Wiretap
All releases

v5.0.1

spring-boot-4.1.1

Spring Boot 4.1.1, a refreshed dependency set at the latest stable patches, and a clean security scan.

Highlights

  • 01

    Spring Boot 4.1.1

    Upgraded from Boot 4.1.0, which brings Spring Kafka 4.1.1. wiretap keeps its own pins ahead of Boot where it matters — Jackson 3 at 3.2.2 (Boot manages 3.1.5) — and kafka-clients stays at 4.2.1, the exact version the embedded broker runs (kafka-server 4.2.1 via spring-kafka-test), so the client is never skewed against the broker under test.

  • 02

    Dependency set refreshed to latest stable

    Jackson 3 3.2.2, Jackson 2 2.22.2, json-schema-validator 3.0.7, slf4j 2.0.18, lz4-java 1.11.2, Avro 1.12.2, and the test-only Confluent serializer 8.3.1. The now-redundant log4j pins were removed — Boot 4.1.1 manages log4j at 2.25.5 (the CVE-2026-49844 fix) via its own BOM.

  • 03

    Heads-up for Avro users

    Avro 1.12.2 tightened its class-security allow-list: SpecificData now refuses to resolve application record classes unless explicitly trusted. If your tests publish your own SpecificRecord types on Avro ≥ 1.12.2, add your package prefix to the test JVM (e.g. -Dorg.apache.avro.SERIALIZABLE_PACKAGES=com.yourcompany). Generic records and @KafkaSeed(avroSchema = …) seeding are unaffected.

  • 04

    Clean security scan

    Verified with the latest Trivy scanner: no CRITICAL/HIGH/MEDIUM findings across the runtime dependency closures of wiretap-core and wiretap-spring-boot, nor in the documentation site's dependency tree.

Full notes

Changed

  • Upgraded to Spring Boot 4.1.1 (from 4.1.0), bringing Spring Kafka 4.1.1; Boot 4.1.1 aligns log4j to 2.25.5, matching the pin wiretap already carried for CVE-2026-49844.
  • Refreshed the managed dependency set to the latest stable patches: Jackson 3 3.2.2, Jackson 2 2.22.2, json-schema-validator 3.0.7, slf4j 2.0.18, lz4-java 1.11.2, Avro 1.12.2, and the test-only Confluent serializer 8.3.1. kafka-clients deliberately stays at 4.2.1 to match the embedded broker.
  • Removed the now-redundant log4j pins from wiretap-spring-boot (the explicit log4j-api/log4j-core management entries and the log4j-bom import); Boot 4.1.1's BOM alone keeps the runtime off the version affected by CVE-2026-49844. The pins were only needed under Boot 4.1.0, which shipped 2.25.4.

Security

  • Verified a clean build with the latest Trivy scanner: no CRITICAL/HIGH/MEDIUM findings across the runtime dependency closures of wiretap-core and wiretap-spring-boot, nor in the documentation site's dependency tree.