Spring Integration6.4.12

🐞 Bug Fixes

• CVE-2026-40987: Remote-file synchronizer writes server-supplied filename under localDirectory without canonicalization

🔨 Dependency Upgrades

• Bump org.springframework.graphql:spring-graphql from 1.3.8 to 1.3.9
• Bump org.springframework.ws:spring-ws-bom from 4.0.19-SNAPSHOT to 4.0.19
• Bump io.micrometer:micrometer-tracing-bom from 1.4.14 to 1.4.15
• Bump io.projectreactor:reactor-bom from 2024.0.17 to 2024.0.17.1
• Bump org.springframework.amqp:spring-amqp-bom from 3.2.10 to 3.2.10.1
• Bump org.springframework.kafka:spring-kafka-bom from 3.3.15 to 3.3.15.1
• Bump org.springframework.data:spring-data-bom from 2024.1.14 to 2024.1.15
• Bump org.springframework:spring-framework-bom from 6.2.18 to 6.2.18.1
• Bump org.springframework.retry:spring-retry from 2.0.12 to 2.0.12.1
• Bump org.apache.groovy:groovy-bom from 4.0.31 to 4.0.32
• Bump io.micrometer:micrometer-bom from 1.14.15 to 1.14.16
• Bump gradle-wrapper from 8.14.4 to 8.14.5
• Bump com.sun.xml.bind:jaxb-impl from 4.0.7 to 4.0.8
• Bump io.projectreactor:reactor-bom from 2024.0.16 to 2024.0.17
• Bump com.fasterxml.jackson:jackson-bom from 2.18.6 to 2.18.7
• Bump org.springframework.kafka:spring-kafka-bom from 3.3.14 to 3.3.15
• Bump org.springframework:spring-framework-bom from 6.2.17 to 6.2.18
• Bump org.springframework.amqp:spring-amqp-bom from 3.2.9 to 3.2.10
• Bump org.springframework.kafka:spring-kafka-bom from 3.3.13 to 3.3.14
• Bump io.projectreactor:reactor-bom from 2024.0.15 to 2024.0.16
• Bump org.apache.groovy:groovy-bom from 4.0.30 to 4.0.31
• Bump com.sun.xml.bind:jaxb-impl from 4.0.6 to 4.0.7
• Bump org.springframework:spring-framework-bom from 6.2.16 to 6.2.17
• Bump com.fasterxml.jackson:jackson-bom from 2.18.5 to 2.18.6