Exclude CODEOWNERS from language statistics

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Alexey Palazhchenko <alexey.palazhchenko@ferretdb.io>

.dockerignore

@@ -14,4 +14,5 @@
 !.gitignore
 
 # additional files for Docker images
-!build/docker
+!build/ferretdb
+!build/postgres-documentdb

.editorconfig

@@ -0,0 +1,9 @@
+# https://editorconfig.org
+
+root = true
+
+[*]
+end_of_line = lf
+trim_trailing_whitespace = true
+insert_final_newline = true
+charset = utf-8

.gitattributes

@@ -2,3 +2,9 @@
 *.jpg filter=lfs diff=lfs merge=lfs -text
 *.png filter=lfs diff=lfs merge=lfs -text
 *.webp filter=lfs diff=lfs merge=lfs -text
+*.gif filter=lfs diff=lfs merge=lfs -text
+
+*.pdf filter=lfs diff=lfs merge=lfs -text
+
+*.go diff=golang
+.gitea/CODEOWNERS linguist-detectable=false

.gitea/CODEOWNERS

@@ -0,0 +1,3 @@
+# Pull requests request review from the eligible staff team(s).
+# One approval from either an Admin or Developer satisfies branch protection.
+*   @trueog/Admins @trueog/Developers

.github/CODEOWNERS

@@ -1,22 +1,10 @@
 # https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners
-# Order is important; the last matching pattern takes the most precedence.
+# Order is important; the last matching pattern has the highest precedence.
 
-*                           @AlekSi
+*               @AlekSi @chilagrow
 
-/cmd/                       @FerretDB/leads
-/ferretdb/                  @FerretDB/leads
-/integration/               @FerretDB/leads
-/internal/                  @FerretDB/leads
-
-/internal/backends/         @AlekSi
-/internal/handlers/hana/    @AlekSi
+/website/       @AlekSi @Fashander
 
 # @AlekSi for engineering, @ptrfarkas for marketing.
 # See also Mergify configuration.
-/website/                   @AlekSi @ptrfarkas
-
-/build/                     @AlekSi
-/build/legacy-mongo-shell/  @FerretDB/specops
-
-go.mod                      @AlekSi
-go.sum                      @AlekSi
+/website/blog/  @AlekSi @ptrfarkas

.github/ISSUE_TEMPLATE/bug.yml

@@ -14,18 +14,14 @@ body:
   - type: textarea
     id: version
     attributes:
-      label: FerretDB version
+      label: FerretDB, PostgreSQL, and DocumentDB versions
       description: >
-        What version and package of FerretDB do you use?
-        Please provide an output of running FerretDB with [`--version` flag](https://docs.ferretdb.io/configuration/flags/).
-    validations:
-      required: true
-  - type: input
-    id: backend
-    attributes:
-      label: Backend
-      description: >
-        What backend (PostgreSQL, etc) and what version do you use?
+        Please add the output of the `serverStatus` command.
+      value: |
+        ```json
+        {
+        }
+        ```
     validations:
       required: true
   - type: textarea
@@ -33,13 +29,13 @@ body:
       label: Environment
       description: |
         For example:
-          - **OS**: Ubuntu 22.04 x86_64
-          - **Deployment**: Docker using `ghcr.io/ferretdb/ferretdb:1.0.0` image
-          - **Deployment details**: Docker version 23.0.5
+          - **OS**: Ubuntu 24.04 x86_64
+          - **Deployment**: Docker using `ghcr.io/ferretdb/ferretdb:2` image
+          - **Deployment details**: Docker version 27.3.1
       value: |
-        - OS:
-        - Deployment:
-        - Deployment details:
+        - **OS**:
+        - **Deployment**:
+        - **Deployment details**:
     validations:
       required: true
   - type: textarea
@@ -65,6 +61,6 @@ body:
     attributes:
       label: What did you see instead?
       description: >
-        Please include FerretDB [logs](https://docs.ferretdb.io/configuration/logging/).
+        Please include FerretDB [logs](https://docs.ferretdb.io/configuration/observability/).
     validations:
       required: true

.github/ISSUE_TEMPLATE/chore.yml

@@ -30,11 +30,11 @@ body:
       label: Definition of Done
       description: What should be done to consider this issue done? List everything that applies.
       value: |
-        - all handlers updated;
+        - handler updated;
         - unit tests added/updated;
         - integration/compatibility tests added/updated;
         - spot refactorings done;
-        - user documentation updated or an issue to create documentation created;
+        - user documentation updated (or an issue to create documentation created);
         - something else?
     validations:
       required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -4,7 +4,7 @@
 blank_issues_enabled: false
 contact_links:
   - name: Quick question
-    url: https://join.slack.com/t/ferretdb/shared_invite/zt-zqe9hj8g-ZcMG3~5Cs5u9uuOPnZB8~A
+    url: https://slack.ferretdb.io/
     about: Please join our Slack chat.
   - name: General question or discussion
     url: https://github.com/FerretDB/FerretDB/discussions/categories/general

.github/PROCESS.md

@@ -6,56 +6,17 @@ We will do all that for you so you can focus on what is really interesting for y
 
 This guide tries to be short and does not mention things that are completely automated by our tooling.
 
-## Team performance and planning
+## Showing progress
 
-We want to deliver fast and make our deliverables predictable.
-To achieve that, we measure the flow of work and estimate tasks.
-The flow of work is measured automatically based on GitHub's pull request workflow.
-Tasks are estimated manually by engineers before or during Sprint planning.
+We want our work to be visible and transparent.
+This way we can help each other and make sure that we are on the right track.
+To uphold these principles, we agree to make results of our daily work available for others through various means
+such as pushed commits, updated pull requests, code reviews, created issues, or any other relevant method.
 
-Task estimation depends on the following parameters:
+### Community
 
-- Scope.
-  Are the changes required in one or multiple files, packages, components?
-- Difficulty.
-  How hard is the task?
-  Does it require to cover a lot of test cases?
-  edge cases?
-- Clarity.
-  Are the description and definition of done clear?
-  Or that's more of a research task?
-
-We use the following T-Shirt Sizes to estimate tasks:
-
-- **S**: Small simple clear task.
-- **M**: Only one parameter can be changed compared to **S** (e.g. a small but not completely clear task).
-- **L**: Two parameters can be changed compared to **S** (e.g. clear but big and somewhat complex task).
-
-If the team thinks that the task is bigger than **L**, it should be decomposed into smaller tasks.
-
-Unless the issue explicitly states otherwise, the following things are always in the scope:
-
-- All handlers.
-- Tests.
-  See contributing documentation for general discussion about unit and integration tests.
-- Small spot refactorings.
-  Larger refactorings should be in a separate issue with minimal behavior changes.
-- Minor updates to existing documentation.
-  Completely new documentation should be in a separate issue.
-
-Words "small", "spot", "larger", "minimal", "minor" and similar are defined to be not clearly defined.
-As always, use your best judgment and communicate (preferably on the planning).
-
-Engineering tasks could be added to the Sprint only if there are no other pre-planned tasks that are not done
-or could not benefit from more help.
-Those tasks should not be estimated.
-
-After every Sprint, we calculate how many tasks of each size we were able to complete
-and discuss what went well and what could be improved.
-We also look at the flows' metrics to gather more information about the team's dynamic.
-
-Estimation mistakes should be an exception, not a norm.
-Try to estimate on the planning as best as you can.
+We expect issues picked up by the community to be done in about two weeks.
+After about a week of inactivity, we should ping contributors.
 
 ## Pull requests
 
@@ -66,24 +27,25 @@ please follow these notes below when you working with pull request:
 1. Send pull requests from forks; do not make personal branches in the main repository.
    This way, we are similar to community members and could notice similar problems that we could fix for everyone,
    not just for us.
-2. Pull request **title** should be accurate and descriptive as it is used in the generated changelog.
+2. Pull request title should be accurate and descriptive
+   as it is used in the generated [changelog](../CHANGELOG.md) as is.
    It generally should start with imperative verb ("Fix …", not "Fixing …", "Fixed …" or other forms).
+   It should not have a prefix ("Fix …", not "Fix: …") (we use labels for categorization).
    It should not mention the issue number.
-3. We provide a pull requests template that includes suggestions and readiness checklist.
-   Please use it.
-4. It is fine to send several sequential pull requests for one issue to make them easier to review.
+3. It is fine to send several sequential pull requests for one issue to make them easier to review.
    In that case, please still use the `Closes` word as described in [CONTRIBUTING.md](../CONTRIBUTING.md)
    (because [words like "refs" do not link PR to the issue](https://docs.github.com/en/issues/tracking-your-work-with-issues/linking-a-pull-request-to-an-issue#linking-a-pull-request-to-an-issue-using-a-keyword)),
    but don't forget to reopen the issue once PR is merged,
    but the issue as a whole is not done.
-5. (This point is for FerretDB Inc. engineers only.)
-   Please create a draft pull request as soon as you start working on an issue; that is needed for our process tooling.
+4. Please create a draft pull request as soon as you start working on an issue; that is needed for our process tooling.
    Once it is ready for review, please mark it as such.
    After that, there is no need to switch between draft and non-draft states.
-6. Pull requests should be merged by an auto-merge that the author should enable.
+5. Pull requests should be merged by an auto-merge that the author should enable.
    If the pull request is not ready to be merged for some reason (but ready to be reviewed as usual),
    the description should explain why, and the `do not merge` label should be applied.
    Even in that case, auto-merge should still be enabled by the author.
+6. Autogenerated GitHub's squash commit's body should be manually replaced by `Closes #<issue_number>.`
+   with optional [trailers for co-authors](https://docs.github.com/en/pull-requests/committing-changes-to-your-project/creating-and-editing-commits/creating-a-commit-with-multiple-authors).
 7. Ultimately, the author is responsible for doing everything to ensure that the pull request is merged and done.
 
 One can see all pull requests that await review [there](https://github.com/pulls/review-requested?q=user%3AFerretDB+is%3Aopen).
@@ -94,10 +56,22 @@ talk with [@GitHub bot in direct messages](https://ferretdb.slack.com/archives/D
 to link your Slack and GitHub identities,
 and then configure notification only for your name.
 
+### Test scripts
+
+Pull requests that add temporary `test.js` test scripts have slightly different rules:
+
+1. The title should start with "Add test script for".
+2. The descriptions of both PR and issue should link to each other.
+3. Commits must change only the `test.js` file.
+
+Once PR with a test script is sent and verified by someone else, it is closed.
+Once the linked issue is resolved, the PR should be reopened and merged with `main` to confirm that the test script pass now.
+Then it should be closed again.
+
 ## Creating issues
 
 1. Please use `Chore` type instead of `Enhancement` or `Feature` (but not `Bug`)
    because its template is much more useful
    (but may be too daunting for regular users, that's why templates for enhancements and features are much simpler).
    After creating an issue, please change its type (label) manually.
-2. Do not change automatically applied labels, assignees, or projects.
+2. Do not change other automatically applied labels, assignees, or projects.

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,27 +1,31 @@
+<!--
+Please remove comments like this one, but keep and use the rest of the template.
+See CONTRIBUTING.md for details.
+-->
+
 # Description
 
-Closes #{issue_number}.
-
 <!--
-    Write a short description to explain changes that are not mentioned in the initial issue.
-    What were the reasons for those changes?
-    Which decisions did you make and why?
-    What else should reviewers know about your changes?
+Write a short description to explain changes that are not mentioned in the initial issue.
+What were the reasons for those changes?
+Which decisions did you make and why?
+What else should reviewers know about your changes?
 -->
 
+<!-- Replace <issue_number> with an actual issue number. -->
+
+Closes #<issue_number>.
+
 ## Readiness checklist
 
-<!--
-    If you want your changes to be merged quickly,
-    please follow CONTRIBUTING.md.
--->
+<!-- Please check all items in this checklist that were done. -->
 
-- [ ] I added/updated unit tests.
-- [ ] I added/updated integration/compatibility tests.
+- [ ] I added/updated unit tests (and they pass).
+- [ ] I added/updated integration/compatibility tests (and they pass).
 - [ ] I added/updated comments and checked rendering.
 - [ ] I made spot refactorings.
 - [ ] I updated user documentation.
 - [ ] I ran `task all`, and it passed.
 - [ ] I ensured that PR title is good enough for the changelog.
-- [ ] (for maintainers only) I set Reviewers ([`@FerretDB/core`](https://github.com/orgs/FerretDB/teams/core)), Labels, Project and project's Sprint fields.
+- [ ] (for maintainers only) I set Reviewers ([`@FerretDB/core`](https://github.com/orgs/FerretDB/teams/core)), Milestone (`Next`), Labels, Project and project's Sprint fields.
 - [ ] I marked all done items in this checklist.

.github/RELEASE_CHECKLIST.md

@@ -2,18 +2,30 @@
 
 ## Preparation
 
-1. Check tests, linters.
-2. Check issues and pull requests, update milestones and labels.
-3. Check if there are breaking changes or anything that should be reflected in the changelog and/or user documentation.
-4. Create draft release on GitHub with autogenerated release notes.
-5. Tweak generated release notes:
-   - Ensure that "This section should be empty" section does not exist.
-   - Add "All closed issues and pull requests" and "All commits", remove "Full Changelog".
-   - Tweak spacing, headers levels.
-6. Update CHANGELOG.md with the same release notes:
-   - Check spacing, header levels.
-   - Run `task docs-fmt`.
-7. Commit and push changes, check `git status`.
+1. [Release DocumentDB](https://github.com/FerretDB/documentdb/blob/ferretdb/.github/RELEASE_CHECKLIST.md).
+2. Update DocumentDB image tags to point to release in:
+   - [eval image](../build/ferretdb/eval.Dockerfile);
+   - [eval-dev image](../build/ferretdb/eval-dev.Dockerfile);
+   - [local image](../build/deps/postgres-documentdb.Dockerfile);
+   - [bw image](../build/ferretdb-bw/Dockerfile).
+3. Update constants in [`documentdb.go`](../build/version/documentdb.go).
+4. Check DocumentDB images/tags in documentation (where we specify full tags).
+5. Re-run tests, linters.
+6. Check issues and pull requests, update milestones and labels.
+7. Check if there are breaking changes or anything that should be reflected in the changelog and/or user documentation.
+8. Create draft release on GitHub with autogenerated release notes.
+9. Update CHANGELOG.md:
+   - Run `task changelog PREV=vX.Y.Z NEXT=vX.Y.Z` to generate release changelog for the given milestone.
+   - Check warnings, copy output to the `CHANGELOG.md` file.
+   - Sort items within sections according to importance if needed.
+   - Add first-time contributor credits if any (copy this data from the release draft).
+   - Add link to DocumentDB release page.
+10. Run `task docs-version VERSION=X.Y`.
+    Update `versions` and `createRedirects` in `docusaurus.config.js`.
+    Remove the oldest version from `versioned_docs`, `versioned_sidebars`, `versions.json`.
+11. Run `task docs`.
+12. Commit and push changes to the PR.
+13. Merge PR, pull and check `git status`.
 
 ## Git tag
 
@@ -21,29 +33,39 @@
 2. Check `task gen-version; git status` output.
 3. Push it!
 4. Refresh
-   - `env GOPROXY=https://proxy.golang.org go mod download -x github.com/FerretDB/FerretDB@<tag>`
-   - `https://pkg.go.dev/github.com/FerretDB/FerretDB@<tag>` from <https://pkg.go.dev/github.com/FerretDB/FerretDB?tab=versions>
+   - `env GOPROXY=https://proxy.golang.org go mod download -x github.com/FerretDB/FerretDB/v2@<vX.Y.Z>`
+   - `https://pkg.go.dev/github.com/FerretDB/FerretDB/v2@<vX.Y.Z>` from https://pkg.go.dev/github.com/FerretDB/FerretDB/v2?tab=versions.
 
 ## Release
 
-1. Wait for the [packages CI build](https://github.com/FerretDB/FerretDB/actions/workflows/packages.yml?query=event%3Apush)
+1. Copy release notes from `CHANGELOG.md` and trim them.
+2. Wait for the [packages CI build](https://github.com/FerretDB/FerretDB/actions/workflows/packages.yml?query=event%3Apush)
    to finish.
-2. Upload the binary and `.deb` and `.rpm` packages to the draft release.
-3. Check:
-   - <https://hub.docker.com/r/ferretdb/ferretdb/tags>
-   - <https://hub.docker.com/r/ferretdb/ferretdb-dev/tags>
-   - <https://hub.docker.com/r/ferretdb/all-in-one/tags>
-   - <https://github.com/FerretDB/FerretDB/pkgs/container/ferretdb>
-   - <https://github.com/FerretDB/FerretDB/pkgs/container/ferretdb-dev>
-   - <https://github.com/FerretDB/FerretDB/pkgs/container/all-in-one>
-4. Close milestone in issues.
-5. Publish release on GitHub.
-6. Announce it on Slack.
+3. Upload binaries and packages to the draft release.
+4. Check:
+   - https://hub.docker.com/r/ferretdb/ferretdb/tags
+   - https://hub.docker.com/r/ferretdb/ferretdb-dev/tags
+   - https://hub.docker.com/r/ferretdb/ferretdb-eval/tags
+   - https://hub.docker.com/r/ferretdb/ferretdb-eval-dev/tags
+   - https://github.com/FerretDB/FerretDB/pkgs/container/ferretdb
+   - https://github.com/FerretDB/FerretDB/pkgs/container/ferretdb-dev
+   - https://github.com/FerretDB/FerretDB/pkgs/container/ferretdb-eval
+   - https://github.com/FerretDB/FerretDB/pkgs/container/ferretdb-eval-dev
+   - https://quay.io/repository/ferretdb/ferretdb?tab=tags
+   - https://quay.io/repository/ferretdb/ferretdb-dev?tab=tags
+   - https://quay.io/repository/ferretdb/ferretdb-eval?tab=tags
+   - https://quay.io/repository/ferretdb/ferretdb-eval-dev?tab=tags
+5. Close milestone in issues.
+6. Publish release on GitHub.
+7. Announce it on Slack.
 
 ## Soon after
 
-1. Bump the latest version on [Beacon](https://beacon.ferretdb.io).
-2. Publish and announce blog post.
-3. Tweet, toot.
-4. Update NixOS package: <https://github.com/NixOS/nixpkgs/tree/master/pkgs/servers/nosql/ferretdb>.
-5. Update Civo package: <https://github.com/civo/kubernetes-marketplace/tree/master/ferretdb>.
+1. Publish and announce blog post.
+2. Add link to blog post to `CHANGELOG.md` and release page.
+3. Bump the latest version on https://beacon.ferretdb.com and https://beacon.ferretdb.io.
+4. Update DocumentDB images/tags in Dockerfiles to point back to development version.
+5. Update DocumentDB images/tags in the current documentation (where we specify full tags)
+   to point to the next (non-existing) version.
+6. Update URLs with `/refs/tags/` in them in the current documentation
+   to point to the next (non-existing) version.

.github/codecov.yml

@@ -3,7 +3,6 @@
 codecov:
   require_ci_to_pass: true
   notify:
-    after_n_builds: 2 # 1 for unit tests + at least 1 for integration tests
     wait_for_ci: true
 
 # https://docs.codecov.com/docs/coverage-configuration
@@ -31,7 +30,32 @@ flag_management:
 
 # https://docs.codecov.com/docs/pull-request-comments
 comment:
-  layout: reach,diff,files,flags
+  layout: reach,diff,files,flags,components
+
+# https://docs.codecov.com/docs/components
+component_management:
+  default_rules:
+    statuses:
+      - type: project
+        target: auto
+        threshold: 1%
+  individual_components:
+    - component_id: clientconn
+      name: "clientconn"
+      paths:
+        - internal/clientconn/**
+    - component_id: dataapi
+      name: "dataapi"
+      paths:
+        - internal/dataapi/**
+    - component_id: documentdb
+      name: "documentdb"
+      paths:
+        - internal/documentdb/**
+    - component_id: handler
+      name: "handler"
+      paths:
+        - internal/handler/**
 
 # https://docs.codecov.com/docs/github-checks
 # Annotations may be hidden by pressing the "a" key or by unselecting "Show annotations" in the top right of the file.

.github/dependabot.yml

@@ -3,30 +3,82 @@
 # Apply the "not ready" label to prevent cascaded CI runs on each auto-merge.
 
 version: 2
+
+# Most configurations are duplicated to add main-v1 branch.
 updates:
   - package-ecosystem: "github-actions"
     directory: "/"
     labels: ["deps", "not ready"]
     assignees: [AlekSi]
     open-pull-requests-limit: 20
+    groups:
+      github-actions:
+        patterns: ["*"]
+    schedule:
+      interval: "weekly"
+      day: "wednesday"
+      time: "01:42"
+  - package-ecosystem: "github-actions"
+    target-branch: "main-v1"
+    directory: "/"
+    labels: ["deps", "not ready"]
+    assignees: [AlekSi]
+    open-pull-requests-limit: 20
+    groups:
+      github-actions-v1:
+        patterns: ["*"]
     schedule:
       interval: "weekly"
       day: "wednesday"
       time: "01:42"
 
   - package-ecosystem: "docker"
-    directory: "/build/docker"
+    directory: "/build/ferretdb"
     labels: ["deps", "not ready"]
     assignees: [AlekSi]
     open-pull-requests-limit: 20
+    groups:
+      build-docker:
+        patterns: ["*"]
     schedule:
       interval: "weekly"
       day: "wednesday"
       time: "01:42"
+  - package-ecosystem: "docker"
+    target-branch: "main-v1"
+    directory: "/build/ferretdb"
+    labels: ["deps", "not ready"]
+    assignees: [AlekSi]
+    open-pull-requests-limit: 20
+    groups:
+      build-docker-v1:
+        patterns: ["*"]
+    schedule:
+      interval: "weekly"
+      day: "wednesday"
+      time: "01:42"
+
   - package-ecosystem: "docker"
     directory: "/build/deps"
     labels: ["deps", "not ready"]
+    assignees: [AlekSi]
     open-pull-requests-limit: 20
+    groups:
+      build-deps:
+        patterns: ["*"]
+    schedule:
+      interval: "weekly"
+      day: "wednesday"
+      time: "01:42"
+  - package-ecosystem: "docker"
+    target-branch: "main-v1"
+    directory: "/build/deps"
+    labels: ["deps", "not ready"]
+    assignees: [AlekSi]
+    open-pull-requests-limit: 20
+    groups:
+      build-deps-v1:
+        patterns: ["*"]
     schedule:
       interval: "weekly"
       day: "wednesday"
@@ -37,33 +89,125 @@ updates:
     labels: ["deps", "not ready"]
     assignees: [AlekSi]
     open-pull-requests-limit: 20
+    groups:
+      ferretdb:
+        patterns: ["*"]
     schedule:
       interval: "weekly"
       day: "wednesday"
       time: "01:42"
+  - package-ecosystem: "gomod"
+    target-branch: "main-v1"
+    directory: "/"
+    labels: ["deps", "not ready"]
+    assignees: [AlekSi]
+    open-pull-requests-limit: 20
+    groups:
+      ferretdb-v1:
+        patterns: ["*"]
+    schedule:
+      interval: "weekly"
+      day: "wednesday"
+      time: "01:42"
+
   - package-ecosystem: "gomod"
     directory: "/integration"
     labels: ["deps", "not ready"]
     assignees: [AlekSi]
     open-pull-requests-limit: 20
+    groups:
+      integration:
+        patterns: ["*"]
     schedule:
       interval: "weekly"
       day: "wednesday"
       time: "01:42"
+  - package-ecosystem: "gomod"
+    target-branch: "main-v1"
+    directory: "/integration"
+    labels: ["deps", "not ready"]
+    assignees: [AlekSi]
+    open-pull-requests-limit: 20
+    groups:
+      integration-v1:
+        patterns: ["*"]
+    schedule:
+      interval: "weekly"
+      day: "wednesday"
+      time: "01:42"
+
   - package-ecosystem: "gomod"
     directory: "/tools"
     labels: ["deps", "not ready"]
     assignees: [AlekSi]
     open-pull-requests-limit: 20
+    groups:
+      tools:
+        patterns: ["*"]
     schedule:
       interval: "weekly"
       day: "wednesday"
       time: "01:42"
+  - package-ecosystem: "gomod"
+    target-branch: "main-v1"
+    directory: "/tools"
+    labels: ["deps", "not ready"]
+    assignees: [AlekSi]
+    open-pull-requests-limit: 20
+    groups:
+      tools-v1:
+        patterns: ["*"]
+    schedule:
+      interval: "weekly"
+      day: "wednesday"
+      time: "01:42"
+
   - package-ecosystem: "gomod"
     directory: "/tools/golangci"
     labels: ["deps", "not ready"]
     assignees: [AlekSi]
     open-pull-requests-limit: 20
+    groups:
+      golangci:
+        patterns: ["*"]
+    schedule:
+      interval: "weekly"
+      day: "wednesday"
+      time: "01:42"
+  - package-ecosystem: "gomod"
+    target-branch: "main-v1"
+    directory: "/tools/golangci"
+    labels: ["deps", "not ready"]
+    assignees: [AlekSi]
+    open-pull-requests-limit: 20
+    groups:
+      golangci-v1:
+        patterns: ["*"]
+    schedule:
+      interval: "weekly"
+      day: "wednesday"
+      time: "01:42"
+
+  # no mcphost in main-v1
+  - package-ecosystem: "gomod"
+    directory: "/tools/mcphost"
+    labels: ["deps", "not ready"]
+    assignees: [AlekSi]
+    open-pull-requests-limit: 20
+    groups:
+      mcphost:
+        patterns: ["*"]
+    schedule:
+      interval: "weekly"
+      day: "wednesday"
+      time: "01:42"
+
+  # no submodules in main-v1
+  - package-ecosystem: "gitsubmodule"
+    directory: "/"
+    labels: ["deps", "not ready"]
+    assignees: [AlekSi]
+    open-pull-requests-limit: 20
     schedule:
       interval: "weekly"
       day: "wednesday"

.github/mergify.yml

@@ -5,16 +5,18 @@ pull_request_rules:
   - name: "Update out-of-date approved PRs"
     conditions:
       # those rules are implicit for the update action:
-      # - "#commits-behind > 0"
       # - "-closed"
-      - "-conflict"
+      # - "-conflict"
+      # - "#commits-behind > 0"
       - "-draft"
       - "-locked"
       - "-merged"
-      - "author != dependabot[bot]"
       - "base = main"
       - "branch-protection-review-decision = APPROVED"
+      - "check-success = golangci-lint"
+      - "check-success = Test"
       - "label != 'not ready'"
+      - "#review-threads-unresolved = 0"
     actions:
       update:
 
@@ -23,11 +25,9 @@ pull_request_rules:
       - "label = 'blog/engineering'"
     actions:
       request_reviews:
-        users: ["AlekSi", "Fashander", "ptrfarkas"]
-        teams: ["@FerretDB/leads", "@FerretDB/core"]
-        users_from_teams: ["@FerretDB/leads", "@FerretDB/core"]
+        users_from_teams: ["@FerretDB/core", "@FerretDB/docs"]
       comment:
-        message: "Engineering blog posts should be reviewed by other engineers and @Fashander."
+        message: "Engineering blog posts should be reviewed by @FerretDB/core and @FerretDB/docs."
 
   - name: "Request review for marketing blogs posts"
     conditions:

.github/release.yml

@@ -1,33 +0,0 @@
----
-# https://docs.github.com/en/repositories/releasing-projects-on-github/automatically-generated-release-notes
-
-changelog:
-  categories:
-    - title: New Features 🎉
-      labels:
-        - code/feature
-
-    - title: Fixed Bugs 🐛
-      labels:
-        - code/bug
-        - code/bug-regression
-
-    - title: Enhancements 🛠
-      labels:
-        - code/enhancement
-
-    - title: Documentation 📄
-      labels:
-        - blog/engineering
-        - blog/marketing
-        - documentation
-
-    - title: Other Changes 🤖
-      labels:
-        - code/chore
-        - project
-        - deps
-
-    - title: This section should be empty
-      labels:
-        - "*"

.github/settings.yml

@@ -0,0 +1,148 @@
+---
+# https://github.com/repository-settings/app
+
+repository:
+  allow_squash_merge: true
+  allow_merge_commit: false
+  allow_rebase_merge: false
+  allow_auto_merge: true
+  allow_update_branch: true
+  delete_branch_on_merge: true
+  enable_automated_security_fixes: true
+  enable_vulnerability_alerts: true
+
+# https://docs.github.com/en/rest/issues/labels
+# Labels are being used by issues, PRs, and discussions.
+labels:
+  # area
+  - name: area/admin
+    color: "#2931BF"
+    description: Issues about administration commands
+  - name: area/aggregations
+    color: "#5319E7"
+    description: Issues about aggregation pipelines
+  - name: area/auth
+    color: "#E4012C"
+    description: Issues about authentication and authorization
+  - name: area/build
+    color: "#52D58A"
+    description: Issues about builds and CI
+  - name: area/cursors
+    color: "#D93F0B"
+    description: Issues about cursors
+  - name: area/dataapi
+    color: "#D98F93"
+    description: Issues about Data API
+  - name: area/diag
+    color: "#909BA6"
+    description: Issues about diagnostic commands
+  - name: area/errors
+    color: "#DE231F"
+    description: Issues about MongoDB-compatible error codes and messages
+  - name: area/fuzz
+    color: "#D4C5F9"
+    description: Issues about fuzzing and smithing
+  - name: area/indexes
+    color: "#006B75"
+    description: Issues about indexes
+  - name: area/mcp
+    color: "#95921F"
+    description: Issues about MCP
+  - name: area/observability
+    color: "#E04D33"
+    description: Issues about metrics, logs, traces, pprof, etc
+  - name: area/performance
+    color: "#D02FE8"
+    description: Issues about performance
+  - name: area/wire
+    color: "#0354F4"
+    description: Issues about BSON and the wire protocol
+
+  # blog
+  - name: blog/engineering
+    color: "#FEF2C0"
+    description: Engineering blog posts
+  - name: blog/marketing
+    color: "#80D0C9"
+    description: Marketing (and releases) blog posts
+
+  # code
+  - name: code/bug
+    color: "#CC0000"
+    description: Some user-visible feature works incorrectly
+  - name: code/bug-regression
+    color: "#FF0000"
+    description: Some user-visible feature works incorrectly, but worked before
+  - name: code/chore
+    color: "#E99695"
+    description: Code maintenance improvements
+  - name: code/enhancement
+    color: "#FBCA04"
+    description: Some user-visible feature could work better
+  - name: code/feature
+    color: "#0E8A16"
+    description: Some user-visible feature is not implemented yet
+
+  # the rest sorted alphabetically
+
+  - name: badly estimated
+    color: "#FF3333"
+    description: Scope, difficulty and/or clarify of the issue were different
+
+  - name: community
+    color: "#297252"
+    description: Issues and PRs assigned to community members
+
+  - name: conflict
+    color: "#FF0000"
+    description: PRs that have merge conflicts
+
+  - name: deps
+    color: "#D4C5F9"
+    description: PRs that update dependencies
+
+  - name: do not merge
+    color: "#0052CC"
+    description: PRs that should not be merged
+
+  - name: documentation
+    color: "#0052CC"
+    description: Something user-visible is badly or not documented
+
+  - name: good first issue
+    color: "#5319E7"
+    description: Good issues for new external contributors
+
+  # until the next time
+  # - name: hacktoberfest
+  #   color: "#FEFBA2"
+  #   description: Good issues for Hacktoberfest
+
+  - name: help wanted
+    color: "#006B75"
+    description: Issues that require extra attention
+
+  - name: not ready
+    color: "#000000"
+    description: Issues that are not ready to be worked on; PRs that should skip CI
+
+  - name: packages
+    color: "#9B022C"
+    description: PRs that should build packages
+
+  - name: project
+    color: "#E99695"
+    description: Project maintenance
+
+  # https://hacktoberfest.com/participation/#spam
+  - name: spam
+    color: "#C5DEF5"
+    description: Spam issues and PRs
+
+  - name: trust
+    color: "#00FF00"
+    description: PRs that can access Actions secrets
+
+  - name: use-git-lfs
+    color: "#FF0000"
+    description: PRs that add large files without Git LFS

.github/workflows/_integration.yml

@@ -0,0 +1,163 @@
+---
+name: Integration # visible at https://github.com/FerretDB/FerretDB/actions
+on:
+  workflow_call:
+    inputs:
+      task:
+        required: true
+        type: string
+      shard_index:
+        required: true
+        type: number
+      shard_total:
+        required: true
+        type: number
+      test_timeout:
+        required: false
+        type: string
+        default: 20m
+      no_xfail:
+        required: false
+        type: boolean
+        default: false
+      skip_flaky_check:
+        required: false
+        type: boolean
+        default: false
+
+env:
+  GOPATH: /home/runner/go
+  GOCACHE: /home/runner/go/cache
+  GOLANGCI_LINT_CACHE: /home/runner/go/cache/lint
+  GOMODCACHE: /home/runner/go/mod
+  GOPROXY: https://proxy.golang.org
+  GOTOOLCHAIN: local
+
+jobs:
+  run:
+    # make it short to fit in GitHub UI; all parameters are already in the caller's name
+    name: Run
+    runs-on: ubuntu-24.04
+    timeout-minutes: 25
+
+    steps:
+      # TODO https://github.com/FerretDB/github-actions/issues/211
+      - name: Checkout code
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 0 # for `git describe` to work
+          lfs: false # LFS is used only by website
+
+      # for branch.txt on pull_request; the correct branch is already checked out on push / schedule
+      - name: Name branch
+        if: github.event_name == 'pull_request'
+        env:
+          BRANCH: ${{ github.head_ref }} # see https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable
+        run: git checkout -b $BRANCH
+
+      - name: Setup Go
+        uses: FerretDB/github-actions/setup-go@main
+        with:
+          cache-key: integration
+
+      - name: Install Task
+        run: go generate -x
+        working-directory: tools
+
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Start environment
+        run: bin/task env-up-detach
+
+      - name: Run init
+        run: bin/task init
+
+      - name: Setup Ollama and MCPHost
+        run: |
+          mkdir -p tmp/logs
+          curl -fsSL https://ollama.com/install.sh | sh
+          sudo systemctl stop ollama
+          bin/task ollama  > tmp/logs/ollama.log  2>&1 &
+          bin/task mcphost > tmp/logs/mcphost.log 2>&1 &
+
+      - name: Wait for and setup environment
+        run: bin/task env-setup
+
+      - name: >
+          Run ${{ inputs.task }} tests
+          (${{ inputs.shard_index }}/${{ inputs.shard_total }})
+        run: >
+          bin/task test-integration-${{ inputs.task }}
+          SHARD_INDEX=${{ inputs.shard_index }}
+          SHARD_TOTAL=${{ inputs.shard_total }}
+          TEST_TIMEOUT=${{ inputs.test_timeout }}
+          NO_XFAIL=${{ inputs.no_xfail }}
+        env:
+          ENVTOOL_DEBUG: ${{ runner.debug == '1' && 'true' || 'false' }}
+
+      - name: Collect logs
+        if: failure()
+        run: |
+          bin/task env-logs-collect
+          cp -v integration/*.json.tmp integration/*.txt.tmp tmp/logs/
+
+      - name: Compress logs before upload
+        if: failure()
+        run: zip -r -q -9 logs.zip tmp/logs
+
+      - name: Upload logs
+        if: failure()
+        uses: actions/upload-artifact@v5
+        with:
+          name: logs-${{ inputs.task }}-${{ inputs.shard_index }}-${{ inputs.shard_total }}
+          path: logs.zip
+          retention-days: 3
+
+      - name: Upload coverage information to codecov
+        if: always()
+        uses: codecov/codecov-action@v5
+        with:
+          files: ./integration/integration-${{ inputs.task }}.txt
+          flags: integration,${{ inputs.task }},${{ inputs.task }}-${{ inputs.shard_index }}
+          disable_file_fixes: true
+          fail_ci_if_error: true
+          verbose: true
+
+      - name: Upload coverage information to coveralls
+        if: always()
+        uses: coverallsapp/github-action@v2
+        with:
+          file: ./integration/integration-${{ inputs.task }}.txt
+          flag-name: integration-${{ inputs.task }}-${{ inputs.shard_index }}
+          parallel: true
+
+      - name: Convert test results to JUnit XML format
+        if: always() && !inputs.skip_flaky_check
+        run: >
+          ./bin/go-junit-report -parser=gojson
+          -in ./integration/*.json.tmp
+          -out ./integration/${{ inputs.task }}.xml
+
+      - name: Upload test results to Codecov
+        if: always()
+        uses: codecov/test-results-action@v1
+        with:
+          flags: integration,${{ inputs.task }},${{ inputs.task }}-${{ inputs.shard_index }}
+          file: ./integration/${{ inputs.task }}.xml
+
+      # we don't want them on CI
+      - name: Clean test and fuzz caches
+        if: always()
+        run: go clean -testcache -fuzzcache
+
+      - name: Check dirty
+        if: always()
+        run: |
+          git status --untracked-files --ignored
+          git status
+          git diff --exit-code

.github/workflows/clean.yml

@@ -1,26 +0,0 @@
-name: clean old packages
-on:
-  workflow_dispatch:
-  schedule:
-    - cron: "0 0 * * *"
-
-jobs:
-  scan-old-package:
-    runs-on: ubuntu-latest
-
-    # disable for now
-    if: false
-
-    steps:
-      - uses: actions/checkout@v3
-      - name: Set up Go
-        uses: actions/setup-go@v4
-        with:
-          go-version: "1.20"
-      - name: Install dependencies
-        run: cd tools; go get ./cleantool
-      - name: Scan old package versions and store the version id to env
-        env:
-          ROBOT_TOKEN: ${{ secrets.ROBOT_TOKEN }}
-        run: |
-          cd tools;go run ./cleantool/cleantool.go

.github/workflows/cleanup.yml

@@ -0,0 +1,43 @@
+---
+name: Cleanup
+on:
+  schedule:
+    - cron: "10 0 * * 1"
+  workflow_dispatch:
+
+env:
+  GOPATH: /home/runner/go
+  GOCACHE: /home/runner/go/cache
+  GOLANGCI_LINT_CACHE: /home/runner/go/cache/lint
+  GOMODCACHE: /home/runner/go/mod
+  GOPROXY: https://proxy.golang.org
+  GOTOOLCHAIN: local
+
+jobs:
+  cleanup:
+    name: Cleanup
+    runs-on: server
+
+    permissions:
+      contents: read
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 0 # for `git describe` to work
+          lfs: false # LFS is used only by website
+
+      - name: Setup Go
+        uses: FerretDB/github-actions/setup-go@main
+        # no cache-key on server
+
+      - name: Install Task
+        run: go generate -x
+        working-directory: tools
+
+      - name: Run docker-cleanup
+        run: bin/task docker-cleanup
+
+      - name: Clean Go caches
+        run: go clean -cache -testcache -modcache -fuzzcache

.github/workflows/conform-pr.yml

@@ -11,8 +11,8 @@
 #   we require the `trust` label to be assigned to PRs by FerretDB maintainers after reviewing changes.
 #   Only a few trusted people have permission to do that.
 # * Thanks to the way `pull_request_target` trigger works,
-#   PR changes in the workflow itself are not run until the changes are merged.
-# * We use a short-lived automatic `GITHUB_TOKEN` instead of a long-living personal access token (PAT) where possible.
+#   PR changes in the workflow itself are not run until they are merged.
+# * We use short-lived automatic `GITHUB_TOKEN`s instead of a long-living personal access tokens (PAT) where possible.
 # * Both `GITHUB_TOKEN`s and PATs have minimal permissions.
 # * We publish Docker images from PRs as separate packages that should not be run by users.
 # * We limit what third-party actions can be used.
@@ -57,13 +57,13 @@ env:
   GOLANGCI_LINT_CACHE: /home/runner/go/cache/lint
   GOMODCACHE: /home/runner/go/mod
   GOPROXY: https://proxy.golang.org
-  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+  GOTOOLCHAIN: local
   CONFORM_TOKEN: ${{ secrets.CONFORM_TOKEN }} # repo-scoped GITHUB_TOKEN is not enough to query org-level projects
 
 jobs:
   conform-pr:
     name: Conform PR
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     timeout-minutes: 5
 
     # No `trust` label check because we don't checkout PR's code.

.github/workflows/cts.yml

@@ -0,0 +1,95 @@
+---
+name: CTS
+on:
+  pull_request:
+    types:
+      - unlabeled # if GitHub Actions stuck, add and remove "not ready" label to force rebuild
+      - opened
+      - reopened
+      - synchronize
+  push:
+    branches:
+      - main
+      - main-*
+      - releases/*
+
+env:
+  GOPATH: /home/runner/go
+  GOCACHE: /home/runner/go/cache
+  GOLANGCI_LINT_CACHE: /home/runner/go/cache/lint
+  GOMODCACHE: /home/runner/go/mod
+  GOPROXY: https://proxy.golang.org
+  GOTOOLCHAIN: local
+
+jobs:
+  run:
+    name: Run CTS tests
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+
+    if: github.event_name != 'pull_request' || !contains(github.event.pull_request.labels.*.name, 'not ready')
+
+    permissions:
+      contents: read
+
+    steps:
+      # TODO https://github.com/FerretDB/github-actions/issues/211
+      - name: Checkout code
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 0 # for `git describe` to work
+          lfs: false # LFS is used only by website
+
+      - name: Setup Go
+        uses: FerretDB/github-actions/setup-go@main
+        with:
+          cache-key: cts
+
+      - name: Install Task
+        run: go generate -x
+        working-directory: tools
+
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Start environment
+        run: bin/task env-up-detach
+
+      - name: Run init
+        run: bin/task init
+
+      - name: Build bin/ferretdb
+        run: bin/task build-host
+
+      - name: Wait for and setup environment
+        run: bin/task env-setup
+
+      - name: Start FerretDB (no auth) in the background
+        run: >
+          bin/ferretdb
+          --listen-addr=:27017
+          --proxy-addr=127.0.0.1:37017
+          --no-auth
+          --mode=diff-normal
+          --postgresql-url='postgres://username:password@127.0.0.1:5432/postgres'
+          2> ferretdb.log &
+
+      - name: Run CTS
+        if: always()
+        run: bin/task cts
+
+      # we don't want them on CI
+      - name: Clean test and fuzz caches
+        if: always()
+        run: go clean -testcache -fuzzcache
+
+      - name: Check dirty
+        if: always()
+        run: |
+          git status --untracked-files --ignored
+          git status
+          git diff --exit-code

.github/workflows/debug.yml

@@ -13,6 +13,7 @@ on:
   push:
     branches:
       - main
+      - main-*
       - releases/*
     tags:
       - "*"
@@ -22,26 +23,32 @@ on:
 # Do not run this workflow in parallel for any PR change.
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.ref_name }}
-  cancel-in-progress: false
+  cancel-in-progress: true
 
 jobs:
   contexts:
     name: Contexts
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     timeout-minutes: 5
 
     # comment out to enable this job
     if: false
 
+    permissions:
+      contents: read
+
     steps:
+      # TODO https://github.com/FerretDB/github-actions/issues/211
       - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v5
         with:
-          fetch-depth: 0
-          lfs: false
+          fetch-depth: 0 # for `git describe` to work
+          lfs: false # LFS is used only by website
 
       - name: Debug git status
-        run: git status
+        run: |
+          git status --untracked-files --ignored
+          git status
 
       - name: Dump github context
         run: echo "$GITHUB_CONTEXT"

.github/workflows/docs.yml

@@ -10,6 +10,7 @@ on:
   push:
     branches:
       - main
+      - main-*
       - releases/*
   schedule:
     - cron: "12 0 * * *"
@@ -26,31 +27,38 @@ env:
   GOLANGCI_LINT_CACHE: /home/runner/go/cache/lint
   GOMODCACHE: /home/runner/go/mod
   GOPROXY: https://proxy.golang.org
+  GOTOOLCHAIN: local
 
 jobs:
   build:
     name: Build docs
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     timeout-minutes: 10
 
     if: github.event_name != 'pull_request' || !contains(github.event.pull_request.labels.*.name, 'not ready')
 
+    permissions:
+      contents: read
+
     steps:
+      # TODO https://github.com/FerretDB/github-actions/issues/211
       - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v5
         with:
+          fetch-depth: 0 # for `git describe` to work
           lfs: true
 
       # This step will fail with "Error: Resource not accessible by integration"
       # while trying to add label and comment to PR, that is not possible for PRs from forks.
-      # See https://github.com/ActionsDesk/lfs-warning/issues/147.
+      # See https://github.com/ppremk/lfs-warning/issues/147.
       # But the real issue will be right above that message: a list of files that should be added using Git LFS.
       - name: Check LFS status
-        uses: actionsdesk/lfs-warning@v3.2
+        uses: ppremk/lfs-warning@v3.3
         with:
           filesizelimit: 102400b
           labelName: use-git-lfs
           exclusionPatterns: |
+            **/*.go
             **/*.js
             **/*.md
             **/go.sum
@@ -69,9 +77,8 @@ jobs:
 
       - name: Build docs
         run: bin/task docs
-
-      - name: Create directory
-        run: mkdir tmp
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # for checkdocs
 
       - name: Archive docs
         run: >
@@ -83,7 +90,7 @@ jobs:
 
       # it has to be exactly "docs.tar" for actions/deploy-pages below
       - name: Upload archive artifact
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v5
         with:
           name: docs
           path: tmp/docs.tar
@@ -97,10 +104,10 @@ jobs:
 
   github:
     name: Deploy to GitHub Pages
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     timeout-minutes: 10
 
-    # deploy only on push to main; exclude pull_request and schedule
+    # exclude pull_request and schedule
     needs: build
     if: github.event_name == 'push'
 
@@ -115,7 +122,7 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deploy
-        uses: actions/deploy-pages@v2
+        uses: actions/deploy-pages@v4
         with:
           artifact_name: docs
           timeout: 300000 # 5*60*1000 milliseconds

.github/workflows/format.yml

@@ -10,6 +10,7 @@ on:
   push:
     branches:
       - main
+      - main-*
       - releases/*
   schedule:
     - cron: "12 0 * * *"
@@ -17,7 +18,7 @@ on:
 # Do not run this workflow in parallel for any PR change.
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.ref_name }}
-  cancel-in-progress: false
+  cancel-in-progress: true
 
 env:
   GOPATH: /home/runner/go
@@ -25,18 +26,23 @@ env:
   GOLANGCI_LINT_CACHE: /home/runner/go/cache/lint
   GOMODCACHE: /home/runner/go/mod
   GOPROXY: https://proxy.golang.org
+  GOTOOLCHAIN: local
 
 jobs:
   format:
     name: Format files
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     timeout-minutes: 10
 
     if: github.event_name != 'pull_request' || !contains(github.event.pull_request.labels.*.name, 'not ready')
 
+    permissions:
+      contents: read
+
     steps:
+      # TODO https://github.com/FerretDB/github-actions/issues/211
       - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v5
         with:
           fetch-depth: 0 # for `git describe` to work
           lfs: false # LFS is used only by website
@@ -50,9 +56,6 @@ jobs:
         run: go generate -x
         working-directory: tools
 
-      - name: Run init
-        run: bin/task init
-
       - name: Format Go code
         run: bin/task fmt-go
 
@@ -60,6 +63,8 @@ jobs:
         run: bin/task fmt-yaml
 
       - name: Check dirty
+        if: always()
         run: |
+          git status --untracked-files --ignored
           git status
           git diff --exit-code

.github/workflows/go.yml

@@ -10,37 +10,50 @@ on:
   push:
     branches:
       - main
+      - main-*
       - releases/*
   schedule:
     - cron: "12 0 * * *"
 
-# Do not run this workflow in parallel for any PR change.
-concurrency:
-  group: ${{ github.workflow }}-${{ github.head_ref || github.ref_name }}
-  cancel-in-progress: false
-
 env:
   GOPATH: /home/runner/go
   GOCACHE: /home/runner/go/cache
   GOLANGCI_LINT_CACHE: /home/runner/go/cache/lint
   GOMODCACHE: /home/runner/go/mod
   GOPROXY: https://proxy.golang.org
+  GOTOOLCHAIN: local
 
 jobs:
   short-test:
     name: Short test
-    runs-on: ubuntu-22.04
-    timeout-minutes: 10
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+
+    # Do not run this job in parallel for any PR change or branch push.
+    concurrency:
+      group: ${{ github.workflow }}-short-test-${{ github.head_ref || github.ref_name }}
+      cancel-in-progress: true
 
     if: github.event_name != 'pull_request' || !contains(github.event.pull_request.labels.*.name, 'not ready')
 
+    permissions:
+      contents: read
+
     steps:
+      # TODO https://github.com/FerretDB/github-actions/issues/211
       - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v5
         with:
           fetch-depth: 0 # for `git describe` to work
           lfs: false # LFS is used only by website
 
+      # for branch.txt on pull_request; the correct branch is already checked out on push / schedule
+      - name: Name branch
+        if: github.event_name == 'pull_request'
+        env:
+          BRANCH: ${{ github.head_ref }} # see https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable
+        run: git checkout -b $BRANCH
+
       - name: Setup Go
         uses: FerretDB/github-actions/setup-go@main
         with:
@@ -54,7 +67,10 @@ jobs:
         run: bin/task init
 
       - name: Run short unit tests
-        run: bin/task test-unit-short
+        run: bin/task test-unit-short TEST_TIMEOUT=10m
+        env:
+          GOFLAGS: ${{ runner.debug == '1' && '-v' || '' }}
+          GITHUB_TOKEN: invalid # to test that -short is handled correctly
 
       # we don't want them on CI
       - name: Clean test and fuzz caches
@@ -62,24 +78,42 @@ jobs:
         run: go clean -testcache -fuzzcache
 
       - name: Check dirty
+        if: always()
         run: |
+          git status --untracked-files --ignored
           git status
           git diff --exit-code
 
   test:
     name: Test
-    runs-on: ubuntu-22.04
-    timeout-minutes: 10
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+
+    # Do not run this job in parallel for any PR change or branch push.
+    concurrency:
+      group: ${{ github.workflow }}-test-${{ github.head_ref || github.ref_name }}
+      cancel-in-progress: true
 
     if: github.event_name != 'pull_request' || !contains(github.event.pull_request.labels.*.name, 'not ready')
 
+    permissions:
+      contents: read
+
     steps:
+      # TODO https://github.com/FerretDB/github-actions/issues/211
       - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v5
         with:
           fetch-depth: 0 # for `git describe` to work
           lfs: false # LFS is used only by website
 
+      # for branch.txt on pull_request; the correct branch is already checked out on push / schedule
+      - name: Name branch
+        if: github.event_name == 'pull_request'
+        env:
+          BRANCH: ${{ github.head_ref }} # see https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable
+        run: git checkout -b $BRANCH
+
       - name: Setup Go
         uses: FerretDB/github-actions/setup-go@main
         with:
@@ -89,45 +123,82 @@ jobs:
         run: go generate -x
         working-directory: tools
 
+      # install.sh starts ollama service, stop it since we want to run with `bin/task ollama` with environment variables
+      - name: Setup Ollama
+        run: |
+          curl -fsSL https://ollama.com/install.sh | sudo -E sh
+          sudo systemctl stop ollama
+
+      - name: Start Ollama in the background
+        run: |
+          bin/task ollama &
+
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
       - name: Start environment
         run: bin/task env-up-detach
 
+      - name: Pull and load Ollama model
+        run: |
+          bin/task ollama-model
+
       - name: Run init
         run: bin/task init
 
+      - name: Wait for and setup environment
+        run: bin/task env-setup
+
       - name: Regenerate and reformat
         run: bin/task gen
+        env:
+          # must be a SUPERUSER to ensure parameter_default is set
+          DOCUMENTDB_GEN_URL: postgres://username:password@127.0.0.1:5432/postgres
 
       - name: Build bin/ferretdb
         run: bin/task build-host
 
-      - name: Wait for and setup environment
-        run: bin/task env-setup
-
       - name: Run unit tests
-        run: bin/task test-unit
+        run: bin/task test-unit TEST_TIMEOUT=10m
+        env:
+          GOFLAGS: ${{ runner.debug == '1' && '-v' || '' }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # for tools
 
-      # The token is not required but should make uploads more stable.
-      # If secrets are unavailable (for example, for a pull request from a fork), it fallbacks to the tokenless uploads.
-      #
-      # Unfortunately, it seems that tokenless uploads fail too often.
-      # See https://github.com/codecov/codecov-action/issues/837.
-      #
-      # We also can't use ${{ vars.CODECOV_TOKEN }}: https://github.com/orgs/community/discussions/44322
       - name: Upload coverage information to codecov
-        uses: codecov/codecov-action@v3
+        if: always()
+        uses: codecov/codecov-action@v5
         with:
-          token: 22159d7c-856d-4fe9-8fdb-5d9ecff35514
           files: ./cover.txt
           flags: unit
+          disable_file_fixes: true
           fail_ci_if_error: true
           verbose: true
 
       - name: Upload coverage information to coveralls
+        if: always()
         uses: coverallsapp/github-action@v2
         with:
           file: ./cover.txt
           flag-name: unit
+          parallel: true
+
+      - name: Convert test results to JUnit XML format
+        if: always()
+        run: >
+          ./bin/go-junit-report
+          -in ./unit.txt
+          -out ./unit.xml
+
+      - name: Upload test results to Codecov
+        if: always()
+        uses: codecov/test-results-action@v1
+        with:
+          flags: unit
+          file: ./unit.xml
 
       # we don't want them on CI
       - name: Clean test and fuzz caches
@@ -135,24 +206,167 @@ jobs:
         run: go clean -testcache -fuzzcache
 
       - name: Check dirty
+        if: always()
         run: |
+          git status --untracked-files --ignored
           git status
           git diff --exit-code
 
-  golangci-lint:
-    name: golangci-lint
-    runs-on: ubuntu-22.04
-    timeout-minutes: 10
+  integration:
+    # job name must be unique; make it unique and nice
+    name: ${{ matrix.task }} ${{ matrix.shard_index }}/${{ matrix.shard_total }}
+
+    # Do not run this job in parallel for any PR change or branch push
+    # to save some resources.
+    concurrency:
+      group: ${{ github.workflow }}-integration-${{ matrix.task }}-${{ matrix.shard_index }}-${{ github.head_ref || github.ref_name }}
+      cancel-in-progress: true
 
     if: github.event_name != 'pull_request' || !contains(github.event.pull_request.labels.*.name, 'not ready')
 
+    strategy:
+      fail-fast: false
+      matrix:
+        task: [postgresql, yugabytedb]
+        shard_index: [1, 2, 3, 4, 5]
+        shard_total: [5]
+        include:
+          - { task: "mongodb", shard_index: 1, shard_total: 1 }
+          - { task: "yugabytedb", skip_flaky_check: true } # Too many failures for now
+
+    uses: ./.github/workflows/_integration.yml
+    with:
+      task: ${{ matrix.task }}
+      shard_index: ${{ matrix.shard_index }}
+      shard_total: ${{ matrix.shard_total }}
+      skip_flaky_check: ${{ matrix.skip_flaky_check || false }}
+
+  integration-no-xfail:
+    name: postgresql no-xfail
+
+    # Do not run this job in parallel for any PR change or branch push
+    # to save some resources.
+    concurrency:
+      group: ${{ github.workflow }}-integration-no-xfail-${{ github.head_ref || github.ref_name }}
+      cancel-in-progress: true
+
+    # disable for now
+    if: false
+    # if: github.event_name != 'pull_request' || !contains(github.event.pull_request.labels.*.name, 'not ready')
+
+    uses: ./.github/workflows/_integration.yml
+    with:
+      task: postgresql
+      shard_index: 1
+      shard_total: 1
+      test_timeout: 5m
+      no_xfail: true
+
+  # https://github.com/lemurheavy/coveralls-public/issues/1636
+  submit-coveralls:
+    name: Submit final coveralls report
+    runs-on: ubuntu-24.04
+    needs: [test, integration]
+
+    if: always() && (github.event_name != 'pull_request' || !contains(github.event.pull_request.labels.*.name, 'not ready'))
+
     steps:
+      - name: Submit coveralls
+        if: always()
+        uses: coverallsapp/github-action@v2
+        with:
+          parallel-finished: true
+
+  env-data:
+    name: env-data
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+
+    # Do not run this job in parallel for any PR change or branch push.
+    concurrency:
+      group: ${{ github.workflow }}-env-data-${{ github.head_ref || github.ref_name }}
+      cancel-in-progress: true
+
+    if: github.event_name != 'pull_request' || !contains(github.event.pull_request.labels.*.name, 'not ready')
+
+    permissions:
+      contents: read
+
+    steps:
+      # TODO https://github.com/FerretDB/github-actions/issues/211
       - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 0 # for `git describe` to work
+          lfs: false # LFS is used only by website
+
+      - name: Setup Go
+        uses: FerretDB/github-actions/setup-go@main
+        with:
+          cache-key: env-data
+
+      - name: Install Task
+        run: go generate -x
+        working-directory: tools
+
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Start environment
+        run: bin/task env-up-detach
+
+      - name: Run init
+        run: bin/task init
+
+      - name: Build bin/ferretdb
+        run: bin/task build-host
+
+      - name: Wait for and setup environment
+        run: bin/task env-setup
+
+      - name: Start FerretDB in the background
+        run: bin/task run &
+
+      - name: Run env-data
+        run: bin/task env-data
+        env:
+          GOFLAGS: ${{ runner.debug == '1' && '-v' || '' }}
+
+  golangci-lint:
+    name: golangci-lint
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+
+    # Do not run this job in parallel for any PR change or branch push.
+    concurrency:
+      group: ${{ github.workflow }}-golangci-lint-${{ github.head_ref || github.ref_name }}
+      cancel-in-progress: true
+
+    if: github.event_name != 'pull_request' || !contains(github.event.pull_request.labels.*.name, 'not ready')
+
+    permissions:
+      contents: read
+      issues: read
+
+    steps:
+      # TODO https://github.com/FerretDB/github-actions/issues/211
+      - name: Checkout code
+        uses: actions/checkout@v5
         with:
           fetch-depth: 0 # for `golangci-lint run --new` to work
           lfs: false # LFS is used only by website
 
+      # for branch.txt on pull_request; the correct branch is already checked out on push / schedule
+      - name: Name branch
+        if: github.event_name == 'pull_request'
+        env:
+          BRANCH: ${{ github.head_ref }} # see https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable
+        run: git checkout -b $BRANCH
+
       - name: Setup Go
         uses: FerretDB/github-actions/setup-go@main
         with:
@@ -160,124 +374,5 @@ jobs:
 
       - name: Run linters
         uses: FerretDB/github-actions/linters@main
-
-  fuzz-short:
-    name: Fuzz short
-    runs-on: ubuntu-22.04
-    timeout-minutes: 10
-
-    if: github.event_name != 'pull_request' || !contains(github.event.pull_request.labels.*.name, 'not ready')
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v3
-        with:
-          path: source
-          fetch-depth: 0 # for `git describe` to work
-          lfs: false # LFS is used only by website
-
-      - name: Setup Go
-        uses: FerretDB/github-actions/setup-go@main
-        with:
-          cache-key: fuzz
-
-      - name: Install Task
-        run: go generate -x
-        working-directory: source/tools
-
-      # Use deploy key instead of Personal Access Token (PAT) to limit access to one repository.
-      # If secrets are not available (for example, for a pull request from a fork), GITHUB_TOKEN PAT is used automatically.
-      - name: Checkout collected fuzz corpus
-        uses: actions/checkout@v3
-        with:
-          repository: FerretDB/fuzz-corpus
-          ssh-key: ${{ secrets.FUZZ_CORPUS_DEPLOY_KEY }}
-          path: fuzz-corpus
-          fetch-depth: 0 # for commit and push to work
-
-      - name: Start environment
-        run: bin/task env-up-detach
-        working-directory: source
-
-      - name: Run init
-        run: bin/task init
-        working-directory: source
-
-      - name: Setup corpus
-        run: bin/task fuzz-corpus
-        working-directory: source
-
-      - name: Wait for and setup environment
-        run: bin/task env-setup
-        working-directory: source
-
-      # precompile tests with unset GOMAXPROCS
-      - name: Init fuzzers
-        run: bin/task fuzz-init
-        working-directory: source
-
-      # TODO https://github.com/FerretDB/FerretDB/issues/238
-      # TODO https://github.com/FerretDB/FerretDB/issues/344
-      - name: Run collected fuzzing corpus
-        run: bin/task fuzz FUZZTIME=1s
-        working-directory: source
         env:
-          GOMAXPROCS: 1 # otherwise, oom-killer kills fuzzer too often
-
-      - name: Collect corpus
-        if: always()
-        run: |
-          bin/task fuzz-corpus
-          go run ./cmd/fuzztool corpus seed ../fuzz-corpus
-        working-directory: source
-
-      # `secrets` are not supported in `if`, so we have to do this trick with environment variable:
-      # https://docs.github.com/en/actions/learn-github-actions/contexts#context-availability
-      # https://github.com/actions/runner/issues/520
-      - name: Push corpus
-        if: ${{ always() && env.KEY != '' }}
-        env:
-          KEY: ${{ secrets.FUZZ_CORPUS_DEPLOY_KEY }}
-        run: |
-          git config user.name ferretdb-bot
-          git config user.email ferretdb-bot@ferretdb.io
-          git add --all .
-          git diff-index --quiet HEAD || git commit --message 'Update corpus'
-          git fetch
-          git rebase origin/main
-          git push
-        working-directory: fuzz-corpus
-
-      - name: Collect Linux logs
-        if: failure()
-        run: |
-          mkdir -p /tmp/logs
-          ls -al /var/log/
-          sudo cp /var/log/syslog /tmp/logs/
-          sudo free > /tmp/logs/free.txt
-          sudo chmod 0666 /tmp/logs/*
-        working-directory: source
-
-      - name: Compress Linux logs before upload
-        if: failure()
-        run: zip -r -q -9 linux-logs.zip /tmp/logs
-
-      - name: Upload Linux logs
-        if: failure()
-        uses: actions/upload-artifact@v3
-        with:
-          name: linux-logs
-          path: linux-logs.zip
-          retention-days: 1
-          if-no-files-found: error
-
-      # we don't want them on CI
-      - name: Clean test and fuzz caches
-        if: always()
-        run: go clean -testcache -fuzzcache
-
-      - name: Check dirty
-        run: |
-          git status
-          git diff --exit-code
-        working-directory: source
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/integration-trust.yml

@@ -1,143 +0,0 @@
----
-# Integration tests that need access to secrets.
-
-name: Trusted integration
-on:
-  pull_request_target:
-    types:
-      # not for "labeled" to prevent two builds for "labeled" and "unlabeled" when labels are changed
-      - unlabeled # if GitHub Actions stuck, add and remove "not ready" label to force rebuild
-      - opened
-      - reopened
-      - synchronize
-  push:
-    branches:
-      - main
-      - releases/*
-  schedule:
-    - cron: "12 2 * * *" # after integration workflow to reuse cache
-
-# Do not run this workflow in parallel for any PR change or branch/tag push
-# to save some resources.
-concurrency:
-  group: ${{ github.workflow }}-${{ github.head_ref || github.ref_name }}
-  cancel-in-progress: true
-
-env:
-  GOPATH: /home/runner/go
-  GOCACHE: /home/runner/go/cache
-  GOLANGCI_LINT_CACHE: /home/runner/go/cache/lint
-  GOMODCACHE: /home/runner/go/mod
-  GOPROXY: https://proxy.golang.org
-
-jobs:
-  test:
-    name: Test ${{ matrix.name }}
-    runs-on:
-      group: paid
-    timeout-minutes: 30
-
-    if: >
-      github.event_name != 'pull_request_target' ||
-      (
-        contains(github.event.pull_request.labels.*.name, 'trust') &&
-        !contains(github.event.pull_request.labels.*.name, 'not ready')
-      )
-
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - { name: "Hana", task: "hana" }
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v3
-        with:
-          fetch-depth: 0 # for `git describe` to work
-          lfs: false # LFS is used only by website
-
-      - name: Checkout pull request code
-        if: github.event_name == 'pull_request_target'
-        uses: actions/checkout@v3
-        with:
-          fetch-depth: 0
-          lfs: false
-          ref: ${{ github.event.pull_request.head.sha }}
-
-      # for branch.txt on pull_request_target; `main` is already checked out on push / schedule
-      - name: Name branch
-        if: github.event_name == 'pull_request_target'
-        env:
-          BRANCH: ${{ github.head_ref }} # see https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable
-        run: git checkout -b $BRANCH
-
-      - name: Setup Go
-        uses: FerretDB/github-actions/setup-go@main
-        with:
-          cache-key: integration
-
-      - name: Install Task
-        run: go generate -x
-        working-directory: tools
-
-      - name: Start environment
-        run: bin/task env-up-detach
-
-      - name: Run init
-        run: bin/task init
-
-      - name: Wait for and setup environment
-        run: bin/task env-setup
-
-      - name: Run ${{ matrix.task }} tests
-        run: bin/task test-integration-${{ matrix.task }}
-        env:
-          FERRETDB_HANA_URL: ${{ secrets.FERRETDB_HANA_URL }}
-
-      # The token is not required but should make uploads more stable.
-      # If secrets are unavailable (for example, for a pull request from a fork), it fallbacks to the tokenless uploads.
-      #
-      # Unfortunately, it seems that tokenless uploads fail too often.
-      # See https://github.com/codecov/codecov-action/issues/837.
-      #
-      # We also can't use ${{ vars.CODECOV_TOKEN }}: https://github.com/orgs/community/discussions/44322
-      - name: Upload coverage information to codecov
-        uses: codecov/codecov-action@v3
-        with:
-          token: 22159d7c-856d-4fe9-8fdb-5d9ecff35514
-          files: ./integration/integration-${{ matrix.task }}.txt
-          flags: integration,${{ matrix.task }}
-          fail_ci_if_error: true
-          verbose: true
-
-      - name: Upload coverage information to coveralls
-        uses: coverallsapp/github-action@v2
-        with:
-          file: ./integration/integration-${{ matrix.task }}.txt
-          flag-name: integration-${{ matrix.task }}
-          parallel: true
-
-      # we don't want them on CI
-      - name: Clean test and fuzz caches
-        if: always()
-        run: go clean -testcache -fuzzcache
-
-      - name: Check dirty
-        run: |
-          git status
-          git diff --exit-code
-
-  submit-coveralls:
-    name: Submit coveralls
-    runs-on: ubuntu-22.04
-
-    needs: test
-    if: github.event_name != 'pull_request' || !contains(github.event.pull_request.labels.*.name, 'not ready')
-
-    steps:
-      - name: Submit coveralls
-        uses: coverallsapp/github-action@v2
-        with:
-          parallel-finished: true
-          carryforward: unit # workaround for https://github.com/lemurheavy/coveralls-public/issues/1636

.github/workflows/integration.yml

@@ -1,161 +0,0 @@
----
-# Integration tests that don't need access to secrets.
-
-name: Integration
-on:
-  pull_request:
-    types:
-      - unlabeled # if GitHub Actions stuck, add and remove "not ready" label to force rebuild
-      - opened
-      - reopened
-      - synchronize
-  push:
-    branches:
-      - main
-      - releases/*
-  schedule:
-    - cron: "12 0 * * *"
-
-# Do not run this workflow in parallel for any PR change or branch/tag push
-# to save some resources.
-concurrency:
-  group: ${{ github.workflow }}-${{ github.head_ref || github.ref_name }}
-  cancel-in-progress: true
-
-env:
-  GOPATH: /home/runner/go
-  GOCACHE: /home/runner/go/cache
-  GOLANGCI_LINT_CACHE: /home/runner/go/cache/lint
-  GOMODCACHE: /home/runner/go/mod
-  GOPROXY: https://proxy.golang.org
-
-jobs:
-  test:
-    name: Test ${{ matrix.name }}
-    runs-on:
-      group: paid
-    timeout-minutes: 45
-
-    if: github.event_name != 'pull_request' || !contains(github.event.pull_request.labels.*.name, 'not ready')
-
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - { name: "MongoDB", task: "mongodb" }
-          - { name: "PostgreSQL", task: "pg" }
-          - { name: "SQLite", task: "sqlite" }
-          # - { name: "Tigris", task: "tigris" }
-          # - { name: "Tigris main", task: "tigris", tigris_dockerfile: "tigris_main" }
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v3
-        with:
-          fetch-depth: 0 # for `git describe` to work
-          lfs: false # LFS is used only by website
-
-      - name: Setup Go
-        uses: FerretDB/github-actions/setup-go@main
-        with:
-          cache-key: integration
-
-      - name: Install Task
-        run: go generate -x
-        working-directory: tools
-
-      - name: Start environment
-        run: bin/task env-up-detach
-        env:
-          TIGRIS_DOCKERFILE: ${{ matrix.tigris_dockerfile }}
-
-      - name: Run init
-        run: bin/task init
-
-      - name: Wait for and setup environment
-        run: bin/task env-setup
-
-      - name: Run ${{ matrix.task }} tests
-        run: bin/task test-integration-${{ matrix.task }}
-
-      # The token is not required but should make uploads more stable.
-      # If secrets are unavailable (for example, for a pull request from a fork), it fallbacks to the tokenless uploads.
-      #
-      # Unfortunately, it seems that tokenless uploads fail too often.
-      # See https://github.com/codecov/codecov-action/issues/837.
-      #
-      # We also can't use ${{ vars.CODECOV_TOKEN }}: https://github.com/orgs/community/discussions/44322
-      - name: Upload coverage information to codecov
-        uses: codecov/codecov-action@v3
-        with:
-          token: 22159d7c-856d-4fe9-8fdb-5d9ecff35514
-          files: ./integration/integration-${{ matrix.task }}.txt
-          flags: integration,${{ matrix.task }}
-          fail_ci_if_error: true
-          verbose: true
-
-      - name: Upload coverage information to coveralls
-        uses: coverallsapp/github-action@v2
-        with:
-          file: ./integration/integration-${{ matrix.task }}.txt
-          flag-name: integration-${{ matrix.task }}
-          parallel: true
-
-      # we don't want them on CI
-      - name: Clean test and fuzz caches
-        if: always()
-        run: go clean -testcache -fuzzcache
-
-      - name: Check dirty
-        run: |
-          git status
-          git diff --exit-code
-
-  env-data:
-    name: env-data
-    runs-on: ubuntu-22.04
-    timeout-minutes: 10
-
-    if: github.event_name != 'pull_request' || !contains(github.event.pull_request.labels.*.name, 'not ready')
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v3
-        with:
-          fetch-depth: 0 # for `git describe` to work
-          lfs: false # LFS is used only by website
-
-      - name: Setup Go
-        uses: FerretDB/github-actions/setup-go@main
-        with:
-          cache-key: env-data
-
-      - name: Install Task
-        run: go generate -x
-        working-directory: tools
-
-      - name: Start environment
-        run: bin/task env-up-detach
-
-      - name: Run init
-        run: bin/task init
-
-      - name: Wait for and setup environment
-        run: bin/task env-setup
-
-      - name: Run env-data
-        run: bin/task env-data
-
-  submit-coveralls:
-    name: Submit coveralls
-    runs-on: ubuntu-22.04
-
-    needs: test
-    if: github.event_name != 'pull_request' || !contains(github.event.pull_request.labels.*.name, 'not ready')
-
-    steps:
-      - name: Submit coveralls
-        uses: coverallsapp/github-action@v2
-        with:
-          parallel-finished: true
-          carryforward: unit # workaround for https://github.com/lemurheavy/coveralls-public/issues/1636

.github/workflows/packages.yml

@@ -21,11 +21,12 @@ on:
   push:
     branches:
       - main
+      - main-*
       - releases/*
     tags:
       - "*"
   schedule:
-    - cron: "12 0 * * 1" # on Mondays to pre-fill cache
+    - cron: "10 1 * * 1" # after cleanup and DocumentDB
 
 # Do not run this workflow in parallel for any PR change or branch/tag push
 # to prevent concurrent pushes for the same Docker image tag
@@ -40,13 +41,13 @@ env:
   GOLANGCI_LINT_CACHE: /home/runner/go/cache/lint
   GOMODCACHE: /home/runner/go/mod
   GOPROXY: https://proxy.golang.org
+  GOTOOLCHAIN: local
 
 jobs:
   build:
     name: Build packages
-    runs-on:
-      group: paid
-    timeout-minutes: 90
+    runs-on: server
+    timeout-minutes: 40
 
     if: >
       github.event_name != 'pull_request_target' ||
@@ -60,19 +61,21 @@ jobs:
       packages: write
 
     steps:
+      # TODO https://github.com/FerretDB/github-actions/issues/211
       - name: Checkout code
         if: github.event_name != 'pull_request_target'
-        uses: actions/checkout@v3
+        uses: actions/checkout@v5
         with:
           fetch-depth: 0 # for `git describe` to work
           lfs: false # LFS is used only by website
 
+      # TODO https://github.com/FerretDB/github-actions/issues/211
       - name: Checkout pull request code
         if: github.event_name == 'pull_request_target'
-        uses: actions/checkout@v3
+        uses: actions/checkout@v5
         with:
-          fetch-depth: 0
-          lfs: false
+          fetch-depth: 0 # for `git describe` to work
+          lfs: false # LFS is used only by website
           ref: ${{ github.event.pull_request.head.sha }}
 
       # for version.txt on push tags; see https://github.com/actions/checkout/issues/290
@@ -81,7 +84,7 @@ jobs:
           git fetch --tags --force
           git status
 
-      # for branch.txt on pull_request_target; `main` is already checked out on push / schedule
+      # for branch.txt on pull_request_target; the correct branch is already checked out on push / schedule
       - name: Name branch
         if: github.event_name == 'pull_request_target'
         env:
@@ -89,10 +92,8 @@ jobs:
         run: git checkout -b $BRANCH
 
       - name: Setup Go
-        id: setup
         uses: FerretDB/github-actions/setup-go@main
-        with:
-          cache-key: packages
+        # no cache-key on server
 
       - name: Install Task
         run: go generate -x
@@ -102,79 +103,99 @@ jobs:
         run: bin/task init
 
       - name: Setup QEMU
-        uses: docker/setup-qemu-action@v2
+        uses: docker/setup-qemu-action@v3
 
       - name: Initialize Docker Buildx builder
         run: bin/task docker-init
 
-      - name: Extract Docker image names
-        id: extract
-        uses: FerretDB/github-actions/extract-docker-tag@main
+      # mostly to check that this command still works
+      - name: Build local Docker image
+        run: bin/task docker-local FILE=production
+
+      - name: Define Docker image names
+        id: tag
+        run: bin/definedockertag
 
       - name: Login to Docker Hub
-        uses: docker/login-action@v2
+        uses: docker/login-action@v3
         with:
           username: ferretdbbot
           password: ${{ secrets.DOCKER_HUB_TOKEN }}
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v2
+        uses: docker/login-action@v3
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Restore Go caches
-        uses: actions/cache@v3
+      - name: Login to Quay.io
+        uses: docker/login-action@v3
         with:
-          path: tmp/docker/gocaches
-          key: packages-gocaches-${{ steps.setup.outputs.cache_week }}-${{ hashFiles('**/go.mod') }}
-          restore-keys: |
-            packages-gocaches-${{ steps.setup.outputs.cache_week }}-
+          registry: quay.io
+          username: ferretdbbot
+          password: ${{ secrets.QUAY_TOKEN }}
 
-      - name: Build and push all-in-one Docker images ${{ steps.extract.outputs.all_in_one_images }}
-        if: steps.extract.outputs.all_in_one_images != ''
-        run: bin/task docker-all-in-one-push DOCKER_IMAGES=${{ steps.extract.outputs.all_in_one_images }}
+      - name: Build and push evaluation development Docker images ${{ steps.tag.outputs.eval_dev_images }}
+        if: steps.tag.outputs.eval_dev_images != ''
+        run: bin/task docker-eval-dev-push DOCKER_IMAGES=${{ steps.tag.outputs.eval_dev_images }}
 
-      - name: Build and push development Docker images ${{ steps.extract.outputs.development_images }}
-        if: steps.extract.outputs.development_images != ''
-        run: bin/task docker-development-push DOCKER_IMAGES=${{ steps.extract.outputs.development_images }}
+      - name: Build and push evaluation Docker images ${{ steps.tag.outputs.eval_images }}
+        if: steps.tag.outputs.eval_images != ''
+        run: bin/task docker-eval-push DOCKER_IMAGES=${{ steps.tag.outputs.eval_images }}
 
-      - name: Build and push production Docker images ${{ steps.extract.outputs.production_images }}
-        if: steps.extract.outputs.production_images != ''
-        run: bin/task docker-production-push DOCKER_IMAGES=${{ steps.extract.outputs.production_images }}
+      - name: Build and push development Docker images ${{ steps.tag.outputs.development_images }}
+        if: steps.tag.outputs.development_images != ''
+        run: bin/task docker-development-push DOCKER_IMAGES=${{ steps.tag.outputs.development_images }}
 
-      - name: Build production release binary
-        run: bin/task build-release
+      - name: Build and push production Docker images ${{ steps.tag.outputs.production_images }}
+        if: steps.tag.outputs.production_images != ''
+        run: bin/task docker-production-push DOCKER_IMAGES=${{ steps.tag.outputs.production_images }}
 
-      - name: Upload ferretdb
-        uses: actions/upload-artifact@v3
+      - name: Build development binaries
+        run: bin/task build-development
+
+      - name: Upload development binaries
+        uses: actions/upload-artifact@v5
         with:
-          name: ferretdb
-          path: bin/ferretdb
+          name: bin-dev
+          path: tmp/bin-dev/
+          retention-days: 1
+          if-no-files-found: error
+
+      - name: Build production binaries
+        run: bin/task build-production
+
+      - name: Upload production binaries
+        uses: actions/upload-artifact@v5
+        with:
+          name: bin
+          path: tmp/bin/
           retention-days: 1
           if-no-files-found: error
 
       - name: Build Linux packages
         run: bin/task packages
 
-      - name: Upload .deb package
-        uses: actions/upload-artifact@v3
+      - name: Upload .deb packages
+        uses: actions/upload-artifact@v5
         with:
-          name: ferretdb.deb
-          path: tmp/debs/ferretdb.deb
+          name: debs
+          path: tmp/debs/
           retention-days: 1
           if-no-files-found: error
 
-      - name: Upload .rpm package
-        uses: actions/upload-artifact@v3
+      - name: Upload .rpm packages
+        uses: actions/upload-artifact@v5
         with:
-          name: ferretdb.rpm
-          path: tmp/rpms/ferretdb.rpm
+          name: rpms
+          path: tmp/rpms/
           retention-days: 1
           if-no-files-found: error
 
       - name: Check dirty
+        if: always()
         run: |
+          git status --untracked-files --ignored
           git status
           git diff --exit-code

.github/workflows/security.yml

@@ -10,6 +10,7 @@ on:
   push:
     branches:
       - main
+      - main-*
       - releases/*
   schedule:
     - cron: "12 0 * * *"
@@ -17,7 +18,7 @@ on:
 # Do not run this workflow in parallel for any PR change.
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.ref_name }}
-  cancel-in-progress: false
+  cancel-in-progress: true
 
 env:
   GOPATH: /home/runner/go
@@ -25,18 +26,23 @@ env:
   GOLANGCI_LINT_CACHE: /home/runner/go/cache/lint
   GOMODCACHE: /home/runner/go/mod
   GOPROXY: https://proxy.golang.org
+  GOTOOLCHAIN: local
 
 jobs:
   security-scan:
     name: Security scan
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     timeout-minutes: 10
 
     if: github.event_name != 'pull_request' || !contains(github.event.pull_request.labels.*.name, 'not ready')
 
+    permissions:
+      contents: read
+
     steps:
+      # TODO https://github.com/FerretDB/github-actions/issues/211
       - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v5
         with:
           fetch-depth: 0 # for `git describe` to work
           lfs: false # LFS is used only by website
@@ -50,18 +56,17 @@ jobs:
         run: go generate -x
         working-directory: tools
 
+      # https://github.com/aquasecurity/trivy/issues?q=is%3Aissue+%22permission+denied%22
+      - name: Create directory
+        run: mkdir -p tmp/trivy/fanal
+
       - name: Scan
-        run: bin/task --exit-code security
+        run: bin/task security
 
       # disabled until https://github.com/actions/dependency-review-action/issues/459 is resolved
       - name: Check dependencies for PRs
         # if: github.event_name == 'pull_request'
         if: false
-        uses: actions/dependency-review-action@v3
+        uses: actions/dependency-review-action@v4
         with:
           allow-licenses: Apache-2.0, BSD-3-Clause, MIT
-
-      # Workaround for `hashFiles` issue.
-      # See https://github.com/actions/runner/issues/449#issuecomment-1265837735.
-      - name: Clean
-        run: sudo rm -fr .cache

.github/workflows/testscripts.yml

@@ -1,5 +1,5 @@
 ---
-name: JS
+name: Test scripts
 on:
   pull_request:
     types:
@@ -9,9 +9,11 @@ on:
       - synchronize
     paths:
       - build/legacy-mongo-shell/*.js
+      - build/testscripts/*.sql
   push:
     branches:
       - main
+      - main-*
       - releases/*
   schedule:
     - cron: "12 0 * * *"
@@ -19,7 +21,7 @@ on:
 # Do not run this workflow in parallel for any PR change.
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.ref_name }}
-  cancel-in-progress: false
+  cancel-in-progress: true
 
 env:
   GOPATH: /home/runner/go
@@ -27,18 +29,23 @@ env:
   GOLANGCI_LINT_CACHE: /home/runner/go/cache/lint
   GOMODCACHE: /home/runner/go/mod
   GOPROXY: https://proxy.golang.org
+  GOTOOLCHAIN: local
 
 jobs:
-  testjs:
-    name: Test script
-    runs-on: ubuntu-22.04
+  run:
+    name: Run test scripts
+    runs-on: ubuntu-24.04
     timeout-minutes: 10
 
     if: github.event_name != 'pull_request' || !contains(github.event.pull_request.labels.*.name, 'not ready')
 
+    permissions:
+      contents: read
+
     steps:
+      # TODO https://github.com/FerretDB/github-actions/issues/211
       - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v5
         with:
           fetch-depth: 0 # for `git describe` to work
           lfs: false # LFS is used only by website
@@ -46,12 +53,19 @@ jobs:
       - name: Setup Go
         uses: FerretDB/github-actions/setup-go@main
         with:
-          cache-key: testjs
+          cache-key: testscripts
 
       - name: Install Task
         run: go generate -x
         working-directory: tools
 
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
       - name: Start environment
         run: bin/task env-up-detach
 
@@ -64,20 +78,26 @@ jobs:
       - name: Wait for and setup environment
         run: bin/task env-setup
 
-      - name: Start FerretDB in the background
+      - name: Start FerretDB (no auth) in the background
         run: >
           bin/ferretdb
           --listen-addr=:27017
-          --proxy-addr=127.0.0.1:47017
+          --proxy-addr=127.0.0.1:37017
+          --no-auth
           --mode=diff-normal
-          --handler=pg
-          --postgresql-url=postgres://username@127.0.0.1:5432/ferretdb
+          --postgresql-url='postgres://username:password@127.0.0.1:5432/postgres'
           2> ferretdb.log &
 
-      - name: Run testjs for MongoDB
-        run: bin/task testjs PORT=47017
+      - name: Run testsql for PostgreSQL
+        if: always()
+        run: bin/task testsql
 
-      - name: Run testjs for FerretDB
+      - name: Run testjs for MongoDB (no auth)
+        if: always()
+        run: bin/task testjs TESTJS_PORT=37017
+
+      - name: Run testjs for FerretDB (no auth)
+        if: always()
         run: bin/task testjs
 
       - name: Compress FerretDB log before upload
@@ -86,7 +106,7 @@ jobs:
 
       - name: Upload FerretDB log
         if: failure()
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v5
         with:
           name: ferretdb-log
           path: ferretdb-log.zip
@@ -96,6 +116,7 @@ jobs:
       - name: Show FerretDB log
         if: always()
         run: |
+          echo "::remove-matcher owner=go::"
           cat ferretdb.log
           rm ferretdb.log
 
@@ -105,6 +126,8 @@ jobs:
         run: go clean -testcache -fuzzcache
 
       - name: Check dirty
+        if: always()
         run: |
+          git status --untracked-files --ignored
           git status
           git diff --exit-code

.github/workflows/website-preview.yml

@@ -21,11 +21,12 @@ env:
   GOLANGCI_LINT_CACHE: /home/runner/go/cache/lint
   GOMODCACHE: /home/runner/go/mod
   GOPROXY: https://proxy.golang.org
+  GOTOOLCHAIN: local
 
 jobs:
   blog-preview:
     name: Preview blog
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     timeout-minutes: 10
 
     if: >
@@ -38,9 +39,13 @@ jobs:
       name: cloudflare-dev-blog
       url: ${{ steps.extract.outputs.extracted_url }}
 
+    permissions:
+      contents: read
+
     steps:
+      # TODO https://github.com/FerretDB/github-actions/issues/211
       - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v5
         with:
           fetch-depth: 0 # for wrangler to work
           lfs: true
@@ -52,7 +57,7 @@ jobs:
           BRANCH: ${{ github.head_ref }} # see https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable
         run: git checkout -b $BRANCH
 
-      # no actionsdesk/lfs-warning due to https://github.com/ActionsDesk/lfs-warning/issues/150
+      # no ppremk/lfs-warning due to https://github.com/ppremk/lfs-warning/issues/150
 
       - name: Setup Go
         uses: FerretDB/github-actions/setup-go@main
@@ -68,6 +73,8 @@ jobs:
 
       - name: Build blog
         run: bin/task blog
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # for checkdocs
 
       - name: Check dirty
         run: |
@@ -75,7 +82,7 @@ jobs:
           git diff --exit-code
 
       - name: Deploy to Cloudflare Pages
-        run: bin/task --exit-code blog-cloudflare-preview | tee deploy.txt
+        run: bin/task blog-cloudflare-preview | tee deploy.txt
         env:
           CLOUDFLARE_ACCOUNT_ID: ${{ vars.CLOUDFLARE_ACCOUNT_ID }}
           CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
@@ -86,7 +93,7 @@ jobs:
 
   docs-preview:
     name: Preview docs
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     timeout-minutes: 10
 
     if: >
@@ -98,18 +105,22 @@ jobs:
       name: cloudflare-dev-docs
       url: ${{ steps.extract.outputs.extracted_url }}
 
+    permissions:
+      contents: read
+
     steps:
       # We can't easily download build results from the Docs workflow:
       # https://github.com/actions/download-artifact/issues/172
       # Just build them again instead.
       # That also allows us to pass branch name, commit hash, etc from git to wrangler.
 
+      # TODO https://github.com/FerretDB/github-actions/issues/211
       - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v5
         with:
           fetch-depth: 0 # for wrangler to work
           lfs: true
-          ref: ${{ github.event.pull_request.head.sha }}
+          ref: ${{ github.event.pull_request.head.sha }} # TODO https://github.com/FerretDB/github-actions/issues/211
 
       # for Wrangler / Cloudflare Pages on pull_request_target
       - name: Name branch
@@ -117,7 +128,7 @@ jobs:
           BRANCH: ${{ github.head_ref }} # see https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable
         run: git checkout -b $BRANCH
 
-      # no actionsdesk/lfs-warning due to https://github.com/ActionsDesk/lfs-warning/issues/150
+      # no ppremk/lfs-warning due to https://github.com/ppremk/lfs-warning/issues/150
 
       - name: Setup Go
         uses: FerretDB/github-actions/setup-go@main
@@ -131,8 +142,13 @@ jobs:
       - name: Build tools
         run: bin/task env-pull
 
+      - name: Create directory
+        run: mkdir -p tmp/githubcache
+
       - name: Build docs
         run: bin/task docs
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # for checkdocs
 
       - name: Check dirty
         run: |
@@ -140,7 +156,7 @@ jobs:
           git diff --exit-code
 
       - name: Deploy to Cloudflare Pages
-        run: bin/task --exit-code docs-cloudflare-preview | tee deploy.txt
+        run: bin/task docs-cloudflare-preview | tee deploy.txt
         env:
           CLOUDFLARE_ACCOUNT_ID: ${{ vars.CLOUDFLARE_ACCOUNT_ID }}
           CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}

.gitignore

@@ -1,19 +1,24 @@
-# Please use global .gitignore file for .vscode/, .idea/, etc.
+# This file is used only for repository-specific patterns.
+# Please use global .gitignore file for .DS_Store, .idea/, go.work, .envrc, etc.
 # See https://docs.github.com/en/get-started/getting-started-with-git/ignoring-files#configuring-ignored-files-for-all-repositories-on-your-computer
 
-# our tools
-bin/
-
-# caches
-.task/
-.cache/
-vendor/
-
-# development and build artifacts, temporary files, etc
-*.out
-*.sqlite
-*.txt
-**/testdata/fuzz/
 state.json
+telemetry.json
+
+*.bc
+*.o
+*.so
+
+*.out
+*.tmp
+*.txt
+!website/static/*.txt
+*.xml
+
+.task/
+bin/
 tmp/
+vendor/
 website/build/
+
+**/testdata/fuzz/

.gitmodules

@@ -0,0 +1,4 @@
+[submodule "documentdb"]
+	path = build/postgres-documentdb/documentdb
+	url = https://github.com/FerretDB/documentdb.git
+	branch = ferretdb

.golangci-new.yml

@@ -5,24 +5,31 @@
 run:
   timeout: 3m
 
+# bin/golangci-lint linters -c .golangci-new.yml
 linters-settings:
   asasalint:
     exclude:
       - ^lazyerrors\.Errorf$
     use-builtin-exclusions: true
     ignore-test: false
+  copyloopvar:
+    check-alias: true
   errcheck:
     check-type-assertions: false
     check-blank: false
     disable-default-exclusions: false
+    exclude-functions:
+      - (*github.com/jackc/pgx/v5.Conn).Close
   errorlint:
     # see caveats at https://github.com/polyfloyd/go-errorlint#fmterrorf-wrapping-verb
     errorf: false
     asserts: true
     comparison: true
   govet:
-    check-shadowing: true
     enable-all: true
+    settings:
+      shadow:
+        strict: true
   revive:
     ignore-generated-header: true
     severity: warning
@@ -30,7 +37,7 @@ linters-settings:
     rules:
       # https://github.com/mgechev/revive/blob/master/RULES_DESCRIPTIONS.md
       - name: exported
-        arguments: [checkPrivateReceivers]
+        arguments: [checkPrivateReceivers, disableStutteringCheck]
       - name: package-comments
   staticcheck:
     checks: ["all"]
@@ -55,7 +62,10 @@ linters:
     - asciicheck
     - depguard
     - exhaustive
+    - exhaustruct
+    - forbidigo
     - gci
+    - gochecksumtype
     - goconst
     - godot
     - godox
@@ -68,46 +78,55 @@ linters:
     - lll
     - misspell
     - nolintlint
+    - sloglint
+    - tagalign
+    - unparam
     - unused
     - whitespace
 
     # TODO https://github.com/FerretDB/FerretDB/issues/2748
     - bidichk
     - bodyclose
+    - canonicalheader
     - containedctx
     - contextcheck
     - cyclop
-    - deadcode
     - decorder
     - dogsled
     - dupl
+    - dupword
     - durationcheck
+    - err113
     - errchkjson
     - errname
-    - execinquery
-    - exhaustivestruct
-    - exhaustruct
-    - exportloopref
-    - forbidigo
+    - fatcontext
     - forcetypeassert
     - funlen
+    - ginkgolinter
+    - gocheckcompilerdirectives
     - gochecknoglobals
     - gochecknoinits
     - gocognit
     - gocritic
     - gocyclo
-    - goerr113
     - gofmt
     - gofumpt
-    - gomnd
     - gomoddirectives
     - goprintffuncname
     - gosec
+    - gosmopolitan
     - grouper
-    - ifshort
+    - iface
+    - inamedparam
+    - interfacebloat
+    - intrange
     - ireturn
+    - loggercheck
     - maintidx
     - makezero
+    - mirror
+    - mnd
+    - musttag
     - nakedret
     - nestif
     - nilerr
@@ -116,31 +135,31 @@ linters:
     - nonamedreturns
     - nosprintfhostport
     - paralleltest
+    - perfsprint
     - prealloc
     - predeclared
     - promlinter
+    - protogetter
+    - reassign
+    - recvcheck
     - rowserrcheck
+    - sloglint
+    - spancheck
     - sqlclosecheck
     - stylecheck
     - tagliatelle
     - tenv
+    - testableexamples
+    - testifylint
     - thelper
     - tparallel
     - typecheck
     - unconvert
-    - unparam
-    - varcheck
+    - usestdlibvars
     - varnamelen
     - wastedassign
     - wrapcheck
-
-    # deprecated
-    - golint
-    - interfacer
-    - maligned
-    - nosnakecase
-    - scopelint
-    - structcheck
+    - zerologlint
 
     - nlreturn # too annoying
     - testpackage # we test internals
@@ -148,5 +167,8 @@ linters:
 issues:
   max-issues-per-linter: 0
   max-same-issues: 0
-  exclude-use-default: false
+
   new-from-rev: origin/main
+  # whole-files: true
+
+  exclude-use-default: false

.golangci.yml

@@ -7,35 +7,120 @@ run:
 linters-settings:
   # asciicheck
   depguard:
-    list-type: blacklist
-    packages:
-      - golang.org/x/net/context # use stdlib's context instead
-      - github.com/FerretDB/FerretDB/internal/bson
-      - github.com/FerretDB/FerretDB/internal/handlers/pg/pgdb
-      - github.com/FerretDB/FerretDB/internal/handlers/sjson
-      - github.com/FerretDB/FerretDB/internal/handlers/tigris/tigrisdb
-      - github.com/FerretDB/FerretDB/internal/handlers/tigris/tjson
-      - github.com/FerretDB/FerretDB/internal/types/fjson
-      - github.com/jackc/pgconn
-      - github.com/jackc/pgproto3
-      - github.com/jackc/pgtype
-      - github.com/jackc/pgx/v4
-      - github.com/tigrisdata/tigris-client-go/api/client/v1/api
-      - github.com/tigrisdata/tigris-client-go/filter # We use our own filter without generics (see tigris/tigrisdb/filter)
+    rules:
+      old-packages:
+        files:
+          - $all
+        deny:
+          - pkg: golang.org/x/net/context
+            desc: use `context` package instead
+          - pkg: golang.org/x/exp/slices
+            desc: use `slices` package instead
+          - pkg: golang.org/x/exp/maps
+            desc: use `maps` package instead
+
+          - pkg: github.com/jackc/pgconn
+            desc: use `github.com/jackc/pgx/v5/pgconn` package instead
+          - pkg: github.com/jackc/pgproto3
+            desc: use `github.com/jackc/pgx/v5/pgproto3` package instead
+          - pkg: github.com/jackc/pgtype
+            desc: use `github.com/jackc/pgx/v5/pgtype` package instead
+          - pkg: github.com/jackc/pgx$
+            desc: use `github.com/jackc/pgx/v5` package instead
+          - pkg: github.com/jackc/pgx/v4
+            desc: use `github.com/jackc/pgx/v5` package instead
+
+          # TODO https://github.com/FerretDB/FerretDB/issues/4798
+          # - pkg: go.mongodb.org/mongo-driver/bson
+          #   desc: use `go.mongodb.org/mongo-driver/v2/bson` package instead
+          # - pkg: go.mongodb.org/mongo-driver/mongo
+          #   desc: use `go.mongodb.org/mongo-driver/v2/mongo` package instead
+
+          # - pkg: github.com/xdg-go/scram
+          #   desc: use `github.com/FerretDB/FerretDB/v2/internal/util/scram` package instead
+      ferretdb-in-tools:
+        files:
+          - "**/tools/**/*.go"
+        deny:
+          - pkg: github.com/FerretDB/FerretDB/v2/internal/
+            desc: tools should not import FerretDB code
+      wirebson:
+        files:
+          - $all
+          - "!**/cmd/envtool/*.go"
+          - "!**/internal/clientconn/*.go"
+          - "!**/internal/dataapi/server/*.go"
+          - "!**/internal/documentdb/**.go"
+          - "!**/internal/driver/*.go"
+          - "!**/internal/handler/**.go"
+          - "!**/internal/mcp/*.go"
+          - "!**/internal/mongoerrors/*.go"
+          - "!**/internal/util/logging/*.go"
+          - "!**/internal/util/scram/*.go"
+          - "!**/internal/util/testutil/*.go"
+        deny:
+          - pkg: github.com/FerretDB/wire/wirebson
+      documentdb:
+        files:
+          - "**/internal/documentdb/genwrap/*.go"
+        deny:
+          - pkg: github.com/FerretDB/FerretDB/v2/internal/documentdb
+      cursor:
+        files:
+          - $all
+          - "!**/internal/documentdb/**.go"
+        deny:
+          - pkg: github.com/FerretDB/FerretDB/v2/internal/documentdb/cursor
   exhaustive:
     default-signifies-exhaustive: false
+  exhaustruct:
+    include:
+      - TODO
+  forbidigo:
+    forbid:
+      - p: ^\Qpgxpool.Pool.AcquireFunc\E$
+        pkg: ^\Qgithub.com/jackc/pgx/v5/pgxpool\E$
+        msg: Use `Acquire` with `defer Release()` instead.
+
+      # TODO https://github.com/FerretDB/FerretDB/issues/4798
+      - p: ^\Qbson.E\E$
+        pkg: ^\Qgo.mongodb.org/mongo-driver/bson\E$
+        msg: Use `*wirebson.Document` or `*wirebson.Array` instead.
+      - p: ^\Qbson.D\E$
+        pkg: ^\Qgo.mongodb.org/mongo-driver/bson\E$
+        msg: Use `*wirebson.Document` instead.
+      - p: ^\Qbson.M\E$
+        pkg: ^\Qgo.mongodb.org/mongo-driver/bson\E$
+        msg: Use `*wirebson.Document` instead.
+      - p: ^\Qbson.A\E$
+        pkg: ^\Qgo.mongodb.org/mongo-driver/bson\E$
+        msg: Use `*wirebson.Array` instead.
+
+      - p: ^\Qbson.E\E$
+        pkg: ^\Qgo.mongodb.org/mongo-driver/v2/bson\E$
+        msg: Use `*wirebson.Document` or `*wirebson.Array` instead.
+      - p: ^\Qbson.D\E$
+        pkg: ^\Qgo.mongodb.org/mongo-driver/v2/bson\E$
+        msg: Use `*wirebson.Document` instead.
+      - p: ^\Qbson.M\E$
+        pkg: ^\Qgo.mongodb.org/mongo-driver/v2/bson\E$
+        msg: Use `*wirebson.Document` instead.
+      - p: ^\Qbson.A\E$
+        pkg: ^\Qgo.mongodb.org/mongo-driver/v2/bson\E$
+        msg: Use `*wirebson.Array` instead.
+    exclude-godoc-examples: true
+    analyze-types: true
   gci:
     sections:
       - standard
       - default
-      - prefix(github.com/FerretDB/FerretDB)
+      - prefix(github.com/FerretDB/FerretDB/v2/)
   goconst:
     min-occurrences: 5
     ignore-tests: true
   godot:
     scope: toplevel
     exclude:
-      - go-sumtype:decl
       - check interfaces
     capital: true
   godox:
@@ -43,6 +128,8 @@ linters-settings:
       - BUG
       - FIXME
       - HACK
+      - lala
+      - lalala
   goheader:
     # Please do not update it, including bumping a year.
     template: |-
@@ -60,12 +147,12 @@ linters-settings:
       See the License for the specific language governing permissions and
       limitations under the License.
   goimports:
-    local-prefixes: github.com/FerretDB/FerretDB
+    local-prefixes: github.com/FerretDB/FerretDB/v2
   gomodguard:
     blocked:
       modules:
-        - go.mongodb.org/mongo-driver:
-            reason: "FerretDB should not depend on MongoDB Go driver."
+        - github.com/FerretDB/FerretDB:
+            reason: "Use `github.com/FerretDB/FerretDB/v2/...` instead."
   gosimple:
     checks: ["all"]
   govet:
@@ -75,17 +162,26 @@ linters-settings:
       - nilness
       - shadow
   importas:
-    no-unaliased: false
-    no-extra-aliases: true
+    # https://github.com/julz/importas/issues/15
+    no-unaliased: true
+    no-extra-aliases: false
     alias:
-      - pkg: github.com/tigrisdata/tigris-client-go/api/server/v1
-        alias: api
+      - pkg: runtime/debug
+        alias: runtimedebug
       - pkg: github.com/prometheus/client_model/go
         alias: dto
-      - pkg: github.com/jackc/pgx-zap
-        alias: zapadapter
-      - pkg: modernc.org/sqlite/lib
-        alias: sqlitelib
+      - pkg: go.opentelemetry.io/otel/attribute
+        alias: otelattribute
+      - pkg: go.opentelemetry.io/otel/codes
+        alias: otelcodes
+      - pkg: go.opentelemetry.io/otel/trace
+        alias: oteltrace
+      - pkg: go.opentelemetry.io/otel/sdk/resource
+        alias: otelsdkresource
+      - pkg: go.opentelemetry.io/otel/sdk/trace
+        alias: otelsdktrace
+      - pkg: go.opentelemetry.io/otel/semconv/v1.34.0
+        alias: otelsemconv
   # ineffassign
   lll:
     line-length: 130
@@ -93,20 +189,51 @@ linters-settings:
   misspell:
     ignore-words:
       - guiness # present in the test dataset
+    extra-words: # https://go.dev/wiki/Spelling, https://github.com/golangci/misspell/issues/11
+      - typo: "iff"
+        correction: "if"
+      - typo: "cancelation"
+        correction: "cancellation"
   nolintlint:
     allow-unused: false
-    allow-leading-space: false
     allow-no-explanation: []
     require-explanation: true
     require-specific: true
   revive:
     ignore-generated-header: true
     severity: error
+    rules: []
+  sloglint:
+    no-mixed-args: true
+    kv-only: false
+    attr-only: true
+    no-global: "all"
+    context: "scope"
+    static-msg: false # TODO https://github.com/FerretDB/FerretDB/issues/3421
+    no-raw-keys: false # TODO https://github.com/FerretDB/FerretDB/issues/3421
+    key-naming-case: snake
+    args-on-sep-lines: false
   staticcheck:
     checks:
       - all
       - -SA1019 # ignore deprecation errors in existing code; new code is checked by the other configuration
-  # unused
+  tagalign:
+    sort: true
+    order:
+      - name
+      - cmd
+      - arg
+      - default
+      - help
+  unparam:
+    check-exported: false
+  unused:
+    field-writes-are-uses: false
+    post-statements-are-reads: false
+    exported-fields-are-used: false
+    parameters-are-used: true # it should be false, TODO https://github.com/FerretDB/FerretDB-DocumentDB/issues/823
+    local-variables-are-used: false
+    generated-is-used: false
   whitespace:
     multi-if: false
     multi-func: false
@@ -117,7 +244,10 @@ linters:
     - asciicheck
     - depguard
     - exhaustive
+    - exhaustruct
+    - forbidigo
     - gci
+    - gochecksumtype
     - goconst
     - godot
     - godox
@@ -132,7 +262,10 @@ linters:
     - misspell
     - nolintlint
     - revive
+    - sloglint
     - staticcheck
+    - tagalign
+    - unparam
     - unused
     - whitespace
 
@@ -142,57 +275,10 @@ issues:
 
   exclude-use-default: false
   exclude-rules:
-    # only `wire` package can import `bson` package
-    - linters: [depguard]
-      path: internal/wire
-      text: bson
-
-    # only `testutil`, `bson` (for testing), and `wire` packages can import `fjson` package
-    - linters: [depguard]
-      path: internal/util/testutil
-      text: fjson
-    - linters: [depguard]
-      path: internal/bson
-      text: fjson
-    - linters: [depguard]
-      path: internal/wire
-      text: fjson
-
-    # only `pg` handler can import `pgdb` package, no other handler can do that
-    - linters: [depguard]
-      path: internal/handlers/pg
-      text: pgdb
-    - linters: [depguard]
-      path: internal/handlers/registry
-      text: pgdb
-    - linters: [depguard]
-      path: cmd/envtool
-      text: pgdb
-
-    # only `pg` handler and `sqlite` backend can import `sjson` package, no other handlers or backends can do that
-    - linters: [depguard]
-      path: internal/handlers/pg
-      text: sjson
-    - linters: [depguard]
-      path: internal/backends/sqlite
-      test: sjson
-
-    # only `tigris` handler can import `tigrisdb` package, no other handler can do that
-    - linters: [depguard]
-      path: internal/handlers/tigris
-      text: tigrisdb
-    - linters: [depguard]
-      path: internal/handlers/registry
-      text: tigrisdb
-    - linters: [depguard]
-      path: cmd/envtool
-      text: tigrisdb
-
-    # only `tigris` handler can import `tjson` package, no other handler can do that
-    - linters: [depguard]
-      path: internal/handlers/tigris
-      text: tjson
-
     # we don't want to introduce that constant
     - linters: [goconst]
       text: "^string `_id` has \\d+ occurrences, make it a constant"
+
+    - linters: [forbidigo]
+      path: "\\Qferretdb/ferretdb_test.go"
+      text: "\\Quse of `bson.D` forbidden"

.prettierignore

@@ -0,0 +1,6 @@
+# We can't have it in build/.prettierignore due to https://github.com/prettier/prettier/issues/15428
+# Textlint uses the same format, so we re-use the file.
+build/postgres-documentdb/documentdb/**
+internal/dataapi/api/openapi.json
+internal/dataapi/api/openapi-original.json
+website/static/codapi/snippet.js

CHANGELOG.md

@@ -2,337 +2,619 @@
 
 <!-- markdownlint-disable MD024 MD034 -->
 
-## [v1.3.0](https://github.com/FerretDB/FerretDB/releases/tag/v1.3.0) (2023-06-05)
+## [v2.7.0](https://github.com/FerretDB/FerretDB/releases/tag/v2.7.0) (2025-11-10)
 
-### New Features 🎉
+(We skipped v2.6.0 to align DocumentDB and FerretDB version numbers.)
 
-- Implement positional operator in projection by @chilagrow in https://github.com/FerretDB/FerretDB/pull/2688
-- Implement `logout` command by @kropidlowsky in https://github.com/FerretDB/FerretDB/pull/2639
+This version works best with
+[DocumentDB v0.107.0-ferretdb-2.7.0](https://github.com/FerretDB/documentdb/releases/tag/v0.107.0-ferretdb-2.7.0).
 
-### Fixed Bugs 🐛
+### Breaking changes
 
-- Fix reporting of updates availability by @rumyantseva in https://github.com/FerretDB/FerretDB/pull/2653
-- Fix `.deb` and `.rpm` package versions by @AlekSi in https://github.com/FerretDB/FerretDB/pull/2725
-- Allow query to be type null in `distinct` command by @b1ron in https://github.com/FerretDB/FerretDB/pull/2658
-- Fix path collisions for multiple update operators by @noisersup in https://github.com/FerretDB/FerretDB/pull/2713
-
-### Enhancements 🛠
-
-- Fix `_id` formatting in update error messages by @noisersup in https://github.com/FerretDB/FerretDB/pull/2711
-
-### Documentation 📄
-
-- Add release blog post for FerretDB version 1.2.0 by @Fashander in https://github.com/FerretDB/FerretDB/pull/2686
-- Update `$project` in Supported Commands by @Fashander in https://github.com/FerretDB/FerretDB/pull/2710
-- Add formatter for markdown tables by @rumyantseva in https://github.com/FerretDB/FerretDB/pull/2693
-- Reformat and lint more documentation files by @AlekSi in https://github.com/FerretDB/FerretDB/pull/2740
-- Document aggregation operations by @Fashander in https://github.com/FerretDB/FerretDB/pull/2672
-- Improve authentication documentation by @chilagrow in https://github.com/FerretDB/FerretDB/pull/2737
-
-### Other Changes 🤖
-
-- Refactor `gitBinaryMaskParam` function by @w84thesun in https://github.com/FerretDB/FerretDB/pull/2634
-- Add `distinct` command errors test by @w84thesun in https://github.com/FerretDB/FerretDB/pull/2687
-- Clarify what's left in handling OP_MSG checksum by @rumyantseva in https://github.com/FerretDB/FerretDB/pull/2677
-- Return a better error for authentication problems by @AlekSi in https://github.com/FerretDB/FerretDB/pull/2703
-- Aggregation operators refactor by @noisersup in https://github.com/FerretDB/FerretDB/pull/2664
-- Implement `envtool version` command by @jeremyphua in https://github.com/FerretDB/FerretDB/pull/2714
-- Make `go test -list=.` work by @AlekSi in https://github.com/FerretDB/FerretDB/pull/2718
-- Include Hana in integration tests by @polyal in https://github.com/FerretDB/FerretDB/pull/2715
-- Bump deps by @AlekSi in https://github.com/FerretDB/FerretDB/pull/2702
-- Add `logout` test for all backend by @chilagrow in https://github.com/FerretDB/FerretDB/pull/2726
-- Fix telemetry reporter logging by @AlekSi in https://github.com/FerretDB/FerretDB/pull/2707
-- Add supported aggregations to the `buildInfo` output by @kropidlowsky in https://github.com/FerretDB/FerretDB/pull/2716
-- Add aggregation operator tests by @chilagrow in https://github.com/FerretDB/FerretDB/pull/2724
-- Add more consistency to table tests' field names by @rumyantseva in https://github.com/FerretDB/FerretDB/pull/2717
-- Don't use `sjson.GetTypeOfValue` where it shouldn't be used by @noisersup in https://github.com/FerretDB/FerretDB/pull/2728
-- Unify test file names by @w84thesun in https://github.com/FerretDB/FerretDB/pull/2709
-- Make `testFindAndModifyCompat` work with `compatTestCaseResultType` by @rumyantseva in https://github.com/FerretDB/FerretDB/pull/2739
-- Bump deps by @AlekSi in https://github.com/FerretDB/FerretDB/pull/2745
-- Call `ListSpecifications` driver's method in tests to check indexes by @rumyantseva in https://github.com/FerretDB/FerretDB/pull/2746
-- Simplify `CountIterator` by @AlekSi in https://github.com/FerretDB/FerretDB/pull/2759
-- Check for `nil` values in iterators explicitly by @AlekSi in https://github.com/FerretDB/FerretDB/pull/2758
-- Trigger GC to run finalizers by @AlekSi in https://github.com/FerretDB/FerretDB/pull/2771
-- Update `golangci-lint` config by @AlekSi in https://github.com/FerretDB/FerretDB/pull/2772
-- Remove the need to call `DeepCopy` in some places by @AlekSi in https://github.com/FerretDB/FerretDB/pull/2774
-- Clean-up `lazyerrors`, use them in more places by @AlekSi in https://github.com/FerretDB/FerretDB/pull/2770
-- Replace document slices with iterators by @noisersup in https://github.com/FerretDB/FerretDB/pull/2730
-- Fix `findAndModify` tests for MongoDB 6.0.6 by @chilagrow in https://github.com/FerretDB/FerretDB/pull/2779
-- Implement a few command stubs by @AlekSi in https://github.com/FerretDB/FerretDB/pull/2777
-- Add more handler tests by @w84thesun in https://github.com/FerretDB/FerretDB/pull/2769
-- Remove `findAndModify` integration tests with `$` prefixed key for MongoDB 6.0.6 compatibility by @chilagrow in https://github.com/FerretDB/FerretDB/pull/2785
-
-## New Contributors
-
-- @jeremyphua made their first contribution in https://github.com/FerretDB/FerretDB/pull/2714
-
-[All closed issues and pull requests](https://github.com/FerretDB/FerretDB/milestone/42?closed=1).
-[All commits](https://github.com/FerretDB/FerretDB/compare/v1.2.1...v1.3.0).
-
-## [v1.2.1](https://github.com/FerretDB/FerretDB/releases/tag/v1.2.1) (2023-05-24)
-
-### Fixed Bugs 🐛
-
-- Fix reporting of updates availability by @rumyantseva in https://github.com/FerretDB/FerretDB/pull/2653
-
-### Other Changes 🤖
-
-- Return a better error for authentication problems by @AlekSi in https://github.com/FerretDB/FerretDB/pull/2703
-
-[All closed issues and pull requests](https://github.com/FerretDB/FerretDB/milestone/43?closed=1).
-[All commits](https://github.com/FerretDB/FerretDB/compare/v1.2.0...v1.2.1).
-
-## [v1.2.0](https://github.com/FerretDB/FerretDB/releases/tag/v1.2.0) (2023-05-22)
+There are some changes in our Prometheus metrics and OpenTelemetry traces.
+Please note that they are
+[not stable yet](https://docs.ferretdb.io/v2.7/configuration/observability/).
 
 ### What's Changed
 
-This release includes a highly experimental and unsupported SQLite backend.
-It will be improved in future releases.
+#### Basic MCP server
 
-### Fixed Bugs 🐛
+This release adds basic MCP server support.
+Future release will bring additional functionality.
 
-- Fix compatibility with C# driver by @b1ron in https://github.com/FerretDB/FerretDB/pull/2613
-- Fix a bug with unset field sorting by @rumyantseva in https://github.com/FerretDB/FerretDB/pull/2638
-- Return `int64` values for `dbStats` and `collStats` by @AlekSi in https://github.com/FerretDB/FerretDB/pull/2642
-- Return command error from `findAndModify` by @chilagrow in https://github.com/FerretDB/FerretDB/pull/2646
-- Fix index creation on nested fields by @wqhhust in https://github.com/FerretDB/FerretDB/pull/2637
+#### Connectivity improvements
 
-### Enhancements 🛠
-
-- Perform `insertMany` in a single transaction by @raeidish in https://github.com/FerretDB/FerretDB/pull/2532
-- Relax PostgreSQL connection checks by @AlekSi in https://github.com/FerretDB/FerretDB/pull/2602
-- Cleanup `insert` command by @noisersup in https://github.com/FerretDB/FerretDB/pull/2609
-- Support dot notation in projection by @chilagrow in https://github.com/FerretDB/FerretDB/pull/2536
-
-### Documentation 📄
-
-- Add FerretDB v1.1.0 release blog post by @Fashander in https://github.com/FerretDB/FerretDB/pull/2594
-- Update blog post image for 1.1.0 by @AlekSi in https://github.com/FerretDB/FerretDB/pull/2601
-- Add documentation for `.rpm` packages by @AlekSi in https://github.com/FerretDB/FerretDB/pull/2604
-- Fix a typo in a blog post by @AlekSi in https://github.com/FerretDB/FerretDB/pull/2611
-- Fix typo on RPM package file name by @christiano in https://github.com/FerretDB/FerretDB/pull/2628
-- Update documentation formatting by @AlekSi in https://github.com/FerretDB/FerretDB/pull/2640
-- Add blog post on "Meteor and FerretDB" by @Fashander in https://github.com/FerretDB/FerretDB/pull/2654
-
-### Other Changes 🤖
-
-- Bump deps by @AlekSi in https://github.com/FerretDB/FerretDB/pull/2592
-- Remove `TODO` comment for closed issue by @adetunjii in https://github.com/FerretDB/FerretDB/pull/2573
-- Add experimental integration test flag for pushdown sorting by @noisersup in https://github.com/FerretDB/FerretDB/pull/2595
-- Extract handler parameters from corresponding structure by @w84thesun in https://github.com/FerretDB/FerretDB/pull/2513
-- Add `shell` subcommands (`mkdir`, `rmdir`) in `envtool` by @kropidlowsky in https://github.com/FerretDB/FerretDB/pull/2596
-- Add basic postcondition checker for errors by @AlekSi in https://github.com/FerretDB/FerretDB/pull/2607
-- Add `sqlite` handler stub by @AlekSi in https://github.com/FerretDB/FerretDB/pull/2608
-- Make protocol-level crashes easier to understand by @AlekSi in https://github.com/FerretDB/FerretDB/pull/2610
-- Simplify `envtool shell` subcommands by @AlekSi in https://github.com/FerretDB/FerretDB/pull/2614
-- Cleanup old Docker images by @wqhhust in https://github.com/FerretDB/FerretDB/pull/2533
-- Fix exponential backoff minimum duration by @noisersup in https://github.com/FerretDB/FerretDB/pull/2578
-- Fix `count`'s `query` parameter by @w84thesun in https://github.com/FerretDB/FerretDB/pull/2622
-- Add a README.md file for assertions by @b1ron in https://github.com/FerretDB/FerretDB/pull/2569
-- Use `ExtractParameters` in handlers by @w84thesun in https://github.com/FerretDB/FerretDB/pull/2620
-- Verify `OP_MSG` message checksum by @adetunjii in https://github.com/FerretDB/FerretDB/pull/2540
-- Separate codebase for aggregation `$project` and query `projection` by @chilagrow in https://github.com/FerretDB/FerretDB/pull/2631
-- Implement `envtool shell read` subcommand by @wqhhust in https://github.com/FerretDB/FerretDB/pull/2626
-- Cleanup projection by @chilagrow in https://github.com/FerretDB/FerretDB/pull/2641
-- Add common backend interface prototype by @AlekSi in https://github.com/FerretDB/FerretDB/pull/2619
-- Add SQLite handler flags by @AlekSi in https://github.com/FerretDB/FerretDB/pull/2651
-- Add tests for aggregation expressions with dots in `$group` aggregation stage by @rumyantseva in https://github.com/FerretDB/FerretDB/pull/2636
-- Implement some SQLite backend commands by @AlekSi in https://github.com/FerretDB/FerretDB/pull/2655
-- Fix tests to assert correct error by @chilagrow in https://github.com/FerretDB/FerretDB/pull/2546
-- Aggregation expression refactor by @noisersup in https://github.com/FerretDB/FerretDB/pull/2644
-- Move common commands to `commoncommands` by @AlekSi in https://github.com/FerretDB/FerretDB/pull/2660
-- Add basic observability into backend interfaces by @AlekSi in https://github.com/FerretDB/FerretDB/pull/2661
-- Implement metadata storage by @w84thesun in https://github.com/FerretDB/FerretDB/pull/2656
-- Add `Query` to the common backend interface by @AlekSi in https://github.com/FerretDB/FerretDB/pull/2662
-- Implement query request for SQLite backend by @w84thesun in https://github.com/FerretDB/FerretDB/pull/2665
-- Add test case for read in envtools by @wqhhust in https://github.com/FerretDB/FerretDB/pull/2657
-- Run integration tests for `sqlite` handler by @AlekSi in https://github.com/FerretDB/FerretDB/pull/2666
-- Bump deps by @AlekSi in https://github.com/FerretDB/FerretDB/pull/2671
-- Create SQLite directory if needed by @AlekSi in https://github.com/FerretDB/FerretDB/pull/2673
-- Implement SQLite `update` and `delete` commands by @w84thesun in https://github.com/FerretDB/FerretDB/pull/2674
-
-### New Contributors
-
-- @adetunjii made their first contribution in https://github.com/FerretDB/FerretDB/pull/2573
-- @christiano made their first contribution in https://github.com/FerretDB/FerretDB/pull/2628
-
-[All closed issues and pull requests](https://github.com/FerretDB/FerretDB/milestone/41?closed=1).
-[All commits](https://github.com/FerretDB/FerretDB/compare/v1.1.0...v1.2.0).
-
-## [v1.1.0](https://github.com/FerretDB/FerretDB/releases/tag/v1.1.0) (2023-05-09)
+PostgreSQL connections are now reused, often yielding modest performance gains.
 
 ### New Features 🎉
 
-- Implement projection fields assignment by @w84thesun in https://github.com/FerretDB/FerretDB/pull/2484
-- Implement `$project` pipeline aggregation stage by @w84thesun in https://github.com/FerretDB/FerretDB/pull/2383
-- Handle `create` and `drop` commands in Hana handler by @polyal in https://github.com/FerretDB/FerretDB/pull/2458
-- Implement `renameCollection` command by @b1ron in https://github.com/FerretDB/FerretDB/pull/2343
-
-### Fixed Bugs 🐛
-
-- Fix `findAndModify` for `$exists` query operator by @chilagrow in https://github.com/FerretDB/FerretDB/pull/2385
-- Fix `SchemaStats` to return correct data by @rumyantseva in https://github.com/FerretDB/FerretDB/pull/2426
-- Fix `findAndModify` for `$set` operator setting `_id` by @chilagrow in https://github.com/FerretDB/FerretDB/pull/2507
-- Fix `update` for conflicting dot notation paths by @chilagrow in https://github.com/FerretDB/FerretDB/pull/2521
-- Fix `$` path errors for sort by @chilagrow in https://github.com/FerretDB/FerretDB/pull/2534
-- Fix empty projections panic by @w84thesun in https://github.com/FerretDB/FerretDB/pull/2562
-- Fix `runCommand`'s inserts of documents without `_id`s by @kropidlowsky in https://github.com/FerretDB/FerretDB/pull/2574
+- Add basic MCP server by @chilagrow in https://github.com/FerretDB/FerretDB/pull/5279
+- Implement DataAPI graceful shutdown and add OpenAPI spec endpoint by @chilagrow in https://github.com/FerretDB/FerretDB/pull/5357
+- Improve proxy mode observability by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5440
+- Add tracing of SQL queries by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5514
 
 ### Enhancements 🛠
 
-- Validate `scale` param for `dbStats` and `collStats` correctly by @rumyantseva in https://github.com/FerretDB/FerretDB/pull/2418
-- Allow database name contain uppercase characters by @syasyayas in https://github.com/FerretDB/FerretDB/pull/2504
-- Add identifying Arch Linux version in `hostInfo` command by @kropidlowsky in https://github.com/FerretDB/FerretDB/pull/2525
-- Handle absent `os-release` file by @kropidlowsky in https://github.com/FerretDB/FerretDB/pull/2541
-- Improve handling of `os-release` files by @kropidlowsky in https://github.com/FerretDB/FerretDB/pull/2553
+- Add `PostgreSQL` metrics by @chilagrow in https://github.com/FerretDB/FerretDB/pull/5427
+- Rename OpenTelemetry spans by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5512
 
 ### Documentation 📄
 
-- Document test script by @chilagrow in https://github.com/FerretDB/FerretDB/pull/2353
-- Use `draft` instead of `unlisted` by @AlekSi in https://github.com/FerretDB/FerretDB/pull/2372
-- Make example docker compose file restart on failure by @noisersup in https://github.com/FerretDB/FerretDB/pull/2376
-- Document how to get logs by @chilagrow in https://github.com/FerretDB/FerretDB/pull/2355
-- Update writing guide by @Fashander in https://github.com/FerretDB/FerretDB/pull/2373
-- Add comments to our documentation workflow by @AlekSi in https://github.com/FerretDB/FerretDB/pull/2390
-- Add blogpost: Announcing FerretDB 1.0 GA - a truly Open Source MongoDB alternative by @AlekSi in https://github.com/FerretDB/FerretDB/pull/2397
-- Update documentation for index options by @AlekSi in https://github.com/FerretDB/FerretDB/pull/2417
-- Add query pushdown documentation by @noisersup in https://github.com/FerretDB/FerretDB/pull/2339
-- Update README.md to link to SSPL by @cooljeanius in https://github.com/FerretDB/FerretDB/pull/2420
-- Improve documentation for Docker by @AlekSi in https://github.com/FerretDB/FerretDB/pull/2396
-- Add more detailed PR guides in CONTRIBUTING.md by @AuruTus in https://github.com/FerretDB/FerretDB/pull/2435
-- Remove a few double spaces by @AlekSi in https://github.com/FerretDB/FerretDB/pull/2431
-- Add image for a future blog post by @AlekSi in https://github.com/FerretDB/FerretDB/pull/2453
-- Add blogpost - Using FerretDB with Studio 3T by @AlekSi in https://github.com/FerretDB/FerretDB/pull/2454
-- Fix YAML indentation by @AlekSi in https://github.com/FerretDB/FerretDB/pull/2455
-- Update blog post on Using FerretDB with Studio3T by @Fashander in https://github.com/FerretDB/FerretDB/pull/2457
-- Document `createIndexes`, `listIndexes`, and `dropIndexes` commands by @Fashander in https://github.com/FerretDB/FerretDB/pull/2488
+- Add blog post on Formio by @Fashander in https://github.com/FerretDB/FerretDB/pull/5395
+- Document cloud instance deployment and setup by @Fashander in https://github.com/FerretDB/FerretDB/pull/5424
+- Update content guide by @Fashander in https://github.com/FerretDB/FerretDB/pull/5441
+- Update compatible apps by @Fashander in https://github.com/FerretDB/FerretDB/pull/5442
+- Add documentation page stub for MCP server by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5451
+- Add FerretDB Cloud blog post by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5461
+- Update cloud installation docs by @Fashander in https://github.com/FerretDB/FerretDB/pull/5466
 
 ### Other Changes 🤖
 
-- Allow setting "package" variable with a testing flag by @AlekSi in https://github.com/FerretDB/FerretDB/pull/2357
-- Make it easier to use Docker-related Task targets by @AlekSi in https://github.com/FerretDB/FerretDB/pull/2358
-- Do not mark released binaries as dirty by @AlekSi in https://github.com/FerretDB/FerretDB/pull/2371
-- Make Docker Compose flags compatible by @AlekSi in https://github.com/FerretDB/FerretDB/pull/2377
-- Bump dependencies by @AlekSi in https://github.com/FerretDB/FerretDB/pull/2367
-- Fix version.txt generation for git tags by @AlekSi in https://github.com/FerretDB/FerretDB/pull/2388
-- Fix types order linter by @AlekSi in https://github.com/FerretDB/FerretDB/pull/2391
-- Cleanup deprecated errors by @chilagrow in https://github.com/FerretDB/FerretDB/pull/2411
-- Bump deps by @AlekSi in https://github.com/FerretDB/FerretDB/pull/2408
-- Use parallel tests consistently by @chilagrow in https://github.com/FerretDB/FerretDB/pull/2409
-- Compress CI artifacts by @noisersup in https://github.com/FerretDB/FerretDB/pull/2424
-- Use exponential backoff with jitter by @j0holo in https://github.com/FerretDB/FerretDB/pull/2419
-- Add Mergify rules for blog posts by @AlekSi in https://github.com/FerretDB/FerretDB/pull/2434
-- Migrate to `pgx/v5` by @craigpastro in https://github.com/FerretDB/FerretDB/pull/2439
-- Make it harder to misuse iterators by @AlekSi in https://github.com/FerretDB/FerretDB/pull/2428
-- Update PR template by @AlekSi in https://github.com/FerretDB/FerretDB/pull/2441
-- Rename testing flag by @AlekSi in https://github.com/FerretDB/FerretDB/pull/2437
-- Fix compilation on riscv64 by @afiskon in https://github.com/FerretDB/FerretDB/pull/2456
-- Cleanup exponential backoff with jitter by @chilagrow in https://github.com/FerretDB/FerretDB/pull/2443
-- Add workaround for CockroachDB issue by @AlekSi in https://github.com/FerretDB/FerretDB/pull/2464
-- Implement blog posts previews by @noisersup in https://github.com/FerretDB/FerretDB/pull/2433
-- Introduce integration benchmarks by @noisersup in https://github.com/FerretDB/FerretDB/pull/2381
-- Add tests to findAndModify on `$exists` operator by @chilagrow in https://github.com/FerretDB/FerretDB/pull/2422
-- Bump deps by @AlekSi in https://github.com/FerretDB/FerretDB/pull/2479
-- Refactor aggregation by @chilagrow in https://github.com/FerretDB/FerretDB/pull/2463
-- Tweak documentation by @AlekSi in https://github.com/FerretDB/FerretDB/pull/2452
-- Fix query projection for top level fields by @w84thesun in https://github.com/FerretDB/FerretDB/pull/2386
-- Handle `envtool` panic on timeout by @syasyayas in https://github.com/FerretDB/FerretDB/pull/2499
-- Enable debugging tracing of SQL queries by @craigpastro in https://github.com/FerretDB/FerretDB/pull/2467
-- Update blog file names to match with slug by @chilagrow in https://github.com/FerretDB/FerretDB/pull/2497
-- Add benchmark for replacing large document by @noisersup in https://github.com/FerretDB/FerretDB/pull/2482
-- Add more documentation-related items to definition of done by @rumyantseva in https://github.com/FerretDB/FerretDB/pull/2494
-- Return unsupported operator error for `$` projection operator by @w84thesun in https://github.com/FerretDB/FerretDB/pull/2512
-- Use `update_available` from Beacon by @chilagrow in https://github.com/FerretDB/FerretDB/pull/2496
-- Use iterator in aggregation stages by @chilagrow in https://github.com/FerretDB/FerretDB/pull/2480
-- Increase timeout for tests by @rumyantseva in https://github.com/FerretDB/FerretDB/pull/2508
-- Add `InsertMany` benchmark by @raeidish in https://github.com/FerretDB/FerretDB/pull/2518
-- Add coveralls.io integration by @noisersup in https://github.com/FerretDB/FerretDB/pull/2483
-- Add linter for checking blog posts by @raeidish in https://github.com/FerretDB/FerretDB/pull/2459
-- Add a YAML formatter by @wqhhust in https://github.com/FerretDB/FerretDB/pull/2485
-- Fix `collStats` for Tigris by @rumyantseva in https://github.com/FerretDB/FerretDB/pull/2520
-- Small addition to YAML formatter usage by @rumyantseva in https://github.com/FerretDB/FerretDB/pull/2524
-- Cleanup of blog post linter for slug by @chilagrow in https://github.com/FerretDB/FerretDB/pull/2526
-- Pushdown simplest sorting for `find` command by @noisersup in https://github.com/FerretDB/FerretDB/pull/2506
-- Move `handlers/pg/pjson` to `handlers/sjson` by @craigpastro in https://github.com/FerretDB/FerretDB/pull/2531
-- Check test database name length in compat test setup by @chilagrow in https://github.com/FerretDB/FerretDB/pull/2527
-- Document `not ready` issues label by @AlekSi in https://github.com/FerretDB/FerretDB/pull/2544
-- Remove version and name assertions in integration tests by @raeidish in https://github.com/FerretDB/FerretDB/pull/2552
-- Add helpers for iterators and generators by @AlekSi in https://github.com/FerretDB/FerretDB/pull/2542
-- Do various small cleanups by @AlekSi in https://github.com/FerretDB/FerretDB/pull/2561
-- Pushdown simplest sorting for `aggregate` command by @noisersup in https://github.com/FerretDB/FerretDB/pull/2530
-- Move handlers parameters to common by @w84thesun in https://github.com/FerretDB/FerretDB/pull/2529
-- Use our own Prettier Docker image by @AlekSi in https://github.com/FerretDB/FerretDB/pull/2535
-- Improve fuzzing with recorded seed data by @fenogentov in https://github.com/FerretDB/FerretDB/pull/2392
-- Add proper CLI to `envtool` - `envtool setup` subcommand by @kropidlowsky in https://github.com/FerretDB/FerretDB/pull/2570
-- Recover from more errors, close connection less often by @AlekSi in https://github.com/FerretDB/FerretDB/pull/2564
-- Tweak issue templates and contributing docs by @AlekSi in https://github.com/FerretDB/FerretDB/pull/2572
-- Refactor integration benchmarks by @AlekSi in https://github.com/FerretDB/FerretDB/pull/2537
-- Do panic in integration tests if connection can't be established by @rumyantseva in https://github.com/FerretDB/FerretDB/pull/2577
-- Small refactoring by @AlekSi in https://github.com/FerretDB/FerretDB/pull/2575
-- Merge `no ci` label into `not ready` by @AlekSi in https://github.com/FerretDB/FerretDB/pull/2580
+- Use middleware by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5377
+- Use generated structs in Data API by @noisersup in https://github.com/FerretDB/FerretDB/pull/5382
+- Upload YugabyteDB log files by @chilagrow in https://github.com/FerretDB/FerretDB/pull/5401
+- Update documentation to point to the next release by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5423
+- Bump YugabyteDB to stable version by @chilagrow in https://github.com/FerretDB/FerretDB/pull/5428
+- Use QEMU on arm64 for Yugabyte for now by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5429
+- Add comments to supervisord config by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5430
+- Update DocumentDB by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5431
+- Make `Run` wait for all `Handle` calls to finish by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5434
+- Tweak `conninfo` by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5435
+- Add middleware by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5437
+- Update expected PostgreSQL version by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5438
+- Avoid hijacking connections from the pool and immediately closing them by @chilagrow in https://github.com/FerretDB/FerretDB/pull/5443
+- Remove flaky test by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5444
+- Add TODO comment about Debian 13 Trixie by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5450
+- Add MCP tools by @chilagrow in https://github.com/FerretDB/FerretDB/pull/5452
+- Bump deps by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5455
+- Update `wire` dependency by @noisersup in https://github.com/FerretDB/FerretDB/pull/5465
+- Add helpers for lazy logging by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5467
+- Move to `documentdb/documentdb` by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5468
+- Update dependencies by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5479
+- Add a test for `*documentdb.Conn` finalizing by @noisersup in https://github.com/FerretDB/FerretDB/pull/5484
+- Finalize PostgreSQL metrics by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5485
+- Fix spelling in `.go` files by @jsoref in https://github.com/FerretDB/FerretDB/pull/5492
+- Fix `CODEOWNERS` grammar by @jsoref in https://github.com/FerretDB/FerretDB/pull/5495
+- Use Go 1.25.1 by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5508
+- Bump deps by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5509
+- Minor observability cleanup by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5511
+- Bump dependencies by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5519
+- Use Go 1.25.3 by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5525
+- Skip flaky test for now by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5526
+- Use forked lazyerrors by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5527
+- Update DocumentDB by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5528
+- Use Go 1.25.4 by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5534
+- Bump DocumentDB by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5536
+- Bump deps by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5537
 
 ### New Contributors
 
-- @cooljeanius made their first contribution in https://github.com/FerretDB/FerretDB/pull/2420
-- @j0holo made their first contribution in https://github.com/FerretDB/FerretDB/pull/2419
-- @AuruTus made their first contribution in https://github.com/FerretDB/FerretDB/pull/2435
-- @craigpastro made their first contribution in https://github.com/FerretDB/FerretDB/pull/2439
-- @afiskon made their first contribution in https://github.com/FerretDB/FerretDB/pull/2456
-- @syasyayas made their first contribution in https://github.com/FerretDB/FerretDB/pull/2499
-- @raeidish made their first contribution in https://github.com/FerretDB/FerretDB/pull/2518
-- @polyal made their first contribution in https://github.com/FerretDB/FerretDB/pull/2458
-- @wqhhust made their first contribution in https://github.com/FerretDB/FerretDB/pull/2485
+- @jsoref made their first contribution in https://github.com/FerretDB/FerretDB/pull/5486
 
-[All closed issues and pull requests](https://github.com/FerretDB/FerretDB/milestone/40?closed=1).
-[All commits](https://github.com/FerretDB/FerretDB/compare/v1.0.0...v1.1.0).
+[All closed issues and pull requests](https://github.com/FerretDB/FerretDB/milestone/80?closed=1).
+[All commits](https://github.com/FerretDB/FerretDB/compare/v2.5.0...v2.7.0).
 
-## [v1.0.0](https://github.com/FerretDB/FerretDB/releases/tag/v1.0.0) (2023-04-03)
+## [v2.5.0](https://github.com/FerretDB/FerretDB/releases/tag/v2.5.0) (2025-08-12)
+
+This version works best with
+[DocumentDB v0.106.0-ferretdb-2.5.0](https://github.com/FerretDB/documentdb/releases/tag/v0.106.0-ferretdb-2.5.0).
+
+### Breaking changes
+
+#### Metric names
+
+We changed Prometheus metric names and `HELP` texts to highlight the fact that they are
+[not stable yet](https://docs.ferretdb.io/configuration/observability/#metrics).
+We plan to promote most of them to stable in the next release.
 
 ### What's Changed
 
-We are delighted to announce the release of FerretDB 1.0 GA!
+#### RPM packages for DocumentDB
 
-### New Features 🎉
-
-- Support `$sum` accumulator of `$group` aggregation by @chilagrow in https://github.com/FerretDB/FerretDB/pull/2292
-- Implement `createIndexes` command by @rumyantseva in https://github.com/FerretDB/FerretDB/pull/2244
-- Add basic `getMore` command by @AlekSi in https://github.com/FerretDB/FerretDB/pull/2309
-- Implement `dropIndexes` command by @chilagrow in https://github.com/FerretDB/FerretDB/pull/2313
-- Implement `$limit` aggregation pipeline stage by @noisersup in https://github.com/FerretDB/FerretDB/pull/2270
-- Add partial support for `collStats`, `dbStats` and `dataSize` by @AlekSi in https://github.com/FerretDB/FerretDB/pull/2322
-- Implement `$skip` aggregation pipeline stage by @w84thesun in https://github.com/FerretDB/FerretDB/pull/2310
-- Implement `$unwind` aggregation pipeline stage by @noisersup in https://github.com/FerretDB/FerretDB/pull/2294
-- Support `count` and `storageStats` fields in `$collStats` aggregation pipeline stage by @rumyantseva in https://github.com/FerretDB/FerretDB/pull/2338
-
-### Fixed Bugs 🐛
-
-- Fix dot notation negative index errors by @w84thesun in https://github.com/FerretDB/FerretDB/pull/2246
-- Apply `skip` before `limit` by @AlekSi in https://github.com/FerretDB/FerretDB/pull/2351
+DocumentDB `.rpm` packages for Red Hat Enterprise Linux are
+[now available](https://docs.ferretdb.io/installation/documentdb/rpm/)!
 
 ### Documentation 📄
 
-- Update supported command for `$sum` aggregation operator by @chilagrow in https://github.com/FerretDB/FerretDB/pull/2318
-- Add supported shells and GUIs images by @AlekSi in https://github.com/FerretDB/FerretDB/pull/2323
-- Publish FerretDB v0.9.4 blog post by @Fashander in https://github.com/FerretDB/FerretDB/pull/2268
-- Use dashes instead of underscores or spaces by @AlekSi in https://github.com/FerretDB/FerretDB/pull/2329
-- Update documentation sidebar by @Fashander in https://github.com/FerretDB/FerretDB/pull/2347
-- Update FerretDB descriptions by @AlekSi in https://github.com/FerretDB/FerretDB/pull/2281
-- Improve flags documentation by @AlekSi in https://github.com/FerretDB/FerretDB/pull/2331
-- Describe supported fields for `$collStats` aggregation stage by @rumyantseva in https://github.com/FerretDB/FerretDB/pull/2352
+- Enable full visibility for images on zoom by @Fashander in https://github.com/FerretDB/FerretDB/pull/5346
+- Add Vault blog post by @Fashander in https://github.com/FerretDB/FerretDB/pull/5368
+- Add WeKan blog post by @Fashander in https://github.com/FerretDB/FerretDB/pull/5381
 
 ### Other Changes 🤖
 
-- Use iterators for `sort`, `limit`, `skip`, and `projection` by @AlekSi in https://github.com/FerretDB/FerretDB/pull/2254
-- Bump dependencies by @AlekSi in https://github.com/FerretDB/FerretDB/pull/2307
-- Improve resource tracking by @AlekSi in https://github.com/FerretDB/FerretDB/pull/2319
-- Add tests for `find`'s and `count`'s `skip` argument by @w84thesun in https://github.com/FerretDB/FerretDB/pull/2325
-- Close iterator properly by @AlekSi in https://github.com/FerretDB/FerretDB/pull/2333
-- Improve large numbers initialization in test data by @noisersup in https://github.com/FerretDB/FerretDB/pull/2324
-- Ignore `unique` index option for now by @AlekSi in https://github.com/FerretDB/FerretDB/pull/2350
+- Add YugabyteDB integration tests by @chilagrow in https://github.com/FerretDB/FerretDB/pull/5274
+- Run all YugabyteDB integration tests by @chilagrow in https://github.com/FerretDB/FerretDB/pull/5283
+- Refactor normal and error responses by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5326
+- Update DocumentDB by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5353
+- Use Codecov for flaky integration tests detection by @noisersup in https://github.com/FerretDB/FerretDB/pull/5361
+- Make accessing YugabyteDB logs easier by @chilagrow in https://github.com/FerretDB/FerretDB/pull/5362
+- Add components in codecov by @noisersup in https://github.com/FerretDB/FerretDB/pull/5364
+- Skip YugabyteDB setup for `arm64` by @chilagrow in https://github.com/FerretDB/FerretDB/pull/5372
+- Tweak Ollama and MCPHost setup by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5375
+- Simplify flags handling by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5378
+- Update DocumentDB by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5380
+- Extract wiring into a separate package by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5383
+- Small cleanup by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5388
+- Encapsulate PostgreSQL pool in the Handler by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5389
+- Bump DocumentDB version by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5392
+- Test flaky tests detection by @noisersup in https://github.com/FerretDB/FerretDB/pull/5393
+- Small tweaks by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5394
+- Make a resource.Untrack thread-safe by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5396
+- Update DocumentDB by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5398
+- Enable MongoDB test commands by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5400
+- Update Prometheus metrics by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5403
+- Update DocumentDB by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5411
 
-[All closed issues and pull requests](https://github.com/FerretDB/FerretDB/milestone/39?closed=1).
-[All commits](https://github.com/FerretDB/FerretDB/compare/v0.9.4...v1.0.0).
+[All closed issues and pull requests](https://github.com/FerretDB/FerretDB/milestone/79?closed=1).
+[All commits](https://github.com/FerretDB/FerretDB/compare/v2.4.0...v2.5.0).
+
+## [v2.4.0](https://github.com/FerretDB/FerretDB/releases/tag/v2.4.0) (2025-07-16)
+
+This version works best with
+[DocumentDB v0.105.0-ferretdb-2.4.0](https://github.com/FerretDB/documentdb/releases/tag/v0.105.0-ferretdb-2.4.0).
+
+### New Features 🎉
+
+- Allow `clusterAdmin` users to perform user management commands by @chilagrow in https://github.com/FerretDB/FerretDB/pull/5314
+
+### Enhancements 🛠
+
+- Use debug-level log messages for continuations by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5266
+
+### Documentation 📄
+
+- Add blog post on setting up LibreChat with FerretDB by @Fashander in https://github.com/FerretDB/FerretDB/pull/4999
+- Add blog post for Payload CMS by @Fashander in https://github.com/FerretDB/FerretDB/pull/5257
+- Add blog post on using Compass GUI by @Fashander in https://github.com/FerretDB/FerretDB/pull/5263
+- Fix social links by @Fashander in https://github.com/FerretDB/FerretDB/pull/5264
+- Add PayloadCMS to compatible apps by @Fashander in https://github.com/FerretDB/FerretDB/pull/5270
+- Add Compass to compatible apps by @Fashander in https://github.com/FerretDB/FerretDB/pull/5275
+- Wrap long lines in a blog post by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5280
+- Add NodeBB compatibility blog post by @Fashander in https://github.com/FerretDB/FerretDB/pull/5285
+- Add Librechat to compatibility section by @Fashander in https://github.com/FerretDB/FerretDB/pull/5286
+- Add NodeBB to compatible apps by @Fashander in https://github.com/FerretDB/FerretDB/pull/5293
+- Cleanup NodeBB blog post by @chilagrow in https://github.com/FerretDB/FerretDB/pull/5294
+- Add Growthbook blogpost by @Fashander in https://github.com/FerretDB/FerretDB/pull/5304
+- Add Heyform compatibility blog post by @Fashander in https://github.com/FerretDB/FerretDB/pull/5316
+- Add GrowthBook to compatible apps by @Fashander in https://github.com/FerretDB/FerretDB/pull/5319
+- Add DBeaver compatibility blogpost by @Fashander in https://github.com/FerretDB/FerretDB/pull/5321
+- Add HyperDX blog post by @Fashander in https://github.com/FerretDB/FerretDB/pull/5334
+- Add compatible applications by @Fashander in https://github.com/FerretDB/FerretDB/pull/5335
+- Prepare v2.4.0 release by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5344
+
+### Other Changes 🤖
+
+- Add YugabyteDB to local setup by @chilagrow in https://github.com/FerretDB/FerretDB/pull/5258
+- Update DocumentDB by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5261
+- Remove skipping of `bypassEmptyTsReplacement` by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5267
+- Update DocumentDB by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5268
+- Bring back Codecov and Coveralls integration by @chilagrow in https://github.com/FerretDB/FerretDB/pull/5276
+- Update DocumentDB by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5282
+- Add `mcphost` as tool by @chilagrow in https://github.com/FerretDB/FerretDB/pull/5287
+- Refactor requests handling by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5292
+- Add Dependabot configuration for mcphost by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5296
+- Extend middleware requests and responses by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5301
+- Minor refactoring of Data API by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5302
+- Bump deps by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5307
+- Refactor responses handling by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5310
+- Add authentication test for client reconnecting by @chilagrow in https://github.com/FerretDB/FerretDB/pull/5311
+- Do not use deprecated method by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5312
+- Update TODO URLs by @chilagrow in https://github.com/FerretDB/FerretDB/pull/5317
+- Remove `must.NotFail(wire[bson].NewXXX(` pattern by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5318
+- Update TODO URL for `dropUsers` test by @chilagrow in https://github.com/FerretDB/FerretDB/pull/5324
+- Avoid extra marshaling by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5327
+- Split command handling and handlers by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5328
+- Update DocumentDB by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5342
+
+### New Contributors
+
+[All closed issues and pull requests](https://github.com/FerretDB/FerretDB/milestone/77?closed=1).
+[All commits](https://github.com/FerretDB/FerretDB/compare/v2.3.1...v2.4.0).
+
+## [v2.3.1](https://github.com/FerretDB/FerretDB/releases/tag/v2.3.1) (2025-06-12)
+
+Hotfix release to restore compatibility with various tools such as `mongoimport` and `mongorestore`.
+
+### Fixed Bugs 🐛
+
+- Revert "Remove hack for `bypassEmptyTsReplacement` (#5217)" by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5256
+
+[All closed issues and pull requests](https://github.com/FerretDB/FerretDB/milestone/78?closed=1).
+[All commits](https://github.com/FerretDB/FerretDB/compare/v2.3.0...v2.3.1).
+
+## [v2.3.0](https://github.com/FerretDB/FerretDB/releases/tag/v2.3.0) (2025-06-11)
+
+This version works best with
+[DocumentDB v0.104.0-ferretdb-2.3.0](https://github.com/FerretDB/documentdb/releases/tag/v0.104.0-ferretdb-2.3.0).
+
+### New Features 🎉
+
+- Add telemetry configuration for embedded FerretDB by @jyz0309 in https://github.com/FerretDB/FerretDB/pull/5109
+- Use DocumentDB's support for `bypassEmptyTsReplacement` by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5217
+- Use DocumentDB's `compat` command by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5242
+
+### Documentation 📄
+
+- Enable `onInlineAuthors` in blog settings by @Balou9 in https://github.com/FerretDB/FerretDB/pull/5079
+- Create compatible apps section by @Fashander in https://github.com/FerretDB/FerretDB/pull/5108
+- Improve insert operations in guides by @Fashander in https://github.com/FerretDB/FerretDB/pull/5131
+- Update versions to point to the next release by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5144
+- Update Docker tags in docs by @Fashander in https://github.com/FerretDB/FerretDB/pull/5156
+- Update Docker tags for next release by @Fashander in https://github.com/FerretDB/FerretDB/pull/5157
+- Do not format MDX as Markdown by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5186
+- Add blog post on Mongo Express compatibility by @Fashander in https://github.com/FerretDB/FerretDB/pull/5194
+- Add blog post for Novu compatibility by @Fashander in https://github.com/FerretDB/FerretDB/pull/5195
+- Update CTS tool to wrap long lines by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5202
+- Disable Markdownlint rule that clashes with MDX by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5210
+- Small documentation tweaks by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5218
+- Prepare v2.3.0 release by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5254
+
+### Other Changes 🤖
+
+- Use `runtime.Cleanup` for resource tracking by @sahinakyol in https://github.com/FerretDB/FerretDB/pull/5077
+- Add Dependabot configuration for `main-v1` by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5098
+- Bump deps by @chilagrow in https://github.com/FerretDB/FerretDB/pull/5159
+- Make `conninfo` a resource by @chilagrow in https://github.com/FerretDB/FerretDB/pull/5166
+- Revert "Update CODEOWNERS" by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5169
+- Bump deps by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5170
+- Add `permissions` to GitHub Actions workflows by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5182
+- Bump deps by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5184
+- Update DocumentDB by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5197
+- Add test for inserting zero timestamp by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5199
+- Update DocumentDB by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5201
+- Refactor resource tracking tests by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5208
+- Unskip test by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5211
+- Use Ollama in local setup by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5215
+- Update TODO comments by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5223
+- Bump Go and deps by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5236
+- Update DocumentDB by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5240
+- Build production Docker images for PRs by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5251
+- Improve telemetry configuration for embedded FerretDB by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5252
+
+### New Contributors
+
+- @sahinakyol made their first contribution in https://github.com/FerretDB/FerretDB/pull/5077
+- @Balou9 made their first contribution in https://github.com/FerretDB/FerretDB/pull/5079
+
+[All closed issues and pull requests](https://github.com/FerretDB/FerretDB/milestone/74?closed=1).
+[All commits](https://github.com/FerretDB/FerretDB/compare/v2.2.0...v2.3.0).
+
+## [v2.2.0](https://github.com/FerretDB/FerretDB/releases/tag/v2.2.0) (2025-05-09)
+
+This version works best with
+[DocumentDB v0.103.0-ferretdb-2.2.0](https://github.com/FerretDB/documentdb/releases/tag/v0.103.0-ferretdb-2.2.0).
+
+### New Features 🎉
+
+- Add full arm64 support by @AlekSi, @chilagrow in https://github.com/FerretDB/FerretDB/pull/5113
+- Rename old `ferretdb-eval` image to `ferretdb-eval-dev` by @chilagrow in https://github.com/FerretDB/FerretDB/pull/5040
+- Provide `ferretdb-eval` Docker image with production build by @chilagrow in https://github.com/FerretDB/FerretDB/pull/5051
+- Supervise services in evaluation images by @chilagrow in https://github.com/FerretDB/FerretDB/pull/5041
+- Use volume for `state` directory by @chilagrow in https://github.com/FerretDB/FerretDB/pull/5083
+
+### Enhancements 🛠
+
+- Rename binaries and packages by @vardbabayan in https://github.com/FerretDB/FerretDB/pull/5078
+- Decode `dropIndexes` response by @chilagrow in https://github.com/FerretDB/FerretDB/pull/5117
+
+### Documentation 📄
+
+- Update DocumentDB debian packages by @Fashander in https://github.com/FerretDB/FerretDB/pull/4959
+- Add Kubernetes installation guide by @Fashander in https://github.com/FerretDB/FerretDB/pull/4971
+- Add blog post on FerretDB and CNPG by @Fashander in https://github.com/FerretDB/FerretDB/pull/4998
+- Update Docker images by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5015
+- Add blog post on migrating to FerretDB with dsync by @Fashander in https://github.com/FerretDB/FerretDB/pull/5033
+- Use &#34;PostgreSQL with DocumentDB extension&#34; phrase by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5050
+- Backport Kubernetes docs to 2.1 by @Fashander in https://github.com/FerretDB/FerretDB/pull/5053
+- Rename and move code files in guides by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5057
+- Update redirects by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5060
+- Update OpenAPI spec description by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5062
+- Document Data API usage by @Fashander in https://github.com/FerretDB/FerretDB/pull/5063
+- Backport `.deb` installation guide by @Fashander in https://github.com/FerretDB/FerretDB/pull/5066
+- Unconvert syntax examples in documentation by @noisersup in https://github.com/FerretDB/FerretDB/pull/5072
+- Reformat linter by @Fashander in https://github.com/FerretDB/FerretDB/pull/5075
+- Update evaluation Docker image documentation by @chilagrow in https://github.com/FerretDB/FerretDB/pull/5076
+- Document required features by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5086
+- Document update process for new releases by @Fashander in https://github.com/FerretDB/FerretDB/pull/5124
+- Remove old TODOs by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5132
+
+### Other Changes 🤖
+
+- Remove MongoDB driver v1 by @KrishnaSindhur in https://github.com/FerretDB/FerretDB/pull/4961
+- Hook CTS tool into documentation building by @noisersup in https://github.com/FerretDB/FerretDB/pull/4990
+- Do not send zero values to telemetry by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5016
+- Update DocumentDB by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5020
+- Update deps by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5024
+- Minor tweaks for proxy code by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5025
+- Move tests for sessions by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5026
+- Bump deps by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5027
+- Merge Msg and Query into a single type by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5032
+- Make proxy handler implement an interface by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5036
+- Move `findAndModify` integration tests by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5037
+- Update wire by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5042
+- Update DocumentDB by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5045
+- Update DocumentDB by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5054
+- Implement handler `Handle` function by @chilagrow in https://github.com/FerretDB/FerretDB/pull/5055
+- Use new `wire` helpers by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5056
+- Fix docker health check on evaluation image by @chilagrow in https://github.com/FerretDB/FerretDB/pull/5067
+- Define docker tags for `ferretdb-eval` image by @chilagrow in https://github.com/FerretDB/FerretDB/pull/5068
+- Use `Handle` function in Data API by @chilagrow in https://github.com/FerretDB/FerretDB/pull/5069
+- Use `Handle` function in `clientconn` by @chilagrow in https://github.com/FerretDB/FerretDB/pull/5070
+- Update DocumentDB by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5074
+- Skip `bypassEmptyTsReplacement` parameters for now by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5080
+- Reorgonize cts output files by @noisersup in https://github.com/FerretDB/FerretDB/pull/5082
+- Unexport handlers by @chilagrow in https://github.com/FerretDB/FerretDB/pull/5084
+- Use new `wire` helpers by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5094
+- Update DocumentDB by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5096
+- Fix Docker tags for pre-release git tags by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5099
+- Update DocumentDB by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5115
+- Hook CTS into CI by @noisersup in https://github.com/FerretDB/FerretDB/pull/5120
+- Run CTS tests against Full Text Search guide examples by @noisersup in https://github.com/FerretDB/FerretDB/pull/5121
+- Run CTS tests against Vector Search guide examples by @noisersup in https://github.com/FerretDB/FerretDB/pull/5122
+- Run CTS tests against TTL Indexes guide examples by @noisersup in https://github.com/FerretDB/FerretDB/pull/5123
+- Remove `$db` parameter from generated mongosh requests by @noisersup in https://github.com/FerretDB/FerretDB/pull/5125
+- Update DocumentDB by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5141
+- Update DocumentDB by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5142
+- Prepare v2.2.0 release by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5138
+
+### New Contributors
+
+- @vardbabayan made their first contribution in https://github.com/FerretDB/FerretDB/pull/5078
+
+[All closed issues and pull requests](https://github.com/FerretDB/FerretDB/milestone/73?closed=1).
+[All commits](https://github.com/FerretDB/FerretDB/compare/v2.1.0...v2.2.0).
+
+## [v2.1.0](https://github.com/FerretDB/FerretDB/releases/tag/v2.1.0) (2025-04-03)
+
+This version works only with
+[DocumentDB v0.102.0-ferretdb-2.1.0](https://github.com/FerretDB/documentdb/releases/tag/v0.102.0-ferretdb-2.1.0).
+
+### Breaking changes
+
+<!-- textlint-disable one-sentence-per-line -->
+
+> [!CAUTION]
+> Please note that due to incompatibilities in our previous releases, DocumentDB can't be updated in place,
+> even with a manual `ALTER EXTENSION UPDATE` query or other means.
+> A new clean installation into an empty data directory/volume is required.
+> All data should be backed up with `mongodump`/`mongoexport` before and restored
+> with `mongorestore`/`mongoimport` after.
+> [See our blog post for more details](https://blog.ferretdb.io/ferretdb-v210-release-performance-improvements-bug-fixes/).
+>
+> We expect future updates to be much smoother.
+
+<!-- textlint-enable one-sentence-per-line -->
+
+### Fixed Bugs 🐛
+
+- Fix version detection for embeddable package by @AlekSi in https://github.com/FerretDB/FerretDB/pull/4936
+
+### Enhancements 🛠
+
+- Add colorized levels to `console` logger by @noisersup in https://github.com/FerretDB/FerretDB/pull/4904
+- Improve `--help` output by @KrishnaSindhur in https://github.com/FerretDB/FerretDB/pull/4918
+- Add support for reading PostgreSQL URL from a file by @KrishnaSindhur in https://github.com/FerretDB/FerretDB/pull/4937
+- Do not decode incoming document twice by @AlekSi in https://github.com/FerretDB/FerretDB/pull/4981
+
+### Documentation 📄
+
+- Add post on MongoDB queries and operations on FerretDB by @Fashander in https://github.com/FerretDB/FerretDB/pull/4732
+- Add example telemetry report to documentation by @AlekSi in https://github.com/FerretDB/FerretDB/pull/4861
+- Add FerretDB v2 GA blog post by @AlekSi in https://github.com/FerretDB/FerretDB/pull/4884
+- Add full text search guide by @Fashander in https://github.com/FerretDB/FerretDB/pull/4886
+- Add guide for GUI apps by @Fashander in https://github.com/FerretDB/FerretDB/pull/4906
+- Add TTL index guide by @Fashander in https://github.com/FerretDB/FerretDB/pull/4926
+- Update `deb` and `rpm` installation docs by @Fashander in https://github.com/FerretDB/FerretDB/pull/4927
+- Sync flags grouping with docs by @AlekSi in https://github.com/FerretDB/FerretDB/pull/4933
+- Add a note to documentation about PR titles by @AlekSi in https://github.com/FerretDB/FerretDB/pull/4944
+- Update/backport full-text and TTL indexes guides by @AlekSi in https://github.com/FerretDB/FerretDB/pull/4948
+- Backport documentation changes to v2.0 by @AlekSi in https://github.com/FerretDB/FerretDB/pull/4952
+- Add basic documentation for supported commands by @AlekSi in https://github.com/FerretDB/FerretDB/pull/4970
+- Update feature blog post by @Fashander in https://github.com/FerretDB/FerretDB/pull/4991
+- Add blogpost on FerretDB v2.1.0 release by @Fashander in https://github.com/FerretDB/FerretDB/pull/5004
+- Create redirects for `/v2.0/` documentation URLs by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5011
+
+### Other Changes 🤖
+
+- Update changelog generator by @AlekSi in https://github.com/FerretDB/FerretDB/pull/4810
+- Update TODO URLs for `listDatabase` tests by @noisersup in https://github.com/FerretDB/FerretDB/pull/4863
+- Document non-enforced format of log messages in `envtool` package by @noisersup in https://github.com/FerretDB/FerretDB/pull/4867
+- Start working on a new release by @AlekSi in https://github.com/FerretDB/FerretDB/pull/4885
+- Adjust pool connection timeout by @AlekSi in https://github.com/FerretDB/FerretDB/pull/4888
+- Check issue URLs in documentation by @chilagrow in https://github.com/FerretDB/FerretDB/pull/4890
+- Add TODO comments for observability tasks by @AlekSi in https://github.com/FerretDB/FerretDB/pull/4896
+- Refactor `clientconn` by @chilagrow in https://github.com/FerretDB/FerretDB/pull/4907
+- Add basic structure for middlewares by @AlekSi in https://github.com/FerretDB/FerretDB/pull/4908
+- Make production builds of the `main` branch by @AlekSi in https://github.com/FerretDB/FerretDB/pull/4911
+- Bump deps by @AlekSi in https://github.com/FerretDB/FerretDB/pull/4916
+- Move message processing in `clientconn` to a function by @chilagrow in https://github.com/FerretDB/FerretDB/pull/4919
+- Change the way OP_MSG handlers are invoked by @AlekSi in https://github.com/FerretDB/FerretDB/pull/4923
+- Improve integration benchmarks by @AlekSi in https://github.com/FerretDB/FerretDB/pull/4925
+- Configure connection pool size in tests by @AlekSi in https://github.com/FerretDB/FerretDB/pull/4932
+- Update DocumentDB by @AlekSi in https://github.com/FerretDB/FerretDB/pull/4941
+- Handle `OP_QUERY` in middleware using interface by @chilagrow in https://github.com/FerretDB/FerretDB/pull/4947
+- Implement error middleware by @chilagrow in https://github.com/FerretDB/FerretDB/pull/4951
+- Use ERROR level logging for failed tests by @AlekSi in https://github.com/FerretDB/FerretDB/pull/4974
+- Update DocumentDB by @AlekSi in https://github.com/FerretDB/FerretDB/pull/4975
+- Disable tracing in benchmarks for now by @AlekSi in https://github.com/FerretDB/FerretDB/pull/4980
+- Update DocumentDB by @AlekSi in https://github.com/FerretDB/FerretDB/pull/4982
+- Add TODOs by @AlekSi in https://github.com/FerretDB/FerretDB/pull/4986
+- Partially revert middleware changes by @AlekSi in https://github.com/FerretDB/FerretDB/pull/4995
+- Add more tests for error handling by @AlekSi in https://github.com/FerretDB/FerretDB/pull/4996
+- Use Go 1.24.2 by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5005
+- Remove error middleware for now by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5008
+- Disable commit check for now by @AlekSi in https://github.com/FerretDB/FerretDB/pull/5012
+
+[All closed issues and pull requests](https://github.com/FerretDB/FerretDB/milestone/72?closed=1).
+[All commits](https://github.com/FerretDB/FerretDB/compare/v2.0.0...v2.1.0).
+
+## [v2.0.0](https://github.com/FerretDB/FerretDB/releases/tag/v2.0.0) (2025-03-05)
+
+The first generally available release of FerretDB v2,
+powered by [DocumentDB PostgreSQL extension](https://github.com/microsoft/documentdb)!
+
+This version works best with
+[DocumentDB v0.102.0-ferretdb-2.0.0](https://github.com/FerretDB/documentdb/releases/tag/v0.102.0-ferretdb-2.0.0).
+
+[Release blog post](https://blog.ferretdb.io/ferretdb-v2-ga-open-source-mongodb-alternative-ready-for-production/).
+
+### Documentation 📄
+
+- Add migration guide from v1.x to v2.x by @Fashander in https://github.com/FerretDB/FerretDB/pull/4850
+- Add basic troubleshooting guide by @Fashander in https://github.com/FerretDB/FerretDB/pull/4854
+- Final preparations by @AlekSi in https://github.com/FerretDB/FerretDB/pull/4874
+
+### Other Changes 🤖
+
+- Unskip tests that refer to closed issue by @AlekSi in https://github.com/FerretDB/FerretDB/pull/4865
+- Use GitHub-hosted CI runners by @AlekSi in https://github.com/FerretDB/FerretDB/pull/4866
+- Skip flaky `currentOp` test and add TODO by @chilagrow in https://github.com/FerretDB/FerretDB/pull/4872
+- Bump Go and safe deps by @AlekSi in https://github.com/FerretDB/FerretDB/pull/4875
+
+[All closed issues and pull requests](https://github.com/FerretDB/FerretDB/milestone/69?closed=1).
+[All commits](https://github.com/FerretDB/FerretDB/compare/v2.0.0-rc.5...v2.0.0).
+
+## [v2.0.0-rc.5](https://github.com/FerretDB/FerretDB/releases/tag/v2.0.0-rc.5) (2025-03-04)
+
+This is the final release candidate before the GA release tomorrow!
+Most users don't need to update.
+
+This version works best with
+[DocumentDB v0.102.0-ferretdb-2.0.0-rc.5](https://github.com/FerretDB/documentdb/releases/tag/v0.102.0-ferretdb-2.0.0-rc.5).
+
+### New Features 🎉
+
+- Use DocumentDB API for `listDatabases` by @AlekSi in https://github.com/FerretDB/FerretDB/pull/4841
+- Implement `currentOp` command by @chilagrow in https://github.com/FerretDB/FerretDB/pull/4855
+
+### Fixed Bugs 🐛
+
+- Make Data API work without authentication if requested by @AlekSi in https://github.com/FerretDB/FerretDB/pull/4849
+
+### Enhancements 🛠
+
+- Publish build info, state, and CLI flags in expvar by @AlekSi in https://github.com/FerretDB/FerretDB/pull/4837
+- Enforce log messages format in development builds by @noisersup in https://github.com/FerretDB/FerretDB/pull/4754
+- Filter out sensitive information from debug archive by @AlekSi in https://github.com/FerretDB/FerretDB/pull/4836
+- Improve messages about DocumentDB version by @AlekSi in https://github.com/FerretDB/FerretDB/pull/4832
+
+### Documentation 📄
+
+- Move comment in docs to fix DocCard by @AlekSi in https://github.com/FerretDB/FerretDB/pull/4845
+- Update URL to join Slack by @AlekSi in https://github.com/FerretDB/FerretDB/pull/4851
+- Recommend using full tags/versions by @Fashander in https://github.com/FerretDB/FerretDB/pull/4834
+
+### Other Changes 🤖
+
+- Change `dbStats` tests TODO links by @noisersup in https://github.com/FerretDB/FerretDB/pull/4823
+- Update TODO comment by @AlekSi in https://github.com/FerretDB/FerretDB/pull/4831
+- Bump DocumentDB for development by @AlekSi in https://github.com/FerretDB/FerretDB/pull/4839
+- Update DocumentDB Docker image by @chilagrow in https://github.com/FerretDB/FerretDB/pull/4853
+- Remove old code for tracking operations by @AlekSi in https://github.com/FerretDB/FerretDB/pull/4842
+- Remove DocumentDB building from this repo by @chilagrow in https://github.com/FerretDB/FerretDB/pull/4852
+
+[All closed issues and pull requests](https://github.com/FerretDB/FerretDB/milestone/71?closed=1).
+[All commits](https://github.com/FerretDB/FerretDB/compare/v2.0.0-rc.2...v2.0.0-rc.5).
+
+## [v2.0.0-rc.2](https://github.com/FerretDB/FerretDB/releases/tag/v2.0.0-rc.2) (2025-02-25)
+
+This version works best with
+[DocumentDB v0.102.0-ferretdb-2.0.0-rc.2](https://github.com/FerretDB/documentdb/releases/tag/v0.102.0-ferretdb-2.0.0-rc.2).
+
+### Breaking changes
+
+The `:latest` Docker image tag now points to this release.
+It is highly recommended always to specify the full version (like `:2.0.0-rc.1`).
+
+### What's Changed
+
+#### Docker images
+
+Docker images are again available on [Docker Hub](https://hub.docker.com/r/ferretdb/ferretdb)
+and [quay.io](https://quay.io/repository/ferretdb/ferretdb)
+(although we recommend using [GitHub Packages](https://github.com/ferretdb/FerretDB/pkgs/container/ferretdb)).
+
+#### Embeddable Go package
+
+Once again, FerretDB can be used as a [Go library](https://pkg.go.dev/github.com/FerretDB/FerretDB/v2/ferretdb).
+
+#### `.deb` packages for DocumentDB
+
+`.deb` packages for DocumentDB are now available [there](https://github.com/FerretDB/documentdb/releases).
+
+#### Indexes
+
+Multiple issues with indexes were resolved, and support for TTL indexes was added.
+After updating DocumentDB and FerretDB, rebuilding indexes using the `reIndex` command is recommended.
+
+### New Features 🎉
+
+- Update Docker tags by @AlekSi in https://github.com/FerretDB/FerretDB/pull/4812
+- Enable Docker Hub and quay.io by @AlekSi in https://github.com/FerretDB/FerretDB/pull/4815
+- Re-introduce embeddable package by @AlekSi in https://github.com/FerretDB/FerretDB/pull/4778
+- Make embeddable package logging configurable by @AlekSi in https://github.com/FerretDB/FerretDB/pull/4807
+- Implement `reIndex` command by @chilagrow in https://github.com/FerretDB/FerretDB/pull/4735
+- Implement `dbStats` command by @noisersup in https://github.com/FerretDB/FerretDB/pull/4804
+- Add `mongo` slog format by @noisersup in https://github.com/FerretDB/FerretDB/pull/4716
+- Enable building FerretDB as PostgreSQL background worker by @AlekSi in https://github.com/FerretDB/FerretDB/pull/4802
+
+### Enhancements 🛠
+
+- Set `GOARM64` explicitly by @AlekSi in https://github.com/FerretDB/FerretDB/pull/4760
+- Tweak CLI for disabling interfaces by @AlekSi in https://github.com/FerretDB/FerretDB/pull/4781
+
+### Documentation 📄
+
+- Add replication blog post by @Fashander in https://github.com/FerretDB/FerretDB/pull/4717
+- Add explicit `platform: linux/amd64` to docs by @AlekSi in https://github.com/FerretDB/FerretDB/pull/4749
+- Add missing space in command by @tlinhart in https://github.com/FerretDB/FerretDB/pull/4753
+- Update config flags by @Fashander in https://github.com/FerretDB/FerretDB/pull/4740
+- Update TLS docs by @Fashander in https://github.com/FerretDB/FerretDB/pull/4752
+- Use `/` consistently in MongoDB URIs by @AlekSi in https://github.com/FerretDB/FerretDB/pull/4759
+- Reformat request/response `.js` files by @AlekSi in https://github.com/FerretDB/FerretDB/pull/4787
+- Update Docker image tag in v1 docs by @AlekSi in https://github.com/FerretDB/FerretDB/pull/4796
+- Convert `json5` to `js` responses in docs by @Fashander in https://github.com/FerretDB/FerretDB/pull/4800
+- Tweak Docusaurus configuration by @AlekSi in https://github.com/FerretDB/FerretDB/pull/4805
+- Update release checklist and `.deb` installation guide by @chilagrow in https://github.com/FerretDB/FerretDB/pull/4767
+- Update blogs to use `js` instead of `json5` by @Fashander in https://github.com/FerretDB/FerretDB/pull/4801
+
+### Other Changes 🤖
+
+- Disable xfail CI configuration for now by @AlekSi in https://github.com/FerretDB/FerretDB/pull/4698
+- Skip private issue links in `checkcomments` by a flag by @chilagrow in https://github.com/FerretDB/FerretDB/pull/4695
+- Fix Dependabot config by @AlekSi in https://github.com/FerretDB/FerretDB/pull/4708
+- Fix error mapping generation by @noisersup in https://github.com/FerretDB/FerretDB/pull/4691
+- Do not use Git LFS for Go files by @AlekSi in https://github.com/FerretDB/FerretDB/pull/4713
+- Refactor extract and convert in `genwrap` tool by @chilagrow in https://github.com/FerretDB/FerretDB/pull/4703
+- Introduce smoke test for Data API by @noisersup in https://github.com/FerretDB/FerretDB/pull/4712
+- Do not use a global variable for logging by @AlekSi in https://github.com/FerretDB/FerretDB/pull/4727
+- Bump deps by @AlekSi in https://github.com/FerretDB/FerretDB/pull/4743
+- Refactor and generate using `genwrap` tool by @chilagrow in https://github.com/FerretDB/FerretDB/pull/4705
+- Check DocumentDB issues in `checkcomments` and `checkdocs` by @chilagrow in https://github.com/FerretDB/FerretDB/pull/4714
+- Use `wireclient` for readiness probe by @chilagrow in https://github.com/FerretDB/FerretDB/pull/4718
+- Remove "all backends" from the issue template by @AlekSi in https://github.com/FerretDB/FerretDB/pull/4751
+- Add/update TODO comments for some issues by @AlekSi in https://github.com/FerretDB/FerretDB/pull/4723
+- Remove `golang.org/x/exp/maps` package by @AlekSi in https://github.com/FerretDB/FerretDB/pull/4711
+- Use Go 1.24.0 by @AlekSi in https://github.com/FerretDB/FerretDB/pull/4775
+- Use directories instead of files for state and telemetry by @AlekSi in https://github.com/FerretDB/FerretDB/pull/4784
+- Update DocumentDB by @AlekSi in https://github.com/FerretDB/FerretDB/pull/4788
+- Make handler take over the pool by @AlekSi in https://github.com/FerretDB/FerretDB/pull/4795
+- Add test helper by @AlekSi in https://github.com/FerretDB/FerretDB/pull/4799
+- Bump Go deps by @AlekSi in https://github.com/FerretDB/FerretDB/pull/4803
+- Fix `envtool` for Go 1.24 by @AlekSi in https://github.com/FerretDB/FerretDB/pull/4809
+- Update DocumentDB by @AlekSi in https://github.com/FerretDB/FerretDB/pull/4811
+
+### New Contributors
+
+- @tlinhart made their first contribution in https://github.com/FerretDB/FerretDB/pull/4753
+
+[All closed issues and pull requests](https://github.com/FerretDB/FerretDB/milestone/70?closed=1).
+[All commits](https://github.com/FerretDB/FerretDB/compare/v2.0.0-rc.1...v2.0.0-rc.2).
+
+## [v2.0.0-rc.1](https://github.com/FerretDB/FerretDB/releases/tag/v2.0.0-rc.1) (2025-01-23)
+
+The first release candidate of FerretDB v2, powered by [DocumentDB PostgreSQL extension](https://github.com/microsoft/documentdb)!
 
 ## Older Releases
 
-See <https://github.com/FerretDB/FerretDB/blob/v1.0.0/CHANGELOG.md>.
+See https://github.com/FerretDB/FerretDB/blob/main-v1/CHANGELOG.md.

CONTRIBUTING.md

@@ -5,18 +5,18 @@ Thank you for your interest in making FerretDB better!
 ## Finding something to work on
 
 We are interested in all contributions, big or small, in code or documentation.
-But unless you are fixing a very small issue like a typo,
-we kindly ask you first to [create an issue](https://github.com/FerretDB/FerretDB/issues/new/choose),
-to leave a comment on an existing issue if you want to work on it,
-or to [join our Slack chat](./README.md#community) and leave a message for us in the `#dev` channel.
-This way, you will get help from us and avoid wasted efforts if something can't be worked on right now
-or someone is already working on it.
+But unless you are fixing a tiny issue like a typo,
+we kindly ask you first to [create an issue](https://github.com/FerretDB/FerretDB/issues/new/choose)
+or leave a comment on an existing issue if you want to work on it.
+This way, we could assign the issue to you, marking it as being worked on,
+preventing others from wasting efforts working on it at the same time.
+Additionally, you can [join our Slack chat](./README.md#community) and leave a message for us in the `#dev` channel.
 
 You can find a list of good first issues for contributors [there](https://github.com/FerretDB/FerretDB/contribute).
 Once you have some experience with contributing to FerretDB,
 feel free to pick any issue
 [that is not assigned to anyone and doesn't have `not ready` label](https://github.com/FerretDB/FerretDB/issues?q=is%3Aissue+is%3Aopen+no%3Aassignee+-label%3A%22not+ready%22).
-Still, please let us know as described above.
+Still, please leave a comment on it as described above.
 
 ## Setting up the environment
 
@@ -30,28 +30,30 @@ On macOS and Windows, [Docker Desktop](https://www.docker.com/products/docker-de
 On Windows, it should be [configured to use WSL 2](https://docs.docker.com/desktop/windows/wsl/) without any distro;
 all commands should be run on the host.
 
-You will need Go 1.20 or later on the host.
+You will need Go 1.25 or later on the host.
 If your package manager doesn't provide it yet,
 please install it from [go.dev](https://go.dev/dl/).
 
 You will also need `git` installed; the version provided by your package manager should do.
-On Windows, the simplest way to install it might be <https://gitforwindows.org>.
+On Windows, the simplest way to install it might be https://gitforwindows.org.
 
 Finally, you will also need [git-lfs](https://git-lfs.github.com) installed and configured (`git lfs install`).
 
 ### Making a working copy
 
 Fork the [FerretDB repository on GitHub](https://github.com/FerretDB/FerretDB/fork).
-To have all the tags in the repository and what they point to, copy all branches by removing checkmark for `copy the main branch only` before forking.
-
-After forking FerretDB on GitHub, you can clone the repository:
+After that, you can clone the repository and add the upstream repository as a remote:
 
 ```sh
 git clone git@github.com:<YOUR_GITHUB_USERNAME>/FerretDB.git
 cd FerretDB
 git remote add upstream https://github.com/FerretDB/FerretDB.git
+git fetch --all --tags
 ```
 
+The last command would fetch all Git tags from our repository that GitHub won't copy to fork by default.
+`git describe` command uses them to determine the FerretDB version during the build process.
+
 To run development commands, you should first install the [`task`](https://taskfile.dev/) tool.
 You can do this by changing the directory to `tools` (`cd tools`) and running `go generate -x`.
 That will install `task` into the `bin` directory (`bin/task` on Linux and macOS, `bin\task.exe` on Windows).
@@ -62,18 +64,56 @@ You can also [install `task` globally](https://taskfile.dev/#/installation),
 but that might lead to the version skew.
 
 With `task` installed,
-you should install development tools with `task init`
+you can see all available tasks by running `task -l` in the root of the repository
+(not in the `tools` directory).
+
+After that, you should install development tools with `task init`
 and download required Docker images with `task env-pull`.
 
 If something does not work correctly,
 you can reset the environment with `task env-reset`.
 
-You can see all available `task` tasks with `task -l`.
+### Building a production release binaries
 
-### Building a production release binary
+To build a production release binaries, run `task build-production`.
+The results will be saved `tmp/bin`.
 
-To build a production release binary, run `task build-release`.
-The result will be saved as `bin/ferretdb`.
+### Setting a GITHUB_TOKEN
+
+Some of our development tools require access to public information on GitHub
+at a rate higher than allowed for unauthenticated requests.
+Those tools will report a problem in this case.
+It could be solved by creating a new classic or fine-grained personal access token
+[there](https://github.com/settings/tokens).
+No scopes are needed for classic tokens, not even `public_repo`.
+For fine-grained tokens, only read-only access to public repositories is needed without any additional permissions.
+After generating a token, set the `GITHUB_TOKEN` environment variable:
+
+```sh
+export GITHUB_TOKEN=ghp_XXX
+```
+
+or
+
+```sh
+export GITHUB_TOKEN=github_pat_XXX
+```
+
+## Reporting a bug
+
+We appreciate reporting a bug to us.
+To help us accurately identify the cause, we encourage you to include a pull request with test script.
+Please write the test script in [build/legacy-mongo-shell/test.js](build/legacy-mongo-shell/test.js).
+You can find an overview of the available assertions [here](build/legacy-mongo-shell/README.md).
+Use these assertions to validate your test's assumptions and invariants.
+
+With `task` installed (see above), you may test your script using following steps:
+
+1. Start the development environment with `task env-up`.
+2. Start FerretDB with `task run`.
+3. Run the test script with `task testjs`.
+
+Please create a pull request and include the link of the pull request in the bug issue.
 
 ## Contributing code
 
@@ -82,27 +122,20 @@ The result will be saved as `bin/ferretdb`.
 With `task` installed (see above), you may do the following:
 
 1. Start the development environment with `task env-up`.
-2. Run all tests in another terminal window with `task test`.
+2. Run all tests with `task test` (see [below](#running-tests)).
 3. Start FerretDB with `task run`.
-   This will start it in a development mode where all requests are handled by FerretDB, but also routed to MongoDB.
-   The differences in response are then logged and the FerretDB response is sent back to the client.
-4. Fill collections in `test` database with data for experiments with `task env-data`.
+   The development environment uses `diff-normal` mode as the default mode.
+   Set preferred mode such as `task run MODE=diff-proxy`.
+   (See [Operation modes](https://docs.ferretdb.io/configuration/operation-modes/) page in our documentation.)
+4. Fill collections in the `test` database with data for experiments with `task env-data`.
 5. Run `mongosh` with `task mongosh`.
-   This allows you to run commands against FerretDB.
-   For example, you can see what data was inserted by the previous command with `db.values.find()`.
+   See what collections were created by the previous command with `show collections`.
 
-### Operation modes
+#### Commands for authenticated connection
 
-FerretDB can run in multiple operation modes.
-Operation mode specify how FerretDB handles incoming requests.
-FerretDB supports four operation modes: `normal`, `proxy`, `diff-normal`, `diff-proxy`,
-see [Operation modes documentation page](https://docs.ferretdb.io/configuration/operation-modes/) for more details.
-
-By running `task run` FerretDB starts on `diff-normal` mode, which routes all of
-the sent requests both to the FerretDB and MongoDB.
-While running, it logs a difference between both returned responses,
-but sends the one from FerretDB to the client.
-If you want to get the MongoDB response, you can run `task run-proxy` to start FerretDB in `diff-proxy` mode.
+1. Start the development environment with `task env-up`.
+2. Start FerretDB with `task run-secure MODE=normal` or `task run-secure MODE=proxy`.
+3. Run `task mongosh-secure` to establish an authenticated connection.
 
 ### Code overview
 
@@ -114,29 +147,19 @@ They are installed into `bin/` by `cd tools; go generate -x`.
 
 The `internal` subpackages contain most of the FerretDB code:
 
-- `types` package provides Go types matching BSON types that don't have built-in Go equivalents:
-  we use `int32` for BSON's int32, but `types.ObjectID` for BSON's ObjectId.
-- `types/fjson` provides converters from/to FJSON for built-in and `types` types.
-  It is used for logging of BSON values and wire protocol messages.
-- `bson` package provides converters from/to BSON for built-in and `types` types.
-- `wire` package provides wire protocol implementation.
-- `clientconn` package provides client connection implementation.
-  It accepts client connections, reads `wire`/`bson` protocol messages, and passes them to `handlers`.
-  Responses are then converted to `wire`/`bson` messages and sent back to the client.
-- `handlers` contains a common interface for backend handlers that they should implement.
-  Handlers use `types` and `wire` packages, but `bson` package details are hidden.
-- `handlers/common` contains code shared by different handlers.
-- `handlers/sjson` provides converters from/to SJSON for built-in and `types` types.
-  SJSON adds some extensions to JSON for keeping object keys in order,
-  preserving BSON type information in the values themselves, etc.
-  It is used by `sqlite` and `pg` handlers.
-- `handlers/sqlite` contains the implementation of the SQLite handler.
-  It is being converted into universal handler for all backends.
-- `handlers/pg` contains the implementation of the PostgreSQL handler.
-- `handlers/tigris` contains the implementation of the Tigris handler.
-- `handlers/tigris/tjson` provides converters from/to TJSON with JSON Schema for built-in and `types` types.
-  BSON type information is preserved either in the schema (where possible) or in the values themselves.
-  It is used by `tigris` handler.
+- `handler` provides implementations of command handlers.
+  The logic of commands like `find` and `aggregate` is there.
+- `dataapi` provides an Data API wrapper for `handler`.
+  It allows FerretDB to be used over HTTP instead of MongoDB wire protocol.
+- `clientconn` provides wire protocol server implementation.
+  It accepts client connections, reads wire protocol messages, and passes them to `handler`.
+  Responses are then converted and sent back to the client.
+- `documentdb` provides DocumentDB extension integration.
+- `mongoerrors` provides MongoDB-compatible error types and codes.
+  They are used by `handler` and `documentdb`.
+
+The wire protocol implementation and BSON handling code were extracted into a separate repository:
+https://github.com/FerretDB/wire
 
 #### Running tests
 
@@ -149,16 +172,16 @@ you can run those with `task test-unit` after starting the environment as descri
 
 We also have a set of "integration" tests in the `integration` directory.
 They use the Go MongoDB driver like a regular user application.
-They could test any MongoDB-compatible database (such as FerretDB or MongoDB itself) via a regular TCP or TLS port or Unix socket.
+They could test any MongoDB-compatible database (such as FerretDB or MongoDB itself) via a regular TCP or TLS port
+or Unix domain socket.
 They also could test in-process FerretDB instances
-(meaning that integration tests start and stop them themselves) with a given handler.
-Finally, some tests (so-called compatibility or "compat" tests) connect to two systems
+(meaning that integration tests start and stop them themselves).
+Finally, some integration tests (so-called compatibility or "compat" tests) connect to two systems
 ("target" for FerretDB and "compat" for MongoDB) at the same time,
 send the same queries to both, and compare results.
 You can run them with:
 
-- `task test-integration-pg` for in-process FerretDB with `pg` handler and MongoDB;
-- `task test-integration-tigris` for in-process FerretDB with `tigris` handler and MongoDB;
+- `task test-integration-postgresql` for in-process FerretDB and MongoDB;
 - `task test-integration-mongodb` for MongoDB only, skipping compat tests;
 - or `task test-integration` to run all in parallel.
 
@@ -167,23 +190,29 @@ If tests fail and the output is too confusing, try running them sequentially by
 
 You can also run `task -C 1` to limit the number of concurrent tasks, which is useful for debugging.
 
-Finally, since all tests just run `go test` with various arguments and flags under the hood,
+To run a subset of integration tests and test cases, you may use Task variable `TEST_RUN`.
+For example, to run all tests for the `getMore` command with in-process FerretDB
+you may use `task test-integration-postgresql TEST_RUN='(?i)GetMore'`.
+
+Finally, since all tests just run `go test` with various arguments and flags under the hood
+(for example, `TEST_RUN` just provides the value for the [`-run` flag](https://pkg.go.dev/cmd/go#hdr-Testing_flags)),
 you may also use all standard `go` tool facilities,
 including [`GOFLAGS` environment variable](https://pkg.go.dev/cmd/go#hdr-Environment_variables).
 For example:
 
-- to run a single test case for in-process FerretDB with `pg` handler
-  with all subtests running sequentially,
-  you may use `env GOFLAGS='-run=TestName/TestCaseName -parallel=1' task test-integration-pg`;
-- to run all tests for in-process FerretDB with `tigris` handler
-  with [Go execution tracer](https://pkg.go.dev/runtime/trace) enabled,
-  you may use `env GOFLAGS='-trace=trace.out' task test-integration-tigris`.
+- to run all tests for the `getMore` command sequentially,
+  you may use `env GOFLAGS='-parallel=1 -p=1' task test-integration-postgresql TEST_RUN='(?i)GetMore'`;
+- to run all tests with MongoDB with [Go execution tracer](https://pkg.go.dev/runtime/trace) enabled
+  you may use `env GOFLAGS='-trace=trace.out' task test-integration-mongodb`.
 
-> **Note**
->
+<!-- textlint-disable one-sentence-per-line -->
+
+> [!NOTE]
 > It is not recommended to set `GOFLAGS` and other Go environment variables with `export GOFLAGS=...`
 > or `go env -w GOFLAGS=...` because they are invisible and easy to forget about, leading to confusion.
 
+<!-- textlint-enable one-sentence-per-line -->
+
 In general, we prefer integration tests over unit tests,
 tests using real databases over short tests
 and real objects over mocks.
@@ -191,13 +220,13 @@ and real objects over mocks.
 (You might disagree with our terminology for "unit" and "integration" tests;
 let's not fight over it.)
 
-We have an additional integration testing system in another repository: <https://github.com/FerretDB/dance>.
+We have an additional integration testing system in another repository: https://github.com/FerretDB/dance.
 
 #### Observability in tests
 
 Integration tests start a debug handler with pprof profiles and execution traces on a random port
 (to allow running multiple test configurations in parallel).
-They also send telemetry traces to the local Jaeger instance that can be accessed at <http://127.0.0.1:16686/>.
+They also send telemetry traces to the local Jaeger instance that can be accessed at http://127.0.0.1:16686/.
 
 ### Code style and conventions
 
@@ -208,95 +237,158 @@ but please also tell us about it, so we can improve all of it.
 If, on the other hand, you see code that is inconsistent without apparent reason (or comment),
 please improve it as you work on it.
 
-Our code most of the standard Go conventions,
-documented on [CodeReviewComments wiki page](https://github.com/golang/go/wiki/CodeReviewComments).
-Some of our idiosyncrasies:
+Our code follows most of the standard Go conventions,
+documented on [CodeReviewComments wiki page](https://go.dev/wiki/CodeReviewComments)
+and some other pages such as [Spelling](https://go.dev/wiki/Spelling).
+Some of our idiosyncrasies are documented below.
 
 1. We use type switches over BSON types in many places in our code.
-   The order of `case`s follows this order: <https://pkg.go.dev/github.com/FerretDB/FerretDB/internal/types#hdr-Mapping>
-   It may seem random, but it is only pseudo-random and follows BSON spec: <https://bsonspec.org/spec.html>
+   The order of `case`s follows this order: https://pkg.go.dev/github.com/FerretDB/wire/wirebson#hdr-Types
+   It may seem random, but it is only pseudo-random and follows BSON spec: https://bsonspec.org/spec.html
 2. We generally pass and return `struct`s by pointers.
-   There are some exceptions like `types.Path` that has value semantics, but when in doubt – use pointers.
+   There are some exceptions like `time.Time` that have value semantics, but when in doubt – use pointers.
+
+#### Comments conventions
+
+1. All top-level declarations, even unexported, should have documentation comments.
+2. In documentation comments do not describe the name in terms of the name itself (`// Registry is a registry of …`).
+   Use other words instead; often, they could add additional information and make reading more pleasant (`// Registry stores …`).
+3. In code comments, in general, do not describe _what_ the code does: it should be clear from the code itself
+   (and when it doesn't and the code is tricky, simplify it instead).
+   Instead, describe _why_ the code does that if it is not clear from the surrounding context, names, etc.
+   There is no need to add comments just because there are no comments if everything is already clear without them.
+4. For code comments, write either
+   sentence fragments (do not start it with a capital letter, do not end it with a dot, use the simplified grammar) for short notes
+   or full sentences (do start them with capital letters, do end them with dots, do check their grammar) when a longer (2+ sentences)
+   explanation is needed (and the code could not be simplified).
+
+#### Logging conventions
+
+(See also our user documentation for notes about logging levels, logging sensitive information, etc.)
+
+1. Log messages should contain a single sentence; use a semicolon if you must.
+2. Log messages should not have leading/trailing spaces or end with punctuation.
+3. Log field names should use `snake_case`.
+4. Whatever sensitive information can be logged should be checked by calling `.Enabled(slog.LevelDebug)` on the appropriate logger,
+   not by directly comparing levels with `<` / `>` operators.
+   The same check should be applied if additional sensitive fields should be added to the log message on a different level.
 
 #### Integration tests conventions
 
-We prefer our integration tests to be straightforward,
-branchless (with a few, if any, `if` and `switch` statements),
-and backend-independent.
-Ideally, the same test should work for both FerretDB with all handlers and MongoDB.
+We prefer our integration tests to be straightforward and
+branchless (with a few, if any, `if` and `switch` statements).
+Ideally, the same test should work for both FerretDB and MongoDB.
 If that's impossible without some branching, use helpers exported from the `setup` package,
-such us `IsTigris`, `SkipForTigrisWithReason`, `TigrisOnlyWithReason`.
+such us `FailsForFerretDB`, `SkipForMongoDB`, etc.
+Please use expected failure rather than skipping the test, whenever it's possible.
+It makes tracking development progress much easier.
+
 The bar for using other ways of branching, such as checking error codes and messages, is very high.
 Writing separate tests might be much better than making a single test that checks error text.
 
 Also, we should use driver methods as much as possible instead of testing commands directly via `RunCommand`.
 
+In most cases, helpers such as `AssertEqualDocuments` are used to compare `bson.D` documents.
+The differences in field order, types, missing fields and others should be reported.
+If differences are expected such as `version` field, only the field key can be used for `bson.D` document comparison.
+Use of (deprecated) `bson.D.Map()` or converting `bson.D` to other types using helpers should be avoided when possible.
+The bar for adding new helpers is very high.
+Please check all existing ones.
+
+If there's a need to use any large number to test corner cases,
+we create constants for them with explanation what do they represent, and refer to them.
+For example:
+
+```go
+const doubleMaxPrec = float64(1<<53 - 1) // 9007199254740991.0:    largest double values that could be represented as integer exactly
+```
+
+Avoid writing tests that cannot run in parallel with other tests.
+The `integration` directory contains multiple test packages,
+and tests from other packages may run at the same time.
+Such test becomes flaky and hard to maintain.
+
+#### Integration tests naming guidelines
+
+<!-- https://github.com/FerretDB/FerretDB/issues/694 -->
+
+Use `Test<Command><Operator><Scenario>` format for test names, omitting `<Operator>` and `<Scenario>` if unnecessary.
+
+1. Include the name of the command (and the operator if any).
+   For example, `TestDistinct` for testing the distinct command.
+2. Compatibility tests should have `Compat` in the name, following the command.
+   For example, `TestDistinctCompat`.
+3. If the test runs a command directly via `RunCommand`, add the suffix `Command`.
+   For example, `TestDistinctCommand`.
+4. If the test is both compat and runs a command, add the suffix `CommandCompat`.
+   For example, `TestInsertCommandCompat`.
+5. If the file consists of compatibility tests, add the `_compat` suffix.
+   For example, `distinct_compat_test.go`.
+6. Use descriptive test names to include the condition or the specific error being tested.
+   For example, `TestAggregateCompatSortDotNotation` for compatibility tests
+   on `aggregate` command `$sort` operator on a document field.
+7. Keep test names concise, avoiding overly cryptic names.
+   Use abbreviations when appropriate.
+8. Avoid including test data in the name to maintain clarity and prevent excessively long names.
+9. Use `TitleCase` capitalization style for test case names.
+   No spaces, dashes or underscores should be used neither for test names nor for test case names.
+10. Use [BSON notation](https://bsonspec.org/spec.html) vocabulary.
+    For example, use `Double` and not `float64`.
+11. Keep the concatenation of test name segments (test, subtests) within 64 characters
+    to satisfy the maximum limit for database names.
+12. Use a package for tests in the same scope.
+    Separating into packages can reduce binary sizes and may enhance performance.
+    For example, use `users` package for user management test files.
+
 ### Submitting code changes
 
 #### Before submitting PR
 
 Before submitting a pull request, please make sure that:
 
-1. Tests are added for new functionality or fixed bugs.
+1. Your changes are committed to a [new branch](https://docs.github.com/en/get-started/quickstart/github-flow)
+   created from the [current state](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/syncing-a-fork)
+   of our main branch.
+2. Tests are added or updated for new functionality or fixed bugs.
    Typical test cases include:
    - happy paths;
    - dot notation for existing and non-existent paths;
    - edge cases for invalid or unexpected values or types.
-2. Comments are added or updated for all new or changed code.
+3. Comments are added or updated for all new or changed code.
    Please add missing comments for all (both exported and unexported)
    new and changed top-level declarations (`package`, `var`, `const`, `func`, `type`).
    Please also check that formatting is correct in the `task godocs` output.
-3. `task all` passes.
+4. `task all` passes.
 
 #### Submitting PR
 
-1. If the pull request is related to some issues,
-   please mention the issue number in the pull request **description** like `Closes #{issue_number}.`
-   or `Closes org/repo#{issue_number}.`
-   (You can just follow the pull request template).
-   Please do not use URLs like `https://github.com/org/repo/issue/{issue_number}`
-   or paths like `org/repo/issue/{issue_number}` even if they are rendered the same on GitHub.
+1. Please follow the pull request template.
+2. If the pull request is related to some issue,
+   please mention the issue number in the pull request description like `Closes #<issue_number>.`
+   or `Closes FerretDB/<repo>#<issue_number>.`
+   Please do not use URLs like `https://github.com/FerretDB/<repo>/issue/<issue_number>`
+   or paths like `FerretDB/<repo>/issue/<issue_number>` even if they are rendered the same on GitHub.
    If you propose a tiny fix, there is no needed to create a new issue.
-2. There is no need to use draft pull requests.
+3. There is no need to use draft pull requests.
    If you want to get feedback on something you are working on,
    please create a normal pull request, even if it is not "fully" ready yet.
-3. In the pull request review conversations,
+4. In the pull request review conversations,
    please either leave a new comment or resolve (close) the conversation,
-   which ensures the other people can read all comments.
-   But **do not** do that simultaneously.
-4. During your development,
-   commit messages (both titles and bodies) are not important and can be "WIP" or anything else.
-   All commits are always squashed on merge by GitHub,
-   so there is **no need** to squash them manually, amend them, and/or do force pushes.
-   But notice that the autogenerated GitHub's squash commit's body
-   **should be** manually replaced by "Closes #{issue_number}.".
-5. Please don't forget to click
+   which ensures other people can read all comments.
+   But do not do that simultaneously.
+   Conversations should typically be resolved by the conversation starter, not the PR author.
+5. During development in a branch/PR,
+   commit messages (both titles and bodies) are not important and can be anything.
+   All commits are always squashed on merge by GitHub.
+   Please **do not** squash them manually, amend them, and/or force push them -
+   that makes the review process harder.
+6. Please don't forget to click
    ["re-request review" buttons](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/requesting-a-pull-request-review)
    once PR is ready for re-review.
 
 If you have interest in becoming or are a long-term contributor,
 please read [PROCESS.md](.github/PROCESS.md) for more details.
 
-## Reporting a bug
-
-We appreciate reporting a bug to us.
-To help us accurately identify the cause, we encourage
-you to include a pull request with test script.
-Please write the test script in
-[build/legacy-mongo-shell/test.js](build/legacy-mongo-shell/test.js).
-You can find an overview of the available assertions [here](build/legacy-mongo-shell/README.md).
-Use these assertions to validate your test's assumptions and invariants.
-You can also find an example of how to prepare a test script in
-[build/legacy-mongo-shell/test.example.js](build/legacy-mongo-shell/test.example.js).
-
-Test your script using following steps:
-
-1. Start the development environment with `task env-up`.
-2. Start FerretDB with `task run`.
-3. Run the test script with `task testjs`.
-
-Please create a pull request and include the link of the pull request in the bug issue.
-
 ## Contributing documentation
 
 ### Commands for contributing documentation
@@ -311,5 +403,8 @@ With `task` installed (see above), you may do the following:
 
 Before submitting a pull request, please make sure that:
 
-1. Documentation is formatted, linted, and built with `task docs`.
-2. Documentation is written according to our [writing guide](https://docs.ferretdb.io/contributing/writing-guide/).
+1. Your changes are committed to a [new branch](https://docs.github.com/en/get-started/quickstart/github-flow)
+   created from the [current state](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/syncing-a-fork)
+   of our main branch.
+2. Documentation is formatted, linted, and built with `task docs`.
+3. Documentation is written according to our [writing guide](https://docs.ferretdb.io/contributing/writing-guide/).

NOTICE

@@ -1,2 +0,0 @@
-FerretDB database system (https://www.ferretdb.io/).
-Copyright 2021 FerretDB Inc.

README.md

@@ -1,18 +1,35 @@
 # FerretDB
 
-[![Go Reference](https://pkg.go.dev/badge/github.com/FerretDB/FerretDB/ferretdb.svg)](https://pkg.go.dev/github.com/FerretDB/FerretDB/ferretdb)
+<!-- textlint-disable one-sentence-per-line -->
+
+> [!TIP]
+> Looking for FerretDB v1?
+> It is [there](https://github.com/FerretDB/FerretDB/tree/main-v1).
+
+<!-- textlint-enable one-sentence-per-line -->
+
+[![Go Reference](https://pkg.go.dev/badge/github.com/FerretDB/FerretDB/v2/ferretdb.svg)](https://pkg.go.dev/github.com/FerretDB/FerretDB/v2/ferretdb)
 
 [![Go](https://github.com/FerretDB/FerretDB/actions/workflows/go.yml/badge.svg?branch=main)](https://github.com/FerretDB/FerretDB/actions/workflows/go.yml)
-[![Integration](https://github.com/FerretDB/FerretDB/actions/workflows/integration.yml/badge.svg?branch=main)](https://github.com/FerretDB/FerretDB/actions/workflows/integration.yml)
 [![codecov](https://codecov.io/gh/FerretDB/FerretDB/branch/main/graph/badge.svg?token=JZ56XFT3DM)](https://codecov.io/gh/FerretDB/FerretDB)
 
 [![Security](https://github.com/FerretDB/FerretDB/actions/workflows/security.yml/badge.svg?branch=main)](https://github.com/FerretDB/FerretDB/actions/workflows/security.yml)
 [![Packages](https://github.com/FerretDB/FerretDB/actions/workflows/packages.yml/badge.svg?branch=main)](https://github.com/FerretDB/FerretDB/actions/workflows/packages.yml)
 [![Docs](https://github.com/FerretDB/FerretDB/actions/workflows/docs.yml/badge.svg?branch=main)](https://github.com/FerretDB/FerretDB/actions/workflows/docs.yml)
 
-FerretDB was founded to become the de-facto open-source substitute to MongoDB.
-FerretDB is an open-source proxy, converting the MongoDB 6.0+ wire protocol queries to SQL -
-using PostgreSQL as a database engine.
+FerretDB is an open-source alternative to MongoDB.
+It is a proxy that converts MongoDB 5.0+ wire protocol queries to SQL
+and uses PostgreSQL with [DocumentDB extension](https://github.com/documentdb/documentdb) as a database engine.
+
+```mermaid
+flowchart LR
+  A["Any application<br>Any MongoDB driver"]
+  F{{FerretDB}}
+  P[(PostgreSQL<br>DocumentDB extension)]
+
+  A -- "MongoDB protocol<br>BSON" --> F
+  F -- "PostgreSQL protocol<br>SQL" --> P
+```
 
 ## Why do we need FerretDB?
 
@@ -20,7 +37,7 @@ MongoDB was originally an eye-opening technology for many of us developers,
 empowering us to build applications faster than using relational databases.
 In its early days, its ease-to-use and well-documented drivers made MongoDB one of the simplest database solutions available.
 However, as time passed, MongoDB abandoned its open-source roots;
-changing the license to [SSPL](https://www.mongodb.com/licensing/server-side-public-license) - making it unusable for many open source and early-stage commercial projects.
+changing the license to [SSPL](https://www.ferretdb.com/sspl) - making it unusable for many open-source and early-stage commercial projects.
 
 Most MongoDB users do not require any advanced features offered by MongoDB;
 however, they need an easy-to-use open-source document database solution.
@@ -29,72 +46,75 @@ Recognizing this, FerretDB is here to fill that gap.
 ## Scope and current state
 
 FerretDB is compatible with MongoDB drivers and popular MongoDB tools.
-It functions as a drop-in replacement for MongoDB 6.0+ in many cases.
+It functions as a drop-in replacement for MongoDB 5.0+ in many cases.
 Features are constantly being added to further increase compatibility and performance.
 
 We welcome all contributors.
 See our [public roadmap](https://github.com/orgs/FerretDB/projects/2/views/1),
-a list of [known differences with MongoDB](https://docs.ferretdb.io/diff/),
+lists of [known differences and supported commands](https://docs.ferretdb.io/migration/compatibility/),
 and [contributing guidelines](CONTRIBUTING.md).
 
 ## Quickstart
 
+Run this command to start FerretDB with PostgreSQL, make sure to update `<username>` and `<password>`:
+
 ```sh
-docker run -d --rm --name ferretdb -p 27017:27017 ghcr.io/ferretdb/all-in-one
+docker run -d --rm --name ferretdb -p 27017:27017 \
+  -e POSTGRES_USER=<username> \
+  -e POSTGRES_PASSWORD=<password> \
+  ghcr.io/ferretdb/ferretdb-eval:2
 ```
 
-This command will start a container with FerretDB, PostgreSQL, and MongoDB Shell for quick testing and experiments.
+This command will start a container with FerretDB, pre-packaged PostgreSQL with DocumentDB extension, and MongoDB Shell for quick testing and experiments.
 However, it is unsuitable for production use cases because it keeps all data inside and loses it on shutdown.
-See our [Docker quickstart guide](https://docs.ferretdb.io/quickstart-guide/docker/) for instructions
+See our [installation guides](https://docs.ferretdb.io/installation/) for instructions
 that don't have those problems.
 
 With that container running, you can:
 
-- Connect to it with any MongoDB client application using MongoDB URI `mongodb://127.0.0.1:27017/`.
-- Connect to it using MongoDB Shell by just running `mongosh`.
+- Connect to it with any MongoDB client application using the MongoDB URI `mongodb://<username>:<password>@127.0.0.1:27017/`.
+- Connect to it using the MongoDB Shell by just running `mongosh`.
   If you don't have it installed locally, you can run `docker exec -it ferretdb mongosh`.
-- Connect to PostgreSQL running inside the container by running `docker exec -it ferretdb psql -U username ferretdb`.
-  FerretDB uses PostgreSQL schemas for MongoDB databases.
-  So, if you created some collections in the `test` database using any MongoDB client,
-  you can switch to it by running `SET search_path = 'test';` query
-  and see a list of PostgreSQL tables by running `\d` `psql` command.
+- For PostgreSQL, connect to it by running `docker exec -it ferretdb psql -U <username> postgres`.
 
 You can stop the container with `docker stop ferretdb`.
 
 We also provide binaries and packages for various Linux distributions.
-See [our documentation](https://docs.ferretdb.io/quickstart-guide/) for more details.
+as well as [Go library package](https://pkg.go.dev/github.com/FerretDB/FerretDB/v2/ferretdb)
+that embeds FerretDB into your application.
+See [our documentation](https://docs.ferretdb.io/installation/) for more details.
 
 ## Building and packaging
 
-We strongly advise users not to build FerretDB themselves.
-Instead, use binaries, Docker images, or `.deb`/`.rpm` packages provided by us.
+<!-- textlint-disable one-sentence-per-line -->
 
-If you want to package FerretDB for your operating system or distribution,
-the recommended way to build the binary is to use the `build-release` task;
-see our [instructions for contributors](CONTRIBUTING.md) for more details.
-FerretDB could also be built as any other Go program,
+> [!NOTE]
+> We advise users not to build FerretDB themselves.
+> Instead, use binaries, Docker images, or packages provided by us.
+
+<!-- textlint-enable one-sentence-per-line -->
+
+FerretDB could be built as any other Go program,
 but a few generated files and build tags could affect it.
-See [there](https://pkg.go.dev/github.com/FerretDB/FerretDB/build/version) for more details.
+See [there](https://pkg.go.dev/github.com/FerretDB/FerretDB/v2/build/version) for more details.
 
 ## Managed FerretDB at cloud providers
 
-- [Civo](https://www.civo.com) (see [here](https://www.civo.com/marketplace/FerretDB)).
-- [Scaleway](https://www.scaleway.com/) (request access [here](https://www.scaleway.com/en/betas/#managed-document-database)).
-
-## Documentation
-
-- [Documentation for users](https://docs.ferretdb.io/).
-- [Documentation for Go developers about embeddable FerretDB](https://pkg.go.dev/github.com/FerretDB/FerretDB/ferretdb).
+- [FerretDB Cloud](https://cloud.ferretdb.com/)
+- [Civo](https://www.civo.com/marketplace/FerretDB)
+- [Tembo](https://tembo.io/docs/tembo-stacks/mongo-alternative)
+- [Elestio](https://elest.io/open-source/ferretdb)
+- [Cozystack](https://cozystack.io/docs/components/#managed-ferretdb)
 
 ## Community
 
-- Website and blog: [https://ferretdb.io](https://ferretdb.io/).
-- Twitter: [@ferret_db](https://twitter.com/ferret_db).
+- Website: https://www.ferretdb.com/.
+- Blog: https://blog.ferretdb.io/.
+- Documentation: https://docs.ferretdb.io/.
+- X (Twitter): [@ferret_db](https://x.com/ferret_db).
 - Mastodon: [@ferretdb@techhub.social](https://techhub.social/@ferretdb).
-- [Slack chat](https://join.slack.com/t/ferretdb/shared_invite/zt-zqe9hj8g-ZcMG3~5Cs5u9uuOPnZB8~A) for quick questions.
+- [Slack chat](https://slack.ferretdb.io/) for quick questions.
 - [GitHub Discussions](https://github.com/FerretDB/FerretDB/discussions) for longer topics.
 - [GitHub Issues](https://github.com/FerretDB/FerretDB/issues) for bugs and missing features.
-- [Open Office Hours meeting](https://calendar.google.com/event?action=TEMPLATE&tmeid=NjNkdTkyN3VoNW5zdHRiaHZybXFtb2l1OWtfMjAyMTEyMTNUMTgwMDAwWiBjX24zN3RxdW9yZWlsOWIwMm0wNzQwMDA3MjQ0QGc&tmsrc=c_n37tquoreil9b02m0740007244%40group.calendar.google.com&scp=ALL)
-  every Monday at 18:00 UTC at [Google Meet](https://meet.google.com/mcb-arhw-qbq).
 
-If you want to contact FerretDB Inc., please use [this form](https://www.ferretdb.io/contact/).
+If you want to contact FerretDB Inc., please use [this form](https://www.ferretdb.com/contact/).

SECURITY.md

@@ -2,12 +2,12 @@
 
 ## Supported Versions
 
-We support all FerretDB versions since 1.0.0.
+We support two of the latest minor versions of FerretDB.
 
 ## Reporting a Vulnerability
 
 Please do not use public issues for security problems.
 Instead, report them [there](https://github.com/FerretDB/FerretDB/security/advisories/new).
-You can also reach us by email at <security@ferretdb.io>.
+You can also reach us by email at security@ferretdb.io.
 
 We should respond to you within seven days.

build/.markdownlint.yml

@@ -1,6 +1,5 @@
 ---
-# https://github.com/DavidAnson/markdownlint
-# https://github.com/DavidAnson/markdownlint-cli2
+# https://github.com/DavidAnson/markdownlint-cli2#configuration
 # https://github.com/DavidAnson/markdownlint/blob/main/doc/Rules.md
 
 default: true
@@ -10,4 +9,9 @@ MD003: { style: atx }
 MD004: { style: "dash" }
 MD006: false # deprecated
 MD013: false # we use https://sembr.org that could lead to long lines
+MD026: { punctuation: ".,;:。，；：" } # default is .,;:!。，；：！
 MD029: { style: ordered }
+MD033: false # for MDX
+MD034: false # autolink tags <link> no longer supported by MDX
+MD037: false # clashes with MDX comments
+MD059: false # not yet

build/.textlintrc

@@ -5,19 +5,37 @@
         "one-sentence-per-line": true,
         "@textlint-rule/pattern": {
             "patterns": [
+                // mostly to keep JS/JSON snippets with correct
                 {
                     "message": "Use straight ASCII double quotes instead of curly double quotes",
-                    "pattern": "/(“|”)/",
+                    "pattern": "/“|”/",
                     "replace": "\"",
                     "forceCode": true
                 },
                 {
                     "message": "Use straight ASCII single quotes instead of curly single quotes",
-                    "pattern": "/(‘|’)/",
+                    "pattern": "/‘|’/",
                     "replace": "'",
                     "forceCode": true
+                },
+
+                // to prevent --flags from being converted to en dashes or em dashes
+                {
+                    "message": "Use en dashes with spaces instead of em dashes",
+                    "pattern": "/—/",
+                    "replace": " – ",
+                    "forceCode": true
+                },
+                {
+                    "message": "Use en dashes with spaces",
+                    "pattern": "/(\\S)–([\\S])/",
+                    "replace": "$1 – $2",
+                    "forceCode": true
                 }
             ]
         }
+    },
+    "filters": {
+        "comments": true
     }
 }

build/.trivyignore

@@ -0,0 +1,7 @@
+# https://github.com/cloudwego/eino#dependencies
+# TODO https://github.com/cloudwego/eino/issues/291
+CVE-2025-30153
+
+# https://nvd.nist.gov/vuln/detail/CVE-2025-51471
+# https://github.com/ollama/ollama/pull/10750
+CVE-2025-51471

build/buildkitd.toml

@@ -0,0 +1,5 @@
+[worker.oci]
+  gc = false
+
+[worker.containerd]
+  gc = false

build/certs/Makefile

@@ -1,11 +1,16 @@
+# see https://github.com/FiloSottile/mkcert
+
 export CAROOT=$(PWD)
 export TRUST_STORES=system
 HOSTS=localhost 127.0.0.1 ::1 host.docker.internal
 
 gen:
+	rm -f *.pem
 	mkcert -install
 	mkcert -client -cert-file client-cert.pem -key-file client-key.pem $(HOSTS)
 	cat client-cert.pem client-key.pem > client.pem
 	mkcert -cert-file server-cert.pem -key-file server-key.pem $(HOSTS)
 	cat server-cert.pem server-key.pem > server.pem
 	mkcert -uninstall
+	mv rootCA.pem rootCA-cert.pem
+	rm -f rootCA-key.pem

build/certs/client-cert.pem

@@ -1,27 +1,27 @@
 -----BEGIN CERTIFICATE-----
-MIIEkjCCAvqgAwIBAgIQIJJuiEy6fblSjN6q3SwleDANBgkqhkiG9w0BAQsFADCB
-kTEeMBwGA1UEChMVbWtjZXJ0IGRldmVsb3BtZW50IENBMTMwMQYDVQQLDCphbGVr
-c2lAUHJvYm9vay5sb2NhbCAoQWxleGV5IFBhbGF6aGNoZW5rbykxOjA4BgNVBAMM
-MW1rY2VydCBhbGVrc2lAUHJvYm9vay5sb2NhbCAoQWxleGV5IFBhbGF6aGNoZW5r
-bykwHhcNMjIxMjEwMDcxODA1WhcNMjUwMzEwMDcxODA1WjBeMScwJQYDVQQKEx5t
-a2NlcnQgZGV2ZWxvcG1lbnQgY2VydGlmaWNhdGUxMzAxBgNVBAsMKmFsZWtzaUBQ
-cm9ib29rLmxvY2FsIChBbGV4ZXkgUGFsYXpoY2hlbmtvKTCCASIwDQYJKoZIhvcN
-AQEBBQADggEPADCCAQoCggEBAL6Wjqflpl7y4g/N0LZGFBZOmUMCveNA9VhSBVYK
-wgaeY8Ypl/xmfTjAcVXbzkSunwxFDVL1cZavaM5fRFLlF9Tj7A8hxaE/Cwr3Gr9U
-qAiFgRMQZb1CxkCdkqw6dgsXx8N5TfcEijG8CEiKhSYTFVD6ca8tgE0F8c568ES1
-CVxynoxAmLedNNGYt3IyCSow6c8YUouWOccf3EzuhoL0NnuYgm0hwIJB2WCJlEJA
-HcYabDMdDCAWhKQ2kNoh4hV576L3I9zl549ghnGrZzGhjcHn8AgNRvZasfgaSttx
-dCAiPqtvc2KJJO6fG3Ue+bDftMk3n9/IZ+XpCRD7gznBVbcCAwEAAaOBlzCBlDAO
-BgNVHQ8BAf8EBAMCBaAwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMBMB8G
-A1UdIwQYMBaAFKrDcJcU9cWHA3BoHNr90+chUt2qMEIGA1UdEQQ7MDmCCWxvY2Fs
-aG9zdIIUaG9zdC5kb2NrZXIuaW50ZXJuYWyHBH8AAAGHEAAAAAAAAAAAAAAAAAAA
-AAEwDQYJKoZIhvcNAQELBQADggGBABbgVfpgwwMNMXa359jwzrjDZA9MMhCec5Du
-UbbwZJxQqWkbvlHsn11VTCTjvRqpjc7pgU9vclZgj3/h+j8cw8uy1ZsjV2sQhyJX
-DQVVfm60jvb3+deamePciPPwXzOHZswdfnEHgRYQiSx035HKniErAFTXR9v+ZSl9
-9qVjkuR6cRi02iLmjmnXB55vzyfgXmlNwMlYqIe9e3WsqdGKKw50qx6B6VU1J0tz
-H7DDmgzF3jiOhNmdjHVFoz4wDnx3e1GhziVc8e8tuBANIAyTasahVlnP+KtJPao2
-ciqFZrRbSxYwXCQRwd5F4FvVLLkqVYO2PRDBGi8m483hHgI5bkOfyrNIvgiNGGWV
-Fq/uVEwgqUItmgpy2ZdRz4zA1GL4olCKX8FALDgwVI6t1Ygo5EoUP1m1xyC7NK5R
-WI701gZnMICUos39Usvp8EagwYyDtkLxumznMS1q+m9sy+gY4Kfag3tnzcJHyjUN
-yfWf5P+Sjdx0+qAVOnAHd+2estdu5g==
+MIIEkzCCAvugAwIBAgIRAJQIOW0DsoWpmhRIS6qVTMkwDQYJKoZIhvcNAQELBQAw
+gZExHjAcBgNVBAoTFW1rY2VydCBkZXZlbG9wbWVudCBDQTEzMDEGA1UECwwqYWxl
+a3NpQFByb2Jvb2subG9jYWwgKEFsZXhleSBQYWxhemhjaGVua28pMTowOAYDVQQD
+DDFta2NlcnQgYWxla3NpQFByb2Jvb2subG9jYWwgKEFsZXhleSBQYWxhemhjaGVu
+a28pMB4XDTI1MDQyNDA2Mjg1NVoXDTI3MDcyNDA2Mjg1NVowXjEnMCUGA1UEChMe
+bWtjZXJ0IGRldmVsb3BtZW50IGNlcnRpZmljYXRlMTMwMQYDVQQLDCphbGVrc2lA
+UHJvYm9vay5sb2NhbCAoQWxleGV5IFBhbGF6aGNoZW5rbykwggEiMA0GCSqGSIb3
+DQEBAQUAA4IBDwAwggEKAoIBAQDGNj/3rcpjgu8GZHg1AS8lAEy8tbg73+9YRPJs
+IAytaCmoQYbRZncrWa9hWT0568DGSWbHye4+ZFrYyW1vNb0ANWPGVd6ReqtJm0wt
+plfcyzbgGN4EIYgHEUjFvVfDg6fHdV5K8z6UGGfnHHtwoj649Vw3CjAIRXufB9dD
+EPAZoh2NKp+EEQiNlX8+oNIMGYmGP6QAh1l/RCrj2yhVeXqXC7s8y9HCKSa08tBO
+e3AzHfWrcksVC2HugR6+/KjinOowlL4GwtpQ9clJF8Vk9ilA+PXL37CIaTkdJOsX
+doacEC84NpeSyQYf8g4q5uHDTEc4kg5NQ04TizFpag1LWs/nAgMBAAGjgZcwgZQw
+DgYDVR0PAQH/BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATAf
+BgNVHSMEGDAWgBRMfF45cY0dizvyML/k08KmEEPhkjBCBgNVHREEOzA5gglsb2Nh
+bGhvc3SCFGhvc3QuZG9ja2VyLmludGVybmFshwR/AAABhxAAAAAAAAAAAAAAAAAA
+AAABMA0GCSqGSIb3DQEBCwUAA4IBgQBiim9kFNYL81xP6MHNJe2erc3IrpCCn7IC
+WfrhqIz89o/2gYIWqwlc7IWA+y13btUAkaXVDZvZMoFMKbvUcF89OpO8G+4XpbX4
+uu9Q5pC3cjnFymO8xTRNgOam6yySLbjwzZwQIZ/0hh9xCeQ64tlw/a4VT6+UJrYn
+SNTPI38f/MwCFkyr4vCkCUIOIwTRfDc2BwHu1CJ820Hu3Jpr10CRzBOvsDJlDg8c
+vcmbdo+jsqEFMNIZpTblZA+MALRq4eK6Bas3YQcqIGjo+lxx9eYCGzZH1ygS/K5X
+501rBpLJ4OklIVTFWuo5IVwJ9RWMPgX3htl3HzpGztEV8nB9LEjKl9Lmm7xPb8+n
+ytycvckVyFe5JtejNtiB+9v0jNyqvEe2B7hdGfSLchuCv0a3xsocnayxnJChKtqI
+vo022s1k9k7wwJ2Qeq49HfK3yY00SgXYpUljKHLZocisYBxHmNbegzSBa2x7RU+k
+YexHKXvwNHdkVNOTs9LgER0EexdK+AM=
 -----END CERTIFICATE-----

build/certs/client-key.pem

@@ -1,28 +1,28 @@
 -----BEGIN PRIVATE KEY-----
-MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQC+lo6n5aZe8uIP
-zdC2RhQWTplDAr3jQPVYUgVWCsIGnmPGKZf8Zn04wHFV285Erp8MRQ1S9XGWr2jO
-X0RS5RfU4+wPIcWhPwsK9xq/VKgIhYETEGW9QsZAnZKsOnYLF8fDeU33BIoxvAhI
-ioUmExVQ+nGvLYBNBfHOevBEtQlccp6MQJi3nTTRmLdyMgkqMOnPGFKLljnHH9xM
-7oaC9DZ7mIJtIcCCQdlgiZRCQB3GGmwzHQwgFoSkNpDaIeIVee+i9yPc5eePYIZx
-q2cxoY3B5/AIDUb2WrH4GkrbcXQgIj6rb3NiiSTunxt1Hvmw37TJN5/fyGfl6QkQ
-+4M5wVW3AgMBAAECggEAMiun+gK2PSBq6gYf/xuLhiPCrKU4H26mJ03QIcpLMTrY
-wP2KCONh62KdcyCdt+7P54b17vS1phke2dSyQ7ATCfPF3GXjhIL4ATbzT5KVeUjL
-pZ0Xay78yV2xkq0BDgKAj7CLGY+UYWtCMvZj/pXfcqW674Zm09/Qu64ZObz+bds5
-cCrGyhpj1pXZJNBwfaJg82VwWIdytwcFdRwtgywiUJOZ+ldcnJU13f3HjxERpYYA
-zSvNi63bkBEMnj844p9MMsqwb5r8/lZQRvI2K6dW/dRa8xmQKi00AjtPOZMly1Re
-07brcVTmav2jYhZp9PxZUiRMmCdzEnhLtsynaYWVoQKBgQDGQxJeQncM12GuV1Oo
-nHJwRyICzB6DJ8nmErpK0a/zvIiQxUD+/qPVzTDI9C5lBWWPniGjdv57Nb0on1l3
-zp9MPzZrzLBTYyFT5nPBLyhcrRyd0Acz0MeB8p/UwErBP4JsJsjfuSB/Pa9YmbgV
-4GtWQ8khV05vhtivtR3xZl+RRQKBgQD2F2DQjfEuq4tD08v1JiBQQLM+Yw3k0tSe
-f4HFlbOHtPGEHbzrt3eD6fOhJmkVEkQcde4h22+oHpKff/5h0iiW5N4NUrIoL4WN
-34ZHIcpo+gjcdzrLF9fytzLbaaSpDApVVhcRX3JinwKpCp9G4y06KKKRV5EhW4MM
-+1kdZbzUywKBgEG/GkdB2ULb5duvv+FpSBXtsNymnfO2bSCr0zVehe/Y9Jy1nREy
-llgfPG9Xck8z0/MlaFhR7KAlOP5QoZW2YmMhj0V+UnbEp9ev03Eb11GsYpH+23SW
-ZqK0N8aQofmluvVsgy6VsK4hYZWLHF281zt7LSauUidv20mhUTWtUkHVAoGBAJUa
-fRJfri30yiCChyU1wIZfbTrzkUt/YkvWPa6VkX076Ml/qyO2ubc3XOHa//hAZPxJ
-h8sDxZc7TuNNDbf/OZCTgubXoBIxGN5o/FbE5nrMY+oQY5MCE1mAHlRKofW60df6
-nWdtSUTvyxDY2sB8jL6cOEOPpuNrKvAGqmvhZJQZAoGBAJOR7QEbU7L5rWEHDs2z
-QU8ry3y9stbt/ViP/RE63jLcxP5RG7LueDRYsNSdY0WA8wbJ6WNElo3EvxMurmmn
-jkjuhbcFgDFZ5W6cjjG8kDytIHcH73xbZLjqmN/NfsSW211HudkembKfQ4G6llPu
-dZpM5PgCoeFawQ1SnC+CSmcR
+MIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQDGNj/3rcpjgu8G
+ZHg1AS8lAEy8tbg73+9YRPJsIAytaCmoQYbRZncrWa9hWT0568DGSWbHye4+ZFrY
+yW1vNb0ANWPGVd6ReqtJm0wtplfcyzbgGN4EIYgHEUjFvVfDg6fHdV5K8z6UGGfn
+HHtwoj649Vw3CjAIRXufB9dDEPAZoh2NKp+EEQiNlX8+oNIMGYmGP6QAh1l/RCrj
+2yhVeXqXC7s8y9HCKSa08tBOe3AzHfWrcksVC2HugR6+/KjinOowlL4GwtpQ9clJ
+F8Vk9ilA+PXL37CIaTkdJOsXdoacEC84NpeSyQYf8g4q5uHDTEc4kg5NQ04TizFp
+ag1LWs/nAgMBAAECggEBAJBcqrJFzYY0sspBGpvgROn6EenPoGNbcgMkFDxUC2ew
+2cZGE18n9duI8odAa6tn3XuNsmII3JBsnw4NhrrctM8WE5k8qWHjqiVuCkmlQZD6
+IPmOowT3Nw+OsyXyBZ3MocJP5WFJUGakb+iPgghC4tPrQEKGFP2xPZxSJaIfEABa
+HgSYTSr+n8lJUKdld00BNSWXBxsVQ8NAw/5AFjFP4R3TeCwbd34lpMpkLvOax05j
+xbdZr0MP03MT8PYMBRzqMcST0OR7bK8vyAnB/ezxhrnQaMV2NeHpisB3UbNFi+PT
+63tNV/S2hCOGDZ5V+jFQ6FRyUw1gOlJK/EMGLIEt3kECgYEA1gMXqlp5w0OIBBkS
+MbhY2LhVO0v3LBHtRCqFbKGdA3yrHrsq/YJKlJbEoiw9mWGgYq7h0jNAsvI/WLgo
+tm4AUxRdG9YZDqNEcfcODnLqFg5D7/abSXx+An3pwZ+fQgL8STGu9up/Xl1Sss1T
+JHBEOM+vqb7TQxPPvl77SUHUwX8CgYEA7RmVO6PEepnJuMGYgG9Au5SMkcFY5iK5
+AqlEHio097+KsQ+K4nxW8yvtNoXnSBsfX3t78vI6zjSeFgk/MhoVUGLKIQTwq6KO
+WvASeB1zIzSkfXISznMs/CxGMt9FODvM9PCJMpeFAvJNDn83vupo0oxagu+EUVoF
+eGoqNEMMVZkCgYEAgx+d7lhE5miH+8rIpQIIHbDDN/ORW8UYFH3hBe/3Xd2Skt+m
+tXCQ9X1yuNJWY5W3SP9RiRKx/3IBcgBToYLAXCbL7XQ+IgPSuejfCedKmXzgDzSP
+bHUEV86B3IpKb42YudfhFZQTueN/+eFnoZnPkudc/6nVkvGehUt4tyfIjU0CgYAP
+PebHB7cYvowmMWPRVdWOeXUz5X8GhFLqZeE4IzR2fLy4tywRdTbNuRQtvhvpGb1B
+kRmdu46mNOG4vu1uFhkqqr8dskiab//AvtAhIpuFNtwgKFYnKWZJ67qziIDVpZp+
+YHwhYXYug08K0IjP4BfO+TDUW/tgk23omMKPy4OeeQKBgQCiKzdHtUO6KujjueYX
+lbDVbdEiXYbGzKcMmE0E/DK73xXpXT/CQ+tjB3nZKHDwkTN6h9ZZYzjhRWmHRlRh
+WqGqmWr4D3I0B9jnxCTpDuZIlJ21G336RbsZD8yi+eyMwJXN4csItGSlMig04jvo
+5vTIN0D0uXAvDD23TEcilpQzcA==
 -----END PRIVATE KEY-----

build/certs/client.pem

@@ -1,55 +1,55 @@
 -----BEGIN CERTIFICATE-----
-MIIEkjCCAvqgAwIBAgIQIJJuiEy6fblSjN6q3SwleDANBgkqhkiG9w0BAQsFADCB
-kTEeMBwGA1UEChMVbWtjZXJ0IGRldmVsb3BtZW50IENBMTMwMQYDVQQLDCphbGVr
-c2lAUHJvYm9vay5sb2NhbCAoQWxleGV5IFBhbGF6aGNoZW5rbykxOjA4BgNVBAMM
-MW1rY2VydCBhbGVrc2lAUHJvYm9vay5sb2NhbCAoQWxleGV5IFBhbGF6aGNoZW5r
-bykwHhcNMjIxMjEwMDcxODA1WhcNMjUwMzEwMDcxODA1WjBeMScwJQYDVQQKEx5t
-a2NlcnQgZGV2ZWxvcG1lbnQgY2VydGlmaWNhdGUxMzAxBgNVBAsMKmFsZWtzaUBQ
-cm9ib29rLmxvY2FsIChBbGV4ZXkgUGFsYXpoY2hlbmtvKTCCASIwDQYJKoZIhvcN
-AQEBBQADggEPADCCAQoCggEBAL6Wjqflpl7y4g/N0LZGFBZOmUMCveNA9VhSBVYK
-wgaeY8Ypl/xmfTjAcVXbzkSunwxFDVL1cZavaM5fRFLlF9Tj7A8hxaE/Cwr3Gr9U
-qAiFgRMQZb1CxkCdkqw6dgsXx8N5TfcEijG8CEiKhSYTFVD6ca8tgE0F8c568ES1
-CVxynoxAmLedNNGYt3IyCSow6c8YUouWOccf3EzuhoL0NnuYgm0hwIJB2WCJlEJA
-HcYabDMdDCAWhKQ2kNoh4hV576L3I9zl549ghnGrZzGhjcHn8AgNRvZasfgaSttx
-dCAiPqtvc2KJJO6fG3Ue+bDftMk3n9/IZ+XpCRD7gznBVbcCAwEAAaOBlzCBlDAO
-BgNVHQ8BAf8EBAMCBaAwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMBMB8G
-A1UdIwQYMBaAFKrDcJcU9cWHA3BoHNr90+chUt2qMEIGA1UdEQQ7MDmCCWxvY2Fs
-aG9zdIIUaG9zdC5kb2NrZXIuaW50ZXJuYWyHBH8AAAGHEAAAAAAAAAAAAAAAAAAA
-AAEwDQYJKoZIhvcNAQELBQADggGBABbgVfpgwwMNMXa359jwzrjDZA9MMhCec5Du
-UbbwZJxQqWkbvlHsn11VTCTjvRqpjc7pgU9vclZgj3/h+j8cw8uy1ZsjV2sQhyJX
-DQVVfm60jvb3+deamePciPPwXzOHZswdfnEHgRYQiSx035HKniErAFTXR9v+ZSl9
-9qVjkuR6cRi02iLmjmnXB55vzyfgXmlNwMlYqIe9e3WsqdGKKw50qx6B6VU1J0tz
-H7DDmgzF3jiOhNmdjHVFoz4wDnx3e1GhziVc8e8tuBANIAyTasahVlnP+KtJPao2
-ciqFZrRbSxYwXCQRwd5F4FvVLLkqVYO2PRDBGi8m483hHgI5bkOfyrNIvgiNGGWV
-Fq/uVEwgqUItmgpy2ZdRz4zA1GL4olCKX8FALDgwVI6t1Ygo5EoUP1m1xyC7NK5R
-WI701gZnMICUos39Usvp8EagwYyDtkLxumznMS1q+m9sy+gY4Kfag3tnzcJHyjUN
-yfWf5P+Sjdx0+qAVOnAHd+2estdu5g==
+MIIEkzCCAvugAwIBAgIRAJQIOW0DsoWpmhRIS6qVTMkwDQYJKoZIhvcNAQELBQAw
+gZExHjAcBgNVBAoTFW1rY2VydCBkZXZlbG9wbWVudCBDQTEzMDEGA1UECwwqYWxl
+a3NpQFByb2Jvb2subG9jYWwgKEFsZXhleSBQYWxhemhjaGVua28pMTowOAYDVQQD
+DDFta2NlcnQgYWxla3NpQFByb2Jvb2subG9jYWwgKEFsZXhleSBQYWxhemhjaGVu
+a28pMB4XDTI1MDQyNDA2Mjg1NVoXDTI3MDcyNDA2Mjg1NVowXjEnMCUGA1UEChMe
+bWtjZXJ0IGRldmVsb3BtZW50IGNlcnRpZmljYXRlMTMwMQYDVQQLDCphbGVrc2lA
+UHJvYm9vay5sb2NhbCAoQWxleGV5IFBhbGF6aGNoZW5rbykwggEiMA0GCSqGSIb3
+DQEBAQUAA4IBDwAwggEKAoIBAQDGNj/3rcpjgu8GZHg1AS8lAEy8tbg73+9YRPJs
+IAytaCmoQYbRZncrWa9hWT0568DGSWbHye4+ZFrYyW1vNb0ANWPGVd6ReqtJm0wt
+plfcyzbgGN4EIYgHEUjFvVfDg6fHdV5K8z6UGGfnHHtwoj649Vw3CjAIRXufB9dD
+EPAZoh2NKp+EEQiNlX8+oNIMGYmGP6QAh1l/RCrj2yhVeXqXC7s8y9HCKSa08tBO
+e3AzHfWrcksVC2HugR6+/KjinOowlL4GwtpQ9clJF8Vk9ilA+PXL37CIaTkdJOsX
+doacEC84NpeSyQYf8g4q5uHDTEc4kg5NQ04TizFpag1LWs/nAgMBAAGjgZcwgZQw
+DgYDVR0PAQH/BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATAf
+BgNVHSMEGDAWgBRMfF45cY0dizvyML/k08KmEEPhkjBCBgNVHREEOzA5gglsb2Nh
+bGhvc3SCFGhvc3QuZG9ja2VyLmludGVybmFshwR/AAABhxAAAAAAAAAAAAAAAAAA
+AAABMA0GCSqGSIb3DQEBCwUAA4IBgQBiim9kFNYL81xP6MHNJe2erc3IrpCCn7IC
+WfrhqIz89o/2gYIWqwlc7IWA+y13btUAkaXVDZvZMoFMKbvUcF89OpO8G+4XpbX4
+uu9Q5pC3cjnFymO8xTRNgOam6yySLbjwzZwQIZ/0hh9xCeQ64tlw/a4VT6+UJrYn
+SNTPI38f/MwCFkyr4vCkCUIOIwTRfDc2BwHu1CJ820Hu3Jpr10CRzBOvsDJlDg8c
+vcmbdo+jsqEFMNIZpTblZA+MALRq4eK6Bas3YQcqIGjo+lxx9eYCGzZH1ygS/K5X
+501rBpLJ4OklIVTFWuo5IVwJ9RWMPgX3htl3HzpGztEV8nB9LEjKl9Lmm7xPb8+n
+ytycvckVyFe5JtejNtiB+9v0jNyqvEe2B7hdGfSLchuCv0a3xsocnayxnJChKtqI
+vo022s1k9k7wwJ2Qeq49HfK3yY00SgXYpUljKHLZocisYBxHmNbegzSBa2x7RU+k
+YexHKXvwNHdkVNOTs9LgER0EexdK+AM=
 -----END CERTIFICATE-----
 -----BEGIN PRIVATE KEY-----
-MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQC+lo6n5aZe8uIP
-zdC2RhQWTplDAr3jQPVYUgVWCsIGnmPGKZf8Zn04wHFV285Erp8MRQ1S9XGWr2jO
-X0RS5RfU4+wPIcWhPwsK9xq/VKgIhYETEGW9QsZAnZKsOnYLF8fDeU33BIoxvAhI
-ioUmExVQ+nGvLYBNBfHOevBEtQlccp6MQJi3nTTRmLdyMgkqMOnPGFKLljnHH9xM
-7oaC9DZ7mIJtIcCCQdlgiZRCQB3GGmwzHQwgFoSkNpDaIeIVee+i9yPc5eePYIZx
-q2cxoY3B5/AIDUb2WrH4GkrbcXQgIj6rb3NiiSTunxt1Hvmw37TJN5/fyGfl6QkQ
-+4M5wVW3AgMBAAECggEAMiun+gK2PSBq6gYf/xuLhiPCrKU4H26mJ03QIcpLMTrY
-wP2KCONh62KdcyCdt+7P54b17vS1phke2dSyQ7ATCfPF3GXjhIL4ATbzT5KVeUjL
-pZ0Xay78yV2xkq0BDgKAj7CLGY+UYWtCMvZj/pXfcqW674Zm09/Qu64ZObz+bds5
-cCrGyhpj1pXZJNBwfaJg82VwWIdytwcFdRwtgywiUJOZ+ldcnJU13f3HjxERpYYA
-zSvNi63bkBEMnj844p9MMsqwb5r8/lZQRvI2K6dW/dRa8xmQKi00AjtPOZMly1Re
-07brcVTmav2jYhZp9PxZUiRMmCdzEnhLtsynaYWVoQKBgQDGQxJeQncM12GuV1Oo
-nHJwRyICzB6DJ8nmErpK0a/zvIiQxUD+/qPVzTDI9C5lBWWPniGjdv57Nb0on1l3
-zp9MPzZrzLBTYyFT5nPBLyhcrRyd0Acz0MeB8p/UwErBP4JsJsjfuSB/Pa9YmbgV
-4GtWQ8khV05vhtivtR3xZl+RRQKBgQD2F2DQjfEuq4tD08v1JiBQQLM+Yw3k0tSe
-f4HFlbOHtPGEHbzrt3eD6fOhJmkVEkQcde4h22+oHpKff/5h0iiW5N4NUrIoL4WN
-34ZHIcpo+gjcdzrLF9fytzLbaaSpDApVVhcRX3JinwKpCp9G4y06KKKRV5EhW4MM
-+1kdZbzUywKBgEG/GkdB2ULb5duvv+FpSBXtsNymnfO2bSCr0zVehe/Y9Jy1nREy
-llgfPG9Xck8z0/MlaFhR7KAlOP5QoZW2YmMhj0V+UnbEp9ev03Eb11GsYpH+23SW
-ZqK0N8aQofmluvVsgy6VsK4hYZWLHF281zt7LSauUidv20mhUTWtUkHVAoGBAJUa
-fRJfri30yiCChyU1wIZfbTrzkUt/YkvWPa6VkX076Ml/qyO2ubc3XOHa//hAZPxJ
-h8sDxZc7TuNNDbf/OZCTgubXoBIxGN5o/FbE5nrMY+oQY5MCE1mAHlRKofW60df6
-nWdtSUTvyxDY2sB8jL6cOEOPpuNrKvAGqmvhZJQZAoGBAJOR7QEbU7L5rWEHDs2z
-QU8ry3y9stbt/ViP/RE63jLcxP5RG7LueDRYsNSdY0WA8wbJ6WNElo3EvxMurmmn
-jkjuhbcFgDFZ5W6cjjG8kDytIHcH73xbZLjqmN/NfsSW211HudkembKfQ4G6llPu
-dZpM5PgCoeFawQ1SnC+CSmcR
+MIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQDGNj/3rcpjgu8G
+ZHg1AS8lAEy8tbg73+9YRPJsIAytaCmoQYbRZncrWa9hWT0568DGSWbHye4+ZFrY
+yW1vNb0ANWPGVd6ReqtJm0wtplfcyzbgGN4EIYgHEUjFvVfDg6fHdV5K8z6UGGfn
+HHtwoj649Vw3CjAIRXufB9dDEPAZoh2NKp+EEQiNlX8+oNIMGYmGP6QAh1l/RCrj
+2yhVeXqXC7s8y9HCKSa08tBOe3AzHfWrcksVC2HugR6+/KjinOowlL4GwtpQ9clJ
+F8Vk9ilA+PXL37CIaTkdJOsXdoacEC84NpeSyQYf8g4q5uHDTEc4kg5NQ04TizFp
+ag1LWs/nAgMBAAECggEBAJBcqrJFzYY0sspBGpvgROn6EenPoGNbcgMkFDxUC2ew
+2cZGE18n9duI8odAa6tn3XuNsmII3JBsnw4NhrrctM8WE5k8qWHjqiVuCkmlQZD6
+IPmOowT3Nw+OsyXyBZ3MocJP5WFJUGakb+iPgghC4tPrQEKGFP2xPZxSJaIfEABa
+HgSYTSr+n8lJUKdld00BNSWXBxsVQ8NAw/5AFjFP4R3TeCwbd34lpMpkLvOax05j
+xbdZr0MP03MT8PYMBRzqMcST0OR7bK8vyAnB/ezxhrnQaMV2NeHpisB3UbNFi+PT
+63tNV/S2hCOGDZ5V+jFQ6FRyUw1gOlJK/EMGLIEt3kECgYEA1gMXqlp5w0OIBBkS
+MbhY2LhVO0v3LBHtRCqFbKGdA3yrHrsq/YJKlJbEoiw9mWGgYq7h0jNAsvI/WLgo
+tm4AUxRdG9YZDqNEcfcODnLqFg5D7/abSXx+An3pwZ+fQgL8STGu9up/Xl1Sss1T
+JHBEOM+vqb7TQxPPvl77SUHUwX8CgYEA7RmVO6PEepnJuMGYgG9Au5SMkcFY5iK5
+AqlEHio097+KsQ+K4nxW8yvtNoXnSBsfX3t78vI6zjSeFgk/MhoVUGLKIQTwq6KO
+WvASeB1zIzSkfXISznMs/CxGMt9FODvM9PCJMpeFAvJNDn83vupo0oxagu+EUVoF
+eGoqNEMMVZkCgYEAgx+d7lhE5miH+8rIpQIIHbDDN/ORW8UYFH3hBe/3Xd2Skt+m
+tXCQ9X1yuNJWY5W3SP9RiRKx/3IBcgBToYLAXCbL7XQ+IgPSuejfCedKmXzgDzSP
+bHUEV86B3IpKb42YudfhFZQTueN/+eFnoZnPkudc/6nVkvGehUt4tyfIjU0CgYAP
+PebHB7cYvowmMWPRVdWOeXUz5X8GhFLqZeE4IzR2fLy4tywRdTbNuRQtvhvpGb1B
+kRmdu46mNOG4vu1uFhkqqr8dskiab//AvtAhIpuFNtwgKFYnKWZJ67qziIDVpZp+
+YHwhYXYug08K0IjP4BfO+TDUW/tgk23omMKPy4OeeQKBgQCiKzdHtUO6KujjueYX
+lbDVbdEiXYbGzKcMmE0E/DK73xXpXT/CQ+tjB3nZKHDwkTN6h9ZZYzjhRWmHRlRh
+WqGqmWr4D3I0B9jnxCTpDuZIlJ21G336RbsZD8yi+eyMwJXN4csItGSlMig04jvo
+5vTIN0D0uXAvDD23TEcilpQzcA==
 -----END PRIVATE KEY-----

build/certs/rootCA-cert.pem

@@ -1,29 +1,29 @@
 -----BEGIN CERTIFICATE-----
-MIIE8zCCA1ugAwIBAgIQTrUnODKCVekcQa56Q2OQzTANBgkqhkiG9w0BAQsFADCB
-kTEeMBwGA1UEChMVbWtjZXJ0IGRldmVsb3BtZW50IENBMTMwMQYDVQQLDCphbGVr
-c2lAUHJvYm9vay5sb2NhbCAoQWxleGV5IFBhbGF6aGNoZW5rbykxOjA4BgNVBAMM
-MW1rY2VydCBhbGVrc2lAUHJvYm9vay5sb2NhbCAoQWxleGV5IFBhbGF6aGNoZW5r
-bykwHhcNMjIxMjA1MDgxNzA0WhcNMzIxMjA1MDgxNzA0WjCBkTEeMBwGA1UEChMV
-bWtjZXJ0IGRldmVsb3BtZW50IENBMTMwMQYDVQQLDCphbGVrc2lAUHJvYm9vay5s
-b2NhbCAoQWxleGV5IFBhbGF6aGNoZW5rbykxOjA4BgNVBAMMMW1rY2VydCBhbGVr
-c2lAUHJvYm9vay5sb2NhbCAoQWxleGV5IFBhbGF6aGNoZW5rbykwggGiMA0GCSqG
-SIb3DQEBAQUAA4IBjwAwggGKAoIBgQCgLa+u4TDI3iPESTdOpaSO3C1zN4Kx+AwV
-6y5MQHs3tQUx5jDdo66wDXkcSIv2xQERbbQSmpTy1rbarN2fq5H4KvgTTQZkpYbt
-ho9sziZjMlAUD1VP7Xo0FkgXK20z+t1i7b5DSuZ8oOGTFxwL67qZwkTP5VKHstEm
-tLiVgNnmNBsGtxZxpkj8zG8Emn7LSS0DpaKAgxeoyDqkMkpU834+sHdqfTbCfWLA
-J8ClkJv4gjR8iXswBl9Gr0j3fOcWNCTOZz0Rn8k6aEUyFnQBSQ5ENN5X44QoXeB9
-Xvh0c0T3tC8M3LLXW6i/LioeHjnQ8tlHl8p8SC+ICz22mrAiMHl2ALVE3qJGd15R
-4Ni0RGL743URQG2r38WzzVqJ/cZHCfi66eCNSMfeP0XOG5UtJUl0Ko6FwKd7bRY4
-BgT6dvxSsCXT2wMyr+Lf4nTkRwKmdJ7PpiG/67fq8b9Jy/1TUK9Y+8F0dyCrDo1O
-iHNfnngVtcCJSS1WmxEY+zPkPir0pykCAwEAAaNFMEMwDgYDVR0PAQH/BAQDAgIE
-MBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0OBBYEFKrDcJcU9cWHA3BoHNr90+ch
-Ut2qMA0GCSqGSIb3DQEBCwUAA4IBgQAeM0iseib1sINK9rlZs2sp4ueg8l/oRr1O
-Jqqlgt8MnF948HM0XDneiqXpKDRjmcNTgFocHEDnGfGObiyqjnOfgdu7+q/pDzkH
-wAnWUc3zQPS2Z4tvy0SFVlZSl1RDgOA8tjt4MyoZLJII+y3O6N/Y9Lu/kCkYzdnQ
-GeiYKYS1CiZ5CfUvuL4uQihdUBIBol7OY2S7/udbmEqBUMw6xOZ7j8DMx5p9BGs/
-zWVCrIYDihHOdSbDb0Dy4cKc12l8YvabzxpUvIte5l7V8/7jLgv0mBAaY1mz6LeT
-xStnsUVL1qUwiUT4LLXc57HT/j4AAWZLW4lvQGSVfDLvpudT9tHJzlizAfJ3XQcq
-3wc5VxUiWi98W63yzX+jDgpdGi9qZwnuTR9oukWkquNJcq7zGl6bgwg15cfnsKwd
-918cPTZ7bhpH2JqiaTcUSXfYm6fOSPGTG3JqKE7R8zyOeITJAM+F19fmmROy3iRE
-h9CGy7MtERq0izVN39Nv/7fEQYISpck=
+MIIE9DCCA1ygAwIBAgIRAKmp4Hngu2VSn3W3/HbqhhcwDQYJKoZIhvcNAQELBQAw
+gZExHjAcBgNVBAoTFW1rY2VydCBkZXZlbG9wbWVudCBDQTEzMDEGA1UECwwqYWxl
+a3NpQFByb2Jvb2subG9jYWwgKEFsZXhleSBQYWxhemhjaGVua28pMTowOAYDVQQD
+DDFta2NlcnQgYWxla3NpQFByb2Jvb2subG9jYWwgKEFsZXhleSBQYWxhemhjaGVu
+a28pMB4XDTI1MDQyNDA2Mjg1MFoXDTM1MDQyNDA2Mjg1MFowgZExHjAcBgNVBAoT
+FW1rY2VydCBkZXZlbG9wbWVudCBDQTEzMDEGA1UECwwqYWxla3NpQFByb2Jvb2su
+bG9jYWwgKEFsZXhleSBQYWxhemhjaGVua28pMTowOAYDVQQDDDFta2NlcnQgYWxl
+a3NpQFByb2Jvb2subG9jYWwgKEFsZXhleSBQYWxhemhjaGVua28pMIIBojANBgkq
+hkiG9w0BAQEFAAOCAY8AMIIBigKCAYEAw/ZCWaFBwUs1uiVu5vwfx7CJKL10EvH7
+rBJfUnDMoK/AYUzAhvVumi1WDmT4TnVG4MSQ/Ep5RV5HsidT8Sz75NB5Vu6rRyD1
+4BVgR0R4WnyE4XQ7QX/eFvuAL1ToRWwqUtKLPaeYN1v+Xvi7HSeiwS1fPYnZ60mt
+SpTOUn3c2EptKwHSZF5g5nrlX0RNEWiqZLW8zy49psDF57883DTOOvDvreH75zRy
+jbaz2zXHdERct/zdnAOqPu5D/dT7Oi6ubtbqpp6Ytd0SYASf1DkMc+pq5ta1ZL6j
+hs9x6a2X/INYwjXIH+TVqhW6VLR15ieT960dFeJOU2kRRDoOoFegOR5DlLgXyt4c
+fap053vL5qbctAWKV0q/4oF4TNRh+9iAXm70HSfPvA8CYv2QIanmsAKlFxkw4lSY
+kh2Gycbi2te8AjA8IYYo++DJiy5Y23NWYswZv/qtnZDymaYc3zVooriCie270iiN
+Dwysl3saSQL2m2C6VimLJZy8CqyCt3HTAgMBAAGjRTBDMA4GA1UdDwEB/wQEAwIC
+BDASBgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdDgQWBBRMfF45cY0dizvyML/k08Km
+EEPhkjANBgkqhkiG9w0BAQsFAAOCAYEAKSq6dmHItnF8C4yWP6i08BHAmhqmGo/Q
+PvgnnDjNMMX888dJ+cDSTi4r6ukPsjmCj16XZ2RNg2v2nYzO4S6qjuW3vPOGBugG
+lCanj0AOZVcZY+te2z8hTxwLDVaRGTm9Tw8jEmjtiNwpChnkIBqAjlHbJZpHpjzv
+khusNY8KKH0I/uMBQfIOMKf8fBvu2k8wYlyW1pwwgmVDWbiTv3tU9px7Lh7WSd3w
+NFTC+xGAsl+tR7Z/UZB9FcI522IZm6A5LsTp4JfsQ4deUdU7iV36cqTrxG6A59BL
+P/BS711oUlei3ORBloFhSXGKVPHqHu1jGGnpIFyQx6uS/0v1M6FN5wmZxAN+YVmO
+7B7ttS3mN3PpALJIy+/P/EjtwVqzX+2HdJ+zo3JIHqtIQunBWAeeCZpltn3yd/35
+MCa9RG7ftdfVrh2SwdZkR/bhKlgbelZ4EoxHXBiJxwZwVY8rJx/n2Bp+fp7crjhC
+ZTscssX+5FbczWgIqzG5vmNescyM4XE3
 -----END CERTIFICATE-----

build/certs/rootCA-key.pem

@@ -1,40 +0,0 @@
------BEGIN PRIVATE KEY-----
-MIIG/QIBADANBgkqhkiG9w0BAQEFAASCBucwggbjAgEAAoIBgQCgLa+u4TDI3iPE
-STdOpaSO3C1zN4Kx+AwV6y5MQHs3tQUx5jDdo66wDXkcSIv2xQERbbQSmpTy1rba
-rN2fq5H4KvgTTQZkpYbtho9sziZjMlAUD1VP7Xo0FkgXK20z+t1i7b5DSuZ8oOGT
-FxwL67qZwkTP5VKHstEmtLiVgNnmNBsGtxZxpkj8zG8Emn7LSS0DpaKAgxeoyDqk
-MkpU834+sHdqfTbCfWLAJ8ClkJv4gjR8iXswBl9Gr0j3fOcWNCTOZz0Rn8k6aEUy
-FnQBSQ5ENN5X44QoXeB9Xvh0c0T3tC8M3LLXW6i/LioeHjnQ8tlHl8p8SC+ICz22
-mrAiMHl2ALVE3qJGd15R4Ni0RGL743URQG2r38WzzVqJ/cZHCfi66eCNSMfeP0XO
-G5UtJUl0Ko6FwKd7bRY4BgT6dvxSsCXT2wMyr+Lf4nTkRwKmdJ7PpiG/67fq8b9J
-y/1TUK9Y+8F0dyCrDo1OiHNfnngVtcCJSS1WmxEY+zPkPir0pykCAwEAAQKCAYBH
-A1oy/vVA6HMU75zMilVFXMntnbucqSq6gPSaq6+1B9UQxUv+xzWIKcD60BL1SWvq
-zScbZFsKujSBCEiNJGRnkK1A6VIfRt9l6NUnWNHeAo1MB2w8Lj2SYBp/4ynb9Kk3
-1c0XSlqbADxhmMo/YrfsuRsGzFVlgdqF/XMkHOb9zzX4KS2THzSWlw/VC6WQ/JUv
-W7yKmxPfKT4OU5luxjC/HD8k//RKD4q7RCR9gnoTl64rVExAA2M0FDwWNNLCnkTL
-iMJVZY8JzGawJr97sMMJ1vKCPyAJIKS/Qv/K49BT01pb08dsgUR0LSwr+e+E8jNL
-f8WBlDD4maHSovztqWeR7Gnczv0WTjIzn+UpiUUmAmBVDjeidXH/NsP01NJUyhPa
-HlKJBCfNbtFNWZkliwMu2Yq5cZnOFFHb3O+3FhyZc7c46np3EdQOJwX+jVgjaaT/
-aQYMTNib0nrVkoliM4vNxH8lNhKZlsPzSXLlr9mAWXa/+iK3HiXmWO6jENRIFq0C
-gcEAzL/2kp8MjbQrKyFrmF9hNQ7e6/ObadgjGwjGAliIlVRwC38lc5tdFbthRQpt
-VfAunRimh2LI+8SBiJnigFa8IezgPkNVuOlopYwcOHTdm//NcAmNH5f5aan99QJS
-IYnD3txvZgKT4kBW8Amt3MdYbBrXJmnDz5AA0ofqJH7XfycIsXuUb8RGML3xi87M
-9Fw81lXsOqag/sAwmTybN0C69iypDTOLEU+LfHd5JYs908JRbSkWfvGozKik9ZHR
-G9IfAoHBAMhFqS0x4Vejs0mZSdXkcdqFbN5eAeNj0+xVuscCbv4ir2QQS9xUqYmy
-gHKbHKASSUXyQ2iKoEdVrvPD0XWQbBbZ0Hx61zdGo9SdDItU4pvZ+jpXsQrmnmxV
-0e3DOKQpkEDJJKVFwVvF/Z/LqK0Zm1aPVjcLXn9t5BAQbATfAlprJF8JziJiNJDy
-csjtuR7wGsXQRWdbnqg3hn6/upl8WtPHhMwew/Cgf8WGYXi0fcqOFyfjjWq+Lu0Y
-lTkqQ54ttwKBwQCGn9VtVHx5k7QqmL/ZISWWMF/svnE6Z+21MdCX7ERqA2nkdUZX
-vBi5WEo9jfyT2+eaTYH5VL+Xov4UpjHidqUenVRYPAfaHEY9S2Gm0ViA4PHgL7eF
-xXQtwKMFfPApsx6Bo2jvptQ7mFhRXdveZYhDFGbQkAw6ppGT29/c/TWOGklCAWJ5
-FpGcLNfsOB5UsW0i9L3tVnBW8GFD8DCSZNJJWNYSowhWannpbdjPEb2mRYcqgjCT
-aSu23VARUz4tz7sCgcAzvrPwZnPntfcr6/xE1IqKQHEZn0ZznyZxaNEifEF7TjDs
-9Lz1B7bqSgGgGu2xeigOd4LtLuwsojna59xluNQEr3CLyR10Pb80vwMvuNX4GMDr
-dB7dRyrlqOLdwNQQrmCELLRYM4a7FJPsRq2lU/lrywsmm7xlxlnnwKZ4N7qe7BHw
-sFLfVWppjQsVWT68fKMeOyrDgsuigP4yH42x/IxnLaTlLInJ0V5SBd+HVXMu87mN
-5+BxFQSA5BoiNAZWh08CgcAriIjqFrqxLEPJZQxmTIB3ZrCiaG27Df9AskFdCCR0
-k+zBNVqQUCVSbJHTwn/hQ/eaQk2DQoGZEfYptGaKaTulhwA17WvmDKdkR2rJrtGk
-6KD54eM3x6spwmk0bNf52d7ATOVqKOTUFZkFjuH7TYM8Mq1QiyUjQK8U7yJz3C8g
-7vc5UB8grPTMHKcmmHD1OUfldVSkHOkpWsPPCE7MQIKE8/Pd+Mw+yEJu2RjTTk4i
-7/buVacrwTZs6HZc8WXXQMA=
------END PRIVATE KEY-----

build/certs/server-cert.pem

@@ -1,27 +1,27 @@
 -----BEGIN CERTIFICATE-----
-MIIEiTCCAvGgAwIBAgIRAIudq+AfKl856muWz/i3yLkwDQYJKoZIhvcNAQELBQAw
+MIIEiTCCAvGgAwIBAgIRAMa57BhiUa7ds8bjquZeuGwwDQYJKoZIhvcNAQELBQAw
 gZExHjAcBgNVBAoTFW1rY2VydCBkZXZlbG9wbWVudCBDQTEzMDEGA1UECwwqYWxl
 a3NpQFByb2Jvb2subG9jYWwgKEFsZXhleSBQYWxhemhjaGVua28pMTowOAYDVQQD
 DDFta2NlcnQgYWxla3NpQFByb2Jvb2subG9jYWwgKEFsZXhleSBQYWxhemhjaGVu
-a28pMB4XDTIyMTIxMDA3MTgwNVoXDTI1MDMxMDA3MTgwNVowXjEnMCUGA1UEChMe
+a28pMB4XDTI1MDQyNDA2Mjg1NVoXDTI3MDcyNDA2Mjg1NVowXjEnMCUGA1UEChMe
 bWtjZXJ0IGRldmVsb3BtZW50IGNlcnRpZmljYXRlMTMwMQYDVQQLDCphbGVrc2lA
 UHJvYm9vay5sb2NhbCAoQWxleGV5IFBhbGF6aGNoZW5rbykwggEiMA0GCSqGSIb3
-DQEBAQUAA4IBDwAwggEKAoIBAQCv9ohL1csSCSPGrQrXhcBrsuQH5w9OskV68cpn
-8E49cofnAeGN462G5Fk98GRfBNLXQOwBXA4KpzjQDWLpWRSnNXjuSa9Y+uti7JCa
-SEVS668euY891vFT2IQyf9ZPr5DYp/t6VPz6UeslrCYFxMI9z/o1ucl/h7Ti+iRV
-pbbaeO6K5kR9/XMC/0kDFS1ORmdC25gFDENpje60dM04MEzJmJECTZCoQ5iSz+bL
-aOt0LmxIgrCN7yH/kjpC64PXWwrUIylMYq/AmnojD0S3RKwRMlNGJOWers5ExYix
-DWZ83BGZiZCJqLxExl7vyiz2D84xdNbWWXJBjQF1l2ye7/tZAgMBAAGjgY0wgYow
+DQEBAQUAA4IBDwAwggEKAoIBAQDBYwQjUTxzptQQJQl5bSSkK8bCA6wAnuzk3lOi
+h0Szk463wSsPpDWPf/NgxsB3HP2ANUtGCdCcKxCmcCJMA8+nZuvJSTdGeYMYF8Ca
+eBGRyQK1ifucZp9o0F+oK02cx36v/BzjhCEyn20IZ4LBcC6dBalox8/iUcZHQpRm
+Rejo07KrLSws8w/T21Lk7GURnHWZej+dicukxZlEZ/fDiYwQC0z0JJaG/+3OQG1p
+gRqYD6Dn/lnB8DvMZfW+EV/zyjT292WgHr9NQ+Yb/99oPLUDL7QcEqQ0yETGTx2i
+jVlN8A3DM0gwlWD7TYXorc6bTQeDiG6vJk+I11Q25TvoE0AtAgMBAAGjgY0wgYow
 DgYDVR0PAQH/BAQDAgWgMBMGA1UdJQQMMAoGCCsGAQUFBwMBMB8GA1UdIwQYMBaA
-FKrDcJcU9cWHA3BoHNr90+chUt2qMEIGA1UdEQQ7MDmCCWxvY2FsaG9zdIIUaG9z
+FEx8XjlxjR2LO/Iwv+TTwqYQQ+GSMEIGA1UdEQQ7MDmCCWxvY2FsaG9zdIIUaG9z
 dC5kb2NrZXIuaW50ZXJuYWyHBH8AAAGHEAAAAAAAAAAAAAAAAAAAAAEwDQYJKoZI
-hvcNAQELBQADggGBAFRfs4mj3CnK43sdCUd30K6ILhTIii2Mjb+olCUmOrR3Gka6
-J3LLEOdvanFpHDpx3wcxHe6YKuBpDAqTkwB/4LuOA0hHyLsV3O+U+QMgNuTvpAWq
-BgB0xs02mXIvcIYmTOI100Nh9SYULNuohZo4Jtw9+noLMc3xIKlEUCKqDjEu26mp
-N9hKkFd4Qf8hs0j4UFNFfZC7qOzTyX1XGd0roGlNFc9Pm/bjo2hW1PgI3wa72Cux
-FXul8NoKUyBYZ0xnUjeXc5akfpxl7cywqOorKXRk2xikr388R5fuAoeBnQK/unr5
-AUOuAVG0zfLheRed46Op5cF7KJmc66OgPFYcgMAdYIwiy+LXZcXmCCuVU+t0WX4S
-2zJ52HcfOHp+ius0FJwYgZ0G0SiVnj0tbxqLj1kBRK3qyyIEWaTdXTjYeotWbDzh
-0BrtGxzft7ploi2CfpSh1vPhTWWoAvtr4I/sHmV91yDLY3PUU/ywoCCk2JCWmBvh
-8ytaa2MFPzdWI6t9Bw==
+hvcNAQELBQADggGBAMOYUQen1PpG34YcmdSNIO62/GFSNR0CID8R+1lvqZFyiaeA
+HTUhDfWVopY8KuqzgXgXE2nAxLf6WSa0kIJOUIE7eLU5zMBW/rLcoa6UxhT2nXjh
+gd7d2PPLSXE/ZBMkoXeQVuZVImywT7haNI0tee3ariIbXeaiaLP6NBlnFva50Tkn
+qKeQpV5UPDQcEvChDtWSvsPkb9yp1CcavBEEJ8XZwgIbV4qKB0z2Q812wsPadpXE
+VLy8KwYhjxBVJyAEH3qpiZH5N+nTnQwu3slWCIck5cskpXGPBX+WIY4nS/4y+idX
+EhnwowfDewWGum58sdUYdyUpdC7NTw4AoZ42y9PcgXu8/qhLr0N0n5/Slmlxe7oN
+zOQfOZduv8oOLW0GuccqGEPwDManU995syDOmqZbBuBt590E2Pid3dwtr/0kyLax
+SyAACTQi7Q0WUPfFj13jCqGU5z99Y6W7RudUg/+snCxiSvc+x/wphjmnGO73X9+p
+uH5dRdyAeGHFw9e2kQ==
 -----END CERTIFICATE-----

build/certs/server-key.pem

@@ -1,28 +1,28 @@
 -----BEGIN PRIVATE KEY-----
-MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCv9ohL1csSCSPG
-rQrXhcBrsuQH5w9OskV68cpn8E49cofnAeGN462G5Fk98GRfBNLXQOwBXA4KpzjQ
-DWLpWRSnNXjuSa9Y+uti7JCaSEVS668euY891vFT2IQyf9ZPr5DYp/t6VPz6Uesl
-rCYFxMI9z/o1ucl/h7Ti+iRVpbbaeO6K5kR9/XMC/0kDFS1ORmdC25gFDENpje60
-dM04MEzJmJECTZCoQ5iSz+bLaOt0LmxIgrCN7yH/kjpC64PXWwrUIylMYq/Amnoj
-D0S3RKwRMlNGJOWers5ExYixDWZ83BGZiZCJqLxExl7vyiz2D84xdNbWWXJBjQF1
-l2ye7/tZAgMBAAECggEBAKVMZds/moV12orfscim2A0UPwyBbarS41xMWYTshMNK
-nQpQhQ+iqzeFuaPq+I8eW+ZkEZBxZqtxTXh8qsdkrHcrT1AiHjvrc0Y5ztlwPNdZ
-mee2Dy7bhVbrlbxOxQeUePBeVWok/oU0gT6hihJvNL2Wa4ke34AS/sUekRV4F98A
-nujWss06lvIv0RqivhFDuYBdGuteygcMyHjCwZj597KQAjoo+p5nvN3DJJ5C/bcq
-dwmRSbKMmauv1tnMl9h8EsZUFM89x2xrCtXEzSzV6ZCe32TF7DimDGhNlCkiVnoC
-Ohzz6eYZzEYfRQTMQT5s3jix24C8Wc6wOYyDGjdjQmUCgYEA1Y+Ju+mLYnhF6xKm
-XOvMGgna16E33LVJessTY3gy1+MZtfvHm3Op+xkGmOAjoVXTk/za5yuDOZf5CR0/
-slY1N/PolZ6/K++ObqIOBBYYt1jE1FX3sGM8tJEIwgq6UCItCxDWPxHOG+ZHRtvx
-v+4A1v7/2PtaYOTiGMGmsbP5RxcCgYEA0u5KKO7fWZG6PSy/kD6LGx68t8nviCY4
-POrG171jir7Rs00qi3PNpln2qzgcnkJdOxpKv/VfDcxZgb42kAVN4O/xeqti/k/4
-YCUfXL2VmQE6T/slBkzhRAKpBLZOf49Awwh3JTutfeCL2MB9JiCHbzrObO5g3MgC
-92L5I6C0Vw8CgYEAl95MV0o8qdjX99Q6ZEf2y+mIK+FlBVoSF/WEIy9eELJaHVUg
-XIbDMWJZk6uJCvkqzcl5rfz+g510JqwbGOo/TDvygTvzvP3NbxVlHDjOeMvypQFB
-c7kOeWXOMZdJaST0nTLq+Mzjoml+9IACibdp93o9XQNaAR+jPXGw5hwTQB8CgYBW
-DmYvQRXawzvKjaEyRnIWhHnWOgsB7yXupJKvnlMoXiXME2WSM5LplbavsFrsroK/
-BEEPBBrd1EuIRYSZSbC2Xu6Ub6wZuaLKBxs+iRKps/iIfRxj76XQS42NoJtyK43u
-hFun0ys7OguUSSRGE+ttk/54LuFR8kBTkgu3X290PQKBgF8s/Fx3akNCpgjG8at3
-U+Edmb3wLVckAiYIDHksnreowdJB4yR/05QDbgGYTrRhppEMuHmsN1geYfQmNa3b
-GAlSvv4H5YK4QrUUJZTcBXBFneMdZK67bohfbRkQIwSm5u0xLDUVoD3UhSz26Pu3
-b1anKvC576arrZ8pewyW2kp1
+MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDBYwQjUTxzptQQ
+JQl5bSSkK8bCA6wAnuzk3lOih0Szk463wSsPpDWPf/NgxsB3HP2ANUtGCdCcKxCm
+cCJMA8+nZuvJSTdGeYMYF8CaeBGRyQK1ifucZp9o0F+oK02cx36v/BzjhCEyn20I
+Z4LBcC6dBalox8/iUcZHQpRmRejo07KrLSws8w/T21Lk7GURnHWZej+dicukxZlE
+Z/fDiYwQC0z0JJaG/+3OQG1pgRqYD6Dn/lnB8DvMZfW+EV/zyjT292WgHr9NQ+Yb
+/99oPLUDL7QcEqQ0yETGTx2ijVlN8A3DM0gwlWD7TYXorc6bTQeDiG6vJk+I11Q2
+5TvoE0AtAgMBAAECggEBAJWdVGM6g0l6hVBkRxsxbIqy75fEnXrxeZdrxkrU2jsQ
+avcRNI5qXaHCvPlfayH8RMe+85ihGUrpKn2J/Y7P2ATMZJka0u/sLJckMTeQsw8V
+88mdkhMjdiryIz+JGQe1c/cVVwhSfhibLRC2fHvJndaPvcw54kRXPc593S/u4E3X
+uc5pyoPkiyon4AzQ3piVTRrdtQRyyT1UDJ+lRyTBLuWcM50H4O50VliIrk2HVxGA
+dfL8tnYOGnW7l12xCa6OoT03/qOBS1yPd8vXFAmnbEzbzvAEIDXC0GXQ5CPHOsFu
+ZnviDmjt2I/OSygBqnaxCuE0cMgIvI7zf2ie43Onu4UCgYEA0STl3mC80lSg8Ddo
+qGj+uPck3aOtUtI0ni94rM4YwgqDakm1aMDtVbivg3F9HLjDPxCe+iyQFOvjJ+uR
+KEdp5zFmS3Sf9lB0PymCbeAicRJA6ku+9GxbYk9VNWkxrNozDn4iolio41xjZSZ4
+iXHBh/s2xeZeGfW65/MOJMjvk/cCgYEA7LZh6ueBrBJkMf3imcmz7cfEkUyzioyM
+3Gz8JMNINPsb8QTYLaAog0m7eQ6FVZB0lIQV9V+pTzbhCxSbAryL7aOr7vKmFlgb
+tB5YqsdYHGftZAqwJzFNorAA2Yh5Z5H1+xAB3i4uB4lHwIC1Sl79vor7tccvGFPK
+hWX8Mz82+/sCgYAmI3NjpQJp3JLom0ITi+n/ctofLMzbkIeV3RRFduPe5qnmRQC2
+1I+zFRW0g4qMJUk9g9tpxZyUpBttWTDERpmSVljQI7lT4oIATqKBROEi+3ApCZ0N
+14Cmoc7pCYDMg5HR78CDGGXb6Cob9PMAJWVkVbQ8THEWjNADojgPDzFZKwKBgGGN
+tIL7z9wbZEGaEUYx8z4+gwsioieqTu8U10FLXbm/9z74MSN0it24iFOWoWqm8vS2
+DtqmBv/HbS2E23FgRQa12kjKpZo1y40KqJ4RM4XZauM86GXuksFGacM81FPTup0y
+dqKbQ4sFj5WNNamlxks9ugirQwRym9coNazlE4L7AoGBAMaeWaVaRbFu+jgscPud
+k5J27o9zH8CS+xngOYEjGFpdR/52ZMhpQOrtFJX0mCOi9vpAQ5Ro0kk1HMPH0mGU
+5b75OUy6SBfnYR7mw7imc85bP+lQoe8kmb+wrIJMYx9RGGbDatDFbxCEasqNzvFf
+VQXTnh0brizumpbOfHlZXced
 -----END PRIVATE KEY-----

build/certs/server.pem

@@ -1,55 +1,55 @@
 -----BEGIN CERTIFICATE-----
-MIIEiTCCAvGgAwIBAgIRAIudq+AfKl856muWz/i3yLkwDQYJKoZIhvcNAQELBQAw
+MIIEiTCCAvGgAwIBAgIRAMa57BhiUa7ds8bjquZeuGwwDQYJKoZIhvcNAQELBQAw
 gZExHjAcBgNVBAoTFW1rY2VydCBkZXZlbG9wbWVudCBDQTEzMDEGA1UECwwqYWxl
 a3NpQFByb2Jvb2subG9jYWwgKEFsZXhleSBQYWxhemhjaGVua28pMTowOAYDVQQD
 DDFta2NlcnQgYWxla3NpQFByb2Jvb2subG9jYWwgKEFsZXhleSBQYWxhemhjaGVu
-a28pMB4XDTIyMTIxMDA3MTgwNVoXDTI1MDMxMDA3MTgwNVowXjEnMCUGA1UEChMe
+a28pMB4XDTI1MDQyNDA2Mjg1NVoXDTI3MDcyNDA2Mjg1NVowXjEnMCUGA1UEChMe
 bWtjZXJ0IGRldmVsb3BtZW50IGNlcnRpZmljYXRlMTMwMQYDVQQLDCphbGVrc2lA
 UHJvYm9vay5sb2NhbCAoQWxleGV5IFBhbGF6aGNoZW5rbykwggEiMA0GCSqGSIb3
-DQEBAQUAA4IBDwAwggEKAoIBAQCv9ohL1csSCSPGrQrXhcBrsuQH5w9OskV68cpn
-8E49cofnAeGN462G5Fk98GRfBNLXQOwBXA4KpzjQDWLpWRSnNXjuSa9Y+uti7JCa
-SEVS668euY891vFT2IQyf9ZPr5DYp/t6VPz6UeslrCYFxMI9z/o1ucl/h7Ti+iRV
-pbbaeO6K5kR9/XMC/0kDFS1ORmdC25gFDENpje60dM04MEzJmJECTZCoQ5iSz+bL
-aOt0LmxIgrCN7yH/kjpC64PXWwrUIylMYq/AmnojD0S3RKwRMlNGJOWers5ExYix
-DWZ83BGZiZCJqLxExl7vyiz2D84xdNbWWXJBjQF1l2ye7/tZAgMBAAGjgY0wgYow
+DQEBAQUAA4IBDwAwggEKAoIBAQDBYwQjUTxzptQQJQl5bSSkK8bCA6wAnuzk3lOi
+h0Szk463wSsPpDWPf/NgxsB3HP2ANUtGCdCcKxCmcCJMA8+nZuvJSTdGeYMYF8Ca
+eBGRyQK1ifucZp9o0F+oK02cx36v/BzjhCEyn20IZ4LBcC6dBalox8/iUcZHQpRm
+Rejo07KrLSws8w/T21Lk7GURnHWZej+dicukxZlEZ/fDiYwQC0z0JJaG/+3OQG1p
+gRqYD6Dn/lnB8DvMZfW+EV/zyjT292WgHr9NQ+Yb/99oPLUDL7QcEqQ0yETGTx2i
+jVlN8A3DM0gwlWD7TYXorc6bTQeDiG6vJk+I11Q25TvoE0AtAgMBAAGjgY0wgYow
 DgYDVR0PAQH/BAQDAgWgMBMGA1UdJQQMMAoGCCsGAQUFBwMBMB8GA1UdIwQYMBaA
-FKrDcJcU9cWHA3BoHNr90+chUt2qMEIGA1UdEQQ7MDmCCWxvY2FsaG9zdIIUaG9z
+FEx8XjlxjR2LO/Iwv+TTwqYQQ+GSMEIGA1UdEQQ7MDmCCWxvY2FsaG9zdIIUaG9z
 dC5kb2NrZXIuaW50ZXJuYWyHBH8AAAGHEAAAAAAAAAAAAAAAAAAAAAEwDQYJKoZI
-hvcNAQELBQADggGBAFRfs4mj3CnK43sdCUd30K6ILhTIii2Mjb+olCUmOrR3Gka6
-J3LLEOdvanFpHDpx3wcxHe6YKuBpDAqTkwB/4LuOA0hHyLsV3O+U+QMgNuTvpAWq
-BgB0xs02mXIvcIYmTOI100Nh9SYULNuohZo4Jtw9+noLMc3xIKlEUCKqDjEu26mp
-N9hKkFd4Qf8hs0j4UFNFfZC7qOzTyX1XGd0roGlNFc9Pm/bjo2hW1PgI3wa72Cux
-FXul8NoKUyBYZ0xnUjeXc5akfpxl7cywqOorKXRk2xikr388R5fuAoeBnQK/unr5
-AUOuAVG0zfLheRed46Op5cF7KJmc66OgPFYcgMAdYIwiy+LXZcXmCCuVU+t0WX4S
-2zJ52HcfOHp+ius0FJwYgZ0G0SiVnj0tbxqLj1kBRK3qyyIEWaTdXTjYeotWbDzh
-0BrtGxzft7ploi2CfpSh1vPhTWWoAvtr4I/sHmV91yDLY3PUU/ywoCCk2JCWmBvh
-8ytaa2MFPzdWI6t9Bw==
+hvcNAQELBQADggGBAMOYUQen1PpG34YcmdSNIO62/GFSNR0CID8R+1lvqZFyiaeA
+HTUhDfWVopY8KuqzgXgXE2nAxLf6WSa0kIJOUIE7eLU5zMBW/rLcoa6UxhT2nXjh
+gd7d2PPLSXE/ZBMkoXeQVuZVImywT7haNI0tee3ariIbXeaiaLP6NBlnFva50Tkn
+qKeQpV5UPDQcEvChDtWSvsPkb9yp1CcavBEEJ8XZwgIbV4qKB0z2Q812wsPadpXE
+VLy8KwYhjxBVJyAEH3qpiZH5N+nTnQwu3slWCIck5cskpXGPBX+WIY4nS/4y+idX
+EhnwowfDewWGum58sdUYdyUpdC7NTw4AoZ42y9PcgXu8/qhLr0N0n5/Slmlxe7oN
+zOQfOZduv8oOLW0GuccqGEPwDManU995syDOmqZbBuBt590E2Pid3dwtr/0kyLax
+SyAACTQi7Q0WUPfFj13jCqGU5z99Y6W7RudUg/+snCxiSvc+x/wphjmnGO73X9+p
+uH5dRdyAeGHFw9e2kQ==
 -----END CERTIFICATE-----
 -----BEGIN PRIVATE KEY-----
-MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCv9ohL1csSCSPG
-rQrXhcBrsuQH5w9OskV68cpn8E49cofnAeGN462G5Fk98GRfBNLXQOwBXA4KpzjQ
-DWLpWRSnNXjuSa9Y+uti7JCaSEVS668euY891vFT2IQyf9ZPr5DYp/t6VPz6Uesl
-rCYFxMI9z/o1ucl/h7Ti+iRVpbbaeO6K5kR9/XMC/0kDFS1ORmdC25gFDENpje60
-dM04MEzJmJECTZCoQ5iSz+bLaOt0LmxIgrCN7yH/kjpC64PXWwrUIylMYq/Amnoj
-D0S3RKwRMlNGJOWers5ExYixDWZ83BGZiZCJqLxExl7vyiz2D84xdNbWWXJBjQF1
-l2ye7/tZAgMBAAECggEBAKVMZds/moV12orfscim2A0UPwyBbarS41xMWYTshMNK
-nQpQhQ+iqzeFuaPq+I8eW+ZkEZBxZqtxTXh8qsdkrHcrT1AiHjvrc0Y5ztlwPNdZ
-mee2Dy7bhVbrlbxOxQeUePBeVWok/oU0gT6hihJvNL2Wa4ke34AS/sUekRV4F98A
-nujWss06lvIv0RqivhFDuYBdGuteygcMyHjCwZj597KQAjoo+p5nvN3DJJ5C/bcq
-dwmRSbKMmauv1tnMl9h8EsZUFM89x2xrCtXEzSzV6ZCe32TF7DimDGhNlCkiVnoC
-Ohzz6eYZzEYfRQTMQT5s3jix24C8Wc6wOYyDGjdjQmUCgYEA1Y+Ju+mLYnhF6xKm
-XOvMGgna16E33LVJessTY3gy1+MZtfvHm3Op+xkGmOAjoVXTk/za5yuDOZf5CR0/
-slY1N/PolZ6/K++ObqIOBBYYt1jE1FX3sGM8tJEIwgq6UCItCxDWPxHOG+ZHRtvx
-v+4A1v7/2PtaYOTiGMGmsbP5RxcCgYEA0u5KKO7fWZG6PSy/kD6LGx68t8nviCY4
-POrG171jir7Rs00qi3PNpln2qzgcnkJdOxpKv/VfDcxZgb42kAVN4O/xeqti/k/4
-YCUfXL2VmQE6T/slBkzhRAKpBLZOf49Awwh3JTutfeCL2MB9JiCHbzrObO5g3MgC
-92L5I6C0Vw8CgYEAl95MV0o8qdjX99Q6ZEf2y+mIK+FlBVoSF/WEIy9eELJaHVUg
-XIbDMWJZk6uJCvkqzcl5rfz+g510JqwbGOo/TDvygTvzvP3NbxVlHDjOeMvypQFB
-c7kOeWXOMZdJaST0nTLq+Mzjoml+9IACibdp93o9XQNaAR+jPXGw5hwTQB8CgYBW
-DmYvQRXawzvKjaEyRnIWhHnWOgsB7yXupJKvnlMoXiXME2WSM5LplbavsFrsroK/
-BEEPBBrd1EuIRYSZSbC2Xu6Ub6wZuaLKBxs+iRKps/iIfRxj76XQS42NoJtyK43u
-hFun0ys7OguUSSRGE+ttk/54LuFR8kBTkgu3X290PQKBgF8s/Fx3akNCpgjG8at3
-U+Edmb3wLVckAiYIDHksnreowdJB4yR/05QDbgGYTrRhppEMuHmsN1geYfQmNa3b
-GAlSvv4H5YK4QrUUJZTcBXBFneMdZK67bohfbRkQIwSm5u0xLDUVoD3UhSz26Pu3
-b1anKvC576arrZ8pewyW2kp1
+MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDBYwQjUTxzptQQ
+JQl5bSSkK8bCA6wAnuzk3lOih0Szk463wSsPpDWPf/NgxsB3HP2ANUtGCdCcKxCm
+cCJMA8+nZuvJSTdGeYMYF8CaeBGRyQK1ifucZp9o0F+oK02cx36v/BzjhCEyn20I
+Z4LBcC6dBalox8/iUcZHQpRmRejo07KrLSws8w/T21Lk7GURnHWZej+dicukxZlE
+Z/fDiYwQC0z0JJaG/+3OQG1pgRqYD6Dn/lnB8DvMZfW+EV/zyjT292WgHr9NQ+Yb
+/99oPLUDL7QcEqQ0yETGTx2ijVlN8A3DM0gwlWD7TYXorc6bTQeDiG6vJk+I11Q2
+5TvoE0AtAgMBAAECggEBAJWdVGM6g0l6hVBkRxsxbIqy75fEnXrxeZdrxkrU2jsQ
+avcRNI5qXaHCvPlfayH8RMe+85ihGUrpKn2J/Y7P2ATMZJka0u/sLJckMTeQsw8V
+88mdkhMjdiryIz+JGQe1c/cVVwhSfhibLRC2fHvJndaPvcw54kRXPc593S/u4E3X
+uc5pyoPkiyon4AzQ3piVTRrdtQRyyT1UDJ+lRyTBLuWcM50H4O50VliIrk2HVxGA
+dfL8tnYOGnW7l12xCa6OoT03/qOBS1yPd8vXFAmnbEzbzvAEIDXC0GXQ5CPHOsFu
+ZnviDmjt2I/OSygBqnaxCuE0cMgIvI7zf2ie43Onu4UCgYEA0STl3mC80lSg8Ddo
+qGj+uPck3aOtUtI0ni94rM4YwgqDakm1aMDtVbivg3F9HLjDPxCe+iyQFOvjJ+uR
+KEdp5zFmS3Sf9lB0PymCbeAicRJA6ku+9GxbYk9VNWkxrNozDn4iolio41xjZSZ4
+iXHBh/s2xeZeGfW65/MOJMjvk/cCgYEA7LZh6ueBrBJkMf3imcmz7cfEkUyzioyM
+3Gz8JMNINPsb8QTYLaAog0m7eQ6FVZB0lIQV9V+pTzbhCxSbAryL7aOr7vKmFlgb
+tB5YqsdYHGftZAqwJzFNorAA2Yh5Z5H1+xAB3i4uB4lHwIC1Sl79vor7tccvGFPK
+hWX8Mz82+/sCgYAmI3NjpQJp3JLom0ITi+n/ctofLMzbkIeV3RRFduPe5qnmRQC2
+1I+zFRW0g4qMJUk9g9tpxZyUpBttWTDERpmSVljQI7lT4oIATqKBROEi+3ApCZ0N
+14Cmoc7pCYDMg5HR78CDGGXb6Cob9PMAJWVkVbQ8THEWjNADojgPDzFZKwKBgGGN
+tIL7z9wbZEGaEUYx8z4+gwsioieqTu8U10FLXbm/9z74MSN0it24iFOWoWqm8vS2
+DtqmBv/HbS2E23FgRQa12kjKpZo1y40KqJ4RM4XZauM86GXuksFGacM81FPTup0y
+dqKbQ4sFj5WNNamlxks9ugirQwRym9coNazlE4L7AoGBAMaeWaVaRbFu+jgscPud
+k5J27o9zH8CS+xngOYEjGFpdR/52ZMhpQOrtFJX0mCOi9vpAQ5Ro0kk1HMPH0mGU
+5b75OUy6SBfnYR7mw7imc85bP+lQoe8kmb+wrIJMYx9RGGbDatDFbxCEasqNzvFf
+VQXTnh0brizumpbOfHlZXced
 -----END PRIVATE KEY-----

build/deps/README.md

@@ -1,4 +1,4 @@
 # What's this?
 
 This directory is a workaround for the lack of support for Docker Compose in Dependabot.
-See <https://github.com/dependabot/dependabot-core/issues/390#issuecomment-1062170379>.
+See https://github.com/dependabot/dependabot-core/issues/390#issuecomment-1062170379.

build/deps/docusaurus-docs.Dockerfile

@@ -1 +1 @@
-FROM ghcr.io/ferretdb/docusaurus-docs:2.4.1-1
+FROM ghcr.io/ferretdb/docusaurus-docs:3.7.0-4

build/deps/ferretdb-prettier.Dockerfile

@@ -1 +1 @@
-FROM ghcr.io/ferretdb/ferretdb-prettier:2.8.8-1
+FROM ghcr.io/ferretdb/ferretdb-prettier:3.6.2-1

build/deps/ferretdb-textlint.Dockerfile

@@ -1 +1 @@
-FROM ghcr.io/ferretdb/ferretdb-textlint:13.3.2-4
+FROM ghcr.io/ferretdb/ferretdb-textlint:15.2.0-1

build/deps/ferretdb-wrangler.Dockerfile

@@ -1 +1 @@
-FROM ghcr.io/ferretdb/ferretdb-wrangler:3.0.1-1
+FROM ghcr.io/ferretdb/ferretdb-wrangler:4.24.0-1

build/deps/jaeger.Dockerfile

@@ -1 +1 @@
-FROM jaegertracing/all-in-one:1.45.0
+FROM jaegertracing/all-in-one:1.74.0

build/deps/legacy-mongo-shell.Dockerfile

@@ -1 +1,2 @@
-FROM ghcr.io/ferretdb/legacy-mongo-shell:6.0.5-1
+# TODO https://github.com/FerretDB/FerretDB/issues/5073
+FROM ghcr.io/ferretdb/legacy-mongo-shell:7.0.8-1

build/deps/markdownlint.Dockerfile

@@ -1,3 +1 @@
-FROM davidanson/markdownlint-cli2:v0.7.1
-
-ENTRYPOINT [ "markdownlint-cli2-config" ]
+FROM davidanson/markdownlint-cli2:v0.18.1

build/deps/mongo6.Dockerfile

@@ -1 +0,0 @@
-FROM mongo:6.0.5

build/deps/mongodb.Dockerfile

@@ -0,0 +1,16 @@
+# syntax=docker/dockerfile:1
+
+# TODO https://github.com/FerretDB/FerretDB/issues/5073
+FROM mongo:7.0.8
+
+# If you encounter an "unknown instruction" error there,
+# please update Docker to the latest version.
+
+# see https://github.com/docker-library/mongo/issues/475
+RUN <<EOF
+set -ex
+
+echo 'topsecret' > /etc/mongod_keyfile.txt
+chmod 0400 /etc/mongod_keyfile.txt
+chown 999:999 /etc/mongod_keyfile.txt
+EOF

build/deps/postgres-documentdb.Dockerfile

@@ -0,0 +1,5 @@
+# Use development image and full tag close to the release.
+FROM ghcr.io/ferretdb/postgres-documentdb-dev:17-0.107.0-ferretdb-2.7.0
+
+# Use moving development image during development.
+# FROM ghcr.io/ferretdb/postgres-documentdb-dev:17-ferretdb

build/deps/postgres.Dockerfile

@@ -1 +0,0 @@
-FROM postgres:15.3

build/deps/tigris.Dockerfile

@@ -1 +0,0 @@
-FROM tigrisdata/tigris-local:1.0.0-beta.51

build/deps/tigris_main.Dockerfile

@@ -1 +0,0 @@
-FROM tigrisdata/tigris-local:main

build/deps/trivy.Dockerfile

@@ -1,2 +1,2 @@
-FROM aquasec/trivy:0.41.0
+FROM aquasec/trivy:0.67.2
 WORKDIR /workdir

build/deps/ubi9.Dockerfile

@@ -1 +0,0 @@
-FROM redhat/ubi9-minimal:9.2

build/deps/ubuntu2204.Dockerfile

@@ -1 +0,0 @@
-FROM ubuntu:22.04

build/deps/yugabytedb.Dockerfile

@@ -0,0 +1 @@
+FROM yugabytedb/yugabyte:2025.1.1.0-b197

build/docker/all-in-one.Dockerfile

@@ -1,134 +0,0 @@
-# syntax=docker/dockerfile:1
-
-# for all-in-one releases (`all-in-one` image)
-
-# While we already know commit and version from commit.txt and version.txt inside image,
-# it is not possible to use them in LABELs for the final image.
-# We need to pass them as build arguments.
-# Defining ARGs there makes them global.
-ARG LABEL_VERSION
-ARG LABEL_COMMIT
-
-
-# build stage
-
-FROM ghcr.io/ferretdb/golang:1.20.4-1 AS all-in-one-build
-
-ARG LABEL_VERSION
-ARG LABEL_COMMIT
-RUN test -n "$LABEL_VERSION"
-RUN test -n "$LABEL_COMMIT"
-
-ARG TARGETARCH
-
-# see .dockerignore
-WORKDIR /src
-COPY . .
-
-# use a single directory for all Go caches to simpliy RUN --mount commands below
-ENV GOPATH /cache/gopath
-ENV GOCACHE /cache/gocache
-ENV GOMODCACHE /cache/gomodcache
-
-# copy cached stdlib builds from the image
-RUN --mount=type=cache,target=/cache \
-    rsync -a /root/.cache/go-build/ /cache/gocache
-
-# remove ",direct"
-ENV GOPROXY https://proxy.golang.org
-
-ENV CGO_ENABLED=1
-ENV GOCOVERDIR=cover
-ENV GORACE=halt_on_error=1,history_size=2
-ENV GOARM=7
-
-# do not raise it without providing a v1 build because v2+ is problematic
-# for some virtualization platforms and older hardware
-ENV GOAMD64=v1
-
-# TODO https://github.com/FerretDB/FerretDB/issues/2170
-# That command could be run only once by using a separate stage;
-# see https://www.docker.com/blog/faster-multi-platform-builds-dockerfile-cross-compilation-guide/
-RUN --mount=type=cache,target=/cache \
-    go mod download
-
-# Do not trim paths to make debugging with delve easier.
-#
-# Disable race detector on arm64 due to https://github.com/golang/go/issues/29948
-# (and that happens on GitHub-hosted Actions runners).
-RUN --mount=type=cache,target=/cache <<EOF
-set -ex
-
-git status
-
-RACE=false
-if test "$TARGETARCH" = "amd64"
-then
-    RACE=true
-fi
-
-# check that stdlib was cached
-go install -v -race=$RACE std
-
-go build -v                 -o=bin/ferretdb -race=$RACE -tags=ferretdb_testcover,ferretdb_tigris ./cmd/ferretdb
-go test  -c -coverpkg=./... -o=bin/ferretdb -race=$RACE -tags=ferretdb_testcover,ferretdb_tigris ./cmd/ferretdb
-
-go version -m bin/ferretdb
-bin/ferretdb --version
-EOF
-
-
-# final stage
-
-FROM postgres:15.3 AS all-in-one
-
-ARG LABEL_VERSION
-ARG LABEL_COMMIT
-
-COPY --from=all-in-one-build /src/bin/ferretdb /ferretdb
-
-# all-in-one hacks start there
-
-COPY --from=all-in-one-build /src/build/docker/all-in-one/ferretdb.sh /etc/service/ferretdb/run
-COPY --from=all-in-one-build /src/build/docker/all-in-one/postgresql.sh /etc/service/postgresql/run
-COPY --from=all-in-one-build /src/build/docker/all-in-one/entrypoint.sh /entrypoint.sh
-
-RUN <<EOF
-set -ex
-
-apt update
-apt install -y curl runit
-curl -L https://www.mongodb.org/static/pgp/server-6.0.asc | apt-key add -
-echo "deb [ arch=amd64,arm64 ] https://repo.mongodb.org/apt/debian bullseye/mongodb-org/6.0 main" | tee /etc/apt/sources.list.d/mongodb-org-6.0.list
-apt update
-apt install -y mongodb-mongosh
-EOF
-
-ENV FERRETDB_POSTGRESQL_URL=postgres://username:password@127.0.0.1:5432/ferretdb
-ENV POSTGRES_USER=username
-ENV POSTGRES_PASSWORD=password
-ENV POSTGRES_DB=ferretdb
-
-STOPSIGNAL SIGHUP
-
-WORKDIR /
-ENTRYPOINT [ "/entrypoint.sh" ]
-EXPOSE 27017
-
-# all-in-one hacks stop there
-
-# don't forget to update documentation if you change defaults
-ENV FERRETDB_LISTEN_ADDR=:27017
-# ENV FERRETDB_LISTEN_TLS=:27018
-ENV FERRETDB_DEBUG_ADDR=:8080
-ENV FERRETDB_STATE_DIR=/state
-
-# TODO https://github.com/FerretDB/FerretDB/issues/2212
-LABEL org.opencontainers.image.description="A truly Open Source MongoDB alternative"
-LABEL org.opencontainers.image.licenses="Apache-2.0"
-LABEL org.opencontainers.image.revision="${LABEL_COMMIT}"
-LABEL org.opencontainers.image.source="https://github.com/FerretDB/FerretDB"
-LABEL org.opencontainers.image.title="FerretDB"
-LABEL org.opencontainers.image.url="https://ferretdb.io/"
-LABEL org.opencontainers.image.vendor="FerretDB Inc."
-LABEL org.opencontainers.image.version="${LABEL_VERSION}"

build/docker/all-in-one/entrypoint.sh

@@ -1,5 +0,0 @@
-#!/bin/bash
-
-set -ex
-
-exec /usr/bin/runsvdir /etc/service

build/docker/all-in-one/ferretdb.sh

@@ -1,5 +0,0 @@
-#!/bin/bash
-
-set -ex
-
-exec /ferretdb

build/docker/all-in-one/postgresql.sh

@@ -1,5 +0,0 @@
-#!/bin/bash
-
-set -ex
-
-exec /usr/local/bin/docker-entrypoint.sh postgres

build/docker/development.Dockerfile

@@ -1,108 +0,0 @@
-# syntax=docker/dockerfile:1
-
-# for development releases (`ferret-dev` image)
-
-# While we already know commit and version from commit.txt and version.txt inside image,
-# it is not possible to use them in LABELs for the final image.
-# We need to pass them as build arguments.
-# Defining ARGs there makes them global.
-ARG LABEL_VERSION
-ARG LABEL_COMMIT
-
-
-# build stage
-
-FROM ghcr.io/ferretdb/golang:1.20.4-1 AS development-build
-
-ARG LABEL_VERSION
-ARG LABEL_COMMIT
-RUN test -n "$LABEL_VERSION"
-RUN test -n "$LABEL_COMMIT"
-
-ARG TARGETARCH
-
-# see .dockerignore
-WORKDIR /src
-COPY . .
-
-# use a single directory for all Go caches to simpliy RUN --mount commands below
-ENV GOPATH /cache/gopath
-ENV GOCACHE /cache/gocache
-ENV GOMODCACHE /cache/gomodcache
-
-# copy cached stdlib builds from the image
-RUN --mount=type=cache,target=/cache \
-    rsync -a /root/.cache/go-build/ /cache/gocache
-
-# remove ",direct"
-ENV GOPROXY https://proxy.golang.org
-
-ENV CGO_ENABLED=1
-ENV GOCOVERDIR=cover
-ENV GORACE=halt_on_error=1,history_size=2
-ENV GOARM=7
-
-# do not raise it without providing a v1 build because v2+ is problematic
-# for some virtualization platforms and older hardware
-ENV GOAMD64=v1
-
-# TODO https://github.com/FerretDB/FerretDB/issues/2170
-# That command could be run only once by using a separate stage;
-# see https://www.docker.com/blog/faster-multi-platform-builds-dockerfile-cross-compilation-guide/
-RUN --mount=type=cache,target=/cache \
-    go mod download
-
-# Do not trim paths to make debugging with delve easier.
-#
-# Disable race detector on arm64 due to https://github.com/golang/go/issues/29948
-# (and that happens on GitHub-hosted Actions runners).
-RUN --mount=type=cache,target=/cache <<EOF
-set -ex
-
-git status
-
-RACE=false
-if test "$TARGETARCH" = "amd64"
-then
-    RACE=true
-fi
-
-# check that stdlib was cached
-go install -v -race=$RACE std
-
-go build -v                 -o=bin/ferretdb -race=$RACE -tags=ferretdb_testcover,ferretdb_tigris ./cmd/ferretdb
-go test  -c -coverpkg=./... -o=bin/ferretdb -race=$RACE -tags=ferretdb_testcover,ferretdb_tigris ./cmd/ferretdb
-
-go version -m bin/ferretdb
-bin/ferretdb --version
-EOF
-
-
-# final stage
-
-FROM golang:1.20.4 AS development
-
-ARG LABEL_VERSION
-ARG LABEL_COMMIT
-
-COPY --from=development-build /src/bin/ferretdb /ferretdb
-
-WORKDIR /
-ENTRYPOINT [ "/ferretdb" ]
-EXPOSE 27017 27018 8080
-
-# don't forget to update documentation if you change defaults
-ENV FERRETDB_LISTEN_ADDR=:27017
-# ENV FERRETDB_LISTEN_TLS=:27018
-ENV FERRETDB_DEBUG_ADDR=:8080
-ENV FERRETDB_STATE_DIR=/state
-
-# TODO https://github.com/FerretDB/FerretDB/issues/2212
-LABEL org.opencontainers.image.description="A truly Open Source MongoDB alternative"
-LABEL org.opencontainers.image.licenses="Apache-2.0"
-LABEL org.opencontainers.image.revision="${LABEL_COMMIT}"
-LABEL org.opencontainers.image.source="https://github.com/FerretDB/FerretDB"
-LABEL org.opencontainers.image.title="FerretDB"
-LABEL org.opencontainers.image.url="https://ferretdb.io/"
-LABEL org.opencontainers.image.vendor="FerretDB Inc."
-LABEL org.opencontainers.image.version="${LABEL_VERSION}"

build/docker/production.Dockerfile

@@ -1,95 +0,0 @@
-# syntax=docker/dockerfile:1
-
-# for production releases (`ferret` image)
-
-# While we already know commit and version from commit.txt and version.txt inside image,
-# it is not possible to use them in LABELs for the final image.
-# We need to pass them as build arguments.
-# Defining ARGs there makes them global.
-ARG LABEL_VERSION
-ARG LABEL_COMMIT
-
-
-# build stage
-
-FROM ghcr.io/ferretdb/golang:1.20.4-1 AS production-build
-
-ARG LABEL_VERSION
-ARG LABEL_COMMIT
-RUN test -n "$LABEL_VERSION"
-RUN test -n "$LABEL_COMMIT"
-
-# see .dockerignore
-WORKDIR /src
-COPY . .
-
-# use a single directory for all Go caches to simpliy RUN --mount commands below
-ENV GOPATH /cache/gopath
-ENV GOCACHE /cache/gocache
-ENV GOMODCACHE /cache/gomodcache
-
-# copy cached stdlib builds from the image
-RUN --mount=type=cache,target=/cache \
-    rsync -a /root/.cache/go-build/ /cache/gocache
-
-# remove ",direct"
-ENV GOPROXY https://proxy.golang.org
-
-ENV CGO_ENABLED=0
-ENV GOARM=7
-
-# do not raise it without providing a v1 build because v2+ is problematic
-# for some virtualization platforms and older hardware
-ENV GOAMD64=v1
-
-# TODO https://github.com/FerretDB/FerretDB/issues/2170
-# That command could be run only once by using a separate stage;
-# see https://www.docker.com/blog/faster-multi-platform-builds-dockerfile-cross-compilation-guide/
-RUN --mount=type=cache,target=/cache \
-    go mod download
-
-RUN --mount=type=cache,target=/cache <<EOF
-set -ex
-
-git status
-
-# check that stdlib was cached
-go install -v -race=false std
-
-go build -v -o=bin/ferretdb -race=false -tags=ferretdb_tigris ./cmd/ferretdb
-
-go version -m bin/ferretdb
-bin/ferretdb --version
-EOF
-
-
-# final stage
-
-# TODO https://github.com/FerretDB/FerretDB/issues/2179
-# Consider a different base image after https://github.com/golang/go/issues/57792 is done.
-FROM gcr.io/distroless/static-debian11:debug AS production
-
-ARG LABEL_VERSION
-ARG LABEL_COMMIT
-
-COPY --from=production-build /src/bin/ferretdb /ferretdb
-
-WORKDIR /
-ENTRYPOINT [ "/ferretdb" ]
-EXPOSE 27017 27018 8080
-
-# don't forget to update documentation if you change defaults
-ENV FERRETDB_LISTEN_ADDR=:27017
-# ENV FERRETDB_LISTEN_TLS=:27018
-ENV FERRETDB_DEBUG_ADDR=:8080
-ENV FERRETDB_STATE_DIR=/state
-
-# TODO https://github.com/FerretDB/FerretDB/issues/2212
-LABEL org.opencontainers.image.description="A truly Open Source MongoDB alternative"
-LABEL org.opencontainers.image.licenses="Apache-2.0"
-LABEL org.opencontainers.image.revision="${LABEL_COMMIT}"
-LABEL org.opencontainers.image.source="https://github.com/FerretDB/FerretDB"
-LABEL org.opencontainers.image.title="FerretDB"
-LABEL org.opencontainers.image.url="https://ferretdb.io/"
-LABEL org.opencontainers.image.vendor="FerretDB Inc."
-LABEL org.opencontainers.image.version="${LABEL_VERSION}"

build/ferretdb-bw/Dockerfile

@@ -0,0 +1,27 @@
+# Use production image and full tag close to the release.
+FROM --platform=linux/amd64 ghcr.io/ferretdb/postgres-documentdb:17-0.107.0-ferretdb-2.7.0
+
+# Use moving development image during development.
+# FROM --platform=linux/amd64 ghcr.io/ferretdb/postgres-documentdb-dev:17-ferretdb
+
+RUN --mount=type=cache,target=/var/cache/apt <<EOF
+
+curl -s https://packagecloud.io/install/repositories/github/git-lfs/script.deb.sh | bash
+
+curl -L https://pgp.mongodb.com/server-7.0.asc | apt-key add -
+echo "deb [ arch=amd64,arm64 ] https://repo.mongodb.org/apt/debian bookworm/mongodb-org/7.0 main" | tee /etc/apt/sources.list.d/mongodb-org-7.0.list
+
+apt update
+apt install -y git-lfs mongodb-mongosh tmux nano
+
+cd /tmp
+curl -OJL https://go.dev/dl/go1.25.4.linux-amd64.tar.gz
+tar -xf go1.25.4.linux-amd64.tar.gz
+rm go1.25.4.linux-amd64.tar.gz
+mv go /usr/local/
+ln -s /usr/local/go/bin/* /usr/local/bin/
+go version
+
+EOF
+
+WORKDIR /ferretdb/build/ferretdb-bw

build/ferretdb-bw/Makefile

@@ -0,0 +1,26 @@
+all: ferretdb_loader ferretdb
+
+ferretdb_loader:
+	$(MAKE) -C $@
+
+ferretdb:
+	$(MAKE) -C $@
+
+clean:
+	$(MAKE) -C ferretdb_loader clean
+	$(MAKE) -C ferretdb clean
+
+install:
+	$(MAKE) -C ferretdb_loader install
+	$(MAKE) -C ferretdb install
+
+docker:
+	docker buildx build --builder=ferretdb --tag=ferretdb-bw --load .
+	docker run --platform=linux/amd64 --name=ferretdb-bw --rm -it \
+		-e POSTGRES_USER=username -e POSTGRES_PASSWORD=password -e POSTGRES_DB=postgres \
+		-v $(shell pwd)/../..:/ferretdb ferretdb-bw /bin/bash
+
+docker-exec:
+	docker exec -it ferretdb-bw /bin/bash
+
+.PHONY: all ferretdb_loader ferretdb

build/ferretdb-bw/README.md

@@ -0,0 +1,4 @@
+# FerretDB as a PostgreSQL background worker
+
+Not supported.
+Do not use yet.

build/ferretdb-bw/ferretdb/Makefile

@@ -0,0 +1,21 @@
+GO ?= $(shell which go)
+PG_CONFIG ?= pg_config
+PG_INCLUDE := $(shell $(PG_CONFIG) --includedir-server)
+PG_PKGLIB := $(shell $(PG_CONFIG) --pkglibdir)
+INSTALL_BIN = $(shell which install)
+
+CGO_CFLAGS ?= "-I$(PG_INCLUDE) -Wno-implicit-function-declaration"
+CGO_LDFLAGS ?= "-shared"
+
+object = ferretdb.so
+
+all: $(object)
+
+$(object): ferretdb.go
+	CGO_CFLAGS=$(CGO_CFLAGS) CGO_LDFLAGS=$(CGO_LDFLAGS) $(GO) build -v -tags=ferretdb_bw -buildmode=c-shared -o $@ .
+
+install: $(object)
+	$(INSTALL_BIN) -c -m 755 $(object) $(PG_PKGLIB)
+
+clean:
+	rm -f $(object)

build/ferretdb-bw/ferretdb/ferretdb.go

@@ -0,0 +1,77 @@
+// Copyright 2021 FerretDB Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//go:build ferretdb_bw
+
+package main
+
+/*
+#include "postgres.h"
+*/
+import "C"
+
+import (
+	"context"
+	"log"
+	"log/slog"
+	"os"
+
+	"github.com/FerretDB/FerretDB/v2/build/version"
+	"github.com/FerretDB/FerretDB/v2/ferretdb"
+	"github.com/FerretDB/FerretDB/v2/internal/util/ctxutil"
+)
+
+//export BackgroundWorkerMain
+func BackgroundWorkerMain(args C.Datum) {
+	log.SetPrefix("ferretdb: ")
+	log.SetFlags(0)
+
+	ctx, stop := ctxutil.SigTerm(context.Background())
+	defer stop()
+
+	f, err := ferretdb.New(&ferretdb.Config{
+		// TODO https://github.com/FerretDB/FerretDB/issues/4771
+		PostgreSQLURL: "postgres://username:password@127.0.0.1:5432/postgres",
+		ListenAddr:    "127.0.0.1:27017",
+		StateDir:      ".",
+		LogLevel:      slog.LevelDebug,
+		LogOutput:     os.Stderr,
+	})
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	version.Get().Package = "extension"
+
+	done := make(chan struct{})
+
+	// Use WaitLatch, ResetLatch, and WL_POSTMASTER_DEATH to check if `postmaster` process died and call stop().
+	// TODO https://github.com/FerretDB/FerretDB/issues/4771
+
+	go func() {
+		f.Run(ctx)
+		close(done)
+	}()
+
+	uri := f.MongoDBURI()
+	log.Printf("Running at %s", uri)
+
+	<-done
+
+	return
+}
+
+func main() {
+	panic("not reached")
+}

build/ferretdb-bw/ferretdb/ferretdb.h

@@ -0,0 +1,86 @@
+/* Code generated by cmd/cgo; DO NOT EDIT. */
+
+/* package github.com/FerretDB/FerretDB/v2/build/ferretdb-bw/ferretdb */
+
+
+#line 1 "cgo-builtin-export-prolog"
+
+#include <stddef.h>
+
+#ifndef GO_CGO_EXPORT_PROLOGUE_H
+#define GO_CGO_EXPORT_PROLOGUE_H
+
+#ifndef GO_CGO_GOSTRING_TYPEDEF
+typedef struct { const char *p; ptrdiff_t n; } _GoString_;
+#endif
+
+#endif
+
+/* Start of preamble from import "C" comments.  */
+
+
+#line 3 "ferretdb.go"
+
+#include "postgres.h"
+
+#line 1 "cgo-generated-wrapper"
+
+
+/* End of preamble from import "C" comments.  */
+
+
+/* Start of boilerplate cgo prologue.  */
+#line 1 "cgo-gcc-export-header-prolog"
+
+#ifndef GO_CGO_PROLOGUE_H
+#define GO_CGO_PROLOGUE_H
+
+typedef signed char GoInt8;
+typedef unsigned char GoUint8;
+typedef short GoInt16;
+typedef unsigned short GoUint16;
+typedef int GoInt32;
+typedef unsigned int GoUint32;
+typedef long long GoInt64;
+typedef unsigned long long GoUint64;
+typedef GoInt64 GoInt;
+typedef GoUint64 GoUint;
+typedef size_t GoUintptr;
+typedef float GoFloat32;
+typedef double GoFloat64;
+#ifdef _MSC_VER
+#include <complex.h>
+typedef _Fcomplex GoComplex64;
+typedef _Dcomplex GoComplex128;
+#else
+typedef float _Complex GoComplex64;
+typedef double _Complex GoComplex128;
+#endif
+
+/*
+  static assertion to make sure the file is being used on architecture
+  at least with matching size of GoInt.
+*/
+typedef char _check_for_64_bit_pointer_matching_GoInt[sizeof(void*)==64/8 ? 1:-1];
+
+#ifndef GO_CGO_GOSTRING_TYPEDEF
+typedef _GoString_ GoString;
+#endif
+typedef void *GoMap;
+typedef void *GoChan;
+typedef struct { void *t; void *v; } GoInterface;
+typedef struct { void *data; GoInt len; GoInt cap; } GoSlice;
+
+#endif
+
+/* End of boilerplate cgo prologue.  */
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+extern void BackgroundWorkerMain(Datum args);
+
+#ifdef __cplusplus
+}
+#endif

build/ferretdb-bw/ferretdb_loader/Makefile

@@ -0,0 +1,4 @@
+MODULES = ferretdb_loader
+PG_CONFIG ?= pg_config
+PGXS := $(shell $(PG_CONFIG) --pgxs)
+include $(PGXS)

build/ferretdb-bw/ferretdb_loader/ferretdb_loader.c

@@ -0,0 +1,53 @@
+#include <dlfcn.h>
+#include "postgres.h"
+#include "pgstat.h"
+#include "postmaster/bgworker.h"
+#include "storage/ipc.h"
+#include "storage/latch.h"
+#include "storage/proc.h"
+#include "miscadmin.h"
+#include "utils/elog.h"
+#include "fmgr.h"
+
+PG_MODULE_MAGIC;
+
+static char *ferretdb_so = "ferretdb.so";
+
+PGDLLEXPORT void background_main(Datum main_arg);
+
+void background_main(Datum main_arg)
+{
+    bgworker_main_type f;
+    char *path;
+    void *h;
+
+    BackgroundWorkerUnblockSignals();
+
+    path = (char *)palloc(strlen(pkglib_path) + 1 + strlen(ferretdb_so) + 1);
+    join_path_components(path, pkglib_path, ferretdb_so);
+    elog(LOG, "ferretdb_loader: loading '%s'", path);
+
+    h = dlopen(path, RTLD_NOW | RTLD_GLOBAL);
+    pfree(path);
+
+    f = (bgworker_main_type)dlsym(h, "BackgroundWorkerMain");
+    f(main_arg);
+
+    dlclose(h);
+    proc_exit(0);
+}
+
+void _PG_init(void)
+{
+    BackgroundWorker worker;
+    MemSet(&worker, 0, sizeof(BackgroundWorker));
+
+    snprintf(worker.bgw_name, BGW_MAXLEN, "FerretDBLoader");
+    worker.bgw_flags = BGWORKER_SHMEM_ACCESS;
+    worker.bgw_start_time = BgWorkerStart_RecoveryFinished;
+    worker.bgw_restart_time = BGW_NEVER_RESTART;
+    snprintf(worker.bgw_library_name, BGW_MAXLEN, "ferretdb_loader");
+    snprintf(worker.bgw_function_name, BGW_MAXLEN, "background_main");
+
+    RegisterBackgroundWorker(&worker);
+}

build/ferretdb.service

@@ -0,0 +1,17 @@
+[Unit]
+Description=FerretDB Database
+Documentation=https://docs.ferretdb.io/
+Wants=network-online.target
+After=network-online.target
+
+[Service]
+ExecStart=/usr/bin/ferretdb
+Restart=on-failure
+
+# Configure the FerretDB service with `systemctl edit ferretdb`.
+# For more configuration options check https://docs.ferretdb.io/configuration/flags/
+
+Environment="FERRETDB_POSTGRESQL_URL=postgres://127.0.0.1:5432/postgres"
+
+[Install]
+WantedBy=multi-user.target

build/ferretdb/development.Dockerfile

@@ -0,0 +1,143 @@
+# syntax=docker/dockerfile:1
+
+# for development releases (`ferretdb-dev` image)
+
+# While we already know commit and version from commit.txt and version.txt inside image,
+# it is not possible to use them in LABELs for the final image.
+# We need to pass them as build arguments.
+# Defining ARGs there makes them global.
+ARG LABEL_VERSION
+ARG LABEL_COMMIT
+
+
+# prepare stage
+
+# TODO https://github.com/FerretDB/FerretDB/issues/5449
+FROM --platform=$BUILDPLATFORM golang:1.25.4-bookworm AS development-prepare
+
+# use a single directory for all Go caches to simplify RUN --mount commands below
+ENV GOPATH=/cache/gopath
+ENV GOCACHE=/cache/gocache
+ENV GOMODCACHE=/cache/gomodcache
+
+# remove ",direct"
+ENV GOPROXY=https://proxy.golang.org
+
+COPY go.mod go.sum /src/
+
+WORKDIR /src
+
+RUN --mount=type=cache,target=/cache <<EOF
+set -ex
+
+go mod download
+go mod verify
+EOF
+
+
+# build stage
+
+# TODO https://github.com/FerretDB/FerretDB/issues/5449
+FROM golang:1.25.4-bookworm AS development-build
+
+ARG TARGETARCH
+
+ARG LABEL_VERSION
+ARG LABEL_COMMIT
+RUN test -n "$LABEL_VERSION"
+RUN test -n "$LABEL_COMMIT"
+
+# use the same directories for Go caches as above
+ENV GOPATH=/cache/gopath
+ENV GOCACHE=/cache/gocache
+ENV GOMODCACHE=/cache/gomodcache
+
+# modules are already downloaded
+ENV GOPROXY=off
+
+# see .dockerignore
+WORKDIR /src
+COPY . .
+
+# to add a dependency
+COPY --from=development-prepare /src/go.mod /src/go.sum /src/
+
+RUN --mount=type=cache,target=/cache <<EOF
+set -ex
+
+git status
+
+# Do not raise without providing separate builds with those values
+# because higher versions are problematic for some virtualization platforms and older hardware.
+export GOAMD64=v1
+export GOARM64=v8.0
+
+export CGO_ENABLED=1
+
+# Disable race detector on arm64 due to https://github.com/golang/go/issues/29948
+# (and that happens on GitHub-hosted Actions runners).
+RACE=false
+if test "$TARGETARCH" = "amd64"
+then
+    RACE=true
+fi
+
+go env
+
+# Do not trim paths to make debugging with delve easier.
+
+# check if stdlib was cached
+go install -v -race=$RACE std
+
+go build -v -o=bin/ferretdb -race=$RACE -tags=ferretdb_dev -coverpkg=./... ./cmd/ferretdb
+
+go version -m bin/ferretdb
+bin/ferretdb --version
+EOF
+
+
+# stage for binary only
+
+FROM scratch AS development-binary
+
+COPY --from=development-build /src/bin/ferretdb /ferretdb
+
+
+# final stage
+
+# TODO https://github.com/FerretDB/FerretDB/issues/5449
+FROM golang:1.25.4-bookworm AS development
+
+ENV GOCOVERDIR=/tmp/cover
+ENV GORACE=halt_on_error=1,history_size=2
+
+RUN mkdir /tmp/cover
+
+COPY --from=development-build /src/bin/ferretdb /ferretdb
+
+ENTRYPOINT [ "/ferretdb" ]
+
+HEALTHCHECK --interval=1m --timeout=5s --retries=1 --start-period=30s --start-interval=5s \
+  CMD ["/ferretdb", "ping"]
+
+WORKDIR /
+VOLUME /state
+EXPOSE 27017 27018 8088
+
+# don't forget to update documentation if you change defaults
+ENV FERRETDB_LISTEN_ADDR=:27017
+# ENV FERRETDB_LISTEN_TLS=:27018
+ENV FERRETDB_DEBUG_ADDR=:8088
+ENV FERRETDB_STATE_DIR=/state
+
+ARG LABEL_VERSION
+ARG LABEL_COMMIT
+
+# TODO https://github.com/FerretDB/FerretDB/issues/2212
+LABEL org.opencontainers.image.description="A truly Open Source MongoDB alternative (development image)"
+LABEL org.opencontainers.image.revision="${LABEL_COMMIT}"
+LABEL org.opencontainers.image.source="https://github.com/FerretDB/FerretDB"
+LABEL org.opencontainers.image.title="FerretDB (development image)"
+LABEL org.opencontainers.image.url="https://www.ferretdb.com/"
+LABEL org.opencontainers.image.vendor="FerretDB Inc."
+LABEL org.opencontainers.image.version="${LABEL_VERSION}"

build/ferretdb/eval-dev.Dockerfile

@@ -0,0 +1,149 @@
+# syntax=docker/dockerfile:1
+
+# evaluation image with development release (`ferretdb-eval-dev` image)
+
+# While we already know commit and version from commit.txt and version.txt inside image,
+# it is not possible to use them in LABELs for the final image.
+# We need to pass them as build arguments.
+# Defining ARGs there makes them global.
+ARG LABEL_VERSION
+ARG LABEL_COMMIT
+
+
+# prepare stage
+
+# TODO https://github.com/FerretDB/FerretDB/issues/5449
+FROM --platform=$BUILDPLATFORM golang:1.25.4-bookworm AS eval-dev-prepare
+
+# use a single directory for all Go caches to simplify RUN --mount commands below
+ENV GOPATH=/cache/gopath
+ENV GOCACHE=/cache/gocache
+ENV GOMODCACHE=/cache/gomodcache
+
+# remove ",direct"
+ENV GOPROXY=https://proxy.golang.org
+
+COPY go.mod go.sum /src/
+
+WORKDIR /src
+
+RUN --mount=type=cache,target=/cache <<EOF
+set -ex
+
+go mod download
+go mod verify
+EOF
+
+
+# build stage
+
+# TODO https://github.com/FerretDB/FerretDB/issues/5449
+FROM golang:1.25.4-bookworm AS eval-dev-build
+
+ARG TARGETARCH
+
+ARG LABEL_VERSION
+ARG LABEL_COMMIT
+RUN test -n "$LABEL_VERSION"
+RUN test -n "$LABEL_COMMIT"
+
+# use the same directories for Go caches as above
+ENV GOPATH=/cache/gopath
+ENV GOCACHE=/cache/gocache
+ENV GOMODCACHE=/cache/gomodcache
+
+# modules are already downloaded
+ENV GOPROXY=off
+
+# see .dockerignore
+WORKDIR /src
+COPY . .
+
+# to add a dependency
+COPY --from=eval-dev-prepare /src/go.mod /src/go.sum /src/
+
+RUN --mount=type=cache,target=/cache <<EOF
+set -ex
+
+git status
+
+# Do not raise without providing separate builds with those values
+# because higher versions are problematic for some virtualization platforms and older hardware.
+export GOAMD64=v1
+export GOARM64=v8.0
+
+export CGO_ENABLED=1
+
+# Disable race detector on arm64 due to https://github.com/golang/go/issues/29948
+# (and that happens on GitHub-hosted Actions runners).
+RACE=false
+if test "$TARGETARCH" = "amd64"
+then
+    RACE=true
+fi
+
+go env
+
+# Do not trim paths to make debugging with delve easier.
+
+# check if stdlib was cached
+go install -v -race=$RACE std
+
+go build -v -o=bin/ferretdb -race=$RACE -tags=ferretdb_dev -coverpkg=./... ./cmd/ferretdb
+
+go version -m bin/ferretdb
+bin/ferretdb --version
+EOF
+
+
+# final stage
+
+# Use development image and full tag close to the release.
+FROM ghcr.io/ferretdb/postgres-documentdb-dev:17-0.107.0-ferretdb-2.7.0 AS eval-dev
+
+# Use moving development image during development.
+# FROM ghcr.io/ferretdb/postgres-documentdb-dev:17-ferretdb AS eval-dev
+
+RUN --mount=type=cache,sharing=locked,target=/var/cache/apt <<EOF
+apt install -y curl supervisor
+curl -L https://pgp.mongodb.com/server-7.0.asc | apt-key add -
+echo "deb [ arch=amd64,arm64 ] https://repo.mongodb.org/apt/debian bookworm/mongodb-org/7.0 main" | tee /etc/apt/sources.list.d/mongodb-org-7.0.list
+apt update
+apt install -y mongodb-mongosh
+
+mkdir /tmp/cover
+EOF
+
+COPY --from=eval-dev-build /src/bin/ferretdb /usr/local/bin/ferretdb
+
+COPY --from=eval-dev-build /src/build/ferretdb/evaluation/supervisord.conf /etc/supervisor/conf.d/supervisord.conf
+COPY --from=eval-dev-build /src/build/ferretdb/evaluation/entrypoint.sh /usr/local/bin/entrypoint.sh
+
+ENTRYPOINT ["entrypoint.sh"]
+
+HEALTHCHECK --interval=1m --timeout=5s --retries=1 --start-period=30s --start-interval=5s \
+  CMD ["/usr/local/bin/ferretdb", "ping"]
+
+VOLUME /state
+EXPOSE 27017 27018 8088
+
+ENV GOCOVERDIR=/tmp/cover
+ENV GORACE=halt_on_error=1,history_size=2
+
+# don't forget to update documentation if you change defaults
+ENV FERRETDB_LISTEN_ADDR=:27017
+# ENV FERRETDB_LISTEN_TLS=:27018
+ENV FERRETDB_DEBUG_ADDR=:8088
+ENV FERRETDB_STATE_DIR=/state
+
+ARG LABEL_VERSION
+ARG LABEL_COMMIT
+
+# TODO https://github.com/FerretDB/FerretDB/issues/2212
+LABEL org.opencontainers.image.description="A truly Open Source MongoDB alternative (evaluation development image)"
+LABEL org.opencontainers.image.revision="${LABEL_COMMIT}"
+LABEL org.opencontainers.image.source="https://github.com/FerretDB/FerretDB"
+LABEL org.opencontainers.image.title="FerretDB (evaluation development image)"
+LABEL org.opencontainers.image.url="https://www.ferretdb.com/"
+LABEL org.opencontainers.image.vendor="FerretDB Inc."
+LABEL org.opencontainers.image.version="${LABEL_VERSION}"

build/ferretdb/eval.Dockerfile

@@ -0,0 +1,136 @@
+# syntax=docker/dockerfile:1
+
+# evaluation image (formerly "all-in-one") with production release (`ferretdb-eval` image)
+
+# While we already know commit and version from commit.txt and version.txt inside image,
+# it is not possible to use them in LABELs for the final image.
+# We need to pass them as build arguments.
+# Defining ARGs there makes them global.
+ARG LABEL_VERSION
+ARG LABEL_COMMIT
+
+
+# prepare stage
+
+# TODO https://github.com/FerretDB/FerretDB/issues/5449
+FROM --platform=$BUILDPLATFORM golang:1.25.4-bookworm AS eval-prepare
+
+# use a single directory for all Go caches to simplify RUN --mount commands below
+ENV GOPATH=/cache/gopath
+ENV GOCACHE=/cache/gocache
+ENV GOMODCACHE=/cache/gomodcache
+
+# remove ",direct"
+ENV GOPROXY=https://proxy.golang.org
+
+COPY go.mod go.sum /src/
+
+WORKDIR /src
+
+RUN --mount=type=cache,target=/cache <<EOF
+set -ex
+
+go mod download
+go mod verify
+EOF
+
+
+# build stage
+
+# TODO https://github.com/FerretDB/FerretDB/issues/5449
+FROM golang:1.25.4-bookworm AS eval-build
+
+ARG TARGETARCH
+
+ARG LABEL_VERSION
+ARG LABEL_COMMIT
+RUN test -n "$LABEL_VERSION"
+RUN test -n "$LABEL_COMMIT"
+
+# use the same directories for Go caches as above
+ENV GOPATH=/cache/gopath
+ENV GOCACHE=/cache/gocache
+ENV GOMODCACHE=/cache/gomodcache
+
+# modules are already downloaded
+ENV GOPROXY=off
+
+# see .dockerignore
+WORKDIR /src
+COPY . .
+
+# to add a dependency
+COPY --from=eval-prepare /src/go.mod /src/go.sum /src/
+
+RUN --mount=type=cache,target=/cache <<EOF
+set -ex
+
+git status
+
+# Do not raise without providing separate builds with those values
+# because higher versions are problematic for some virtualization platforms and older hardware.
+export GOAMD64=v1
+export GOARM64=v8.0
+
+export CGO_ENABLED=0
+
+go env
+
+# Trim paths mostly to check that building with `-trimpath` is supported.
+
+# check if stdlib was cached
+go install -v -trimpath std
+
+go build -v -trimpath -o=bin/ferretdb ./cmd/ferretdb
+
+go version -m bin/ferretdb
+bin/ferretdb --version
+EOF
+
+
+# final stage
+
+# Use production image and full tag close to the release.
+FROM ghcr.io/ferretdb/postgres-documentdb:17-0.107.0-ferretdb-2.7.0 AS eval
+
+# Use moving development image during development.
+# FROM ghcr.io/ferretdb/postgres-documentdb-dev:17-ferretdb AS eval
+
+RUN --mount=type=cache,sharing=locked,target=/var/cache/apt <<EOF
+apt install -y curl supervisor
+curl -L https://pgp.mongodb.com/server-7.0.asc | apt-key add -
+echo "deb [ arch=amd64,arm64 ] https://repo.mongodb.org/apt/debian bookworm/mongodb-org/7.0 main" | tee /etc/apt/sources.list.d/mongodb-org-7.0.list
+apt update
+apt install -y mongodb-mongosh
+EOF
+
+COPY --from=eval-build /src/bin/ferretdb /usr/local/bin/ferretdb
+
+COPY --from=eval-build /src/build/ferretdb/evaluation/supervisord.conf /etc/supervisor/conf.d/supervisord.conf
+COPY --from=eval-build /src/build/ferretdb/evaluation/entrypoint.sh /usr/local/bin/entrypoint.sh
+
+ENTRYPOINT ["entrypoint.sh"]
+
+HEALTHCHECK --interval=1m --timeout=5s --retries=1 --start-period=30s --start-interval=5s \
+  CMD ["/usr/local/bin/ferretdb", "ping"]
+
+VOLUME /state
+EXPOSE 27017 27018 8088
+
+# don't forget to update documentation if you change defaults
+ENV FERRETDB_LISTEN_ADDR=:27017
+# ENV FERRETDB_LISTEN_TLS=:27018
+ENV FERRETDB_DEBUG_ADDR=:8088
+ENV FERRETDB_STATE_DIR=/state
+
+ARG LABEL_VERSION
+ARG LABEL_COMMIT
+
+# TODO https://github.com/FerretDB/FerretDB/issues/2212
+LABEL org.opencontainers.image.description="A truly Open Source MongoDB alternative (evaluation image)"
+LABEL org.opencontainers.image.revision="${LABEL_COMMIT}"
+LABEL org.opencontainers.image.source="https://github.com/FerretDB/FerretDB"
+LABEL org.opencontainers.image.title="FerretDB (evaluation image)"
+LABEL org.opencontainers.image.url="https://www.ferretdb.com/"
+LABEL org.opencontainers.image.vendor="FerretDB Inc."
+LABEL org.opencontainers.image.version="${LABEL_VERSION}"

build/ferretdb/evaluation/entrypoint.sh

@@ -0,0 +1,20 @@
+#!/bin/bash
+
+set -e
+
+if [ -z "$POSTGRES_PASSWORD" ]; then
+    echo "Error: POSTGRES_PASSWORD must be set. See https://docs.ferretdb.io/installation/evaluation/"
+    exit 1
+fi
+
+if [ "${POSTGRES_DB:-postgres}" != "postgres" ]; then
+    echo "Error: POSTGRES_DB must be set to 'postgres' or unset. See https://docs.ferretdb.io/installation/evaluation/"
+    exit 1
+fi
+
+# prevent unset POSTGRES_DB using the value of POSTGRES_USER, see https://hub.docker.com/_/postgres
+export POSTGRES_DB="postgres"
+
+export FERRETDB_POSTGRESQL_URL="postgresql://${POSTGRES_USER:-postgres}:${POSTGRES_PASSWORD}@127.0.0.1:5432/${POSTGRES_DB}"
+
+exec /usr/bin/supervisord -c /etc/supervisor/conf.d/supervisord.conf

build/ferretdb/evaluation/supervisord.conf

@@ -0,0 +1,24 @@
+; https://supervisord.org/configuration.html#supervisord-section-values
+[supervisord]
+nodaemon=true
+loglevel=info
+logfile=/dev/stderr
+logfile_maxbytes=0
+
+; https://supervisord.org/configuration.html#program-x-section-values
+[program:postgres]
+command=/usr/local/bin/docker-entrypoint.sh postgres
+; lower priority postgres starts before ferretdb (default priority 999)
+priority=1
+; fast shutdown https://www.postgresql.org/docs/current/server-shutdown.html
+stopsignal=INT
+stdout_logfile=/dev/stderr
+stdout_logfile_maxbytes=0
+redirect_stderr=true
+
+; https://supervisord.org/configuration.html#program-x-section-values
+[program:ferretdb]
+command=/usr/local/bin/ferretdb
+stdout_logfile=/dev/stderr
+stdout_logfile_maxbytes=0
+redirect_stderr=true

build/ferretdb/group

@@ -0,0 +1 @@
+ferretdb:x:1000:

build/ferretdb/passwd

@@ -0,0 +1 @@
+ferretdb:x:1000:1000::/nonexistent:/nonexistent

build/ferretdb/production.Dockerfile

@@ -0,0 +1,135 @@
+# syntax=docker/dockerfile:1
+
+# for production releases (`ferretdb` image)
+
+# While we already know commit and version from commit.txt and version.txt inside image,
+# it is not possible to use them in LABELs for the final image.
+# We need to pass them as build arguments.
+# Defining ARGs there makes them global.
+ARG LABEL_VERSION
+ARG LABEL_COMMIT
+
+
+# prepare stage
+
+# TODO https://github.com/FerretDB/FerretDB/issues/5449
+FROM --platform=$BUILDPLATFORM golang:1.25.4-bookworm AS production-prepare
+
+# use a single directory for all Go caches to simplify RUN --mount commands below
+ENV GOPATH=/cache/gopath
+ENV GOCACHE=/cache/gocache
+ENV GOMODCACHE=/cache/gomodcache
+
+# remove ",direct"
+ENV GOPROXY=https://proxy.golang.org
+
+COPY go.mod go.sum /src/
+
+WORKDIR /src
+
+RUN --mount=type=cache,target=/cache <<EOF
+set -ex
+
+go mod download
+go mod verify
+EOF
+
+
+# build stage
+
+# TODO https://github.com/FerretDB/FerretDB/issues/5449
+FROM golang:1.25.4-bookworm AS production-build
+
+ARG TARGETARCH
+
+ARG LABEL_VERSION
+ARG LABEL_COMMIT
+RUN test -n "$LABEL_VERSION"
+RUN test -n "$LABEL_COMMIT"
+
+# use the same directories for Go caches as above
+ENV GOPATH=/cache/gopath
+ENV GOCACHE=/cache/gocache
+ENV GOMODCACHE=/cache/gomodcache
+
+# modules are already downloaded
+ENV GOPROXY=off
+
+# see .dockerignore
+WORKDIR /src
+COPY . .
+
+# to add a dependency
+COPY --from=production-prepare /src/go.mod /src/go.sum /src/
+
+RUN --mount=type=cache,target=/cache <<EOF
+set -ex
+
+git status
+
+# Do not raise without providing separate builds with those values
+# because higher versions are problematic for some virtualization platforms and older hardware.
+export GOAMD64=v1
+export GOARM64=v8.0
+
+export CGO_ENABLED=0
+
+go env
+
+# Trim paths mostly to check that building with `-trimpath` is supported.
+
+# check if stdlib was cached
+go install -v -trimpath std
+
+go build -v -trimpath -o=bin/ferretdb ./cmd/ferretdb
+
+go version -m bin/ferretdb
+bin/ferretdb --version
+
+mkdir /state
+EOF
+
+# stage for binary only
+
+FROM scratch AS production-binary
+
+COPY --from=production-build /src/bin/ferretdb /ferretdb
+
+
+# final stage
+
+FROM scratch AS production
+
+COPY build/ferretdb/passwd /etc/passwd
+COPY build/ferretdb/group  /etc/group
+USER ferretdb:ferretdb
+
+COPY --from=production-build /src/bin/ferretdb /ferretdb
+COPY --from=production-build --chown=ferretdb:ferretdb /state /state
+
+ENTRYPOINT [ "/ferretdb" ]
+
+HEALTHCHECK --interval=1m --timeout=5s --retries=1 --start-period=30s --start-interval=5s \
+  CMD ["/ferretdb", "ping"]
+
+WORKDIR /
+VOLUME /state
+EXPOSE 27017 27018 8088
+
+# don't forget to update documentation if you change defaults
+ENV FERRETDB_LISTEN_ADDR=:27017
+# ENV FERRETDB_LISTEN_TLS=:27018
+ENV FERRETDB_DEBUG_ADDR=:8088
+ENV FERRETDB_STATE_DIR=/state
+
+ARG LABEL_VERSION
+ARG LABEL_COMMIT
+
+# TODO https://github.com/FerretDB/FerretDB/issues/2212
+LABEL org.opencontainers.image.description="A truly Open Source MongoDB alternative"
+LABEL org.opencontainers.image.revision="${LABEL_COMMIT}"
+LABEL org.opencontainers.image.source="https://github.com/FerretDB/FerretDB"
+LABEL org.opencontainers.image.title="FerretDB"
+LABEL org.opencontainers.image.url="https://www.ferretdb.com/"
+LABEL org.opencontainers.image.vendor="FerretDB Inc."
+LABEL org.opencontainers.image.version="${LABEL_VERSION}"

build/legacy-mongo-shell/test.example.js

@@ -1,28 +0,0 @@
-// Copy to test.js and run with `task testjs`.
-
-(function() {
-  'use strict';
-
-  const coll = db.test;
-
-  coll.drop();
-
-  const init = [
-    {_id: 'double', v: 42.13},
-    {_id: 'double-whole', v: 42.0},
-    {_id: 'double-zero', v: 0.0},
-  ];
-
-  coll.insertMany(init);
-
-  const query = {v: {$gt: 42.0}};
-
-  const expected = [
-    {_id: 'double', v: 42.13},
-  ];
-
-  const actual = coll.find(query).toArray();
-  assert.eq(expected, actual);
-
-  print('test.js passed!');
-})();

build/legacy-mongo-shell/test.js

@@ -1,7 +1,28 @@
 // Please do not merge changes in this file.
 
-(function() {
-  'use strict';
+(function () {
+  "use strict";
 
-  print('test.js passed!');
+  // Update the following example with your test.
+
+  const coll = db.test;
+
+  coll.drop();
+
+  const init = [
+    { _id: "double", v: 42.13 },
+    { _id: "double-whole", v: 42.0 },
+    { _id: "double-zero", v: 0.0 },
+  ];
+
+  coll.insertMany(init);
+
+  const query = { v: { $gt: 42.0 } };
+
+  const expected = [{ _id: "double", v: 42.13 }];
+
+  const actual = coll.find(query).toArray();
+  assert.eq(expected, actual);
+
+  print("test.js passed!");
 })();

build/mcphost.json

@@ -0,0 +1,8 @@
+{
+  "mcpServers": {
+    "FerretDB": {
+      "type": "remote",
+      "url": "http://127.0.0.1:8081/mcp"
+    }
+  }
+}

build/mongod.conf

@@ -1,5 +0,0 @@
-net:
-  port: 27017
-  bindIpAll: true
-  tls:
-    mode: disabled