On behalf of the team and everyone who contributed, I am pleased to announce the start of the new Spring Integration 7.2 minor version. The first milestone has made it to Maven Central.

In addition, the 7.1.1 and 7.0.6 versions with bug & CVE fixes and dependency upgrades has been released.

CVEs fixed in this release

• CVE-2026-47861: UDP adapter sends ack to attacker-supplied host:port parsed from packet body, even when acknowledge=false
• CVE-2026-47880: Skip properties by default in toHeaders
• CVE-2026-59274: Add size constraint options to UnzipTransformer
• CVE-2026-59293: Set SMB default version to SMB202
• CVE-2026-59307: JdbcMessageStore: new mapper on setBeanClassLoader
• CVE-2026-59292: Add metadata store file permissions control
• CVE-2026-59311: Prevent zip transformers from writing temp files to symlink
• CVE-2026-59322: Change EmbeddedHeadersJsonMessageMapper default to no headers
• CVE-2026-59321: Fix AbstractScriptExecutor for not thread-safe engines
• CVE-2026-59324: Fix cross-message header leakage in fluxTransform() under concurrency
• CVE-2026-47864: Unsafe Java deserialization in SerializingHttpMessageConverter — remote code execution
• CVE-2026-47862: ZipTransformer uses file_name header to build workDirectory path without sanitization
• CVE-2026-47859: Unbounded memory allocation in RFC6587SyslogDeserializer (octet-counted framing) — remote DoS
• CVE-2026-47856: JsonToObjectTransformer resolves the json__TypeId__ message header to an arbitrary class without an allow-list

Some notable changes in 7.2.0-M1:

• Support for Spring AMQP's simple publisher mechanism.
• JdbcMetadataStore has been updated so that a stored NULL value can no longer be misread as a successful putIfAbsent() insert.
• Deprecate RestTemplate based HTTP outbound gateway configurations.

See What's New in 7.2 for more details.

We have a lot of planning yet for upcoming milestones, however, don't hesitate to reach out with any feedback or ideas!

Cheers,
Glenn

Project Page | GitHub Issues | Contributing