_winerr_to_string (GetLastError ()));
+   // CRYPT_DELETEKEYSET leaves provider undefined. Do not call CryptReleaseContext.
+}
+
+static bool
+has_imported_pkcs1_key (void)
+{
+   HCRYPTPROV provider = 0;
+   bool success = CryptAcquireContextW (&provider,          /* phProv */
+                                        pkcs1_key_name,     /* pszContainer */
+                                        MS_ENHANCED_PROV_W, /* pszProvider */
+                                        PROV_RSA_FULL,      /* dwProvType */
+                                        CRYPT_SILENT);      /* dwFlags */
+   if (!success) {
+      const DWORD lastError = GetLastError ();
+      // NTE_BAD_KEYSET is expected if key is not found.
+      ASSERT_WITH_MSG (lastError == (DWORD) NTE_BAD_KEYSET,
+                       "Unexpected error in acquiring context: %s",
+                       mongoc_winerr_to_string (lastError));
+      return false;
+   }
+
+   ASSERT (CryptReleaseContext (provider, 0));
+   return true;
+}
+
+#define SCHANNEL_ASSERT_PKCS8_KEY_IMPORTED() ASSERT (has_imported_pkcs8_key ())
+#define SCHANNEL_ASSERT_PKCS8_KEY_NOT_IMPORTED() ASSERT (!has_imported_pkcs8_key ())
+#define SCHANNEL_DELETE_PKCS8_KEY() \
+   if (has_imported_pkcs8_key ())   \
+      delete_imported_pkcs8_key (); \
+   else                             \
+      (void) 0
+#define SCHANNEL_ASSERT_PKCS1_KEY_IMPORTED() ASSERT (has_imported_pkcs1_key ())
+#define SCHANNEL_ASSERT_PKCS1_KEY_NOT_IMPORTED() ASSERT (!has_imported_pkcs1_key ())
+#define SCHANNEL_DELETE_PKCS1_KEY() \
+   if (has_imported_pkcs1_key ())   \
+      delete_imported_pkcs1_key (); \
+   else                             \
+      (void) 0
+#else
+#define SCHANNEL_ASSERT_PKCS8_KEY_IMPORTED() ((void) 0)
+#define SCHANNEL_ASSERT_PKCS8_KEY_NOT_IMPORTED() ((void) 0)
+#define SCHANNEL_DELETE_PKCS8_KEY() ((void) 0)
+#define SCHANNEL_ASSERT_PKCS1_KEY_IMPORTED() ((void) 0)
+#define SCHANNEL_ASSERT_PKCS1_KEY_NOT_IMPORTED() ((void) 0)
+#define SCHANNEL_DELETE_PKCS1_KEY() ((void) 0)
+#endif // MONGOC_ENABLE_SSL_SECURE_CHANNEL
+
 static void
 test_x509_auth (void *unused)
 {
@@ -156,7 +268,20 @@ test_x509_auth (void *unused)
       // Try auth:
       bson_error_t error = {0};
       bool ok;
+
+      // Test SChannel key is not previously imported:
       {
+         SCHANNEL_DELETE_PKCS8_KEY ();
+         SCHANNEL_ASSERT_PKCS8_KEY_NOT_IMPORTED ();
+         mongoc_client_t *client = test_framework_client_new_from_uri (uri, NULL); // Imports key.
+         SCHANNEL_ASSERT_PKCS8_KEY_IMPORTED ();
+         ok = try_insert (client, &error);
+         mongoc_client_destroy (client);
+      }
+
+      // Test SChannel key is previously imported:
+      {
+         SCHANNEL_ASSERT_PKCS8_KEY_IMPORTED ();
          mongoc_client_t *client = test_framework_client_new_from_uri (uri, NULL);
          ok = try_insert (client, &error);
          mongoc_client_destroy (client);
@@ -166,8 +291,11 @@ test_x509_auth (void *unused)
       mongoc_uri_destroy (uri);
    }
 
-   // Test auth works:
+   // Test auth works with a PKCS1 key:
    {
+      SCHANNEL_DELETE_PKCS1_KEY ();
+      SCHANNEL_ASSERT_PKCS1_KEY_NOT_IMPORTED ();
+
       // Create URI:
       mongoc_uri_t *uri = get_x509_uri ();
       {
@@ -178,7 +306,19 @@ test_x509_auth (void *unused)
       // Try auth:
       bson_error_t error = {0};
       bool ok;
+      // Test SChannel key is not previously imported:
       {
+         SCHANNEL_DELETE_PKCS1_KEY ();
+         SCHANNEL_ASSERT_PKCS1_KEY_NOT_IMPORTED ();
+         mongoc_client_t *client = test_framework_client_new_from_uri (uri, NULL); // Imports key.
+         SCHANNEL_ASSERT_PKCS1_KEY_IMPORTED ();
+         ok = try_insert (client, &error);
+         mongoc_client_destroy (client);
+      }
+
+      // Test SChannel key is previously imported:
+      {
+         SCHANNEL_ASSERT_PKCS1_KEY_IMPORTED ();
          mongoc_client_t *client = test_framework_client_new_from_uri (uri, NULL);
          ok = try_insert (client, &error);
          mongoc_client_destroy (client);
@@ -346,15 +486,13 @@ test_x509_auth (void *unused)
       bson_error_t error = {0};
       bool ok;
       {
-         mongoc_client_t *client = test_framework_client_new_from_uri (uri, NULL);
          capture_logs (true);
+         mongoc_client_t *client = test_framework_client_new_from_uri (uri, NULL);
          ok = try_insert (client, &error);
-#if defined(MONGOC_ENABLE_SSL_SECURE_TRANSPORT)
+#if defined(MONGOC_ENABLE_SSL_SECURE_TRANSPORT) || defined(MONGOC_ENABLE_SSL_OPENSSL)
          ASSERT_CAPTURED_LOG ("tls", MONGOC_LOG_LEVEL_ERROR, "Cannot find certificate");
 #elif defined(MONGOC_ENABLE_SSL_SECURE_CHANNEL)
          ASSERT_CAPTURED_LOG ("tls", MONGOC_LOG_LEVEL_ERROR, "Failed to open file");
-#elif defined(MONGOC_ENABLE_SSL_OPENSSL)
-         ASSERT_NO_CAPTURED_LOGS ("tls");
 #endif
          mongoc_client_destroy (client);
       }
@@ -437,7 +575,7 @@ test_crl (void *unused)
    bool ok = try_insert (client, &error);
 #ifdef MONGOC_ENABLE_SSL_SECURE_CHANNEL
    remove_crl_for_secure_channel (ssl_opts.crl_file);
-   ASSERT_CAPTURED_LOG ("tls", MONGOC_LOG_LEVEL_ERROR, "Mutual Authentication failed");
+   ASSERT_CAPTURED_LOG ("tls", MONGOC_LOG_LEVEL_ERROR, "The certificate is revoked");
 #else
    ASSERT_NO_CAPTURED_LOGS ("tls");
 #endif
diff -pruN 2.0.2-1/src/libmongoc/tests/test-service-gcp.c 2.1.0-1/src/libmongoc/tests/test-service-gcp.c
--- 2.0.2-1/src/libmongoc/tests/test-service-gcp.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/test-service-gcp.c	2025-08-14 18:37:23.000000000 +0000
@@ -1,7 +1,9 @@
-#include <mongoc/service-gcp.h>
-#include <mongoc/mongoc-host-list-private.h>
-#include "TestSuite.h"
 #include <common-string-private.h>
+#include <mongoc/mongoc-host-list-private.h>
+
+#include <mongoc/service-gcp.h>
+
+#include <TestSuite.h>
 
 static void
 _test_gcp_parse (void)
diff -pruN 2.0.2-1/src/libmongoc/tests/unified/entity-map.c 2.1.0-1/src/libmongoc/tests/unified/entity-map.c
--- 2.0.2-1/src/libmongoc/tests/unified/entity-map.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/unified/entity-map.c	2025-08-14 18:37:23.000000000 +0000
@@ -14,26 +14,28 @@
  * limitations under the License.
  */
 
-#include "entity-map.h"
+#include "./entity-map.h"
+#include "./util.h"
+
+#include <common-b64-private.h>
+#include <common-bson-dsl-private.h>
+#include <mongoc/mongoc-client-side-encryption-private.h>
 
-#include "bsonutil/bson-parser.h"
-#include "TestSuite.h"
 #include <mongoc/mongoc.h>
-#include "test-conveniences.h"
-#include "test-libmongoc.h"
 #include <mongoc/utlist.h>
-#include "util.h"
 
-#include <common-bson-dsl-private.h>
+#include <bson/bson.h>
+#include <bsonutil/bson-parser.h>
 
-#include <common-b64-private.h>
-#include <mongoc/mongoc-client-side-encryption-private.h>
+#include <TestSuite.h>
+#include <test-conveniences.h>
+#include <test-libmongoc.h>
 
 /* TODO: use public API to reduce min heartbeat once CDRIVER-3130 is resolved.
  */
+#include <common-string-private.h>
 #include <mongoc/mongoc-client-private.h>
 #include <mongoc/mongoc-topology-private.h>
-#include <common-string-private.h>
 
 #define REDUCED_HEARTBEAT_FREQUENCY_MS 500
 #define REDUCED_MIN_HEARTBEAT_FREQUENCY_MS 50
@@ -48,6 +50,9 @@ typedef void (*event_serialize_func_t) (
 static void
 entity_destroy (entity_t *entity);
 
+static bool
+_parse_and_set_auto_encryption_opts (mongoc_client_t *client, bson_t *opts, bson_error_t *error);
+
 entity_map_t *
 entity_map_new (void)
 {
@@ -135,9 +140,10 @@ done:
    return ret;
 }
 
-/* Consider refactoring the names, this is confusing. "type" has been the name of the specific event
- * type. "eventType" is more like what's called the "component" in structured logging, but here it's
- * named after the field in expectedEventsForClient. */
+/* Consider refactoring the names, this is confusing. "type" has been the name
+ * of the specific event type. "eventType" is more like what's called the
+ * "component" in structured logging, but here it's named after the field in
+ * expectedEventsForClient. */
 static event_t *
 event_new (const char *type, const char *eventType, bson_t *serialized, bool is_sensitive_command)
 {
@@ -179,7 +185,8 @@ event_destroy (event_t *event)
 
 /**
  * @brief Test whether a structured log entry is accepted by all active filters
- * @returns true if all filters have returned true in response to this entry, or if no filters were active
+ * @returns true if all filters have returned true in response to this entry, or
+ * if no filters were active
  * @param entity Client entity with the filter stack to query
  * @param entry Borrowed constant reference to the log entry
  *
@@ -201,7 +208,8 @@ _entity_log_filter_accepts (const entity
 /**
  * @brief Push a new structured log filter function onto the stack
  * @param entity Client entity to modify the filter stack for
- * @param func Filter function, returns true to accept a log or false to reject. May be NULL to reject all logs.
+ * @param func Filter function, returns true to accept a log or false to reject.
+ * May be NULL to reject all logs.
  * @param user_data Optional user_data pointer, passed to 'func'.
  *
  * Must be paired with entity_log_filter_pop.
@@ -225,10 +233,13 @@ entity_log_filter_push (entity_t *entity
 }
 
 /**
- * @brief Pop the most recent structured log filter from the stack, which must match
+ * @brief Pop the most recent structured log filter from the stack, which must
+ * match
  * @param entity Client entity to modify the filter stack for
- * @param func Filter function, must match the value given to entity_log_filter_push
- * @param user_data Must match the corresponding user_data value from entity_log_filter_push
+ * @param func Filter function, must match the value given to
+ * entity_log_filter_push
+ * @param user_data Must match the corresponding user_data value from
+ * entity_log_filter_push
  *
  * Briefly acquires log_mutex.
  */
@@ -724,6 +735,7 @@ entity_client_new (entity_map_t *em, bso
    bool ret = false;
    mongoc_apm_callbacks_t *callbacks = NULL;
    bson_t *uri_options = NULL;
+   bson_t *auto_encryption_opts = NULL;
    mongoc_structured_log_opts_t *log_opts = mongoc_structured_log_opts_new ();
    bool use_multiple_mongoses = false;
    bool use_multiple_mongoses_set = false;
@@ -743,19 +755,19 @@ entity_client_new (entity_map_t *em, bso
       else (error ("A client 'id' string is required")),
       // Optional 'uriOptions' for the client
       find (key ("uriOptions"),
-            if (not(type (doc)), then (error ("'uriOptions' must be a document value"))),
+            if (not (type (doc)), then (error ("'uriOptions' must be a document value"))),
             storeDocDupPtr (uri_options)),
       // Optional 'useMultipleMongoses' bool
       find (key ("useMultipleMongoses"),
-            if (not(type (boolean)), then (error ("'useMultipleMongoses' must be a bool value"))),
+            if (not (type (boolean)), then (error ("'useMultipleMongoses' must be a bool value"))),
             do (use_multiple_mongoses_set = true),
             storeBool (use_multiple_mongoses)),
       // Events to observe:
       find (key ("observeEvents"),
-            if (not(type (array)), then (error ("'observeEvents' must be an array"))),
+            if (not (type (array)), then (error ("'observeEvents' must be an array"))),
             visitEach (case (
                // Ensure all elements are strings:
-               when (not(type (utf8)), error ("Every 'observeEvents' element must be a string")),
+               when (not (type (utf8)), error ("Every 'observeEvents' element must be a string")),
                // Dispatch based on the event name:
                when (eval (is_supported_event_type (bson_iter_utf8 (&bsonVisitIter, NULL))), do ({
                         const char *const type = bson_iter_utf8 (&bsonVisitIter, NULL);
@@ -769,14 +781,14 @@ entity_client_new (entity_map_t *em, bso
                else (do (test_error ("Unknown event type '%s'", bsonAs (cstr))))))),
       // Command events to ignore
       find (key ("ignoreCommandMonitoringEvents"),
-            if (not(type (array)), then (error ("'ignoreCommandMonitoringEvents' must be an array"))),
-            visitEach (if (not(type (utf8)),
+            if (not (type (array)), then (error ("'ignoreCommandMonitoringEvents' must be an array"))),
+            visitEach (if (not (type (utf8)),
                            then (error ("Every 'ignoreCommandMonitoringEvents' "
                                         "element must be a string")))),
             storeDocDupPtr (entity->ignore_command_monitoring_events)),
       // Parse the serverApi, if present
       find (key ("serverApi"),
-            if (not(type (doc)), then (error ("'serverApi' must be a document"))),
+            if (not (type (doc)), then (error ("'serverApi' must be a document"))),
             parse ( // The "version" string is required first:
                find (keyWithType ("version", utf8), do ({
                         mongoc_server_api_version_t ver;
@@ -789,49 +801,54 @@ entity_client_new (entity_map_t *em, bso
                else (error ("Missing 'version' property in 'serverApi' object")),
                // Toggle strictness:
                find (key ("strict"),
-                     if (not(type (boolean)), then (error ("'serverApi.strict' must be a bool"))),
+                     if (not (type (boolean)), then (error ("'serverApi.strict' must be a bool"))),
                      do (mongoc_server_api_strict (api, bsonAs (boolean)))),
                // Toggle deprecation errors:
                find (key ("deprecationErrors"),
-                     if (not(type (boolean)), then (error ("serverApi.deprecationErrors must be a bool"))),
+                     if (not (type (boolean)), then (error ("serverApi.deprecationErrors must be a bool"))),
                      do (mongoc_server_api_deprecation_errors (api, bsonAs (boolean)))))),
       // Toggle observation of sensitive commands
       find (key ("observeSensitiveCommands"),
-            if (not(type (boolean)), then (error ("'observeSensitiveCommands' must be a bool"))),
+            if (not (type (boolean)), then (error ("'observeSensitiveCommands' must be a bool"))),
             do ({
                bool *p = entity->observe_sensitive_commands = bson_malloc (sizeof (bool));
                *p = bsonAs (boolean);
             })),
       // Which events should be available as entities:
-      find (
-         key ("storeEventsAsEntities"),
-         if (not(type (array)), then (error ("'storeEventsAsEntities' must be an array"))),
-         visitEach (parse (
-            find (keyWithType ("id", utf8), storeStrRef (store_entity_id), do ({
-                     if (!entity_map_add_bson_array (em, store_entity_id, error)) {
-                        test_error ("failed to create storeEventsAsEntities "
-                                    "entity '%s': %s",
-                                    store_entity_id,
-                                    error->message);
-                     }
-                  })),
-            find (keyWithType ("events", array),
-                  visitEach (case (when (not(type (utf8)),
-                                         error ("Every 'storeEventsAsEntities.events' "
-                                                "element must be a string")),
-                                   when (eval (is_supported_event_type (bson_iter_utf8 (&bsonVisitIter, NULL))), do ({
-                                            const char *const type = bson_iter_utf8 (&bsonVisitIter, NULL);
-                                            set_event_callback (callbacks, type);
-                                            add_store_event (entity, type, store_entity_id);
-                                         })),
-                                   when (eval (is_unsupported_event_type (bson_iter_utf8 (&bsonVisitIter, NULL))),
-                                         do (MONGOC_DEBUG ("Skipping unsupported event type '%s'", bsonAs (cstr)))),
-                                   else (do (test_error ("Unknown event type '%s'", bsonAs (cstr))))))),
-            visitOthers (
-               errorf (err, "Unexpected field '%s' in storeEventsAsEntities", bson_iter_key (&bsonVisitIter)))))),
+      find (key ("storeEventsAsEntities"),
+            if (not (type (array)), then (error ("'storeEventsAsEntities' must be an array"))),
+            visitEach (parse (
+               find (keyWithType ("id", utf8), storeStrRef (store_entity_id), do ({
+                        if (!entity_map_add_bson_array (em, store_entity_id, error)) {
+                           test_error ("failed to create storeEventsAsEntities "
+                                       "entity '%s': %s",
+                                       store_entity_id,
+                                       error->message);
+                        }
+                     })),
+               find (keyWithType ("events", array),
+                     visitEach (case (when (not (type (utf8)),
+                                            error ("Every 'storeEventsAsEntities.events' "
+                                                   "element must be a string")),
+                                      when (anyOf (iStrEqual ("commandStartedEvent"),
+                                                   iStrEqual ("commandFailedEvent"),
+                                                   iStrEqual ("commandSucceededEvent")),
+                                            do ({
+                                               const char *const type = bson_iter_utf8 (&bsonVisitIter, NULL);
+                                               set_event_callback (callbacks, type);
+                                               add_store_event (entity, type, store_entity_id);
+                                            })),
+                                      when (eval (is_unsupported_event_type (bson_iter_utf8 (&bsonVisitIter, NULL))),
+                                            do (MONGOC_DEBUG ("Skipping unsupported event type '%s'", bsonAs (cstr)))),
+                                      else (do (test_error ("Unknown event type '%s'", bsonAs (cstr))))))),
+               visitOthers (
+                  errorf (err, "Unexpected field '%s' in storeEventsAsEntities", bson_iter_key (&bsonVisitIter)))))),
+      find (key ("autoEncryptOpts"),
+            if (not (type (doc)), then (error ("'autoEncryptOpts' must be a document value"))),
+            storeDocDupPtr (auto_encryption_opts)),
       // Log messages to observe:
       find (key ("observeLogMessages"),
-            if (not(type (doc)), then (error ("'observeLogMessages' must be a document"))),
+            if (not (type (doc)), then (error ("'observeLogMessages' must be a document"))),
             do ({
                // Initialize all components to the lowest available level, and install a handler.
                BSON_ASSERT (mongoc_structured_log_opts_set_max_level_for_all_components (
@@ -842,7 +859,7 @@ entity_client_new (entity_map_t *em, bso
                mongoc_structured_log_opts_set_max_document_length (log_opts, 10000);
             }),
             visitEach (
-               if (not(type (utf8)), then (error ("Every value in 'observeLogMessages' must be a log level string"))),
+               if (not (type (utf8)), then (error ("Every value in 'observeLogMessages' must be a log level string"))),
                do ({
                   const char *const component_name = bson_iter_key (&bsonVisitIter);
                   mongoc_structured_log_component_t component;
@@ -914,6 +931,12 @@ entity_client_new (entity_map_t *em, bso
       client->topology->min_heartbeat_frequency_msec = REDUCED_MIN_HEARTBEAT_FREQUENCY_MS;
    }
 
+   if (auto_encryption_opts) {
+      if (!_parse_and_set_auto_encryption_opts (client, auto_encryption_opts, error)) {
+         goto done;
+      }
+   }
+
    ret = true;
 done:
    mongoc_uri_destroy (uri);
@@ -921,6 +944,7 @@ done:
    mongoc_server_api_destroy (api);
    mongoc_structured_log_opts_destroy (log_opts);
    bson_destroy (uri_options);
+   bson_destroy (auto_encryption_opts);
    if (!ret) {
       entity_destroy (entity);
       return NULL;
@@ -1232,8 +1256,13 @@ _parse_kms_provider_local (
 }
 
 static bool
-_parse_and_set_kms_providers (mongoc_client_encryption_opts_t *ce_opts, bson_t *kms_from_file, bson_error_t *error)
+_get_kms_providers_docs (bson_t *kms_from_file, bson_t *kms_providers, bson_t *tls_opts, bson_error_t *error)
 {
+   BSON_ASSERT_PARAM (kms_from_file);
+   BSON_ASSERT_PARAM (kms_providers);
+   BSON_ASSERT_PARAM (tls_opts);
+   BSON_OPTIONAL_PARAM (error);
+
    /* Map provider to corresponding KMS parser. */
    typedef struct _prov_map_t {
       const char *provider;
@@ -1255,10 +1284,6 @@ _parse_and_set_kms_providers (mongoc_cli
                                   {.provider = "local:name2", .parse = _parse_kms_provider_local}};
 
    const size_t prov_map_size = sizeof (prov_map) / sizeof (prov_map[0]);
-
-   bool ret = false;
-   bson_t kms_providers = BSON_INITIALIZER;
-   bson_t tls_opts = BSON_INITIALIZER;
    bson_iter_t iter;
 
    BSON_FOREACH (kms_from_file, iter)
@@ -1270,12 +1295,12 @@ _parse_and_set_kms_providers (mongoc_cli
 
       if (!bson_init_from_value (&kms_doc, bson_iter_value (&iter))) {
          test_set_error (error, "kmsProviders field '%s' is not a valid document", provider);
-         goto done;
+         return false;
       }
 
       for (i = 0u; i < prov_map_size; ++i) {
          if (strcmp (provider, prov_map[i].provider) == 0) {
-            found = prov_map[i].parse (&kms_providers, &tls_opts, provider, &kms_doc, error);
+            found = prov_map[i].parse (kms_providers, tls_opts, provider, &kms_doc, error);
             goto parsed;
          }
       }
@@ -1286,13 +1311,137 @@ _parse_and_set_kms_providers (mongoc_cli
       bson_destroy (&kms_doc);
 
       if (!found) {
+         return false;
+      }
+   }
+   return true;
+}
+
+static void
+maybe_set_extra_crypt_shared (bson_t *extra)
+{
+   if (bson_has_field (extra, "cryptSharedLibPath")) {
+      return; // Already set.
+   }
+
+   char *const path = test_framework_getenv ("MONGOC_TEST_CRYPT_SHARED_LIB_PATH");
+   if (path) {
+      BSON_APPEND_UTF8 (extra, "cryptSharedLibPath", path);
+      bson_free (path);
+   }
+}
+
+static bool
+_parse_and_set_auto_encryption_opts (mongoc_client_t *client, bson_t *opts, bson_error_t *error)
+{
+   bool ret = false;
+   mongoc_auto_encryption_opts_t *auto_encryption_opts = mongoc_auto_encryption_opts_new ();
+   bson_t kms_providers = BSON_INITIALIZER;
+   bson_t tls_opts = BSON_INITIALIZER;
+   BSON_ASSERT (client);
+   bson_t *extra = NULL;
+
+   bson_parser_t *const parser = bson_parser_new ();
+
+   bson_t *kms_providers_raw;
+   bson_parser_doc (parser, "kmsProviders", &kms_providers_raw);
+
+   char *keyvault_ns;
+   bson_parser_utf8 (parser, "keyVaultNamespace", &keyvault_ns);
+
+   bson_t *schema_map;
+   bson_parser_doc_optional (parser, "schemaMap", &schema_map);
+
+   bool *bypass_auto_encryption;
+   bson_parser_bool_optional (parser, "bypassAutoEncryption", &bypass_auto_encryption);
+
+   bool *bypass_query_analysis;
+   bson_parser_bool_optional (parser, "bypassQueryAnalysis", &bypass_query_analysis);
+
+   bson_t *encrypted_fields_map;
+   bson_parser_doc_optional (parser, "encryptedFieldsMap", &encrypted_fields_map);
+
+   int64_t *key_expiration_ms;
+   bson_parser_int_optional (parser, "keyExpirationMS", &key_expiration_ms);
+
+   bson_t *extra_options;
+   bson_parser_doc_optional (parser, "extraOptions", &extra_options);
+
+   if (!bson_parser_parse (parser, opts, error)) {
+      goto done;
+   }
+
+   {
+      if (!_get_kms_providers_docs (kms_providers_raw, &kms_providers, &tls_opts, error)) {
          goto done;
       }
+      mongoc_auto_encryption_opts_set_kms_providers (auto_encryption_opts, &kms_providers);
+      mongoc_auto_encryption_opts_set_tls_opts (auto_encryption_opts, &tls_opts);
+   }
+
+   {
+      // keyVaultNamespace
+      char *dot = strstr (keyvault_ns, ".");
+      BSON_ASSERT (dot);
+      char *db_name = bson_strndup (keyvault_ns, dot - keyvault_ns);
+      char *coll_name = bson_strdup (dot + 1);
+      mongoc_auto_encryption_opts_set_keyvault_namespace (auto_encryption_opts, db_name, coll_name);
+
+      bson_free (db_name);
+      bson_free (coll_name);
+   }
+
+   if (schema_map) {
+      mongoc_auto_encryption_opts_set_schema_map (auto_encryption_opts, schema_map);
+   }
+
+   if (bypass_auto_encryption) {
+      mongoc_auto_encryption_opts_set_bypass_auto_encryption (auto_encryption_opts, *bypass_auto_encryption);
+   }
+
+   if (bypass_query_analysis) {
+      mongoc_auto_encryption_opts_set_bypass_query_analysis (auto_encryption_opts, *bypass_query_analysis);
    }
 
+   if (encrypted_fields_map) {
+      mongoc_auto_encryption_opts_set_encrypted_fields_map (auto_encryption_opts, encrypted_fields_map);
+   }
+
+   if (key_expiration_ms) {
+      mongoc_auto_encryption_opts_set_key_expiration (auto_encryption_opts, *key_expiration_ms);
+   }
+
+   if (extra_options) {
+      extra = bson_copy (extra_options);
+      maybe_set_extra_crypt_shared (extra);
+      mongoc_auto_encryption_opts_set_extra (auto_encryption_opts, extra);
+   }
+
+   if (!mongoc_client_enable_auto_encryption (client, auto_encryption_opts, error)) {
+      goto done;
+   }
+   ret = true;
+
+done:
+   bson_destroy (extra);
+   mongoc_auto_encryption_opts_destroy (auto_encryption_opts);
+   bson_destroy (&kms_providers);
+   bson_destroy (&tls_opts);
+   bson_parser_destroy_with_parsed_fields (parser);
+   return ret;
+}
+
+static bool
+_parse_and_set_kms_providers (mongoc_client_encryption_opts_t *ce_opts, bson_t *kms_from_file, bson_error_t *error)
+{
+   bool ret = false;
+   bson_t kms_providers = BSON_INITIALIZER;
+   bson_t tls_opts = BSON_INITIALIZER;
+   if (!_get_kms_providers_docs (kms_from_file, &kms_providers, &tls_opts, error)) {
+      goto done;
+   }
    mongoc_client_encryption_opts_set_kms_providers (ce_opts, &kms_providers);
    mongoc_client_encryption_opts_set_tls_opts (ce_opts, &tls_opts);
-
    ret = true;
 
 done:
@@ -1413,6 +1562,7 @@ typedef struct {
    mongoc_read_concern_t *rc;
    mongoc_write_concern_t *wc;
    mongoc_read_prefs_t *rp;
+   bson_t *encrypted_fields;
 } coll_or_db_opts_t;
 
 static coll_or_db_opts_t *
@@ -1430,6 +1580,7 @@ coll_or_db_opts_destroy (coll_or_db_opts
    mongoc_read_concern_destroy (opts->rc);
    mongoc_read_prefs_destroy (opts->rp);
    mongoc_write_concern_destroy (opts->wc);
+   bson_destroy (opts->encrypted_fields);
    bson_free (opts);
 }
 
@@ -1651,7 +1802,10 @@ done:
 }
 
 entity_t *
-entity_session_new (entity_map_t *entity_map, bson_t *bson, bson_error_t *error)
+entity_session_new (entity_map_t *entity_map,
+                    bson_t *bson,
+                    const bson_t *cluster_time_after_initial_data,
+                    bson_error_t *error)
 {
    bson_parser_t *parser = NULL;
    entity_t *entity = NULL;
@@ -1691,6 +1845,9 @@ entity_session_new (entity_map_t *entity
    if (!session) {
       goto done;
    }
+   if (cluster_time_after_initial_data) {
+      mongoc_client_session_advance_cluster_time (session, cluster_time_after_initial_data);
+   }
    entity->value = session;
    /* Ending a session destroys the session object.
     * After a session is ended, match assertions may be made on the lsid.
@@ -1785,7 +1942,10 @@ done:
  * object immediately.
  */
 bool
-entity_map_create (entity_map_t *entity_map, bson_t *bson, bson_error_t *error)
+entity_map_create (entity_map_t *entity_map,
+                   bson_t *bson,
+                   const bson_t *cluster_time_after_initial_data,
+                   bson_error_t *error)
 {
    bson_iter_t iter;
    const char *entity_type;
@@ -1816,7 +1976,7 @@ entity_map_create (entity_map_t *entity_
    } else if (0 == strcmp (entity_type, "collection")) {
       entity = entity_collection_new (entity_map, &entity_bson, error);
    } else if (0 == strcmp (entity_type, "session")) {
-      entity = entity_session_new (entity_map, &entity_bson, error);
+      entity = entity_session_new (entity_map, &entity_bson, cluster_time_after_initial_data, error);
    } else if (0 == strcmp (entity_type, "bucket")) {
       entity = entity_bucket_new (entity_map, &entity_bson, error);
    } else {
diff -pruN 2.0.2-1/src/libmongoc/tests/unified/entity-map.h 2.1.0-1/src/libmongoc/tests/unified/entity-map.h
--- 2.0.2-1/src/libmongoc/tests/unified/entity-map.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/unified/entity-map.h	2025-08-14 18:37:23.000000000 +0000
@@ -17,13 +17,16 @@
 #ifndef UNIFIED_ENTITY_MAP_H
 #define UNIFIED_ENTITY_MAP_H
 
-#include <bson/bson.h>
-#include <mongoc/mongoc.h>
-#include <mongoc/mongoc-topology-description-private.h>
-#include <mongoc/mongoc-array-private.h>
+#include "./test-diagnostics.h"
+
 #include <common-thread-private.h>
-#include "bsonutil/bson-match.h"
-#include "test-diagnostics.h"
+#include <mongoc/mongoc-array-private.h>
+#include <mongoc/mongoc-topology-description-private.h>
+
+#include <mongoc/mongoc.h>
+
+#include <bson/bson.h>
+#include <bsonutil/bson-match.h>
 
 typedef struct _event_t {
    struct _event_t *next;
@@ -96,7 +99,7 @@ entity_map_destroy (entity_map_t *em);
 /* Creates an entry in the entity map based on what is specified in @bson.
  */
 bool
-entity_map_create (entity_map_t *em, bson_t *bson, bson_error_t *error);
+entity_map_create (entity_map_t *em, bson_t *bson, const bson_t *cluster_time_after_initial_data, bson_error_t *error);
 
 /* Steals ownership of changestream. */
 bool
@@ -211,5 +214,4 @@ entity_map_log_filter_push (entity_map_t
 void
 entity_map_log_filter_pop (entity_map_t *entity_map, const char *entity_id, log_filter_func_t *func, void *user_data);
 
-
 #endif /* UNIFIED_ENTITY_MAP_H */
diff -pruN 2.0.2-1/src/libmongoc/tests/unified/operation.c 2.1.0-1/src/libmongoc/tests/unified/operation.c
--- 2.0.2-1/src/libmongoc/tests/unified/operation.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/unified/operation.c	2025-08-14 18:37:23.000000000 +0000
@@ -14,19 +14,22 @@
  * limitations under the License.
  */
 
-#include "operation.h"
+#include "./operation.h"
+#include "./result.h"
+#include "./test-diagnostics.h"
+#include "./util.h"
 
+#include <common-bson-dsl-private.h>
 #include <mongoc/mongoc-array-private.h>
-#include <mongoc/mongoc-bulkwrite.h>
 #include <mongoc/mongoc-util-private.h> // hex_to_bin
-#include "result.h"
-#include "test-diagnostics.h"
-#include "test-libmongoc.h"
-#include "util.h"
+
+#include <mongoc/mongoc-bulkwrite.h>
 #include <mongoc/utlist.h>
-#include <common-bson-dsl-private.h>
+
 #include <mlib/cmp.h>
 
+#include <test-libmongoc.h>
+
 typedef struct {
    char *name;
    char *object;
@@ -482,7 +485,7 @@ operation_client_bulkwrite (test_t *test
                // Return with a success (to not abort test runner) and propagate
                // the error as a result.
                ret = true;
-               *error = (bson_error_t){0};
+               *error = (bson_error_t) {0};
                bson_parser_destroy_with_parsed_fields (parser);
                goto done;
             }
@@ -1141,6 +1144,9 @@ operation_drop_collection (test_t *test,
       goto done;
    }
 
+   /* Forward all arguments other than collection name as-is. */
+   BSON_ASSERT (bson_concat (opts, bson_parser_get_extra (parser)));
+
    coll = mongoc_database_get_collection (db, collection);
    mongoc_collection_drop_with_opts (coll, opts, &op_error);
 
@@ -1550,7 +1556,6 @@ operation_bulk_write (test_t *test, oper
    mongoc_bulk_operation_execute (bulk_op, &op_reply, &op_error);
    result_from_bulk_write (result, &op_reply, &op_error);
 
-
    ret = true;
 done:
    bson_parser_destroy_with_parsed_fields (parser);
@@ -1850,7 +1855,7 @@ operation_distinct (test_t *test, operat
    }
 
    distinct = BCON_NEW (
-      "distinct", mongoc_collection_get_name (coll), "key", BCON_UTF8 (field_name), "query", "{", &filter, "}");
+      "distinct", mongoc_collection_get_name (coll), "key", BCON_UTF8 (field_name), "query", BCON_DOCUMENT (filter));
 
    bson_destroy (&op_reply);
    mongoc_collection_read_command_with_opts (coll, distinct, NULL /* read prefs */, opts, &op_reply, &op_error);
@@ -2234,7 +2239,6 @@ operation_insert_one (test_t *test, oper
    mongoc_collection_insert_one (coll, document, opts, &op_reply, &op_error);
    result_from_insert_one (result, &op_reply, &op_error);
 
-
    ret = true;
 done:
    bson_destroy (&op_reply);
@@ -2702,7 +2706,7 @@ operation_upload (test_t *test, operatio
    if (stream) {
       size_t total_written = 0u;
       uint8_t *source_bytes;
-      uint32_t source_bytes_len;
+      size_t source_bytes_len;
       bson_iter_t iter;
 
       if (!bson_iter_init_find (&iter, source, "$$hexBytes") || !BSON_ITER_HOLDS_UTF8 (&iter)) {
@@ -3300,256 +3304,6 @@ operation_assert_session_unpinned (test_
 }
 
 static bool
-create_loop_bson_array_entity (entity_map_t *em, const char *id, bson_error_t *error)
-{
-   BSON_ASSERT_PARAM (em);
-   BSON_OPTIONAL_PARAM (id);
-   BSON_OPTIONAL_PARAM (error);
-
-   if (!id) {
-      // Nothing to do.
-      return true;
-   }
-
-   const entity_t *const entity = entity_map_get (em, id, error);
-
-   // If the entity does not exist, the test runner MUST create it with the
-   // type of BSON array.
-   if (!entity) {
-      return entity_map_add_bson_array (em, id, error);
-   }
-
-   // If the entity exists and is of type BSON array, the test runner MUST do
-   // nothing.
-   else if (strcmp (entity->type, "bson_array") == 0) {
-      return true;
-   }
-
-   // If the entity exists and is of a different type, the test runner MUST
-   // raise an error.
-   else {
-      test_set_error (error, "loop entity %s exists but is not of type BSON array", id);
-      return false;
-   }
-}
-
-static bool
-create_loop_size_t_entity (entity_map_t *em, const char *id, bson_error_t *error)
-{
-   BSON_ASSERT_PARAM (em);
-   BSON_OPTIONAL_PARAM (id);
-   BSON_OPTIONAL_PARAM (error);
-
-   if (!id) {
-      return true;
-   }
-
-   const entity_t *const entity = entity_map_get (em, id, error);
-
-   // If the entity of the specified name already exists, the test runner MUST
-   // raise an error.
-   if (entity) {
-      test_set_error (error, "loop entity %s already exists when it should not", id);
-      return false;
-   }
-
-   return entity_map_add_size_t (em, id, bson_malloc0 (sizeof (size_t)), error);
-}
-
-static void
-increment_loop_counter (entity_map_t *em, const char *id)
-{
-   BSON_ASSERT_PARAM (em);
-   BSON_OPTIONAL_PARAM (id);
-
-   if (id) {
-      bson_error_t error = {0};
-      size_t *const counter = entity_map_get_size_t (em, id, &error);
-
-      // Entity should always be valid at this point.
-      ASSERT_OR_PRINT (counter, error);
-
-      *counter += 1u;
-   }
-}
-
-static bool
-append_loop_error (entity_map_t *em, const char *id, bson_error_t *op_error, bson_error_t *error)
-{
-   BSON_ASSERT_PARAM (em);
-   BSON_OPTIONAL_PARAM (id);
-   BSON_ASSERT_PARAM (op_error);
-   BSON_OPTIONAL_PARAM (error);
-
-   if (!id) {
-      return true;
-   }
-
-   mongoc_array_t *array = entity_map_get_bson_array (em, id, error);
-
-   if (!array) {
-      return false;
-   }
-
-   const int64_t usecs = usecs_since_epoch ();
-   const double secs = (double) usecs / 1000000.0;
-
-   bson_t *doc = bson_new ();
-   BSON_APPEND_UTF8 (doc, "error", op_error->message);
-   BSON_APPEND_DOUBLE (doc, "time", secs);
-
-   _mongoc_array_append_val (array, doc); // Transfer ownership.
-
-   return true;
-}
-
-// Expected to be set by a SIGINT (on Linux and OS X) or CTRL_BREAK_EVENT (on
-// Windows) handler when test suite is being executed by test-atlas-executor.
-volatile sig_atomic_t operation_loop_terminated = false;
-
-static bool
-operation_loop (test_t *test, operation_t *op, result_t *result, bson_error_t *error)
-{
-   bool ret = false;
-
-   BSON_ASSERT_PARAM (test);
-   BSON_ASSERT_PARAM (op);
-   BSON_ASSERT_PARAM (result);
-   BSON_ASSERT_PARAM (error);
-
-   if (test->loop_operation_executed) {
-      test_set_error (error, "test should not contain more than one loop operation");
-      return false;
-   } else {
-      test->loop_operation_executed = true;
-   }
-
-   if (!op->object || strcmp (op->object, "testRunner") != 0) {
-      test_set_error (error, "loop operation object should be \"testRunner\"");
-      return false;
-   }
-
-   bson_t *operations = NULL;
-   char *errors_as_entity = NULL;
-   char *failures_as_entity = NULL;
-   char *successes_as_entity = NULL;
-   char *iterations_as_entity = NULL;
-
-   bson_parser_t *const parser = bson_parser_new ();
-
-   bson_parser_array (parser, "operations", &operations);
-   bson_parser_utf8_optional (parser, "storeErrorsAsEntity", &errors_as_entity);
-   bson_parser_utf8_optional (parser, "storeFailuresAsEntity", &failures_as_entity);
-   bson_parser_utf8_optional (parser, "storeSuccessesAsEntity", &successes_as_entity);
-   bson_parser_utf8_optional (parser, "storeIterationsAsEntity", &iterations_as_entity);
-
-   if (!bson_parser_parse (parser, op->arguments, error)) {
-      goto done;
-   }
-
-   // If the test runner propagates an error or failure (e.g. it is not captured
-   // by the loop or occurs outside of the loop), it MUST be reported by the
-   // workload executor.
-   const bool should_propagate = !failures_as_entity && !errors_as_entity;
-
-   // Guarantee propagation of errors if captures are not defined by the loop.
-   if (should_propagate) {
-      // Ensure any errors or failures are still reported.
-      errors_as_entity = bson_strdup ("errors");
-   }
-
-   // If only one of errors or failures is provided, all failures and errors
-   // must be stored in the provided entity.
-   if ((errors_as_entity ? 1 : 0) != (failures_as_entity ? 1 : 0)) {
-      if (errors_as_entity) {
-         failures_as_entity = bson_strdup (errors_as_entity);
-      } else {
-         errors_as_entity = bson_strdup (failures_as_entity);
-      }
-   }
-
-   if (!create_loop_bson_array_entity (test->entity_map, errors_as_entity, error)) {
-      goto done;
-   }
-
-   if (!create_loop_bson_array_entity (test->entity_map, failures_as_entity, error)) {
-      goto done;
-   }
-
-   if (!create_loop_size_t_entity (test->entity_map, successes_as_entity, error)) {
-      goto done;
-   }
-
-   if (!create_loop_size_t_entity (test->entity_map, iterations_as_entity, error)) {
-      goto done;
-   }
-
-   MONGOC_DEBUG ("running loop operations...");
-   // `operation_loop_terminated` may be set to true within the loop if
-   // `should_propagate` is true on error/failure or by test-atlas-executor upon
-   // receiving a termination request.
-   while (!operation_loop_terminated) {
-      // Clear any prior errors that may have occurred.
-      error->code = 0;
-
-      increment_loop_counter (test->entity_map, iterations_as_entity);
-
-      bson_iter_t iter;
-      BSON_FOREACH (operations, iter)
-      {
-         bson_t op_bson;
-         bson_iter_bson (&iter, &op_bson);
-
-         bson_error_t op_error = {0};
-
-         // Execute the loop sub-operation.
-         const bool res = operation_run (test, &op_bson, &op_error);
-
-         if (res) {
-            increment_loop_counter (test->entity_map, successes_as_entity);
-         } else {
-            // Categorize errors triggered by a sub-operation as a "failure".
-            // If this operation fails, categorize as an "error" instead.
-            (void) append_loop_error (test->entity_map, failures_as_entity, &op_error, error);
-
-            // If neither storeErrorsAsEntity nor storeFailuresAsEntity are
-            // specified, the loop MUST terminate and raise the error/failure
-            // (i.e. the error/failure will interrupt the test).
-            operation_loop_terminated = operation_loop_terminated || should_propagate;
-
-            // If, in the course of executing sub-operations, a sub-operation
-            // yields an error or failure, the test runner MUST NOT execute
-            // subsequent sub-operations in the same loop iteration.
-            break;
-         }
-      } // End of loop sub-operations, but *not* end of loop iterations.
-
-      // Categorize errors triggered outside of sub-operation execution as
-      // "errors".
-      if (error->code != 0) {
-         // We have a problem if we can't store errors without triggering a new
-         // error. Terminate the test suite early instead of looping with an
-         // irrecoverable state.
-         ASSERT_OR_PRINT (append_loop_error (test->entity_map, errors_as_entity, error, error), (*error));
-
-         // If neither storeErrorsAsEntity nor storeFailuresAsEntity are
-         // specified, the loop MUST terminate and raise the error/failure
-         // (i.e. the error/failure will interrupt the test).
-         operation_loop_terminated = operation_loop_terminated || should_propagate;
-      }
-   }
-   MONGOC_DEBUG ("running loop operations... done.");
-
-   result_from_ok (result);
-   ret = true;
-
-done:
-   bson_parser_destroy_with_parsed_fields (parser);
-
-   return ret;
-}
-
-static bool
 operation_assert_number_connections_checked_out (test_t *test, operation_t *op, result_t *result, bson_error_t *error)
 {
    BSON_UNUSED (test);
@@ -3833,7 +3587,7 @@ operation_create_entities (test_t *test,
    {
       bson_t entity;
       bson_iter_bson (&entity_iter, &entity);
-      bool create_ret = entity_map_create (test->entity_map, &entity, error);
+      bool create_ret = entity_map_create (test->entity_map, &entity, test->cluster_time_after_initial_data, error);
       bson_destroy (&entity);
       if (!create_ret) {
          goto done;
@@ -3961,7 +3715,7 @@ operation_wait_for_event (test_t *test,
                          (int) (duration / 1000),
                          (int) WAIT_FOR_EVENT_TIMEOUT_MS);
          goto done;
-      };
+      }
 
       _operation_hidden_wait (test, client, "waitForEvent");
    }
@@ -4291,7 +4045,6 @@ operation_run (test_t *test, bson_t *op_
       {"assertIndexExists", operation_assert_index_exists},
       {"assertSessionPinned", operation_assert_session_pinned},
       {"assertSessionUnpinned", operation_assert_session_unpinned},
-      {"loop", operation_loop},
       {"assertNumberConnectionsCheckedOut", operation_assert_number_connections_checked_out},
       {"wait", operation_wait},
       {"waitForEvent", operation_wait_for_event},
@@ -4343,7 +4096,7 @@ operation_run (test_t *test, bson_t *op_
    }
 
    // Avoid spamming output with sub-operations when executing loop operation.
-   if (!test->loop_operation_executed || operation_loop_terminated) {
+   if (!test->loop_operation_executed) {
       MONGOC_DEBUG ("running operation: %s", tmp_json (op_bson));
    }
 
diff -pruN 2.0.2-1/src/libmongoc/tests/unified/operation.h 2.1.0-1/src/libmongoc/tests/unified/operation.h
--- 2.0.2-1/src/libmongoc/tests/unified/operation.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/unified/operation.h	2025-08-14 18:37:23.000000000 +0000
@@ -17,15 +17,11 @@
 #ifndef UNIFIED_OPERATION_H
 #define UNIFIED_OPERATION_H
 
-#include "runner.h"
-#include "test-diagnostics.h"
+#include "./runner.h"
 
 #include <signal.h>
 
 bool
 operation_run (test_t *test, bson_t *bson, bson_error_t *error);
 
-// Should only be used by test-atlas-executor.
-extern volatile sig_atomic_t operation_loop_terminated;
-
 #endif /* UNIFIED_OPERATION_H */
diff -pruN 2.0.2-1/src/libmongoc/tests/unified/result.c 2.1.0-1/src/libmongoc/tests/unified/result.c
--- 2.0.2-1/src/libmongoc/tests/unified/result.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/unified/result.c	2025-08-14 18:37:23.000000000 +0000
@@ -14,16 +14,18 @@
  * limitations under the License.
  */
 
-#include "result.h"
+#include "./result.h"
+#include "./util.h"
 
-#include <bson/bson.h>
-#include "bsonutil/bson-parser.h"
-#include "bsonutil/bson-match.h"
-#include <mongoc/mongoc-error-private.h>
-#include "test-conveniences.h"
-#include "util.h"
-#include "TestSuite.h"
 #include <common-string-private.h>
+#include <mongoc/mongoc-error-private.h>
+
+#include <bson/bson.h>
+#include <bsonutil/bson-match.h>
+#include <bsonutil/bson-parser.h>
+
+#include <TestSuite.h>
+#include <test-conveniences.h>
 
 struct _result_t {
    bool ok;
@@ -413,7 +415,7 @@ result_check (result_t *result, entity_m
       }
 
       if (error_contains) {
-         if (strstr (result->error.message, error_contains) == NULL) {
+         if (mongoc_strcasestr (result->error.message, error_contains) == NULL) {
             test_set_error (
                error, "expected error to contain \"%s\", but got: \"%s\"", error_contains, result->error.message);
             goto done;
diff -pruN 2.0.2-1/src/libmongoc/tests/unified/result.h 2.1.0-1/src/libmongoc/tests/unified/result.h
--- 2.0.2-1/src/libmongoc/tests/unified/result.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/unified/result.h	2025-08-14 18:37:23.000000000 +0000
@@ -17,11 +17,13 @@
 #ifndef UNIFIED_OPERATION_RESULT_H
 #define UNIFIED_OPERATION_RESULT_H
 
-#include "test-diagnostics.h"
-#include "bsonutil/bson-val.h"
-#include "entity-map.h"
-#include <mongoc/mongoc-cursor.h>
+#include "./entity-map.h"
+#include "./test-diagnostics.h"
+
 #include <mongoc/mongoc-bulkwrite.h>
+#include <mongoc/mongoc-cursor.h>
+
+#include <bsonutil/bson-val.h>
 
 typedef struct _result_t result_t;
 
diff -pruN 2.0.2-1/src/libmongoc/tests/unified/runner.c 2.1.0-1/src/libmongoc/tests/unified/runner.c
--- 2.0.2-1/src/libmongoc/tests/unified/runner.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/unified/runner.c	2025-08-14 18:37:23.000000000 +0000
@@ -14,19 +14,28 @@
  * limitations under the License.
  */
 
-#include "bsonutil/bson-parser.h"
-#include "entity-map.h"
-#include "json-test.h"
-#include "operation.h"
-#include "runner.h"
-#include "test-conveniences.h"
-#include "test-libmongoc.h"
-#include "test-diagnostics.h"
-#include <mongoc/utlist.h>
-#include "util.h"
+#include "./entity-map.h"
+#include "./operation.h"
+#include "./runner.h"
+#include "./test-diagnostics.h"
+#include "./util.h"
+
+#include <common-oid-private.h>
 #include <common-string-private.h>
+#include <mongoc/mongoc-database-private.h>
+
+#include <mongoc/utlist.h>
+
+#include <bson/bson.h>
+#include <bsonutil/bson-match.h>
+#include <bsonutil/bson-parser.h>
+#include <bsonutil/bson-val.h>
+
 #include <mlib/cmp.h>
-#include <common-oid-private.h>
+
+#include <json-test.h>
+#include <test-conveniences.h>
+#include <test-libmongoc.h>
 
 typedef struct {
    const char *file_description;
@@ -323,10 +332,7 @@ test_runner_terminate_open_transactions
    bool cmd_ret = false;
    bson_error_t cmd_error = {0};
 
-   if (test_framework_getenv_bool ("MONGOC_TEST_ATLAS")) {
-      // Not applicable when running as test-atlas-executor.
-      return true;
-   } else if (0 == test_framework_skip_if_no_txns ()) {
+   if (0 == test_framework_skip_if_no_txns ()) {
       ret = true;
       goto done;
    }
@@ -383,9 +389,6 @@ test_runner_new (void)
 {
    bson_error_t error;
 
-   // Avoid executing unnecessary commands when running as test-atlas-executor.
-   const bool is_atlas = test_framework_getenv_bool ("MONGOC_TEST_ATLAS");
-
    test_runner_t *const test_runner = bson_malloc0 (sizeof (test_runner_t));
 
    _mongoc_array_init (&test_runner->server_ids, sizeof (uint32_t));
@@ -393,10 +396,9 @@ test_runner_new (void)
    {
       mongoc_uri_t *const uri = test_framework_get_uri ();
 
-
       /* In load balanced mode, the internal client must use the
        * SINGLE_LB_MONGOS_URI. */
-      if (!is_atlas && !test_framework_is_loadbalanced ()) {
+      if (!test_framework_is_loadbalanced ()) {
          /* Always use multiple mongoses if speaking to a mongos.
           * Some test operations require communicating with all known mongos */
          if (!test_framework_uri_apply_multi_mongos (uri, true, &error)) {
@@ -532,6 +534,7 @@ test_destroy (test_t *test)
    bson_destroy (test->run_on_requirements);
    bson_free (test->description);
    bson_free (test->skip_reason);
+   bson_destroy (test->cluster_time_after_initial_data);
    bson_free (test);
 }
 
@@ -557,7 +560,6 @@ is_sharded (bson_t *hello_reply)
       return false;
    }
 
-
    val = bson_lookup_utf8 (hello_reply, "msg");
    if (0 == strcmp (val, "isdbgrid")) {
       return true;
@@ -635,8 +637,9 @@ check_schema_version (test_file_t *test_
    // 1.18 is partially supported (additional properties in kmsProviders)
    // 1.21 is partially supported (expectedError.writeErrors and expectedError.writeConcernErrors)
    // 1.22 is partially supported (keyExpirationMS in client encryption options)
+   // 1.23 is partially supported (automatic encryption)
    semver_t schema_version;
-   semver_parse ("1.22", &schema_version);
+   semver_parse ("1.23", &schema_version);
 
    if (schema_version.major != test_file->schema_version.major) {
       goto fail;
@@ -790,6 +793,11 @@ check_run_on_requirement (test_runner_t
             return false;
          }
 
+         if (0 == test_framework_skip_if_no_client_side_encryption ()) {
+            *fail_reason = bson_strdup ("CSFLE is required but not all environment variables are set");
+            return false;
+         }
+
          if (csfle_required) {
             continue;
          }
@@ -866,8 +874,27 @@ test_setup_initial_data (test_t *test, b
    test_file = test->test_file;
    test_runner = test_file->test_runner;
 
+   mongoc_client_session_t *sess = mongoc_client_start_session (test_runner->internal_client, NULL, error);
+   if (sess == NULL) {
+      return false;
+   }
+
    if (!test_file->initial_data) {
-      return true;
+      // Send a "ping" command with the session to get a cluster time.
+      bson_t opts = BSON_INITIALIZER;
+      bool ok = mongoc_client_session_append (sess, &opts, error);
+      ok = ok && mongoc_client_command_with_opts (
+                    test_runner->internal_client, "db", tmp_bson ("{'ping': 1}"), NULL, &opts, NULL, error);
+      if (ok) {
+         // Check for cluster time (not available on standalone).
+         const bson_t *ct = mongoc_client_session_get_cluster_time (sess);
+         if (ct) {
+            test->cluster_time_after_initial_data = bson_copy (ct);
+         }
+      }
+      mongoc_client_session_destroy (sess);
+      bson_destroy (&opts);
+      return ok;
    }
 
    BSON_FOREACH (test_file->initial_data, initial_data_iter)
@@ -883,7 +910,7 @@ test_setup_initial_data (test_t *test, b
       mongoc_write_concern_t *wc = NULL;
       bson_t *bulk_opts = NULL;
       bson_t *drop_opts = bson_new ();
-      bson_t *create_opts = bson_new ();
+      bson_t *create_opts = NULL;
       bool ret = false;
 
       bson_iter_bson (&initial_data_iter, &collection_data);
@@ -891,14 +918,22 @@ test_setup_initial_data (test_t *test, b
       bson_parser_utf8 (parser, "databaseName", &database_name);
       bson_parser_utf8 (parser, "collectionName", &collection_name);
       bson_parser_array (parser, "documents", &documents);
+      bson_parser_doc_optional (parser, "createOptions", &create_opts);
       if (!bson_parser_parse (parser, &collection_data, error)) {
          goto loopexit;
       }
 
+      if (create_opts == NULL) {
+         create_opts = bson_new ();
+      }
+
       wc = mongoc_write_concern_new ();
       mongoc_write_concern_set_w (wc, MONGOC_WRITE_CONCERN_W_MAJORITY);
       bulk_opts = bson_new ();
       mongoc_write_concern_append (wc, bulk_opts);
+      if (!mongoc_client_session_append (sess, bulk_opts, error)) {
+         goto loopexit;
+      }
 
       /* Drop the collection. */
       /* Check if the server supports majority write concern on 'drop' and
@@ -913,8 +948,15 @@ test_setup_initial_data (test_t *test, b
          BSON_APPEND_INT32 (drop_opts, "serverId", 1);
          BSON_APPEND_INT32 (create_opts, "serverId", 1);
       }
+      if (!mongoc_client_session_append (sess, create_opts, error)) {
+         goto loopexit;
+      }
+      if (!mongoc_client_session_append (sess, drop_opts, error)) {
+         goto loopexit;
+      }
 
       coll = mongoc_client_get_collection (test_runner->internal_client, database_name, collection_name);
+
       if (!mongoc_collection_drop_with_opts (coll, drop_opts, error)) {
          if (error->code != 26 && (NULL == strstr (error->message, "ns not found"))) {
             /* This is not a "ns not found" error. Fail the test. */
@@ -924,6 +966,52 @@ test_setup_initial_data (test_t *test, b
          memset (error, 0, sizeof (bson_error_t));
       }
 
+      // Drop `enxcol_.<coll>.esc` and `enxcol_.<coll>.ecoc` in case the collection will be used for QE.
+      // https://github.com/mongodb/specifications/blob/f4c0bbdbf8a8560580c947ca2c331794431a0c78/source/unified-test-format/unified-test-format.md#executing-a-test
+      {
+         char *collection_name_esc = bson_strdup_printf ("enxcol_.%s.esc", collection_name);
+         mongoc_collection_t *coll_esc =
+            mongoc_client_get_collection (test_runner->internal_client, database_name, collection_name_esc);
+         if (!mongoc_collection_drop_with_opts (coll_esc, drop_opts, error)) {
+            if (error->code != 26 && (NULL == strstr (error->message, "ns not found"))) {
+               /* This is not a "ns not found" error. Fail the test. */
+               mongoc_collection_destroy (coll_esc);
+               bson_free (collection_name_esc);
+               goto loopexit;
+            }
+            /* Clear an "ns not found" error. */
+            memset (error, 0, sizeof (bson_error_t));
+         }
+         mongoc_collection_destroy (coll_esc);
+         bson_free (collection_name_esc);
+      }
+
+      {
+         char *collection_name_ecoc = bson_strdup_printf ("enxcol_.%s.ecoc", collection_name);
+         mongoc_collection_t *coll_ecoc =
+            mongoc_client_get_collection (test_runner->internal_client, database_name, collection_name_ecoc);
+         if (!mongoc_collection_drop_with_opts (coll_ecoc, drop_opts, error)) {
+            if (error->code != 26 && (NULL == strstr (error->message, "ns not found"))) {
+               /* This is not a "ns not found" error. Fail the test. */
+               mongoc_collection_destroy (coll_ecoc);
+               bson_free (collection_name_ecoc);
+               goto loopexit;
+            }
+            /* Clear an "ns not found" error. */
+            memset (error, 0, sizeof (bson_error_t));
+         }
+         mongoc_collection_destroy (coll_ecoc);
+         bson_free (collection_name_ecoc);
+      }
+
+      mongoc_collection_t *new_coll = NULL;
+      db = mongoc_client_get_database (test_runner->internal_client, database_name);
+      new_coll = mongoc_database_create_collection (db, collection_name, create_opts, error);
+      if (!new_coll) {
+         goto loopexit;
+      }
+      mongoc_collection_destroy (new_coll);
+
       /* Insert documents if specified. */
       if (bson_count_keys (documents) > 0) {
          bson_iter_t documents_iter;
@@ -946,15 +1034,6 @@ test_setup_initial_data (test_t *test, b
          if (!mongoc_bulk_operation_execute (bulk_insert, NULL, error)) {
             goto loopexit;
          }
-      } else {
-         mongoc_collection_t *new_coll = NULL;
-         /* Test does not need data inserted, just create the collection. */
-         db = mongoc_client_get_database (test_runner->internal_client, database_name);
-         new_coll = mongoc_database_create_collection (db, collection_name, create_opts, error);
-         if (!new_coll) {
-            goto loopexit;
-         }
-         mongoc_collection_destroy (new_coll);
       }
 
       ret = true;
@@ -972,9 +1051,18 @@ test_setup_initial_data (test_t *test, b
       bson_parser_destroy (parser);
       mongoc_database_destroy (db);
       if (!ret) {
+         mongoc_client_session_destroy (sess);
          return false;
       }
    }
+
+   // Obtain cluster time to advance client sessions. See DRIVERS-2816.
+   // Check for cluster time (not available on standalone).
+   const bson_t *ct = mongoc_client_session_get_cluster_time (sess);
+   if (ct) {
+      test->cluster_time_after_initial_data = bson_copy (ct);
+   }
+   mongoc_client_session_destroy (sess);
    return true;
 }
 
@@ -1001,7 +1089,7 @@ test_create_entities (test_t *test, bson
       bson_t entity_bson;
 
       bson_iter_bson (&iter, &entity_bson);
-      if (!entity_map_create (test->entity_map, &entity_bson, error)) {
+      if (!entity_map_create (test->entity_map, &entity_bson, test->cluster_time_after_initial_data, error)) {
          return false;
       }
    }
@@ -1291,6 +1379,24 @@ test_count_matching_events_for_client (
    return true;
 }
 
+// `is_keyvault_listcollections` returns true if a `listCollections` event produced by libmongoc should be ignored.
+// The extra events are caused by operations on the key vault collection. Unlike other drivers, libmongoc does not
+// create a separate client for key vault operations.
+static bool
+is_keyvault_listcollections (const bson_t *event)
+{
+   if (!bson_has_field (event, "commandName") || !bson_has_field (event, "databaseName")) {
+      return false;
+   }
+
+   const char *cmdname = bson_lookup_utf8 (event, "commandName");
+   const char *dbname = bson_lookup_utf8 (event, "databaseName");
+   if (cmdname && 0 == strcmp (cmdname, "listCollections") && dbname && 0 == strcmp (dbname, "keyvault")) {
+      return true;
+   }
+   return false;
+}
+
 static bool
 test_check_expected_events_for_client (test_t *test, bson_t *expected_events_for_client, bson_error_t *error)
 {
@@ -1335,6 +1441,10 @@ test_check_expected_events_for_client (t
    event_t *eiter;
    LL_FOREACH (entity->events, eiter)
    {
+      if (is_keyvault_listcollections (eiter->serialized)) {
+         // Ignore.
+         continue;
+      }
       if (event_matches_eventtype (eiter, event_type)) {
          actual_num_events++;
       }
@@ -1358,8 +1468,11 @@ test_check_expected_events_for_client (t
    bson_iter_t iter;
    BSON_FOREACH (expected_events, iter)
    {
-      while (eiter && !event_matches_eventtype (eiter, event_type)) {
+      while (eiter &&
+             (is_keyvault_listcollections (eiter->serialized) || !event_matches_eventtype (eiter, event_type))) {
+         // Skip.
          eiter = eiter->next;
+         continue;
       }
       bson_t expected_event;
       bson_iter_bson (&iter, &expected_event);
@@ -1368,7 +1481,11 @@ test_check_expected_events_for_client (t
          goto done;
       }
       if (!test_check_event (test, &expected_event, eiter, error)) {
-         test_diagnostics_error_info ("checking for expected event: %s", tmp_json (&expected_event));
+         test_diagnostics_error_info ("could not match event\n"
+                                      "\texpected: %s\n"
+                                      "\tactual: %s",
+                                      tmp_json (&expected_event),
+                                      tmp_json (eiter->serialized));
          goto done;
       }
       eiter = eiter->next;
@@ -1516,7 +1633,7 @@ test_check_log_message (bson_t *expected
       if (!bson_iter_init_find (&failure_iter, actual->message, "failure")) {
          test_set_error (error, "expected log 'failure' to exist");
          goto done;
-      };
+      }
       if (*failure_is_redacted) {
          if (!check_failure_is_redacted (&failure_iter, error)) {
             test_diagnostics_error_info ("actual log message: %s", tmp_json (actual->message));
@@ -1814,111 +1931,6 @@ done:
    return ret;
 }
 
-static void
-append_size_t (bson_t *doc, const char *key, size_t value)
-{
-   BSON_ASSERT (mlib_in_range (int64_t, value));
-   BSON_ASSERT (BSON_APPEND_INT64 (doc, key, (int64_t) value));
-}
-
-static void
-append_bson_array (bson_t *doc, const char *key, const mongoc_array_t *array)
-{
-   BSON_ASSERT_PARAM (key);
-   BSON_OPTIONAL_PARAM (array);
-
-   if (!array) {
-      bson_t empty = BSON_INITIALIZER;
-      BSON_ASSERT (BSON_APPEND_ARRAY (doc, key, &empty));
-      bson_destroy (&empty);
-   } else {
-      bson_t **const begin = array->data;
-      bson_t **const end = begin + array->len;
-
-      bson_array_builder_t *elements;
-
-      BSON_ASSERT (BSON_APPEND_ARRAY_BUILDER_BEGIN (doc, key, &elements));
-      for (bson_t **iter = begin; iter != end; ++iter) {
-         BSON_ASSERT (bson_array_builder_append_document (elements, *iter));
-      }
-      BSON_ASSERT (bson_append_array_builder_end (doc, elements));
-   }
-}
-
-static bool
-test_generate_atlas_results (test_t *test, bson_error_t *error)
-{
-   BSON_ASSERT_PARAM (test);
-   BSON_ASSERT_PARAM (error);
-
-   // This is only applicable when the unified test runner is being run by
-   // test-atlas-executor. Must be implemented within unified test runner in
-   // order to capture entities before destruction of parent test object.
-   if (!test_framework_getenv_bool ("MONGOC_TEST_ATLAS")) {
-      return true;
-   }
-
-   MONGOC_DEBUG ("generating events.json and results.json files...");
-
-   size_t *const iterations = entity_map_get_size_t (test->entity_map, "iterations", NULL);
-   size_t *const successes = entity_map_get_size_t (test->entity_map, "successes", NULL);
-   mongoc_array_t *const errors = entity_map_get_bson_array (test->entity_map, "errors", NULL);
-   mongoc_array_t *const failures = entity_map_get_bson_array (test->entity_map, "failures", NULL);
-   mongoc_array_t *const events = entity_map_get_bson_array (test->entity_map, "events", NULL);
-
-   bson_t events_doc = BSON_INITIALIZER;
-   bson_t results_doc = BSON_INITIALIZER;
-
-   append_bson_array (&events_doc, "events", events);
-   append_bson_array (&events_doc, "failures", failures);
-   append_bson_array (&events_doc, "errors", errors);
-
-   append_size_t (&results_doc, "numErrors", errors ? errors->len : 0u);
-   append_size_t (&results_doc, "numFailures", failures ? failures->len : 0u);
-   append_size_t (&results_doc, "numIterations", iterations ? *iterations : 0u);
-   append_size_t (&results_doc, "numSuccesses", successes ? *successes : 0u);
-
-#ifdef WIN32
-   const int perms = _S_IWRITE;
-#else
-   const int perms = S_IRWXU;
-#endif
-
-   mongoc_stream_t *const events_file =
-      mongoc_stream_file_new_for_path ("events.json", O_CREAT | O_WRONLY | O_TRUNC, perms);
-   ASSERT_WITH_MSG (events_file, "could not open events.json");
-
-   mongoc_stream_t *const results_file =
-      mongoc_stream_file_new_for_path ("results.json", O_CREAT | O_WRONLY | O_TRUNC, perms);
-   ASSERT_WITH_MSG (results_file, "could not open results.json");
-
-   size_t events_json_len = 0u;
-   size_t results_json_len = 0u;
-   char *const events_json = bson_as_relaxed_extended_json (&events_doc, &events_json_len);
-   char *const results_json = bson_as_relaxed_extended_json (&results_doc, &results_json_len);
-
-   ASSERT_WITH_MSG (events_json, "failed to convert events BSON document to JSON");
-   ASSERT_WITH_MSG (results_json, "failed to convert results BSON document to JSON");
-
-   ASSERT_WITH_MSG (mongoc_stream_write (events_file, events_json, events_json_len, 500) > 0,
-                    "failed to write events to events.json");
-   ASSERT_WITH_MSG (mongoc_stream_write (results_file, results_json, results_json_len, 500) > 0,
-                    "failed to write results to results.json");
-
-   bson_free (events_json);
-   bson_free (results_json);
-
-   mongoc_stream_destroy (events_file);
-   mongoc_stream_destroy (results_file);
-
-   bson_destroy (&events_doc);
-   bson_destroy (&results_doc);
-
-   MONGOC_DEBUG ("generating events.json and results.json files... done.");
-
-   return true;
-}
-
 static bool
 run_distinct_on_each_mongos (test_t *test, char *db_name, char *coll_name, bson_error_t *error)
 {
@@ -2106,11 +2118,6 @@ test_run (test_t *test, bson_error_t *er
       goto done;
    }
 
-   if (!test_generate_atlas_results (test, error)) {
-      test_diagnostics_error_info ("%s", "generating Atlas test results");
-      goto done;
-   }
-
    ret = true;
 done:
    /* always clean up failpoints, even on test failure */
diff -pruN 2.0.2-1/src/libmongoc/tests/unified/runner.h 2.1.0-1/src/libmongoc/tests/unified/runner.h
--- 2.0.2-1/src/libmongoc/tests/unified/runner.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/unified/runner.h	2025-08-14 18:37:23.000000000 +0000
@@ -17,12 +17,15 @@
 #ifndef UNIFIED_RUNNER_H
 #define UNIFIED_RUNNER_H
 
-#include <bson/bson.h>
-#include "bsonutil/bson-parser.h"
-#include "entity-map.h"
+#include "./entity-map.h"
+
 #include <mongoc/mongoc-array-private.h>
-#include "test-conveniences.h"
-#include "TestSuite.h"
+
+#include <bson/bson.h>
+#include <bsonutil/bson-parser.h>
+
+#include <TestSuite.h>
+#include <test-conveniences.h>
 
 /* test_runner_t, test_file_t, and test_t model the types described in the "Test
  * Runner Implementation" section of the Unified Test Format specification. */
@@ -63,6 +66,7 @@ typedef struct {
    entity_map_t *entity_map;
    failpoint_t *failpoints;
    bool loop_operation_executed;
+   bson_t *cluster_time_after_initial_data;
 } test_t;
 
 /* Set server_id to 0 if the failpoint was not against a pinned mongos. */
diff -pruN 2.0.2-1/src/libmongoc/tests/unified/test-diagnostics.c 2.1.0-1/src/libmongoc/tests/unified/test-diagnostics.c
--- 2.0.2-1/src/libmongoc/tests/unified/test-diagnostics.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/unified/test-diagnostics.c	2025-08-14 18:37:23.000000000 +0000
@@ -14,13 +14,16 @@
  * limitations under the License.
  */
 
-#include "test-diagnostics.h"
+#include "./test-diagnostics.h"
 
-#include <mongoc/utlist.h>
-#include "TestSuite.h"
+#include <common-string-private.h>
 #include <common-thread-private.h>
+
+#include <mongoc/utlist.h>
+
+#include <TestSuite.h>
+
 #include <signal.h>
-#include <common-string-private.h>
 
 typedef struct _msg_t {
    char *string;
diff -pruN 2.0.2-1/src/libmongoc/tests/unified/util.c 2.1.0-1/src/libmongoc/tests/unified/util.c
--- 2.0.2-1/src/libmongoc/tests/unified/util.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/unified/util.c	2025-08-14 18:37:23.000000000 +0000
@@ -14,13 +14,14 @@
  * limitations under the License.
  */
 
-#include "util.h"
+#include "./util.h"
 
-#include "test-conveniences.h"
-#include "TestSuite.h"
 #include <mlib/cmp.h>
 #include <mlib/loop.h>
 
+#include <TestSuite.h>
+#include <test-conveniences.h>
+
 static int
 cmp_key (const void *a, const void *b)
 {
@@ -161,3 +162,33 @@ usecs_since_epoch (void)
 
    return secs * factor + usecs;
 }
+
+const char *
+mongoc_strcasestr (const char *haystack, const char *needle)
+{
+   BSON_ASSERT_PARAM (haystack);
+   BSON_ASSERT_PARAM (needle);
+
+   if (!*needle) {
+      return haystack;
+   }
+
+   const char *h = haystack;
+   while (*h) {
+      const char *h_start = h;
+      const char *n = needle;
+
+      while (*n && *h && tolower (*h) == tolower (*n)) {
+         h++;
+         n++;
+      }
+
+      if (!*n) {
+         return h_start; // Match found
+      }
+
+      h = h_start + 1; // Move to the next starting position in haystack
+   }
+
+   return NULL; // No match found
+}
diff -pruN 2.0.2-1/src/libmongoc/tests/unified/util.h 2.1.0-1/src/libmongoc/tests/unified/util.h
--- 2.0.2-1/src/libmongoc/tests/unified/util.h	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/libmongoc/tests/unified/util.h	2025-08-14 18:37:23.000000000 +0000
@@ -36,4 +36,6 @@ is_unsupported_event_type (const char *e
 int64_t
 usecs_since_epoch (void);
 
+const char *
+mongoc_strcasestr (const char *haystack, const char *needle);
 #endif /* UNIFIED_UTIL_H */
diff -pruN 2.0.2-1/src/tools/mongoc-stat.c 2.1.0-1/src/tools/mongoc-stat.c
--- 2.0.2-1/src/tools/mongoc-stat.c	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/src/tools/mongoc-stat.c	2025-08-14 18:37:23.000000000 +0000
@@ -30,6 +30,7 @@
 #include <sys/stat.h>
 #include <unistd.h>
 
+#include <mlib/cmp.h>
 
 #pragma pack(1)
 typedef struct {
@@ -109,6 +110,7 @@ mongoc_counters_new_from_pid (unsigned p
       return NULL;
    }
 
+   BSON_ASSERT (mlib_in_range (size_t, len));
    size = len;
 
    if (MAP_FAILED == (mem = mmap (NULL, size, PROT_READ, MAP_SHARED, fd, 0))) {
diff -pruN 2.0.2-1/tools/build.earth 2.1.0-1/tools/build.earth
--- 2.0.2-1/tools/build.earth	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/tools/build.earth	2025-08-14 18:37:23.000000000 +0000
@@ -83,6 +83,12 @@ ADD_CXX_COMPILER:
             # Old Alpine 3.16 bundles libstdc++ in g++, so we need to pull GCC along anyway
             LET cxx_pkg = clang g++
         END
+    ELSE IF test -f /etc/redhat-release
+        IF test "$cxx_compiler" = g++
+            LET cxx_pkg = "gcc-c++"
+        ELSE IF test "$cxx_compiler" = clang++
+            LET cxx_pkg = clang gcc-c++
+        END
     END
     IF test "$cxx_pkg" = ""
         RUN __fail "Unable to infer package name for --cxx_compiler “%s” on this platform (check spelling or pass a “--cxx_pkg” argument)" "$cxx_compiler"
diff -pruN 2.0.2-1/tools/earthly.sh 2.1.0-1/tools/earthly.sh
--- 2.0.2-1/tools/earthly.sh	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/tools/earthly.sh	2025-08-14 18:37:23.000000000 +0000
@@ -4,7 +4,7 @@
 
 set -euo pipefail
 
-: "${EARTHLY_VERSION:=0.8.3}"
+: "${EARTHLY_VERSION:=0.8.16}"
 
 # Calc the arch of the executable we want
 case "$ARCHNAME" in
diff -pruN 2.0.2-1/tools/format.py 2.1.0-1/tools/format.py
--- 2.0.2-1/tools/format.py	1970-01-01 00:00:00.000000000 +0000
+++ 2.1.0-1/tools/format.py	2025-08-14 18:37:23.000000000 +0000
@@ -0,0 +1,277 @@
+"""
+Run clang-format and header-fixup on the source code for the repository.
+
+By default this script runs `clang-format` over most source files in the
+repository (excluding some vendored code that we don't want to format).
+Alteratively, a list of files can be given as positional arguments to
+selectively format files. `--help` for more details.
+
+It also fixes up `#include` directives to use angle bracket syntax if they have
+a certain spelling. (See `INCLUDE_RE` in the script)
+"""
+
+import argparse
+import functools
+import itertools
+import multiprocessing
+import os
+import re
+import subprocess
+import sys
+from concurrent.futures import ThreadPoolExecutor
+from pathlib import Path
+from typing import Iterable, Literal, Sequence
+
+
+def main(argv: Sequence[str]) -> int:
+    parser = argparse.ArgumentParser(
+        description=__doc__,
+        formatter_class=argparse.RawDescriptionHelpFormatter,
+        allow_abbrev=False,
+    )
+    # By default, add two jobs to the CPU count since some work is waiting on disk
+    dflt_jobs = multiprocessing.cpu_count() + 2
+    parser.add_argument(
+        "--jobs",
+        "-j",
+        type=int,
+        help=f"Number of parallel jobs to run (default: {dflt_jobs})",
+        metavar="<num-jobs>",
+        default=dflt_jobs,
+    )
+    parser.add_argument(
+        "--mode",
+        choices=RunMode.__args__,
+        help="Whether to apply changes, or simply check for formatting violations (default: apply)",
+        default="apply",
+    )
+    parser.add_argument(
+        "--clang-format-bin",
+        help="The clang-format executable to be used (default: “clang-format”)",
+        default="clang-format",
+        metavar="<executable>",
+    )
+    parser.add_argument(
+        "files",
+        metavar="<filepath>",
+        nargs="*",
+        help="List of files to be selected for formatting. If omitted, the default set of files are selected",
+    )
+    args = parser.parse_args(argv)
+    mode: RunMode = args.mode
+    file_patterns: list[str] = args.files
+    cf: str = args.clang_format_bin
+    # Convert filepath patterns to a list of paths
+    files: list[Path]
+    try:
+        match file_patterns:
+            case []:
+                files = list(all_our_sources())
+            case patterns:
+                files = [Path(p).resolve() for p in patterns]
+    except Exception as e:
+        raise RuntimeError("Failed to collect files for formatting (See above)") from e
+    # Fail if no files matched
+    assert files
+    # Split the file list into groups to be dispatched
+    num_jobs: int = min(args.jobs, len(files))
+    groups = [files[n::num_jobs] for n in range(num_jobs)]
+    print(f"Formatting {len(files)} files with {num_jobs} workers...", file=sys.stderr)
+
+    # Bind the formatting arguments to the formatter function
+    format_group = functools.partial(_format_files, mode=mode, clang_format=cf)
+    # Run in a thread pool. Even though Python is single-threaded, most work will
+    # be waiting on clang-format or disk I/O
+    pool = ThreadPoolExecutor(max_workers=num_jobs)
+    try:
+        okay = all(pool.map(format_group, groups))
+    except Exception as e:
+        raise RuntimeError("Unexpected error while formatting files (See above)") from e
+    if not okay:
+        return 1
+    return 0
+
+
+RunMode = Literal["apply", "check"]
+"Whether we should apply changes, or just check for violations"
+
+#: This regex tells us which #include directives should be modified to use angle brackets
+#: The regex is written to preserve whitespace and surrounding context. re.VERBOSE
+#: allows us to use verbose syntax with regex comments.
+INCLUDE_RE = r"""
+    # Start of line
+    ^
+
+    # The #include directive
+    (?P<directive>
+        \s*  # Any whitespace at start of line
+        [#] \s* include  # The "#" and "include", with any whitespace between
+        \s+  # One ore more whitespace following "include"
+    )
+
+    " # Open quote
+    # Match any path that does not start with a dot
+    (?P<path> [^.] .*?)
+    " # Close quote
+
+    # Everything else on the line
+    (?P<tail>.*)
+
+    # End of line
+    $
+    """
+
+REPO_DIR = Path(__file__).parent.parent.resolve()
+"""
+Directory for the root of the repository.
+
+This path is constructed based on the path to this file itself, so moving this
+script should modify the above expression
+"""
+
+SOURCE_PATTERNS = [
+    "**/*.h",
+    "**/*.hpp",
+    "**/*.c",
+    "**/*.cpp",
+]
+"""
+Recursive source file patterns, based on file extensions.
+"""
+
+SOURCE_DIRS = [
+    "src/common",
+    "src/libbson",
+    "src/libmongoc",
+    "tests",
+]
+"""
+Directories that contain our own source files (not vendored code)
+"""
+
+EXCLUDE_SOURCES = [
+    "src/libbson/src/jsonsl/**/*",
+]
+"""
+Globbing patterns that select files that are contained in our source directories,
+but are vendored third-party code.
+"""
+
+
+def all_our_sources() -> set[Path]:
+    """
+    Obtain a set of all first-party source files in the repository.
+    """
+    # Every file in our main source dirs:
+    everything = set(
+        itertools.chain.from_iterable(
+            REPO_DIR.joinpath(subdir).glob(p) for p in SOURCE_PATTERNS for subdir in SOURCE_DIRS
+        )
+    )
+    # Every file in our main source dirs that we want to exclude:
+    excluded = set(itertools.chain.from_iterable(REPO_DIR.glob(exc) for exc in EXCLUDE_SOURCES))
+    # Remove excluded from everything. Return that.
+    return everything - excluded
+
+
+def _include_subst_fn(fpath: Path):
+    "Create a regex substitution function that prints a message for the file when a substitution is made"
+
+    parent_dir = fpath.parent
+
+    def f(mat: re.Match[str]) -> str:
+        # See groups in INCLUDE_RE
+        target = mat["path"]
+        abs_target = parent_dir / target
+        if abs_target.is_file():
+            # This should be a relative include:
+            newl = f'{mat["directive"]}"./{target}"{mat["tail"]}'
+        else:
+            newl = f"{mat['directive']}<{target}>{mat['tail']}"
+        print(f" - {fpath}: update #include directive: {mat[0]!r} → {newl!r}", file=sys.stderr)
+        return newl
+
+    return f
+
+
+def _fixup_includes(fpath: Path, *, mode: RunMode) -> bool:
+    """
+    Apply #include-fixup to the content of the given source file.
+    """
+    # Split into lines
+    old_lines = fpath.read_text().split("\n")
+    # Do a regex substitution on ever line:
+    rx = re.compile(INCLUDE_RE, re.VERBOSE)
+    new_lines = [rx.sub(_include_subst_fn(fpath), ln) for ln in old_lines]
+    # Did we change anything?
+    did_change = new_lines != old_lines
+    # We changed something. What do we do next?
+    match did_change, mode:
+        case False, _:
+            # No file changes. Nothing to do
+            return True
+        case _, "apply":
+            # We are applying changes. Write the lines back into the file and tell
+            # the caller that we succeeded
+            fpath.write_text("\n".join(new_lines), newline="\n")
+            return True
+        case _, "check":
+            # File changes, and we are only checking. Print an error message and indicate failure to the caller
+            print(f"File [{fpath}] contains improper #include directives", file=sys.stderr)
+            return False
+
+
+def _format_files(files: Iterable[Path], *, mode: RunMode, clang_format: str) -> bool:
+    """
+    Run clang-format on some files, and fixup the #includes in those files.
+    """
+
+    def fixup_one(p: Path) -> bool:
+        try:
+            return _fixup_includes(p, mode=mode)
+        except Exception as e:
+            raise RuntimeError(f"Unexpected error while fixing-up the #includes on file [{p}] (See above)") from e
+
+    # First update the `#include` directives, since that can change the sort order
+    # that clang-format might want to apply
+    if not all(list(map(fixup_one, files))):
+        return False
+
+    # Whether we check for format violations or modify the files in-place
+    match mode:
+        case "apply":
+            mode_args = ["-i"]
+        case "check":
+            mode_args = ["--dry-run", "-Werror"]
+    cmd = [clang_format, *mode_args, *map(str, files)]
+    try:
+        res = subprocess.run(cmd, check=False, stderr=subprocess.STDOUT, stdout=subprocess.PIPE)
+    except Exception as e:
+        raise RuntimeError(f"Failed to spawn [{clang_format}] process for formatting files (See above)") from e
+    sys.stderr.buffer.write(res.stdout)
+    return res.returncode == 0
+
+
+def _get_files_matching(pat: str) -> Sequence[Path]:
+    """
+    Obtain files according to a globbing pattern. Checks that at least one file
+    matches.
+    """
+
+    try:
+        if os.path.isabs(pat):
+            # Given an absolute path, glob relative to the root directory
+            root = Path(pat).root
+            ret = tuple(Path(root).glob(str(Path(pat).relative_to(root))))
+        else:
+            # None-relative path, glob relative to CWD
+            ret = tuple(Path.cwd().glob(pat))
+    except Exception as e:
+        raise RuntimeError(f"Failed to collect files for globbing pattern: “{pat}” (See above)") from e
+    if not ret:
+        raise RuntimeError(f"Globbing pattern “{pat}” did not match any files")
+    return ret
+
+
+if __name__ == "__main__":
+    sys.exit(main(sys.argv[1:]))
diff -pruN 2.0.2-1/tools/init.ps1 2.1.0-1/tools/init.ps1
--- 2.0.2-1/tools/init.ps1	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/tools/init.ps1	1970-01-01 00:00:00.000000000 +0000
@@ -1,55 +0,0 @@
-$ErrorActionPreference = "Stop"
-
-$is_windows = $PSVersionTable.Platform -eq "Win32NT" -or $PSVersionTable.PSEdition -eq "Desktop"
-
-if (-not $is_windows) {
-    throw "This script is meant for Windows only."
-}
-
-$USER_CACHES_DIR = $env:USER_CACHES_DIR
-if ([String]::IsNullOrEmpty($USER_CACHES_DIR)) {
-    $USER_CACHES_DIR = $env:LOCALAPPDATA
-}
-
-$BUILD_CACHE_BUST = $env:BUILD_CACHE_BUST
-if ([String]::IsNullOrEmpty($BUILD_CACHE_BUST)) {
-    $BUILD_CACHE_BUST = "1"
-}
-$BUILD_CACHE_DIR = Join-Path $USER_CACHES_DIR "mongoc.$BUILD_CACHE_BUST"
-Write-Debug "Calculated mongoc build cache directory to be [$BUILD_CACHE_DIR]"
-
-
-function Test-Command {
-    param (
-        [string[]]$Name,
-        [System.Management.Automation.CommandTypes]$CommandType = 'All'
-    )
-    $found = @(Get-Command -Name:$Name -CommandType:$CommandType -ErrorAction Ignore -TotalCount 1)
-    if ($found.Length -ne 0) {
-        return $true
-    }
-    return $false
-}
-
-function Find-Python {
-    if (Test-Command "py" -CommandType Application -and (& py -c "(x:=0)")) {
-        $found = "py"
-    }
-    else {
-        foreach ($n in 20..8) {
-            $cand = "python3.$n"
-            Write-Debug "Try Python: [$cand]"
-            if (!(Test-Command $cand -CommandType Application)) {
-                continue;
-            }
-            if (& "$cand" -c "(x:=0)") {
-                $found = "$cand"
-                break
-            }
-        }
-    }
-    $found = (Get-Command "$found" -CommandType Application).Source
-    $ver = (& $found -c "import sys; print(sys.version)" | Out-String).Trim()
-    Write-Debug "Found Python: [$found] (Version $ver)"
-    return $found
-}
diff -pruN 2.0.2-1/tools/poetry.ps1 2.1.0-1/tools/poetry.ps1
--- 2.0.2-1/tools/poetry.ps1	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/tools/poetry.ps1	1970-01-01 00:00:00.000000000 +0000
@@ -1,102 +0,0 @@
-<#
-.SYNOPSIS
-    Execute a pinned and cached installation of Poetry
-.DESCRIPTION
-    This command will execute a Poetry command subprocess. It first looks for
-    an installed version, installs it if it is absent, and then uses the
-    installed Poetry to execute the requested command.
-
-    For help from Poetry, Use the 'poetry.ps1 help' command as seen in example 1.
-.EXAMPLE
-    > poetry.ps1 help
-
-    Print help messages from Poetry itself
-.EXAMPLE
-    > poetry.ps1 install --with=docs --with=env
-
-    Installs the project dependencies in the active virtualenv. This operation
-    is idempotent
-.EXAMPLE
-    > poetry.ps1 shell
-
-    Spawn a new interactive PowerShell session with the project's virtualenv
-    active. With this, the project's dependencies will be available on
-    $env:PATH.
-.EXAMPLE
-    > poetry.ps1 run sphinx-build -bhtml docs/ out/docs/html
-
-    Execute the sphinx-build executable that is installed within the
-    Poetry-managed virtual environment.
-.LINK
-    https://python-poetry.org
-
-        The Poetry website.
-#>
-[CmdletBinding(PositionalBinding = $false)]
-param(
-    # The version of Poetry that we want to install. By default, installs 1.4.2
-    [string]
-    $PoetryVersion = "1.4.2",
-    # Force the directory in which Poetry will be installed
-    [string]
-    $PoetryHome,
-    # The Poetry subcommand to execute. (If any Poetry arguments conflict with
-    # PowerShell argument parsing, enquote them to ensure they are passed as
-    # positional string arguments.)
-    [Parameter(Position = 2, ValueFromRemainingArguments)]
-    [string[]]
-    $Command
-)
-
-# Halt on subcommand errors
-$ErrorActionPreference = 'Stop'
-
-# We assume Windows and pwsh 7+
-$is_pwsh_win = $PSVersionTable.Platform -eq "Win32NT" -or $PSVersionTable.PSEdition -eq "Desktop"
-if (-not $is_pwsh_win) {
-    throw "This script is meant for PowerShell 7+ on Windows. (Use 'pwsh' on Windows, and use poetry.sh for Unix-like systems.)"
-}
-
-# The directory that contains this file:
-$this_dir = $PSScriptRoot
-
-# Load util vars and functions:
-. "$this_dir/init.ps1"
-
-# The directory in which we are installing Poetry:
-if ([String]::IsNullOrEmpty($PoetryHome)) {
-    $PoetryHome = "$BUILD_CACHE_DIR/poetry-$PoetryVersion"
-}
-$stamp_file = Join-Path $PoetryHome ".installed.done"
-
-# Poetry respects the POETRY_HOME environment variable.
-$env:POETRY_HOME = $PoetryHome
-
-$py = Find-Python
-
-# Create the Poetry installation if it is not already present
-if (!(Test-Path $stamp_file)) {
-    Write-Debug "Installing Poetry $PoetryVersion into [$PoetryHome]"
-    # Lock to prevent concurrent installations
-    $mtx = New-Object System.Threading.Mutex($false, "Global\MongoCPoetryInstall")
-    [void]$mtx.WaitOne()
-    # (No need to double-check, since a second install is a no-op)
-    try {
-        # Do the actual install:
-        & $py -u "$this_dir/install-poetry.py" --yes --version "$PoetryVersion"
-        if ($LASTEXITCODE -ne 0) {
-            throw "Poetry installation failed [$LASTEXITCODE]"
-        }
-        # Touch the stamp file to tell future runs that the install is okay:
-        Set-Content $stamp_file ""
-    }
-    finally {
-        [void]$mtx.ReleaseMutex()
-    }
-}
-
-# Execute the Poetry command
-$poetry_exe = Join-Path $PoetryHome "bin/poetry.exe"
-& $poetry_exe env use --quiet $py
-& $poetry_exe @Command
-exit $LASTEXITCODE
diff -pruN 2.0.2-1/tools/poetry.sh 2.1.0-1/tools/poetry.sh
--- 2.0.2-1/tools/poetry.sh	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/tools/poetry.sh	1970-01-01 00:00:00.000000000 +0000
@@ -1,99 +0,0 @@
-#!/usr/bin/env bash
-
-# Automatically installs and invokes a pinned version of Poetry (https://python-poetry.org/)
-#
-## Commands defined by this file:
-#
-# * run-poetry [<cmd> ...]
-#     • Execute the given Poetry command. This script can also be executed
-#       directly to run the same Poetry command.
-#
-#       On first run, will install a new Poetry instance in a user-local cache
-#       directory. This script DOES NOT respect POETRY_HOME! Instead, use
-#       FORCE_POETRY_HOME to force a directory in which to install Poetry.
-#
-# * ensure-poetry [<version> [<home>]]
-#     • Ensures that Poetry of the given <version> is installed into <home>.
-#       This is an idempotent operation. Defaults are from WANT_POETRY_VERSION
-#       and POETRY_HOME (see below).
-#
-## Variables set by this file:
-#
-# * POETRY_HOME
-#     • The default user-local directory in which Poetry will be installed.
-#       This can be overriden by setting FORCE_POETRY_HOME.
-# * POETRY_EXE
-#     • The default full path to the Poetry that will be installed and run by
-#       this script (not present until after ensure-poetry or run-poetry is
-#       executed).
-# * WANT_POETRY_VERSION (overridable) (default 1.8.2)
-#     • The version of Poetry that will be installed by run-poetry when executed.
-# * POETRY_PYTHON_VERSION (overridable) (default to result of find-python)
-#     • The Python binary to use by the Poetry installer and virtual environment(s).
-
-# Load vars and utils:
-. "$(dirname "${BASH_SOURCE[0]}")/use.sh" python paths base with_lock download
-
-: "${WANT_POETRY_VERSION:=1.8.2}"
-declare -r -x POETRY_HOME=${FORCE_POETRY_HOME:-"$BUILD_CACHE_DIR/poetry-$WANT_POETRY_VERSION"}
-declare -r POETRY_EXE=$POETRY_HOME/bin/poetry$EXE_SUFFIX
-
-# Usage: install-poetry <version> <poetry-home>
-install-poetry() {
-    declare poetry_version=$1
-    declare poetry_home=$2
-    log "Installing Poetry $poetry_version into [$poetry_home]"
-    mkdir -p "$poetry_home"
-    # Download the automated installer:
-    installer=$poetry_home/install-poetry.py
-    download-file --uri=https://install.python-poetry.org --out="$installer"
-    # Run the install:
-    : "${POETRY_PYTHON_BINARY:="$(find-python)"}"
-    with-lock "$POETRY_HOME/.install.lock" \
-        env POETRY_HOME="$poetry_home" \
-        "$POETRY_PYTHON_BINARY" -u "$installer" --yes --version "$poetry_version" \
-    || (
-        cat -- poetry-installer*.log && fail "Poetry installation failed"
-    )
-    printf %s "$poetry_version" > "$POETRY_HOME/installed.txt"
-}
-
-# Idempotent installation:
-# Usage: ensure-poetry <version> <poetry-home>
-ensure-poetry() {
-    declare version=${1:-$WANT_POETRY_VERSION}
-    declare home=${2:-$POETRY_HOME}
-    if ! is-file "$home/installed.txt" || [[ "$(cat "$home/installed.txt")" != "$version" ]]; then
-        install-poetry "$version" "$home"
-    fi
-    : "${POETRY_PYTHON_BINARY:="$(find-python)"}"
-    # Extra step must be taken to ensure Poetry's virtual environment uses the correct Python binary.
-    # See: https://github.com/python-poetry/poetry/issues/522
-    with-lock "$POETRY_HOME/.install.lock" \
-        env POETRY_HOME="$POETRY_HOME" \
-        "$POETRY_EXE" env use --quiet -- "$POETRY_PYTHON_BINARY" \
-    || (
-        fail "Poetry failed to set Python binary to $POETRY_PYTHON_BINARY"
-    )
-}
-
-run-poetry() {
-    ensure-poetry "$WANT_POETRY_VERSION" "$POETRY_HOME"
-    env POETRY_HOME="$POETRY_HOME" "$POETRY_EXE" "$@"
-}
-
-# Poetry bug: Poetry uses the keyring, even for non-authenticating commands,
-# which can wreak havoc in cases where the keyring is unavailable
-# (i.e. SSH and non-interactive sessions)
-# (https://github.com/python-poetry/poetry/issues/1917)
-export PYTHON_KEYRING_BACKEND="keyring.backends.null.Keyring"
-
-if is-main; then
-    if [[ "$*" = "--ensure-installed" ]]; then
-        # Just install, don't run it
-        ensure-poetry "$WANT_POETRY_VERSION" "$POETRY_HOME"
-    else
-        # Run the Poetry command:
-        run-poetry "$@"
-    fi
-fi
diff -pruN 2.0.2-1/tools/python.sh 2.1.0-1/tools/python.sh
--- 2.0.2-1/tools/python.sh	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/tools/python.sh	1970-01-01 00:00:00.000000000 +0000
@@ -1,56 +0,0 @@
-#!/usr/bin/env bash
-
-## Commands defined by this file:
-#
-# * run-python [...]
-#     • Execute the Python interpreter with the given arguments
-# * find-python
-#     • Searches for a Python executable that supports Python 3.8 or newer
-#
-# Run this file directly to invoke the same Python executable.
-# Invoke this script with "--where" to print the path to the Python executable
-# that would be used.
-
-. "$(dirname "${BASH_SOURCE[0]}")/use.sh" base
-
-find-python() {
-    pys=(
-        py
-        python3.14
-        python3.13
-        python3.12
-        python3.11
-        python3.10
-        python3.9
-        python3.8
-        python3
-        python
-    )
-    for cand in "${pys[@]}"; do
-        # Find a Python that supports "x := 0", which was added in Python 3.8
-        if have-command "$cand" && "$cand" -c "(x:=0)" > /dev/null 2>&1; then
-            _found=$(type -P "$cand")
-            break
-        fi
-    done
-    if ! is-set _found; then
-        fail "No Python (≥3.8) executable was found"
-    fi
-
-    debug "Found Python: $_found"
-    printf %s "$_found"
-}
-
-run-python() {
-    local py
-    py=$(find-python)
-    "$py" "$@"
-}
-
-if is-main; then
-    if [[ "$*" = "--where" ]]; then
-        printf "%s\n" "$(find-python)"
-    else
-        run-python "$@"
-    fi
-fi
diff -pruN 2.0.2-1/tools/with_lock.sh 2.1.0-1/tools/with_lock.sh
--- 2.0.2-1/tools/with_lock.sh	2025-06-19 15:42:22.000000000 +0000
+++ 2.1.0-1/tools/with_lock.sh	1970-01-01 00:00:00.000000000 +0000
@@ -1,21 +0,0 @@
-#!/usr/bin/env bash
-
-. "$(dirname "${BASH_SOURCE[0]}")/use.sh" base
-
-# * with-lock <lockfile> [command ...]
-#       Execute ‘command’ while holding <lockfile> as an exclusive lock. This
-#       requires the ‘lckdo’ command, otherwise it executes the command without
-#       taking any lock. The parent directory of <lockfile> must exists. NOTE:
-#       the given command must be an application, and not a shell-internal or
-#       shell function.
-with-lock() {
-    [[ "$#" -gt 1 ]] || fail "with-lock requires a lock filename and a command to run"
-    if ! have-command lckdo; then
-        log "No ‘lckdo’ program is installed. We'll run without the lock, but parallel tasks may contend."
-        log "  (‘lckdo’ is part of the ‘moreutils’ package)"
-        shift
-        command "$@"
-    else
-        lckdo -W 30 -- "$@"
-    fi
-}
diff -pruN 2.0.2-1/uv.lock 2.1.0-1/uv.lock
--- 2.0.2-1/uv.lock	1970-01-01 00:00:00.000000000 +0000
+++ 2.1.0-1/uv.lock	2025-08-14 18:37:23.000000000 +0000
@@ -0,0 +1,810 @@
+version = 1
+revision = 2
+requires-python = ">=3.10"
+resolution-markers = [
+    "python_full_version >= '3.11'",
+    "python_full_version < '3.11'",
+]
+
+[[package]]
+name = "accessible-pygments"
+version = "0.0.5"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "pygments" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/bc/c1/bbac6a50d02774f91572938964c582fff4270eee73ab822a4aeea4d8b11b/accessible_pygments-0.0.5.tar.gz", hash = "sha256:40918d3e6a2b619ad424cb91e556bd3bd8865443d9f22f1dcdf79e33c8046872", size = 1377899, upload-time = "2024-05-10T11:23:10.216Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/8d/3f/95338030883d8c8b91223b4e21744b04d11b161a3ef117295d8241f50ab4/accessible_pygments-0.0.5-py3-none-any.whl", hash = "sha256:88ae3211e68a1d0b011504b2ffc1691feafce124b845bd072ab6f9f66f34d4b7", size = 1395903, upload-time = "2024-05-10T11:23:08.421Z" },
+]
+
+[[package]]
+name = "alabaster"
+version = "1.0.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/a6/f8/d9c74d0daf3f742840fd818d69cfae176fa332022fd44e3469487d5a9420/alabaster-1.0.0.tar.gz", hash = "sha256:c00dca57bca26fa62a6d7d0a9fcce65f3e026e9bfe33e9c538fd3fbb2144fd9e", size = 24210, upload-time = "2024-07-26T18:15:03.762Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/7e/b3/6b4067be973ae96ba0d615946e314c5ae35f9f993eca561b356540bb0c2b/alabaster-1.0.0-py3-none-any.whl", hash = "sha256:fc6786402dc3fcb2de3cabd5fe455a2db534b371124f1f21de8731783dec828b", size = 13929, upload-time = "2024-07-26T18:15:02.05Z" },
+]
+
+[[package]]
+name = "annotated-types"
+version = "0.7.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/ee/67/531ea369ba64dcff5ec9c3402f9f51bf748cec26dde048a2f973a4eea7f5/annotated_types-0.7.0.tar.gz", hash = "sha256:aff07c09a53a08bc8cfccb9c85b05f1aa9a2a6f23728d790723543408344ce89", size = 16081, upload-time = "2024-05-20T21:33:25.928Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/78/b6/6307fbef88d9b5ee7421e68d78a9f162e0da4900bc5f5793f6d3d0e34fb8/annotated_types-0.7.0-py3-none-any.whl", hash = "sha256:1f02e8b43a8fbbc3f3e0d4f0f4bfc8131bcb4eebe8849b8e5c773f3a1c582a53", size = 13643, upload-time = "2024-05-20T21:33:24.1Z" },
+]
+
+[[package]]
+name = "babel"
+version = "2.17.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/7d/6b/d52e42361e1aa00709585ecc30b3f9684b3ab62530771402248b1b1d6240/babel-2.17.0.tar.gz", hash = "sha256:0c54cffb19f690cdcc52a3b50bcbf71e07a808d1c80d549f2459b9d2cf0afb9d", size = 9951852, upload-time = "2025-02-01T15:17:41.026Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/b7/b8/3fe70c75fe32afc4bb507f75563d39bc5642255d1d94f1f23604725780bf/babel-2.17.0-py3-none-any.whl", hash = "sha256:4d0b53093fdfb4b21c92b5213dba5a1b23885afa8383709427046b21c366e5f2", size = 10182537, upload-time = "2025-02-01T15:17:37.39Z" },
+]
+
+[[package]]
+name = "beautifulsoup4"
+version = "4.13.4"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "soupsieve" },
+    { name = "typing-extensions" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/d8/e4/0c4c39e18fd76d6a628d4dd8da40543d136ce2d1752bd6eeeab0791f4d6b/beautifulsoup4-4.13.4.tar.gz", hash = "sha256:dbb3c4e1ceae6aefebdaf2423247260cd062430a410e38c66f2baa50a8437195", size = 621067, upload-time = "2025-04-15T17:05:13.836Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/50/cd/30110dc0ffcf3b131156077b90e9f60ed75711223f306da4db08eff8403b/beautifulsoup4-4.13.4-py3-none-any.whl", hash = "sha256:9bbbb14bfde9d79f38b8cd5f8c7c85f4b8f2523190ebed90e950a8dea4cb1c4b", size = 187285, upload-time = "2025-04-15T17:05:12.221Z" },
+]
+
+[[package]]
+name = "certifi"
+version = "2025.7.14"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/b3/76/52c535bcebe74590f296d6c77c86dabf761c41980e1347a2422e4aa2ae41/certifi-2025.7.14.tar.gz", hash = "sha256:8ea99dbdfaaf2ba2f9bac77b9249ef62ec5218e7c2b2e903378ed5fccf765995", size = 163981, upload-time = "2025-07-14T03:29:28.449Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/4f/52/34c6cf5bb9285074dc3531c437b3919e825d976fde097a7a73f79e726d03/certifi-2025.7.14-py3-none-any.whl", hash = "sha256:6b31f564a415d79ee77df69d757bb49a5bb53bd9f756cbbe24394ffd6fc1f4b2", size = 162722, upload-time = "2025-07-14T03:29:26.863Z" },
+]
+
+[[package]]
+name = "charset-normalizer"
+version = "3.4.2"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/e4/33/89c2ced2b67d1c2a61c19c6751aa8902d46ce3dacb23600a283619f5a12d/charset_normalizer-3.4.2.tar.gz", hash = "sha256:5baececa9ecba31eff645232d59845c07aa030f0c81ee70184a90d35099a0e63", size = 126367, upload-time = "2025-05-02T08:34:42.01Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/95/28/9901804da60055b406e1a1c5ba7aac1276fb77f1dde635aabfc7fd84b8ab/charset_normalizer-3.4.2-cp310-cp310-macosx_10_9_universal2.whl", hash = "sha256:7c48ed483eb946e6c04ccbe02c6b4d1d48e51944b6db70f697e089c193404941", size = 201818, upload-time = "2025-05-02T08:31:46.725Z" },
+    { url = "https://files.pythonhosted.org/packages/d9/9b/892a8c8af9110935e5adcbb06d9c6fe741b6bb02608c6513983048ba1a18/charset_normalizer-3.4.2-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:b2d318c11350e10662026ad0eb71bb51c7812fc8590825304ae0bdd4ac283acd", size = 144649, upload-time = "2025-05-02T08:31:48.889Z" },
+    { url = "https://files.pythonhosted.org/packages/7b/a5/4179abd063ff6414223575e008593861d62abfc22455b5d1a44995b7c101/charset_normalizer-3.4.2-cp310-cp310-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:9cbfacf36cb0ec2897ce0ebc5d08ca44213af24265bd56eca54bee7923c48fd6", size = 155045, upload-time = "2025-05-02T08:31:50.757Z" },
+    { url = "https://files.pythonhosted.org/packages/3b/95/bc08c7dfeddd26b4be8c8287b9bb055716f31077c8b0ea1cd09553794665/charset_normalizer-3.4.2-cp310-cp310-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:18dd2e350387c87dabe711b86f83c9c78af772c748904d372ade190b5c7c9d4d", size = 147356, upload-time = "2025-05-02T08:31:52.634Z" },
+    { url = "https://files.pythonhosted.org/packages/a8/2d/7a5b635aa65284bf3eab7653e8b4151ab420ecbae918d3e359d1947b4d61/charset_normalizer-3.4.2-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:8075c35cd58273fee266c58c0c9b670947c19df5fb98e7b66710e04ad4e9ff86", size = 149471, upload-time = "2025-05-02T08:31:56.207Z" },
+    { url = "https://files.pythonhosted.org/packages/ae/38/51fc6ac74251fd331a8cfdb7ec57beba8c23fd5493f1050f71c87ef77ed0/charset_normalizer-3.4.2-cp310-cp310-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:5bf4545e3b962767e5c06fe1738f951f77d27967cb2caa64c28be7c4563e162c", size = 151317, upload-time = "2025-05-02T08:31:57.613Z" },
+    { url = "https://files.pythonhosted.org/packages/b7/17/edee1e32215ee6e9e46c3e482645b46575a44a2d72c7dfd49e49f60ce6bf/charset_normalizer-3.4.2-cp310-cp310-musllinux_1_2_aarch64.whl", hash = "sha256:7a6ab32f7210554a96cd9e33abe3ddd86732beeafc7a28e9955cdf22ffadbab0", size = 146368, upload-time = "2025-05-02T08:31:59.468Z" },
+    { url = "https://files.pythonhosted.org/packages/26/2c/ea3e66f2b5f21fd00b2825c94cafb8c326ea6240cd80a91eb09e4a285830/charset_normalizer-3.4.2-cp310-cp310-musllinux_1_2_i686.whl", hash = "sha256:b33de11b92e9f75a2b545d6e9b6f37e398d86c3e9e9653c4864eb7e89c5773ef", size = 154491, upload-time = "2025-05-02T08:32:01.219Z" },
+    { url = "https://files.pythonhosted.org/packages/52/47/7be7fa972422ad062e909fd62460d45c3ef4c141805b7078dbab15904ff7/charset_normalizer-3.4.2-cp310-cp310-musllinux_1_2_ppc64le.whl", hash = "sha256:8755483f3c00d6c9a77f490c17e6ab0c8729e39e6390328e42521ef175380ae6", size = 157695, upload-time = "2025-05-02T08:32:03.045Z" },
+    { url = "https://files.pythonhosted.org/packages/2f/42/9f02c194da282b2b340f28e5fb60762de1151387a36842a92b533685c61e/charset_normalizer-3.4.2-cp310-cp310-musllinux_1_2_s390x.whl", hash = "sha256:68a328e5f55ec37c57f19ebb1fdc56a248db2e3e9ad769919a58672958e8f366", size = 154849, upload-time = "2025-05-02T08:32:04.651Z" },
+    { url = "https://files.pythonhosted.org/packages/67/44/89cacd6628f31fb0b63201a618049be4be2a7435a31b55b5eb1c3674547a/charset_normalizer-3.4.2-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:21b2899062867b0e1fde9b724f8aecb1af14f2778d69aacd1a5a1853a597a5db", size = 150091, upload-time = "2025-05-02T08:32:06.719Z" },
+    { url = "https://files.pythonhosted.org/packages/1f/79/4b8da9f712bc079c0f16b6d67b099b0b8d808c2292c937f267d816ec5ecc/charset_normalizer-3.4.2-cp310-cp310-win32.whl", hash = "sha256:e8082b26888e2f8b36a042a58307d5b917ef2b1cacab921ad3323ef91901c71a", size = 98445, upload-time = "2025-05-02T08:32:08.66Z" },
+    { url = "https://files.pythonhosted.org/packages/7d/d7/96970afb4fb66497a40761cdf7bd4f6fca0fc7bafde3a84f836c1f57a926/charset_normalizer-3.4.2-cp310-cp310-win_amd64.whl", hash = "sha256:f69a27e45c43520f5487f27627059b64aaf160415589230992cec34c5e18a509", size = 105782, upload-time = "2025-05-02T08:32:10.46Z" },
+    { url = "https://files.pythonhosted.org/packages/05/85/4c40d00dcc6284a1c1ad5de5e0996b06f39d8232f1031cd23c2f5c07ee86/charset_normalizer-3.4.2-cp311-cp311-macosx_10_9_universal2.whl", hash = "sha256:be1e352acbe3c78727a16a455126d9ff83ea2dfdcbc83148d2982305a04714c2", size = 198794, upload-time = "2025-05-02T08:32:11.945Z" },
+    { url = "https://files.pythonhosted.org/packages/41/d9/7a6c0b9db952598e97e93cbdfcb91bacd89b9b88c7c983250a77c008703c/charset_normalizer-3.4.2-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:aa88ca0b1932e93f2d961bf3addbb2db902198dca337d88c89e1559e066e7645", size = 142846, upload-time = "2025-05-02T08:32:13.946Z" },
+    { url = "https://files.pythonhosted.org/packages/66/82/a37989cda2ace7e37f36c1a8ed16c58cf48965a79c2142713244bf945c89/charset_normalizer-3.4.2-cp311-cp311-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:d524ba3f1581b35c03cb42beebab4a13e6cdad7b36246bd22541fa585a56cccd", size = 153350, upload-time = "2025-05-02T08:32:15.873Z" },
+    { url = "https://files.pythonhosted.org/packages/df/68/a576b31b694d07b53807269d05ec3f6f1093e9545e8607121995ba7a8313/charset_normalizer-3.4.2-cp311-cp311-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:28a1005facc94196e1fb3e82a3d442a9d9110b8434fc1ded7a24a2983c9888d8", size = 145657, upload-time = "2025-05-02T08:32:17.283Z" },
+    { url = "https://files.pythonhosted.org/packages/92/9b/ad67f03d74554bed3aefd56fe836e1623a50780f7c998d00ca128924a499/charset_normalizer-3.4.2-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:fdb20a30fe1175ecabed17cbf7812f7b804b8a315a25f24678bcdf120a90077f", size = 147260, upload-time = "2025-05-02T08:32:18.807Z" },
+    { url = "https://files.pythonhosted.org/packages/a6/e6/8aebae25e328160b20e31a7e9929b1578bbdc7f42e66f46595a432f8539e/charset_normalizer-3.4.2-cp311-cp311-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:0f5d9ed7f254402c9e7d35d2f5972c9bbea9040e99cd2861bd77dc68263277c7", size = 149164, upload-time = "2025-05-02T08:32:20.333Z" },
+    { url = "https://files.pythonhosted.org/packages/8b/f2/b3c2f07dbcc248805f10e67a0262c93308cfa149a4cd3d1fe01f593e5fd2/charset_normalizer-3.4.2-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:efd387a49825780ff861998cd959767800d54f8308936b21025326de4b5a42b9", size = 144571, upload-time = "2025-05-02T08:32:21.86Z" },
+    { url = "https://files.pythonhosted.org/packages/60/5b/c3f3a94bc345bc211622ea59b4bed9ae63c00920e2e8f11824aa5708e8b7/charset_normalizer-3.4.2-cp311-cp311-musllinux_1_2_i686.whl", hash = "sha256:f0aa37f3c979cf2546b73e8222bbfa3dc07a641585340179d768068e3455e544", size = 151952, upload-time = "2025-05-02T08:32:23.434Z" },
+    { url = "https://files.pythonhosted.org/packages/e2/4d/ff460c8b474122334c2fa394a3f99a04cf11c646da895f81402ae54f5c42/charset_normalizer-3.4.2-cp311-cp311-musllinux_1_2_ppc64le.whl", hash = "sha256:e70e990b2137b29dc5564715de1e12701815dacc1d056308e2b17e9095372a82", size = 155959, upload-time = "2025-05-02T08:32:24.993Z" },
+    { url = "https://files.pythonhosted.org/packages/a2/2b/b964c6a2fda88611a1fe3d4c400d39c66a42d6c169c924818c848f922415/charset_normalizer-3.4.2-cp311-cp311-musllinux_1_2_s390x.whl", hash = "sha256:0c8c57f84ccfc871a48a47321cfa49ae1df56cd1d965a09abe84066f6853b9c0", size = 153030, upload-time = "2025-05-02T08:32:26.435Z" },
+    { url = "https://files.pythonhosted.org/packages/59/2e/d3b9811db26a5ebf444bc0fa4f4be5aa6d76fc6e1c0fd537b16c14e849b6/charset_normalizer-3.4.2-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:6b66f92b17849b85cad91259efc341dce9c1af48e2173bf38a85c6329f1033e5", size = 148015, upload-time = "2025-05-02T08:32:28.376Z" },
+    { url = "https://files.pythonhosted.org/packages/90/07/c5fd7c11eafd561bb51220d600a788f1c8d77c5eef37ee49454cc5c35575/charset_normalizer-3.4.2-cp311-cp311-win32.whl", hash = "sha256:daac4765328a919a805fa5e2720f3e94767abd632ae410a9062dff5412bae65a", size = 98106, upload-time = "2025-05-02T08:32:30.281Z" },
+    { url = "https://files.pythonhosted.org/packages/a8/05/5e33dbef7e2f773d672b6d79f10ec633d4a71cd96db6673625838a4fd532/charset_normalizer-3.4.2-cp311-cp311-win_amd64.whl", hash = "sha256:e53efc7c7cee4c1e70661e2e112ca46a575f90ed9ae3fef200f2a25e954f4b28", size = 105402, upload-time = "2025-05-02T08:32:32.191Z" },
+    { url = "https://files.pythonhosted.org/packages/d7/a4/37f4d6035c89cac7930395a35cc0f1b872e652eaafb76a6075943754f095/charset_normalizer-3.4.2-cp312-cp312-macosx_10_13_universal2.whl", hash = "sha256:0c29de6a1a95f24b9a1aa7aefd27d2487263f00dfd55a77719b530788f75cff7", size = 199936, upload-time = "2025-05-02T08:32:33.712Z" },
+    { url = "https://files.pythonhosted.org/packages/ee/8a/1a5e33b73e0d9287274f899d967907cd0bf9c343e651755d9307e0dbf2b3/charset_normalizer-3.4.2-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:cddf7bd982eaa998934a91f69d182aec997c6c468898efe6679af88283b498d3", size = 143790, upload-time = "2025-05-02T08:32:35.768Z" },
+    { url = "https://files.pythonhosted.org/packages/66/52/59521f1d8e6ab1482164fa21409c5ef44da3e9f653c13ba71becdd98dec3/charset_normalizer-3.4.2-cp312-cp312-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:fcbe676a55d7445b22c10967bceaaf0ee69407fbe0ece4d032b6eb8d4565982a", size = 153924, upload-time = "2025-05-02T08:32:37.284Z" },
+    { url = "https://files.pythonhosted.org/packages/86/2d/fb55fdf41964ec782febbf33cb64be480a6b8f16ded2dbe8db27a405c09f/charset_normalizer-3.4.2-cp312-cp312-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:d41c4d287cfc69060fa91cae9683eacffad989f1a10811995fa309df656ec214", size = 146626, upload-time = "2025-05-02T08:32:38.803Z" },
+    { url = "https://files.pythonhosted.org/packages/8c/73/6ede2ec59bce19b3edf4209d70004253ec5f4e319f9a2e3f2f15601ed5f7/charset_normalizer-3.4.2-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:4e594135de17ab3866138f496755f302b72157d115086d100c3f19370839dd3a", size = 148567, upload-time = "2025-05-02T08:32:40.251Z" },
+    { url = "https://files.pythonhosted.org/packages/09/14/957d03c6dc343c04904530b6bef4e5efae5ec7d7990a7cbb868e4595ee30/charset_normalizer-3.4.2-cp312-cp312-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:cf713fe9a71ef6fd5adf7a79670135081cd4431c2943864757f0fa3a65b1fafd", size = 150957, upload-time = "2025-05-02T08:32:41.705Z" },
+    { url = "https://files.pythonhosted.org/packages/0d/c8/8174d0e5c10ccebdcb1b53cc959591c4c722a3ad92461a273e86b9f5a302/charset_normalizer-3.4.2-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:a370b3e078e418187da8c3674eddb9d983ec09445c99a3a263c2011993522981", size = 145408, upload-time = "2025-05-02T08:32:43.709Z" },
+    { url = "https://files.pythonhosted.org/packages/58/aa/8904b84bc8084ac19dc52feb4f5952c6df03ffb460a887b42615ee1382e8/charset_normalizer-3.4.2-cp312-cp312-musllinux_1_2_i686.whl", hash = "sha256:a955b438e62efdf7e0b7b52a64dc5c3396e2634baa62471768a64bc2adb73d5c", size = 153399, upload-time = "2025-05-02T08:32:46.197Z" },
+    { url = "https://files.pythonhosted.org/packages/c2/26/89ee1f0e264d201cb65cf054aca6038c03b1a0c6b4ae998070392a3ce605/charset_normalizer-3.4.2-cp312-cp312-musllinux_1_2_ppc64le.whl", hash = "sha256:7222ffd5e4de8e57e03ce2cef95a4c43c98fcb72ad86909abdfc2c17d227fc1b", size = 156815, upload-time = "2025-05-02T08:32:48.105Z" },
+    { url = "https://files.pythonhosted.org/packages/fd/07/68e95b4b345bad3dbbd3a8681737b4338ff2c9df29856a6d6d23ac4c73cb/charset_normalizer-3.4.2-cp312-cp312-musllinux_1_2_s390x.whl", hash = "sha256:bee093bf902e1d8fc0ac143c88902c3dfc8941f7ea1d6a8dd2bcb786d33db03d", size = 154537, upload-time = "2025-05-02T08:32:49.719Z" },
+    { url = "https://files.pythonhosted.org/packages/77/1a/5eefc0ce04affb98af07bc05f3bac9094513c0e23b0562d64af46a06aae4/charset_normalizer-3.4.2-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:dedb8adb91d11846ee08bec4c8236c8549ac721c245678282dcb06b221aab59f", size = 149565, upload-time = "2025-05-02T08:32:51.404Z" },
+    { url = "https://files.pythonhosted.org/packages/37/a0/2410e5e6032a174c95e0806b1a6585eb21e12f445ebe239fac441995226a/charset_normalizer-3.4.2-cp312-cp312-win32.whl", hash = "sha256:db4c7bf0e07fc3b7d89ac2a5880a6a8062056801b83ff56d8464b70f65482b6c", size = 98357, upload-time = "2025-05-02T08:32:53.079Z" },
+    { url = "https://files.pythonhosted.org/packages/6c/4f/c02d5c493967af3eda9c771ad4d2bbc8df6f99ddbeb37ceea6e8716a32bc/charset_normalizer-3.4.2-cp312-cp312-win_amd64.whl", hash = "sha256:5a9979887252a82fefd3d3ed2a8e3b937a7a809f65dcb1e068b090e165bbe99e", size = 105776, upload-time = "2025-05-02T08:32:54.573Z" },
+    { url = "https://files.pythonhosted.org/packages/ea/12/a93df3366ed32db1d907d7593a94f1fe6293903e3e92967bebd6950ed12c/charset_normalizer-3.4.2-cp313-cp313-macosx_10_13_universal2.whl", hash = "sha256:926ca93accd5d36ccdabd803392ddc3e03e6d4cd1cf17deff3b989ab8e9dbcf0", size = 199622, upload-time = "2025-05-02T08:32:56.363Z" },
+    { url = "https://files.pythonhosted.org/packages/04/93/bf204e6f344c39d9937d3c13c8cd5bbfc266472e51fc8c07cb7f64fcd2de/charset_normalizer-3.4.2-cp313-cp313-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:eba9904b0f38a143592d9fc0e19e2df0fa2e41c3c3745554761c5f6447eedabf", size = 143435, upload-time = "2025-05-02T08:32:58.551Z" },
+    { url = "https://files.pythonhosted.org/packages/22/2a/ea8a2095b0bafa6c5b5a55ffdc2f924455233ee7b91c69b7edfcc9e02284/charset_normalizer-3.4.2-cp313-cp313-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:3fddb7e2c84ac87ac3a947cb4e66d143ca5863ef48e4a5ecb83bd48619e4634e", size = 153653, upload-time = "2025-05-02T08:33:00.342Z" },
+    { url = "https://files.pythonhosted.org/packages/b6/57/1b090ff183d13cef485dfbe272e2fe57622a76694061353c59da52c9a659/charset_normalizer-3.4.2-cp313-cp313-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:98f862da73774290f251b9df8d11161b6cf25b599a66baf087c1ffe340e9bfd1", size = 146231, upload-time = "2025-05-02T08:33:02.081Z" },
+    { url = "https://files.pythonhosted.org/packages/e2/28/ffc026b26f441fc67bd21ab7f03b313ab3fe46714a14b516f931abe1a2d8/charset_normalizer-3.4.2-cp313-cp313-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:6c9379d65defcab82d07b2a9dfbfc2e95bc8fe0ebb1b176a3190230a3ef0e07c", size = 148243, upload-time = "2025-05-02T08:33:04.063Z" },
+    { url = "https://files.pythonhosted.org/packages/c0/0f/9abe9bd191629c33e69e47c6ef45ef99773320e9ad8e9cb08b8ab4a8d4cb/charset_normalizer-3.4.2-cp313-cp313-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:e635b87f01ebc977342e2697d05b56632f5f879a4f15955dfe8cef2448b51691", size = 150442, upload-time = "2025-05-02T08:33:06.418Z" },
+    { url = "https://files.pythonhosted.org/packages/67/7c/a123bbcedca91d5916c056407f89a7f5e8fdfce12ba825d7d6b9954a1a3c/charset_normalizer-3.4.2-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:1c95a1e2902a8b722868587c0e1184ad5c55631de5afc0eb96bc4b0d738092c0", size = 145147, upload-time = "2025-05-02T08:33:08.183Z" },
+    { url = "https://files.pythonhosted.org/packages/ec/fe/1ac556fa4899d967b83e9893788e86b6af4d83e4726511eaaad035e36595/charset_normalizer-3.4.2-cp313-cp313-musllinux_1_2_i686.whl", hash = "sha256:ef8de666d6179b009dce7bcb2ad4c4a779f113f12caf8dc77f0162c29d20490b", size = 153057, upload-time = "2025-05-02T08:33:09.986Z" },
+    { url = "https://files.pythonhosted.org/packages/2b/ff/acfc0b0a70b19e3e54febdd5301a98b72fa07635e56f24f60502e954c461/charset_normalizer-3.4.2-cp313-cp313-musllinux_1_2_ppc64le.whl", hash = "sha256:32fc0341d72e0f73f80acb0a2c94216bd704f4f0bce10aedea38f30502b271ff", size = 156454, upload-time = "2025-05-02T08:33:11.814Z" },
+    { url = "https://files.pythonhosted.org/packages/92/08/95b458ce9c740d0645feb0e96cea1f5ec946ea9c580a94adfe0b617f3573/charset_normalizer-3.4.2-cp313-cp313-musllinux_1_2_s390x.whl", hash = "sha256:289200a18fa698949d2b39c671c2cc7a24d44096784e76614899a7ccf2574b7b", size = 154174, upload-time = "2025-05-02T08:33:13.707Z" },
+    { url = "https://files.pythonhosted.org/packages/78/be/8392efc43487ac051eee6c36d5fbd63032d78f7728cb37aebcc98191f1ff/charset_normalizer-3.4.2-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:4a476b06fbcf359ad25d34a057b7219281286ae2477cc5ff5e3f70a246971148", size = 149166, upload-time = "2025-05-02T08:33:15.458Z" },
+    { url = "https://files.pythonhosted.org/packages/44/96/392abd49b094d30b91d9fbda6a69519e95802250b777841cf3bda8fe136c/charset_normalizer-3.4.2-cp313-cp313-win32.whl", hash = "sha256:aaeeb6a479c7667fbe1099af9617c83aaca22182d6cf8c53966491a0f1b7ffb7", size = 98064, upload-time = "2025-05-02T08:33:17.06Z" },
+    { url = "https://files.pythonhosted.org/packages/e9/b0/0200da600134e001d91851ddc797809e2fe0ea72de90e09bec5a2fbdaccb/charset_normalizer-3.4.2-cp313-cp313-win_amd64.whl", hash = "sha256:aa6af9e7d59f9c12b33ae4e9450619cf2488e2bbe9b44030905877f0b2324980", size = 105641, upload-time = "2025-05-02T08:33:18.753Z" },
+    { url = "https://files.pythonhosted.org/packages/20/94/c5790835a017658cbfabd07f3bfb549140c3ac458cfc196323996b10095a/charset_normalizer-3.4.2-py3-none-any.whl", hash = "sha256:7f56930ab0abd1c45cd15be65cc741c28b1c9a34876ce8c17a2fa107810c0af0", size = 52626, upload-time = "2025-05-02T08:34:40.053Z" },
+]
+
+[[package]]
+name = "clang-format"
+version = "20.1.8"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/62/e5/6560d6466378597f76292a6f54702dcf8a3746edfbd5fbdcb54b12e9ac46/clang_format-20.1.8.tar.gz", hash = "sha256:8ebd717257d8c7daf6bb1f703a4024f009a58941723eeb0d92ec493ce26aa520", size = 11500, upload-time = "2025-07-10T11:40:06.899Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/4f/cd/6dab2c15bb2f13ad13015fb92eda0b49b3bd866153072e4d9796f7b220e4/clang_format-20.1.8-py2.py3-none-macosx_10_9_x86_64.whl", hash = "sha256:e9422bc81b3bea6c0ee773662fbe3bfd8a9479ae70e59008095dfae7001c5a84", size = 1429486, upload-time = "2025-07-10T11:39:38.665Z" },
+    { url = "https://files.pythonhosted.org/packages/d8/4c/3efe4fe6910e1e00dcec0c8d9ef715164500f043e9911bdf253370ff917b/clang_format-20.1.8-py2.py3-none-macosx_11_0_arm64.whl", hash = "sha256:c0cf62720247a7dd1e2d610816a2f7d7016433f9c2869880cba655449bd09616", size = 1400840, upload-time = "2025-07-10T11:39:40.516Z" },
+    { url = "https://files.pythonhosted.org/packages/dc/c3/af601563d3bfa4c514406347c13dc639f984df7c9e13df3a0adf3a650fc9/clang_format-20.1.8-py2.py3-none-manylinux2014_i686.manylinux_2_17_i686.whl", hash = "sha256:4f998e5c19e10f69b87af6991ccb14db934b5fa36fd28c7dbfc17dee957007f4", size = 1777504, upload-time = "2025-07-10T11:39:42.266Z" },
+    { url = "https://files.pythonhosted.org/packages/06/60/7c2ff3019599ad985d0a61f74ba8226d538c72485b0e3d25b1899601a9f5/clang_format-20.1.8-py2.py3-none-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:34de32fe53452a07497793d5faf3fd03f7cf8b960b915417471ae81227461a39", size = 1692081, upload-time = "2025-07-10T11:39:43.67Z" },
+    { url = "https://files.pythonhosted.org/packages/99/74/956bc5455ce102767805b2eafcada0de003c391adb8299222432091af309/clang_format-20.1.8-py2.py3-none-manylinux_2_27_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:1397b1b700ee78af73b14c5d65ad777c570c79a175c220768056fbcb7afed113", size = 1987169, upload-time = "2025-07-10T11:39:45.465Z" },
+    { url = "https://files.pythonhosted.org/packages/70/3f/0c141c391a0d4bd4012758f68a27ddc1db8b48814f96eb459417e197124a/clang_format-20.1.8-py2.py3-none-manylinux_2_27_s390x.manylinux_2_28_s390x.whl", hash = "sha256:e195b5f6b79d89d42d4094d103f0a4f47ff3997d6474811622b95ab596f01fd2", size = 2005960, upload-time = "2025-07-10T11:39:47.163Z" },
+    { url = "https://files.pythonhosted.org/packages/a6/77/786aa0fc8a75d8ce94966bb33e44c63fec1964cbf343ee862ed6a5be38c1/clang_format-20.1.8-py2.py3-none-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:7c6bcb7e01ba4f05a4c980fda147b330f7e4833c2aea8c92a0c2df9573ae7afe", size = 1777063, upload-time = "2025-07-10T11:39:48.962Z" },
+    { url = "https://files.pythonhosted.org/packages/bc/0b/79cc55d7a64f3798a044c1f12c288048c6551af834700ac2ed1204c1181d/clang_format-20.1.8-py2.py3-none-manylinux_2_31_armv7l.whl", hash = "sha256:d99a5f3d7a252ab762ed79bc2a271a63fe593ae2e2565ce287835c00ce13c37e", size = 1626598, upload-time = "2025-07-10T11:39:50.468Z" },
+    { url = "https://files.pythonhosted.org/packages/cf/a2/913509f0e845b2beb0d298a9ec78c230a3a1f659c6928f990e84b842da4a/clang_format-20.1.8-py2.py3-none-musllinux_1_2_aarch64.whl", hash = "sha256:0a687c6efd7708227eafec37e98143e0b4b7dbeca82ff8e1de110d434f4e63ac", size = 2689936, upload-time = "2025-07-10T11:39:52.08Z" },
+    { url = "https://files.pythonhosted.org/packages/0e/29/7cb26c5884040d4cb2f1e3ece6d37ebaf318d7cd281339affc94d1a9803c/clang_format-20.1.8-py2.py3-none-musllinux_1_2_armv7l.whl", hash = "sha256:d6491195d8edc788de8abfaea30b78ff74ad3f5ee89653cd0a27a4af4feb1317", size = 2462082, upload-time = "2025-07-10T11:39:53.73Z" },
+    { url = "https://files.pythonhosted.org/packages/6a/55/11ba71667856abfc7872c33e71b15c551d2d0fc3ef86ef73f92a46b2749c/clang_format-20.1.8-py2.py3-none-musllinux_1_2_i686.whl", hash = "sha256:9ceae6a1fbd594ec2a31157997378b70df42273795a0177be0725a4e96336231", size = 2927834, upload-time = "2025-07-10T11:39:55.264Z" },
+    { url = "https://files.pythonhosted.org/packages/e6/71/496d2bafcb03b16a6fff25e73dcbe5aedcf68dd138580022b3114a3f7a84/clang_format-20.1.8-py2.py3-none-musllinux_1_2_ppc64le.whl", hash = "sha256:941396455b529ca130fae24d6d95bdf9a236d2ad22318991090d0b7ae53d236a", size = 3054954, upload-time = "2025-07-10T11:39:56.823Z" },
+    { url = "https://files.pythonhosted.org/packages/d5/b9/8e5595a8d301c9695802664e4e00548a4c88a9fb6e434aac43e4778f06e1/clang_format-20.1.8-py2.py3-none-musllinux_1_2_s390x.whl", hash = "sha256:8dbbdfce85bdde675dee98fdbcddee445e6a9492b2a2b04afabfd33525be5642", size = 3159351, upload-time = "2025-07-10T11:39:58.95Z" },
+    { url = "https://files.pythonhosted.org/packages/51/50/d385c1eb678061a18ab1de198e8400bb8c69003ec54fd4220f1c34ea6c46/clang_format-20.1.8-py2.py3-none-musllinux_1_2_x86_64.whl", hash = "sha256:abc1b72f42db5db695d539b0a1b3cc3c125dfaa9c5baea0a94a3a2d6d1e50c1f", size = 2809188, upload-time = "2025-07-10T11:40:00.797Z" },
+    { url = "https://files.pythonhosted.org/packages/a7/2d/e02502cd8c845f0b3e17c556648fd481aca0d77935adf8684cda5e4293e5/clang_format-20.1.8-py2.py3-none-win32.whl", hash = "sha256:635b57361fa3caeb9449aa62584d7cd38fbee81dbf3addd6b1d7c377eb34e766", size = 1261819, upload-time = "2025-07-10T11:40:02.194Z" },
+    { url = "https://files.pythonhosted.org/packages/bd/ee/656287efdf58dccc7a7299fab547fe1313b49ca1ea1607ea475b262d640f/clang_format-20.1.8-py2.py3-none-win_amd64.whl", hash = "sha256:346ac8cab571eaba4d6b89dfa30fdbbc512db82a66ab0eeb1763cacc5977e325", size = 1414174, upload-time = "2025-07-10T11:40:03.701Z" },
+    { url = "https://files.pythonhosted.org/packages/8b/27/71cd96599d47229bd819dcc0c688a859764bb1b4960a23b8a75f8558c044/clang_format-20.1.8-py2.py3-none-win_arm64.whl", hash = "sha256:d18b7b69697e97b6917a69f4bf48bf94e3827b016b491c90dd0f6ab917e37cf9", size = 1319592, upload-time = "2025-07-10T11:40:05.441Z" },
+]
+
+[[package]]
+name = "colorama"
+version = "0.4.6"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/d8/53/6f443c9a4a8358a93a6792e2acffb9d9d5cb0a5cfd8802644b7b1c9a02e4/colorama-0.4.6.tar.gz", hash = "sha256:08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44", size = 27697, upload-time = "2022-10-25T02:36:22.414Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/d1/d6/3965ed04c63042e047cb6a3e6ed1a63a35087b6a609aa3a15ed8ac56c221/colorama-0.4.6-py2.py3-none-any.whl", hash = "sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6", size = 25335, upload-time = "2022-10-25T02:36:20.889Z" },
+]
+
+[[package]]
+name = "croniter"
+version = "1.4.1"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "python-dateutil" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/96/56/f8500161d9ab57ea5ad29c203b85989f87af13a367b3178ade0cd34d8d3a/croniter-1.4.1.tar.gz", hash = "sha256:1a6df60eacec3b7a0aa52a8f2ef251ae3dd2a7c7c8b9874e73e791636d55a361", size = 42301, upload-time = "2023-06-15T18:03:35.834Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/f2/91/e5ae454da8200c6eb6cf94ca05d799b51e2cb2cc458a7737aebc0c5a21bb/croniter-1.4.1-py2.py3-none-any.whl", hash = "sha256:9595da48af37ea06ec3a9f899738f1b2c1c13da3c38cea606ef7cd03ea421128", size = 19579, upload-time = "2023-06-15T18:03:32.125Z" },
+]
+
+[[package]]
+name = "docutils"
+version = "0.21.2"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/ae/ed/aefcc8cd0ba62a0560c3c18c33925362d46c6075480bfa4df87b28e169a9/docutils-0.21.2.tar.gz", hash = "sha256:3a6b18732edf182daa3cd12775bbb338cf5691468f91eeeb109deff6ebfa986f", size = 2204444, upload-time = "2024-04-23T18:57:18.24Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/8f/d7/9322c609343d929e75e7e5e6255e614fcc67572cfd083959cdef3b7aad79/docutils-0.21.2-py3-none-any.whl", hash = "sha256:dafca5b9e384f0e419294eb4d2ff9fa826435bf15f15b7bd45723e8ad76811b2", size = 587408, upload-time = "2024-04-23T18:57:14.835Z" },
+]
+
+[[package]]
+name = "furo"
+version = "2025.7.19"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "accessible-pygments" },
+    { name = "beautifulsoup4" },
+    { name = "pygments" },
+    { name = "sphinx", version = "8.1.3", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version < '3.11'" },
+    { name = "sphinx", version = "8.2.3", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version >= '3.11'" },
+    { name = "sphinx-basic-ng" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/d0/69/312cd100fa45ddaea5a588334d2defa331ff427bcb61f5fe2ae61bdc3762/furo-2025.7.19.tar.gz", hash = "sha256:4164b2cafcf4023a59bb3c594e935e2516f6b9d35e9a5ea83d8f6b43808fe91f", size = 1662054, upload-time = "2025-07-19T10:52:09.754Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/3a/34/2b07b72bee02a63241d654f5d8af87a2de977c59638eec41ca356ab915cd/furo-2025.7.19-py3-none-any.whl", hash = "sha256:bdea869822dfd2b494ea84c0973937e35d1575af088b6721a29c7f7878adc9e3", size = 342175, upload-time = "2025-07-19T10:52:02.399Z" },
+]
+
+[[package]]
+name = "idna"
+version = "3.10"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/f1/70/7703c29685631f5a7590aa73f1f1d3fa9a380e654b86af429e0934a32f7d/idna-3.10.tar.gz", hash = "sha256:12f65c9b470abda6dc35cf8e63cc574b1c52b11df2c86030af0ac09b01b13ea9", size = 190490, upload-time = "2024-09-15T18:07:39.745Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/76/c6/c88e154df9c4e1a2a66ccf0005a88dfb2650c1dffb6f5ce603dfbd452ce3/idna-3.10-py3-none-any.whl", hash = "sha256:946d195a0d259cbba61165e88e65941f16e9b36ea6ddb97f00452bae8b1287d3", size = 70442, upload-time = "2024-09-15T18:07:37.964Z" },
+]
+
+[[package]]
+name = "imagesize"
+version = "1.4.1"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/a7/84/62473fb57d61e31fef6e36d64a179c8781605429fd927b5dd608c997be31/imagesize-1.4.1.tar.gz", hash = "sha256:69150444affb9cb0d5cc5a92b3676f0b2fb7cd9ae39e947a5e11a36b4497cd4a", size = 1280026, upload-time = "2022-07-01T12:21:05.687Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/ff/62/85c4c919272577931d407be5ba5d71c20f0b616d31a0befe0ae45bb79abd/imagesize-1.4.1-py2.py3-none-any.whl", hash = "sha256:0d8d18d08f840c19d0ee7ca1fd82490fdc3729b7ac93f49870406ddde8ef8d8b", size = 8769, upload-time = "2022-07-01T12:21:02.467Z" },
+]
+
+[[package]]
+name = "jinja2"
+version = "3.1.6"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "markupsafe" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/df/bf/f7da0350254c0ed7c72f3e33cef02e048281fec7ecec5f032d4aac52226b/jinja2-3.1.6.tar.gz", hash = "sha256:0137fb05990d35f1275a587e9aee6d56da821fc83491a0fb838183be43f66d6d", size = 245115, upload-time = "2025-03-05T20:05:02.478Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/62/a1/3d680cbfd5f4b8f15abc1d571870c5fc3e594bb582bc3b64ea099db13e56/jinja2-3.1.6-py3-none-any.whl", hash = "sha256:85ece4451f492d0c13c5dd7c13a64681a86afae63a5f347908daf103ce6d2f67", size = 134899, upload-time = "2025-03-05T20:05:00.369Z" },
+]
+
+[[package]]
+name = "markupsafe"
+version = "3.0.2"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/b2/97/5d42485e71dfc078108a86d6de8fa46db44a1a9295e89c5d6d4a06e23a62/markupsafe-3.0.2.tar.gz", hash = "sha256:ee55d3edf80167e48ea11a923c7386f4669df67d7994554387f84e7d8b0a2bf0", size = 20537, upload-time = "2024-10-18T15:21:54.129Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/04/90/d08277ce111dd22f77149fd1a5d4653eeb3b3eaacbdfcbae5afb2600eebd/MarkupSafe-3.0.2-cp310-cp310-macosx_10_9_universal2.whl", hash = "sha256:7e94c425039cde14257288fd61dcfb01963e658efbc0ff54f5306b06054700f8", size = 14357, upload-time = "2024-10-18T15:20:51.44Z" },
+    { url = "https://files.pythonhosted.org/packages/04/e1/6e2194baeae0bca1fae6629dc0cbbb968d4d941469cbab11a3872edff374/MarkupSafe-3.0.2-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:9e2d922824181480953426608b81967de705c3cef4d1af983af849d7bd619158", size = 12393, upload-time = "2024-10-18T15:20:52.426Z" },
+    { url = "https://files.pythonhosted.org/packages/1d/69/35fa85a8ece0a437493dc61ce0bb6d459dcba482c34197e3efc829aa357f/MarkupSafe-3.0.2-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:38a9ef736c01fccdd6600705b09dc574584b89bea478200c5fbf112a6b0d5579", size = 21732, upload-time = "2024-10-18T15:20:53.578Z" },
+    { url = "https://files.pythonhosted.org/packages/22/35/137da042dfb4720b638d2937c38a9c2df83fe32d20e8c8f3185dbfef05f7/MarkupSafe-3.0.2-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:bbcb445fa71794da8f178f0f6d66789a28d7319071af7a496d4d507ed566270d", size = 20866, upload-time = "2024-10-18T15:20:55.06Z" },
+    { url = "https://files.pythonhosted.org/packages/29/28/6d029a903727a1b62edb51863232152fd335d602def598dade38996887f0/MarkupSafe-3.0.2-cp310-cp310-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:57cb5a3cf367aeb1d316576250f65edec5bb3be939e9247ae594b4bcbc317dfb", size = 20964, upload-time = "2024-10-18T15:20:55.906Z" },
+    { url = "https://files.pythonhosted.org/packages/cc/cd/07438f95f83e8bc028279909d9c9bd39e24149b0d60053a97b2bc4f8aa51/MarkupSafe-3.0.2-cp310-cp310-musllinux_1_2_aarch64.whl", hash = "sha256:3809ede931876f5b2ec92eef964286840ed3540dadf803dd570c3b7e13141a3b", size = 21977, upload-time = "2024-10-18T15:20:57.189Z" },
+    { url = "https://files.pythonhosted.org/packages/29/01/84b57395b4cc062f9c4c55ce0df7d3108ca32397299d9df00fedd9117d3d/MarkupSafe-3.0.2-cp310-cp310-musllinux_1_2_i686.whl", hash = "sha256:e07c3764494e3776c602c1e78e298937c3315ccc9043ead7e685b7f2b8d47b3c", size = 21366, upload-time = "2024-10-18T15:20:58.235Z" },
+    { url = "https://files.pythonhosted.org/packages/bd/6e/61ebf08d8940553afff20d1fb1ba7294b6f8d279df9fd0c0db911b4bbcfd/MarkupSafe-3.0.2-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:b424c77b206d63d500bcb69fa55ed8d0e6a3774056bdc4839fc9298a7edca171", size = 21091, upload-time = "2024-10-18T15:20:59.235Z" },
+    { url = "https://files.pythonhosted.org/packages/11/23/ffbf53694e8c94ebd1e7e491de185124277964344733c45481f32ede2499/MarkupSafe-3.0.2-cp310-cp310-win32.whl", hash = "sha256:fcabf5ff6eea076f859677f5f0b6b5c1a51e70a376b0579e0eadef8db48c6b50", size = 15065, upload-time = "2024-10-18T15:21:00.307Z" },
+    { url = "https://files.pythonhosted.org/packages/44/06/e7175d06dd6e9172d4a69a72592cb3f7a996a9c396eee29082826449bbc3/MarkupSafe-3.0.2-cp310-cp310-win_amd64.whl", hash = "sha256:6af100e168aa82a50e186c82875a5893c5597a0c1ccdb0d8b40240b1f28b969a", size = 15514, upload-time = "2024-10-18T15:21:01.122Z" },
+    { url = "https://files.pythonhosted.org/packages/6b/28/bbf83e3f76936960b850435576dd5e67034e200469571be53f69174a2dfd/MarkupSafe-3.0.2-cp311-cp311-macosx_10_9_universal2.whl", hash = "sha256:9025b4018f3a1314059769c7bf15441064b2207cb3f065e6ea1e7359cb46db9d", size = 14353, upload-time = "2024-10-18T15:21:02.187Z" },
+    { url = "https://files.pythonhosted.org/packages/6c/30/316d194b093cde57d448a4c3209f22e3046c5bb2fb0820b118292b334be7/MarkupSafe-3.0.2-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:93335ca3812df2f366e80509ae119189886b0f3c2b81325d39efdb84a1e2ae93", size = 12392, upload-time = "2024-10-18T15:21:02.941Z" },
+    { url = "https://files.pythonhosted.org/packages/f2/96/9cdafba8445d3a53cae530aaf83c38ec64c4d5427d975c974084af5bc5d2/MarkupSafe-3.0.2-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:2cb8438c3cbb25e220c2ab33bb226559e7afb3baec11c4f218ffa7308603c832", size = 23984, upload-time = "2024-10-18T15:21:03.953Z" },
+    { url = "https://files.pythonhosted.org/packages/f1/a4/aefb044a2cd8d7334c8a47d3fb2c9f328ac48cb349468cc31c20b539305f/MarkupSafe-3.0.2-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:a123e330ef0853c6e822384873bef7507557d8e4a082961e1defa947aa59ba84", size = 23120, upload-time = "2024-10-18T15:21:06.495Z" },
+    { url = "https://files.pythonhosted.org/packages/8d/21/5e4851379f88f3fad1de30361db501300d4f07bcad047d3cb0449fc51f8c/MarkupSafe-3.0.2-cp311-cp311-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:1e084f686b92e5b83186b07e8a17fc09e38fff551f3602b249881fec658d3eca", size = 23032, upload-time = "2024-10-18T15:21:07.295Z" },
+    { url = "https://files.pythonhosted.org/packages/00/7b/e92c64e079b2d0d7ddf69899c98842f3f9a60a1ae72657c89ce2655c999d/MarkupSafe-3.0.2-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:d8213e09c917a951de9d09ecee036d5c7d36cb6cb7dbaece4c71a60d79fb9798", size = 24057, upload-time = "2024-10-18T15:21:08.073Z" },
+    { url = "https://files.pythonhosted.org/packages/f9/ac/46f960ca323037caa0a10662ef97d0a4728e890334fc156b9f9e52bcc4ca/MarkupSafe-3.0.2-cp311-cp311-musllinux_1_2_i686.whl", hash = "sha256:5b02fb34468b6aaa40dfc198d813a641e3a63b98c2b05a16b9f80b7ec314185e", size = 23359, upload-time = "2024-10-18T15:21:09.318Z" },
+    { url = "https://files.pythonhosted.org/packages/69/84/83439e16197337b8b14b6a5b9c2105fff81d42c2a7c5b58ac7b62ee2c3b1/MarkupSafe-3.0.2-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:0bff5e0ae4ef2e1ae4fdf2dfd5b76c75e5c2fa4132d05fc1b0dabcd20c7e28c4", size = 23306, upload-time = "2024-10-18T15:21:10.185Z" },
+    { url = "https://files.pythonhosted.org/packages/9a/34/a15aa69f01e2181ed8d2b685c0d2f6655d5cca2c4db0ddea775e631918cd/MarkupSafe-3.0.2-cp311-cp311-win32.whl", hash = "sha256:6c89876f41da747c8d3677a2b540fb32ef5715f97b66eeb0c6b66f5e3ef6f59d", size = 15094, upload-time = "2024-10-18T15:21:11.005Z" },
+    { url = "https://files.pythonhosted.org/packages/da/b8/3a3bd761922d416f3dc5d00bfbed11f66b1ab89a0c2b6e887240a30b0f6b/MarkupSafe-3.0.2-cp311-cp311-win_amd64.whl", hash = "sha256:70a87b411535ccad5ef2f1df5136506a10775d267e197e4cf531ced10537bd6b", size = 15521, upload-time = "2024-10-18T15:21:12.911Z" },
+    { url = "https://files.pythonhosted.org/packages/22/09/d1f21434c97fc42f09d290cbb6350d44eb12f09cc62c9476effdb33a18aa/MarkupSafe-3.0.2-cp312-cp312-macosx_10_13_universal2.whl", hash = "sha256:9778bd8ab0a994ebf6f84c2b949e65736d5575320a17ae8984a77fab08db94cf", size = 14274, upload-time = "2024-10-18T15:21:13.777Z" },
+    { url = "https://files.pythonhosted.org/packages/6b/b0/18f76bba336fa5aecf79d45dcd6c806c280ec44538b3c13671d49099fdd0/MarkupSafe-3.0.2-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:846ade7b71e3536c4e56b386c2a47adf5741d2d8b94ec9dc3e92e5e1ee1e2225", size = 12348, upload-time = "2024-10-18T15:21:14.822Z" },
+    { url = "https://files.pythonhosted.org/packages/e0/25/dd5c0f6ac1311e9b40f4af06c78efde0f3b5cbf02502f8ef9501294c425b/MarkupSafe-3.0.2-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:1c99d261bd2d5f6b59325c92c73df481e05e57f19837bdca8413b9eac4bd8028", size = 24149, upload-time = "2024-10-18T15:21:15.642Z" },
+    { url = "https://files.pythonhosted.org/packages/f3/f0/89e7aadfb3749d0f52234a0c8c7867877876e0a20b60e2188e9850794c17/MarkupSafe-3.0.2-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:e17c96c14e19278594aa4841ec148115f9c7615a47382ecb6b82bd8fea3ab0c8", size = 23118, upload-time = "2024-10-18T15:21:17.133Z" },
+    { url = "https://files.pythonhosted.org/packages/d5/da/f2eeb64c723f5e3777bc081da884b414671982008c47dcc1873d81f625b6/MarkupSafe-3.0.2-cp312-cp312-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:88416bd1e65dcea10bc7569faacb2c20ce071dd1f87539ca2ab364bf6231393c", size = 22993, upload-time = "2024-10-18T15:21:18.064Z" },
+    { url = "https://files.pythonhosted.org/packages/da/0e/1f32af846df486dce7c227fe0f2398dc7e2e51d4a370508281f3c1c5cddc/MarkupSafe-3.0.2-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:2181e67807fc2fa785d0592dc2d6206c019b9502410671cc905d132a92866557", size = 24178, upload-time = "2024-10-18T15:21:18.859Z" },
+    { url = "https://files.pythonhosted.org/packages/c4/f6/bb3ca0532de8086cbff5f06d137064c8410d10779c4c127e0e47d17c0b71/MarkupSafe-3.0.2-cp312-cp312-musllinux_1_2_i686.whl", hash = "sha256:52305740fe773d09cffb16f8ed0427942901f00adedac82ec8b67752f58a1b22", size = 23319, upload-time = "2024-10-18T15:21:19.671Z" },
+    { url = "https://files.pythonhosted.org/packages/a2/82/8be4c96ffee03c5b4a034e60a31294daf481e12c7c43ab8e34a1453ee48b/MarkupSafe-3.0.2-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:ad10d3ded218f1039f11a75f8091880239651b52e9bb592ca27de44eed242a48", size = 23352, upload-time = "2024-10-18T15:21:20.971Z" },
+    { url = "https://files.pythonhosted.org/packages/51/ae/97827349d3fcffee7e184bdf7f41cd6b88d9919c80f0263ba7acd1bbcb18/MarkupSafe-3.0.2-cp312-cp312-win32.whl", hash = "sha256:0f4ca02bea9a23221c0182836703cbf8930c5e9454bacce27e767509fa286a30", size = 15097, upload-time = "2024-10-18T15:21:22.646Z" },
+    { url = "https://files.pythonhosted.org/packages/c1/80/a61f99dc3a936413c3ee4e1eecac96c0da5ed07ad56fd975f1a9da5bc630/MarkupSafe-3.0.2-cp312-cp312-win_amd64.whl", hash = "sha256:8e06879fc22a25ca47312fbe7c8264eb0b662f6db27cb2d3bbbc74b1df4b9b87", size = 15601, upload-time = "2024-10-18T15:21:23.499Z" },
+    { url = "https://files.pythonhosted.org/packages/83/0e/67eb10a7ecc77a0c2bbe2b0235765b98d164d81600746914bebada795e97/MarkupSafe-3.0.2-cp313-cp313-macosx_10_13_universal2.whl", hash = "sha256:ba9527cdd4c926ed0760bc301f6728ef34d841f405abf9d4f959c478421e4efd", size = 14274, upload-time = "2024-10-18T15:21:24.577Z" },
+    { url = "https://files.pythonhosted.org/packages/2b/6d/9409f3684d3335375d04e5f05744dfe7e9f120062c9857df4ab490a1031a/MarkupSafe-3.0.2-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:f8b3d067f2e40fe93e1ccdd6b2e1d16c43140e76f02fb1319a05cf2b79d99430", size = 12352, upload-time = "2024-10-18T15:21:25.382Z" },
+    { url = "https://files.pythonhosted.org/packages/d2/f5/6eadfcd3885ea85fe2a7c128315cc1bb7241e1987443d78c8fe712d03091/MarkupSafe-3.0.2-cp313-cp313-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:569511d3b58c8791ab4c2e1285575265991e6d8f8700c7be0e88f86cb0672094", size = 24122, upload-time = "2024-10-18T15:21:26.199Z" },
+    { url = "https://files.pythonhosted.org/packages/0c/91/96cf928db8236f1bfab6ce15ad070dfdd02ed88261c2afafd4b43575e9e9/MarkupSafe-3.0.2-cp313-cp313-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:15ab75ef81add55874e7ab7055e9c397312385bd9ced94920f2802310c930396", size = 23085, upload-time = "2024-10-18T15:21:27.029Z" },
+    { url = "https://files.pythonhosted.org/packages/c2/cf/c9d56af24d56ea04daae7ac0940232d31d5a8354f2b457c6d856b2057d69/MarkupSafe-3.0.2-cp313-cp313-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:f3818cb119498c0678015754eba762e0d61e5b52d34c8b13d770f0719f7b1d79", size = 22978, upload-time = "2024-10-18T15:21:27.846Z" },
+    { url = "https://files.pythonhosted.org/packages/2a/9f/8619835cd6a711d6272d62abb78c033bda638fdc54c4e7f4272cf1c0962b/MarkupSafe-3.0.2-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:cdb82a876c47801bb54a690c5ae105a46b392ac6099881cdfb9f6e95e4014c6a", size = 24208, upload-time = "2024-10-18T15:21:28.744Z" },
+    { url = "https://files.pythonhosted.org/packages/f9/bf/176950a1792b2cd2102b8ffeb5133e1ed984547b75db47c25a67d3359f77/MarkupSafe-3.0.2-cp313-cp313-musllinux_1_2_i686.whl", hash = "sha256:cabc348d87e913db6ab4aa100f01b08f481097838bdddf7c7a84b7575b7309ca", size = 23357, upload-time = "2024-10-18T15:21:29.545Z" },
+    { url = "https://files.pythonhosted.org/packages/ce/4f/9a02c1d335caabe5c4efb90e1b6e8ee944aa245c1aaaab8e8a618987d816/MarkupSafe-3.0.2-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:444dcda765c8a838eaae23112db52f1efaf750daddb2d9ca300bcae1039adc5c", size = 23344, upload-time = "2024-10-18T15:21:30.366Z" },
+    { url = "https://files.pythonhosted.org/packages/ee/55/c271b57db36f748f0e04a759ace9f8f759ccf22b4960c270c78a394f58be/MarkupSafe-3.0.2-cp313-cp313-win32.whl", hash = "sha256:bcf3e58998965654fdaff38e58584d8937aa3096ab5354d493c77d1fdd66d7a1", size = 15101, upload-time = "2024-10-18T15:21:31.207Z" },
+    { url = "https://files.pythonhosted.org/packages/29/88/07df22d2dd4df40aba9f3e402e6dc1b8ee86297dddbad4872bd5e7b0094f/MarkupSafe-3.0.2-cp313-cp313-win_amd64.whl", hash = "sha256:e6a2a455bd412959b57a172ce6328d2dd1f01cb2135efda2e4576e8a23fa3b0f", size = 15603, upload-time = "2024-10-18T15:21:32.032Z" },
+    { url = "https://files.pythonhosted.org/packages/62/6a/8b89d24db2d32d433dffcd6a8779159da109842434f1dd2f6e71f32f738c/MarkupSafe-3.0.2-cp313-cp313t-macosx_10_13_universal2.whl", hash = "sha256:b5a6b3ada725cea8a5e634536b1b01c30bcdcd7f9c6fff4151548d5bf6b3a36c", size = 14510, upload-time = "2024-10-18T15:21:33.625Z" },
+    { url = "https://files.pythonhosted.org/packages/7a/06/a10f955f70a2e5a9bf78d11a161029d278eeacbd35ef806c3fd17b13060d/MarkupSafe-3.0.2-cp313-cp313t-macosx_11_0_arm64.whl", hash = "sha256:a904af0a6162c73e3edcb969eeeb53a63ceeb5d8cf642fade7d39e7963a22ddb", size = 12486, upload-time = "2024-10-18T15:21:34.611Z" },
+    { url = "https://files.pythonhosted.org/packages/34/cf/65d4a571869a1a9078198ca28f39fba5fbb910f952f9dbc5220afff9f5e6/MarkupSafe-3.0.2-cp313-cp313t-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:4aa4e5faecf353ed117801a068ebab7b7e09ffb6e1d5e412dc852e0da018126c", size = 25480, upload-time = "2024-10-18T15:21:35.398Z" },
+    { url = "https://files.pythonhosted.org/packages/0c/e3/90e9651924c430b885468b56b3d597cabf6d72be4b24a0acd1fa0e12af67/MarkupSafe-3.0.2-cp313-cp313t-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:c0ef13eaeee5b615fb07c9a7dadb38eac06a0608b41570d8ade51c56539e509d", size = 23914, upload-time = "2024-10-18T15:21:36.231Z" },
+    { url = "https://files.pythonhosted.org/packages/66/8c/6c7cf61f95d63bb866db39085150df1f2a5bd3335298f14a66b48e92659c/MarkupSafe-3.0.2-cp313-cp313t-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:d16a81a06776313e817c951135cf7340a3e91e8c1ff2fac444cfd75fffa04afe", size = 23796, upload-time = "2024-10-18T15:21:37.073Z" },
+    { url = "https://files.pythonhosted.org/packages/bb/35/cbe9238ec3f47ac9a7c8b3df7a808e7cb50fe149dc7039f5f454b3fba218/MarkupSafe-3.0.2-cp313-cp313t-musllinux_1_2_aarch64.whl", hash = "sha256:6381026f158fdb7c72a168278597a5e3a5222e83ea18f543112b2662a9b699c5", size = 25473, upload-time = "2024-10-18T15:21:37.932Z" },
+    { url = "https://files.pythonhosted.org/packages/e6/32/7621a4382488aa283cc05e8984a9c219abad3bca087be9ec77e89939ded9/MarkupSafe-3.0.2-cp313-cp313t-musllinux_1_2_i686.whl", hash = "sha256:3d79d162e7be8f996986c064d1c7c817f6df3a77fe3d6859f6f9e7be4b8c213a", size = 24114, upload-time = "2024-10-18T15:21:39.799Z" },
+    { url = "https://files.pythonhosted.org/packages/0d/80/0985960e4b89922cb5a0bac0ed39c5b96cbc1a536a99f30e8c220a996ed9/MarkupSafe-3.0.2-cp313-cp313t-musllinux_1_2_x86_64.whl", hash = "sha256:131a3c7689c85f5ad20f9f6fb1b866f402c445b220c19fe4308c0b147ccd2ad9", size = 24098, upload-time = "2024-10-18T15:21:40.813Z" },
+    { url = "https://files.pythonhosted.org/packages/82/78/fedb03c7d5380df2427038ec8d973587e90561b2d90cd472ce9254cf348b/MarkupSafe-3.0.2-cp313-cp313t-win32.whl", hash = "sha256:ba8062ed2cf21c07a9e295d5b8a2a5ce678b913b45fdf68c32d95d6c1291e0b6", size = 15208, upload-time = "2024-10-18T15:21:41.814Z" },
+    { url = "https://files.pythonhosted.org/packages/4f/65/6079a46068dfceaeabb5dcad6d674f5f5c61a6fa5673746f42a9f4c233b3/MarkupSafe-3.0.2-cp313-cp313t-win_amd64.whl", hash = "sha256:e444a31f8db13eb18ada366ab3cf45fd4b31e4db1236a4448f68778c1d1a5a2f", size = 15739, upload-time = "2024-10-18T15:21:42.784Z" },
+]
+
+[[package]]
+name = "mongo-c-driver"
+version = "0.1.0"
+source = { editable = "." }
+
+[package.dev-dependencies]
+dev = [
+    { name = "clang-format" },
+    { name = "furo" },
+    { name = "packaging" },
+    { name = "pydantic" },
+    { name = "shrub-py" },
+    { name = "sphinx", version = "8.1.3", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version < '3.11'" },
+    { name = "sphinx", version = "8.2.3", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version >= '3.11'" },
+    { name = "sphinx-design" },
+    { name = "yamlloader" },
+]
+docs = [
+    { name = "furo" },
+    { name = "sphinx", version = "8.1.3", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version < '3.11'" },
+    { name = "sphinx", version = "8.2.3", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version >= '3.11'" },
+    { name = "sphinx-design" },
+]
+evg = [
+    { name = "packaging" },
+    { name = "pydantic" },
+    { name = "shrub-py" },
+    { name = "yamlloader" },
+]
+format = [
+    { name = "clang-format" },
+]
+
+[package.metadata]
+
+[package.metadata.requires-dev]
+dev = [
+    { name = "clang-format", specifier = "~=20.1.0" },
+    { name = "furo", specifier = ">=2023.5.20" },
+    { name = "packaging", specifier = ">=14.0" },
+    { name = "pydantic", specifier = ">=2.8" },
+    { name = "shrub-py", specifier = ">=3.7" },
+    { name = "sphinx", specifier = ">=7.1.1,<9.0" },
+    { name = "sphinx-design", specifier = ">=0.5.0" },
+    { name = "yamlloader", specifier = ">=1.5" },
+]
+docs = [
+    { name = "furo", specifier = ">=2023.5.20" },
+    { name = "sphinx", specifier = ">=7.1.1,<9.0" },
+    { name = "sphinx-design", specifier = ">=0.5.0" },
+]
+evg = [
+    { name = "packaging", specifier = ">=14.0" },
+    { name = "pydantic", specifier = ">=2.8" },
+    { name = "shrub-py", specifier = ">=3.7" },
+    { name = "yamlloader", specifier = ">=1.5" },
+]
+format = [{ name = "clang-format", specifier = "~=20.1.0" }]
+
+[[package]]
+name = "packaging"
+version = "25.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/a1/d4/1fc4078c65507b51b96ca8f8c3ba19e6a61c8253c72794544580a7b6c24d/packaging-25.0.tar.gz", hash = "sha256:d443872c98d677bf60f6a1f2f8c1cb748e8fe762d2bf9d3148b5599295b0fc4f", size = 165727, upload-time = "2025-04-19T11:48:59.673Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/20/12/38679034af332785aac8774540895e234f4d07f7545804097de4b666afd8/packaging-25.0-py3-none-any.whl", hash = "sha256:29572ef2b1f17581046b3a2227d5c611fb25ec70ca1ba8554b24b0e69331a484", size = 66469, upload-time = "2025-04-19T11:48:57.875Z" },
+]
+
+[[package]]
+name = "pydantic"
+version = "2.11.7"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "annotated-types" },
+    { name = "pydantic-core" },
+    { name = "typing-extensions" },
+    { name = "typing-inspection" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/00/dd/4325abf92c39ba8623b5af936ddb36ffcfe0beae70405d456ab1fb2f5b8c/pydantic-2.11.7.tar.gz", hash = "sha256:d989c3c6cb79469287b1569f7447a17848c998458d49ebe294e975b9baf0f0db", size = 788350, upload-time = "2025-06-14T08:33:17.137Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/6a/c0/ec2b1c8712ca690e5d61979dee872603e92b8a32f94cc1b72d53beab008a/pydantic-2.11.7-py3-none-any.whl", hash = "sha256:dde5df002701f6de26248661f6835bbe296a47bf73990135c7d07ce741b9623b", size = 444782, upload-time = "2025-06-14T08:33:14.905Z" },
+]
+
+[[package]]
+name = "pydantic-core"
+version = "2.33.2"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "typing-extensions" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/ad/88/5f2260bdfae97aabf98f1778d43f69574390ad787afb646292a638c923d4/pydantic_core-2.33.2.tar.gz", hash = "sha256:7cb8bc3605c29176e1b105350d2e6474142d7c1bd1d9327c4a9bdb46bf827acc", size = 435195, upload-time = "2025-04-23T18:33:52.104Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/e5/92/b31726561b5dae176c2d2c2dc43a9c5bfba5d32f96f8b4c0a600dd492447/pydantic_core-2.33.2-cp310-cp310-macosx_10_12_x86_64.whl", hash = "sha256:2b3d326aaef0c0399d9afffeb6367d5e26ddc24d351dbc9c636840ac355dc5d8", size = 2028817, upload-time = "2025-04-23T18:30:43.919Z" },
+    { url = "https://files.pythonhosted.org/packages/a3/44/3f0b95fafdaca04a483c4e685fe437c6891001bf3ce8b2fded82b9ea3aa1/pydantic_core-2.33.2-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:0e5b2671f05ba48b94cb90ce55d8bdcaaedb8ba00cc5359f6810fc918713983d", size = 1861357, upload-time = "2025-04-23T18:30:46.372Z" },
+    { url = "https://files.pythonhosted.org/packages/30/97/e8f13b55766234caae05372826e8e4b3b96e7b248be3157f53237682e43c/pydantic_core-2.33.2-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:0069c9acc3f3981b9ff4cdfaf088e98d83440a4c7ea1bc07460af3d4dc22e72d", size = 1898011, upload-time = "2025-04-23T18:30:47.591Z" },
+    { url = "https://files.pythonhosted.org/packages/9b/a3/99c48cf7bafc991cc3ee66fd544c0aae8dc907b752f1dad2d79b1b5a471f/pydantic_core-2.33.2-cp310-cp310-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:d53b22f2032c42eaaf025f7c40c2e3b94568ae077a606f006d206a463bc69572", size = 1982730, upload-time = "2025-04-23T18:30:49.328Z" },
+    { url = "https://files.pythonhosted.org/packages/de/8e/a5b882ec4307010a840fb8b58bd9bf65d1840c92eae7534c7441709bf54b/pydantic_core-2.33.2-cp310-cp310-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:0405262705a123b7ce9f0b92f123334d67b70fd1f20a9372b907ce1080c7ba02", size = 2136178, upload-time = "2025-04-23T18:30:50.907Z" },
+    { url = "https://files.pythonhosted.org/packages/e4/bb/71e35fc3ed05af6834e890edb75968e2802fe98778971ab5cba20a162315/pydantic_core-2.33.2-cp310-cp310-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:4b25d91e288e2c4e0662b8038a28c6a07eaac3e196cfc4ff69de4ea3db992a1b", size = 2736462, upload-time = "2025-04-23T18:30:52.083Z" },
+    { url = "https://files.pythonhosted.org/packages/31/0d/c8f7593e6bc7066289bbc366f2235701dcbebcd1ff0ef8e64f6f239fb47d/pydantic_core-2.33.2-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:6bdfe4b3789761f3bcb4b1ddf33355a71079858958e3a552f16d5af19768fef2", size = 2005652, upload-time = "2025-04-23T18:30:53.389Z" },
+    { url = "https://files.pythonhosted.org/packages/d2/7a/996d8bd75f3eda405e3dd219ff5ff0a283cd8e34add39d8ef9157e722867/pydantic_core-2.33.2-cp310-cp310-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:efec8db3266b76ef9607c2c4c419bdb06bf335ae433b80816089ea7585816f6a", size = 2113306, upload-time = "2025-04-23T18:30:54.661Z" },
+    { url = "https://files.pythonhosted.org/packages/ff/84/daf2a6fb2db40ffda6578a7e8c5a6e9c8affb251a05c233ae37098118788/pydantic_core-2.33.2-cp310-cp310-musllinux_1_1_aarch64.whl", hash = "sha256:031c57d67ca86902726e0fae2214ce6770bbe2f710dc33063187a68744a5ecac", size = 2073720, upload-time = "2025-04-23T18:30:56.11Z" },
+    { url = "https://files.pythonhosted.org/packages/77/fb/2258da019f4825128445ae79456a5499c032b55849dbd5bed78c95ccf163/pydantic_core-2.33.2-cp310-cp310-musllinux_1_1_armv7l.whl", hash = "sha256:f8de619080e944347f5f20de29a975c2d815d9ddd8be9b9b7268e2e3ef68605a", size = 2244915, upload-time = "2025-04-23T18:30:57.501Z" },
+    { url = "https://files.pythonhosted.org/packages/d8/7a/925ff73756031289468326e355b6fa8316960d0d65f8b5d6b3a3e7866de7/pydantic_core-2.33.2-cp310-cp310-musllinux_1_1_x86_64.whl", hash = "sha256:73662edf539e72a9440129f231ed3757faab89630d291b784ca99237fb94db2b", size = 2241884, upload-time = "2025-04-23T18:30:58.867Z" },
+    { url = "https://files.pythonhosted.org/packages/0b/b0/249ee6d2646f1cdadcb813805fe76265745c4010cf20a8eba7b0e639d9b2/pydantic_core-2.33.2-cp310-cp310-win32.whl", hash = "sha256:0a39979dcbb70998b0e505fb1556a1d550a0781463ce84ebf915ba293ccb7e22", size = 1910496, upload-time = "2025-04-23T18:31:00.078Z" },
+    { url = "https://files.pythonhosted.org/packages/66/ff/172ba8f12a42d4b552917aa65d1f2328990d3ccfc01d5b7c943ec084299f/pydantic_core-2.33.2-cp310-cp310-win_amd64.whl", hash = "sha256:b0379a2b24882fef529ec3b4987cb5d003b9cda32256024e6fe1586ac45fc640", size = 1955019, upload-time = "2025-04-23T18:31:01.335Z" },
+    { url = "https://files.pythonhosted.org/packages/3f/8d/71db63483d518cbbf290261a1fc2839d17ff89fce7089e08cad07ccfce67/pydantic_core-2.33.2-cp311-cp311-macosx_10_12_x86_64.whl", hash = "sha256:4c5b0a576fb381edd6d27f0a85915c6daf2f8138dc5c267a57c08a62900758c7", size = 2028584, upload-time = "2025-04-23T18:31:03.106Z" },
+    { url = "https://files.pythonhosted.org/packages/24/2f/3cfa7244ae292dd850989f328722d2aef313f74ffc471184dc509e1e4e5a/pydantic_core-2.33.2-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:e799c050df38a639db758c617ec771fd8fb7a5f8eaaa4b27b101f266b216a246", size = 1855071, upload-time = "2025-04-23T18:31:04.621Z" },
+    { url = "https://files.pythonhosted.org/packages/b3/d3/4ae42d33f5e3f50dd467761304be2fa0a9417fbf09735bc2cce003480f2a/pydantic_core-2.33.2-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:dc46a01bf8d62f227d5ecee74178ffc448ff4e5197c756331f71efcc66dc980f", size = 1897823, upload-time = "2025-04-23T18:31:06.377Z" },
+    { url = "https://files.pythonhosted.org/packages/f4/f3/aa5976e8352b7695ff808599794b1fba2a9ae2ee954a3426855935799488/pydantic_core-2.33.2-cp311-cp311-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:a144d4f717285c6d9234a66778059f33a89096dfb9b39117663fd8413d582dcc", size = 1983792, upload-time = "2025-04-23T18:31:07.93Z" },
+    { url = "https://files.pythonhosted.org/packages/d5/7a/cda9b5a23c552037717f2b2a5257e9b2bfe45e687386df9591eff7b46d28/pydantic_core-2.33.2-cp311-cp311-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:73cf6373c21bc80b2e0dc88444f41ae60b2f070ed02095754eb5a01df12256de", size = 2136338, upload-time = "2025-04-23T18:31:09.283Z" },
+    { url = "https://files.pythonhosted.org/packages/2b/9f/b8f9ec8dd1417eb9da784e91e1667d58a2a4a7b7b34cf4af765ef663a7e5/pydantic_core-2.33.2-cp311-cp311-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:3dc625f4aa79713512d1976fe9f0bc99f706a9dee21dfd1810b4bbbf228d0e8a", size = 2730998, upload-time = "2025-04-23T18:31:11.7Z" },
+    { url = "https://files.pythonhosted.org/packages/47/bc/cd720e078576bdb8255d5032c5d63ee5c0bf4b7173dd955185a1d658c456/pydantic_core-2.33.2-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:881b21b5549499972441da4758d662aeea93f1923f953e9cbaff14b8b9565aef", size = 2003200, upload-time = "2025-04-23T18:31:13.536Z" },
+    { url = "https://files.pythonhosted.org/packages/ca/22/3602b895ee2cd29d11a2b349372446ae9727c32e78a94b3d588a40fdf187/pydantic_core-2.33.2-cp311-cp311-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:bdc25f3681f7b78572699569514036afe3c243bc3059d3942624e936ec93450e", size = 2113890, upload-time = "2025-04-23T18:31:15.011Z" },
+    { url = "https://files.pythonhosted.org/packages/ff/e6/e3c5908c03cf00d629eb38393a98fccc38ee0ce8ecce32f69fc7d7b558a7/pydantic_core-2.33.2-cp311-cp311-musllinux_1_1_aarch64.whl", hash = "sha256:fe5b32187cbc0c862ee201ad66c30cf218e5ed468ec8dc1cf49dec66e160cc4d", size = 2073359, upload-time = "2025-04-23T18:31:16.393Z" },
+    { url = "https://files.pythonhosted.org/packages/12/e7/6a36a07c59ebefc8777d1ffdaf5ae71b06b21952582e4b07eba88a421c79/pydantic_core-2.33.2-cp311-cp311-musllinux_1_1_armv7l.whl", hash = "sha256:bc7aee6f634a6f4a95676fcb5d6559a2c2a390330098dba5e5a5f28a2e4ada30", size = 2245883, upload-time = "2025-04-23T18:31:17.892Z" },
+    { url = "https://files.pythonhosted.org/packages/16/3f/59b3187aaa6cc0c1e6616e8045b284de2b6a87b027cce2ffcea073adf1d2/pydantic_core-2.33.2-cp311-cp311-musllinux_1_1_x86_64.whl", hash = "sha256:235f45e5dbcccf6bd99f9f472858849f73d11120d76ea8707115415f8e5ebebf", size = 2241074, upload-time = "2025-04-23T18:31:19.205Z" },
+    { url = "https://files.pythonhosted.org/packages/e0/ed/55532bb88f674d5d8f67ab121a2a13c385df382de2a1677f30ad385f7438/pydantic_core-2.33.2-cp311-cp311-win32.whl", hash = "sha256:6368900c2d3ef09b69cb0b913f9f8263b03786e5b2a387706c5afb66800efd51", size = 1910538, upload-time = "2025-04-23T18:31:20.541Z" },
+    { url = "https://files.pythonhosted.org/packages/fe/1b/25b7cccd4519c0b23c2dd636ad39d381abf113085ce4f7bec2b0dc755eb1/pydantic_core-2.33.2-cp311-cp311-win_amd64.whl", hash = "sha256:1e063337ef9e9820c77acc768546325ebe04ee38b08703244c1309cccc4f1bab", size = 1952909, upload-time = "2025-04-23T18:31:22.371Z" },
+    { url = "https://files.pythonhosted.org/packages/49/a9/d809358e49126438055884c4366a1f6227f0f84f635a9014e2deb9b9de54/pydantic_core-2.33.2-cp311-cp311-win_arm64.whl", hash = "sha256:6b99022f1d19bc32a4c2a0d544fc9a76e3be90f0b3f4af413f87d38749300e65", size = 1897786, upload-time = "2025-04-23T18:31:24.161Z" },
+    { url = "https://files.pythonhosted.org/packages/18/8a/2b41c97f554ec8c71f2a8a5f85cb56a8b0956addfe8b0efb5b3d77e8bdc3/pydantic_core-2.33.2-cp312-cp312-macosx_10_12_x86_64.whl", hash = "sha256:a7ec89dc587667f22b6a0b6579c249fca9026ce7c333fc142ba42411fa243cdc", size = 2009000, upload-time = "2025-04-23T18:31:25.863Z" },
+    { url = "https://files.pythonhosted.org/packages/a1/02/6224312aacb3c8ecbaa959897af57181fb6cf3a3d7917fd44d0f2917e6f2/pydantic_core-2.33.2-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:3c6db6e52c6d70aa0d00d45cdb9b40f0433b96380071ea80b09277dba021ddf7", size = 1847996, upload-time = "2025-04-23T18:31:27.341Z" },
+    { url = "https://files.pythonhosted.org/packages/d6/46/6dcdf084a523dbe0a0be59d054734b86a981726f221f4562aed313dbcb49/pydantic_core-2.33.2-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:4e61206137cbc65e6d5256e1166f88331d3b6238e082d9f74613b9b765fb9025", size = 1880957, upload-time = "2025-04-23T18:31:28.956Z" },
+    { url = "https://files.pythonhosted.org/packages/ec/6b/1ec2c03837ac00886ba8160ce041ce4e325b41d06a034adbef11339ae422/pydantic_core-2.33.2-cp312-cp312-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:eb8c529b2819c37140eb51b914153063d27ed88e3bdc31b71198a198e921e011", size = 1964199, upload-time = "2025-04-23T18:31:31.025Z" },
+    { url = "https://files.pythonhosted.org/packages/2d/1d/6bf34d6adb9debd9136bd197ca72642203ce9aaaa85cfcbfcf20f9696e83/pydantic_core-2.33.2-cp312-cp312-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:c52b02ad8b4e2cf14ca7b3d918f3eb0ee91e63b3167c32591e57c4317e134f8f", size = 2120296, upload-time = "2025-04-23T18:31:32.514Z" },
+    { url = "https://files.pythonhosted.org/packages/e0/94/2bd0aaf5a591e974b32a9f7123f16637776c304471a0ab33cf263cf5591a/pydantic_core-2.33.2-cp312-cp312-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:96081f1605125ba0855dfda83f6f3df5ec90c61195421ba72223de35ccfb2f88", size = 2676109, upload-time = "2025-04-23T18:31:33.958Z" },
+    { url = "https://files.pythonhosted.org/packages/f9/41/4b043778cf9c4285d59742281a769eac371b9e47e35f98ad321349cc5d61/pydantic_core-2.33.2-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:8f57a69461af2a5fa6e6bbd7a5f60d3b7e6cebb687f55106933188e79ad155c1", size = 2002028, upload-time = "2025-04-23T18:31:39.095Z" },
+    { url = "https://files.pythonhosted.org/packages/cb/d5/7bb781bf2748ce3d03af04d5c969fa1308880e1dca35a9bd94e1a96a922e/pydantic_core-2.33.2-cp312-cp312-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:572c7e6c8bb4774d2ac88929e3d1f12bc45714ae5ee6d9a788a9fb35e60bb04b", size = 2100044, upload-time = "2025-04-23T18:31:41.034Z" },
+    { url = "https://files.pythonhosted.org/packages/fe/36/def5e53e1eb0ad896785702a5bbfd25eed546cdcf4087ad285021a90ed53/pydantic_core-2.33.2-cp312-cp312-musllinux_1_1_aarch64.whl", hash = "sha256:db4b41f9bd95fbe5acd76d89920336ba96f03e149097365afe1cb092fceb89a1", size = 2058881, upload-time = "2025-04-23T18:31:42.757Z" },
+    { url = "https://files.pythonhosted.org/packages/01/6c/57f8d70b2ee57fc3dc8b9610315949837fa8c11d86927b9bb044f8705419/pydantic_core-2.33.2-cp312-cp312-musllinux_1_1_armv7l.whl", hash = "sha256:fa854f5cf7e33842a892e5c73f45327760bc7bc516339fda888c75ae60edaeb6", size = 2227034, upload-time = "2025-04-23T18:31:44.304Z" },
+    { url = "https://files.pythonhosted.org/packages/27/b9/9c17f0396a82b3d5cbea4c24d742083422639e7bb1d5bf600e12cb176a13/pydantic_core-2.33.2-cp312-cp312-musllinux_1_1_x86_64.whl", hash = "sha256:5f483cfb75ff703095c59e365360cb73e00185e01aaea067cd19acffd2ab20ea", size = 2234187, upload-time = "2025-04-23T18:31:45.891Z" },
+    { url = "https://files.pythonhosted.org/packages/b0/6a/adf5734ffd52bf86d865093ad70b2ce543415e0e356f6cacabbc0d9ad910/pydantic_core-2.33.2-cp312-cp312-win32.whl", hash = "sha256:9cb1da0f5a471435a7bc7e439b8a728e8b61e59784b2af70d7c169f8dd8ae290", size = 1892628, upload-time = "2025-04-23T18:31:47.819Z" },
+    { url = "https://files.pythonhosted.org/packages/43/e4/5479fecb3606c1368d496a825d8411e126133c41224c1e7238be58b87d7e/pydantic_core-2.33.2-cp312-cp312-win_amd64.whl", hash = "sha256:f941635f2a3d96b2973e867144fde513665c87f13fe0e193c158ac51bfaaa7b2", size = 1955866, upload-time = "2025-04-23T18:31:49.635Z" },
+    { url = "https://files.pythonhosted.org/packages/0d/24/8b11e8b3e2be9dd82df4b11408a67c61bb4dc4f8e11b5b0fc888b38118b5/pydantic_core-2.33.2-cp312-cp312-win_arm64.whl", hash = "sha256:cca3868ddfaccfbc4bfb1d608e2ccaaebe0ae628e1416aeb9c4d88c001bb45ab", size = 1888894, upload-time = "2025-04-23T18:31:51.609Z" },
+    { url = "https://files.pythonhosted.org/packages/46/8c/99040727b41f56616573a28771b1bfa08a3d3fe74d3d513f01251f79f172/pydantic_core-2.33.2-cp313-cp313-macosx_10_12_x86_64.whl", hash = "sha256:1082dd3e2d7109ad8b7da48e1d4710c8d06c253cbc4a27c1cff4fbcaa97a9e3f", size = 2015688, upload-time = "2025-04-23T18:31:53.175Z" },
+    { url = "https://files.pythonhosted.org/packages/3a/cc/5999d1eb705a6cefc31f0b4a90e9f7fc400539b1a1030529700cc1b51838/pydantic_core-2.33.2-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:f517ca031dfc037a9c07e748cefd8d96235088b83b4f4ba8939105d20fa1dcd6", size = 1844808, upload-time = "2025-04-23T18:31:54.79Z" },
+    { url = "https://files.pythonhosted.org/packages/6f/5e/a0a7b8885c98889a18b6e376f344da1ef323d270b44edf8174d6bce4d622/pydantic_core-2.33.2-cp313-cp313-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:0a9f2c9dd19656823cb8250b0724ee9c60a82f3cdf68a080979d13092a3b0fef", size = 1885580, upload-time = "2025-04-23T18:31:57.393Z" },
+    { url = "https://files.pythonhosted.org/packages/3b/2a/953581f343c7d11a304581156618c3f592435523dd9d79865903272c256a/pydantic_core-2.33.2-cp313-cp313-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:2b0a451c263b01acebe51895bfb0e1cc842a5c666efe06cdf13846c7418caa9a", size = 1973859, upload-time = "2025-04-23T18:31:59.065Z" },
+    { url = "https://files.pythonhosted.org/packages/e6/55/f1a813904771c03a3f97f676c62cca0c0a4138654107c1b61f19c644868b/pydantic_core-2.33.2-cp313-cp313-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:1ea40a64d23faa25e62a70ad163571c0b342b8bf66d5fa612ac0dec4f069d916", size = 2120810, upload-time = "2025-04-23T18:32:00.78Z" },
+    { url = "https://files.pythonhosted.org/packages/aa/c3/053389835a996e18853ba107a63caae0b9deb4a276c6b472931ea9ae6e48/pydantic_core-2.33.2-cp313-cp313-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:0fb2d542b4d66f9470e8065c5469ec676978d625a8b7a363f07d9a501a9cb36a", size = 2676498, upload-time = "2025-04-23T18:32:02.418Z" },
+    { url = "https://files.pythonhosted.org/packages/eb/3c/f4abd740877a35abade05e437245b192f9d0ffb48bbbbd708df33d3cda37/pydantic_core-2.33.2-cp313-cp313-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:9fdac5d6ffa1b5a83bca06ffe7583f5576555e6c8b3a91fbd25ea7780f825f7d", size = 2000611, upload-time = "2025-04-23T18:32:04.152Z" },
+    { url = "https://files.pythonhosted.org/packages/59/a7/63ef2fed1837d1121a894d0ce88439fe3e3b3e48c7543b2a4479eb99c2bd/pydantic_core-2.33.2-cp313-cp313-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:04a1a413977ab517154eebb2d326da71638271477d6ad87a769102f7c2488c56", size = 2107924, upload-time = "2025-04-23T18:32:06.129Z" },
+    { url = "https://files.pythonhosted.org/packages/04/8f/2551964ef045669801675f1cfc3b0d74147f4901c3ffa42be2ddb1f0efc4/pydantic_core-2.33.2-cp313-cp313-musllinux_1_1_aarch64.whl", hash = "sha256:c8e7af2f4e0194c22b5b37205bfb293d166a7344a5b0d0eaccebc376546d77d5", size = 2063196, upload-time = "2025-04-23T18:32:08.178Z" },
+    { url = "https://files.pythonhosted.org/packages/26/bd/d9602777e77fc6dbb0c7db9ad356e9a985825547dce5ad1d30ee04903918/pydantic_core-2.33.2-cp313-cp313-musllinux_1_1_armv7l.whl", hash = "sha256:5c92edd15cd58b3c2d34873597a1e20f13094f59cf88068adb18947df5455b4e", size = 2236389, upload-time = "2025-04-23T18:32:10.242Z" },
+    { url = "https://files.pythonhosted.org/packages/42/db/0e950daa7e2230423ab342ae918a794964b053bec24ba8af013fc7c94846/pydantic_core-2.33.2-cp313-cp313-musllinux_1_1_x86_64.whl", hash = "sha256:65132b7b4a1c0beded5e057324b7e16e10910c106d43675d9bd87d4f38dde162", size = 2239223, upload-time = "2025-04-23T18:32:12.382Z" },
+    { url = "https://files.pythonhosted.org/packages/58/4d/4f937099c545a8a17eb52cb67fe0447fd9a373b348ccfa9a87f141eeb00f/pydantic_core-2.33.2-cp313-cp313-win32.whl", hash = "sha256:52fb90784e0a242bb96ec53f42196a17278855b0f31ac7c3cc6f5c1ec4811849", size = 1900473, upload-time = "2025-04-23T18:32:14.034Z" },
+    { url = "https://files.pythonhosted.org/packages/a0/75/4a0a9bac998d78d889def5e4ef2b065acba8cae8c93696906c3a91f310ca/pydantic_core-2.33.2-cp313-cp313-win_amd64.whl", hash = "sha256:c083a3bdd5a93dfe480f1125926afcdbf2917ae714bdb80b36d34318b2bec5d9", size = 1955269, upload-time = "2025-04-23T18:32:15.783Z" },
+    { url = "https://files.pythonhosted.org/packages/f9/86/1beda0576969592f1497b4ce8e7bc8cbdf614c352426271b1b10d5f0aa64/pydantic_core-2.33.2-cp313-cp313-win_arm64.whl", hash = "sha256:e80b087132752f6b3d714f041ccf74403799d3b23a72722ea2e6ba2e892555b9", size = 1893921, upload-time = "2025-04-23T18:32:18.473Z" },
+    { url = "https://files.pythonhosted.org/packages/a4/7d/e09391c2eebeab681df2b74bfe6c43422fffede8dc74187b2b0bf6fd7571/pydantic_core-2.33.2-cp313-cp313t-macosx_11_0_arm64.whl", hash = "sha256:61c18fba8e5e9db3ab908620af374db0ac1baa69f0f32df4f61ae23f15e586ac", size = 1806162, upload-time = "2025-04-23T18:32:20.188Z" },
+    { url = "https://files.pythonhosted.org/packages/f1/3d/847b6b1fed9f8ed3bb95a9ad04fbd0b212e832d4f0f50ff4d9ee5a9f15cf/pydantic_core-2.33.2-cp313-cp313t-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:95237e53bb015f67b63c91af7518a62a8660376a6a0db19b89acc77a4d6199f5", size = 1981560, upload-time = "2025-04-23T18:32:22.354Z" },
+    { url = "https://files.pythonhosted.org/packages/6f/9a/e73262f6c6656262b5fdd723ad90f518f579b7bc8622e43a942eec53c938/pydantic_core-2.33.2-cp313-cp313t-win_amd64.whl", hash = "sha256:c2fc0a768ef76c15ab9238afa6da7f69895bb5d1ee83aeea2e3509af4472d0b9", size = 1935777, upload-time = "2025-04-23T18:32:25.088Z" },
+    { url = "https://files.pythonhosted.org/packages/30/68/373d55e58b7e83ce371691f6eaa7175e3a24b956c44628eb25d7da007917/pydantic_core-2.33.2-pp310-pypy310_pp73-macosx_10_12_x86_64.whl", hash = "sha256:5c4aa4e82353f65e548c476b37e64189783aa5384903bfea4f41580f255fddfa", size = 2023982, upload-time = "2025-04-23T18:32:53.14Z" },
+    { url = "https://files.pythonhosted.org/packages/a4/16/145f54ac08c96a63d8ed6442f9dec17b2773d19920b627b18d4f10a061ea/pydantic_core-2.33.2-pp310-pypy310_pp73-macosx_11_0_arm64.whl", hash = "sha256:d946c8bf0d5c24bf4fe333af284c59a19358aa3ec18cb3dc4370080da1e8ad29", size = 1858412, upload-time = "2025-04-23T18:32:55.52Z" },
+    { url = "https://files.pythonhosted.org/packages/41/b1/c6dc6c3e2de4516c0bb2c46f6a373b91b5660312342a0cf5826e38ad82fa/pydantic_core-2.33.2-pp310-pypy310_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:87b31b6846e361ef83fedb187bb5b4372d0da3f7e28d85415efa92d6125d6e6d", size = 1892749, upload-time = "2025-04-23T18:32:57.546Z" },
+    { url = "https://files.pythonhosted.org/packages/12/73/8cd57e20afba760b21b742106f9dbdfa6697f1570b189c7457a1af4cd8a0/pydantic_core-2.33.2-pp310-pypy310_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:aa9d91b338f2df0508606f7009fde642391425189bba6d8c653afd80fd6bb64e", size = 2067527, upload-time = "2025-04-23T18:32:59.771Z" },
+    { url = "https://files.pythonhosted.org/packages/e3/d5/0bb5d988cc019b3cba4a78f2d4b3854427fc47ee8ec8e9eaabf787da239c/pydantic_core-2.33.2-pp310-pypy310_pp73-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:2058a32994f1fde4ca0480ab9d1e75a0e8c87c22b53a3ae66554f9af78f2fe8c", size = 2108225, upload-time = "2025-04-23T18:33:04.51Z" },
+    { url = "https://files.pythonhosted.org/packages/f1/c5/00c02d1571913d496aabf146106ad8239dc132485ee22efe08085084ff7c/pydantic_core-2.33.2-pp310-pypy310_pp73-musllinux_1_1_aarch64.whl", hash = "sha256:0e03262ab796d986f978f79c943fc5f620381be7287148b8010b4097f79a39ec", size = 2069490, upload-time = "2025-04-23T18:33:06.391Z" },
+    { url = "https://files.pythonhosted.org/packages/22/a8/dccc38768274d3ed3a59b5d06f59ccb845778687652daa71df0cab4040d7/pydantic_core-2.33.2-pp310-pypy310_pp73-musllinux_1_1_armv7l.whl", hash = "sha256:1a8695a8d00c73e50bff9dfda4d540b7dee29ff9b8053e38380426a85ef10052", size = 2237525, upload-time = "2025-04-23T18:33:08.44Z" },
+    { url = "https://files.pythonhosted.org/packages/d4/e7/4f98c0b125dda7cf7ccd14ba936218397b44f50a56dd8c16a3091df116c3/pydantic_core-2.33.2-pp310-pypy310_pp73-musllinux_1_1_x86_64.whl", hash = "sha256:fa754d1850735a0b0e03bcffd9d4b4343eb417e47196e4485d9cca326073a42c", size = 2238446, upload-time = "2025-04-23T18:33:10.313Z" },
+    { url = "https://files.pythonhosted.org/packages/ce/91/2ec36480fdb0b783cd9ef6795753c1dea13882f2e68e73bce76ae8c21e6a/pydantic_core-2.33.2-pp310-pypy310_pp73-win_amd64.whl", hash = "sha256:a11c8d26a50bfab49002947d3d237abe4d9e4b5bdc8846a63537b6488e197808", size = 2066678, upload-time = "2025-04-23T18:33:12.224Z" },
+    { url = "https://files.pythonhosted.org/packages/7b/27/d4ae6487d73948d6f20dddcd94be4ea43e74349b56eba82e9bdee2d7494c/pydantic_core-2.33.2-pp311-pypy311_pp73-macosx_10_12_x86_64.whl", hash = "sha256:dd14041875d09cc0f9308e37a6f8b65f5585cf2598a53aa0123df8b129d481f8", size = 2025200, upload-time = "2025-04-23T18:33:14.199Z" },
+    { url = "https://files.pythonhosted.org/packages/f1/b8/b3cb95375f05d33801024079b9392a5ab45267a63400bf1866e7ce0f0de4/pydantic_core-2.33.2-pp311-pypy311_pp73-macosx_11_0_arm64.whl", hash = "sha256:d87c561733f66531dced0da6e864f44ebf89a8fba55f31407b00c2f7f9449593", size = 1859123, upload-time = "2025-04-23T18:33:16.555Z" },
+    { url = "https://files.pythonhosted.org/packages/05/bc/0d0b5adeda59a261cd30a1235a445bf55c7e46ae44aea28f7bd6ed46e091/pydantic_core-2.33.2-pp311-pypy311_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:2f82865531efd18d6e07a04a17331af02cb7a651583c418df8266f17a63c6612", size = 1892852, upload-time = "2025-04-23T18:33:18.513Z" },
+    { url = "https://files.pythonhosted.org/packages/3e/11/d37bdebbda2e449cb3f519f6ce950927b56d62f0b84fd9cb9e372a26a3d5/pydantic_core-2.33.2-pp311-pypy311_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:2bfb5112df54209d820d7bf9317c7a6c9025ea52e49f46b6a2060104bba37de7", size = 2067484, upload-time = "2025-04-23T18:33:20.475Z" },
+    { url = "https://files.pythonhosted.org/packages/8c/55/1f95f0a05ce72ecb02a8a8a1c3be0579bbc29b1d5ab68f1378b7bebc5057/pydantic_core-2.33.2-pp311-pypy311_pp73-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:64632ff9d614e5eecfb495796ad51b0ed98c453e447a76bcbeeb69615079fc7e", size = 2108896, upload-time = "2025-04-23T18:33:22.501Z" },
+    { url = "https://files.pythonhosted.org/packages/53/89/2b2de6c81fa131f423246a9109d7b2a375e83968ad0800d6e57d0574629b/pydantic_core-2.33.2-pp311-pypy311_pp73-musllinux_1_1_aarch64.whl", hash = "sha256:f889f7a40498cc077332c7ab6b4608d296d852182211787d4f3ee377aaae66e8", size = 2069475, upload-time = "2025-04-23T18:33:24.528Z" },
+    { url = "https://files.pythonhosted.org/packages/b8/e9/1f7efbe20d0b2b10f6718944b5d8ece9152390904f29a78e68d4e7961159/pydantic_core-2.33.2-pp311-pypy311_pp73-musllinux_1_1_armv7l.whl", hash = "sha256:de4b83bb311557e439b9e186f733f6c645b9417c84e2eb8203f3f820a4b988bf", size = 2239013, upload-time = "2025-04-23T18:33:26.621Z" },
+    { url = "https://files.pythonhosted.org/packages/3c/b2/5309c905a93811524a49b4e031e9851a6b00ff0fb668794472ea7746b448/pydantic_core-2.33.2-pp311-pypy311_pp73-musllinux_1_1_x86_64.whl", hash = "sha256:82f68293f055f51b51ea42fafc74b6aad03e70e191799430b90c13d643059ebb", size = 2238715, upload-time = "2025-04-23T18:33:28.656Z" },
+    { url = "https://files.pythonhosted.org/packages/32/56/8a7ca5d2cd2cda1d245d34b1c9a942920a718082ae8e54e5f3e5a58b7add/pydantic_core-2.33.2-pp311-pypy311_pp73-win_amd64.whl", hash = "sha256:329467cecfb529c925cf2bbd4d60d2c509bc2fb52a20c1045bf09bb70971a9c1", size = 2066757, upload-time = "2025-04-23T18:33:30.645Z" },
+]
+
+[[package]]
+name = "pygments"
+version = "2.19.2"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/b0/77/a5b8c569bf593b0140bde72ea885a803b82086995367bf2037de0159d924/pygments-2.19.2.tar.gz", hash = "sha256:636cb2477cec7f8952536970bc533bc43743542f70392ae026374600add5b887", size = 4968631, upload-time = "2025-06-21T13:39:12.283Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/c7/21/705964c7812476f378728bdf590ca4b771ec72385c533964653c68e86bdc/pygments-2.19.2-py3-none-any.whl", hash = "sha256:86540386c03d588bb81d44bc3928634ff26449851e99741617ecb9037ee5ec0b", size = 1225217, upload-time = "2025-06-21T13:39:07.939Z" },
+]
+
+[[package]]
+name = "python-dateutil"
+version = "2.9.0.post0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "six" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/66/c0/0c8b6ad9f17a802ee498c46e004a0eb49bc148f2fd230864601a86dcf6db/python-dateutil-2.9.0.post0.tar.gz", hash = "sha256:37dd54208da7e1cd875388217d5e00ebd4179249f90fb72437e91a35459a0ad3", size = 342432, upload-time = "2024-03-01T18:36:20.211Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/ec/57/56b9bcc3c9c6a792fcbaf139543cee77261f3651ca9da0c93f5c1221264b/python_dateutil-2.9.0.post0-py2.py3-none-any.whl", hash = "sha256:a8b2bc7bffae282281c8140a97d3aa9c14da0b136dfe83f850eea9a5f7470427", size = 229892, upload-time = "2024-03-01T18:36:18.57Z" },
+]
+
+[[package]]
+name = "pyyaml"
+version = "6.0.2"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/54/ed/79a089b6be93607fa5cdaedf301d7dfb23af5f25c398d5ead2525b063e17/pyyaml-6.0.2.tar.gz", hash = "sha256:d584d9ec91ad65861cc08d42e834324ef890a082e591037abe114850ff7bbc3e", size = 130631, upload-time = "2024-08-06T20:33:50.674Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/9b/95/a3fac87cb7158e231b5a6012e438c647e1a87f09f8e0d123acec8ab8bf71/PyYAML-6.0.2-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:0a9a2848a5b7feac301353437eb7d5957887edbf81d56e903999a75a3d743086", size = 184199, upload-time = "2024-08-06T20:31:40.178Z" },
+    { url = "https://files.pythonhosted.org/packages/c7/7a/68bd47624dab8fd4afbfd3c48e3b79efe09098ae941de5b58abcbadff5cb/PyYAML-6.0.2-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:29717114e51c84ddfba879543fb232a6ed60086602313ca38cce623c1d62cfbf", size = 171758, upload-time = "2024-08-06T20:31:42.173Z" },
+    { url = "https://files.pythonhosted.org/packages/49/ee/14c54df452143b9ee9f0f29074d7ca5516a36edb0b4cc40c3f280131656f/PyYAML-6.0.2-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:8824b5a04a04a047e72eea5cec3bc266db09e35de6bdfe34c9436ac5ee27d237", size = 718463, upload-time = "2024-08-06T20:31:44.263Z" },
+    { url = "https://files.pythonhosted.org/packages/4d/61/de363a97476e766574650d742205be468921a7b532aa2499fcd886b62530/PyYAML-6.0.2-cp310-cp310-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:7c36280e6fb8385e520936c3cb3b8042851904eba0e58d277dca80a5cfed590b", size = 719280, upload-time = "2024-08-06T20:31:50.199Z" },
+    { url = "https://files.pythonhosted.org/packages/6b/4e/1523cb902fd98355e2e9ea5e5eb237cbc5f3ad5f3075fa65087aa0ecb669/PyYAML-6.0.2-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:ec031d5d2feb36d1d1a24380e4db6d43695f3748343d99434e6f5f9156aaa2ed", size = 751239, upload-time = "2024-08-06T20:31:52.292Z" },
+    { url = "https://files.pythonhosted.org/packages/b7/33/5504b3a9a4464893c32f118a9cc045190a91637b119a9c881da1cf6b7a72/PyYAML-6.0.2-cp310-cp310-musllinux_1_1_aarch64.whl", hash = "sha256:936d68689298c36b53b29f23c6dbb74de12b4ac12ca6cfe0e047bedceea56180", size = 695802, upload-time = "2024-08-06T20:31:53.836Z" },
+    { url = "https://files.pythonhosted.org/packages/5c/20/8347dcabd41ef3a3cdc4f7b7a2aff3d06598c8779faa189cdbf878b626a4/PyYAML-6.0.2-cp310-cp310-musllinux_1_1_x86_64.whl", hash = "sha256:23502f431948090f597378482b4812b0caae32c22213aecf3b55325e049a6c68", size = 720527, upload-time = "2024-08-06T20:31:55.565Z" },
+    { url = "https://files.pythonhosted.org/packages/be/aa/5afe99233fb360d0ff37377145a949ae258aaab831bde4792b32650a4378/PyYAML-6.0.2-cp310-cp310-win32.whl", hash = "sha256:2e99c6826ffa974fe6e27cdb5ed0021786b03fc98e5ee3c5bfe1fd5015f42b99", size = 144052, upload-time = "2024-08-06T20:31:56.914Z" },
+    { url = "https://files.pythonhosted.org/packages/b5/84/0fa4b06f6d6c958d207620fc60005e241ecedceee58931bb20138e1e5776/PyYAML-6.0.2-cp310-cp310-win_amd64.whl", hash = "sha256:a4d3091415f010369ae4ed1fc6b79def9416358877534caf6a0fdd2146c87a3e", size = 161774, upload-time = "2024-08-06T20:31:58.304Z" },
+    { url = "https://files.pythonhosted.org/packages/f8/aa/7af4e81f7acba21a4c6be026da38fd2b872ca46226673c89a758ebdc4fd2/PyYAML-6.0.2-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:cc1c1159b3d456576af7a3e4d1ba7e6924cb39de8f67111c735f6fc832082774", size = 184612, upload-time = "2024-08-06T20:32:03.408Z" },
+    { url = "https://files.pythonhosted.org/packages/8b/62/b9faa998fd185f65c1371643678e4d58254add437edb764a08c5a98fb986/PyYAML-6.0.2-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:1e2120ef853f59c7419231f3bf4e7021f1b936f6ebd222406c3b60212205d2ee", size = 172040, upload-time = "2024-08-06T20:32:04.926Z" },
+    { url = "https://files.pythonhosted.org/packages/ad/0c/c804f5f922a9a6563bab712d8dcc70251e8af811fce4524d57c2c0fd49a4/PyYAML-6.0.2-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:5d225db5a45f21e78dd9358e58a98702a0302f2659a3c6cd320564b75b86f47c", size = 736829, upload-time = "2024-08-06T20:32:06.459Z" },
+    { url = "https://files.pythonhosted.org/packages/51/16/6af8d6a6b210c8e54f1406a6b9481febf9c64a3109c541567e35a49aa2e7/PyYAML-6.0.2-cp311-cp311-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:5ac9328ec4831237bec75defaf839f7d4564be1e6b25ac710bd1a96321cc8317", size = 764167, upload-time = "2024-08-06T20:32:08.338Z" },
+    { url = "https://files.pythonhosted.org/packages/75/e4/2c27590dfc9992f73aabbeb9241ae20220bd9452df27483b6e56d3975cc5/PyYAML-6.0.2-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:3ad2a3decf9aaba3d29c8f537ac4b243e36bef957511b4766cb0057d32b0be85", size = 762952, upload-time = "2024-08-06T20:32:14.124Z" },
+    { url = "https://files.pythonhosted.org/packages/9b/97/ecc1abf4a823f5ac61941a9c00fe501b02ac3ab0e373c3857f7d4b83e2b6/PyYAML-6.0.2-cp311-cp311-musllinux_1_1_aarch64.whl", hash = "sha256:ff3824dc5261f50c9b0dfb3be22b4567a6f938ccce4587b38952d85fd9e9afe4", size = 735301, upload-time = "2024-08-06T20:32:16.17Z" },
+    { url = "https://files.pythonhosted.org/packages/45/73/0f49dacd6e82c9430e46f4a027baa4ca205e8b0a9dce1397f44edc23559d/PyYAML-6.0.2-cp311-cp311-musllinux_1_1_x86_64.whl", hash = "sha256:797b4f722ffa07cc8d62053e4cff1486fa6dc094105d13fea7b1de7d8bf71c9e", size = 756638, upload-time = "2024-08-06T20:32:18.555Z" },
+    { url = "https://files.pythonhosted.org/packages/22/5f/956f0f9fc65223a58fbc14459bf34b4cc48dec52e00535c79b8db361aabd/PyYAML-6.0.2-cp311-cp311-win32.whl", hash = "sha256:11d8f3dd2b9c1207dcaf2ee0bbbfd5991f571186ec9cc78427ba5bd32afae4b5", size = 143850, upload-time = "2024-08-06T20:32:19.889Z" },
+    { url = "https://files.pythonhosted.org/packages/ed/23/8da0bbe2ab9dcdd11f4f4557ccaf95c10b9811b13ecced089d43ce59c3c8/PyYAML-6.0.2-cp311-cp311-win_amd64.whl", hash = "sha256:e10ce637b18caea04431ce14fabcf5c64a1c61ec9c56b071a4b7ca131ca52d44", size = 161980, upload-time = "2024-08-06T20:32:21.273Z" },
+    { url = "https://files.pythonhosted.org/packages/86/0c/c581167fc46d6d6d7ddcfb8c843a4de25bdd27e4466938109ca68492292c/PyYAML-6.0.2-cp312-cp312-macosx_10_9_x86_64.whl", hash = "sha256:c70c95198c015b85feafc136515252a261a84561b7b1d51e3384e0655ddf25ab", size = 183873, upload-time = "2024-08-06T20:32:25.131Z" },
+    { url = "https://files.pythonhosted.org/packages/a8/0c/38374f5bb272c051e2a69281d71cba6fdb983413e6758b84482905e29a5d/PyYAML-6.0.2-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:ce826d6ef20b1bc864f0a68340c8b3287705cae2f8b4b1d932177dcc76721725", size = 173302, upload-time = "2024-08-06T20:32:26.511Z" },
+    { url = "https://files.pythonhosted.org/packages/c3/93/9916574aa8c00aa06bbac729972eb1071d002b8e158bd0e83a3b9a20a1f7/PyYAML-6.0.2-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:1f71ea527786de97d1a0cc0eacd1defc0985dcf6b3f17bb77dcfc8c34bec4dc5", size = 739154, upload-time = "2024-08-06T20:32:28.363Z" },
+    { url = "https://files.pythonhosted.org/packages/95/0f/b8938f1cbd09739c6da569d172531567dbcc9789e0029aa070856f123984/PyYAML-6.0.2-cp312-cp312-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:9b22676e8097e9e22e36d6b7bda33190d0d400f345f23d4065d48f4ca7ae0425", size = 766223, upload-time = "2024-08-06T20:32:30.058Z" },
+    { url = "https://files.pythonhosted.org/packages/b9/2b/614b4752f2e127db5cc206abc23a8c19678e92b23c3db30fc86ab731d3bd/PyYAML-6.0.2-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:80bab7bfc629882493af4aa31a4cfa43a4c57c83813253626916b8c7ada83476", size = 767542, upload-time = "2024-08-06T20:32:31.881Z" },
+    { url = "https://files.pythonhosted.org/packages/d4/00/dd137d5bcc7efea1836d6264f049359861cf548469d18da90cd8216cf05f/PyYAML-6.0.2-cp312-cp312-musllinux_1_1_aarch64.whl", hash = "sha256:0833f8694549e586547b576dcfaba4a6b55b9e96098b36cdc7ebefe667dfed48", size = 731164, upload-time = "2024-08-06T20:32:37.083Z" },
+    { url = "https://files.pythonhosted.org/packages/c9/1f/4f998c900485e5c0ef43838363ba4a9723ac0ad73a9dc42068b12aaba4e4/PyYAML-6.0.2-cp312-cp312-musllinux_1_1_x86_64.whl", hash = "sha256:8b9c7197f7cb2738065c481a0461e50ad02f18c78cd75775628afb4d7137fb3b", size = 756611, upload-time = "2024-08-06T20:32:38.898Z" },
+    { url = "https://files.pythonhosted.org/packages/df/d1/f5a275fdb252768b7a11ec63585bc38d0e87c9e05668a139fea92b80634c/PyYAML-6.0.2-cp312-cp312-win32.whl", hash = "sha256:ef6107725bd54b262d6dedcc2af448a266975032bc85ef0172c5f059da6325b4", size = 140591, upload-time = "2024-08-06T20:32:40.241Z" },
+    { url = "https://files.pythonhosted.org/packages/0c/e8/4f648c598b17c3d06e8753d7d13d57542b30d56e6c2dedf9c331ae56312e/PyYAML-6.0.2-cp312-cp312-win_amd64.whl", hash = "sha256:7e7401d0de89a9a855c839bc697c079a4af81cf878373abd7dc625847d25cbd8", size = 156338, upload-time = "2024-08-06T20:32:41.93Z" },
+    { url = "https://files.pythonhosted.org/packages/ef/e3/3af305b830494fa85d95f6d95ef7fa73f2ee1cc8ef5b495c7c3269fb835f/PyYAML-6.0.2-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:efdca5630322a10774e8e98e1af481aad470dd62c3170801852d752aa7a783ba", size = 181309, upload-time = "2024-08-06T20:32:43.4Z" },
+    { url = "https://files.pythonhosted.org/packages/45/9f/3b1c20a0b7a3200524eb0076cc027a970d320bd3a6592873c85c92a08731/PyYAML-6.0.2-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:50187695423ffe49e2deacb8cd10510bc361faac997de9efef88badc3bb9e2d1", size = 171679, upload-time = "2024-08-06T20:32:44.801Z" },
+    { url = "https://files.pythonhosted.org/packages/7c/9a/337322f27005c33bcb656c655fa78325b730324c78620e8328ae28b64d0c/PyYAML-6.0.2-cp313-cp313-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:0ffe8360bab4910ef1b9e87fb812d8bc0a308b0d0eef8c8f44e0254ab3b07133", size = 733428, upload-time = "2024-08-06T20:32:46.432Z" },
+    { url = "https://files.pythonhosted.org/packages/a3/69/864fbe19e6c18ea3cc196cbe5d392175b4cf3d5d0ac1403ec3f2d237ebb5/PyYAML-6.0.2-cp313-cp313-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:17e311b6c678207928d649faa7cb0d7b4c26a0ba73d41e99c4fff6b6c3276484", size = 763361, upload-time = "2024-08-06T20:32:51.188Z" },
+    { url = "https://files.pythonhosted.org/packages/04/24/b7721e4845c2f162d26f50521b825fb061bc0a5afcf9a386840f23ea19fa/PyYAML-6.0.2-cp313-cp313-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:70b189594dbe54f75ab3a1acec5f1e3faa7e8cf2f1e08d9b561cb41b845f69d5", size = 759523, upload-time = "2024-08-06T20:32:53.019Z" },
+    { url = "https://files.pythonhosted.org/packages/2b/b2/e3234f59ba06559c6ff63c4e10baea10e5e7df868092bf9ab40e5b9c56b6/PyYAML-6.0.2-cp313-cp313-musllinux_1_1_aarch64.whl", hash = "sha256:41e4e3953a79407c794916fa277a82531dd93aad34e29c2a514c2c0c5fe971cc", size = 726660, upload-time = "2024-08-06T20:32:54.708Z" },
+    { url = "https://files.pythonhosted.org/packages/fe/0f/25911a9f080464c59fab9027482f822b86bf0608957a5fcc6eaac85aa515/PyYAML-6.0.2-cp313-cp313-musllinux_1_1_x86_64.whl", hash = "sha256:68ccc6023a3400877818152ad9a1033e3db8625d899c72eacb5a668902e4d652", size = 751597, upload-time = "2024-08-06T20:32:56.985Z" },
+    { url = "https://files.pythonhosted.org/packages/14/0d/e2c3b43bbce3cf6bd97c840b46088a3031085179e596d4929729d8d68270/PyYAML-6.0.2-cp313-cp313-win32.whl", hash = "sha256:bc2fa7c6b47d6bc618dd7fb02ef6fdedb1090ec036abab80d4681424b84c1183", size = 140527, upload-time = "2024-08-06T20:33:03.001Z" },
+    { url = "https://files.pythonhosted.org/packages/fa/de/02b54f42487e3d3c6efb3f89428677074ca7bf43aae402517bc7cca949f3/PyYAML-6.0.2-cp313-cp313-win_amd64.whl", hash = "sha256:8388ee1976c416731879ac16da0aff3f63b286ffdd57cdeb95f3f2e085687563", size = 156446, upload-time = "2024-08-06T20:33:04.33Z" },
+]
+
+[[package]]
+name = "requests"
+version = "2.32.4"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "certifi" },
+    { name = "charset-normalizer" },
+    { name = "idna" },
+    { name = "urllib3" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/e1/0a/929373653770d8a0d7ea76c37de6e41f11eb07559b103b1c02cafb3f7cf8/requests-2.32.4.tar.gz", hash = "sha256:27d0316682c8a29834d3264820024b62a36942083d52caf2f14c0591336d3422", size = 135258, upload-time = "2025-06-09T16:43:07.34Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/7c/e4/56027c4a6b4ae70ca9de302488c5ca95ad4a39e190093d6c1a8ace08341b/requests-2.32.4-py3-none-any.whl", hash = "sha256:27babd3cda2a6d50b30443204ee89830707d396671944c998b5975b031ac2b2c", size = 64847, upload-time = "2025-06-09T16:43:05.728Z" },
+]
+
+[[package]]
+name = "roman-numerals-py"
+version = "3.1.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/30/76/48fd56d17c5bdbdf65609abbc67288728a98ed4c02919428d4f52d23b24b/roman_numerals_py-3.1.0.tar.gz", hash = "sha256:be4bf804f083a4ce001b5eb7e3c0862479d10f94c936f6c4e5f250aa5ff5bd2d", size = 9017, upload-time = "2025-02-22T07:34:54.333Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/53/97/d2cbbaa10c9b826af0e10fdf836e1bf344d9f0abb873ebc34d1f49642d3f/roman_numerals_py-3.1.0-py3-none-any.whl", hash = "sha256:9da2ad2fb670bcf24e81070ceb3be72f6c11c440d73bd579fbeca1e9f330954c", size = 7742, upload-time = "2025-02-22T07:34:52.422Z" },
+]
+
+[[package]]
+name = "shrub-py"
+version = "3.10.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "croniter" },
+    { name = "pydantic" },
+    { name = "pyyaml" },
+    { name = "typing-extensions" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/76/09/6b6528a84471d432c37ecfb48fd3987cf9b02bba6bca5ef8a406b66822c5/shrub_py-3.10.0.tar.gz", hash = "sha256:035cb81fabbd72f47792ab4304ce33af262005842fa5886c1e57b7a2a9d53cfa", size = 33236, upload-time = "2025-04-10T18:26:58.814Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/1f/08/0f1d5a935de84c74239b8337c6e215fa8e75c3eb9733c68e9bef88ae9052/shrub_py-3.10.0-py3-none-any.whl", hash = "sha256:239ad492819c84f14f4349d3679f5a6218468441861f310a2320ec9683862805", size = 40326, upload-time = "2025-04-10T18:26:54.592Z" },
+]
+
+[[package]]
+name = "six"
+version = "1.17.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/94/e7/b2c673351809dca68a0e064b6af791aa332cf192da575fd474ed7d6f16a2/six-1.17.0.tar.gz", hash = "sha256:ff70335d468e7eb6ec65b95b99d3a2836546063f63acc5171de367e834932a81", size = 34031, upload-time = "2024-12-04T17:35:28.174Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/b7/ce/149a00dd41f10bc29e5921b496af8b574d8413afcd5e30dfa0ed46c2cc5e/six-1.17.0-py2.py3-none-any.whl", hash = "sha256:4721f391ed90541fddacab5acf947aa0d3dc7d27b2e1e8eda2be8970586c3274", size = 11050, upload-time = "2024-12-04T17:35:26.475Z" },
+]
+
+[[package]]
+name = "snowballstemmer"
+version = "3.0.1"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/75/a7/9810d872919697c9d01295633f5d574fb416d47e535f258272ca1f01f447/snowballstemmer-3.0.1.tar.gz", hash = "sha256:6d5eeeec8e9f84d4d56b847692bacf79bc2c8e90c7f80ca4444ff8b6f2e52895", size = 105575, upload-time = "2025-05-09T16:34:51.843Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/c8/78/3565d011c61f5a43488987ee32b6f3f656e7f107ac2782dd57bdd7d91d9a/snowballstemmer-3.0.1-py3-none-any.whl", hash = "sha256:6cd7b3897da8d6c9ffb968a6781fa6532dce9c3618a4b127d920dab764a19064", size = 103274, upload-time = "2025-05-09T16:34:50.371Z" },
+]
+
+[[package]]
+name = "soupsieve"
+version = "2.7"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/3f/f4/4a80cd6ef364b2e8b65b15816a843c0980f7a5a2b4dc701fc574952aa19f/soupsieve-2.7.tar.gz", hash = "sha256:ad282f9b6926286d2ead4750552c8a6142bc4c783fd66b0293547c8fe6ae126a", size = 103418, upload-time = "2025-04-20T18:50:08.518Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/e7/9c/0e6afc12c269578be5c0c1c9f4b49a8d32770a080260c333ac04cc1c832d/soupsieve-2.7-py3-none-any.whl", hash = "sha256:6e60cc5c1ffaf1cebcc12e8188320b72071e922c2e897f737cadce79ad5d30c4", size = 36677, upload-time = "2025-04-20T18:50:07.196Z" },
+]
+
+[[package]]
+name = "sphinx"
+version = "8.1.3"
+source = { registry = "https://pypi.org/simple" }
+resolution-markers = [
+    "python_full_version < '3.11'",
+]
+dependencies = [
+    { name = "alabaster", marker = "python_full_version < '3.11'" },
+    { name = "babel", marker = "python_full_version < '3.11'" },
+    { name = "colorama", marker = "python_full_version < '3.11' and sys_platform == 'win32'" },
+    { name = "docutils", marker = "python_full_version < '3.11'" },
+    { name = "imagesize", marker = "python_full_version < '3.11'" },
+    { name = "jinja2", marker = "python_full_version < '3.11'" },
+    { name = "packaging", marker = "python_full_version < '3.11'" },
+    { name = "pygments", marker = "python_full_version < '3.11'" },
+    { name = "requests", marker = "python_full_version < '3.11'" },
+    { name = "snowballstemmer", marker = "python_full_version < '3.11'" },
+    { name = "sphinxcontrib-applehelp", marker = "python_full_version < '3.11'" },
+    { name = "sphinxcontrib-devhelp", marker = "python_full_version < '3.11'" },
+    { name = "sphinxcontrib-htmlhelp", marker = "python_full_version < '3.11'" },
+    { name = "sphinxcontrib-jsmath", marker = "python_full_version < '3.11'" },
+    { name = "sphinxcontrib-qthelp", marker = "python_full_version < '3.11'" },
+    { name = "sphinxcontrib-serializinghtml", marker = "python_full_version < '3.11'" },
+    { name = "tomli", marker = "python_full_version < '3.11'" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/6f/6d/be0b61178fe2cdcb67e2a92fc9ebb488e3c51c4f74a36a7824c0adf23425/sphinx-8.1.3.tar.gz", hash = "sha256:43c1911eecb0d3e161ad78611bc905d1ad0e523e4ddc202a58a821773dc4c927", size = 8184611, upload-time = "2024-10-13T20:27:13.93Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/26/60/1ddff83a56d33aaf6f10ec8ce84b4c007d9368b21008876fceda7e7381ef/sphinx-8.1.3-py3-none-any.whl", hash = "sha256:09719015511837b76bf6e03e42eb7595ac8c2e41eeb9c29c5b755c6b677992a2", size = 3487125, upload-time = "2024-10-13T20:27:10.448Z" },
+]
+
+[[package]]
+name = "sphinx"
+version = "8.2.3"
+source = { registry = "https://pypi.org/simple" }
+resolution-markers = [
+    "python_full_version >= '3.11'",
+]
+dependencies = [
+    { name = "alabaster", marker = "python_full_version >= '3.11'" },
+    { name = "babel", marker = "python_full_version >= '3.11'" },
+    { name = "colorama", marker = "python_full_version >= '3.11' and sys_platform == 'win32'" },
+    { name = "docutils", marker = "python_full_version >= '3.11'" },
+    { name = "imagesize", marker = "python_full_version >= '3.11'" },
+    { name = "jinja2", marker = "python_full_version >= '3.11'" },
+    { name = "packaging", marker = "python_full_version >= '3.11'" },
+    { name = "pygments", marker = "python_full_version >= '3.11'" },
+    { name = "requests", marker = "python_full_version >= '3.11'" },
+    { name = "roman-numerals-py", marker = "python_full_version >= '3.11'" },
+    { name = "snowballstemmer", marker = "python_full_version >= '3.11'" },
+    { name = "sphinxcontrib-applehelp", marker = "python_full_version >= '3.11'" },
+    { name = "sphinxcontrib-devhelp", marker = "python_full_version >= '3.11'" },
+    { name = "sphinxcontrib-htmlhelp", marker = "python_full_version >= '3.11'" },
+    { name = "sphinxcontrib-jsmath", marker = "python_full_version >= '3.11'" },
+    { name = "sphinxcontrib-qthelp", marker = "python_full_version >= '3.11'" },
+    { name = "sphinxcontrib-serializinghtml", marker = "python_full_version >= '3.11'" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/38/ad/4360e50ed56cb483667b8e6dadf2d3fda62359593faabbe749a27c4eaca6/sphinx-8.2.3.tar.gz", hash = "sha256:398ad29dee7f63a75888314e9424d40f52ce5a6a87ae88e7071e80af296ec348", size = 8321876, upload-time = "2025-03-02T22:31:59.658Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/31/53/136e9eca6e0b9dc0e1962e2c908fbea2e5ac000c2a2fbd9a35797958c48b/sphinx-8.2.3-py3-none-any.whl", hash = "sha256:4405915165f13521d875a8c29c8970800a0141c14cc5416a38feca4ea5d9b9c3", size = 3589741, upload-time = "2025-03-02T22:31:56.836Z" },
+]
+
+[[package]]
+name = "sphinx-basic-ng"
+version = "1.0.0b2"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "sphinx", version = "8.1.3", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version < '3.11'" },
+    { name = "sphinx", version = "8.2.3", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version >= '3.11'" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/98/0b/a866924ded68efec7a1759587a4e478aec7559d8165fac8b2ad1c0e774d6/sphinx_basic_ng-1.0.0b2.tar.gz", hash = "sha256:9ec55a47c90c8c002b5960c57492ec3021f5193cb26cebc2dc4ea226848651c9", size = 20736, upload-time = "2023-07-08T18:40:54.166Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/3c/dd/018ce05c532a22007ac58d4f45232514cd9d6dd0ee1dc374e309db830983/sphinx_basic_ng-1.0.0b2-py3-none-any.whl", hash = "sha256:eb09aedbabfb650607e9b4b68c9d240b90b1e1be221d6ad71d61c52e29f7932b", size = 22496, upload-time = "2023-07-08T18:40:52.659Z" },
+]
+
+[[package]]
+name = "sphinx-design"
+version = "0.6.1"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "sphinx", version = "8.1.3", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version < '3.11'" },
+    { name = "sphinx", version = "8.2.3", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version >= '3.11'" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/2b/69/b34e0cb5336f09c6866d53b4a19d76c227cdec1bbc7ac4de63ca7d58c9c7/sphinx_design-0.6.1.tar.gz", hash = "sha256:b44eea3719386d04d765c1a8257caca2b3e6f8421d7b3a5e742c0fd45f84e632", size = 2193689, upload-time = "2024-08-02T13:48:44.277Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/c6/43/65c0acbd8cc6f50195a3a1fc195c404988b15c67090e73c7a41a9f57d6bd/sphinx_design-0.6.1-py3-none-any.whl", hash = "sha256:b11f37db1a802a183d61b159d9a202314d4d2fe29c163437001324fe2f19549c", size = 2215338, upload-time = "2024-08-02T13:48:42.106Z" },
+]
+
+[[package]]
+name = "sphinxcontrib-applehelp"
+version = "2.0.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/ba/6e/b837e84a1a704953c62ef8776d45c3e8d759876b4a84fe14eba2859106fe/sphinxcontrib_applehelp-2.0.0.tar.gz", hash = "sha256:2f29ef331735ce958efa4734873f084941970894c6090408b079c61b2e1c06d1", size = 20053, upload-time = "2024-07-29T01:09:00.465Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/5d/85/9ebeae2f76e9e77b952f4b274c27238156eae7979c5421fba91a28f4970d/sphinxcontrib_applehelp-2.0.0-py3-none-any.whl", hash = "sha256:4cd3f0ec4ac5dd9c17ec65e9ab272c9b867ea77425228e68ecf08d6b28ddbdb5", size = 119300, upload-time = "2024-07-29T01:08:58.99Z" },
+]
+
+[[package]]
+name = "sphinxcontrib-devhelp"
+version = "2.0.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/f6/d2/5beee64d3e4e747f316bae86b55943f51e82bb86ecd325883ef65741e7da/sphinxcontrib_devhelp-2.0.0.tar.gz", hash = "sha256:411f5d96d445d1d73bb5d52133377b4248ec79db5c793ce7dbe59e074b4dd1ad", size = 12967, upload-time = "2024-07-29T01:09:23.417Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/35/7a/987e583882f985fe4d7323774889ec58049171828b58c2217e7f79cdf44e/sphinxcontrib_devhelp-2.0.0-py3-none-any.whl", hash = "sha256:aefb8b83854e4b0998877524d1029fd3e6879210422ee3780459e28a1f03a8a2", size = 82530, upload-time = "2024-07-29T01:09:21.945Z" },
+]
+
+[[package]]
+name = "sphinxcontrib-htmlhelp"
+version = "2.1.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/43/93/983afd9aa001e5201eab16b5a444ed5b9b0a7a010541e0ddfbbfd0b2470c/sphinxcontrib_htmlhelp-2.1.0.tar.gz", hash = "sha256:c9e2916ace8aad64cc13a0d233ee22317f2b9025b9cf3295249fa985cc7082e9", size = 22617, upload-time = "2024-07-29T01:09:37.889Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/0a/7b/18a8c0bcec9182c05a0b3ec2a776bba4ead82750a55ff798e8d406dae604/sphinxcontrib_htmlhelp-2.1.0-py3-none-any.whl", hash = "sha256:166759820b47002d22914d64a075ce08f4c46818e17cfc9470a9786b759b19f8", size = 98705, upload-time = "2024-07-29T01:09:36.407Z" },
+]
+
+[[package]]
+name = "sphinxcontrib-jsmath"
+version = "1.0.1"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/b2/e8/9ed3830aeed71f17c026a07a5097edcf44b692850ef215b161b8ad875729/sphinxcontrib-jsmath-1.0.1.tar.gz", hash = "sha256:a9925e4a4587247ed2191a22df5f6970656cb8ca2bd6284309578f2153e0c4b8", size = 5787, upload-time = "2019-01-21T16:10:16.347Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/c2/42/4c8646762ee83602e3fb3fbe774c2fac12f317deb0b5dbeeedd2d3ba4b77/sphinxcontrib_jsmath-1.0.1-py2.py3-none-any.whl", hash = "sha256:2ec2eaebfb78f3f2078e73666b1415417a116cc848b72e5172e596c871103178", size = 5071, upload-time = "2019-01-21T16:10:14.333Z" },
+]
+
+[[package]]
+name = "sphinxcontrib-qthelp"
+version = "2.0.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/68/bc/9104308fc285eb3e0b31b67688235db556cd5b0ef31d96f30e45f2e51cae/sphinxcontrib_qthelp-2.0.0.tar.gz", hash = "sha256:4fe7d0ac8fc171045be623aba3e2a8f613f8682731f9153bb2e40ece16b9bbab", size = 17165, upload-time = "2024-07-29T01:09:56.435Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/27/83/859ecdd180cacc13b1f7e857abf8582a64552ea7a061057a6c716e790fce/sphinxcontrib_qthelp-2.0.0-py3-none-any.whl", hash = "sha256:b18a828cdba941ccd6ee8445dbe72ffa3ef8cbe7505d8cd1fa0d42d3f2d5f3eb", size = 88743, upload-time = "2024-07-29T01:09:54.885Z" },
+]
+
+[[package]]
+name = "sphinxcontrib-serializinghtml"
+version = "2.0.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/3b/44/6716b257b0aa6bfd51a1b31665d1c205fb12cb5ad56de752dfa15657de2f/sphinxcontrib_serializinghtml-2.0.0.tar.gz", hash = "sha256:e9d912827f872c029017a53f0ef2180b327c3f7fd23c87229f7a8e8b70031d4d", size = 16080, upload-time = "2024-07-29T01:10:09.332Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/52/a7/d2782e4e3f77c8450f727ba74a8f12756d5ba823d81b941f1b04da9d033a/sphinxcontrib_serializinghtml-2.0.0-py3-none-any.whl", hash = "sha256:6e2cb0eef194e10c27ec0023bfeb25badbbb5868244cf5bc5bdc04e4464bf331", size = 92072, upload-time = "2024-07-29T01:10:08.203Z" },
+]
+
+[[package]]
+name = "tomli"
+version = "2.2.1"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/18/87/302344fed471e44a87289cf4967697d07e532f2421fdaf868a303cbae4ff/tomli-2.2.1.tar.gz", hash = "sha256:cd45e1dc79c835ce60f7404ec8119f2eb06d38b1deba146f07ced3bbc44505ff", size = 17175, upload-time = "2024-11-27T22:38:36.873Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/43/ca/75707e6efa2b37c77dadb324ae7d9571cb424e61ea73fad7c56c2d14527f/tomli-2.2.1-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:678e4fa69e4575eb77d103de3df8a895e1591b48e740211bd1067378c69e8249", size = 131077, upload-time = "2024-11-27T22:37:54.956Z" },
+    { url = "https://files.pythonhosted.org/packages/c7/16/51ae563a8615d472fdbffc43a3f3d46588c264ac4f024f63f01283becfbb/tomli-2.2.1-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:023aa114dd824ade0100497eb2318602af309e5a55595f76b626d6d9f3b7b0a6", size = 123429, upload-time = "2024-11-27T22:37:56.698Z" },
+    { url = "https://files.pythonhosted.org/packages/f1/dd/4f6cd1e7b160041db83c694abc78e100473c15d54620083dbd5aae7b990e/tomli-2.2.1-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:ece47d672db52ac607a3d9599a9d48dcb2f2f735c6c2d1f34130085bb12b112a", size = 226067, upload-time = "2024-11-27T22:37:57.63Z" },
+    { url = "https://files.pythonhosted.org/packages/a9/6b/c54ede5dc70d648cc6361eaf429304b02f2871a345bbdd51e993d6cdf550/tomli-2.2.1-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:6972ca9c9cc9f0acaa56a8ca1ff51e7af152a9f87fb64623e31d5c83700080ee", size = 236030, upload-time = "2024-11-27T22:37:59.344Z" },
+    { url = "https://files.pythonhosted.org/packages/1f/47/999514fa49cfaf7a92c805a86c3c43f4215621855d151b61c602abb38091/tomli-2.2.1-cp311-cp311-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:c954d2250168d28797dd4e3ac5cf812a406cd5a92674ee4c8f123c889786aa8e", size = 240898, upload-time = "2024-11-27T22:38:00.429Z" },
+    { url = "https://files.pythonhosted.org/packages/73/41/0a01279a7ae09ee1573b423318e7934674ce06eb33f50936655071d81a24/tomli-2.2.1-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:8dd28b3e155b80f4d54beb40a441d366adcfe740969820caf156c019fb5c7ec4", size = 229894, upload-time = "2024-11-27T22:38:02.094Z" },
+    { url = "https://files.pythonhosted.org/packages/55/18/5d8bc5b0a0362311ce4d18830a5d28943667599a60d20118074ea1b01bb7/tomli-2.2.1-cp311-cp311-musllinux_1_2_i686.whl", hash = "sha256:e59e304978767a54663af13c07b3d1af22ddee3bb2fb0618ca1593e4f593a106", size = 245319, upload-time = "2024-11-27T22:38:03.206Z" },
+    { url = "https://files.pythonhosted.org/packages/92/a3/7ade0576d17f3cdf5ff44d61390d4b3febb8a9fc2b480c75c47ea048c646/tomli-2.2.1-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:33580bccab0338d00994d7f16f4c4ec25b776af3ffaac1ed74e0b3fc95e885a8", size = 238273, upload-time = "2024-11-27T22:38:04.217Z" },
+    { url = "https://files.pythonhosted.org/packages/72/6f/fa64ef058ac1446a1e51110c375339b3ec6be245af9d14c87c4a6412dd32/tomli-2.2.1-cp311-cp311-win32.whl", hash = "sha256:465af0e0875402f1d226519c9904f37254b3045fc5084697cefb9bdde1ff99ff", size = 98310, upload-time = "2024-11-27T22:38:05.908Z" },
+    { url = "https://files.pythonhosted.org/packages/6a/1c/4a2dcde4a51b81be3530565e92eda625d94dafb46dbeb15069df4caffc34/tomli-2.2.1-cp311-cp311-win_amd64.whl", hash = "sha256:2d0f2fdd22b02c6d81637a3c95f8cd77f995846af7414c5c4b8d0545afa1bc4b", size = 108309, upload-time = "2024-11-27T22:38:06.812Z" },
+    { url = "https://files.pythonhosted.org/packages/52/e1/f8af4c2fcde17500422858155aeb0d7e93477a0d59a98e56cbfe75070fd0/tomli-2.2.1-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:4a8f6e44de52d5e6c657c9fe83b562f5f4256d8ebbfe4ff922c495620a7f6cea", size = 132762, upload-time = "2024-11-27T22:38:07.731Z" },
+    { url = "https://files.pythonhosted.org/packages/03/b8/152c68bb84fc00396b83e7bbddd5ec0bd3dd409db4195e2a9b3e398ad2e3/tomli-2.2.1-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:8d57ca8095a641b8237d5b079147646153d22552f1c637fd3ba7f4b0b29167a8", size = 123453, upload-time = "2024-11-27T22:38:09.384Z" },
+    { url = "https://files.pythonhosted.org/packages/c8/d6/fc9267af9166f79ac528ff7e8c55c8181ded34eb4b0e93daa767b8841573/tomli-2.2.1-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:4e340144ad7ae1533cb897d406382b4b6fede8890a03738ff1683af800d54192", size = 233486, upload-time = "2024-11-27T22:38:10.329Z" },
+    { url = "https://files.pythonhosted.org/packages/5c/51/51c3f2884d7bab89af25f678447ea7d297b53b5a3b5730a7cb2ef6069f07/tomli-2.2.1-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:db2b95f9de79181805df90bedc5a5ab4c165e6ec3fe99f970d0e302f384ad222", size = 242349, upload-time = "2024-11-27T22:38:11.443Z" },
+    { url = "https://files.pythonhosted.org/packages/ab/df/bfa89627d13a5cc22402e441e8a931ef2108403db390ff3345c05253935e/tomli-2.2.1-cp312-cp312-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:40741994320b232529c802f8bc86da4e1aa9f413db394617b9a256ae0f9a7f77", size = 252159, upload-time = "2024-11-27T22:38:13.099Z" },
+    { url = "https://files.pythonhosted.org/packages/9e/6e/fa2b916dced65763a5168c6ccb91066f7639bdc88b48adda990db10c8c0b/tomli-2.2.1-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:400e720fe168c0f8521520190686ef8ef033fb19fc493da09779e592861b78c6", size = 237243, upload-time = "2024-11-27T22:38:14.766Z" },
+    { url = "https://files.pythonhosted.org/packages/b4/04/885d3b1f650e1153cbb93a6a9782c58a972b94ea4483ae4ac5cedd5e4a09/tomli-2.2.1-cp312-cp312-musllinux_1_2_i686.whl", hash = "sha256:02abe224de6ae62c19f090f68da4e27b10af2b93213d36cf44e6e1c5abd19fdd", size = 259645, upload-time = "2024-11-27T22:38:15.843Z" },
+    { url = "https://files.pythonhosted.org/packages/9c/de/6b432d66e986e501586da298e28ebeefd3edc2c780f3ad73d22566034239/tomli-2.2.1-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:b82ebccc8c8a36f2094e969560a1b836758481f3dc360ce9a3277c65f374285e", size = 244584, upload-time = "2024-11-27T22:38:17.645Z" },
+    { url = "https://files.pythonhosted.org/packages/1c/9a/47c0449b98e6e7d1be6cbac02f93dd79003234ddc4aaab6ba07a9a7482e2/tomli-2.2.1-cp312-cp312-win32.whl", hash = "sha256:889f80ef92701b9dbb224e49ec87c645ce5df3fa2cc548664eb8a25e03127a98", size = 98875, upload-time = "2024-11-27T22:38:19.159Z" },
+    { url = "https://files.pythonhosted.org/packages/ef/60/9b9638f081c6f1261e2688bd487625cd1e660d0a85bd469e91d8db969734/tomli-2.2.1-cp312-cp312-win_amd64.whl", hash = "sha256:7fc04e92e1d624a4a63c76474610238576942d6b8950a2d7f908a340494e67e4", size = 109418, upload-time = "2024-11-27T22:38:20.064Z" },
+    { url = "https://files.pythonhosted.org/packages/04/90/2ee5f2e0362cb8a0b6499dc44f4d7d48f8fff06d28ba46e6f1eaa61a1388/tomli-2.2.1-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:f4039b9cbc3048b2416cc57ab3bda989a6fcf9b36cf8937f01a6e731b64f80d7", size = 132708, upload-time = "2024-11-27T22:38:21.659Z" },
+    { url = "https://files.pythonhosted.org/packages/c0/ec/46b4108816de6b385141f082ba99e315501ccd0a2ea23db4a100dd3990ea/tomli-2.2.1-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:286f0ca2ffeeb5b9bd4fcc8d6c330534323ec51b2f52da063b11c502da16f30c", size = 123582, upload-time = "2024-11-27T22:38:22.693Z" },
+    { url = "https://files.pythonhosted.org/packages/a0/bd/b470466d0137b37b68d24556c38a0cc819e8febe392d5b199dcd7f578365/tomli-2.2.1-cp313-cp313-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:a92ef1a44547e894e2a17d24e7557a5e85a9e1d0048b0b5e7541f76c5032cb13", size = 232543, upload-time = "2024-11-27T22:38:24.367Z" },
+    { url = "https://files.pythonhosted.org/packages/d9/e5/82e80ff3b751373f7cead2815bcbe2d51c895b3c990686741a8e56ec42ab/tomli-2.2.1-cp313-cp313-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:9316dc65bed1684c9a98ee68759ceaed29d229e985297003e494aa825ebb0281", size = 241691, upload-time = "2024-11-27T22:38:26.081Z" },
+    { url = "https://files.pythonhosted.org/packages/05/7e/2a110bc2713557d6a1bfb06af23dd01e7dde52b6ee7dadc589868f9abfac/tomli-2.2.1-cp313-cp313-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:e85e99945e688e32d5a35c1ff38ed0b3f41f43fad8df0bdf79f72b2ba7bc5272", size = 251170, upload-time = "2024-11-27T22:38:27.921Z" },
+    { url = "https://files.pythonhosted.org/packages/64/7b/22d713946efe00e0adbcdfd6d1aa119ae03fd0b60ebed51ebb3fa9f5a2e5/tomli-2.2.1-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:ac065718db92ca818f8d6141b5f66369833d4a80a9d74435a268c52bdfa73140", size = 236530, upload-time = "2024-11-27T22:38:29.591Z" },
+    { url = "https://files.pythonhosted.org/packages/38/31/3a76f67da4b0cf37b742ca76beaf819dca0ebef26d78fc794a576e08accf/tomli-2.2.1-cp313-cp313-musllinux_1_2_i686.whl", hash = "sha256:d920f33822747519673ee656a4b6ac33e382eca9d331c87770faa3eef562aeb2", size = 258666, upload-time = "2024-11-27T22:38:30.639Z" },
+    { url = "https://files.pythonhosted.org/packages/07/10/5af1293da642aded87e8a988753945d0cf7e00a9452d3911dd3bb354c9e2/tomli-2.2.1-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:a198f10c4d1b1375d7687bc25294306e551bf1abfa4eace6650070a5c1ae2744", size = 243954, upload-time = "2024-11-27T22:38:31.702Z" },
+    { url = "https://files.pythonhosted.org/packages/5b/b9/1ed31d167be802da0fc95020d04cd27b7d7065cc6fbefdd2f9186f60d7bd/tomli-2.2.1-cp313-cp313-win32.whl", hash = "sha256:d3f5614314d758649ab2ab3a62d4f2004c825922f9e370b29416484086b264ec", size = 98724, upload-time = "2024-11-27T22:38:32.837Z" },
+    { url = "https://files.pythonhosted.org/packages/c7/32/b0963458706accd9afcfeb867c0f9175a741bf7b19cd424230714d722198/tomli-2.2.1-cp313-cp313-win_amd64.whl", hash = "sha256:a38aa0308e754b0e3c67e344754dff64999ff9b513e691d0e786265c93583c69", size = 109383, upload-time = "2024-11-27T22:38:34.455Z" },
+    { url = "https://files.pythonhosted.org/packages/6e/c2/61d3e0f47e2b74ef40a68b9e6ad5984f6241a942f7cd3bbfbdbd03861ea9/tomli-2.2.1-py3-none-any.whl", hash = "sha256:cb55c73c5f4408779d0cf3eef9f762b9c9f147a77de7b258bef0a5628adc85cc", size = 14257, upload-time = "2024-11-27T22:38:35.385Z" },
+]
+
+[[package]]
+name = "typing-extensions"
+version = "4.14.1"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/98/5a/da40306b885cc8c09109dc2e1abd358d5684b1425678151cdaed4731c822/typing_extensions-4.14.1.tar.gz", hash = "sha256:38b39f4aeeab64884ce9f74c94263ef78f3c22467c8724005483154c26648d36", size = 107673, upload-time = "2025-07-04T13:28:34.16Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/b5/00/d631e67a838026495268c2f6884f3711a15a9a2a96cd244fdaea53b823fb/typing_extensions-4.14.1-py3-none-any.whl", hash = "sha256:d1e1e3b58374dc93031d6eda2420a48ea44a36c2b4766a4fdeb3710755731d76", size = 43906, upload-time = "2025-07-04T13:28:32.743Z" },
+]
+
+[[package]]
+name = "typing-inspection"
+version = "0.4.1"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "typing-extensions" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/f8/b1/0c11f5058406b3af7609f121aaa6b609744687f1d158b3c3a5bf4cc94238/typing_inspection-0.4.1.tar.gz", hash = "sha256:6ae134cc0203c33377d43188d4064e9b357dba58cff3185f22924610e70a9d28", size = 75726, upload-time = "2025-05-21T18:55:23.885Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/17/69/cd203477f944c353c31bade965f880aa1061fd6bf05ded0726ca845b6ff7/typing_inspection-0.4.1-py3-none-any.whl", hash = "sha256:389055682238f53b04f7badcb49b989835495a96700ced5dab2d8feae4b26f51", size = 14552, upload-time = "2025-05-21T18:55:22.152Z" },
+]
+
+[[package]]
+name = "urllib3"
+version = "2.5.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/15/22/9ee70a2574a4f4599c47dd506532914ce044817c7752a79b6a51286319bc/urllib3-2.5.0.tar.gz", hash = "sha256:3fc47733c7e419d4bc3f6b3dc2b4f890bb743906a30d56ba4a5bfa4bbff92760", size = 393185, upload-time = "2025-06-18T14:07:41.644Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/a7/c2/fe1e52489ae3122415c51f387e221dd0773709bad6c6cdaa599e8a2c5185/urllib3-2.5.0-py3-none-any.whl", hash = "sha256:e6b01673c0fa6a13e374b50871808eb3bf7046c4b125b216f6bf1cc604cff0dc", size = 129795, upload-time = "2025-06-18T14:07:40.39Z" },
+]
+
+[[package]]
+name = "yamlloader"
+version = "1.5.1"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/6f/6b/7f094b4d9009794cb69dea18c99bdee4e62b4e0ee69bb19128178191f18a/yamlloader-1.5.1.tar.gz", hash = "sha256:8dece19b050acb1c6a8ca14aa30793388f9be154f734b826541f9a1828d41cec", size = 77157, upload-time = "2025-01-01T17:31:36.453Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/68/0f/28323a9c418403cd4080d1736873c354bf058ad34306be5ff58639dcaedd/yamlloader-1.5.1-py3-none-any.whl", hash = "sha256:610014b14e25d7328d69f6526524d4616a552561f4c1b919f1282695bc1f4a11", size = 7684, upload-time = "2025-01-01T17:31:33.627Z" },
+]
