v4.0.5

⭐ New Features

• Feature Request: Add support for setting a connection name in SingleAmqpConnectionFactory #3547
• RepublishMessageRecoverer: don't publish error stack trace by default #3522

🐞 Bug Fixes

• CVE-2026-59271: Don't log password in BrokerRunningSupport #3589
• CVE-2026-59272: AmqpAppender : verifyHostname=true by default #3588
• CVE-2026-59275: Allowlist for the ultimate array component #3586
• CVE-2026-47860: Unbounded decompression of attacker-supplied compressed message bodies #3582
• Concurrency race condition around RabbitAmqpListenerContainer.ConsumerMessageHandler.ConsumerBatch #3531
• The AbstractJacksonMessageConverter may got confused with wrong content-type from the message #3526
• Kotiln: Inconstistent nullability in all properties of MessageProperties #3504
• The DefaultMessagePropertiesConverter.toMessageProperties() fails with a ClassCastException when x-death header is melformed #3499
• Encode queue in the RabbitMQ management URL #3497
• [3.2.11 Regression] x-queue-leader-locator breaks classic queue declarations on RabbitMQ 3.13 #3480

🔨 Dependency Upgrades

• Upgrade micrometer-tracing to 1.6.7 #3579
• Upgrade micrometer to 1.16.7 #3574
• Upgrade reactor to 2025.0.7 #3571
• Upgrade spring-framework to 7.0.9 #3567
• Upgrade spring-data-bom to 2025.1.7 #3564
• Bump org.apache.logging.log4j:log4j-bom from 2.25.4 to 2.25.5 #3510
• Bump ch.qos.logback:logback-classic from 1.5.37 to 1.5.38 #3509
• Bump ch.qos.logback:logback-classic from 1.5.35 to 1.5.37 #3501
• Bump ch.qos.logback:logback-classic from 1.5.34 to 1.5.35 #3494

⚠️ Attention Required

• RepublishMessageRecoverer: don't publish error stack trace by default #3522

❤️ Contributors

Thank you to all the contributors who worked on this release:

@cppwfs