On behalf of the team and everyone who contributed, I am pleased to announce the start of the new Spring AMQP 4.2 minor version. The first milestone has made it to Maven Central.

In addition, version 4.1.1 and 4.0.5 with bug & CVE fixes and dependency upgrades has been released.

CVEs fixed in this release

• CVE-2026-47860: Unbounded decompression of attacker-supplied compressed message bodies
• CVE-2026-59272: Log4j2 AmqpAppender disables TLS hostname verification by default
• CVE-2026-59275: Remote JVM termination — a nested-array Java deserialization payload bypasses the allowlist and triggers a StackOverflowError, causing the default JavaLangErrorHandler to call System.exit(99)
• CVE-2026-59271: Admin password disclosed in BrokerNotAliveException message
• CVE-2026-59320: Link credit never replenished on listener exception path

Some notable changes in 4.2.0-M1:

• Deprecate RestTemplateNodeLocator and replace it with RestClientNodeLocator.
• Add routing AmqpConnectionFactory support.
• Allow per-listener overrides of the container factory's batchSize and batchReceiveTimeout properties for @RabbitListener.
• Deprecate enableHostnameVerification with no replacement - always enabled with SSL.

See What's New in 4.2 for more details.

We have a lot of planning yet for upcoming milestones, however, but don't hesitate to reach out with any feedback or ideas!

Cheers,
Glenn

Project Page | GitHub Issues | Contributing