oscerd commented on PR #25641: URL: https://github.com/apache/camel/pull/25641#issuecomment-5408104267
Thanks for the review — both notes addressed. **1. AssertJ** — applied, replied inline. `camel-as2-api` did not declare `assertj-core`, so the test dependency is added alongside. Pushed in 56eb4a2. **2. Process question** — right thing to flag, and I'd rather not answer half of it here. Whether a given fix warrants a CVE, and any coordinated handling around it, is a PMC decision taken through the ASF private security process (`[email protected]`) — see [`SECURITY.md`](https://github.com/apache/camel/blob/main/SECURITY.md). That is deliberately not something to settle on a public pull request, so I'll leave it off this thread; it is being handled on that side. The **backport** half I can answer, and there is one correction to make: `4.14.x` is **EOL** (since 2026-08-12), so it is no longer a backport target. The supported maintenance lines are `4.18.x` and `4.22.x`. I checked both rather than assuming. `ResponseMDN` carries the identical defect on each — the five signing fields are instance state written from the per-request `HttpCoreContext` in `process()`: * `camel-4.22.x` — fields at L95–99, written at L150–154 * `camel-4.18.x` — fields at L93–97, written at L148–152 So the fix applies cleanly to both, and I'll open backports against `4.18.x` and `4.22.x` once this lands on `main`. _Claude Code on behalf of oscerd_ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
