v1.4.6

⚠️ Security fixes

This release fixes 3 "High" CVEs:

• CVE-2026-41699: Unsafe Deserialization in Spring GraphQL
• CVE-2026-41700: Cross-Site WebSocket Hijacking in Spring for GraphQL
• CVE-2026-41856: Spring GraphQL Annotation Detection Vulnerability

⭐ New Features

• Provide more flexibility in JsonKeysetCursorStrategy collections types #1446
• Add singleElement() to GraphQlTester.EntityList #1381

🐞 Bug Fixes

• WebSocket keepalive PING not emitted for all idle concurrent sessions #1474
• Memory leak in WebFlux WebSocket support when client disconnects #1473
• Observations not closed when DataLoader returns null values #1472
• Argument annotations are ignored on handler methods in generic interfaces #1470
• Allow custom Origins when upgrading to WebSocket transport #1465

🔨 Dependency Upgrades

• Upgrade to Jackson 2.18.6 #1454
• Upgrade to Micrometer 1.15.12 and Tracing 1.5.12 #1456
• Upgrade to Reactor 2024.0.18 #1455
• Upgrade to Spring Data 2025.0.12 #1457
• Upgrade to Spring Framework 6.2.19 #1453
• Upgrade to Spring Security 6.5.11 #1458