This is an automated email from the ASF dual-hosted git repository.
oscerd pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/camel-website.git
The following commit(s) were added to refs/heads/main by this push:
new 0b8f9ced fix(trust): correct the advisory count on the Trust page
(#1712)
0b8f9ced is described below
commit 0b8f9cedfdb8190cbffcf45414febf2c937d50f7
Author: Andrea Cosentino <[email protected]>
AuthorDate: Wed Jul 29 14:13:20 2026 +0200
fix(trust): correct the advisory count on the Trust page (#1712)
The Trust page said the 4.14.8, 4.18.3 and 4.21.0 releases "fixed and
disclosed 32 vulnerabilities between them". Read strictly that is 34:
CVE-2026-40047 shipped in 4.18.3, and CVE-2026-40859 in 4.14.8 and
4.18.3, but both had their main-line fix in an earlier minor so neither
is counted in the 4.21.0 batch. 32 is exactly the number of advisories
fixed in 4.21.0, so the sentence did not say what it computed.
Anchor the figure to the single release it describes, and add the fact
that the two LTS lines got the backports within four days (4.21.0 on
1 July, 4.18.3 on 3 July, 4.14.8 on 4 July), which is the stronger claim
and was already true. The "26 of those 32 fixes were carried back to the
4.14.x LTS line" sentence further down is correct as written and is left
alone.
Also drops the em-dash from the sentence being edited.
Signed-off-by: Andrea Cosentino <[email protected]>
Co-authored-by: Claude Opus 5 (1M context) <[email protected]>
---
content/trust/_index.md | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/content/trust/_index.md b/content/trust/_index.md
index 7f7ff308..371b2d46 100644
--- a/content/trust/_index.md
+++ b/content/trust/_index.md
@@ -84,9 +84,9 @@ someone else to find the problem.
## A busy advisory page is a good sign
-The 4.14.8, 4.18.3 and 4.21.0 releases fixed and disclosed
-[**32 vulnerabilities**](/security/) between them, and every one of them got a
full public advisory.
-That is what an active security effort looks like from the outside — not a
framework springing
+Camel 4.21.0 fixed and disclosed [**32 vulnerabilities**](/security/), and
every one of them got a
+full public advisory. The 4.18.3 and 4.14.8 LTS releases shipped the backports
within four days.
+That is what an active security effort looks like from the outside, not a
framework springing
leaks. Researchers across the industry report their findings to the ASF's
private security list, and
we go looking ourselves: when one component turns out to mishandle inbound
message headers, we sweep
the connector portfolio for the same pattern instead of patching only the one
that was reported. That
