PYTHON-5573 Require dnspython 2.6.1+ (#2559)

.github/workflows/test-python.yml

@@ -225,7 +225,7 @@ jobs:
       permissions:
         contents: read
       runs-on: ubuntu-latest
-      name: Test using minimum dependencies and supported Python
+      name: Test minimum dependencies and Python
       steps:
         - uses: actions/checkout@v5
           with:
@@ -238,37 +238,10 @@ jobs:
           uses: mongodb-labs/drivers-evergreen-tools@master
           with:
             version: "8.0"
-        # Async and our test_dns do not support dnspython 1.X, so we don't run async or dns tests here
         - name: Run tests
           shell: bash
           run: |
             uv venv
             source .venv/bin/activate
-            uv pip install -e ".[test]" --resolution=lowest-direct
-            pytest -v test/test_srv_polling.py
-
-  test_minimum_for_async:
-      permissions:
-        contents: read
-      runs-on: ubuntu-latest
-      name: Test async's minimum dependencies and Python
-      steps:
-        - uses: actions/checkout@v5
-          with:
-            persist-credentials: false
-        - name: Install uv
-          uses: astral-sh/setup-uv@b75a909f75acd358c2196fb9a5f1299a9a8868a4 # v5
-          with:
-            python-version: '3.9'
-        - id: setup-mongodb
-          uses: mongodb-labs/drivers-evergreen-tools@master
-          with:
-            version: "8.0"
-        # The lifetime kwarg we use in srv resolution was added to the async resolver API in dnspython 2.1.0
-        - name: Run tests
-          shell: bash
-          run: |
-            uv venv
-            source .venv/bin/activate
-            uv pip install -e ".[test]" --resolution=lowest-direct dnspython==2.1.0 --force-reinstall
+            uv pip install -e ".[test]" --resolution=lowest-direct --force-reinstall
             pytest -v test/test_srv_polling.py test/test_dns.py test/asynchronous/test_srv_polling.py test/asynchronous/test_dns.py

doc/changelog.rst

@@ -9,6 +9,8 @@ PyMongo 4.16 brings a number of changes including:
 - Removed invalid documents from :class:`bson.errors.InvalidDocument` error messages as
   doing so may leak sensitive user data.
   Instead, invalid documents are stored in :attr:`bson.errors.InvalidDocument.document`.
+- PyMongo now requires ``dnspython>=2.6.1``, since ``dnspython`` 1.0 is no longer maintained and is incompatible with
+  Python 3.10+.  The minimum version is ``2.6.1`` to account for `CVE-2023-29483 <https://www.cve.org/CVERecord?id=CVE-2023-29483>`_.
 - Removed support for Eventlet.
   Eventlet is actively being sunset by its maintainers and has compatibility issues with PyMongo's dnspython dependency.
 

pymongo/asynchronous/srv_resolver.py

@@ -58,20 +58,11 @@ async def _resolve(*args: Any, **kwargs: Any) -> resolver.Answer:
     if _IS_SYNC:
         from dns import resolver
 
-        if hasattr(resolver, "resolve"):
-            # dnspython >= 2
-            return resolver.resolve(*args, **kwargs)
-        # dnspython 1.X
-        return resolver.query(*args, **kwargs)
+        return resolver.resolve(*args, **kwargs)
     else:
         from dns import asyncresolver
 
-        if hasattr(asyncresolver, "resolve"):
-            # dnspython >= 2
-            return await asyncresolver.resolve(*args, **kwargs)  # type:ignore[return-value]
-        raise ConfigurationError(
-            "Upgrade to dnspython version >= 2.0 to use AsyncMongoClient with mongodb+srv:// connections."
-        )
+        return await asyncresolver.resolve(*args, **kwargs)  # type:ignore[return-value]
 
 
 _INVALID_HOST_MSG = (

pymongo/synchronous/srv_resolver.py

@@ -58,20 +58,11 @@ def _resolve(*args: Any, **kwargs: Any) -> resolver.Answer:
     if _IS_SYNC:
         from dns import resolver
 
-        if hasattr(resolver, "resolve"):
-            # dnspython >= 2
-            return resolver.resolve(*args, **kwargs)
-        # dnspython 1.X
-        return resolver.query(*args, **kwargs)
+        return resolver.resolve(*args, **kwargs)
     else:
         from dns import asyncresolver
 
-        if hasattr(asyncresolver, "resolve"):
-            # dnspython >= 2
-            return asyncresolver.resolve(*args, **kwargs)  # type:ignore[return-value]
-        raise ConfigurationError(
-            "Upgrade to dnspython version >= 2.0 to use MongoClient with mongodb+srv:// connections."
-        )
+        return asyncresolver.resolve(*args, **kwargs)  # type:ignore[return-value]
 
 
 _INVALID_HOST_MSG = (

requirements.txt

@@ -1 +1 @@
-dnspython>=1.16.0,<3.0.0
+dnspython>=2.6.1,<3.0.0

uv.lock

@@ -1224,7 +1224,7 @@ requires-dist = [
     { name = "certifi", marker = "(os_name == 'nt' and extra == 'encryption') or (sys_platform == 'darwin' and extra == 'encryption')", specifier = ">=2023.7.22" },
     { name = "certifi", marker = "(os_name == 'nt' and extra == 'ocsp') or (sys_platform == 'darwin' and extra == 'ocsp')", specifier = ">=2023.7.22" },
     { name = "cryptography", marker = "extra == 'ocsp'", specifier = ">=2.5" },
-    { name = "dnspython", specifier = ">=1.16.0,<3.0.0" },
+    { name = "dnspython", specifier = ">=2.6.1,<3.0.0" },
     { name = "furo", marker = "extra == 'docs'", specifier = "==2025.7.19" },
     { name = "importlib-metadata", marker = "python_full_version < '3.13' and extra == 'test'", specifier = ">=7.0" },
     { name = "pykerberos", marker = "os_name != 'nt' and extra == 'gssapi'" },