davsclaus opened a new pull request, #25644: URL: https://github.com/apache/camel/pull/25644
## Backport of #25622 Cherry-pick of #25622 onto `camel-4.22.x` to remediate **CVE-2026-35563**. **Original PR:** #25622 — Pin org.apache.directory.api artifacts to 2.1.8 to remediate CVE-2026-35563 **Original author:** @ivonaest **Target branch:** `camel-4.22.x` ### Summary `apacheds-core-api` transitively pulls `org.apache.directory.api` 2.1.5, affected by CVE-2026-35563. ApacheDS is dormant and will not release a fix, but Apache Directory API 2.1.8 remediates it. This excludes `org.apache.directory.api:*` from the `apacheds-*` dependencies (camel-ldif compile scope, camel-ldap test scope) and re-declares the required artifacts at a new central `directory-api-version=2.1.8` property, avoiding any 2.1.5/2.1.8 version skew. Cherry-picked cleanly. Verified: `camel-ldif` and `camel-ldap` build on this branch and their dependency trees resolve all `org.apache.directory.api` artifacts at 2.1.8 (no 2.1.5 remaining). _Backport prepared by Claude Code on behalf of @davsclaus_ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
