This is an automated email from the ASF dual-hosted git repository.
Croway pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/camel.git
The following commit(s) were added to refs/heads/main by this push:
new 4024bf3d477d chore(deps): upgrade Apache Avro to 1.12.2
4024bf3d477d is described below
commit 4024bf3d477d1980588b73589552be6814075872
Author: Croway <[email protected]>
AuthorDate: Tue Sep 1 12:39:33 2026 +0200
chore(deps): upgrade Apache Avro to 1.12.2
---
.../camel-avro-rpc-component/pom.xml | 5 +++++
components/camel-avro/pom.xml | 2 ++
.../ROOT/pages/camel-4x-upgrade-guide-4_23.adoc | 26 ++++++++++++++++++++++
parent/pom.xml | 6 ++---
4 files changed, 36 insertions(+), 3 deletions(-)
diff --git a/components/camel-avro-rpc/camel-avro-rpc-component/pom.xml
b/components/camel-avro-rpc/camel-avro-rpc-component/pom.xml
index b95223406385..1d37f9ef3d89 100644
--- a/components/camel-avro-rpc/camel-avro-rpc-component/pom.xml
+++ b/components/camel-avro-rpc/camel-avro-rpc-component/pom.xml
@@ -31,6 +31,11 @@
<name>Camel :: Avro RPC</name>
<description>Camel Avro RPC component</description>
+ <properties>
+ <!-- Avro 1.12.2 requires the IPC and test protocol model packages to
be explicitly trusted. -->
+
<camel.surefire.fork.additional-vmargs>-Dorg.apache.avro.SERIALIZABLE_PACKAGES=org.apache.avro,org.apache.camel.avro</camel.surefire.fork.additional-vmargs>
+ </properties>
+
<dependencies>
<dependency>
<groupId>org.apache.camel</groupId>
diff --git a/components/camel-avro/pom.xml b/components/camel-avro/pom.xml
index a2aa06a360cc..d684367e013c 100644
--- a/components/camel-avro/pom.xml
+++ b/components/camel-avro/pom.xml
@@ -32,6 +32,8 @@
<description>Camel Avro data format</description>
<properties>
+ <!-- Avro 1.12.2 requires application model packages to be explicitly
trusted. -->
+
<camel.surefire.fork.additional-vmargs>-Dorg.apache.avro.SERIALIZABLE_PACKAGES=org.apache.camel.dataformat.avro.example</camel.surefire.fork.additional-vmargs>
</properties>
<dependencies>
diff --git
a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_23.adoc
b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_23.adoc
index d669300f0e83..1c3b57e5338a 100644
--- a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_23.adoc
+++ b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_23.adoc
@@ -13,6 +13,32 @@ See the xref:camel-upgrade-recipes-tool.adoc[documentation]
page for details.
== Upgrading Camel 4.22 to 4.23
+=== Apache Avro trusted packages
+
+Camel now uses Apache Avro 1.12.2. Avro validates classes resolved from schemas
+and no longer trusts application packages by default. If your routes use Avro
+specific records, reflected POJOs, or schemas with Java class names, configure
+the `org.apache.avro.SERIALIZABLE_PACKAGES` JVM system property with the
+comma-separated packages that contain only your trusted Avro model classes.
+
+For example, if generated records are in `com.example.orders.avro`, add the
+following JVM option:
+
+[source]
+----
+-Dorg.apache.avro.SERIALIZABLE_PACKAGES=com.example.orders.avro
+----
+
+If you use `camel-avro-rpc`, also include `org.apache.avro`, which contains the
+Avro IPC handshake classes:
+
+[source]
+----
+-Dorg.apache.avro.SERIALIZABLE_PACKAGES=org.apache.avro,com.example.orders.avro
+----
+
+Do not use `*`, as it disables Avro's class-loading protection.
+
=== camel-exec
`allowControlHeaders` is now annotated `security = "insecure:dev"`.
diff --git a/parent/pom.xml b/parent/pom.xml
index 56b60e492d35..8add446479bd 100644
--- a/parent/pom.xml
+++ b/parent/pom.xml
@@ -86,9 +86,9 @@
<asterisk-java-version>3.42.2</asterisk-java-version>
<atlassian-fugue-version>6.1.5</atlassian-fugue-version>
<atmosphere-version>3.1.0</atmosphere-version>
- <avro-version>1.12.1</avro-version>
- <avro-ipc-jetty-version>1.12.1</avro-ipc-jetty-version>
- <avro-ipc-netty-version>1.12.1</avro-ipc-netty-version>
+ <avro-version>1.12.2</avro-version>
+ <avro-ipc-jetty-version>1.12.2</avro-ipc-jetty-version>
+ <avro-ipc-netty-version>1.12.2</avro-ipc-netty-version>
<awaitility-version>4.3.0</awaitility-version>
<aws-java-sdk2-version>2.54.7</aws-java-sdk2-version>
<azure-sdk-bom-version>1.3.3</azure-sdk-bom-version>
