On behalf of the team and everyone who has contributed, I'm happy to announce that Spring for Apache Pulsar 1.2.18 and 2.0.6 have been released and are now available from Maven Central.

Both releases are maintenance releases focused on dependency updates. The 2.0.6 release includes an upgrade to Apache Pulsar client 4.2.1, along with updates to Jackson, logback, Caffeine, and Testcontainers. The 1.2.18 release brings Jackson and logback maintenance bumps for the 1.2.x line.

The 1.2.18 release will be included in the upcoming Spring Boot 3.5.15 release. The 2.0.6 release will be included in the upcoming Spring Boot 4.0.7 and Spring Boot 4.1.0 releases, respectively.

CVEs fixed in this release

• CVE-2026-41732: Default header mapper deserializes attacker-chosen classes

Please see the release notes (1.2.18 and 2.0.6) for more details.