spring-cloud-stream v5.0.3

Security

• CVE-2026-59302 — Potential for logging sensitive data in Spring Cloud Stream
• CVE-2026-59303 — Dynamic destination cache size is not properly bound in Spring Cloud Stream
• CVE-2026-59304 — Improper caching of the original content type in Spring Cloud Stream Avro
• CVE-2026-59305 — Partition interceptor may be improperly added while sending message
• CVE-2026-59306 — Potential for deserialization of untrusted types in Spring Cloud Stream

What’s Changed

• Update RetryTemplate documentation to reflect Spring Cloud Stream 5. by @un1024 in https://github.com/spring-cloud/spring-cloud-stream/pull/3209
• Bump actions/cache from 4 to 6 by @dependabot[bot] in https://github.com/spring-cloud/spring-cloud-stream/pull/3212
• Bump actions/checkout from 2 to 7 by @dependabot[bot] in https://github.com/spring-cloud/spring-cloud-stream/pull/3213
• Bump actions/setup-java from 3 to 5 by @dependabot[bot] in https://github.com/spring-cloud/spring-cloud-stream/pull/3214
• Bump org.testcontainers:rabbitmq from 1.17.1 to 1.17.6 by @dependabot[bot] in https://github.com/spring-cloud/spring-cloud-stream/pull/3215
• Bump actions/upload-artifact from 4 to 7 by @dependabot[bot] in https://github.com/spring-cloud/spring-cloud-stream/pull/3216
• Bump org.springframework.cloud:spring-cloud-function-context from 5.0.3-SNAPSHOT to 5.0.3 by @dependabot[bot] in https://github.com/spring-cloud/spring-cloud-stream/pull/3217
• Bump io.micrometer:context-propagation from 1.1.0 to 1.1.4 by @dependabot[bot] in https://github.com/spring-cloud/spring-cloud-stream/pull/3219
• Bump antora from 3.2.0-alpha.12 to 3.2.0-rc.2 in /docs by @dependabot[bot] in https://github.com/spring-cloud/spring-cloud-stream/pull/3227
• Bump org.apache.maven.plugins:maven-surefire-plugin from 3.0.0-M7 to 3.0.0 by @dependabot[bot] in https://github.com/spring-cloud/spring-cloud-stream/pull/3229
• Bump org.springframework.cloud:spring-cloud-connectors-core from 2.0.7.RELEASE to 2.0.9.RELEASE by @dependabot[bot] in https://github.com/spring-cloud/spring-cloud-stream/pull/3230
• Bump org.apache.httpcomponents.client5:httpclient5 from 5.6.1 to 5.6.3 by @dependabot[bot] in https://github.com/spring-cloud/spring-cloud-stream/pull/3238
• Bump @springio/antora-extensions from 1.14.12 to 1.14.13 in /docs by @dependabot[bot] in https://github.com/spring-cloud/spring-cloud-stream/pull/3239
• Bump org.apache.httpcomponents.client5:httpclient5 from 5.6.3 to 5.6.4 by @dependabot[bot] in https://github.com/spring-cloud/spring-cloud-stream/pull/3246

New Contributors

• @un1024 made their first contribution in https://github.com/spring-cloud/spring-cloud-stream/pull/3209

Full Changelog: https://github.com/spring-cloud/spring-cloud-stream/compare/v5.0.2…v5.0.3

---

Source spring-cloud/spring-cloud-stream · v5.0.3 · 2026-08-20 · upstream release

Mirrored verbatim for indexing. All rights belong to the upstream project.