Bump org.mongodb:mongodb-driver-reactivestreams from 5.9.1 to 5.10.0

[dependabot]

Bumps org.mongodb:mongodb-driver-reactivestreams from 5.9.1 to 5.10.0.

Release notes

Sourced from org.mongodb:mongodb-driver-reactivestreams's releases.

Java Driver 5.10.0 (August 14, 2026)

What's Changed

• Added $scoreFusion hybrid search stage for combining and normalizing the scores of multiple search pipelines (MongoDB 8.2+) #2024 by @​nhachicha
• Added a fluent builder API for the $score aggregation stage, with normalization, weighting, and score details (MongoDB 8.2+) #2023 by @​strogiyotec
• Added $vectorSearch support for nested embeddings and arrays of embeddings via parentFilter and nestedOptions #2026 by @​rozza
• Removed stale @Beta from SearchOptions and VectorSearchOptions in the Java and Scala drivers #2026 by @​rozza
• Encoded Kotlin ByteArray data class fields as BSON Binary, and added an opt-in ByteArray BSON Binary serializer for bson-kotlinx #2019 by @​rozza
• Included the fix for CVE-2026-18710 / JAVA-6266, where ProxySettings.toString() rendered the SOCKS5 proxy username and password into application logs. First shipped in 5.9.2 #2035 by @​strogiyotec
• ByteArray fields in Kotlin data classes are once again encoded as BSON Binary rather than a BSON array of int32, restoring the behavior from before 5.1.3. Decoding accepts both forms, so documents written by 5.1.3–5.9.x still read back correctly, but newly written documents change BSON type. Review any non-driver consumers of those fields before upgrading. See JAVA-6224

Verifying artifact signatures

Please refer to https://www.mongodb.com/docs/drivers/java/sync/current/security/validate-signatures/ for the full procedure.

To download and import the public key for verifying signatures, execute

gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys 1a75005e142192223d6a7c3b76e0008d166740a8

Full Changelog: mongodb/mongo-java-driver@r5.9.0...r5.10.0

Java Driver 5.9.2 (August 11, 2026)

What's Changed

[!WARNING] Starting from driver version 4.11.0, ProxySettings.toString() included the SOCKS5 proxy username and password in application logs.

See JAVA-6266 / CVE-2026-18710

The username and password are no longer included in toString() starting in this release.

If you cannot upgrade, set the org.mongodb.driver.client logger to WARN or higher to suppress the client-construction message. We do not recommend this as a long-term measure: it silences diagnostic information that is valuable for support, and it does not remove credentials already written to existing logs.

Full Changelog: mongodb/mongo-java-driver@r5.9.1...r5.9.2

Commits

• 6acf4b6 Version: bump 5.10.0
• 09aa019 Merge commit from fork (#2035)
• d751950 Evergreen CI windows fixes
• 533b2b6 Ensure Kotlin can encode ByteArrays efficiently (#2019)
• 94863fa Support $vectorSearch against nested embeddings and arrays of embeddings (#2026)
• 1b958ae JAVA-5990 Hybrid Search Score Fusion (#2024)
• dd814f8 JAVA-6146 Move detail out of the root AGENTS.md into references
• d87d93a Fluent API for $score (#2023)
• 0956b9f Resolve forwarded type arguments across POJO hierarchy edges (#2014)
• cab37d0 Improve readability of NettyStreamCloseFutureListenerTest
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)