chore(deps): Bump mongo-java-driver-version from 5.9.1 to 5.10.0

[dependabot]

Bumps mongo-java-driver-version from 5.9.1 to 5.10.0.
Updates org.mongodb:mongodb-driver-core from 5.9.1 to 5.10.0

Release notes

Sourced from org.mongodb:mongodb-driver-core's releases.

Java Driver 5.10.0 (August 14, 2026)

What's Changed

• Added $scoreFusion hybrid search stage for combining and normalizing the scores of multiple search pipelines (MongoDB 8.2+) #2024 by @​nhachicha
• Added a fluent builder API for the $score aggregation stage, with normalization, weighting, and score details (MongoDB 8.2+) #2023 by @​strogiyotec
• Added $vectorSearch support for nested embeddings and arrays of embeddings via parentFilter and nestedOptions #2026 by @​rozza
• Removed stale @Beta from SearchOptions and VectorSearchOptions in the Java and Scala drivers #2026 by @​rozza
• Encoded Kotlin ByteArray data class fields as BSON Binary, and added an opt-in ByteArray BSON Binary serializer for bson-kotlinx #2019 by @​rozza
• Included the fix for CVE-2026-18710 / JAVA-6266, where ProxySettings.toString() rendered the SOCKS5 proxy username and password into application logs. First shipped in 5.9.2 #2035 by @​strogiyotec
• ByteArray fields in Kotlin data classes are once again encoded as BSON Binary rather than a BSON array of int32, restoring the behavior from before 5.1.3. Decoding accepts both forms, so documents written by 5.1.3–5.9.x still read back correctly, but newly written documents change BSON type. Review any non-driver consumers of those fields before upgrading. See JAVA-6224

Verifying artifact signatures

Please refer to https://www.mongodb.com/docs/drivers/java/sync/current/security/validate-signatures/ for the full procedure.

To download and import the public key for verifying signatures, execute

gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys 1a75005e142192223d6a7c3b76e0008d166740a8

Full Changelog: mongodb/mongo-java-driver@r5.9.0...r5.10.0

Java Driver 5.9.2 (August 11, 2026)

What's Changed

[!WARNING] Starting from driver version 4.11.0, ProxySettings.toString() included the SOCKS5 proxy username and password in application logs.

See JAVA-6266 / CVE-2026-18710

The username and password are no longer included in toString() starting in this release.

If you cannot upgrade, set the org.mongodb.driver.client logger to WARN or higher to suppress the client-construction message. We do not recommend this as a long-term measure: it silences diagnostic information that is valuable for support, and it does not remove credentials already written to existing logs.

Full Changelog: mongodb/mongo-java-driver@r5.9.1...r5.9.2

Commits

• 6acf4b6 Version: bump 5.10.0
• 09aa019 Merge commit from fork (#2035)
• d751950 Evergreen CI windows fixes
• 533b2b6 Ensure Kotlin can encode ByteArrays efficiently (#2019)
• 94863fa Support $vectorSearch against nested embeddings and arrays of embeddings (#2026)
• 1b958ae JAVA-5990 Hybrid Search Score Fusion (#2024)
• dd814f8 JAVA-6146 Move detail out of the root AGENTS.md into references
• d87d93a Fluent API for $score (#2023)
• 0956b9f Resolve forwarded type arguments across POJO hierarchy edges (#2014)
• cab37d0 Improve readability of NettyStreamCloseFutureListenerTest
• Additional commits viewable in compare view

Updates org.mongodb:mongodb-driver-sync from 5.9.1 to 5.10.0

Release notes

Sourced from org.mongodb:mongodb-driver-sync's releases.

Java Driver 5.10.0 (August 14, 2026)

What's Changed

• Added $scoreFusion hybrid search stage for combining and normalizing the scores of multiple search pipelines (MongoDB 8.2+) #2024 by @​nhachicha
• Added a fluent builder API for the $score aggregation stage, with normalization, weighting, and score details (MongoDB 8.2+) #2023 by @​strogiyotec
• Added $vectorSearch support for nested embeddings and arrays of embeddings via parentFilter and nestedOptions #2026 by @​rozza
• Removed stale @Beta from SearchOptions and VectorSearchOptions in the Java and Scala drivers #2026 by @​rozza
• Encoded Kotlin ByteArray data class fields as BSON Binary, and added an opt-in ByteArray BSON Binary serializer for bson-kotlinx #2019 by @​rozza
• Included the fix for CVE-2026-18710 / JAVA-6266, where ProxySettings.toString() rendered the SOCKS5 proxy username and password into application logs. First shipped in 5.9.2 #2035 by @​strogiyotec
• ByteArray fields in Kotlin data classes are once again encoded as BSON Binary rather than a BSON array of int32, restoring the behavior from before 5.1.3. Decoding accepts both forms, so documents written by 5.1.3–5.9.x still read back correctly, but newly written documents change BSON type. Review any non-driver consumers of those fields before upgrading. See JAVA-6224

Verifying artifact signatures

Please refer to https://www.mongodb.com/docs/drivers/java/sync/current/security/validate-signatures/ for the full procedure.

To download and import the public key for verifying signatures, execute

gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys 1a75005e142192223d6a7c3b76e0008d166740a8

Full Changelog: mongodb/mongo-java-driver@r5.9.0...r5.10.0

Java Driver 5.9.2 (August 11, 2026)

What's Changed

[!WARNING] Starting from driver version 4.11.0, ProxySettings.toString() included the SOCKS5 proxy username and password in application logs.

See JAVA-6266 / CVE-2026-18710

The username and password are no longer included in toString() starting in this release.

If you cannot upgrade, set the org.mongodb.driver.client logger to WARN or higher to suppress the client-construction message. We do not recommend this as a long-term measure: it silences diagnostic information that is valuable for support, and it does not remove credentials already written to existing logs.

Full Changelog: mongodb/mongo-java-driver@r5.9.1...r5.9.2

Commits

• 6acf4b6 Version: bump 5.10.0
• 09aa019 Merge commit from fork (#2035)
• d751950 Evergreen CI windows fixes
• 533b2b6 Ensure Kotlin can encode ByteArrays efficiently (#2019)
• 94863fa Support $vectorSearch against nested embeddings and arrays of embeddings (#2026)
• 1b958ae JAVA-5990 Hybrid Search Score Fusion (#2024)
• dd814f8 JAVA-6146 Move detail out of the root AGENTS.md into references
• d87d93a Fluent API for $score (#2023)
• 0956b9f Resolve forwarded type arguments across POJO hierarchy edges (#2014)
• cab37d0 Improve readability of NettyStreamCloseFutureListenerTest
• Additional commits viewable in compare view

Updates org.mongodb:bson from 5.9.1 to 5.10.0

Release notes

Sourced from org.mongodb:bson's releases.

Java Driver 5.10.0 (August 14, 2026)

What's Changed

• Added $scoreFusion hybrid search stage for combining and normalizing the scores of multiple search pipelines (MongoDB 8.2+) #2024 by @​nhachicha
• Added a fluent builder API for the $score aggregation stage, with normalization, weighting, and score details (MongoDB 8.2+) #2023 by @​strogiyotec
• Added $vectorSearch support for nested embeddings and arrays of embeddings via parentFilter and nestedOptions #2026 by @​rozza
• Removed stale @Beta from SearchOptions and VectorSearchOptions in the Java and Scala drivers #2026 by @​rozza
• Encoded Kotlin ByteArray data class fields as BSON Binary, and added an opt-in ByteArray BSON Binary serializer for bson-kotlinx #2019 by @​rozza
• Included the fix for CVE-2026-18710 / JAVA-6266, where ProxySettings.toString() rendered the SOCKS5 proxy username and password into application logs. First shipped in 5.9.2 #2035 by @​strogiyotec
• ByteArray fields in Kotlin data classes are once again encoded as BSON Binary rather than a BSON array of int32, restoring the behavior from before 5.1.3. Decoding accepts both forms, so documents written by 5.1.3–5.9.x still read back correctly, but newly written documents change BSON type. Review any non-driver consumers of those fields before upgrading. See JAVA-6224

Verifying artifact signatures

Please refer to https://www.mongodb.com/docs/drivers/java/sync/current/security/validate-signatures/ for the full procedure.

To download and import the public key for verifying signatures, execute

gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys 1a75005e142192223d6a7c3b76e0008d166740a8

Full Changelog: mongodb/mongo-java-driver@r5.9.0...r5.10.0

Java Driver 5.9.2 (August 11, 2026)

What's Changed

[!WARNING] Starting from driver version 4.11.0, ProxySettings.toString() included the SOCKS5 proxy username and password in application logs.

See JAVA-6266 / CVE-2026-18710

The username and password are no longer included in toString() starting in this release.

If you cannot upgrade, set the org.mongodb.driver.client logger to WARN or higher to suppress the client-construction message. We do not recommend this as a long-term measure: it silences diagnostic information that is valuable for support, and it does not remove credentials already written to existing logs.

Full Changelog: mongodb/mongo-java-driver@r5.9.1...r5.9.2

Commits

• 6acf4b6 Version: bump 5.10.0
• 09aa019 Merge commit from fork (#2035)
• d751950 Evergreen CI windows fixes
• 533b2b6 Ensure Kotlin can encode ByteArrays efficiently (#2019)
• 94863fa Support $vectorSearch against nested embeddings and arrays of embeddings (#2026)
• 1b958ae JAVA-5990 Hybrid Search Score Fusion (#2024)
• dd814f8 JAVA-6146 Move detail out of the root AGENTS.md into references
• d87d93a Fluent API for $score (#2023)
• 0956b9f Resolve forwarded type arguments across POJO hierarchy edges (#2014)
• cab37d0 Improve readability of NettyStreamCloseFutureListenerTest
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

🌟 Thank you for your contribution to the Apache Camel project! 🌟
🤖 CI automation will test this PR automatically.

🐫 Apache Camel Committers, please review the following items:

• First-time contributors require MANUAL approval for the GitHub Actions to run
• You can use the command /component-test (camel-)component-name1 (camel-)component-name2.. to request a test from the test bot although they are normally detected and executed by CI.
• You can label PRs using skip-tests and test-dependents to fine-tune the checks executed by this PR.
• Build and test logs are available in the summary page. Only Apache Camel committers have access to the summary.

⚠️ Be careful when sharing logs. Review their contents before sharing them publicly.

[github-actions]

🧪 CI tested the following changed modules:

• parent

✅ POM dependency changes: targeted tests included

Changed properties: mongo-java-driver-version

Modules affected by dependency changes (2)

• :camel-mongodb-gridfs
• :camel-mongodb

---

🔬 Scalpel shadow comparison — Scalpel: 10 tested, 29 compile-only — current: 0 all tested

Maveniverse Scalpel detected 39 affected modules (current approach: 0).

⚠️ Modules only in Scalpel (39)

• apache-camel
• camel-allcomponents
• camel-catalog
• camel-catalog-console
• camel-catalog-lucene
• camel-catalog-maven
• camel-catalog-suggest
• camel-componentdsl
• camel-csimple-maven-plugin
• camel-endpointdsl
• camel-endpointdsl-support
• camel-itest
• camel-jbang-core
• camel-jbang-it
• camel-jbang-main
• camel-jbang-mcp
• camel-jbang-plugin-edit
• camel-jbang-plugin-generate
• camel-jbang-plugin-kubernetes
• camel-jbang-plugin-mcp
• camel-jbang-plugin-route-parser
• camel-jbang-plugin-test
• camel-jbang-plugin-tui
• camel-jbang-plugin-validate
• camel-kamelet-main
• camel-launcher
• camel-launcher-container
• camel-mongodb
• camel-mongodb-gridfs
• camel-report-maven-plugin
• camel-route-parser
• camel-yaml-dsl
• camel-yaml-dsl-deserializers
• camel-yaml-dsl-maven-plugin
• camel-yaml-dsl-validator
• camel-yaml-dsl-validator-maven-plugin
• coverage
• docs
• dummy-component

Changed properties: mongo-java-driver-version

Skip-tests mode would test 10 modules (2 direct + 8 downstream), skip tests for 29 (generated code, meta-modules)

Modules Scalpel would test (10)

• camel-jbang-mcp
• camel-jbang-plugin-mcp
• camel-jbang-plugin-route-parser
• camel-jbang-plugin-tui
• camel-jbang-plugin-validate
• camel-launcher-container
• camel-mongodb
• camel-mongodb-gridfs
• camel-yaml-dsl-validator
• camel-yaml-dsl-validator-maven-plugin

Modules with tests skipped (29)

• apache-camel
• camel-allcomponents
• camel-catalog
• camel-catalog-console
• camel-catalog-lucene
• camel-catalog-maven
• camel-catalog-suggest
• camel-componentdsl
• camel-csimple-maven-plugin
• camel-endpointdsl
• camel-endpointdsl-support
• camel-itest
• camel-jbang-core
• camel-jbang-it
• camel-jbang-main
• camel-jbang-plugin-edit
• camel-jbang-plugin-generate
• camel-jbang-plugin-kubernetes
• camel-jbang-plugin-test
• camel-kamelet-main
• camel-launcher
• camel-report-maven-plugin
• camel-route-parser
• camel-yaml-dsl
• camel-yaml-dsl-deserializers
• camel-yaml-dsl-maven-plugin
• coverage
• docs
• dummy-component

ℹ️ Shadow mode — Scalpel observes but does not affect test execution. Learn more

All tested modules (40 modules)

• Camel :: All Components Sync point
• Camel :: Assembly
• Camel :: Catalog :: CSimple Maven Plugin (deprecated)
• Camel :: Catalog :: Camel Catalog
• Camel :: Catalog :: Camel Report Maven Plugin
• Camel :: Catalog :: Camel Route Parser
• Camel :: Catalog :: Console
• Camel :: Catalog :: Dummy Component
• Camel :: Catalog :: Lucene (deprecated)
• Camel :: Catalog :: Maven
• Camel :: Catalog :: Suggest
• Camel :: Component DSL
• Camel :: Coverage
• Camel :: Docs
• Camel :: Endpoint DSL
• Camel :: Endpoint DSL :: Support
• Camel :: Integration Tests
• Camel :: JBang :: Core
• Camel :: JBang :: Integration tests
• Camel :: JBang :: MCP
• Camel :: JBang :: Main
• Camel :: JBang :: Plugin :: Edit
• Camel :: JBang :: Plugin :: Generate
• Camel :: JBang :: Plugin :: Kubernetes
• Camel :: JBang :: Plugin :: MCP
• Camel :: JBang :: Plugin :: Route Parser
• Camel :: JBang :: Plugin :: TUI
• Camel :: JBang :: Plugin :: Testing
• Camel :: JBang :: Plugin :: Validate
• Camel :: Kamelet Main
• Camel :: Launcher
• Camel :: Launcher :: Container
• Camel :: MongoDB
• Camel :: MongoDB GridFS
• Camel :: Parent
• Camel :: YAML DSL
• Camel :: YAML DSL :: Deserializers
• Camel :: YAML DSL :: Maven Plugins
• Camel :: YAML DSL :: Validator
• Camel :: YAML DSL :: Validator Maven Plugin

---

⚙️ View full build and test results