oscerd opened a new pull request, #25946: URL: https://github.com/apache/camel/pull/25946
Backport to `camel-4.18.x` of five fixes already reviewed and merged on `main`. These are grouped together because each **changes a default or adds a check that was not there before**, so they deserve a closer look than the other backports in this wave before going into a patch release. - CAMEL-24454: camel-mllp - default `logPhi` to false and honour it on the paths that ignored it (#25832, `dd2bf571`) - CAMEL-24443: camel-knative - do not trust every certificate when SSL is enabled without a truststore (#25824, `26c899d8`) - CAMEL-24437: camel-oauth - bind the authorization code callback to the flow with a state parameter (#25821, `495c5ad3`) - CAMEL-24439: camel-shiro - verify the presented credentials on every exchange (#25822, `6f72ae64`) - CAMEL-24441: camel-crypto-pgp - require integrity protection when decrypting (#25848, `9d3108de`) The same set is going to `camel-4.22.x` in #25944. **What changes for an existing deployment:** - camel-mllp stops writing HL7 payload content to the log unless `logPhi=true` is set explicitly. Previously it defaulted to on, and two paths logged regardless of the setting. - camel-knative with SSL enabled but no truststore configured no longer falls back to trusting every certificate. Such a deployment now needs a truststore, or `trustAll` set deliberately. - camel-oauth rejects an authorization-code callback whose `state` does not match the one issued for that session. A deployment behind a proxy that drops or rewrites the callback query string would start seeing 400s. - camel-shiro verifies the presented credentials on every exchange rather than accepting a subject already bound to the thread. `alwaysReauthenticate=false` keeps the old behaviour. - camel-crypto-pgp refuses a decryption whose message has no integrity packet. `requireIntegrityProtection=false` restores the old acceptance. **Deviations from a straight cherry-pick.** This branch has diverged from `main` in `MllpSocketBuffer`, in the test layer, and across the generated model files: - `MllpSocketBuffer` keeps this branch's `synchronized` methods rather than `main`'s `ReentrantLock` form, and its existing `readFrom` structure. The substantive change is carried across: `convertToLoggableString` in the partial-payload warning, plus the new `toLoggableStringAndReset`. - The generated model, catalog, XSD and YAML DSL files for CAMEL-24441 are **regenerated from this branch** rather than taken from `main`. `camel-java-io` and the canonical/model YAML schemas do not exist here, so those files are dropped. `camel-spring.xsd` gains the new attribute by hand, in the exact wording the generator produced for `camel-xml-io.xsd` on this branch. - `OAuthProcessorFailClosedTest` uses JUnit assertions (no assertj test dependency here, and the rest of that file is JUnit), and `ShiroAuthenticationCredentialAlwaysCheckedTest` imports `camel-test-junit5`. Each is folded into its own commit. The upgrade-guide entries are not included: the guides for every line live on `main`. Built and tested per module on this branch, including the new and touched tests: `PGPRequireIntegrityProtectionTest`, `PGPDataFormatTest`, `KnativeSslClientOptionsTrustTest`, `LogPhiTest`, `Hl7UtilTest`, `OAuthProcessorFailClosedTest`, `ShiroAuthenticationCredentialAlwaysCheckedTest`. _Claude Code on behalf of oscerd_ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
