spring-kafka v4.1.1

:lady_beetle: Bug Fixes

• CVE-2026-59317: Harden retry_topic-original-timestamp and backoff timestamp header … #4576
• CVE-2026-59278: Normalize and restrict certain java.net types in header type mapping #4575
• CommonDelegatingErrorHandler does not delegate onPartitionsAssigned(), causing silent record loss during retry #4560
• No negative caching in KafkaAdmin.clusterId() can block the listener and cause log spam #4537
• Suspend @KafkaListener with two failing records on the same partition skips one of them entirely (never retried, never recovered) #4504

:hammer: Dependency Upgrades

• Upgrade spring-data-bom to 2026.0.1 #4574
• Bump org.apache.logging.log4j:log4j-bom from 2.25.4 to 2.25.5 #4530
• Bump tools.jackson:jackson-bom from 3.1.4 to 3.1.5 #4528
• Bump com.fasterxml.jackson:jackson-bom from 2.21.4 to 2.21.5 #4527

:heart: Contributors

Thank you to all the contributors who worked on this release:

@BK202503, @bclozel, @cfcromn, @cppwfs, and @sobychacko

---

Source spring-projects/spring-kafka · v4.1.1 · 2026-08-20 · upstream release

Mirrored verbatim for indexing. All rights belong to the upstream project.