This is an automated email from the ASF dual-hosted git repository.
oscerd pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/camel-spring-boot.git
The following commit(s) were added to refs/heads/main by this push:
new 0afd3056dfc chore: mark Camel 4.14.x EOL in the OSS Helper security
rules (#1893)
0afd3056dfc is described below
commit 0afd3056dfc7e4a6f065cd49edce42c713ac35f8
Author: Andrea Cosentino <[email protected]>
AuthorDate: Mon Aug 24 10:22:06 2026 +0200
chore: mark Camel 4.14.x EOL in the OSS Helper security rules (#1893)
Camel 4.14.x has reached end of life, so the supported release lines
that a security fix must be backported to are now 4.18.x and 4.22.x.
apache/camel already recorded the same change in its own
.oss-ai-helper-rules (commit 3ec2d2c8, "4.14 is EOL"); this keeps
camel-spring-boot's copy, which is the one the /oss-draft-cve and
/oss-triage-security-report flows read, in sync.
Co-authored-by: Claude Opus 5 (1M context) <[email protected]>
---
.oss-ai-helper-rules/project-security.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/.oss-ai-helper-rules/project-security.md
b/.oss-ai-helper-rules/project-security.md
index e724c3a5228..4629f071f43 100644
--- a/.oss-ai-helper-rules/project-security.md
+++ b/.oss-ai-helper-rules/project-security.md
@@ -15,7 +15,7 @@ Apache Camel Spring Boot is part of the Apache Camel project
and follows the sam
- **Advisory template (reference):**
https://camel.apache.org/security/CVE-2025-27636.html (rendered) or its source
https://github.com/apache/camel-website/blob/main/content/security/CVE-2025-27636.md.
The advisory format is shared across all Camel sub-projects. Pass either as
the `/oss-draft-cve template=` argument.
- **Publication location:** advisories for all Camel sub-projects are
published centrally — commit to `apache/camel-website` under
`content/security/` (`CVE-YYYY-NNNNN.md` + `CVE-YYYY-NNNNN.txt.asc`); it
renders live at `https://camel.apache.org/security/CVE-YYYY-NNNNN.html`.
- **Signing key:** the Camel release/PMC GPG key published in
https://downloads.apache.org/camel/KEYS. `gpg --clearsign CVE-YYYY-NNNNN.txt`
produces `CVE-YYYY-NNNNN.txt.asc`. The OSS Helper never runs `gpg` — the
maintainer signs after review.
-- **Supported release lines / backport branches:** Camel Spring Boot is
released in lockstep with Camel core and shares its version numbers, so its
supported lines match core — **4.14.x** and **4.18.x** as of May 2026 (4.10.x
and all 3.x releases are EOL). Backport the fix to every supported line in
`apache/camel-spring-boot`, then derive fixed versions with `git tag --contains
<fix-commit> | sort -V`. Confirm the current lines against
https://camel.apache.org/categories/Roadmap/ before [...]
+- **Supported release lines / backport branches:** Camel Spring Boot is
released in lockstep with Camel core and shares its version numbers, so its
supported lines match core — **4.18.x** and **4.22.x** as of August 2026
(4.14.x, 4.10.x and all 3.x releases are EOL). Backport the fix to every
supported line in `apache/camel-spring-boot`, then derive fixed versions with
`git tag --contains <fix-commit> | sort -V`. Confirm the current lines against
https://camel.apache.org/categories/Roadm [...]
- **Disclosure & announcement:** publish only after the fixed releases are
available. Announce to `[email protected]` and `[email protected]`,
notify the reporter, and post to `[email protected]`; the CVE is
pushed to MITRE/NVD through the ASF CNA. The post to `oss-security` is the
first public mention of the issue — never disclose specifics before the fix is
released.
- **Third-party CVE notes ("not affected" rationale):** where
`/oss-analyze-third-party-cve` should record a verified exposure analysis.
(TODO: decide whether to track these in release notes, a dedicated security
page, or a private PMC tracking issue.)
