davsclaus opened a new pull request, #25646: URL: https://github.com/apache/camel/pull/25646
## Backport of #25622 Cherry-pick of #25622 onto `camel-4.18.x` to remediate **CVE-2026-35563**. **Original PR:** #25622 — Pin org.apache.directory.api artifacts to 2.1.8 to remediate CVE-2026-35563 **Original author:** @ivonaest **Target branch:** `camel-4.18.x` ### Summary `apacheds-core-api` transitively pulls `org.apache.directory.api` 2.1.5, affected by CVE-2026-35563. ApacheDS is dormant and will not release a fix, but Apache Directory API 2.1.8 remediates it. This excludes `org.apache.directory.api:*` from the `apacheds-*` dependencies (camel-ldif compile scope, camel-ldap test scope) and re-declares the required artifacts at a new central `directory-api-version=2.1.8` property, avoiding any 2.1.5/2.1.8 version skew. ### Backport notes Cherry-picked cleanly (no conflicts). The component-pom changes are byte-identical to the 4.22.x backport (#25644) and to the original on `main`, and `apacheds-version` is `2.0.0.AM27` on all three branches, so the transitive `org.apache.directory.api` module set — and thus the required pin set — is identical. Full-reactor compile verification was performed on the 4.22.x backport (both modules build; dependency tree resolves all `org.apache.directory.api` artifacts at 2.1.8 with no 2.1.5 remaining); CI runs the authoritative build here. _Backport prepared by Claude Code on behalf of @davsclaus_ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
