I am pleased to announce that Spring for GraphQL 1.4.6 and 2.0.4 maintenance releases are now available on Maven Central.

These releases fix 3 "High" CVEs, please upgrade at your earliest convenience:

• CVE-2026-41699: Unsafe Deserialization in Spring GraphQL
• CVE-2026-41700: Cross-Site WebSocket Hijacking in Spring for GraphQL
• CVE-2026-41856: Spring GraphQL Annotation Detection Vulnerability

Note that the 1.4.6 release is the last OSS release of the 1.4.x generation, superseded by the 2.0.x line. Commercial support is also available.

How can you help?

If you have general questions, please ask on stackoverflow.com using the spring-graphql tag.

Project Page | GitHub | Issues | Documentation | Stack Overflow