What's Changed

• JAVA-6231 build(deps): bump testing/resources/specifications from d4d0cdf to 92b3c0b by @dependabot[bot] in #2039
• JAVA-6284 add server 9.0 test variant to evergreen by @strogiyotec in #2037
• Fix the failing :driver-sync:codenarcTest command by @strogiyotec in #2059
• Client Backpressure by @stIncMale, @vbabanin, @nhachicha, @strogiyotec in #1918

Full Changelog: r5.11.0...r5.12.0

Intelligent Workload Management (IWM)

Added support for MongoDB 9.0's Intelligent Workload Management (IWM). The driver now gracefully handles write-blocking scenarios and optimizes connection establishment during high-load conditions to maintain application availability.

Verifying artifact signatures

Please refer to https://www.mongodb.com/docs/languages/java/mongodb-hibernate/upcoming/security/validate-signatures/ for the full procedure.

To download and import the public key for verifying signatures, execute

gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys 1a75005e142192223d6a7c3b76e0008d166740a8

What's Changed

See JAVA-6283 / CVE-2026-88033]

Upgrade reactive/sync driver version to 5.11.1 or later.

If you cannot upgrade, applications using older driver versions should call another delete overload delete(ObjectId). The driver constructs the BsonObjectId internally from a typed value, so no document can reach the filter.

See JAVA-6266 / CVE-2026-88032

Upgrade both reactive driver and mongodb-crypt to version 5.11.1 or later.

Full Changelog: r5.11.0...r5.11.1

What's Changed

• Java 6173 CSFLE/QE Support for HTTP Proxies by @strogiyotec in #2043

CSFLE/QE Http proxies notes

• The driver always negotiates TLS with the KMS host itself, using the SSLContext configured for
  the KMS provider. Implementations must not negotiate TLS with the KMS host; doing so would let an
  intermediary read the key material in transit.
• An implementation may use TLS for its own connection to the intermediary, in which case it returns
  an SSLSocket and the driver layers the KMS host's TLS session on top of it.
• Ownership of the returned socket passes to the driver, which closes it when the KMS request
  completes. A socket that is never returned must be closed by the implementation.
• Applicable only to the synchronous driver. The reactive streams driver rejects(RuntimeException) a configured
  callback.

Code example

Code example uses only the JDK API , so no HTTP client dependency is required. If you use your own HTTP client, it must return the tunnelled socket without negotiating TLS with the KMS host

First define the callback

private static final String PROXY_HOST = "proxy.example.com";
private static final int PROXY_PORT = 8080;
private static final int TIMEOUT_MILLIS = 10_000;

// Routes every KMS request through an HTTP proxy using the HTTP CONNECT method
// refer to the docs https://www.rfc-editor.org/info/rfc9110/#section-9.3.6
KmsConnectCallback proxyCallback = context -> {
    Socket socket = new Socket();
    try {
        // 1. Connect to the proxy, not to the KMS host.
        socket.connect(new InetSocketAddress(PROXY_HOST, PROXY_PORT), TIMEOUT_MILLIS);
        socket.setSoTimeout(TIMEOUT_MILLIS);

        // 2. Ask the proxy to open a tunnel to the KMS host the driver wants to reach. Only the
        //    driver knows which host that is, so always take it from the context rather than
        //    hard-coding it.
        String target = context.getHost() + ":" + context.getPort();
        String connectRequest = "CONNECT " + target + " HTTP/1.1\r\n"
                + "Host: " + target + "\r\n"
                // If the proxy requires authentication, add the appropriate header, for example:
                // + "Proxy-Authorization: Basic " + base64("user:password") + "\r\n"
                + "\r\n";
        socket.getOutputStream().write(connectRequest.getBytes(StandardCharsets.US_ASCII));

        // 3. Check the proxy accepted the tunnel before handing the socket back.
        checkProxyAcceptedTunnel(socket.getInputStream());
    } catch (IOException | RuntimeException e) {
        // The driver never received this socket, so it cannot close it for you.
        socket.close();
        throw e;
    }

    // 4. Return the tunnelled socket. The driver now performs its own TLS handshake with the KMS
    //    host over it, verifying the KMS host's certificate. Do not negotiate TLS with the KMS
    //    host yourself.
    return socket;
};

// Reads the proxy's response to CONNECT and fails unless it is 2xx.
static void checkProxyAcceptedTunnel(InputStream in) throws IOException {
    StringBuilder response = new StringBuilder();
    int b;
    while (response.indexOf("\r\n\r\n") < 0 && (b = in.read()) != -1) {
        response.append((char) b);
    }
    String statusLine = response.toString().split("\r\n", 2)[0];
    if (!statusLine.startsWith("HTTP/1.1 2") && !statusLine.startsWith("HTTP/1.0 2")) {
        throw new IOException("Proxy refused the CONNECT request: " + statusLine);
    }
}

Then use this callback to configure the ClientEncryption

ClientEncryptionSettings settings = ClientEncryptionSettings.builder()
        .keyVaultMongoClientSettings(keyVaultClientSettings)
        .keyVaultNamespace("keyvault.datakeys")
        .kmsProviders(kmsProviders)
        .kmsConnectCallback(proxyCallback)
        .build();

Or using automatic encryption

AutoEncryptionSettings settings = AutoEncryptionSettings.builder()
        .keyVaultNamespace("keyvault.datakeys")
        .kmsProviders(kmsProviders)
        .kmsConnectCallback(proxyCallback)
        .build();

Full Changelog: r5.10.0...r5.11.0

What's Changed

• Added $scoreFusion hybrid search stage for combining and normalizing the scores of multiple search pipelines (MongoDB 8.2+) #2024 by @nhachicha
• Added a fluent builder API for the $score aggregation stage, with normalization, weighting, and score details (MongoDB 8.2+) #2023 by @strogiyotec
• Added $vectorSearch support for nested embeddings and arrays of embeddings via parentFilter and nestedOptions #2026 by @rozza
• Removed stale @Beta from SearchOptions and VectorSearchOptions in the Java and Scala drivers #2026 by @rozza
• Encoded Kotlin ByteArray data class fields as BSON Binary, and added an opt-in ByteArray BSON Binary serializer for bson-kotlinx #2019 by @rozza
• Included the fix for CVE-2026-18710 / JAVA-6266, where ProxySettings.toString() rendered the SOCKS5 proxy username and password into application logs. First shipped in 5.9.2 #2035 by @strogiyotec
• ByteArray fields in Kotlin data classes are once again encoded as BSON Binary rather than a BSON array of int32, restoring the behavior from before 5.1.3. Decoding accepts both forms, so documents written by 5.1.3–5.9.x still read back correctly, but newly written documents change BSON type. Review any non-driver consumers of those fields before upgrading. See JAVA-6224

Verifying artifact signatures

Please refer to https://www.mongodb.com/docs/drivers/java/sync/current/security/validate-signatures/ for the full procedure.

To download and import the public key for verifying signatures, execute

gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys 1a75005e142192223d6a7c3b76e0008d166740a8

Full Changelog: r5.9.0...r5.10.0

What's Changed

See JAVA-6266 / CVE-2026-18710

The username and password are no longer included in toString() starting in this release.

If you cannot upgrade, set the org.mongodb.driver.client logger to WARN or higher to suppress the client-construction message. We do not recommend this as a long-term measure: it silences diagnostic information that is valuable for support, and it does not remove credentials already written to existing logs.

Full Changelog: r5.9.1...r5.9.2

What's Changed

• Backport: Resolve forwarded type arguments across POJO hierarchy edges by @vbabanin in #2020

Verifying artifact signatures

Please refer to https://www.mongodb.com/docs/drivers/java/sync/current/security/validate-signatures/ for the full procedure.

To download and import the public key for verifying signatures, execute

gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys 1a75005e142192223d6a7c3b76e0008d166740a8

Full Changelog: r5.9.0...r5.9.1

What's Changed

• build(deps): bump testing/resources/specifications from b519824 to 25bee54 by @dependabot[bot] in #1984
• Evergreen: fixes - gpg and oidc by @rozza in #1987
• JAVA-6182 Update the Git submodule from 25bee54 to 4484038 by @stIncMale in #1992
• Add Windows CI testing by @vbabanin in #1935
• Update Specs to latest by @rozza in #2001
• Fix reactive streams MongoClient.getTimeout always returning null by @stIncMale in #2009
• JAVA-6237: Explicit Encryption Case 2 uses contention-10 collection by @rozza in #2003
• JAVA-6168 JAVA-6244 JAVA-6196: QE prefix/suffix/substring GA + rename Text API to String by @nhachicha in #2010

Verifying artifact signatures

Please refer to https://www.mongodb.com/docs/drivers/java/sync/current/security/validate-signatures/ for the full procedure.

To download and import the public key for verifying signatures, execute

gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys 1a75005e142192223d6a7c3b76e0008d166740a8

Full Changelog: r5.8.0...r5.9.0

What's Changed

• Fix reactive streams MongoClient.getTimeout always returning null by @stIncMale in #2011

Verifying artifact signatures

Please refer to https://www.mongodb.com/docs/drivers/java/sync/current/security/validate-signatures/ for the full procedure.

To download and import the public key for verifying signatures, execute

gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys 1a75005e142192223d6a7c3b76e0008d166740a8

Full Changelog: r5.8.0...r5.8.1

What's Changed

🔥 Enhancements

• Added typed builder API for vector search index definitions #1960 by @rozza
• Added $rerank aggregation stage support (MongoDB 8.3 / Atlas) #1963 by @rozza
• Added vectorSearch operator support for the $search pipeline stage #1962 by @rozza
• Added storedSource support for vector search indexes and returnStoredSource for $vectorSearch queries #1977 by @rozza
• Added BinaryVector and VectorSearchQuery vectorSearch overloads to the Scala driver #1986 by @rozza
• Optimized RawBsonDocument encode and decode by eliminating intermediate allocations #1988 by @rozza
• Preliminary refactoring for backpressure support #1952 by @stIncMale
• Small improvements related to value-based classes #1964 by @stIncMale

🛠 Fixes

• Fixed OSGi bundle resolution failure when Micrometer is not present #1982 by @rozza
• Added missing Javadoc to MongodbObservation and MongodbObservationContext by @rozza

📦 Dependency Updates

• Upgraded libmongocrypt to 1.18.1 #1983 by @strogiyotec

🧪 Testing & CI

• Added AGENTS.md for AI coding agent support across all modules by @rozza
• Added test cases for new auto-embedding index fields #1936 by @strogiyotec
• Added Scala 3 to publish.sh #1958 by @rozza
• Fixed NamespaceExists test failure #1956 by @nhachicha
• Simplified RetryState creation as preliminary backpressure work #1961 by @stIncMale
• Made RetryState.isLastAttempt private and simplified code #1967 by @stIncMale

New Contributors

• @techbelle made their first contribution in #1972

Verifying artifact signatures

Please refer to https://www.mongodb.com/docs/drivers/java/sync/current/security/validate-signatures/ for the full procedure.

To download and import the public key for verifying signatures, execute

gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys 1a75005e142192223d6a7c3b76e0008d166740a8

Full Changelog: r5.7.0...r5.8.0

What's Changed

• JAVA-6189 - Added Scala 3 to publish.sh by @rozza in #1957
• JAVA-6197 - Fix javadoc warnings in micrometer 5.7 by @rozza in #1966
• JAVA-6215 - Mark micrometer OSGi imports as optional and add bundle resolution test by @rozza in #1985

Full Changelog: r5.7.0...r5.7.1

What's Changed

• Added Scala 3 support by @rozza in #1904
• Do various small timeout-related improvements by @stIncMale in #1908
• Add TODO-JAVA-6126 to inform readers that the problem is known by @stIncMale in #1910
• Fix ServerMonitor thread name JAVA-6135 by @raipc in #1861
• Revert "Temp disable large encryption tests on mongocryptd (#1872)" by @rozza in #1914
• build(deps): bump testing/resources/specifications from bb9dddd to 0535e65 by @dependabot[bot] in #1915
• Remove unused OperationContextBinding test wrappers by @vbabanin in #1903
• Add Javadoc to specify that CSOT does not limit socket writes by @vbabanin in #1791
• Update Junit 5 to latest by @rozza in #1909
• JAVA-6144 increase wait time for thread pool shutdown by @strogiyotec in #1920
• JAVA-6145 fix encryption test case by @strogiyotec in #1923
• JAVA-6148 increase timeout in RetryableWritesProseTest by @strogiyotec in #1927
• Use ZstdInputStreamNoFinalizer for Zstd decompression by @rozza in #1924
• Release connection between empty getMore responses in AsyncCommandCursor by @vbabanin in #1925
• build(deps): bump testing/resources/specifications from 0535e65 to c3c82b6 by @dependabot[bot] in #1930
• Fix com.mongodb.client.FailPoint.enable by @stIncMale in #1931
• Add stack-safe async loop support with trampoline pattern by @vbabanin in #1905
• JsonBsonEncoder: fix parsing of JsonPrimitive numbers by @berlix in #1937
• build(deps): bump testing/resources/specifications from c3c82b6 to 7039e69 by @dependabot[bot] in #1945
• JAVA-6171 upgrade libcrypt to 1.17.3 by @strogiyotec in #1947
• Fix Kotlin bson decoding of optionals by @rozza in #1941
• [JAVA-6159] Micrometer feedback by @nhachicha in #1940
• [JAVA-6186] Micrometer tests expect the network transport to be tcp by @nhachicha in #1955
• Skip QE prefixPreview and suffixPreview tests on server 9.0.0+ by @rozza in #1954

New Contributors

• @raipc made their first contribution in #1861
• @berlix made their first contribution in #1937

Verifying artifact signatures

Please refer to https://www.mongodb.com/docs/drivers/java/sync/current/security/validate-signatures/ for the full procedure.

To download and import the public key for verifying signatures, execute

gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys 1a75005e142192223d6a7c3b76e0008d166740a8

Full Changelog: r5.7.0-beta1...r5.7.0

What's Changed

🔥 Enhancements

• Add Micrometer/OpenTelemetry tracing support to the reactive-streams
  (Micrometer / OpenTelemetry) #1898

• Improved client-side timeout handling to better account for RTT variations #1793

🛠 Fixes

• Fixed RawBsonDocument encoding performance regression by restoring optimized codec path #1888

• Fixed Netty ByteBuf reference counting and reverted read-only change that could cause leaks during logging #1891

📦 Dependency Updates

• Updated Netty to latest version #1867

• Updated Snappy for latest security fixes #1868

🧪 Testing & CI

• Updated BSON/spec tests and improved Extended JSON alignment #1883

• Added SARIF reporting and CI improvements #1869

• Temporarily disabled large encryption tests on mongocryptd for CI stability #1872

Verifying artifact signatures

Please refer to https://www.mongodb.com/docs/drivers/java/sync/v5.4/security/validate-signatures/ for the full procedure.

To download and import the public key for verifying signatures, execute

gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys 1a75005e142192223d6a7c3b76e0008d166740a8

Full Changelog: r5.7.0-beta0...r5.7.0-beta1

What's Changed

🛠 Fixes

• AsyncCommandCursor.getMoreLoop() held a pool connection across empty getMore responses on tailable cursors, exhausting the connection pool when idle change streams reached maxPoolSize and causing MongoTimeoutException for all other operations. The retry loop has been moved out of getMoreLoop() and into next().

Verifying artifact signatures

Please refer to https://www.mongodb.com/docs/drivers/java/sync/v5.4/security/validate-signatures/ for the full procedure.

To download and import the public key for verifying signatures, execute

gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys 1a75005e142192223d6a7c3b76e0008d166740a8

Full Changelog: r5.6.4...r5.6.5