Bump @azure/cosmos from 4.9.3 to 4.10.0 in /api

[dependabot]

Bumps @azure/cosmos from 4.9.3 to 4.10.0.

Changelog

Sourced from @​azure/cosmos's changelog.

4.10.0 (2026-07-21)

Features Added

• Added a semantic reranking API. Use Container.semanticRerank(rerankContext, documents, options) to score and reorder documents by relevance via the Cosmos DB Inference Service. Configure it through enablePreviewFeatures.semanticRerank on CosmosClientOptions: inferenceEndpoint (required) and an optional inferenceRequestTimeout (ms, default 5000) single-attempt timeout that fails with HTTP 408 when exceeded. Requires AAD authentication. The result and any thrown error include CosmosDiagnostics for the operation.
• Added enablePreviewFeatures to CosmosClientOptions, a dictionary for opting into preview features of the SDK.

Bugs Fixed

• #38087 Made boundingBox optional on the SpatialIndex type. Bounding boxes are only required for geometry spatial indexes, not geography ones.
• Fixed cross-partition queries making a redundant /pkranges metadata call on every query. Queries now reuse the shared partition key range cache (worst for hybrid queries, which previously fetched ranges per component query). The cache is also made failure-safe so a transient fetch error no longer poisons later lookups.
• #39115 Fixed continuation token handling for enableQueryControl queries. Resuming now routes through the query plan instead of forwarding the SDK-internal composite token to the gateway, avoiding an extra failing call and the MalformedContinuationToken error.

Commits

• 022e01c Adlnu/fix signoff pipeline (#38985)
• a55c383 [Cosmos] Bump @​azure/cosmos version to 4.10.0 (#39305)
• 04d12eb feat(cosmos): add semantic rerank API (#37981)
• 73754d0 [cosmos] Route enableQueryControl continuation resume through the query plan ...
• 0b2529b [@​azure/cosmos] Reuse shared partition key range cache for cross-partition qu...
• 55e1705 feat(cosmos): add enablePreviewFeatures to CosmosClientOptions (#39040)
• 1d09a0f [EngSys] upgrade dev dependency prettier to v3.9.1 (#39127)
• 0616d26 Re-export RestError and isRestError in non-management packages (#39007)
• 3181ad2 [EngSys] Bump min-version to node 22 (#38887) NO_CI
• 56d7d95 fix(cosmos): make boundingBox optional on SpatialIndex type (#38230)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: api, dependencies. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[Copilot]

Pull request overview

Note

Copilot could not run the full agentic suite for this review because it was automatically requested on a bot-authored pull request. Request a review from Copilot under Reviewers to retry with the full agentic suite. Improved support for bot-authored pull requests is coming soon.

Updates the Azure Cosmos DB SDK dependency in the API package to a newer patch/minor version.

Changes:

• Bumped @azure/cosmos from ~4.9.3 to ~4.10.0 in api/package.json.

Files not reviewed (1)

• api/package-lock.json: Generated file

[github-actions]

⚠️ Deprecation Warning: The deny-licenses option is deprecated for possible removal in the next major release. For more information, see issue 997.

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
npm/@azure/cosmos	4.10.0	🟢 7.3	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 10 issue activity found in the last 90 days -- score normalized to 10 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Code-Review 🟢 10 all changesets reviewed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Security-Policy 🟢 10 security policy file detected Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Branch-Protection 🟢 5 branch protection is not maximal on development and all release branches Token-Permissions 🟢 9 detected GitHub workflow tokens with excessive permissions SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0 Binary-Artifacts 🟢 9 binaries present in source code Pinned-Dependencies 🟢 7 dependency not pinned by hash detected -- score normalized to 7 Fuzzing ⚠️ 0 project is not fuzzed

Scanned Files

• api/package-lock.json

[Copilot]

Review details

Files not reviewed (1)

• api/package-lock.json: Generated file

• Files reviewed: 1/2 changed files
• Comments generated: 1
• Review effort level: Low

[github-actions]

🧹 Preview Environment Cleaned Up

Resource group ZavaGiftExchange-pr-101 is being deleted.

All Azure resources for this PR have been removed.