⭐ New Features

• Add MQTT outbound channel adapter implementation #11530
• Make SerializingHttpMessageConverter to require allowedPatterns from its ctor #11480
• Add Inbound Channel Adapter for MQTT based on hivemq #10989
• Spring Integration JMS DefaultJmsHeaderMapper doesn't have feature to set the OutboundHeaderNames and InboundHeaderNames [INT-4412] #8337
• Provide a Bean Validation (JSR 303) filter [INT-4068] #8009
• Add Proxy support to DefaultFtpSessionFactory [INT-2505] #6485
• FeedEntryMessageSource fails if entry date fields are null [INT-1810] #5797

🐞 Bug Fixes

• Remove broken stack trace from HttpRequestHandlingController errors #11515
• Reject unconvertible messages in AMQP 1.0 inbound endpoints #11500
• PropertiesPersistingMetadataStore does not retry flush after an IOException #11495

📔 Documentation

• Improve docs for security concerns of the SerializingHttpMessageConverter #11455
• Fix typos in the documentation and XSD #11454

🔨 Dependency Upgrades

• Upgrade micrometer-tracing to 1.8.0-RC1 #11593
• Upgrade micrometer to 1.18.0-RC1 #11591
• Upgrade reactor to 2026.0.0-RC1 #11588
• Upgrade spring-amqp to 4.2.0-RC1 #11585
• Upgrade spring-data-bom to 2026.1.0-RC1 #11582
• Upgrade spring-graphql to 2.1.0-RC1 #11579
• Upgrade spring-kafka to 4.2.0-RC1 #11576
• Upgrade spring-security to 7.2.0-RC1 #11573
• Upgrade spring-framework to 7.1.0-RC1 #11570
• Upgrade spring-ws to 5.1.0-RC1 #11567
• Bump cloudEventsVersion from 5.0.0 to 5.1.0 #11552
• Bump io.lettuce:lettuce-core from 7.8.0.RELEASE to 7.9.0.RELEASE #11551
• Bump com.github.spotbugs:spotbugs-annotations from 4.10.4 to 4.10.5 #11550
• Bump com.hivemq:hivemq-mqtt-client from 1.4.0 to 1.4.1 #11549
• Bump org.apache.camel:camel-bom from 4.22.1 to 4.23.0 #11547
• Bump io.grpc:grpc-bom from 1.84.2 to 1.85.0 #11545
• Bump io.freefair.aggregate-javadoc from 9.8.0 to 9.8.2 #11544
• Bump gradle-wrapper from 9.8.0 to 9.8.1 #11529
• Bump io.grpc:grpc-bom from 1.84.0 to 1.84.2 #11528
• Bump com.esotericsoftware:kryo from 5.7.0 to 5.7.1 #11527
• Bump kotlinVersion from 2.4.20 to 2.4.21 #11526
• Bump org.checkerframework:checker-qual from 4.3.0 to 4.3.1 #11523
• Bump io.freefair.aggregate-javadoc from 9.7.0 to 9.8.0 #11514
• Bump org.checkerframework:checker-qual from 4.2.3 to 4.3.0 #11513
• Bump org.codelibs:jcifs from 3.0.3 to 3.0.4 #11511
• Bump debeziumVersion from 3.6.3.Final to 3.7.0.Final #11510
• Bump com.esotericsoftware:kryo from 5.6.2 to 5.7.0 #11508
• Bump org.apache.sshd:sshd-sftp from 2.19.0 to 2.20.0 #11507
• Bump io.lettuce:lettuce-core from 7.7.0.RELEASE to 7.8.0.RELEASE #11493
• Bump org.mongodb:mongodb-driver-bom from 5.12.0 to 5.13.0 #11492
• Bump gradle-wrapper from 9.7.1 to 9.8.0 #11491
• Bump tools.jackson:jackson-bom from 3.2.2 to 3.2.3 #11490
• Bump org.mockito:mockito-core from 5.23.0 to 5.24.0 #11488
• Bump org.apache.groovy:groovy-bom from 5.1.2 to 6.0.0 #11477
• Bump io.freefair.aggregate-javadoc from 9.5.0 to 9.7.0 #11468
• Bump com.fasterxml.jackson:jackson-bom from 2.22.2 to 2.22.3 #11467
• Bump org.jruby:jruby-complete from 10.1.1.0 to 10.1.2.0 #11466

❤️ Contributors

Thank you to all the contributors who worked on this release:

@Ashutosh-Panda2004, @janwaleed09, @mjd507, and @ngocnhan-tran1996

🐞 Bug Fixes

• Remove broken stack trace from HttpRequestHandlingController errors #11516
• Reject unconvertible messages in AMQP 1.0 inbound endpoints #11501
• PropertiesPersistingMetadataStore does not retry flush after an IOException #11498
• File inbound message sources stay running after a failed start() #11426
• TcpNioServerConnectionFactory.stop() logs "Selector closed" at ERROR on normal stop (regression of INT-3473) #11424
• AmqpClientInboundGateway corrupts percent-encoded AMQP 1.0 reply-to queue names #11422
• RedisLockRegistry and JdbcLockRegistry: lock(Duration) does not restore the interrupted status #11411
• TcpNioClientConnectionFactory.stop() logs "Selector closed" at ERROR on every normal stop due to selector-close/active-flag ordering #11398
• FileWritingMessageHandler: a failing close() is swallowed and the truncated file is still promoted #11394
• ReactiveStreamsConsumer over PollableChannel can silently lose a message on stop() #11384
• Restart Apache Commons Tailer if its background thread dies #11382
• AdviceMessage.equals() returns true for messages with different payloads #11379
• The AbstractMailMessageTransformer is losing upstream headers #11375

📔 Documentation

• Improve docs for security concerns of the SerializingHttpMessageConverter #11484

🔨 Dependency Upgrades

• Upgrade micrometer-tracing to 1.7.2 #11596
• Upgrade micrometer to 1.17.2 #11594
• Upgrade reactor to 2025.0.8 #11590
• Upgrade spring-amqp to 4.1.2 #11587
• Upgrade spring-data-bom to 2026.0.2 #11583
• Upgrade spring-graphql to 2.0.6 #11580
• Upgrade spring-kafka to 4.1.2 #11577
• Upgrade spring-security to 7.1.2 #11574
• Upgrade spring-framework to 7.0.10 #11571
• Upgrade spring-ws to 5.0.3 #11568
• Bump kotlinVersion from 2.4.20 to 2.4.21 #11525
• Bump org.codelibs:jcifs from 3.0.3 to 3.0.4 #11512
• Bump org.jruby:jruby-complete from 10.1.1.0 to 10.1.2.0 #11479
• Bump com.fasterxml.jackson:jackson-bom from 2.22.2 to 2.22.3 #11478
• Bump tools.jackson:jackson-bom from 3.1.6 to 3.1.7 #11475
• Bump graalvmVersion from 25.0.4.1 to 25.0.4.1.1 #11438
• Bump kotlinVersion from 2.4.10 to 2.4.20 #11417
• Bump org.checkerframework:checker-qual from 4.2.2 to 4.2.3 #11408
• Bump tools.jackson:jackson-bom from 3.1.5 to 3.1.6 #11364
• Bump com.fasterxml.jackson:jackson-bom from 2.22.1 to 2.22.2 #11363
• Bump org.apache.avro:avro from 1.12.1 to 1.12.2 #11361
• Bump graalvmVersion from 25.0.4 to 25.0.4.1 #11359
• Bump org.codelibs:jcifs from 3.0.2 to 3.0.3 #11274

🐞 Bug Fixes

• Remove broken stack trace from HttpRequestHandlingController errors #11517
• Reject unconvertible messages in AMQP 1.0 inbound endpoints #11502
• PropertiesPersistingMetadataStore does not retry flush after an IOException #11499
• File inbound message sources stay running after a failed start() #11427
• TcpNioServerConnectionFactory.stop() logs "Selector closed" at ERROR on normal stop (regression of INT-3473) #11425
• AmqpClientInboundGateway corrupts percent-encoded AMQP 1.0 reply-to queue names #11423
• RedisLockRegistry and JdbcLockRegistry: lock(Duration) does not restore the interrupted status #11412
• TcpNioClientConnectionFactory.stop() logs "Selector closed" at ERROR on every normal stop due to selector-close/active-flag ordering #11399
• FileWritingMessageHandler: a failing close() is swallowed and the truncated file is still promoted #11395
• ReactiveStreamsConsumer over PollableChannel can silently lose a message on stop() #11385
• Restart Apache Commons Tailer if its background thread dies #11383
• AdviceMessage.equals() returns true for messages with different payloads #11380
• The AbstractMailMessageTransformer is losing upstream headers #11376

📔 Documentation

• Improve docs for security concerns of the SerializingHttpMessageConverter #11483

🔨 Dependency Upgrades

• Upgrade micrometer-tracing to 1.6.8 #11595
• Upgrade micrometer to 1.16.8 #11592
• Upgrade reactor to 2025.0.8 #11589
• Upgrade spring-amqp to 4.0.6 #11586
• Upgrade spring-data-bom to 2025.1.8 #11584
• Upgrade spring-graphql to 2.0.6 #11581
• Upgrade spring-kafka to 4.0.8 #11578
• Upgrade spring-security to 7.0.8 #11575
• Upgrade spring-framework to 7.0.10 #11572
• Upgrade spring-ws to 5.0.3 #11569
• Bump org.codelibs:jcifs from 3.0.3 to 3.0.4 #11509
• Bump org.jruby:jruby-complete from 10.0.6.0 to 10.0.7.0 #11474
• Bump graalvmVersion from 25.0.4.1 to 25.0.4.1.1 #11437
• Bump org.apache.avro:avro from 1.12.1 to 1.12.2 #11362
• Bump graalvmVersion from 25.0.4 to 25.0.4.1 #11357
• Bump org.codelibs:jcifs from 3.0.2 to 3.0.3 #11273

⭐ New Features

• Add Kafka share consumer channel adapter #11413
• Get rid off Apache Derby dependency and usage #11387
• Make Function<MimeMessage, ?> as CheckedFunction in Mail Java DSL #11280
• FullyQualifiedType usage found by new checkstyle check #11275

🐞 Bug Fixes

• File inbound message sources stay running after a failed start() #11420
• TcpNioServerConnectionFactory.stop() logs "Selector closed" at ERROR on normal stop (regression of INT-3473) #11418
• AmqpClientInboundGateway corrupts percent-encoded AMQP 1.0 reply-to queue names #11414
• RedisLockRegistry and JdbcLockRegistry: lock(Duration) does not restore the interrupted status #11409
• Fix race in FileWritingMessageHandler stop() losing track of an in-flight flush #11386
• Restart Apache Commons Tailer if its background thread dies #11381
• AdviceMessage.equals() returns true for messages with different payloads #11377
• FileWritingMessageHandler: a failing close() is swallowed and the truncated file is still promoted #11352
• The AbstractMailMessageTransformer is losing upstream headers #11281
• TcpNioClientConnectionFactory.stop() logs "Selector closed" at ERROR on every normal stop due to selector-close/active-flag ordering #11269
• ReactiveStreamsConsumer over PollableChannel can silently lose a message on stop() #11262

📔 Documentation

• Polish Change History Section #11402
• chore: fix a typo in a docs example #11397
• Update JDBC Lock Registry links in Change History #11366

🔨 Dependency Upgrades

• Upgrade micrometer-tracing to 1.8.0-M2 #11465
• Upgrade micrometer to 1.18.0-M2 #11464
• Upgrade reactor to 2026.0.0-M2 #11463
• Upgrade spring-amqp to 4.2.0-M2 #11462
• Upgrade spring-data-bom to 2026.1.0-M2 #11461
• Upgrade spring-graphql to 2.1.0-M1 #11460
• Upgrade spring-kafka to 4.2.0-M2 #11459
• Upgrade spring-security to 7.2.0-M2 #11458
• Upgrade spring-framework to 7.1.0-M2 #11457
• Upgrade spring-ws to 5.1.0-M1 #11456
• Bump debeziumVersion from 3.6.2.Final to 3.6.3.Final #11450
• Bump com.google.protobuf:protobuf-bom from 4.36.1 to 4.36.2 #11449
• Bump org.mongodb:mongodb-driver-bom from 5.11.1 to 5.12.0 #11447
• Bump graalvmVersion from 25.0.4.1.1 to 25.2.4 #11444
• Bump org.apache.camel:camel-bom from 4.22.0 to 4.22.1 #11443
• Bump org.apache.groovy:groovy-bom from 5.0.8 to 5.1.2 #11442
• Bump org.apache.artemis:artemis-bom from 2.55.0 to 2.57.0 #11441
• Bump io.grpc:grpc-bom from 1.83.1 to 1.84.0 #11440
• Bump org.mongodb:mongodb-driver-bom from 5.9.2 to 5.11.1 #11439
• Bump io.lettuce:lettuce-core from 7.6.0.RELEASE to 7.7.0.RELEASE #11436
• Bump org.apache.camel:camel-bom from 4.21.0 to 4.22.0 #11434
• Bump com.h2database:h2 from 2.4.240 to 2.5.250 #11433
• Bump com.google.protobuf:protobuf-bom from 4.35.1 to 4.36.1 #11432
• Bump kotlinVersion from 2.4.10 to 2.4.20 #11416
• Bump org.checkerframework:checker-qual from 4.2.2 to 4.2.3 #11407
• Bump debeziumVersion from 3.6.1.Final to 3.6.2.Final #11405
• Bump com.github.spotbugs:spotbugs-annotations from 4.10.3 to 4.10.4 #11373
• Update all Spring Dependencies except SF #11367
• Bump tools.jackson:jackson-bom from 3.2.1 to 3.2.2 #11360
• Bump com.fasterxml.jackson:jackson-bom from 2.22.1 to 2.22.2 #11358
• Bump org.apache.avro:avro from 1.12.1 to 1.12.2 #11355
• Bump gradle-wrapper from 9.7.0 to 9.7.1 #11354
• Bump org.mongodb:mongodb-driver-bom from 5.9.1 to 5.9.2 #11272
• Bump org.codelibs:jcifs from 3.0.2 to 3.0.3 #11271
• Downgrade to GraalVM 25.0.4.1.1; Re-enable Jsr223ServiceActivatorTests #11261

⚠️ Attention Required

• Jms MessageConverters now return null when converting an incoming JMS Message with no payload.
  The AbstractJmsChannel treats it as a conversion failure and throws a MessageConversionException rather than discarding the message. #11351

❤️ Contributors

Thank you to all the contributors who worked on this release:

@ngocnhan-tran1996 and @robert-gurol-ps

⭐ New Features

• JdbcMetadataStore.putIfAbsent() returns null for an existing row with a null METADATA_VALUE #11248
• Fix RestTemplate-related deprecations in the HTTP module #11234
• Options to use simple publisher confirms in AMQP outbound endpoints #11194
• Preserve original headers in DefaultErrorMessageStrategy #11160

🐞 Bug Fixes

• CVE-2026-47856: JsonToObjectTransformer resolves the json__TypeId__ message header to an arbitrary class without an allow-list #11350
• CVE-2026-47859: Unbounded memory allocation in RFC6587SyslogDeserializer (octet-counted framing) — remote DoS #11349
• CVE-2026-47862: ZipTransformer uses file_name header to build workDirectory path without sanitization #11348
• CVE-2026-47864: Unsafe Java deserialization in SerializingHttpMessageConverter — remote code execution #11347
• CVE-2026-59324: Fix cross-message header leakage in fluxTransform() under concurrency #11346
• CVE-2026-59321: Fix AbstractScriptExecutor for not thread-safe engines #11345
• CVE-2026-59322: Change EmbeddedHeadersJsonMessageMapper default to no headers #11344
• CVE-2026-59311: Prevent zip transformers from writing temp files to symlink #11343
• CVE-2026-59292: Add metadata store file permissions control #11342
• CVE-2026-59307: JdbcMessageStore: new mapper on setBeanClassLoader #11341
• CVE-2026-59293: Set SMB default version to SMB202 #11339
• CVE-2026-59274: Add size constraint options to UnzipTransformer #11336
• CVE-2026-47880: Skip properties by default in toHeaders #11331
• CVE-2026-47861: UDP adapter sends ack to attacker-supplied host:port parsed from packet body, even when acknowledge=false #11328
• FileWritingMessageHandler: concurrent auto-creation of the same destination directory fails with "Destination directory [...] could not be created." #11253
• Fix ZookeeperLockRegistry test isolation and interrupt handling #11244
• JdbcMetadataStore putIfAbsent may stuck in while loop on MySQL database. #10847

🔨 Dependency Upgrades

• Upgrade micrometer-tracing to 1.8.0-M1 #11324
• Upgrade micrometer to 1.18.0-M1 #11321
• Upgrade reactor to 2026.0.0-M1 #11316
• Upgrade spring-amqp to 4.2.0-M1 #11314
• Upgrade spring-data-bom to 2026.1.0-M1 #11311
• Upgrade spring-graphql to 2.0.5 #11307
• Upgrade spring-security to 7.1.1 #11303
• Upgrade spring-framework to 7.1.0-M1 #11299
• Upgrade spring-kafka to 4.2.0-M1 #11295
• Bump org.junit:junit-bom from 6.1.2 to 6.1.3 #11265
• Bump org.checkerframework:checker-qual from 4.2.1 to 4.2.2 #11264
• Bump debeziumVersion from 3.6.0.Final to 3.6.1.Final #11252
• Bump org.apache.groovy:groovy-bom from 5.0.7 to 5.0.8 #11239
• Upgrade com.mysql:mysql-connector-j to 26.7.0 #11231
• Upgrade io.cloudevents:cloudevents-bom to 5.0.0 #11230
• Upgrade org.graalvm.sdk:graal-sdk to 25.2.4 #11229
• Upgrade org.zeroturnaround:zt-zip to 1.18.2 #11228
• Upgrade org.xmlunit:xmlunit-assertj3 to 2.13.0 #11227
• Upgrade com.oracle.database.jdbc:ojdbc11 to 23.26.3.0.0 #11226
• Upgrade org.mongodb:mongodb-driver-bom to 5.9.1 #11225
• Upgrade tools.jackson:jackson-bom to 3.2.1 #11224
• Upgrade io.grpc:grpc-bom to 1.83.1 #11223
• Upgrade io.debezium:debezium-embedded to 3.6.0.Final #11222
• Upgrade org.apache.camel:camel-bom to 4.21.0 #11221
• Upgrade org.apache.artemis:artemis-bom to 2.55.0 #11220
• Upgrade org.apache.sshd:sshd-sftp to 2.19.0 #11219

⚠️ Attention Required

• JdbcMetadataStore.putIfAbsent() returns null for an existing row with a null METADATA_VALUE #11248

❤️ Contributors

Thank you to all the contributors who worked on this release:

@cppwfs and @mjd507

⭐ New Features

• Do not convert wrong message in the JmsOutboundGateway.onMessageSync() just for debug logging #11197
• Not warn that Redis 7 server does not support DELEX #11137

🐞 Bug Fixes

• CVE-2026-47856: JsonToObjectTransformer resolves the json__TypeId__ message header to an arbitrary class without an allow-list #11340
• CVE-2026-47859: Unbounded memory allocation in RFC6587SyslogDeserializer (octet-counted framing) — remote DoS #11338
• CVE-2026-47862: ZipTransformer uses file_name header to build workDirectory path without sanitization #11334
• CVE-2026-47864: Unsafe Java deserialization in SerializingHttpMessageConverter — remote code execution #11332
• CVE-2026-59324: Fix cross-message header leakage in fluxTransform() under concurrency #11329
• CVE-2026-59321: Fix AbstractScriptExecutor for not thread-safe engines #11326
• CVE-2026-59322: Change EmbeddedHeadersJsonMessageMapper default to no headers #11323
• CVE-2026-59311: Prevent zip transformers from writing temp files to symlink #11320
• CVE-2026-59292: Add metadata store file permissions control #11317
• CVE-2026-59307: JdbcMessageStore: new mapper on setBeanClassLoader #11313
• CVE-2026-59293: Set SMB default version to SMB202 #11310
• CVE-2026-59274: Add size constraint options to UnzipTransformer #11308
• CVE-2026-47880: Skip properties by default in toHeaders #11305
• CVE-2026-47861: UDP adapter sends ack to attacker-supplied host:port parsed from packet body, even when acknowledge=false #11302
• FileWritingMessageHandler: concurrent auto-creation of the same destination directory fails with "Destination directory [...] could not be created." #11257
• JdbcMetadataStore putIfAbsent may stuck in while loop on MySQL database. #11255
• Fix ZookeeperLockRegistry test isolation and interrupt handling #11245
• Dynamic IntegrationFlow registration skips dependency injection for additional and internal components #11196
• Concurrency race condition in the AcceptOnceFileListFilter #11185
• KafkaMessageDrivenChannelAdapter in batch mode doesn't generate message ID, causing splitter to fail #11183
• Redis locks are not not unique #11180
• Adjust cache capacity in the JdbcLockRegistry #11172
• Mark function return type @Nullable for lockKey & waitLockDuration #11168
• JDBC locks not unique #11157
• Throw a generic error from the AbstractWebServiceInboundGateway back to the client #11147
• JdbcLockRegistry & RedisLockRegistry - Shared ReentrantLock from DefaultLockRegistry causes APP_LOCK entry not deleted on unlock when two different lock keys map to the same bucket #11146
• The BaseIntegrationFlowDefinition.REFERENCED_REPLY_PRODUCERS can be accessed concurrently #11127
• Fix multibyte ack-header offset in DatagramPacketMessageMapper #11115
• The PartitionedDispatcher.dispatch() fails with the IndexOutOfBoundsException when hash code is the Integer.MIN_VALUE #11114
• Prevent eviction of held locks from ZooKeeper registry #11113
• Specifying channel name for inbound JMS components in Java DSL causes startup failure due to no BeanFactory #11107
• Fix FileReadingMessageSource to deal with canonical files #11103

📔 Documentation

• Include RedisHeaders.COMMAND into Sensitive Metadata #11201
• Document security implications for the storedProcedureNameExpression #11200
• Document FileHeaders.ORIGINAL_FILE as a Sensitive Metadata #11199
• Mention a security concern for Control Bus Controller #11198
• The FileWritingMessageHandler.trigger() Javadoc should mention ReDoS #11132

🔨 Dependency Upgrades

• Upgrade micrometer-tracing to 1.7.1 #11300
• Upgrade micrometer to 1.17.1 #11297
• Upgrade reactor to 2025.0.7 #11294
• Upgrade spring-amqp to 4.1.1 #11292
• Upgrade spring-graphql to 2.0.5 #11290
• Upgrade spring-kafka to 4.1.1 #11288
• Upgrade spring-security to 7.1.1 #11286
• Upgrade spring-framework to 7.0.9 #11284
• Upgrade spring-data-bom to 2026.0.1 #11282
• Bump org.checkerframework:checker-qual from 4.2.1 to 4.2.2 #11267
• Bump org.junit:junit-bom from 6.1.2 to 6.1.3 #11266
• Bump org.apache.groovy:groovy-bom from 5.0.7 to 5.0.8 #11238
• Bump org.jruby:jruby-complete from 10.1.0.0 to 10.1.1.0 #11204
• Bump graalvmVersion from 25.0.3 to 25.0.4 #11203
• Bump org.junit:junit-bom from 6.1.1 to 6.1.2 #11193
• Bump org.mongodb:mongodb-driver-bom from 5.8.0 to 5.8.1 #11192
• Bump kotlinVersion from 2.4.0 to 2.4.10 #11191
• Bump tools.jackson:jackson-bom from 3.1.4 to 3.1.5 #11179
• Bump io.grpc:grpc-bom from 1.81.0 to 1.81.1 #11178
• Bump com.fasterxml.jackson:jackson-bom from 2.22.0 to 2.22.1 #11176
• Bump org.junit:junit-bom from 6.1.0 to 6.1.1 #11167
• Bump org.checkerframework:checker-qual from 4.2.0 to 4.2.1 #11166
• Bump org.apache.logging.log4j:log4j-bom from 2.26.0 to 2.26.1 #11165
• Bump org.apache.groovy:groovy-bom from 5.0.6 to 5.0.7 #11164
• Bump com.google.protobuf:protobuf-bom from 4.35.0 to 4.35.1 #11111

❤️ Contributors

Thank you to all the contributors who worked on this release:

@bclozel, @michaldo, @mjd507, and @uwezkhan

⭐ New Features

• Do not convert wrong message in the JmsOutboundGateway.onMessageSync() just for debug logging #11212

🐞 Bug Fixes

• CVE-2026-47856: JsonToObjectTransformer resolves the json__TypeId__ message header to an arbitrary class without an allow-list #11337
• CVE-2026-47859: Unbounded memory allocation in RFC6587SyslogDeserializer (octet-counted framing) — remote DoS #11335
• CVE-2026-47862: ZipTransformer uses file_name header to build workDirectory path without sanitization #11333
• CVE-2026-47864: Unsafe Java deserialization in SerializingHttpMessageConverter — remote code execution #11330
• CVE-2026-59324: Fix cross-message header leakage in fluxTransform() under concurrency #11327
• CVE-2026-59321: Fix AbstractScriptExecutor for not thread-safe engines #11325
• CVE-2026-59322: Change EmbeddedHeadersJsonMessageMapper default to no headers #11322
• CVE-2026-59311: Prevent zip transformers from writing temp files to symlink #11319
• CVE-2026-59292: Add metadata store file permissions control #11318
• CVE-2026-59307: JdbcMessageStore: new mapper on setBeanClassLoader #11315
• CVE-2026-59293: Set SMB default version to SMB202 #11312
• CVE-2026-59274: Add size constraint options to UnzipTransformer #11309
• CVE-2026-47880: Skip properties by default in toHeaders #11306
• CVE-2026-47861: UDP adapter sends ack to attacker-supplied host:port parsed from packet body, even when acknowledge=false #11304
• FileWritingMessageHandler: concurrent auto-creation of the same destination directory fails with "Destination directory [...] could not be created." #11258
• JdbcMetadataStore putIfAbsent may stuck in while loop on MySQL database. #11256
• Fix ZookeeperLockRegistry test isolation and interrupt handling #11246
• Dynamic IntegrationFlow registration skips dependency injection for additional and internal components #11216
• Concurrency race condition in the AcceptOnceFileListFilter #11195
• KafkaMessageDrivenChannelAdapter in batch mode doesn't generate message ID, causing splitter to fail #11186
• Redis locks are not not unique #11182
• Adjust cache capacity in the JdbcLockRegistry #11173
• JDBC locks not unique #11171
• Mark function return type @Nullable for lockKey & waitLockDuration #11169
• JdbcLockRegistry & RedisLockRegistry - Shared ReentrantLock from DefaultLockRegistry causes APP_LOCK entry not deleted on unlock when two different lock keys map to the same bucket #11155
• Throw a generic error from the AbstractWebServiceInboundGateway back to the client #11148
• Prevent eviction of held locks from ZooKeeper registry #11135
• The BaseIntegrationFlowDefinition.REFERENCED_REPLY_PRODUCERS can be accessed concurrently #11129
• Specifying channel name for inbound JMS components in Java DSL causes startup failure due to no BeanFactory #11125
• Fix multibyte ack-header offset in DatagramPacketMessageMapper #11119
• The PartitionedDispatcher.dispatch() fails with the IndexOutOfBoundsException when hash code is the Integer.MIN_VALUE #11117
• Fix FileReadingMessageSource to deal with canonical files #11104

📔 Documentation

• Document FileHeaders.ORIGINAL_FILE as a Sensitive Metadata #11218
• Document security implications for the storedProcedureNameExpression #11217
• Include RedisHeaders.COMMAND into Sensitive Metadata #11211
• Mention a security concern for Control Bus Controller #11208
• The FileWritingMessageHandler.trigger() Javadoc should mention ReDoS #11133
• Add AGENTS.md & CLAUDE.md for AI assistance #11102

🔨 Dependency Upgrades

• Upgrade micrometer-tracing to 1.6.7 #11301
• Upgrade micrometer to 1.16.7 #11298
• Upgrade reactor to 2025.0.7 #11296
• Upgrade spring-amqp to 4.0.5 #11293
• Upgrade spring-graphql to 2.0.5 #11291
• Upgrade spring-kafka to 4.0.7 #11289
• Upgrade spring-security to 7.0.7 #11287
• Upgrade spring-framework to 7.0.9 #11285
• Upgrade spring-data-bom to 2025.1.7 #11283
• Bump org.apache.groovy:groovy-bom from 5.0.7 to 5.0.8 #11237
• Bump graalvmVersion from 25.0.3 to 25.0.4 #11202
• Bump org.apache.logging.log4j:log4j-bom from 2.25.4 to 2.25.5 #11177
• Bump org.apache.groovy:groovy-bom from 5.0.6 to 5.0.7 #11162
• Bump org.jruby:jruby-complete from 10.0.5.0 to 10.0.6.0 #11110

❤️ Contributors

Thank you to all the contributors who worked on this release:

@cppwfs

🐞 Bug Fixes

• JdbcLockRegistry & RedisLockRegistry - Shared ReentrantLock from DefaultLockRegistry causes APP_LOCK entry not deleted on unlock when two different lock keys map to the same bucket #11156
• Throw a generic error from the AbstractWebServiceInboundGateway back to the client #11154
• Prevent eviction of held locks from ZooKeeper registry #11136
• The BaseIntegrationFlowDefinition.REFERENCED_REPLY_PRODUCERS can be accessed concurrently #11128
• Specifying channel name for inbound JMS components in Java DSL causes startup failure due to no BeanFactory #11126
• Fix multibyte ack-header offset in DatagramPacketMessageMapper #11118
• The PartitionedDispatcher.dispatch() fails with the IndexOutOfBoundsException when hash code is the Integer.MIN_VALUE #11116
• Fix FileReadingMessageSource to deal with canonical files #11105

📔 Documentation

• The FileWritingMessageHandler.trigger() Javadoc should mention ReDoS #11134

🔨 Dependency Upgrades

• Bump org.springframework.data:spring-data-bom from 2025.0.12 to 2025.0.13 #11153
• Bump org.springframework.amqp:spring-amqp-bom from 3.2.11 to 3.2.12 #11152

⭐ New Features

• Add message selector based on header value matching patterns #11092
• Revise tests using IntegrationRegistrar to register infra beans #11028
• Allow skipping messaging annotation post processor registration in pure DSL scenarios #11024
• polish constructors in ExpressionEvaluatingMessageProcessor #11002
• Disable allowCredentials in the CrossOrigin and introduce originPatterns #10988
• Add message_store pattern in IntegrationPatternType #10978

🐞 Bug Fixes

• Prevent file writing outside output directory #11095
• The RedisLockRegistry unlock race condition on the interrupted thread #11049
• Prevent eviction of held locks from Redis registry #11044
• The ControlBusCommandRegistry.controlBusCommands must be a ConcurrentHashMap #11042
• Prevent eviction of held locks from JDBC registry #11041
• Do not propage server error to the client from the GrpcInboundGateway #11040
• ZookeeperMetadataStore.replace() breaks the CAS logic #11013
• Mqttv5PahoMessageHandler fails due to incorrect MessageConverter.fromMessage usage #11011
• Mqttv5PahoMessageDrivenChannelAdapter ignores payloadType due to incorrect MessageConverter.toMessage usage #10990

📔 Documentation

• Fix navigation link for Configuration section #11057
• Fix typo in java-runtime-flows.adoc #11021
• Fix misleading Javadoc for messaging annotation post-processors #11020
• Fix typo in message ID generation section #11014
• Documentation Enhancement: Describe point to point vs Centralized ESB #2886

🔨 Dependency Upgrades

• Update RC and SNAPSHOT to release versions #11089
• Bump io.micrometer:micrometer-tracing-bom from 1.7.0-RC1 to 1.7.0 #11078
• Bump io.projectreactor:reactor-bom from 2025.0.5 to 2025.0.6 #11076
• Bump cloudEventsVersion from 4.1.0 to 4.1.1 #11071
• Update project dependency versions #11050
• Bump com.sun.xml.bind:jaxb-impl from 4.0.8 to 4.0.9 #11037
• Bump com.fasterxml.jackson:jackson-bom from 2.21.3 to 2.21.4 #11035
• Bump tools.jackson:jackson-bom from 3.1.3 to 3.1.4 #11034
• Bump org.mongodb:mongodb-driver-bom from 5.7.0 to 5.7.1 #11032
• Bump com.google.protobuf:protobuf-bom from 4.34.1 to 4.34.2 #11019
• Bump debeziumVersion from 3.5.0.Final to 3.5.1.Final #11006
• Bump io.lettuce:lettuce-core from 7.5.1.RELEASE to 7.5.2.RELEASE #11005
• Bump com.sun.xml.bind:jaxb-impl from 4.0.7 to 4.0.8 #11000
• Bump org.apache.groovy:groovy-bom from 5.0.5 to 5.0.6 #10996
• Bump org.mongodb:mongodb-driver-bom from 5.7.0-beta1 to 5.7.0 #10987
• Bump tools.jackson:jackson-bom from 3.1.2 to 3.1.3 #10986
• Bump com.fasterxml.jackson:jackson-bom from 2.21.2 to 2.21.3 #10985
• Bump kotlinVersion from 2.3.20 to 2.3.21 #10981

❤️ Contributors

Thank you to all the contributors who worked on this release:

@mjd507 and @DragonFSKY

⭐ New Features

• Add message selector based on header value matching patterns #11093
• Disable allowCredentials in the CrossOrigin and introduce originPatterns #11008

🐞 Bug Fixes

• Prevent file writing outside output directory #11096
• The RedisLockRegistry unlock race condition on the interrupted thread #11059
• The ControlBusCommandRegistry.controlBusCommands must be a ConcurrentHashMap #11055
• Prevent eviction of held locks from Redis registry #11052
• Prevent eviction of held locks from JDBC registry #11047
• ZookeeperMetadataStore.replace() breaks the CAS logic #11022
• ServerWebSocketContainer.registerWebSocketHandlers() uses setAllowedOrigins() instead of setAllowedOriginPatterns(), causing incompatibility with allowCredentials=true in Spring Framework 7 #10943
• JDBC lock repository fails after entering daylight savings #10909
• Docs: Fix schema link for ftp/sftp/smb #10899

📔 Documentation

• Fix navigation link for Configuration section #11061

🔨 Dependency Upgrades

• Update spring release versions #11091
• Bump org.springframework.kafka:spring-kafka-bom from 4.0.5 to 4.0.6 #11070
• Bump io.micrometer:micrometer-bom from 1.16.5 to 1.16.6 #11068
• Bump io.micrometer:micrometer-tracing-bom from 1.6.5 to 1.6.6 #11066
• Bump org.springframework.data:spring-data-bom from 2025.1.5 to 2025.1.6 #11065
• Bump io.projectreactor:reactor-bom from 2025.0.5 to 2025.0.6 #11064
• Bump org.springframework.amqp:spring-amqp-bom from 4.0.3 to 4.0.4 #11063
• Bump com.sun.xml.bind:jaxb-impl from 4.0.8 to 4.0.9 #11033
• Bump com.sun.xml.bind:jaxb-impl from 4.0.7 to 4.0.8 #10997
• Bump org.apache.groovy:groovy-bom from 5.0.5 to 5.0.6 #10995
• Bump org.springframework.graphql:spring-graphql from 2.0.2 to 2.0.3 #10975
• Bump org.springframework.kafka:spring-kafka-bom from 4.0.4 to 4.0.5 #10973
• Bump org.springframework.amqp:spring-amqp-bom from 4.0.2 to 4.0.3 #10972
• Bump graalvmVersion from 25.0.2 to 25.0.3 #10971
• Bump io.micrometer:micrometer-bom from 1.16.4 to 1.16.5 #10959
• Bump io.projectreactor:reactor-bom from 2025.0.4 to 2025.0.5 #10958
• Bump org.springframework:spring-framework-bom from 7.0.6 to 7.0.7 #10957
• Bump org.springframework.data:spring-data-bom from 2025.1.4 to 2025.1.5 #10955
• Bump io.micrometer:micrometer-tracing-bom from 1.6.4 to 1.6.5 #10954
• Bump org.mongodb:mongodb-driver-bom from 5.6.4 to 5.6.5 #10940
• Bump org.jruby:jruby-complete from 10.0.4.0 to 10.0.5.0 #10925
• Bump org.apache.groovy:groovy-bom from 5.0.3 to 5.0.5 #10919
• Bump org.apache.logging.log4j:log4j-bom from 2.25.3 to 2.25.4 #10904
• Bump protobufVersion from 4.33.5 to 4.33.6 #10896

❤️ Contributors

Thank you to all the contributors who worked on this release:

@cppwfs