⭐ New Features Do not convert wrong message in the JmsOutboundGateway.onMessageSync() just for debug logging #11197 Not warn that Redis 7 server does not support DELEX #11137 🐞 Bug Fixes CVE-2026-47856: JsonToObjectTransformer resolves the json__TypeId__ message header to an arbitrary class without an allow-list #11340 CVE-2026-47859: Unbounded memory allocation in RFC6587SyslogDeserializer (octet-counted framing) — remote DoS #11338 CVE-2026-47862: ZipTransformer uses file_name header to build workDirectory path without sanitization #11334 CVE-2026-47864: Unsafe Java deserialization in Serial