Update spring-kafka.version [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
org.springframework.kafka:spring-kafka	2.8.2 → 2.9.11
org.apache.kafka:kafka-clients	3.1.0 → 3.9.1
org.slf4j:slf4j-api (source, changelog)	1.7.35 → 1.7.36
org.projectlombok:lombok (source)	1.18.22 → 1.18.42

GitHub Vulnerability Alerts

CVE-2023-34040

In Spring for Apache Kafka 3.0.9 and earlier and versions 2.9.10 and earlier, a possible deserialization attack vector existed, but only if unusual configuration was applied. An attacker would have to construct a malicious serialized object in one of the deserialization exception record headers.

Specifically, an application is vulnerable when all of the following are true:

• The user does not configure an ErrorHandlingDeserializer for the key and/or value of the record
• The user explicitly sets container properties checkDeserExWhenKeyNull and/or checkDeserExWhenValueNull container properties to true.
• The user allows untrusted sources to publish to a Kafka topic

By default, these properties are false, and the container only attempts to deserialize the headers if an ErrorHandlingDeserializer is configured. The ErrorHandlingDeserializer prevents the vulnerability by removing any such malicious headers before processing the record.

CVE-2024-31141

Files or Directories Accessible to External Parties, Improper Privilege Management vulnerability in Apache Kafka Clients.

Apache Kafka Clients accept configuration data for customizing behavior, and includes ConfigProvider plugins in order to manipulate these configurations. Apache Kafka also provides FileConfigProvider, DirectoryConfigProvider, and EnvVarConfigProvider implementations which include the ability to read from disk or environment variables.
In applications where Apache Kafka Clients configurations can be specified by an untrusted party, attackers may use these ConfigProviders to read arbitrary contents of the disk and environment variables.

In particular, this flaw may be used in Apache Kafka Connect to escalate from REST API access to filesystem/environment access, which may be undesirable in certain environments, including SaaS products.
This issue affects Apache Kafka Clients: from from 2.3.0 through 3.5.2, 3.6.0 through 3.6.2, and 3.7.0.

Users with affected applications are recommended to upgrade kafka-clients to version >=3.8.0, and set the JVM system property "org.apache.kafka.automatic.config.providers=none".
Users of Kafka Connect with one of the listed ConfigProvider implementations specified in their worker config are also recommended to add appropriate "allowlist.pattern" and "allowed.paths" to restrict their operation to appropriate bounds.

For users of Kafka Clients or Kafka Connect in environments that trust users with disk and environment variable access, it is not recommended to set the system property.
For users of the Kafka Broker, Kafka MirrorMaker 2.0, Kafka Streams, and Kafka command-line tools, it is not recommended to set the system property.

CVE-2025-27817

A possible arbitrary file read and SSRF vulnerability has been identified in Apache Kafka Client. Apache Kafka Clients accept configuration data for setting the SASL/OAUTHBEARER connection with the brokers, including "sasl.oauthbearer.token.endpoint.url" and "sasl.oauthbearer.jwks.endpoint.url". Apache Kafka allows clients to read an arbitrary file and return the content in the error log, or sending requests to an unintended location. In applications where Apache Kafka Clients configurations can be specified by an untrusted party, attackers may use the "sasl.oauthbearer.token.endpoint.url" and "sasl.oauthbearer.jwks.endpoint.url" configuratin to read arbitrary contents of the disk and environment variables or make requests to an unintended location. In particular, this flaw may be used in Apache Kafka Connect to escalate from REST API access to filesystem/environment/URL access, which may be undesirable in certain environments, including SaaS products.

Since Apache Kafka 3.9.1/4.0.0, we have added a system property ("-Dorg.apache.kafka.sasl.oauthbearer.allowed.urls") to set the allowed urls in SASL JAAS configuration. In 3.9.1, it accepts all urls by default for backward compatibility. However in 4.0.0 and newer, the default value is empty list and users have to set the allowed urls explicitly.

---

Release Notes

spring-projects/spring-kafka (org.springframework.kafka:spring-kafka)

v2.9.11

Compare Source

⭐ New Features

• Private Header Type for DeserializationExceptions #​2771

🐞 Bug Fixes

• AdminClient doesn't use configured properties while starting a container listener #​2764

🔨 Dependency Upgrades

• Upgrade Micrometer, Reactor, Spring Data Versions #​2777

External Links

• Reference Documentation

v2.9.10

Compare Source

⭐ New Features

• Make KafkaAdmin Easier to Subclass and Add a Filter Mechanism #​2726
• GH-2709: Preserve existing JAAS configuration #​2718
• Auto Config Non-Blocking Retries with asyncAcks #​2707

🐞 Bug Fixes

• Possible dead lock between DefaultKafkaProducerFactory.expire and DefaultKafkaProducerFactory.removeProducer #​2748
• Pausing container results in WakeupException without retrying failed listener invocation #​2740
• Behavior Change When Interceptor Throws an Exception #​2728
• Fix Race Condition in DelegatingInvocableHandler #​2725

🔨 Dependency Upgrades

• Upgrade Spring Framework, Data, Micrometer, Reactor Versions #​2745

❤️ Contributors

Thank you to all the contributors who worked on this release:

@​antonio-tomac and @​edanidzerda

External Links

• Reference Documentation

v2.9.9

Compare Source

🐞 Bug Fixes

• Fix CommonErrorHandler for asyncAcks and AckMode.MANUAL #​2679
• Fix Race in Micrometer Test #​2662

🔨 Dependency Upgrades

• Upgrade Spring Data, Micrometer Versions #​2681

External Links

• Reference Documentation

v2.9.8

Compare Source

⭐ New Features

• Support Dynamic Micrometer Tags Based on Consumer/Producer Record #​2649

🐞 Bug Fixes

• "resetStateOnExceptionChange" has no effect, because the cause of "ListenerExecutionFailedException" is always a "TimestampedException" #​2646
• Races in KafkaListenerAnnotationBeanPostProcessor on scope=prototype bean instantiation #​2644

🔨 Dependency Upgrades

• Upgrade Spring Framework, Data, Reactor, Micrometer Versions #​2656

External Links

• Reference Documentation

v2.9.7

Compare Source

🐞 Bug Fixes

• Deadlock on lifecycleMonitor #​2630
• Reclassify Exception in FallbackBatchErrorHandler When Exception Changes #​2623
• Spring Kafka Listener uses stale oauthbearer token, fails to connect after initial token expired. #​2614
• Synchronized kafka transaction is not committed nor rolled back when code from custom "afterCommit" throws exception #​2606
• Spring Messaging batch payload incompatible with Kotlin #​2603
• KafkaMessageListenerContainer pauses for a long time after error handling #​2598

🔨 Dependency Upgrades

• Upgrade Spring Framework to 5.3.26 #​2633

External Links

• Reference Documentation

v2.9.6

Compare Source

⭐ New Features

• GH-2566: Both Converters in Container Factory #​2570
• Repeating headers in Non-Blocking Retry Mechanism #​2551

🐞 Bug Fixes

• Container Does Not Pause for Missing Acks After a Rebalance #​2587
• ProducerFactory's argument txIdPrefix of createProducer not marked as @Nullable #​2585
• Non-blocking retries: partition rebalance causes emergency consumer stop #​2580
• GH-2565: Topic partition is not resumed for RetryTopic #​2569
• GH-2558: Fix Possible NPE in FailedBatchProcessor #​2560
• The RetryTopicBeanNames.DEFAULT_SCHEDULER_WRAPPER_BEAN_NAME accidentally points to defaultRetryTopicKafkaTemplate #​2557

📔 Documentation

• Update Docs For Overriding Boot Dependencies #​2564
• GH-2516: Fix code example in the documentation for for Non-Blocking Retries - DLT Failure Behavior #​2556

🔨 Dependency Upgrades

• Upgrade Jackson, Micrometer, Reactor, Spring Data Versions #​2591

❤️ Contributors

Thank you to all the contributors who worked on this release:

@​cenkakin and @​jucosorin

External Links

• Reference Documentation

v2.9.5

Compare Source

⭐ New Features

• GH-2542: FallbackBatchErrorHandler Improvement #​2544
• Add possibility to remove custom headers in method: addHeadersFunction(...) from DeadLetterPublishingRecoverer #​2530

🐞 Bug Fixes

• Topic partition is not resumed after re-assignment for RetryTopic #​2534

📔 Documentation

• GH-2511: Fix code examples in the documentation for for Non-Blocking Retries - BackOff Configuration #​2513

🔨 Dependency Upgrades

• Upgrade Spring, Micrometer, Reactor Versions #​2547

🔨 Tasks

• kafka-clients 3.3.2 Compatibility #​2541

❤️ Contributors

Thank you to all the contributors who worked on this release:

@​jucosorin and @​truepele

External Links

• Reference Documentation

v2.9.4

Compare Source

🐞 Bug Fixes

• Duplicate consumption triggered by consumer group rebalance #​2492

📔 Documentation

• Fix Consumer Thread Naming Documentation #​2504
• Document Parameter Annotation Limitations #​2500

❤️ Contributors

Thank you to all the contributors who worked on this release:

@​mikael-carlstedt

v2.9.3

Compare Source

Change log:

5a412d8 Upgrade Versions; Prepare for Release
91ac6d2 GH-2477: Fix Static State RetryTopicConfigSupport
8c15f7d Fix Missing Re-Interrupt
42f654d Revert KafkaAdmin Change (Previous Commit)
30d2b89 Fix Missing Re-Interrupts
65bbdb6 Add KafkaTestUtils methods using Duration for timeout (2.9) (#​2468)
c92ec76 GH-2464: Fix Delivery Attempt Header (Rare)
921e6ae GH-2459: Resolve Sonar Issues
f9f6a55 @​RetryableTopic More SpEL Support
5c70ec1 GH-2459: FallbackBatchErrorHandler Retryable Ex
2966c7d GH-2451: Fix Class Level Listener Multi Instances
9e07035 GH-2352: Fix Doc Typo
2bf7d62 GH-2352: Expose KLERegistrar Getter on BPP

v2.9.2

Compare Source

Change log:

6b938e4 Upgrade Versions; Prepare for Release
e455431 GH-2438: RetryTopic Destination Partition Select
58aa8b1 GH-2432: Remove Unnecessary Variable
9850af5 GH-2432: Fix Retryable Topic Provisioning
cb5c36b GH-2410: Disallow nack() with Out of Order Commits
91507a9 Update config example type in doc
c69791e Add Acknowledgment.nack() variants accepting Duration
43bc67a Fix Race In Test
3850a01 GH-2419: DLPR: Protect Against Non-Compliant PF
5c776cd GH-2387: Fix FallbackBatchErrorHandler Events
7c648d7 Don't Use kafka.common.KafkaException in Broker
766333c GH-2415: Doc for DeserializationEx... with DLPR
8ad588e GH-2395: RetryListener - Add Batch Methods
f584d8f Upgrade Apache Kafka to 3.2.3
5fed903 GH-2400: ReplyingKT Improve CorrelationId Logging

v2.9.1

Compare Source

Change log:

fabdcb7 Upgrade Versions; Prepare for Release
5efa335 Upgrade Apache Kafka to 3.2.2
4fdedd7 GH-2184: Don't Log KafkaBackoffException
8336461 Deprecate ListenableFuture Callback Extensions
ea6fa8f Add Missing Pause/Resume Events
781e726 GH-2382: Fix Unchecked Cast in Test
2eacf7a Remove Another Dead Link from Change History
8f6fd87 Remove Dead Links from Change History
7da485a Fix Duplicate Doc Anchors
f9419c2 Fix typo in whats-new.adoc
6a28cc5 GH-2382: Fix FBEH Cross Talk
798dea3 GH-2375: Add KLER.unregisterListenerContainer
90c6e95 GH-2357: Remove Remaining Uses of ListenableFuture

v2.9.0

Compare Source

Change log:

7a3223d Upgrade Versions; Prepare for Release
295b68c GH-2357: Fix Sonar Issues
128372f GH-2357: Switch to CompletableFuture
a4ee066 GH-2355: Add ManualAckListenerErrorHandler (#​2356)
e682c87 GH-2350: Fix Paused Partitions After Rebalance
2732303 GH-2344: AggReplyingKT Support Custom Correlation
b1d97b9 GH-2345: Fix Possible NPE in KafkaAdmin
4e6d59c Sonar Fixes
e579c62 Fix for Java 8 compatibility
dd981e1 GH-2239: Fix Boot AutoConfiguration
15e5668 GH-2340: Fix Retrying Batch Error Handling
e220b17 Sonar Fixes
11e03c9 GH-2262: Fix Possible NPE
f7cbbfe Sonar Fixes

v2.8.11

Compare Source

Change log:

e31e639 Upgrade Versions; Prepare for Release
5df71c1 Fix Missing Re-Interrupt
a9b0252 Revert KafkaAdmin Change (Previous Commit)
8c2b325 Fix Missing Re-Interrupts
6ec1b3b GH-2459: FallbackBatchErrorHandler Retryable Ex
48b2017 GH-2451: Fix Class Level Listener Multi Instances

v2.8.10

Compare Source

Change log:

e021e32 Upgrade Versions; Prepare for Release
bd146f6 GH-2432: Remove Unnecessary Variable
6a253f2 GH-2432: Fix Retryable Topic Provisioning
950a2ea GH-2410: Disallow nack() with Out of Order Commits
0547dc7 Update config example type in doc
a03f67b Fix Race In Test
5bd08c0 GH-2419: DLPR: Protect Against Non-Compliant PF
f6cbf11 GH-2387: Fix FallbackBatchErrorHandler Events
2e1feb3 Don't Use kafka.common.KafkaException in Broker
34c48f5 GH-2415: Doc for DeserializationEx... with DLPR
5df2568 Fix previous commit conflicts
8cfd1d8 GH-2395: RetryListener - Add Batch Methods

v2.8.9

Compare Source

Change log:

48334e4 Upgrade Reactor Version
269fd79 Upgrade Versions; Prepare for Release
8193cd2 Upgrade Apache Kafka to 3.0.2
a190ba7 Add Missing Pause/Resume Events
e1bb194 GH-2382: Fix Unchecked Cast in Test
e4eedb7 Remove Another Dead Link from Change History
6d72816 Remove Dead Links from Change History
f3837a1 Fix Duplicate Doc Anchors
3de1e89 GH-2382: Fix RetryingBatchErrorHandler Cross Talk
f001423 GH-2375: Add KLER.unregisterListenerContainer
b6b4c1a GH-2363: Fix Class Cast in ErrorHandlerAdapter

v2.8.8

Compare Source

Change log:

16fbdde Upgrade Versions; Prepare for Release
e94985b GH-2350: Fix Paused Partitions After Rebalance
f1f200c GH-2344: AggReplyingKT Support Custom Correlation
f747329 GH-2345: Fix Possible NPE in KafkaAdmin
dee71ae GH-2340: Fix Retrying Batch Error Handling
3f30673 GH-2288: Delegating EH - Traverse Causes
4b93cdf KafkaAdmin: fix usage of the Map.of()
989fb29 GH-2332: Fix Container.pause() with Manual Assign.
b286250 GH-2335: Fix RetryTopic Cause Header Name
3eb5d9f Fix Doc Copyright
fea092c transactionIdPrefix Doc Polishing
bdb7e84 Polish Container setTransactionManager Javadocs
46c63e2 GH-2321: Support Inbound Header Mapping Matchers
558c19f GH-2318: ReplyingKT - Wait for Assignment
e49d850 Fix Possible Race in KafkaAdmin
d1b60d2 Widen Delegate Type for KafkaBackoffAwareMLAdapter

v2.8.7

Compare Source

Change log:

c93304a Upgrade Versions; Prepare for Release
9675989 Update Gradle Enterprise plugin
4bce526 GH-2306: Improve DeserEx Message For Improper Ex.
168b9d2 Add Converter Factories to Method Factory
273416c GH-2304: Fix SendTo on Interface Etc.
1d60eda GH-2297: Add KLERegistry.alwaysStartAfterRefresh
e88711f GH-1482: Make Topic Config Update Optional
ec2608b GH-1482: Support Admin.incrementalAlterConfigs
a1f112c Add Acknowledgment.nack() variants accepting Duration
a9a19a7 GH-2295: No Resolvers with ConsumerRecordMetadata
23a103e Log Uncommitted After Rebalance
1e82ac9 GH-2292: Doc - Fix Container Factory Generics
5101b17 GH-2286: Doc Fixes
07e4bc8 Precise unit for sleep duration and wake time
388b23f GH-2148: Use ObjectProvider to Locate MeterRegistry
ba309fb GH-2274: Option to Not Configure (De)serializers

v2.8.6

Compare Source

Change log:

7f5395d Upgrade Versions; Prepare for Release
041ce86 GH-2269: Improve DLPR Extensibility
6e92b7f GH-2252: Keep offset metadata in case of batch reprocessing (#​2253)
9a36d9b GH-2128: More Doc Polishing
1708bf4 GH-2249: Batch Listener LISTENER_INFO Headers
fc544cd GH-2128: Document Nack Sleep Time Limitations
60c8f6c Add JUnit5 params Module to Build
f90c8e1 GH-2240: Bug fix for KafkaTemplate.receive(..)
63e56a7 Fix Sonar Issue
34e1950 Make artifactoryPublish dependsOn build
fe74dbf Revert "Make artifactoryPublish depend on build"

v2.8.5

Compare Source

Change log:

fa07690 Make artifactoryPublish depend on build
f823b3a Upgrade versions; prepared for release
2f45a82 Fix TopicPartitionOffset Hash Code (NPE)
cbca786 GH-2220: Fix Test After Back Port
0072574 GH-2220: Fix TopicPartitionOffset for Retry Topics (#​2223)
c863597 GH-2222: Fix Race in Test
3903d1a Fix Links to Boot Documentation
7103483 GH-2222: Re-Pause Paused Partitions After Rebal.
4154271 GH-2212: Log listener exception in retry topic flow (#​2213)
e7db6d4 GH-2218 add ability to pass AdminClient
26de6d2 GH-2214: Fix Manual Nack with Zero Sleep
dc81e7c GH-2208: Add Paragraph to Doc
340ac79 Fix test compatibility with the RecordInterceptor
a67a230 GH-2208: Fix Manual Nack with Mutating Interceptor
fea221f GH-2197: Fix Container State After Fatal Stop
94721d5 Upgrade Jackson Version
5246daa GH-2170: Support Custom OffsetAndMetadata
5650491 GH-2059: adminTimeout property on @​EmbeddedKafka
da0b820 GH-2184 KafkaBackOffException logged as ERROR
5df194e DLPR - Generate Header Values Lazily
93efeb4 GH-2182 - Capitalize title in docs

v2.8.4

Compare Source

Change log:

243e68c GH-2178: Fix CSA.onPartitionsAssigned (Manual)
b27a0d6 Upgrade versions; prepare for release
a78a3cd GH-2179: Exit RetryingBatchErrorHandler on Stop
e9310c0 Fix typo
e0a2711 GH-1886: Fix Javadocs
ea7cc33 GH-1886 More RetryTemplate Related Deprecations
59f2550 Fix KafkaHeaderMapper Javadocs
f3f3eac GH-2155: DeadLetterPublishingRecoverer Improvement
a1ca194 Fix Sonar Issues
f96edc0 GH-2162: Fix Record Interceptor Javadocs
ea50386 GH-2154: Fix Tombstones with Delegating Seriali...
8ec7ed0 GH-2132: Deprecate ListenerUtils.recordToString
60fd3e8 GH-2148: Fix MeterRegistry Detection
be4b1bf GH-2128 Do Not Sleep Consumer Thread for Nack
220262d Fix JavaDocs typo in the KafkaUtils
f6e4a7d GH-2132: Producer Record Log Formatting
15bef9d GH-2134: Doc and Javadoc Polishihg
9623116 Fix Compiler Warnings
279b753 GH-2134: Add filter to @​KafkaListener
0ac422e Add Nullable to API methods
9d3d034 Docs - Fix ToC
1e5915d Fix Deprecation Warning in Test
6b60316 GH-615: Docs - Migrating Legacy Error Handlers
1bc6f39 Fix Sonar Issues
3020619 Add getter for StreamsUncaughtExceptionHandler (#​2144)
b09619b Fix Sonar Issues
9fdb6c3 GH-2139: Clarify ExponentialBackOff maxDelay default
a7621a1 GH-2116: Add blocking retries to RT (#​2124)
841a6b7 GH-2135: Fix NPE in JsonDeserializer
796624e ExceptionClassifier Reverse Option

v2.8.3

Compare Source

Change log:

810a4c8 Add what's new and docs for RT's new features
427b024 GH-2117: Make ListenerContainerFactoryConfigurer ctor public
8580d70 GH-2118: Make DLPR skip same topic fatal ex optional
92ccb55 GH-2113: Add ex classification to DDTopicResolver
e2750e1 Upgrade versions; prepare for release
a110259 GH-2069: Same factory for retryable and normal endpoints (#​2108)
2cb2adf Change Spring repositories to official
fefebd1 GH-2109: Increase EKB Zookeeper Timeouts
3325e36 Doc Polishing
c20b0fb Non-Responsive Consumer Doc Polishing
1c045a2 Fix Event Consumption ToC
22737f5 GH-2089: Add Deprecations for 3.0 Removal
9300f7c GH-2099: Deprecate RetryingBatchErrorHandler
36a5297 Deprecate Accessors for Legacy Error Handlers
5728ed7 add nullable annotation to FailedRecordTracker.setBackOffFunction
550b718 Fix Missing Topics Fatal Javadoc
9722b84 GH-2076: Fix Async Commit Retries
4637d2f JsonSerde Improvement
10e73b5 GH-2085: DelegatingByTypeSerializer Improvements
b669c12 GH-2070: Producer Factory Improvements
917134d GH-2082: Fix RecordInterceptor
dd64db8 2.8.x kafka-clients 3.1.0 Compatibility

projectlombok/lombok (org.projectlombok:lombok)

v1.18.42

v1.18.40

v1.18.38

v1.18.36

Compare Source

v1.18.34

v1.18.32

v1.18.30

v1.18.28

v1.18.26

v1.18.24

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 27.88%. Comparing base (f3005e4) to head (80679c3).

❗ Current head 80679c3 differs from pull request most recent head 29339c6

Please upload reports for the commit 29339c6 to get more accurate results.

Additional details and impacted files

@@            Coverage Diff            @@
##             master      #25   +/-   ##
=========================================
  Coverage     27.88%   27.88%           
  Complexity       28       28           
=========================================
  Files            15       15           
  Lines           269      269           
  Branches          5        5           
=========================================
  Hits             75       75           
  Misses          192      192           
  Partials          2        2           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.