org.springframework.kafka:spring-kafka

⭐ New Features

• Conflict when observability enabled and mixed batch and non-batch listeners #3947

🐞 Bug Fixes

• CVE-2026-59317: Harden retry_topic-original-timestamp and backoff timestamp header … #4578
• CVE-2026-59278: Normalize and restrict certain java.net types in header type mapping #4577
• Fix generateAntoraYml after version catalog migration #4559
• Fix tx offset lag when marker batch is separate #4553
• CommonDelegatingErrorHandler does not delegate onPartitionsAssigned(), causing silent record loss during retry #4545
• Backoff breaks recovery on batching listener container in multi partition environment #4371

📔 Documentation

• Fix typo in ConsumerProperties#setAuthExceptionRetryInterval javadoc #4556
• Update broken crosss reference in change-history.adoc #4544

🔨 Dependency Upgrades

• Bump org.junit:junit-bom from 6.1.2 to 6.1.3 #4566
• Dependency updates for 4.2.0-SNAPSHOT #4550

❤️ Contributors

Thank you to all the contributors who worked on this release:

@cppwfs, @ngocnhan-tran1996, @sobychacko, and @wolfpeyton

🐞 Bug Fixes

• CVE-2026-59317: Harden retry_topic-original-timestamp and backoff timestamp header … #4576
• CVE-2026-59278: Normalize and restrict certain java.net types in header type mapping #4575
• CommonDelegatingErrorHandler does not delegate onPartitionsAssigned(), causing silent record loss during retry #4560
• No negative caching in KafkaAdmin.clusterId() can block the listener and cause log spam #4537
• Suspend @KafkaListener with two failing records on the same partition skips one of them entirely (never retried, never recovered) #4504

🔨 Dependency Upgrades

• Upgrade spring-data-bom to 2026.0.1 #4574
• Bump org.apache.logging.log4j:log4j-bom from 2.25.4 to 2.25.5 #4530
• Bump tools.jackson:jackson-bom from 3.1.4 to 3.1.5 #4528
• Bump com.fasterxml.jackson:jackson-bom from 2.21.4 to 2.21.5 #4527

❤️ Contributors

Thank you to all the contributors who worked on this release:

@BK202503, @bclozel, @cfcromn, @cppwfs, and @sobychacko

⭐ New Features

• make the method setBackOffFunction work for the batch processing as well #4455

🐞 Bug Fixes

• Require exact package match for trusted header types #4496
• Harden retry topic headers decoding in Spring Kafka #4493
• Fix unbounded cache in DelegatingDeserializer #4489
• @RetryableTopic: built-in DLT logging handler fails with "No Acknowledgment available" on 4.0 (works on 3.3.x) #4468
• Suspend @KafkaListener re-delivers a failing record without bound after DefaultErrorHandler retries are exhausted #4465
• KafkaMessageListenerContainer for ackMode=COUNT_TIME doesn't check ackTime #4444
• Different behavior for value serializer mappings for different classloaders #4442
• DefaultAfterRollbackProcessor for batch-listeners consuming ConsumerRecords doesn't seek consumer #4439
• NPE when properties are not defined for StreamsBuilderFactoryBean #4434
• Incorrect key, value, and headers passed to KafkaStreamsDeadLetterDestinationResolver #4430
• Inconsistent handling of non-string values in Properties argument passed to DefaultConsumerFactory::createKafkaConsumer #4384

📔 Documentation

• BatchListenerFailedException silently commits offsets for unprocessed records in BatchMessageListener #4436
• Polish README.md and CONTRIBUTING.adoc #4184

🔨 Dependency Upgrades

• Bump io.projectreactor:reactor-bom from 2025.0.5 to 2025.0.6 #4485
• Bump org.springframework:spring-framework-bom from 7.0.7 to 7.0.8 #4481
• Bump io.micrometer:micrometer-tracing-bom from 1.7.0-SNAPSHOT to 1.7.0 #4480
• Bump com.fasterxml.jackson:jackson-bom from 2.21.3 to 2.21.4 #4458
• Bump tools.jackson:jackson-bom from 3.1.3 to 3.1.4 #4457
• Bump kafkaVersion from 4.2.0 to 4.2.1 #4456
• Bump org.slf4j:slf4j-api from 2.0.17 to 2.0.18 #4445
• Bump tools.jackson:jackson-bom from 3.1.2 to 3.1.3 #4438
• Bump com.fasterxml.jackson:jackson-bom from 2.21.2 to 2.21.3 #4437
• Bump kotlinVersion from 2.3.20 to 2.3.21 #4426

❤️ Contributors

Thank you to all the contributors who worked on this release:

@LeosBitto and @ngocnhan-tran1996

⭐ New Features

• Add AcknowledgementCommitCallback support for async share consumer commits #4380
• Introduce ShareAckMode enum for share consumers #4376
• Expose group.protocol configuration for Kafka Streams server-side rebalance (KIP-1071) #4329
• Expose native Kafka Streams DLQ configuration (KIP-1034) #4328
• Add stop and failure lifecycle events to share consumer container #4327
• Verify share.acquire.mode (KIP-1206) works through Spring's config model #4326
• Add async commit option to share consumer container #4324

🐞 Bug Fixes

• Fix immutability StreamsBuilderFactory properties #4382
• Async Processing (and out of order commits) with FilteringMessageListenerAdapter #4377
• ShareKafkaMessageListenerContainer.doStart() does not await consumer thread startup #4357
• Missing JSpecify @Nullable annotation for consumer & producer factories #4355

📔 Documentation

• Improve description of messageListener in container properties documentation #4417

🔨 Dependency Upgrades

• Bump io.projectreactor:reactor-bom from 2025.0.4 to 2025.0.5 #4409
• Bump tools.jackson:jackson-bom from 3.1.1 to 3.1.2 #4407
• Bump org.springframework:spring-framework-bom from 7.0.6 to 7.0.7 #4403
• Bump org.apache.logging.log4j:log4j-bom from 2.25.3 to 2.25.4 #4387
• Bump tools.jackson:jackson-bom from 3.1.0 to 3.1.1 #4375
• Bump gradle-wrapper from 9.4.0 to 9.4.1 #4364
• Bump com.fasterxml.jackson:jackson-bom from 2.21.1 to 2.21.2 #4361

❤️ Contributors

Thank you to all the contributors who worked on this release:

@maxwell-balla, @Tarte12, @zooo-code, @loicgreffier, @Arbaz4Sayyad, @Gautam-aman, @jad837

⭐ New Features

• Add RENEW acknowledgment type to ShareAcknowledgment #4322
• Add error handling strategy (poll-level and listener-level) to Share consumer container #4321
• Align default behavior of @RetryableTopic and RetryTopicConfigurationBuilder with documentation #3706
• DefaultErrorHandler doesn't work with suspend methods #3618

🐞 Bug Fixes

• Listener with async acks pauses indefinitely #4332
• Observations for filtered messages are leaked, filling memory #4306
• assertTopic validation breaks meta-annotated @KafkaListener with programmatic topic resolution #4303
• With a @KafkaListener that returns a Mono, the error handler does not retry #4198

🔨 Dependency Upgrades

• Bump kotlinVersion from 2.3.10 to 2.3.20 #4354
• Bump io.projectreactor:reactor-bom from 2025.0.3 to 2025.0.4 #4350
• Bump org.springframework:spring-framework-bom from 7.0.5 to 7.0.6 #4347
• Bump org.springframework:spring-framework-bom from 7.0.4 to 7.0.5 #4308
• Upgrade to Apache Kafka 4.2.0 #4302

❤️ Contributors

Thank you to all the contributors who worked on this release:

@sobychacko

🐞 Bug Fixes

• CVE-2026-59317: Harden retry_topic-original-timestamp and backoff timestamp header … #4573
• CVE-2026-59278: Normalize and restrict certain java.net types in header type mapping #4572
• CommonDelegatingErrorHandler does not delegate onPartitionsAssigned(), causing silent record loss during retry #4561
• KafkaTemplate send overloads expose incorrect nullability for partition and key #4532
• Suspend @KafkaListener with two failing records on the same partition skips one of them entirely (never retried, never recovered) #4515

📔 Documentation

• Update Topic Partition Assignment anchor #4539

🔨 Dependency Upgrades

• Upgrade spring-data-bom to 2025.1.7 #4571
• Bump log4jVersion from 2.25.4 to 2.25.5 #4529

❤️ Contributors

Thank you to all the contributors who worked on this release:

@BK202503 and @cppwfs

⭐ New Features

• make the method setBackOffFunction work for the batch processing as well #4473

🐞 Bug Fixes

• Require exact package match for trusted header types #4497
• Harden retry topic headers decoding in Spring Kafka #4495
• Fix unbounded cache in DelegatingDeserializer #4491
• @RetryableTopic: built-in DLT logging handler fails with "No Acknowledgment available" on 4.0 (works on 3.3.x) #4474
• Different behavior for value serializer mappings for different classloaders #4461
• NPE when properties are not defined for StreamsBuilderFactoryBean #4454
• DefaultAfterRollbackProcessor for batch-listeners consuming ConsumerRecords doesn't seek consumer #4452
• Inconsistent handling of non-string values in Properties argument passed to DefaultConsumerFactory::createKafkaConsumer #4421

📔 Documentation

• Spring Kafka documentation does not mention spring-boot-starter-kafka requirement for Spring Boot 4 #4464

🔨 Dependency Upgrades

• Bump org.springframework.data:spring-data-bom from 2025.1.5 to 2025.1.6 #4488
• Bump org.springframework:spring-framework-bom from 7.0.7 to 7.0.8 #4478
• Bump io.micrometer:micrometer-tracing-bom from 1.6.5 to 1.6.6 #4477
• Bump io.projectreactor:reactor-bom from 2025.0.5 to 2025.0.6 #4476
• Bump io.micrometer:micrometer-bom from 1.16.5 to 1.16.6 #4475
• Bump org.slf4j:slf4j-api from 2.0.17 to 2.0.18 #4446

🐞 Bug Fixes

• Async Processing (and out of order commits) with FilteringMessageListenerAdapter #4414
• ShareKafkaMessageListenerContainer.doStart() does not await consumer thread startup #4400
• Fix immutability StreamsBuilderFactory properties #4389
• Missing JSpecify @Nullable annotation for consumer & producer factories #4368

🔨 Dependency Upgrades

• Bump org.springframework:spring-framework-bom from 7.0.6 to 7.0.7 #4413
• Bump io.projectreactor:reactor-bom from 2025.0.4 to 2025.0.5 #4412
• Bump org.springframework.data:spring-data-bom from 2025.1.4 to 2025.1.5 #4411
• Bump io.micrometer:micrometer-tracing-bom from 1.6.4 to 1.6.5 #4408
• Bump io.micrometer:micrometer-bom from 1.16.4 to 1.16.5 #4406
• Bump log4jVersion from 2.25.3 to 2.25.4 #4386
• Bump kafkaVersion from 4.1.1 to 4.1.2 #4363

⭐ New Features

• make the method setBackOffFunction work for the batch processing as well #4472

🐞 Bug Fixes

• Require exact package match for trusted header types #4498
• Harden retry topic headers decoding in Spring Kafka #4494
• Fix unbounded cache in DelegatingDeserializer #4492
• Different behavior for value serializer mappings for different classloaders #4462
• NPE when properties are not defined for StreamsBuilderFactoryBean #4453
• Inconsistent handling of non-string values in Properties argument passed to DefaultConsumerFactory::createKafkaConsumer #4420

🔨 Dependency Upgrades

• Bump org.springframework.retry:spring-retry from 2.0.12 to 2.0.13 #4484
• Bump org.springframework:spring-framework-bom from 6.2.18 to 6.2.19 #4482
• Bump io.projectreactor:reactor-bom from 2024.0.17 to 2024.0.18 #4479
• Bump com.fasterxml.jackson:jackson-bom from 2.18.7 to 2.18.8 #4459
• Bump gradle-wrapper from 8.14.4 to 8.14.5 #4441
• Bump com.fasterxml.jackson:jackson-bom from 2.18.6 to 2.18.7 #4424

🐞 Bug Fixes

• Async Processing (and out of order commits) with FilteringMessageListenerAdapter #4415

🔨 Dependency Upgrades

• Bump org.springframework:spring-framework-bom from 6.2.17 to 6.2.18 #4410
• Bump io.projectreactor:reactor-bom from 2024.0.16 to 2024.0.17 #4405