org.springframework.cloud:spring-cloud-starter-stream-rabbit

Security

• CVE-2026-59302 — Potential for logging sensitive data in Spring Cloud Stream
• CVE-2026-59303 — Dynamic destination cache size is not properly bound in Spring Cloud Stream
• CVE-2026-59304 — Improper caching of the original content type in Spring Cloud Stream Avro
• CVE-2026-59305 — Partition interceptor may be improperly added while sending message
• CVE-2026-59306 — Potential for deserialization of untrusted types in Spring Cloud Stream

What's Changed

• Update RetryTemplate documentation to reflect Spring Cloud Stream 5. by @un1024 in #3209
• Bump actions/cache from 4 to 6 by @dependabot[bot] in #3212
• Bump actions/checkout from 2 to 7 by @dependabot[bot] in #3213
• Bump actions/setup-java from 3 to 5 by @dependabot[bot] in #3214
• Bump org.testcontainers:rabbitmq from 1.17.1 to 1.17.6 by @dependabot[bot] in #3215
• Bump actions/upload-artifact from 4 to 7 by @dependabot[bot] in #3216
• Bump org.springframework.cloud:spring-cloud-function-context from 5.0.3-SNAPSHOT to 5.0.3 by @dependabot[bot] in #3217
• Bump io.micrometer:context-propagation from 1.1.0 to 1.1.4 by @dependabot[bot] in #3219
• Bump antora from 3.2.0-alpha.12 to 3.2.0-rc.2 in /docs by @dependabot[bot] in #3227
• Bump org.apache.maven.plugins:maven-surefire-plugin from 3.0.0-M7 to 3.0.0 by @dependabot[bot] in #3229
• Bump org.springframework.cloud:spring-cloud-connectors-core from 2.0.7.RELEASE to 2.0.9.RELEASE by @dependabot[bot] in #3230
• Bump org.apache.httpcomponents.client5:httpclient5 from 5.6.1 to 5.6.3 by @dependabot[bot] in #3238
• Bump @springio/antora-extensions from 1.14.12 to 1.14.13 in /docs by @dependabot[bot] in #3239
• Bump org.apache.httpcomponents.client5:httpclient5 from 5.6.3 to 5.6.4 by @dependabot[bot] in #3246

New Contributors

• @un1024 made their first contribution in #3209

Full Changelog: v5.0.2...v5.0.3

🐞 Bug Fixes

• Kafka Binder does not work with multiple bindings #3173

📔 Documentation

• Document MessageRoutingCallback in the Event Routing section #3198
• Incorrect republishToDlq property default value in documentation #3142

❤️ Contributors

Thank you to all the contributors who worked on this release:

@wadhwaroh-lang and @won-seoop

New Contributors

• @varunu28 made their first contribution in #3180
• @mhalbritter made their first contribution in #3194
• @won-seoop made their first contribution in #3198

Full Changelog: v5.0.1...v5.0.2

Update SNAPSHOT to 5.0.1

⭐ New Features

• Add consumer priority #3147
• Add caching and logging control options for KTable materialization #3136
• KafkaMessageChannelBinder should switch to use setKafkaAwareTransactionManager in ContainerProperties as setTransactionManager has been long deprecated and marked for removal #3130
• Add CacheEnabled and LoggingEnabled properties to Kafka Streams binder for enhanced KTable control #3094

🐞 Bug Fixes

• Dependencies are not wired into custom KafkaMessageChannelBinder with non-empty properties #3148
• Container settings are not propagated to individual listeners #3124
• Target Protocol header is incorrect for non-Kafka or Rabbit binders #2222

❤️ Contributors

Thank you to all the contributors who worked on this release:

@belljun3395, @ferblaca, and @gihong-park

Update SNAPSHOT to 5.0.0-RC1

Update SNAPSHOT to 5.0.0-M4

Full Changelog: v4.3.2...v4.3.3

Update SNAPSHOT to 4.3.2

❤️ Contributors

Thank you to all the contributors who worked on this release:

@darth-raijin

Full Changelog: v4.3.0...v4.3.1

Full Changelog: v4.2.2...v4.2.3