⚠️ Security fixes
This release fixes 3 "High" CVEs:
- CVE-2026-41699: Unsafe Deserialization in Spring GraphQL
- CVE-2026-41700: Cross-Site WebSocket Hijacking in Spring for GraphQL
- CVE-2026-41856: Spring GraphQL Annotation Detection Vulnerability
⭐ New Features
- Provide more flexibility in JsonKeysetCursorStrategy collections types #1446
- Add singleElement() to GraphQlTester.EntityList #1381
🐞 Bug Fixes
- WebSocket keepalive PING not emitted for all idle concurrent sessions #1474
- Memory leak in WebFlux WebSocket support when client disconnects #1473
- Observations not closed when DataLoader returns null values #1472
- Argument annotations are ignored on handler methods in generic interfaces #1470
- Allow custom Origins when upgrading to WebSocket transport #1465