5.1.0-M1

What's Changed

• Update Maven wrapper to 3.9.16 by @spring-builds in #3248
• Add reflection hints for Kafka serializers by @mhalbritter in #3255
• Bump actions/setup-java from 5 to 6 by @dependabot[bot] in #3259
• Bump antora from 3.2.0-rc.2 to 3.2.0-rc.3 in /docs by @dependabot[bot] in #3249
• Bump antora from 3.2.0-rc.3 to 3.2.0 in /docs by @dependabot[bot] in #3264
• Polish producing-and-consuming-messages.adoc by @ngocnhan-tran1996 in #3256

New Contributors

• @spring-builds made their first contribution in #3248
• @ngocnhan-tran1996 made their first contribution in #3256

Full Changelog: v5.0.3...v5.1.0-M1

5.0.3

Security

• CVE-2026-59302 — Potential for logging sensitive data in Spring Cloud Stream
• CVE-2026-59303 — Dynamic destination cache size is not properly bound in Spring Cloud Stream
• CVE-2026-59304 — Improper caching of the original content type in Spring Cloud Stream Avro
• CVE-2026-59305 — Partition interceptor may be improperly added while sending message
• CVE-2026-59306 — Potential for deserialization of untrusted types in Spring Cloud Stream

What's Changed

• Update RetryTemplate documentation to reflect Spring Cloud Stream 5. by @un1024 in #3209
• Bump actions/cache from 4 to 6 by @dependabot[bot] in #3212
• Bump actions/checkout from 2 to 7 by @dependabot[bot] in #3213
• Bump actions/setup-java from 3 to 5 by @dependabot[bot] in #3214
• Bump org.testcontainers:rabbitmq from 1.17.1 to 1.17.6 by @dependabot[bot] in #3215
• Bump actions/upload-artifact from 4 to 7 by @dependabot[bot] in #3216
• Bump org.springframework.cloud:spring-cloud-function-context from 5.0.3-SNAPSHOT to 5.0.3 by @dependabot[bot] in #3217
• Bump io.micrometer:context-propagation from 1.1.0 to 1.1.4 by @dependabot[bot] in #3219
• Bump antora from 3.2.0-alpha.12 to 3.2.0-rc.2 in /docs by @dependabot[bot] in #3227
• Bump org.apache.maven.plugins:maven-surefire-plugin from 3.0.0-M7 to 3.0.0 by @dependabot[bot] in #3229
• Bump org.springframework.cloud:spring-cloud-connectors-core from 2.0.7.RELEASE to 2.0.9.RELEASE by @dependabot[bot] in #3230
• Bump org.apache.httpcomponents.client5:httpclient5 from 5.6.1 to 5.6.3 by @dependabot[bot] in #3238
• Bump @springio/antora-extensions from 1.14.12 to 1.14.13 in /docs by @dependabot[bot] in #3239
• Bump org.apache.httpcomponents.client5:httpclient5 from 5.6.3 to 5.6.4 by @dependabot[bot] in #3246

New Contributors

• @un1024 made their first contribution in #3209

Full Changelog: v5.0.2...v5.0.3

5.0.2

🐞 Bug Fixes

• Kafka Binder does not work with multiple bindings #3173

📔 Documentation

• Document MessageRoutingCallback in the Event Routing section #3198
• Incorrect republishToDlq property default value in documentation #3142

❤️ Contributors

Thank you to all the contributors who worked on this release:

@wadhwaroh-lang and @won-seoop

New Contributors

• @varunu28 made their first contribution in #3180
• @mhalbritter made their first contribution in #3194
• @won-seoop made their first contribution in #3198

Full Changelog: v5.0.1...v5.0.2

v4.3.3

Full Changelog: v4.3.2...v4.3.3

4.3.1

❤️ Contributors

Thank you to all the contributors who worked on this release:

@darth-raijin

Full Changelog: v4.3.0...v4.3.1

v4.2.3

Full Changelog: v4.2.2...v4.2.3

5.0.0

⭐ New Features

• Add consumer priority #3147
• Add caching and logging control options for KTable materialization #3136
• KafkaMessageChannelBinder should switch to use setKafkaAwareTransactionManager in ContainerProperties as setTransactionManager has been long deprecated and marked for removal #3130
• Add CacheEnabled and LoggingEnabled properties to Kafka Streams binder for enhanced KTable control #3094

🐞 Bug Fixes

• Dependencies are not wired into custom KafkaMessageChannelBinder with non-empty properties #3148
• Container settings are not propagated to individual listeners #3124
• Target Protocol header is incorrect for non-Kafka or Rabbit binders #2222

❤️ Contributors

Thank you to all the contributors who worked on this release:

@belljun3395, @ferblaca, and @gihong-park

5.0.0-M1

❤️ Contributors

Thank you to all the contributors who worked on this release:

@wilkinsona

4.3.0

⭐ New Features

• Removes deprecated DescribeTopicsResult method #3111
• StreamBridge does not add dynamic Bindings to Output/Input binding lifecycle #3106
• Retain Binder in AbstractExtendedBindingProperties to improve performance #3101
• Double micrometer-tracing-bridge since last Spring Cloud Stream #3100
• Replaced ReentrantLock with ConcurrentHashMap.computeIfAbsent() #3098
• Ability to create new bindings at runtime via the BindingLifecycleController #3086
• Error retrieving state store during graceful shutdown #3067
• Default-retryable setting is ignored #3066
• Inconsistent behavior of Environment binding properties in SCS parent-child contexts #3039

🐞 Bug Fixes

• output-bindings property does not work for bindings definition #3109
• StreamBridge Function cache does not return the good value #3105
• Bindings endpoint doesn't works when SpEL expression is configured #3104
• ConfluentSchemaRegistryClient picks wrong subject version when using SpecificRecord types #3103
• fix(kafka-topic-provisioner): Prevent resource leak #3093
• Problems with applying clientFactoryCustomizer when �using a transaction producer #3090
• (Reactive) Bindings do not recover from application restart #3083
• Longer Startup Times Post Spring-Boot 3.4.0 Upgrade #3076

📔 Documentation

• Fix a couple typos #3110

❤️ Contributors

Thank you to all the contributors who worked on this release:

@2tsumo-hitori, @StevenPG, @akenra, @nhajratw, and @xDeyan

4.2.1

⭐ New Features

• Enabling lazy initialization breaks Kafka Streams #3065
• Clarify that having a custom error handler disables auto send to DLQ #3063
• Add spring.cloud.stream.function.autodetect to additional-spring-configuration-metadata.json #3052
• fix(observability): register ObservationRegistry for dynamic MessageChannels in StreamBridge (#3033) #3036
• Batch-Capable Producer Bindings #2969

🐞 Bug Fixes

• Can't create CRaC checkpoint, fails with the error message "CheckpointOpenSocketException: ... kafka/172.18.0.3:9092" #3062
• Kafka Binder's partitionCount (auto-discovered from the broker) gets reset after environment refresh #3054
• No converter found capable of converting from type [java.lang.String] to type [org.springframework.expression.Expression] #3053
• CloudEventMessageBuilder creates URI with surrounding quotes #3055
• Default-retryable setting is ignored #3066

❤️ Contributors

Thank you to all the contributors who worked on this release:

@agustino-lim and @destan