What's Changed

• JAVA-6236 add builder API for facet without operator and clean up search api from beta Reason.SERVER by @strogiyotec in #2006
• JAVA-6164 Bump maxWireVersion to 29 for MongoDB 9.0 by @nhachicha in #2067
• Java-6108 replace deprecated orchestration with run-mongodb script by @strogiyotec in #2070
• Improve handling of Errors by @stIncMale in #2038
• JAVA-6310 Update Evergreen config to download latest builds from private S3 bucket by @stIncMale in #2077
• JAVA-6071 use trampoline pattern to avoid stackoverflow in reactive driver by @strogiyotec in #1973
• Fix OCSP Evergreen build variants by @stIncMale in #2079
• Harden BsonBinaryReader.skipValue() size validation and array allocations. by @rozza in #1990
• JAVA-6179: Send afterClusterTime on writes in causally-consistent ses… by @apmasell in #2047
• Close SocketChannel on pre-registration failure in TlsChannelStream by @rozza in #1981
• JAVA-5392: Make Evergreen green again by @apmasell in #2078
• [JAVA-6060] Reduce global state by grouping internal settings by @nhachicha in #1864
• JAVA-6158: Add Atlas Secure Frontend Processor (SFP) prose tests by @nhachicha in #2072
• project-reactor-bom 2025.0.7, reactor-core 3.8.7 by @julianladisch in #2050
• build(deps): bump testing/resources/specifications from 549238e to 3cfdaf4 by @dependabot[bot] in #2089
• Fixed BsonBinaryWriter.pipe(byte[], int, int) to validate that a document's declared size matches its actual length, preventing malformed RawBsonDocument instances from desynchronizing the BSON structure of outbound commands
  Full Changelog: r5.13.0...r5.14.0

New Contributors

• @julianladisch made their first contribution in #2050

Verifying artifact signatures

Please refer to https://www.mongodb.com/docs/languages/java/mongodb-hibernate/upcoming/security/validate-signatures/ for the full procedure.

To download and import the public key for verifying signatures, execute

gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys 1a75005e142192223d6a7c3b76e0008d166740a8

What's Changed

• build(deps): bump testing/resources/specifications from 92b3c0b to 529a2dd by @apmasell in #2061
• JAVA-6312 Increase testConnectionPoolBackpressure completion time on CI by @nhachicha in #2062
• JAVA-6235: Configurable DNS domain validation for SRV records by @apmasell in #2054
• JAVA-6235 Add SRV allow hosts option to legacy driver by @apmasell in #2065

Full Changelog: r5.12.0...r5.13.0

New Contributors

• @apmasell made their first contribution in #2061

Verifying artifact signatures

Please refer to https://www.mongodb.com/docs/languages/java/mongodb-hibernate/upcoming/security/validate-signatures/ for the full procedure.

To download and import the public key for verifying signatures, execute

gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys 1a75005e142192223d6a7c3b76e0008d166740a8

What's Changed

• JAVA-6231 build(deps): bump testing/resources/specifications from d4d0cdf to 92b3c0b by @dependabot[bot] in #2039
• JAVA-6284 add server 9.0 test variant to evergreen by @strogiyotec in #2037
• Fix the failing :driver-sync:codenarcTest command by @strogiyotec in #2059
• Client Backpressure by @stIncMale, @vbabanin, @nhachicha, @strogiyotec in #1918

Full Changelog: r5.11.0...r5.12.0

Intelligent Workload Management (IWM)

Added support for MongoDB 9.0's Intelligent Workload Management (IWM). The driver now gracefully handles write-blocking scenarios and optimizes connection establishment during high-load conditions to maintain application availability.

Verifying artifact signatures

Please refer to https://www.mongodb.com/docs/languages/java/mongodb-hibernate/upcoming/security/validate-signatures/ for the full procedure.

To download and import the public key for verifying signatures, execute

gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys 1a75005e142192223d6a7c3b76e0008d166740a8

What's Changed

See JAVA-6283 / CVE-2026-88033]

Upgrade reactive/sync driver version to 5.11.1 or later.

If you cannot upgrade, applications using older driver versions should call another delete overload delete(ObjectId). The driver constructs the BsonObjectId internally from a typed value, so no document can reach the filter.

See JAVA-6266 / CVE-2026-88032

Upgrade both reactive driver and mongodb-crypt to version 5.11.1 or later.

Full Changelog: r5.11.0...r5.11.1

What's Changed

• Java 6173 CSFLE/QE Support for HTTP Proxies by @strogiyotec in #2043

CSFLE/QE Http proxies notes

• The driver always negotiates TLS with the KMS host itself, using the SSLContext configured for
  the KMS provider. Implementations must not negotiate TLS with the KMS host; doing so would let an
  intermediary read the key material in transit.
• An implementation may use TLS for its own connection to the intermediary, in which case it returns
  an SSLSocket and the driver layers the KMS host's TLS session on top of it.
• Ownership of the returned socket passes to the driver, which closes it when the KMS request
  completes. A socket that is never returned must be closed by the implementation.
• Applicable only to the synchronous driver. The reactive streams driver rejects(RuntimeException) a configured
  callback.

Code example

Code example uses only the JDK API , so no HTTP client dependency is required. If you use your own HTTP client, it must return the tunnelled socket without negotiating TLS with the KMS host

First define the callback

private static final String PROXY_HOST = "proxy.example.com";
private static final int PROXY_PORT = 8080;
private static final int TIMEOUT_MILLIS = 10_000;

// Routes every KMS request through an HTTP proxy using the HTTP CONNECT method
// refer to the docs https://www.rfc-editor.org/info/rfc9110/#section-9.3.6
KmsConnectCallback proxyCallback = context -> {
    Socket socket = new Socket();
    try {
        // 1. Connect to the proxy, not to the KMS host.
        socket.connect(new InetSocketAddress(PROXY_HOST, PROXY_PORT), TIMEOUT_MILLIS);
        socket.setSoTimeout(TIMEOUT_MILLIS);

        // 2. Ask the proxy to open a tunnel to the KMS host the driver wants to reach. Only the
        //    driver knows which host that is, so always take it from the context rather than
        //    hard-coding it.
        String target = context.getHost() + ":" + context.getPort();
        String connectRequest = "CONNECT " + target + " HTTP/1.1\r\n"
                + "Host: " + target + "\r\n"
                // If the proxy requires authentication, add the appropriate header, for example:
                // + "Proxy-Authorization: Basic " + base64("user:password") + "\r\n"
                + "\r\n";
        socket.getOutputStream().write(connectRequest.getBytes(StandardCharsets.US_ASCII));

        // 3. Check the proxy accepted the tunnel before handing the socket back.
        checkProxyAcceptedTunnel(socket.getInputStream());
    } catch (IOException | RuntimeException e) {
        // The driver never received this socket, so it cannot close it for you.
        socket.close();
        throw e;
    }

    // 4. Return the tunnelled socket. The driver now performs its own TLS handshake with the KMS
    //    host over it, verifying the KMS host's certificate. Do not negotiate TLS with the KMS
    //    host yourself.
    return socket;
};

// Reads the proxy's response to CONNECT and fails unless it is 2xx.
static void checkProxyAcceptedTunnel(InputStream in) throws IOException {
    StringBuilder response = new StringBuilder();
    int b;
    while (response.indexOf("\r\n\r\n") < 0 && (b = in.read()) != -1) {
        response.append((char) b);
    }
    String statusLine = response.toString().split("\r\n", 2)[0];
    if (!statusLine.startsWith("HTTP/1.1 2") && !statusLine.startsWith("HTTP/1.0 2")) {
        throw new IOException("Proxy refused the CONNECT request: " + statusLine);
    }
}

Then use this callback to configure the ClientEncryption

ClientEncryptionSettings settings = ClientEncryptionSettings.builder()
        .keyVaultMongoClientSettings(keyVaultClientSettings)
        .keyVaultNamespace("keyvault.datakeys")
        .kmsProviders(kmsProviders)
        .kmsConnectCallback(proxyCallback)
        .build();

Or using automatic encryption

AutoEncryptionSettings settings = AutoEncryptionSettings.builder()
        .keyVaultNamespace("keyvault.datakeys")
        .kmsProviders(kmsProviders)
        .kmsConnectCallback(proxyCallback)
        .build();

Full Changelog: r5.10.0...r5.11.0

What's Changed

• Added $scoreFusion hybrid search stage for combining and normalizing the scores of multiple search pipelines (MongoDB 8.2+) #2024 by @nhachicha
• Added a fluent builder API for the $score aggregation stage, with normalization, weighting, and score details (MongoDB 8.2+) #2023 by @strogiyotec
• Added $vectorSearch support for nested embeddings and arrays of embeddings via parentFilter and nestedOptions #2026 by @rozza
• Removed stale @Beta from SearchOptions and VectorSearchOptions in the Java and Scala drivers #2026 by @rozza
• Encoded Kotlin ByteArray data class fields as BSON Binary, and added an opt-in ByteArray BSON Binary serializer for bson-kotlinx #2019 by @rozza
• Included the fix for CVE-2026-18710 / JAVA-6266, where ProxySettings.toString() rendered the SOCKS5 proxy username and password into application logs. First shipped in 5.9.2 #2035 by @strogiyotec
• ByteArray fields in Kotlin data classes are once again encoded as BSON Binary rather than a BSON array of int32, restoring the behavior from before 5.1.3. Decoding accepts both forms, so documents written by 5.1.3–5.9.x still read back correctly, but newly written documents change BSON type. Review any non-driver consumers of those fields before upgrading. See JAVA-6224

Verifying artifact signatures

Please refer to https://www.mongodb.com/docs/drivers/java/sync/current/security/validate-signatures/ for the full procedure.

To download and import the public key for verifying signatures, execute

gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys 1a75005e142192223d6a7c3b76e0008d166740a8

Full Changelog: r5.9.0...r5.10.0

What's Changed

See JAVA-6266 / CVE-2026-18710

The username and password are no longer included in toString() starting in this release.

If you cannot upgrade, set the org.mongodb.driver.client logger to WARN or higher to suppress the client-construction message. We do not recommend this as a long-term measure: it silences diagnostic information that is valuable for support, and it does not remove credentials already written to existing logs.

Full Changelog: r5.9.1...r5.9.2

What's Changed

• Backport: Resolve forwarded type arguments across POJO hierarchy edges by @vbabanin in #2020

Verifying artifact signatures

Please refer to https://www.mongodb.com/docs/drivers/java/sync/current/security/validate-signatures/ for the full procedure.

To download and import the public key for verifying signatures, execute

gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys 1a75005e142192223d6a7c3b76e0008d166740a8

Full Changelog: r5.9.0...r5.9.1

What's Changed

• Fix reactive streams MongoClient.getTimeout always returning null by @stIncMale in #2011

Verifying artifact signatures

Please refer to https://www.mongodb.com/docs/drivers/java/sync/current/security/validate-signatures/ for the full procedure.

To download and import the public key for verifying signatures, execute

gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys 1a75005e142192223d6a7c3b76e0008d166740a8

Full Changelog: r5.8.0...r5.8.1

What's Changed

• build(deps): bump testing/resources/specifications from b519824 to 25bee54 by @dependabot[bot] in #1984
• Evergreen: fixes - gpg and oidc by @rozza in #1987
• JAVA-6182 Update the Git submodule from 25bee54 to 4484038 by @stIncMale in #1992
• Add Windows CI testing by @vbabanin in #1935
• Update Specs to latest by @rozza in #2001
• Fix reactive streams MongoClient.getTimeout always returning null by @stIncMale in #2009
• JAVA-6237: Explicit Encryption Case 2 uses contention-10 collection by @rozza in #2003
• JAVA-6168 JAVA-6244 JAVA-6196: QE prefix/suffix/substring GA + rename Text API to String by @nhachicha in #2010

Verifying artifact signatures

Please refer to https://www.mongodb.com/docs/drivers/java/sync/current/security/validate-signatures/ for the full procedure.

To download and import the public key for verifying signatures, execute

gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys 1a75005e142192223d6a7c3b76e0008d166740a8

Full Changelog: r5.8.0...r5.9.0