Spring for Apache Kafka 4.1.0 Reaches GA With Three CVE Fixes
Spring for Apache Kafka 4.1.0 has reached general availability, following on from the 4.1.0-RC1 released in April. The GA release is primarily a stabilization pass, but it carries real security weight: it patches three CVEs (CVE-2026-41726, CVE-2026-41727, and CVE-2026-41731) that were disclosed against the Kafka listener container infrastructure since the release candidate shipped.
Alongside the security fixes, the release corrects a correctness bug in BatchListenerFailedException handling that could cause silent offset commits — meaning a batch listener that threw a partial-failure exception could, under certain retry configurations, have Kafka commit offsets for records that were never successfully processed. Teams relying on at-least-once delivery semantics with batch listeners should prioritize this upgrade, since silent offset advancement is exactly the kind of bug that causes quiet data loss rather than a visible failure.
The release also bumps the underlying Kafka client dependency to 4.2.1 along with routine updates to Jackson, Kotlin, and slf4j. Spring for Apache Kafka 4.1.0 is the version integrated into the Spring Boot 4.1.0 dependency management BOM, so any project already on Spring Boot 4.1 picking up a routine dependency update will get these fixes automatically; projects pinning an explicit Spring Kafka version should upgrade directly.
Spring Batch Adds a MongoDB-Backed NoSQL Job Repository
Spring Batch has shipped its first NoSQL job repository implementation, backed by MongoDB, via a new spring-boot-batch-data-mongo starter module. Until now, Spring Batch's job repository — the store that tracks job execution state, step status, and restart metadata — has been relational-only, backed by JDBC. Teams running MongoDB as their primary datastore had to either stand up a separate relational database purely to track batch metadata, or roll their own repository implementation against the JobRepository SPI.
The new MongoDB job repository requires MongoDB 4.0 or later and ships with a setup script that creates the necessary collections for storing job and step execution metadata. On the configuration side, Spring Batch introduces MongoDefaultBatchConfiguration, a programmatic base class that lets teams customize job repository beans and other batch infrastructure components without falling back to raw XML or manual bean wiring — consistent with how the JDBC-backed DefaultBatchConfiguration already works.
For teams building document-oriented pipelines — ETL jobs, data migration tasks, or scheduled aggregation jobs that already read and write MongoDB collections — this removes a persistent friction point: batch state can now live in the same database as the business data it's processing, simplifying both operational topology and backup/restore procedures.
