v4.1.1

🐞 Bug Fixes

• CVE-2026-59317: Harden retry_topic-original-timestamp and backoff timestamp header … #4576
• CVE-2026-59278: Normalize and restrict certain java.net types in header type mapping #4575
• CommonDelegatingErrorHandler does not delegate onPartitionsAssigned(), causing silent record loss during retry #4560
• No negative caching in KafkaAdmin.clusterId() can block the listener and cause log spam #4537
• Suspend @KafkaListener with two failing records on the same partition skips one of them entirely (never retried, never recovered) #4504

🔨 Dependency Upgrades

• Upgrade spring-data-bom to 2026.0.1 #4574
• Bump org.apache.logging.log4j:log4j-bom from 2.25.4 to 2.25.5 #4530
• Bump tools.jackson:jackson-bom from 3.1.4 to 3.1.5 #4528
• Bump com.fasterxml.jackson:jackson-bom from 2.21.4 to 2.21.5 #4527

❤️ Contributors

Thank you to all the contributors who worked on this release:

@BK202503, @bclozel, @cfcromn, @cppwfs, and @sobychacko