davsclaus commented on code in PR #25622:
URL: https://github.com/apache/camel/pull/25622#discussion_r3845289024
##########
components/camel-ldap/pom.xml:
##########
@@ -32,6 +32,9 @@
<description>Camel LDAP support</description>
<properties>
+ <!-- CAMEL-XXXXX: pin to remediate CVE-2026-35563, apacheds-*
(test-scope only)
Review Comment:
Nit: `CAMEL-XXXXX` doesn't need to be a real ticket reference here — the
existing exclusion comments elsewhere in this file don't reference one either.
A plain descriptive comment without the placeholder works fine.
##########
components/camel-ldap/pom.xml:
##########
@@ -77,5 +80,77 @@
<version>${mina-version}</version>
<scope>test</scope>
</dependency>
+ <dependency>
Review Comment:
Rather than re-declaring 12 `org.apache.directory.api` artifacts as explicit
overrides, consider excluding the whole group from the `apacheds-*`
dependencies above and re-adding only the "root" artifacts actually needed —
this repo already does this elsewhere (e.g. `camel-metrics/pom.xml` excludes
`com.fasterxml.jackson.core:*` from `metrics-json`).
Concretely: add an
`<exclusion><groupId>org.apache.directory.api</groupId><artifactId>*</artifactId></exclusion>`
to `apacheds-server-jndi`, `apacheds-server-integ`, and `apacheds-core-integ`
above, then re-add just `api-ldap-client-api`, `api-ldap-extras-util`,
`api-ldap-codec-standalone`, `api-ldap-extras-sp`, `api-dsml-engine`, and
`api-ldap-extras-trigger` (test scope). Their own transitive graphs pull the
full 18-artifact closure back in at `2.1.8` automatically — no manual list to
keep in sync, and it can't silently miss an artifact the way the current list
does (see review summary). I verified this with `dependency:tree
-Dincludes=org.apache.directory.api` before suggesting it — resolves clean with
zero `2.1.5` left.
Note: re-adding only `api-ldap-client-api` alone is *not* enough —
`apacheds-test-framework`/`apacheds-interceptors-hash` need the other roots
independently for their own internal use, not just what Camel's code imports.
##########
components/camel-ldif/pom.xml:
##########
@@ -55,6 +58,68 @@
</exclusion>
</exclusions>
</dependency>
+ <!-- CAMEL-XXXXX: pin org.apache.directory.api transitively brought in
by
+ apacheds-core-api (dormant, no release with the fix) to remediate
CVE-2026-35563 -->
+ <dependency>
Review Comment:
Same suggestion as on `camel-ldap/pom.xml`: exclude
`org.apache.directory.api:*` from `apacheds-core-api` above (compile scope) and
from `apacheds-server-integ`/`apacheds-core-integ` below (test scope), then
re-add just `api-ldap-client-api` + `api-ldap-extras-util` (compile) and
`api-ldap-codec-standalone` + `api-ldap-extras-sp` + `api-dsml-engine` +
`api-ldap-extras-trigger` (test). This reconstitutes the full 18-artifact
closure at `2.1.8` with correct scopes preserved automatically, instead of the
current 12-entry manual list which misses 6 artifacts (still left at `2.1.5` —
see review summary).
I verified this end-to-end locally, including running the real `LdifRouteIT`
suite (6 tests, live OpenLDAP container, exercises the actual `LdifProducer`
production code path) — all green with this restructuring.
##########
components/camel-ldap/pom.xml:
##########
@@ -32,6 +32,9 @@
<description>Camel LDAP support</description>
<properties>
+ <!-- CAMEL-XXXXX: pin to remediate CVE-2026-35563, apacheds-*
(test-scope only)
+ transitively brings in a vulnerable version and ApacheDS is
dormant with no fix release -->
+ <directory-api-version>2.1.8</directory-api-version>
Review Comment:
`apacheds-version` is already centrally managed in `parent/pom.xml:77` and
shared by both `camel-ldap` and `camel-ldif`. Consider adding
`directory-api-version` there too instead of duplicating the same
property+value independently in both component poms — keeps the two from
drifting apart on a future bump.
##########
components/camel-ldif/pom.xml:
##########
@@ -35,6 +35,9 @@
<!-- OpenLDAP container is not available on these platforms -->
<skipITs.ppc64le>true</skipITs.ppc64le>
<skipITs.s390x>true</skipITs.s390x>
+ <!-- CAMEL-XXXXX: pin to remediate CVE-2026-35563, apacheds-core-api
transitively
+ brings in a vulnerable version and ApacheDS is dormant with no
fix release -->
+ <directory-api-version>2.1.8</directory-api-version>
Review Comment:
Same as the `camel-ldap` pom: since this is consumed at compile scope here
(production code via `LdifProducer`), centralizing `directory-api-version` in
`parent/pom.xml` next to `apacheds-version` seems especially worthwhile rather
than duplicating it across both component poms.
##########
components/camel-ldif/pom.xml:
##########
@@ -55,6 +58,68 @@
</exclusion>
</exclusions>
</dependency>
+ <!-- CAMEL-XXXXX: pin org.apache.directory.api transitively brought in
by
Review Comment:
Nit: same as in `camel-ldap/pom.xml` — `CAMEL-XXXXX` isn't needed here, a
plain descriptive comment is enough.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
